@geekmidas/cli 10.0.0-alpha.60 → 10.0.0-alpha.61

package/dist/index.mjs

@@ -1,32 +1,34 @@
 #!/usr/bin/env -S npx tsx
 import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { $ as loginCommand, B as providerOf, C as run$1, D as constructGlobs, E as backendsOf$1, F as quoteIdentifier, G as withOwningTsconfigJsx, H as describeServices, I as pgClient, J as findAvailablePort, K as createCredentialsPreload, M as forgetState, O as derivedContainers, P as postgresDatabaseNames, Q as prepareEntryCredentials, R as cacheBackendFor, S as keyFingerprint, T as FAKE_ENV, U as fakeKey, W as primaryPortKey, X as loadEnvFiles, Y as isPortAvailable, Z as loadSecretsForApp, a as dockerCommand, at as getDokployToken, et as logoutCommand, g as createStateStore, it as getDokployRegistryId, j as LOCAL_CA_PATH, k as reconcileWorkspace, n as sniffAppEnvironment, nt as whoamiCommand, q as createEntryWrapper, rt as getDokployCredentials, v as DokployApi } from "./sniffer-BM8fpCas.mjs";
+import { $ as quoteIdentifier, At as getDokployCredentials, B as run$1, Ct as loadEnvFiles, Dt as logoutCommand, Et as loginCommand, G as derivedContainers, H as FAKE_ENV, I as withGeneratedSecrets, J as LOCAL_CA_PATH, K as reconcileWorkspace, Mt as getDokployToken, P as createStateStore, Q as postgresStatements, St as isPortAvailable, Tt as prepareEntryCredentials, U as backendsOf$1, V as runOutput, W as constructGlobs, X as applyPostgres, Y as forgetState, Z as postgresDatabaseNames, _t as primaryPortKey, at as localRolePassword, bt as createEntryWrapper, c as dockerCommand, ct as hostFor, d as generateDockerignore, dt as providerOf, et as composeFor, f as generateSlimDockerfile, g as createEmptyState, gt as portKeys, h as resolveHost, ht as fakeKey, it as envFor, jt as getDokployRegistryId, kt as whoamiCommand, l as siteDockerfile, lt as cacheBackendFor, m as isMainFrontendApp, mt as describeServices, n as sniffAppEnvironment, nt as appEnvKeys, ot as planFor, p as validateImageRef, pt as DEFAULT_IMAGES, r as DokployApi, rt as networkEnv, s as appPackageName$1, tt as pgClient, u as detectPackageManager$2, vt as withOwningTsconfigJsx, wt as loadSecretsForApp, xt as findAvailablePort, yt as createCredentialsPreload, z as keyFingerprint } from "./sniffer-bdleks5l.mjs";
 import { i as ConstructGenerator, t as discover } from "./discover-FrYvzkeC.mjs";
 import { d as parseModuleConfig, f as appKey, l as loadWorkspaceConfig, n as NotABackendApp, o as loadAppConfig, r as NotInAnApp, s as loadConfig, t as ConfigNotFound, u as loadWorkspaceSettings } from "./config-C5-EEdmr.mjs";
-import { E as TEST_STAGE, O as deployedProblems, T as InvalidStages, a as getAppBuildOrder, k as stageProblems, o as getAppGkmConfig, t as allConstructGlobs } from "./workspace-Bp1xVaOz.mjs";
-import { a as withCustomSecret, i as toEmbeddableSecrets, n as maskPassword } from "./storage-BzaUxmqe.mjs";
-import { a as getKeyPath, i as FileSecretsStore, n as secretsStoreFor, s as projectKey } from "./store-BS8A7NcA.mjs";
-import { i as telemetryFor, n as EndpointGenerator, r as runtimeFor } from "./OpenApiTsGenerator-CvVr1Ilz.mjs";
+import { D as assertDeployedStage, E as TEST_STAGE, O as deployedProblems, T as InvalidStages, a as getAppBuildOrder, k as stageProblems, o as getAppGkmConfig, t as allConstructGlobs } from "./workspace-Bp1xVaOz.mjs";
+import { a as withCustomSecret, i as toEmbeddableSecrets, n as maskPassword, t as initStageSecrets } from "./storage-BzaUxmqe.mjs";
+import { a as getKeyPath, f as imageRef, i as FileSecretsStore, n as secretsStoreFor, s as projectKey, u as deployIdentity } from "./store-BS8A7NcA.mjs";
+import { i as telemetryFor, n as EndpointGenerator, r as runtimeFor } from "./OpenApiTsGenerator-q5B0z8Xg.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
+import { n as DEFAULT_CACHE, r as DEFAULT_EVENTS } from "./fakes-C9RiT6XG.mjs";
 import { a as describeHolder, i as assignAppPorts, o as holderOf, r as appTag, s as withAppPorts, t as APP_TAG_ENV } from "./appPorts-C9z9Pzn9.mjs";
-import { a as writeTestHarness, c as driversFor, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, o as SubscriberGenerator, s as cacheBackendsIn, t as TEST_READY_ENV } from "./ready-CIHpnUc5.mjs";
+import { a as writeTestHarness, c as driversFor, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, o as SubscriberGenerator, s as cacheBackendsIn, t as TEST_READY_ENV } from "./ready-DQIy21W5.mjs";
 import { n as withCompute, r as withRoutes, t as manifestModule } from "./emit-C1e8qD08.mjs";
-import { t as LocalStateStore } from "./LocalStateStore-BFLiOocU.mjs";
+import { t as LocalStateStore } from "./LocalStateStore-DfUwQsL8.mjs";
 import { createRequire } from "node:module";
-import { basename, dirname, isAbsolute, join, parse, relative, resolve } from "node:path";
+import { basename, dirname, extname, isAbsolute, join, parse, relative, resolve } from "node:path";
 import { Command } from "commander";
 import { existsSync, linkSync, mkdirSync, readFileSync, readdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
-import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { appendFile, chmod, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { promisify } from "node:util";
-import { canonicalId, kebabCase, migrationFolder, provideKey, schemeBase, serviceKey } from "@geekmidas/manifest";
+import { DATABASE_FOLDERS, MIGRATIONS_ROOT, canonicalId, kebabCase, migrationFolder, migrationTargets, provideKey, provisionOrder, publicEnvFor, schemeBase, serviceKey } from "@geekmidas/manifest";
 import fg from "fast-glob";
 import { execFile, execSync, spawn } from "node:child_process";
 import chokidar from "chokidar";
 import { connect } from "node:net";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { pathToFileURL } from "node:url";
-import { parse as parse$1, parseDocument } from "yaml";
+import pg from "pg";
+import { parse as parse$1, parseDocument, stringify } from "yaml";
 import prompts from "prompts";
 import { createServer as createServer$1 } from "node:http";
 import { Readable } from "node:stream";
@@ -39,7 +41,7 @@ import { Function } from "@geekmidas/constructs/functions";
 import { Queue } from "@geekmidas/constructs/queue";
 import { Topic } from "@geekmidas/constructs/topic";
 //#region package.json
-var version = "10.0.0-alpha.60";
+var version = "10.0.0-alpha.61";
 //#endregion
 //#region src/trust/index.ts
 /**
@@ -56,7 +58,7 @@ var version = "10.0.0-alpha.60";
 * worse trade than one that tells you what to type. Caddy's own `caddy trust`
 * draws the line in the same place.
 */
-const logger$7 = console;
+const logger$8 = console;
 const run = promisify(execFile);
 /**
 * How each platform is told about a new authority.
@@ -108,15 +110,15 @@ async function trustCommand(options = {}) {
 	const certificate = join(workspace.root, LOCAL_CA_PATH);
 	if (!existsSync(certificate)) throw new NoLocalAuthority(certificate);
 	const { describe, asks, steps } = installation(process.platform, certificate);
-	logger$7.log(`\n🔐 Trusting the local authority in ${describe}`);
-	logger$7.log(`   ${certificate}\n`);
+	logger$8.log(`\n🔐 Trusting the local authority in ${describe}`);
+	logger$8.log(`   ${certificate}\n`);
 	if (options.dryRun) {
-		for (const [command, args] of steps) logger$7.log(`   ${command} ${args.join(" ")}`);
+		for (const [command, args] of steps) logger$8.log(`   ${command} ${args.join(" ")}`);
 		return;
 	}
-	logger$7.log(`   ${asks}\n`);
+	logger$8.log(`   ${asks}\n`);
 	for (const [command, args] of steps) await run(command, args, { stdio: "inherit" });
-	logger$7.log("\n✅ Local https addresses are trusted. Restart your browser.\n");
+	logger$8.log("\n✅ Local https addresses are trusted. Restart your browser.\n");
 }
 /**
 * Trust the authority if this machine lacks it and its owner agrees.
@@ -133,7 +135,7 @@ async function ensureTrusted(root, url, options = {}) {
 	if (await isTrusted(url)) return;
 	if (!options.assumeYes) {
 		if (!process.stdin.isTTY) {
-			logger$7.log("   Local https addresses are not trusted here. Run \"gkm trust\", or \"gkm setup --yes\".");
+			logger$8.log("   Local https addresses are not trusted here. Run \"gkm trust\", or \"gkm setup --yes\".");
 			return;
 		}
 		if (await declined(root)) return;
@@ -145,7 +147,7 @@ async function ensureTrusted(root, url, options = {}) {
 		});
 		if (!install) {
 			await recordDeclined(root);
-			logger$7.log("   Skipped. Run \"gkm trust\" later.");
+			logger$8.log("   Skipped. Run \"gkm trust\" later.");
 			return;
 		}
 	}
@@ -1310,7 +1312,7 @@ function closeFakes(served) {
 }
 //#endregion
 //#region src/exec/index.ts
-const logger$6 = console;
+const logger$7 = console;
 /** `gkm exec` was given nothing to run. */
 var NoCommandSpecified = class extends Error {
 	constructor() {
@@ -1333,17 +1335,17 @@ async function execCommand(commandArgs, options = {}) {
 	const cwd = options.cwd ?? process.cwd();
 	if (!commandArgs[0]) throw new NoCommandSpecified();
 	const defaultEnv = loadEnvFiles(".env");
-	if (defaultEnv.loaded.length > 0) logger$6.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	if (defaultEnv.loaded.length > 0) logger$7.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
 	const { credentials, secretsJsonPath, appName } = await prepareEntryCredentials({ cwd });
-	if (appName) logger$6.log(`📦 App: ${appName}`);
+	if (appName) logger$7.log(`📦 App: ${appName}`);
 	const secretCount = Object.keys(credentials).filter((k) => k !== "PORT").length;
-	if (secretCount > 0) logger$6.log(`🔐 Loaded ${secretCount} secret(s)`);
+	if (secretCount > 0) logger$7.log(`🔐 Loaded ${secretCount} secret(s)`);
 	const preloadDir = join(cwd, ".gkm");
 	await mkdir(preloadDir, { recursive: true });
 	const preloadPath = join(preloadDir, "credentials-preload.mjs");
 	await createCredentialsPreload(preloadPath, secretsJsonPath);
 	const [cmd, ...args] = commandArgs;
-	logger$6.log(`🚀 Running: ${[cmd, ...args].join(" ")}`);
+	logger$7.log(`🚀 Running: ${[cmd, ...args].join(" ")}`);
 	const nodeOptions = [(process.env.NODE_OPTIONS ?? "").replace(/--import[= ]\S+/g, "").trim(), `--import=${preloadPath}`].filter(Boolean).join(" ");
 	const child = spawn(cmd, args, {
 		cwd,
@@ -1357,7 +1359,7 @@ async function execCommand(commandArgs, options = {}) {
 	const exitCode = await new Promise((resolve) => {
 		child.on("close", (code) => resolve(code ?? 0));
 		child.on("error", (error) => {
-			logger$6.error(`Failed to run command: ${error.message}`);
+			logger$7.error(`Failed to run command: ${error.message}`);
 			resolve(1);
 		});
 	});
@@ -1365,7 +1367,7 @@ async function execCommand(commandArgs, options = {}) {
 }
 //#endregion
 //#region src/dev/index.ts
-const logger$5 = console;
+const logger$6 = console;
 /**
 * Normalize telescope configuration
 * @internal Exported for testing
@@ -1435,13 +1437,13 @@ async function devCommand(options) {
 	if (options.subscribers === false) process.env[SUBSCRIBERS_ENV] = "off";
 	if (options.entry) return entryDevCommand(options);
 	const defaultEnv = loadEnvFiles(".env");
-	if (defaultEnv.loaded.length > 0) logger$5.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	if (defaultEnv.loaded.length > 0) logger$6.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
 	const appConfig = await loadAppConfig().catch((error) => {
 		if (error instanceof NotInAnApp || error instanceof NotABackendApp) return;
 		throw error;
 	});
 	if (!appConfig) {
-		logger$5.log("🔎 Reading gkm.config.ts and the constructs");
+		logger$6.log("🔎 Reading gkm.config.ts and the constructs");
 		const { workspace: everything } = await loadWorkspaceConfig();
 		return workspaceDevCommand(everything, options);
 	}
@@ -1454,12 +1456,12 @@ async function devCommand(options) {
 		holder: holderOf
 	});
 	if (assigned.running.length > 0) throw new WorkspacePortsInUse(assigned.running);
-	for (const { app, from, to, holder } of assigned.moved) logger$5.log(`↪️  ${app}: ${from} is held by ${describeHolder(holder)}, which is not this workspace's — using ${to}`);
+	for (const { app, from, to, holder } of assigned.moved) logger$6.log(`↪️  ${app}: ${from} is held by ${describeHolder(holder)}, which is not this workspace's — using ${to}`);
 	const workspace = withAppPorts(appConfig.workspace, assigned.ports);
 	const workspaceAppPort = assigned.ports[workspaceAppName] ?? appConfig.app.port;
 	process.env[APP_TAG_ENV] = appTag(appConfig.workspaceRoot, workspaceAppName);
 	if (appConfig.app.entry) {
-		logger$5.log(`📄 Using entry point: ${appConfig.app.entry}`);
+		logger$6.log(`📄 Using entry point: ${appConfig.app.entry}`);
 		return entryDevCommand({
 			...options,
 			entry: appConfig.app.entry,
@@ -1469,8 +1471,8 @@ async function devCommand(options) {
 	}
 	if (config.env) {
 		const { loaded, missing } = loadEnvFiles(config.env, appRoot);
-		if (loaded.length > 0) logger$5.log(`📦 Loaded env: ${loaded.join(", ")}`);
-		if (missing.length > 0) logger$5.warn(`⚠️  Missing env files: ${missing.join(", ")}`);
+		if (loaded.length > 0) logger$6.log(`📦 Loaded env: ${loaded.join(", ")}`);
+		if (missing.length > 0) logger$6.warn(`⚠️  Missing env files: ${missing.join(", ")}`);
 	}
 	const telescope = normalizeTelescopeConfig(config.telescope);
 	const hooks = normalizeHooksConfig(config.hooks, appRoot);
@@ -1489,7 +1491,7 @@ async function devCommand(options) {
 		bustCache,
 		serveEmpty: true
 	}));
-	logger$5.log(`🔨 Building ${workspaceAppName ?? "the app"}`);
+	logger$6.log(`🔨 Building ${workspaceAppName ?? "the app"}`);
 	const initial = await build();
 	const runtime = config.runtime ?? "node";
 	let secretsJsonPath;
@@ -1500,11 +1502,11 @@ async function devCommand(options) {
 		const reconciled = await reconcileWorkspace(workspace, {
 			stage: workspace.stages.local,
 			...options.fake ? { fake: true } : {},
-			progress: (message) => logger$5.log(message)
+			progress: (message) => logger$6.log(message)
 		});
 		if (reconciled.services.length > 0) {
-			logger$5.log("🐳 Services");
-			for (const line of describeServices(reconciled.services)) logger$5.log(line);
+			logger$6.log("🐳 Services");
+			for (const line of describeServices(reconciled.services)) logger$6.log(line);
 		}
 		Object.assign(appSecrets, reconciled.env);
 		const own = reconciled.plan.resources.find((r) => (r.kind === "rest-api" || r.kind === "site") && appKey(r.id) === workspaceAppName);
@@ -1571,11 +1573,11 @@ async function devCommand(options) {
 		cwd: appRoot
 	});
 	watcher.on("error", (error) => {
-		logger$5.error("❌ Watcher error:", error);
+		logger$6.error("❌ Watcher error:", error);
 	});
 	let rebuildTimeout = null;
 	watcher.on("change", async (path) => {
-		logger$5.log(`🔄 ${path} changed — rebuilding`);
+		logger$6.log(`🔄 ${path} changed — rebuilding`);
 		if (rebuildTimeout) clearTimeout(rebuildTimeout);
 		rebuildTimeout = setTimeout(async () => {
 			try {
@@ -1584,8 +1586,8 @@ async function devCommand(options) {
 				await devServer.restart();
 			} catch (error) {
 				const err = error;
-				logger$5.error(`❌ Rebuild failed: ${err.message}`);
-				if (err.stack) logger$5.error(err.stack);
+				logger$6.error(`❌ Rebuild failed: ${err.message}`);
+				if (err.stack) logger$6.error(err.stack);
 			}
 		}, 300);
 	});
@@ -1593,13 +1595,13 @@ async function devCommand(options) {
 	const shutdown = () => {
 		if (isShuttingDown) return;
 		isShuttingDown = true;
-		logger$5.log("\n🛑 Shutting down...");
+		logger$6.log("\n🛑 Shutting down...");
 		Promise.all([
 			watcher.close(),
 			devServer.stop(),
 			discovery.leave()
 		]).catch((err) => {
-			logger$5.error("Error during shutdown:", err);
+			logger$6.error("Error during shutdown:", err);
 		}).finally(() => {
 			process.exit(0);
 		});
@@ -1803,13 +1805,13 @@ async function workspaceDevCommand(configured, options) {
 		holder: holderOf
 	});
 	if (assigned.running.length > 0) throw new WorkspacePortsInUse(assigned.running);
-	for (const { app, from, to, holder } of assigned.moved) logger$5.log(`↪️  ${app}: ${from} is held by ${describeHolder(holder)}, which is not this workspace's — using ${to}`);
+	for (const { app, from, to, holder } of assigned.moved) logger$6.log(`↪️  ${app}: ${from} is held by ${describeHolder(holder)}, which is not this workspace's — using ${to}`);
 	const workspace = withAppPorts(configured, assigned.ports);
 	const appCount = Object.keys(workspace.apps).length;
 	const frontendApps = Object.entries(workspace.apps).filter(([_, app]) => app.type === "web");
 	const conflicts = checkPortConflicts(workspace);
 	if (conflicts.length > 0) {
-		for (const conflict of conflicts) logger$5.error(`❌ Port conflict: Apps "${conflict.app1}" and "${conflict.app2}" both use port ${conflict.port}`);
+		for (const conflict of conflicts) logger$6.error(`❌ Port conflict: Apps "${conflict.app1}" and "${conflict.app2}" both use port ${conflict.port}`);
 		throw new Error("Port conflicts detected. Please assign unique ports to each app.");
 	}
 	if (frontendApps.length > 0) {
@@ -1818,10 +1820,10 @@ async function workspaceDevCommand(configured, options) {
 		for (const result of validationResults) {
 			if (!result.valid) {
 				hasErrors = true;
-				logger$5.error(`\n❌ Frontend app "${result.appName}" validation failed:`);
-				for (const error of result.errors) logger$5.error(`   • ${error}`);
+				logger$6.error(`\n❌ Frontend app "${result.appName}" validation failed:`);
+				for (const error of result.errors) logger$6.error(`   • ${error}`);
 			}
-			for (const warning of result.warnings) logger$5.warn(`   ⚠️  ${result.appName}: ${warning}`);
+			for (const warning of result.warnings) logger$6.warn(`   ⚠️  ${result.appName}: ${warning}`);
 		}
 		if (hasErrors) throw new Error("Frontend app validation failed. Fix the issues above and try again.");
 	}
@@ -1829,24 +1831,24 @@ async function workspaceDevCommand(configured, options) {
 	const reconciled = await reconcileWorkspace(workspace, {
 		stage: workspace.stages.local,
 		...options.fake ? { fake: true } : {},
-		progress: (message) => logger$5.log(message)
+		progress: (message) => logger$6.log(message)
 	});
 	if (reconciled.services.length > 0) {
-		logger$5.log("🐳 Services");
-		for (const line of describeServices(reconciled.services)) logger$5.log(line);
+		logger$6.log("🐳 Services");
+		for (const line of describeServices(reconciled.services)) logger$6.log(line);
 	}
 	const secretsEnv = {
 		...rawSecrets,
 		...reconciled.env
 	};
 	const fakes = options.fake ? await serveFakes(reconciled.fakes, reconciled.ports) : [];
-	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
-	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
+	for (const { id, port } of fakes) logger$6.log(`🎭 ${id} fake: http://localhost:${port}`);
+	logger$6.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await import("./migrate-B_6KofUo.mjs");
+		const { prepareDevDatabases } = await import("./migrate-5_J5JySj.mjs");
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await import("./migrate-B_6KofUo.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
-		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
+	} else await import("./migrate-5_J5JySj.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+		logger$6.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
 	for (const resource of reconciled.plan.resources) {
@@ -1867,11 +1869,11 @@ async function workspaceDevCommand(configured, options) {
 	else {
 		const { filters, unpackaged } = turboFilters(workspace);
 		turboFilter = filters.flatMap((name) => ["--filter", name]);
-		if (unpackaged.length > 0) logger$5.warn(`⚠️  No package.json with a name for: ${unpackaged.join(", ")} — turbo cannot run ${unpackaged.length === 1 ? "it" : "them"}.`);
+		if (unpackaged.length > 0) logger$6.warn(`⚠️  No package.json with a name for: ${unpackaged.join(", ")} — turbo cannot run ${unpackaged.length === 1 ? "it" : "them"}.`);
 	}
 	const buildOrder = getAppBuildOrder(workspace);
 	const width = Math.max(...buildOrder.map((name) => name.length));
-	logger$5.log(`\n${workspace.name}: ${appCount} app(s)`);
+	logger$6.log(`\n${workspace.name}: ${appCount} app(s)`);
 	for (const appName of buildOrder) {
 		const app = workspace.apps[appName];
 		if (!app) continue;
@@ -1879,14 +1881,14 @@ async function workspaceDevCommand(configured, options) {
 			const own = reconciled.plan.resources.find((r) => r.kind === "mobile-app" && appKey(r.id) === appName);
 			const scheme = own ? reconciled.env[own.envKey] : void 0;
 			const device = Object.entries(reconciled.env).find(([key]) => key.endsWith("_DEVICE_URL"))?.[1];
-			logger$5.log(`   ${appName.padEnd(width)}  ${scheme ? `${scheme}://` : "mobile"}${device ? ` — devices reach ${new URL(device).hostname}` : ""}`);
+			logger$6.log(`   ${appName.padEnd(width)}  ${scheme ? `${scheme}://` : "mobile"}${device ? ` — devices reach ${new URL(device).hostname}` : ""}`);
 			continue;
 		}
 		const local = `http://localhost:${app.port}`;
 		const url = Object.entries(appUrls).find(([id]) => appKey(id) === appName)?.[1];
-		logger$5.log(`   ${appName.padEnd(width)}  ${url ? `${url} -> ${local}` : local}`);
+		logger$6.log(`   ${appName.padEnd(width)}  ${url ? `${url} -> ${local}` : local}`);
 	}
-	logger$5.log("");
+	logger$6.log("");
 	const configFiles = [
 		"gkm.config.ts",
 		"gkm.config.js",
@@ -1934,7 +1936,7 @@ async function workspaceDevCommand(configured, options) {
 		...options.fake ? { [FAKE_ENV]: "1" } : {},
 		[DISCOVERY_QUIET_ENV]: "1"
 	};
-	logger$5.log(`🚀 Starting ${appCount} app(s) — each builds before it answers, and says so when it is ready`);
+	logger$6.log(`🚀 Starting ${appCount} app(s) — each builds before it answers, and says so when it is ready`);
 	const turboProcess = spawn("pnpm", [
 		"turbo",
 		"run",
@@ -1950,7 +1952,7 @@ async function workspaceDevCommand(configured, options) {
 	const shutdown = () => {
 		if (isShuttingDown) return;
 		isShuttingDown = true;
-		logger$5.log("\n🛑 Shutting down workspace...");
+		logger$6.log("\n🛑 Shutting down workspace...");
 		closeFakes(fakes);
 		discovery.leave();
 		const pid = turboProcess.pid;
@@ -1976,7 +1978,7 @@ async function workspaceDevCommand(configured, options) {
 	process.on("SIGTERM", shutdown);
 	return new Promise((resolve, reject) => {
 		turboProcess.on("error", (error) => {
-			logger$5.error("❌ Turbo error:", error);
+			logger$6.error("❌ Turbo error:", error);
 			reject(error);
 		});
 		turboProcess.on("exit", (code) => {
@@ -1995,11 +1997,11 @@ async function entryDevCommand(options) {
 	const entryPath = resolve(process.cwd(), entry);
 	if (!existsSync(entryPath)) throw new Error(`Entry file not found: ${entryPath}`);
 	const defaultEnv = loadEnvFiles(".env");
-	if (defaultEnv.loaded.length > 0) logger$5.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	if (defaultEnv.loaded.length > 0) logger$6.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
 	const { credentials, resolvedPort, secretsJsonPath, appName } = await prepareEntryCredentials({ explicitPort: options.portExplicit ? options.port : void 0 });
-	if (appName) logger$5.log(`📦 App: ${appName} (port ${resolvedPort})`);
-	logger$5.log(`🚀 Starting entry file: ${entry} on port ${resolvedPort}`);
-	if (Object.keys(credentials).length > 1) logger$5.log(`🔐 Loaded ${Object.keys(credentials).length - 1} secret(s) + PORT`);
+	if (appName) logger$6.log(`📦 App: ${appName} (port ${resolvedPort})`);
+	logger$6.log(`🚀 Starting entry file: ${entry} on port ${resolvedPort}`);
+	if (Object.keys(credentials).length > 1) logger$6.log(`🔐 Loaded ${Object.keys(credentials).length - 1} secret(s) + PORT`);
 	const wrapperDir = join(process.cwd(), ".gkm");
 	await mkdir(wrapperDir, { recursive: true });
 	const wrapperPath = join(wrapperDir, "entry-wrapper.ts");
@@ -2010,7 +2012,7 @@ async function entryDevCommand(options) {
 	const shutdown = () => {
 		if (isShuttingDown) return;
 		isShuttingDown = true;
-		logger$5.log("\n🛑 Shutting down...");
+		logger$6.log("\n🛑 Shutting down...");
 		runner.stop();
 		process.exit(0);
 	};
@@ -2046,14 +2048,14 @@ var EntryRunner = class {
 			});
 			let restartTimeout = null;
 			this.watcher.on("change", (path) => {
-				logger$5.log(`📝 File changed: ${path}`);
+				logger$6.log(`📝 File changed: ${path}`);
 				if (restartTimeout) clearTimeout(restartTimeout);
 				restartTimeout = setTimeout(async () => {
-					logger$5.log("🔄 Restarting...");
+					logger$6.log("🔄 Restarting...");
 					await this.restart();
 				}, 300);
 			});
-			logger$5.log(`👀 Watching for changes in: ${watchDir}`);
+			logger$6.log(`👀 Watching for changes in: ${watchDir}`);
 		}
 	}
 	async runProcess() {
@@ -2069,17 +2071,17 @@ var EntryRunner = class {
 		});
 		this.isRunning = true;
 		this.childProcess.on("error", (error) => {
-			logger$5.error("❌ Process error:", error);
+			logger$6.error("❌ Process error:", error);
 		});
 		this.childProcess.on("exit", (code) => {
-			if (code !== null && code !== 0 && code !== 143) logger$5.error(`❌ Process exited with code ${code}`);
+			if (code !== null && code !== 0 && code !== 143) logger$6.error(`❌ Process exited with code ${code}`);
 			this.isRunning = false;
 		});
 		await new Promise((resolve) => setTimeout(resolve, 500));
 		if (this.isRunning) {
-			logger$5.log("");
-			logger$5.log(`  \x1b[32m✓ Ready\x1b[0m at \x1b[36mhttp://localhost:${this.port}\x1b[0m`);
-			logger$5.log("");
+			logger$6.log("");
+			logger$6.log(`  \x1b[32m✓ Ready\x1b[0m at \x1b[36mhttp://localhost:${this.port}\x1b[0m`);
+			logger$6.log("");
 		}
 	}
 	async restart() {
@@ -2198,7 +2200,7 @@ start({
 * lets a console read what this machine is running.
 */
 function announce(discovery) {
-	logger$5.log(`🧭 Discovery: ${discovery.connectUrl}`);
+	logger$6.log(`🧭 Discovery: ${discovery.connectUrl}`);
 }
 /** Run `fn` with `console.log` muted — warnings and errors still print. */
 async function quietly(fn) {
@@ -2316,7 +2318,7 @@ var DevServer = class {
 			this.actualPort = this.requestedPort;
 		} else {
 			this.actualPort = await findAvailablePort(this.requestedPort);
-			if (this.actualPort !== this.requestedPort) logger$5.log(`ℹ️  Port ${this.requestedPort} was in use, using port ${this.actualPort} instead`);
+			if (this.actualPort !== this.requestedPort) logger$6.log(`ℹ️  Port ${this.requestedPort} was in use, using port ${this.actualPort} instead`);
 		}
 		const serverEntryPath = join(this.appRoot, ".gkm", "server", "server.ts");
 		await this.createServerEntry();
@@ -2336,11 +2338,11 @@ var DevServer = class {
 		});
 		this.isRunning = true;
 		this.serverProcess.on("error", (error) => {
-			logger$5.error("❌ Server error:", error);
+			logger$6.error("❌ Server error:", error);
 		});
 		const child = this.serverProcess;
 		child.on("exit", (code, signal) => {
-			if (code !== null && code !== 0 && signal !== "SIGTERM") logger$5.error(`❌ Server exited with code ${code}`);
+			if (code !== null && code !== 0 && signal !== "SIGTERM") logger$6.error(`❌ Server exited with code ${code}`);
 			this.isRunning = false;
 			if (this.serverProcess === child) this.onStatus?.("stopped");
 		});
@@ -2349,13 +2351,13 @@ var DevServer = class {
 			const local = `http://localhost:${this.actualPort}`;
 			const address = this.publicUrl ? `${this.publicUrl} -> ${local}` : local;
 			const seconds = ((Date.now() - this.startTime) / 1e3).toFixed(1);
-			logger$5.log(`\x1b[32m✓\x1b[0m ${this.label} ready in ${seconds}s  ${address}`);
+			logger$6.log(`\x1b[32m✓\x1b[0m ${this.label} ready in ${seconds}s  ${address}`);
 			const tools = this.selfServing ? [] : [
 				...this.enableOpenApi ? ["docs /__docs"] : [],
 				...this.telescope ? [`telescope ${this.telescope.path}`] : [],
 				...this.databaseApi ? [`db ${this.databaseApi}`] : []
 			];
-			if (tools.length > 0) logger$5.log(`  ${tools.join(" · ")}`);
+			if (tools.length > 0) logger$6.log(`  ${tools.join(" · ")}`);
 			this.onStatus?.("ready");
 		}
 	}
@@ -2995,9 +2997,63 @@ export const { app } = await surface.server({ envParser, context: snifferContext
 export default app;
 `);
 }
+/**
+* The production server for a surface that serves itself.
+*
+* `app.ts` exports the construct's own Hono app and starts nothing, which is
+* what `gkm dev` wants: its server mounts the app beside its tools. An image
+* needs a process, so a production build starts one here — the health check
+* every image is probed on, the surface behind it, and the same bounded drain
+* on SIGTERM the generated route servers have. Without it an auth server had
+* no bundle to put in an image at all.
+*/
+async function writeSurfaceServer(outputDir, options) {
+	await mkdir(outputDir, { recursive: true });
+	const shutdown = options.gracefulShutdown ? `
+// Stop taking requests, let in-flight ones finish, then close what the
+// construct opened — bounded by GKM_SHUTDOWN_TIMEOUT_MS, under Docker's 10s
+// stop timeout, so the process exits on its own terms.
+let shuttingDown = false;
+const shutdown = async () => {
+  if (shuttingDown) return;
+  shuttingDown = true;
+  const deadline = Number(process.env.GKM_SHUTDOWN_TIMEOUT_MS) || 8000;
+  setTimeout(() => process.exit(1), deadline).unref();
+  await new Promise<void>((resolve) => server.close(() => resolve()));
+  await runShutdownHooks((error) => console.error(error));
+  process.exit(0);
+};
+
+process.on('SIGTERM', shutdown);
+process.on('SIGINT', shutdown);
+` : "";
+	const path = join(outputDir, "server.ts");
+	await writeFile(path, `#!/usr/bin/env node
+/**
+ * Production server for a surface that serves itself.
+ * Generated by 'gkm build --production'.
+ */
+import { serve } from '@hono/node-server';
+import { Hono } from 'hono';
+${options.gracefulShutdown ? "import { runShutdownHooks } from '@geekmidas/constructs';\n" : ""}import { app as surface } from './app.js';
+
+const port = Number(process.env.PORT) || 3000;
+
+const app = new Hono();
+// First, so a probe is answered without reaching the surface's own routes.
+app.get(${JSON.stringify(options.healthCheck)}, (c) =>
+  c.json({ status: 'ok', timestamp: Date.now() }),
+);
+app.route('/', surface);
+
+const server = serve({ fetch: app.fetch, port });
+console.log(JSON.stringify({ msg: 'Production server started', port }));
+${shutdown}`);
+	return path;
+}
 //#endregion
 //#region src/build/index.ts
-const logger$4 = console;
+const logger$5 = console;
 /**
 * Where `gkm build --stage` leaves the key its bundle's secrets were encrypted
 * with, beside the bundle in `.gkm/server/` and readable by its owner alone.
@@ -3045,7 +3101,7 @@ async function buildCommand(options) {
 		const isAtWorkspaceRoot = cwd === workspaceRoot;
 		const someAppIsElsewhere = Object.values(loadedConfig.workspace.apps).some((app) => resolve(workspaceRoot, app.path) !== workspaceRoot);
 		if (isAtWorkspaceRoot && someAppIsElsewhere) {
-			logger$4.log("📦 Detected workspace configuration");
+			logger$5.log("📦 Detected workspace configuration");
 			return workspaceBuildCommand(loadedConfig.workspace, options);
 		}
 	}
@@ -3091,13 +3147,13 @@ async function buildOneApp(input) {
 	const { config, options, workspace, appRoot, target } = input;
 	const cacheBackend = cacheBackendFor(providerOf(workspace));
 	const production = normalizeProductionConfig(options.production ?? false);
-	if (production) logger$4.log(`🏭 Building for PRODUCTION`);
-	logger$4.log(`Building for ${target}`);
-	logger$4.log(`Loading constructs from: ${formatRoutes(config.constructs)}`);
+	if (production) logger$5.log(`🏭 Building for PRODUCTION`);
+	logger$5.log(`Building for ${target}`);
+	logger$5.log(`Loading constructs from: ${formatRoutes(config.constructs)}`);
 	const telescope = production ? void 0 : normalizeTelescopeConfig(config.telescope);
-	if (telescope) logger$4.log(`🔭 Telescope enabled at ${telescope.path}`);
+	if (telescope) logger$5.log(`🔭 Telescope enabled at ${telescope.path}`);
 	const hooks = normalizeHooksConfig(config.hooks, appRoot);
-	if (hooks) logger$4.log(`🪝 Server hooks enabled`);
+	if (hooks) logger$5.log(`🪝 Server hooks enabled`);
 	return buildApp({
 		config,
 		workspaceRoot: workspace.root,
@@ -3139,7 +3195,7 @@ async function writeManifest(input) {
 	});
 	const path = join(manifestDir, `${target}.ts`);
 	await writeFile(path, manifestModule(folded, backends));
-	logger$4.log(`Manifest: ${relative(process.cwd(), path)}`);
+	logger$5.log(`Manifest: ${relative(process.cwd(), path)}`);
 }
 /**
 * Turn one app's constructs into its generated entry.
@@ -3167,7 +3223,21 @@ async function buildApp(input) {
 	});
 	if (selfServing) {
 		await writeSurfaceEntry(join(appRoot, ".gkm", "server"), selfServing.source);
-		logger$4.log(`Generated a server for ${selfServing.id} from its own declaration`);
+		logger$5.log(`Generated a server for ${selfServing.id} from its own declaration`);
+		if (production?.bundle && !input.skipBundle) {
+			const outputDir = join(appRoot, ".gkm", "server");
+			const entryPoint = await writeSurfaceServer(outputDir, production);
+			const { bundleServer } = await import("./bundler-B5VsKW-_.mjs");
+			await bundleServer({
+				entryPoint,
+				outputDir: join(outputDir, "dist"),
+				minify: production.minify,
+				sourcemap: false,
+				external: production.external,
+				...input.stage ? { stage: input.stage } : {}
+			});
+			logger$5.log(`✅ Bundle complete: .gkm/server/dist/server.mjs`);
+		}
 		return { selfServing: selfServing.id };
 	}
 	const derived = ownersContext({
@@ -3212,14 +3282,14 @@ async function buildApp(input) {
 		topicGenerator.load(code, appRoot, bustCache)
 	]);
 	const allEndpoints = servedBy(loadedEndpoints, derived.surface);
-	logger$4.log(`Found ${allEndpoints.length} endpoints`);
-	logger$4.log(`Found ${allFunctions.length} functions`);
-	logger$4.log(`Found ${allCrons.length} crons`);
-	logger$4.log(`Found ${allSubscribers.length} subscribers`);
-	logger$4.log(`Found ${allQueues.length} queues`);
-	logger$4.log(`Found ${allTopics.length} topics`);
+	logger$5.log(`Found ${allEndpoints.length} endpoints`);
+	logger$5.log(`Found ${allFunctions.length} functions`);
+	logger$5.log(`Found ${allCrons.length} crons`);
+	logger$5.log(`Found ${allSubscribers.length} subscribers`);
+	logger$5.log(`Found ${allQueues.length} queues`);
+	logger$5.log(`Found ${allTopics.length} topics`);
 	if (!input.serveEmpty && allEndpoints.length === 0 && allFunctions.length === 0 && allCrons.length === 0 && allSubscribers.length === 0 && allQueues.length === 0 && allTopics.length === 0) {
-		logger$4.log("No endpoints, functions, crons, subscribers, queues, or topics found to process");
+		logger$5.log("No endpoints, functions, crons, subscribers, queues, or topics found to process");
 		return {};
 	}
 	if (production?.subscribers === "include" && derived.surface) {
@@ -3232,7 +3302,7 @@ async function buildApp(input) {
 			[allQueues.length, "queue consumer"],
 			[allSubscribers.length, "subscriber"]
 		].filter(([n]) => n > 0).map(([n, what]) => `${n} ${what}${n === 1 ? "" : "s"}`);
-		if (left.length > 0) logger$4.log(`Serving ${derived.surface.id} only: leaving out ${left.join(", ")} — they run in a Worker's image`);
+		if (left.length > 0) logger$5.log(`Serving ${derived.surface.id} only: leaving out ${left.join(", ")} — they run in a Worker's image`);
 	}
 	const result = await buildForTarget(target, buildContext, appRoot, workspaceRoot, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, queueGenerator, topicGenerator, allEndpoints, allFunctions, allCrons, allSubscribers, allQueues, allTopics, enableOpenApi, input.skipBundle ?? false, input.stage);
 	await generateOpenApi(allEndpoints.map(({ construct }) => construct), {
@@ -3255,7 +3325,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		force: true
 	});
 	await mkdir(outputDir, { recursive: true });
-	logger$4.log(`\nGenerating handlers for ${target}`);
+	logger$5.log(`\nGenerating handlers for ${target}`);
 	const options = {
 		target,
 		root: workspaceRoot
@@ -3271,7 +3341,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		queueGenerator.build(context, queues, outputDir, options),
 		topicGenerator.build(context, topics, outputDir, options)
 	]);
-	logger$4.log(`Generated ${routes.length} routes, ${functionInfos.length} functions, ${cronInfos.length} crons, ${subscriberInfos.length} subscribers, ${queueInfos.length} queues, ${topicInfos.length} topics for ${target}`);
+	logger$5.log(`Generated ${routes.length} routes, ${functionInfos.length} functions, ${cronInfos.length} crons, ${subscriberInfos.length} subscribers, ${queueInfos.length} queues, ${topicInfos.length} topics for ${target}`);
 	const fields = {
 		...context.surface ? { surface: context.surface.id } : {},
 		functions: functionInfos,
@@ -3294,8 +3364,8 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		};
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
-			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await import("./bundler-DJVR4QlW.mjs");
+			logger$5.log(`\n📦 Bundling production server...`);
+			const { bundleServer } = await import("./bundler-B5VsKW-_.mjs");
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -3312,13 +3382,13 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 				stage,
 				constructs: allConstructs
 			})).masterKey;
-			logger$4.log(`✅ Bundle complete: .gkm/server/dist/server.mjs`);
+			logger$5.log(`✅ Bundle complete: .gkm/server/dist/server.mjs`);
 			if (masterKey) {
 				const keyPath = join(outputDir, MASTER_KEY_FILE);
 				await writeFile(keyPath, `${masterKey}\n`, { mode: 384 });
 				await chmod(keyPath, 384);
-				logger$4.log(`\n🔐 Secrets encrypted for deployment`);
-				logger$4.log(`   Run with GKM_MASTER_KEY set to the key in ${relative(appRoot, keyPath)} (fingerprint ${keyFingerprint(masterKey)})`);
+				logger$5.log(`\n🔐 Secrets encrypted for deployment`);
+				logger$5.log(`   Run with GKM_MASTER_KEY set to the key in ${relative(appRoot, keyPath)} (fingerprint ${keyFingerprint(masterKey)})`);
 			}
 		}
 		return {
@@ -3419,12 +3489,12 @@ async function workspaceBuildCommand(workspace, options) {
 	const apps = Object.entries(workspace.apps);
 	const backendApps = apps.filter(([, app]) => app.type === "backend");
 	const frontendApps = apps.filter(([, app]) => app.type === "web");
-	logger$4.log(`\n🏗️  Building workspace: ${workspace.name}`);
-	logger$4.log(`   Backend apps: ${backendApps.map(([name]) => name).join(", ") || "none"}`);
-	logger$4.log(`   Frontend apps: ${frontendApps.map(([name]) => name).join(", ") || "none"}`);
-	if (options.production) logger$4.log(`   🏭 Production mode enabled`);
+	logger$5.log(`\n🏗️  Building workspace: ${workspace.name}`);
+	logger$5.log(`   Backend apps: ${backendApps.map(([name]) => name).join(", ") || "none"}`);
+	logger$5.log(`   Frontend apps: ${frontendApps.map(([name]) => name).join(", ") || "none"}`);
+	if (options.production) logger$5.log(`   🏭 Production mode enabled`);
 	const buildOrder = getAppBuildOrder(workspace);
-	logger$4.log(`   Build order: ${buildOrder.join(" → ")}`);
+	logger$5.log(`   Build order: ${buildOrder.join(" → ")}`);
 	try {
 		const target = options.provider ?? providerOf(workspace);
 		const builds = [];
@@ -3432,7 +3502,7 @@ async function workspaceBuildCommand(workspace, options) {
 			const app = workspace.apps[appName];
 			const config = getAppGkmConfig(workspace, appName);
 			if (!app || app.type !== "backend" || !config) continue;
-			logger$4.log(`\n⚙️  ${appName}`);
+			logger$5.log(`\n⚙️  ${appName}`);
 			const output = await buildOneApp({
 				config,
 				options,
@@ -3457,8 +3527,8 @@ async function workspaceBuildCommand(workspace, options) {
 		const pm = detectPackageManager$1();
 		const [turboBin, turboArgs] = getTurboArgs(pm, filters, { only: true });
 		if (filters.length > 0) {
-			logger$4.log(`\n📦 Using ${pm} with Turbo for the other apps...\n`);
-			logger$4.log(`Running: ${[turboBin, ...turboArgs].join(" ")}`);
+			logger$5.log(`\n📦 Using ${pm} with Turbo for the other apps...\n`);
+			logger$5.log(`Running: ${[turboBin, ...turboArgs].join(" ")}`);
 			await run$1(turboBin, turboArgs, {
 				cwd: workspace.root,
 				env: {
@@ -3476,15 +3546,15 @@ async function workspaceBuildCommand(workspace, options) {
 				outputPath
 			});
 		}
-		logger$4.log(`\n✅ Workspace build complete!`);
-		logger$4.log(`\n📋 Build Summary:`);
+		logger$5.log(`\n✅ Workspace build complete!`);
+		logger$5.log(`\n📋 Build Summary:`);
 		for (const result of results) {
 			const icon = result.type === "backend" ? "⚙️" : result.type === "mobile" ? "📱" : "🌐";
-			logger$4.log(`   ${icon} ${result.appName}: ${result.outputPath || "built"}`);
+			logger$5.log(`   ${icon} ${result.appName}: ${result.outputPath || "built"}`);
 		}
 	} catch (error) {
 		const errorMessage = error instanceof Error ? error.message : "Build failed";
-		logger$4.log(`\n❌ Build failed: ${errorMessage}`);
+		logger$5.log(`\n❌ Build failed: ${errorMessage}`);
 		for (const [appName, app] of apps) results.push({
 			appName,
 			type: app.type,
@@ -3513,6 +3583,1491 @@ function getAppOutputPath(workspace, _appName, app) {
 function formatRoutes(routes) {
 	return Array.isArray(routes) ? routes.join(", ") : routes;
 }
+//#endregion
+//#region src/migrate/provider.ts
+/**
+* One construct's migrations and seeds, read from its folders.
+*
+* Two kinds of file, told apart by extension rather than by configuration: a
+* script exports `up` (and may export `down`) — or `seed(db, { stage })`, in
+* `seeds/` — and a
+* `.sql` file is run whole. The second is what makes a folder independent of
+* the client the app uses — Better Auth's schema is SQL whatever the
+* application queries with.
+*/
+const SCRIPTS = /* @__PURE__ */ new Set([
+	".ts",
+	".mts",
+	".js",
+	".mjs"
+]);
+/** Two files in one folder that would be one migration. */
+var DuplicateMigration = class extends Error {
+	folder;
+	migration;
+	constructor(folder, migration) {
+		super(`${folder} has two migrations named '${migration}' — a script and a .sql file with the same name. A migration is recorded by name, so only one of them could ever run; rename or remove the other.`);
+		this.folder = folder;
+		this.migration = migration;
+		this.name = "DuplicateMigration";
+	}
+};
+/** A script in a migrations folder that exports no `up`. */
+var MigrationHasNoUp = class extends Error {
+	file;
+	constructor(file) {
+		super(`${file} is in a migrations folder but exports no \`up\` function. Export \`async function up(db: Kysely<unknown>)\`, or move the file out of the folder if it is not a migration.`);
+		this.file = file;
+		this.name = "MigrationHasNoUp";
+	}
+};
+/** A script in a seeds folder that exports no `seed`. */
+var SeedHasNoSeed = class extends Error {
+	file;
+	constructor(file) {
+		super(`${file} is in a seeds folder but exports no \`seed\` function. Export \`async function seed(db, { stage })\`, or move the file out of the folder if it is not a seed.`);
+		this.file = file;
+		this.name = "SeedHasNoSeed";
+	}
+};
+/**
+* The migration files in a folder, by name, without reading them.
+*
+* Also what `gkm dev` compares against a construct's history to report what
+* is pending, which is why it is separate from loading them.
+*/
+async function migrationFiles(folder) {
+	const entries = await readdir(folder, { withFileTypes: true }).catch((error) => {
+		if (error.code === "ENOENT") return [];
+		throw error;
+	});
+	const files = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		if (!entry.isFile() || !isMigration(entry.name)) continue;
+		const name = entry.name.slice(0, -extname(entry.name).length);
+		if (files.has(name)) throw new DuplicateMigration(folder, name);
+		files.set(name, join(folder, entry.name));
+	}
+	return files;
+}
+/** A Kysely provider over one construct's folder. */
+function folderProvider(folder, raw) {
+	return { async getMigrations() {
+		const migrations = {};
+		for (const [name, file] of await migrationFiles(folder)) migrations[name] = extname(file) === ".sql" ? await sqlMigration(file, raw) : await scriptMigration(file);
+		return migrations;
+	} };
+}
+/**
+* The seeds in a folder, loaded, in name order.
+*
+* Every one runs on every pass — there is no history to consult — so the order
+* is the only thing between two seeds where one reads what another writes.
+* Name them to sort that way.
+*/
+async function loadSeeds(folder, raw) {
+	const files = [...await migrationFiles(folder)].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+	const seeds = [];
+	for (const [name, file] of files) seeds.push({
+		name,
+		run: extname(file) === ".sql" ? (await sqlMigration(file, raw)).up : await scriptSeed(file)
+	});
+	return seeds;
+}
+/**
+* A seed script, imported as it is on disk now.
+*
+* Keyed by its modification time: a seed is run again after it is edited, and
+* a process that has imported it once would otherwise run the old one.
+*/
+async function scriptSeed(file) {
+	const url = pathToFileURL(file);
+	url.searchParams.set("mtime", String((await stat(file)).mtimeMs));
+	const module = await import(url.href);
+	if (typeof module.seed !== "function") throw new SeedHasNoSeed(file);
+	return module.seed;
+}
+function isMigration(file) {
+	if (file.endsWith(".d.ts")) return false;
+	if (/\.(spec|test)\.[cm]?[jt]s$/.test(file)) return false;
+	const extension = extname(file);
+	return extension === ".sql" || SCRIPTS.has(extension);
+}
+async function scriptMigration(file) {
+	const module = await import(pathToFileURL(file).href);
+	if (typeof module.up !== "function") throw new MigrationHasNoUp(file);
+	return {
+		up: module.up,
+		...typeof module.down === "function" ? { down: module.down } : {}
+	};
+}
+/**
+* A `.sql` file, run whole.
+*
+* One query rather than split on `;`: with no parameters, Postgres takes
+* several statements in one message, and splitting by hand breaks on the first
+* `;` inside a string or a function body. There is no `down` — a generated
+* schema is rolled back by a migration that says how, not by guessing.
+*/
+async function sqlMigration(file, raw) {
+	const statements = await readFile(file, "utf-8");
+	return { up: async (db) => {
+		await raw.raw(statements).execute(db);
+	} };
+}
+//#endregion
+//#region src/migrate/databases.ts
+/**
+* Bring each construct's schema up to its migrations folder.
+*
+* Which constructs, in what order, from which folder, is `migrationTargets`'
+* answer and nobody else's. What is decided here is only how one target is
+* run: as its owner, in its own schema, with a history of its own.
+*/
+/** A folder under `db/` that names no construct. */
+var UnknownMigrationFolder = class extends Error {
+	folder;
+	known;
+	constructor(folder, known) {
+		super(`${folder} names no database construct, so its migrations would never run. ${known.length > 0 ? `The folders that do: ${known.join(", ")}.` : "This project declares no database."} Rename the folder after the construct it belongs to.`);
+		this.folder = folder;
+		this.known = known;
+		this.name = "UnknownMigrationFolder";
+	}
+};
+/** A construct was asked for by a name that takes no migrations. */
+var NoSuchMigrationTarget = class extends Error {
+	construct;
+	known;
+	constructor(construct, known) {
+		super(`'${construct}' is not a database construct. ` + (known.length > 0 ? `The ones with migrations: ${known.join(", ")}.` : "This project declares no database."));
+		this.construct = construct;
+		this.known = known;
+		this.name = "NoSuchMigrationTarget";
+	}
+};
+/**
+* A migration left directly in a construct's folder, where nothing reads it.
+*
+* Migrations moved into `migrations/` so seeds could sit beside them. A file
+* still at the old level would otherwise never run, and nothing would say so.
+*/
+var MigrationsOutsideFolder = class extends Error {
+	folder;
+	files;
+	constructor(folder, files) {
+		super(`${folder} has ${files.join(", ")} directly inside it, where nothing runs them. Migrations live in ${folder}/migrations/ and seeds in ${folder}/seeds/ — move ${files.length === 1 ? "it" : "them"} there.`);
+		this.folder = folder;
+		this.files = files;
+		this.name = "MigrationsOutsideFolder";
+	}
+};
+/** A folder inside a construct's folder that is neither `migrations` nor `seeds`. */
+var UnknownDatabaseFolder = class extends Error {
+	folder;
+	constructor(folder) {
+		super(`${folder} is neither migrations/ nor seeds/, so nothing in it would ever run. A construct's folder holds those two; rename or remove it.`);
+		this.folder = folder;
+		this.name = "UnknownDatabaseFolder";
+	}
+};
+/** A seed failed; its own writes are rolled back, the ones before it stay. */
+var SeedFailed = class extends Error {
+	construct;
+	seed;
+	cause;
+	constructor(construct, seed, cause) {
+		super(`${construct}: seed '${seed}' failed — ${cause instanceof Error ? cause.message : String(cause)}. Its writes were rolled back; fix it and run it again.`);
+		this.construct = construct;
+		this.seed = seed;
+		this.cause = cause;
+		this.name = "SeedFailed";
+	}
+};
+/** A construct with roles has no owner URL to migrate with. */
+var NoOwnerCredential = class extends Error {
+	construct;
+	key;
+	constructor(construct, key) {
+		super(`${construct} has no ${key} to migrate with. Migrations run as the owner role — the runtime one cannot create a table — and nothing resolved its URL. Is the stage reconciled?`);
+		this.construct = construct;
+		this.key = key;
+		this.name = "NoOwnerCredential";
+	}
+};
+/** A migration failed; the ones before it in the run stay applied. */
+var MigrationFailed = class extends Error {
+	construct;
+	migration;
+	cause;
+	constructor(construct, migration, cause) {
+		super(`${construct}: migration ${migration ? `'${migration}' ` : ""}failed — ${cause instanceof Error ? cause.message : String(cause)}`);
+		this.construct = construct;
+		this.migration = migration;
+		this.cause = cause;
+		this.name = "MigrationFailed";
+	}
+};
+/** The project's Kysely could not be found from where a database is declared. */
+var KyselyNotFound = class extends Error {
+	from;
+	constructor(from) {
+		super(`Could not resolve 'kysely' from ${from}. Migrations run with the project's own Kysely — install it where the database is declared.`);
+		this.from = from;
+		this.name = "KyselyNotFound";
+	}
+};
+/** Apply every pending migration, construct by construct, parents first. */
+async function migrateDatabases(options) {
+	const runs = [];
+	for (const target of await targetsFor(options)) {
+		if ((await migrationFiles(join(options.root, target.migrations))).size === 0) {
+			runs.push({
+				target,
+				applied: []
+			});
+			continue;
+		}
+		const applied = await withMigrator(options, target, async (migrator) => {
+			const { error, results = [] } = await migrator.migrateToLatest();
+			if (error) {
+				const failed = results.find((result) => result.status === "Error");
+				throw new MigrationFailed(target.id, failed?.migrationName, error);
+			}
+			return results.filter((result) => result.status === "Success").map((result) => result.migrationName);
+		});
+		runs.push({
+			target,
+			applied
+		});
+	}
+	return runs;
+}
+/**
+* Run every construct's seeds, parents first — each one, every time, on every
+* stage, production included. Each is handed the stage, so a seed decides
+* what belongs where.
+*
+* Seeds are reference data kept up to date by being run again, so there is no
+* history: a seed is an upsert, and a changed one is applied by the next run.
+* Each runs in its own transaction, as the construct's owner, so a failure
+* leaves nothing half-written. Assumes the schema is migrated —
+* {@link migrateAndSeed} is what makes that true.
+*/
+async function seedDatabases(options) {
+	const runs = [];
+	for (const target of await targetsFor(options)) {
+		const folder = join(options.root, target.seeds);
+		if ((await migrationFiles(folder)).size === 0) {
+			runs.push({
+				target,
+				seeded: []
+			});
+			continue;
+		}
+		const seeded = await withOwner(options, target, async (db, kysely) => {
+			const names = [];
+			for (const seed of await loadSeeds(folder, kysely.sql)) {
+				try {
+					await db.transaction().execute((trx) => seed.run(trx, { stage: options.stage }));
+				} catch (error) {
+					throw new SeedFailed(target.id, seed.name, error);
+				}
+				names.push(seed.name);
+			}
+			return names;
+		});
+		runs.push({
+			target,
+			seeded
+		});
+	}
+	return runs;
+}
+/**
+* Migrate, then seed: a seed only ever runs against the schema it was written
+* for.
+*
+* With `only`, the constructs it lives in are migrated too — a tenant's seed
+* cannot run before the database that owns its schema exists — and only it is
+* seeded.
+*/
+async function migrateAndSeed(options) {
+	const migrations = [];
+	for (const target of await withParents(options)) migrations.push(...await migrateDatabases({
+		...options,
+		only: target.id
+	}));
+	return {
+		migrations,
+		seeds: await seedDatabases(options)
+	};
+}
+/** The targets `only` names, after the ones it lives in; all without it. */
+async function withParents(options) {
+	const chosen = await targetsFor(options);
+	if (!options.only) return chosen;
+	const all = migrationTargets(options.manifest);
+	const ids = /* @__PURE__ */ new Set();
+	for (const target of chosen) {
+		let current = target;
+		while (current) {
+			ids.add(current.id);
+			const parent = current.of;
+			current = parent ? all.find((t) => t.id === parent) : void 0;
+		}
+	}
+	return all.filter((target) => ids.has(target.id));
+}
+/**
+* What each construct's folder has that its history does not — without
+* applying any of it. What `gkm dev` reports.
+*/
+async function pendingMigrations(options) {
+	const found = [];
+	for (const target of await targetsFor(options)) {
+		if ((await migrationFiles(join(options.root, target.migrations))).size === 0) continue;
+		const pending = await withMigrator(options, target, async (migrator) => (await migrator.getMigrations()).filter((migration) => migration.executedAt === void 0).map((migration) => migration.name));
+		if (pending.length > 0) found.push({
+			target,
+			pending
+		});
+	}
+	return found;
+}
+/**
+* The targets this run covers, with every folder under `db/` accounted for.
+*
+* A folder that names no construct is an error rather than something to skip:
+* a typo in its name is otherwise a migration that silently never runs.
+*/
+async function targetsFor(options) {
+	const targets = migrationTargets(options.manifest);
+	const folders = targets.map((target) => target.folder);
+	for (const folder of await foldersIn(join(options.root, MIGRATIONS_ROOT))) {
+		const relative = `${MIGRATIONS_ROOT}/${folder}`;
+		if (!folders.includes(relative)) throw new UnknownMigrationFolder(relative, folders);
+		await checkLayout(options.root, relative);
+	}
+	if (!options.only) return targets;
+	const id = canonicalId(options.only);
+	const chosen = targets.filter((target) => target.id === id);
+	if (chosen.length === 0) throw new NoSuchMigrationTarget(options.only, targets.map((target) => target.id));
+	return chosen;
+}
+/**
+* A construct's folder holds `migrations/` and `seeds/`, and nothing else —
+* anything beside them is a file or folder nothing would ever run.
+*/
+async function checkLayout(root, folder) {
+	const entries = await readdir(join(root, folder), { withFileTypes: true });
+	const loose = entries.filter((entry) => entry.isFile() && !entry.name.startsWith(".")).map((entry) => entry.name);
+	if (loose.length > 0) throw new MigrationsOutsideFolder(folder, loose);
+	for (const entry of entries) if (entry.isDirectory() && !DATABASE_FOLDERS.includes(entry.name)) throw new UnknownDatabaseFolder(`${folder}/${entry.name}`);
+}
+async function foldersIn(dir) {
+	return (await readdir(dir, { withFileTypes: true }).catch((error) => {
+		if (error.code === "ENOENT") return [];
+		throw error;
+	})).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+}
+/**
+* A migrator for one target, connected as its owner.
+*
+* No `migrationTableSchema`: the owner role's `search_path` is pinned to the
+* construct's schema, so the history lands there — `app.kysely_migration` for
+* the database, `auth_database.kysely_migration` for its tenant — and two
+* constructs in one Postgres never share one.
+*
+* Unordered migrations are allowed. Files are timestamped, so a branch merged
+* after another's migration ran carries an older one; refusing it would make
+* every such merge a manual repair.
+*/
+async function withMigrator(options, target, run) {
+	return withOwner(options, target, (db, { Migrator, sql }) => run(new Migrator({
+		db,
+		provider: folderProvider(join(options.root, target.migrations), sql),
+		allowUnorderedMigrations: true
+	})));
+}
+/**
+* One target's database, connected as its owner and closed afterwards — what
+* migrations and seeds both run as.
+*/
+async function withOwner(options, target, run) {
+	const kysely = await kyselyFrom(options.sources?.[target.id]?.file ?? (target.of ? options.sources?.[target.of]?.file : void 0) ?? join(options.root, "package.json"));
+	const db = new kysely.Kysely({ dialect: new kysely.PostgresDialect({ pool: new pg.Pool(poolConfig(ownerUrl(options, target))) }) });
+	try {
+		return await run(db, kysely);
+	} finally {
+		await db.destroy();
+	}
+}
+/**
+* The owner's URL, with no fallback to the runtime one.
+*
+* The runtime role can create nothing, so falling back would only move the
+* failure to the first `CREATE TABLE` and make it read like a permissions
+* bug. The one exception is a database declared `roles: false`, where there is
+* no owner — both URLs are the master credential by design.
+*/
+function ownerUrl(options, target) {
+	const key = provideKey(target.id, "ownerUrl");
+	const owner = options.env[key];
+	if (owner) return owner;
+	const database = options.manifest[target.of ?? target.id];
+	if (database?.kind === "database" && database.roles === false) {
+		const url = options.env[provideKey(target.id, "url")];
+		if (url) return url;
+	}
+	throw new NoOwnerCredential(target.id, key);
+}
+/**
+* Pool settings for a URL, with `?search_path=` as the startup option Postgres
+* reads. Only a `roles: false` URL carries it — a role pins its own.
+*/
+function poolConfig(url) {
+	const parsed = new URL(url);
+	const searchPath = parsed.searchParams.get("search_path");
+	if (!searchPath) return { connectionString: url };
+	parsed.searchParams.delete("search_path");
+	return {
+		connectionString: parsed.toString(),
+		options: `-c search_path=${searchPath}`
+	};
+}
+/** Kysely as the project resolves it from `from`. */
+async function kyselyFrom(from) {
+	const require = createRequire(from);
+	try {
+		const [main, migration] = await Promise.all([import(pathToFileURL(require.resolve("kysely")).href), import(pathToFileURL(require.resolve("kysely/migration")).href)]);
+		return {
+			Kysely: main.Kysely,
+			PostgresDialect: main.PostgresDialect,
+			sql: main.sql,
+			Migrator: migration.Migrator
+		};
+	} catch {
+		throw new KyselyNotFound(from);
+	}
+}
+//#endregion
+//#region src/compose/docker.ts
+/**
+* The Docker operations `gkm compose` needs, behind an interface.
+*
+* Small on purpose, like reconcile's: the rules about *when* each runs — the
+* registry is asked before anything is pulled, nothing is started for a tag
+* that is missing — are asserted against a fake, and this file is only the
+* wiring to the real CLI.
+*
+* Every call is an argument array. Image refs, tags and paths come from the
+* workspace, and none of them reaches a shell.
+*/
+/** How long a stack has to pass its health checks. */
+const WAIT_TIMEOUT_S = 180;
+/** `docker compose port` printed nothing a port can be read from. */
+var ServicePortUnknown = class extends Error {
+	service;
+	inside;
+	output;
+	constructor(service, inside, output) {
+		super(`'${service}' publishes no host port for ${inside} (docker said: ${output.trim() || "nothing"}). Is it running? \`docker compose ps\` shows the stack.`);
+		this.service = service;
+		this.inside = inside;
+		this.output = output;
+		this.name = "ServicePortUnknown";
+	}
+};
+function compose(stack, args) {
+	return [
+		"compose",
+		"-p",
+		stack.project,
+		"-f",
+		stack.file,
+		...args
+	];
+}
+/** Run a program and keep everything it said, whatever it exits with. */
+function capture(command, args, timeoutMs = 6e4) {
+	return new Promise((resolve, reject) => {
+		const child = spawn(command, [...args], {
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			shell: false
+		});
+		let stdout = "";
+		let stderr = "";
+		child.stdout.on("data", (chunk) => {
+			stdout += chunk.toString();
+		});
+		child.stderr.on("data", (chunk) => {
+			stderr += chunk.toString();
+		});
+		const timer = setTimeout(() => child.kill("SIGKILL"), timeoutMs);
+		timer.unref?.();
+		child.on("error", (error) => {
+			clearTimeout(timer);
+			reject(error);
+		});
+		child.on("close", (code) => {
+			clearTimeout(timer);
+			resolve({
+				code,
+				stdout,
+				stderr
+			});
+		});
+	});
+}
+/**
+* Whether a failed `docker manifest inspect` means the tag is not there, as
+* opposed to the registry not answering.
+*
+* Read off the message because that is all the CLI gives. Anything not
+* recognisably "no such tag" is treated as the registry being unreachable:
+* a registry that refused credentials must not be reported as a tag that was
+* never pushed, or the fix offered would be the wrong one.
+*/
+function isMissingManifest(output) {
+	return /no such manifest|manifest unknown|manifest for .* not found|not found: manifest/i.test(output);
+}
+const dockerCompose = {
+	async lookup(ref) {
+		const { code, stdout, stderr } = await capture("docker", [
+			"manifest",
+			"inspect",
+			ref
+		]);
+		if (code === 0) return {
+			ref,
+			status: "found"
+		};
+		const output = `${stderr}\n${stdout}`.trim();
+		return isMissingManifest(output) ? {
+			ref,
+			status: "missing"
+		} : {
+			ref,
+			status: "unreachable",
+			detail: output
+		};
+	},
+	async build(stack, services) {
+		await run$1("docker", compose(stack, ["build", ...services]), {
+			cwd: stack.cwd,
+			env: {
+				...process.env,
+				DOCKER_BUILDKIT: "1"
+			}
+		});
+	},
+	async pull(stack, services) {
+		await run$1("docker", compose(stack, ["pull", ...services]), { cwd: stack.cwd });
+	},
+	async up(stack, services) {
+		await run$1("docker", compose(stack, [
+			"up",
+			"-d",
+			"--wait",
+			`--wait-timeout=${WAIT_TIMEOUT_S}`,
+			...services ? [] : ["--remove-orphans"],
+			...services ?? []
+		]), { cwd: stack.cwd });
+	},
+	async down(stack) {
+		await run$1("docker", compose(stack, ["down"]), { cwd: stack.cwd });
+	},
+	async port(stack, service, inside) {
+		const output = await runOutput("docker", compose(stack, [
+			"port",
+			service,
+			String(inside)
+		]), { cwd: stack.cwd });
+		const port = Number(output.trim().split(":").pop());
+		if (!Number.isInteger(port) || port <= 0) throw new ServicePortUnknown(service, inside, output);
+		return port;
+	},
+	async copyOut(stack, service, from, to) {
+		await mkdir(dirname(to), { recursive: true });
+		await run$1("docker", compose(stack, [
+			"cp",
+			`${service}:${from}`,
+			to
+		]), { cwd: stack.cwd });
+	},
+	async digest(ref) {
+		const { code, stdout } = await capture("docker", [
+			"image",
+			"inspect",
+			"--format={{json .RepoDigests}} {{.Id}}",
+			ref
+		]);
+		if (code !== 0) return void 0;
+		const [json = "[]", id] = stdout.trim().split(" ");
+		const repository = ref.split("@")[0].replace(/:[\w][\w.-]*$/, "");
+		try {
+			const digests = JSON.parse(json);
+			const match = Array.isArray(digests) ? digests.find((entry) => typeof entry === "string" && entry.startsWith(`${repository}@`)) : void 0;
+			if (match) return match.slice(repository.length + 1);
+		} catch {}
+		return id || void 0;
+	}
+};
+//#endregion
+//#region src/compose/images.ts
+/**
+* The tag a site's image carries for a release.
+*
+* A site's public URLs are inlined when it is built, so one bundle serves one
+* stage: `v1.4.0-production` and `v1.4.0-staging` are two images of the same
+* commit. A backend reads its URLs at runtime, so one image serves every stage
+* and its tag is the release's alone.
+*/
+function siteTag(tag, stage) {
+	return `${tag}-${stage}`;
+}
+/** Images a tag names that the registry does not have. */
+var ImageTagNotFound = class extends Error {
+	tag;
+	refs;
+	constructor(tag, refs) {
+		super(`The registry has no image for ${refs.length === 1 ? "this app" : `${refs.length} apps`} at '${tag}':\n` + refs.map((ref) => `  - ${ref}`).join("\n") + `\nNothing was pulled or started. Push '${tag}' for every app from CI, pick a tag that exists, or run without --tag to build from this checkout.`);
+		this.tag = tag;
+		this.refs = refs;
+		this.name = "ImageTagNotFound";
+	}
+};
+/** The registry did not answer, or did not let this machine in. */
+var RegistryUnreachable = class extends Error {
+	ref;
+	detail;
+	constructor(ref, detail) {
+		super(`Could not ask the registry about ${ref}: ${detail || "no answer"}\nNothing was pulled or started. Check the registry is reachable and that this machine is logged in to it (\`docker login <registry>\`).`);
+		this.ref = ref;
+		this.detail = detail;
+		this.name = "RegistryUnreachable";
+	}
+};
+/**
+* Assert every image exists, before anything else happens.
+*
+* Asked all at once and reported all at once: a release missing two images is
+* one problem with two names, and finding the second only after fixing the
+* first is a slower way to learn the same thing.
+*
+* @throws {RegistryUnreachable} when the registry cannot say
+* @throws {ImageTagNotFound} listing every missing image
+*/
+async function assertImagesExist(docker, tag, images) {
+	const lookups = await Promise.all(images.map((image) => docker.lookup(image.ref)));
+	const unreachable = lookups.find((lookup) => lookup.status === "unreachable");
+	if (unreachable?.status === "unreachable") throw new RegistryUnreachable(unreachable.ref, unreachable.detail);
+	const missing = lookups.filter((lookup) => lookup.status === "missing").map((lookup) => lookup.ref);
+	if (missing.length > 0) throw new ImageTagNotFound(tag, missing);
+}
+//#endregion
+//#region src/compose/caddyfile.ts
+/** The Caddyfile for a stack's edge. */
+function edgeCaddyfile(sites, options) {
+	const global = options.local ? `{
+	# No ACME and no public DNS: the CA is Caddy's own and the names resolve
+	# to this machine.
+	local_certs
+	auto_https disable_redirects
+}` : options.email ? `{
+	email ${options.email}
+}` : "";
+	const blocks = sites.map(({ host, upstream }) => `https://${host} {${options.local ? `
+	tls internal
+` : ""}
+	# Host and X-Forwarded-* are passed through as Caddy does by default, so
+	# an app builds redirects, cookies and links on the address a caller used.
+	reverse_proxy ${upstream} {
+		# Never buffer: a streamed response — server-sent events, a Next.js
+		# RSC payload — reaches the client as each chunk is written.
+		flush_interval -1
+	}
+}`);
+	return `${HEADER}${global ? `${global}\n\n` : ""}${blocks.join("\n\n")}\n`;
+}
+const HEADER = `# Generated by gkm compose from the construct manifest — do not edit.
+#
+# One host per API and site, each in front of its own container.
+`;
+//#endregion
+//#region src/compose/stack.ts
+/**
+* The stack a workspace runs as for one stage — pure.
+*
+* Everything `gkm compose` writes is decided here, as data: the compose file,
+* the Caddyfile, one env file per backend, and the image each app runs. The
+* command around it reads the workspace, asks the registry, writes the files
+* and starts Docker; none of those decide anything, so all of it can be
+* asserted without a daemon.
+*
+* The values come from the same derivations every other target uses. The
+* plan is reconcile's `planFor`, the keys an app reads are `appEnvKeys`, and
+* every URL is `envFor`'s — asked twice, once with each app at its public
+* address and once on the compose network, because a browser and a sibling
+* service reach the same API by different names.
+*/
+/** Where a stack's files are written, relative to the workspace root. */
+function stackDir(stage) {
+	return `.gkm/compose/${stage}`;
+}
+/**
+* The compose project a stage's stack runs as.
+*
+* The deploy identity's scope, so two workspaces with one name in different
+* namespaces never share containers or volumes — and the stage, so a
+* machine can run two stages side by side.
+*/
+function composeProject(identity) {
+	return `${identity.scope}-${identity.stage}`;
+}
+/** The ports the edge is published on, and the variables that move them. */
+const EDGE_PORT_ENV = {
+	https: "GKM_COMPOSE_HTTPS_PORT",
+	http: "GKM_COMPOSE_HTTP_PORT"
+};
+/**
+* Containers this target does not run.
+*
+* Object storage is the stage's own — an externally hosted bucket whose URL
+* the stage's secrets hold — and so is a deployed stage's mail. The AWS
+* emulator never applies: a stack is a server target, whose events are
+* pg-boss.
+*/
+const NOT_RUN = {
+	minio: true,
+	localstack: true,
+	caddy: true
+};
+/** Kinds whose `<ID>_URL` a stage must be given, because nothing here runs them. */
+const EXTERNAL_KINDS = {
+	objects: true,
+	"file-server": true
+};
+/** The S3 client's credentials, read beside a bucket's URL when it has them. */
+const STORAGE_KEYS = [
+	"AWS_ACCESS_KEY_ID",
+	"AWS_SECRET_ACCESS_KEY",
+	"AWS_REGION"
+];
+/** A bucket the stack needs and the stage was not given. */
+var BucketNotConfigured = class extends Error {
+	app;
+	id;
+	key;
+	stage;
+	constructor(app, id, key, stage) {
+		super(`'${app}' uses the bucket '${id}', and gkm compose runs no object storage: the stage needs an externally hosted bucket. Set its URL in the stage's secrets: gkm secrets:set ${key} 's3://…' --stage ${stage}`);
+		this.app = app;
+		this.id = id;
+		this.key = key;
+		this.stage = stage;
+		this.name = "BucketNotConfigured";
+	}
+};
+/** A value only the stage's secrets can hold, and they do not. */
+var StageSecretMissing = class extends Error {
+	app;
+	key;
+	stage;
+	constructor(app, key, stage) {
+		super(`'${app}' reads ${key}, and the stage '${stage}' has none. Nothing in the stack can derive it; set it in the stage's secrets: gkm secrets:set ${key} '…' --stage ${stage}`);
+		this.app = app;
+		this.key = key;
+		this.stage = stage;
+		this.name = "StageSecretMissing";
+	}
+};
+/** A deployed stage's secrets with no seed to derive its passwords from. */
+var StageSeedMissing = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`The stage '${stage}' has no seed in its secrets, and a deployed stage's database passwords are derived from it. Run gkm compose without --dry-run once, or gkm deploy, to generate it.`);
+		this.stage = stage;
+		this.name = "StageSeedMissing";
+	}
+};
+/** A workspace with no API and no site to run. */
+var NothingToCompose = class extends Error {
+	root;
+	constructor(root) {
+		super(`${root} declares no RestApi and no site, so a stack would run nothing. Workers and mobile apps are not run by gkm compose yet.`);
+		this.root = root;
+		this.name = "NothingToCompose";
+	}
+};
+/** A value that cannot be written to an env file a line at a time. */
+var EnvValueMultiline = class extends Error {
+	app;
+	key;
+	constructor(app, key) {
+		super(`${key} for '${app}' spans more than one line, and an env file holds one value per line. Store it on one line — base64, or JSON — and decode it where it is read.`);
+		this.app = app;
+		this.key = key;
+		this.name = "EnvValueMultiline";
+	}
+};
+/** The services a stack's apps wait on and the edge waits on in turn. */
+const HEALTHY = { condition: "service_healthy" };
+/**
+* An app's health check: its own server, asked on 127.0.0.1 — not
+* `localhost`, which resolves to `::1` first in an Alpine container while a
+* server may listen on IPv4 alone.
+*/
+function probe(port, path) {
+	return {
+		test: [
+			"CMD",
+			"wget",
+			"-q",
+			"-O",
+			"/dev/null",
+			`http://127.0.0.1:${port}${path}`
+		],
+		interval: "5s",
+		timeout: "3s",
+		retries: 20,
+		start_period: "10s"
+	};
+}
+/** The stack for one stage. */
+function composeStack(input) {
+	const { workspace, manifest, stage, identity } = input;
+	const local = stage === workspace.stages.local;
+	const project = composeProject(identity);
+	const custom = input.secrets?.custom ?? {};
+	const https = input.ports?.https ?? 443;
+	const http = input.ports?.http ?? 80;
+	const plan = planFor(manifest, stage, provisionOrder(manifest), {
+		localStage: workspace.stages.local,
+		events: DEFAULT_EVENTS.server,
+		cache: DEFAULT_CACHE.server,
+		edge: false
+	});
+	const byId = new Map(plan.resources.map((r) => [r.id, r]));
+	const seed = local ? void 0 : input.secrets?.seed;
+	if (!local && !seed) throw new StageSeedMissing(stage);
+	const credential = {
+		master: local ? "geekmidas" : localRolePassword(workspace.name, plan, "master", seed),
+		...seed ? { seed } : {}
+	};
+	const infra = plan.containers.filter((c) => !NOT_RUN[c]).filter((c) => local || c !== "mailpit").sort();
+	const apps = stackApps(workspace, manifest, plan, {
+		local,
+		stage,
+		https,
+		identity,
+		images: input.images
+	});
+	if (apps.length === 0) throw new NothingToCompose(workspace.root);
+	const derivation = {
+		project: workspace.name,
+		master: credential.master,
+		...credential.seed ? { seed: credential.seed } : {}
+	};
+	const outside = networkEnv(plan, {
+		...derivation,
+		addresses: Object.fromEntries(apps.map((app) => [app.id, app.url]))
+	});
+	const inside = networkEnv(plan, {
+		...derivation,
+		addresses: Object.fromEntries(apps.map((app) => [app.id, `http://${app.name}:${app.port}`]))
+	});
+	const owners = /* @__PURE__ */ new Map();
+	for (const resource of plan.resources) {
+		owners.set(resource.envKey, resource);
+		if (resource.kind === "email") {
+			owners.set(provideKey(resource.id, "from"), resource);
+			owners.set(provideKey(resource.id, "inboxUrl"), resource);
+		}
+		if (resource.kind === "external-api") owners.set(provideKey(resource.id, "credentials"), resource);
+	}
+	const surfaceUrls = new Map(plan.resources.filter((r) => r.kind === "rest-api" || r.kind === "site").map((r) => [r.envKey, r.id]));
+	const appById = new Map(apps.map((app) => [app.id, app]));
+	/**
+	* What a key resolves to for one app, from the stage's secrets where only
+	* they can hold it, and the derivations otherwise.
+	*/
+	const valueFor = (app, key, owner) => {
+		if (owner && EXTERNAL_KINDS[owner.kind] && key === owner.envKey) {
+			const value = custom[key];
+			if (value === void 0) throw new BucketNotConfigured(app.name, owner.id, key, stage);
+			return value;
+		}
+		if (owner && suppliedBy(owner, key, local)) {
+			const value = custom[key];
+			if (value === void 0) throw new StageSecretMissing(app.name, key, stage);
+			return value;
+		}
+		if (custom[key] !== void 0) return custom[key];
+		const surface = surfaceUrls.get(key);
+		if (app.kind === "rest-api" && surface && surface !== app.id) return inside[key];
+		return outside[key];
+	};
+	for (const app of apps) {
+		if (app.kind === "site") {
+			const site = manifest[app.id];
+			if (site?.kind !== "site") continue;
+			const args = {};
+			for (const [key, source] of Object.entries(publicEnvFor(site, manifest))) {
+				const value = valueFor(app, source, owners.get(source));
+				if (value !== void 0) args[key] = value;
+			}
+			if (app.build && Object.keys(args).length > 0) app.build.args = args;
+			continue;
+		}
+		const keys = appEnvKeys(manifest, app.name, input.runnables) ?? /* @__PURE__ */ new Set();
+		const values = {};
+		for (const key of [...keys].sort()) {
+			const owner = owners.get(key) ?? storageOwner(key, plan);
+			if (!local && owner?.kind === "email" && key.endsWith("_INBOX_URL")) continue;
+			if (STORAGE_KEYS.includes(key)) {
+				if (custom[key] !== void 0) values[key] = custom[key];
+				continue;
+			}
+			const value = valueFor(app, key, owner);
+			if (value !== void 0) values[key] = value;
+		}
+		const trusted = provideKey(app.id, "trustedOrigins");
+		if (keys.has(trusted)) {
+			const internal = (byId.get(app.id)?.callers ?? []).map((caller) => appById.get(caller)).filter((caller) => caller?.kind === "rest-api").map((caller) => `http://${caller.name}:${caller.port}`);
+			const origins = [...(values[trusted] ?? "").split(",").filter(Boolean), ...internal];
+			values[trusted] = [...new Set(origins)].join(",");
+		}
+		app.env = {
+			...values,
+			NODE_ENV: "production",
+			PORT: String(app.port),
+			STAGE: stage
+		};
+		for (const [key, value] of Object.entries(app.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(app.name, key);
+	}
+	const compose = stackFile({
+		project,
+		plan,
+		infra,
+		apps,
+		master: credential.master,
+		https,
+		http
+	});
+	const caddyfile = edgeCaddyfile(apps.map((app) => ({
+		host: app.host,
+		upstream: `${app.name}:${app.port}`
+	})), { local });
+	const dockerfiles = {};
+	for (const app of apps) {
+		if (!app.build) continue;
+		dockerfiles[app.build.dockerfile] = app.kind === "site" ? siteDockerfile(app.name, workspace.apps[app.name], {
+			turboPackage: input.packages?.[app.name] ?? app.name,
+			packageManager: input.packageManager ?? "pnpm",
+			manifest
+		}) : generateSlimDockerfile({
+			imageName: app.name,
+			baseImage: "node:22-alpine",
+			port: app.port,
+			healthCheckPath: "/health",
+			prebuilt: true,
+			packageManager: input.packageManager ?? "pnpm",
+			bundle: `${app.path}/.gkm/server/dist/server.mjs`
+		});
+	}
+	return {
+		project,
+		stage,
+		local,
+		apps,
+		infra,
+		compose,
+		caddyfile,
+		dockerfiles,
+		plan,
+		credential
+	};
+	/** Whether only the stage's secrets can supply `key` to `owner`. */
+	function suppliedBy(owner, key, isLocal) {
+		if (owner.kind === "credential") return true;
+		if (owner.kind === "external-api") return key === provideKey(owner.id, "credentials");
+		if (isLocal) return false;
+		if (owner.kind === "secret" || owner.kind === "encryption") return true;
+		return owner.kind === "email" && !key.endsWith("_INBOX_URL");
+	}
+}
+/** Which bucket an S3 credential key belongs to — the first one declared. */
+function storageOwner(key, plan) {
+	if (!STORAGE_KEYS.includes(key)) return void 0;
+	return plan.resources.find((r) => r.kind === "objects");
+}
+/** The apps a stack runs: every API and every site, at its stage address. */
+function stackApps(workspace, manifest, plan, options) {
+	const apps = [];
+	const resources = new Map(plan.resources.map((r) => [r.id, r]));
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration.kind !== "rest-api" && declaration.kind !== "site") continue;
+		const name = appKey(id);
+		const app = workspace.apps[name];
+		const resource = resources.get(id);
+		if (!app || !resource || !app.port) continue;
+		const host = hostOf(name, app, workspace, resource, options);
+		const tag = declaration.kind === "site" ? siteTag(options.images.tag, options.stage) : options.images.tag;
+		const ref = validateImageRef(imageRef(options.identity, name, options.images.registry, tag));
+		apps.push({
+			app: name,
+			name,
+			id,
+			kind: declaration.kind,
+			path: app.path,
+			port: app.port,
+			host,
+			url: `https://${host}${options.local && options.https !== 443 ? `:${options.https}` : ""}`,
+			ref,
+			tag,
+			...options.images.mode === "build" ? { build: { dockerfile: `${stackDir(options.stage)}/Dockerfile.${name}` } } : {}
+		});
+	}
+	return apps.sort((a, b) => a.name.localeCompare(b.name));
+}
+/**
+* The host an app answers on for a stage: the `gkm dev` edge's
+* `*.localhost` names for the local stage, and the stage's domain — by the
+* same rule a deploy follows — for any other.
+*/
+function hostOf(name, app, workspace, resource, options) {
+	if (options.local) return hostFor(resource, workspace.name);
+	return resolveHost(name, app, options.stage, workspace.deploy?.domains, isMainFrontendApp(name, app, workspace.apps));
+}
+/** The compose document: the infrastructure, the apps, and the edge. */
+function stackFile(options) {
+	const { project, plan, infra, apps } = options;
+	const derived = composeFor({
+		...plan,
+		containers: [...infra]
+	}, {
+		project,
+		ports: Object.fromEntries(portKeys(infra, plan.fakes).map((key) => [key, 0]))
+	});
+	const services = {};
+	const volumes = {
+		...derived.volumes,
+		"caddy-data": {},
+		"caddy-config": {}
+	};
+	for (const name of infra) {
+		const { ports: _ports, depends_on, profiles: _profiles, ...service } = derived.services[name];
+		services[name] = {
+			...service,
+			...depends_on?.length ? { depends_on: Object.fromEntries(depends_on.map((dep) => [dep, HEALTHY])) } : {}
+		};
+	}
+	const postgres = services.postgres;
+	if (postgres) {
+		postgres.environment = {
+			...postgres.environment,
+			POSTGRES_PASSWORD: options.master
+		};
+		postgres.ports = ["127.0.0.1::5432"];
+	}
+	for (const app of apps) services[app.name] = {
+		image: app.ref,
+		...app.build ? { build: {
+			context: "../../..",
+			dockerfile: app.build.dockerfile,
+			...app.build.args ? { args: app.build.args } : {}
+		} } : {},
+		restart: "unless-stopped",
+		...app.kind === "rest-api" ? {
+			env_file: [{
+				path: `./${app.name}.env`,
+				format: "raw"
+			}],
+			...infra.length ? { depends_on: Object.fromEntries(infra.map((name) => [name, HEALTHY])) } : {}
+		} : {},
+		healthcheck: probe(app.port, app.kind === "site" ? "/" : "/health")
+	};
+	services.caddy = {
+		image: DEFAULT_IMAGES.caddy,
+		restart: "unless-stopped",
+		ports: [`${options.https}:443`, `${options.http}:80`],
+		volumes: [
+			"./Caddyfile:/etc/caddy/Caddyfile:ro",
+			"caddy-data:/data",
+			"caddy-config:/config"
+		],
+		depends_on: Object.fromEntries(apps.map((app) => [app.name, HEALTHY])),
+		healthcheck: {
+			test: [
+				"CMD",
+				"caddy",
+				"version"
+			],
+			interval: "10s",
+			timeout: "5s",
+			retries: 5
+		}
+	};
+	return {
+		name: project,
+		services,
+		volumes
+	};
+}
+/** Render an app's env file: one `KEY=value` per line, read raw by compose. */
+function envFile(env) {
+	return `${Object.entries(env).sort(([a], [b]) => a.localeCompare(b)).map(([key, value]) => `${key}=${value}`).join("\n")}\n`;
+}
+//#endregion
+//#region src/compose/index.ts
+/**
+* `gkm compose` — a workspace's APIs and sites for one stage, as one Docker
+* Compose stack behind Caddy.
+*
+* The order is the point of this file, and the rules it keeps are these:
+*
+* - A tag is checked before anything happens. Every app's image is asked of
+*   the registry first; one missing image stops the run naming them all, and
+*   nothing is written, pulled or started.
+* - The databases exist before the apps do. Postgres comes up alone, its
+*   databases, roles and grants are created and its migrations applied from
+*   this machine, and only then do the apps start — so an app never boots
+*   against a schema that is not there yet.
+* - What a stage runs is recorded. Each app's tag and the digest it resolved
+*   to are written to the stage's state, so "what is this stage running" has
+*   an exact answer.
+*
+* Docker, the registry, the build and the clock are injected, so the rules are
+* asserted without a daemon; the defaults are the real ones.
+*/
+const logger$4 = console;
+/** `--build` and `--pull` together ask for two different things. */
+var ComposeModeConflict = class extends Error {
+	constructor() {
+		super("--build and --pull ask for opposite things: build images from this checkout, or pull a tag CI pushed. Pass one of them.");
+		this.name = "ComposeModeConflict";
+	}
+};
+/** A build with no commit to tag its images with. */
+var NoGitRevision = class extends Error {
+	root;
+	constructor(root) {
+		super(`Images built here are tagged with the commit they were built from, and ${root} is not in a git repository with a commit. Commit, or pass --tag to name the images yourself.`);
+		this.root = root;
+		this.name = "NoGitRevision";
+	}
+};
+/** A port variable that does not hold a port. */
+var EdgePortInvalid = class extends Error {
+	variable;
+	value;
+	constructor(variable, value) {
+		super(`${variable}=${value} is not a port. Set it to a number between 1 and 65535, or unset it for the default.`);
+		this.variable = variable;
+		this.value = value;
+		this.name = "EdgePortInvalid";
+	}
+};
+/** The commit HEAD is at, short — and `-dirty` when the tree has changes. */
+async function gitRevision(root) {
+	let sha;
+	try {
+		sha = (await runOutput("git", [
+			"rev-parse",
+			"--short",
+			"HEAD"
+		], { cwd: root })).trim();
+	} catch {
+		throw new NoGitRevision(root);
+	}
+	if (!sha) throw new NoGitRevision(root);
+	return (await runOutput("git", ["status", "--porcelain"], { cwd: root }).catch(() => "")).trim() ? `${sha}-dirty` : sha;
+}
+/**
+* Bundle a backend with the gkm that is running — the same build a deploy
+* makes, so the image holds one file and no dependencies.
+*/
+async function bundleWithThisCli(appRoot) {
+	const entry = process.argv[1];
+	if (!entry) return;
+	await run$1(process.execPath, [
+		...process.execArgv,
+		entry,
+		"build",
+		"--provider",
+		"server",
+		"--production"
+	], { cwd: appRoot });
+}
+const defaultDeps = {
+	docker: dockerCompose,
+	bundle: bundleWithThisCli,
+	revision: gitRevision
+};
+/** The edge's ports, from the environment — 443 and 80 when unset. */
+function edgePorts(env = process.env) {
+	const read = (variable, fallback) => {
+		const value = env[variable];
+		if (value === void 0 || value === "") return fallback;
+		const port = Number(value);
+		if (!Number.isInteger(port) || port < 1 || port > 65535) throw new EdgePortInvalid(variable, value);
+		return port;
+	};
+	return {
+		https: read(EDGE_PORT_ENV.https, 443),
+		http: read(EDGE_PORT_ENV.http, 80)
+	};
+}
+/** `gkm compose`. */
+async function composeCommand(options = {}, deps = {}) {
+	const { docker, bundle, revision } = {
+		...defaultDeps,
+		...deps
+	};
+	const env = deps.env ?? process.env;
+	if (options.build && options.pull) throw new ComposeModeConflict();
+	const { workspace } = await loadWorkspaceConfig(options.cwd);
+	const root = workspace.root;
+	const stage = options.stage ?? workspace.stages.local;
+	if (!(stage === workspace.stages.local)) assertDeployedStage(workspace.stages, stage);
+	const identity = deployIdentity(workspace, stage);
+	const dir = join(root, stackDir(stage));
+	const file = join(dir, "docker-compose.yml");
+	const ref = {
+		project: composeProject(identity),
+		file,
+		cwd: root
+	};
+	if (options.down) {
+		await docker.down(ref);
+		logger$4.log(`🛑 Stopped ${ref.project}. Its volumes are kept.`);
+		return;
+	}
+	const sources = {};
+	const runnables = {};
+	const manifest = await discover({
+		patterns: constructGlobs(workspace),
+		cwd: root,
+		sources,
+		runnables
+	});
+	const mode = options.build || !options.pull && !options.tag ? "build" : "pull";
+	const tag = options.tag ?? (mode === "pull" ? "latest" : await revision(root));
+	const { secrets, keep } = await stageSecrets(workspace, manifest, stage);
+	const packageManager = detectPackageManager$2(root);
+	const stack = composeStack({
+		workspace,
+		manifest,
+		runnables,
+		stage,
+		identity,
+		images: {
+			mode,
+			tag,
+			...workspace.deploy?.dokploy?.registry ? { registry: workspace.deploy.dokploy.registry } : {}
+		},
+		secrets,
+		ports: edgePorts(env),
+		packageManager,
+		packages: Object.fromEntries(Object.entries(workspace.apps).map(([name, app]) => [name, appPackageName$1(root, name, app.path)]))
+	});
+	if (mode === "pull" && !options.dryRun) await assertImagesExist(docker, tag, stack.apps);
+	if (options.dryRun) keep.skip();
+	else await keep.write();
+	const files = await writeStack(root, dir, stack);
+	printPlan(stack, mode, files);
+	if (options.dryRun) return {
+		stack,
+		files
+	};
+	const store = deps.state ? await deps.state(workspace) : await createStateStore({
+		config: workspace.state,
+		workspaceRoot: root,
+		workspaceName: workspace.name
+	});
+	const lock = await store.lock(stage, { operation: "compose" });
+	try {
+		const apps = stack.apps.map((app) => app.name);
+		if (mode === "build") {
+			for (const app of stack.apps.filter((a) => a.kind === "rest-api")) {
+				logger$4.log(`\n📦 Bundling ${app.name}…`);
+				await bundle(join(root, app.path));
+			}
+			logger$4.log("\n🐳 Building images…");
+			await docker.build(ref, apps);
+		} else {
+			logger$4.log(`\n🐳 Pulling ${tag}…`);
+			await docker.pull(ref, apps);
+		}
+		if (stack.infra.length > 0) {
+			logger$4.log(`\n🗄️  Starting ${stack.infra.join(", ")}…`);
+			await docker.up(ref, stack.infra);
+		}
+		if (stack.infra.includes("postgres")) await prepareDatabases(stack, workspace, manifest, sources, {
+			docker,
+			ref,
+			sql: deps.sql ?? pgClient,
+			migrate: deps.migrate ?? migrateDatabases
+		});
+		logger$4.log("\n🚀 Starting the stack…");
+		await docker.up(ref);
+		if (stack.local) await docker.copyOut(ref, "caddy", "/data/caddy/pki/authorities/local/root.crt", join(dir, "caddy-root.crt")).catch(() => {});
+		const images = await recordImages(store, stack, docker, mode);
+		logger$4.log(`\n✅ ${ref.project} is running:`);
+		for (const app of stack.apps) logger$4.log(`   ${app.name.padEnd(12)} ${app.url}`);
+		if (stack.local) logger$4.log(`\n🔐 Certificates are from Caddy's local CA: NODE_EXTRA_CA_CERTS=${join(stackDir(stage), "caddy-root.crt")}`);
+		return {
+			stack,
+			files,
+			images
+		};
+	} finally {
+		await lock.release();
+	}
+}
+/**
+* The stage's secrets — and, for a deployed stage, everything it generates
+* once: its seed, and each declared secret and keyring. Written back before
+* anything is derived from them, so the next run derives the same passwords.
+*/
+async function stageSecrets(workspace, manifest, stage) {
+	const store = await secretsStoreFor(workspace, stage);
+	const stored = await store.read(stage);
+	const nothing = {
+		write: async () => {},
+		skip: () => {}
+	};
+	if (stage === workspace.stages.local) return {
+		secrets: stored,
+		keep: nothing
+	};
+	const { secrets, generated } = withGeneratedSecrets(stored ?? initStageSecrets(stage), manifest);
+	if (generated.length === 0) return {
+		secrets,
+		keep: nothing
+	};
+	return {
+		secrets,
+		keep: {
+			async write() {
+				await store.write(stage, secrets);
+				logger$4.log(`🔑 Generated for "${stage}" (${store.name}): ${generated.join(", ")}`);
+			},
+			skip() {
+				logger$4.log(`🔑 "${stage}" has no ${generated.join(", ")} yet; this dry run used values it did not keep.`);
+			}
+		}
+	};
+}
+/** Write the stack's files: owner-only, since the env files hold secrets. */
+async function writeStack(root, dir, stack) {
+	await mkdir(dir, {
+		recursive: true,
+		mode: 448
+	});
+	await chmod(dir, 448);
+	const files = [];
+	const write = async (path, content, mode = 420) => {
+		await mkdir(dirname(path), { recursive: true });
+		await writeFile(path, content, { mode });
+		await chmod(path, mode);
+		files.push(path);
+	};
+	await write(join(dir, "docker-compose.yml"), composeYaml(stack));
+	await write(join(dir, "Caddyfile"), stack.caddyfile);
+	for (const app of stack.apps) if (app.env) await write(join(dir, `${app.name}.env`), envFile(app.env), 384);
+	for (const [path, content] of Object.entries(stack.dockerfiles)) await write(join(root, path), content);
+	await ignoreStacks(root);
+	return files;
+}
+/** Make sure the build context leaves `.gkm/compose` out. */
+async function ignoreStacks(root) {
+	const path = join(root, ".dockerignore");
+	if (!existsSync(path)) {
+		await writeFile(path, generateDockerignore());
+		return;
+	}
+	const current = await readFile(path, "utf-8");
+	if (/^\/?\.gkm\/compose\/?$|^\/?\.gkm\/?$/m.test(current)) return;
+	await appendFile(path, `${current.endsWith("\n") ? "" : "\n"}\n# gkm compose's stacks: each app's env file holds its stage's secrets\n.gkm/compose\n`);
+}
+function composeYaml(stack) {
+	return `# Generated by gkm compose from the construct manifest — do not edit.
+# The ${stack.stage} stage's APIs and sites behind one Caddy. Each backend
+# reads exactly the keys in its own env file beside this one.
+#
+#   gkm compose${stack.local ? "" : ` --stage ${stack.stage}`}          start or update it
+#   gkm compose${stack.local ? "" : ` --stage ${stack.stage}`} --down   stop it
+${stringify(stack.compose, {
+		lineWidth: 0,
+		aliasDuplicateObjects: false
+	})}`;
+}
+/** Create what the plan names in the stack's Postgres, then migrate it. */
+async function prepareDatabases(stack, workspace, manifest, sources, deps) {
+	const port = await deps.docker.port(deps.ref, "postgres", 5432);
+	const statements = postgresStatements(stack.plan, workspace.name, stack.credential.seed);
+	if (statements.length > 0) {
+		logger$4.log("🗄️  Creating databases, roles and grants…");
+		await applyPostgres(deps.sql(port, stack.credential.master), statements);
+	}
+	const env = envFor(stack.plan, {
+		ports: { [primaryPortKey("postgres")]: port },
+		project: workspace.name,
+		master: stack.credential.master,
+		...stack.credential.seed ? { seed: stack.credential.seed } : {}
+	});
+	const runs = await deps.migrate({
+		root: workspace.root,
+		manifest,
+		sources,
+		env
+	});
+	for (const { target, applied } of runs) if (applied.length > 0) logger$4.log(`🗄️  ${target.migrations}: applied ${applied.length}`);
+}
+/**
+* Record each app's image in the stage's state: the tag it ran and the digest
+* the tag resolved to — or, for an image built here and never pushed, its
+* content id.
+*/
+async function recordImages(store, stack, docker, mode) {
+	if (!await store.read(stack.stage)) await store.write(stack.stage, createEmptyState(stack.stage, "", ""), { expectedVersion: null });
+	const images = {};
+	for (const app of stack.apps) {
+		const digest = await docker.digest(app.ref);
+		images[app.name] = {
+			ref: app.ref,
+			tag: app.tag,
+			...digest ? { digest } : {}
+		};
+		await store.putResource(stack.stage, {
+			key: `compose:${app.name}`,
+			type: "compose-image",
+			status: "ready",
+			...digest ? { id: digest } : {},
+			data: {
+				project: stack.project,
+				ref: app.ref,
+				tag: app.tag,
+				source: mode,
+				...digest ? { digest } : {}
+			}
+		});
+	}
+	return images;
+}
+function printPlan(stack, mode, files) {
+	logger$4.log(`\n🧱 ${stack.project} — stage ${stack.stage}`);
+	for (const app of stack.apps) logger$4.log(`   ${app.name.padEnd(12)} ${app.url.padEnd(40)} ${mode === "build" ? "build" : "pull"} ${app.ref}`);
+	if (stack.infra.length > 0) logger$4.log(`   infrastructure: ${stack.infra.join(", ")}`);
+	logger$4.log(`\n📝 Wrote ${files.length} file(s) under ${stackDir(stack.stage)}/`);
+}
 /**
 * Format a fatal error for display.
 * Always includes the full stack trace since these are process-ending errors.
@@ -4918,25 +6473,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.60",
-	"@geekmidas/auth": "~10.0.0-alpha.60",
-	"@geekmidas/cache": "~10.0.0-alpha.60",
-	"@geekmidas/client": "~10.0.0-alpha.60",
-	"@geekmidas/cloud": "~10.0.0-alpha.60",
-	"@geekmidas/constructs": "~10.0.0-alpha.60",
-	"@geekmidas/db": "~10.0.0-alpha.60",
-	"@geekmidas/emailkit": "~10.0.0-alpha.60",
-	"@geekmidas/envkit": "~10.0.0-alpha.60",
-	"@geekmidas/errors": "~10.0.0-alpha.60",
-	"@geekmidas/events": "~10.0.0-alpha.60",
-	"@geekmidas/logger": "~10.0.0-alpha.60",
-	"@geekmidas/manifest": "~10.0.0-alpha.60",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.60",
-	"@geekmidas/schema": "~10.0.0-alpha.60",
-	"@geekmidas/services": "~10.0.0-alpha.60",
-	"@geekmidas/storage": "~10.0.0-alpha.60",
-	"@geekmidas/telescope": "~10.0.0-alpha.60",
-	"@geekmidas/testkit": "~10.0.0-alpha.60",
+	"@geekmidas/audit": "~10.0.0-alpha.61",
+	"@geekmidas/auth": "~10.0.0-alpha.61",
+	"@geekmidas/cache": "~10.0.0-alpha.61",
+	"@geekmidas/client": "~10.0.0-alpha.61",
+	"@geekmidas/cloud": "~10.0.0-alpha.61",
+	"@geekmidas/constructs": "~10.0.0-alpha.61",
+	"@geekmidas/db": "~10.0.0-alpha.61",
+	"@geekmidas/emailkit": "~10.0.0-alpha.61",
+	"@geekmidas/envkit": "~10.0.0-alpha.61",
+	"@geekmidas/errors": "~10.0.0-alpha.61",
+	"@geekmidas/events": "~10.0.0-alpha.61",
+	"@geekmidas/logger": "~10.0.0-alpha.61",
+	"@geekmidas/manifest": "~10.0.0-alpha.61",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.61",
+	"@geekmidas/schema": "~10.0.0-alpha.61",
+	"@geekmidas/services": "~10.0.0-alpha.61",
+	"@geekmidas/storage": "~10.0.0-alpha.61",
+	"@geekmidas/telescope": "~10.0.0-alpha.61",
+	"@geekmidas/testkit": "~10.0.0-alpha.61",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -10837,7 +12392,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await import("./migrate-B_6KofUo.mjs");
+	const { migrateAndSeed } = await import("./migrate-5_J5JySj.mjs");
 	const { discover } = await import("./discover-FrYvzkeC.mjs").then((n) => n.n);
 	const sources = {};
 	const manifest = await discover({
@@ -11268,7 +12823,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-B_6KofUo.mjs");
+		const { migrateCommand } = await import("./migrate-5_J5JySj.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11282,7 +12837,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await import("./migrate-B_6KofUo.mjs");
+		const { seedCommand } = await import("./migrate-5_J5JySj.mjs");
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11296,7 +12851,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-B_6KofUo.mjs");
+		const { migrationCommand } = await import("./migrate-5_J5JySj.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -11341,6 +12896,16 @@ program.command("docker").description("Generate Docker deployment files").option
 		process.exit(1);
 	}
 });
+program.command("compose").description("Run the workspace's APIs and sites for a stage as one Docker Compose stack behind Caddy").option("--stage <stage>", "Stage to run (default: the local stage)").option("--tag <tag>", "Run the images CI pushed at this tag (sites: <tag>-<stage>); nothing is built").option("--build", "Build images from this checkout, tagged with the commit").option("--pull", "Pull images (at --tag, or latest) rather than build them").option("--dry-run", "Write the files and print the plan; start nothing").option("--down", "Stop the stage's stack (its volumes are kept)").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		await composeCommand(options);
+	} catch (error) {
+		console.error(formatError(error));
+		process.exit(1);
+	}
+});
 program.command("prepack").description("Generate Docker files for production deployment").option("--build", "Build Docker image after generating files").option("--push", "Push image to registry after building").option("--tag <tag>", "Image tag", "latest").option("--registry <registry>", "Container registry URL").option("--slim", "Build locally first, then use slim Dockerfile").option("--skip-bundle", "Skip bundling step (only with --slim)").option("--turbo", "Use turbo prune for monorepo optimization").option("--turbo-package <name>", "Package name for turbo prune").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
@@ -11394,7 +12959,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await import("./encryption-aDA2AzVx.mjs");
+		const { encryptionRotateCommand } = await import("./encryption-DaA9gRXr.mjs");
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11405,7 +12970,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await import("./encryption-aDA2AzVx.mjs");
+		const { encryptionRetireCommand } = await import("./encryption-DaA9gRXr.mjs");
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11457,7 +13022,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./sniffer-BM8fpCas.mjs").then((n) => n.A);
+		const { derivedContainers } = await import("./sniffer-bdleks5l.mjs").then((n) => n.q);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -11472,7 +13037,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 	}
 });
 program.command("deploy").description("Deploy application to a provider").requiredOption("--provider <provider>", "Deploy provider (docker, dokploy, aws-lambda)").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp)").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").action(async (options) => {
-	const { deployCli } = await import("./cli-DzR1hpum.mjs");
+	const { deployCli } = await import("./cli-DEA_J3Sa.mjs");
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: resolve(globalOptions.cwd ?? process.cwd()),
@@ -11639,6 +13204,6 @@ program.command("upgrade").description("Upgrade @geekmidas/cli (with --all, ever
 });
 program.parse();
 //#endregion
-export { formatError as i, slug as n, stamp as r, generateFullstackCustomSecrets as t };
+export { DuplicateMigration as _, KyselyNotFound as a, NoOwnerCredential as c, UnknownDatabaseFolder as d, UnknownMigrationFolder as f, seedDatabases as g, pendingMigrations as h, formatError as i, NoSuchMigrationTarget as l, migrateDatabases as m, slug as n, MigrationFailed as o, migrateAndSeed as p, stamp as r, MigrationsOutsideFolder as s, generateFullstackCustomSecrets as t, SeedFailed as u, MigrationHasNoUp as v, SeedHasNoSeed as y };
 
 //# sourceMappingURL=index.mjs.map