@geekmidas/cli 10.0.0-alpha.60 → 10.0.0-alpha.61

package/dist/index.cjs

@@ -1,18 +1,19 @@
 #!/usr/bin/env -S npx tsx
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
-const require_sniffer = require("./sniffer-DIv12ncU.cjs");
+const require_sniffer = require("./sniffer-CQmJnNJM.cjs");
 const require_discover = require("./discover-Bc-4eA_p.cjs");
 const require_config = require("./config-DXnkCEq0.cjs");
 const require_workspace = require("./workspace-B64Xk1Mb.cjs");
 const require_storage = require("./storage-CSGoC3bK.cjs");
 const require_store = require("./store-KvNQwYaB.cjs");
-const require_OpenApiTsGenerator = require("./OpenApiTsGenerator-BTuUumsV.cjs");
+const require_OpenApiTsGenerator = require("./OpenApiTsGenerator-BSrgw7B0.cjs");
 const require_openapi = require("./openapi.cjs");
+const require_fakes = require("./fakes-zW-jNAbQ.cjs");
 const require_appPorts = require("./appPorts-Cu79hJF6.cjs");
-const require_ready = require("./ready-CCLIAkwR.cjs");
+const require_ready = require("./ready-XlNx-Gbo.cjs");
 const require_emit = require("./emit-Dmc1nvdS.cjs");
-const require_LocalStateStore = require("./LocalStateStore-Dpuqka1N.cjs");
+const require_LocalStateStore = require("./LocalStateStore-DHj_-CQB.cjs");
 let node_path = require("node:path");
 let commander = require("commander");
 let node_fs = require("node:fs");
@@ -29,6 +30,8 @@ chokidar = require_rolldown_runtime.__toESM(chokidar, 1);
 let node_net = require("node:net");
 let node_crypto = require("node:crypto");
 let node_url = require("node:url");
+let pg = require("pg");
+pg = require_rolldown_runtime.__toESM(pg, 1);
 let yaml = require("yaml");
 let prompts = require("prompts");
 prompts = require_rolldown_runtime.__toESM(prompts, 1);
@@ -44,7 +47,7 @@ let _geekmidas_constructs_functions = require("@geekmidas/constructs/functions")
 let _geekmidas_constructs_queue = require("@geekmidas/constructs/queue");
 let _geekmidas_constructs_topic = require("@geekmidas/constructs/topic");
 //#region package.json
-var version = "10.0.0-alpha.60";
+var version = "10.0.0-alpha.61";
 //#endregion
 //#region src/trust/index.ts
 /**
@@ -61,7 +64,7 @@ var version = "10.0.0-alpha.60";
 * worse trade than one that tells you what to type. Caddy's own `caddy trust`
 * draws the line in the same place.
 */
-const logger$7 = console;
+const logger$8 = console;
 const run = (0, node_util.promisify)(node_child_process.execFile);
 /**
 * How each platform is told about a new authority.
@@ -113,15 +116,15 @@ async function trustCommand(options = {}) {
 	const certificate = (0, node_path.join)(workspace.root, require_sniffer.LOCAL_CA_PATH);
 	if (!(0, node_fs.existsSync)(certificate)) throw new NoLocalAuthority(certificate);
 	const { describe, asks, steps } = installation(process.platform, certificate);
-	logger$7.log(`\n🔐 Trusting the local authority in ${describe}`);
-	logger$7.log(`   ${certificate}\n`);
+	logger$8.log(`\n🔐 Trusting the local authority in ${describe}`);
+	logger$8.log(`   ${certificate}\n`);
 	if (options.dryRun) {
-		for (const [command, args] of steps) logger$7.log(`   ${command} ${args.join(" ")}`);
+		for (const [command, args] of steps) logger$8.log(`   ${command} ${args.join(" ")}`);
 		return;
 	}
-	logger$7.log(`   ${asks}\n`);
+	logger$8.log(`   ${asks}\n`);
 	for (const [command, args] of steps) await run(command, args, { stdio: "inherit" });
-	logger$7.log("\n✅ Local https addresses are trusted. Restart your browser.\n");
+	logger$8.log("\n✅ Local https addresses are trusted. Restart your browser.\n");
 }
 /**
 * Trust the authority if this machine lacks it and its owner agrees.
@@ -138,7 +141,7 @@ async function ensureTrusted(root, url, options = {}) {
 	if (await isTrusted(url)) return;
 	if (!options.assumeYes) {
 		if (!process.stdin.isTTY) {
-			logger$7.log("   Local https addresses are not trusted here. Run \"gkm trust\", or \"gkm setup --yes\".");
+			logger$8.log("   Local https addresses are not trusted here. Run \"gkm trust\", or \"gkm setup --yes\".");
 			return;
 		}
 		if (await declined(root)) return;
@@ -150,7 +153,7 @@ async function ensureTrusted(root, url, options = {}) {
 		});
 		if (!install) {
 			await recordDeclined(root);
-			logger$7.log("   Skipped. Run \"gkm trust\" later.");
+			logger$8.log("   Skipped. Run \"gkm trust\" later.");
 			return;
 		}
 	}
@@ -1315,7 +1318,7 @@ function closeFakes(served) {
 }
 //#endregion
 //#region src/exec/index.ts
-const logger$6 = console;
+const logger$7 = console;
 /** `gkm exec` was given nothing to run. */
 var NoCommandSpecified = class extends Error {
 	constructor() {
@@ -1338,17 +1341,17 @@ async function execCommand(commandArgs, options = {}) {
 	const cwd = options.cwd ?? process.cwd();
 	if (!commandArgs[0]) throw new NoCommandSpecified();
 	const defaultEnv = require_sniffer.loadEnvFiles(".env");
-	if (defaultEnv.loaded.length > 0) logger$6.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	if (defaultEnv.loaded.length > 0) logger$7.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
 	const { credentials, secretsJsonPath, appName } = await require_sniffer.prepareEntryCredentials({ cwd });
-	if (appName) logger$6.log(`📦 App: ${appName}`);
+	if (appName) logger$7.log(`📦 App: ${appName}`);
 	const secretCount = Object.keys(credentials).filter((k) => k !== "PORT").length;
-	if (secretCount > 0) logger$6.log(`🔐 Loaded ${secretCount} secret(s)`);
+	if (secretCount > 0) logger$7.log(`🔐 Loaded ${secretCount} secret(s)`);
 	const preloadDir = (0, node_path.join)(cwd, ".gkm");
 	await (0, node_fs_promises.mkdir)(preloadDir, { recursive: true });
 	const preloadPath = (0, node_path.join)(preloadDir, "credentials-preload.mjs");
 	await require_sniffer.createCredentialsPreload(preloadPath, secretsJsonPath);
 	const [cmd, ...args] = commandArgs;
-	logger$6.log(`🚀 Running: ${[cmd, ...args].join(" ")}`);
+	logger$7.log(`🚀 Running: ${[cmd, ...args].join(" ")}`);
 	const nodeOptions = [(process.env.NODE_OPTIONS ?? "").replace(/--import[= ]\S+/g, "").trim(), `--import=${preloadPath}`].filter(Boolean).join(" ");
 	const child = (0, node_child_process.spawn)(cmd, args, {
 		cwd,
@@ -1362,7 +1365,7 @@ async function execCommand(commandArgs, options = {}) {
 	const exitCode = await new Promise((resolve) => {
 		child.on("close", (code) => resolve(code ?? 0));
 		child.on("error", (error) => {
-			logger$6.error(`Failed to run command: ${error.message}`);
+			logger$7.error(`Failed to run command: ${error.message}`);
 			resolve(1);
 		});
 	});
@@ -1370,7 +1373,7 @@ async function execCommand(commandArgs, options = {}) {
 }
 //#endregion
 //#region src/dev/index.ts
-const logger$5 = console;
+const logger$6 = console;
 /**
 * Normalize telescope configuration
 * @internal Exported for testing
@@ -1440,13 +1443,13 @@ async function devCommand(options) {
 	if (options.subscribers === false) process.env[SUBSCRIBERS_ENV] = "off";
 	if (options.entry) return entryDevCommand(options);
 	const defaultEnv = require_sniffer.loadEnvFiles(".env");
-	if (defaultEnv.loaded.length > 0) logger$5.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	if (defaultEnv.loaded.length > 0) logger$6.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
 	const appConfig = await require_config.loadAppConfig().catch((error) => {
 		if (error instanceof require_config.NotInAnApp || error instanceof require_config.NotABackendApp) return;
 		throw error;
 	});
 	if (!appConfig) {
-		logger$5.log("🔎 Reading gkm.config.ts and the constructs");
+		logger$6.log("🔎 Reading gkm.config.ts and the constructs");
 		const { workspace: everything } = await require_config.loadWorkspaceConfig();
 		return workspaceDevCommand(everything, options);
 	}
@@ -1459,12 +1462,12 @@ async function devCommand(options) {
 		holder: require_appPorts.holderOf
 	});
 	if (assigned.running.length > 0) throw new WorkspacePortsInUse(assigned.running);
-	for (const { app, from, to, holder } of assigned.moved) logger$5.log(`↪️  ${app}: ${from} is held by ${require_appPorts.describeHolder(holder)}, which is not this workspace's — using ${to}`);
+	for (const { app, from, to, holder } of assigned.moved) logger$6.log(`↪️  ${app}: ${from} is held by ${require_appPorts.describeHolder(holder)}, which is not this workspace's — using ${to}`);
 	const workspace = require_appPorts.withAppPorts(appConfig.workspace, assigned.ports);
 	const workspaceAppPort = assigned.ports[workspaceAppName] ?? appConfig.app.port;
 	process.env[require_appPorts.APP_TAG_ENV] = require_appPorts.appTag(appConfig.workspaceRoot, workspaceAppName);
 	if (appConfig.app.entry) {
-		logger$5.log(`📄 Using entry point: ${appConfig.app.entry}`);
+		logger$6.log(`📄 Using entry point: ${appConfig.app.entry}`);
 		return entryDevCommand({
 			...options,
 			entry: appConfig.app.entry,
@@ -1474,8 +1477,8 @@ async function devCommand(options) {
 	}
 	if (config.env) {
 		const { loaded, missing } = require_sniffer.loadEnvFiles(config.env, appRoot);
-		if (loaded.length > 0) logger$5.log(`📦 Loaded env: ${loaded.join(", ")}`);
-		if (missing.length > 0) logger$5.warn(`⚠️  Missing env files: ${missing.join(", ")}`);
+		if (loaded.length > 0) logger$6.log(`📦 Loaded env: ${loaded.join(", ")}`);
+		if (missing.length > 0) logger$6.warn(`⚠️  Missing env files: ${missing.join(", ")}`);
 	}
 	const telescope = normalizeTelescopeConfig(config.telescope);
 	const hooks = normalizeHooksConfig(config.hooks, appRoot);
@@ -1494,7 +1497,7 @@ async function devCommand(options) {
 		bustCache,
 		serveEmpty: true
 	}));
-	logger$5.log(`🔨 Building ${workspaceAppName ?? "the app"}`);
+	logger$6.log(`🔨 Building ${workspaceAppName ?? "the app"}`);
 	const initial = await build();
 	const runtime = config.runtime ?? "node";
 	let secretsJsonPath;
@@ -1505,11 +1508,11 @@ async function devCommand(options) {
 		const reconciled = await require_sniffer.reconcileWorkspace(workspace, {
 			stage: workspace.stages.local,
 			...options.fake ? { fake: true } : {},
-			progress: (message) => logger$5.log(message)
+			progress: (message) => logger$6.log(message)
 		});
 		if (reconciled.services.length > 0) {
-			logger$5.log("🐳 Services");
-			for (const line of require_sniffer.describeServices(reconciled.services)) logger$5.log(line);
+			logger$6.log("🐳 Services");
+			for (const line of require_sniffer.describeServices(reconciled.services)) logger$6.log(line);
 		}
 		Object.assign(appSecrets, reconciled.env);
 		const own = reconciled.plan.resources.find((r) => (r.kind === "rest-api" || r.kind === "site") && require_config.appKey(r.id) === workspaceAppName);
@@ -1576,11 +1579,11 @@ async function devCommand(options) {
 		cwd: appRoot
 	});
 	watcher.on("error", (error) => {
-		logger$5.error("❌ Watcher error:", error);
+		logger$6.error("❌ Watcher error:", error);
 	});
 	let rebuildTimeout = null;
 	watcher.on("change", async (path) => {
-		logger$5.log(`🔄 ${path} changed — rebuilding`);
+		logger$6.log(`🔄 ${path} changed — rebuilding`);
 		if (rebuildTimeout) clearTimeout(rebuildTimeout);
 		rebuildTimeout = setTimeout(async () => {
 			try {
@@ -1589,8 +1592,8 @@ async function devCommand(options) {
 				await devServer.restart();
 			} catch (error) {
 				const err = error;
-				logger$5.error(`❌ Rebuild failed: ${err.message}`);
-				if (err.stack) logger$5.error(err.stack);
+				logger$6.error(`❌ Rebuild failed: ${err.message}`);
+				if (err.stack) logger$6.error(err.stack);
 			}
 		}, 300);
 	});
@@ -1598,13 +1601,13 @@ async function devCommand(options) {
 	const shutdown = () => {
 		if (isShuttingDown) return;
 		isShuttingDown = true;
-		logger$5.log("\n🛑 Shutting down...");
+		logger$6.log("\n🛑 Shutting down...");
 		Promise.all([
 			watcher.close(),
 			devServer.stop(),
 			discovery.leave()
 		]).catch((err) => {
-			logger$5.error("Error during shutdown:", err);
+			logger$6.error("Error during shutdown:", err);
 		}).finally(() => {
 			process.exit(0);
 		});
@@ -1808,13 +1811,13 @@ async function workspaceDevCommand(configured, options) {
 		holder: require_appPorts.holderOf
 	});
 	if (assigned.running.length > 0) throw new WorkspacePortsInUse(assigned.running);
-	for (const { app, from, to, holder } of assigned.moved) logger$5.log(`↪️  ${app}: ${from} is held by ${require_appPorts.describeHolder(holder)}, which is not this workspace's — using ${to}`);
+	for (const { app, from, to, holder } of assigned.moved) logger$6.log(`↪️  ${app}: ${from} is held by ${require_appPorts.describeHolder(holder)}, which is not this workspace's — using ${to}`);
 	const workspace = require_appPorts.withAppPorts(configured, assigned.ports);
 	const appCount = Object.keys(workspace.apps).length;
 	const frontendApps = Object.entries(workspace.apps).filter(([_, app]) => app.type === "web");
 	const conflicts = checkPortConflicts(workspace);
 	if (conflicts.length > 0) {
-		for (const conflict of conflicts) logger$5.error(`❌ Port conflict: Apps "${conflict.app1}" and "${conflict.app2}" both use port ${conflict.port}`);
+		for (const conflict of conflicts) logger$6.error(`❌ Port conflict: Apps "${conflict.app1}" and "${conflict.app2}" both use port ${conflict.port}`);
 		throw new Error("Port conflicts detected. Please assign unique ports to each app.");
 	}
 	if (frontendApps.length > 0) {
@@ -1823,10 +1826,10 @@ async function workspaceDevCommand(configured, options) {
 		for (const result of validationResults) {
 			if (!result.valid) {
 				hasErrors = true;
-				logger$5.error(`\n❌ Frontend app "${result.appName}" validation failed:`);
-				for (const error of result.errors) logger$5.error(`   • ${error}`);
+				logger$6.error(`\n❌ Frontend app "${result.appName}" validation failed:`);
+				for (const error of result.errors) logger$6.error(`   • ${error}`);
 			}
-			for (const warning of result.warnings) logger$5.warn(`   ⚠️  ${result.appName}: ${warning}`);
+			for (const warning of result.warnings) logger$6.warn(`   ⚠️  ${result.appName}: ${warning}`);
 		}
 		if (hasErrors) throw new Error("Frontend app validation failed. Fix the issues above and try again.");
 	}
@@ -1834,24 +1837,24 @@ async function workspaceDevCommand(configured, options) {
 	const reconciled = await require_sniffer.reconcileWorkspace(workspace, {
 		stage: workspace.stages.local,
 		...options.fake ? { fake: true } : {},
-		progress: (message) => logger$5.log(message)
+		progress: (message) => logger$6.log(message)
 	});
 	if (reconciled.services.length > 0) {
-		logger$5.log("🐳 Services");
-		for (const line of require_sniffer.describeServices(reconciled.services)) logger$5.log(line);
+		logger$6.log("🐳 Services");
+		for (const line of require_sniffer.describeServices(reconciled.services)) logger$6.log(line);
 	}
 	const secretsEnv = {
 		...rawSecrets,
 		...reconciled.env
 	};
 	const fakes = options.fake ? await serveFakes(reconciled.fakes, reconciled.ports) : [];
-	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
-	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
+	for (const { id, port } of fakes) logger$6.log(`🎭 ${id} fake: http://localhost:${port}`);
+	logger$6.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-BTqIflwc.cjs"));
+		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-BScRpCEx.cjs"));
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await Promise.resolve().then(() => require("./migrate-BTqIflwc.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
-		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
+	} else await Promise.resolve().then(() => require("./migrate-BScRpCEx.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+		logger$6.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
 	for (const resource of reconciled.plan.resources) {
@@ -1872,11 +1875,11 @@ async function workspaceDevCommand(configured, options) {
 	else {
 		const { filters, unpackaged } = turboFilters(workspace);
 		turboFilter = filters.flatMap((name) => ["--filter", name]);
-		if (unpackaged.length > 0) logger$5.warn(`⚠️  No package.json with a name for: ${unpackaged.join(", ")} — turbo cannot run ${unpackaged.length === 1 ? "it" : "them"}.`);
+		if (unpackaged.length > 0) logger$6.warn(`⚠️  No package.json with a name for: ${unpackaged.join(", ")} — turbo cannot run ${unpackaged.length === 1 ? "it" : "them"}.`);
 	}
 	const buildOrder = require_workspace.getAppBuildOrder(workspace);
 	const width = Math.max(...buildOrder.map((name) => name.length));
-	logger$5.log(`\n${workspace.name}: ${appCount} app(s)`);
+	logger$6.log(`\n${workspace.name}: ${appCount} app(s)`);
 	for (const appName of buildOrder) {
 		const app = workspace.apps[appName];
 		if (!app) continue;
@@ -1884,14 +1887,14 @@ async function workspaceDevCommand(configured, options) {
 			const own = reconciled.plan.resources.find((r) => r.kind === "mobile-app" && require_config.appKey(r.id) === appName);
 			const scheme = own ? reconciled.env[own.envKey] : void 0;
 			const device = Object.entries(reconciled.env).find(([key]) => key.endsWith("_DEVICE_URL"))?.[1];
-			logger$5.log(`   ${appName.padEnd(width)}  ${scheme ? `${scheme}://` : "mobile"}${device ? ` — devices reach ${new URL(device).hostname}` : ""}`);
+			logger$6.log(`   ${appName.padEnd(width)}  ${scheme ? `${scheme}://` : "mobile"}${device ? ` — devices reach ${new URL(device).hostname}` : ""}`);
 			continue;
 		}
 		const local = `http://localhost:${app.port}`;
 		const url = Object.entries(appUrls).find(([id]) => require_config.appKey(id) === appName)?.[1];
-		logger$5.log(`   ${appName.padEnd(width)}  ${url ? `${url} -> ${local}` : local}`);
+		logger$6.log(`   ${appName.padEnd(width)}  ${url ? `${url} -> ${local}` : local}`);
 	}
-	logger$5.log("");
+	logger$6.log("");
 	const configFiles = [
 		"gkm.config.ts",
 		"gkm.config.js",
@@ -1939,7 +1942,7 @@ async function workspaceDevCommand(configured, options) {
 		...options.fake ? { [require_sniffer.FAKE_ENV]: "1" } : {},
 		[DISCOVERY_QUIET_ENV]: "1"
 	};
-	logger$5.log(`🚀 Starting ${appCount} app(s) — each builds before it answers, and says so when it is ready`);
+	logger$6.log(`🚀 Starting ${appCount} app(s) — each builds before it answers, and says so when it is ready`);
 	const turboProcess = (0, node_child_process.spawn)("pnpm", [
 		"turbo",
 		"run",
@@ -1955,7 +1958,7 @@ async function workspaceDevCommand(configured, options) {
 	const shutdown = () => {
 		if (isShuttingDown) return;
 		isShuttingDown = true;
-		logger$5.log("\n🛑 Shutting down workspace...");
+		logger$6.log("\n🛑 Shutting down workspace...");
 		closeFakes(fakes);
 		discovery.leave();
 		const pid = turboProcess.pid;
@@ -1981,7 +1984,7 @@ async function workspaceDevCommand(configured, options) {
 	process.on("SIGTERM", shutdown);
 	return new Promise((resolve, reject) => {
 		turboProcess.on("error", (error) => {
-			logger$5.error("❌ Turbo error:", error);
+			logger$6.error("❌ Turbo error:", error);
 			reject(error);
 		});
 		turboProcess.on("exit", (code) => {
@@ -2000,11 +2003,11 @@ async function entryDevCommand(options) {
 	const entryPath = (0, node_path.resolve)(process.cwd(), entry);
 	if (!(0, node_fs.existsSync)(entryPath)) throw new Error(`Entry file not found: ${entryPath}`);
 	const defaultEnv = require_sniffer.loadEnvFiles(".env");
-	if (defaultEnv.loaded.length > 0) logger$5.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	if (defaultEnv.loaded.length > 0) logger$6.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
 	const { credentials, resolvedPort, secretsJsonPath, appName } = await require_sniffer.prepareEntryCredentials({ explicitPort: options.portExplicit ? options.port : void 0 });
-	if (appName) logger$5.log(`📦 App: ${appName} (port ${resolvedPort})`);
-	logger$5.log(`🚀 Starting entry file: ${entry} on port ${resolvedPort}`);
-	if (Object.keys(credentials).length > 1) logger$5.log(`🔐 Loaded ${Object.keys(credentials).length - 1} secret(s) + PORT`);
+	if (appName) logger$6.log(`📦 App: ${appName} (port ${resolvedPort})`);
+	logger$6.log(`🚀 Starting entry file: ${entry} on port ${resolvedPort}`);
+	if (Object.keys(credentials).length > 1) logger$6.log(`🔐 Loaded ${Object.keys(credentials).length - 1} secret(s) + PORT`);
 	const wrapperDir = (0, node_path.join)(process.cwd(), ".gkm");
 	await (0, node_fs_promises.mkdir)(wrapperDir, { recursive: true });
 	const wrapperPath = (0, node_path.join)(wrapperDir, "entry-wrapper.ts");
@@ -2015,7 +2018,7 @@ async function entryDevCommand(options) {
 	const shutdown = () => {
 		if (isShuttingDown) return;
 		isShuttingDown = true;
-		logger$5.log("\n🛑 Shutting down...");
+		logger$6.log("\n🛑 Shutting down...");
 		runner.stop();
 		process.exit(0);
 	};
@@ -2051,14 +2054,14 @@ var EntryRunner = class {
 			});
 			let restartTimeout = null;
 			this.watcher.on("change", (path) => {
-				logger$5.log(`📝 File changed: ${path}`);
+				logger$6.log(`📝 File changed: ${path}`);
 				if (restartTimeout) clearTimeout(restartTimeout);
 				restartTimeout = setTimeout(async () => {
-					logger$5.log("🔄 Restarting...");
+					logger$6.log("🔄 Restarting...");
 					await this.restart();
 				}, 300);
 			});
-			logger$5.log(`👀 Watching for changes in: ${watchDir}`);
+			logger$6.log(`👀 Watching for changes in: ${watchDir}`);
 		}
 	}
 	async runProcess() {
@@ -2074,17 +2077,17 @@ var EntryRunner = class {
 		});
 		this.isRunning = true;
 		this.childProcess.on("error", (error) => {
-			logger$5.error("❌ Process error:", error);
+			logger$6.error("❌ Process error:", error);
 		});
 		this.childProcess.on("exit", (code) => {
-			if (code !== null && code !== 0 && code !== 143) logger$5.error(`❌ Process exited with code ${code}`);
+			if (code !== null && code !== 0 && code !== 143) logger$6.error(`❌ Process exited with code ${code}`);
 			this.isRunning = false;
 		});
 		await new Promise((resolve) => setTimeout(resolve, 500));
 		if (this.isRunning) {
-			logger$5.log("");
-			logger$5.log(`  \x1b[32m✓ Ready\x1b[0m at \x1b[36mhttp://localhost:${this.port}\x1b[0m`);
-			logger$5.log("");
+			logger$6.log("");
+			logger$6.log(`  \x1b[32m✓ Ready\x1b[0m at \x1b[36mhttp://localhost:${this.port}\x1b[0m`);
+			logger$6.log("");
 		}
 	}
 	async restart() {
@@ -2203,7 +2206,7 @@ start({
 * lets a console read what this machine is running.
 */
 function announce(discovery) {
-	logger$5.log(`🧭 Discovery: ${discovery.connectUrl}`);
+	logger$6.log(`🧭 Discovery: ${discovery.connectUrl}`);
 }
 /** Run `fn` with `console.log` muted — warnings and errors still print. */
 async function quietly(fn) {
@@ -2321,7 +2324,7 @@ var DevServer = class {
 			this.actualPort = this.requestedPort;
 		} else {
 			this.actualPort = await require_sniffer.findAvailablePort(this.requestedPort);
-			if (this.actualPort !== this.requestedPort) logger$5.log(`ℹ️  Port ${this.requestedPort} was in use, using port ${this.actualPort} instead`);
+			if (this.actualPort !== this.requestedPort) logger$6.log(`ℹ️  Port ${this.requestedPort} was in use, using port ${this.actualPort} instead`);
 		}
 		const serverEntryPath = (0, node_path.join)(this.appRoot, ".gkm", "server", "server.ts");
 		await this.createServerEntry();
@@ -2341,11 +2344,11 @@ var DevServer = class {
 		});
 		this.isRunning = true;
 		this.serverProcess.on("error", (error) => {
-			logger$5.error("❌ Server error:", error);
+			logger$6.error("❌ Server error:", error);
 		});
 		const child = this.serverProcess;
 		child.on("exit", (code, signal) => {
-			if (code !== null && code !== 0 && signal !== "SIGTERM") logger$5.error(`❌ Server exited with code ${code}`);
+			if (code !== null && code !== 0 && signal !== "SIGTERM") logger$6.error(`❌ Server exited with code ${code}`);
 			this.isRunning = false;
 			if (this.serverProcess === child) this.onStatus?.("stopped");
 		});
@@ -2354,13 +2357,13 @@ var DevServer = class {
 			const local = `http://localhost:${this.actualPort}`;
 			const address = this.publicUrl ? `${this.publicUrl} -> ${local}` : local;
 			const seconds = ((Date.now() - this.startTime) / 1e3).toFixed(1);
-			logger$5.log(`\x1b[32m✓\x1b[0m ${this.label} ready in ${seconds}s  ${address}`);
+			logger$6.log(`\x1b[32m✓\x1b[0m ${this.label} ready in ${seconds}s  ${address}`);
 			const tools = this.selfServing ? [] : [
 				...this.enableOpenApi ? ["docs /__docs"] : [],
 				...this.telescope ? [`telescope ${this.telescope.path}`] : [],
 				...this.databaseApi ? [`db ${this.databaseApi}`] : []
 			];
-			if (tools.length > 0) logger$5.log(`  ${tools.join(" · ")}`);
+			if (tools.length > 0) logger$6.log(`  ${tools.join(" · ")}`);
 			this.onStatus?.("ready");
 		}
 	}
@@ -3000,9 +3003,63 @@ export const { app } = await surface.server({ envParser, context: snifferContext
 export default app;
 `);
 }
+/**
+* The production server for a surface that serves itself.
+*
+* `app.ts` exports the construct's own Hono app and starts nothing, which is
+* what `gkm dev` wants: its server mounts the app beside its tools. An image
+* needs a process, so a production build starts one here — the health check
+* every image is probed on, the surface behind it, and the same bounded drain
+* on SIGTERM the generated route servers have. Without it an auth server had
+* no bundle to put in an image at all.
+*/
+async function writeSurfaceServer(outputDir, options) {
+	await (0, node_fs_promises.mkdir)(outputDir, { recursive: true });
+	const shutdown = options.gracefulShutdown ? `
+// Stop taking requests, let in-flight ones finish, then close what the
+// construct opened — bounded by GKM_SHUTDOWN_TIMEOUT_MS, under Docker's 10s
+// stop timeout, so the process exits on its own terms.
+let shuttingDown = false;
+const shutdown = async () => {
+  if (shuttingDown) return;
+  shuttingDown = true;
+  const deadline = Number(process.env.GKM_SHUTDOWN_TIMEOUT_MS) || 8000;
+  setTimeout(() => process.exit(1), deadline).unref();
+  await new Promise<void>((resolve) => server.close(() => resolve()));
+  await runShutdownHooks((error) => console.error(error));
+  process.exit(0);
+};
+
+process.on('SIGTERM', shutdown);
+process.on('SIGINT', shutdown);
+` : "";
+	const path = (0, node_path.join)(outputDir, "server.ts");
+	await (0, node_fs_promises.writeFile)(path, `#!/usr/bin/env node
+/**
+ * Production server for a surface that serves itself.
+ * Generated by 'gkm build --production'.
+ */
+import { serve } from '@hono/node-server';
+import { Hono } from 'hono';
+${options.gracefulShutdown ? "import { runShutdownHooks } from '@geekmidas/constructs';\n" : ""}import { app as surface } from './app.js';
+
+const port = Number(process.env.PORT) || 3000;
+
+const app = new Hono();
+// First, so a probe is answered without reaching the surface's own routes.
+app.get(${JSON.stringify(options.healthCheck)}, (c) =>
+  c.json({ status: 'ok', timestamp: Date.now() }),
+);
+app.route('/', surface);
+
+const server = serve({ fetch: app.fetch, port });
+console.log(JSON.stringify({ msg: 'Production server started', port }));
+${shutdown}`);
+	return path;
+}
 //#endregion
 //#region src/build/index.ts
-const logger$4 = console;
+const logger$5 = console;
 /**
 * Where `gkm build --stage` leaves the key its bundle's secrets were encrypted
 * with, beside the bundle in `.gkm/server/` and readable by its owner alone.
@@ -3050,7 +3107,7 @@ async function buildCommand(options) {
 		const isAtWorkspaceRoot = cwd === workspaceRoot;
 		const someAppIsElsewhere = Object.values(loadedConfig.workspace.apps).some((app) => (0, node_path.resolve)(workspaceRoot, app.path) !== workspaceRoot);
 		if (isAtWorkspaceRoot && someAppIsElsewhere) {
-			logger$4.log("📦 Detected workspace configuration");
+			logger$5.log("📦 Detected workspace configuration");
 			return workspaceBuildCommand(loadedConfig.workspace, options);
 		}
 	}
@@ -3096,13 +3153,13 @@ async function buildOneApp(input) {
 	const { config, options, workspace, appRoot, target } = input;
 	const cacheBackend = require_sniffer.cacheBackendFor(require_sniffer.providerOf(workspace));
 	const production = normalizeProductionConfig(options.production ?? false);
-	if (production) logger$4.log(`🏭 Building for PRODUCTION`);
-	logger$4.log(`Building for ${target}`);
-	logger$4.log(`Loading constructs from: ${formatRoutes(config.constructs)}`);
+	if (production) logger$5.log(`🏭 Building for PRODUCTION`);
+	logger$5.log(`Building for ${target}`);
+	logger$5.log(`Loading constructs from: ${formatRoutes(config.constructs)}`);
 	const telescope = production ? void 0 : normalizeTelescopeConfig(config.telescope);
-	if (telescope) logger$4.log(`🔭 Telescope enabled at ${telescope.path}`);
+	if (telescope) logger$5.log(`🔭 Telescope enabled at ${telescope.path}`);
 	const hooks = normalizeHooksConfig(config.hooks, appRoot);
-	if (hooks) logger$4.log(`🪝 Server hooks enabled`);
+	if (hooks) logger$5.log(`🪝 Server hooks enabled`);
 	return buildApp({
 		config,
 		workspaceRoot: workspace.root,
@@ -3144,7 +3201,7 @@ async function writeManifest(input) {
 	});
 	const path = (0, node_path.join)(manifestDir, `${target}.ts`);
 	await (0, node_fs_promises.writeFile)(path, require_emit.manifestModule(folded, backends));
-	logger$4.log(`Manifest: ${(0, node_path.relative)(process.cwd(), path)}`);
+	logger$5.log(`Manifest: ${(0, node_path.relative)(process.cwd(), path)}`);
 }
 /**
 * Turn one app's constructs into its generated entry.
@@ -3172,7 +3229,21 @@ async function buildApp(input) {
 	});
 	if (selfServing) {
 		await writeSurfaceEntry((0, node_path.join)(appRoot, ".gkm", "server"), selfServing.source);
-		logger$4.log(`Generated a server for ${selfServing.id} from its own declaration`);
+		logger$5.log(`Generated a server for ${selfServing.id} from its own declaration`);
+		if (production?.bundle && !input.skipBundle) {
+			const outputDir = (0, node_path.join)(appRoot, ".gkm", "server");
+			const entryPoint = await writeSurfaceServer(outputDir, production);
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-DXATpO1T.cjs"));
+			await bundleServer({
+				entryPoint,
+				outputDir: (0, node_path.join)(outputDir, "dist"),
+				minify: production.minify,
+				sourcemap: false,
+				external: production.external,
+				...input.stage ? { stage: input.stage } : {}
+			});
+			logger$5.log(`✅ Bundle complete: .gkm/server/dist/server.mjs`);
+		}
 		return { selfServing: selfServing.id };
 	}
 	const derived = ownersContext({
@@ -3217,14 +3288,14 @@ async function buildApp(input) {
 		topicGenerator.load(code, appRoot, bustCache)
 	]);
 	const allEndpoints = servedBy(loadedEndpoints, derived.surface);
-	logger$4.log(`Found ${allEndpoints.length} endpoints`);
-	logger$4.log(`Found ${allFunctions.length} functions`);
-	logger$4.log(`Found ${allCrons.length} crons`);
-	logger$4.log(`Found ${allSubscribers.length} subscribers`);
-	logger$4.log(`Found ${allQueues.length} queues`);
-	logger$4.log(`Found ${allTopics.length} topics`);
+	logger$5.log(`Found ${allEndpoints.length} endpoints`);
+	logger$5.log(`Found ${allFunctions.length} functions`);
+	logger$5.log(`Found ${allCrons.length} crons`);
+	logger$5.log(`Found ${allSubscribers.length} subscribers`);
+	logger$5.log(`Found ${allQueues.length} queues`);
+	logger$5.log(`Found ${allTopics.length} topics`);
 	if (!input.serveEmpty && allEndpoints.length === 0 && allFunctions.length === 0 && allCrons.length === 0 && allSubscribers.length === 0 && allQueues.length === 0 && allTopics.length === 0) {
-		logger$4.log("No endpoints, functions, crons, subscribers, queues, or topics found to process");
+		logger$5.log("No endpoints, functions, crons, subscribers, queues, or topics found to process");
 		return {};
 	}
 	if (production?.subscribers === "include" && derived.surface) {
@@ -3237,7 +3308,7 @@ async function buildApp(input) {
 			[allQueues.length, "queue consumer"],
 			[allSubscribers.length, "subscriber"]
 		].filter(([n]) => n > 0).map(([n, what]) => `${n} ${what}${n === 1 ? "" : "s"}`);
-		if (left.length > 0) logger$4.log(`Serving ${derived.surface.id} only: leaving out ${left.join(", ")} — they run in a Worker's image`);
+		if (left.length > 0) logger$5.log(`Serving ${derived.surface.id} only: leaving out ${left.join(", ")} — they run in a Worker's image`);
 	}
 	const result = await buildForTarget(target, buildContext, appRoot, workspaceRoot, endpointGenerator, functionGenerator, cronGenerator, subscriberGenerator, queueGenerator, topicGenerator, allEndpoints, allFunctions, allCrons, allSubscribers, allQueues, allTopics, enableOpenApi, input.skipBundle ?? false, input.stage);
 	await require_openapi.generateOpenApi(allEndpoints.map(({ construct }) => construct), {
@@ -3260,7 +3331,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		force: true
 	});
 	await (0, node_fs_promises.mkdir)(outputDir, { recursive: true });
-	logger$4.log(`\nGenerating handlers for ${target}`);
+	logger$5.log(`\nGenerating handlers for ${target}`);
 	const options = {
 		target,
 		root: workspaceRoot
@@ -3276,7 +3347,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		queueGenerator.build(context, queues, outputDir, options),
 		topicGenerator.build(context, topics, outputDir, options)
 	]);
-	logger$4.log(`Generated ${routes.length} routes, ${functionInfos.length} functions, ${cronInfos.length} crons, ${subscriberInfos.length} subscribers, ${queueInfos.length} queues, ${topicInfos.length} topics for ${target}`);
+	logger$5.log(`Generated ${routes.length} routes, ${functionInfos.length} functions, ${cronInfos.length} crons, ${subscriberInfos.length} subscribers, ${queueInfos.length} queues, ${topicInfos.length} topics for ${target}`);
 	const fields = {
 		...context.surface ? { surface: context.surface.id } : {},
 		functions: functionInfos,
@@ -3299,8 +3370,8 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		};
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
-			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-CzXZPSBJ.cjs"));
+			logger$5.log(`\n📦 Bundling production server...`);
+			const { bundleServer } = await Promise.resolve().then(() => require("./bundler-DXATpO1T.cjs"));
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -3317,13 +3388,13 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 				stage,
 				constructs: allConstructs
 			})).masterKey;
-			logger$4.log(`✅ Bundle complete: .gkm/server/dist/server.mjs`);
+			logger$5.log(`✅ Bundle complete: .gkm/server/dist/server.mjs`);
 			if (masterKey) {
 				const keyPath = (0, node_path.join)(outputDir, MASTER_KEY_FILE);
 				await (0, node_fs_promises.writeFile)(keyPath, `${masterKey}\n`, { mode: 384 });
 				await (0, node_fs_promises.chmod)(keyPath, 384);
-				logger$4.log(`\n🔐 Secrets encrypted for deployment`);
-				logger$4.log(`   Run with GKM_MASTER_KEY set to the key in ${(0, node_path.relative)(appRoot, keyPath)} (fingerprint ${require_sniffer.keyFingerprint(masterKey)})`);
+				logger$5.log(`\n🔐 Secrets encrypted for deployment`);
+				logger$5.log(`   Run with GKM_MASTER_KEY set to the key in ${(0, node_path.relative)(appRoot, keyPath)} (fingerprint ${require_sniffer.keyFingerprint(masterKey)})`);
 			}
 		}
 		return {
@@ -3424,12 +3495,12 @@ async function workspaceBuildCommand(workspace, options) {
 	const apps = Object.entries(workspace.apps);
 	const backendApps = apps.filter(([, app]) => app.type === "backend");
 	const frontendApps = apps.filter(([, app]) => app.type === "web");
-	logger$4.log(`\n🏗️  Building workspace: ${workspace.name}`);
-	logger$4.log(`   Backend apps: ${backendApps.map(([name]) => name).join(", ") || "none"}`);
-	logger$4.log(`   Frontend apps: ${frontendApps.map(([name]) => name).join(", ") || "none"}`);
-	if (options.production) logger$4.log(`   🏭 Production mode enabled`);
+	logger$5.log(`\n🏗️  Building workspace: ${workspace.name}`);
+	logger$5.log(`   Backend apps: ${backendApps.map(([name]) => name).join(", ") || "none"}`);
+	logger$5.log(`   Frontend apps: ${frontendApps.map(([name]) => name).join(", ") || "none"}`);
+	if (options.production) logger$5.log(`   🏭 Production mode enabled`);
 	const buildOrder = require_workspace.getAppBuildOrder(workspace);
-	logger$4.log(`   Build order: ${buildOrder.join(" → ")}`);
+	logger$5.log(`   Build order: ${buildOrder.join(" → ")}`);
 	try {
 		const target = options.provider ?? require_sniffer.providerOf(workspace);
 		const builds = [];
@@ -3437,7 +3508,7 @@ async function workspaceBuildCommand(workspace, options) {
 			const app = workspace.apps[appName];
 			const config = require_workspace.getAppGkmConfig(workspace, appName);
 			if (!app || app.type !== "backend" || !config) continue;
-			logger$4.log(`\n⚙️  ${appName}`);
+			logger$5.log(`\n⚙️  ${appName}`);
 			const output = await buildOneApp({
 				config,
 				options,
@@ -3462,8 +3533,8 @@ async function workspaceBuildCommand(workspace, options) {
 		const pm = detectPackageManager$1();
 		const [turboBin, turboArgs] = getTurboArgs(pm, filters, { only: true });
 		if (filters.length > 0) {
-			logger$4.log(`\n📦 Using ${pm} with Turbo for the other apps...\n`);
-			logger$4.log(`Running: ${[turboBin, ...turboArgs].join(" ")}`);
+			logger$5.log(`\n📦 Using ${pm} with Turbo for the other apps...\n`);
+			logger$5.log(`Running: ${[turboBin, ...turboArgs].join(" ")}`);
 			await require_sniffer.run(turboBin, turboArgs, {
 				cwd: workspace.root,
 				env: {
@@ -3481,15 +3552,15 @@ async function workspaceBuildCommand(workspace, options) {
 				outputPath
 			});
 		}
-		logger$4.log(`\n✅ Workspace build complete!`);
-		logger$4.log(`\n📋 Build Summary:`);
+		logger$5.log(`\n✅ Workspace build complete!`);
+		logger$5.log(`\n📋 Build Summary:`);
 		for (const result of results) {
 			const icon = result.type === "backend" ? "⚙️" : result.type === "mobile" ? "📱" : "🌐";
-			logger$4.log(`   ${icon} ${result.appName}: ${result.outputPath || "built"}`);
+			logger$5.log(`   ${icon} ${result.appName}: ${result.outputPath || "built"}`);
 		}
 	} catch (error) {
 		const errorMessage = error instanceof Error ? error.message : "Build failed";
-		logger$4.log(`\n❌ Build failed: ${errorMessage}`);
+		logger$5.log(`\n❌ Build failed: ${errorMessage}`);
 		for (const [appName, app] of apps) results.push({
 			appName,
 			type: app.type,
@@ -3518,6 +3589,1491 @@ function getAppOutputPath(workspace, _appName, app) {
 function formatRoutes(routes) {
 	return Array.isArray(routes) ? routes.join(", ") : routes;
 }
+//#endregion
+//#region src/migrate/provider.ts
+/**
+* One construct's migrations and seeds, read from its folders.
+*
+* Two kinds of file, told apart by extension rather than by configuration: a
+* script exports `up` (and may export `down`) — or `seed(db, { stage })`, in
+* `seeds/` — and a
+* `.sql` file is run whole. The second is what makes a folder independent of
+* the client the app uses — Better Auth's schema is SQL whatever the
+* application queries with.
+*/
+const SCRIPTS = /* @__PURE__ */ new Set([
+	".ts",
+	".mts",
+	".js",
+	".mjs"
+]);
+/** Two files in one folder that would be one migration. */
+var DuplicateMigration = class extends Error {
+	folder;
+	migration;
+	constructor(folder, migration) {
+		super(`${folder} has two migrations named '${migration}' — a script and a .sql file with the same name. A migration is recorded by name, so only one of them could ever run; rename or remove the other.`);
+		this.folder = folder;
+		this.migration = migration;
+		this.name = "DuplicateMigration";
+	}
+};
+/** A script in a migrations folder that exports no `up`. */
+var MigrationHasNoUp = class extends Error {
+	file;
+	constructor(file) {
+		super(`${file} is in a migrations folder but exports no \`up\` function. Export \`async function up(db: Kysely<unknown>)\`, or move the file out of the folder if it is not a migration.`);
+		this.file = file;
+		this.name = "MigrationHasNoUp";
+	}
+};
+/** A script in a seeds folder that exports no `seed`. */
+var SeedHasNoSeed = class extends Error {
+	file;
+	constructor(file) {
+		super(`${file} is in a seeds folder but exports no \`seed\` function. Export \`async function seed(db, { stage })\`, or move the file out of the folder if it is not a seed.`);
+		this.file = file;
+		this.name = "SeedHasNoSeed";
+	}
+};
+/**
+* The migration files in a folder, by name, without reading them.
+*
+* Also what `gkm dev` compares against a construct's history to report what
+* is pending, which is why it is separate from loading them.
+*/
+async function migrationFiles(folder) {
+	const entries = await (0, node_fs_promises.readdir)(folder, { withFileTypes: true }).catch((error) => {
+		if (error.code === "ENOENT") return [];
+		throw error;
+	});
+	const files = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		if (!entry.isFile() || !isMigration(entry.name)) continue;
+		const name = entry.name.slice(0, -(0, node_path.extname)(entry.name).length);
+		if (files.has(name)) throw new DuplicateMigration(folder, name);
+		files.set(name, (0, node_path.join)(folder, entry.name));
+	}
+	return files;
+}
+/** A Kysely provider over one construct's folder. */
+function folderProvider(folder, raw) {
+	return { async getMigrations() {
+		const migrations = {};
+		for (const [name, file] of await migrationFiles(folder)) migrations[name] = (0, node_path.extname)(file) === ".sql" ? await sqlMigration(file, raw) : await scriptMigration(file);
+		return migrations;
+	} };
+}
+/**
+* The seeds in a folder, loaded, in name order.
+*
+* Every one runs on every pass — there is no history to consult — so the order
+* is the only thing between two seeds where one reads what another writes.
+* Name them to sort that way.
+*/
+async function loadSeeds(folder, raw) {
+	const files = [...await migrationFiles(folder)].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+	const seeds = [];
+	for (const [name, file] of files) seeds.push({
+		name,
+		run: (0, node_path.extname)(file) === ".sql" ? (await sqlMigration(file, raw)).up : await scriptSeed(file)
+	});
+	return seeds;
+}
+/**
+* A seed script, imported as it is on disk now.
+*
+* Keyed by its modification time: a seed is run again after it is edited, and
+* a process that has imported it once would otherwise run the old one.
+*/
+async function scriptSeed(file) {
+	const url = (0, node_url.pathToFileURL)(file);
+	url.searchParams.set("mtime", String((await (0, node_fs_promises.stat)(file)).mtimeMs));
+	const module = await import(url.href);
+	if (typeof module.seed !== "function") throw new SeedHasNoSeed(file);
+	return module.seed;
+}
+function isMigration(file) {
+	if (file.endsWith(".d.ts")) return false;
+	if (/\.(spec|test)\.[cm]?[jt]s$/.test(file)) return false;
+	const extension = (0, node_path.extname)(file);
+	return extension === ".sql" || SCRIPTS.has(extension);
+}
+async function scriptMigration(file) {
+	const module = await import((0, node_url.pathToFileURL)(file).href);
+	if (typeof module.up !== "function") throw new MigrationHasNoUp(file);
+	return {
+		up: module.up,
+		...typeof module.down === "function" ? { down: module.down } : {}
+	};
+}
+/**
+* A `.sql` file, run whole.
+*
+* One query rather than split on `;`: with no parameters, Postgres takes
+* several statements in one message, and splitting by hand breaks on the first
+* `;` inside a string or a function body. There is no `down` — a generated
+* schema is rolled back by a migration that says how, not by guessing.
+*/
+async function sqlMigration(file, raw) {
+	const statements = await (0, node_fs_promises.readFile)(file, "utf-8");
+	return { up: async (db) => {
+		await raw.raw(statements).execute(db);
+	} };
+}
+//#endregion
+//#region src/migrate/databases.ts
+/**
+* Bring each construct's schema up to its migrations folder.
+*
+* Which constructs, in what order, from which folder, is `migrationTargets`'
+* answer and nobody else's. What is decided here is only how one target is
+* run: as its owner, in its own schema, with a history of its own.
+*/
+/** A folder under `db/` that names no construct. */
+var UnknownMigrationFolder = class extends Error {
+	folder;
+	known;
+	constructor(folder, known) {
+		super(`${folder} names no database construct, so its migrations would never run. ${known.length > 0 ? `The folders that do: ${known.join(", ")}.` : "This project declares no database."} Rename the folder after the construct it belongs to.`);
+		this.folder = folder;
+		this.known = known;
+		this.name = "UnknownMigrationFolder";
+	}
+};
+/** A construct was asked for by a name that takes no migrations. */
+var NoSuchMigrationTarget = class extends Error {
+	construct;
+	known;
+	constructor(construct, known) {
+		super(`'${construct}' is not a database construct. ` + (known.length > 0 ? `The ones with migrations: ${known.join(", ")}.` : "This project declares no database."));
+		this.construct = construct;
+		this.known = known;
+		this.name = "NoSuchMigrationTarget";
+	}
+};
+/**
+* A migration left directly in a construct's folder, where nothing reads it.
+*
+* Migrations moved into `migrations/` so seeds could sit beside them. A file
+* still at the old level would otherwise never run, and nothing would say so.
+*/
+var MigrationsOutsideFolder = class extends Error {
+	folder;
+	files;
+	constructor(folder, files) {
+		super(`${folder} has ${files.join(", ")} directly inside it, where nothing runs them. Migrations live in ${folder}/migrations/ and seeds in ${folder}/seeds/ — move ${files.length === 1 ? "it" : "them"} there.`);
+		this.folder = folder;
+		this.files = files;
+		this.name = "MigrationsOutsideFolder";
+	}
+};
+/** A folder inside a construct's folder that is neither `migrations` nor `seeds`. */
+var UnknownDatabaseFolder = class extends Error {
+	folder;
+	constructor(folder) {
+		super(`${folder} is neither migrations/ nor seeds/, so nothing in it would ever run. A construct's folder holds those two; rename or remove it.`);
+		this.folder = folder;
+		this.name = "UnknownDatabaseFolder";
+	}
+};
+/** A seed failed; its own writes are rolled back, the ones before it stay. */
+var SeedFailed = class extends Error {
+	construct;
+	seed;
+	cause;
+	constructor(construct, seed, cause) {
+		super(`${construct}: seed '${seed}' failed — ${cause instanceof Error ? cause.message : String(cause)}. Its writes were rolled back; fix it and run it again.`);
+		this.construct = construct;
+		this.seed = seed;
+		this.cause = cause;
+		this.name = "SeedFailed";
+	}
+};
+/** A construct with roles has no owner URL to migrate with. */
+var NoOwnerCredential = class extends Error {
+	construct;
+	key;
+	constructor(construct, key) {
+		super(`${construct} has no ${key} to migrate with. Migrations run as the owner role — the runtime one cannot create a table — and nothing resolved its URL. Is the stage reconciled?`);
+		this.construct = construct;
+		this.key = key;
+		this.name = "NoOwnerCredential";
+	}
+};
+/** A migration failed; the ones before it in the run stay applied. */
+var MigrationFailed = class extends Error {
+	construct;
+	migration;
+	cause;
+	constructor(construct, migration, cause) {
+		super(`${construct}: migration ${migration ? `'${migration}' ` : ""}failed — ${cause instanceof Error ? cause.message : String(cause)}`);
+		this.construct = construct;
+		this.migration = migration;
+		this.cause = cause;
+		this.name = "MigrationFailed";
+	}
+};
+/** The project's Kysely could not be found from where a database is declared. */
+var KyselyNotFound = class extends Error {
+	from;
+	constructor(from) {
+		super(`Could not resolve 'kysely' from ${from}. Migrations run with the project's own Kysely — install it where the database is declared.`);
+		this.from = from;
+		this.name = "KyselyNotFound";
+	}
+};
+/** Apply every pending migration, construct by construct, parents first. */
+async function migrateDatabases(options) {
+	const runs = [];
+	for (const target of await targetsFor(options)) {
+		if ((await migrationFiles((0, node_path.join)(options.root, target.migrations))).size === 0) {
+			runs.push({
+				target,
+				applied: []
+			});
+			continue;
+		}
+		const applied = await withMigrator(options, target, async (migrator) => {
+			const { error, results = [] } = await migrator.migrateToLatest();
+			if (error) {
+				const failed = results.find((result) => result.status === "Error");
+				throw new MigrationFailed(target.id, failed?.migrationName, error);
+			}
+			return results.filter((result) => result.status === "Success").map((result) => result.migrationName);
+		});
+		runs.push({
+			target,
+			applied
+		});
+	}
+	return runs;
+}
+/**
+* Run every construct's seeds, parents first — each one, every time, on every
+* stage, production included. Each is handed the stage, so a seed decides
+* what belongs where.
+*
+* Seeds are reference data kept up to date by being run again, so there is no
+* history: a seed is an upsert, and a changed one is applied by the next run.
+* Each runs in its own transaction, as the construct's owner, so a failure
+* leaves nothing half-written. Assumes the schema is migrated —
+* {@link migrateAndSeed} is what makes that true.
+*/
+async function seedDatabases(options) {
+	const runs = [];
+	for (const target of await targetsFor(options)) {
+		const folder = (0, node_path.join)(options.root, target.seeds);
+		if ((await migrationFiles(folder)).size === 0) {
+			runs.push({
+				target,
+				seeded: []
+			});
+			continue;
+		}
+		const seeded = await withOwner(options, target, async (db, kysely) => {
+			const names = [];
+			for (const seed of await loadSeeds(folder, kysely.sql)) {
+				try {
+					await db.transaction().execute((trx) => seed.run(trx, { stage: options.stage }));
+				} catch (error) {
+					throw new SeedFailed(target.id, seed.name, error);
+				}
+				names.push(seed.name);
+			}
+			return names;
+		});
+		runs.push({
+			target,
+			seeded
+		});
+	}
+	return runs;
+}
+/**
+* Migrate, then seed: a seed only ever runs against the schema it was written
+* for.
+*
+* With `only`, the constructs it lives in are migrated too — a tenant's seed
+* cannot run before the database that owns its schema exists — and only it is
+* seeded.
+*/
+async function migrateAndSeed(options) {
+	const migrations = [];
+	for (const target of await withParents(options)) migrations.push(...await migrateDatabases({
+		...options,
+		only: target.id
+	}));
+	return {
+		migrations,
+		seeds: await seedDatabases(options)
+	};
+}
+/** The targets `only` names, after the ones it lives in; all without it. */
+async function withParents(options) {
+	const chosen = await targetsFor(options);
+	if (!options.only) return chosen;
+	const all = (0, _geekmidas_manifest.migrationTargets)(options.manifest);
+	const ids = /* @__PURE__ */ new Set();
+	for (const target of chosen) {
+		let current = target;
+		while (current) {
+			ids.add(current.id);
+			const parent = current.of;
+			current = parent ? all.find((t) => t.id === parent) : void 0;
+		}
+	}
+	return all.filter((target) => ids.has(target.id));
+}
+/**
+* What each construct's folder has that its history does not — without
+* applying any of it. What `gkm dev` reports.
+*/
+async function pendingMigrations(options) {
+	const found = [];
+	for (const target of await targetsFor(options)) {
+		if ((await migrationFiles((0, node_path.join)(options.root, target.migrations))).size === 0) continue;
+		const pending = await withMigrator(options, target, async (migrator) => (await migrator.getMigrations()).filter((migration) => migration.executedAt === void 0).map((migration) => migration.name));
+		if (pending.length > 0) found.push({
+			target,
+			pending
+		});
+	}
+	return found;
+}
+/**
+* The targets this run covers, with every folder under `db/` accounted for.
+*
+* A folder that names no construct is an error rather than something to skip:
+* a typo in its name is otherwise a migration that silently never runs.
+*/
+async function targetsFor(options) {
+	const targets = (0, _geekmidas_manifest.migrationTargets)(options.manifest);
+	const folders = targets.map((target) => target.folder);
+	for (const folder of await foldersIn((0, node_path.join)(options.root, _geekmidas_manifest.MIGRATIONS_ROOT))) {
+		const relative = `${_geekmidas_manifest.MIGRATIONS_ROOT}/${folder}`;
+		if (!folders.includes(relative)) throw new UnknownMigrationFolder(relative, folders);
+		await checkLayout(options.root, relative);
+	}
+	if (!options.only) return targets;
+	const id = (0, _geekmidas_manifest.canonicalId)(options.only);
+	const chosen = targets.filter((target) => target.id === id);
+	if (chosen.length === 0) throw new NoSuchMigrationTarget(options.only, targets.map((target) => target.id));
+	return chosen;
+}
+/**
+* A construct's folder holds `migrations/` and `seeds/`, and nothing else —
+* anything beside them is a file or folder nothing would ever run.
+*/
+async function checkLayout(root, folder) {
+	const entries = await (0, node_fs_promises.readdir)((0, node_path.join)(root, folder), { withFileTypes: true });
+	const loose = entries.filter((entry) => entry.isFile() && !entry.name.startsWith(".")).map((entry) => entry.name);
+	if (loose.length > 0) throw new MigrationsOutsideFolder(folder, loose);
+	for (const entry of entries) if (entry.isDirectory() && !_geekmidas_manifest.DATABASE_FOLDERS.includes(entry.name)) throw new UnknownDatabaseFolder(`${folder}/${entry.name}`);
+}
+async function foldersIn(dir) {
+	return (await (0, node_fs_promises.readdir)(dir, { withFileTypes: true }).catch((error) => {
+		if (error.code === "ENOENT") return [];
+		throw error;
+	})).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+}
+/**
+* A migrator for one target, connected as its owner.
+*
+* No `migrationTableSchema`: the owner role's `search_path` is pinned to the
+* construct's schema, so the history lands there — `app.kysely_migration` for
+* the database, `auth_database.kysely_migration` for its tenant — and two
+* constructs in one Postgres never share one.
+*
+* Unordered migrations are allowed. Files are timestamped, so a branch merged
+* after another's migration ran carries an older one; refusing it would make
+* every such merge a manual repair.
+*/
+async function withMigrator(options, target, run) {
+	return withOwner(options, target, (db, { Migrator, sql }) => run(new Migrator({
+		db,
+		provider: folderProvider((0, node_path.join)(options.root, target.migrations), sql),
+		allowUnorderedMigrations: true
+	})));
+}
+/**
+* One target's database, connected as its owner and closed afterwards — what
+* migrations and seeds both run as.
+*/
+async function withOwner(options, target, run) {
+	const kysely = await kyselyFrom(options.sources?.[target.id]?.file ?? (target.of ? options.sources?.[target.of]?.file : void 0) ?? (0, node_path.join)(options.root, "package.json"));
+	const db = new kysely.Kysely({ dialect: new kysely.PostgresDialect({ pool: new pg.default.Pool(poolConfig(ownerUrl(options, target))) }) });
+	try {
+		return await run(db, kysely);
+	} finally {
+		await db.destroy();
+	}
+}
+/**
+* The owner's URL, with no fallback to the runtime one.
+*
+* The runtime role can create nothing, so falling back would only move the
+* failure to the first `CREATE TABLE` and make it read like a permissions
+* bug. The one exception is a database declared `roles: false`, where there is
+* no owner — both URLs are the master credential by design.
+*/
+function ownerUrl(options, target) {
+	const key = (0, _geekmidas_manifest.provideKey)(target.id, "ownerUrl");
+	const owner = options.env[key];
+	if (owner) return owner;
+	const database = options.manifest[target.of ?? target.id];
+	if (database?.kind === "database" && database.roles === false) {
+		const url = options.env[(0, _geekmidas_manifest.provideKey)(target.id, "url")];
+		if (url) return url;
+	}
+	throw new NoOwnerCredential(target.id, key);
+}
+/**
+* Pool settings for a URL, with `?search_path=` as the startup option Postgres
+* reads. Only a `roles: false` URL carries it — a role pins its own.
+*/
+function poolConfig(url) {
+	const parsed = new URL(url);
+	const searchPath = parsed.searchParams.get("search_path");
+	if (!searchPath) return { connectionString: url };
+	parsed.searchParams.delete("search_path");
+	return {
+		connectionString: parsed.toString(),
+		options: `-c search_path=${searchPath}`
+	};
+}
+/** Kysely as the project resolves it from `from`. */
+async function kyselyFrom(from) {
+	const require$2 = (0, node_module.createRequire)(from);
+	try {
+		const [main, migration] = await Promise.all([import((0, node_url.pathToFileURL)(require$2.resolve("kysely")).href), import((0, node_url.pathToFileURL)(require$2.resolve("kysely/migration")).href)]);
+		return {
+			Kysely: main.Kysely,
+			PostgresDialect: main.PostgresDialect,
+			sql: main.sql,
+			Migrator: migration.Migrator
+		};
+	} catch {
+		throw new KyselyNotFound(from);
+	}
+}
+//#endregion
+//#region src/compose/docker.ts
+/**
+* The Docker operations `gkm compose` needs, behind an interface.
+*
+* Small on purpose, like reconcile's: the rules about *when* each runs — the
+* registry is asked before anything is pulled, nothing is started for a tag
+* that is missing — are asserted against a fake, and this file is only the
+* wiring to the real CLI.
+*
+* Every call is an argument array. Image refs, tags and paths come from the
+* workspace, and none of them reaches a shell.
+*/
+/** How long a stack has to pass its health checks. */
+const WAIT_TIMEOUT_S = 180;
+/** `docker compose port` printed nothing a port can be read from. */
+var ServicePortUnknown = class extends Error {
+	service;
+	inside;
+	output;
+	constructor(service, inside, output) {
+		super(`'${service}' publishes no host port for ${inside} (docker said: ${output.trim() || "nothing"}). Is it running? \`docker compose ps\` shows the stack.`);
+		this.service = service;
+		this.inside = inside;
+		this.output = output;
+		this.name = "ServicePortUnknown";
+	}
+};
+function compose(stack, args) {
+	return [
+		"compose",
+		"-p",
+		stack.project,
+		"-f",
+		stack.file,
+		...args
+	];
+}
+/** Run a program and keep everything it said, whatever it exits with. */
+function capture(command, args, timeoutMs = 6e4) {
+	return new Promise((resolve, reject) => {
+		const child = (0, node_child_process.spawn)(command, [...args], {
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			shell: false
+		});
+		let stdout = "";
+		let stderr = "";
+		child.stdout.on("data", (chunk) => {
+			stdout += chunk.toString();
+		});
+		child.stderr.on("data", (chunk) => {
+			stderr += chunk.toString();
+		});
+		const timer = setTimeout(() => child.kill("SIGKILL"), timeoutMs);
+		timer.unref?.();
+		child.on("error", (error) => {
+			clearTimeout(timer);
+			reject(error);
+		});
+		child.on("close", (code) => {
+			clearTimeout(timer);
+			resolve({
+				code,
+				stdout,
+				stderr
+			});
+		});
+	});
+}
+/**
+* Whether a failed `docker manifest inspect` means the tag is not there, as
+* opposed to the registry not answering.
+*
+* Read off the message because that is all the CLI gives. Anything not
+* recognisably "no such tag" is treated as the registry being unreachable:
+* a registry that refused credentials must not be reported as a tag that was
+* never pushed, or the fix offered would be the wrong one.
+*/
+function isMissingManifest(output) {
+	return /no such manifest|manifest unknown|manifest for .* not found|not found: manifest/i.test(output);
+}
+const dockerCompose = {
+	async lookup(ref) {
+		const { code, stdout, stderr } = await capture("docker", [
+			"manifest",
+			"inspect",
+			ref
+		]);
+		if (code === 0) return {
+			ref,
+			status: "found"
+		};
+		const output = `${stderr}\n${stdout}`.trim();
+		return isMissingManifest(output) ? {
+			ref,
+			status: "missing"
+		} : {
+			ref,
+			status: "unreachable",
+			detail: output
+		};
+	},
+	async build(stack, services) {
+		await require_sniffer.run("docker", compose(stack, ["build", ...services]), {
+			cwd: stack.cwd,
+			env: {
+				...process.env,
+				DOCKER_BUILDKIT: "1"
+			}
+		});
+	},
+	async pull(stack, services) {
+		await require_sniffer.run("docker", compose(stack, ["pull", ...services]), { cwd: stack.cwd });
+	},
+	async up(stack, services) {
+		await require_sniffer.run("docker", compose(stack, [
+			"up",
+			"-d",
+			"--wait",
+			`--wait-timeout=${WAIT_TIMEOUT_S}`,
+			...services ? [] : ["--remove-orphans"],
+			...services ?? []
+		]), { cwd: stack.cwd });
+	},
+	async down(stack) {
+		await require_sniffer.run("docker", compose(stack, ["down"]), { cwd: stack.cwd });
+	},
+	async port(stack, service, inside) {
+		const output = await require_sniffer.runOutput("docker", compose(stack, [
+			"port",
+			service,
+			String(inside)
+		]), { cwd: stack.cwd });
+		const port = Number(output.trim().split(":").pop());
+		if (!Number.isInteger(port) || port <= 0) throw new ServicePortUnknown(service, inside, output);
+		return port;
+	},
+	async copyOut(stack, service, from, to) {
+		await (0, node_fs_promises.mkdir)((0, node_path.dirname)(to), { recursive: true });
+		await require_sniffer.run("docker", compose(stack, [
+			"cp",
+			`${service}:${from}`,
+			to
+		]), { cwd: stack.cwd });
+	},
+	async digest(ref) {
+		const { code, stdout } = await capture("docker", [
+			"image",
+			"inspect",
+			"--format={{json .RepoDigests}} {{.Id}}",
+			ref
+		]);
+		if (code !== 0) return void 0;
+		const [json = "[]", id] = stdout.trim().split(" ");
+		const repository = ref.split("@")[0].replace(/:[\w][\w.-]*$/, "");
+		try {
+			const digests = JSON.parse(json);
+			const match = Array.isArray(digests) ? digests.find((entry) => typeof entry === "string" && entry.startsWith(`${repository}@`)) : void 0;
+			if (match) return match.slice(repository.length + 1);
+		} catch {}
+		return id || void 0;
+	}
+};
+//#endregion
+//#region src/compose/images.ts
+/**
+* The tag a site's image carries for a release.
+*
+* A site's public URLs are inlined when it is built, so one bundle serves one
+* stage: `v1.4.0-production` and `v1.4.0-staging` are two images of the same
+* commit. A backend reads its URLs at runtime, so one image serves every stage
+* and its tag is the release's alone.
+*/
+function siteTag(tag, stage) {
+	return `${tag}-${stage}`;
+}
+/** Images a tag names that the registry does not have. */
+var ImageTagNotFound = class extends Error {
+	tag;
+	refs;
+	constructor(tag, refs) {
+		super(`The registry has no image for ${refs.length === 1 ? "this app" : `${refs.length} apps`} at '${tag}':\n` + refs.map((ref) => `  - ${ref}`).join("\n") + `\nNothing was pulled or started. Push '${tag}' for every app from CI, pick a tag that exists, or run without --tag to build from this checkout.`);
+		this.tag = tag;
+		this.refs = refs;
+		this.name = "ImageTagNotFound";
+	}
+};
+/** The registry did not answer, or did not let this machine in. */
+var RegistryUnreachable = class extends Error {
+	ref;
+	detail;
+	constructor(ref, detail) {
+		super(`Could not ask the registry about ${ref}: ${detail || "no answer"}\nNothing was pulled or started. Check the registry is reachable and that this machine is logged in to it (\`docker login <registry>\`).`);
+		this.ref = ref;
+		this.detail = detail;
+		this.name = "RegistryUnreachable";
+	}
+};
+/**
+* Assert every image exists, before anything else happens.
+*
+* Asked all at once and reported all at once: a release missing two images is
+* one problem with two names, and finding the second only after fixing the
+* first is a slower way to learn the same thing.
+*
+* @throws {RegistryUnreachable} when the registry cannot say
+* @throws {ImageTagNotFound} listing every missing image
+*/
+async function assertImagesExist(docker, tag, images) {
+	const lookups = await Promise.all(images.map((image) => docker.lookup(image.ref)));
+	const unreachable = lookups.find((lookup) => lookup.status === "unreachable");
+	if (unreachable?.status === "unreachable") throw new RegistryUnreachable(unreachable.ref, unreachable.detail);
+	const missing = lookups.filter((lookup) => lookup.status === "missing").map((lookup) => lookup.ref);
+	if (missing.length > 0) throw new ImageTagNotFound(tag, missing);
+}
+//#endregion
+//#region src/compose/caddyfile.ts
+/** The Caddyfile for a stack's edge. */
+function edgeCaddyfile(sites, options) {
+	const global = options.local ? `{
+	# No ACME and no public DNS: the CA is Caddy's own and the names resolve
+	# to this machine.
+	local_certs
+	auto_https disable_redirects
+}` : options.email ? `{
+	email ${options.email}
+}` : "";
+	const blocks = sites.map(({ host, upstream }) => `https://${host} {${options.local ? `
+	tls internal
+` : ""}
+	# Host and X-Forwarded-* are passed through as Caddy does by default, so
+	# an app builds redirects, cookies and links on the address a caller used.
+	reverse_proxy ${upstream} {
+		# Never buffer: a streamed response — server-sent events, a Next.js
+		# RSC payload — reaches the client as each chunk is written.
+		flush_interval -1
+	}
+}`);
+	return `${HEADER}${global ? `${global}\n\n` : ""}${blocks.join("\n\n")}\n`;
+}
+const HEADER = `# Generated by gkm compose from the construct manifest — do not edit.
+#
+# One host per API and site, each in front of its own container.
+`;
+//#endregion
+//#region src/compose/stack.ts
+/**
+* The stack a workspace runs as for one stage — pure.
+*
+* Everything `gkm compose` writes is decided here, as data: the compose file,
+* the Caddyfile, one env file per backend, and the image each app runs. The
+* command around it reads the workspace, asks the registry, writes the files
+* and starts Docker; none of those decide anything, so all of it can be
+* asserted without a daemon.
+*
+* The values come from the same derivations every other target uses. The
+* plan is reconcile's `planFor`, the keys an app reads are `appEnvKeys`, and
+* every URL is `envFor`'s — asked twice, once with each app at its public
+* address and once on the compose network, because a browser and a sibling
+* service reach the same API by different names.
+*/
+/** Where a stack's files are written, relative to the workspace root. */
+function stackDir(stage) {
+	return `.gkm/compose/${stage}`;
+}
+/**
+* The compose project a stage's stack runs as.
+*
+* The deploy identity's scope, so two workspaces with one name in different
+* namespaces never share containers or volumes — and the stage, so a
+* machine can run two stages side by side.
+*/
+function composeProject(identity) {
+	return `${identity.scope}-${identity.stage}`;
+}
+/** The ports the edge is published on, and the variables that move them. */
+const EDGE_PORT_ENV = {
+	https: "GKM_COMPOSE_HTTPS_PORT",
+	http: "GKM_COMPOSE_HTTP_PORT"
+};
+/**
+* Containers this target does not run.
+*
+* Object storage is the stage's own — an externally hosted bucket whose URL
+* the stage's secrets hold — and so is a deployed stage's mail. The AWS
+* emulator never applies: a stack is a server target, whose events are
+* pg-boss.
+*/
+const NOT_RUN = {
+	minio: true,
+	localstack: true,
+	caddy: true
+};
+/** Kinds whose `<ID>_URL` a stage must be given, because nothing here runs them. */
+const EXTERNAL_KINDS = {
+	objects: true,
+	"file-server": true
+};
+/** The S3 client's credentials, read beside a bucket's URL when it has them. */
+const STORAGE_KEYS = [
+	"AWS_ACCESS_KEY_ID",
+	"AWS_SECRET_ACCESS_KEY",
+	"AWS_REGION"
+];
+/** A bucket the stack needs and the stage was not given. */
+var BucketNotConfigured = class extends Error {
+	app;
+	id;
+	key;
+	stage;
+	constructor(app, id, key, stage) {
+		super(`'${app}' uses the bucket '${id}', and gkm compose runs no object storage: the stage needs an externally hosted bucket. Set its URL in the stage's secrets: gkm secrets:set ${key} 's3://…' --stage ${stage}`);
+		this.app = app;
+		this.id = id;
+		this.key = key;
+		this.stage = stage;
+		this.name = "BucketNotConfigured";
+	}
+};
+/** A value only the stage's secrets can hold, and they do not. */
+var StageSecretMissing = class extends Error {
+	app;
+	key;
+	stage;
+	constructor(app, key, stage) {
+		super(`'${app}' reads ${key}, and the stage '${stage}' has none. Nothing in the stack can derive it; set it in the stage's secrets: gkm secrets:set ${key} '…' --stage ${stage}`);
+		this.app = app;
+		this.key = key;
+		this.stage = stage;
+		this.name = "StageSecretMissing";
+	}
+};
+/** A deployed stage's secrets with no seed to derive its passwords from. */
+var StageSeedMissing = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`The stage '${stage}' has no seed in its secrets, and a deployed stage's database passwords are derived from it. Run gkm compose without --dry-run once, or gkm deploy, to generate it.`);
+		this.stage = stage;
+		this.name = "StageSeedMissing";
+	}
+};
+/** A workspace with no API and no site to run. */
+var NothingToCompose = class extends Error {
+	root;
+	constructor(root) {
+		super(`${root} declares no RestApi and no site, so a stack would run nothing. Workers and mobile apps are not run by gkm compose yet.`);
+		this.root = root;
+		this.name = "NothingToCompose";
+	}
+};
+/** A value that cannot be written to an env file a line at a time. */
+var EnvValueMultiline = class extends Error {
+	app;
+	key;
+	constructor(app, key) {
+		super(`${key} for '${app}' spans more than one line, and an env file holds one value per line. Store it on one line — base64, or JSON — and decode it where it is read.`);
+		this.app = app;
+		this.key = key;
+		this.name = "EnvValueMultiline";
+	}
+};
+/** The services a stack's apps wait on and the edge waits on in turn. */
+const HEALTHY = { condition: "service_healthy" };
+/**
+* An app's health check: its own server, asked on 127.0.0.1 — not
+* `localhost`, which resolves to `::1` first in an Alpine container while a
+* server may listen on IPv4 alone.
+*/
+function probe(port, path) {
+	return {
+		test: [
+			"CMD",
+			"wget",
+			"-q",
+			"-O",
+			"/dev/null",
+			`http://127.0.0.1:${port}${path}`
+		],
+		interval: "5s",
+		timeout: "3s",
+		retries: 20,
+		start_period: "10s"
+	};
+}
+/** The stack for one stage. */
+function composeStack(input) {
+	const { workspace, manifest, stage, identity } = input;
+	const local = stage === workspace.stages.local;
+	const project = composeProject(identity);
+	const custom = input.secrets?.custom ?? {};
+	const https = input.ports?.https ?? 443;
+	const http = input.ports?.http ?? 80;
+	const plan = require_sniffer.planFor(manifest, stage, (0, _geekmidas_manifest.provisionOrder)(manifest), {
+		localStage: workspace.stages.local,
+		events: require_fakes.DEFAULT_EVENTS.server,
+		cache: require_fakes.DEFAULT_CACHE.server,
+		edge: false
+	});
+	const byId = new Map(plan.resources.map((r) => [r.id, r]));
+	const seed = local ? void 0 : input.secrets?.seed;
+	if (!local && !seed) throw new StageSeedMissing(stage);
+	const credential = {
+		master: local ? "geekmidas" : require_sniffer.localRolePassword(workspace.name, plan, "master", seed),
+		...seed ? { seed } : {}
+	};
+	const infra = plan.containers.filter((c) => !NOT_RUN[c]).filter((c) => local || c !== "mailpit").sort();
+	const apps = stackApps(workspace, manifest, plan, {
+		local,
+		stage,
+		https,
+		identity,
+		images: input.images
+	});
+	if (apps.length === 0) throw new NothingToCompose(workspace.root);
+	const derivation = {
+		project: workspace.name,
+		master: credential.master,
+		...credential.seed ? { seed: credential.seed } : {}
+	};
+	const outside = require_sniffer.networkEnv(plan, {
+		...derivation,
+		addresses: Object.fromEntries(apps.map((app) => [app.id, app.url]))
+	});
+	const inside = require_sniffer.networkEnv(plan, {
+		...derivation,
+		addresses: Object.fromEntries(apps.map((app) => [app.id, `http://${app.name}:${app.port}`]))
+	});
+	const owners = /* @__PURE__ */ new Map();
+	for (const resource of plan.resources) {
+		owners.set(resource.envKey, resource);
+		if (resource.kind === "email") {
+			owners.set((0, _geekmidas_manifest.provideKey)(resource.id, "from"), resource);
+			owners.set((0, _geekmidas_manifest.provideKey)(resource.id, "inboxUrl"), resource);
+		}
+		if (resource.kind === "external-api") owners.set((0, _geekmidas_manifest.provideKey)(resource.id, "credentials"), resource);
+	}
+	const surfaceUrls = new Map(plan.resources.filter((r) => r.kind === "rest-api" || r.kind === "site").map((r) => [r.envKey, r.id]));
+	const appById = new Map(apps.map((app) => [app.id, app]));
+	/**
+	* What a key resolves to for one app, from the stage's secrets where only
+	* they can hold it, and the derivations otherwise.
+	*/
+	const valueFor = (app, key, owner) => {
+		if (owner && EXTERNAL_KINDS[owner.kind] && key === owner.envKey) {
+			const value = custom[key];
+			if (value === void 0) throw new BucketNotConfigured(app.name, owner.id, key, stage);
+			return value;
+		}
+		if (owner && suppliedBy(owner, key, local)) {
+			const value = custom[key];
+			if (value === void 0) throw new StageSecretMissing(app.name, key, stage);
+			return value;
+		}
+		if (custom[key] !== void 0) return custom[key];
+		const surface = surfaceUrls.get(key);
+		if (app.kind === "rest-api" && surface && surface !== app.id) return inside[key];
+		return outside[key];
+	};
+	for (const app of apps) {
+		if (app.kind === "site") {
+			const site = manifest[app.id];
+			if (site?.kind !== "site") continue;
+			const args = {};
+			for (const [key, source] of Object.entries((0, _geekmidas_manifest.publicEnvFor)(site, manifest))) {
+				const value = valueFor(app, source, owners.get(source));
+				if (value !== void 0) args[key] = value;
+			}
+			if (app.build && Object.keys(args).length > 0) app.build.args = args;
+			continue;
+		}
+		const keys = require_sniffer.appEnvKeys(manifest, app.name, input.runnables) ?? /* @__PURE__ */ new Set();
+		const values = {};
+		for (const key of [...keys].sort()) {
+			const owner = owners.get(key) ?? storageOwner(key, plan);
+			if (!local && owner?.kind === "email" && key.endsWith("_INBOX_URL")) continue;
+			if (STORAGE_KEYS.includes(key)) {
+				if (custom[key] !== void 0) values[key] = custom[key];
+				continue;
+			}
+			const value = valueFor(app, key, owner);
+			if (value !== void 0) values[key] = value;
+		}
+		const trusted = (0, _geekmidas_manifest.provideKey)(app.id, "trustedOrigins");
+		if (keys.has(trusted)) {
+			const internal = (byId.get(app.id)?.callers ?? []).map((caller) => appById.get(caller)).filter((caller) => caller?.kind === "rest-api").map((caller) => `http://${caller.name}:${caller.port}`);
+			const origins = [...(values[trusted] ?? "").split(",").filter(Boolean), ...internal];
+			values[trusted] = [...new Set(origins)].join(",");
+		}
+		app.env = {
+			...values,
+			NODE_ENV: "production",
+			PORT: String(app.port),
+			STAGE: stage
+		};
+		for (const [key, value] of Object.entries(app.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(app.name, key);
+	}
+	const compose = stackFile({
+		project,
+		plan,
+		infra,
+		apps,
+		master: credential.master,
+		https,
+		http
+	});
+	const caddyfile = edgeCaddyfile(apps.map((app) => ({
+		host: app.host,
+		upstream: `${app.name}:${app.port}`
+	})), { local });
+	const dockerfiles = {};
+	for (const app of apps) {
+		if (!app.build) continue;
+		dockerfiles[app.build.dockerfile] = app.kind === "site" ? require_sniffer.siteDockerfile(app.name, workspace.apps[app.name], {
+			turboPackage: input.packages?.[app.name] ?? app.name,
+			packageManager: input.packageManager ?? "pnpm",
+			manifest
+		}) : require_sniffer.generateSlimDockerfile({
+			imageName: app.name,
+			baseImage: "node:22-alpine",
+			port: app.port,
+			healthCheckPath: "/health",
+			prebuilt: true,
+			packageManager: input.packageManager ?? "pnpm",
+			bundle: `${app.path}/.gkm/server/dist/server.mjs`
+		});
+	}
+	return {
+		project,
+		stage,
+		local,
+		apps,
+		infra,
+		compose,
+		caddyfile,
+		dockerfiles,
+		plan,
+		credential
+	};
+	/** Whether only the stage's secrets can supply `key` to `owner`. */
+	function suppliedBy(owner, key, isLocal) {
+		if (owner.kind === "credential") return true;
+		if (owner.kind === "external-api") return key === (0, _geekmidas_manifest.provideKey)(owner.id, "credentials");
+		if (isLocal) return false;
+		if (owner.kind === "secret" || owner.kind === "encryption") return true;
+		return owner.kind === "email" && !key.endsWith("_INBOX_URL");
+	}
+}
+/** Which bucket an S3 credential key belongs to — the first one declared. */
+function storageOwner(key, plan) {
+	if (!STORAGE_KEYS.includes(key)) return void 0;
+	return plan.resources.find((r) => r.kind === "objects");
+}
+/** The apps a stack runs: every API and every site, at its stage address. */
+function stackApps(workspace, manifest, plan, options) {
+	const apps = [];
+	const resources = new Map(plan.resources.map((r) => [r.id, r]));
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration.kind !== "rest-api" && declaration.kind !== "site") continue;
+		const name = require_config.appKey(id);
+		const app = workspace.apps[name];
+		const resource = resources.get(id);
+		if (!app || !resource || !app.port) continue;
+		const host = hostOf(name, app, workspace, resource, options);
+		const tag = declaration.kind === "site" ? siteTag(options.images.tag, options.stage) : options.images.tag;
+		const ref = require_sniffer.validateImageRef(require_store.imageRef(options.identity, name, options.images.registry, tag));
+		apps.push({
+			app: name,
+			name,
+			id,
+			kind: declaration.kind,
+			path: app.path,
+			port: app.port,
+			host,
+			url: `https://${host}${options.local && options.https !== 443 ? `:${options.https}` : ""}`,
+			ref,
+			tag,
+			...options.images.mode === "build" ? { build: { dockerfile: `${stackDir(options.stage)}/Dockerfile.${name}` } } : {}
+		});
+	}
+	return apps.sort((a, b) => a.name.localeCompare(b.name));
+}
+/**
+* The host an app answers on for a stage: the `gkm dev` edge's
+* `*.localhost` names for the local stage, and the stage's domain — by the
+* same rule a deploy follows — for any other.
+*/
+function hostOf(name, app, workspace, resource, options) {
+	if (options.local) return require_sniffer.hostFor(resource, workspace.name);
+	return require_sniffer.resolveHost(name, app, options.stage, workspace.deploy?.domains, require_sniffer.isMainFrontendApp(name, app, workspace.apps));
+}
+/** The compose document: the infrastructure, the apps, and the edge. */
+function stackFile(options) {
+	const { project, plan, infra, apps } = options;
+	const derived = require_sniffer.composeFor({
+		...plan,
+		containers: [...infra]
+	}, {
+		project,
+		ports: Object.fromEntries(require_sniffer.portKeys(infra, plan.fakes).map((key) => [key, 0]))
+	});
+	const services = {};
+	const volumes = {
+		...derived.volumes,
+		"caddy-data": {},
+		"caddy-config": {}
+	};
+	for (const name of infra) {
+		const { ports: _ports, depends_on, profiles: _profiles, ...service } = derived.services[name];
+		services[name] = {
+			...service,
+			...depends_on?.length ? { depends_on: Object.fromEntries(depends_on.map((dep) => [dep, HEALTHY])) } : {}
+		};
+	}
+	const postgres = services.postgres;
+	if (postgres) {
+		postgres.environment = {
+			...postgres.environment,
+			POSTGRES_PASSWORD: options.master
+		};
+		postgres.ports = ["127.0.0.1::5432"];
+	}
+	for (const app of apps) services[app.name] = {
+		image: app.ref,
+		...app.build ? { build: {
+			context: "../../..",
+			dockerfile: app.build.dockerfile,
+			...app.build.args ? { args: app.build.args } : {}
+		} } : {},
+		restart: "unless-stopped",
+		...app.kind === "rest-api" ? {
+			env_file: [{
+				path: `./${app.name}.env`,
+				format: "raw"
+			}],
+			...infra.length ? { depends_on: Object.fromEntries(infra.map((name) => [name, HEALTHY])) } : {}
+		} : {},
+		healthcheck: probe(app.port, app.kind === "site" ? "/" : "/health")
+	};
+	services.caddy = {
+		image: require_sniffer.DEFAULT_IMAGES.caddy,
+		restart: "unless-stopped",
+		ports: [`${options.https}:443`, `${options.http}:80`],
+		volumes: [
+			"./Caddyfile:/etc/caddy/Caddyfile:ro",
+			"caddy-data:/data",
+			"caddy-config:/config"
+		],
+		depends_on: Object.fromEntries(apps.map((app) => [app.name, HEALTHY])),
+		healthcheck: {
+			test: [
+				"CMD",
+				"caddy",
+				"version"
+			],
+			interval: "10s",
+			timeout: "5s",
+			retries: 5
+		}
+	};
+	return {
+		name: project,
+		services,
+		volumes
+	};
+}
+/** Render an app's env file: one `KEY=value` per line, read raw by compose. */
+function envFile(env) {
+	return `${Object.entries(env).sort(([a], [b]) => a.localeCompare(b)).map(([key, value]) => `${key}=${value}`).join("\n")}\n`;
+}
+//#endregion
+//#region src/compose/index.ts
+/**
+* `gkm compose` — a workspace's APIs and sites for one stage, as one Docker
+* Compose stack behind Caddy.
+*
+* The order is the point of this file, and the rules it keeps are these:
+*
+* - A tag is checked before anything happens. Every app's image is asked of
+*   the registry first; one missing image stops the run naming them all, and
+*   nothing is written, pulled or started.
+* - The databases exist before the apps do. Postgres comes up alone, its
+*   databases, roles and grants are created and its migrations applied from
+*   this machine, and only then do the apps start — so an app never boots
+*   against a schema that is not there yet.
+* - What a stage runs is recorded. Each app's tag and the digest it resolved
+*   to are written to the stage's state, so "what is this stage running" has
+*   an exact answer.
+*
+* Docker, the registry, the build and the clock are injected, so the rules are
+* asserted without a daemon; the defaults are the real ones.
+*/
+const logger$4 = console;
+/** `--build` and `--pull` together ask for two different things. */
+var ComposeModeConflict = class extends Error {
+	constructor() {
+		super("--build and --pull ask for opposite things: build images from this checkout, or pull a tag CI pushed. Pass one of them.");
+		this.name = "ComposeModeConflict";
+	}
+};
+/** A build with no commit to tag its images with. */
+var NoGitRevision = class extends Error {
+	root;
+	constructor(root) {
+		super(`Images built here are tagged with the commit they were built from, and ${root} is not in a git repository with a commit. Commit, or pass --tag to name the images yourself.`);
+		this.root = root;
+		this.name = "NoGitRevision";
+	}
+};
+/** A port variable that does not hold a port. */
+var EdgePortInvalid = class extends Error {
+	variable;
+	value;
+	constructor(variable, value) {
+		super(`${variable}=${value} is not a port. Set it to a number between 1 and 65535, or unset it for the default.`);
+		this.variable = variable;
+		this.value = value;
+		this.name = "EdgePortInvalid";
+	}
+};
+/** The commit HEAD is at, short — and `-dirty` when the tree has changes. */
+async function gitRevision(root) {
+	let sha;
+	try {
+		sha = (await require_sniffer.runOutput("git", [
+			"rev-parse",
+			"--short",
+			"HEAD"
+		], { cwd: root })).trim();
+	} catch {
+		throw new NoGitRevision(root);
+	}
+	if (!sha) throw new NoGitRevision(root);
+	return (await require_sniffer.runOutput("git", ["status", "--porcelain"], { cwd: root }).catch(() => "")).trim() ? `${sha}-dirty` : sha;
+}
+/**
+* Bundle a backend with the gkm that is running — the same build a deploy
+* makes, so the image holds one file and no dependencies.
+*/
+async function bundleWithThisCli(appRoot) {
+	const entry = process.argv[1];
+	if (!entry) return;
+	await require_sniffer.run(process.execPath, [
+		...process.execArgv,
+		entry,
+		"build",
+		"--provider",
+		"server",
+		"--production"
+	], { cwd: appRoot });
+}
+const defaultDeps = {
+	docker: dockerCompose,
+	bundle: bundleWithThisCli,
+	revision: gitRevision
+};
+/** The edge's ports, from the environment — 443 and 80 when unset. */
+function edgePorts(env = process.env) {
+	const read = (variable, fallback) => {
+		const value = env[variable];
+		if (value === void 0 || value === "") return fallback;
+		const port = Number(value);
+		if (!Number.isInteger(port) || port < 1 || port > 65535) throw new EdgePortInvalid(variable, value);
+		return port;
+	};
+	return {
+		https: read(EDGE_PORT_ENV.https, 443),
+		http: read(EDGE_PORT_ENV.http, 80)
+	};
+}
+/** `gkm compose`. */
+async function composeCommand(options = {}, deps = {}) {
+	const { docker, bundle, revision } = {
+		...defaultDeps,
+		...deps
+	};
+	const env = deps.env ?? process.env;
+	if (options.build && options.pull) throw new ComposeModeConflict();
+	const { workspace } = await require_config.loadWorkspaceConfig(options.cwd);
+	const root = workspace.root;
+	const stage = options.stage ?? workspace.stages.local;
+	if (!(stage === workspace.stages.local)) require_workspace.assertDeployedStage(workspace.stages, stage);
+	const identity = require_store.deployIdentity(workspace, stage);
+	const dir = (0, node_path.join)(root, stackDir(stage));
+	const file = (0, node_path.join)(dir, "docker-compose.yml");
+	const ref = {
+		project: composeProject(identity),
+		file,
+		cwd: root
+	};
+	if (options.down) {
+		await docker.down(ref);
+		logger$4.log(`🛑 Stopped ${ref.project}. Its volumes are kept.`);
+		return;
+	}
+	const sources = {};
+	const runnables = {};
+	const manifest = await require_discover.discover({
+		patterns: require_sniffer.constructGlobs(workspace),
+		cwd: root,
+		sources,
+		runnables
+	});
+	const mode = options.build || !options.pull && !options.tag ? "build" : "pull";
+	const tag = options.tag ?? (mode === "pull" ? "latest" : await revision(root));
+	const { secrets, keep } = await stageSecrets(workspace, manifest, stage);
+	const packageManager = require_sniffer.detectPackageManager(root);
+	const stack = composeStack({
+		workspace,
+		manifest,
+		runnables,
+		stage,
+		identity,
+		images: {
+			mode,
+			tag,
+			...workspace.deploy?.dokploy?.registry ? { registry: workspace.deploy.dokploy.registry } : {}
+		},
+		secrets,
+		ports: edgePorts(env),
+		packageManager,
+		packages: Object.fromEntries(Object.entries(workspace.apps).map(([name, app]) => [name, require_sniffer.appPackageName(root, name, app.path)]))
+	});
+	if (mode === "pull" && !options.dryRun) await assertImagesExist(docker, tag, stack.apps);
+	if (options.dryRun) keep.skip();
+	else await keep.write();
+	const files = await writeStack(root, dir, stack);
+	printPlan(stack, mode, files);
+	if (options.dryRun) return {
+		stack,
+		files
+	};
+	const store = deps.state ? await deps.state(workspace) : await require_sniffer.createStateStore({
+		config: workspace.state,
+		workspaceRoot: root,
+		workspaceName: workspace.name
+	});
+	const lock = await store.lock(stage, { operation: "compose" });
+	try {
+		const apps = stack.apps.map((app) => app.name);
+		if (mode === "build") {
+			for (const app of stack.apps.filter((a) => a.kind === "rest-api")) {
+				logger$4.log(`\n📦 Bundling ${app.name}…`);
+				await bundle((0, node_path.join)(root, app.path));
+			}
+			logger$4.log("\n🐳 Building images…");
+			await docker.build(ref, apps);
+		} else {
+			logger$4.log(`\n🐳 Pulling ${tag}…`);
+			await docker.pull(ref, apps);
+		}
+		if (stack.infra.length > 0) {
+			logger$4.log(`\n🗄️  Starting ${stack.infra.join(", ")}…`);
+			await docker.up(ref, stack.infra);
+		}
+		if (stack.infra.includes("postgres")) await prepareDatabases(stack, workspace, manifest, sources, {
+			docker,
+			ref,
+			sql: deps.sql ?? require_sniffer.pgClient,
+			migrate: deps.migrate ?? migrateDatabases
+		});
+		logger$4.log("\n🚀 Starting the stack…");
+		await docker.up(ref);
+		if (stack.local) await docker.copyOut(ref, "caddy", "/data/caddy/pki/authorities/local/root.crt", (0, node_path.join)(dir, "caddy-root.crt")).catch(() => {});
+		const images = await recordImages(store, stack, docker, mode);
+		logger$4.log(`\n✅ ${ref.project} is running:`);
+		for (const app of stack.apps) logger$4.log(`   ${app.name.padEnd(12)} ${app.url}`);
+		if (stack.local) logger$4.log(`\n🔐 Certificates are from Caddy's local CA: NODE_EXTRA_CA_CERTS=${(0, node_path.join)(stackDir(stage), "caddy-root.crt")}`);
+		return {
+			stack,
+			files,
+			images
+		};
+	} finally {
+		await lock.release();
+	}
+}
+/**
+* The stage's secrets — and, for a deployed stage, everything it generates
+* once: its seed, and each declared secret and keyring. Written back before
+* anything is derived from them, so the next run derives the same passwords.
+*/
+async function stageSecrets(workspace, manifest, stage) {
+	const store = await require_store.secretsStoreFor(workspace, stage);
+	const stored = await store.read(stage);
+	const nothing = {
+		write: async () => {},
+		skip: () => {}
+	};
+	if (stage === workspace.stages.local) return {
+		secrets: stored,
+		keep: nothing
+	};
+	const { secrets, generated } = require_sniffer.withGeneratedSecrets(stored ?? require_storage.initStageSecrets(stage), manifest);
+	if (generated.length === 0) return {
+		secrets,
+		keep: nothing
+	};
+	return {
+		secrets,
+		keep: {
+			async write() {
+				await store.write(stage, secrets);
+				logger$4.log(`🔑 Generated for "${stage}" (${store.name}): ${generated.join(", ")}`);
+			},
+			skip() {
+				logger$4.log(`🔑 "${stage}" has no ${generated.join(", ")} yet; this dry run used values it did not keep.`);
+			}
+		}
+	};
+}
+/** Write the stack's files: owner-only, since the env files hold secrets. */
+async function writeStack(root, dir, stack) {
+	await (0, node_fs_promises.mkdir)(dir, {
+		recursive: true,
+		mode: 448
+	});
+	await (0, node_fs_promises.chmod)(dir, 448);
+	const files = [];
+	const write = async (path, content, mode = 420) => {
+		await (0, node_fs_promises.mkdir)((0, node_path.dirname)(path), { recursive: true });
+		await (0, node_fs_promises.writeFile)(path, content, { mode });
+		await (0, node_fs_promises.chmod)(path, mode);
+		files.push(path);
+	};
+	await write((0, node_path.join)(dir, "docker-compose.yml"), composeYaml(stack));
+	await write((0, node_path.join)(dir, "Caddyfile"), stack.caddyfile);
+	for (const app of stack.apps) if (app.env) await write((0, node_path.join)(dir, `${app.name}.env`), envFile(app.env), 384);
+	for (const [path, content] of Object.entries(stack.dockerfiles)) await write((0, node_path.join)(root, path), content);
+	await ignoreStacks(root);
+	return files;
+}
+/** Make sure the build context leaves `.gkm/compose` out. */
+async function ignoreStacks(root) {
+	const path = (0, node_path.join)(root, ".dockerignore");
+	if (!(0, node_fs.existsSync)(path)) {
+		await (0, node_fs_promises.writeFile)(path, require_sniffer.generateDockerignore());
+		return;
+	}
+	const current = await (0, node_fs_promises.readFile)(path, "utf-8");
+	if (/^\/?\.gkm\/compose\/?$|^\/?\.gkm\/?$/m.test(current)) return;
+	await (0, node_fs_promises.appendFile)(path, `${current.endsWith("\n") ? "" : "\n"}\n# gkm compose's stacks: each app's env file holds its stage's secrets\n.gkm/compose\n`);
+}
+function composeYaml(stack) {
+	return `# Generated by gkm compose from the construct manifest — do not edit.
+# The ${stack.stage} stage's APIs and sites behind one Caddy. Each backend
+# reads exactly the keys in its own env file beside this one.
+#
+#   gkm compose${stack.local ? "" : ` --stage ${stack.stage}`}          start or update it
+#   gkm compose${stack.local ? "" : ` --stage ${stack.stage}`} --down   stop it
+${(0, yaml.stringify)(stack.compose, {
+		lineWidth: 0,
+		aliasDuplicateObjects: false
+	})}`;
+}
+/** Create what the plan names in the stack's Postgres, then migrate it. */
+async function prepareDatabases(stack, workspace, manifest, sources, deps) {
+	const port = await deps.docker.port(deps.ref, "postgres", 5432);
+	const statements = require_sniffer.postgresStatements(stack.plan, workspace.name, stack.credential.seed);
+	if (statements.length > 0) {
+		logger$4.log("🗄️  Creating databases, roles and grants…");
+		await require_sniffer.applyPostgres(deps.sql(port, stack.credential.master), statements);
+	}
+	const env = require_sniffer.envFor(stack.plan, {
+		ports: { [require_sniffer.primaryPortKey("postgres")]: port },
+		project: workspace.name,
+		master: stack.credential.master,
+		...stack.credential.seed ? { seed: stack.credential.seed } : {}
+	});
+	const runs = await deps.migrate({
+		root: workspace.root,
+		manifest,
+		sources,
+		env
+	});
+	for (const { target, applied } of runs) if (applied.length > 0) logger$4.log(`🗄️  ${target.migrations}: applied ${applied.length}`);
+}
+/**
+* Record each app's image in the stage's state: the tag it ran and the digest
+* the tag resolved to — or, for an image built here and never pushed, its
+* content id.
+*/
+async function recordImages(store, stack, docker, mode) {
+	if (!await store.read(stack.stage)) await store.write(stack.stage, require_sniffer.createEmptyState(stack.stage, "", ""), { expectedVersion: null });
+	const images = {};
+	for (const app of stack.apps) {
+		const digest = await docker.digest(app.ref);
+		images[app.name] = {
+			ref: app.ref,
+			tag: app.tag,
+			...digest ? { digest } : {}
+		};
+		await store.putResource(stack.stage, {
+			key: `compose:${app.name}`,
+			type: "compose-image",
+			status: "ready",
+			...digest ? { id: digest } : {},
+			data: {
+				project: stack.project,
+				ref: app.ref,
+				tag: app.tag,
+				source: mode,
+				...digest ? { digest } : {}
+			}
+		});
+	}
+	return images;
+}
+function printPlan(stack, mode, files) {
+	logger$4.log(`\n🧱 ${stack.project} — stage ${stack.stage}`);
+	for (const app of stack.apps) logger$4.log(`   ${app.name.padEnd(12)} ${app.url.padEnd(40)} ${mode === "build" ? "build" : "pull"} ${app.ref}`);
+	if (stack.infra.length > 0) logger$4.log(`   infrastructure: ${stack.infra.join(", ")}`);
+	logger$4.log(`\n📝 Wrote ${files.length} file(s) under ${stackDir(stack.stage)}/`);
+}
 /**
 * Format a fatal error for display.
 * Always includes the full stack trace since these are process-ending errors.
@@ -4923,25 +6479,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.60",
-	"@geekmidas/auth": "~10.0.0-alpha.60",
-	"@geekmidas/cache": "~10.0.0-alpha.60",
-	"@geekmidas/client": "~10.0.0-alpha.60",
-	"@geekmidas/cloud": "~10.0.0-alpha.60",
-	"@geekmidas/constructs": "~10.0.0-alpha.60",
-	"@geekmidas/db": "~10.0.0-alpha.60",
-	"@geekmidas/emailkit": "~10.0.0-alpha.60",
-	"@geekmidas/envkit": "~10.0.0-alpha.60",
-	"@geekmidas/errors": "~10.0.0-alpha.60",
-	"@geekmidas/events": "~10.0.0-alpha.60",
-	"@geekmidas/logger": "~10.0.0-alpha.60",
-	"@geekmidas/manifest": "~10.0.0-alpha.60",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.60",
-	"@geekmidas/schema": "~10.0.0-alpha.60",
-	"@geekmidas/services": "~10.0.0-alpha.60",
-	"@geekmidas/storage": "~10.0.0-alpha.60",
-	"@geekmidas/telescope": "~10.0.0-alpha.60",
-	"@geekmidas/testkit": "~10.0.0-alpha.60",
+	"@geekmidas/audit": "~10.0.0-alpha.61",
+	"@geekmidas/auth": "~10.0.0-alpha.61",
+	"@geekmidas/cache": "~10.0.0-alpha.61",
+	"@geekmidas/client": "~10.0.0-alpha.61",
+	"@geekmidas/cloud": "~10.0.0-alpha.61",
+	"@geekmidas/constructs": "~10.0.0-alpha.61",
+	"@geekmidas/db": "~10.0.0-alpha.61",
+	"@geekmidas/emailkit": "~10.0.0-alpha.61",
+	"@geekmidas/envkit": "~10.0.0-alpha.61",
+	"@geekmidas/errors": "~10.0.0-alpha.61",
+	"@geekmidas/events": "~10.0.0-alpha.61",
+	"@geekmidas/logger": "~10.0.0-alpha.61",
+	"@geekmidas/manifest": "~10.0.0-alpha.61",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.61",
+	"@geekmidas/schema": "~10.0.0-alpha.61",
+	"@geekmidas/services": "~10.0.0-alpha.61",
+	"@geekmidas/storage": "~10.0.0-alpha.61",
+	"@geekmidas/telescope": "~10.0.0-alpha.61",
+	"@geekmidas/testkit": "~10.0.0-alpha.61",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -10842,7 +12398,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-BTqIflwc.cjs"));
+	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-BScRpCEx.cjs"));
 	const { discover } = await Promise.resolve().then(() => require("./discover-Bc-4eA_p.cjs")).then((n) => n.discover_exports);
 	const sources = {};
 	const manifest = await discover({
@@ -11273,7 +12829,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-BTqIflwc.cjs"));
+		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-BScRpCEx.cjs"));
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11287,7 +12843,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-BTqIflwc.cjs"));
+		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-BScRpCEx.cjs"));
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11301,7 +12857,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-BTqIflwc.cjs"));
+		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-BScRpCEx.cjs"));
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -11346,6 +12902,16 @@ program.command("docker").description("Generate Docker deployment files").option
 		process.exit(1);
 	}
 });
+program.command("compose").description("Run the workspace's APIs and sites for a stage as one Docker Compose stack behind Caddy").option("--stage <stage>", "Stage to run (default: the local stage)").option("--tag <tag>", "Run the images CI pushed at this tag (sites: <tag>-<stage>); nothing is built").option("--build", "Build images from this checkout, tagged with the commit").option("--pull", "Pull images (at --tag, or latest) rather than build them").option("--dry-run", "Write the files and print the plan; start nothing").option("--down", "Stop the stage's stack (its volumes are kept)").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		await composeCommand(options);
+	} catch (error) {
+		console.error(formatError(error));
+		process.exit(1);
+	}
+});
 program.command("prepack").description("Generate Docker files for production deployment").option("--build", "Build Docker image after generating files").option("--push", "Push image to registry after building").option("--tag <tag>", "Image tag", "latest").option("--registry <registry>", "Container registry URL").option("--slim", "Build locally first, then use slim Dockerfile").option("--skip-bundle", "Skip bundling step (only with --slim)").option("--turbo", "Use turbo prune for monorepo optimization").option("--turbo-package <name>", "Package name for turbo prune").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
@@ -11399,7 +12965,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-CML4UaPi.cjs"));
+		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-ojzUo7-z.cjs"));
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11410,7 +12976,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-CML4UaPi.cjs"));
+		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-ojzUo7-z.cjs"));
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11462,7 +13028,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./sniffer-DIv12ncU.cjs")).then((n) => n.workspace_exports);
+		const { derivedContainers } = await Promise.resolve().then(() => require("./sniffer-CQmJnNJM.cjs")).then((n) => n.workspace_exports);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -11477,7 +13043,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 	}
 });
 program.command("deploy").description("Deploy application to a provider").requiredOption("--provider <provider>", "Deploy provider (docker, dokploy, aws-lambda)").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp)").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").action(async (options) => {
-	const { deployCli } = await Promise.resolve().then(() => require("./cli-D_qTl20Z.cjs"));
+	const { deployCli } = await Promise.resolve().then(() => require("./cli-DQdrVkj2.cjs"));
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: (0, node_path.resolve)(globalOptions.cwd ?? process.cwd()),
@@ -11644,8 +13210,23 @@ program.command("upgrade").description("Upgrade @geekmidas/cli (with --all, ever
 });
 program.parse();
 //#endregion
+exports.DuplicateMigration = DuplicateMigration;
+exports.KyselyNotFound = KyselyNotFound;
+exports.MigrationFailed = MigrationFailed;
+exports.MigrationHasNoUp = MigrationHasNoUp;
+exports.MigrationsOutsideFolder = MigrationsOutsideFolder;
+exports.NoOwnerCredential = NoOwnerCredential;
+exports.NoSuchMigrationTarget = NoSuchMigrationTarget;
+exports.SeedFailed = SeedFailed;
+exports.SeedHasNoSeed = SeedHasNoSeed;
+exports.UnknownDatabaseFolder = UnknownDatabaseFolder;
+exports.UnknownMigrationFolder = UnknownMigrationFolder;
 exports.formatError = formatError;
 exports.generateFullstackCustomSecrets = generateFullstackCustomSecrets;
+exports.migrateAndSeed = migrateAndSeed;
+exports.migrateDatabases = migrateDatabases;
+exports.pendingMigrations = pendingMigrations;
+exports.seedDatabases = seedDatabases;
 exports.slug = slug;
 exports.stamp = stamp;