@geekmidas/cli 10.0.0-alpha.63 → 10.0.0-alpha.65

package/dist/compose-391oEKj1.cjs

@@ -0,0 +1,1982 @@
+const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
+const require_local = require("./local-BdH4XN0E.cjs");
+const require_discover = require("./discover-DHdECueV.cjs");
+const require_sandbox = require("./sandbox-CL--ZDui.cjs");
+const require_derive = require("./derive-DAbo49sm.cjs");
+const require_define = require("./define-DzRz8FgH.cjs");
+const require_storage = require("./storage-CSGoC3bK.cjs");
+const require_store = require("./store-CJF1Tqkq.cjs");
+const require_state = require("./state-DF26e_lo.cjs");
+const require_fakes = require("./fakes-zW-jNAbQ.cjs");
+let node_path = require("node:path");
+let node_fs = require("node:fs");
+let node_fs_promises = require("node:fs/promises");
+let _geekmidas_manifest = require("@geekmidas/manifest");
+let node_module = require("node:module");
+let node_url = require("node:url");
+let node_child_process = require("node:child_process");
+let pg = require("pg");
+pg = require_rolldown_runtime.__toESM(pg, 1);
+let yaml = require("yaml");
+let node_https = require("node:https");
+//#region src/compose/docker.ts
+/**
+* The Docker operations `gkm compose` needs, behind an interface.
+*
+* Small on purpose, like reconcile's: the rules about *when* each runs — the
+* registry is asked before anything is pulled, nothing is started for a tag
+* that is missing — are asserted against a fake, and this file is only the
+* wiring to the real CLI.
+*
+* Every call is an argument array. Image refs, tags and paths come from the
+* workspace, and none of them reaches a shell.
+*/
+/** `output` as `spawn` reads it. */
+const STDIO = {
+	inherit: "inherit",
+	stderr: [
+		"ignore",
+		2,
+		2
+	],
+	ignore: "ignore"
+};
+/** How a stack's docker commands run: where it is, where output goes. */
+function runOptions(stack, env) {
+	return {
+		cwd: stack.cwd,
+		stdio: STDIO[stack.output ?? "inherit"],
+		...env ? { env } : {},
+		...stack.signal ? { signal: stack.signal } : {}
+	};
+}
+/** How long a stack has to pass its health checks. */
+const WAIT_TIMEOUT_S = 180;
+/** `docker compose port` printed nothing a port can be read from. */
+var ServicePortUnknown = class extends Error {
+	service;
+	inside;
+	output;
+	constructor(service, inside, output) {
+		super(`'${service}' publishes no host port for ${inside} (docker said: ${output.trim() || "nothing"}). Is it running? \`docker compose ps\` shows the stack.`);
+		this.service = service;
+		this.inside = inside;
+		this.output = output;
+		this.name = "ServicePortUnknown";
+	}
+};
+function compose(stack, args) {
+	return [
+		"compose",
+		"-p",
+		stack.project,
+		"-f",
+		stack.file,
+		...args
+	];
+}
+/** Run a program and keep everything it said, whatever it exits with. */
+function capture(command, args, timeoutMs = 6e4) {
+	return new Promise((resolve, reject) => {
+		const child = (0, node_child_process.spawn)(command, [...args], {
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			shell: false
+		});
+		let stdout = "";
+		let stderr = "";
+		child.stdout.on("data", (chunk) => {
+			stdout += chunk.toString();
+		});
+		child.stderr.on("data", (chunk) => {
+			stderr += chunk.toString();
+		});
+		const timer = setTimeout(() => child.kill("SIGKILL"), timeoutMs);
+		timer.unref?.();
+		child.on("error", (error) => {
+			clearTimeout(timer);
+			reject(error);
+		});
+		child.on("close", (code) => {
+			clearTimeout(timer);
+			resolve({
+				code,
+				stdout,
+				stderr
+			});
+		});
+	});
+}
+/**
+* Whether a failed `docker manifest inspect` means the tag is not there, as
+* opposed to the registry not answering.
+*
+* Read off the message because that is all the CLI gives. Anything not
+* recognisably "no such tag" is treated as the registry being unreachable:
+* a registry that refused credentials must not be reported as a tag that was
+* never pushed, or the fix offered would be the wrong one.
+*/
+function isMissingManifest(output) {
+	return /no such manifest|manifest unknown|manifest for .* not found|not found: manifest/i.test(output);
+}
+const dockerCompose = {
+	async lookup(ref) {
+		const { code, stdout, stderr } = await capture("docker", [
+			"manifest",
+			"inspect",
+			ref
+		]);
+		if (code === 0) return {
+			ref,
+			status: "found"
+		};
+		const output = `${stderr}\n${stdout}`.trim();
+		return isMissingManifest(output) ? {
+			ref,
+			status: "missing"
+		} : {
+			ref,
+			status: "unreachable",
+			detail: output
+		};
+	},
+	async build(stack, services) {
+		await require_local.run("docker", compose(stack, ["build", ...services]), runOptions(stack, {
+			...process.env,
+			DOCKER_BUILDKIT: "1"
+		}));
+	},
+	async pull(stack, services) {
+		await require_local.run("docker", compose(stack, ["pull", ...services]), runOptions(stack));
+	},
+	async up(stack, services) {
+		await require_local.run("docker", compose(stack, [
+			"up",
+			"-d",
+			"--wait",
+			`--wait-timeout=${WAIT_TIMEOUT_S}`,
+			...services ? [] : ["--remove-orphans"],
+			...services ?? []
+		]), runOptions(stack));
+	},
+	async down(stack) {
+		await require_local.run("docker", compose(stack, ["down"]), runOptions(stack));
+	},
+	async port(stack, service, inside) {
+		const output = await require_local.runOutput("docker", compose(stack, [
+			"port",
+			service,
+			String(inside)
+		]), {
+			cwd: stack.cwd,
+			...stack.signal ? { signal: stack.signal } : {}
+		});
+		const port = Number(output.trim().split(":").pop());
+		if (!Number.isInteger(port) || port <= 0) throw new ServicePortUnknown(service, inside, output);
+		return port;
+	},
+	async copyOut(stack, service, from, to) {
+		await (0, node_fs_promises.mkdir)((0, node_path.dirname)(to), { recursive: true });
+		await require_local.run("docker", compose(stack, [
+			"cp",
+			`${service}:${from}`,
+			to
+		]), runOptions(stack));
+	},
+	async digest(ref) {
+		const { code, stdout } = await capture("docker", [
+			"image",
+			"inspect",
+			"--format={{json .RepoDigests}} {{.Id}}",
+			ref
+		]);
+		if (code !== 0) return void 0;
+		const [json = "[]", id] = stdout.trim().split(" ");
+		const repository = ref.split("@")[0].replace(/:[\w][\w.-]*$/, "");
+		try {
+			const digests = JSON.parse(json);
+			const match = Array.isArray(digests) ? digests.find((entry) => typeof entry === "string" && entry.startsWith(`${repository}@`)) : void 0;
+			if (match) return match.slice(repository.length + 1);
+		} catch {}
+		return id || void 0;
+	}
+};
+//#endregion
+//#region src/compose/images.ts
+/**
+* The tag a site's image carries for a release.
+*
+* A site's public URLs are inlined when it is built, so one bundle serves one
+* stage: `v1.4.0-production` and `v1.4.0-staging` are two images of the same
+* commit. A backend reads its URLs at runtime, so one image serves every stage
+* and its tag is the release's alone.
+*/
+function siteTag(tag, stage) {
+	return `${tag}-${stage}`;
+}
+/** Images a tag names that the registry does not have. */
+var ImageTagNotFound = class extends Error {
+	tag;
+	refs;
+	constructor(tag, refs) {
+		super(`The registry has no image for ${refs.length === 1 ? "this app" : `${refs.length} apps`} at '${tag}':\n` + refs.map((ref) => `  - ${ref}`).join("\n") + `\nNothing was pulled or started. Push '${tag}' for every app from CI, pick a tag that exists, or run without --tag to build from this checkout.`);
+		this.tag = tag;
+		this.refs = refs;
+		this.name = "ImageTagNotFound";
+	}
+};
+/** The registry did not answer, or did not let this machine in. */
+var RegistryUnreachable = class extends Error {
+	ref;
+	detail;
+	constructor(ref, detail) {
+		super(`Could not ask the registry about ${ref}: ${detail || "no answer"}\nNothing was pulled or started. Check the registry is reachable and that this machine is logged in to it (\`docker login <registry>\`).`);
+		this.ref = ref;
+		this.detail = detail;
+		this.name = "RegistryUnreachable";
+	}
+};
+/**
+* Assert every image exists, before anything else happens.
+*
+* Asked all at once and reported all at once: a release missing two images is
+* one problem with two names, and finding the second only after fixing the
+* first is a slower way to learn the same thing.
+*
+* @throws {RegistryUnreachable} when the registry cannot say
+* @throws {ImageTagNotFound} listing every missing image
+*/
+async function assertImagesExist(docker, tag, images) {
+	const lookups = await Promise.all(images.map((image) => docker.lookup(image.ref)));
+	const unreachable = lookups.find((lookup) => lookup.status === "unreachable");
+	if (unreachable?.status === "unreachable") throw new RegistryUnreachable(unreachable.ref, unreachable.detail);
+	const missing = lookups.filter((lookup) => lookup.status === "missing").map((lookup) => lookup.ref);
+	if (missing.length > 0) throw new ImageTagNotFound(tag, missing);
+}
+//#endregion
+//#region src/compose/caddyfile.ts
+/** The Caddyfile for a stack's edge. */
+function edgeCaddyfile(sites, options) {
+	const global = options.local ? `{
+	# No ACME and no public DNS: the CA is Caddy's own and the names resolve
+	# to this machine.
+	local_certs
+	auto_https disable_redirects
+}` : options.email ? `{
+	email ${options.email}
+}` : "";
+	const blocks = sites.map(({ host, upstream }) => `https://${host} {${options.local ? `
+	tls internal
+` : ""}
+	# Host and X-Forwarded-* are passed through as Caddy does by default, so
+	# an app builds redirects, cookies and links on the address a caller used.
+	reverse_proxy ${upstream} {
+		# Never buffer: a streamed response — server-sent events, a Next.js
+		# RSC payload — reaches the client as each chunk is written.
+		flush_interval -1
+	}
+}`);
+	return `${HEADER}${global ? `${global}\n\n` : ""}${blocks.join("\n\n")}\n`;
+}
+const HEADER = `# Generated by gkm compose from the construct manifest — do not edit.
+#
+# One host per API and site, each in front of its own container.
+`;
+//#endregion
+//#region src/compose/stack.ts
+/**
+* The stack a workspace runs as for one stage — pure.
+*
+* Everything `gkm compose` writes is decided here, as data: the compose file,
+* the Caddyfile, one env file per backend, and the image each app runs. The
+* command around it reads the workspace, asks the registry, writes the files
+* and starts Docker; none of those decide anything, so all of it can be
+* asserted without a daemon.
+*
+* The values come from the same derivations every other target uses. The
+* plan is reconcile's `planFor`, the keys an app reads are `appEnvKeys`, and
+* every URL is `envFor`'s — asked twice, once with each app at its public
+* address and once on the compose network, because a browser and a sibling
+* service reach the same API by different names.
+*/
+/** Where a stack's files are written, relative to the workspace root. */
+function stackDir(stage) {
+	return `.gkm/compose/${stage}`;
+}
+/**
+* The compose project a stage's stack runs as.
+*
+* The deploy identity's scope, so two workspaces with one name in different
+* namespaces never share containers or volumes — and the stage, so a
+* machine can run two stages side by side.
+*/
+function composeProject(identity) {
+	return `${identity.scope}-${identity.stage}`;
+}
+/** The ports the edge is published on, and the variables that move them. */
+const EDGE_PORT_ENV = {
+	https: "GKM_COMPOSE_HTTPS_PORT",
+	http: "GKM_COMPOSE_HTTP_PORT"
+};
+/**
+* Containers this target does not run.
+*
+* Object storage is the stage's own — an externally hosted bucket whose URL
+* the stage's secrets hold — and so is a deployed stage's mail. The AWS
+* emulator never applies: a stack is a server target, whose events are
+* pg-boss.
+*/
+const NOT_RUN = {
+	minio: true,
+	localstack: true,
+	caddy: true
+};
+/** Kinds whose `<ID>_URL` a stage must be given, because nothing here runs them. */
+const EXTERNAL_KINDS = {
+	objects: true,
+	"file-server": true
+};
+/** The S3 client's credentials, read beside a bucket's URL when it has them. */
+const STORAGE_KEYS = [
+	"AWS_ACCESS_KEY_ID",
+	"AWS_SECRET_ACCESS_KEY",
+	"AWS_REGION"
+];
+/** A bucket the stack needs and the stage was not given. */
+var BucketNotConfigured = class extends Error {
+	app;
+	id;
+	key;
+	stage;
+	constructor(app, id, key, stage) {
+		super(`'${app}' uses the bucket '${id}', and gkm compose runs no object storage: the stage needs an externally hosted bucket. Set its URL in the stage's secrets: gkm secrets:set ${key} 's3://…' --stage ${stage}`);
+		this.app = app;
+		this.id = id;
+		this.key = key;
+		this.stage = stage;
+		this.name = "BucketNotConfigured";
+	}
+};
+/** A value only the stage's secrets can hold, and they do not. */
+var StageSecretMissing = class extends Error {
+	app;
+	key;
+	stage;
+	constructor(app, key, stage) {
+		super(`'${app}' reads ${key}, and the stage '${stage}' has none. Nothing in the stack can derive it; set it in the stage's secrets: gkm secrets:set ${key} '…' --stage ${stage}`);
+		this.app = app;
+		this.key = key;
+		this.stage = stage;
+		this.name = "StageSecretMissing";
+	}
+};
+/** A deployed stage's secrets with no seed to derive its passwords from. */
+var StageSeedMissing = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`The stage '${stage}' has no seed in its secrets, and a deployed stage's database passwords are derived from it. Run gkm compose without --dry-run once, or gkm deploy, to generate it.`);
+		this.stage = stage;
+		this.name = "StageSeedMissing";
+	}
+};
+/** A workspace with no API and no site to run. */
+var NothingToCompose = class extends Error {
+	root;
+	constructor(root) {
+		super(`${root} declares no RestApi and no site, so a stack would run nothing. Workers and mobile apps are not run by gkm compose yet.`);
+		this.root = root;
+		this.name = "NothingToCompose";
+	}
+};
+/** A value that cannot be written to an env file a line at a time. */
+var EnvValueMultiline = class extends Error {
+	app;
+	key;
+	constructor(app, key) {
+		super(`${key} for '${app}' spans more than one line, and an env file holds one value per line. Store it on one line — base64, or JSON — and decode it where it is read.`);
+		this.app = app;
+		this.key = key;
+		this.name = "EnvValueMultiline";
+	}
+};
+/** The services a stack's apps wait on and the edge waits on in turn. */
+const HEALTHY = { condition: "service_healthy" };
+/**
+* An app's health check: its own server, asked on 127.0.0.1 — not
+* `localhost`, which resolves to `::1` first in an Alpine container while a
+* server may listen on IPv4 alone.
+*/
+function probe(port, path) {
+	return {
+		test: [
+			"CMD",
+			"wget",
+			"-q",
+			"-O",
+			"/dev/null",
+			`http://127.0.0.1:${port}${path}`
+		],
+		interval: "5s",
+		timeout: "3s",
+		retries: 20,
+		start_period: "10s"
+	};
+}
+/** The stack for one stage. */
+function composeStack(input) {
+	const { workspace, manifest, stage, identity } = input;
+	const local = stage === workspace.stages.local;
+	const project = composeProject(identity);
+	const custom = input.secrets?.custom ?? {};
+	const https = input.ports?.https ?? 443;
+	const http = input.ports?.http ?? 80;
+	const plan = require_state.planFor(manifest, stage, (0, _geekmidas_manifest.provisionOrder)(manifest), {
+		localStage: workspace.stages.local,
+		events: require_fakes.DEFAULT_EVENTS.server,
+		cache: require_fakes.DEFAULT_CACHE.server,
+		edge: false
+	});
+	const byId = new Map(plan.resources.map((r) => [r.id, r]));
+	const seed = local ? void 0 : input.secrets?.seed;
+	if (!local && !seed) throw new StageSeedMissing(stage);
+	const credential = {
+		master: local ? "geekmidas" : require_state.localRolePassword(workspace.name, plan, "master", seed),
+		...seed ? { seed } : {}
+	};
+	const infra = plan.containers.filter((c) => !NOT_RUN[c]).filter((c) => local || c !== "mailpit").sort();
+	const apps = stackApps(workspace, manifest, plan, {
+		local,
+		stage,
+		https,
+		identity,
+		images: input.images
+	});
+	if (apps.length === 0) throw new NothingToCompose(workspace.root);
+	const derivation = {
+		project: workspace.name,
+		master: credential.master,
+		...credential.seed ? { seed: credential.seed } : {}
+	};
+	const outside = require_state.networkEnv(plan, {
+		...derivation,
+		addresses: Object.fromEntries(apps.map((app) => [app.id, app.url]))
+	});
+	const inside = require_state.networkEnv(plan, {
+		...derivation,
+		addresses: Object.fromEntries(apps.map((app) => [app.id, `http://${app.name}:${app.port}`]))
+	});
+	const owners = /* @__PURE__ */ new Map();
+	for (const resource of plan.resources) {
+		owners.set(resource.envKey, resource);
+		if (resource.kind === "email") {
+			owners.set((0, _geekmidas_manifest.provideKey)(resource.id, "from"), resource);
+			owners.set((0, _geekmidas_manifest.provideKey)(resource.id, "inboxUrl"), resource);
+		}
+		if (resource.kind === "external-api") owners.set((0, _geekmidas_manifest.provideKey)(resource.id, "credentials"), resource);
+	}
+	const surfaceUrls = new Map(plan.resources.filter((r) => r.kind === "rest-api" || r.kind === "site").map((r) => [r.envKey, r.id]));
+	const appById = new Map(apps.map((app) => [app.id, app]));
+	/**
+	* What a key resolves to for one app, from the stage's secrets where only
+	* they can hold it, and the derivations otherwise.
+	*/
+	const valueFor = (app, key, owner) => {
+		if (owner && EXTERNAL_KINDS[owner.kind] && key === owner.envKey) {
+			const value = custom[key];
+			if (value === void 0) throw new BucketNotConfigured(app.name, owner.id, key, stage);
+			return value;
+		}
+		if (owner && suppliedBy(owner, key, local)) {
+			const value = custom[key];
+			if (value === void 0) throw new StageSecretMissing(app.name, key, stage);
+			return value;
+		}
+		if (custom[key] !== void 0) return custom[key];
+		const surface = surfaceUrls.get(key);
+		if (app.kind === "rest-api" && surface && surface !== app.id) return inside[key];
+		return outside[key];
+	};
+	for (const app of apps) {
+		if (app.kind === "site") {
+			const site = manifest[app.id];
+			if (site?.kind !== "site") continue;
+			const args = {};
+			for (const [key, source] of Object.entries((0, _geekmidas_manifest.publicEnvFor)(site, manifest))) {
+				const value = valueFor(app, source, owners.get(source));
+				if (value !== void 0) args[key] = value;
+			}
+			if (app.build && Object.keys(args).length > 0) app.build.args = args;
+			continue;
+		}
+		const keys = require_state.appEnvKeys(manifest, app.name, input.runnables) ?? /* @__PURE__ */ new Set();
+		const values = {};
+		for (const key of [...keys].sort()) {
+			const owner = owners.get(key) ?? storageOwner(key, plan);
+			if (!local && owner?.kind === "email" && key.endsWith("_INBOX_URL")) continue;
+			if (STORAGE_KEYS.includes(key)) {
+				if (custom[key] !== void 0) values[key] = custom[key];
+				continue;
+			}
+			const value = valueFor(app, key, owner);
+			if (value !== void 0) values[key] = value;
+		}
+		const trusted = (0, _geekmidas_manifest.provideKey)(app.id, "trustedOrigins");
+		if (keys.has(trusted)) {
+			const internal = (byId.get(app.id)?.callers ?? []).map((caller) => appById.get(caller)).filter((caller) => caller?.kind === "rest-api").map((caller) => `http://${caller.name}:${caller.port}`);
+			const origins = [...(values[trusted] ?? "").split(",").filter(Boolean), ...internal];
+			values[trusted] = [...new Set(origins)].join(",");
+		}
+		app.env = {
+			...values,
+			NODE_ENV: "production",
+			PORT: String(app.port),
+			STAGE: stage
+		};
+		for (const [key, value] of Object.entries(app.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(app.name, key);
+	}
+	const compose = stackFile({
+		project,
+		plan,
+		infra,
+		apps,
+		master: credential.master,
+		https,
+		http
+	});
+	const caddyfile = edgeCaddyfile(apps.map((app) => ({
+		host: app.host,
+		upstream: `${app.name}:${app.port}`
+	})), { local });
+	const dockerfiles = {};
+	for (const app of apps) {
+		if (!app.build) continue;
+		dockerfiles[app.build.dockerfile] = app.kind === "site" ? require_state.siteDockerfile(app.name, workspace.apps[app.name], {
+			turboPackage: input.packages?.[app.name] ?? app.name,
+			packageManager: input.packageManager ?? "pnpm",
+			manifest
+		}) : require_state.generateSlimDockerfile({
+			imageName: app.name,
+			baseImage: "node:22-alpine",
+			port: app.port,
+			healthCheckPath: "/health",
+			prebuilt: true,
+			packageManager: input.packageManager ?? "pnpm",
+			bundle: `${app.path}/.gkm/server/dist/server.mjs`
+		});
+	}
+	return {
+		project,
+		stage,
+		local,
+		apps,
+		infra,
+		compose,
+		caddyfile,
+		dockerfiles,
+		plan,
+		credential
+	};
+	/** Whether only the stage's secrets can supply `key` to `owner`. */
+	function suppliedBy(owner, key, isLocal) {
+		if (owner.kind === "credential") return true;
+		if (owner.kind === "external-api") return key === (0, _geekmidas_manifest.provideKey)(owner.id, "credentials");
+		if (isLocal) return false;
+		if (owner.kind === "secret" || owner.kind === "encryption") return true;
+		return owner.kind === "email" && !key.endsWith("_INBOX_URL");
+	}
+}
+/** Which bucket an S3 credential key belongs to — the first one declared. */
+function storageOwner(key, plan) {
+	if (!STORAGE_KEYS.includes(key)) return void 0;
+	return plan.resources.find((r) => r.kind === "objects");
+}
+/** The apps a stack runs: every API and every site, at its stage address. */
+function stackApps(workspace, manifest, plan, options) {
+	const apps = [];
+	const resources = new Map(plan.resources.map((r) => [r.id, r]));
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration.kind !== "rest-api" && declaration.kind !== "site") continue;
+		const name = require_derive.appKey(id);
+		const app = workspace.apps[name];
+		const resource = resources.get(id);
+		if (!app || !resource || !app.port) continue;
+		const host = hostOf(name, app, workspace, resource, options);
+		const tag = declaration.kind === "site" ? siteTag(options.images.tag, options.stage) : options.images.tag;
+		const ref = require_state.validateImageRef(require_store.imageRef(options.identity, name, options.images.registry, tag));
+		apps.push({
+			app: name,
+			name,
+			id,
+			kind: declaration.kind,
+			path: app.path,
+			port: app.port,
+			host,
+			url: `https://${host}${options.local && options.https !== 443 ? `:${options.https}` : ""}`,
+			ref,
+			tag,
+			...options.images.mode === "build" ? { build: { dockerfile: `${stackDir(options.stage)}/Dockerfile.${name}` } } : {}
+		});
+	}
+	return apps.sort((a, b) => a.name.localeCompare(b.name));
+}
+/**
+* The host an app answers on for a stage: the `gkm dev` edge's
+* `*.localhost` names for the local stage, and the stage's domain — by the
+* same rule a deploy follows — for any other.
+*/
+function hostOf(name, app, workspace, resource, options) {
+	if (options.local) return require_state.hostFor(resource, workspace.name);
+	return require_state.resolveHost(name, app, options.stage, workspace.deploy?.domains, require_state.isMainFrontendApp(name, app, workspace.apps));
+}
+/** The compose document: the infrastructure, the apps, and the edge. */
+function stackFile(options) {
+	const { project, plan, infra, apps } = options;
+	const derived = require_state.composeFor({
+		...plan,
+		containers: [...infra]
+	}, {
+		project,
+		ports: Object.fromEntries(require_state.portKeys(infra, plan.fakes).map((key) => [key, 0]))
+	});
+	const services = {};
+	const volumes = {
+		...derived.volumes,
+		"caddy-data": {},
+		"caddy-config": {}
+	};
+	for (const name of infra) {
+		const { ports: _ports, depends_on, profiles: _profiles, ...service } = derived.services[name];
+		services[name] = {
+			...service,
+			...depends_on?.length ? { depends_on: Object.fromEntries(depends_on.map((dep) => [dep, HEALTHY])) } : {}
+		};
+	}
+	const postgres = services.postgres;
+	if (postgres) {
+		postgres.environment = {
+			...postgres.environment,
+			POSTGRES_PASSWORD: options.master
+		};
+		postgres.ports = ["127.0.0.1::5432"];
+	}
+	for (const app of apps) services[app.name] = {
+		image: app.ref,
+		...app.build ? { build: {
+			context: "../../..",
+			dockerfile: app.build.dockerfile,
+			...app.build.args ? { args: app.build.args } : {}
+		} } : {},
+		restart: "unless-stopped",
+		...app.kind === "rest-api" ? {
+			env_file: [{
+				path: `./${app.name}.env`,
+				format: "raw"
+			}],
+			...infra.length ? { depends_on: Object.fromEntries(infra.map((name) => [name, HEALTHY])) } : {}
+		} : {},
+		healthcheck: probe(app.port, app.kind === "site" ? "/" : "/health")
+	};
+	services.caddy = {
+		image: require_state.DEFAULT_IMAGES.caddy,
+		restart: "unless-stopped",
+		ports: [`${options.https}:443`, `${options.http}:80`],
+		volumes: [
+			"./Caddyfile:/etc/caddy/Caddyfile:ro",
+			"caddy-data:/data",
+			"caddy-config:/config"
+		],
+		depends_on: Object.fromEntries(apps.map((app) => [app.name, HEALTHY])),
+		healthcheck: {
+			test: [
+				"CMD",
+				"caddy",
+				"version"
+			],
+			interval: "10s",
+			timeout: "5s",
+			retries: 5
+		}
+	};
+	return {
+		name: project,
+		services,
+		volumes
+	};
+}
+/** Render an app's env file: one `KEY=value` per line, read raw by compose. */
+function envFile(env) {
+	return `${Object.entries(env).sort(([a], [b]) => a.localeCompare(b)).map(([key, value]) => `${key}=${value}`).join("\n")}\n`;
+}
+//#endregion
+//#region src/migrate/provider.ts
+/**
+* One construct's migrations and seeds, read from its folders.
+*
+* Two kinds of file, told apart by extension rather than by configuration: a
+* script exports `up` (and may export `down`) — or `seed(db, { stage })`, in
+* `seeds/` — and a
+* `.sql` file is run whole. The second is what makes a folder independent of
+* the client the app uses — Better Auth's schema is SQL whatever the
+* application queries with.
+*/
+const SCRIPTS = /* @__PURE__ */ new Set([
+	".ts",
+	".mts",
+	".js",
+	".mjs"
+]);
+/** Two files in one folder that would be one migration. */
+var DuplicateMigration = class extends Error {
+	folder;
+	migration;
+	constructor(folder, migration) {
+		super(`${folder} has two migrations named '${migration}' — a script and a .sql file with the same name. A migration is recorded by name, so only one of them could ever run; rename or remove the other.`);
+		this.folder = folder;
+		this.migration = migration;
+		this.name = "DuplicateMigration";
+	}
+};
+/** A script in a migrations folder that exports no `up`. */
+var MigrationHasNoUp = class extends Error {
+	file;
+	constructor(file) {
+		super(`${file} is in a migrations folder but exports no \`up\` function. Export \`async function up(db: Kysely<unknown>)\`, or move the file out of the folder if it is not a migration.`);
+		this.file = file;
+		this.name = "MigrationHasNoUp";
+	}
+};
+/** A script in a seeds folder that exports no `seed`. */
+var SeedHasNoSeed = class extends Error {
+	file;
+	constructor(file) {
+		super(`${file} is in a seeds folder but exports no \`seed\` function. Export \`async function seed(db, { stage })\`, or move the file out of the folder if it is not a seed.`);
+		this.file = file;
+		this.name = "SeedHasNoSeed";
+	}
+};
+/**
+* The migration files in a folder, by name, without reading them.
+*
+* Also what `gkm dev` compares against a construct's history to report what
+* is pending, which is why it is separate from loading them.
+*/
+async function migrationFiles(folder) {
+	const entries = await (0, node_fs_promises.readdir)(folder, { withFileTypes: true }).catch((error) => {
+		if (error.code === "ENOENT") return [];
+		throw error;
+	});
+	const files = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		if (!entry.isFile() || !isMigration(entry.name)) continue;
+		const name = entry.name.slice(0, -(0, node_path.extname)(entry.name).length);
+		if (files.has(name)) throw new DuplicateMigration(folder, name);
+		files.set(name, (0, node_path.join)(folder, entry.name));
+	}
+	return files;
+}
+/** A Kysely provider over one construct's folder. */
+function folderProvider(folder, raw) {
+	return { async getMigrations() {
+		const migrations = {};
+		for (const [name, file] of await migrationFiles(folder)) migrations[name] = (0, node_path.extname)(file) === ".sql" ? await sqlMigration(file, raw) : await scriptMigration(file);
+		return migrations;
+	} };
+}
+/**
+* The seeds in a folder, loaded, in name order.
+*
+* Every one runs on every pass — there is no history to consult — so the order
+* is the only thing between two seeds where one reads what another writes.
+* Name them to sort that way.
+*/
+async function loadSeeds(folder, raw) {
+	const files = [...await migrationFiles(folder)].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+	const seeds = [];
+	for (const [name, file] of files) seeds.push({
+		name,
+		run: (0, node_path.extname)(file) === ".sql" ? (await sqlMigration(file, raw)).up : await scriptSeed(file)
+	});
+	return seeds;
+}
+/**
+* A seed script, imported as it is on disk now.
+*
+* Keyed by its modification time: a seed is run again after it is edited, and
+* a process that has imported it once would otherwise run the old one.
+*/
+async function scriptSeed(file) {
+	const url = (0, node_url.pathToFileURL)(file);
+	url.searchParams.set("mtime", String((await (0, node_fs_promises.stat)(file)).mtimeMs));
+	const module = await import(url.href);
+	if (typeof module.seed !== "function") throw new SeedHasNoSeed(file);
+	return module.seed;
+}
+function isMigration(file) {
+	if (file.endsWith(".d.ts")) return false;
+	if (/\.(spec|test)\.[cm]?[jt]s$/.test(file)) return false;
+	const extension = (0, node_path.extname)(file);
+	return extension === ".sql" || SCRIPTS.has(extension);
+}
+async function scriptMigration(file) {
+	const module = await import((0, node_url.pathToFileURL)(file).href);
+	if (typeof module.up !== "function") throw new MigrationHasNoUp(file);
+	return {
+		up: module.up,
+		...typeof module.down === "function" ? { down: module.down } : {}
+	};
+}
+/**
+* A `.sql` file, run whole.
+*
+* One query rather than split on `;`: with no parameters, Postgres takes
+* several statements in one message, and splitting by hand breaks on the first
+* `;` inside a string or a function body. There is no `down` — a generated
+* schema is rolled back by a migration that says how, not by guessing.
+*/
+async function sqlMigration(file, raw) {
+	const statements = await (0, node_fs_promises.readFile)(file, "utf-8");
+	return { up: async (db) => {
+		await raw.raw(statements).execute(db);
+	} };
+}
+//#endregion
+//#region src/migrate/databases.ts
+/**
+* Bring each construct's schema up to its migrations folder.
+*
+* Which constructs, in what order, from which folder, is `migrationTargets`'
+* answer and nobody else's. What is decided here is only how one target is
+* run: as its owner, in its own schema, with a history of its own.
+*/
+/** A folder under `db/` that names no construct. */
+var UnknownMigrationFolder = class extends Error {
+	folder;
+	known;
+	constructor(folder, known) {
+		super(`${folder} names no database construct, so its migrations would never run. ${known.length > 0 ? `The folders that do: ${known.join(", ")}.` : "This project declares no database."} Rename the folder after the construct it belongs to.`);
+		this.folder = folder;
+		this.known = known;
+		this.name = "UnknownMigrationFolder";
+	}
+};
+/** A construct was asked for by a name that takes no migrations. */
+var NoSuchMigrationTarget = class extends Error {
+	construct;
+	known;
+	constructor(construct, known) {
+		super(`'${construct}' is not a database construct. ` + (known.length > 0 ? `The ones with migrations: ${known.join(", ")}.` : "This project declares no database."));
+		this.construct = construct;
+		this.known = known;
+		this.name = "NoSuchMigrationTarget";
+	}
+};
+/**
+* A migration left directly in a construct's folder, where nothing reads it.
+*
+* Migrations moved into `migrations/` so seeds could sit beside them. A file
+* still at the old level would otherwise never run, and nothing would say so.
+*/
+var MigrationsOutsideFolder = class extends Error {
+	folder;
+	files;
+	constructor(folder, files) {
+		super(`${folder} has ${files.join(", ")} directly inside it, where nothing runs them. Migrations live in ${folder}/migrations/ and seeds in ${folder}/seeds/ — move ${files.length === 1 ? "it" : "them"} there.`);
+		this.folder = folder;
+		this.files = files;
+		this.name = "MigrationsOutsideFolder";
+	}
+};
+/** A folder inside a construct's folder that is neither `migrations` nor `seeds`. */
+var UnknownDatabaseFolder = class extends Error {
+	folder;
+	constructor(folder) {
+		super(`${folder} is neither migrations/ nor seeds/, so nothing in it would ever run. A construct's folder holds those two; rename or remove it.`);
+		this.folder = folder;
+		this.name = "UnknownDatabaseFolder";
+	}
+};
+/** A seed failed; its own writes are rolled back, the ones before it stay. */
+var SeedFailed = class extends Error {
+	construct;
+	seed;
+	cause;
+	constructor(construct, seed, cause) {
+		super(`${construct}: seed '${seed}' failed — ${cause instanceof Error ? cause.message : String(cause)}. Its writes were rolled back; fix it and run it again.`);
+		this.construct = construct;
+		this.seed = seed;
+		this.cause = cause;
+		this.name = "SeedFailed";
+	}
+};
+/** A construct with roles has no owner URL to migrate with. */
+var NoOwnerCredential = class extends Error {
+	construct;
+	key;
+	constructor(construct, key) {
+		super(`${construct} has no ${key} to migrate with. Migrations run as the owner role — the runtime one cannot create a table — and nothing resolved its URL. Is the stage reconciled?`);
+		this.construct = construct;
+		this.key = key;
+		this.name = "NoOwnerCredential";
+	}
+};
+/** A migration failed; the ones before it in the run stay applied. */
+var MigrationFailed = class extends Error {
+	construct;
+	migration;
+	cause;
+	constructor(construct, migration, cause) {
+		super(`${construct}: migration ${migration ? `'${migration}' ` : ""}failed — ${cause instanceof Error ? cause.message : String(cause)}`);
+		this.construct = construct;
+		this.migration = migration;
+		this.cause = cause;
+		this.name = "MigrationFailed";
+	}
+};
+/** The project's Kysely could not be found from where a database is declared. */
+var KyselyNotFound = class extends Error {
+	from;
+	constructor(from) {
+		super(`Could not resolve 'kysely' from ${from}. Migrations run with the project's own Kysely — install it where the database is declared.`);
+		this.from = from;
+		this.name = "KyselyNotFound";
+	}
+};
+/** Apply every pending migration, construct by construct, parents first. */
+async function migrateDatabases(options) {
+	const runs = [];
+	for (const target of await targetsFor(options)) {
+		if ((await migrationFiles((0, node_path.join)(options.root, target.migrations))).size === 0) {
+			runs.push({
+				target,
+				applied: []
+			});
+			continue;
+		}
+		const applied = await withMigrator(options, target, async (migrator) => {
+			const { error, results = [] } = await migrator.migrateToLatest();
+			if (error) {
+				const failed = results.find((result) => result.status === "Error");
+				throw new MigrationFailed(target.id, failed?.migrationName, error);
+			}
+			return results.filter((result) => result.status === "Success").map((result) => result.migrationName);
+		});
+		runs.push({
+			target,
+			applied
+		});
+	}
+	return runs;
+}
+/**
+* Run every construct's seeds, parents first — each one, every time, on every
+* stage, production included. Each is handed the stage, so a seed decides
+* what belongs where.
+*
+* Seeds are reference data kept up to date by being run again, so there is no
+* history: a seed is an upsert, and a changed one is applied by the next run.
+* Each runs in its own transaction, as the construct's owner, so a failure
+* leaves nothing half-written. Assumes the schema is migrated —
+* {@link migrateAndSeed} is what makes that true.
+*/
+async function seedDatabases(options) {
+	const runs = [];
+	for (const target of await targetsFor(options)) {
+		const folder = (0, node_path.join)(options.root, target.seeds);
+		if ((await migrationFiles(folder)).size === 0) {
+			runs.push({
+				target,
+				seeded: []
+			});
+			continue;
+		}
+		const seeded = await withOwner(options, target, async (db, kysely) => {
+			const names = [];
+			for (const seed of await loadSeeds(folder, kysely.sql)) {
+				try {
+					await db.transaction().execute((trx) => seed.run(trx, { stage: options.stage }));
+				} catch (error) {
+					throw new SeedFailed(target.id, seed.name, error);
+				}
+				names.push(seed.name);
+			}
+			return names;
+		});
+		runs.push({
+			target,
+			seeded
+		});
+	}
+	return runs;
+}
+/**
+* Migrate, then seed: a seed only ever runs against the schema it was written
+* for.
+*
+* With `only`, the constructs it lives in are migrated too — a tenant's seed
+* cannot run before the database that owns its schema exists — and only it is
+* seeded.
+*/
+async function migrateAndSeed(options) {
+	const migrations = [];
+	for (const target of await withParents(options)) migrations.push(...await migrateDatabases({
+		...options,
+		only: target.id
+	}));
+	return {
+		migrations,
+		seeds: await seedDatabases(options)
+	};
+}
+/** The targets `only` names, after the ones it lives in; all without it. */
+async function withParents(options) {
+	const chosen = await targetsFor(options);
+	if (!options.only) return chosen;
+	const all = (0, _geekmidas_manifest.migrationTargets)(options.manifest);
+	const ids = /* @__PURE__ */ new Set();
+	for (const target of chosen) {
+		let current = target;
+		while (current) {
+			ids.add(current.id);
+			const parent = current.of;
+			current = parent ? all.find((t) => t.id === parent) : void 0;
+		}
+	}
+	return all.filter((target) => ids.has(target.id));
+}
+/**
+* What each construct's folder has that its history does not — without
+* applying any of it. What `gkm dev` reports.
+*/
+async function pendingMigrations(options) {
+	const found = [];
+	for (const target of await targetsFor(options)) {
+		if ((await migrationFiles((0, node_path.join)(options.root, target.migrations))).size === 0) continue;
+		const pending = await withMigrator(options, target, async (migrator) => (await migrator.getMigrations()).filter((migration) => migration.executedAt === void 0).map((migration) => migration.name));
+		if (pending.length > 0) found.push({
+			target,
+			pending
+		});
+	}
+	return found;
+}
+/**
+* The targets this run covers, with every folder under `db/` accounted for.
+*
+* A folder that names no construct is an error rather than something to skip:
+* a typo in its name is otherwise a migration that silently never runs.
+*/
+async function targetsFor(options) {
+	const targets = (0, _geekmidas_manifest.migrationTargets)(options.manifest);
+	const folders = targets.map((target) => target.folder);
+	for (const folder of await foldersIn((0, node_path.join)(options.root, _geekmidas_manifest.MIGRATIONS_ROOT))) {
+		const relative = `${_geekmidas_manifest.MIGRATIONS_ROOT}/${folder}`;
+		if (!folders.includes(relative)) throw new UnknownMigrationFolder(relative, folders);
+		await checkLayout(options.root, relative);
+	}
+	if (!options.only) return targets;
+	const id = (0, _geekmidas_manifest.canonicalId)(options.only);
+	const chosen = targets.filter((target) => target.id === id);
+	if (chosen.length === 0) throw new NoSuchMigrationTarget(options.only, targets.map((target) => target.id));
+	return chosen;
+}
+/**
+* A construct's folder holds `migrations/` and `seeds/`, and nothing else —
+* anything beside them is a file or folder nothing would ever run.
+*/
+async function checkLayout(root, folder) {
+	const entries = await (0, node_fs_promises.readdir)((0, node_path.join)(root, folder), { withFileTypes: true });
+	const loose = entries.filter((entry) => entry.isFile() && !entry.name.startsWith(".")).map((entry) => entry.name);
+	if (loose.length > 0) throw new MigrationsOutsideFolder(folder, loose);
+	for (const entry of entries) if (entry.isDirectory() && !_geekmidas_manifest.DATABASE_FOLDERS.includes(entry.name)) throw new UnknownDatabaseFolder(`${folder}/${entry.name}`);
+}
+async function foldersIn(dir) {
+	return (await (0, node_fs_promises.readdir)(dir, { withFileTypes: true }).catch((error) => {
+		if (error.code === "ENOENT") return [];
+		throw error;
+	})).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+}
+/**
+* A migrator for one target, connected as its owner.
+*
+* No `migrationTableSchema`: the owner role's `search_path` is pinned to the
+* construct's schema, so the history lands there — `app.kysely_migration` for
+* the database, `auth_database.kysely_migration` for its tenant — and two
+* constructs in one Postgres never share one.
+*
+* Unordered migrations are allowed. Files are timestamped, so a branch merged
+* after another's migration ran carries an older one; refusing it would make
+* every such merge a manual repair.
+*/
+async function withMigrator(options, target, run) {
+	return withOwner(options, target, (db, { Migrator, sql }) => run(new Migrator({
+		db,
+		provider: folderProvider((0, node_path.join)(options.root, target.migrations), sql),
+		allowUnorderedMigrations: true
+	})));
+}
+/**
+* One target's database, connected as its owner and closed afterwards — what
+* migrations and seeds both run as.
+*/
+async function withOwner(options, target, run) {
+	const kysely = await kyselyFrom(options.sources?.[target.id]?.file ?? (target.of ? options.sources?.[target.of]?.file : void 0) ?? (0, node_path.join)(options.root, "package.json"));
+	const db = new kysely.Kysely({ dialect: new kysely.PostgresDialect({ pool: new pg.default.Pool(poolConfig(ownerUrl(options, target))) }) });
+	try {
+		return await run(db, kysely);
+	} finally {
+		await db.destroy();
+	}
+}
+/**
+* The owner's URL, with no fallback to the runtime one.
+*
+* The runtime role can create nothing, so falling back would only move the
+* failure to the first `CREATE TABLE` and make it read like a permissions
+* bug. The one exception is a database declared `roles: false`, where there is
+* no owner — both URLs are the master credential by design.
+*/
+function ownerUrl(options, target) {
+	const key = (0, _geekmidas_manifest.provideKey)(target.id, "ownerUrl");
+	const owner = options.env[key];
+	if (owner) return owner;
+	const database = options.manifest[target.of ?? target.id];
+	if (database?.kind === "database" && database.roles === false) {
+		const url = options.env[(0, _geekmidas_manifest.provideKey)(target.id, "url")];
+		if (url) return url;
+	}
+	throw new NoOwnerCredential(target.id, key);
+}
+/**
+* Pool settings for a URL, with `?search_path=` as the startup option Postgres
+* reads. Only a `roles: false` URL carries it — a role pins its own.
+*/
+function poolConfig(url) {
+	const parsed = new URL(url);
+	const searchPath = parsed.searchParams.get("search_path");
+	if (!searchPath) return { connectionString: url };
+	parsed.searchParams.delete("search_path");
+	return {
+		connectionString: parsed.toString(),
+		options: `-c search_path=${searchPath}`
+	};
+}
+/** Kysely as the project resolves it from `from`. */
+async function kyselyFrom(from) {
+	const require$1 = (0, node_module.createRequire)(from);
+	try {
+		const [main, migration] = await Promise.all([import((0, node_url.pathToFileURL)(require$1.resolve("kysely")).href), import((0, node_url.pathToFileURL)(require$1.resolve("kysely/migration")).href)]);
+		return {
+			Kysely: main.Kysely,
+			PostgresDialect: main.PostgresDialect,
+			sql: main.sql,
+			Migrator: migration.Migrator
+		};
+	} catch {
+		throw new KyselyNotFound(from);
+	}
+}
+//#endregion
+//#region src/target/compose/health.ts
+/**
+* Asking each app of a stack whether it answers — through Caddy, over HTTPS,
+* the way a browser reaches it.
+*
+* `docker compose up --wait` already knows each container passed its own
+* health check, asked on 127.0.0.1 inside it. What that cannot say is whether
+* the stack is reachable: whether the edge routes the host to the app, and
+* whether the certificate it presents is one a client accepts. So the check
+* goes through the edge, by hostname, and verifies the certificate.
+*/
+/** A request that got no answer in time. */
+var HealthRequestTimedOut = class extends Error {
+	url;
+	timeoutMs;
+	constructor(url, timeoutMs) {
+		super(`${url} did not answer within ${timeoutMs}ms. Check the stack is up with \`docker compose ps\`.`);
+		this.url = url;
+		this.timeoutMs = timeoutMs;
+		this.name = "HealthRequestTimedOut";
+	}
+};
+/** The real probe: one HTTPS GET, the certificate verified. */
+const httpsProbe = ({ url, ca, connectTo, timeoutMs, signal }) => {
+	const target = new URL(url);
+	return new Promise((resolve, reject) => {
+		const req = (0, node_https.request)({
+			host: connectTo ?? target.hostname,
+			port: target.port || 443,
+			servername: target.hostname,
+			path: `${target.pathname}${target.search}`,
+			method: "GET",
+			headers: { host: target.host },
+			...ca ? { ca } : {},
+			...signal ? { signal } : {},
+			timeout: timeoutMs
+		}, (res) => {
+			res.resume();
+			res.on("end", () => resolve(res.statusCode ?? 0));
+			res.on("error", reject);
+		});
+		req.on("timeout", () => req.destroy(new HealthRequestTimedOut(url, timeoutMs)));
+		req.on("error", reject);
+		req.end();
+	});
+};
+/** Whether a status means the app answered as it should. */
+function isHealthy(status) {
+	return status >= 200 && status < 400;
+}
+/** Apps that did not answer through the edge. */
+var ComposeAppsUnhealthy = class extends Error {
+	project;
+	apps;
+	constructor(project, apps) {
+		super(`${project} started, but ${apps.length === 1 ? "this app does" : "these apps do"} not answer through Caddy:\n` + apps.map(({ url, last }) => `  - ${url}: ${last}`).join("\n") + `\nSee why with \`docker compose -p ${project} logs caddy ${apps.map((a) => a.app).join(" ")}\`.`);
+		this.project = project;
+		this.apps = apps;
+		this.name = "ComposeAppsUnhealthy";
+	}
+};
+//#endregion
+//#region src/target/compose/phases.ts
+/**
+* The compose target's phases: a stage as one Docker Compose stack behind
+* Caddy, on the machine the deploy runs on.
+*
+* The order is the point of this file, and the rules it keeps are these:
+*
+* - A tag is checked before anything happens (`validate`). Every app's image
+*   is asked of the registry first; one missing image stops the run naming
+*   them all, and nothing is written, pulled or started.
+* - The databases exist before the apps do (`provision`). Postgres comes up
+*   alone, its databases, roles and grants are created and its migrations
+*   applied from this machine, and only then do the apps start — so an app
+*   never boots against a schema that is not there yet.
+* - What a stage runs is recorded (`release`). Each app's image, the tag it
+*   was released under and the digest it resolved to are written to the
+*   stage's state, so "what is this stage running" has an exact answer.
+* - What was started answers (`verify`): each app is asked through Caddy,
+*   over HTTPS, with the certificate verified.
+*
+* Docker, the registry, the bundler, Postgres and the health probe are
+* injected, so the rules are asserted without a daemon; the defaults are the
+* real ones.
+*/
+/** A port variable that does not hold a port. */
+var EdgePortInvalid = class extends Error {
+	variable;
+	value;
+	constructor(variable, value) {
+		super(`${variable}=${value} is not a port. Set it to a number between 1 and 65535, or unset it for the default.`);
+		this.variable = variable;
+		this.value = value;
+		this.name = "EdgePortInvalid";
+	}
+};
+/** A build with no commit to tag its images with. */
+var NoGitRevision = class extends Error {
+	root;
+	constructor(root) {
+		super(`Images built here are tagged with the commit they were built from, and ${root} is not in a git repository with a commit. Commit, or pass --tag to name the images yourself.`);
+		this.root = root;
+		this.name = "NoGitRevision";
+	}
+};
+/** A backend's production bundle did not build. */
+var BundleFailed = class extends Error {
+	app;
+	exitCode;
+	stderr;
+	constructor(app, exitCode, stderr) {
+		super(`Bundling '${app}' for production failed (exit code ${exitCode}).${stderr.trim() ? `\n${stderr.trim().slice(-4e3)}` : ""}\nRun \`gkm build --provider server --production\` in the app's directory to see it again.`);
+		this.app = app;
+		this.exitCode = exitCode;
+		this.stderr = stderr;
+		this.name = "BundleFailed";
+	}
+};
+/** The CLI's own entry, which the bundle step runs, is not where it should be. */
+var CliEntryNotFound = class extends Error {
+	from;
+	constructor(from) {
+		super(`Could not find bin/gkm.mjs above ${from}, which bundling a backend runs. Reinstall @geekmidas/cli.`);
+		this.from = from;
+		this.name = "CliEntryNotFound";
+	}
+};
+/** The commit HEAD is at, short — and `-dirty` when the tree has changes. */
+async function gitRevision(root) {
+	let sha;
+	try {
+		sha = (await require_local.runOutput("git", [
+			"rev-parse",
+			"--short",
+			"HEAD"
+		], { cwd: root })).trim();
+	} catch {
+		throw new NoGitRevision(root);
+	}
+	if (!sha) throw new NoGitRevision(root);
+	return (await require_local.runOutput("git", ["status", "--porcelain"], { cwd: root }).catch(() => "")).trim() ? `${sha}-dirty` : sha;
+}
+/** The edge's ports, from the environment — 443 and 80 when unset. */
+function edgePorts(env = process.env) {
+	const read = (variable, fallback) => {
+		const value = env[variable];
+		if (value === void 0 || value === "") return fallback;
+		const port = Number(value);
+		if (!Number.isInteger(port) || port < 1 || port > 65535) throw new EdgePortInvalid(variable, value);
+		return port;
+	};
+	return {
+		https: read(EDGE_PORT_ENV.https, 443),
+		http: read(EDGE_PORT_ENV.http, 80)
+	};
+}
+/** `bin/gkm.mjs` of the CLI that is running. */
+function cliEntry() {
+	const from = (0, node_path.dirname)((0, node_url.fileURLToPath)(require("url").pathToFileURL(__filename).href));
+	for (let dir = from; (0, node_path.dirname)(dir) !== dir; dir = (0, node_path.dirname)(dir)) {
+		const entry = (0, node_path.join)(dir, "bin", "gkm.mjs");
+		if ((0, node_fs.existsSync)(entry)) return entry;
+	}
+	throw new CliEntryNotFound(from);
+}
+/** A cold production bundle is seconds; a hung one must not hold the lock. */
+const BUNDLE_TIMEOUT_MS = 6e5;
+/**
+* Bundle a backend with the gkm that is running — the same build a deploy
+* makes, so the image holds one file and no dependencies — in the run's
+* sandbox, because the build imports the project's code.
+*/
+async function bundleInSandbox(appRoot, ctx) {
+	const sandbox = require_sandbox.activeSandbox() ?? new require_local.LocalSandbox({ root: ctx.cwd });
+	const result = await sandbox.exec("node", [
+		cliEntry(),
+		"build",
+		"--provider",
+		"server",
+		"--production"
+	], {
+		cwd: appRoot,
+		env: sandbox.env,
+		timeoutMs: BUNDLE_TIMEOUT_MS,
+		output: ctx.childOutput,
+		signal: ctx.signal
+	});
+	if (result.exitCode !== 0) throw new BundleFailed(appRoot, result.exitCode, result.stderr);
+}
+/**
+* The real ones. Each app is asked for three minutes before it counts as
+* down: a deployed stage's first ACME certificate can take that long.
+*/
+const defaultDeps = {
+	docker: dockerCompose,
+	bundle: bundleInSandbox,
+	revision: gitRevision,
+	sql: require_state.pgClient,
+	migrate: migrateDatabases,
+	probe: httpsProbe,
+	healthAttempts: 90,
+	healthIntervalMs: 2e3,
+	env: process.env
+};
+/**
+* The stack the stage would run, and — for a tag — the registry's word that
+* every image it names exists. Nothing is written: a missing image stops the
+* run here, before a file, a secret or a container is touched.
+*/
+async function validateCompose(ctx, deps, forced) {
+	const { workspace, stage, identity, tag } = ctx;
+	const root = workspace.root;
+	const mode = forced ?? (ctx.tagGiven ? "pull" : "build");
+	const runnables = {};
+	const manifest = await require_discover.discover({
+		patterns: require_state.constructGlobs(workspace),
+		cwd: root,
+		runnables
+	});
+	const { secrets, generated } = await stageSecrets(ctx, manifest);
+	const stack = composeStack({
+		workspace,
+		manifest,
+		runnables,
+		stage,
+		identity,
+		images: {
+			mode,
+			tag,
+			...workspace.deploy?.registry ? { registry: workspace.deploy.registry } : {}
+		},
+		secrets,
+		ports: edgePorts(deps.env),
+		packageManager: require_state.detectPackageManager(root),
+		packages: Object.fromEntries(Object.entries(workspace.apps).map(([name, app]) => [name, require_state.appPackageName(root, name, app.path)]))
+	});
+	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, stack.apps);
+	const dir = (0, node_path.join)(root, stackDir(stage));
+	const previous = (await ctx.state.read(stage))?.state.images ?? {};
+	return {
+		mode,
+		stack,
+		dir,
+		ref: {
+			project: composeProject(identity),
+			file: (0, node_path.join)(dir, "docker-compose.yml"),
+			cwd: root,
+			output: ctx.childOutput,
+			signal: ctx.signal
+		},
+		secrets,
+		generated,
+		previous,
+		files: [],
+		images: {},
+		changes: []
+	};
+}
+/**
+* The stage's secrets — and, for a deployed stage, everything it generates
+* once: its seed, and each declared secret and keyring. Kept only once the
+* run goes ahead (`provision`), so a dry run, or a tag that is not there,
+* leaves the stage's secrets as it found them.
+*/
+async function stageSecrets(ctx, manifest) {
+	const stored = await ctx.secrets.read();
+	if (ctx.stage === ctx.workspace.stages.local) return {
+		secrets: stored,
+		generated: []
+	};
+	const { secrets, generated } = require_state.withGeneratedSecrets(stored ?? require_storage.initStageSecrets(ctx.stage), manifest);
+	if (secrets.seed) ctx.secrets.mask(secrets.seed);
+	for (const value of Object.values(secrets.custom ?? {})) ctx.secrets.mask(value);
+	return {
+		secrets,
+		generated
+	};
+}
+/**
+* A dry run: the stack's files, written so they can be read, and what a real
+* run would do — no image is built or pulled, no container touched, nothing
+* recorded and no secret kept.
+*/
+async function planCompose(ctx, run) {
+	if (run.generated.length > 0) ctx.logger.info(`🔑 "${ctx.stage}" has no ${run.generated.join(", ")} yet; this dry run used values it did not keep.`);
+	run.files = await writeStack(ctx.cwd, run.dir, run.stack);
+	printPlan(ctx, run);
+	const planned = (change) => {
+		run.changes.push(change);
+		ctx.emit({
+			type: "resource.planned",
+			...change
+		});
+	};
+	for (const service of run.stack.infra) planned({
+		key: `service:${service}`,
+		resourceType: "service",
+		action: "ensure"
+	});
+	for (const app of run.stack.apps) {
+		planned({
+			key: `image:${app.name}`,
+			resourceType: "image",
+			action: run.mode === "build" ? "build" : "reuse",
+			id: app.ref
+		});
+		planned({
+			key: `service:${app.name}`,
+			resourceType: "service",
+			action: run.previous[app.name] ? "reuse" : "create"
+		});
+	}
+	planned({
+		key: "service:caddy",
+		resourceType: "service",
+		action: "ensure"
+	});
+}
+/**
+* What the apps run on: the stage's generated secrets kept, the stack's files
+* written, its infrastructure started, and its databases, roles, grants and
+* migrations applied.
+*/
+async function provisionCompose(ctx, run, deps) {
+	const { stack, ref } = run;
+	if (run.generated.length > 0 && run.secrets) {
+		await ctx.secrets.write(run.secrets);
+		ctx.logger.info(`🔑 Generated for "${ctx.stage}" (${ctx.secrets.store}): ${run.generated.join(", ")}`);
+	}
+	run.files = await writeStack(ctx.cwd, run.dir, stack);
+	printPlan(ctx, run);
+	if (stack.infra.length > 0) {
+		ctx.logger.info(`\n🗄️  Starting ${stack.infra.join(", ")}…`);
+		await deps.docker.up(ref, stack.infra);
+		for (const service of stack.infra) applied(ctx, run, {
+			key: `service:${service}`,
+			resourceType: "service",
+			action: "ensure",
+			id: `${stack.project}/${service}`,
+			via: Object.keys(run.previous).length > 0 ? "recorded" : "created"
+		});
+	}
+	if (stack.infra.includes("postgres")) await prepareDatabases(ctx, run, deps);
+}
+/** Create what the plan names in the stack's Postgres, then migrate it. */
+async function prepareDatabases(ctx, run, deps) {
+	const { stack } = run;
+	const workspace = ctx.workspace;
+	const port = await deps.docker.port(run.ref, "postgres", 5432);
+	const statements = require_state.postgresStatements(stack.plan, workspace.name, stack.credential.seed);
+	if (statements.length > 0) {
+		ctx.logger.info("🗄️  Creating databases, roles and grants…");
+		await require_state.applyPostgres(deps.sql(port, stack.credential.master), statements);
+	}
+	const sources = {};
+	const manifest = await require_discover.discover({
+		patterns: require_state.constructGlobs(workspace),
+		cwd: workspace.root,
+		sources
+	});
+	const env = require_state.envFor(stack.plan, {
+		ports: { [require_state.primaryPortKey("postgres")]: port },
+		project: workspace.name,
+		master: stack.credential.master,
+		...stack.credential.seed ? { seed: stack.credential.seed } : {}
+	});
+	const runs = await deps.migrate({
+		root: workspace.root,
+		manifest,
+		sources,
+		env
+	});
+	for (const { target, applied } of runs) if (applied.length > 0) ctx.logger.info(`🗄️  ${target.migrations}: applied ${applied.length}`);
+}
+/**
+* Each app's image: built from this checkout — every backend bundled first,
+* on the host, with this CLI — or pulled at the tag. Nothing live changes.
+*/
+async function buildCompose(ctx, run, deps) {
+	const { stack, ref } = run;
+	const apps = stack.apps.map((app) => app.name);
+	if (run.mode === "build") {
+		for (const app of stack.apps.filter((a) => a.kind === "rest-api")) {
+			ctx.signal.throwIfAborted();
+			ctx.logger.info(`\n📦 Bundling ${app.name}…`);
+			await deps.bundle((0, node_path.join)(ctx.cwd, app.path), ctx);
+		}
+		ctx.logger.info("\n🐳 Building images…");
+		await deps.docker.build(ref, apps);
+	} else {
+		ctx.logger.info(`\n🐳 Pulling ${ctx.tag}…`);
+		await deps.docker.pull(ref, apps);
+	}
+	for (const app of stack.apps) {
+		const digest = await deps.docker.digest(app.ref);
+		run.images[app.name] = {
+			ref: app.ref,
+			tag: app.tag,
+			...digest ? { digest } : {}
+		};
+		ctx.emit({
+			type: "artifact.built",
+			app: app.name,
+			imageRef: app.ref,
+			...digest ? { digest } : {}
+		});
+		run.changes.push({
+			key: `image:${app.name}`,
+			resourceType: "image",
+			action: run.mode === "build" ? "build" : "reuse",
+			id: digest ?? app.ref
+		});
+	}
+}
+/**
+* The whole stack up — anything it no longer defines removed — and each
+* app's image recorded in the stage's state.
+*/
+async function releaseCompose(ctx, run, deps) {
+	const { stack, ref } = run;
+	ctx.logger.info("\n🚀 Starting the stack…");
+	await deps.docker.up(ref);
+	if (stack.local) await deps.docker.copyOut(ref, "caddy", "/data/caddy/pki/authorities/local/root.crt", caFile(run)).catch(() => {});
+	await recordImages(ctx, run);
+	for (const app of stack.apps) {
+		const image = run.images[app.name];
+		applied(ctx, run, {
+			key: `service:${app.name}`,
+			resourceType: "service",
+			action: "ensure",
+			id: `${stack.project}/${app.name}`,
+			via: run.previous[app.name] ? "recorded" : "created"
+		});
+		ctx.emit({
+			type: "app.deployed",
+			app: app.name,
+			applicationId: `${stack.project}/${app.name}`,
+			imageRef: image?.ref ?? app.ref,
+			url: app.url
+		});
+	}
+	ctx.logger.info(`\n✅ ${stack.project} is running:`);
+	for (const app of stack.apps) ctx.logger.info(`   ${app.name.padEnd(12)} ${app.url}`);
+	if (stack.local) ctx.logger.info(`\n🔐 Certificates are from Caddy's local CA: NODE_EXTRA_CA_CERTS=${(0, node_path.join)(stackDir(ctx.stage), "caddy-root.crt")}`);
+}
+/**
+* Each app's image in the stage's state — the same `images` a Dokploy deploy
+* records: the ref it runs, the tag it was released under, and the digest
+* the tag resolved to.
+*/
+async function recordImages(ctx, run) {
+	const journal = await require_state.DeployJournal.open(ctx.state, ctx.stage, () => require_state.createEmptyState(ctx.stage, "", ""));
+	for (const app of run.stack.apps) {
+		const image = run.images[app.name] ?? {
+			ref: app.ref,
+			tag: app.tag
+		};
+		require_state.setDeployedImage(journal.state, app.name, image);
+	}
+	journal.state.identity = ctx.identity.key;
+	await journal.save();
+}
+/**
+* Each app asked through Caddy, over HTTPS, the certificate verified: an API
+* at `/health`, a site at `/`. On the local stage the edge is this machine and
+* its certificates are Caddy's internal CA's, so the CA `release` copied out
+* is the one trusted and the request goes to 127.0.0.1.
+*/
+async function verifyCompose(ctx, run, deps) {
+	const { stack } = run;
+	const ca = stack.local ? await (0, node_fs_promises.readFile)(caFile(run), "utf-8").catch(() => void 0) : void 0;
+	ctx.logger.info("\n🩺 Checking each app through Caddy…");
+	const down = (await Promise.all(stack.apps.map((app) => checkApp(ctx, app, deps, {
+		ca,
+		local: stack.local
+	})))).filter((result) => !result.healthy).map(({ app, url, last }) => ({
+		app,
+		url,
+		last
+	}));
+	if (down.length > 0) throw new ComposeAppsUnhealthy(stack.project, down);
+}
+async function checkApp(ctx, app, deps, options) {
+	const url = `${app.url}${app.kind === "site" ? "/" : "/health"}`;
+	let last = "not asked";
+	for (let attempt = 1; attempt <= deps.healthAttempts; attempt++) {
+		ctx.signal.throwIfAborted();
+		let status;
+		try {
+			status = await deps.probe({
+				url,
+				...options.ca ? { ca: options.ca } : {},
+				...options.local ? { connectTo: "127.0.0.1" } : {},
+				timeoutMs: 1e4,
+				signal: ctx.signal
+			});
+			last = `HTTP ${status}`;
+		} catch (error) {
+			last = error instanceof Error ? error.message : String(error);
+		}
+		const healthy = status !== void 0 && isHealthy(status);
+		ctx.emit({
+			type: "health.checked",
+			app: app.name,
+			url,
+			healthy,
+			...status !== void 0 ? { status } : {},
+			attempt
+		});
+		if (healthy) {
+			ctx.logger.info(`   ✓ ${app.name.padEnd(12)} ${url} (${last})`);
+			return {
+				app: app.name,
+				url,
+				last,
+				healthy
+			};
+		}
+		if (attempt < deps.healthAttempts) await new Promise((resolve) => setTimeout(resolve, deps.healthIntervalMs));
+	}
+	ctx.logger.warn(`   ✗ ${app.name.padEnd(12)} ${url} (${last})`);
+	return {
+		app: app.name,
+		url,
+		last,
+		healthy: false
+	};
+}
+function composeResult(ctx, run) {
+	const apps = run.stack.apps.map((app) => {
+		const image = run.images[app.name];
+		return {
+			appName: app.name,
+			type: app.kind === "site" ? "web" : "backend",
+			success: !ctx.dryRun,
+			applicationId: `${run.stack.project}/${app.name}`,
+			imageRef: image?.ref ?? app.ref,
+			...image?.digest ? { digest: image.digest } : {},
+			url: app.url
+		};
+	});
+	return {
+		apps,
+		projectId: run.stack.project,
+		successCount: ctx.dryRun ? 0 : apps.length,
+		failedCount: 0,
+		stage: ctx.stage,
+		identity: ctx.identity.key,
+		tag: ctx.tag,
+		dryRun: ctx.dryRun,
+		environmentId: "",
+		skipped: [...ctx.skipped],
+		urls: Object.fromEntries(run.stack.apps.map((app) => [app.name, app.url])),
+		changes: run.changes
+	};
+}
+function caFile(run) {
+	return (0, node_path.join)(run.dir, "caddy-root.crt");
+}
+function applied(ctx, run, change) {
+	const { via, ...rest } = change;
+	run.changes.push(rest);
+	ctx.emit({
+		type: "resource.applied",
+		...rest,
+		via
+	});
+}
+/** Write the stack's files: owner-only, since the env files hold secrets. */
+async function writeStack(root, dir, stack) {
+	await (0, node_fs_promises.mkdir)(dir, {
+		recursive: true,
+		mode: 448
+	});
+	await (0, node_fs_promises.chmod)(dir, 448);
+	const files = [];
+	const write = async (path, content, mode = 420) => {
+		await (0, node_fs_promises.mkdir)((0, node_path.dirname)(path), { recursive: true });
+		await (0, node_fs_promises.writeFile)(path, content, { mode });
+		await (0, node_fs_promises.chmod)(path, mode);
+		files.push(path);
+	};
+	await write((0, node_path.join)(dir, "docker-compose.yml"), composeYaml(stack));
+	await write((0, node_path.join)(dir, "Caddyfile"), stack.caddyfile);
+	for (const app of stack.apps) if (app.env) await write((0, node_path.join)(dir, `${app.name}.env`), envFile(app.env), 384);
+	for (const [path, content] of Object.entries(stack.dockerfiles)) await write((0, node_path.join)(root, path), content);
+	await ignoreStacks(root);
+	return files;
+}
+/** Make sure the build context leaves `.gkm/compose` out. */
+async function ignoreStacks(root) {
+	const path = (0, node_path.join)(root, ".dockerignore");
+	if (!(0, node_fs.existsSync)(path)) {
+		await (0, node_fs_promises.writeFile)(path, require_state.generateDockerignore());
+		return;
+	}
+	const current = await (0, node_fs_promises.readFile)(path, "utf-8");
+	if (/^\/?\.gkm\/compose\/?$|^\/?\.gkm\/?$/m.test(current)) return;
+	await (0, node_fs_promises.appendFile)(path, `${current.endsWith("\n") ? "" : "\n"}\n# gkm compose's stacks: each app's env file holds its stage's secrets\n.gkm/compose\n`);
+}
+function composeYaml(stack) {
+	const stage = stack.local ? "" : ` --stage ${stack.stage}`;
+	return `# Generated by gkm compose from the construct manifest — do not edit.
+# The ${stack.stage} stage's APIs and sites behind one Caddy. Each backend
+# reads exactly the keys in its own env file beside this one.
+#
+#   gkm compose${stage}          start or update it
+#   gkm compose${stage} --down   stop it
+${(0, yaml.stringify)(stack.compose, {
+		lineWidth: 0,
+		aliasDuplicateObjects: false
+	})}`;
+}
+function printPlan(ctx, run) {
+	const { stack, mode, files } = run;
+	ctx.logger.info(`\n🧱 ${stack.project} — stage ${stack.stage}`);
+	for (const app of stack.apps) ctx.logger.info(`   ${app.name.padEnd(12)} ${app.url.padEnd(40)} ${mode} ${app.ref}`);
+	if (stack.infra.length > 0) ctx.logger.info(`   infrastructure: ${stack.infra.join(", ")}`);
+	ctx.logger.info(`\n📝 Wrote ${files.length} file(s) under ${stackDir(stack.stage)}/`);
+}
+//#endregion
+//#region src/target/compose/index.ts
+/**
+* The built-in `compose` target: a stage as one Docker Compose stack behind
+* Caddy, on the machine that runs the deploy.
+*
+* ```bash
+* gkm deploy --target compose --stage production --tag v1.4.0  # what CI pushed
+* gkm deploy --target compose --stage production               # built from here
+* gkm deploy --target compose --stage development              # the local stage
+* ```
+*
+* - `validate`: the stack (`composeStack`, pure) and, for a tag, every image
+*   looked up in the registry — `ImageTagNotFound` before anything changes
+* - `plan`: the stack's files and what a run would create or reuse
+* - `provision`: generated secrets kept, files written, infrastructure up,
+*   databases, roles, grants and migrations
+* - `build`: each backend bundled on the host and every image built — or, for
+*   a tag, pulled
+* - `release`: `up --wait --remove-orphans`, and each app's image, tag and
+*   digest in the stage's state
+* - `verify`: each app asked through Caddy over HTTPS
+*
+* `gkm compose` is this target with a few more switches (`--build`, `--pull`,
+* `--down`), run through the same `deploy()`.
+*/
+var compose_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({ composeTarget: () => composeTarget });
+/** The compose target, with its Docker, bundler and probe as given. */
+function composeTarget(options = {}) {
+	const { mode, report, ...given } = options;
+	const deps = {
+		...defaultDeps,
+		...given
+	};
+	return require_define.defineTarget({
+		name: "compose",
+		runtime: "server",
+		capabilities: {
+			rollback: false,
+			migrations: "target",
+			images: true,
+			localStage: true
+		},
+		credentials: [],
+		tag: ({ cwd }) => deps.revision(cwd),
+		validate: (ctx) => validateCompose(ctx, deps, mode),
+		plan: (ctx, run) => planCompose(ctx, run),
+		provision: (ctx, run) => provisionCompose(ctx, run, deps),
+		build: (ctx, run) => buildCompose(ctx, run, deps),
+		release: (ctx, run) => releaseCompose(ctx, run, deps),
+		verify: (ctx, run) => verifyCompose(ctx, run, deps),
+		result: (ctx, run) => {
+			report?.(run);
+			return composeResult(ctx, run);
+		}
+	});
+}
+//#endregion
+Object.defineProperty(exports, "DuplicateMigration", {
+	enumerable: true,
+	get: function() {
+		return DuplicateMigration;
+	}
+});
+Object.defineProperty(exports, "KyselyNotFound", {
+	enumerable: true,
+	get: function() {
+		return KyselyNotFound;
+	}
+});
+Object.defineProperty(exports, "MigrationFailed", {
+	enumerable: true,
+	get: function() {
+		return MigrationFailed;
+	}
+});
+Object.defineProperty(exports, "MigrationHasNoUp", {
+	enumerable: true,
+	get: function() {
+		return MigrationHasNoUp;
+	}
+});
+Object.defineProperty(exports, "MigrationsOutsideFolder", {
+	enumerable: true,
+	get: function() {
+		return MigrationsOutsideFolder;
+	}
+});
+Object.defineProperty(exports, "NoOwnerCredential", {
+	enumerable: true,
+	get: function() {
+		return NoOwnerCredential;
+	}
+});
+Object.defineProperty(exports, "NoSuchMigrationTarget", {
+	enumerable: true,
+	get: function() {
+		return NoSuchMigrationTarget;
+	}
+});
+Object.defineProperty(exports, "SeedFailed", {
+	enumerable: true,
+	get: function() {
+		return SeedFailed;
+	}
+});
+Object.defineProperty(exports, "SeedHasNoSeed", {
+	enumerable: true,
+	get: function() {
+		return SeedHasNoSeed;
+	}
+});
+Object.defineProperty(exports, "UnknownDatabaseFolder", {
+	enumerable: true,
+	get: function() {
+		return UnknownDatabaseFolder;
+	}
+});
+Object.defineProperty(exports, "UnknownMigrationFolder", {
+	enumerable: true,
+	get: function() {
+		return UnknownMigrationFolder;
+	}
+});
+Object.defineProperty(exports, "composeProject", {
+	enumerable: true,
+	get: function() {
+		return composeProject;
+	}
+});
+Object.defineProperty(exports, "composeTarget", {
+	enumerable: true,
+	get: function() {
+		return composeTarget;
+	}
+});
+Object.defineProperty(exports, "compose_exports", {
+	enumerable: true,
+	get: function() {
+		return compose_exports;
+	}
+});
+Object.defineProperty(exports, "dockerCompose", {
+	enumerable: true,
+	get: function() {
+		return dockerCompose;
+	}
+});
+Object.defineProperty(exports, "migrateAndSeed", {
+	enumerable: true,
+	get: function() {
+		return migrateAndSeed;
+	}
+});
+Object.defineProperty(exports, "migrateDatabases", {
+	enumerable: true,
+	get: function() {
+		return migrateDatabases;
+	}
+});
+Object.defineProperty(exports, "pendingMigrations", {
+	enumerable: true,
+	get: function() {
+		return pendingMigrations;
+	}
+});
+Object.defineProperty(exports, "seedDatabases", {
+	enumerable: true,
+	get: function() {
+		return seedDatabases;
+	}
+});
+Object.defineProperty(exports, "stackDir", {
+	enumerable: true,
+	get: function() {
+		return stackDir;
+	}
+});
+
+//# sourceMappingURL=compose-391oEKj1.cjs.map