@geekmidas/cli 10.0.0-alpha.63 → 10.0.0-alpha.65

package/dist/compose-DprE3ASm.mjs

@@ -0,0 +1,1862 @@
+import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
+import { c as runOutput, s as run, t as LocalSandbox } from "./local-CWR4Y_kW.mjs";
+import { r as discover } from "./discover-LMrqsWSU.mjs";
+import { i as activeSandbox } from "./sandbox-Dm247NGx.mjs";
+import { t as appKey } from "./derive-B4vDpzgP.mjs";
+import { t as defineTarget } from "./define-DR8xGYfL.mjs";
+import { t as initStageSecrets } from "./storage-BzaUxmqe.mjs";
+import { f as imageRef } from "./store-CLiHnqOY.mjs";
+import { $ as portKeys, B as networkEnv, C as isMainFrontendApp, D as constructGlobs, F as postgresStatements, G as hostFor, H as localRolePassword, L as composeFor, N as applyPostgres, R as pgClient, S as validateImageRef, U as planFor, V as envFor, X as DEFAULT_IMAGES, b as generateDockerignore, et as primaryPortKey, f as DeployJournal, g as appPackageName, p as withGeneratedSecrets, s as setDeployedImage, t as createEmptyState, v as siteDockerfile, w as resolveHost, x as generateSlimDockerfile, y as detectPackageManager, z as appEnvKeys } from "./state-B8YwmUZU.mjs";
+import { n as DEFAULT_CACHE, r as DEFAULT_EVENTS } from "./fakes-C9RiT6XG.mjs";
+import { createRequire } from "node:module";
+import { dirname, extname, join } from "node:path";
+import { existsSync } from "node:fs";
+import { appendFile, chmod, mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
+import { DATABASE_FOLDERS, MIGRATIONS_ROOT, canonicalId, migrationTargets, provideKey, provisionOrder, publicEnvFor } from "@geekmidas/manifest";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { spawn } from "node:child_process";
+import pg from "pg";
+import { stringify } from "yaml";
+import { request } from "node:https";
+//#region src/compose/docker.ts
+/**
+* The Docker operations `gkm compose` needs, behind an interface.
+*
+* Small on purpose, like reconcile's: the rules about *when* each runs — the
+* registry is asked before anything is pulled, nothing is started for a tag
+* that is missing — are asserted against a fake, and this file is only the
+* wiring to the real CLI.
+*
+* Every call is an argument array. Image refs, tags and paths come from the
+* workspace, and none of them reaches a shell.
+*/
+/** `output` as `spawn` reads it. */
+const STDIO = {
+	inherit: "inherit",
+	stderr: [
+		"ignore",
+		2,
+		2
+	],
+	ignore: "ignore"
+};
+/** How a stack's docker commands run: where it is, where output goes. */
+function runOptions(stack, env) {
+	return {
+		cwd: stack.cwd,
+		stdio: STDIO[stack.output ?? "inherit"],
+		...env ? { env } : {},
+		...stack.signal ? { signal: stack.signal } : {}
+	};
+}
+/** How long a stack has to pass its health checks. */
+const WAIT_TIMEOUT_S = 180;
+/** `docker compose port` printed nothing a port can be read from. */
+var ServicePortUnknown = class extends Error {
+	service;
+	inside;
+	output;
+	constructor(service, inside, output) {
+		super(`'${service}' publishes no host port for ${inside} (docker said: ${output.trim() || "nothing"}). Is it running? \`docker compose ps\` shows the stack.`);
+		this.service = service;
+		this.inside = inside;
+		this.output = output;
+		this.name = "ServicePortUnknown";
+	}
+};
+function compose(stack, args) {
+	return [
+		"compose",
+		"-p",
+		stack.project,
+		"-f",
+		stack.file,
+		...args
+	];
+}
+/** Run a program and keep everything it said, whatever it exits with. */
+function capture(command, args, timeoutMs = 6e4) {
+	return new Promise((resolve, reject) => {
+		const child = spawn(command, [...args], {
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			shell: false
+		});
+		let stdout = "";
+		let stderr = "";
+		child.stdout.on("data", (chunk) => {
+			stdout += chunk.toString();
+		});
+		child.stderr.on("data", (chunk) => {
+			stderr += chunk.toString();
+		});
+		const timer = setTimeout(() => child.kill("SIGKILL"), timeoutMs);
+		timer.unref?.();
+		child.on("error", (error) => {
+			clearTimeout(timer);
+			reject(error);
+		});
+		child.on("close", (code) => {
+			clearTimeout(timer);
+			resolve({
+				code,
+				stdout,
+				stderr
+			});
+		});
+	});
+}
+/**
+* Whether a failed `docker manifest inspect` means the tag is not there, as
+* opposed to the registry not answering.
+*
+* Read off the message because that is all the CLI gives. Anything not
+* recognisably "no such tag" is treated as the registry being unreachable:
+* a registry that refused credentials must not be reported as a tag that was
+* never pushed, or the fix offered would be the wrong one.
+*/
+function isMissingManifest(output) {
+	return /no such manifest|manifest unknown|manifest for .* not found|not found: manifest/i.test(output);
+}
+const dockerCompose = {
+	async lookup(ref) {
+		const { code, stdout, stderr } = await capture("docker", [
+			"manifest",
+			"inspect",
+			ref
+		]);
+		if (code === 0) return {
+			ref,
+			status: "found"
+		};
+		const output = `${stderr}\n${stdout}`.trim();
+		return isMissingManifest(output) ? {
+			ref,
+			status: "missing"
+		} : {
+			ref,
+			status: "unreachable",
+			detail: output
+		};
+	},
+	async build(stack, services) {
+		await run("docker", compose(stack, ["build", ...services]), runOptions(stack, {
+			...process.env,
+			DOCKER_BUILDKIT: "1"
+		}));
+	},
+	async pull(stack, services) {
+		await run("docker", compose(stack, ["pull", ...services]), runOptions(stack));
+	},
+	async up(stack, services) {
+		await run("docker", compose(stack, [
+			"up",
+			"-d",
+			"--wait",
+			`--wait-timeout=${WAIT_TIMEOUT_S}`,
+			...services ? [] : ["--remove-orphans"],
+			...services ?? []
+		]), runOptions(stack));
+	},
+	async down(stack) {
+		await run("docker", compose(stack, ["down"]), runOptions(stack));
+	},
+	async port(stack, service, inside) {
+		const output = await runOutput("docker", compose(stack, [
+			"port",
+			service,
+			String(inside)
+		]), {
+			cwd: stack.cwd,
+			...stack.signal ? { signal: stack.signal } : {}
+		});
+		const port = Number(output.trim().split(":").pop());
+		if (!Number.isInteger(port) || port <= 0) throw new ServicePortUnknown(service, inside, output);
+		return port;
+	},
+	async copyOut(stack, service, from, to) {
+		await mkdir(dirname(to), { recursive: true });
+		await run("docker", compose(stack, [
+			"cp",
+			`${service}:${from}`,
+			to
+		]), runOptions(stack));
+	},
+	async digest(ref) {
+		const { code, stdout } = await capture("docker", [
+			"image",
+			"inspect",
+			"--format={{json .RepoDigests}} {{.Id}}",
+			ref
+		]);
+		if (code !== 0) return void 0;
+		const [json = "[]", id] = stdout.trim().split(" ");
+		const repository = ref.split("@")[0].replace(/:[\w][\w.-]*$/, "");
+		try {
+			const digests = JSON.parse(json);
+			const match = Array.isArray(digests) ? digests.find((entry) => typeof entry === "string" && entry.startsWith(`${repository}@`)) : void 0;
+			if (match) return match.slice(repository.length + 1);
+		} catch {}
+		return id || void 0;
+	}
+};
+//#endregion
+//#region src/compose/images.ts
+/**
+* The tag a site's image carries for a release.
+*
+* A site's public URLs are inlined when it is built, so one bundle serves one
+* stage: `v1.4.0-production` and `v1.4.0-staging` are two images of the same
+* commit. A backend reads its URLs at runtime, so one image serves every stage
+* and its tag is the release's alone.
+*/
+function siteTag(tag, stage) {
+	return `${tag}-${stage}`;
+}
+/** Images a tag names that the registry does not have. */
+var ImageTagNotFound = class extends Error {
+	tag;
+	refs;
+	constructor(tag, refs) {
+		super(`The registry has no image for ${refs.length === 1 ? "this app" : `${refs.length} apps`} at '${tag}':\n` + refs.map((ref) => `  - ${ref}`).join("\n") + `\nNothing was pulled or started. Push '${tag}' for every app from CI, pick a tag that exists, or run without --tag to build from this checkout.`);
+		this.tag = tag;
+		this.refs = refs;
+		this.name = "ImageTagNotFound";
+	}
+};
+/** The registry did not answer, or did not let this machine in. */
+var RegistryUnreachable = class extends Error {
+	ref;
+	detail;
+	constructor(ref, detail) {
+		super(`Could not ask the registry about ${ref}: ${detail || "no answer"}\nNothing was pulled or started. Check the registry is reachable and that this machine is logged in to it (\`docker login <registry>\`).`);
+		this.ref = ref;
+		this.detail = detail;
+		this.name = "RegistryUnreachable";
+	}
+};
+/**
+* Assert every image exists, before anything else happens.
+*
+* Asked all at once and reported all at once: a release missing two images is
+* one problem with two names, and finding the second only after fixing the
+* first is a slower way to learn the same thing.
+*
+* @throws {RegistryUnreachable} when the registry cannot say
+* @throws {ImageTagNotFound} listing every missing image
+*/
+async function assertImagesExist(docker, tag, images) {
+	const lookups = await Promise.all(images.map((image) => docker.lookup(image.ref)));
+	const unreachable = lookups.find((lookup) => lookup.status === "unreachable");
+	if (unreachable?.status === "unreachable") throw new RegistryUnreachable(unreachable.ref, unreachable.detail);
+	const missing = lookups.filter((lookup) => lookup.status === "missing").map((lookup) => lookup.ref);
+	if (missing.length > 0) throw new ImageTagNotFound(tag, missing);
+}
+//#endregion
+//#region src/compose/caddyfile.ts
+/** The Caddyfile for a stack's edge. */
+function edgeCaddyfile(sites, options) {
+	const global = options.local ? `{
+	# No ACME and no public DNS: the CA is Caddy's own and the names resolve
+	# to this machine.
+	local_certs
+	auto_https disable_redirects
+}` : options.email ? `{
+	email ${options.email}
+}` : "";
+	const blocks = sites.map(({ host, upstream }) => `https://${host} {${options.local ? `
+	tls internal
+` : ""}
+	# Host and X-Forwarded-* are passed through as Caddy does by default, so
+	# an app builds redirects, cookies and links on the address a caller used.
+	reverse_proxy ${upstream} {
+		# Never buffer: a streamed response — server-sent events, a Next.js
+		# RSC payload — reaches the client as each chunk is written.
+		flush_interval -1
+	}
+}`);
+	return `${HEADER}${global ? `${global}\n\n` : ""}${blocks.join("\n\n")}\n`;
+}
+const HEADER = `# Generated by gkm compose from the construct manifest — do not edit.
+#
+# One host per API and site, each in front of its own container.
+`;
+//#endregion
+//#region src/compose/stack.ts
+/**
+* The stack a workspace runs as for one stage — pure.
+*
+* Everything `gkm compose` writes is decided here, as data: the compose file,
+* the Caddyfile, one env file per backend, and the image each app runs. The
+* command around it reads the workspace, asks the registry, writes the files
+* and starts Docker; none of those decide anything, so all of it can be
+* asserted without a daemon.
+*
+* The values come from the same derivations every other target uses. The
+* plan is reconcile's `planFor`, the keys an app reads are `appEnvKeys`, and
+* every URL is `envFor`'s — asked twice, once with each app at its public
+* address and once on the compose network, because a browser and a sibling
+* service reach the same API by different names.
+*/
+/** Where a stack's files are written, relative to the workspace root. */
+function stackDir(stage) {
+	return `.gkm/compose/${stage}`;
+}
+/**
+* The compose project a stage's stack runs as.
+*
+* The deploy identity's scope, so two workspaces with one name in different
+* namespaces never share containers or volumes — and the stage, so a
+* machine can run two stages side by side.
+*/
+function composeProject(identity) {
+	return `${identity.scope}-${identity.stage}`;
+}
+/** The ports the edge is published on, and the variables that move them. */
+const EDGE_PORT_ENV = {
+	https: "GKM_COMPOSE_HTTPS_PORT",
+	http: "GKM_COMPOSE_HTTP_PORT"
+};
+/**
+* Containers this target does not run.
+*
+* Object storage is the stage's own — an externally hosted bucket whose URL
+* the stage's secrets hold — and so is a deployed stage's mail. The AWS
+* emulator never applies: a stack is a server target, whose events are
+* pg-boss.
+*/
+const NOT_RUN = {
+	minio: true,
+	localstack: true,
+	caddy: true
+};
+/** Kinds whose `<ID>_URL` a stage must be given, because nothing here runs them. */
+const EXTERNAL_KINDS = {
+	objects: true,
+	"file-server": true
+};
+/** The S3 client's credentials, read beside a bucket's URL when it has them. */
+const STORAGE_KEYS = [
+	"AWS_ACCESS_KEY_ID",
+	"AWS_SECRET_ACCESS_KEY",
+	"AWS_REGION"
+];
+/** A bucket the stack needs and the stage was not given. */
+var BucketNotConfigured = class extends Error {
+	app;
+	id;
+	key;
+	stage;
+	constructor(app, id, key, stage) {
+		super(`'${app}' uses the bucket '${id}', and gkm compose runs no object storage: the stage needs an externally hosted bucket. Set its URL in the stage's secrets: gkm secrets:set ${key} 's3://…' --stage ${stage}`);
+		this.app = app;
+		this.id = id;
+		this.key = key;
+		this.stage = stage;
+		this.name = "BucketNotConfigured";
+	}
+};
+/** A value only the stage's secrets can hold, and they do not. */
+var StageSecretMissing = class extends Error {
+	app;
+	key;
+	stage;
+	constructor(app, key, stage) {
+		super(`'${app}' reads ${key}, and the stage '${stage}' has none. Nothing in the stack can derive it; set it in the stage's secrets: gkm secrets:set ${key} '…' --stage ${stage}`);
+		this.app = app;
+		this.key = key;
+		this.stage = stage;
+		this.name = "StageSecretMissing";
+	}
+};
+/** A deployed stage's secrets with no seed to derive its passwords from. */
+var StageSeedMissing = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`The stage '${stage}' has no seed in its secrets, and a deployed stage's database passwords are derived from it. Run gkm compose without --dry-run once, or gkm deploy, to generate it.`);
+		this.stage = stage;
+		this.name = "StageSeedMissing";
+	}
+};
+/** A workspace with no API and no site to run. */
+var NothingToCompose = class extends Error {
+	root;
+	constructor(root) {
+		super(`${root} declares no RestApi and no site, so a stack would run nothing. Workers and mobile apps are not run by gkm compose yet.`);
+		this.root = root;
+		this.name = "NothingToCompose";
+	}
+};
+/** A value that cannot be written to an env file a line at a time. */
+var EnvValueMultiline = class extends Error {
+	app;
+	key;
+	constructor(app, key) {
+		super(`${key} for '${app}' spans more than one line, and an env file holds one value per line. Store it on one line — base64, or JSON — and decode it where it is read.`);
+		this.app = app;
+		this.key = key;
+		this.name = "EnvValueMultiline";
+	}
+};
+/** The services a stack's apps wait on and the edge waits on in turn. */
+const HEALTHY = { condition: "service_healthy" };
+/**
+* An app's health check: its own server, asked on 127.0.0.1 — not
+* `localhost`, which resolves to `::1` first in an Alpine container while a
+* server may listen on IPv4 alone.
+*/
+function probe(port, path) {
+	return {
+		test: [
+			"CMD",
+			"wget",
+			"-q",
+			"-O",
+			"/dev/null",
+			`http://127.0.0.1:${port}${path}`
+		],
+		interval: "5s",
+		timeout: "3s",
+		retries: 20,
+		start_period: "10s"
+	};
+}
+/** The stack for one stage. */
+function composeStack(input) {
+	const { workspace, manifest, stage, identity } = input;
+	const local = stage === workspace.stages.local;
+	const project = composeProject(identity);
+	const custom = input.secrets?.custom ?? {};
+	const https = input.ports?.https ?? 443;
+	const http = input.ports?.http ?? 80;
+	const plan = planFor(manifest, stage, provisionOrder(manifest), {
+		localStage: workspace.stages.local,
+		events: DEFAULT_EVENTS.server,
+		cache: DEFAULT_CACHE.server,
+		edge: false
+	});
+	const byId = new Map(plan.resources.map((r) => [r.id, r]));
+	const seed = local ? void 0 : input.secrets?.seed;
+	if (!local && !seed) throw new StageSeedMissing(stage);
+	const credential = {
+		master: local ? "geekmidas" : localRolePassword(workspace.name, plan, "master", seed),
+		...seed ? { seed } : {}
+	};
+	const infra = plan.containers.filter((c) => !NOT_RUN[c]).filter((c) => local || c !== "mailpit").sort();
+	const apps = stackApps(workspace, manifest, plan, {
+		local,
+		stage,
+		https,
+		identity,
+		images: input.images
+	});
+	if (apps.length === 0) throw new NothingToCompose(workspace.root);
+	const derivation = {
+		project: workspace.name,
+		master: credential.master,
+		...credential.seed ? { seed: credential.seed } : {}
+	};
+	const outside = networkEnv(plan, {
+		...derivation,
+		addresses: Object.fromEntries(apps.map((app) => [app.id, app.url]))
+	});
+	const inside = networkEnv(plan, {
+		...derivation,
+		addresses: Object.fromEntries(apps.map((app) => [app.id, `http://${app.name}:${app.port}`]))
+	});
+	const owners = /* @__PURE__ */ new Map();
+	for (const resource of plan.resources) {
+		owners.set(resource.envKey, resource);
+		if (resource.kind === "email") {
+			owners.set(provideKey(resource.id, "from"), resource);
+			owners.set(provideKey(resource.id, "inboxUrl"), resource);
+		}
+		if (resource.kind === "external-api") owners.set(provideKey(resource.id, "credentials"), resource);
+	}
+	const surfaceUrls = new Map(plan.resources.filter((r) => r.kind === "rest-api" || r.kind === "site").map((r) => [r.envKey, r.id]));
+	const appById = new Map(apps.map((app) => [app.id, app]));
+	/**
+	* What a key resolves to for one app, from the stage's secrets where only
+	* they can hold it, and the derivations otherwise.
+	*/
+	const valueFor = (app, key, owner) => {
+		if (owner && EXTERNAL_KINDS[owner.kind] && key === owner.envKey) {
+			const value = custom[key];
+			if (value === void 0) throw new BucketNotConfigured(app.name, owner.id, key, stage);
+			return value;
+		}
+		if (owner && suppliedBy(owner, key, local)) {
+			const value = custom[key];
+			if (value === void 0) throw new StageSecretMissing(app.name, key, stage);
+			return value;
+		}
+		if (custom[key] !== void 0) return custom[key];
+		const surface = surfaceUrls.get(key);
+		if (app.kind === "rest-api" && surface && surface !== app.id) return inside[key];
+		return outside[key];
+	};
+	for (const app of apps) {
+		if (app.kind === "site") {
+			const site = manifest[app.id];
+			if (site?.kind !== "site") continue;
+			const args = {};
+			for (const [key, source] of Object.entries(publicEnvFor(site, manifest))) {
+				const value = valueFor(app, source, owners.get(source));
+				if (value !== void 0) args[key] = value;
+			}
+			if (app.build && Object.keys(args).length > 0) app.build.args = args;
+			continue;
+		}
+		const keys = appEnvKeys(manifest, app.name, input.runnables) ?? /* @__PURE__ */ new Set();
+		const values = {};
+		for (const key of [...keys].sort()) {
+			const owner = owners.get(key) ?? storageOwner(key, plan);
+			if (!local && owner?.kind === "email" && key.endsWith("_INBOX_URL")) continue;
+			if (STORAGE_KEYS.includes(key)) {
+				if (custom[key] !== void 0) values[key] = custom[key];
+				continue;
+			}
+			const value = valueFor(app, key, owner);
+			if (value !== void 0) values[key] = value;
+		}
+		const trusted = provideKey(app.id, "trustedOrigins");
+		if (keys.has(trusted)) {
+			const internal = (byId.get(app.id)?.callers ?? []).map((caller) => appById.get(caller)).filter((caller) => caller?.kind === "rest-api").map((caller) => `http://${caller.name}:${caller.port}`);
+			const origins = [...(values[trusted] ?? "").split(",").filter(Boolean), ...internal];
+			values[trusted] = [...new Set(origins)].join(",");
+		}
+		app.env = {
+			...values,
+			NODE_ENV: "production",
+			PORT: String(app.port),
+			STAGE: stage
+		};
+		for (const [key, value] of Object.entries(app.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(app.name, key);
+	}
+	const compose = stackFile({
+		project,
+		plan,
+		infra,
+		apps,
+		master: credential.master,
+		https,
+		http
+	});
+	const caddyfile = edgeCaddyfile(apps.map((app) => ({
+		host: app.host,
+		upstream: `${app.name}:${app.port}`
+	})), { local });
+	const dockerfiles = {};
+	for (const app of apps) {
+		if (!app.build) continue;
+		dockerfiles[app.build.dockerfile] = app.kind === "site" ? siteDockerfile(app.name, workspace.apps[app.name], {
+			turboPackage: input.packages?.[app.name] ?? app.name,
+			packageManager: input.packageManager ?? "pnpm",
+			manifest
+		}) : generateSlimDockerfile({
+			imageName: app.name,
+			baseImage: "node:22-alpine",
+			port: app.port,
+			healthCheckPath: "/health",
+			prebuilt: true,
+			packageManager: input.packageManager ?? "pnpm",
+			bundle: `${app.path}/.gkm/server/dist/server.mjs`
+		});
+	}
+	return {
+		project,
+		stage,
+		local,
+		apps,
+		infra,
+		compose,
+		caddyfile,
+		dockerfiles,
+		plan,
+		credential
+	};
+	/** Whether only the stage's secrets can supply `key` to `owner`. */
+	function suppliedBy(owner, key, isLocal) {
+		if (owner.kind === "credential") return true;
+		if (owner.kind === "external-api") return key === provideKey(owner.id, "credentials");
+		if (isLocal) return false;
+		if (owner.kind === "secret" || owner.kind === "encryption") return true;
+		return owner.kind === "email" && !key.endsWith("_INBOX_URL");
+	}
+}
+/** Which bucket an S3 credential key belongs to — the first one declared. */
+function storageOwner(key, plan) {
+	if (!STORAGE_KEYS.includes(key)) return void 0;
+	return plan.resources.find((r) => r.kind === "objects");
+}
+/** The apps a stack runs: every API and every site, at its stage address. */
+function stackApps(workspace, manifest, plan, options) {
+	const apps = [];
+	const resources = new Map(plan.resources.map((r) => [r.id, r]));
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration.kind !== "rest-api" && declaration.kind !== "site") continue;
+		const name = appKey(id);
+		const app = workspace.apps[name];
+		const resource = resources.get(id);
+		if (!app || !resource || !app.port) continue;
+		const host = hostOf(name, app, workspace, resource, options);
+		const tag = declaration.kind === "site" ? siteTag(options.images.tag, options.stage) : options.images.tag;
+		const ref = validateImageRef(imageRef(options.identity, name, options.images.registry, tag));
+		apps.push({
+			app: name,
+			name,
+			id,
+			kind: declaration.kind,
+			path: app.path,
+			port: app.port,
+			host,
+			url: `https://${host}${options.local && options.https !== 443 ? `:${options.https}` : ""}`,
+			ref,
+			tag,
+			...options.images.mode === "build" ? { build: { dockerfile: `${stackDir(options.stage)}/Dockerfile.${name}` } } : {}
+		});
+	}
+	return apps.sort((a, b) => a.name.localeCompare(b.name));
+}
+/**
+* The host an app answers on for a stage: the `gkm dev` edge's
+* `*.localhost` names for the local stage, and the stage's domain — by the
+* same rule a deploy follows — for any other.
+*/
+function hostOf(name, app, workspace, resource, options) {
+	if (options.local) return hostFor(resource, workspace.name);
+	return resolveHost(name, app, options.stage, workspace.deploy?.domains, isMainFrontendApp(name, app, workspace.apps));
+}
+/** The compose document: the infrastructure, the apps, and the edge. */
+function stackFile(options) {
+	const { project, plan, infra, apps } = options;
+	const derived = composeFor({
+		...plan,
+		containers: [...infra]
+	}, {
+		project,
+		ports: Object.fromEntries(portKeys(infra, plan.fakes).map((key) => [key, 0]))
+	});
+	const services = {};
+	const volumes = {
+		...derived.volumes,
+		"caddy-data": {},
+		"caddy-config": {}
+	};
+	for (const name of infra) {
+		const { ports: _ports, depends_on, profiles: _profiles, ...service } = derived.services[name];
+		services[name] = {
+			...service,
+			...depends_on?.length ? { depends_on: Object.fromEntries(depends_on.map((dep) => [dep, HEALTHY])) } : {}
+		};
+	}
+	const postgres = services.postgres;
+	if (postgres) {
+		postgres.environment = {
+			...postgres.environment,
+			POSTGRES_PASSWORD: options.master
+		};
+		postgres.ports = ["127.0.0.1::5432"];
+	}
+	for (const app of apps) services[app.name] = {
+		image: app.ref,
+		...app.build ? { build: {
+			context: "../../..",
+			dockerfile: app.build.dockerfile,
+			...app.build.args ? { args: app.build.args } : {}
+		} } : {},
+		restart: "unless-stopped",
+		...app.kind === "rest-api" ? {
+			env_file: [{
+				path: `./${app.name}.env`,
+				format: "raw"
+			}],
+			...infra.length ? { depends_on: Object.fromEntries(infra.map((name) => [name, HEALTHY])) } : {}
+		} : {},
+		healthcheck: probe(app.port, app.kind === "site" ? "/" : "/health")
+	};
+	services.caddy = {
+		image: DEFAULT_IMAGES.caddy,
+		restart: "unless-stopped",
+		ports: [`${options.https}:443`, `${options.http}:80`],
+		volumes: [
+			"./Caddyfile:/etc/caddy/Caddyfile:ro",
+			"caddy-data:/data",
+			"caddy-config:/config"
+		],
+		depends_on: Object.fromEntries(apps.map((app) => [app.name, HEALTHY])),
+		healthcheck: {
+			test: [
+				"CMD",
+				"caddy",
+				"version"
+			],
+			interval: "10s",
+			timeout: "5s",
+			retries: 5
+		}
+	};
+	return {
+		name: project,
+		services,
+		volumes
+	};
+}
+/** Render an app's env file: one `KEY=value` per line, read raw by compose. */
+function envFile(env) {
+	return `${Object.entries(env).sort(([a], [b]) => a.localeCompare(b)).map(([key, value]) => `${key}=${value}`).join("\n")}\n`;
+}
+//#endregion
+//#region src/migrate/provider.ts
+/**
+* One construct's migrations and seeds, read from its folders.
+*
+* Two kinds of file, told apart by extension rather than by configuration: a
+* script exports `up` (and may export `down`) — or `seed(db, { stage })`, in
+* `seeds/` — and a
+* `.sql` file is run whole. The second is what makes a folder independent of
+* the client the app uses — Better Auth's schema is SQL whatever the
+* application queries with.
+*/
+const SCRIPTS = /* @__PURE__ */ new Set([
+	".ts",
+	".mts",
+	".js",
+	".mjs"
+]);
+/** Two files in one folder that would be one migration. */
+var DuplicateMigration = class extends Error {
+	folder;
+	migration;
+	constructor(folder, migration) {
+		super(`${folder} has two migrations named '${migration}' — a script and a .sql file with the same name. A migration is recorded by name, so only one of them could ever run; rename or remove the other.`);
+		this.folder = folder;
+		this.migration = migration;
+		this.name = "DuplicateMigration";
+	}
+};
+/** A script in a migrations folder that exports no `up`. */
+var MigrationHasNoUp = class extends Error {
+	file;
+	constructor(file) {
+		super(`${file} is in a migrations folder but exports no \`up\` function. Export \`async function up(db: Kysely<unknown>)\`, or move the file out of the folder if it is not a migration.`);
+		this.file = file;
+		this.name = "MigrationHasNoUp";
+	}
+};
+/** A script in a seeds folder that exports no `seed`. */
+var SeedHasNoSeed = class extends Error {
+	file;
+	constructor(file) {
+		super(`${file} is in a seeds folder but exports no \`seed\` function. Export \`async function seed(db, { stage })\`, or move the file out of the folder if it is not a seed.`);
+		this.file = file;
+		this.name = "SeedHasNoSeed";
+	}
+};
+/**
+* The migration files in a folder, by name, without reading them.
+*
+* Also what `gkm dev` compares against a construct's history to report what
+* is pending, which is why it is separate from loading them.
+*/
+async function migrationFiles(folder) {
+	const entries = await readdir(folder, { withFileTypes: true }).catch((error) => {
+		if (error.code === "ENOENT") return [];
+		throw error;
+	});
+	const files = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		if (!entry.isFile() || !isMigration(entry.name)) continue;
+		const name = entry.name.slice(0, -extname(entry.name).length);
+		if (files.has(name)) throw new DuplicateMigration(folder, name);
+		files.set(name, join(folder, entry.name));
+	}
+	return files;
+}
+/** A Kysely provider over one construct's folder. */
+function folderProvider(folder, raw) {
+	return { async getMigrations() {
+		const migrations = {};
+		for (const [name, file] of await migrationFiles(folder)) migrations[name] = extname(file) === ".sql" ? await sqlMigration(file, raw) : await scriptMigration(file);
+		return migrations;
+	} };
+}
+/**
+* The seeds in a folder, loaded, in name order.
+*
+* Every one runs on every pass — there is no history to consult — so the order
+* is the only thing between two seeds where one reads what another writes.
+* Name them to sort that way.
+*/
+async function loadSeeds(folder, raw) {
+	const files = [...await migrationFiles(folder)].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+	const seeds = [];
+	for (const [name, file] of files) seeds.push({
+		name,
+		run: extname(file) === ".sql" ? (await sqlMigration(file, raw)).up : await scriptSeed(file)
+	});
+	return seeds;
+}
+/**
+* A seed script, imported as it is on disk now.
+*
+* Keyed by its modification time: a seed is run again after it is edited, and
+* a process that has imported it once would otherwise run the old one.
+*/
+async function scriptSeed(file) {
+	const url = pathToFileURL(file);
+	url.searchParams.set("mtime", String((await stat(file)).mtimeMs));
+	const module = await import(url.href);
+	if (typeof module.seed !== "function") throw new SeedHasNoSeed(file);
+	return module.seed;
+}
+function isMigration(file) {
+	if (file.endsWith(".d.ts")) return false;
+	if (/\.(spec|test)\.[cm]?[jt]s$/.test(file)) return false;
+	const extension = extname(file);
+	return extension === ".sql" || SCRIPTS.has(extension);
+}
+async function scriptMigration(file) {
+	const module = await import(pathToFileURL(file).href);
+	if (typeof module.up !== "function") throw new MigrationHasNoUp(file);
+	return {
+		up: module.up,
+		...typeof module.down === "function" ? { down: module.down } : {}
+	};
+}
+/**
+* A `.sql` file, run whole.
+*
+* One query rather than split on `;`: with no parameters, Postgres takes
+* several statements in one message, and splitting by hand breaks on the first
+* `;` inside a string or a function body. There is no `down` — a generated
+* schema is rolled back by a migration that says how, not by guessing.
+*/
+async function sqlMigration(file, raw) {
+	const statements = await readFile(file, "utf-8");
+	return { up: async (db) => {
+		await raw.raw(statements).execute(db);
+	} };
+}
+//#endregion
+//#region src/migrate/databases.ts
+/**
+* Bring each construct's schema up to its migrations folder.
+*
+* Which constructs, in what order, from which folder, is `migrationTargets`'
+* answer and nobody else's. What is decided here is only how one target is
+* run: as its owner, in its own schema, with a history of its own.
+*/
+/** A folder under `db/` that names no construct. */
+var UnknownMigrationFolder = class extends Error {
+	folder;
+	known;
+	constructor(folder, known) {
+		super(`${folder} names no database construct, so its migrations would never run. ${known.length > 0 ? `The folders that do: ${known.join(", ")}.` : "This project declares no database."} Rename the folder after the construct it belongs to.`);
+		this.folder = folder;
+		this.known = known;
+		this.name = "UnknownMigrationFolder";
+	}
+};
+/** A construct was asked for by a name that takes no migrations. */
+var NoSuchMigrationTarget = class extends Error {
+	construct;
+	known;
+	constructor(construct, known) {
+		super(`'${construct}' is not a database construct. ` + (known.length > 0 ? `The ones with migrations: ${known.join(", ")}.` : "This project declares no database."));
+		this.construct = construct;
+		this.known = known;
+		this.name = "NoSuchMigrationTarget";
+	}
+};
+/**
+* A migration left directly in a construct's folder, where nothing reads it.
+*
+* Migrations moved into `migrations/` so seeds could sit beside them. A file
+* still at the old level would otherwise never run, and nothing would say so.
+*/
+var MigrationsOutsideFolder = class extends Error {
+	folder;
+	files;
+	constructor(folder, files) {
+		super(`${folder} has ${files.join(", ")} directly inside it, where nothing runs them. Migrations live in ${folder}/migrations/ and seeds in ${folder}/seeds/ — move ${files.length === 1 ? "it" : "them"} there.`);
+		this.folder = folder;
+		this.files = files;
+		this.name = "MigrationsOutsideFolder";
+	}
+};
+/** A folder inside a construct's folder that is neither `migrations` nor `seeds`. */
+var UnknownDatabaseFolder = class extends Error {
+	folder;
+	constructor(folder) {
+		super(`${folder} is neither migrations/ nor seeds/, so nothing in it would ever run. A construct's folder holds those two; rename or remove it.`);
+		this.folder = folder;
+		this.name = "UnknownDatabaseFolder";
+	}
+};
+/** A seed failed; its own writes are rolled back, the ones before it stay. */
+var SeedFailed = class extends Error {
+	construct;
+	seed;
+	cause;
+	constructor(construct, seed, cause) {
+		super(`${construct}: seed '${seed}' failed — ${cause instanceof Error ? cause.message : String(cause)}. Its writes were rolled back; fix it and run it again.`);
+		this.construct = construct;
+		this.seed = seed;
+		this.cause = cause;
+		this.name = "SeedFailed";
+	}
+};
+/** A construct with roles has no owner URL to migrate with. */
+var NoOwnerCredential = class extends Error {
+	construct;
+	key;
+	constructor(construct, key) {
+		super(`${construct} has no ${key} to migrate with. Migrations run as the owner role — the runtime one cannot create a table — and nothing resolved its URL. Is the stage reconciled?`);
+		this.construct = construct;
+		this.key = key;
+		this.name = "NoOwnerCredential";
+	}
+};
+/** A migration failed; the ones before it in the run stay applied. */
+var MigrationFailed = class extends Error {
+	construct;
+	migration;
+	cause;
+	constructor(construct, migration, cause) {
+		super(`${construct}: migration ${migration ? `'${migration}' ` : ""}failed — ${cause instanceof Error ? cause.message : String(cause)}`);
+		this.construct = construct;
+		this.migration = migration;
+		this.cause = cause;
+		this.name = "MigrationFailed";
+	}
+};
+/** The project's Kysely could not be found from where a database is declared. */
+var KyselyNotFound = class extends Error {
+	from;
+	constructor(from) {
+		super(`Could not resolve 'kysely' from ${from}. Migrations run with the project's own Kysely — install it where the database is declared.`);
+		this.from = from;
+		this.name = "KyselyNotFound";
+	}
+};
+/** Apply every pending migration, construct by construct, parents first. */
+async function migrateDatabases(options) {
+	const runs = [];
+	for (const target of await targetsFor(options)) {
+		if ((await migrationFiles(join(options.root, target.migrations))).size === 0) {
+			runs.push({
+				target,
+				applied: []
+			});
+			continue;
+		}
+		const applied = await withMigrator(options, target, async (migrator) => {
+			const { error, results = [] } = await migrator.migrateToLatest();
+			if (error) {
+				const failed = results.find((result) => result.status === "Error");
+				throw new MigrationFailed(target.id, failed?.migrationName, error);
+			}
+			return results.filter((result) => result.status === "Success").map((result) => result.migrationName);
+		});
+		runs.push({
+			target,
+			applied
+		});
+	}
+	return runs;
+}
+/**
+* Run every construct's seeds, parents first — each one, every time, on every
+* stage, production included. Each is handed the stage, so a seed decides
+* what belongs where.
+*
+* Seeds are reference data kept up to date by being run again, so there is no
+* history: a seed is an upsert, and a changed one is applied by the next run.
+* Each runs in its own transaction, as the construct's owner, so a failure
+* leaves nothing half-written. Assumes the schema is migrated —
+* {@link migrateAndSeed} is what makes that true.
+*/
+async function seedDatabases(options) {
+	const runs = [];
+	for (const target of await targetsFor(options)) {
+		const folder = join(options.root, target.seeds);
+		if ((await migrationFiles(folder)).size === 0) {
+			runs.push({
+				target,
+				seeded: []
+			});
+			continue;
+		}
+		const seeded = await withOwner(options, target, async (db, kysely) => {
+			const names = [];
+			for (const seed of await loadSeeds(folder, kysely.sql)) {
+				try {
+					await db.transaction().execute((trx) => seed.run(trx, { stage: options.stage }));
+				} catch (error) {
+					throw new SeedFailed(target.id, seed.name, error);
+				}
+				names.push(seed.name);
+			}
+			return names;
+		});
+		runs.push({
+			target,
+			seeded
+		});
+	}
+	return runs;
+}
+/**
+* Migrate, then seed: a seed only ever runs against the schema it was written
+* for.
+*
+* With `only`, the constructs it lives in are migrated too — a tenant's seed
+* cannot run before the database that owns its schema exists — and only it is
+* seeded.
+*/
+async function migrateAndSeed(options) {
+	const migrations = [];
+	for (const target of await withParents(options)) migrations.push(...await migrateDatabases({
+		...options,
+		only: target.id
+	}));
+	return {
+		migrations,
+		seeds: await seedDatabases(options)
+	};
+}
+/** The targets `only` names, after the ones it lives in; all without it. */
+async function withParents(options) {
+	const chosen = await targetsFor(options);
+	if (!options.only) return chosen;
+	const all = migrationTargets(options.manifest);
+	const ids = /* @__PURE__ */ new Set();
+	for (const target of chosen) {
+		let current = target;
+		while (current) {
+			ids.add(current.id);
+			const parent = current.of;
+			current = parent ? all.find((t) => t.id === parent) : void 0;
+		}
+	}
+	return all.filter((target) => ids.has(target.id));
+}
+/**
+* What each construct's folder has that its history does not — without
+* applying any of it. What `gkm dev` reports.
+*/
+async function pendingMigrations(options) {
+	const found = [];
+	for (const target of await targetsFor(options)) {
+		if ((await migrationFiles(join(options.root, target.migrations))).size === 0) continue;
+		const pending = await withMigrator(options, target, async (migrator) => (await migrator.getMigrations()).filter((migration) => migration.executedAt === void 0).map((migration) => migration.name));
+		if (pending.length > 0) found.push({
+			target,
+			pending
+		});
+	}
+	return found;
+}
+/**
+* The targets this run covers, with every folder under `db/` accounted for.
+*
+* A folder that names no construct is an error rather than something to skip:
+* a typo in its name is otherwise a migration that silently never runs.
+*/
+async function targetsFor(options) {
+	const targets = migrationTargets(options.manifest);
+	const folders = targets.map((target) => target.folder);
+	for (const folder of await foldersIn(join(options.root, MIGRATIONS_ROOT))) {
+		const relative = `${MIGRATIONS_ROOT}/${folder}`;
+		if (!folders.includes(relative)) throw new UnknownMigrationFolder(relative, folders);
+		await checkLayout(options.root, relative);
+	}
+	if (!options.only) return targets;
+	const id = canonicalId(options.only);
+	const chosen = targets.filter((target) => target.id === id);
+	if (chosen.length === 0) throw new NoSuchMigrationTarget(options.only, targets.map((target) => target.id));
+	return chosen;
+}
+/**
+* A construct's folder holds `migrations/` and `seeds/`, and nothing else —
+* anything beside them is a file or folder nothing would ever run.
+*/
+async function checkLayout(root, folder) {
+	const entries = await readdir(join(root, folder), { withFileTypes: true });
+	const loose = entries.filter((entry) => entry.isFile() && !entry.name.startsWith(".")).map((entry) => entry.name);
+	if (loose.length > 0) throw new MigrationsOutsideFolder(folder, loose);
+	for (const entry of entries) if (entry.isDirectory() && !DATABASE_FOLDERS.includes(entry.name)) throw new UnknownDatabaseFolder(`${folder}/${entry.name}`);
+}
+async function foldersIn(dir) {
+	return (await readdir(dir, { withFileTypes: true }).catch((error) => {
+		if (error.code === "ENOENT") return [];
+		throw error;
+	})).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+}
+/**
+* A migrator for one target, connected as its owner.
+*
+* No `migrationTableSchema`: the owner role's `search_path` is pinned to the
+* construct's schema, so the history lands there — `app.kysely_migration` for
+* the database, `auth_database.kysely_migration` for its tenant — and two
+* constructs in one Postgres never share one.
+*
+* Unordered migrations are allowed. Files are timestamped, so a branch merged
+* after another's migration ran carries an older one; refusing it would make
+* every such merge a manual repair.
+*/
+async function withMigrator(options, target, run) {
+	return withOwner(options, target, (db, { Migrator, sql }) => run(new Migrator({
+		db,
+		provider: folderProvider(join(options.root, target.migrations), sql),
+		allowUnorderedMigrations: true
+	})));
+}
+/**
+* One target's database, connected as its owner and closed afterwards — what
+* migrations and seeds both run as.
+*/
+async function withOwner(options, target, run) {
+	const kysely = await kyselyFrom(options.sources?.[target.id]?.file ?? (target.of ? options.sources?.[target.of]?.file : void 0) ?? join(options.root, "package.json"));
+	const db = new kysely.Kysely({ dialect: new kysely.PostgresDialect({ pool: new pg.Pool(poolConfig(ownerUrl(options, target))) }) });
+	try {
+		return await run(db, kysely);
+	} finally {
+		await db.destroy();
+	}
+}
+/**
+* The owner's URL, with no fallback to the runtime one.
+*
+* The runtime role can create nothing, so falling back would only move the
+* failure to the first `CREATE TABLE` and make it read like a permissions
+* bug. The one exception is a database declared `roles: false`, where there is
+* no owner — both URLs are the master credential by design.
+*/
+function ownerUrl(options, target) {
+	const key = provideKey(target.id, "ownerUrl");
+	const owner = options.env[key];
+	if (owner) return owner;
+	const database = options.manifest[target.of ?? target.id];
+	if (database?.kind === "database" && database.roles === false) {
+		const url = options.env[provideKey(target.id, "url")];
+		if (url) return url;
+	}
+	throw new NoOwnerCredential(target.id, key);
+}
+/**
+* Pool settings for a URL, with `?search_path=` as the startup option Postgres
+* reads. Only a `roles: false` URL carries it — a role pins its own.
+*/
+function poolConfig(url) {
+	const parsed = new URL(url);
+	const searchPath = parsed.searchParams.get("search_path");
+	if (!searchPath) return { connectionString: url };
+	parsed.searchParams.delete("search_path");
+	return {
+		connectionString: parsed.toString(),
+		options: `-c search_path=${searchPath}`
+	};
+}
+/** Kysely as the project resolves it from `from`. */
+async function kyselyFrom(from) {
+	const require = createRequire(from);
+	try {
+		const [main, migration] = await Promise.all([import(pathToFileURL(require.resolve("kysely")).href), import(pathToFileURL(require.resolve("kysely/migration")).href)]);
+		return {
+			Kysely: main.Kysely,
+			PostgresDialect: main.PostgresDialect,
+			sql: main.sql,
+			Migrator: migration.Migrator
+		};
+	} catch {
+		throw new KyselyNotFound(from);
+	}
+}
+//#endregion
+//#region src/target/compose/health.ts
+/**
+* Asking each app of a stack whether it answers — through Caddy, over HTTPS,
+* the way a browser reaches it.
+*
+* `docker compose up --wait` already knows each container passed its own
+* health check, asked on 127.0.0.1 inside it. What that cannot say is whether
+* the stack is reachable: whether the edge routes the host to the app, and
+* whether the certificate it presents is one a client accepts. So the check
+* goes through the edge, by hostname, and verifies the certificate.
+*/
+/** A request that got no answer in time. */
+var HealthRequestTimedOut = class extends Error {
+	url;
+	timeoutMs;
+	constructor(url, timeoutMs) {
+		super(`${url} did not answer within ${timeoutMs}ms. Check the stack is up with \`docker compose ps\`.`);
+		this.url = url;
+		this.timeoutMs = timeoutMs;
+		this.name = "HealthRequestTimedOut";
+	}
+};
+/** The real probe: one HTTPS GET, the certificate verified. */
+const httpsProbe = ({ url, ca, connectTo, timeoutMs, signal }) => {
+	const target = new URL(url);
+	return new Promise((resolve, reject) => {
+		const req = request({
+			host: connectTo ?? target.hostname,
+			port: target.port || 443,
+			servername: target.hostname,
+			path: `${target.pathname}${target.search}`,
+			method: "GET",
+			headers: { host: target.host },
+			...ca ? { ca } : {},
+			...signal ? { signal } : {},
+			timeout: timeoutMs
+		}, (res) => {
+			res.resume();
+			res.on("end", () => resolve(res.statusCode ?? 0));
+			res.on("error", reject);
+		});
+		req.on("timeout", () => req.destroy(new HealthRequestTimedOut(url, timeoutMs)));
+		req.on("error", reject);
+		req.end();
+	});
+};
+/** Whether a status means the app answered as it should. */
+function isHealthy(status) {
+	return status >= 200 && status < 400;
+}
+/** Apps that did not answer through the edge. */
+var ComposeAppsUnhealthy = class extends Error {
+	project;
+	apps;
+	constructor(project, apps) {
+		super(`${project} started, but ${apps.length === 1 ? "this app does" : "these apps do"} not answer through Caddy:\n` + apps.map(({ url, last }) => `  - ${url}: ${last}`).join("\n") + `\nSee why with \`docker compose -p ${project} logs caddy ${apps.map((a) => a.app).join(" ")}\`.`);
+		this.project = project;
+		this.apps = apps;
+		this.name = "ComposeAppsUnhealthy";
+	}
+};
+//#endregion
+//#region src/target/compose/phases.ts
+/**
+* The compose target's phases: a stage as one Docker Compose stack behind
+* Caddy, on the machine the deploy runs on.
+*
+* The order is the point of this file, and the rules it keeps are these:
+*
+* - A tag is checked before anything happens (`validate`). Every app's image
+*   is asked of the registry first; one missing image stops the run naming
+*   them all, and nothing is written, pulled or started.
+* - The databases exist before the apps do (`provision`). Postgres comes up
+*   alone, its databases, roles and grants are created and its migrations
+*   applied from this machine, and only then do the apps start — so an app
+*   never boots against a schema that is not there yet.
+* - What a stage runs is recorded (`release`). Each app's image, the tag it
+*   was released under and the digest it resolved to are written to the
+*   stage's state, so "what is this stage running" has an exact answer.
+* - What was started answers (`verify`): each app is asked through Caddy,
+*   over HTTPS, with the certificate verified.
+*
+* Docker, the registry, the bundler, Postgres and the health probe are
+* injected, so the rules are asserted without a daemon; the defaults are the
+* real ones.
+*/
+/** A port variable that does not hold a port. */
+var EdgePortInvalid = class extends Error {
+	variable;
+	value;
+	constructor(variable, value) {
+		super(`${variable}=${value} is not a port. Set it to a number between 1 and 65535, or unset it for the default.`);
+		this.variable = variable;
+		this.value = value;
+		this.name = "EdgePortInvalid";
+	}
+};
+/** A build with no commit to tag its images with. */
+var NoGitRevision = class extends Error {
+	root;
+	constructor(root) {
+		super(`Images built here are tagged with the commit they were built from, and ${root} is not in a git repository with a commit. Commit, or pass --tag to name the images yourself.`);
+		this.root = root;
+		this.name = "NoGitRevision";
+	}
+};
+/** A backend's production bundle did not build. */
+var BundleFailed = class extends Error {
+	app;
+	exitCode;
+	stderr;
+	constructor(app, exitCode, stderr) {
+		super(`Bundling '${app}' for production failed (exit code ${exitCode}).${stderr.trim() ? `\n${stderr.trim().slice(-4e3)}` : ""}\nRun \`gkm build --provider server --production\` in the app's directory to see it again.`);
+		this.app = app;
+		this.exitCode = exitCode;
+		this.stderr = stderr;
+		this.name = "BundleFailed";
+	}
+};
+/** The CLI's own entry, which the bundle step runs, is not where it should be. */
+var CliEntryNotFound = class extends Error {
+	from;
+	constructor(from) {
+		super(`Could not find bin/gkm.mjs above ${from}, which bundling a backend runs. Reinstall @geekmidas/cli.`);
+		this.from = from;
+		this.name = "CliEntryNotFound";
+	}
+};
+/** The commit HEAD is at, short — and `-dirty` when the tree has changes. */
+async function gitRevision(root) {
+	let sha;
+	try {
+		sha = (await runOutput("git", [
+			"rev-parse",
+			"--short",
+			"HEAD"
+		], { cwd: root })).trim();
+	} catch {
+		throw new NoGitRevision(root);
+	}
+	if (!sha) throw new NoGitRevision(root);
+	return (await runOutput("git", ["status", "--porcelain"], { cwd: root }).catch(() => "")).trim() ? `${sha}-dirty` : sha;
+}
+/** The edge's ports, from the environment — 443 and 80 when unset. */
+function edgePorts(env = process.env) {
+	const read = (variable, fallback) => {
+		const value = env[variable];
+		if (value === void 0 || value === "") return fallback;
+		const port = Number(value);
+		if (!Number.isInteger(port) || port < 1 || port > 65535) throw new EdgePortInvalid(variable, value);
+		return port;
+	};
+	return {
+		https: read(EDGE_PORT_ENV.https, 443),
+		http: read(EDGE_PORT_ENV.http, 80)
+	};
+}
+/** `bin/gkm.mjs` of the CLI that is running. */
+function cliEntry() {
+	const from = dirname(fileURLToPath(import.meta.url));
+	for (let dir = from; dirname(dir) !== dir; dir = dirname(dir)) {
+		const entry = join(dir, "bin", "gkm.mjs");
+		if (existsSync(entry)) return entry;
+	}
+	throw new CliEntryNotFound(from);
+}
+/** A cold production bundle is seconds; a hung one must not hold the lock. */
+const BUNDLE_TIMEOUT_MS = 6e5;
+/**
+* Bundle a backend with the gkm that is running — the same build a deploy
+* makes, so the image holds one file and no dependencies — in the run's
+* sandbox, because the build imports the project's code.
+*/
+async function bundleInSandbox(appRoot, ctx) {
+	const sandbox = activeSandbox() ?? new LocalSandbox({ root: ctx.cwd });
+	const result = await sandbox.exec("node", [
+		cliEntry(),
+		"build",
+		"--provider",
+		"server",
+		"--production"
+	], {
+		cwd: appRoot,
+		env: sandbox.env,
+		timeoutMs: BUNDLE_TIMEOUT_MS,
+		output: ctx.childOutput,
+		signal: ctx.signal
+	});
+	if (result.exitCode !== 0) throw new BundleFailed(appRoot, result.exitCode, result.stderr);
+}
+/**
+* The real ones. Each app is asked for three minutes before it counts as
+* down: a deployed stage's first ACME certificate can take that long.
+*/
+const defaultDeps = {
+	docker: dockerCompose,
+	bundle: bundleInSandbox,
+	revision: gitRevision,
+	sql: pgClient,
+	migrate: migrateDatabases,
+	probe: httpsProbe,
+	healthAttempts: 90,
+	healthIntervalMs: 2e3,
+	env: process.env
+};
+/**
+* The stack the stage would run, and — for a tag — the registry's word that
+* every image it names exists. Nothing is written: a missing image stops the
+* run here, before a file, a secret or a container is touched.
+*/
+async function validateCompose(ctx, deps, forced) {
+	const { workspace, stage, identity, tag } = ctx;
+	const root = workspace.root;
+	const mode = forced ?? (ctx.tagGiven ? "pull" : "build");
+	const runnables = {};
+	const manifest = await discover({
+		patterns: constructGlobs(workspace),
+		cwd: root,
+		runnables
+	});
+	const { secrets, generated } = await stageSecrets(ctx, manifest);
+	const stack = composeStack({
+		workspace,
+		manifest,
+		runnables,
+		stage,
+		identity,
+		images: {
+			mode,
+			tag,
+			...workspace.deploy?.registry ? { registry: workspace.deploy.registry } : {}
+		},
+		secrets,
+		ports: edgePorts(deps.env),
+		packageManager: detectPackageManager(root),
+		packages: Object.fromEntries(Object.entries(workspace.apps).map(([name, app]) => [name, appPackageName(root, name, app.path)]))
+	});
+	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, stack.apps);
+	const dir = join(root, stackDir(stage));
+	const previous = (await ctx.state.read(stage))?.state.images ?? {};
+	return {
+		mode,
+		stack,
+		dir,
+		ref: {
+			project: composeProject(identity),
+			file: join(dir, "docker-compose.yml"),
+			cwd: root,
+			output: ctx.childOutput,
+			signal: ctx.signal
+		},
+		secrets,
+		generated,
+		previous,
+		files: [],
+		images: {},
+		changes: []
+	};
+}
+/**
+* The stage's secrets — and, for a deployed stage, everything it generates
+* once: its seed, and each declared secret and keyring. Kept only once the
+* run goes ahead (`provision`), so a dry run, or a tag that is not there,
+* leaves the stage's secrets as it found them.
+*/
+async function stageSecrets(ctx, manifest) {
+	const stored = await ctx.secrets.read();
+	if (ctx.stage === ctx.workspace.stages.local) return {
+		secrets: stored,
+		generated: []
+	};
+	const { secrets, generated } = withGeneratedSecrets(stored ?? initStageSecrets(ctx.stage), manifest);
+	if (secrets.seed) ctx.secrets.mask(secrets.seed);
+	for (const value of Object.values(secrets.custom ?? {})) ctx.secrets.mask(value);
+	return {
+		secrets,
+		generated
+	};
+}
+/**
+* A dry run: the stack's files, written so they can be read, and what a real
+* run would do — no image is built or pulled, no container touched, nothing
+* recorded and no secret kept.
+*/
+async function planCompose(ctx, run) {
+	if (run.generated.length > 0) ctx.logger.info(`🔑 "${ctx.stage}" has no ${run.generated.join(", ")} yet; this dry run used values it did not keep.`);
+	run.files = await writeStack(ctx.cwd, run.dir, run.stack);
+	printPlan(ctx, run);
+	const planned = (change) => {
+		run.changes.push(change);
+		ctx.emit({
+			type: "resource.planned",
+			...change
+		});
+	};
+	for (const service of run.stack.infra) planned({
+		key: `service:${service}`,
+		resourceType: "service",
+		action: "ensure"
+	});
+	for (const app of run.stack.apps) {
+		planned({
+			key: `image:${app.name}`,
+			resourceType: "image",
+			action: run.mode === "build" ? "build" : "reuse",
+			id: app.ref
+		});
+		planned({
+			key: `service:${app.name}`,
+			resourceType: "service",
+			action: run.previous[app.name] ? "reuse" : "create"
+		});
+	}
+	planned({
+		key: "service:caddy",
+		resourceType: "service",
+		action: "ensure"
+	});
+}
+/**
+* What the apps run on: the stage's generated secrets kept, the stack's files
+* written, its infrastructure started, and its databases, roles, grants and
+* migrations applied.
+*/
+async function provisionCompose(ctx, run, deps) {
+	const { stack, ref } = run;
+	if (run.generated.length > 0 && run.secrets) {
+		await ctx.secrets.write(run.secrets);
+		ctx.logger.info(`🔑 Generated for "${ctx.stage}" (${ctx.secrets.store}): ${run.generated.join(", ")}`);
+	}
+	run.files = await writeStack(ctx.cwd, run.dir, stack);
+	printPlan(ctx, run);
+	if (stack.infra.length > 0) {
+		ctx.logger.info(`\n🗄️  Starting ${stack.infra.join(", ")}…`);
+		await deps.docker.up(ref, stack.infra);
+		for (const service of stack.infra) applied(ctx, run, {
+			key: `service:${service}`,
+			resourceType: "service",
+			action: "ensure",
+			id: `${stack.project}/${service}`,
+			via: Object.keys(run.previous).length > 0 ? "recorded" : "created"
+		});
+	}
+	if (stack.infra.includes("postgres")) await prepareDatabases(ctx, run, deps);
+}
+/** Create what the plan names in the stack's Postgres, then migrate it. */
+async function prepareDatabases(ctx, run, deps) {
+	const { stack } = run;
+	const workspace = ctx.workspace;
+	const port = await deps.docker.port(run.ref, "postgres", 5432);
+	const statements = postgresStatements(stack.plan, workspace.name, stack.credential.seed);
+	if (statements.length > 0) {
+		ctx.logger.info("🗄️  Creating databases, roles and grants…");
+		await applyPostgres(deps.sql(port, stack.credential.master), statements);
+	}
+	const sources = {};
+	const manifest = await discover({
+		patterns: constructGlobs(workspace),
+		cwd: workspace.root,
+		sources
+	});
+	const env = envFor(stack.plan, {
+		ports: { [primaryPortKey("postgres")]: port },
+		project: workspace.name,
+		master: stack.credential.master,
+		...stack.credential.seed ? { seed: stack.credential.seed } : {}
+	});
+	const runs = await deps.migrate({
+		root: workspace.root,
+		manifest,
+		sources,
+		env
+	});
+	for (const { target, applied } of runs) if (applied.length > 0) ctx.logger.info(`🗄️  ${target.migrations}: applied ${applied.length}`);
+}
+/**
+* Each app's image: built from this checkout — every backend bundled first,
+* on the host, with this CLI — or pulled at the tag. Nothing live changes.
+*/
+async function buildCompose(ctx, run, deps) {
+	const { stack, ref } = run;
+	const apps = stack.apps.map((app) => app.name);
+	if (run.mode === "build") {
+		for (const app of stack.apps.filter((a) => a.kind === "rest-api")) {
+			ctx.signal.throwIfAborted();
+			ctx.logger.info(`\n📦 Bundling ${app.name}…`);
+			await deps.bundle(join(ctx.cwd, app.path), ctx);
+		}
+		ctx.logger.info("\n🐳 Building images…");
+		await deps.docker.build(ref, apps);
+	} else {
+		ctx.logger.info(`\n🐳 Pulling ${ctx.tag}…`);
+		await deps.docker.pull(ref, apps);
+	}
+	for (const app of stack.apps) {
+		const digest = await deps.docker.digest(app.ref);
+		run.images[app.name] = {
+			ref: app.ref,
+			tag: app.tag,
+			...digest ? { digest } : {}
+		};
+		ctx.emit({
+			type: "artifact.built",
+			app: app.name,
+			imageRef: app.ref,
+			...digest ? { digest } : {}
+		});
+		run.changes.push({
+			key: `image:${app.name}`,
+			resourceType: "image",
+			action: run.mode === "build" ? "build" : "reuse",
+			id: digest ?? app.ref
+		});
+	}
+}
+/**
+* The whole stack up — anything it no longer defines removed — and each
+* app's image recorded in the stage's state.
+*/
+async function releaseCompose(ctx, run, deps) {
+	const { stack, ref } = run;
+	ctx.logger.info("\n🚀 Starting the stack…");
+	await deps.docker.up(ref);
+	if (stack.local) await deps.docker.copyOut(ref, "caddy", "/data/caddy/pki/authorities/local/root.crt", caFile(run)).catch(() => {});
+	await recordImages(ctx, run);
+	for (const app of stack.apps) {
+		const image = run.images[app.name];
+		applied(ctx, run, {
+			key: `service:${app.name}`,
+			resourceType: "service",
+			action: "ensure",
+			id: `${stack.project}/${app.name}`,
+			via: run.previous[app.name] ? "recorded" : "created"
+		});
+		ctx.emit({
+			type: "app.deployed",
+			app: app.name,
+			applicationId: `${stack.project}/${app.name}`,
+			imageRef: image?.ref ?? app.ref,
+			url: app.url
+		});
+	}
+	ctx.logger.info(`\n✅ ${stack.project} is running:`);
+	for (const app of stack.apps) ctx.logger.info(`   ${app.name.padEnd(12)} ${app.url}`);
+	if (stack.local) ctx.logger.info(`\n🔐 Certificates are from Caddy's local CA: NODE_EXTRA_CA_CERTS=${join(stackDir(ctx.stage), "caddy-root.crt")}`);
+}
+/**
+* Each app's image in the stage's state — the same `images` a Dokploy deploy
+* records: the ref it runs, the tag it was released under, and the digest
+* the tag resolved to.
+*/
+async function recordImages(ctx, run) {
+	const journal = await DeployJournal.open(ctx.state, ctx.stage, () => createEmptyState(ctx.stage, "", ""));
+	for (const app of run.stack.apps) {
+		const image = run.images[app.name] ?? {
+			ref: app.ref,
+			tag: app.tag
+		};
+		setDeployedImage(journal.state, app.name, image);
+	}
+	journal.state.identity = ctx.identity.key;
+	await journal.save();
+}
+/**
+* Each app asked through Caddy, over HTTPS, the certificate verified: an API
+* at `/health`, a site at `/`. On the local stage the edge is this machine and
+* its certificates are Caddy's internal CA's, so the CA `release` copied out
+* is the one trusted and the request goes to 127.0.0.1.
+*/
+async function verifyCompose(ctx, run, deps) {
+	const { stack } = run;
+	const ca = stack.local ? await readFile(caFile(run), "utf-8").catch(() => void 0) : void 0;
+	ctx.logger.info("\n🩺 Checking each app through Caddy…");
+	const down = (await Promise.all(stack.apps.map((app) => checkApp(ctx, app, deps, {
+		ca,
+		local: stack.local
+	})))).filter((result) => !result.healthy).map(({ app, url, last }) => ({
+		app,
+		url,
+		last
+	}));
+	if (down.length > 0) throw new ComposeAppsUnhealthy(stack.project, down);
+}
+async function checkApp(ctx, app, deps, options) {
+	const url = `${app.url}${app.kind === "site" ? "/" : "/health"}`;
+	let last = "not asked";
+	for (let attempt = 1; attempt <= deps.healthAttempts; attempt++) {
+		ctx.signal.throwIfAborted();
+		let status;
+		try {
+			status = await deps.probe({
+				url,
+				...options.ca ? { ca: options.ca } : {},
+				...options.local ? { connectTo: "127.0.0.1" } : {},
+				timeoutMs: 1e4,
+				signal: ctx.signal
+			});
+			last = `HTTP ${status}`;
+		} catch (error) {
+			last = error instanceof Error ? error.message : String(error);
+		}
+		const healthy = status !== void 0 && isHealthy(status);
+		ctx.emit({
+			type: "health.checked",
+			app: app.name,
+			url,
+			healthy,
+			...status !== void 0 ? { status } : {},
+			attempt
+		});
+		if (healthy) {
+			ctx.logger.info(`   ✓ ${app.name.padEnd(12)} ${url} (${last})`);
+			return {
+				app: app.name,
+				url,
+				last,
+				healthy
+			};
+		}
+		if (attempt < deps.healthAttempts) await new Promise((resolve) => setTimeout(resolve, deps.healthIntervalMs));
+	}
+	ctx.logger.warn(`   ✗ ${app.name.padEnd(12)} ${url} (${last})`);
+	return {
+		app: app.name,
+		url,
+		last,
+		healthy: false
+	};
+}
+function composeResult(ctx, run) {
+	const apps = run.stack.apps.map((app) => {
+		const image = run.images[app.name];
+		return {
+			appName: app.name,
+			type: app.kind === "site" ? "web" : "backend",
+			success: !ctx.dryRun,
+			applicationId: `${run.stack.project}/${app.name}`,
+			imageRef: image?.ref ?? app.ref,
+			...image?.digest ? { digest: image.digest } : {},
+			url: app.url
+		};
+	});
+	return {
+		apps,
+		projectId: run.stack.project,
+		successCount: ctx.dryRun ? 0 : apps.length,
+		failedCount: 0,
+		stage: ctx.stage,
+		identity: ctx.identity.key,
+		tag: ctx.tag,
+		dryRun: ctx.dryRun,
+		environmentId: "",
+		skipped: [...ctx.skipped],
+		urls: Object.fromEntries(run.stack.apps.map((app) => [app.name, app.url])),
+		changes: run.changes
+	};
+}
+function caFile(run) {
+	return join(run.dir, "caddy-root.crt");
+}
+function applied(ctx, run, change) {
+	const { via, ...rest } = change;
+	run.changes.push(rest);
+	ctx.emit({
+		type: "resource.applied",
+		...rest,
+		via
+	});
+}
+/** Write the stack's files: owner-only, since the env files hold secrets. */
+async function writeStack(root, dir, stack) {
+	await mkdir(dir, {
+		recursive: true,
+		mode: 448
+	});
+	await chmod(dir, 448);
+	const files = [];
+	const write = async (path, content, mode = 420) => {
+		await mkdir(dirname(path), { recursive: true });
+		await writeFile(path, content, { mode });
+		await chmod(path, mode);
+		files.push(path);
+	};
+	await write(join(dir, "docker-compose.yml"), composeYaml(stack));
+	await write(join(dir, "Caddyfile"), stack.caddyfile);
+	for (const app of stack.apps) if (app.env) await write(join(dir, `${app.name}.env`), envFile(app.env), 384);
+	for (const [path, content] of Object.entries(stack.dockerfiles)) await write(join(root, path), content);
+	await ignoreStacks(root);
+	return files;
+}
+/** Make sure the build context leaves `.gkm/compose` out. */
+async function ignoreStacks(root) {
+	const path = join(root, ".dockerignore");
+	if (!existsSync(path)) {
+		await writeFile(path, generateDockerignore());
+		return;
+	}
+	const current = await readFile(path, "utf-8");
+	if (/^\/?\.gkm\/compose\/?$|^\/?\.gkm\/?$/m.test(current)) return;
+	await appendFile(path, `${current.endsWith("\n") ? "" : "\n"}\n# gkm compose's stacks: each app's env file holds its stage's secrets\n.gkm/compose\n`);
+}
+function composeYaml(stack) {
+	const stage = stack.local ? "" : ` --stage ${stack.stage}`;
+	return `# Generated by gkm compose from the construct manifest — do not edit.
+# The ${stack.stage} stage's APIs and sites behind one Caddy. Each backend
+# reads exactly the keys in its own env file beside this one.
+#
+#   gkm compose${stage}          start or update it
+#   gkm compose${stage} --down   stop it
+${stringify(stack.compose, {
+		lineWidth: 0,
+		aliasDuplicateObjects: false
+	})}`;
+}
+function printPlan(ctx, run) {
+	const { stack, mode, files } = run;
+	ctx.logger.info(`\n🧱 ${stack.project} — stage ${stack.stage}`);
+	for (const app of stack.apps) ctx.logger.info(`   ${app.name.padEnd(12)} ${app.url.padEnd(40)} ${mode} ${app.ref}`);
+	if (stack.infra.length > 0) ctx.logger.info(`   infrastructure: ${stack.infra.join(", ")}`);
+	ctx.logger.info(`\n📝 Wrote ${files.length} file(s) under ${stackDir(stack.stage)}/`);
+}
+//#endregion
+//#region src/target/compose/index.ts
+/**
+* The built-in `compose` target: a stage as one Docker Compose stack behind
+* Caddy, on the machine that runs the deploy.
+*
+* ```bash
+* gkm deploy --target compose --stage production --tag v1.4.0  # what CI pushed
+* gkm deploy --target compose --stage production               # built from here
+* gkm deploy --target compose --stage development              # the local stage
+* ```
+*
+* - `validate`: the stack (`composeStack`, pure) and, for a tag, every image
+*   looked up in the registry — `ImageTagNotFound` before anything changes
+* - `plan`: the stack's files and what a run would create or reuse
+* - `provision`: generated secrets kept, files written, infrastructure up,
+*   databases, roles, grants and migrations
+* - `build`: each backend bundled on the host and every image built — or, for
+*   a tag, pulled
+* - `release`: `up --wait --remove-orphans`, and each app's image, tag and
+*   digest in the stage's state
+* - `verify`: each app asked through Caddy over HTTPS
+*
+* `gkm compose` is this target with a few more switches (`--build`, `--pull`,
+* `--down`), run through the same `deploy()`.
+*/
+var compose_exports = /* @__PURE__ */ __exportAll({ composeTarget: () => composeTarget });
+/** The compose target, with its Docker, bundler and probe as given. */
+function composeTarget(options = {}) {
+	const { mode, report, ...given } = options;
+	const deps = {
+		...defaultDeps,
+		...given
+	};
+	return defineTarget({
+		name: "compose",
+		runtime: "server",
+		capabilities: {
+			rollback: false,
+			migrations: "target",
+			images: true,
+			localStage: true
+		},
+		credentials: [],
+		tag: ({ cwd }) => deps.revision(cwd),
+		validate: (ctx) => validateCompose(ctx, deps, mode),
+		plan: (ctx, run) => planCompose(ctx, run),
+		provision: (ctx, run) => provisionCompose(ctx, run, deps),
+		build: (ctx, run) => buildCompose(ctx, run, deps),
+		release: (ctx, run) => releaseCompose(ctx, run, deps),
+		verify: (ctx, run) => verifyCompose(ctx, run, deps),
+		result: (ctx, run) => {
+			report?.(run);
+			return composeResult(ctx, run);
+		}
+	});
+}
+//#endregion
+export { SeedHasNoSeed as _, MigrationsOutsideFolder as a, dockerCompose as b, SeedFailed as c, migrateAndSeed as d, migrateDatabases as f, MigrationHasNoUp as g, DuplicateMigration as h, MigrationFailed as i, UnknownDatabaseFolder as l, seedDatabases as m, compose_exports as n, NoOwnerCredential as o, pendingMigrations as p, KyselyNotFound as r, NoSuchMigrationTarget as s, composeTarget as t, UnknownMigrationFolder as u, composeProject as v, stackDir as y };
+
+//# sourceMappingURL=compose-DprE3ASm.mjs.map