@geekmidas/cli 10.0.0-alpha.64 → 10.0.0-alpha.66

package/dist/compose-CNQL8BnO.mjs

@@ -0,0 +1,1398 @@
+import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
+import { c as runOutput, s as run, t as LocalSandbox } from "./local-CWR4Y_kW.mjs";
+import { r as discover } from "./discover-BFoJWKGD.mjs";
+import { i as activeSandbox } from "./sandbox-Dm247NGx.mjs";
+import { t as appKey } from "./derive-B4vDpzgP.mjs";
+import { t as defineTarget } from "./define-DR8xGYfL.mjs";
+import { B as appEnvKeys, C as validateImageRef, Et as initStageSecrets, G as planFor, H as networkEnv, I as postgresStatements, O as constructGlobs, P as applyPostgres, Q as DEFAULT_IMAGES, R as composeFor, S as generateSlimDockerfile, T as resolveHost, U as envFor, W as localRolePassword, _ as appPackageName, a as recordRelease, b as detectPackageManager, m as withGeneratedSecrets, nt as primaryPortKey, p as DeployJournal, q as hostFor, t as createEmptyState, tt as portKeys, w as isMainFrontendApp, x as generateDockerignore, xt as imageRef, y as siteDockerfile, z as pgClient } from "./state-uuYqnRVO.mjs";
+import { n as DEFAULT_CACHE, r as DEFAULT_EVENTS } from "./fakes-C9RiT6XG.mjs";
+import { u as migrateDatabases } from "./databases-hUHTuwhx.mjs";
+import { dirname, join } from "node:path";
+import { existsSync } from "node:fs";
+import { appendFile, chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { provideKey, provisionOrder, publicEnvFor } from "@geekmidas/manifest";
+import { fileURLToPath } from "node:url";
+import { spawn } from "node:child_process";
+import { stringify } from "yaml";
+import { request } from "node:https";
+//#region src/compose/docker.ts
+/**
+* The Docker operations `gkm compose` needs, behind an interface.
+*
+* Small on purpose, like reconcile's: the rules about *when* each runs — the
+* registry is asked before anything is pulled, nothing is started for a tag
+* that is missing — are asserted against a fake, and this file is only the
+* wiring to the real CLI.
+*
+* Every call is an argument array. Image refs, tags and paths come from the
+* workspace, and none of them reaches a shell.
+*/
+/** `output` as `spawn` reads it. */
+const STDIO = {
+	inherit: "inherit",
+	stderr: [
+		"ignore",
+		2,
+		2
+	],
+	ignore: "ignore"
+};
+/** How a stack's docker commands run: where it is, where output goes. */
+function runOptions(stack, env) {
+	return {
+		cwd: stack.cwd,
+		stdio: STDIO[stack.output ?? "inherit"],
+		...env ? { env } : {},
+		...stack.signal ? { signal: stack.signal } : {}
+	};
+}
+/** How long a stack has to pass its health checks. */
+const WAIT_TIMEOUT_S = 180;
+/** `docker compose port` printed nothing a port can be read from. */
+var ServicePortUnknown = class extends Error {
+	service;
+	inside;
+	output;
+	constructor(service, inside, output) {
+		super(`'${service}' publishes no host port for ${inside} (docker said: ${output.trim() || "nothing"}). Is it running? \`docker compose ps\` shows the stack.`);
+		this.service = service;
+		this.inside = inside;
+		this.output = output;
+		this.name = "ServicePortUnknown";
+	}
+};
+function compose(stack, args) {
+	return [
+		"compose",
+		"-p",
+		stack.project,
+		"-f",
+		stack.file,
+		...args
+	];
+}
+/** Run a program and keep everything it said, whatever it exits with. */
+function capture(command, args, timeoutMs = 6e4) {
+	return new Promise((resolve, reject) => {
+		const child = spawn(command, [...args], {
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			shell: false
+		});
+		let stdout = "";
+		let stderr = "";
+		child.stdout.on("data", (chunk) => {
+			stdout += chunk.toString();
+		});
+		child.stderr.on("data", (chunk) => {
+			stderr += chunk.toString();
+		});
+		const timer = setTimeout(() => child.kill("SIGKILL"), timeoutMs);
+		timer.unref?.();
+		child.on("error", (error) => {
+			clearTimeout(timer);
+			reject(error);
+		});
+		child.on("close", (code) => {
+			clearTimeout(timer);
+			resolve({
+				code,
+				stdout,
+				stderr
+			});
+		});
+	});
+}
+/**
+* Whether a failed `docker manifest inspect` means the tag is not there, as
+* opposed to the registry not answering.
+*
+* Read off the message because that is all the CLI gives. Anything not
+* recognisably "no such tag" is treated as the registry being unreachable:
+* a registry that refused credentials must not be reported as a tag that was
+* never pushed, or the fix offered would be the wrong one.
+*/
+function isMissingManifest(output) {
+	return /no such manifest|manifest unknown|manifest for .* not found|not found: manifest/i.test(output);
+}
+const dockerCompose = {
+	async lookup(ref) {
+		const { code, stdout, stderr } = await capture("docker", [
+			"manifest",
+			"inspect",
+			ref
+		]);
+		if (code === 0) return {
+			ref,
+			status: "found"
+		};
+		const output = `${stderr}\n${stdout}`.trim();
+		return isMissingManifest(output) ? {
+			ref,
+			status: "missing"
+		} : {
+			ref,
+			status: "unreachable",
+			detail: output
+		};
+	},
+	async build(stack, services) {
+		await run("docker", compose(stack, ["build", ...services]), runOptions(stack, {
+			...process.env,
+			DOCKER_BUILDKIT: "1"
+		}));
+	},
+	async pull(stack, services) {
+		await run("docker", compose(stack, ["pull", ...services]), runOptions(stack));
+	},
+	async up(stack, services) {
+		await run("docker", compose(stack, [
+			"up",
+			"-d",
+			"--wait",
+			`--wait-timeout=${WAIT_TIMEOUT_S}`,
+			...services ? [] : ["--remove-orphans"],
+			...services ?? []
+		]), runOptions(stack));
+	},
+	async down(stack) {
+		await run("docker", compose(stack, ["down"]), runOptions(stack));
+	},
+	async port(stack, service, inside) {
+		const output = await runOutput("docker", compose(stack, [
+			"port",
+			service,
+			String(inside)
+		]), {
+			cwd: stack.cwd,
+			...stack.signal ? { signal: stack.signal } : {}
+		});
+		const port = Number(output.trim().split(":").pop());
+		if (!Number.isInteger(port) || port <= 0) throw new ServicePortUnknown(service, inside, output);
+		return port;
+	},
+	async copyOut(stack, service, from, to) {
+		await mkdir(dirname(to), { recursive: true });
+		await run("docker", compose(stack, [
+			"cp",
+			`${service}:${from}`,
+			to
+		]), runOptions(stack));
+	},
+	async digest(ref) {
+		const { code, stdout } = await capture("docker", [
+			"image",
+			"inspect",
+			"--format={{json .RepoDigests}} {{.Id}}",
+			ref
+		]);
+		if (code !== 0) return void 0;
+		const [json = "[]", id] = stdout.trim().split(" ");
+		const repository = ref.split("@")[0].replace(/:[\w][\w.-]*$/, "");
+		try {
+			const digests = JSON.parse(json);
+			const match = Array.isArray(digests) ? digests.find((entry) => typeof entry === "string" && entry.startsWith(`${repository}@`)) : void 0;
+			if (match) return match.slice(repository.length + 1);
+		} catch {}
+		return id || void 0;
+	}
+};
+//#endregion
+//#region src/compose/images.ts
+/**
+* The tag a site's image carries for a release.
+*
+* A site's public URLs are inlined when it is built, so one bundle serves one
+* stage: `v1.4.0-production` and `v1.4.0-staging` are two images of the same
+* commit. A backend reads its URLs at runtime, so one image serves every stage
+* and its tag is the release's alone.
+*/
+function siteTag(tag, stage) {
+	return `${tag}-${stage}`;
+}
+/** Images a tag names that the registry does not have. */
+var ImageTagNotFound = class extends Error {
+	tag;
+	refs;
+	constructor(tag, refs) {
+		super(`The registry has no image for ${refs.length === 1 ? "this app" : `${refs.length} apps`} at '${tag}':\n` + refs.map((ref) => `  - ${ref}`).join("\n") + `\nNothing was pulled or started. Push '${tag}' for every app from CI, pick a tag that exists, or run without --tag to build from this checkout.`);
+		this.tag = tag;
+		this.refs = refs;
+		this.name = "ImageTagNotFound";
+	}
+};
+/** The registry did not answer, or did not let this machine in. */
+var RegistryUnreachable = class extends Error {
+	ref;
+	detail;
+	constructor(ref, detail) {
+		super(`Could not ask the registry about ${ref}: ${detail || "no answer"}\nNothing was pulled or started. Check the registry is reachable and that this machine is logged in to it (\`docker login <registry>\`).`);
+		this.ref = ref;
+		this.detail = detail;
+		this.name = "RegistryUnreachable";
+	}
+};
+/**
+* Assert every image exists, before anything else happens.
+*
+* Asked all at once and reported all at once: a release missing two images is
+* one problem with two names, and finding the second only after fixing the
+* first is a slower way to learn the same thing.
+*
+* @throws {RegistryUnreachable} when the registry cannot say
+* @throws {ImageTagNotFound} listing every missing image
+*/
+async function assertImagesExist(docker, tag, images) {
+	const lookups = await Promise.all(images.map((image) => docker.lookup(image.ref)));
+	const unreachable = lookups.find((lookup) => lookup.status === "unreachable");
+	if (unreachable?.status === "unreachable") throw new RegistryUnreachable(unreachable.ref, unreachable.detail);
+	const missing = lookups.filter((lookup) => lookup.status === "missing").map((lookup) => lookup.ref);
+	if (missing.length > 0) throw new ImageTagNotFound(tag, missing);
+}
+//#endregion
+//#region src/compose/caddyfile.ts
+/** The Caddyfile for a stack's edge. */
+function edgeCaddyfile(sites, options) {
+	const global = options.local ? `{
+	# No ACME and no public DNS: the CA is Caddy's own and the names resolve
+	# to this machine.
+	local_certs
+	auto_https disable_redirects
+}` : options.email ? `{
+	email ${options.email}
+}` : "";
+	const blocks = sites.map(({ host, upstream }) => `https://${host} {${options.local ? `
+	tls internal
+` : ""}
+	# Host and X-Forwarded-* are passed through as Caddy does by default, so
+	# an app builds redirects, cookies and links on the address a caller used.
+	reverse_proxy ${upstream} {
+		# Never buffer: a streamed response — server-sent events, a Next.js
+		# RSC payload — reaches the client as each chunk is written.
+		flush_interval -1
+	}
+}`);
+	return `${HEADER}${global ? `${global}\n\n` : ""}${blocks.join("\n\n")}\n`;
+}
+const HEADER = `# Generated by gkm compose from the construct manifest — do not edit.
+#
+# One host per API and site, each in front of its own container.
+`;
+//#endregion
+//#region src/compose/stack.ts
+/**
+* The stack a workspace runs as for one stage — pure.
+*
+* Everything `gkm compose` writes is decided here, as data: the compose file,
+* the Caddyfile, one env file per backend, and the image each app runs. The
+* command around it reads the workspace, asks the registry, writes the files
+* and starts Docker; none of those decide anything, so all of it can be
+* asserted without a daemon.
+*
+* The values come from the same derivations every other target uses. The
+* plan is reconcile's `planFor`, the keys an app reads are `appEnvKeys`, and
+* every URL is `envFor`'s — asked twice, once with each app at its public
+* address and once on the compose network, because a browser and a sibling
+* service reach the same API by different names.
+*/
+/** Where a stack's files are written, relative to the workspace root. */
+function stackDir(stage) {
+	return `.gkm/compose/${stage}`;
+}
+/**
+* The compose project a stage's stack runs as.
+*
+* The deploy identity's scope, so two workspaces with one name in different
+* namespaces never share containers or volumes — and the stage, so a
+* machine can run two stages side by side.
+*/
+function composeProject(identity) {
+	return `${identity.scope}-${identity.stage}`;
+}
+/** The ports the edge is published on, and the variables that move them. */
+const EDGE_PORT_ENV = {
+	https: "GKM_COMPOSE_HTTPS_PORT",
+	http: "GKM_COMPOSE_HTTP_PORT"
+};
+/**
+* Containers this target does not run.
+*
+* Object storage is the stage's own — an externally hosted bucket whose URL
+* the stage's secrets hold — and so is a deployed stage's mail. The AWS
+* emulator never applies: a stack is a server target, whose events are
+* pg-boss.
+*/
+const NOT_RUN = {
+	minio: true,
+	localstack: true,
+	caddy: true
+};
+/** Kinds whose `<ID>_URL` a stage must be given, because nothing here runs them. */
+const EXTERNAL_KINDS = {
+	objects: true,
+	"file-server": true
+};
+/** The S3 client's credentials, read beside a bucket's URL when it has them. */
+const STORAGE_KEYS = [
+	"AWS_ACCESS_KEY_ID",
+	"AWS_SECRET_ACCESS_KEY",
+	"AWS_REGION"
+];
+/** A bucket the stack needs and the stage was not given. */
+var BucketNotConfigured = class extends Error {
+	app;
+	id;
+	key;
+	stage;
+	constructor(app, id, key, stage) {
+		super(`'${app}' uses the bucket '${id}', and gkm compose runs no object storage: the stage needs an externally hosted bucket. Set its URL in the stage's secrets: gkm secrets:set ${key} 's3://…' --stage ${stage}`);
+		this.app = app;
+		this.id = id;
+		this.key = key;
+		this.stage = stage;
+		this.name = "BucketNotConfigured";
+	}
+};
+/** A value only the stage's secrets can hold, and they do not. */
+var StageSecretMissing = class extends Error {
+	app;
+	key;
+	stage;
+	constructor(app, key, stage) {
+		super(`'${app}' reads ${key}, and the stage '${stage}' has none. Nothing in the stack can derive it; set it in the stage's secrets: gkm secrets:set ${key} '…' --stage ${stage}`);
+		this.app = app;
+		this.key = key;
+		this.stage = stage;
+		this.name = "StageSecretMissing";
+	}
+};
+/** A deployed stage's secrets with no seed to derive its passwords from. */
+var StageSeedMissing = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`The stage '${stage}' has no seed in its secrets, and a deployed stage's database passwords are derived from it. Run gkm compose without --dry-run once, or gkm deploy, to generate it.`);
+		this.stage = stage;
+		this.name = "StageSeedMissing";
+	}
+};
+/** A workspace with no API and no site to run. */
+var NothingToCompose = class extends Error {
+	root;
+	constructor(root) {
+		super(`${root} declares no RestApi and no site, so a stack would run nothing. Workers and mobile apps are not run by gkm compose yet.`);
+		this.root = root;
+		this.name = "NothingToCompose";
+	}
+};
+/** A value that cannot be written to an env file a line at a time. */
+var EnvValueMultiline = class extends Error {
+	app;
+	key;
+	constructor(app, key) {
+		super(`${key} for '${app}' spans more than one line, and an env file holds one value per line. Store it on one line — base64, or JSON — and decode it where it is read.`);
+		this.app = app;
+		this.key = key;
+		this.name = "EnvValueMultiline";
+	}
+};
+/** The services a stack's apps wait on and the edge waits on in turn. */
+const HEALTHY = { condition: "service_healthy" };
+/**
+* An app's health check: its own server, asked on 127.0.0.1 — not
+* `localhost`, which resolves to `::1` first in an Alpine container while a
+* server may listen on IPv4 alone.
+*/
+function probe(port, path) {
+	return {
+		test: [
+			"CMD",
+			"wget",
+			"-q",
+			"-O",
+			"/dev/null",
+			`http://127.0.0.1:${port}${path}`
+		],
+		interval: "5s",
+		timeout: "3s",
+		retries: 20,
+		start_period: "10s"
+	};
+}
+/** The stack for one stage. */
+function composeStack(input) {
+	const { workspace, manifest, stage, identity } = input;
+	const local = stage === workspace.stages.local;
+	const project = composeProject(identity);
+	const custom = input.secrets?.custom ?? {};
+	const https = input.ports?.https ?? 443;
+	const http = input.ports?.http ?? 80;
+	const plan = planFor(manifest, stage, provisionOrder(manifest), {
+		localStage: workspace.stages.local,
+		events: DEFAULT_EVENTS.server,
+		cache: DEFAULT_CACHE.server,
+		edge: false
+	});
+	const byId = new Map(plan.resources.map((r) => [r.id, r]));
+	const seed = local ? void 0 : input.secrets?.seed;
+	if (!local && !seed) throw new StageSeedMissing(stage);
+	const credential = {
+		master: local ? "geekmidas" : localRolePassword(workspace.name, plan, "master", seed),
+		...seed ? { seed } : {}
+	};
+	const infra = plan.containers.filter((c) => !NOT_RUN[c]).filter((c) => local || c !== "mailpit").sort();
+	const apps = stackApps(workspace, manifest, plan, {
+		local,
+		stage,
+		https,
+		identity,
+		images: input.images
+	});
+	if (apps.length === 0) throw new NothingToCompose(workspace.root);
+	const derivation = {
+		project: workspace.name,
+		master: credential.master,
+		...credential.seed ? { seed: credential.seed } : {}
+	};
+	const outside = networkEnv(plan, {
+		...derivation,
+		addresses: Object.fromEntries(apps.map((app) => [app.id, app.url]))
+	});
+	const inside = networkEnv(plan, {
+		...derivation,
+		addresses: Object.fromEntries(apps.map((app) => [app.id, `http://${app.name}:${app.port}`]))
+	});
+	const owners = /* @__PURE__ */ new Map();
+	for (const resource of plan.resources) {
+		owners.set(resource.envKey, resource);
+		if (resource.kind === "email") {
+			owners.set(provideKey(resource.id, "from"), resource);
+			owners.set(provideKey(resource.id, "inboxUrl"), resource);
+		}
+		if (resource.kind === "external-api") owners.set(provideKey(resource.id, "credentials"), resource);
+	}
+	const surfaceUrls = new Map(plan.resources.filter((r) => r.kind === "rest-api" || r.kind === "site").map((r) => [r.envKey, r.id]));
+	const appById = new Map(apps.map((app) => [app.id, app]));
+	/**
+	* What a key resolves to for one app, from the stage's secrets where only
+	* they can hold it, and the derivations otherwise.
+	*/
+	const valueFor = (app, key, owner) => {
+		if (owner && EXTERNAL_KINDS[owner.kind] && key === owner.envKey) {
+			const value = custom[key];
+			if (value === void 0) throw new BucketNotConfigured(app.name, owner.id, key, stage);
+			return value;
+		}
+		if (owner && suppliedBy(owner, key, local)) {
+			const value = custom[key];
+			if (value === void 0) throw new StageSecretMissing(app.name, key, stage);
+			return value;
+		}
+		if (custom[key] !== void 0) return custom[key];
+		const surface = surfaceUrls.get(key);
+		if (app.kind === "rest-api" && surface && surface !== app.id) return inside[key];
+		return outside[key];
+	};
+	for (const app of apps) {
+		if (app.kind === "site") {
+			const site = manifest[app.id];
+			if (site?.kind !== "site") continue;
+			const args = {};
+			for (const [key, source] of Object.entries(publicEnvFor(site, manifest))) {
+				const value = valueFor(app, source, owners.get(source));
+				if (value !== void 0) args[key] = value;
+			}
+			if (app.build && Object.keys(args).length > 0) app.build.args = args;
+			continue;
+		}
+		const keys = appEnvKeys(manifest, app.name, input.runnables) ?? /* @__PURE__ */ new Set();
+		const values = {};
+		for (const key of [...keys].sort()) {
+			const owner = owners.get(key) ?? storageOwner(key, plan);
+			if (!local && owner?.kind === "email" && key.endsWith("_INBOX_URL")) continue;
+			if (STORAGE_KEYS.includes(key)) {
+				if (custom[key] !== void 0) values[key] = custom[key];
+				continue;
+			}
+			const value = valueFor(app, key, owner);
+			if (value !== void 0) values[key] = value;
+		}
+		const trusted = provideKey(app.id, "trustedOrigins");
+		if (keys.has(trusted)) {
+			const internal = (byId.get(app.id)?.callers ?? []).map((caller) => appById.get(caller)).filter((caller) => caller?.kind === "rest-api").map((caller) => `http://${caller.name}:${caller.port}`);
+			const origins = [...(values[trusted] ?? "").split(",").filter(Boolean), ...internal];
+			values[trusted] = [...new Set(origins)].join(",");
+		}
+		app.env = {
+			...values,
+			NODE_ENV: "production",
+			PORT: String(app.port),
+			STAGE: stage
+		};
+		for (const [key, value] of Object.entries(app.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(app.name, key);
+	}
+	const compose = stackFile({
+		project,
+		plan,
+		infra,
+		apps,
+		master: credential.master,
+		https,
+		http
+	});
+	const caddyfile = edgeCaddyfile(apps.map((app) => ({
+		host: app.host,
+		upstream: `${app.name}:${app.port}`
+	})), { local });
+	const dockerfiles = {};
+	for (const app of apps) {
+		if (!app.build) continue;
+		dockerfiles[app.build.dockerfile] = app.kind === "site" ? siteDockerfile(app.name, workspace.apps[app.name], {
+			turboPackage: input.packages?.[app.name] ?? app.name,
+			packageManager: input.packageManager ?? "pnpm",
+			manifest
+		}) : generateSlimDockerfile({
+			imageName: app.name,
+			baseImage: "node:22-alpine",
+			port: app.port,
+			healthCheckPath: "/health",
+			prebuilt: true,
+			packageManager: input.packageManager ?? "pnpm",
+			bundle: `${app.path}/.gkm/server/dist/server.mjs`
+		});
+	}
+	return {
+		project,
+		stage,
+		local,
+		apps,
+		infra,
+		compose,
+		caddyfile,
+		dockerfiles,
+		plan,
+		credential
+	};
+	/** Whether only the stage's secrets can supply `key` to `owner`. */
+	function suppliedBy(owner, key, isLocal) {
+		if (owner.kind === "credential") return true;
+		if (owner.kind === "external-api") return key === provideKey(owner.id, "credentials");
+		if (isLocal) return false;
+		if (owner.kind === "secret" || owner.kind === "encryption") return true;
+		return owner.kind === "email" && !key.endsWith("_INBOX_URL");
+	}
+}
+/** Which bucket an S3 credential key belongs to — the first one declared. */
+function storageOwner(key, plan) {
+	if (!STORAGE_KEYS.includes(key)) return void 0;
+	return plan.resources.find((r) => r.kind === "objects");
+}
+/** The apps a stack runs: every API and every site, at its stage address. */
+function stackApps(workspace, manifest, plan, options) {
+	const apps = [];
+	const resources = new Map(plan.resources.map((r) => [r.id, r]));
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration.kind !== "rest-api" && declaration.kind !== "site") continue;
+		const name = appKey(id);
+		const app = workspace.apps[name];
+		const resource = resources.get(id);
+		if (!app || !resource || !app.port) continue;
+		const host = hostOf(name, app, workspace, resource, options);
+		const tag = declaration.kind === "site" ? siteTag(options.images.tag, options.stage) : options.images.tag;
+		const ref = validateImageRef(imageRef(options.identity, name, options.images.registry, tag));
+		apps.push({
+			app: name,
+			name,
+			id,
+			kind: declaration.kind,
+			path: app.path,
+			port: app.port,
+			host,
+			url: `https://${host}${options.local && options.https !== 443 ? `:${options.https}` : ""}`,
+			ref,
+			tag,
+			...options.images.mode === "build" ? { build: { dockerfile: `${stackDir(options.stage)}/Dockerfile.${name}` } } : {}
+		});
+	}
+	return apps.sort((a, b) => a.name.localeCompare(b.name));
+}
+/**
+* The host an app answers on for a stage: the `gkm dev` edge's
+* `*.localhost` names for the local stage, and the stage's domain — by the
+* same rule a deploy follows — for any other.
+*/
+function hostOf(name, app, workspace, resource, options) {
+	if (options.local) return hostFor(resource, workspace.name);
+	return resolveHost(name, app, options.stage, workspace.deploy?.domains, isMainFrontendApp(name, app, workspace.apps));
+}
+/** The compose document: the infrastructure, the apps, and the edge. */
+function stackFile(options) {
+	const { project, plan, infra, apps } = options;
+	const derived = composeFor({
+		...plan,
+		containers: [...infra]
+	}, {
+		project,
+		ports: Object.fromEntries(portKeys(infra, plan.fakes).map((key) => [key, 0]))
+	});
+	const services = {};
+	const volumes = {
+		...derived.volumes,
+		"caddy-data": {},
+		"caddy-config": {}
+	};
+	for (const name of infra) {
+		const { ports: _ports, depends_on, profiles: _profiles, ...service } = derived.services[name];
+		services[name] = {
+			...service,
+			...depends_on?.length ? { depends_on: Object.fromEntries(depends_on.map((dep) => [dep, HEALTHY])) } : {}
+		};
+	}
+	const postgres = services.postgres;
+	if (postgres) {
+		postgres.environment = {
+			...postgres.environment,
+			POSTGRES_PASSWORD: options.master
+		};
+		postgres.ports = ["127.0.0.1::5432"];
+	}
+	for (const app of apps) services[app.name] = {
+		image: app.ref,
+		...app.build ? { build: {
+			context: "../../..",
+			dockerfile: app.build.dockerfile,
+			...app.build.args ? { args: app.build.args } : {}
+		} } : {},
+		restart: "unless-stopped",
+		...app.kind === "rest-api" ? {
+			env_file: [{
+				path: `./${app.name}.env`,
+				format: "raw"
+			}],
+			...infra.length ? { depends_on: Object.fromEntries(infra.map((name) => [name, HEALTHY])) } : {}
+		} : {},
+		healthcheck: probe(app.port, app.kind === "site" ? "/" : "/health")
+	};
+	services.caddy = {
+		image: DEFAULT_IMAGES.caddy,
+		restart: "unless-stopped",
+		ports: [`${options.https}:443`, `${options.http}:80`],
+		volumes: [
+			"./Caddyfile:/etc/caddy/Caddyfile:ro",
+			"caddy-data:/data",
+			"caddy-config:/config"
+		],
+		depends_on: Object.fromEntries(apps.map((app) => [app.name, HEALTHY])),
+		healthcheck: {
+			test: [
+				"CMD",
+				"caddy",
+				"version"
+			],
+			interval: "10s",
+			timeout: "5s",
+			retries: 5
+		}
+	};
+	return {
+		name: project,
+		services,
+		volumes
+	};
+}
+/** Render an app's env file: one `KEY=value` per line, read raw by compose. */
+function envFile(env) {
+	return `${Object.entries(env).sort(([a], [b]) => a.localeCompare(b)).map(([key, value]) => `${key}=${value}`).join("\n")}\n`;
+}
+//#endregion
+//#region src/target/compose/health.ts
+/**
+* Asking each app of a stack whether it answers — through Caddy, over HTTPS,
+* the way a browser reaches it.
+*
+* `docker compose up --wait` already knows each container passed its own
+* health check, asked on 127.0.0.1 inside it. What that cannot say is whether
+* the stack is reachable: whether the edge routes the host to the app, and
+* whether the certificate it presents is one a client accepts. So the check
+* goes through the edge, by hostname, and verifies the certificate.
+*/
+/** A request that got no answer in time. */
+var HealthRequestTimedOut = class extends Error {
+	url;
+	timeoutMs;
+	constructor(url, timeoutMs) {
+		super(`${url} did not answer within ${timeoutMs}ms. Check the stack is up with \`docker compose ps\`.`);
+		this.url = url;
+		this.timeoutMs = timeoutMs;
+		this.name = "HealthRequestTimedOut";
+	}
+};
+/** The real probe: one HTTPS GET, the certificate verified. */
+const httpsProbe = ({ url, ca, connectTo, timeoutMs, signal }) => {
+	const target = new URL(url);
+	return new Promise((resolve, reject) => {
+		const req = request({
+			host: connectTo ?? target.hostname,
+			port: target.port || 443,
+			servername: target.hostname,
+			path: `${target.pathname}${target.search}`,
+			method: "GET",
+			headers: { host: target.host },
+			...ca ? { ca } : {},
+			...signal ? { signal } : {},
+			timeout: timeoutMs
+		}, (res) => {
+			res.resume();
+			res.on("end", () => resolve(res.statusCode ?? 0));
+			res.on("error", reject);
+		});
+		req.on("timeout", () => req.destroy(new HealthRequestTimedOut(url, timeoutMs)));
+		req.on("error", reject);
+		req.end();
+	});
+};
+/** Whether a status means the app answered as it should. */
+function isHealthy(status) {
+	return status >= 200 && status < 400;
+}
+/** Apps that did not answer through the edge. */
+var ComposeAppsUnhealthy = class extends Error {
+	project;
+	apps;
+	constructor(project, apps) {
+		super(`${project} started, but ${apps.length === 1 ? "this app does" : "these apps do"} not answer through Caddy:\n` + apps.map(({ url, last }) => `  - ${url}: ${last}`).join("\n") + `\nSee why with \`docker compose -p ${project} logs caddy ${apps.map((a) => a.app).join(" ")}\`.`);
+		this.project = project;
+		this.apps = apps;
+		this.name = "ComposeAppsUnhealthy";
+	}
+};
+//#endregion
+//#region src/target/compose/phases.ts
+/**
+* The compose target's phases: a stage as one Docker Compose stack behind
+* Caddy, on the machine the deploy runs on.
+*
+* The order is the point of this file, and the rules it keeps are these:
+*
+* - A tag is checked before anything happens (`validate`). Every app's image
+*   is asked of the registry first; one missing image stops the run naming
+*   them all, and nothing is written, pulled or started.
+* - The databases exist before the apps do (`provision`). Postgres comes up
+*   alone, its databases, roles and grants are created and its migrations
+*   applied from this machine, and only then do the apps start — so an app
+*   never boots against a schema that is not there yet.
+* - What a stage runs is recorded (`release`). Each app's image, the tag it
+*   was released under and the digest it resolved to are written to the
+*   stage's state, so "what is this stage running" has an exact answer.
+* - What was started answers (`verify`): each app is asked through Caddy,
+*   over HTTPS, with the certificate verified.
+*
+* Docker, the registry, the bundler, Postgres and the health probe are
+* injected, so the rules are asserted without a daemon; the defaults are the
+* real ones.
+*/
+/** A port variable that does not hold a port. */
+var EdgePortInvalid = class extends Error {
+	variable;
+	value;
+	constructor(variable, value) {
+		super(`${variable}=${value} is not a port. Set it to a number between 1 and 65535, or unset it for the default.`);
+		this.variable = variable;
+		this.value = value;
+		this.name = "EdgePortInvalid";
+	}
+};
+/** A build with no commit to tag its images with. */
+var NoGitRevision = class extends Error {
+	root;
+	constructor(root) {
+		super(`Images built here are tagged with the commit they were built from, and ${root} is not in a git repository with a commit. Commit, or pass --tag to name the images yourself.`);
+		this.root = root;
+		this.name = "NoGitRevision";
+	}
+};
+/** A backend's production bundle did not build. */
+var BundleFailed = class extends Error {
+	app;
+	exitCode;
+	stderr;
+	constructor(app, exitCode, stderr) {
+		super(`Bundling '${app}' for production failed (exit code ${exitCode}).${stderr.trim() ? `\n${stderr.trim().slice(-4e3)}` : ""}\nRun \`gkm build --provider server --production\` in the app's directory to see it again.`);
+		this.app = app;
+		this.exitCode = exitCode;
+		this.stderr = stderr;
+		this.name = "BundleFailed";
+	}
+};
+/** The CLI's own entry, which the bundle step runs, is not where it should be. */
+var CliEntryNotFound = class extends Error {
+	from;
+	constructor(from) {
+		super(`Could not find bin/gkm.mjs above ${from}, which bundling a backend runs. Reinstall @geekmidas/cli.`);
+		this.from = from;
+		this.name = "CliEntryNotFound";
+	}
+};
+/** The commit HEAD is at, short — and `-dirty` when the tree has changes. */
+async function gitRevision(root) {
+	let sha;
+	try {
+		sha = (await runOutput("git", [
+			"rev-parse",
+			"--short",
+			"HEAD"
+		], { cwd: root })).trim();
+	} catch {
+		throw new NoGitRevision(root);
+	}
+	if (!sha) throw new NoGitRevision(root);
+	return (await runOutput("git", ["status", "--porcelain"], { cwd: root }).catch(() => "")).trim() ? `${sha}-dirty` : sha;
+}
+/** The edge's ports, from the environment — 443 and 80 when unset. */
+function edgePorts(env = process.env) {
+	const read = (variable, fallback) => {
+		const value = env[variable];
+		if (value === void 0 || value === "") return fallback;
+		const port = Number(value);
+		if (!Number.isInteger(port) || port < 1 || port > 65535) throw new EdgePortInvalid(variable, value);
+		return port;
+	};
+	return {
+		https: read(EDGE_PORT_ENV.https, 443),
+		http: read(EDGE_PORT_ENV.http, 80)
+	};
+}
+/** `bin/gkm.mjs` of the CLI that is running. */
+function cliEntry() {
+	const from = dirname(fileURLToPath(import.meta.url));
+	for (let dir = from; dirname(dir) !== dir; dir = dirname(dir)) {
+		const entry = join(dir, "bin", "gkm.mjs");
+		if (existsSync(entry)) return entry;
+	}
+	throw new CliEntryNotFound(from);
+}
+/** A cold production bundle is seconds; a hung one must not hold the lock. */
+const BUNDLE_TIMEOUT_MS = 6e5;
+/**
+* Bundle a backend with the gkm that is running — the same build a deploy
+* makes, so the image holds one file and no dependencies — in the run's
+* sandbox, because the build imports the project's code.
+*/
+async function bundleInSandbox(appRoot, ctx) {
+	const sandbox = activeSandbox() ?? new LocalSandbox({ root: ctx.cwd });
+	const result = await sandbox.exec("node", [
+		cliEntry(),
+		"build",
+		"--provider",
+		"server",
+		"--production"
+	], {
+		cwd: appRoot,
+		env: sandbox.env,
+		timeoutMs: BUNDLE_TIMEOUT_MS,
+		output: ctx.childOutput,
+		signal: ctx.signal
+	});
+	if (result.exitCode !== 0) throw new BundleFailed(appRoot, result.exitCode, result.stderr);
+}
+/**
+* The real ones. Each app is asked for three minutes before it counts as
+* down: a deployed stage's first ACME certificate can take that long.
+*/
+const defaultDeps = {
+	docker: dockerCompose,
+	bundle: bundleInSandbox,
+	revision: gitRevision,
+	sql: pgClient,
+	migrate: migrateDatabases,
+	probe: httpsProbe,
+	healthAttempts: 90,
+	healthIntervalMs: 2e3,
+	env: process.env
+};
+/**
+* The stack the stage would run, and — for a tag — the registry's word that
+* every image it names exists. Nothing is written: a missing image stops the
+* run here, before a file, a secret or a container is touched.
+*/
+async function validateCompose(ctx, deps, forced) {
+	const { workspace, stage, identity, tag } = ctx;
+	const root = workspace.root;
+	const mode = forced ?? (ctx.tagGiven ? "pull" : "build");
+	const runnables = {};
+	const manifest = await discover({
+		patterns: constructGlobs(workspace),
+		cwd: root,
+		runnables
+	});
+	const { secrets, generated } = await stageSecrets(ctx, manifest);
+	const stack = composeStack({
+		workspace,
+		manifest,
+		runnables,
+		stage,
+		identity,
+		images: {
+			mode,
+			tag,
+			...workspace.deploy?.registry ? { registry: workspace.deploy.registry } : {}
+		},
+		secrets,
+		ports: edgePorts(deps.env),
+		packageManager: detectPackageManager(root),
+		packages: Object.fromEntries(Object.entries(workspace.apps).map(([name, app]) => [name, appPackageName(root, name, app.path)]))
+	});
+	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, stack.apps);
+	const dir = join(root, stackDir(stage));
+	const previous = Object.fromEntries(Object.entries((await ctx.state.read(stage))?.state.releases ?? {}).map(([name, releases]) => {
+		const { ref, tag, digest } = releases.current;
+		return [name, {
+			ref,
+			...tag ? { tag } : {},
+			...digest ? { digest } : {}
+		}];
+	}));
+	return {
+		mode,
+		stack,
+		dir,
+		ref: {
+			project: composeProject(identity),
+			file: join(dir, "docker-compose.yml"),
+			cwd: root,
+			output: ctx.childOutput,
+			signal: ctx.signal
+		},
+		secrets,
+		generated,
+		previous,
+		files: [],
+		images: {},
+		changes: []
+	};
+}
+/**
+* The stage's secrets — and, for a deployed stage, everything it generates
+* once: its seed, and each declared secret and keyring. Kept only once the
+* run goes ahead (`provision`), so a dry run, or a tag that is not there,
+* leaves the stage's secrets as it found them.
+*/
+async function stageSecrets(ctx, manifest) {
+	const stored = await ctx.secrets.read();
+	if (ctx.stage === ctx.workspace.stages.local) return {
+		secrets: stored,
+		generated: []
+	};
+	const { secrets, generated } = withGeneratedSecrets(stored ?? initStageSecrets(ctx.stage), manifest);
+	if (secrets.seed) ctx.secrets.mask(secrets.seed);
+	for (const value of Object.values(secrets.custom ?? {})) ctx.secrets.mask(value);
+	return {
+		secrets,
+		generated
+	};
+}
+/**
+* A dry run: the stack's files, written so they can be read, and what a real
+* run would do — no image is built or pulled, no container touched, nothing
+* recorded and no secret kept.
+*/
+async function planCompose(ctx, run) {
+	if (run.generated.length > 0) ctx.logger.info(`🔑 "${ctx.stage}" has no ${run.generated.join(", ")} yet; this dry run used values it did not keep.`);
+	run.files = await writeStack(ctx.cwd, run.dir, run.stack);
+	printPlan(ctx, run);
+	const planned = (change) => {
+		run.changes.push(change);
+		ctx.emit({
+			type: "resource.planned",
+			...change
+		});
+	};
+	for (const service of run.stack.infra) planned({
+		key: `service:${service}`,
+		resourceType: "service",
+		action: "ensure"
+	});
+	for (const app of run.stack.apps) {
+		planned({
+			key: `image:${app.name}`,
+			resourceType: "image",
+			action: run.mode === "build" ? "build" : "reuse",
+			id: app.ref
+		});
+		planned({
+			key: `service:${app.name}`,
+			resourceType: "service",
+			action: run.previous[app.name] ? "reuse" : "create"
+		});
+	}
+	planned({
+		key: "service:caddy",
+		resourceType: "service",
+		action: "ensure"
+	});
+}
+/**
+* What the apps run on: the stage's generated secrets kept, the stack's files
+* written, its infrastructure started, and its databases, roles, grants and
+* migrations applied.
+*/
+async function provisionCompose(ctx, run, deps) {
+	const { stack, ref } = run;
+	if (run.generated.length > 0 && run.secrets) {
+		await ctx.secrets.write(run.secrets);
+		ctx.logger.info(`🔑 Generated for "${ctx.stage}" (${ctx.secrets.store}): ${run.generated.join(", ")}`);
+	}
+	run.files = await writeStack(ctx.cwd, run.dir, stack);
+	printPlan(ctx, run);
+	if (stack.infra.length > 0) {
+		ctx.logger.info(`\n🗄️  Starting ${stack.infra.join(", ")}…`);
+		await deps.docker.up(ref, stack.infra);
+		for (const service of stack.infra) applied(ctx, run, {
+			key: `service:${service}`,
+			resourceType: "service",
+			action: "ensure",
+			id: `${stack.project}/${service}`,
+			via: Object.keys(run.previous).length > 0 ? "recorded" : "created"
+		});
+	}
+	if (stack.infra.includes("postgres")) await prepareDatabases(ctx, run, deps);
+}
+/** Create what the plan names in the stack's Postgres, then migrate it. */
+async function prepareDatabases(ctx, run, deps) {
+	const { stack } = run;
+	const workspace = ctx.workspace;
+	const port = await deps.docker.port(run.ref, "postgres", 5432);
+	const statements = postgresStatements(stack.plan, workspace.name, stack.credential.seed);
+	if (statements.length > 0) {
+		ctx.logger.info("🗄️  Creating databases, roles and grants…");
+		await applyPostgres(deps.sql(port, stack.credential.master), statements);
+	}
+	const sources = {};
+	const manifest = await discover({
+		patterns: constructGlobs(workspace),
+		cwd: workspace.root,
+		sources
+	});
+	const env = envFor(stack.plan, {
+		ports: { [primaryPortKey("postgres")]: port },
+		project: workspace.name,
+		master: stack.credential.master,
+		...stack.credential.seed ? { seed: stack.credential.seed } : {}
+	});
+	const runs = await deps.migrate({
+		root: workspace.root,
+		manifest,
+		sources,
+		env
+	});
+	for (const { target, applied } of runs) if (applied.length > 0) ctx.logger.info(`🗄️  ${target.migrations}: applied ${applied.length}`);
+}
+/**
+* Each app's image: built from this checkout — every backend bundled first,
+* on the host, with this CLI — or pulled at the tag. Nothing live changes.
+*/
+async function buildCompose(ctx, run, deps) {
+	const { stack, ref } = run;
+	const apps = stack.apps.map((app) => app.name);
+	if (run.mode === "build") {
+		for (const app of stack.apps.filter((a) => a.kind === "rest-api")) {
+			ctx.signal.throwIfAborted();
+			ctx.logger.info(`\n📦 Bundling ${app.name}…`);
+			await deps.bundle(join(ctx.cwd, app.path), ctx);
+		}
+		ctx.logger.info("\n🐳 Building images…");
+		await deps.docker.build(ref, apps);
+	} else {
+		ctx.logger.info(`\n🐳 Pulling ${ctx.tag}…`);
+		await deps.docker.pull(ref, apps);
+	}
+	for (const app of stack.apps) {
+		const digest = await deps.docker.digest(app.ref);
+		run.images[app.name] = {
+			ref: app.ref,
+			tag: app.tag,
+			...digest ? { digest } : {}
+		};
+		ctx.emit({
+			type: "artifact.built",
+			app: app.name,
+			imageRef: app.ref,
+			...digest ? { digest } : {}
+		});
+		run.changes.push({
+			key: `image:${app.name}`,
+			resourceType: "image",
+			action: run.mode === "build" ? "build" : "reuse",
+			id: digest ?? app.ref
+		});
+	}
+}
+/**
+* The whole stack up — anything it no longer defines removed — and each
+* app's image recorded in the stage's state.
+*/
+async function releaseCompose(ctx, run, deps) {
+	const { stack, ref } = run;
+	ctx.logger.info("\n🚀 Starting the stack…");
+	await deps.docker.up(ref);
+	if (stack.local) await deps.docker.copyOut(ref, "caddy", "/data/caddy/pki/authorities/local/root.crt", caFile(run)).catch(() => {});
+	await recordImages(ctx, run);
+	for (const app of stack.apps) {
+		const image = run.images[app.name];
+		applied(ctx, run, {
+			key: `service:${app.name}`,
+			resourceType: "service",
+			action: "ensure",
+			id: `${stack.project}/${app.name}`,
+			via: run.previous[app.name] ? "recorded" : "created"
+		});
+		ctx.emit({
+			type: "app.deployed",
+			app: app.name,
+			applicationId: `${stack.project}/${app.name}`,
+			imageRef: image?.ref ?? app.ref,
+			url: app.url
+		});
+	}
+	ctx.logger.info(`\n✅ ${stack.project} is running:`);
+	for (const app of stack.apps) ctx.logger.info(`   ${app.name.padEnd(12)} ${app.url}`);
+	if (stack.local) ctx.logger.info(`\n🔐 Certificates are from Caddy's local CA: NODE_EXTRA_CA_CERTS=${join(stackDir(ctx.stage), "caddy-root.crt")}`);
+}
+/**
+* Each app's image in the stage's state — the same `images` a Dokploy deploy
+* records: the ref it runs, the tag it was released under, and the digest
+* the tag resolved to.
+*/
+async function recordImages(ctx, run) {
+	const journal = await DeployJournal.open(ctx.state, ctx.stage, () => createEmptyState(ctx.stage, "", ""));
+	for (const app of run.stack.apps) {
+		const image = run.images[app.name] ?? {
+			ref: app.ref,
+			tag: app.tag
+		};
+		recordRelease(journal.state, app.name, image);
+	}
+	journal.state.identity = ctx.identity.key;
+	await journal.save();
+}
+/**
+* Each app asked through Caddy, over HTTPS, the certificate verified: an API
+* at `/health`, a site at `/`. On the local stage the edge is this machine and
+* its certificates are Caddy's internal CA's, so the CA `release` copied out
+* is the one trusted and the request goes to 127.0.0.1.
+*/
+async function verifyCompose(ctx, run, deps) {
+	const { stack } = run;
+	const ca = stack.local ? await readFile(caFile(run), "utf-8").catch(() => void 0) : void 0;
+	ctx.logger.info("\n🩺 Checking each app through Caddy…");
+	const down = (await Promise.all(stack.apps.map((app) => checkApp(ctx, app, deps, {
+		ca,
+		local: stack.local
+	})))).filter((result) => !result.healthy).map(({ app, url, last }) => ({
+		app,
+		url,
+		last
+	}));
+	if (down.length > 0) throw new ComposeAppsUnhealthy(stack.project, down);
+}
+async function checkApp(ctx, app, deps, options) {
+	const url = `${app.url}${app.kind === "site" ? "/" : "/health"}`;
+	let last = "not asked";
+	for (let attempt = 1; attempt <= deps.healthAttempts; attempt++) {
+		ctx.signal.throwIfAborted();
+		let status;
+		try {
+			status = await deps.probe({
+				url,
+				...options.ca ? { ca: options.ca } : {},
+				...options.local ? { connectTo: "127.0.0.1" } : {},
+				timeoutMs: 1e4,
+				signal: ctx.signal
+			});
+			last = `HTTP ${status}`;
+		} catch (error) {
+			last = error instanceof Error ? error.message : String(error);
+		}
+		const healthy = status !== void 0 && isHealthy(status);
+		ctx.emit({
+			type: "health.checked",
+			app: app.name,
+			url,
+			healthy,
+			...status !== void 0 ? { status } : {},
+			attempt
+		});
+		if (healthy) {
+			ctx.logger.info(`   ✓ ${app.name.padEnd(12)} ${url} (${last})`);
+			return {
+				app: app.name,
+				url,
+				last,
+				healthy
+			};
+		}
+		if (attempt < deps.healthAttempts) await new Promise((resolve) => setTimeout(resolve, deps.healthIntervalMs));
+	}
+	ctx.logger.warn(`   ✗ ${app.name.padEnd(12)} ${url} (${last})`);
+	return {
+		app: app.name,
+		url,
+		last,
+		healthy: false
+	};
+}
+function composeResult(ctx, run) {
+	const apps = run.stack.apps.map((app) => {
+		const image = run.images[app.name];
+		return {
+			appName: app.name,
+			type: app.kind === "site" ? "web" : "backend",
+			success: !ctx.dryRun,
+			applicationId: `${run.stack.project}/${app.name}`,
+			imageRef: image?.ref ?? app.ref,
+			...image?.digest ? { digest: image.digest } : {},
+			url: app.url
+		};
+	});
+	return {
+		apps,
+		projectId: run.stack.project,
+		successCount: ctx.dryRun ? 0 : apps.length,
+		failedCount: 0,
+		stage: ctx.stage,
+		identity: ctx.identity.key,
+		tag: ctx.tag,
+		dryRun: ctx.dryRun,
+		environmentId: "",
+		skipped: [...ctx.skipped],
+		urls: Object.fromEntries(run.stack.apps.map((app) => [app.name, app.url])),
+		changes: run.changes
+	};
+}
+function caFile(run) {
+	return join(run.dir, "caddy-root.crt");
+}
+function applied(ctx, run, change) {
+	const { via, ...rest } = change;
+	run.changes.push(rest);
+	ctx.emit({
+		type: "resource.applied",
+		...rest,
+		via
+	});
+}
+/** Write the stack's files: owner-only, since the env files hold secrets. */
+async function writeStack(root, dir, stack) {
+	await mkdir(dir, {
+		recursive: true,
+		mode: 448
+	});
+	await chmod(dir, 448);
+	const files = [];
+	const write = async (path, content, mode = 420) => {
+		await mkdir(dirname(path), { recursive: true });
+		await writeFile(path, content, { mode });
+		await chmod(path, mode);
+		files.push(path);
+	};
+	await write(join(dir, "docker-compose.yml"), composeYaml(stack));
+	await write(join(dir, "Caddyfile"), stack.caddyfile);
+	for (const app of stack.apps) if (app.env) await write(join(dir, `${app.name}.env`), envFile(app.env), 384);
+	for (const [path, content] of Object.entries(stack.dockerfiles)) await write(join(root, path), content);
+	await ignoreStacks(root);
+	return files;
+}
+/** Make sure the build context leaves `.gkm/compose` out. */
+async function ignoreStacks(root) {
+	const path = join(root, ".dockerignore");
+	if (!existsSync(path)) {
+		await writeFile(path, generateDockerignore());
+		return;
+	}
+	const current = await readFile(path, "utf-8");
+	if (/^\/?\.gkm\/compose\/?$|^\/?\.gkm\/?$/m.test(current)) return;
+	await appendFile(path, `${current.endsWith("\n") ? "" : "\n"}\n# gkm compose's stacks: each app's env file holds its stage's secrets\n.gkm/compose\n`);
+}
+function composeYaml(stack) {
+	const stage = stack.local ? "" : ` --stage ${stack.stage}`;
+	return `# Generated by gkm compose from the construct manifest — do not edit.
+# The ${stack.stage} stage's APIs and sites behind one Caddy. Each backend
+# reads exactly the keys in its own env file beside this one.
+#
+#   gkm compose${stage}          start or update it
+#   gkm compose${stage} --down   stop it
+${stringify(stack.compose, {
+		lineWidth: 0,
+		aliasDuplicateObjects: false
+	})}`;
+}
+function printPlan(ctx, run) {
+	const { stack, mode, files } = run;
+	ctx.logger.info(`\n🧱 ${stack.project} — stage ${stack.stage}`);
+	for (const app of stack.apps) ctx.logger.info(`   ${app.name.padEnd(12)} ${app.url.padEnd(40)} ${mode} ${app.ref}`);
+	if (stack.infra.length > 0) ctx.logger.info(`   infrastructure: ${stack.infra.join(", ")}`);
+	ctx.logger.info(`\n📝 Wrote ${files.length} file(s) under ${stackDir(stack.stage)}/`);
+}
+//#endregion
+//#region src/target/compose/index.ts
+/**
+* The built-in `compose` target: a stage as one Docker Compose stack behind
+* Caddy, on the machine that runs the deploy.
+*
+* ```bash
+* gkm deploy --target compose --stage production --tag v1.4.0  # what CI pushed
+* gkm deploy --target compose --stage production               # built from here
+* gkm deploy --target compose --stage development              # the local stage
+* ```
+*
+* - `validate`: the stack (`composeStack`, pure) and, for a tag, every image
+*   looked up in the registry — `ImageTagNotFound` before anything changes
+* - `plan`: the stack's files and what a run would create or reuse
+* - `provision`: generated secrets kept, files written, infrastructure up,
+*   databases, roles, grants and migrations
+* - `build`: each backend bundled on the host and every image built — or, for
+*   a tag, pulled
+* - `release`: `up --wait --remove-orphans`, and each app's image, tag and
+*   digest in the stage's state
+* - `verify`: each app asked through Caddy over HTTPS
+*
+* `gkm compose` is this target with a few more switches (`--build`, `--pull`,
+* `--down`), run through the same `deploy()`.
+*/
+var compose_exports = /* @__PURE__ */ __exportAll({ composeTarget: () => composeTarget });
+/** The compose target, with its Docker, bundler and probe as given. */
+function composeTarget(options = {}) {
+	const { mode, report, ...given } = options;
+	const deps = {
+		...defaultDeps,
+		...given
+	};
+	return defineTarget({
+		name: "compose",
+		runtime: "server",
+		capabilities: {
+			rollback: false,
+			migrations: "target",
+			images: true,
+			localStage: true
+		},
+		credentials: [],
+		tag: ({ cwd }) => deps.revision(cwd),
+		validate: (ctx) => validateCompose(ctx, deps, mode),
+		plan: (ctx, run) => planCompose(ctx, run),
+		provision: (ctx, run) => provisionCompose(ctx, run, deps),
+		build: (ctx, run) => buildCompose(ctx, run, deps),
+		release: (ctx, run) => releaseCompose(ctx, run, deps),
+		verify: (ctx, run) => verifyCompose(ctx, run, deps),
+		result: (ctx, run) => {
+			report?.(run);
+			return composeResult(ctx, run);
+		}
+	});
+}
+//#endregion
+export { dockerCompose as a, stackDir as i, compose_exports as n, composeProject as r, composeTarget as t };
+
+//# sourceMappingURL=compose-CNQL8BnO.mjs.map