@geekmidas/cli 10.0.0-alpha.65 → 10.0.0-alpha.67

package/dist/{compose-DprE3ASm.mjs → compose-BjToENzG.mjs}

@@ -1,21 +1,15 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { c as runOutput, s as run, t as LocalSandbox } from "./local-CWR4Y_kW.mjs";
-import { r as discover } from "./discover-LMrqsWSU.mjs";
-import { i as activeSandbox } from "./sandbox-Dm247NGx.mjs";
+import { a as runOutput, i as run } from "./run-BJLIerMM.mjs";
+import { r as discover } from "./discover-BFoJWKGD.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
 import { t as defineTarget } from "./define-DR8xGYfL.mjs";
-import { t as initStageSecrets } from "./storage-BzaUxmqe.mjs";
-import { f as imageRef } from "./store-CLiHnqOY.mjs";
-import { $ as portKeys, B as networkEnv, C as isMainFrontendApp, D as constructGlobs, F as postgresStatements, G as hostFor, H as localRolePassword, L as composeFor, N as applyPostgres, R as pgClient, S as validateImageRef, U as planFor, V as envFor, X as DEFAULT_IMAGES, b as generateDockerignore, et as primaryPortKey, f as DeployJournal, g as appPackageName, p as withGeneratedSecrets, s as setDeployedImage, t as createEmptyState, v as siteDockerfile, w as resolveHost, x as generateSlimDockerfile, y as detectPackageManager, z as appEnvKeys } from "./state-B8YwmUZU.mjs";
+import { B as pgClient, C as resolveHost, Et as imageRef, F as applyPostgres, G as planFor, H as networkEnv, J as composeBuildPaths, L as postgresStatements, Q as findBuildRoot, S as isMainFrontendApp, U as envFor, V as appEnvKeys, W as localRolePassword, X as TURBO_VERSION, Y as imageLayout, a as recordRelease, b as ensureDockerignore, g as credentialsFileContent, h as credentialsBuildArg, jt as initStageSecrets, k as constructGlobs, m as withGeneratedSecrets, ot as portKeys, p as DeployJournal, q as hostFor, rt as DEFAULT_IMAGES, st as primaryPortKey, t as createEmptyState, v as appDockerfile, w as encryptSecrets, x as validateImageRef, z as composeFor } from "./state-DkUStoqJ.mjs";
 import { n as DEFAULT_CACHE, r as DEFAULT_EVENTS } from "./fakes-C9RiT6XG.mjs";
-import { createRequire } from "node:module";
-import { dirname, extname, join } from "node:path";
-import { existsSync } from "node:fs";
-import { appendFile, chmod, mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
-import { DATABASE_FOLDERS, MIGRATIONS_ROOT, canonicalId, migrationTargets, provideKey, provisionOrder, publicEnvFor } from "@geekmidas/manifest";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { u as migrateDatabases } from "./databases-hUHTuwhx.mjs";
+import { dirname, join } from "node:path";
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { provideKey, provisionOrder, publicEnvFor } from "@geekmidas/manifest";
 import { spawn } from "node:child_process";
-import pg from "pg";
 import { stringify } from "yaml";
 import { request } from "node:https";
 //#region src/compose/docker.ts
@@ -536,6 +530,7 @@ function composeStack(input) {
 		};
 		for (const [key, value] of Object.entries(app.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(app.name, key);
 	}
+	const layout = input.layout ?? defaultLayout(workspace.root);
 	const compose = stackFile({
 		project,
 		plan,
@@ -543,7 +538,10 @@ function composeStack(input) {
 		apps,
 		master: credential.master,
 		https,
-		http
+		http,
+		composeDir: join(workspace.root, stackDir(stage)),
+		buildRoot: layout.buildRoot,
+		workspaceRoot: workspace.root
 	});
 	const caddyfile = edgeCaddyfile(apps.map((app) => ({
 		host: app.host,
@@ -552,18 +550,10 @@ function composeStack(input) {
 	const dockerfiles = {};
 	for (const app of apps) {
 		if (!app.build) continue;
-		dockerfiles[app.build.dockerfile] = app.kind === "site" ? siteDockerfile(app.name, workspace.apps[app.name], {
-			turboPackage: input.packages?.[app.name] ?? app.name,
-			packageManager: input.packageManager ?? "pnpm",
+		dockerfiles[app.build.dockerfile] = appDockerfile(app.name, workspace.apps[app.name], {
+			layout,
+			workspaceRoot: workspace.root,
 			manifest
-		}) : generateSlimDockerfile({
-			imageName: app.name,
-			baseImage: "node:22-alpine",
-			port: app.port,
-			healthCheckPath: "/health",
-			prebuilt: true,
-			packageManager: input.packageManager ?? "pnpm",
-			bundle: `${app.path}/.gkm/server/dist/server.mjs`
 		});
 	}
 	return {
@@ -664,8 +654,12 @@ function stackFile(options) {
 	for (const app of apps) services[app.name] = {
 		image: app.ref,
 		...app.build ? { build: {
-			context: "../../..",
-			dockerfile: app.build.dockerfile,
+			...composeBuildPaths({
+				composeDir: options.composeDir,
+				buildRoot: options.buildRoot,
+				workspaceRoot: options.workspaceRoot,
+				dockerfile: app.build.dockerfile
+			}),
 			...app.build.args ? { args: app.build.args } : {}
 		} } : {},
 		restart: "unless-stopped",
@@ -705,477 +699,83 @@ function stackFile(options) {
 		volumes
 	};
 }
-/** Render an app's env file: one `KEY=value` per line, read raw by compose. */
-function envFile(env) {
-	return `${Object.entries(env).sort(([a], [b]) => a.localeCompare(b)).map(([key, value]) => `${key}=${value}`).join("\n")}\n`;
-}
-//#endregion
-//#region src/migrate/provider.ts
-/**
-* One construct's migrations and seeds, read from its folders.
-*
-* Two kinds of file, told apart by extension rather than by configuration: a
-* script exports `up` (and may export `down`) — or `seed(db, { stage })`, in
-* `seeds/` — and a
-* `.sql` file is run whole. The second is what makes a folder independent of
-* the client the app uses — Better Auth's schema is SQL whatever the
-* application queries with.
-*/
-const SCRIPTS = /* @__PURE__ */ new Set([
-	".ts",
-	".mts",
-	".js",
-	".mjs"
-]);
-/** Two files in one folder that would be one migration. */
-var DuplicateMigration = class extends Error {
-	folder;
-	migration;
-	constructor(folder, migration) {
-		super(`${folder} has two migrations named '${migration}' — a script and a .sql file with the same name. A migration is recorded by name, so only one of them could ever run; rename or remove the other.`);
-		this.folder = folder;
-		this.migration = migration;
-		this.name = "DuplicateMigration";
-	}
-};
-/** A script in a migrations folder that exports no `up`. */
-var MigrationHasNoUp = class extends Error {
-	file;
-	constructor(file) {
-		super(`${file} is in a migrations folder but exports no \`up\` function. Export \`async function up(db: Kysely<unknown>)\`, or move the file out of the folder if it is not a migration.`);
-		this.file = file;
-		this.name = "MigrationHasNoUp";
-	}
-};
-/** A script in a seeds folder that exports no `seed`. */
-var SeedHasNoSeed = class extends Error {
-	file;
-	constructor(file) {
-		super(`${file} is in a seeds folder but exports no \`seed\` function. Export \`async function seed(db, { stage })\`, or move the file out of the folder if it is not a seed.`);
-		this.file = file;
-		this.name = "SeedHasNoSeed";
-	}
-};
-/**
-* The migration files in a folder, by name, without reading them.
-*
-* Also what `gkm dev` compares against a construct's history to report what
-* is pending, which is why it is separate from loading them.
-*/
-async function migrationFiles(folder) {
-	const entries = await readdir(folder, { withFileTypes: true }).catch((error) => {
-		if (error.code === "ENOENT") return [];
-		throw error;
-	});
-	const files = /* @__PURE__ */ new Map();
-	for (const entry of entries) {
-		if (!entry.isFile() || !isMigration(entry.name)) continue;
-		const name = entry.name.slice(0, -extname(entry.name).length);
-		if (files.has(name)) throw new DuplicateMigration(folder, name);
-		files.set(name, join(folder, entry.name));
-	}
-	return files;
-}
-/** A Kysely provider over one construct's folder. */
-function folderProvider(folder, raw) {
-	return { async getMigrations() {
-		const migrations = {};
-		for (const [name, file] of await migrationFiles(folder)) migrations[name] = extname(file) === ".sql" ? await sqlMigration(file, raw) : await scriptMigration(file);
-		return migrations;
-	} };
-}
-/**
-* The seeds in a folder, loaded, in name order.
-*
-* Every one runs on every pass — there is no history to consult — so the order
-* is the only thing between two seeds where one reads what another writes.
-* Name them to sort that way.
-*/
-async function loadSeeds(folder, raw) {
-	const files = [...await migrationFiles(folder)].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
-	const seeds = [];
-	for (const [name, file] of files) seeds.push({
-		name,
-		run: extname(file) === ".sql" ? (await sqlMigration(file, raw)).up : await scriptSeed(file)
-	});
-	return seeds;
-}
 /**
-* A seed script, imported as it is on disk now.
-*
-* Keyed by its modification time: a seed is run again after it is edited, and
-* a process that has imported it once would otherwise run the old one.
+* A build without a layout: the workspace is the build root, with pnpm.
+* What a caller that never looked at the filesystem gets.
 */
-async function scriptSeed(file) {
-	const url = pathToFileURL(file);
-	url.searchParams.set("mtime", String((await stat(file)).mtimeMs));
-	const module = await import(url.href);
-	if (typeof module.seed !== "function") throw new SeedHasNoSeed(file);
-	return module.seed;
-}
-function isMigration(file) {
-	if (file.endsWith(".d.ts")) return false;
-	if (/\.(spec|test)\.[cm]?[jt]s$/.test(file)) return false;
-	const extension = extname(file);
-	return extension === ".sql" || SCRIPTS.has(extension);
-}
-async function scriptMigration(file) {
-	const module = await import(pathToFileURL(file).href);
-	if (typeof module.up !== "function") throw new MigrationHasNoUp(file);
+function defaultLayout(root) {
 	return {
-		up: module.up,
-		...typeof module.down === "function" ? { down: module.down } : {}
+		buildRoot: root,
+		gkmRoot: ".",
+		tools: {
+			packageManager: "pnpm",
+			turboVersion: TURBO_VERSION,
+			monorepo: true
+		},
+		gkmPaths: ["gkm.config.*"]
 	};
 }
-/**
-* A `.sql` file, run whole.
-*
-* One query rather than split on `;`: with no parameters, Postgres takes
-* several statements in one message, and splitting by hand breaks on the first
-* `;` inside a string or a function body. There is no `down` — a generated
-* schema is rolled back by a migration that says how, not by guessing.
-*/
-async function sqlMigration(file, raw) {
-	const statements = await readFile(file, "utf-8");
-	return { up: async (db) => {
-		await raw.raw(statements).execute(db);
-	} };
+/** The id the stack's compose file names an app's build credentials by. */
+function credentialsSecret(app) {
+	return `${app}_credentials`;
 }
-//#endregion
-//#region src/migrate/databases.ts
-/**
-* Bring each construct's schema up to its migrations folder.
-*
-* Which constructs, in what order, from which folder, is `migrationTargets`'
-* answer and nobody else's. What is decided here is only how one target is
-* run: as its owner, in its own schema, with a history of its own.
-*/
-/** A folder under `db/` that names no construct. */
-var UnknownMigrationFolder = class extends Error {
-	folder;
-	known;
-	constructor(folder, known) {
-		super(`${folder} names no database construct, so its migrations would never run. ${known.length > 0 ? `The folders that do: ${known.join(", ")}.` : "This project declares no database."} Rename the folder after the construct it belongs to.`);
-		this.folder = folder;
-		this.known = known;
-		this.name = "UnknownMigrationFolder";
-	}
-};
-/** A construct was asked for by a name that takes no migrations. */
-var NoSuchMigrationTarget = class extends Error {
-	construct;
-	known;
-	constructor(construct, known) {
-		super(`'${construct}' is not a database construct. ` + (known.length > 0 ? `The ones with migrations: ${known.join(", ")}.` : "This project declares no database."));
-		this.construct = construct;
-		this.known = known;
-		this.name = "NoSuchMigrationTarget";
-	}
-};
-/**
-* A migration left directly in a construct's folder, where nothing reads it.
-*
-* Migrations moved into `migrations/` so seeds could sit beside them. A file
-* still at the old level would otherwise never run, and nothing would say so.
-*/
-var MigrationsOutsideFolder = class extends Error {
-	folder;
-	files;
-	constructor(folder, files) {
-		super(`${folder} has ${files.join(", ")} directly inside it, where nothing runs them. Migrations live in ${folder}/migrations/ and seeds in ${folder}/seeds/ — move ${files.length === 1 ? "it" : "them"} there.`);
-		this.folder = folder;
-		this.files = files;
-		this.name = "MigrationsOutsideFolder";
-	}
-};
-/** A folder inside a construct's folder that is neither `migrations` nor `seeds`. */
-var UnknownDatabaseFolder = class extends Error {
-	folder;
-	constructor(folder) {
-		super(`${folder} is neither migrations/ nor seeds/, so nothing in it would ever run. A construct's folder holds those two; rename or remove it.`);
-		this.folder = folder;
-		this.name = "UnknownDatabaseFolder";
-	}
-};
-/** A seed failed; its own writes are rolled back, the ones before it stay. */
-var SeedFailed = class extends Error {
-	construct;
-	seed;
-	cause;
-	constructor(construct, seed, cause) {
-		super(`${construct}: seed '${seed}' failed — ${cause instanceof Error ? cause.message : String(cause)}. Its writes were rolled back; fix it and run it again.`);
-		this.construct = construct;
-		this.seed = seed;
-		this.cause = cause;
-		this.name = "SeedFailed";
-	}
-};
-/** A construct with roles has no owner URL to migrate with. */
-var NoOwnerCredential = class extends Error {
-	construct;
-	key;
-	constructor(construct, key) {
-		super(`${construct} has no ${key} to migrate with. Migrations run as the owner role — the runtime one cannot create a table — and nothing resolved its URL. Is the stage reconciled?`);
-		this.construct = construct;
-		this.key = key;
-		this.name = "NoOwnerCredential";
-	}
-};
-/** A migration failed; the ones before it in the run stay applied. */
-var MigrationFailed = class extends Error {
-	construct;
-	migration;
-	cause;
-	constructor(construct, migration, cause) {
-		super(`${construct}: migration ${migration ? `'${migration}' ` : ""}failed — ${cause instanceof Error ? cause.message : String(cause)}`);
-		this.construct = construct;
-		this.migration = migration;
-		this.cause = cause;
-		this.name = "MigrationFailed";
-	}
-};
-/** The project's Kysely could not be found from where a database is declared. */
-var KyselyNotFound = class extends Error {
-	from;
-	constructor(from) {
-		super(`Could not resolve 'kysely' from ${from}. Migrations run with the project's own Kysely — install it where the database is declared.`);
-		this.from = from;
-		this.name = "KyselyNotFound";
-	}
-};
-/** Apply every pending migration, construct by construct, parents first. */
-async function migrateDatabases(options) {
-	const runs = [];
-	for (const target of await targetsFor(options)) {
-		if ((await migrationFiles(join(options.root, target.migrations))).size === 0) {
-			runs.push({
-				target,
-				applied: []
-			});
-			continue;
-		}
-		const applied = await withMigrator(options, target, async (migrator) => {
-			const { error, results = [] } = await migrator.migrateToLatest();
-			if (error) {
-				const failed = results.find((result) => result.status === "Error");
-				throw new MigrationFailed(target.id, failed?.migrationName, error);
-			}
-			return results.filter((result) => result.status === "Success").map((result) => result.migrationName);
-		});
-		runs.push({
-			target,
-			applied
-		});
-	}
-	return runs;
+/** The file beside the compose file an app's build credentials are read from. */
+function credentialsFile(app) {
+	return `${app}.credentials`;
 }
 /**
-* Run every construct's seeds, parents first — each one, every time, on every
-* stage, production included. Each is handed the stage, so a seed decides
-* what belongs where.
+* The stack with each backend's image built with its encrypted credentials:
+* a BuildKit secret per app — the file `credentialsFile` names, mounted as
+* `gkm_credentials` — and the hash naming them as a build arg, so a new key
+* rebuilds the layer that embeds them. Each backend's env file gains the
+* `GKM_MASTER_KEY` that decrypts them, the way a Dokploy deploy injects it.
 *
-* Seeds are reference data kept up to date by being run again, so there is no
-* history: a seed is an upsert, and a changed one is applied by the next run.
-* Each runs in its own transaction, as the construct's owner, so a failure
-* leaves nothing half-written. Assumes the schema is migrated —
-* {@link migrateAndSeed} is what makes that true.
+* Pure: the caller encrypted them.
 */
-async function seedDatabases(options) {
-	const runs = [];
-	for (const target of await targetsFor(options)) {
-		const folder = join(options.root, target.seeds);
-		if ((await migrationFiles(folder)).size === 0) {
-			runs.push({
-				target,
-				seeded: []
-			});
-			continue;
-		}
-		const seeded = await withOwner(options, target, async (db, kysely) => {
-			const names = [];
-			for (const seed of await loadSeeds(folder, kysely.sql)) {
-				try {
-					await db.transaction().execute((trx) => seed.run(trx, { stage: options.stage }));
-				} catch (error) {
-					throw new SeedFailed(target.id, seed.name, error);
-				}
-				names.push(seed.name);
+function withBuildCredentials(stack, credentials) {
+	const services = { ...stack.compose.services };
+	const secrets = { ...stack.compose.secrets };
+	const apps = stack.apps.map((app) => {
+		const own = credentials[app.name];
+		const service = services[app.name];
+		if (!own || !service?.build) return app;
+		const [key, value] = own.buildArg.split("=");
+		services[app.name] = {
+			...service,
+			build: {
+				...service.build,
+				args: {
+					...service.build.args,
+					[key]: value
+				},
+				secrets: [{
+					source: credentialsSecret(app.name),
+					target: "gkm_credentials"
+				}]
 			}
-			return names;
-		});
-		runs.push({
-			target,
-			seeded
-		});
-	}
-	return runs;
-}
-/**
-* Migrate, then seed: a seed only ever runs against the schema it was written
-* for.
-*
-* With `only`, the constructs it lives in are migrated too — a tenant's seed
-* cannot run before the database that owns its schema exists — and only it is
-* seeded.
-*/
-async function migrateAndSeed(options) {
-	const migrations = [];
-	for (const target of await withParents(options)) migrations.push(...await migrateDatabases({
-		...options,
-		only: target.id
-	}));
+		};
+		secrets[credentialsSecret(app.name)] = { file: `./${credentialsFile(app.name)}` };
+		return {
+			...app,
+			env: {
+				...app.env,
+				GKM_MASTER_KEY: own.masterKey
+			}
+		};
+	});
 	return {
-		migrations,
-		seeds: await seedDatabases(options)
-	};
-}
-/** The targets `only` names, after the ones it lives in; all without it. */
-async function withParents(options) {
-	const chosen = await targetsFor(options);
-	if (!options.only) return chosen;
-	const all = migrationTargets(options.manifest);
-	const ids = /* @__PURE__ */ new Set();
-	for (const target of chosen) {
-		let current = target;
-		while (current) {
-			ids.add(current.id);
-			const parent = current.of;
-			current = parent ? all.find((t) => t.id === parent) : void 0;
+		...stack,
+		apps,
+		compose: {
+			...stack.compose,
+			services,
+			...Object.keys(secrets).length ? { secrets } : {}
 		}
-	}
-	return all.filter((target) => ids.has(target.id));
-}
-/**
-* What each construct's folder has that its history does not — without
-* applying any of it. What `gkm dev` reports.
-*/
-async function pendingMigrations(options) {
-	const found = [];
-	for (const target of await targetsFor(options)) {
-		if ((await migrationFiles(join(options.root, target.migrations))).size === 0) continue;
-		const pending = await withMigrator(options, target, async (migrator) => (await migrator.getMigrations()).filter((migration) => migration.executedAt === void 0).map((migration) => migration.name));
-		if (pending.length > 0) found.push({
-			target,
-			pending
-		});
-	}
-	return found;
-}
-/**
-* The targets this run covers, with every folder under `db/` accounted for.
-*
-* A folder that names no construct is an error rather than something to skip:
-* a typo in its name is otherwise a migration that silently never runs.
-*/
-async function targetsFor(options) {
-	const targets = migrationTargets(options.manifest);
-	const folders = targets.map((target) => target.folder);
-	for (const folder of await foldersIn(join(options.root, MIGRATIONS_ROOT))) {
-		const relative = `${MIGRATIONS_ROOT}/${folder}`;
-		if (!folders.includes(relative)) throw new UnknownMigrationFolder(relative, folders);
-		await checkLayout(options.root, relative);
-	}
-	if (!options.only) return targets;
-	const id = canonicalId(options.only);
-	const chosen = targets.filter((target) => target.id === id);
-	if (chosen.length === 0) throw new NoSuchMigrationTarget(options.only, targets.map((target) => target.id));
-	return chosen;
-}
-/**
-* A construct's folder holds `migrations/` and `seeds/`, and nothing else —
-* anything beside them is a file or folder nothing would ever run.
-*/
-async function checkLayout(root, folder) {
-	const entries = await readdir(join(root, folder), { withFileTypes: true });
-	const loose = entries.filter((entry) => entry.isFile() && !entry.name.startsWith(".")).map((entry) => entry.name);
-	if (loose.length > 0) throw new MigrationsOutsideFolder(folder, loose);
-	for (const entry of entries) if (entry.isDirectory() && !DATABASE_FOLDERS.includes(entry.name)) throw new UnknownDatabaseFolder(`${folder}/${entry.name}`);
-}
-async function foldersIn(dir) {
-	return (await readdir(dir, { withFileTypes: true }).catch((error) => {
-		if (error.code === "ENOENT") return [];
-		throw error;
-	})).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
-}
-/**
-* A migrator for one target, connected as its owner.
-*
-* No `migrationTableSchema`: the owner role's `search_path` is pinned to the
-* construct's schema, so the history lands there — `app.kysely_migration` for
-* the database, `auth_database.kysely_migration` for its tenant — and two
-* constructs in one Postgres never share one.
-*
-* Unordered migrations are allowed. Files are timestamped, so a branch merged
-* after another's migration ran carries an older one; refusing it would make
-* every such merge a manual repair.
-*/
-async function withMigrator(options, target, run) {
-	return withOwner(options, target, (db, { Migrator, sql }) => run(new Migrator({
-		db,
-		provider: folderProvider(join(options.root, target.migrations), sql),
-		allowUnorderedMigrations: true
-	})));
-}
-/**
-* One target's database, connected as its owner and closed afterwards — what
-* migrations and seeds both run as.
-*/
-async function withOwner(options, target, run) {
-	const kysely = await kyselyFrom(options.sources?.[target.id]?.file ?? (target.of ? options.sources?.[target.of]?.file : void 0) ?? join(options.root, "package.json"));
-	const db = new kysely.Kysely({ dialect: new kysely.PostgresDialect({ pool: new pg.Pool(poolConfig(ownerUrl(options, target))) }) });
-	try {
-		return await run(db, kysely);
-	} finally {
-		await db.destroy();
-	}
-}
-/**
-* The owner's URL, with no fallback to the runtime one.
-*
-* The runtime role can create nothing, so falling back would only move the
-* failure to the first `CREATE TABLE` and make it read like a permissions
-* bug. The one exception is a database declared `roles: false`, where there is
-* no owner — both URLs are the master credential by design.
-*/
-function ownerUrl(options, target) {
-	const key = provideKey(target.id, "ownerUrl");
-	const owner = options.env[key];
-	if (owner) return owner;
-	const database = options.manifest[target.of ?? target.id];
-	if (database?.kind === "database" && database.roles === false) {
-		const url = options.env[provideKey(target.id, "url")];
-		if (url) return url;
-	}
-	throw new NoOwnerCredential(target.id, key);
-}
-/**
-* Pool settings for a URL, with `?search_path=` as the startup option Postgres
-* reads. Only a `roles: false` URL carries it — a role pins its own.
-*/
-function poolConfig(url) {
-	const parsed = new URL(url);
-	const searchPath = parsed.searchParams.get("search_path");
-	if (!searchPath) return { connectionString: url };
-	parsed.searchParams.delete("search_path");
-	return {
-		connectionString: parsed.toString(),
-		options: `-c search_path=${searchPath}`
 	};
 }
-/** Kysely as the project resolves it from `from`. */
-async function kyselyFrom(from) {
-	const require = createRequire(from);
-	try {
-		const [main, migration] = await Promise.all([import(pathToFileURL(require.resolve("kysely")).href), import(pathToFileURL(require.resolve("kysely/migration")).href)]);
-		return {
-			Kysely: main.Kysely,
-			PostgresDialect: main.PostgresDialect,
-			sql: main.sql,
-			Migrator: migration.Migrator
-		};
-	} catch {
-		throw new KyselyNotFound(from);
-	}
+/** Render an app's env file: one `KEY=value` per line, read raw by compose. */
+function envFile(env) {
+	return `${Object.entries(env).sort(([a], [b]) => a.localeCompare(b)).map(([key, value]) => `${key}=${value}`).join("\n")}\n`;
 }
 //#endregion
 //#region src/target/compose/health.ts
@@ -1260,7 +860,11 @@ var ComposeAppsUnhealthy = class extends Error {
 * - What was started answers (`verify`): each app is asked through Caddy,
 *   over HTTPS, with the certificate verified.
 *
-* Docker, the registry, the bundler, Postgres and the health probe are
+* Every image is built inside Docker from a pruned slice of the build root —
+* the same Dockerfiles `gkm docker` writes — so nothing is built on this
+* machine before `docker compose build`.
+*
+* Docker, the registry, Postgres and the health probe are
 * injected, so the rules are asserted without a daemon; the defaults are the
 * real ones.
 */
@@ -1284,28 +888,6 @@ var NoGitRevision = class extends Error {
 		this.name = "NoGitRevision";
 	}
 };
-/** A backend's production bundle did not build. */
-var BundleFailed = class extends Error {
-	app;
-	exitCode;
-	stderr;
-	constructor(app, exitCode, stderr) {
-		super(`Bundling '${app}' for production failed (exit code ${exitCode}).${stderr.trim() ? `\n${stderr.trim().slice(-4e3)}` : ""}\nRun \`gkm build --provider server --production\` in the app's directory to see it again.`);
-		this.app = app;
-		this.exitCode = exitCode;
-		this.stderr = stderr;
-		this.name = "BundleFailed";
-	}
-};
-/** The CLI's own entry, which the bundle step runs, is not where it should be. */
-var CliEntryNotFound = class extends Error {
-	from;
-	constructor(from) {
-		super(`Could not find bin/gkm.mjs above ${from}, which bundling a backend runs. Reinstall @geekmidas/cli.`);
-		this.from = from;
-		this.name = "CliEntryNotFound";
-	}
-};
 /** The commit HEAD is at, short — and `-dirty` when the tree has changes. */
 async function gitRevision(root) {
 	let sha;
@@ -1335,46 +917,12 @@ function edgePorts(env = process.env) {
 		http: read(EDGE_PORT_ENV.http, 80)
 	};
 }
-/** `bin/gkm.mjs` of the CLI that is running. */
-function cliEntry() {
-	const from = dirname(fileURLToPath(import.meta.url));
-	for (let dir = from; dirname(dir) !== dir; dir = dirname(dir)) {
-		const entry = join(dir, "bin", "gkm.mjs");
-		if (existsSync(entry)) return entry;
-	}
-	throw new CliEntryNotFound(from);
-}
-/** A cold production bundle is seconds; a hung one must not hold the lock. */
-const BUNDLE_TIMEOUT_MS = 6e5;
-/**
-* Bundle a backend with the gkm that is running — the same build a deploy
-* makes, so the image holds one file and no dependencies — in the run's
-* sandbox, because the build imports the project's code.
-*/
-async function bundleInSandbox(appRoot, ctx) {
-	const sandbox = activeSandbox() ?? new LocalSandbox({ root: ctx.cwd });
-	const result = await sandbox.exec("node", [
-		cliEntry(),
-		"build",
-		"--provider",
-		"server",
-		"--production"
-	], {
-		cwd: appRoot,
-		env: sandbox.env,
-		timeoutMs: BUNDLE_TIMEOUT_MS,
-		output: ctx.childOutput,
-		signal: ctx.signal
-	});
-	if (result.exitCode !== 0) throw new BundleFailed(appRoot, result.exitCode, result.stderr);
-}
 /**
 * The real ones. Each app is asked for three minutes before it counts as
 * down: a deployed stage's first ACME certificate can take that long.
 */
 const defaultDeps = {
 	docker: dockerCompose,
-	bundle: bundleInSandbox,
 	revision: gitRevision,
 	sql: pgClient,
 	migrate: migrateDatabases,
@@ -1399,7 +947,9 @@ async function validateCompose(ctx, deps, forced) {
 		runnables
 	});
 	const { secrets, generated } = await stageSecrets(ctx, manifest);
-	const stack = composeStack({
+	const masterKeys = {};
+	const layout = mode === "build" ? imageLayout(workspace) : void 0;
+	const composed = composeStack({
 		workspace,
 		manifest,
 		runnables,
@@ -1412,12 +962,36 @@ async function validateCompose(ctx, deps, forced) {
 		},
 		secrets,
 		ports: edgePorts(deps.env),
-		packageManager: detectPackageManager(root),
-		packages: Object.fromEntries(Object.entries(workspace.apps).map(([name, app]) => [name, appPackageName(root, name, app.path)]))
+		...layout ? { layout } : {}
 	});
+	const credentials = {};
+	if (mode === "build") for (const app of composed.apps) {
+		if (app.kind !== "rest-api" || !app.env || !app.build) continue;
+		const { encrypted, iv, masterKey } = encryptSecrets(app.env);
+		credentials[app.name] = {
+			encrypted,
+			iv
+		};
+		ctx.secrets.mask(masterKey);
+		masterKeys[app.name] = {
+			masterKey,
+			buildArg: credentialsBuildArg({
+				encrypted,
+				iv
+			})
+		};
+	}
+	const stack = withBuildCredentials(composed, masterKeys);
 	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, stack.apps);
 	const dir = join(root, stackDir(stage));
-	const previous = (await ctx.state.read(stage))?.state.images ?? {};
+	const previous = Object.fromEntries(Object.entries((await ctx.state.read(stage))?.state.releases ?? {}).map(([name, releases]) => {
+		const { ref, tag, digest } = releases.current;
+		return [name, {
+			ref,
+			...tag ? { tag } : {},
+			...digest ? { digest } : {}
+		}];
+	}));
 	return {
 		mode,
 		stack,
@@ -1433,6 +1007,7 @@ async function validateCompose(ctx, deps, forced) {
 		generated,
 		previous,
 		files: [],
+		credentials,
 		images: {},
 		changes: []
 	};
@@ -1464,7 +1039,7 @@ async function stageSecrets(ctx, manifest) {
 */
 async function planCompose(ctx, run) {
 	if (run.generated.length > 0) ctx.logger.info(`🔑 "${ctx.stage}" has no ${run.generated.join(", ")} yet; this dry run used values it did not keep.`);
-	run.files = await writeStack(ctx.cwd, run.dir, run.stack);
+	run.files = await writeStack(ctx.cwd, run.dir, run.stack, run.credentials);
 	printPlan(ctx, run);
 	const planned = (change) => {
 		run.changes.push(change);
@@ -1508,7 +1083,7 @@ async function provisionCompose(ctx, run, deps) {
 		await ctx.secrets.write(run.secrets);
 		ctx.logger.info(`🔑 Generated for "${ctx.stage}" (${ctx.secrets.store}): ${run.generated.join(", ")}`);
 	}
-	run.files = await writeStack(ctx.cwd, run.dir, stack);
+	run.files = await writeStack(ctx.cwd, run.dir, stack, run.credentials);
 	printPlan(ctx, run);
 	if (stack.infra.length > 0) {
 		ctx.logger.info(`\n🗄️  Starting ${stack.infra.join(", ")}…`);
@@ -1554,18 +1129,14 @@ async function prepareDatabases(ctx, run, deps) {
 	for (const { target, applied } of runs) if (applied.length > 0) ctx.logger.info(`🗄️  ${target.migrations}: applied ${applied.length}`);
 }
 /**
-* Each app's image: built from this checkout — every backend bundled first,
-* on the host, with this CLI — or pulled at the tag. Nothing live changes.
+* Each app's image: built from this checkout — inside Docker, every one of
+* them, from a pruned slice of the build root — or pulled at the tag. Nothing
+* live changes.
 */
 async function buildCompose(ctx, run, deps) {
 	const { stack, ref } = run;
 	const apps = stack.apps.map((app) => app.name);
 	if (run.mode === "build") {
-		for (const app of stack.apps.filter((a) => a.kind === "rest-api")) {
-			ctx.signal.throwIfAborted();
-			ctx.logger.info(`\n📦 Bundling ${app.name}…`);
-			await deps.bundle(join(ctx.cwd, app.path), ctx);
-		}
 		ctx.logger.info("\n🐳 Building images…");
 		await deps.docker.build(ref, apps);
 	} else {
@@ -1636,7 +1207,7 @@ async function recordImages(ctx, run) {
 			ref: app.ref,
 			tag: app.tag
 		};
-		setDeployedImage(journal.state, app.name, image);
+		recordRelease(journal.state, app.name, image);
 	}
 	journal.state.identity = ctx.identity.key;
 	await journal.save();
@@ -1748,7 +1319,7 @@ function applied(ctx, run, change) {
 	});
 }
 /** Write the stack's files: owner-only, since the env files hold secrets. */
-async function writeStack(root, dir, stack) {
+async function writeStack(root, dir, stack, credentials = {}) {
 	await mkdir(dir, {
 		recursive: true,
 		mode: 448
@@ -1764,21 +1335,11 @@ async function writeStack(root, dir, stack) {
 	await write(join(dir, "docker-compose.yml"), composeYaml(stack));
 	await write(join(dir, "Caddyfile"), stack.caddyfile);
 	for (const app of stack.apps) if (app.env) await write(join(dir, `${app.name}.env`), envFile(app.env), 384);
+	for (const [name, payload] of Object.entries(credentials)) await write(join(dir, credentialsFile(name)), credentialsFileContent(payload), 384);
 	for (const [path, content] of Object.entries(stack.dockerfiles)) await write(join(root, path), content);
-	await ignoreStacks(root);
+	await ensureDockerignore(findBuildRoot(root));
 	return files;
 }
-/** Make sure the build context leaves `.gkm/compose` out. */
-async function ignoreStacks(root) {
-	const path = join(root, ".dockerignore");
-	if (!existsSync(path)) {
-		await writeFile(path, generateDockerignore());
-		return;
-	}
-	const current = await readFile(path, "utf-8");
-	if (/^\/?\.gkm\/compose\/?$|^\/?\.gkm\/?$/m.test(current)) return;
-	await appendFile(path, `${current.endsWith("\n") ? "" : "\n"}\n# gkm compose's stacks: each app's env file holds its stage's secrets\n.gkm/compose\n`);
-}
 function composeYaml(stack) {
 	const stage = stack.local ? "" : ` --stage ${stack.stage}`;
 	return `# Generated by gkm compose from the construct manifest — do not edit.
@@ -1857,6 +1418,6 @@ function composeTarget(options = {}) {
 	});
 }
 //#endregion
-export { SeedHasNoSeed as _, MigrationsOutsideFolder as a, dockerCompose as b, SeedFailed as c, migrateAndSeed as d, migrateDatabases as f, MigrationHasNoUp as g, DuplicateMigration as h, MigrationFailed as i, UnknownDatabaseFolder as l, seedDatabases as m, compose_exports as n, NoOwnerCredential as o, pendingMigrations as p, KyselyNotFound as r, NoSuchMigrationTarget as s, composeTarget as t, UnknownMigrationFolder as u, composeProject as v, stackDir as y };
+export { dockerCompose as a, stackDir as i, compose_exports as n, composeProject as r, composeTarget as t };
 
-//# sourceMappingURL=compose-DprE3ASm.mjs.map
+//# sourceMappingURL=compose-BjToENzG.mjs.map