@geekmidas/cli 10.0.0-alpha.65 → 10.0.0-alpha.67

package/dist/{compose-391oEKj1.cjs → compose-5oNHAKNT.cjs}

@@ -1,22 +1,15 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
-const require_local = require("./local-BdH4XN0E.cjs");
-const require_discover = require("./discover-DHdECueV.cjs");
-const require_sandbox = require("./sandbox-CL--ZDui.cjs");
+const require_run = require("./run-fVZ-rLnc.cjs");
+const require_discover = require("./discover-OEfZ9OkA.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
 const require_define = require("./define-DzRz8FgH.cjs");
-const require_storage = require("./storage-CSGoC3bK.cjs");
-const require_store = require("./store-CJF1Tqkq.cjs");
-const require_state = require("./state-DF26e_lo.cjs");
+const require_state = require("./state-DgmM4EKq.cjs");
 const require_fakes = require("./fakes-zW-jNAbQ.cjs");
+const require_databases = require("./databases-C2p5LGAp.cjs");
 let node_path = require("node:path");
-let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
 let _geekmidas_manifest = require("@geekmidas/manifest");
-let node_module = require("node:module");
-let node_url = require("node:url");
 let node_child_process = require("node:child_process");
-let pg = require("pg");
-pg = require_rolldown_runtime.__toESM(pg, 1);
 let yaml = require("yaml");
 let node_https = require("node:https");
 //#region src/compose/docker.ts
@@ -144,16 +137,16 @@ const dockerCompose = {
 		};
 	},
 	async build(stack, services) {
-		await require_local.run("docker", compose(stack, ["build", ...services]), runOptions(stack, {
+		await require_run.run("docker", compose(stack, ["build", ...services]), runOptions(stack, {
 			...process.env,
 			DOCKER_BUILDKIT: "1"
 		}));
 	},
 	async pull(stack, services) {
-		await require_local.run("docker", compose(stack, ["pull", ...services]), runOptions(stack));
+		await require_run.run("docker", compose(stack, ["pull", ...services]), runOptions(stack));
 	},
 	async up(stack, services) {
-		await require_local.run("docker", compose(stack, [
+		await require_run.run("docker", compose(stack, [
 			"up",
 			"-d",
 			"--wait",
@@ -163,10 +156,10 @@ const dockerCompose = {
 		]), runOptions(stack));
 	},
 	async down(stack) {
-		await require_local.run("docker", compose(stack, ["down"]), runOptions(stack));
+		await require_run.run("docker", compose(stack, ["down"]), runOptions(stack));
 	},
 	async port(stack, service, inside) {
-		const output = await require_local.runOutput("docker", compose(stack, [
+		const output = await require_run.runOutput("docker", compose(stack, [
 			"port",
 			service,
 			String(inside)
@@ -180,7 +173,7 @@ const dockerCompose = {
 	},
 	async copyOut(stack, service, from, to) {
 		await (0, node_fs_promises.mkdir)((0, node_path.dirname)(to), { recursive: true });
-		await require_local.run("docker", compose(stack, [
+		await require_run.run("docker", compose(stack, [
 			"cp",
 			`${service}:${from}`,
 			to
@@ -537,6 +530,7 @@ function composeStack(input) {
 		};
 		for (const [key, value] of Object.entries(app.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(app.name, key);
 	}
+	const layout = input.layout ?? defaultLayout(workspace.root);
 	const compose = stackFile({
 		project,
 		plan,
@@ -544,7 +538,10 @@ function composeStack(input) {
 		apps,
 		master: credential.master,
 		https,
-		http
+		http,
+		composeDir: (0, node_path.join)(workspace.root, stackDir(stage)),
+		buildRoot: layout.buildRoot,
+		workspaceRoot: workspace.root
 	});
 	const caddyfile = edgeCaddyfile(apps.map((app) => ({
 		host: app.host,
@@ -553,18 +550,10 @@ function composeStack(input) {
 	const dockerfiles = {};
 	for (const app of apps) {
 		if (!app.build) continue;
-		dockerfiles[app.build.dockerfile] = app.kind === "site" ? require_state.siteDockerfile(app.name, workspace.apps[app.name], {
-			turboPackage: input.packages?.[app.name] ?? app.name,
-			packageManager: input.packageManager ?? "pnpm",
+		dockerfiles[app.build.dockerfile] = require_state.appDockerfile(app.name, workspace.apps[app.name], {
+			layout,
+			workspaceRoot: workspace.root,
 			manifest
-		}) : require_state.generateSlimDockerfile({
-			imageName: app.name,
-			baseImage: "node:22-alpine",
-			port: app.port,
-			healthCheckPath: "/health",
-			prebuilt: true,
-			packageManager: input.packageManager ?? "pnpm",
-			bundle: `${app.path}/.gkm/server/dist/server.mjs`
 		});
 	}
 	return {
@@ -605,7 +594,7 @@ function stackApps(workspace, manifest, plan, options) {
 		if (!app || !resource || !app.port) continue;
 		const host = hostOf(name, app, workspace, resource, options);
 		const tag = declaration.kind === "site" ? siteTag(options.images.tag, options.stage) : options.images.tag;
-		const ref = require_state.validateImageRef(require_store.imageRef(options.identity, name, options.images.registry, tag));
+		const ref = require_state.validateImageRef(require_state.imageRef(options.identity, name, options.images.registry, tag));
 		apps.push({
 			app: name,
 			name,
@@ -665,8 +654,12 @@ function stackFile(options) {
 	for (const app of apps) services[app.name] = {
 		image: app.ref,
 		...app.build ? { build: {
-			context: "../../..",
-			dockerfile: app.build.dockerfile,
+			...require_state.composeBuildPaths({
+				composeDir: options.composeDir,
+				buildRoot: options.buildRoot,
+				workspaceRoot: options.workspaceRoot,
+				dockerfile: app.build.dockerfile
+			}),
 			...app.build.args ? { args: app.build.args } : {}
 		} } : {},
 		restart: "unless-stopped",
@@ -706,477 +699,83 @@ function stackFile(options) {
 		volumes
 	};
 }
-/** Render an app's env file: one `KEY=value` per line, read raw by compose. */
-function envFile(env) {
-	return `${Object.entries(env).sort(([a], [b]) => a.localeCompare(b)).map(([key, value]) => `${key}=${value}`).join("\n")}\n`;
-}
-//#endregion
-//#region src/migrate/provider.ts
 /**
-* One construct's migrations and seeds, read from its folders.
-*
-* Two kinds of file, told apart by extension rather than by configuration: a
-* script exports `up` (and may export `down`) — or `seed(db, { stage })`, in
-* `seeds/` — and a
-* `.sql` file is run whole. The second is what makes a folder independent of
-* the client the app uses — Better Auth's schema is SQL whatever the
-* application queries with.
+* A build without a layout: the workspace is the build root, with pnpm.
+* What a caller that never looked at the filesystem gets.
 */
-const SCRIPTS = /* @__PURE__ */ new Set([
-	".ts",
-	".mts",
-	".js",
-	".mjs"
-]);
-/** Two files in one folder that would be one migration. */
-var DuplicateMigration = class extends Error {
-	folder;
-	migration;
-	constructor(folder, migration) {
-		super(`${folder} has two migrations named '${migration}' — a script and a .sql file with the same name. A migration is recorded by name, so only one of them could ever run; rename or remove the other.`);
-		this.folder = folder;
-		this.migration = migration;
-		this.name = "DuplicateMigration";
-	}
-};
-/** A script in a migrations folder that exports no `up`. */
-var MigrationHasNoUp = class extends Error {
-	file;
-	constructor(file) {
-		super(`${file} is in a migrations folder but exports no \`up\` function. Export \`async function up(db: Kysely<unknown>)\`, or move the file out of the folder if it is not a migration.`);
-		this.file = file;
-		this.name = "MigrationHasNoUp";
-	}
-};
-/** A script in a seeds folder that exports no `seed`. */
-var SeedHasNoSeed = class extends Error {
-	file;
-	constructor(file) {
-		super(`${file} is in a seeds folder but exports no \`seed\` function. Export \`async function seed(db, { stage })\`, or move the file out of the folder if it is not a seed.`);
-		this.file = file;
-		this.name = "SeedHasNoSeed";
-	}
-};
-/**
-* The migration files in a folder, by name, without reading them.
-*
-* Also what `gkm dev` compares against a construct's history to report what
-* is pending, which is why it is separate from loading them.
-*/
-async function migrationFiles(folder) {
-	const entries = await (0, node_fs_promises.readdir)(folder, { withFileTypes: true }).catch((error) => {
-		if (error.code === "ENOENT") return [];
-		throw error;
-	});
-	const files = /* @__PURE__ */ new Map();
-	for (const entry of entries) {
-		if (!entry.isFile() || !isMigration(entry.name)) continue;
-		const name = entry.name.slice(0, -(0, node_path.extname)(entry.name).length);
-		if (files.has(name)) throw new DuplicateMigration(folder, name);
-		files.set(name, (0, node_path.join)(folder, entry.name));
-	}
-	return files;
-}
-/** A Kysely provider over one construct's folder. */
-function folderProvider(folder, raw) {
-	return { async getMigrations() {
-		const migrations = {};
-		for (const [name, file] of await migrationFiles(folder)) migrations[name] = (0, node_path.extname)(file) === ".sql" ? await sqlMigration(file, raw) : await scriptMigration(file);
-		return migrations;
-	} };
-}
-/**
-* The seeds in a folder, loaded, in name order.
-*
-* Every one runs on every pass — there is no history to consult — so the order
-* is the only thing between two seeds where one reads what another writes.
-* Name them to sort that way.
-*/
-async function loadSeeds(folder, raw) {
-	const files = [...await migrationFiles(folder)].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
-	const seeds = [];
-	for (const [name, file] of files) seeds.push({
-		name,
-		run: (0, node_path.extname)(file) === ".sql" ? (await sqlMigration(file, raw)).up : await scriptSeed(file)
-	});
-	return seeds;
-}
-/**
-* A seed script, imported as it is on disk now.
-*
-* Keyed by its modification time: a seed is run again after it is edited, and
-* a process that has imported it once would otherwise run the old one.
-*/
-async function scriptSeed(file) {
-	const url = (0, node_url.pathToFileURL)(file);
-	url.searchParams.set("mtime", String((await (0, node_fs_promises.stat)(file)).mtimeMs));
-	const module = await import(url.href);
-	if (typeof module.seed !== "function") throw new SeedHasNoSeed(file);
-	return module.seed;
-}
-function isMigration(file) {
-	if (file.endsWith(".d.ts")) return false;
-	if (/\.(spec|test)\.[cm]?[jt]s$/.test(file)) return false;
-	const extension = (0, node_path.extname)(file);
-	return extension === ".sql" || SCRIPTS.has(extension);
-}
-async function scriptMigration(file) {
-	const module = await import((0, node_url.pathToFileURL)(file).href);
-	if (typeof module.up !== "function") throw new MigrationHasNoUp(file);
+function defaultLayout(root) {
 	return {
-		up: module.up,
-		...typeof module.down === "function" ? { down: module.down } : {}
+		buildRoot: root,
+		gkmRoot: ".",
+		tools: {
+			packageManager: "pnpm",
+			turboVersion: require_state.TURBO_VERSION,
+			monorepo: true
+		},
+		gkmPaths: ["gkm.config.*"]
 	};
 }
-/**
-* A `.sql` file, run whole.
-*
-* One query rather than split on `;`: with no parameters, Postgres takes
-* several statements in one message, and splitting by hand breaks on the first
-* `;` inside a string or a function body. There is no `down` — a generated
-* schema is rolled back by a migration that says how, not by guessing.
-*/
-async function sqlMigration(file, raw) {
-	const statements = await (0, node_fs_promises.readFile)(file, "utf-8");
-	return { up: async (db) => {
-		await raw.raw(statements).execute(db);
-	} };
+/** The id the stack's compose file names an app's build credentials by. */
+function credentialsSecret(app) {
+	return `${app}_credentials`;
 }
-//#endregion
-//#region src/migrate/databases.ts
-/**
-* Bring each construct's schema up to its migrations folder.
-*
-* Which constructs, in what order, from which folder, is `migrationTargets`'
-* answer and nobody else's. What is decided here is only how one target is
-* run: as its owner, in its own schema, with a history of its own.
-*/
-/** A folder under `db/` that names no construct. */
-var UnknownMigrationFolder = class extends Error {
-	folder;
-	known;
-	constructor(folder, known) {
-		super(`${folder} names no database construct, so its migrations would never run. ${known.length > 0 ? `The folders that do: ${known.join(", ")}.` : "This project declares no database."} Rename the folder after the construct it belongs to.`);
-		this.folder = folder;
-		this.known = known;
-		this.name = "UnknownMigrationFolder";
-	}
-};
-/** A construct was asked for by a name that takes no migrations. */
-var NoSuchMigrationTarget = class extends Error {
-	construct;
-	known;
-	constructor(construct, known) {
-		super(`'${construct}' is not a database construct. ` + (known.length > 0 ? `The ones with migrations: ${known.join(", ")}.` : "This project declares no database."));
-		this.construct = construct;
-		this.known = known;
-		this.name = "NoSuchMigrationTarget";
-	}
-};
-/**
-* A migration left directly in a construct's folder, where nothing reads it.
-*
-* Migrations moved into `migrations/` so seeds could sit beside them. A file
-* still at the old level would otherwise never run, and nothing would say so.
-*/
-var MigrationsOutsideFolder = class extends Error {
-	folder;
-	files;
-	constructor(folder, files) {
-		super(`${folder} has ${files.join(", ")} directly inside it, where nothing runs them. Migrations live in ${folder}/migrations/ and seeds in ${folder}/seeds/ — move ${files.length === 1 ? "it" : "them"} there.`);
-		this.folder = folder;
-		this.files = files;
-		this.name = "MigrationsOutsideFolder";
-	}
-};
-/** A folder inside a construct's folder that is neither `migrations` nor `seeds`. */
-var UnknownDatabaseFolder = class extends Error {
-	folder;
-	constructor(folder) {
-		super(`${folder} is neither migrations/ nor seeds/, so nothing in it would ever run. A construct's folder holds those two; rename or remove it.`);
-		this.folder = folder;
-		this.name = "UnknownDatabaseFolder";
-	}
-};
-/** A seed failed; its own writes are rolled back, the ones before it stay. */
-var SeedFailed = class extends Error {
-	construct;
-	seed;
-	cause;
-	constructor(construct, seed, cause) {
-		super(`${construct}: seed '${seed}' failed — ${cause instanceof Error ? cause.message : String(cause)}. Its writes were rolled back; fix it and run it again.`);
-		this.construct = construct;
-		this.seed = seed;
-		this.cause = cause;
-		this.name = "SeedFailed";
-	}
-};
-/** A construct with roles has no owner URL to migrate with. */
-var NoOwnerCredential = class extends Error {
-	construct;
-	key;
-	constructor(construct, key) {
-		super(`${construct} has no ${key} to migrate with. Migrations run as the owner role — the runtime one cannot create a table — and nothing resolved its URL. Is the stage reconciled?`);
-		this.construct = construct;
-		this.key = key;
-		this.name = "NoOwnerCredential";
-	}
-};
-/** A migration failed; the ones before it in the run stay applied. */
-var MigrationFailed = class extends Error {
-	construct;
-	migration;
-	cause;
-	constructor(construct, migration, cause) {
-		super(`${construct}: migration ${migration ? `'${migration}' ` : ""}failed — ${cause instanceof Error ? cause.message : String(cause)}`);
-		this.construct = construct;
-		this.migration = migration;
-		this.cause = cause;
-		this.name = "MigrationFailed";
-	}
-};
-/** The project's Kysely could not be found from where a database is declared. */
-var KyselyNotFound = class extends Error {
-	from;
-	constructor(from) {
-		super(`Could not resolve 'kysely' from ${from}. Migrations run with the project's own Kysely — install it where the database is declared.`);
-		this.from = from;
-		this.name = "KyselyNotFound";
-	}
-};
-/** Apply every pending migration, construct by construct, parents first. */
-async function migrateDatabases(options) {
-	const runs = [];
-	for (const target of await targetsFor(options)) {
-		if ((await migrationFiles((0, node_path.join)(options.root, target.migrations))).size === 0) {
-			runs.push({
-				target,
-				applied: []
-			});
-			continue;
-		}
-		const applied = await withMigrator(options, target, async (migrator) => {
-			const { error, results = [] } = await migrator.migrateToLatest();
-			if (error) {
-				const failed = results.find((result) => result.status === "Error");
-				throw new MigrationFailed(target.id, failed?.migrationName, error);
-			}
-			return results.filter((result) => result.status === "Success").map((result) => result.migrationName);
-		});
-		runs.push({
-			target,
-			applied
-		});
-	}
-	return runs;
+/** The file beside the compose file an app's build credentials are read from. */
+function credentialsFile(app) {
+	return `${app}.credentials`;
 }
 /**
-* Run every construct's seeds, parents first — each one, every time, on every
-* stage, production included. Each is handed the stage, so a seed decides
-* what belongs where.
+* The stack with each backend's image built with its encrypted credentials:
+* a BuildKit secret per app — the file `credentialsFile` names, mounted as
+* `gkm_credentials` — and the hash naming them as a build arg, so a new key
+* rebuilds the layer that embeds them. Each backend's env file gains the
+* `GKM_MASTER_KEY` that decrypts them, the way a Dokploy deploy injects it.
 *
-* Seeds are reference data kept up to date by being run again, so there is no
-* history: a seed is an upsert, and a changed one is applied by the next run.
-* Each runs in its own transaction, as the construct's owner, so a failure
-* leaves nothing half-written. Assumes the schema is migrated —
-* {@link migrateAndSeed} is what makes that true.
+* Pure: the caller encrypted them.
 */
-async function seedDatabases(options) {
-	const runs = [];
-	for (const target of await targetsFor(options)) {
-		const folder = (0, node_path.join)(options.root, target.seeds);
-		if ((await migrationFiles(folder)).size === 0) {
-			runs.push({
-				target,
-				seeded: []
-			});
-			continue;
-		}
-		const seeded = await withOwner(options, target, async (db, kysely) => {
-			const names = [];
-			for (const seed of await loadSeeds(folder, kysely.sql)) {
-				try {
-					await db.transaction().execute((trx) => seed.run(trx, { stage: options.stage }));
-				} catch (error) {
-					throw new SeedFailed(target.id, seed.name, error);
-				}
-				names.push(seed.name);
+function withBuildCredentials(stack, credentials) {
+	const services = { ...stack.compose.services };
+	const secrets = { ...stack.compose.secrets };
+	const apps = stack.apps.map((app) => {
+		const own = credentials[app.name];
+		const service = services[app.name];
+		if (!own || !service?.build) return app;
+		const [key, value] = own.buildArg.split("=");
+		services[app.name] = {
+			...service,
+			build: {
+				...service.build,
+				args: {
+					...service.build.args,
+					[key]: value
+				},
+				secrets: [{
+					source: credentialsSecret(app.name),
+					target: "gkm_credentials"
+				}]
 			}
-			return names;
-		});
-		runs.push({
-			target,
-			seeded
-		});
-	}
-	return runs;
-}
-/**
-* Migrate, then seed: a seed only ever runs against the schema it was written
-* for.
-*
-* With `only`, the constructs it lives in are migrated too — a tenant's seed
-* cannot run before the database that owns its schema exists — and only it is
-* seeded.
-*/
-async function migrateAndSeed(options) {
-	const migrations = [];
-	for (const target of await withParents(options)) migrations.push(...await migrateDatabases({
-		...options,
-		only: target.id
-	}));
+		};
+		secrets[credentialsSecret(app.name)] = { file: `./${credentialsFile(app.name)}` };
+		return {
+			...app,
+			env: {
+				...app.env,
+				GKM_MASTER_KEY: own.masterKey
+			}
+		};
+	});
 	return {
-		migrations,
-		seeds: await seedDatabases(options)
-	};
-}
-/** The targets `only` names, after the ones it lives in; all without it. */
-async function withParents(options) {
-	const chosen = await targetsFor(options);
-	if (!options.only) return chosen;
-	const all = (0, _geekmidas_manifest.migrationTargets)(options.manifest);
-	const ids = /* @__PURE__ */ new Set();
-	for (const target of chosen) {
-		let current = target;
-		while (current) {
-			ids.add(current.id);
-			const parent = current.of;
-			current = parent ? all.find((t) => t.id === parent) : void 0;
+		...stack,
+		apps,
+		compose: {
+			...stack.compose,
+			services,
+			...Object.keys(secrets).length ? { secrets } : {}
 		}
-	}
-	return all.filter((target) => ids.has(target.id));
-}
-/**
-* What each construct's folder has that its history does not — without
-* applying any of it. What `gkm dev` reports.
-*/
-async function pendingMigrations(options) {
-	const found = [];
-	for (const target of await targetsFor(options)) {
-		if ((await migrationFiles((0, node_path.join)(options.root, target.migrations))).size === 0) continue;
-		const pending = await withMigrator(options, target, async (migrator) => (await migrator.getMigrations()).filter((migration) => migration.executedAt === void 0).map((migration) => migration.name));
-		if (pending.length > 0) found.push({
-			target,
-			pending
-		});
-	}
-	return found;
-}
-/**
-* The targets this run covers, with every folder under `db/` accounted for.
-*
-* A folder that names no construct is an error rather than something to skip:
-* a typo in its name is otherwise a migration that silently never runs.
-*/
-async function targetsFor(options) {
-	const targets = (0, _geekmidas_manifest.migrationTargets)(options.manifest);
-	const folders = targets.map((target) => target.folder);
-	for (const folder of await foldersIn((0, node_path.join)(options.root, _geekmidas_manifest.MIGRATIONS_ROOT))) {
-		const relative = `${_geekmidas_manifest.MIGRATIONS_ROOT}/${folder}`;
-		if (!folders.includes(relative)) throw new UnknownMigrationFolder(relative, folders);
-		await checkLayout(options.root, relative);
-	}
-	if (!options.only) return targets;
-	const id = (0, _geekmidas_manifest.canonicalId)(options.only);
-	const chosen = targets.filter((target) => target.id === id);
-	if (chosen.length === 0) throw new NoSuchMigrationTarget(options.only, targets.map((target) => target.id));
-	return chosen;
-}
-/**
-* A construct's folder holds `migrations/` and `seeds/`, and nothing else —
-* anything beside them is a file or folder nothing would ever run.
-*/
-async function checkLayout(root, folder) {
-	const entries = await (0, node_fs_promises.readdir)((0, node_path.join)(root, folder), { withFileTypes: true });
-	const loose = entries.filter((entry) => entry.isFile() && !entry.name.startsWith(".")).map((entry) => entry.name);
-	if (loose.length > 0) throw new MigrationsOutsideFolder(folder, loose);
-	for (const entry of entries) if (entry.isDirectory() && !_geekmidas_manifest.DATABASE_FOLDERS.includes(entry.name)) throw new UnknownDatabaseFolder(`${folder}/${entry.name}`);
-}
-async function foldersIn(dir) {
-	return (await (0, node_fs_promises.readdir)(dir, { withFileTypes: true }).catch((error) => {
-		if (error.code === "ENOENT") return [];
-		throw error;
-	})).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
-}
-/**
-* A migrator for one target, connected as its owner.
-*
-* No `migrationTableSchema`: the owner role's `search_path` is pinned to the
-* construct's schema, so the history lands there — `app.kysely_migration` for
-* the database, `auth_database.kysely_migration` for its tenant — and two
-* constructs in one Postgres never share one.
-*
-* Unordered migrations are allowed. Files are timestamped, so a branch merged
-* after another's migration ran carries an older one; refusing it would make
-* every such merge a manual repair.
-*/
-async function withMigrator(options, target, run) {
-	return withOwner(options, target, (db, { Migrator, sql }) => run(new Migrator({
-		db,
-		provider: folderProvider((0, node_path.join)(options.root, target.migrations), sql),
-		allowUnorderedMigrations: true
-	})));
-}
-/**
-* One target's database, connected as its owner and closed afterwards — what
-* migrations and seeds both run as.
-*/
-async function withOwner(options, target, run) {
-	const kysely = await kyselyFrom(options.sources?.[target.id]?.file ?? (target.of ? options.sources?.[target.of]?.file : void 0) ?? (0, node_path.join)(options.root, "package.json"));
-	const db = new kysely.Kysely({ dialect: new kysely.PostgresDialect({ pool: new pg.default.Pool(poolConfig(ownerUrl(options, target))) }) });
-	try {
-		return await run(db, kysely);
-	} finally {
-		await db.destroy();
-	}
-}
-/**
-* The owner's URL, with no fallback to the runtime one.
-*
-* The runtime role can create nothing, so falling back would only move the
-* failure to the first `CREATE TABLE` and make it read like a permissions
-* bug. The one exception is a database declared `roles: false`, where there is
-* no owner — both URLs are the master credential by design.
-*/
-function ownerUrl(options, target) {
-	const key = (0, _geekmidas_manifest.provideKey)(target.id, "ownerUrl");
-	const owner = options.env[key];
-	if (owner) return owner;
-	const database = options.manifest[target.of ?? target.id];
-	if (database?.kind === "database" && database.roles === false) {
-		const url = options.env[(0, _geekmidas_manifest.provideKey)(target.id, "url")];
-		if (url) return url;
-	}
-	throw new NoOwnerCredential(target.id, key);
-}
-/**
-* Pool settings for a URL, with `?search_path=` as the startup option Postgres
-* reads. Only a `roles: false` URL carries it — a role pins its own.
-*/
-function poolConfig(url) {
-	const parsed = new URL(url);
-	const searchPath = parsed.searchParams.get("search_path");
-	if (!searchPath) return { connectionString: url };
-	parsed.searchParams.delete("search_path");
-	return {
-		connectionString: parsed.toString(),
-		options: `-c search_path=${searchPath}`
 	};
 }
-/** Kysely as the project resolves it from `from`. */
-async function kyselyFrom(from) {
-	const require$1 = (0, node_module.createRequire)(from);
-	try {
-		const [main, migration] = await Promise.all([import((0, node_url.pathToFileURL)(require$1.resolve("kysely")).href), import((0, node_url.pathToFileURL)(require$1.resolve("kysely/migration")).href)]);
-		return {
-			Kysely: main.Kysely,
-			PostgresDialect: main.PostgresDialect,
-			sql: main.sql,
-			Migrator: migration.Migrator
-		};
-	} catch {
-		throw new KyselyNotFound(from);
-	}
+/** Render an app's env file: one `KEY=value` per line, read raw by compose. */
+function envFile(env) {
+	return `${Object.entries(env).sort(([a], [b]) => a.localeCompare(b)).map(([key, value]) => `${key}=${value}`).join("\n")}\n`;
 }
 //#endregion
 //#region src/target/compose/health.ts
@@ -1261,7 +860,11 @@ var ComposeAppsUnhealthy = class extends Error {
 * - What was started answers (`verify`): each app is asked through Caddy,
 *   over HTTPS, with the certificate verified.
 *
-* Docker, the registry, the bundler, Postgres and the health probe are
+* Every image is built inside Docker from a pruned slice of the build root —
+* the same Dockerfiles `gkm docker` writes — so nothing is built on this
+* machine before `docker compose build`.
+*
+* Docker, the registry, Postgres and the health probe are
 * injected, so the rules are asserted without a daemon; the defaults are the
 * real ones.
 */
@@ -1285,33 +888,11 @@ var NoGitRevision = class extends Error {
 		this.name = "NoGitRevision";
 	}
 };
-/** A backend's production bundle did not build. */
-var BundleFailed = class extends Error {
-	app;
-	exitCode;
-	stderr;
-	constructor(app, exitCode, stderr) {
-		super(`Bundling '${app}' for production failed (exit code ${exitCode}).${stderr.trim() ? `\n${stderr.trim().slice(-4e3)}` : ""}\nRun \`gkm build --provider server --production\` in the app's directory to see it again.`);
-		this.app = app;
-		this.exitCode = exitCode;
-		this.stderr = stderr;
-		this.name = "BundleFailed";
-	}
-};
-/** The CLI's own entry, which the bundle step runs, is not where it should be. */
-var CliEntryNotFound = class extends Error {
-	from;
-	constructor(from) {
-		super(`Could not find bin/gkm.mjs above ${from}, which bundling a backend runs. Reinstall @geekmidas/cli.`);
-		this.from = from;
-		this.name = "CliEntryNotFound";
-	}
-};
 /** The commit HEAD is at, short — and `-dirty` when the tree has changes. */
 async function gitRevision(root) {
 	let sha;
 	try {
-		sha = (await require_local.runOutput("git", [
+		sha = (await require_run.runOutput("git", [
 			"rev-parse",
 			"--short",
 			"HEAD"
@@ -1320,7 +901,7 @@ async function gitRevision(root) {
 		throw new NoGitRevision(root);
 	}
 	if (!sha) throw new NoGitRevision(root);
-	return (await require_local.runOutput("git", ["status", "--porcelain"], { cwd: root }).catch(() => "")).trim() ? `${sha}-dirty` : sha;
+	return (await require_run.runOutput("git", ["status", "--porcelain"], { cwd: root }).catch(() => "")).trim() ? `${sha}-dirty` : sha;
 }
 /** The edge's ports, from the environment — 443 and 80 when unset. */
 function edgePorts(env = process.env) {
@@ -1336,49 +917,15 @@ function edgePorts(env = process.env) {
 		http: read(EDGE_PORT_ENV.http, 80)
 	};
 }
-/** `bin/gkm.mjs` of the CLI that is running. */
-function cliEntry() {
-	const from = (0, node_path.dirname)((0, node_url.fileURLToPath)(require("url").pathToFileURL(__filename).href));
-	for (let dir = from; (0, node_path.dirname)(dir) !== dir; dir = (0, node_path.dirname)(dir)) {
-		const entry = (0, node_path.join)(dir, "bin", "gkm.mjs");
-		if ((0, node_fs.existsSync)(entry)) return entry;
-	}
-	throw new CliEntryNotFound(from);
-}
-/** A cold production bundle is seconds; a hung one must not hold the lock. */
-const BUNDLE_TIMEOUT_MS = 6e5;
-/**
-* Bundle a backend with the gkm that is running — the same build a deploy
-* makes, so the image holds one file and no dependencies — in the run's
-* sandbox, because the build imports the project's code.
-*/
-async function bundleInSandbox(appRoot, ctx) {
-	const sandbox = require_sandbox.activeSandbox() ?? new require_local.LocalSandbox({ root: ctx.cwd });
-	const result = await sandbox.exec("node", [
-		cliEntry(),
-		"build",
-		"--provider",
-		"server",
-		"--production"
-	], {
-		cwd: appRoot,
-		env: sandbox.env,
-		timeoutMs: BUNDLE_TIMEOUT_MS,
-		output: ctx.childOutput,
-		signal: ctx.signal
-	});
-	if (result.exitCode !== 0) throw new BundleFailed(appRoot, result.exitCode, result.stderr);
-}
 /**
 * The real ones. Each app is asked for three minutes before it counts as
 * down: a deployed stage's first ACME certificate can take that long.
 */
 const defaultDeps = {
 	docker: dockerCompose,
-	bundle: bundleInSandbox,
 	revision: gitRevision,
 	sql: require_state.pgClient,
-	migrate: migrateDatabases,
+	migrate: require_databases.migrateDatabases,
 	probe: httpsProbe,
 	healthAttempts: 90,
 	healthIntervalMs: 2e3,
@@ -1400,7 +947,9 @@ async function validateCompose(ctx, deps, forced) {
 		runnables
 	});
 	const { secrets, generated } = await stageSecrets(ctx, manifest);
-	const stack = composeStack({
+	const masterKeys = {};
+	const layout = mode === "build" ? require_state.imageLayout(workspace) : void 0;
+	const composed = composeStack({
 		workspace,
 		manifest,
 		runnables,
@@ -1413,12 +962,36 @@ async function validateCompose(ctx, deps, forced) {
 		},
 		secrets,
 		ports: edgePorts(deps.env),
-		packageManager: require_state.detectPackageManager(root),
-		packages: Object.fromEntries(Object.entries(workspace.apps).map(([name, app]) => [name, require_state.appPackageName(root, name, app.path)]))
+		...layout ? { layout } : {}
 	});
+	const credentials = {};
+	if (mode === "build") for (const app of composed.apps) {
+		if (app.kind !== "rest-api" || !app.env || !app.build) continue;
+		const { encrypted, iv, masterKey } = require_state.encryptSecrets(app.env);
+		credentials[app.name] = {
+			encrypted,
+			iv
+		};
+		ctx.secrets.mask(masterKey);
+		masterKeys[app.name] = {
+			masterKey,
+			buildArg: require_state.credentialsBuildArg({
+				encrypted,
+				iv
+			})
+		};
+	}
+	const stack = withBuildCredentials(composed, masterKeys);
 	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, stack.apps);
 	const dir = (0, node_path.join)(root, stackDir(stage));
-	const previous = (await ctx.state.read(stage))?.state.images ?? {};
+	const previous = Object.fromEntries(Object.entries((await ctx.state.read(stage))?.state.releases ?? {}).map(([name, releases]) => {
+		const { ref, tag, digest } = releases.current;
+		return [name, {
+			ref,
+			...tag ? { tag } : {},
+			...digest ? { digest } : {}
+		}];
+	}));
 	return {
 		mode,
 		stack,
@@ -1434,6 +1007,7 @@ async function validateCompose(ctx, deps, forced) {
 		generated,
 		previous,
 		files: [],
+		credentials,
 		images: {},
 		changes: []
 	};
@@ -1450,7 +1024,7 @@ async function stageSecrets(ctx, manifest) {
 		secrets: stored,
 		generated: []
 	};
-	const { secrets, generated } = require_state.withGeneratedSecrets(stored ?? require_storage.initStageSecrets(ctx.stage), manifest);
+	const { secrets, generated } = require_state.withGeneratedSecrets(stored ?? require_state.initStageSecrets(ctx.stage), manifest);
 	if (secrets.seed) ctx.secrets.mask(secrets.seed);
 	for (const value of Object.values(secrets.custom ?? {})) ctx.secrets.mask(value);
 	return {
@@ -1465,7 +1039,7 @@ async function stageSecrets(ctx, manifest) {
 */
 async function planCompose(ctx, run) {
 	if (run.generated.length > 0) ctx.logger.info(`🔑 "${ctx.stage}" has no ${run.generated.join(", ")} yet; this dry run used values it did not keep.`);
-	run.files = await writeStack(ctx.cwd, run.dir, run.stack);
+	run.files = await writeStack(ctx.cwd, run.dir, run.stack, run.credentials);
 	printPlan(ctx, run);
 	const planned = (change) => {
 		run.changes.push(change);
@@ -1509,7 +1083,7 @@ async function provisionCompose(ctx, run, deps) {
 		await ctx.secrets.write(run.secrets);
 		ctx.logger.info(`🔑 Generated for "${ctx.stage}" (${ctx.secrets.store}): ${run.generated.join(", ")}`);
 	}
-	run.files = await writeStack(ctx.cwd, run.dir, stack);
+	run.files = await writeStack(ctx.cwd, run.dir, stack, run.credentials);
 	printPlan(ctx, run);
 	if (stack.infra.length > 0) {
 		ctx.logger.info(`\n🗄️  Starting ${stack.infra.join(", ")}…`);
@@ -1555,18 +1129,14 @@ async function prepareDatabases(ctx, run, deps) {
 	for (const { target, applied } of runs) if (applied.length > 0) ctx.logger.info(`🗄️  ${target.migrations}: applied ${applied.length}`);
 }
 /**
-* Each app's image: built from this checkout — every backend bundled first,
-* on the host, with this CLI — or pulled at the tag. Nothing live changes.
+* Each app's image: built from this checkout — inside Docker, every one of
+* them, from a pruned slice of the build root — or pulled at the tag. Nothing
+* live changes.
 */
 async function buildCompose(ctx, run, deps) {
 	const { stack, ref } = run;
 	const apps = stack.apps.map((app) => app.name);
 	if (run.mode === "build") {
-		for (const app of stack.apps.filter((a) => a.kind === "rest-api")) {
-			ctx.signal.throwIfAborted();
-			ctx.logger.info(`\n📦 Bundling ${app.name}…`);
-			await deps.bundle((0, node_path.join)(ctx.cwd, app.path), ctx);
-		}
 		ctx.logger.info("\n🐳 Building images…");
 		await deps.docker.build(ref, apps);
 	} else {
@@ -1637,7 +1207,7 @@ async function recordImages(ctx, run) {
 			ref: app.ref,
 			tag: app.tag
 		};
-		require_state.setDeployedImage(journal.state, app.name, image);
+		require_state.recordRelease(journal.state, app.name, image);
 	}
 	journal.state.identity = ctx.identity.key;
 	await journal.save();
@@ -1749,7 +1319,7 @@ function applied(ctx, run, change) {
 	});
 }
 /** Write the stack's files: owner-only, since the env files hold secrets. */
-async function writeStack(root, dir, stack) {
+async function writeStack(root, dir, stack, credentials = {}) {
 	await (0, node_fs_promises.mkdir)(dir, {
 		recursive: true,
 		mode: 448
@@ -1765,21 +1335,11 @@ async function writeStack(root, dir, stack) {
 	await write((0, node_path.join)(dir, "docker-compose.yml"), composeYaml(stack));
 	await write((0, node_path.join)(dir, "Caddyfile"), stack.caddyfile);
 	for (const app of stack.apps) if (app.env) await write((0, node_path.join)(dir, `${app.name}.env`), envFile(app.env), 384);
+	for (const [name, payload] of Object.entries(credentials)) await write((0, node_path.join)(dir, credentialsFile(name)), require_state.credentialsFileContent(payload), 384);
 	for (const [path, content] of Object.entries(stack.dockerfiles)) await write((0, node_path.join)(root, path), content);
-	await ignoreStacks(root);
+	await require_state.ensureDockerignore(require_state.findBuildRoot(root));
 	return files;
 }
-/** Make sure the build context leaves `.gkm/compose` out. */
-async function ignoreStacks(root) {
-	const path = (0, node_path.join)(root, ".dockerignore");
-	if (!(0, node_fs.existsSync)(path)) {
-		await (0, node_fs_promises.writeFile)(path, require_state.generateDockerignore());
-		return;
-	}
-	const current = await (0, node_fs_promises.readFile)(path, "utf-8");
-	if (/^\/?\.gkm\/compose\/?$|^\/?\.gkm\/?$/m.test(current)) return;
-	await (0, node_fs_promises.appendFile)(path, `${current.endsWith("\n") ? "" : "\n"}\n# gkm compose's stacks: each app's env file holds its stage's secrets\n.gkm/compose\n`);
-}
 function composeYaml(stack) {
 	const stage = stack.local ? "" : ` --stage ${stack.stage}`;
 	return `# Generated by gkm compose from the construct manifest — do not edit.
@@ -1858,72 +1418,6 @@ function composeTarget(options = {}) {
 	});
 }
 //#endregion
-Object.defineProperty(exports, "DuplicateMigration", {
-	enumerable: true,
-	get: function() {
-		return DuplicateMigration;
-	}
-});
-Object.defineProperty(exports, "KyselyNotFound", {
-	enumerable: true,
-	get: function() {
-		return KyselyNotFound;
-	}
-});
-Object.defineProperty(exports, "MigrationFailed", {
-	enumerable: true,
-	get: function() {
-		return MigrationFailed;
-	}
-});
-Object.defineProperty(exports, "MigrationHasNoUp", {
-	enumerable: true,
-	get: function() {
-		return MigrationHasNoUp;
-	}
-});
-Object.defineProperty(exports, "MigrationsOutsideFolder", {
-	enumerable: true,
-	get: function() {
-		return MigrationsOutsideFolder;
-	}
-});
-Object.defineProperty(exports, "NoOwnerCredential", {
-	enumerable: true,
-	get: function() {
-		return NoOwnerCredential;
-	}
-});
-Object.defineProperty(exports, "NoSuchMigrationTarget", {
-	enumerable: true,
-	get: function() {
-		return NoSuchMigrationTarget;
-	}
-});
-Object.defineProperty(exports, "SeedFailed", {
-	enumerable: true,
-	get: function() {
-		return SeedFailed;
-	}
-});
-Object.defineProperty(exports, "SeedHasNoSeed", {
-	enumerable: true,
-	get: function() {
-		return SeedHasNoSeed;
-	}
-});
-Object.defineProperty(exports, "UnknownDatabaseFolder", {
-	enumerable: true,
-	get: function() {
-		return UnknownDatabaseFolder;
-	}
-});
-Object.defineProperty(exports, "UnknownMigrationFolder", {
-	enumerable: true,
-	get: function() {
-		return UnknownMigrationFolder;
-	}
-});
 Object.defineProperty(exports, "composeProject", {
 	enumerable: true,
 	get: function() {
@@ -1948,30 +1442,6 @@ Object.defineProperty(exports, "dockerCompose", {
 		return dockerCompose;
 	}
 });
-Object.defineProperty(exports, "migrateAndSeed", {
-	enumerable: true,
-	get: function() {
-		return migrateAndSeed;
-	}
-});
-Object.defineProperty(exports, "migrateDatabases", {
-	enumerable: true,
-	get: function() {
-		return migrateDatabases;
-	}
-});
-Object.defineProperty(exports, "pendingMigrations", {
-	enumerable: true,
-	get: function() {
-		return pendingMigrations;
-	}
-});
-Object.defineProperty(exports, "seedDatabases", {
-	enumerable: true,
-	get: function() {
-		return seedDatabases;
-	}
-});
 Object.defineProperty(exports, "stackDir", {
 	enumerable: true,
 	get: function() {
@@ -1979,4 +1449,4 @@ Object.defineProperty(exports, "stackDir", {
 	}
 });
 
-//# sourceMappingURL=compose-391oEKj1.cjs.map
+//# sourceMappingURL=compose-5oNHAKNT.cjs.map