@geekmidas/cli 10.0.0-alpha.66 → 10.0.0-alpha.68

package/dist/{compose-CNQL8BnO.mjs → compose-DFxuYhn6.mjs}

@@ -1,17 +1,14 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { c as runOutput, s as run, t as LocalSandbox } from "./local-CWR4Y_kW.mjs";
+import { a as runOutput, i as run } from "./run-BJLIerMM.mjs";
 import { r as discover } from "./discover-BFoJWKGD.mjs";
-import { i as activeSandbox } from "./sandbox-Dm247NGx.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
 import { t as defineTarget } from "./define-DR8xGYfL.mjs";
-import { B as appEnvKeys, C as validateImageRef, Et as initStageSecrets, G as planFor, H as networkEnv, I as postgresStatements, O as constructGlobs, P as applyPostgres, Q as DEFAULT_IMAGES, R as composeFor, S as generateSlimDockerfile, T as resolveHost, U as envFor, W as localRolePassword, _ as appPackageName, a as recordRelease, b as detectPackageManager, m as withGeneratedSecrets, nt as primaryPortKey, p as DeployJournal, q as hostFor, t as createEmptyState, tt as portKeys, w as isMainFrontendApp, x as generateDockerignore, xt as imageRef, y as siteDockerfile, z as pgClient } from "./state-uuYqnRVO.mjs";
+import { A as assertExternalServices, C as isMainFrontendApp, Ct as primaryPortKey, F as reportDevServices, Ht as imageRef, I as encryptSecrets, J as applyPolicies, Q as postgresStatements, S as NoDomainForStage, St as portKeys, V as constructGlobs, X as bucketPolicies, Y as applyPostgres, a as recordRelease, at as envFor, b as ensureDockerignore, dt as imageLayout, et as composeFor, ft as TURBO_VERSION, g as credentialsFileContent, h as credentialsBuildArg, it as networkEnv, j as devServicesUsed, lt as hostFor, m as withGeneratedSecrets, mt as findBuildRoot, nt as pgClient, ot as localRolePassword, p as DeployJournal, q as applyBuckets, qt as initStageSecrets, rt as appEnvKeys, st as planFor, t as createEmptyState, tt as bucketClient, ut as composeBuildPaths, v as appDockerfile, w as resolveHost, x as validateImageRef, yt as DEFAULT_IMAGES } from "./state-Bn5JDMFT.mjs";
 import { n as DEFAULT_CACHE, r as DEFAULT_EVENTS } from "./fakes-C9RiT6XG.mjs";
 import { u as migrateDatabases } from "./databases-hUHTuwhx.mjs";
 import { dirname, join } from "node:path";
-import { existsSync } from "node:fs";
-import { appendFile, chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
 import { provideKey, provisionOrder, publicEnvFor } from "@geekmidas/manifest";
-import { fileURLToPath } from "node:url";
 import { spawn } from "node:child_process";
 import { stringify } from "yaml";
 import { request } from "node:https";
@@ -264,22 +261,29 @@ function edgeCaddyfile(sites, options) {
 }` : options.email ? `{
 	email ${options.email}
 }` : "";
-	const blocks = sites.map(({ host, upstream }) => `https://${host} {${options.local ? `
+	const blocks = sites.map(({ host, upstream, rewrite }) => `https://${host} {${options.local ? `
 	tls internal
-` : ""}
+` : ""}${rewrite ? `
+	# A bucket, served at a host of its own: the bucket is a prefix on MinIO,
+	# which routes and signs on the Host header — so it is sent the upstream's.
+	reverse_proxy ${upstream} {
+		rewrite ${rewrite}
+		header_up Host {upstream_hostport}
+	}` : `
 	# Host and X-Forwarded-* are passed through as Caddy does by default, so
 	# an app builds redirects, cookies and links on the address a caller used.
 	reverse_proxy ${upstream} {
 		# Never buffer: a streamed response — server-sent events, a Next.js
 		# RSC payload — reaches the client as each chunk is written.
 		flush_interval -1
-	}
+	}`}
 }`);
 	return `${HEADER}${global ? `${global}\n\n` : ""}${blocks.join("\n\n")}\n`;
 }
 const HEADER = `# Generated by gkm compose from the construct manifest — do not edit.
 #
-# One host per API and site, each in front of its own container.
+# One host per API and site, each in front of its own container, and one per
+# file server in front of the stack's MinIO.
 `;
 //#endregion
 //#region src/compose/stack.ts
@@ -320,42 +324,32 @@ const EDGE_PORT_ENV = {
 /**
 * Containers this target does not run.
 *
-* Object storage is the stage's own — an externally hosted bucket whose URL
-* the stage's secrets hold — and so is a deployed stage's mail. The AWS
-* emulator never applies: a stack is a server target, whose events are
-* pg-boss.
+* The AWS emulator never applies: a stack is a server target, whose events
+* are pg-boss. Reconcile's Caddy fronts `gkm dev`'s host processes; the stack
+* brings its own edge.
+*
+* MinIO and Mailpit run on the local stage always, and on a deployed stage
+* only where `--allow-dev-services` allowed them and its secrets configure no
+* real bucket or mail server — see `devServices.ts`.
 */
 const NOT_RUN = {
-	minio: true,
 	localstack: true,
 	caddy: true
 };
-/** Kinds whose `<ID>_URL` a stage must be given, because nothing here runs them. */
-const EXTERNAL_KINDS = {
-	objects: true,
-	"file-server": true
+/** The kinds a deployed stage takes from its secrets, or a dev service. */
+const SERVICE_KINDS = {
+	email: "email",
+	objects: "objects",
+	"file-server": "file-server"
 };
+/** The region MinIO is addressed with. It has no regions; the SDK wants one. */
+const MINIO_REGION = "us-east-1";
 /** The S3 client's credentials, read beside a bucket's URL when it has them. */
 const STORAGE_KEYS = [
 	"AWS_ACCESS_KEY_ID",
 	"AWS_SECRET_ACCESS_KEY",
 	"AWS_REGION"
 ];
-/** A bucket the stack needs and the stage was not given. */
-var BucketNotConfigured = class extends Error {
-	app;
-	id;
-	key;
-	stage;
-	constructor(app, id, key, stage) {
-		super(`'${app}' uses the bucket '${id}', and gkm compose runs no object storage: the stage needs an externally hosted bucket. Set its URL in the stage's secrets: gkm secrets:set ${key} 's3://…' --stage ${stage}`);
-		this.app = app;
-		this.id = id;
-		this.key = key;
-		this.stage = stage;
-		this.name = "BucketNotConfigured";
-	}
-};
 /** A value only the stage's secrets can hold, and they do not. */
 var StageSecretMissing = class extends Error {
 	app;
@@ -373,7 +367,7 @@ var StageSecretMissing = class extends Error {
 var StageSeedMissing = class extends Error {
 	stage;
 	constructor(stage) {
-		super(`The stage '${stage}' has no seed in its secrets, and a deployed stage's database passwords are derived from it. Run gkm compose without --dry-run once, or gkm deploy, to generate it.`);
+		super(`The stage '${stage}' has no seed in its secrets, and a deployed stage's database passwords are derived from it. Run gkm compose --stage ${stage} without --dry-run once, or gkm deploy, to generate it.`);
 		this.stage = stage;
 		this.name = "StageSeedMissing";
 	}
@@ -442,7 +436,6 @@ function composeStack(input) {
 		master: local ? "geekmidas" : localRolePassword(workspace.name, plan, "master", seed),
 		...seed ? { seed } : {}
 	};
-	const infra = plan.containers.filter((c) => !NOT_RUN[c]).filter((c) => local || c !== "mailpit").sort();
 	const apps = stackApps(workspace, manifest, plan, {
 		local,
 		stage,
@@ -451,10 +444,47 @@ function composeStack(input) {
 		images: input.images
 	});
 	if (apps.length === 0) throw new NothingToCompose(workspace.root);
+	const owners = /* @__PURE__ */ new Map();
+	for (const resource of plan.resources) {
+		owners.set(resource.envKey, resource);
+		if (resource.kind === "email") {
+			owners.set(provideKey(resource.id, "from"), resource);
+			owners.set(provideKey(resource.id, "inboxUrl"), resource);
+		}
+		if (resource.kind === "external-api") owners.set(provideKey(resource.id, "credentials"), resource);
+	}
+	const reads = /* @__PURE__ */ new Map();
+	for (const app of apps) {
+		const site = manifest[app.id];
+		reads.set(app.name, site?.kind === "site" ? Object.values(publicEnvFor(site, manifest)) : [...appEnvKeys(manifest, app.name, input.runnables) ?? []]);
+	}
+	const domain = workspace.deploy?.domains?.[stage];
+	const services = local ? {
+		missing: [],
+		minio: plan.resources.filter((r) => r.kind === "objects").map((r) => r.id),
+		mailpit: plan.resources.filter((r) => r.kind === "email").map((r) => r.id)
+	} : assertExternalServices({
+		stage,
+		declarations: serviceDeclarations(plan, reads, owners),
+		supplied: custom,
+		allow: input.allowDevServices ?? [],
+		...domain ? { domain } : {}
+	});
+	const infra = plan.containers.filter((c) => !NOT_RUN[c]).filter((c) => c !== "minio" || services.minio.length > 0).filter((c) => c !== "mailpit" || services.mailpit.length > 0).sort();
+	const storage = infra.includes("minio") ? (() => {
+		const buckets = services.minio.map((id) => byId.get(id)?.name).filter((name) => Boolean(name)).sort();
+		return {
+			user: custom.AWS_ACCESS_KEY_ID ?? (local ? "geekmidas" : `${workspace.name}-minio`),
+			password: custom.AWS_SECRET_ACCESS_KEY ?? (local ? "geekmidas" : localRolePassword(workspace.name, plan, "minio", seed)),
+			buckets,
+			policies: bucketPolicies(plan).filter((p) => buckets.includes(p.bucket))
+		};
+	})() : void 0;
 	const derivation = {
 		project: workspace.name,
 		master: credential.master,
-		...credential.seed ? { seed: credential.seed } : {}
+		...credential.seed ? { seed: credential.seed } : {},
+		...!local && domain ? { mailFrom: `noreply@${domain}` } : {}
 	};
 	const outside = networkEnv(plan, {
 		...derivation,
@@ -464,14 +494,27 @@ function composeStack(input) {
 		...derivation,
 		addresses: Object.fromEntries(apps.map((app) => [app.id, `http://${app.name}:${app.port}`]))
 	});
-	const owners = /* @__PURE__ */ new Map();
-	for (const resource of plan.resources) {
-		owners.set(resource.envKey, resource);
-		if (resource.kind === "email") {
-			owners.set(provideKey(resource.id, "from"), resource);
-			owners.set(provideKey(resource.id, "inboxUrl"), resource);
+	const fileServers = /* @__PURE__ */ new Map();
+	if (storage) for (const resource of plan.resources) {
+		if (resource.kind !== "file-server" || !resource.of) continue;
+		if (!services.minio.includes(resource.of)) continue;
+		if (custom[resource.envKey] !== void 0) continue;
+		const bucket = byId.get(resource.of);
+		if (!bucket) continue;
+		let host;
+		if (local) host = hostFor(resource, workspace.name);
+		else {
+			if (!domain) throw new NoDomainForStage(stage);
+			host = `${resource.subdomain ?? appKey(resource.id)}.${domain}`;
 		}
-		if (resource.kind === "external-api") owners.set(provideKey(resource.id, "credentials"), resource);
+		fileServers.set(resource.id, {
+			url: `https://${host}${local && https !== 443 ? `:${https}` : ""}`,
+			site: {
+				host,
+				upstream: "minio:9000",
+				rewrite: `/${bucket.name}{uri}`
+			}
+		});
 	}
 	const surfaceUrls = new Map(plan.resources.filter((r) => r.kind === "rest-api" || r.kind === "site").map((r) => [r.envKey, r.id]));
 	const appById = new Map(apps.map((app) => [app.id, app]));
@@ -480,10 +523,10 @@ function composeStack(input) {
 	* they can hold it, and the derivations otherwise.
 	*/
 	const valueFor = (app, key, owner) => {
-		if (owner && EXTERNAL_KINDS[owner.kind] && key === owner.envKey) {
-			const value = custom[key];
-			if (value === void 0) throw new BucketNotConfigured(app.name, owner.id, key, stage);
-			return value;
+		if (owner && SERVICE_KINDS[owner.kind]) {
+			if (custom[key] !== void 0) return custom[key];
+			if (owner.kind === "file-server") return fileServers.get(owner.id)?.url;
+			return outside[key];
 		}
 		if (owner && suppliedBy(owner, key, local)) {
 			const value = custom[key];
@@ -513,7 +556,8 @@ function composeStack(input) {
 			const owner = owners.get(key) ?? storageOwner(key, plan);
 			if (!local && owner?.kind === "email" && key.endsWith("_INBOX_URL")) continue;
 			if (STORAGE_KEYS.includes(key)) {
-				if (custom[key] !== void 0) values[key] = custom[key];
+				const value = custom[key] ?? storageValue(key, storage);
+				if (value !== void 0) values[key] = value;
 				continue;
 			}
 			const value = valueFor(app, key, owner);
@@ -533,34 +577,31 @@ function composeStack(input) {
 		};
 		for (const [key, value] of Object.entries(app.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(app.name, key);
 	}
+	const layout = input.layout ?? defaultLayout(workspace.root);
 	const compose = stackFile({
 		project,
 		plan,
 		infra,
 		apps,
 		master: credential.master,
+		...storage ? { storage } : {},
 		https,
-		http
+		http,
+		composeDir: join(workspace.root, stackDir(stage)),
+		buildRoot: layout.buildRoot,
+		workspaceRoot: workspace.root
 	});
-	const caddyfile = edgeCaddyfile(apps.map((app) => ({
+	const caddyfile = edgeCaddyfile([...apps.map((app) => ({
 		host: app.host,
 		upstream: `${app.name}:${app.port}`
-	})), { local });
+	})), ...[...fileServers.values()].map(({ site }) => site)], { local });
 	const dockerfiles = {};
 	for (const app of apps) {
 		if (!app.build) continue;
-		dockerfiles[app.build.dockerfile] = app.kind === "site" ? siteDockerfile(app.name, workspace.apps[app.name], {
-			turboPackage: input.packages?.[app.name] ?? app.name,
-			packageManager: input.packageManager ?? "pnpm",
+		dockerfiles[app.build.dockerfile] = appDockerfile(app.name, workspace.apps[app.name], {
+			layout,
+			workspaceRoot: workspace.root,
 			manifest
-		}) : generateSlimDockerfile({
-			imageName: app.name,
-			baseImage: "node:22-alpine",
-			port: app.port,
-			healthCheckPath: "/health",
-			prebuilt: true,
-			packageManager: input.packageManager ?? "pnpm",
-			bundle: `${app.path}/.gkm/server/dist/server.mjs`
 		});
 	}
 	return {
@@ -573,16 +614,56 @@ function composeStack(input) {
 		caddyfile,
 		dockerfiles,
 		plan,
-		credential
+		credential,
+		...storage ? { storage } : {},
+		devServices: local ? [] : devServicesUsed(services)
 	};
 	/** Whether only the stage's secrets can supply `key` to `owner`. */
 	function suppliedBy(owner, key, isLocal) {
 		if (owner.kind === "credential") return true;
 		if (owner.kind === "external-api") return key === provideKey(owner.id, "credentials");
 		if (isLocal) return false;
-		if (owner.kind === "secret" || owner.kind === "encryption") return true;
-		return owner.kind === "email" && !key.endsWith("_INBOX_URL");
+		return owner.kind === "secret" || owner.kind === "encryption";
+	}
+}
+/**
+* The mail and storage constructs a deployed stage's apps read, with who
+* reads each — and every file server's bucket, which serves it whether or
+* not an app reads it directly.
+*/
+function serviceDeclarations(plan, reads, owners) {
+	const byId = new Map(plan.resources.map((r) => [r.id, r]));
+	const readers = /* @__PURE__ */ new Map();
+	const add = (id, app) => {
+		const set = readers.get(id) ?? /* @__PURE__ */ new Set();
+		if (app) set.add(app);
+		readers.set(id, set);
+	};
+	for (const [app, keys] of reads) for (const key of keys) {
+		const owner = owners.get(key);
+		if (!owner || !SERVICE_KINDS[owner.kind]) continue;
+		if (owner.kind === "email" && key.endsWith("_INBOX_URL")) continue;
+		add(owner.id, app);
+		if (owner.kind === "file-server" && owner.of) add(owner.of);
 	}
+	return [...readers].flatMap(([id, apps]) => {
+		const resource = byId.get(id);
+		const kind = resource && SERVICE_KINDS[resource.kind];
+		if (!resource || !kind) return [];
+		return [{
+			id,
+			kind,
+			...resource.of ? { of: resource.of } : {},
+			apps: [...apps].sort()
+		}];
+	});
+}
+/** The stack's MinIO's value for one of the S3 client's keys. */
+function storageValue(key, storage) {
+	if (!storage) return void 0;
+	if (key === "AWS_ACCESS_KEY_ID") return storage.user;
+	if (key === "AWS_SECRET_ACCESS_KEY") return storage.password;
+	if (key === "AWS_REGION") return MINIO_REGION;
 }
 /** Which bucket an S3 credential key belongs to — the first one declared. */
 function storageOwner(key, plan) {
@@ -658,11 +739,24 @@ function stackFile(options) {
 		};
 		postgres.ports = ["127.0.0.1::5432"];
 	}
+	const minio = services.minio;
+	if (minio && options.storage) {
+		minio.environment = {
+			...minio.environment,
+			MINIO_ROOT_USER: options.storage.user,
+			MINIO_ROOT_PASSWORD: options.storage.password
+		};
+		minio.ports = ["127.0.0.1::9000"];
+	}
 	for (const app of apps) services[app.name] = {
 		image: app.ref,
 		...app.build ? { build: {
-			context: "../../..",
-			dockerfile: app.build.dockerfile,
+			...composeBuildPaths({
+				composeDir: options.composeDir,
+				buildRoot: options.buildRoot,
+				workspaceRoot: options.workspaceRoot,
+				dockerfile: app.build.dockerfile
+			}),
 			...app.build.args ? { args: app.build.args } : {}
 		} } : {},
 		restart: "unless-stopped",
@@ -702,6 +796,80 @@ function stackFile(options) {
 		volumes
 	};
 }
+/**
+* A build without a layout: the workspace is the build root, with pnpm.
+* What a caller that never looked at the filesystem gets.
+*/
+function defaultLayout(root) {
+	return {
+		buildRoot: root,
+		gkmRoot: ".",
+		tools: {
+			packageManager: "pnpm",
+			turboVersion: TURBO_VERSION,
+			monorepo: true
+		},
+		gkmPaths: ["gkm.config.*"]
+	};
+}
+/** The id the stack's compose file names an app's build credentials by. */
+function credentialsSecret(app) {
+	return `${app}_credentials`;
+}
+/** The file beside the compose file an app's build credentials are read from. */
+function credentialsFile(app) {
+	return `${app}.credentials`;
+}
+/**
+* The stack with each backend's image built with its encrypted credentials:
+* a BuildKit secret per app — the file `credentialsFile` names, mounted as
+* `gkm_credentials` — and the hash naming them as a build arg, so a new key
+* rebuilds the layer that embeds them. Each backend's env file gains the
+* `GKM_MASTER_KEY` that decrypts them, the way a Dokploy deploy injects it.
+*
+* Pure: the caller encrypted them.
+*/
+function withBuildCredentials(stack, credentials) {
+	const services = { ...stack.compose.services };
+	const secrets = { ...stack.compose.secrets };
+	const apps = stack.apps.map((app) => {
+		const own = credentials[app.name];
+		const service = services[app.name];
+		if (!own || !service?.build) return app;
+		const [key, value] = own.buildArg.split("=");
+		services[app.name] = {
+			...service,
+			build: {
+				...service.build,
+				args: {
+					...service.build.args,
+					[key]: value
+				},
+				secrets: [{
+					source: credentialsSecret(app.name),
+					target: "gkm_credentials"
+				}]
+			}
+		};
+		secrets[credentialsSecret(app.name)] = { file: `./${credentialsFile(app.name)}` };
+		return {
+			...app,
+			env: {
+				...app.env,
+				GKM_MASTER_KEY: own.masterKey
+			}
+		};
+	});
+	return {
+		...stack,
+		apps,
+		compose: {
+			...stack.compose,
+			services,
+			...Object.keys(secrets).length ? { secrets } : {}
+		}
+	};
+}
 /** Render an app's env file: one `KEY=value` per line, read raw by compose. */
 function envFile(env) {
 	return `${Object.entries(env).sort(([a], [b]) => a.localeCompare(b)).map(([key, value]) => `${key}=${value}`).join("\n")}\n`;
@@ -789,7 +957,11 @@ var ComposeAppsUnhealthy = class extends Error {
 * - What was started answers (`verify`): each app is asked through Caddy,
 *   over HTTPS, with the certificate verified.
 *
-* Docker, the registry, the bundler, Postgres and the health probe are
+* Every image is built inside Docker from a pruned slice of the build root —
+* the same Dockerfiles `gkm docker` writes — so nothing is built on this
+* machine before `docker compose build`.
+*
+* Docker, the registry, Postgres and the health probe are
 * injected, so the rules are asserted without a daemon; the defaults are the
 * real ones.
 */
@@ -813,28 +985,6 @@ var NoGitRevision = class extends Error {
 		this.name = "NoGitRevision";
 	}
 };
-/** A backend's production bundle did not build. */
-var BundleFailed = class extends Error {
-	app;
-	exitCode;
-	stderr;
-	constructor(app, exitCode, stderr) {
-		super(`Bundling '${app}' for production failed (exit code ${exitCode}).${stderr.trim() ? `\n${stderr.trim().slice(-4e3)}` : ""}\nRun \`gkm build --provider server --production\` in the app's directory to see it again.`);
-		this.app = app;
-		this.exitCode = exitCode;
-		this.stderr = stderr;
-		this.name = "BundleFailed";
-	}
-};
-/** The CLI's own entry, which the bundle step runs, is not where it should be. */
-var CliEntryNotFound = class extends Error {
-	from;
-	constructor(from) {
-		super(`Could not find bin/gkm.mjs above ${from}, which bundling a backend runs. Reinstall @geekmidas/cli.`);
-		this.from = from;
-		this.name = "CliEntryNotFound";
-	}
-};
 /** The commit HEAD is at, short — and `-dirty` when the tree has changes. */
 async function gitRevision(root) {
 	let sha;
@@ -864,48 +1014,15 @@ function edgePorts(env = process.env) {
 		http: read(EDGE_PORT_ENV.http, 80)
 	};
 }
-/** `bin/gkm.mjs` of the CLI that is running. */
-function cliEntry() {
-	const from = dirname(fileURLToPath(import.meta.url));
-	for (let dir = from; dirname(dir) !== dir; dir = dirname(dir)) {
-		const entry = join(dir, "bin", "gkm.mjs");
-		if (existsSync(entry)) return entry;
-	}
-	throw new CliEntryNotFound(from);
-}
-/** A cold production bundle is seconds; a hung one must not hold the lock. */
-const BUNDLE_TIMEOUT_MS = 6e5;
-/**
-* Bundle a backend with the gkm that is running — the same build a deploy
-* makes, so the image holds one file and no dependencies — in the run's
-* sandbox, because the build imports the project's code.
-*/
-async function bundleInSandbox(appRoot, ctx) {
-	const sandbox = activeSandbox() ?? new LocalSandbox({ root: ctx.cwd });
-	const result = await sandbox.exec("node", [
-		cliEntry(),
-		"build",
-		"--provider",
-		"server",
-		"--production"
-	], {
-		cwd: appRoot,
-		env: sandbox.env,
-		timeoutMs: BUNDLE_TIMEOUT_MS,
-		output: ctx.childOutput,
-		signal: ctx.signal
-	});
-	if (result.exitCode !== 0) throw new BundleFailed(appRoot, result.exitCode, result.stderr);
-}
 /**
 * The real ones. Each app is asked for three minutes before it counts as
 * down: a deployed stage's first ACME certificate can take that long.
 */
 const defaultDeps = {
 	docker: dockerCompose,
-	bundle: bundleInSandbox,
 	revision: gitRevision,
 	sql: pgClient,
+	buckets: bucketClient,
 	migrate: migrateDatabases,
 	probe: httpsProbe,
 	healthAttempts: 90,
@@ -928,7 +1045,9 @@ async function validateCompose(ctx, deps, forced) {
 		runnables
 	});
 	const { secrets, generated } = await stageSecrets(ctx, manifest);
-	const stack = composeStack({
+	const masterKeys = {};
+	const layout = mode === "build" ? imageLayout(workspace) : void 0;
+	const composed = composeStack({
 		workspace,
 		manifest,
 		runnables,
@@ -940,10 +1059,29 @@ async function validateCompose(ctx, deps, forced) {
 			...workspace.deploy?.registry ? { registry: workspace.deploy.registry } : {}
 		},
 		secrets,
+		allowDevServices: ctx.allowDevServices,
 		ports: edgePorts(deps.env),
-		packageManager: detectPackageManager(root),
-		packages: Object.fromEntries(Object.entries(workspace.apps).map(([name, app]) => [name, appPackageName(root, name, app.path)]))
+		...layout ? { layout } : {}
 	});
+	reportDevServices(ctx, composed.devServices);
+	const credentials = {};
+	if (mode === "build") for (const app of composed.apps) {
+		if (app.kind !== "rest-api" || !app.env || !app.build) continue;
+		const { encrypted, iv, masterKey } = encryptSecrets(app.env);
+		credentials[app.name] = {
+			encrypted,
+			iv
+		};
+		ctx.secrets.mask(masterKey);
+		masterKeys[app.name] = {
+			masterKey,
+			buildArg: credentialsBuildArg({
+				encrypted,
+				iv
+			})
+		};
+	}
+	const stack = withBuildCredentials(composed, masterKeys);
 	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, stack.apps);
 	const dir = join(root, stackDir(stage));
 	const previous = Object.fromEntries(Object.entries((await ctx.state.read(stage))?.state.releases ?? {}).map(([name, releases]) => {
@@ -969,6 +1107,7 @@ async function validateCompose(ctx, deps, forced) {
 		generated,
 		previous,
 		files: [],
+		credentials,
 		images: {},
 		changes: []
 	};
@@ -1000,7 +1139,7 @@ async function stageSecrets(ctx, manifest) {
 */
 async function planCompose(ctx, run) {
 	if (run.generated.length > 0) ctx.logger.info(`🔑 "${ctx.stage}" has no ${run.generated.join(", ")} yet; this dry run used values it did not keep.`);
-	run.files = await writeStack(ctx.cwd, run.dir, run.stack);
+	run.files = await writeStack(ctx.cwd, run.dir, run.stack, run.credentials);
 	printPlan(ctx, run);
 	const planned = (change) => {
 		run.changes.push(change);
@@ -1044,7 +1183,7 @@ async function provisionCompose(ctx, run, deps) {
 		await ctx.secrets.write(run.secrets);
 		ctx.logger.info(`🔑 Generated for "${ctx.stage}" (${ctx.secrets.store}): ${run.generated.join(", ")}`);
 	}
-	run.files = await writeStack(ctx.cwd, run.dir, stack);
+	run.files = await writeStack(ctx.cwd, run.dir, stack, run.credentials);
 	printPlan(ctx, run);
 	if (stack.infra.length > 0) {
 		ctx.logger.info(`\n🗄️  Starting ${stack.infra.join(", ")}…`);
@@ -1058,6 +1197,20 @@ async function provisionCompose(ctx, run, deps) {
 		});
 	}
 	if (stack.infra.includes("postgres")) await prepareDatabases(ctx, run, deps);
+	if (stack.storage && stack.infra.includes("minio")) await prepareBuckets(ctx, run, deps);
+}
+/**
+* Create each bucket the stack's MinIO serves, and the open paths of each
+* one a file server fronts — from this machine, on MinIO's loopback port,
+* the way `gkm dev` creates them.
+*/
+async function prepareBuckets(ctx, run, deps) {
+	const storage = run.stack.storage;
+	if (storage.buckets.length === 0) return;
+	const port = await deps.docker.port(run.ref, "minio", 9e3);
+	const client = deps.buckets(port, storage);
+	const created = [...await applyBuckets(client, storage.buckets), ...await applyPolicies(client, storage.policies)].filter((entry) => entry.created).length;
+	ctx.logger.info(`🪣  Buckets: ${storage.buckets.join(", ")}${created ? ` (${created} change(s))` : ""}`);
 }
 /** Create what the plan names in the stack's Postgres, then migrate it. */
 async function prepareDatabases(ctx, run, deps) {
@@ -1090,18 +1243,14 @@ async function prepareDatabases(ctx, run, deps) {
 	for (const { target, applied } of runs) if (applied.length > 0) ctx.logger.info(`🗄️  ${target.migrations}: applied ${applied.length}`);
 }
 /**
-* Each app's image: built from this checkout — every backend bundled first,
-* on the host, with this CLI — or pulled at the tag. Nothing live changes.
+* Each app's image: built from this checkout — inside Docker, every one of
+* them, from a pruned slice of the build root — or pulled at the tag. Nothing
+* live changes.
 */
 async function buildCompose(ctx, run, deps) {
 	const { stack, ref } = run;
 	const apps = stack.apps.map((app) => app.name);
 	if (run.mode === "build") {
-		for (const app of stack.apps.filter((a) => a.kind === "rest-api")) {
-			ctx.signal.throwIfAborted();
-			ctx.logger.info(`\n📦 Bundling ${app.name}…`);
-			await deps.bundle(join(ctx.cwd, app.path), ctx);
-		}
 		ctx.logger.info("\n🐳 Building images…");
 		await deps.docker.build(ref, apps);
 	} else {
@@ -1284,7 +1433,7 @@ function applied(ctx, run, change) {
 	});
 }
 /** Write the stack's files: owner-only, since the env files hold secrets. */
-async function writeStack(root, dir, stack) {
+async function writeStack(root, dir, stack, credentials = {}) {
 	await mkdir(dir, {
 		recursive: true,
 		mode: 448
@@ -1300,23 +1449,13 @@ async function writeStack(root, dir, stack) {
 	await write(join(dir, "docker-compose.yml"), composeYaml(stack));
 	await write(join(dir, "Caddyfile"), stack.caddyfile);
 	for (const app of stack.apps) if (app.env) await write(join(dir, `${app.name}.env`), envFile(app.env), 384);
+	for (const [name, payload] of Object.entries(credentials)) await write(join(dir, credentialsFile(name)), credentialsFileContent(payload), 384);
 	for (const [path, content] of Object.entries(stack.dockerfiles)) await write(join(root, path), content);
-	await ignoreStacks(root);
+	await ensureDockerignore(findBuildRoot(root));
 	return files;
 }
-/** Make sure the build context leaves `.gkm/compose` out. */
-async function ignoreStacks(root) {
-	const path = join(root, ".dockerignore");
-	if (!existsSync(path)) {
-		await writeFile(path, generateDockerignore());
-		return;
-	}
-	const current = await readFile(path, "utf-8");
-	if (/^\/?\.gkm\/compose\/?$|^\/?\.gkm\/?$/m.test(current)) return;
-	await appendFile(path, `${current.endsWith("\n") ? "" : "\n"}\n# gkm compose's stacks: each app's env file holds its stage's secrets\n.gkm/compose\n`);
-}
 function composeYaml(stack) {
-	const stage = stack.local ? "" : ` --stage ${stack.stage}`;
+	const stage = ` --stage ${stack.stage}`;
 	return `# Generated by gkm compose from the construct manifest — do not edit.
 # The ${stack.stage} stage's APIs and sites behind one Caddy. Each backend
 # reads exactly the keys in its own env file beside this one.
@@ -1395,4 +1534,4 @@ function composeTarget(options = {}) {
 //#endregion
 export { dockerCompose as a, stackDir as i, compose_exports as n, composeProject as r, composeTarget as t };
 
-//# sourceMappingURL=compose-CNQL8BnO.mjs.map
+//# sourceMappingURL=compose-DFxuYhn6.mjs.map