@geekmidas/cli 10.0.0-alpha.9 → 10.0.0-alpha.91

package/dist/compose-Bhmf0n4o.mjs

@@ -0,0 +1,3140 @@
+import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
+import { c as runOutput, s as run, x as gkmHome } from "./credentials-CnVqoXMb.mjs";
+import { r as discover } from "./discover-BPelzeGW.mjs";
+import { t as appKey } from "./derive-B4vDpzgP.mjs";
+import { B as LOGS_PORT, I as otlpTelemetryEnv, L as resolveStageTelemetry, at as SERVER_IPV6_KEY, it as SERVER_IPV4_KEY, nt as certificateFor, ot as cnameTarget, rt as proxyFor, st as isReservedStageKey, tt as ComposeTlsFileMissing, z as telemetryEnv } from "./workspace-CJ0lKFq-.mjs";
+import { t as defineTarget } from "./define-DR8xGYfL.mjs";
+import { At as applyPolicies, Bt as appEnvKeys, Ct as redisService, Et as withRedisPassword, F as createDnsProvider, Gt as localRolePassword, Ht as networkEnv, It as LEGACY_LOCAL_LOGIN, Jn as initStageSecrets, Jt as TURBO_VERSION, Kt as composeBuildPaths, Lt as ensurePostgresLogin, Mt as bucketPolicies, O as recordRelease, P as DnsRecordsUnreadable, Pt as postgresStatements, Q as devServicesUsed, Rt as bucketClient, S as normalizeDnsConfig, Sn as primaryPortKey, St as STACK_CACHE, T as createEmptyState, Tt as stackRedis, Un as imageRef, Ut as workerEnvKeys, Wt as envFor, Yt as WORKER_PORT, Z as assertExternalServices, Zt as findBuildRoot, _ as workerDockerfile, _n as DEFAULT_IMAGES, _t as loadLocalCredentials, an as composeFor, ar as NoDomainForStage, b as extractSubdomain, bn as portKeys, bt as withGeneratedSecrets, cn as planFor, d as stageProviderNotes, er as LOGS_SERVICE, fn as isTelemetryKey, ft as constructGlobs, g as ensureDockerignore, gn as usesTelemetry, gt as LOCAL_RABBITMQ_USER, hn as telemetryOf, i as assertNoStaleSecrets, ir as withLogsPassword, it as workerUnits, jt as applyPostgres, kt as applyBuckets, l as assertStageProvidersEnabled, m as appDockerfile, n as reportDatabaseRuns, nr as logsService, o as verifyStageProviders, on as EMULATOR_ACCESS_KEY_ID, or as isMainFrontendApp, pn as scopeTelemetryEnv, qt as imageLayout, r as reportPlannedSeeds, rr as stackLogs, rt as suppliedOnly, s as DeployJournal, sr as resolveHost, t as DeploySeedsFailed, tr as logsAccess, tt as reportDevServices, un as hostFor, vt as postgresSuperuser, wt as runsRedis, x as findRootDomain, xt as REDIS_SERVICE, y as validateImageRef, zt as pgClient } from "./seeds-odfgSCmu.mjs";
+import { i as DEFAULT_EVENTS } from "./SubscriberGenerator-BPqQf8fB.mjs";
+import { i as installedFrom } from "./drivers-DTZzxeIl.mjs";
+import { f as plannedSeeds, o as SeedFailed, p as seedDatabases, u as migrateDatabases } from "./databases-CzszQV0N.mjs";
+import { n as assertStageCredentials } from "./credentialSchemas-BJqRJNK4.mjs";
+import { dirname, join } from "node:path";
+import { existsSync } from "node:fs";
+import { chmod, copyFile, mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
+import { hostname, userInfo } from "node:os";
+import { CLIENT_IP_HEADER, provideKey, provisionOrder, publicEnvFor } from "@geekmidas/manifest";
+import { isIPv4, isIPv6 } from "node:net";
+import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import { stringify } from "yaml";
+import { lookup } from "node:dns/promises";
+import { request } from "node:https";
+//#region src/compose/dns.ts
+/**
+* A compose stage's DNS: the records its public hosts need, and the check that
+* they resolve to its server before a certificate is asked for.
+*
+* - **The server** (`serverAddress`): the stage's own secrets hold its public
+*   addresses — `GKM_SERVER_IPV4`, and `GKM_SERVER_IPV6` where it has one.
+*   Reserved for gkm: never handed to an app.
+* - **The plan** (`planStackDns`, pure): every public host the stack serves —
+*   its apex, each app, each file server, the public log UI — pointed at the
+*   server. An A record per host (and an AAAA with an IPv6 address), or, where
+*   the domain's `dns` entry says `records: { mode: 'cname', target }`, one A
+*   record for the target and a CNAME to it for every other host but the
+*   apex, which DNS forbids a CNAME at.
+* - **Applying it** (`applyStackDns`): through the domain's provider in `dns`,
+*   a record set at a time. A record with the right value is left alone; one
+*   with another value is replaced and the change printed. A `manual` domain
+*   is printed and nothing else. A dry run reads, prints and writes nothing.
+* - **The check** (`checkStackDns`): each host resolved with the system
+*   resolver. One that is not the server stops the deploy with
+*   {@link HostNotPointingAtServer}, before Caddy or Traefik ask Let's Encrypt
+*   for a certificate it cannot get — and use up the rate limit trying.
+*/
+/** The line that says how to set the server's address. */
+function serverAddressHint(stage) {
+	return `gkm secrets:set ${SERVER_IPV4_KEY} '<ip>' --stage ${stage}`;
+}
+/** A server address in the stage's secrets that is not an address. */
+var ServerAddressInvalid = class extends Error {
+	stage;
+	key;
+	value;
+	constructor(stage, key, value) {
+		const ipv4 = key === SERVER_IPV4_KEY;
+		super(`${key} in the '${stage}' stage's secrets is ${JSON.stringify(value)}, which is not an ${ipv4 ? "IPv4 address (like 203.0.113.10)" : "IPv6 address (like 2001:db8::10)"}. Set the server's public address: gkm secrets:set ${key} '<ip>' --stage ${stage}.`);
+		this.stage = stage;
+		this.key = key;
+		this.value = value;
+		this.name = "ServerAddressInvalid";
+	}
+};
+/**
+* A compose stage that serves real domains with no server address: its hosts
+* cannot be pointed or checked, and a certificate would be asked for blind.
+*/
+var ServerAddressMissing = class extends Error {
+	stage;
+	domain;
+	constructor(stage, domain) {
+		super(`The '${stage}' stage serves ${domain} and its secrets hold no ${SERVER_IPV4_KEY} — the public address of the server its stack runs on, which its hosts' DNS records point at and every deploy checks before asking for certificates. Set it: ${serverAddressHint(stage)} (and ${SERVER_IPV6_KEY} for an IPv6 address).`);
+		this.stage = stage;
+		this.domain = domain;
+		this.name = "ServerAddressMissing";
+	}
+};
+/**
+* The server's address from the stage's secrets, checked — `undefined` when
+* `GKM_SERVER_IPV4` is not set.
+*
+* @throws {ServerAddressInvalid} for a value that is not an address
+*/
+function serverAddress(stage, custom) {
+	const ipv4 = custom?.[SERVER_IPV4_KEY]?.trim();
+	const ipv6 = custom?.[SERVER_IPV6_KEY]?.trim();
+	if (ipv6 && !isIPv6(ipv6)) throw new ServerAddressInvalid(stage, SERVER_IPV6_KEY, ipv6);
+	if (!ipv4) return void 0;
+	if (!isIPv4(ipv4)) throw new ServerAddressInvalid(stage, SERVER_IPV4_KEY, ipv4);
+	return {
+		ipv4,
+		...ipv6 ? { ipv6 } : {}
+	};
+}
+/**
+* A name that resolves to this machine by definition — `localhost` and every
+* `*.localhost` — and is in nobody's DNS.
+*/
+function isLocalHost(host) {
+	const name = host.toLowerCase().replace(/\.$/, "");
+	return name === "localhost" || name.endsWith(".localhost");
+}
+/**
+* The server's address, required where the stage serves real domains — not
+* `*.localhost` ones, which point at this machine already.
+*
+* @throws {ServerAddressMissing} when the stage has a domain and no address
+* @throws {ServerAddressInvalid} for a value that is not an address
+*/
+function requiredServerAddress(stage, domain, custom) {
+	const server = serverAddress(stage, custom);
+	if (!server && domain && !isLocalHost(domain)) throw new ServerAddressMissing(stage, domain);
+	return server;
+}
+const MANAGED = [
+	"A",
+	"AAAA",
+	"CNAME"
+];
+/** Every public host the stack serves, once each, sorted. */
+function stackHosts(stack) {
+	return [...new Set(stack.routes.map((route) => route.host))].sort();
+}
+/** The TTL a domain's records are written with. */
+function recordTtl(config) {
+	const ttl = "ttl" in config ? config.ttl : void 0;
+	if (ttl) return ttl;
+	return config.provider === "godaddy" ? 600 : 300;
+}
+function providerName(config) {
+	return typeof config.provider === "string" ? config.provider : "custom";
+}
+/** The records a stage's hosts need — pure. */
+function planStackDns(input) {
+	const { stage, server } = input;
+	const dns = input.dns ? normalizeDnsConfig(input.dns) : {};
+	const records = /* @__PURE__ */ new Map();
+	const uncovered = [];
+	const add = (host, domain, type, value) => {
+		const name = extractSubdomain(host, domain);
+		records.set(`${domain} ${name} ${type}`, {
+			host,
+			domain,
+			name,
+			type,
+			value,
+			ttl: recordTtl(dns[domain])
+		});
+	};
+	const pointAt = (host, domain) => {
+		add(host, domain, "A", server.ipv4);
+		if (server.ipv6) add(host, domain, "AAAA", server.ipv6);
+	};
+	for (const raw of input.hosts) {
+		const host = raw.toLowerCase();
+		const domain = findRootDomain(host, dns);
+		if (!domain) {
+			uncovered.push(host);
+			continue;
+		}
+		const target = cnameTarget(dns[domain].records, stage);
+		if (target) pointAt(target, domain);
+		if (target && host !== domain && host !== target) add(host, domain, "CNAME", target);
+		else pointAt(host, domain);
+	}
+	const domains = /* @__PURE__ */ new Map();
+	for (const record of [...records.values()].sort((a, b) => a.domain.localeCompare(b.domain) || a.name.localeCompare(b.name) || a.type.localeCompare(b.type))) {
+		const config = dns[record.domain];
+		const plan = domains.get(record.domain) ?? {
+			domain: record.domain,
+			provider: providerName(config),
+			config,
+			records: []
+		};
+		plan.records.push(record);
+		domains.set(record.domain, plan);
+	}
+	return {
+		stage,
+		server,
+		domains: [...domains.values()],
+		uncovered: uncovered.sort()
+	};
+}
+/** `api.example.com  A  203.0.113.10  (TTL 600)` */
+function describe(record) {
+	return `${record.host.padEnd(32)} ${record.type.padEnd(5)} ${record.value}  (TTL ${record.ttl})`;
+}
+function printManual(plan, log, why) {
+	log(`   ${plan.domain}: ${why} — create these records at its DNS host:`);
+	for (const record of plan.records) log(`     ${describe(record)}`);
+	return plan.records.map((r) => ({
+		domain: r.domain,
+		name: r.name,
+		type: r.type,
+		action: "manual",
+		value: r.value,
+		ttl: r.ttl
+	}));
+}
+/** The existing records of every planned name, for the types gkm manages. */
+async function existingRecords(provider, plan) {
+	const names = [...new Set(plan.records.map((r) => r.name))];
+	const wanted = names.flatMap((name) => MANAGED.map((type) => ({
+		name,
+		type
+	})));
+	if (provider.readRecords) return provider.readRecords(plan.domain, wanted);
+	return (await provider.getRecords(plan.domain)).filter((r) => names.includes(r.name) && MANAGED.includes(r.type));
+}
+const same = (a, b) => a.trim().replace(/\.$/, "").toLowerCase() === b.trim().replace(/\.$/, "").toLowerCase();
+/**
+* What each domain's records need, compared with what is there: creates,
+* updates, and the deletes a change of mode needs — a name moving from an A
+* record to a CNAME, or back, cannot hold both. Nothing else is deleted.
+*/
+function diffDomainDns(plan, existing) {
+	const changes = [];
+	const find = (name, type) => existing.find((r) => r.name === name && r.type === type);
+	const planned = /* @__PURE__ */ new Map();
+	for (const record of plan.records) {
+		const types = planned.get(record.name) ?? /* @__PURE__ */ new Set();
+		types.add(record.type);
+		planned.set(record.name, types);
+	}
+	for (const [name, types] of planned) {
+		const conflicting = types.has("CNAME") ? ["A", "AAAA"] : ["CNAME"];
+		for (const type of conflicting) {
+			const found = find(name, type);
+			if (!found || found.values.length === 0) continue;
+			changes.push({
+				domain: plan.domain,
+				name,
+				type,
+				action: "delete",
+				previous: found.values.join(", ")
+			});
+		}
+	}
+	for (const record of plan.records) {
+		const found = find(record.name, record.type);
+		const base = {
+			domain: plan.domain,
+			name: record.name,
+			type: record.type,
+			value: record.value,
+			ttl: record.ttl
+		};
+		if (!found || found.values.length === 0) changes.push({
+			...base,
+			action: "create"
+		});
+		else if (found.values.length === 1 && same(found.values[0], record.value)) changes.push({
+			...base,
+			action: "unchanged"
+		});
+		else changes.push({
+			...base,
+			action: "update",
+			previous: found.values.join(", ")
+		});
+	}
+	return changes;
+}
+/** A host's full name from a domain and a relative name. */
+function fullName(domain, name) {
+	return name === "@" ? domain : `${name}.${domain}`;
+}
+function printChange(change, dryRun, log) {
+	const host = fullName(change.domain, change.name).padEnd(32);
+	const type = change.type.padEnd(5);
+	const would = dryRun ? "would " : "";
+	switch (change.action) {
+		case "unchanged":
+			log(`   ✓ ${host} ${type} ${change.value}  (TTL ${change.ttl}) — up to date`);
+			break;
+		case "create":
+			log(`   + ${host} ${type} ${change.value}  (TTL ${change.ttl}) — ${would}create`);
+			break;
+		case "update":
+			log(`   ~ ${host} ${type} ${change.previous} → ${change.value}  (TTL ${change.ttl}) — ${would}update`);
+			break;
+		case "write":
+			log(dryRun ? `   ? ${host} ${type} ${change.value}  (TTL ${change.ttl}) — would write; current value unknown (key cannot read DNS)` : `   ! ${host} ${type} ${change.value}  (TTL ${change.ttl}) — written (not diffed)`);
+			break;
+		case "delete": log(`   - ${host} ${type} ${change.previous} — ${would}delete (a name cannot hold a CNAME and an A record)`);
+	}
+}
+/**
+* Each domain's records, through its provider. Returns every change, the
+* unchanged included; a dry run makes none of them.
+*/
+async function applyStackDns(plan, options = {}) {
+	const dryRun = options.dryRun === true;
+	const log = options.log ?? ((line) => console.log(line));
+	const providerFor = options.providerFor ?? ((config) => createDnsProvider({
+		config,
+		...options.credentials ? { godaddy: options.credentials } : {}
+	}));
+	const changes = [];
+	for (const host of plan.uncovered) log(`   ⚠ ${host} is under no domain in dns — point it at ${plan.server.ipv4} yourself`);
+	for (const domain of plan.domains) {
+		if (domain.provider === "manual") {
+			changes.push(...printManual(domain, log, "manual"));
+			continue;
+		}
+		const provider = await providerFor(domain.config);
+		if (!provider) {
+			changes.push(...printManual(domain, log, "manual"));
+			continue;
+		}
+		log(`   ${domain.domain} (${provider.name})${dryRun ? " — dry run" : ""}`);
+		let existing;
+		let diff;
+		try {
+			existing = await existingRecords(provider, domain);
+			diff = diffDomainDns(domain, existing);
+		} catch (error) {
+			if (!(error instanceof DnsRecordsUnreadable)) throw error;
+			log(`   ℹ The ${provider.name} key cannot read ${domain.domain}'s DNS records, so changes cannot be diffed: every record is written (idempotent).`);
+			existing = [];
+			diff = domain.records.map((r) => ({
+				domain: r.domain,
+				name: r.name,
+				type: r.type,
+				action: "write",
+				value: r.value,
+				ttl: r.ttl
+			}));
+		}
+		for (const change of diff) printChange(change, dryRun, log);
+		if (!plan.server.ipv6) for (const name of new Set(domain.records.map((r) => r.name))) {
+			const aaaa = existing.find((r) => r.name === name && r.type === "AAAA");
+			const planned = domain.records.find((r) => r.name === name && r.type === "A");
+			if (aaaa && planned && aaaa.values.length > 0) log(`   ⚠ ${fullName(domain.domain, name)} also has AAAA ${aaaa.values.join(", ")}: set ${SERVER_IPV6_KEY} in the '${plan.stage}' stage's secrets to the server's IPv6 address, or remove that record, or IPv6 clients go elsewhere`);
+		}
+		changes.push(...diff);
+		if (dryRun) continue;
+		const deletes = diff.filter((c) => c.action === "delete");
+		if (deletes.length > 0) await provider.deleteRecords(domain.domain, deletes.map((c) => ({
+			name: c.name,
+			type: c.type
+		})));
+		const writes = diff.filter((c) => c.action === "create" || c.action === "update" || c.action === "write");
+		if (writes.length > 0) await provider.upsertRecords(domain.domain, writes.map((c) => ({
+			name: c.name,
+			type: c.type,
+			value: c.value,
+			ttl: c.ttl
+		})));
+	}
+	return changes;
+}
+/** The system resolver: what the server's own clients would be told. */
+const systemLookup = async (host) => {
+	return (await lookup(host, { all: true })).map((a) => a.address);
+};
+/** Hosts that do not resolve to the stage's server. */
+var HostNotPointingAtServer = class extends Error {
+	stage;
+	hosts;
+	expected;
+	fix;
+	constructor(stage, hosts, expected, fix) {
+		const want = expected.ipv6 ? `${expected.ipv4} (and ${expected.ipv6})` : expected.ipv4;
+		const lines = hosts.map((h) => `  - ${h.host} → ${h.resolved.length > 0 ? h.resolved.join(", ") : `nothing${h.error ? ` (${h.error})` : ""}`}, expected ${want}`);
+		super(`${hosts.length === 1 ? "A host" : `${hosts.length} hosts`} of '${stage}' do${hosts.length === 1 ? "es" : ""} not resolve to its server, so a certificate for ${hosts.length === 1 ? "it" : "them"} cannot be issued:\n${lines.join("\n")}\n${fix}\nRecords can take a few minutes to propagate. With a CDN or proxy in front of the server, pass --skip-dns-check.`);
+		this.stage = stage;
+		this.hosts = hosts;
+		this.expected = expected;
+		this.fix = fix;
+		this.name = "HostNotPointingAtServer";
+	}
+};
+/**
+* Every host resolved: each must resolve to the server's IPv4 address and to
+* nothing but the server's addresses.
+*
+* @throws {HostNotPointingAtServer} naming every host that does not
+*/
+async function checkStackDns(input) {
+	const lookup = input.lookup ?? systemLookup;
+	const { server } = input;
+	const ours = new Set([server.ipv4, server.ipv6].filter(Boolean).map((a) => a.toLowerCase()));
+	const bad = [];
+	const ok = [];
+	for (const host of input.hosts) {
+		let resolved;
+		try {
+			resolved = [...new Set(await lookup(host))];
+		} catch (error) {
+			const code = error && typeof error === "object" && "code" in error ? String(error.code) : error instanceof Error ? error.message : String(error);
+			bad.push({
+				host,
+				resolved: [],
+				error: code
+			});
+			continue;
+		}
+		if (resolved.some((a) => a.toLowerCase() === server.ipv4.toLowerCase()) && resolved.every((a) => ours.has(a.toLowerCase()))) ok.push(host);
+		else bad.push({
+			host,
+			resolved
+		});
+	}
+	if (bad.length > 0) throw new HostNotPointingAtServer(input.stage, bad, {
+		ipv4: server.ipv4,
+		...server.ipv6 ? { ipv6: server.ipv6 } : {}
+	}, dnsFix(input, bad));
+	return ok;
+}
+/** How to fix it: `gkm setup`, or the records to create by hand. */
+function dnsFix(input, bad) {
+	const hosts = bad.map((h) => h.host);
+	let plan;
+	try {
+		plan = planStackDns({
+			stage: input.stage,
+			hosts,
+			server: input.server,
+			dns: input.dns
+		});
+	} catch {
+		plan = {
+			stage: input.stage,
+			server: input.server,
+			domains: [],
+			uncovered: hosts
+		};
+	}
+	const automatic = plan.domains.filter((d) => d.provider !== "manual");
+	const byHand = [...plan.domains.filter((d) => d.provider === "manual").flatMap((d) => d.records.map(describe)), ...plan.uncovered.flatMap((host) => [`${host.padEnd(32)} A     ${input.server.ipv4}`, ...input.server.ipv6 ? [`${host.padEnd(32)} AAAA  ${input.server.ipv6}`] : []])];
+	const lines = [];
+	if (automatic.length > 0) lines.push(`Fix: gkm setup --stage ${input.stage} writes the records for ${automatic.map((d) => d.domain).join(", ")} (gkm setup --stage ${input.stage} --dry-run shows them first).`);
+	if (byHand.length > 0) lines.push(`${automatic.length > 0 ? "And create" : "Fix: create"} these records at the DNS host:`, ...byHand.map((line) => `    ${line}`));
+	return lines.join("\n");
+}
+//#endregion
+//#region src/compose/docker.ts
+/**
+* The Docker operations `gkm compose` needs, behind an interface.
+*
+* Small on purpose, like reconcile's: the rules about *when* each runs — the
+* registry is asked before anything is pulled, nothing is started for a tag
+* that is missing — are asserted against a fake, and this file is only the
+* wiring to the real CLI.
+*
+* Every call is an argument array. Image refs, tags and paths come from the
+* workspace, and none of them reaches a shell.
+*/
+/** `output` as `spawn` reads it. */
+const STDIO = {
+	inherit: "inherit",
+	stderr: [
+		"ignore",
+		2,
+		2
+	],
+	ignore: "ignore"
+};
+/** How a stack's docker commands run: where it is, where output goes. */
+function runOptions(stack, env) {
+	return {
+		cwd: stack.cwd,
+		stdio: STDIO[stack.output ?? "inherit"],
+		...env ? { env } : {},
+		...stack.signal ? { signal: stack.signal } : {}
+	};
+}
+/**
+* The host ports a `docker ps` Ports column publishes: `0.0.0.0:443->443/tcp,
+* [::]:443->443/tcp, 0.0.0.0:9000-9001->9000-9001/tcp`.
+*/
+function publishedPorts(column) {
+	const ports = /* @__PURE__ */ new Set();
+	for (const match of column.matchAll(/(?:[\d.]+|\[[^\]]*\]):(\d+)(?:-(\d+))?->/g)) {
+		const first = Number(match[1]);
+		const last = match[2] ? Number(match[2]) : first;
+		for (let port = first; port <= last; port++) ports.add(port);
+	}
+	return [...ports];
+}
+/** Each line `docker ps` printed, as the containers holding `port`. */
+function portHolders(output, port) {
+	return output.split("\n").filter(Boolean).map((line) => line.split("	")).filter(([, , , column = ""]) => publishedPorts(column).includes(port)).map(([container = "", project, service]) => ({
+		container,
+		...project ? { project } : {},
+		...service ? { service } : {}
+	}));
+}
+/** How long a stack has to pass its health checks. */
+const WAIT_TIMEOUT_S = 180;
+/** `docker compose port` printed nothing a port can be read from. */
+var ServicePortUnknown = class extends Error {
+	service;
+	inside;
+	output;
+	constructor(service, inside, output) {
+		super(`'${service}' publishes no host port for ${inside} (docker said: ${output.trim() || "nothing"}). Is it running? \`docker compose ps\` shows the stack.`);
+		this.service = service;
+		this.inside = inside;
+		this.output = output;
+		this.name = "ServicePortUnknown";
+	}
+};
+/**
+* Whether `ref` names a registry on this machine's loopback — which the
+* daemon pulls from and pushes to over plain HTTP by default, and `docker
+* manifest inspect` reaches only when told `--insecure` (without it, a local
+* registry's image is reported as no such manifest).
+*/
+function isLoopbackRegistry(ref) {
+	const first = ref.split("/")[0];
+	if (!ref.includes("/") || !/[.:]|^localhost$/.test(first)) return false;
+	const host = first.replace(/:\d+$/, "");
+	return host === "localhost" || /^127(?:\.\d{1,3}){3}$/.test(host);
+}
+/** `docker push` finished without saying what digest the registry stored. */
+var PushDigestUnknown = class extends Error {
+	ref;
+	output;
+	constructor(ref, output) {
+		super(`Pushed ${ref}, but docker did not say which digest the registry stored (it said: ${output.trim().split("\n").slice(-3).join(" / ") || "nothing"}). Check the push with \`docker buildx imagetools inspect ${ref}\`.`);
+		this.ref = ref;
+		this.output = output;
+		this.name = "PushDigestUnknown";
+	}
+};
+/** The digest `docker push` reports last: `<tag>: digest: sha256:… size: …`. */
+function pushedDigest(output) {
+	return [...output.matchAll(/digest: (sha256:[0-9a-f]{64})/g)].at(-1)?.[1];
+}
+function compose(stack, args) {
+	return [
+		"compose",
+		"-p",
+		stack.project,
+		"-f",
+		stack.file,
+		...(stack.overrides ?? []).flatMap((file) => ["-f", file]),
+		...args
+	];
+}
+/** Run a program and keep everything it said, whatever it exits with. */
+function capture(command, args, timeoutMs = 6e4) {
+	return new Promise((resolve, reject) => {
+		const child = spawn(command, [...args], {
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			shell: false
+		});
+		let stdout = "";
+		let stderr = "";
+		child.stdout.on("data", (chunk) => {
+			stdout += chunk.toString();
+		});
+		child.stderr.on("data", (chunk) => {
+			stderr += chunk.toString();
+		});
+		const timer = setTimeout(() => child.kill("SIGKILL"), timeoutMs);
+		timer.unref?.();
+		child.on("error", (error) => {
+			clearTimeout(timer);
+			reject(error);
+		});
+		child.on("close", (code) => {
+			clearTimeout(timer);
+			resolve({
+				code,
+				stdout,
+				stderr
+			});
+		});
+	});
+}
+/**
+* Whether a failed `docker manifest inspect` means the tag is not there, as
+* opposed to the registry not answering.
+*
+* Read off the message because that is all the CLI gives. Anything not
+* recognisably "no such tag" is treated as the registry being unreachable:
+* a registry that refused credentials must not be reported as a tag that was
+* never pushed, or the fix offered would be the wrong one.
+*/
+function isMissingManifest(output) {
+	return /no such manifest|manifest unknown|manifest for .* not found|not found: manifest/i.test(output);
+}
+const dockerCompose = {
+	async lookup(ref) {
+		const { code, stdout, stderr } = await capture("docker", [
+			"manifest",
+			"inspect",
+			...isLoopbackRegistry(ref) ? ["--insecure"] : [],
+			ref
+		]);
+		if (code === 0) return {
+			ref,
+			status: "found"
+		};
+		const output = `${stderr}\n${stdout}`.trim();
+		return isMissingManifest(output) ? {
+			ref,
+			status: "missing"
+		} : {
+			ref,
+			status: "unreachable",
+			detail: output
+		};
+	},
+	async build(stack, services) {
+		await run("docker", compose(stack, ["build", ...services]), runOptions(stack, {
+			...process.env,
+			DOCKER_BUILDKIT: "1"
+		}));
+	},
+	async pull(stack, services) {
+		await run("docker", compose(stack, ["pull", ...services]), runOptions(stack));
+	},
+	async up(stack, services) {
+		await run("docker", compose(stack, [
+			"up",
+			"-d",
+			"--wait",
+			`--wait-timeout=${WAIT_TIMEOUT_S}`,
+			...services ? [] : ["--remove-orphans"],
+			...services ?? []
+		]), runOptions(stack));
+	},
+	async down(stack) {
+		await run("docker", compose(stack, ["down"]), runOptions(stack));
+	},
+	async port(stack, service, inside) {
+		const output = await runOutput("docker", compose(stack, [
+			"port",
+			service,
+			String(inside)
+		]), {
+			cwd: stack.cwd,
+			...stack.signal ? { signal: stack.signal } : {}
+		});
+		const port = Number(output.trim().split(":").pop());
+		if (!Number.isInteger(port) || port <= 0) throw new ServicePortUnknown(service, inside, output);
+		return port;
+	},
+	async health(stack, service) {
+		const { code, stdout } = await capture("docker", [...compose(stack, [
+			"ps",
+			"--format",
+			"{{.Health}}",
+			service
+		])]);
+		if (code !== 0) return void 0;
+		return stdout.trim().split("\n")[0] || void 0;
+	},
+	async copyOut(stack, service, from, to) {
+		await mkdir(dirname(to), { recursive: true });
+		await run("docker", compose(stack, [
+			"cp",
+			`${service}:${from}`,
+			to
+		]), runOptions(stack));
+	},
+	async push(stack, ref) {
+		const output = await runOutput("docker", ["push", ref], {
+			cwd: stack.cwd,
+			...stack.signal ? { signal: stack.signal } : {}
+		});
+		const digest = pushedDigest(output);
+		if (!digest) throw new PushDigestUnknown(ref, output);
+		return digest;
+	},
+	async digest(ref) {
+		const { code, stdout } = await capture("docker", [
+			"image",
+			"inspect",
+			"--format={{json .RepoDigests}} {{.Id}}",
+			ref
+		]);
+		if (code !== 0) return void 0;
+		const [json = "[]", id] = stdout.trim().split(" ");
+		const repository = ref.split("@")[0].replace(/:[\w][\w.-]*$/, "");
+		try {
+			const digests = JSON.parse(json);
+			const match = Array.isArray(digests) ? digests.find((entry) => typeof entry === "string" && entry.startsWith(`${repository}@`)) : void 0;
+			if (match) return match.slice(repository.length + 1);
+		} catch {}
+		return id || void 0;
+	},
+	async ensureNetwork(name) {
+		const { code } = await capture("docker", [
+			"network",
+			"inspect",
+			name
+		]);
+		if (code === 0) return;
+		const created = await capture("docker", [
+			"network",
+			"create",
+			name
+		]);
+		if (created.code !== 0 && !/already exists/.test(created.stderr)) throw new NetworkCreateFailed(name, created.stderr);
+	},
+	async publishers(port) {
+		const { stdout } = await capture("docker", [
+			"ps",
+			"--format",
+			"{{.Names}}	{{.Label \"com.docker.compose.project\"}}	{{.Label \"com.docker.compose.service\"}}	{{.Ports}}"
+		]);
+		return portHolders(stdout, port);
+	}
+};
+/** `docker network create` failed. */
+var NetworkCreateFailed = class extends Error {
+	network;
+	output;
+	constructor(network, output) {
+		super(`Could not create the Docker network '${network}' (docker said: ${output.trim() || "nothing"}). Create it by hand with \`docker network create ${network}\` and run again.`);
+		this.network = network;
+		this.output = output;
+		this.name = "NetworkCreateFailed";
+	}
+};
+//#endregion
+//#region src/compose/traefik.ts
+/**
+* The server's shared edge, rendered for Traefik: what the edge itself runs
+* with, and what one stack registers with it.
+*
+* One Traefik per server owns 80 and 443, the ACME state and the redirect to
+* HTTPS. It is configured through its file provider alone: each stack writes
+* one file — its routers, services and middlewares, every name prefixed with
+* its compose project — into a directory the edge watches, and removes it
+* when it stops. There is no Docker socket: the edge never learns what runs
+* on the server except from those files.
+*
+* The edge and the stacks meet on one external Docker network. Only a
+* stack's public services join it, each under an alias prefixed with its
+* project (`<project>-api`), because the network is shared: a bare service
+* name there would be answered by every stack's `api`.
+*
+* Pure: the documents are data, and the edge's side effects are `edge.ts`'s.
+*/
+/**
+* The image, pinned: the edge is every stack's way in, so a new version is a
+* change to this line, not whatever `latest` is on the day a server starts.
+*/
+const TRAEFIK_IMAGE = "traefik:v3.7.13";
+/** The edge's compose project, one per server. */
+const EDGE_PROJECT = "gkm-edge";
+/** The external network the edge and every stack's public services share. */
+const EDGE_NETWORK = "gkm-edge";
+/** The edge's compose service. */
+const EDGE_SERVICE = "traefik";
+/** Inside the edge's container: what it watches, and where certificates are. */
+const EDGE_DYNAMIC_DIR = "/etc/gkm-edge/dynamic";
+const EDGE_CERTS_DIR = "/etc/gkm-edge/certs";
+/** The certificate resolver every deployed route without its own certificate uses. */
+const ACME_RESOLVER = "letsencrypt";
+/** The internal entrypoint the edge's health check asks; never published. */
+const PING_PORT = 8082;
+/** A stack's service, as the edge — and the stack itself — reach it. */
+function edgeAlias(project, service) {
+	return `${project}-${service}`;
+}
+/** A stack's certificate, as the edge's container reads it. */
+function edgeCertificatePaths(project) {
+	return {
+		certFile: `${EDGE_CERTS_DIR}/${project}.crt`,
+		keyFile: `${EDGE_CERTS_DIR}/${project}.key`
+	};
+}
+/**
+* The edge's static configuration: the entrypoints, the redirect, ACME, and
+* the directory it watches. No API and no dashboard — nothing about the edge
+* is reachable but the routes stacks register.
+*/
+function traefikStatic(ports) {
+	return {
+		global: {
+			checkNewVersion: false,
+			sendAnonymousUsage: false
+		},
+		entryPoints: {
+			web: {
+				address: ":80",
+				http: { redirections: { entryPoint: {
+					to: ports.https === 443 ? "websecure" : `:${ports.https}`,
+					scheme: "https",
+					permanent: true
+				} } }
+			},
+			websecure: { address: ":443" },
+			ping: { address: `:${PING_PORT}` }
+		},
+		ping: { entryPoint: "ping" },
+		providers: { file: {
+			directory: EDGE_DYNAMIC_DIR,
+			watch: true
+		} },
+		certificatesResolvers: { [ACME_RESOLVER]: { acme: {
+			storage: "/acme/acme.json",
+			httpChallenge: { entryPoint: "web" }
+		} } },
+		log: { level: "INFO" }
+	};
+}
+/** The edge's compose document. */
+function edgeCompose(options) {
+	const { dir, ports } = options;
+	return {
+		name: EDGE_PROJECT,
+		services: { [EDGE_SERVICE]: {
+			image: TRAEFIK_IMAGE,
+			restart: "unless-stopped",
+			ports: [`${ports.https}:443`, `${ports.http}:80`],
+			volumes: [
+				`${dir}/traefik.yml:/etc/traefik/traefik.yml:ro`,
+				`${dir}/dynamic:${EDGE_DYNAMIC_DIR}:ro`,
+				`${dir}/certs:${EDGE_CERTS_DIR}:ro`,
+				"acme:/acme"
+			],
+			labels: { "dev.geekmidas.edge.config": createHash("sha256").update(options.staticConfig).digest("hex").slice(0, 16) },
+			networks: ["edge"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"traefik",
+					"healthcheck",
+					"--ping"
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5
+			},
+			logging: options.logging
+		} },
+		volumes: { acme: {} },
+		networks: { edge: {
+			name: EDGE_NETWORK,
+			external: true
+		} }
+	};
+}
+/** A stack's dynamic configuration, as an object. */
+function traefikDynamic(routes, options) {
+	const { project, tls } = options;
+	const name = (route, suffix) => `${project}-${route.name}${suffix ? `-${suffix}` : ""}`;
+	const url = ({ service, port }) => `http://${edgeAlias(project, service)}:${port}`;
+	const routers = {};
+	const services = {};
+	const middlewares = {};
+	const strip = `${project}-strip-gkm-headers`;
+	if (routes.length > 0) middlewares[strip] = { headers: { customRequestHeaders: { [CLIENT_IP_HEADER]: "" } } };
+	for (const route of routes) {
+		const chain = [strip];
+		if (route.allow) {
+			middlewares[name(route, "allow")] = { ipAllowList: { sourceRange: [...route.allow] } };
+			chain.push(name(route, "allow"));
+		}
+		if (route.prefix) {
+			middlewares[name(route, "prefix")] = { addPrefix: { prefix: route.prefix } };
+			chain.push(name(route, "prefix"));
+		}
+		routers[name(route)] = {
+			rule: `Host(\`${route.host}\`)`,
+			entryPoints: ["websecure"],
+			service: name(route),
+			middlewares: chain,
+			tls: tls.kind === "acme" ? { certResolver: ACME_RESOLVER } : {}
+		};
+		services[name(route)] = { loadBalancer: {
+			servers: route.upstreams.map((upstream) => ({ url: url(upstream) })),
+			...route.prefix ? { passHostHeader: false } : {},
+			...route.streaming ? { responseForwarding: { flushInterval: "-1ms" } } : {},
+			...route.health ? { healthCheck: {
+				path: route.health,
+				interval: "5s",
+				timeout: "3s"
+			} } : {}
+		} };
+	}
+	return {
+		http: {
+			routers,
+			services,
+			...Object.keys(middlewares).length > 0 ? { middlewares } : {}
+		},
+		...tls.kind === "files" ? { tls: { certificates: [{
+			certFile: tls.certFile,
+			keyFile: tls.keyFile
+		}] } } : {}
+	};
+}
+/** A stack's dynamic configuration file, as written to the edge's directory. */
+function traefikDynamicFile(routes, options) {
+	return `# Generated by gkm compose for ${options.project} — do not edit.
+# The shared edge (${EDGE_PROJECT}) reads every file in this directory; this
+# one is removed by gkm compose --down.
+${yaml(traefikDynamic(routes, options))}`;
+}
+/** The edge's static configuration file. */
+function traefikStaticFile(ports) {
+	return `# Generated by gkm compose — the server's shared edge. Do not edit.
+${yaml(traefikStatic(ports))}`;
+}
+/** The edge's compose file. */
+function edgeComposeFile(options) {
+	return `# Generated by gkm compose — the server's shared edge. Do not edit.
+#
+# Started by the first stack that runs with proxy: 'traefik', and left
+# running by gkm compose --down. Stop it, once nothing uses it, with:
+#
+#   docker compose -p ${EDGE_PROJECT} -f ${options.dir}/docker-compose.yml down
+${yaml(edgeCompose(options))}`;
+}
+function yaml(value) {
+	return stringify(value, {
+		lineWidth: 0,
+		aliasDuplicateObjects: false
+	});
+}
+//#endregion
+//#region src/compose/edge.ts
+/**
+* The server's shared Traefik edge, on disk and in Docker: started when a
+* stack needs it, and each stack's routes written to — and removed from —
+* the directory it watches.
+*
+* The edge lives in the deploy user's gkm home (`$GKM_HOME/edge`, else
+* `~/.gkm/edge`): the user who runs `gkm compose` owns it, so nothing needs
+* root, and it sits beside the stage keys that same user already keeps.
+*
+*   ~/.gkm/edge/
+*     docker-compose.yml   the edge's compose project (gkm-edge)
+*     traefik.yml          its static configuration
+*     dynamic/<project>.yml  one per stack: its routers, services, middlewares
+*     certs/<project>.crt|.key  a stack's own certificate, where it has one
+*/
+/** The edge's directory on this machine. */
+function edgeDir(env = process.env) {
+	return join(gkmHome(env), "edge");
+}
+/** The edge's compose project, as docker is asked about it. */
+function edgeRef(dir, options = {}) {
+	return {
+		project: EDGE_PROJECT,
+		file: join(dir, "docker-compose.yml"),
+		cwd: dir,
+		...options
+	};
+}
+/**
+* Something other than the proxy a stack is set to holds the edge's ports.
+*
+* With `proxy: 'traefik'`, the stack's own Caddy — still running from before
+* the switch — or any other container; with `proxy: 'caddy'`, the shared
+* edge, or another stack's Caddy. Refused before anything is started, so the
+* stack is never left half on one proxy and half on the other.
+*/
+var ComposeProxyClash = class extends Error {
+	project;
+	proxy;
+	port;
+	holder;
+	constructor(project, proxy, port, holder) {
+		const by = holder.project ? `${holder.container} (compose project ${holder.project})` : holder.container;
+		const fix = proxy === "traefik" ? holder.project === project && holder.service === "caddy" ? `That is this stack's own Caddy, from before it was switched to proxy: 'traefik'. Move it once: stop it (docker compose -p ${project} stop caddy), then run gkm compose again — the shared edge takes 80/443 and the stack registers with it.` : `The shared edge needs ports 80 and 443. Stop ${holder.container}${holder.project ? ` (docker compose -p ${holder.project} down, or its own gkm compose --down)` : ""}, or move the edge with GKM_COMPOSE_HTTPS_PORT/GKM_COMPOSE_HTTP_PORT.` : holder.project === "gkm-edge" ? `That is the server's shared Traefik edge, which other stacks register with. Set deploy.compose.proxy to 'traefik' for this stage so the stack registers with it too, or stop the edge once nothing uses it (docker compose -p ${EDGE_PROJECT} down).` : `Stop ${holder.container}, or publish this stack's Caddy elsewhere with GKM_COMPOSE_HTTPS_PORT/GKM_COMPOSE_HTTP_PORT.`;
+		super(`${project} is set to proxy: '${proxy}', and port ${port} is held by ${by}. ${fix}`);
+		this.project = project;
+		this.proxy = proxy;
+		this.port = port;
+		this.holder = holder;
+		this.name = "ComposeProxyClash";
+	}
+};
+/**
+* Refuse a stack whose edge ports are held by anything but its own proxy:
+* the shared edge for `'traefik'`, the stack's own Caddy for `'caddy'`.
+*/
+async function assertEdgePorts(docker, options) {
+	const { project, proxy, ports } = options;
+	for (const port of [ports.https, ports.http]) for (const holder of await docker.publishers(port)) if (!(proxy === "traefik" ? holder.project === "gkm-edge" : holder.project === project && holder.service === "caddy")) throw new ComposeProxyClash(project, proxy, port, holder);
+}
+/** Write a file whole or not at all: a temporary file, then a rename. */
+async function writeAtomic(path, content, mode = 420) {
+	const temporary = `${path}.${process.pid}.tmp`;
+	await writeFile(temporary, content, { mode });
+	await chmod(temporary, mode);
+	await rename(temporary, path);
+}
+/** Write a file only when its content changed; whether it did. */
+async function writeIfChanged(path, content) {
+	if (await readFile(path, "utf-8").catch(() => void 0) === content) return false;
+	await writeAtomic(path, content);
+	return true;
+}
+/**
+* The edge, up: its network, its files, and its container — started when it
+* is not running, and recreated when its configuration changed. Idempotent:
+* on a server where it already runs as configured, `up` changes nothing.
+*/
+async function ensureEdge(docker, options) {
+	const { dir, ports } = options;
+	await mkdir(join(dir, "dynamic"), { recursive: true });
+	await mkdir(join(dir, "certs"), {
+		recursive: true,
+		mode: 448
+	});
+	const staticConfig = traefikStaticFile(ports);
+	await writeIfChanged(join(dir, "traefik.yml"), staticConfig);
+	await writeIfChanged(join(dir, "docker-compose.yml"), edgeComposeFile({
+		dir,
+		ports,
+		staticConfig,
+		logging: options.logging
+	}));
+	await docker.ensureNetwork(EDGE_NETWORK);
+	await docker.up(edgeRef(dir, {
+		...options.output ? { output: options.output } : {},
+		...options.signal ? { signal: options.signal } : {}
+	}), [EDGE_SERVICE]);
+	return [join(dir, "traefik.yml"), join(dir, "docker-compose.yml")];
+}
+/** A stack's file in the edge's directory. */
+function routesFile(dir, project) {
+	return join(dir, "dynamic", `${project}.yml`);
+}
+/**
+* Register a stack with the edge: its certificate first, where it has one,
+* so the routes that need it never load without it — then its routes, in one
+* rename the edge picks up whole.
+*/
+async function writeEdgeRoutes(dir, project, routes, certificate) {
+	const files = [];
+	if (certificate) {
+		const certs = join(dir, "certs");
+		await mkdir(certs, {
+			recursive: true,
+			mode: 448
+		});
+		const crt = join(certs, `${project}.crt`);
+		const key = join(certs, `${project}.key`);
+		await copyFile(certificate.certFile, `${crt}.tmp`);
+		await rename(`${crt}.tmp`, crt);
+		await copyFile(certificate.keyFile, `${key}.tmp`);
+		await chmod(`${key}.tmp`, 384);
+		await rename(`${key}.tmp`, key);
+		files.push(crt, key);
+	} else await removeCertificate(dir, project);
+	await mkdir(join(dir, "dynamic"), { recursive: true });
+	const file = routesFile(dir, project);
+	await writeAtomic(file, routes);
+	files.push(file);
+	return files;
+}
+/** What a stack's file holds for the moment between emptying and removal. */
+const UNREGISTERED = "# Unregistered by gkm compose --down.\n";
+async function removeCertificate(dir, project) {
+	for (const ext of ["crt", "key"]) await rm(join(dir, "certs", `${project}.${ext}`), { force: true });
+}
+/**
+* Unregister a stack: its routes, then its certificate. Whether there was
+* anything to remove.
+*/
+async function removeEdgeRoutes(dir, project) {
+	const file = routesFile(dir, project);
+	const existed = existsSync(file);
+	if (existed) await writeAtomic(file, UNREGISTERED);
+	await rm(file, { force: true });
+	await removeCertificate(dir, project);
+	return existed;
+}
+//#endregion
+//#region src/compose/images.ts
+/**
+* The tag a site's image carries for a release.
+*
+* A site's public URLs are inlined when it is built, so one bundle serves one
+* stage: `v1.4.0-production` and `v1.4.0-staging` are two images of the same
+* commit. A backend reads its URLs at runtime, so one image serves every stage
+* and its tag is the release's alone.
+*/
+function siteTag(tag, stage) {
+	return `${tag}-${stage}`;
+}
+/** Images a tag names that the registry does not have. */
+var ImageTagNotFound = class extends Error {
+	tag;
+	refs;
+	constructor(tag, refs) {
+		super(`The registry has no image for ${refs.length === 1 ? "this app" : `${refs.length} apps`} at '${tag}':\n` + refs.map((ref) => `  - ${ref}`).join("\n") + `\nNothing was pulled or started. Push '${tag}' for every app from CI, pick a tag that exists, or run without --tag to build from this checkout.`);
+		this.tag = tag;
+		this.refs = refs;
+		this.name = "ImageTagNotFound";
+	}
+};
+/** The registry did not answer, or did not let this machine in. */
+var RegistryUnreachable = class extends Error {
+	ref;
+	detail;
+	constructor(ref, detail) {
+		super(`Could not ask the registry about ${ref}: ${detail || "no answer"}\nNothing was pulled or started. Check the registry is reachable and that this machine is logged in to it (\`docker login <registry>\`).`);
+		this.ref = ref;
+		this.detail = detail;
+		this.name = "RegistryUnreachable";
+	}
+};
+/**
+* Assert every image exists, before anything else happens.
+*
+* Asked all at once and reported all at once: a release missing two images is
+* one problem with two names, and finding the second only after fixing the
+* first is a slower way to learn the same thing.
+*
+* @throws {RegistryUnreachable} when the registry cannot say
+* @throws {ImageTagNotFound} listing every missing image
+*/
+async function assertImagesExist(docker, tag, images) {
+	const lookups = await Promise.all(images.map((image) => docker.lookup(image.ref)));
+	const unreachable = lookups.find((lookup) => lookup.status === "unreachable");
+	if (unreachable?.status === "unreachable") throw new RegistryUnreachable(unreachable.ref, unreachable.detail);
+	const missing = lookups.filter((lookup) => lookup.status === "missing").map((lookup) => lookup.ref);
+	if (missing.length > 0) throw new ImageTagNotFound(tag, missing);
+}
+/**
+* A push or a pull with no `deploy.registry` to push to or pull from.
+*
+* Without one an image is named `<namespace>/<project>-<app>:<tag>`, which
+* Docker resolves to Docker Hub — so a release would be pushed to, or pulled
+* from, somebody else's account. It is never a fallback.
+*/
+var RegistryRequired = class extends Error {
+	operation;
+	ref;
+	constructor(operation, ref) {
+		super(`${operation === "push" ? "Pushing" : "Pulling"} images needs a registry, and gkm.config.ts sets no deploy.registry: '${ref}' would be ${operation === "push" ? "pushed to" : "pulled from"} Docker Hub. Set deploy.registry (e.g. registry: 'ghcr.io/acme') in gkm.config.ts.` + (operation === "pull" ? " To run images built here instead, pass --build." : ""));
+		this.operation = operation;
+		this.ref = ref;
+		this.name = "RegistryRequired";
+	}
+};
+/** An image pinned to its digest: `<ref>@sha256:…`. */
+function pinnedRef(ref, digest) {
+	return `${ref.split("@")[0]}@${digest}`;
+}
+/** A digests file with no entry for an app the stack runs. */
+var ImageDigestMissing = class extends Error {
+	file;
+	apps;
+	constructor(file, apps) {
+		super(`${file} pins no digest for ${apps.join(", ")}. Use the file the same release's \`gkm compose --build --push --digests-file\` wrote, or run without --digests-file to pull by tag.`);
+		this.file = file;
+		this.apps = apps;
+		this.name = "ImageDigestMissing";
+	}
+};
+/** A digests file entry that is not this app's image. */
+var ImageDigestMismatch = class extends Error {
+	app;
+	expected;
+	found;
+	constructor(app, expected, found) {
+		super(`The digests file pins '${app}' to ${found}, but this release runs ${expected}. It was written for another registry, project, stage or tag; use the file this stage's push of this tag wrote.`);
+		this.app = app;
+		this.expected = expected;
+		this.found = found;
+		this.name = "ImageDigestMismatch";
+	}
+};
+/** A digests file that is not a JSON object of app to pinned ref. */
+var ImageDigestsInvalid = class extends Error {
+	file;
+	detail;
+	constructor(file, detail) {
+		super(`${file} is not a digests file (${detail}). It should be the JSON object \`gkm compose --build --push --digests-file\` writes: { "api": "<registry>/<image>:<tag>@sha256:…" }.`);
+		this.file = file;
+		this.detail = detail;
+		this.name = "ImageDigestsInvalid";
+	}
+};
+/** Parse a digests file's content, checking its shape. */
+function parseDigests(file, content) {
+	let parsed;
+	try {
+		parsed = JSON.parse(content);
+	} catch (error) {
+		throw new ImageDigestsInvalid(file, error instanceof Error ? error.message : String(error));
+	}
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new ImageDigestsInvalid(file, "not a JSON object");
+	for (const [app, value] of Object.entries(parsed)) if (typeof value !== "string" || !/@sha256:[0-9a-f]{64}$/.test(value)) throw new ImageDigestsInvalid(file, `'${app}' is not an <image>:<tag>@sha256:… ref`);
+	return parsed;
+}
+/**
+* Each image pinned to the digest the file names for it.
+*
+* @throws {ImageDigestMissing} naming every app the file has no entry for
+* @throws {ImageDigestMismatch} when an entry is another image or tag
+*/
+function pinImages(file, digests, images) {
+	const missing = images.filter((image) => !digests[image.app]).map((image) => image.app);
+	if (missing.length > 0) throw new ImageDigestMissing(file, missing);
+	return images.map((image) => {
+		const pinned = digests[image.app];
+		if (pinned.split("@")[0] !== image.ref) throw new ImageDigestMismatch(image.app, image.ref, pinned);
+		return {
+			...image,
+			ref: pinned
+		};
+	});
+}
+//#endregion
+//#region src/compose/secrets.ts
+var secrets_exports = /* @__PURE__ */ __exportAll({ deployedStackSecrets: () => deployedStackSecrets });
+function deployedStackSecrets(workspace, stage, stored, manifest) {
+	const withSeed = withGeneratedSecrets(stored ?? initStageSecrets(stage), manifest);
+	const withLogs = resolveStageTelemetry({
+		...workspace.deploy?.telemetry ? { telemetry: workspace.deploy.telemetry } : {},
+		stage,
+		local: false,
+		target: "compose",
+		runtime: "server",
+		selfHosted: true,
+		used: usesTelemetry(manifest)
+	})?.provider === "self-hosted" ? withLogsPassword(withSeed.secrets) : {
+		secrets: withSeed.secrets,
+		generated: []
+	};
+	const withRedis = runsRedis(manifest, withLogs.secrets.custom ?? {}) ? withRedisPassword(withLogs.secrets) : {
+		secrets: withLogs.secrets,
+		generated: []
+	};
+	return {
+		secrets: withRedis.secrets,
+		generated: [
+			...withSeed.generated,
+			...withLogs.generated,
+			...withRedis.generated
+		]
+	};
+}
+//#endregion
+//#region src/compose/caddyfile.ts
+/**
+* The stack's own edge, rendered for Caddy: one site block per route.
+*
+* Deployed, each host is the stage's real domain and Caddy gets it a
+* certificate from Let's Encrypt on first request — the same automatic HTTPS
+* it does anywhere, with nothing to configure but the name — or serves the
+* stage's own certificate (`deploy.compose.tls`). Locally the hosts are
+* `*.localhost` and the certificates come from Caddy's own CA, as the `gkm
+* dev` edge does, so a local stack is `https://` like a deployed one.
+*
+* Pure: the routes are data (`routes.ts`), and rendering them is one string.
+*/
+/** Where Caddy reads a stage's own certificate, inside its container. */
+const CADDY_TLS_DIR = "/etc/caddy/tls";
+/** An upstream on the stack's own network: its service name. */
+function address({ service, port }) {
+	return `${service}:${port}`;
+}
+/** The Caddyfile for a stack's edge. */
+function edgeCaddyfile(routes, options) {
+	const { tls } = options;
+	const global = tls.kind === "internal" ? `{
+	# No ACME and no public DNS: the CA is Caddy's own and the names resolve
+	# to this machine.
+	local_certs
+	auto_https disable_redirects
+}` : options.email ? `{
+	email ${options.email}
+}` : "";
+	const certificate = tls.kind === "internal" ? `
+	tls internal
+` : tls.kind === "files" ? `
+	tls ${tls.certFile} ${tls.keyFile}
+` : "";
+	const blocks = routes.map(({ host, upstreams, prefix, allow, streaming }) => `https://${host} {${certificate}
+	# gkm's own header, which only a service of this stack may send: the auth
+	# server rate-limits by the client address it carries.
+	request_header -${CLIENT_IP_HEADER}
+${allow ? `
+	# Only these addresses — the peer Caddy sees, never a header a client
+	# could set. Everything else is refused before it reaches the upstream.
+	@denied not remote_ip ${allow.join(" ")}
+	respond @denied 403
+` : ""}${prefix ? `
+	# A bucket, served at a host of its own: the bucket is a prefix on MinIO,
+	# which routes and signs on the Host header — so it is sent the upstream's.
+	reverse_proxy ${upstreams.map(address).join(" ")} {
+		rewrite ${prefix}{uri}
+		header_up Host {upstream_hostport}
+	}` : `
+	# Host and X-Forwarded-* are passed through as Caddy does by default, so
+	# an app builds redirects, cookies and links on the address a caller used.
+	reverse_proxy ${upstreams.map(address).join(" ")}${streaming ? ` {
+		# Never buffer: a streamed response — server-sent events, a Next.js
+		# RSC payload — reaches the client as each chunk is written.
+		flush_interval -1
+	}` : ""}`}
+}`);
+	return `${HEADER}${global ? `${global}\n\n` : ""}${blocks.join("\n\n")}\n`;
+}
+const HEADER = `# Generated by gkm compose from the construct manifest — do not edit.
+#
+# One host per API and site, each in front of its own container, one per
+# file server in front of the stack's MinIO, and — when its logs are served
+# publicly — one for OpenObserve, to the addresses it allows.
+`;
+//#endregion
+//#region src/compose/stack.ts
+/**
+* The stack a workspace runs as for one stage — pure.
+*
+* Everything `gkm compose` writes is decided here, as data: the compose file,
+* the Caddyfile, one env file per backend, and the image each app runs. The
+* command around it reads the workspace, asks the registry, writes the files
+* and starts Docker; none of those decide anything, so all of it can be
+* asserted without a daemon.
+*
+* The values come from the same derivations every other target uses. The
+* plan is reconcile's `planFor`, the keys an app reads are `appEnvKeys`, and
+* every URL is `envFor`'s — asked twice, once with each app at its public
+* address and once on the compose network, because a browser and a sibling
+* service reach the same API by different names.
+*/
+var stack_exports = /* @__PURE__ */ __exportAll({
+	EDGE_PORT_ENV: () => EDGE_PORT_ENV,
+	EnvValueMultiline: () => EnvValueMultiline,
+	LOGS_PORT_ENV: () => LOGS_PORT_ENV,
+	LOG_ROTATION: () => LOG_ROTATION,
+	LocalCredentialsMissing: () => LocalCredentialsMissing,
+	NothingToCompose: () => NothingToCompose,
+	StageSecretMissing: () => StageSecretMissing,
+	StageSeedMissing: () => StageSeedMissing,
+	composeProject: () => composeProject,
+	composeStack: () => composeStack,
+	derivedCredentials: () => derivedCredentials,
+	envFile: () => envFile,
+	stackDir: () => stackDir
+});
+/** Where a stack's files are written, relative to the workspace root. */
+function stackDir(stage) {
+	return `.gkm/compose/${stage}`;
+}
+/**
+* The compose project a stage's stack runs as.
+*
+* The deploy identity's scope, so two workspaces with one name in different
+* namespaces never share containers or volumes — and the stage, so a
+* machine can run two stages side by side.
+*/
+function composeProject(identity) {
+	return `${identity.scope}-${identity.stage}`;
+}
+/** The ports the edge is published on, and the variables that move them. */
+const EDGE_PORT_ENV = {
+	https: "GKM_COMPOSE_HTTPS_PORT",
+	http: "GKM_COMPOSE_HTTP_PORT"
+};
+/**
+* The variable that moves the local stage's OpenObserve off its loopback
+* port, 5080 — which the local stage takes from nowhere else, since it
+* ignores `deploy.telemetry`. Another stack, or another tool, may hold 5080.
+*/
+const LOGS_PORT_ENV = "GKM_COMPOSE_LOGS_PORT";
+/**
+* Containers this target does not run.
+*
+* The AWS emulator never applies: a stack is a server target, whose events
+* are pg-boss. Reconcile's Caddy fronts `gkm dev`'s host processes; the stack
+* brings its own edge.
+*
+* MinIO and Mailpit run on the local stage always, and on a deployed stage
+* only where `--allow-dev-services` allowed them and its secrets configure no
+* real bucket or mail server — see `devServices.ts`.
+*/
+const NOT_RUN = {
+	localstack: true,
+	caddy: true
+};
+/** The kinds a deployed stage takes from its secrets, or a dev service. */
+const SERVICE_KINDS = {
+	email: "email",
+	objects: "objects",
+	"file-server": "file-server"
+};
+/** The region MinIO is addressed with. It has no regions; the SDK wants one. */
+const MINIO_REGION = "us-east-1";
+/** The S3 client's credentials, read beside a bucket's URL when it has them. */
+const STORAGE_KEYS = [
+	"AWS_ACCESS_KEY_ID",
+	"AWS_SECRET_ACCESS_KEY",
+	"AWS_REGION"
+];
+/**
+* Every service's Docker logs, rotated. The json-file driver keeps a
+* container's output in one file that grows until the disk is full — on a
+* small server, in weeks. Three files of 10 MB each per container is enough
+* to see what happened and never fills anything. A project's own override
+* file that sets `logging` wins over it.
+*/
+const LOG_ROTATION = {
+	driver: "json-file",
+	options: {
+		"max-size": "10m",
+		"max-file": "3"
+	}
+};
+/** The local stage's stack, without the logins `gkm dev` generates. */
+var LocalCredentialsMissing = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`The local stage '${stage}' runs with this machine's generated logins, and none were passed. Load them with loadLocalCredentials(workspace) and pass them as localCredentials.`);
+		this.stage = stage;
+		this.name = "LocalCredentialsMissing";
+	}
+};
+/**
+* A deployed stage's container logins, derived from its seed like its role
+* passwords — so every deploy of the stage computes the same ones, and no one
+* reading the repo can.
+*/
+function derivedCredentials(project, plan, seed) {
+	const derive = (purpose) => localRolePassword(project, plan, purpose, seed);
+	return {
+		postgres: {
+			user: postgresSuperuser(project),
+			password: derive("master")
+		},
+		minio: {
+			user: `${project}-minio`,
+			password: derive("minio")
+		},
+		rabbitmq: {
+			user: LOCAL_RABBITMQ_USER,
+			password: derive("rabbitmq")
+		},
+		redis: { password: derive("redis") },
+		cacheToken: derive("cache-token"),
+		emulator: {
+			accessKeyId: EMULATOR_ACCESS_KEY_ID,
+			secretAccessKey: derive("emulator")
+		},
+		logs: {
+			email: `admin@${project}`,
+			password: derive("logs")
+		}
+	};
+}
+/** A value only the stage's secrets can hold, and they do not. */
+var StageSecretMissing = class extends Error {
+	app;
+	key;
+	stage;
+	constructor(app, key, stage) {
+		super(`'${app}' reads ${key}, and the stage '${stage}' has none. Nothing in the stack can derive it; set it in the stage's secrets: gkm secrets:set ${key} '…' --stage ${stage}`);
+		this.app = app;
+		this.key = key;
+		this.stage = stage;
+		this.name = "StageSecretMissing";
+	}
+};
+/** A deployed stage's secrets with no seed to derive its passwords from. */
+var StageSeedMissing = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`The stage '${stage}' has no seed in its secrets, and a deployed stage's database passwords are derived from it. Run gkm compose --stage ${stage} without --dry-run once, or gkm deploy, to generate it.`);
+		this.stage = stage;
+		this.name = "StageSeedMissing";
+	}
+};
+/** A workspace with no API and no site to run. */
+var NothingToCompose = class extends Error {
+	root;
+	constructor(root) {
+		super(`${root} declares no RestApi, no site and no Worker with work to do, so a stack would run nothing. Mobile apps ship through their own toolchain.`);
+		this.root = root;
+		this.name = "NothingToCompose";
+	}
+};
+/** A value that cannot be written to an env file a line at a time. */
+var EnvValueMultiline = class extends Error {
+	app;
+	key;
+	constructor(app, key) {
+		super(`${key} for '${app}' spans more than one line, and an env file holds one value per line. Store it on one line — base64, or JSON — and decode it where it is read.`);
+		this.app = app;
+		this.key = key;
+		this.name = "EnvValueMultiline";
+	}
+};
+/** The services a stack's apps wait on and the edge waits on in turn. */
+const HEALTHY = { condition: "service_healthy" };
+/**
+* An app's health check: its own server, asked on 127.0.0.1 — not
+* `localhost`, which resolves to `::1` first in an Alpine container while a
+* server may listen on IPv4 alone.
+*/
+function probe(port, path) {
+	return {
+		test: [
+			"CMD",
+			"wget",
+			"-q",
+			"-O",
+			"/dev/null",
+			`http://127.0.0.1:${port}${path}`
+		],
+		interval: "5s",
+		timeout: "3s",
+		retries: 20,
+		start_period: "10s"
+	};
+}
+/** The stack for one stage. */
+function composeStack(input) {
+	const { workspace, manifest, stage, identity } = input;
+	const local = stage === workspace.stages.local;
+	const project = composeProject(identity);
+	const custom = input.secrets?.custom ?? {};
+	const https = input.ports?.https ?? 443;
+	const http = input.ports?.http ?? 80;
+	const proxy = proxyFor(workspace.deploy?.compose, stage, local);
+	const certificate = local ? void 0 : certificateFor(workspace.deploy?.compose, stage, workspace.root);
+	const plan = planFor(manifest, stage, provisionOrder(manifest), {
+		localStage: workspace.stages.local,
+		events: DEFAULT_EVENTS.server,
+		cache: STACK_CACHE,
+		edge: false
+	});
+	const byId = new Map(plan.resources.map((r) => [r.id, r]));
+	if (local && !input.localCredentials) throw new LocalCredentialsMissing(stage);
+	const seed = local ? input.localCredentials.seed : input.secrets?.seed;
+	if (!seed) throw new StageSeedMissing(stage);
+	const containers = local ? input.localCredentials : derivedCredentials(workspace.name, plan, seed);
+	const credential = {
+		containers: {
+			...containers,
+			minio: {
+				user: custom.AWS_ACCESS_KEY_ID ?? containers.minio.user,
+				password: custom.AWS_SECRET_ACCESS_KEY ?? containers.minio.password
+			}
+		},
+		seed
+	};
+	const apps = stackApps(workspace, manifest, plan, {
+		local,
+		stage,
+		https,
+		identity,
+		images: input.images
+	});
+	const workers = stackWorkers(workerUnits(workspace, manifest, input.background ?? {}), {
+		stage,
+		identity,
+		images: input.images
+	});
+	if (apps.length === 0 && workers.length === 0) throw new NothingToCompose(workspace.root);
+	const owners = /* @__PURE__ */ new Map();
+	for (const resource of plan.resources) {
+		owners.set(resource.envKey, resource);
+		if (resource.kind === "email") {
+			owners.set(provideKey(resource.id, "from"), resource);
+			owners.set(provideKey(resource.id, "inboxUrl"), resource);
+		}
+		if (resource.kind === "external-api") owners.set(provideKey(resource.id, "credentials"), resource);
+	}
+	const reads = /* @__PURE__ */ new Map();
+	for (const app of apps) {
+		const site = manifest[app.id];
+		reads.set(app.name, site?.kind === "site" ? Object.values(publicEnvFor(site, manifest)) : [...appEnvKeys(manifest, app.name, input.runnables) ?? []]);
+	}
+	for (const worker of workers) reads.set(worker.name, [...workerEnvKeys(manifest, worker.id, input.runnables) ?? []]);
+	const domain = workspace.domains?.[stage];
+	const telemetry = resolveStageTelemetry({
+		...workspace.deploy?.telemetry ? { telemetry: workspace.deploy.telemetry } : {},
+		stage,
+		local,
+		target: "compose",
+		runtime: "server",
+		selfHosted: true,
+		used: usesTelemetry(manifest)
+	});
+	const logsBase = telemetry?.provider === "self-hosted" ? stackLogs({
+		config: local && input.ports?.logs ? {
+			...telemetry.selfHosted,
+			port: input.ports.logs
+		} : telemetry.selfHosted,
+		stage,
+		local,
+		project: workspace.name,
+		...domain ? { domain } : {},
+		custom,
+		https,
+		...local ? { localLogin: input.localCredentials.logs } : {}
+	}) : void 0;
+	const services = local ? {
+		missing: [],
+		minio: plan.resources.filter((r) => r.kind === "objects").map((r) => r.id),
+		mailpit: plan.resources.filter((r) => r.kind === "email").map((r) => r.id)
+	} : (() => {
+		assertStageProvidersEnabled(workspace, manifest, stage);
+		return assertExternalServices({
+			stage,
+			declarations: serviceDeclarations(plan, reads, owners),
+			supplied: custom,
+			allow: input.allowDevServices === true,
+			...domain ? { domain } : {},
+			providers: stageProviderNotes(workspace, stage)
+		});
+	})();
+	const redis = stackRedis({
+		plan,
+		stage,
+		local,
+		custom,
+		...local ? { localPassword: input.localCredentials.redis.password } : {}
+	});
+	const infra = [...plan.containers.filter((c) => !NOT_RUN[c]).filter((c) => c !== LOGS_SERVICE).filter((c) => c !== "minio" || services.minio.length > 0).filter((c) => c !== "mailpit" || services.mailpit.length > 0).filter((c) => c !== "redis" || redis !== void 0), ...logsBase ? [LOGS_SERVICE] : []].sort();
+	const storage = infra.includes("minio") ? (() => {
+		const buckets = services.minio.map((id) => byId.get(id)?.name).filter((name) => Boolean(name)).sort();
+		return {
+			...credential.containers.minio,
+			buckets,
+			policies: bucketPolicies(plan).filter((p) => buckets.includes(p.bucket))
+		};
+	})() : void 0;
+	const fileServers = /* @__PURE__ */ new Map();
+	if (storage) for (const resource of plan.resources) {
+		if (resource.kind !== "file-server" || !resource.of) continue;
+		if (!services.minio.includes(resource.of)) continue;
+		if (custom[resource.envKey] !== void 0) continue;
+		const bucket = byId.get(resource.of);
+		if (!bucket) continue;
+		let host;
+		if (local) host = hostFor(resource, workspace.name);
+		else {
+			if (!domain) throw new NoDomainForStage(stage);
+			host = `${resource.subdomain ?? appKey(resource.id)}.${domain}`;
+		}
+		fileServers.set(resource.id, {
+			url: `https://${host}${local && https !== 443 ? `:${https}` : ""}`,
+			route: {
+				name: `files-${appKey(resource.id)}`,
+				host,
+				upstreams: [{
+					service: "minio",
+					port: 9e3
+				}],
+				streaming: false,
+				prefix: `/${bucket.name}`
+			}
+		});
+	}
+	const edgeServices = new Set(proxy === "traefik" ? [
+		...apps.map((app) => app.name),
+		...fileServers.size > 0 ? ["minio"] : [],
+		...logsBase?.host && logsBase.public ? [LOGS_SERVICE] : []
+	] : []);
+	const hostOf = (service) => edgeServices.has(service) ? edgeAlias(project, service) : service;
+	const logs = logsBase && {
+		...logsBase,
+		appEnv: {
+			...logsBase.appEnv,
+			OTEL_EXPORTER_OTLP_ENDPOINT: logsBase.appEnv.OTEL_EXPORTER_OTLP_ENDPOINT.replace(`//openobserve:`, `//${hostOf("openobserve")}:`)
+		}
+	};
+	const derivation = {
+		project: workspace.name,
+		credentials: credential.containers,
+		seed: credential.seed,
+		...!local && domain ? { mailFrom: `noreply@${domain}` } : {}
+	};
+	const outside = networkEnv(plan, {
+		...derivation,
+		addresses: Object.fromEntries(apps.map((app) => [app.id, app.url]))
+	}, hostOf);
+	const inside = networkEnv(plan, {
+		...derivation,
+		addresses: Object.fromEntries(apps.map((app) => [app.id, `http://${hostOf(app.name)}:${app.port}`]))
+	}, hostOf);
+	const surfaceUrls = new Map(plan.resources.filter((r) => r.kind === "rest-api" || r.kind === "site").map((r) => [r.envKey, r.id]));
+	const appById = new Map(apps.map((app) => [app.id, app]));
+	/**
+	* What a key resolves to for one app, from the stage's secrets where only
+	* they can hold it, and the derivations otherwise.
+	*/
+	const valueFor = (app, key, owner) => {
+		if (isReservedStageKey(key)) return void 0;
+		if (owner && SERVICE_KINDS[owner.kind]) {
+			if (custom[key] !== void 0) return custom[key];
+			if (owner.kind === "file-server") return fileServers.get(owner.id)?.url;
+			return outside[key];
+		}
+		if (owner && suppliedOnly(owner.kind, owner.id, key, local)) {
+			const value = custom[key];
+			if (value === void 0) throw new StageSecretMissing(app.name, key, stage);
+			return value;
+		}
+		if (custom[key] !== void 0) return custom[key];
+		if (owner?.kind === "cache") return redis?.urls[key];
+		const surface = surfaceUrls.get(key);
+		if (app.kind === "rest-api" && surface && surface !== app.id) return inside[key];
+		return outside[key];
+	};
+	const telemetryValues = logs ? telemetryEnv({
+		endpoint: logs.appEnv.OTEL_EXPORTER_OTLP_ENDPOINT,
+		headers: logs.appEnv.OTEL_EXPORTER_OTLP_HEADERS
+	}, telemetry?.sampleRate ?? 1) : telemetry?.provider === "otlp" ? otlpTelemetryEnv(telemetry) : void 0;
+	/** Each key one backend process reads, resolved for this stage. */
+	const valuesFor = (app, keys) => {
+		const values = {};
+		for (const key of [...keys].sort()) {
+			if (isTelemetryKey(key)) continue;
+			const owner = owners.get(key) ?? storageOwner(key, plan);
+			if (!local && owner?.kind === "email" && key.endsWith("_INBOX_URL")) continue;
+			if (STORAGE_KEYS.includes(key)) {
+				const value = custom[key] ?? storageValue(key, storage);
+				if (value !== void 0) values[key] = value;
+				continue;
+			}
+			const value = valueFor(app, key, owner);
+			if (value !== void 0) values[key] = value;
+		}
+		return values;
+	};
+	for (const app of apps) {
+		if (app.kind === "site") {
+			const site = manifest[app.id];
+			if (site?.kind !== "site") continue;
+			const args = {};
+			for (const [key, source] of Object.entries(publicEnvFor(site, manifest))) {
+				const value = valueFor(app, source, owners.get(source));
+				if (value !== void 0) args[key] = value;
+			}
+			if (app.build && Object.keys(args).length > 0) app.build.args = args;
+			continue;
+		}
+		if (input.buildOnly) continue;
+		const keys = appEnvKeys(manifest, app.name, input.runnables) ?? /* @__PURE__ */ new Set();
+		const values = valuesFor(app, keys);
+		const trusted = provideKey(app.id, "trustedOrigins");
+		if (keys.has(trusted)) {
+			const internal = (byId.get(app.id)?.callers ?? []).map((caller) => appById.get(caller)).filter((caller) => caller?.kind === "rest-api").map((caller) => `http://${hostOf(caller.name)}:${caller.port}`);
+			const origins = [...(values[trusted] ?? "").split(",").filter(Boolean), ...internal];
+			values[trusted] = [...new Set(origins)].join(",");
+		}
+		app.env = {
+			...scopeTelemetryEnv(values, {
+				uses: telemetryOf(manifest, app.id) !== void 0,
+				serviceName: app.name,
+				...telemetryValues ? { telemetry: telemetryValues } : {}
+			}),
+			NODE_ENV: "production",
+			PORT: String(app.port),
+			STAGE: stage
+		};
+		for (const [key, value] of Object.entries(app.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(app.name, key);
+	}
+	for (const worker of input.buildOnly ? [] : workers) {
+		const keys = workerEnvKeys(manifest, worker.id, input.runnables) ?? /* @__PURE__ */ new Set();
+		worker.env = {
+			...scopeTelemetryEnv(valuesFor({
+				name: worker.name,
+				id: worker.id,
+				kind: "rest-api"
+			}, keys), {
+				uses: telemetryOf(manifest, worker.id) !== void 0,
+				serviceName: worker.name,
+				...telemetryValues ? { telemetry: telemetryValues } : {}
+			}),
+			NODE_ENV: "production",
+			PORT: String(worker.port),
+			STAGE: stage
+		};
+		for (const [key, value] of Object.entries(worker.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(worker.name, key);
+	}
+	const deployedTls = certificate ? {
+		kind: "files",
+		...proxy === "caddy" ? {
+			certFile: `${CADDY_TLS_DIR}/cert.pem`,
+			keyFile: `${CADDY_TLS_DIR}/key.pem`
+		} : edgeCertificatePaths(project)
+	} : { kind: "acme" };
+	const tls = local ? { kind: "internal" } : deployedTls;
+	const layout = input.layout ?? defaultLayout(workspace.root);
+	const compose = stackFile({
+		project,
+		plan,
+		infra,
+		apps,
+		workers,
+		credentials: credential.containers,
+		...storage ? { storage } : {},
+		...logs ? { logs } : {},
+		...redis ? { redis } : {},
+		https,
+		http,
+		composeDir: join(workspace.root, stackDir(stage)),
+		buildRoot: layout.buildRoot,
+		workspaceRoot: workspace.root,
+		envFiles: !input.buildOnly,
+		proxy,
+		edge: new Map([...edgeServices].map((service) => [service, hostOf(service)])),
+		tls: certificate !== void 0
+	});
+	const routes = [
+		...apps.map((app) => ({
+			name: app.name,
+			host: app.host,
+			upstreams: [{
+				service: app.name,
+				port: app.port
+			}],
+			streaming: true,
+			health: app.kind === "site" ? "/" : "/health"
+		})),
+		...[...fileServers.values()].map(({ route }) => route),
+		...logs?.host && logs.public ? [{
+			name: LOGS_SERVICE,
+			host: logs.host,
+			upstreams: [{
+				service: LOGS_SERVICE,
+				port: LOGS_PORT
+			}],
+			streaming: true,
+			allow: logs.public.allow
+		}] : []
+	];
+	const dockerfiles = {};
+	for (const app of apps) {
+		if (!app.build) continue;
+		dockerfiles[app.build.dockerfile] = appDockerfile(app.name, workspace.apps[app.name], {
+			layout,
+			workspaceRoot: workspace.root,
+			apps: workspace.apps,
+			manifest,
+			cache: STACK_CACHE,
+			workspace,
+			stage
+		});
+	}
+	for (const worker of workers) {
+		if (!worker.build) continue;
+		dockerfiles[worker.build.dockerfile] = workerDockerfile({
+			id: worker.id,
+			name: worker.name,
+			app: worker.host
+		}, workspace.apps[worker.host], {
+			layout,
+			workspaceRoot: workspace.root,
+			cache: STACK_CACHE
+		});
+	}
+	return {
+		project,
+		stage,
+		local,
+		apps,
+		workers,
+		infra,
+		compose,
+		proxy,
+		routes,
+		...proxy === "caddy" ? { caddyfile: edgeCaddyfile(routes, { tls }) } : { traefik: traefikDynamicFile(routes, {
+			project,
+			tls: deployedTls
+		}) },
+		...certificate ? { tls: certificate } : {},
+		dockerfiles,
+		plan,
+		credential,
+		...storage ? { storage } : {},
+		devServices: local ? [] : devServicesUsed(services),
+		...logs ? { logs } : {},
+		...telemetry ? { telemetry } : {},
+		...redis ? { redis } : {}
+	};
+}
+/**
+* The mail and storage constructs a deployed stage's apps read, with who
+* reads each — and every file server's bucket, which serves it whether or
+* not an app reads it directly.
+*/
+function serviceDeclarations(plan, reads, owners) {
+	const byId = new Map(plan.resources.map((r) => [r.id, r]));
+	const readers = /* @__PURE__ */ new Map();
+	const add = (id, app) => {
+		const set = readers.get(id) ?? /* @__PURE__ */ new Set();
+		if (app) set.add(app);
+		readers.set(id, set);
+	};
+	for (const [app, keys] of reads) for (const key of keys) {
+		const owner = owners.get(key);
+		if (!owner || !SERVICE_KINDS[owner.kind]) continue;
+		if (owner.kind === "email" && key.endsWith("_INBOX_URL")) continue;
+		add(owner.id, app);
+		if (owner.kind === "file-server" && owner.of) add(owner.of);
+	}
+	return [...readers].flatMap(([id, apps]) => {
+		const resource = byId.get(id);
+		const kind = resource && SERVICE_KINDS[resource.kind];
+		if (!resource || !kind) return [];
+		return [{
+			id,
+			kind,
+			...resource.of ? { of: resource.of } : {},
+			apps: [...apps].sort()
+		}];
+	});
+}
+/** The stack's MinIO's value for one of the S3 client's keys. */
+function storageValue(key, storage) {
+	if (!storage) return void 0;
+	if (key === "AWS_ACCESS_KEY_ID") return storage.user;
+	if (key === "AWS_SECRET_ACCESS_KEY") return storage.password;
+	if (key === "AWS_REGION") return MINIO_REGION;
+}
+/** Which bucket an S3 credential key belongs to — the first one declared. */
+function storageOwner(key, plan) {
+	if (!STORAGE_KEYS.includes(key)) return void 0;
+	return plan.resources.find((r) => r.kind === "objects");
+}
+/** The apps a stack runs: every API and every site, at its stage address. */
+function stackApps(workspace, manifest, plan, options) {
+	const apps = [];
+	const resources = new Map(plan.resources.map((r) => [r.id, r]));
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration.kind !== "rest-api" && declaration.kind !== "site") continue;
+		const name = appKey(id);
+		const app = workspace.apps[name];
+		const resource = resources.get(id);
+		if (!app || !resource || !app.port) continue;
+		const host = hostOf(name, app, workspace, resource, options);
+		const tag = declaration.kind === "site" ? siteTag(options.images.tag, options.stage) : options.images.tag;
+		const ref = validateImageRef(imageRef(options.identity, name, options.images.registry, tag));
+		apps.push({
+			app: name,
+			name,
+			id,
+			kind: declaration.kind,
+			path: app.path,
+			port: app.port,
+			host,
+			url: `https://${host}${options.local && options.https !== 443 ? `:${options.https}` : ""}`,
+			ref,
+			tag,
+			...options.images.mode === "build" ? { build: { dockerfile: `${stackDir(options.stage)}/Dockerfile.${name}` } } : {}
+		});
+	}
+	return apps.sort((a, b) => a.name.localeCompare(b.name));
+}
+/** Each worker's image, and where it is built from. */
+function stackWorkers(units, options) {
+	return units.map((unit) => ({
+		app: unit.name,
+		name: unit.name,
+		id: unit.id,
+		host: unit.app,
+		port: WORKER_PORT,
+		ref: validateImageRef(imageRef(options.identity, unit.name, options.images.registry, options.images.tag)),
+		tag: options.images.tag,
+		...options.images.mode === "build" ? { build: { dockerfile: `${stackDir(options.stage)}/Dockerfile.${unit.name}` } } : {}
+	}));
+}
+/**
+* The host an app answers on for a stage: the `gkm dev` edge's
+* `*.localhost` names for the local stage, and the stage's domain — by the
+* same rule a deploy follows — for any other.
+*/
+function hostOf(name, app, workspace, resource, options) {
+	if (options.local) return hostFor(resource, workspace.name);
+	return resolveHost(name, app, options.stage, workspace.domains, isMainFrontendApp(name, app, workspace.apps));
+}
+/** The compose document: the infrastructure, the apps, and the edge. */
+function stackFile(options) {
+	const { project, plan, apps } = options;
+	const infra = options.infra.filter((name) => name !== LOGS_SERVICE);
+	const derived = composeFor({
+		...plan,
+		containers: [...infra]
+	}, {
+		project,
+		ports: Object.fromEntries(portKeys(infra, plan.fakes).map((key) => [key, 0])),
+		credentials: options.credentials
+	});
+	const services = {};
+	const volumes = {
+		...derived.volumes,
+		...options.proxy === "caddy" ? {
+			"caddy-data": {},
+			"caddy-config": {}
+		} : {},
+		...options.logs ? { "openobserve-data": {} } : {}
+	};
+	for (const name of infra) {
+		const { ports: _ports, depends_on, profiles: _profiles, ...service } = derived.services[name];
+		services[name] = {
+			...service,
+			...depends_on?.length ? { depends_on: Object.fromEntries(depends_on.map((dep) => [dep, HEALTHY])) } : {}
+		};
+	}
+	const postgres = services.postgres;
+	if (postgres) postgres.ports = ["127.0.0.1::5432"];
+	const minio = services.minio;
+	if (minio && options.storage) {
+		minio.environment = {
+			...minio.environment,
+			MINIO_ROOT_USER: options.storage.user,
+			MINIO_ROOT_PASSWORD: options.storage.password
+		};
+		minio.ports = ["127.0.0.1::9000"];
+	}
+	if (services["redis"] && options.redis) services[REDIS_SERVICE] = redisService(options.redis);
+	if (options.logs) services[LOGS_SERVICE] = logsService(options.logs);
+	for (const app of apps) services[app.name] = {
+		image: app.ref,
+		...app.build ? { build: {
+			...composeBuildPaths({
+				composeDir: options.composeDir,
+				buildRoot: options.buildRoot,
+				workspaceRoot: options.workspaceRoot,
+				dockerfile: app.build.dockerfile
+			}),
+			...app.build.args ? { args: app.build.args } : {}
+		} } : {},
+		restart: "unless-stopped",
+		...app.kind === "rest-api" ? {
+			env_file: [{
+				path: `./${app.name}.env`,
+				format: "raw"
+			}],
+			...infra.length ? { depends_on: Object.fromEntries(infra.map((name) => [name, HEALTHY])) } : {}
+		} : {},
+		healthcheck: probe(app.port, app.kind === "site" ? "/" : "/health")
+	};
+	for (const worker of options.workers) services[worker.name] = {
+		image: worker.ref,
+		...worker.build ? { build: composeBuildPaths({
+			composeDir: options.composeDir,
+			buildRoot: options.buildRoot,
+			workspaceRoot: options.workspaceRoot,
+			dockerfile: worker.build.dockerfile
+		}) } : {},
+		restart: "unless-stopped",
+		env_file: [{
+			path: `./${worker.name}.env`,
+			format: "raw"
+		}],
+		...infra.length ? { depends_on: Object.fromEntries(infra.map((name) => [name, HEALTHY])) } : {},
+		healthcheck: probe(worker.port, "/health")
+	};
+	if (options.proxy === "caddy") services.caddy = {
+		image: DEFAULT_IMAGES.caddy,
+		restart: "unless-stopped",
+		ports: [`${options.https}:443`, `${options.http}:80`],
+		volumes: [
+			"./Caddyfile:/etc/caddy/Caddyfile:ro",
+			"caddy-data:/data",
+			"caddy-config:/config",
+			...options.tls ? [`./tls:${CADDY_TLS_DIR}:ro`] : []
+		],
+		depends_on: Object.fromEntries(apps.map((app) => [app.name, HEALTHY])),
+		healthcheck: {
+			test: [
+				"CMD",
+				"caddy",
+				"version"
+			],
+			interval: "10s",
+			timeout: "5s",
+			retries: 5
+		}
+	};
+	for (const [service, alias] of options.edge) {
+		const definition = services[service];
+		if (!definition) continue;
+		definition.networks = {
+			default: { aliases: [alias] },
+			edge: { aliases: [alias] }
+		};
+	}
+	for (const service of Object.values(services)) {
+		if (!options.envFiles) delete service.env_file;
+		service.logging = {
+			driver: LOG_ROTATION.driver,
+			options: { ...LOG_ROTATION.options }
+		};
+	}
+	return {
+		name: project,
+		services,
+		volumes,
+		...options.edge.size > 0 ? { networks: { edge: {
+			name: EDGE_NETWORK,
+			external: true
+		} } } : {}
+	};
+}
+/**
+* A build without a layout: the workspace is the build root, with pnpm.
+* What a caller that never looked at the filesystem gets.
+*/
+function defaultLayout(root) {
+	return {
+		buildRoot: root,
+		gkmRoot: ".",
+		tools: {
+			packageManager: "pnpm",
+			turboVersion: TURBO_VERSION,
+			monorepo: true
+		},
+		gkmPaths: ["gkm.config.*"]
+	};
+}
+/** Render an app's env file: one `KEY=value` per line, read raw by compose. */
+function envFile(env) {
+	return `${Object.entries(env).sort(([a], [b]) => a.localeCompare(b)).map(([key, value]) => `${key}=${value}`).join("\n")}\n`;
+}
+//#endregion
+//#region src/target/compose/health.ts
+/**
+* Asking each app of a stack whether it answers — through Caddy, over HTTPS,
+* the way a browser reaches it.
+*
+* `docker compose up --wait` already knows each container passed its own
+* health check, asked on 127.0.0.1 inside it. What that cannot say is whether
+* the stack is reachable: whether the edge routes the host to the app, and
+* whether the certificate it presents is one a client accepts. So the check
+* goes through the edge, by hostname, and verifies the certificate.
+*/
+/** A request that got no answer in time. */
+var HealthRequestTimedOut = class extends Error {
+	url;
+	timeoutMs;
+	constructor(url, timeoutMs) {
+		super(`${url} did not answer within ${timeoutMs}ms. Check the stack is up with \`docker compose ps\`.`);
+		this.url = url;
+		this.timeoutMs = timeoutMs;
+		this.name = "HealthRequestTimedOut";
+	}
+};
+/** The real probe: one HTTPS GET, the certificate verified. */
+const httpsProbe = ({ url, ca, connectTo, connectPort, timeoutMs, signal }) => {
+	const target = new URL(url);
+	return new Promise((resolve, reject) => {
+		const req = request({
+			host: connectTo ?? target.hostname,
+			port: connectPort ?? (target.port || 443),
+			servername: target.hostname,
+			path: `${target.pathname}${target.search}`,
+			method: "GET",
+			headers: { host: target.host },
+			...ca ? { ca } : {},
+			...signal ? { signal } : {},
+			timeout: timeoutMs
+		}, (res) => {
+			res.resume();
+			res.on("end", () => resolve(res.statusCode ?? 0));
+			res.on("error", reject);
+		});
+		req.on("timeout", () => req.destroy(new HealthRequestTimedOut(url, timeoutMs)));
+		req.on("error", reject);
+		req.end();
+	});
+};
+/** Whether a status means the app answered as it should. */
+function isHealthy(status) {
+	return status >= 200 && status < 400;
+}
+/** Apps that did not answer through the edge. */
+var ComposeAppsUnhealthy = class extends Error {
+	project;
+	apps;
+	proxy;
+	constructor(project, apps, proxy = "caddy") {
+		const names = apps.map((a) => a.app).join(" ");
+		super(`${project} started, but ${apps.length === 1 ? "this app does" : "these apps do"} not answer through ${proxy === "caddy" ? "Caddy" : "the shared Traefik edge"}:\n` + apps.map(({ url, last }) => `  - ${url}: ${last}`).join("\n") + (proxy === "caddy" ? `\nSee why with \`docker compose -p ${project} logs caddy ${names}\`.` : `\nSee why with \`docker compose -p gkm-edge logs traefik\` and \`docker compose -p ${project} logs ${names}\`.`));
+		this.project = project;
+		this.apps = apps;
+		this.proxy = proxy;
+		this.name = "ComposeAppsUnhealthy";
+	}
+};
+//#endregion
+//#region src/target/compose/phases.ts
+/**
+* The compose target's phases: a stage as one Docker Compose stack behind
+* Caddy, on the machine the deploy runs on.
+*
+* The order is the point of this file, and the rules it keeps are these:
+*
+* - A tag is checked before anything happens (`validate`). Every app's image
+*   is asked of the registry first; one missing image stops the run naming
+*   them all, and nothing is written, pulled or started.
+* - The databases exist before the apps do (`provision`). Postgres comes up
+*   alone, its databases, roles and grants are created, its migrations
+*   applied and its seeds run from this machine, and only then do the apps
+*   start — so an app
+*   never boots against a schema that is not there yet.
+* - What a stage runs is recorded (`release`). Each app's image, the tag it
+*   was released under and the digest it resolved to are written to the
+*   stage's state, so "what is this stage running" has an exact answer.
+* - What was started answers (`verify`): each app is asked through Caddy,
+*   over HTTPS, with the certificate verified.
+*
+* Every image is built inside Docker from a pruned slice of the build root —
+* the same Dockerfiles `gkm docker` writes — so nothing is built on this
+* machine before `docker compose build`.
+*
+* Docker, the registry, Postgres and the health probe are
+* injected, so the rules are asserted without a daemon; the defaults are the
+* real ones.
+*/
+/** `--push` without `--build`: there is nothing built here to push. */
+var ComposePushNeedsBuild = class extends Error {
+	constructor() {
+		super("--push pushes the images this checkout builds, so it needs --build (and never --pull): gkm compose --stage <stage> --build --push --tag <tag>.");
+		this.name = "ComposePushNeedsBuild";
+	}
+};
+/** Digests to run by, on a run that pulls nothing. */
+var ComposePinNeedsPull = class extends Error {
+	constructor() {
+		super("--digests-file pins the images a release pulls, so it needs --tag (or --pull) — or, with --build --push, it is where the pushed digests are written.");
+		this.name = "ComposePinNeedsPull";
+	}
+};
+/** A port variable that does not hold a port. */
+var EdgePortInvalid = class extends Error {
+	variable;
+	value;
+	constructor(variable, value) {
+		super(`${variable}=${value} is not a port. Set it to a number between 1 and 65535, or unset it for the default.`);
+		this.variable = variable;
+		this.value = value;
+		this.name = "EdgePortInvalid";
+	}
+};
+/** A build with no commit to tag its images with. */
+var NoGitRevision = class extends Error {
+	root;
+	constructor(root) {
+		super(`Images built here are tagged with the commit they were built from, and ${root} is not in a git repository with a commit. Commit, or pass --tag to name the images yourself.`);
+		this.root = root;
+		this.name = "NoGitRevision";
+	}
+};
+/**
+* The project's own file merged over a stage's stack: `docker-compose.<stage>.yml`
+* at the workspace root. What the generated file cannot know — a port bound
+* to a tailnet address, another log driver — goes there, and is never
+* overwritten.
+*/
+function stackOverrideFile(root, stage) {
+	return join(root, `docker-compose.${stage}.yml`);
+}
+/** The commit HEAD is at, short — and `-dirty` when the tree has changes. */
+async function gitRevision(root) {
+	let sha;
+	try {
+		sha = (await runOutput("git", [
+			"rev-parse",
+			"--short",
+			"HEAD"
+		], { cwd: root })).trim();
+	} catch {
+		throw new NoGitRevision(root);
+	}
+	if (!sha) throw new NoGitRevision(root);
+	return (await runOutput("git", ["status", "--porcelain"], { cwd: root }).catch(() => "")).trim() ? `${sha}-dirty` : sha;
+}
+/** The edge's ports, from the environment — 443 and 80 when unset. */
+function edgePorts(env = process.env) {
+	const read = (variable, fallback) => {
+		const value = env[variable];
+		if (value === void 0 || value === "") return fallback;
+		const port = Number(value);
+		if (!Number.isInteger(port) || port < 1 || port > 65535) throw new EdgePortInvalid(variable, value);
+		return port;
+	};
+	const logs = env["GKM_COMPOSE_LOGS_PORT"] ? read(LOGS_PORT_ENV, 0) : void 0;
+	return {
+		https: read(EDGE_PORT_ENV.https, 443),
+		http: read(EDGE_PORT_ENV.http, 80),
+		...logs ? { logs } : {}
+	};
+}
+/**
+* The real ones. Each app is asked for three minutes before it counts as
+* down: a deployed stage's first ACME certificate can take that long.
+*/
+const defaultDeps = {
+	docker: dockerCompose,
+	revision: gitRevision,
+	sql: pgClient,
+	buckets: bucketClient,
+	logins: ensurePostgresLogin,
+	migrate: migrateDatabases,
+	seed: seedDatabases,
+	probe: httpsProbe,
+	healthAttempts: 90,
+	healthIntervalMs: 2e3,
+	env: process.env,
+	lookup: systemLookup
+};
+/**
+* The stack the stage would run, and — for a tag — the registry's word that
+* every image it names exists. Nothing is written: a missing image stops the
+* run here, before a file, a secret or a container is touched.
+*/
+async function validateCompose(ctx, deps, options = {}) {
+	const { workspace, stage, identity, tag } = ctx;
+	const root = workspace.root;
+	const mode = options.mode ?? (ctx.tagGiven ? "pull" : "build");
+	const push = options.push === true;
+	if (push && mode !== "build") throw new ComposePushNeedsBuild();
+	if (options.pin && mode !== "pull") throw new ComposePinNeedsPull();
+	const registry = workspace.deploy?.registry;
+	if (!registry && (push || mode === "pull")) throw new RegistryRequired(push ? "push" : "pull", imageRef(identity, ctx.apps[0] ?? workspace.name, void 0, tag));
+	const runnables = {};
+	const background = {};
+	const manifest = await discover({
+		patterns: constructGlobs(workspace),
+		cwd: root,
+		runnables,
+		background
+	});
+	const { secrets, generated } = await stageSecrets(ctx, manifest);
+	const server = push || stage === workspace.stages.local ? void 0 : requiredServerAddress(stage, workspace.domains?.[stage], secrets?.custom);
+	if (!push) {
+		assertNoStaleSecrets({
+			manifest,
+			stage,
+			supplied: secrets?.custom ?? {}
+		});
+		await assertStageCredentials({
+			root,
+			patterns: constructGlobs(workspace),
+			manifest,
+			stage,
+			supplied: secrets?.custom ?? {}
+		});
+	}
+	const layout = mode === "build" ? imageLayout(workspace) : void 0;
+	const composed = composeStack({
+		workspace,
+		manifest,
+		runnables,
+		background,
+		stage,
+		identity,
+		images: {
+			mode,
+			tag,
+			...registry ? { registry } : {}
+		},
+		secrets,
+		...stage === workspace.stages.local ? { localCredentials: (await loadLocalCredentials(workspace)).credentials } : {},
+		allowDevServices: ctx.allowDevServices,
+		ports: edgePorts(deps.env),
+		...layout ? { layout } : {},
+		...push ? { buildOnly: true } : {}
+	});
+	reportDevServices(ctx, composed.devServices);
+	if (!push && stage !== workspace.stages.local) {
+		const verified = await verifyStageProviders({
+			workspace,
+			manifest,
+			stage,
+			secrets: secrets?.custom ?? {}
+		});
+		for (const line of verified) ctx.logger.info(`✓ ${line} verified`);
+	}
+	if (mode === "build") assertRedisClient(workspace, composed);
+	const stack = options.pin ? withPinnedImages(composed, options.pin.file, options.pin.digests) : composed;
+	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, [...stack.apps, ...stack.workers]);
+	if (stack.tls && !push) {
+		for (const file of [stack.tls.certFile, stack.tls.keyFile]) if (!existsSync(file)) throw new ComposeTlsFileMissing(stage, file);
+	}
+	if (!push && !stack.local) await checkDns(ctx, deps, stackHosts(stack).filter((host) => !isLocalHost(host)), server);
+	if (stack.redis && !stack.local) ctx.secrets.mask(stack.redis.password);
+	if (stack.logs && (!stack.local || stack.logs.passwordFromSecrets)) {
+		ctx.secrets.mask(stack.logs.password);
+		ctx.secrets.mask(stack.logs.appEnv.OTEL_EXPORTER_OTLP_HEADERS);
+	}
+	const dir = join(root, stackDir(stage));
+	const override = stackOverrideFile(root, stage);
+	const overrides = existsSync(override) ? [override] : [];
+	if (overrides.length > 0) ctx.logger.info(`🧩 Merging docker-compose.${stage}.yml over the generated stack`);
+	const recorded = push ? void 0 : await ctx.state.read(stage);
+	const previous = Object.fromEntries(Object.entries(recorded?.state.releases ?? {}).map(([name, releases]) => {
+		const { ref, tag, digest } = releases.current;
+		return [name, {
+			ref,
+			...tag ? { tag } : {},
+			...digest ? { digest } : {}
+		}];
+	}));
+	return {
+		mode,
+		push,
+		stack,
+		dir,
+		ref: {
+			project: composeProject(identity),
+			file: join(dir, "docker-compose.yml"),
+			...overrides.length > 0 ? { overrides } : {},
+			cwd: root,
+			output: ctx.childOutput,
+			signal: ctx.signal
+		},
+		secrets,
+		generated,
+		previous,
+		files: [],
+		images: {},
+		changes: []
+	};
+}
+/** A stack whose caches are in Redis, built for an app that has no client. */
+var RedisClientMissing = class extends Error {
+	apps;
+	constructor(apps) {
+		super(`The stack keeps every cache in Redis, and ${apps.join(", ")} ${apps.length === 1 ? "does" : "do"} not depend on ioredis, the client the generated server reaches it with. Add it to the workspace: pnpm add ioredis`);
+		this.apps = apps;
+		this.name = "RedisClientMissing";
+	}
+};
+/**
+* Every backend and worker image built for a stack with a cache can resolve
+* `ioredis` — listed by its app or a directory above it, the way Node and
+* the image's install find it.
+*/
+function assertRedisClient(workspace, stack) {
+	if (!stack.plan.resources.some((r) => r.kind === "cache")) return;
+	const missing = [.../* @__PURE__ */ new Set([...stack.apps.filter((app) => app.kind === "rest-api").map((a) => a.name), ...stack.workers.map((worker) => worker.host)])].filter((name) => {
+		const app = workspace.apps[name];
+		return app && !installedFrom(join(workspace.root, app.path), "ioredis");
+	}).sort();
+	if (missing.length > 0) throw new RedisClientMissing(missing);
+}
+/**
+* The stage's secrets — and, for a deployed stage, everything it generates
+* once: its seed, and each declared secret and keyring. Kept only once the
+* run goes ahead (`provision`), so a dry run, or a tag that is not there,
+* leaves the stage's secrets as it found them.
+*/
+/**
+* The deploy-time DNS check: each public host resolved with the system
+* resolver and compared with the server's address from the stage's secrets.
+* A dry run warns rather than stops.
+*/
+async function checkDns(ctx, deps, hosts, server) {
+	const { workspace, stage } = ctx;
+	if (hosts.length === 0) return;
+	if (ctx.skipDnsCheck) {
+		ctx.logger.info("🌐 DNS check skipped (--skip-dns-check)");
+		return;
+	}
+	if (!server) {
+		ctx.logger.info(`🌐 DNS check skipped: no ${SERVER_IPV4_KEY} in '${stage}''s secrets — ${serverAddressHint(stage)}`);
+		return;
+	}
+	try {
+		const ok = await checkStackDns({
+			stage,
+			hosts,
+			server,
+			dns: workspace.dns,
+			lookup: deps.lookup ?? systemLookup
+		});
+		ctx.logger.info(`🌐 ${ok.length} host${ok.length === 1 ? "" : "s"} resolve${ok.length === 1 ? "s" : ""} to ${server.ipv4}`);
+	} catch (error) {
+		if (ctx.dryRun && error instanceof HostNotPointingAtServer) {
+			ctx.logger.warn(`⚠ ${error.message}`);
+			return;
+		}
+		throw error;
+	}
+}
+async function stageSecrets(ctx, manifest) {
+	const stored = await ctx.secrets.read();
+	if (ctx.stage === ctx.workspace.stages.local) return {
+		secrets: stored,
+		generated: []
+	};
+	const { secrets, generated } = deployedStackSecrets(ctx.workspace, ctx.stage, stored, manifest);
+	if (secrets.seed) ctx.secrets.mask(secrets.seed);
+	for (const value of Object.values(secrets.custom ?? {})) ctx.secrets.mask(value);
+	return {
+		secrets,
+		generated
+	};
+}
+/**
+* The stack with each app's and worker's image pinned to the digest the file
+* names: the refs it is checked, pulled and recorded by, and the image each
+* compose service runs.
+*/
+function withPinnedImages(stack, file, digests) {
+	const apps = pinImages(file, digests, stack.apps);
+	const workers = pinImages(file, digests, stack.workers);
+	const services = { ...stack.compose.services };
+	for (const image of [...apps, ...workers]) services[image.name] = {
+		...services[image.name],
+		image: image.ref
+	};
+	return {
+		...stack,
+		apps,
+		workers,
+		compose: {
+			...stack.compose,
+			services
+		}
+	};
+}
+/**
+* A dry run: the stack's files, written so they can be read, and what a real
+* run would do — no image is built or pulled, no container touched, nothing
+* recorded and no secret kept.
+*/
+async function planCompose(ctx, run) {
+	if (run.generated.length > 0) ctx.logger.info(`🔑 "${ctx.stage}" has no ${run.generated.join(", ")} yet; this dry run used values it did not keep.`);
+	run.files = await writeStack(ctx.cwd, run.dir, run.stack);
+	printPlan(ctx, run);
+	if (!run.push && run.stack.infra.includes("postgres")) reportPlannedSeeds((await plannedSeeds({
+		root: ctx.workspace.root,
+		manifest: ctx.manifest
+	})).map(({ target, seeds }) => ({
+		folder: target.seeds,
+		seeds
+	})), (line) => ctx.logger.info(line));
+	const planned = (change) => {
+		run.changes.push(change);
+		ctx.emit({
+			type: "resource.planned",
+			...change
+		});
+	};
+	for (const service of run.push ? [] : run.stack.infra) planned({
+		key: `service:${service}`,
+		resourceType: "service",
+		action: "ensure"
+	});
+	for (const app of run.stack.apps) {
+		planned({
+			key: `image:${app.name}`,
+			resourceType: "image",
+			action: run.mode === "build" ? "build" : "reuse",
+			id: app.ref
+		});
+		if (run.push) continue;
+		planned({
+			key: `service:${app.name}`,
+			resourceType: "service",
+			action: run.previous[app.name] ? "reuse" : "create"
+		});
+	}
+	for (const worker of run.stack.workers) {
+		planned({
+			key: `image:${worker.name}`,
+			resourceType: "image",
+			action: run.mode === "build" ? "build" : "reuse",
+			id: worker.ref
+		});
+		if (run.push) continue;
+		planned({
+			key: `service:${worker.name}`,
+			resourceType: "service",
+			action: run.previous[worker.name] ? "reuse" : "create"
+		});
+	}
+	if (!run.push) planned({
+		key: run.stack.proxy === "caddy" ? "service:caddy" : `service:${EDGE_PROJECT}/${EDGE_SERVICE}`,
+		resourceType: "service",
+		action: "ensure"
+	});
+}
+/**
+* What the apps run on: the stage's generated secrets kept, the stack's files
+* written, its infrastructure started, and its databases, roles, grants and
+* migrations applied.
+*/
+async function provisionCompose(ctx, run, deps) {
+	const { stack, ref } = run;
+	if (run.push) return;
+	if (run.generated.length > 0 && run.secrets) {
+		await ctx.secrets.write(run.secrets);
+		ctx.logger.info(`🔑 Generated for "${ctx.stage}" (${ctx.secrets.store}): ${run.generated.join(", ")}`);
+	}
+	const ports = edgePorts(deps.env);
+	await assertEdgePorts(deps.docker, {
+		project: stack.project,
+		proxy: stack.proxy,
+		ports
+	});
+	run.files = await writeStack(ctx.cwd, run.dir, stack);
+	printPlan(ctx, run);
+	if (stack.proxy === "traefik") {
+		const dir = edgeDir(deps.env);
+		ctx.logger.info(`\n🌐 Starting the shared edge (${EDGE_PROJECT}) from ${dir}…`);
+		run.files.push(...await ensureEdge(deps.docker, {
+			dir,
+			ports,
+			logging: {
+				driver: LOG_ROTATION.driver,
+				options: { ...LOG_ROTATION.options }
+			},
+			...ref.output ? { output: ref.output } : {},
+			...ref.signal ? { signal: ref.signal } : {}
+		}));
+		applied(ctx, run, {
+			key: `service:${EDGE_PROJECT}/${EDGE_SERVICE}`,
+			resourceType: "service",
+			action: "ensure",
+			id: `${EDGE_PROJECT}/${EDGE_SERVICE}`,
+			via: "found"
+		});
+	}
+	if (stack.infra.length > 0) {
+		ctx.logger.info(`\n🗄️  Starting ${stack.infra.join(", ")}…`);
+		await deps.docker.up(ref, stack.infra);
+		for (const service of stack.infra) applied(ctx, run, {
+			key: `service:${service}`,
+			resourceType: "service",
+			action: "ensure",
+			id: `${stack.project}/${service}`,
+			via: Object.keys(run.previous).length > 0 ? "recorded" : "created"
+		});
+	}
+	if (stack.infra.includes("postgres")) await prepareDatabases(ctx, run, deps);
+	if (stack.storage && stack.infra.includes("minio")) await prepareBuckets(ctx, run, deps);
+}
+/**
+* Create each bucket the stack's MinIO serves, and the open paths of each
+* one a file server fronts — from this machine, on MinIO's loopback port,
+* the way `gkm dev` creates them.
+*/
+async function prepareBuckets(ctx, run, deps) {
+	const storage = run.stack.storage;
+	if (storage.buckets.length === 0) return;
+	const port = await deps.docker.port(run.ref, "minio", 9e3);
+	const client = deps.buckets(port, storage);
+	const created = [...await applyBuckets(client, storage.buckets), ...await applyPolicies(client, storage.policies)].filter((entry) => entry.created).length;
+	ctx.logger.info(`🪣  Buckets: ${storage.buckets.join(", ")}${created ? ` (${created} change(s))` : ""}`);
+}
+/**
+* Create what the plan names in the stack's Postgres, migrate it, then run
+* its seeds — every one, every time, as each construct's owner.
+*/
+async function prepareDatabases(ctx, run, deps) {
+	const { stack } = run;
+	const workspace = ctx.workspace;
+	const port = await deps.docker.port(run.ref, "postgres", 5432);
+	const superuser = stack.credential.containers.postgres;
+	const login = await deps.logins({
+		port,
+		login: superuser,
+		legacy: [{
+			user: LEGACY_LOCAL_LOGIN.user,
+			password: superuser.password
+		}, ...stack.local ? [LEGACY_LOCAL_LOGIN] : []]
+	});
+	if (login.notice) ctx.logger.info(login.notice);
+	const statements = postgresStatements(stack.plan, workspace.name, stack.credential.seed);
+	if (statements.length > 0) {
+		ctx.logger.info("🗄️  Creating databases, roles and grants…");
+		await applyPostgres(deps.sql(port, login.login), statements);
+	}
+	const sources = {};
+	const manifest = await discover({
+		patterns: constructGlobs(workspace),
+		cwd: workspace.root,
+		sources
+	});
+	const env = envFor(stack.plan, {
+		ports: { [primaryPortKey("postgres")]: port },
+		project: workspace.name,
+		credentials: {
+			...stack.credential.containers,
+			postgres: login.login
+		},
+		seed: stack.credential.seed
+	});
+	const options = {
+		root: workspace.root,
+		manifest,
+		sources,
+		env
+	};
+	const runs = await deps.migrate(options);
+	const seeds = await deps.seed({
+		...options,
+		stage: ctx.stage
+	}).catch((error) => {
+		if (error instanceof SeedFailed) throw new DeploySeedsFailed(ctx.stage, error.construct, error.seed, error);
+		throw error;
+	});
+	reportDatabaseRuns(runs.map(({ target, applied }) => ({
+		construct: target.id,
+		folder: target.migrations,
+		applied
+	})), seeds.map(({ target, seeded }) => ({
+		construct: target.id,
+		folder: target.seeds,
+		seeded
+	})), (line) => ctx.logger.info(line), (event) => ctx.emit(event));
+}
+/**
+* Each app's image: built from this checkout — inside Docker, every one of
+* them, from a pruned slice of the build root — or pulled at the tag. Nothing
+* live changes.
+*/
+async function buildCompose(ctx, run, deps) {
+	const { stack, ref } = run;
+	const images = [...stack.apps, ...stack.workers];
+	const apps = images.map((image) => image.app);
+	if (run.push) {
+		run.files = await writeStack(ctx.cwd, run.dir, stack);
+		printPlan(ctx, run);
+	}
+	if (run.mode === "build") {
+		ctx.logger.info("\n🐳 Building images…");
+		await deps.docker.build(ref, apps);
+	} else {
+		ctx.logger.info(`\n🐳 Pulling ${ctx.tag}…`);
+		await deps.docker.pull(ref, apps);
+	}
+	if (run.push) ctx.logger.info("\n📤 Pushing images…");
+	for (const image of images) {
+		const digest = run.push ? await deps.docker.push(ref, image.ref) : await deps.docker.digest(image.ref);
+		if (run.push) ctx.logger.info(`   ${image.app.padEnd(12)} ${image.ref}@${digest}`);
+		run.images[image.app] = {
+			ref: image.ref,
+			tag: image.tag,
+			...digest ? { digest } : {}
+		};
+		ctx.emit({
+			type: "artifact.built",
+			app: image.app,
+			imageRef: image.ref,
+			...digest ? { digest } : {}
+		});
+		run.changes.push({
+			key: `image:${image.app}`,
+			resourceType: "image",
+			action: run.mode === "build" ? "build" : "reuse",
+			id: digest ?? image.ref
+		});
+	}
+}
+/**
+* The whole stack up — anything it no longer defines removed — and each
+* app's image recorded in the stage's state.
+*/
+async function releaseCompose(ctx, run, deps) {
+	const { stack, ref } = run;
+	if (run.push) return;
+	ctx.logger.info("\n🚀 Starting the stack…");
+	await deps.docker.up(ref);
+	const edge = edgeDir(deps.env);
+	if (stack.proxy === "traefik" && stack.traefik) {
+		const written = await writeEdgeRoutes(edge, stack.project, stack.traefik, stack.tls);
+		run.files.push(...written);
+		ctx.logger.info(`🌐 Registered ${stack.routes.length} route(s) with ${EDGE_PROJECT}: ${written.at(-1)}`);
+	} else await removeEdgeRoutes(edge, stack.project);
+	if (stack.local) await deps.docker.copyOut(ref, "caddy", "/data/caddy/pki/authorities/local/root.crt", caFile(run)).catch(() => {});
+	await recordImages(ctx, run);
+	for (const app of stack.apps) {
+		const image = run.images[app.name];
+		applied(ctx, run, {
+			key: `service:${app.name}`,
+			resourceType: "service",
+			action: "ensure",
+			id: `${stack.project}/${app.name}`,
+			via: run.previous[app.name] ? "recorded" : "created"
+		});
+		ctx.emit({
+			type: "app.deployed",
+			app: app.name,
+			applicationId: `${stack.project}/${app.name}`,
+			imageRef: image?.ref ?? app.ref,
+			url: app.url
+		});
+	}
+	for (const worker of stack.workers) applied(ctx, run, {
+		key: `service:${worker.name}`,
+		resourceType: "service",
+		action: "ensure",
+		id: `${stack.project}/${worker.name}`,
+		via: run.previous[worker.name] ? "recorded" : "created"
+	});
+	ctx.logger.info(`\n✅ ${stack.project} is running:`);
+	for (const app of stack.apps) ctx.logger.info(`   ${app.name.padEnd(12)} ${app.url}`);
+	for (const worker of stack.workers) ctx.logger.info(`   ${worker.name.padEnd(12)} worker ${worker.id}`);
+	if (stack.local) ctx.logger.info(`\n🔐 Certificates are from Caddy's local CA: NODE_EXTRA_CA_CERTS=${join(stackDir(ctx.stage), "caddy-root.crt")}`);
+}
+/**
+* Each app's image in the stage's state — the same `images` a Dokploy deploy
+* records: the ref it runs, the tag it was released under, and the digest
+* the tag resolved to.
+*/
+async function recordImages(ctx, run) {
+	const journal = await DeployJournal.open(ctx.state, ctx.stage, () => createEmptyState(ctx.stage, "", ""));
+	for (const app of [...run.stack.apps, ...run.stack.workers]) {
+		const image = run.images[app.app] ?? {
+			ref: app.ref,
+			tag: app.tag
+		};
+		recordRelease(journal.state, app.app, image);
+	}
+	journal.state.identity = ctx.identity.key;
+	await journal.save();
+}
+/**
+* Each app asked through Caddy, over HTTPS, the certificate verified: an API
+* at `/health`, a site at `/`. On the local stage the edge is this machine and
+* its certificates are Caddy's internal CA's, so the CA `release` copied out
+* is the one trusted and the request goes to 127.0.0.1.
+*/
+async function verifyCompose(ctx, run, deps) {
+	const { stack } = run;
+	if (run.push) return;
+	const ca = stack.local ? await readFile(caFile(run), "utf-8").catch(() => void 0) : void 0;
+	ctx.logger.info(`\n🩺 Checking each app through ${stack.proxy === "caddy" ? "Caddy" : "the shared edge"}…`);
+	const edge = stack.local || stack.proxy === "traefik" ? {
+		connectTo: "127.0.0.1",
+		...stack.local ? {} : { connectPort: edgePorts(deps.env).https }
+	} : void 0;
+	const results = await Promise.all(stack.apps.map((app) => checkApp(ctx, app, deps, {
+		ca,
+		edge
+	})));
+	results.push(...await Promise.all(stack.workers.map((worker) => checkContainer(ctx, run, deps, worker.name))));
+	if (stack.logs) results.push(await checkContainer(ctx, run, deps, LOGS_SERVICE));
+	const down = results.filter((result) => !result.healthy).map(({ app, url, last }) => ({
+		app,
+		url,
+		last
+	}));
+	if (down.length > 0) throw new ComposeAppsUnhealthy(stack.project, down, stack.proxy);
+	if (stack.logs) reportLogs(ctx, stack.logs, stack.local);
+}
+/**
+* A container's own health check, as Docker reports it: a worker's, which
+* has no route through the edge, and OpenObserve's — by default it has no
+* host there, and served publicly it answers only the addresses it allows,
+* which need not include this one.
+*/
+async function checkContainer(ctx, run, deps, service) {
+	const url = `docker:${service}`;
+	let last = "not asked";
+	for (let attempt = 1; attempt <= deps.healthAttempts; attempt++) {
+		ctx.signal.throwIfAborted();
+		const health = await deps.docker.health(run.ref, service).catch((error) => error instanceof Error ? error.message : String(error));
+		last = health ?? "not running";
+		const healthy = health === "healthy";
+		ctx.emit({
+			type: "health.checked",
+			app: service,
+			url,
+			healthy,
+			attempt
+		});
+		if (healthy) {
+			ctx.logger.info(`   ✓ ${service.padEnd(12)} ${url} (${last})`);
+			return {
+				app: service,
+				url,
+				last,
+				healthy
+			};
+		}
+		if (attempt < deps.healthAttempts) await new Promise((resolve) => setTimeout(resolve, deps.healthIntervalMs));
+	}
+	ctx.logger.warn(`   ✗ ${service.padEnd(12)} ${url} (${last})`);
+	return {
+		app: service,
+		url,
+		last,
+		healthy: false
+	};
+}
+/** How to open the logs, printed — and as an event, for a headless caller. */
+function reportLogs(ctx, logs, local) {
+	const lines = logsAccess(logs, {
+		stage: ctx.stage,
+		local,
+		user: currentUser(),
+		hostname: hostname()
+	});
+	ctx.logger.info(`\n${lines.join("\n")}`);
+	ctx.emit({
+		type: "logs.ready",
+		service: LOGS_SERVICE,
+		access: logs.public ? "public" : "tunnel",
+		url: logs.url,
+		...logs.public ? { allow: [...logs.public.allow] } : { port: logs.port },
+		email: logs.email
+	});
+}
+/** This machine's user — a guess at who would SSH in. */
+function currentUser() {
+	try {
+		return userInfo().username;
+	} catch {
+		return process.env.USER ?? "user";
+	}
+}
+async function checkApp(ctx, app, deps, options) {
+	const url = `${app.url}${app.kind === "site" ? "/" : "/health"}`;
+	let last = "not asked";
+	for (let attempt = 1; attempt <= deps.healthAttempts; attempt++) {
+		ctx.signal.throwIfAborted();
+		let status;
+		try {
+			status = await deps.probe({
+				url,
+				...options.ca ? { ca: options.ca } : {},
+				...options.edge,
+				timeoutMs: 1e4,
+				signal: ctx.signal
+			});
+			last = `HTTP ${status}`;
+		} catch (error) {
+			last = error instanceof Error ? error.message : String(error);
+		}
+		const healthy = status !== void 0 && isHealthy(status);
+		ctx.emit({
+			type: "health.checked",
+			app: app.name,
+			url,
+			healthy,
+			...status !== void 0 ? { status } : {},
+			attempt
+		});
+		if (healthy) {
+			ctx.logger.info(`   ✓ ${app.name.padEnd(12)} ${url} (${last})`);
+			return {
+				app: app.name,
+				url,
+				last,
+				healthy
+			};
+		}
+		if (attempt < deps.healthAttempts) await new Promise((resolve) => setTimeout(resolve, deps.healthIntervalMs));
+	}
+	ctx.logger.warn(`   ✗ ${app.name.padEnd(12)} ${url} (${last})`);
+	return {
+		app: app.name,
+		url,
+		last,
+		healthy: false
+	};
+}
+function composeResult(ctx, run) {
+	const apps = [...run.stack.apps.map((app) => {
+		const image = run.images[app.name];
+		return {
+			appName: app.name,
+			type: app.kind === "site" ? "web" : "backend",
+			success: !ctx.dryRun,
+			applicationId: `${run.stack.project}/${app.name}`,
+			imageRef: image?.ref ?? app.ref,
+			...image?.digest ? { digest: image.digest } : {},
+			url: app.url
+		};
+	}), ...run.stack.workers.map((worker) => {
+		const image = run.images[worker.name];
+		return {
+			appName: worker.name,
+			type: "backend",
+			success: !ctx.dryRun,
+			applicationId: `${run.stack.project}/${worker.name}`,
+			imageRef: image?.ref ?? worker.ref,
+			...image?.digest ? { digest: image.digest } : {}
+		};
+	})];
+	return {
+		apps,
+		projectId: run.stack.project,
+		successCount: ctx.dryRun ? 0 : apps.length,
+		failedCount: 0,
+		stage: ctx.stage,
+		identity: ctx.identity.key,
+		tag: ctx.tag,
+		dryRun: ctx.dryRun,
+		environmentId: "",
+		skipped: [...ctx.skipped],
+		urls: Object.fromEntries(run.stack.apps.map((app) => [app.name, app.url])),
+		changes: run.changes
+	};
+}
+function caFile(run) {
+	return join(run.dir, "caddy-root.crt");
+}
+function applied(ctx, run, change) {
+	const { via, ...rest } = change;
+	run.changes.push(rest);
+	ctx.emit({
+		type: "resource.applied",
+		...rest,
+		via
+	});
+}
+/** Write the stack's files: owner-only, since the env files hold secrets. */
+async function writeStack(root, dir, stack) {
+	await mkdir(dir, {
+		recursive: true,
+		mode: 448
+	});
+	await chmod(dir, 448);
+	const files = [];
+	const write = async (path, content, mode = 420) => {
+		await mkdir(dirname(path), { recursive: true });
+		await writeFile(path, content, { mode });
+		await chmod(path, mode);
+		files.push(path);
+	};
+	await write(join(dir, "docker-compose.yml"), composeYaml(stack));
+	if (stack.caddyfile !== void 0) {
+		await write(join(dir, "Caddyfile"), stack.caddyfile);
+		await rm(join(dir, "traefik.yml"), { force: true });
+	} else await rm(join(dir, "Caddyfile"), { force: true });
+	if (stack.traefik !== void 0) await write(join(dir, "traefik.yml"), stack.traefik);
+	if (stack.proxy === "caddy" && stack.tls) {
+		await mkdir(join(dir, "tls"), {
+			recursive: true,
+			mode: 448
+		});
+		await write(join(dir, "tls", "cert.pem"), await readFile(stack.tls.certFile, "utf-8"));
+		await write(join(dir, "tls", "key.pem"), await readFile(stack.tls.keyFile, "utf-8"), 384);
+	} else await rm(join(dir, "tls"), {
+		recursive: true,
+		force: true
+	});
+	for (const app of [...stack.apps, ...stack.workers]) if (app.env) await write(join(dir, `${app.name}.env`), envFile(app.env), 384);
+	if (stack.logs && stack.compose.services["openobserve"]?.env_file) await write(join(dir, `${LOGS_SERVICE}.env`), envFile(stack.logs.env), 384);
+	if (stack.redis && stack.compose.services["redis"]?.env_file) await write(join(dir, `${REDIS_SERVICE}.env`), envFile(stack.redis.env), 384);
+	for (const entry of await readdir(dir)) if (entry.endsWith(".credentials")) await rm(join(dir, entry));
+	for (const [path, content] of Object.entries(stack.dockerfiles)) await write(join(root, path), content);
+	await ensureDockerignore(findBuildRoot(root));
+	return files;
+}
+function composeYaml(stack) {
+	const stage = ` --stage ${stack.stage}`;
+	return `# Generated by gkm compose from the construct manifest — do not edit.
+# The ${stack.stage} stage's APIs and sites behind ${stack.proxy === "caddy" ? "one Caddy" : `the shared Traefik edge (${EDGE_PROJECT})`}, and its workers.
+# Each backend and worker reads exactly the keys in its own env file beside
+# this one.
+#
+#   gkm compose${stage}          start or update it
+#   gkm compose${stage} --down   stop it
+${stringify(stack.compose, {
+		lineWidth: 0,
+		aliasDuplicateObjects: false
+	})}`;
+}
+function printPlan(ctx, run) {
+	const { stack, mode, files } = run;
+	ctx.logger.info(`\n🧱 ${stack.project} — stage ${stack.stage}`);
+	for (const app of stack.apps) ctx.logger.info(`   ${app.name.padEnd(12)} ${app.url.padEnd(40)} ${mode} ${app.ref}`);
+	for (const worker of stack.workers) ctx.logger.info(`   ${worker.name.padEnd(12)} ${`worker ${worker.id} (no route)`.padEnd(40)} ${mode} ${worker.ref}`);
+	if (stack.infra.length > 0) ctx.logger.info(`   infrastructure: ${stack.infra.join(", ")}`);
+	ctx.logger.info(`\n📝 Wrote ${files.length} file(s) under ${stackDir(stack.stage)}/`);
+}
+//#endregion
+//#region src/target/compose/index.ts
+/**
+* The built-in `compose` target: a stage as one Docker Compose stack behind
+* Caddy, on the machine that runs the deploy.
+*
+* ```bash
+* gkm deploy --target compose --stage production --tag v1.4.0  # what CI pushed
+* gkm deploy --target compose --stage production               # built from here
+* gkm deploy --target compose --stage development              # the local stage
+* ```
+*
+* - `validate`: the stack (`composeStack`, pure) and, for a tag, every image
+*   looked up in the registry — `ImageTagNotFound` before anything changes
+* - `plan`: the stack's files and what a run would create or reuse
+* - `provision`: generated secrets kept, files written, infrastructure up,
+*   databases, roles, grants and migrations
+* - `build`: each backend bundled on the host and every image built — or, for
+*   a tag, pulled
+* - `release`: `up --wait --remove-orphans`, and each app's image, tag and
+*   digest in the stage's state
+* - `verify`: each app asked through Caddy over HTTPS
+*
+* With `push` (`gkm compose --build --push`), run with `buildOnly`, it builds
+* every image and pushes it to `deploy.registry`, and does nothing else.
+*
+* `gkm compose` is this target with a few more switches (`--build`, `--pull`,
+* `--down`), run through the same `deploy()`.
+*/
+var compose_exports = /* @__PURE__ */ __exportAll({ composeTarget: () => composeTarget });
+/** The compose target, with its Docker, bundler and probe as given. */
+function composeTarget(options = {}) {
+	const { mode, push, pin, report, ...given } = options;
+	const deps = {
+		...defaultDeps,
+		...given
+	};
+	return defineTarget({
+		name: "compose",
+		runtime: "server",
+		capabilities: {
+			rollback: false,
+			migrations: "target",
+			images: true,
+			localStage: true,
+			selfHostedTelemetry: true
+		},
+		credentials: [],
+		tag: ({ cwd }) => deps.revision(cwd),
+		validate: (ctx) => validateCompose(ctx, deps, {
+			...mode ? { mode } : {},
+			...push ? { push } : {},
+			...pin ? { pin } : {}
+		}),
+		plan: (ctx, run) => planCompose(ctx, run),
+		provision: (ctx, run) => provisionCompose(ctx, run, deps),
+		build: (ctx, run) => buildCompose(ctx, run, deps),
+		release: (ctx, run) => releaseCompose(ctx, run, deps),
+		verify: (ctx, run) => verifyCompose(ctx, run, deps),
+		result: (ctx, run) => {
+			report?.(run);
+			return composeResult(ctx, run);
+		}
+	});
+}
+//#endregion
+export { planStackDns as _, stackOverrideFile as a, serverAddressHint as b, stack_exports as c, pinnedRef as d, edgeDir as f, applyStackDns as g, dockerCompose as h, ComposePushNeedsBuild as i, secrets_exports as l, EDGE_PROJECT as m, compose_exports as n, composeProject as o, removeEdgeRoutes as p, ComposePinNeedsPull as r, stackDir as s, composeTarget as t, parseDigests as u, requiredServerAddress as v, stackHosts as x, serverAddress as y };
+
+//# sourceMappingURL=compose-Bhmf0n4o.mjs.map