@geekmidas/cli 10.0.0-alpha.92 → 10.0.0-alpha.93

package/dist/compose-DrEB_4F-.mjs

@@ -0,0 +1,1476 @@
+import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
+import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
+import { c as runOutput, s as run, x as gkmHome } from "./credentials-C4KII3PD.mjs";
+import { r as discover } from "./discover-qjFapetL.mjs";
+import { it as SERVER_IPV4_KEY, tt as ComposeTlsFileMissing } from "./workspace-Bzw7Zs82.mjs";
+import { t as defineTarget } from "./define-6poNqm5O.mjs";
+import { $t as bucketClient, C as HostNotPointingAtServer, D as serverAddressHint, Dt as constructGlobs, E as requiredServerAddress, Gt as applyPolicies, It as REDIS_SERVICE, Kt as applyPostgres, L as recordRelease, Ln as primaryPortKey, Mt as loadLocalCredentials, N as createComposeState, O as stackHosts, Qt as ensurePostgresLogin, T as isLocalHost, Wt as applyBuckets, Yt as postgresStatements, Zt as LEGACY_LOCAL_LOGIN, an as envFor, cn as imageLayout, en as pgClient, fn as findBuildRoot, gr as logsAccess, gt as reportDevServices, hr as LOGS_SERVICE, i as assertNoStaleSecrets, ir as imageRef, it as currentActor, k as systemLookup, n as reportDatabaseRuns, o as verifyStageProviders, r as reportPlannedSeeds, t as DeploySeedsFailed, u as DeployJournal, w as checkStackDns, y as ensureDockerignore } from "./seeds-BSL55F6q.mjs";
+import { i as installedFrom } from "./drivers-CTaWrA_L.mjs";
+import { _ as edgeComposeFile, a as composeStack, f as pinImages, g as EDGE_SERVICE, h as EDGE_PROJECT, i as composeProject, l as RegistryRequired, m as EDGE_NETWORK, n as LOGS_PORT_ENV, o as envFile, r as LOG_ROTATION, s as stackDir, t as EDGE_PORT_ENV, u as assertImagesExist, v as traefikStaticFile } from "./stack-Co4uZkAo.mjs";
+import { t as deployedStackSecrets } from "./secrets-DbPmAS4k.mjs";
+import { f as plannedSeeds, o as SeedFailed, p as seedDatabases, u as migrateDatabases } from "./databases-BeGP5eDh.mjs";
+import { n as assertStageCredentials } from "./credentialSchemas-BJFvfkaz.mjs";
+import { dirname, join } from "node:path";
+import { existsSync } from "node:fs";
+import { chmod, copyFile, mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
+import { hostname, userInfo } from "node:os";
+import { spawn } from "node:child_process";
+import { stringify } from "yaml";
+import { request } from "node:https";
+//#region src/compose/docker.ts
+/**
+* The Docker operations `gkm compose` needs, behind an interface.
+*
+* Small on purpose, like reconcile's: the rules about *when* each runs — the
+* registry is asked before anything is pulled, nothing is started for a tag
+* that is missing — are asserted against a fake, and this file is only the
+* wiring to the real CLI.
+*
+* Every call is an argument array. Image refs, tags and paths come from the
+* workspace, and none of them reaches a shell.
+*/
+/** `output` as `spawn` reads it. */
+const STDIO = {
+	inherit: "inherit",
+	stderr: [
+		"ignore",
+		2,
+		2
+	],
+	ignore: "ignore"
+};
+/** How a stack's docker commands run: where it is, where output goes. */
+function runOptions(stack, env) {
+	return {
+		cwd: stack.cwd,
+		stdio: STDIO[stack.output ?? "inherit"],
+		...env ? { env } : {},
+		...stack.signal ? { signal: stack.signal } : {}
+	};
+}
+/**
+* The host ports a `docker ps` Ports column publishes: `0.0.0.0:443->443/tcp,
+* [::]:443->443/tcp, 0.0.0.0:9000-9001->9000-9001/tcp`.
+*/
+function publishedPorts(column) {
+	const ports = /* @__PURE__ */ new Set();
+	for (const match of column.matchAll(/(?:[\d.]+|\[[^\]]*\]):(\d+)(?:-(\d+))?->/g)) {
+		const first = Number(match[1]);
+		const last = match[2] ? Number(match[2]) : first;
+		for (let port = first; port <= last; port++) ports.add(port);
+	}
+	return [...ports];
+}
+/** Each line `docker ps` printed, as the containers holding `port`. */
+function portHolders(output, port) {
+	return output.split("\n").filter(Boolean).map((line) => line.split("	")).filter(([, , , column = ""]) => publishedPorts(column).includes(port)).map(([container = "", project, service]) => ({
+		container,
+		...project ? { project } : {},
+		...service ? { service } : {}
+	}));
+}
+/** How long a stack has to pass its health checks. */
+const WAIT_TIMEOUT_S = 180;
+/** `docker compose port` printed nothing a port can be read from. */
+var ServicePortUnknown = class extends GkmError {
+	service;
+	inside;
+	output;
+	constructor(service, inside, output) {
+		super(`'${service}' publishes no host port for ${inside} (docker said: ${output.trim() || "nothing"}). Is it running? \`docker compose ps\` shows the stack.`);
+		this.service = service;
+		this.inside = inside;
+		this.output = output;
+		this.name = "ServicePortUnknown";
+	}
+};
+/**
+* Whether `ref` names a registry on this machine's loopback — which the
+* daemon pulls from and pushes to over plain HTTP by default, and `docker
+* manifest inspect` reaches only when told `--insecure` (without it, a local
+* registry's image is reported as no such manifest).
+*/
+function isLoopbackRegistry(ref) {
+	const first = ref.split("/")[0];
+	if (!ref.includes("/") || !/[.:]|^localhost$/.test(first)) return false;
+	const host = first.replace(/:\d+$/, "");
+	return host === "localhost" || /^127(?:\.\d{1,3}){3}$/.test(host);
+}
+/** `docker push` finished without saying what digest the registry stored. */
+var PushDigestUnknown = class extends GkmError {
+	ref;
+	output;
+	constructor(ref, output) {
+		super(`Pushed ${ref}, but docker did not say which digest the registry stored (it said: ${output.trim().split("\n").slice(-3).join(" / ") || "nothing"}). Check the push with \`docker buildx imagetools inspect ${ref}\`.`);
+		this.ref = ref;
+		this.output = output;
+		this.name = "PushDigestUnknown";
+	}
+};
+/** The digest `docker push` reports last: `<tag>: digest: sha256:… size: …`. */
+function pushedDigest(output) {
+	return [...output.matchAll(/digest: (sha256:[0-9a-f]{64})/g)].at(-1)?.[1];
+}
+function compose(stack, args) {
+	return [
+		"compose",
+		"-p",
+		stack.project,
+		"-f",
+		stack.file,
+		...(stack.overrides ?? []).flatMap((file) => ["-f", file]),
+		...args
+	];
+}
+/** Run a program and keep everything it said, whatever it exits with. */
+function capture(command, args, timeoutMs = 6e4) {
+	return new Promise((resolve, reject) => {
+		const child = spawn(command, [...args], {
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			shell: false
+		});
+		let stdout = "";
+		let stderr = "";
+		child.stdout.on("data", (chunk) => {
+			stdout += chunk.toString();
+		});
+		child.stderr.on("data", (chunk) => {
+			stderr += chunk.toString();
+		});
+		const timer = setTimeout(() => child.kill("SIGKILL"), timeoutMs);
+		timer.unref?.();
+		child.on("error", (error) => {
+			clearTimeout(timer);
+			reject(error);
+		});
+		child.on("close", (code) => {
+			clearTimeout(timer);
+			resolve({
+				code,
+				stdout,
+				stderr
+			});
+		});
+	});
+}
+/**
+* Whether a failed `docker manifest inspect` means the tag is not there, as
+* opposed to the registry not answering.
+*
+* Read off the message because that is all the CLI gives. Anything not
+* recognisably "no such tag" is treated as the registry being unreachable:
+* a registry that refused credentials must not be reported as a tag that was
+* never pushed, or the fix offered would be the wrong one.
+*/
+function isMissingManifest(output) {
+	return /no such manifest|manifest unknown|manifest for .* not found|not found: manifest/i.test(output);
+}
+const dockerCompose = {
+	async lookup(ref) {
+		const { code, stdout, stderr } = await capture("docker", [
+			"manifest",
+			"inspect",
+			...isLoopbackRegistry(ref) ? ["--insecure"] : [],
+			ref
+		]);
+		if (code === 0) return {
+			ref,
+			status: "found"
+		};
+		const output = `${stderr}\n${stdout}`.trim();
+		return isMissingManifest(output) ? {
+			ref,
+			status: "missing"
+		} : {
+			ref,
+			status: "unreachable",
+			detail: output
+		};
+	},
+	async build(stack, services) {
+		await run("docker", compose(stack, ["build", ...services]), runOptions(stack, {
+			...process.env,
+			DOCKER_BUILDKIT: "1"
+		}));
+	},
+	async pull(stack, services) {
+		await run("docker", compose(stack, ["pull", ...services]), runOptions(stack));
+	},
+	async up(stack, services) {
+		await run("docker", compose(stack, [
+			"up",
+			"-d",
+			"--wait",
+			`--wait-timeout=${WAIT_TIMEOUT_S}`,
+			...services ? [] : ["--remove-orphans"],
+			...services ?? []
+		]), runOptions(stack));
+	},
+	async down(stack) {
+		await run("docker", compose(stack, ["down"]), runOptions(stack));
+	},
+	async port(stack, service, inside) {
+		const output = await runOutput("docker", compose(stack, [
+			"port",
+			service,
+			String(inside)
+		]), {
+			cwd: stack.cwd,
+			...stack.signal ? { signal: stack.signal } : {}
+		});
+		const port = Number(output.trim().split(":").pop());
+		if (!Number.isInteger(port) || port <= 0) throw new ServicePortUnknown(service, inside, output);
+		return port;
+	},
+	async health(stack, service) {
+		const { code, stdout } = await capture("docker", [...compose(stack, [
+			"ps",
+			"--format",
+			"{{.Health}}",
+			service
+		])]);
+		if (code !== 0) return void 0;
+		return stdout.trim().split("\n")[0] || void 0;
+	},
+	async copyOut(stack, service, from, to) {
+		await mkdir(dirname(to), { recursive: true });
+		await run("docker", compose(stack, [
+			"cp",
+			`${service}:${from}`,
+			to
+		]), runOptions(stack));
+	},
+	async push(stack, ref) {
+		const output = await runOutput("docker", ["push", ref], {
+			cwd: stack.cwd,
+			...stack.signal ? { signal: stack.signal } : {}
+		});
+		const digest = pushedDigest(output);
+		if (!digest) throw new PushDigestUnknown(ref, output);
+		return digest;
+	},
+	async digest(ref) {
+		const { code, stdout } = await capture("docker", [
+			"image",
+			"inspect",
+			"--format={{json .RepoDigests}} {{.Id}}",
+			ref
+		]);
+		if (code !== 0) return void 0;
+		const [json = "[]", id] = stdout.trim().split(" ");
+		const repository = ref.split("@")[0].replace(/:[\w][\w.-]*$/, "");
+		try {
+			const digests = JSON.parse(json);
+			const match = Array.isArray(digests) ? digests.find((entry) => typeof entry === "string" && entry.startsWith(`${repository}@`)) : void 0;
+			if (match) return match.slice(repository.length + 1);
+		} catch {}
+		return id || void 0;
+	},
+	async ensureNetwork(name) {
+		const { code } = await capture("docker", [
+			"network",
+			"inspect",
+			name
+		]);
+		if (code === 0) return;
+		const created = await capture("docker", [
+			"network",
+			"create",
+			name
+		]);
+		if (created.code !== 0 && !/already exists/.test(created.stderr)) throw new NetworkCreateFailed(name, created.stderr);
+	},
+	async publishers(port) {
+		const { stdout } = await capture("docker", [
+			"ps",
+			"--format",
+			"{{.Names}}	{{.Label \"com.docker.compose.project\"}}	{{.Label \"com.docker.compose.service\"}}	{{.Ports}}"
+		]);
+		return portHolders(stdout, port);
+	}
+};
+/** `docker network create` failed. */
+var NetworkCreateFailed = class extends Error {
+	network;
+	output;
+	constructor(network, output) {
+		super(`Could not create the Docker network '${network}' (docker said: ${output.trim() || "nothing"}). Create it by hand with \`docker network create ${network}\` and run again.`);
+		this.network = network;
+		this.output = output;
+		this.name = "NetworkCreateFailed";
+	}
+};
+//#endregion
+//#region src/compose/edge.ts
+/**
+* The server's shared Traefik edge, on disk and in Docker: started when a
+* stack needs it, and each stack's routes written to — and removed from —
+* the directory it watches.
+*
+* The edge lives in the deploy user's gkm home (`$GKM_HOME/edge`, else
+* `~/.gkm/edge`): the user who runs `gkm compose` owns it, so nothing needs
+* root, and it sits beside the stage keys that same user already keeps.
+*
+*   ~/.gkm/edge/
+*     docker-compose.yml   the edge's compose project (gkm-edge)
+*     traefik.yml          its static configuration
+*     dynamic/<project>.yml  one per stack: its routers, services, middlewares
+*     certs/<project>.crt|.key  a stack's own certificate, where it has one
+*/
+/** The edge's directory on this machine. */
+function edgeDir(env = process.env) {
+	return join(gkmHome(env), "edge");
+}
+/** The edge's compose project, as docker is asked about it. */
+function edgeRef(dir, options = {}) {
+	return {
+		project: EDGE_PROJECT,
+		file: join(dir, "docker-compose.yml"),
+		cwd: dir,
+		...options
+	};
+}
+/**
+* Something other than the proxy a stack is set to holds the edge's ports.
+*
+* With `proxy: 'traefik'`, the stack's own Caddy — still running from before
+* the switch — or any other container; with `proxy: 'caddy'`, the shared
+* edge, or another stack's Caddy. Refused before anything is started, so the
+* stack is never left half on one proxy and half on the other.
+*/
+var ComposeProxyClash = class extends GkmError {
+	project;
+	proxy;
+	port;
+	holder;
+	constructor(project, proxy, port, holder) {
+		const by = holder.project ? `${holder.container} (compose project ${holder.project})` : holder.container;
+		const fix = proxy === "traefik" ? holder.project === project && holder.service === "caddy" ? `That is this stack's own Caddy, from before it was switched to proxy: 'traefik'. Move it once: stop it (docker compose -p ${project} stop caddy), then run gkm compose again — the shared edge takes 80/443 and the stack registers with it.` : `The shared edge needs ports 80 and 443. Stop ${holder.container}${holder.project ? ` (docker compose -p ${holder.project} down, or its own gkm compose --down)` : ""}, or move the edge with GKM_COMPOSE_HTTPS_PORT/GKM_COMPOSE_HTTP_PORT.` : holder.project === "gkm-edge" ? `That is the server's shared Traefik edge, which other stacks register with. Set deploy.compose.proxy to 'traefik' for this stage so the stack registers with it too, or stop the edge once nothing uses it (docker compose -p ${EDGE_PROJECT} down).` : `Stop ${holder.container}, or publish this stack's Caddy elsewhere with GKM_COMPOSE_HTTPS_PORT/GKM_COMPOSE_HTTP_PORT.`;
+		super(`${project} is set to proxy: '${proxy}', and port ${port} is held by ${by}. ${fix}`);
+		this.project = project;
+		this.proxy = proxy;
+		this.port = port;
+		this.holder = holder;
+		this.name = "ComposeProxyClash";
+	}
+};
+/**
+* Refuse a stack whose edge ports are held by anything but its own proxy:
+* the shared edge for `'traefik'`, the stack's own Caddy for `'caddy'`.
+*/
+async function assertEdgePorts(docker, options) {
+	const { project, proxy, ports } = options;
+	for (const port of [ports.https, ports.http]) for (const holder of await docker.publishers(port)) if (!(proxy === "traefik" ? holder.project === "gkm-edge" : holder.project === project && holder.service === "caddy")) throw new ComposeProxyClash(project, proxy, port, holder);
+}
+/** Write a file whole or not at all: a temporary file, then a rename. */
+async function writeAtomic(path, content, mode = 420) {
+	const temporary = `${path}.${process.pid}.tmp`;
+	await writeFile(temporary, content, { mode });
+	await chmod(temporary, mode);
+	await rename(temporary, path);
+}
+/** Write a file only when its content changed; whether it did. */
+async function writeIfChanged(path, content) {
+	if (await readFile(path, "utf-8").catch(() => void 0) === content) return false;
+	await writeAtomic(path, content);
+	return true;
+}
+/**
+* The edge, up: its network, its files, and its container — started when it
+* is not running, and recreated when its configuration changed. Idempotent:
+* on a server where it already runs as configured, `up` changes nothing.
+*/
+async function ensureEdge(docker, options) {
+	const { dir, ports } = options;
+	await mkdir(join(dir, "dynamic"), { recursive: true });
+	await mkdir(join(dir, "certs"), {
+		recursive: true,
+		mode: 448
+	});
+	const staticConfig = traefikStaticFile(ports);
+	await writeIfChanged(join(dir, "traefik.yml"), staticConfig);
+	await writeIfChanged(join(dir, "docker-compose.yml"), edgeComposeFile({
+		dir,
+		ports,
+		staticConfig,
+		logging: options.logging
+	}));
+	await docker.ensureNetwork(EDGE_NETWORK);
+	await docker.up(edgeRef(dir, {
+		...options.output ? { output: options.output } : {},
+		...options.signal ? { signal: options.signal } : {}
+	}), [EDGE_SERVICE]);
+	return [join(dir, "traefik.yml"), join(dir, "docker-compose.yml")];
+}
+/** A stack's file in the edge's directory. */
+function routesFile(dir, project) {
+	return join(dir, "dynamic", `${project}.yml`);
+}
+/**
+* Register a stack with the edge: its certificate first, where it has one,
+* so the routes that need it never load without it — then its routes, in one
+* rename the edge picks up whole.
+*/
+async function writeEdgeRoutes(dir, project, routes, certificate) {
+	const files = [];
+	if (certificate) {
+		const certs = join(dir, "certs");
+		await mkdir(certs, {
+			recursive: true,
+			mode: 448
+		});
+		const crt = join(certs, `${project}.crt`);
+		const key = join(certs, `${project}.key`);
+		await copyFile(certificate.certFile, `${crt}.tmp`);
+		await rename(`${crt}.tmp`, crt);
+		await copyFile(certificate.keyFile, `${key}.tmp`);
+		await chmod(`${key}.tmp`, 384);
+		await rename(`${key}.tmp`, key);
+		files.push(crt, key);
+	} else await removeCertificate(dir, project);
+	await mkdir(join(dir, "dynamic"), { recursive: true });
+	const file = routesFile(dir, project);
+	await writeAtomic(file, routes);
+	files.push(file);
+	return files;
+}
+/** What a stack's file holds for the moment between emptying and removal. */
+const UNREGISTERED = "# Unregistered by gkm compose --down.\n";
+async function removeCertificate(dir, project) {
+	for (const ext of ["crt", "key"]) await rm(join(dir, "certs", `${project}.${ext}`), { force: true });
+}
+/**
+* Unregister a stack: its routes, then its certificate. Whether there was
+* anything to remove.
+*/
+async function removeEdgeRoutes(dir, project) {
+	const file = routesFile(dir, project);
+	const existed = existsSync(file);
+	if (existed) await writeAtomic(file, UNREGISTERED);
+	await rm(file, { force: true });
+	await removeCertificate(dir, project);
+	return existed;
+}
+//#endregion
+//#region src/target/compose/health.ts
+/**
+* Asking each app of a stack whether it answers — through Caddy, over HTTPS,
+* the way a browser reaches it.
+*
+* `docker compose up --wait` already knows each container passed its own
+* health check, asked on 127.0.0.1 inside it. What that cannot say is whether
+* the stack is reachable: whether the edge routes the host to the app, and
+* whether the certificate it presents is one a client accepts. So the check
+* goes through the edge, by hostname, and verifies the certificate.
+*/
+/** A request that got no answer in time. */
+var HealthRequestTimedOut = class extends GkmError {
+	url;
+	timeoutMs;
+	constructor(url, timeoutMs) {
+		super(`${url} did not answer within ${timeoutMs}ms. Check the stack is up with \`docker compose ps\`.`);
+		this.url = url;
+		this.timeoutMs = timeoutMs;
+		this.name = "HealthRequestTimedOut";
+	}
+};
+/** The real probe: one HTTPS GET, the certificate verified. */
+const httpsProbe = ({ url, ca, connectTo, connectPort, timeoutMs, signal }) => {
+	const target = new URL(url);
+	return new Promise((resolve, reject) => {
+		const req = request({
+			host: connectTo ?? target.hostname,
+			port: connectPort ?? (target.port || 443),
+			servername: target.hostname,
+			path: `${target.pathname}${target.search}`,
+			method: "GET",
+			headers: { host: target.host },
+			...ca ? { ca } : {},
+			...signal ? { signal } : {},
+			timeout: timeoutMs
+		}, (res) => {
+			res.resume();
+			res.on("end", () => resolve(res.statusCode ?? 0));
+			res.on("error", reject);
+		});
+		req.on("timeout", () => req.destroy(new HealthRequestTimedOut(url, timeoutMs)));
+		req.on("error", reject);
+		req.end();
+	});
+};
+/** Whether a status means the app answered as it should. */
+function isHealthy(status) {
+	return status >= 200 && status < 400;
+}
+/** Apps that did not answer through the edge. */
+var ComposeAppsUnhealthy = class extends GkmError {
+	project;
+	apps;
+	proxy;
+	constructor(project, apps, proxy = "caddy") {
+		const names = apps.map((a) => a.app).join(" ");
+		super(`${project} started, but ${apps.length === 1 ? "this app does" : "these apps do"} not answer through ${proxy === "caddy" ? "Caddy" : "the shared Traefik edge"}:\n` + apps.map(({ url, last }) => `  - ${url}: ${last}`).join("\n") + (proxy === "caddy" ? `\nSee why with \`docker compose -p ${project} logs caddy ${names}\`.` : `\nSee why with \`docker compose -p gkm-edge logs traefik\` and \`docker compose -p ${project} logs ${names}\`.`));
+		this.project = project;
+		this.apps = apps;
+		this.proxy = proxy;
+		this.name = "ComposeAppsUnhealthy";
+	}
+};
+//#endregion
+//#region src/target/compose/phases.ts
+/**
+* The compose target's phases: a stage as one Docker Compose stack behind
+* Caddy, on the machine the deploy runs on.
+*
+* The order is the point of this file, and the rules it keeps are these:
+*
+* - A tag is checked before anything happens (`validate`). Every app's image
+*   is asked of the registry first; one missing image stops the run naming
+*   them all, and nothing is written, pulled or started.
+* - The databases exist before the apps do (`provision`). Postgres comes up
+*   alone, its databases, roles and grants are created, its migrations
+*   applied and its seeds run from this machine, and only then do the apps
+*   start — so an app
+*   never boots against a schema that is not there yet.
+* - What a stage runs is recorded (`release`). Each app's image, the tag it
+*   was released under and the digest it resolved to are written to the
+*   stage's state, so "what is this stage running" has an exact answer.
+* - What was started answers (`verify`): each app is asked through Caddy,
+*   over HTTPS, with the certificate verified.
+*
+* Every image is built inside Docker from a pruned slice of the build root —
+* the same Dockerfiles `gkm docker` writes — so nothing is built on this
+* machine before `docker compose build`.
+*
+* Docker, the registry, Postgres and the health probe are
+* injected, so the rules are asserted without a daemon; the defaults are the
+* real ones.
+*/
+/** `--push` without `--build`: there is nothing built here to push. */
+var ComposePushNeedsBuild = class extends GkmError {
+	constructor() {
+		super("--push pushes the images this checkout builds, so it needs --build (and never --pull): gkm compose --stage <stage> --build --push --tag <tag>.");
+		this.name = "ComposePushNeedsBuild";
+	}
+};
+/** Digests to run by, on a run that pulls nothing. */
+var ComposePinNeedsPull = class extends GkmError {
+	constructor() {
+		super("--digests-file pins the images a release pulls, so it needs --tag (or --pull) — or, with --build --push, it is where the pushed digests are written.");
+		this.name = "ComposePinNeedsPull";
+	}
+};
+/** A port variable that does not hold a port. */
+var EdgePortInvalid = class extends GkmError {
+	variable;
+	value;
+	constructor(variable, value) {
+		super(`${variable}=${value} is not a port. Set it to a number between 1 and 65535, or unset it for the default.`);
+		this.variable = variable;
+		this.value = value;
+		this.name = "EdgePortInvalid";
+	}
+};
+/** A build with no commit to tag its images with. */
+var NoGitRevision = class extends GkmError {
+	root;
+	constructor(root) {
+		super(`Images built here are tagged with the commit they were built from, and ${root} is not in a git repository with a commit. Commit, or pass --tag to name the images yourself.`);
+		this.root = root;
+		this.name = "NoGitRevision";
+	}
+};
+/**
+* The project's own file merged over a stage's stack: `docker-compose.<stage>.yml`
+* at the workspace root. What the generated file cannot know — a port bound
+* to a tailnet address, another log driver — goes there, and is never
+* overwritten.
+*/
+function stackOverrideFile(root, stage) {
+	return join(root, `docker-compose.${stage}.yml`);
+}
+/** The commit HEAD is at, short — and `-dirty` when the tree has changes. */
+async function gitRevision(root) {
+	let sha;
+	try {
+		sha = (await runOutput("git", [
+			"rev-parse",
+			"--short",
+			"HEAD"
+		], { cwd: root })).trim();
+	} catch {
+		throw new NoGitRevision(root);
+	}
+	if (!sha) throw new NoGitRevision(root);
+	return (await runOutput("git", ["status", "--porcelain"], { cwd: root }).catch(() => "")).trim() ? `${sha}-dirty` : sha;
+}
+/** The edge's ports, from the environment — 443 and 80 when unset. */
+function edgePorts(env = process.env) {
+	const read = (variable, fallback) => {
+		const value = env[variable];
+		if (value === void 0 || value === "") return fallback;
+		const port = Number(value);
+		if (!Number.isInteger(port) || port < 1 || port > 65535) throw new EdgePortInvalid(variable, value);
+		return port;
+	};
+	const logs = env["GKM_COMPOSE_LOGS_PORT"] ? read(LOGS_PORT_ENV, 0) : void 0;
+	return {
+		https: read(EDGE_PORT_ENV.https, 443),
+		http: read(EDGE_PORT_ENV.http, 80),
+		...logs ? { logs } : {}
+	};
+}
+/**
+* The real ones. Each app is asked for three minutes before it counts as
+* down: a deployed stage's first ACME certificate can take that long.
+*/
+const defaultDeps = {
+	docker: dockerCompose,
+	revision: gitRevision,
+	sql: pgClient,
+	buckets: bucketClient,
+	logins: ensurePostgresLogin,
+	migrate: migrateDatabases,
+	seed: seedDatabases,
+	probe: httpsProbe,
+	healthAttempts: 90,
+	healthIntervalMs: 2e3,
+	env: process.env,
+	lookup: systemLookup
+};
+/**
+* The stack the stage would run, and — for a tag — the registry's word that
+* every image it names exists. Nothing is written: a missing image stops the
+* run here, before a file, a secret or a container is touched.
+*/
+async function validateCompose(ctx, deps, options = {}) {
+	const { workspace, stage, identity, tag } = ctx;
+	const root = workspace.root;
+	const mode = options.mode ?? (ctx.tagGiven ? "pull" : "build");
+	const push = options.push === true;
+	if (push && mode !== "build") throw new ComposePushNeedsBuild();
+	if (options.pin && mode !== "pull") throw new ComposePinNeedsPull();
+	const registry = workspace.deploy?.registry;
+	if (!registry && (push || mode === "pull")) throw new RegistryRequired(push ? "push" : "pull", imageRef(identity, ctx.apps[0] ?? workspace.name, void 0, tag));
+	const runnables = {};
+	const background = {};
+	const manifest = await discover({
+		patterns: constructGlobs(workspace),
+		cwd: root,
+		runnables,
+		background
+	});
+	const { secrets, generated } = await stageSecrets(ctx, manifest);
+	const server = push || stage === workspace.stages.local ? void 0 : requiredServerAddress(stage, workspace.domains?.[stage], secrets?.custom);
+	if (!push) {
+		assertNoStaleSecrets({
+			manifest,
+			stage,
+			supplied: secrets?.custom ?? {}
+		});
+		await assertStageCredentials({
+			root,
+			patterns: constructGlobs(workspace),
+			manifest,
+			stage,
+			supplied: secrets?.custom ?? {}
+		});
+	}
+	const layout = mode === "build" ? imageLayout(workspace) : void 0;
+	const composed = composeStack({
+		workspace,
+		manifest,
+		runnables,
+		background,
+		stage,
+		identity,
+		images: {
+			mode,
+			tag,
+			...registry ? { registry } : {}
+		},
+		secrets,
+		...stage === workspace.stages.local ? { localCredentials: (await loadLocalCredentials(workspace)).credentials } : {},
+		allowDevServices: ctx.allowDevServices,
+		ports: edgePorts(deps.env),
+		...layout ? { layout } : {},
+		...push ? { buildOnly: true } : {}
+	});
+	reportDevServices(ctx, composed.devServices);
+	if (!push && stage !== workspace.stages.local) {
+		const verified = await verifyStageProviders({
+			workspace,
+			manifest,
+			stage,
+			secrets: secrets?.custom ?? {}
+		});
+		for (const line of verified) ctx.logger.info(`✓ ${line} verified`);
+	}
+	if (mode === "build") assertRedisClient(workspace, composed);
+	const stack = options.pin ? withPinnedImages(composed, options.pin.file, options.pin.digests) : composed;
+	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, [...stack.apps, ...stack.workers]);
+	if (stack.tls && !push) {
+		for (const file of [stack.tls.certFile, stack.tls.keyFile]) if (!existsSync(file)) throw new ComposeTlsFileMissing(stage, file);
+	}
+	if (!push && !stack.local) await checkDns(ctx, deps, stackHosts(stack).filter((host) => !isLocalHost(host)), server);
+	if (stack.redis && !stack.local) ctx.secrets.mask(stack.redis.password);
+	if (stack.logs && (!stack.local || stack.logs.passwordFromSecrets)) {
+		ctx.secrets.mask(stack.logs.password);
+		ctx.secrets.mask(stack.logs.appEnv.OTEL_EXPORTER_OTLP_HEADERS);
+	}
+	const dir = join(root, stackDir(stage));
+	const override = stackOverrideFile(root, stage);
+	const overrides = existsSync(override) ? [override] : [];
+	if (overrides.length > 0) ctx.logger.info(`🧩 Merging docker-compose.${stage}.yml over the generated stack`);
+	const recorded = push ? void 0 : await ctx.state.read(stage);
+	const previous = Object.fromEntries(Object.entries(recorded?.state.releases ?? {}).map(([name, releases]) => {
+		const { ref, tag, digest } = releases.current;
+		return [name, {
+			ref,
+			...tag ? { tag } : {},
+			...digest ? { digest } : {}
+		}];
+	}));
+	return {
+		mode,
+		push,
+		stack,
+		dir,
+		ref: {
+			project: composeProject(identity),
+			file: join(dir, "docker-compose.yml"),
+			...overrides.length > 0 ? { overrides } : {},
+			cwd: root,
+			output: ctx.childOutput,
+			signal: ctx.signal
+		},
+		secrets,
+		generated,
+		previous,
+		files: [],
+		images: {},
+		changes: []
+	};
+}
+/** A stack whose caches are in Redis, built for an app that has no client. */
+var RedisClientMissing = class extends GkmError {
+	apps;
+	constructor(apps) {
+		super(`The stack keeps every cache in Redis, and ${apps.join(", ")} ${apps.length === 1 ? "does" : "do"} not depend on ioredis, the client the generated server reaches it with. Add it to the workspace: pnpm add ioredis`);
+		this.apps = apps;
+		this.name = "RedisClientMissing";
+	}
+};
+/**
+* Every backend and worker image built for a stack with a cache can resolve
+* `ioredis` — listed by its app or a directory above it, the way Node and
+* the image's install find it.
+*/
+function assertRedisClient(workspace, stack) {
+	if (!stack.plan.resources.some((r) => r.kind === "cache")) return;
+	const missing = [.../* @__PURE__ */ new Set([...stack.apps.filter((app) => app.kind === "rest-api").map((a) => a.name), ...stack.workers.map((worker) => worker.host)])].filter((name) => {
+		const app = workspace.apps[name];
+		return app && !installedFrom(join(workspace.root, app.path), "ioredis");
+	}).sort();
+	if (missing.length > 0) throw new RedisClientMissing(missing);
+}
+/**
+* The stage's secrets — and, for a deployed stage, everything it generates
+* once: its seed, and each declared secret and keyring. Kept only once the
+* run goes ahead (`provision`), so a dry run, or a tag that is not there,
+* leaves the stage's secrets as it found them.
+*/
+/**
+* The deploy-time DNS check: each public host resolved with the system
+* resolver and compared with the server's address from the stage's secrets.
+* A dry run warns rather than stops.
+*/
+async function checkDns(ctx, deps, hosts, server) {
+	const { workspace, stage } = ctx;
+	if (hosts.length === 0) return;
+	if (ctx.skipDnsCheck) {
+		ctx.logger.info("🌐 DNS check skipped (--skip-dns-check)");
+		return;
+	}
+	if (!server) {
+		ctx.logger.info(`🌐 DNS check skipped: no ${SERVER_IPV4_KEY} in '${stage}''s secrets — ${serverAddressHint(stage)}`);
+		return;
+	}
+	try {
+		const ok = await checkStackDns({
+			stage,
+			hosts,
+			server,
+			dns: workspace.dns,
+			lookup: deps.lookup ?? systemLookup
+		});
+		ctx.logger.info(`🌐 ${ok.length} host${ok.length === 1 ? "" : "s"} resolve${ok.length === 1 ? "s" : ""} to ${server.ipv4}`);
+	} catch (error) {
+		if (ctx.dryRun && error instanceof HostNotPointingAtServer) {
+			ctx.logger.warn(`⚠ ${error.message}`);
+			return;
+		}
+		throw error;
+	}
+}
+async function stageSecrets(ctx, manifest) {
+	const stored = await ctx.secrets.read();
+	if (ctx.stage === ctx.workspace.stages.local) return {
+		secrets: stored,
+		generated: []
+	};
+	const { secrets, generated } = deployedStackSecrets(ctx.workspace, ctx.stage, stored, manifest);
+	if (secrets.seed) ctx.secrets.mask(secrets.seed);
+	for (const value of Object.values(secrets.custom ?? {})) ctx.secrets.mask(value);
+	return {
+		secrets,
+		generated
+	};
+}
+/**
+* The stack with each app's and worker's image pinned to the digest the file
+* names: the refs it is checked, pulled and recorded by, and the image each
+* compose service runs.
+*/
+function withPinnedImages(stack, file, digests) {
+	const apps = pinImages(file, digests, stack.apps);
+	const workers = pinImages(file, digests, stack.workers);
+	const services = { ...stack.compose.services };
+	for (const image of [...apps, ...workers]) services[image.name] = {
+		...services[image.name],
+		image: image.ref
+	};
+	return {
+		...stack,
+		apps,
+		workers,
+		compose: {
+			...stack.compose,
+			services
+		}
+	};
+}
+/**
+* A dry run: the stack's files, written so they can be read, and what a real
+* run would do — no image is built or pulled, no container touched, nothing
+* recorded and no secret kept.
+*/
+async function planCompose(ctx, run) {
+	if (run.generated.length > 0) ctx.logger.info(`🔑 "${ctx.stage}" has no ${run.generated.join(", ")} yet; this dry run used values it did not keep.`);
+	run.files = await writeStack(ctx.cwd, run.dir, run.stack);
+	printPlan(ctx, run);
+	if (!run.push && run.stack.infra.includes("postgres")) reportPlannedSeeds((await plannedSeeds({
+		root: ctx.workspace.root,
+		manifest: ctx.manifest
+	})).map(({ target, seeds }) => ({
+		folder: target.seeds,
+		seeds
+	})), (line) => ctx.logger.info(line));
+	const planned = (change) => {
+		run.changes.push(change);
+		ctx.emit({
+			type: "resource.planned",
+			...change
+		});
+	};
+	for (const service of run.push ? [] : run.stack.infra) planned({
+		key: `service:${service}`,
+		resourceType: "service",
+		action: "ensure"
+	});
+	for (const app of run.stack.apps) {
+		planned({
+			key: `image:${app.name}`,
+			resourceType: "image",
+			action: run.mode === "build" ? "build" : "reuse",
+			id: app.ref
+		});
+		if (run.push) continue;
+		planned({
+			key: `service:${app.name}`,
+			resourceType: "service",
+			action: run.previous[app.name] ? "reuse" : "create"
+		});
+	}
+	for (const worker of run.stack.workers) {
+		planned({
+			key: `image:${worker.name}`,
+			resourceType: "image",
+			action: run.mode === "build" ? "build" : "reuse",
+			id: worker.ref
+		});
+		if (run.push) continue;
+		planned({
+			key: `service:${worker.name}`,
+			resourceType: "service",
+			action: run.previous[worker.name] ? "reuse" : "create"
+		});
+	}
+	if (!run.push) planned({
+		key: run.stack.proxy === "caddy" ? "service:caddy" : `service:${EDGE_PROJECT}/${EDGE_SERVICE}`,
+		resourceType: "service",
+		action: "ensure"
+	});
+}
+/**
+* What the apps run on: the stage's generated secrets kept, the stack's files
+* written, its infrastructure started, and its databases, roles, grants and
+* migrations applied.
+*/
+async function provisionCompose(ctx, run, deps) {
+	const { stack, ref } = run;
+	if (run.push) return;
+	if (run.generated.length > 0 && run.secrets) {
+		await ctx.secrets.write(run.secrets);
+		ctx.logger.info(`🔑 Generated for "${ctx.stage}" (${ctx.secrets.store}): ${run.generated.join(", ")}`);
+	}
+	const ports = edgePorts(deps.env);
+	await assertEdgePorts(deps.docker, {
+		project: stack.project,
+		proxy: stack.proxy,
+		ports
+	});
+	run.files = await writeStack(ctx.cwd, run.dir, stack);
+	printPlan(ctx, run);
+	if (stack.proxy === "traefik") {
+		const dir = edgeDir(deps.env);
+		ctx.logger.info(`\n🌐 Starting the shared edge (${EDGE_PROJECT}) from ${dir}…`);
+		run.files.push(...await ensureEdge(deps.docker, {
+			dir,
+			ports,
+			logging: {
+				driver: LOG_ROTATION.driver,
+				options: { ...LOG_ROTATION.options }
+			},
+			...ref.output ? { output: ref.output } : {},
+			...ref.signal ? { signal: ref.signal } : {}
+		}));
+		applied(ctx, run, {
+			key: `service:${EDGE_PROJECT}/${EDGE_SERVICE}`,
+			resourceType: "service",
+			action: "ensure",
+			id: `${EDGE_PROJECT}/${EDGE_SERVICE}`,
+			via: "found"
+		});
+	}
+	if (stack.infra.length > 0) {
+		ctx.logger.info(`\n🗄️  Starting ${stack.infra.join(", ")}…`);
+		await deps.docker.up(ref, stack.infra);
+		for (const service of stack.infra) applied(ctx, run, {
+			key: `service:${service}`,
+			resourceType: "service",
+			action: "ensure",
+			id: `${stack.project}/${service}`,
+			via: Object.keys(run.previous).length > 0 ? "recorded" : "created"
+		});
+	}
+	if (stack.infra.includes("postgres")) await prepareDatabases(ctx, run, deps);
+	if (stack.storage && stack.infra.includes("minio")) await prepareBuckets(ctx, run, deps);
+}
+/**
+* Create each bucket the stack's MinIO serves, and the open paths of each
+* one a file server fronts — from this machine, on MinIO's loopback port,
+* the way `gkm dev` creates them.
+*/
+async function prepareBuckets(ctx, run, deps) {
+	const storage = run.stack.storage;
+	if (storage.buckets.length === 0) return;
+	const port = await deps.docker.port(run.ref, "minio", 9e3);
+	const client = deps.buckets(port, storage);
+	const created = [...await applyBuckets(client, storage.buckets), ...await applyPolicies(client, storage.policies)].filter((entry) => entry.created).length;
+	ctx.logger.info(`🪣  Buckets: ${storage.buckets.join(", ")}${created ? ` (${created} change(s))` : ""}`);
+}
+/**
+* Create what the plan names in the stack's Postgres, migrate it, then run
+* its seeds — every one, every time, as each construct's owner.
+*/
+async function prepareDatabases(ctx, run, deps) {
+	const { stack } = run;
+	const workspace = ctx.workspace;
+	const port = await deps.docker.port(run.ref, "postgres", 5432);
+	const superuser = stack.credential.containers.postgres;
+	const login = await deps.logins({
+		port,
+		login: superuser,
+		legacy: [{
+			user: LEGACY_LOCAL_LOGIN.user,
+			password: superuser.password
+		}, ...stack.local ? [LEGACY_LOCAL_LOGIN] : []]
+	});
+	if (login.notice) ctx.logger.info(login.notice);
+	const statements = postgresStatements(stack.plan, workspace.name, stack.credential.seed);
+	if (statements.length > 0) {
+		ctx.logger.info("🗄️  Creating databases, roles and grants…");
+		await applyPostgres(deps.sql(port, login.login), statements);
+	}
+	const sources = {};
+	const manifest = await discover({
+		patterns: constructGlobs(workspace),
+		cwd: workspace.root,
+		sources
+	});
+	const env = envFor(stack.plan, {
+		ports: { [primaryPortKey("postgres")]: port },
+		project: workspace.name,
+		credentials: {
+			...stack.credential.containers,
+			postgres: login.login
+		},
+		seed: stack.credential.seed
+	});
+	const options = {
+		root: workspace.root,
+		manifest,
+		sources,
+		env
+	};
+	const runs = await deps.migrate(options);
+	const seeds = await deps.seed({
+		...options,
+		stage: ctx.stage
+	}).catch((error) => {
+		if (error instanceof SeedFailed) throw new DeploySeedsFailed(ctx.stage, error.construct, error.seed, error);
+		throw error;
+	});
+	reportDatabaseRuns(runs.map(({ target, applied }) => ({
+		construct: target.id,
+		folder: target.migrations,
+		applied
+	})), seeds.map(({ target, seeded }) => ({
+		construct: target.id,
+		folder: target.seeds,
+		seeded
+	})), (line) => ctx.logger.info(line), (event) => ctx.emit(event));
+}
+/**
+* Each app's image: built from this checkout — inside Docker, every one of
+* them, from a pruned slice of the build root — or pulled at the tag. Nothing
+* live changes.
+*/
+async function buildCompose(ctx, run, deps) {
+	const { stack, ref } = run;
+	const images = [...stack.apps, ...stack.workers];
+	const apps = images.map((image) => image.app);
+	if (run.push) {
+		run.files = await writeStack(ctx.cwd, run.dir, stack);
+		printPlan(ctx, run);
+	}
+	if (run.mode === "build") {
+		ctx.logger.info("\n🐳 Building images…");
+		await deps.docker.build(ref, apps);
+	} else {
+		ctx.logger.info(`\n🐳 Pulling ${ctx.tag}…`);
+		await deps.docker.pull(ref, apps);
+	}
+	if (run.push) ctx.logger.info("\n📤 Pushing images…");
+	for (const image of images) {
+		const digest = run.push ? await deps.docker.push(ref, image.ref) : await deps.docker.digest(image.ref);
+		if (run.push) ctx.logger.info(`   ${image.app.padEnd(12)} ${image.ref}@${digest}`);
+		run.images[image.app] = {
+			ref: image.ref,
+			tag: image.tag,
+			...digest ? { digest } : {}
+		};
+		ctx.emit({
+			type: "artifact.built",
+			app: image.app,
+			imageRef: image.ref,
+			...digest ? { digest } : {}
+		});
+		run.changes.push({
+			key: `image:${image.app}`,
+			resourceType: "image",
+			action: run.mode === "build" ? "build" : "reuse",
+			id: digest ?? image.ref
+		});
+	}
+}
+/**
+* The whole stack up — anything it no longer defines removed — and each
+* app's image recorded in the stage's state.
+*/
+async function releaseCompose(ctx, run, deps) {
+	const { stack, ref } = run;
+	if (run.push) return;
+	ctx.logger.info("\n🚀 Starting the stack…");
+	await deps.docker.up(ref);
+	const edge = edgeDir(deps.env);
+	if (stack.proxy === "traefik" && stack.traefik) {
+		const written = await writeEdgeRoutes(edge, stack.project, stack.traefik, stack.tls);
+		run.files.push(...written);
+		ctx.logger.info(`🌐 Registered ${stack.routes.length} route(s) with ${EDGE_PROJECT}: ${written.at(-1)}`);
+	} else await removeEdgeRoutes(edge, stack.project);
+	if (stack.local) await deps.docker.copyOut(ref, "caddy", "/data/caddy/pki/authorities/local/root.crt", caFile(run)).catch(() => {});
+	await recordImages(ctx, run);
+	for (const app of stack.apps) {
+		const image = run.images[app.name];
+		applied(ctx, run, {
+			key: `service:${app.name}`,
+			resourceType: "service",
+			action: "ensure",
+			id: `${stack.project}/${app.name}`,
+			via: run.previous[app.name] ? "recorded" : "created"
+		});
+		ctx.emit({
+			type: "app.deployed",
+			app: app.name,
+			applicationId: `${stack.project}/${app.name}`,
+			imageRef: image?.ref ?? app.ref,
+			url: app.url
+		});
+	}
+	for (const worker of stack.workers) applied(ctx, run, {
+		key: `service:${worker.name}`,
+		resourceType: "service",
+		action: "ensure",
+		id: `${stack.project}/${worker.name}`,
+		via: run.previous[worker.name] ? "recorded" : "created"
+	});
+	ctx.logger.info(`\n✅ ${stack.project} is running:`);
+	for (const app of stack.apps) ctx.logger.info(`   ${app.name.padEnd(12)} ${app.url}`);
+	for (const worker of stack.workers) ctx.logger.info(`   ${worker.name.padEnd(12)} worker ${worker.id}`);
+	if (stack.local) ctx.logger.info(`\n🔐 Certificates are from Caddy's local CA: NODE_EXTRA_CA_CERTS=${join(stackDir(ctx.stage), "caddy-root.crt")}`);
+}
+/**
+* Each app's image in the stage's state — the same `images` a Dokploy deploy
+* records: the ref it runs, the tag it was released under, and the digest
+* the tag resolved to.
+*/
+async function recordImages(ctx, run) {
+	const journal = await DeployJournal.open(ctx.state, ctx.stage, () => createComposeState(ctx.stage));
+	const by = currentActor();
+	for (const app of [...run.stack.apps, ...run.stack.workers]) {
+		const image = run.images[app.app] ?? {
+			ref: app.ref,
+			tag: app.tag
+		};
+		recordRelease(journal.state, app.app, image, by);
+	}
+	journal.state.identity = ctx.identity.key;
+	await journal.save();
+}
+/**
+* Each app asked through Caddy, over HTTPS, the certificate verified: an API
+* at `/health`, a site at `/`. On the local stage the edge is this machine and
+* its certificates are Caddy's internal CA's, so the CA `release` copied out
+* is the one trusted and the request goes to 127.0.0.1.
+*/
+async function verifyCompose(ctx, run, deps) {
+	const { stack } = run;
+	if (run.push) return;
+	const ca = stack.local ? await readFile(caFile(run), "utf-8").catch(() => void 0) : void 0;
+	ctx.logger.info(`\n🩺 Checking each app through ${stack.proxy === "caddy" ? "Caddy" : "the shared edge"}…`);
+	const edge = stack.local || stack.proxy === "traefik" ? {
+		connectTo: "127.0.0.1",
+		...stack.local ? {} : { connectPort: edgePorts(deps.env).https }
+	} : void 0;
+	const results = await Promise.all(stack.apps.map((app) => checkApp(ctx, app, deps, {
+		ca,
+		edge
+	})));
+	results.push(...await Promise.all(stack.workers.map((worker) => checkContainer(ctx, run, deps, worker.name))));
+	if (stack.logs) results.push(await checkContainer(ctx, run, deps, LOGS_SERVICE));
+	const down = results.filter((result) => !result.healthy).map(({ app, url, last }) => ({
+		app,
+		url,
+		last
+	}));
+	if (down.length > 0) throw new ComposeAppsUnhealthy(stack.project, down, stack.proxy);
+	if (stack.logs) reportLogs(ctx, stack.logs, stack.local);
+}
+/**
+* A container's own health check, as Docker reports it: a worker's, which
+* has no route through the edge, and OpenObserve's — by default it has no
+* host there, and served publicly it answers only the addresses it allows,
+* which need not include this one.
+*/
+async function checkContainer(ctx, run, deps, service) {
+	const url = `docker:${service}`;
+	let last = "not asked";
+	for (let attempt = 1; attempt <= deps.healthAttempts; attempt++) {
+		ctx.signal.throwIfAborted();
+		const health = await deps.docker.health(run.ref, service).catch((error) => error instanceof Error ? error.message : String(error));
+		last = health ?? "not running";
+		const healthy = health === "healthy";
+		ctx.emit({
+			type: "health.checked",
+			app: service,
+			url,
+			healthy,
+			attempt
+		});
+		if (healthy) {
+			ctx.logger.info(`   ✓ ${service.padEnd(12)} ${url} (${last})`);
+			return {
+				app: service,
+				url,
+				last,
+				healthy
+			};
+		}
+		if (attempt < deps.healthAttempts) await new Promise((resolve) => setTimeout(resolve, deps.healthIntervalMs));
+	}
+	ctx.logger.warn(`   ✗ ${service.padEnd(12)} ${url} (${last})`);
+	return {
+		app: service,
+		url,
+		last,
+		healthy: false
+	};
+}
+/** How to open the logs, printed — and as an event, for a headless caller. */
+function reportLogs(ctx, logs, local) {
+	const lines = logsAccess(logs, {
+		stage: ctx.stage,
+		local,
+		user: currentUser(),
+		hostname: hostname()
+	});
+	ctx.logger.info(`\n${lines.join("\n")}`);
+	ctx.emit({
+		type: "logs.ready",
+		service: LOGS_SERVICE,
+		access: logs.public ? "public" : "tunnel",
+		url: logs.url,
+		...logs.public ? { allow: [...logs.public.allow] } : { port: logs.port },
+		email: logs.email
+	});
+}
+/** This machine's user — a guess at who would SSH in. */
+function currentUser() {
+	try {
+		return userInfo().username;
+	} catch {
+		return process.env.USER ?? "user";
+	}
+}
+async function checkApp(ctx, app, deps, options) {
+	const url = `${app.url}${app.kind === "site" ? "/" : "/health"}`;
+	let last = "not asked";
+	for (let attempt = 1; attempt <= deps.healthAttempts; attempt++) {
+		ctx.signal.throwIfAborted();
+		let status;
+		try {
+			status = await deps.probe({
+				url,
+				...options.ca ? { ca: options.ca } : {},
+				...options.edge,
+				timeoutMs: 1e4,
+				signal: ctx.signal
+			});
+			last = `HTTP ${status}`;
+		} catch (error) {
+			last = error instanceof Error ? error.message : String(error);
+		}
+		const healthy = status !== void 0 && isHealthy(status);
+		ctx.emit({
+			type: "health.checked",
+			app: app.name,
+			url,
+			healthy,
+			...status !== void 0 ? { status } : {},
+			attempt
+		});
+		if (healthy) {
+			ctx.logger.info(`   ✓ ${app.name.padEnd(12)} ${url} (${last})`);
+			return {
+				app: app.name,
+				url,
+				last,
+				healthy
+			};
+		}
+		if (attempt < deps.healthAttempts) await new Promise((resolve) => setTimeout(resolve, deps.healthIntervalMs));
+	}
+	ctx.logger.warn(`   ✗ ${app.name.padEnd(12)} ${url} (${last})`);
+	return {
+		app: app.name,
+		url,
+		last,
+		healthy: false
+	};
+}
+function composeResult(ctx, run) {
+	const apps = [...run.stack.apps.map((app) => {
+		const image = run.images[app.name];
+		return {
+			appName: app.name,
+			type: app.kind === "site" ? "web" : "backend",
+			success: !ctx.dryRun,
+			applicationId: `${run.stack.project}/${app.name}`,
+			imageRef: image?.ref ?? app.ref,
+			...image?.digest ? { digest: image.digest } : {},
+			url: app.url
+		};
+	}), ...run.stack.workers.map((worker) => {
+		const image = run.images[worker.name];
+		return {
+			appName: worker.name,
+			type: "backend",
+			success: !ctx.dryRun,
+			applicationId: `${run.stack.project}/${worker.name}`,
+			imageRef: image?.ref ?? worker.ref,
+			...image?.digest ? { digest: image.digest } : {}
+		};
+	})];
+	return {
+		apps,
+		projectId: run.stack.project,
+		successCount: ctx.dryRun ? 0 : apps.length,
+		failedCount: 0,
+		stage: ctx.stage,
+		identity: ctx.identity.key,
+		tag: ctx.tag,
+		dryRun: ctx.dryRun,
+		environmentId: "",
+		skipped: [...ctx.skipped],
+		urls: Object.fromEntries(run.stack.apps.map((app) => [app.name, app.url])),
+		changes: run.changes
+	};
+}
+function caFile(run) {
+	return join(run.dir, "caddy-root.crt");
+}
+function applied(ctx, run, change) {
+	const { via, ...rest } = change;
+	run.changes.push(rest);
+	ctx.emit({
+		type: "resource.applied",
+		...rest,
+		via
+	});
+}
+/** Write the stack's files: owner-only, since the env files hold secrets. */
+async function writeStack(root, dir, stack) {
+	await mkdir(dir, {
+		recursive: true,
+		mode: 448
+	});
+	await chmod(dir, 448);
+	const files = [];
+	const write = async (path, content, mode = 420) => {
+		await mkdir(dirname(path), { recursive: true });
+		await writeFile(path, content, { mode });
+		await chmod(path, mode);
+		files.push(path);
+	};
+	await write(join(dir, "docker-compose.yml"), composeYaml(stack));
+	if (stack.caddyfile !== void 0) {
+		await write(join(dir, "Caddyfile"), stack.caddyfile);
+		await rm(join(dir, "traefik.yml"), { force: true });
+	} else await rm(join(dir, "Caddyfile"), { force: true });
+	if (stack.traefik !== void 0) await write(join(dir, "traefik.yml"), stack.traefik);
+	if (stack.proxy === "caddy" && stack.tls) {
+		await mkdir(join(dir, "tls"), {
+			recursive: true,
+			mode: 448
+		});
+		await write(join(dir, "tls", "cert.pem"), await readFile(stack.tls.certFile, "utf-8"));
+		await write(join(dir, "tls", "key.pem"), await readFile(stack.tls.keyFile, "utf-8"), 384);
+	} else await rm(join(dir, "tls"), {
+		recursive: true,
+		force: true
+	});
+	for (const app of [...stack.apps, ...stack.workers]) if (app.env) await write(join(dir, `${app.name}.env`), envFile(app.env), 384);
+	if (stack.logs && stack.compose.services["openobserve"]?.env_file) await write(join(dir, `${LOGS_SERVICE}.env`), envFile(stack.logs.env), 384);
+	if (stack.redis && stack.compose.services["redis"]?.env_file) await write(join(dir, `${REDIS_SERVICE}.env`), envFile(stack.redis.env), 384);
+	for (const entry of await readdir(dir)) if (entry.endsWith(".credentials")) await rm(join(dir, entry));
+	for (const [path, content] of Object.entries(stack.dockerfiles)) await write(join(root, path), content);
+	await ensureDockerignore(findBuildRoot(root));
+	return files;
+}
+function composeYaml(stack) {
+	const stage = ` --stage ${stack.stage}`;
+	return `# Generated by gkm compose from the construct manifest — do not edit.
+# The ${stack.stage} stage's APIs and sites behind ${stack.proxy === "caddy" ? "one Caddy" : `the shared Traefik edge (${EDGE_PROJECT})`}, and its workers.
+# Each backend and worker reads exactly the keys in its own env file beside
+# this one.
+#
+#   gkm compose${stage}          start or update it
+#   gkm compose${stage} --down   stop it
+${stringify(stack.compose, {
+		lineWidth: 0,
+		aliasDuplicateObjects: false
+	})}`;
+}
+function printPlan(ctx, run) {
+	const { stack, mode, files } = run;
+	ctx.logger.info(`\n🧱 ${stack.project} — stage ${stack.stage}`);
+	for (const app of stack.apps) ctx.logger.info(`   ${app.name.padEnd(12)} ${app.url.padEnd(40)} ${mode} ${app.ref}`);
+	for (const worker of stack.workers) ctx.logger.info(`   ${worker.name.padEnd(12)} ${`worker ${worker.id} (no route)`.padEnd(40)} ${mode} ${worker.ref}`);
+	if (stack.infra.length > 0) ctx.logger.info(`   infrastructure: ${stack.infra.join(", ")}`);
+	ctx.logger.info(`\n📝 Wrote ${files.length} file(s) under ${stackDir(stack.stage)}/`);
+}
+//#endregion
+//#region src/target/compose/index.ts
+/**
+* The built-in `compose` target: a stage as one Docker Compose stack behind
+* Caddy, on the machine that runs the deploy.
+*
+* ```bash
+* gkm deploy --target compose --stage production --tag v1.4.0  # what CI pushed
+* gkm deploy --target compose --stage production               # built from here
+* gkm deploy --target compose --stage development              # the local stage
+* ```
+*
+* - `validate`: the stack (`composeStack`, pure) and, for a tag, every image
+*   looked up in the registry — `ImageTagNotFound` before anything changes
+* - `plan`: the stack's files and what a run would create or reuse
+* - `provision`: generated secrets kept, files written, infrastructure up,
+*   databases, roles, grants and migrations
+* - `build`: each backend bundled on the host and every image built — or, for
+*   a tag, pulled
+* - `release`: `up --wait --remove-orphans`, and each app's image, tag and
+*   digest in the stage's state
+* - `verify`: each app asked through Caddy over HTTPS
+*
+* With `push` (`gkm compose --build --push`), run with `buildOnly`, it builds
+* every image and pushes it to `deploy.registry`, and does nothing else.
+*
+* `gkm compose` is this target with a few more switches (`--build`, `--pull`,
+* `--down`), run through the same `deploy()`.
+*/
+var compose_exports = /* @__PURE__ */ __exportAll({ composeTarget: () => composeTarget });
+/** The compose target, with its Docker, bundler and probe as given. */
+function composeTarget(options = {}) {
+	const { mode, push, pin, report, ...given } = options;
+	const deps = {
+		...defaultDeps,
+		...given
+	};
+	return defineTarget({
+		name: "compose",
+		runtime: "server",
+		capabilities: {
+			rollback: false,
+			migrations: "target",
+			images: true,
+			localStage: true,
+			selfHostedTelemetry: true
+		},
+		credentials: [],
+		tag: ({ cwd }) => deps.revision(cwd),
+		validate: (ctx) => validateCompose(ctx, deps, {
+			...mode ? { mode } : {},
+			...push ? { push } : {},
+			...pin ? { pin } : {}
+		}),
+		plan: (ctx, run) => planCompose(ctx, run),
+		provision: (ctx, run) => provisionCompose(ctx, run, deps),
+		build: (ctx, run) => buildCompose(ctx, run, deps),
+		release: (ctx, run) => releaseCompose(ctx, run, deps),
+		verify: (ctx, run) => verifyCompose(ctx, run, deps),
+		result: (ctx, run) => {
+			report?.(run);
+			return composeResult(ctx, run);
+		}
+	});
+}
+//#endregion
+export { stackOverrideFile as a, dockerCompose as c, ComposePushNeedsBuild as i, compose_exports as n, edgeDir as o, ComposePinNeedsPull as r, removeEdgeRoutes as s, composeTarget as t };
+
+//# sourceMappingURL=compose-DrEB_4F-.mjs.map