@geekmidas/cli 10.0.0-alpha.98 → 10.0.0-alpha.99

package/dist/stack-A6MAFZ6u.mjs

@@ -1,1201 +0,0 @@
-import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
-import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { B as LOGS_PORT, I as otlpTelemetryEnv, L as resolveStageTelemetry, at as certificateFor, ot as proxyFor, ut as isReservedStageKey, z as telemetryEnv } from "./workspace-BBeT6Pil.mjs";
-import { $n as stackLogs, Gt as WORKER_PORT, Ht as composeBuildPaths, It as appEnvKeys, N as stageProviderNotes, O as stageServiceDeclarations, Ot as bucketPolicies, Qn as logsService, Rt as networkEnv, T as externalServices, Vt as localRolePassword, Wt as TURBO_VERSION, Xn as LOGS_SERVICE, _t as REDIS_SERVICE, cn as isTelemetryKey, d as validateImageRef, dn as telemetryOf, et as workerUnits, fn as usesTelemetry, ft as LOCAL_RABBITMQ_USER, gn as portKeys, in as planFor, k as suppliedOnly, l as workerDockerfile, ln as scopeTelemetryEnv, mt as postgresSuperuser, nn as EMULATOR_ACCESS_KEY_ID, nr as isMainFrontendApp, o as appDockerfile, on as hostFor, pn as DEFAULT_IMAGES, rr as resolveHost, tn as composeFor, tr as NoDomainForStage, vt as STACK_CACHE, w as devServicesUsed, xt as stackRedis, yt as redisService, zn as imageRef, zt as workerEnvKeys } from "./seeds-BvxWUGKJ.mjs";
-import { i as DEFAULT_EVENTS } from "./SubscriberGenerator-CyN2VF5X.mjs";
-import { join } from "node:path";
-import { CLIENT_IP_HEADER, provideKey, provisionOrder, publicEnvFor } from "@geekmidas/manifest";
-import { createHash } from "node:crypto";
-import { stringify } from "yaml";
-//#region src/compose/traefik.ts
-/**
-* The server's shared edge, rendered for Traefik: what the edge itself runs
-* with, and what one stack registers with it.
-*
-* One Traefik per server owns 80 and 443, the ACME state and the redirect to
-* HTTPS. It is configured through its file provider alone: each stack writes
-* one file — its routers, services and middlewares, every name prefixed with
-* its compose project — into a directory the edge watches, and removes it
-* when it stops. There is no Docker socket: the edge never learns what runs
-* on the server except from those files.
-*
-* The edge and the stacks meet on one external Docker network. Only a
-* stack's public services join it, each under an alias prefixed with its
-* project (`<project>-api`), because the network is shared: a bare service
-* name there would be answered by every stack's `api`.
-*
-* Pure: the documents are data, and the edge's side effects are `edge.ts`'s.
-*/
-/**
-* The image, pinned: the edge is every stack's way in, so a new version is a
-* change to this line, not whatever `latest` is on the day a server starts.
-*/
-const TRAEFIK_IMAGE = "traefik:v3.7.13";
-/** The edge's compose project, one per server. */
-const EDGE_PROJECT = "gkm-edge";
-/** The external network the edge and every stack's public services share. */
-const EDGE_NETWORK = "gkm-edge";
-/** The edge's compose service. */
-const EDGE_SERVICE = "traefik";
-/** Inside the edge's container: what it watches, and where certificates are. */
-const EDGE_DYNAMIC_DIR = "/etc/gkm-edge/dynamic";
-const EDGE_CERTS_DIR = "/etc/gkm-edge/certs";
-/** The certificate resolver every deployed route without its own certificate uses. */
-const ACME_RESOLVER = "letsencrypt";
-/** The internal entrypoint the edge's health check asks; never published. */
-const PING_PORT = 8082;
-/** A stack's service, as the edge — and the stack itself — reach it. */
-function edgeAlias(project, service) {
-	return `${project}-${service}`;
-}
-/** A stack's certificate, as the edge's container reads it. */
-function edgeCertificatePaths(project) {
-	return {
-		certFile: `${EDGE_CERTS_DIR}/${project}.crt`,
-		keyFile: `${EDGE_CERTS_DIR}/${project}.key`
-	};
-}
-/**
-* The edge's static configuration: the entrypoints, the redirect, ACME, and
-* the directory it watches. No API and no dashboard — nothing about the edge
-* is reachable but the routes stacks register.
-*/
-function traefikStatic(ports) {
-	return {
-		global: {
-			checkNewVersion: false,
-			sendAnonymousUsage: false
-		},
-		entryPoints: {
-			web: {
-				address: ":80",
-				http: { redirections: { entryPoint: {
-					to: ports.https === 443 ? "websecure" : `:${ports.https}`,
-					scheme: "https",
-					permanent: true
-				} } }
-			},
-			websecure: { address: ":443" },
-			ping: { address: `:${PING_PORT}` }
-		},
-		ping: { entryPoint: "ping" },
-		providers: { file: {
-			directory: EDGE_DYNAMIC_DIR,
-			watch: true
-		} },
-		certificatesResolvers: { [ACME_RESOLVER]: { acme: {
-			storage: "/acme/acme.json",
-			httpChallenge: { entryPoint: "web" }
-		} } },
-		log: { level: "INFO" }
-	};
-}
-/** The edge's compose document. */
-function edgeCompose(options) {
-	const { dir, ports } = options;
-	return {
-		name: EDGE_PROJECT,
-		services: { [EDGE_SERVICE]: {
-			image: TRAEFIK_IMAGE,
-			restart: "unless-stopped",
-			ports: [`${ports.https}:443`, `${ports.http}:80`],
-			volumes: [
-				`${dir}/traefik.yml:/etc/traefik/traefik.yml:ro`,
-				`${dir}/dynamic:${EDGE_DYNAMIC_DIR}:ro`,
-				`${dir}/certs:${EDGE_CERTS_DIR}:ro`,
-				"acme:/acme"
-			],
-			labels: { "dev.geekmidas.edge.config": createHash("sha256").update(options.staticConfig).digest("hex").slice(0, 16) },
-			networks: ["edge"],
-			healthcheck: {
-				test: [
-					"CMD",
-					"traefik",
-					"healthcheck",
-					"--ping"
-				],
-				interval: "10s",
-				timeout: "5s",
-				retries: 5
-			},
-			logging: options.logging
-		} },
-		volumes: { acme: {} },
-		networks: { edge: {
-			name: EDGE_NETWORK,
-			external: true
-		} }
-	};
-}
-/** A stack's dynamic configuration, as an object. */
-function traefikDynamic(routes, options) {
-	const { project, tls } = options;
-	const name = (route, suffix) => `${project}-${route.name}${suffix ? `-${suffix}` : ""}`;
-	const url = ({ service, port }) => `http://${edgeAlias(project, service)}:${port}`;
-	const routers = {};
-	const services = {};
-	const middlewares = {};
-	const strip = `${project}-strip-gkm-headers`;
-	if (routes.length > 0) middlewares[strip] = { headers: { customRequestHeaders: { [CLIENT_IP_HEADER]: "" } } };
-	for (const route of routes) {
-		const chain = [strip];
-		if (route.allow) {
-			middlewares[name(route, "allow")] = { ipAllowList: { sourceRange: [...route.allow] } };
-			chain.push(name(route, "allow"));
-		}
-		if (route.prefix) {
-			middlewares[name(route, "prefix")] = { addPrefix: { prefix: route.prefix } };
-			chain.push(name(route, "prefix"));
-		}
-		routers[name(route)] = {
-			rule: `Host(\`${route.host}\`)`,
-			entryPoints: ["websecure"],
-			service: name(route),
-			middlewares: chain,
-			tls: tls.kind === "acme" ? { certResolver: ACME_RESOLVER } : {}
-		};
-		services[name(route)] = { loadBalancer: {
-			servers: route.upstreams.map((upstream) => ({ url: url(upstream) })),
-			...route.prefix ? { passHostHeader: false } : {},
-			...route.streaming ? { responseForwarding: { flushInterval: "-1ms" } } : {},
-			...route.health ? { healthCheck: {
-				path: route.health,
-				interval: "5s",
-				timeout: "3s"
-			} } : {}
-		} };
-	}
-	return {
-		http: {
-			routers,
-			services,
-			...Object.keys(middlewares).length > 0 ? { middlewares } : {}
-		},
-		...tls.kind === "files" ? { tls: { certificates: [{
-			certFile: tls.certFile,
-			keyFile: tls.keyFile
-		}] } } : {}
-	};
-}
-/** A stack's dynamic configuration file, as written to the edge's directory. */
-function traefikDynamicFile(routes, options) {
-	return `# Generated by gkm compose for ${options.project} — do not edit.
-# The shared edge (${EDGE_PROJECT}) reads every file in this directory; this
-# one is removed by gkm compose --down.
-${yaml(traefikDynamic(routes, options))}`;
-}
-/** The edge's static configuration file. */
-function traefikStaticFile(ports) {
-	return `# Generated by gkm compose — the server's shared edge. Do not edit.
-${yaml(traefikStatic(ports))}`;
-}
-/** The edge's compose file. */
-function edgeComposeFile(options) {
-	return `# Generated by gkm compose — the server's shared edge. Do not edit.
-#
-# Started by the first stack that runs with proxy: 'traefik', and left
-# running by gkm compose --down. Stop it, once nothing uses it, with:
-#
-#   docker compose -p ${EDGE_PROJECT} -f ${options.dir}/docker-compose.yml down
-${yaml(edgeCompose(options))}`;
-}
-function yaml(value) {
-	return stringify(value, {
-		lineWidth: 0,
-		aliasDuplicateObjects: false
-	});
-}
-//#endregion
-//#region src/compose/images.ts
-/**
-* Which image each app runs — and, for a tag, whether every one exists.
-*
-* A tag is a release's identity: `--tag=v1.4.0` means the images CI pushed as
-* v1.4.0, and nothing else. So a stack is never half rolled out: every app's
-* image is asked of the registry before anything is pulled or the running
-* stack is touched, and one missing image stops the whole run naming every
-* one that is missing. Nor is a missing image quietly built instead — a build
-* of whatever is checked out here is not the release the tag names.
-*/
-/**
-* The tag a site's image carries for a release.
-*
-* A site's public URLs are inlined when it is built, so one bundle serves one
-* stage: `v1.4.0-production` and `v1.4.0-staging` are two images of the same
-* commit. A backend reads its URLs at runtime, so one image serves every stage
-* and its tag is the release's alone.
-*/
-function siteTag(tag, stage) {
-	return `${tag}-${stage}`;
-}
-/** Images a tag names that the registry does not have. */
-var ImageTagNotFound = class extends GkmError {
-	tag;
-	refs;
-	constructor(tag, refs) {
-		super(`The registry has no image for ${refs.length === 1 ? "this app" : `${refs.length} apps`} at '${tag}':\n` + refs.map((ref) => `  - ${ref}`).join("\n") + `\nNothing was pulled or started. Push '${tag}' for every app from CI, pick a tag that exists, or run without --tag to build from this checkout.`);
-		this.tag = tag;
-		this.refs = refs;
-		this.name = "ImageTagNotFound";
-	}
-};
-/** The registry did not answer, or did not let this machine in. */
-var RegistryUnreachable = class extends GkmError {
-	ref;
-	detail;
-	constructor(ref, detail) {
-		super(`Could not ask the registry about ${ref}: ${detail || "no answer"}\nNothing was pulled or started. Check the registry is reachable and that this machine is logged in to it (\`docker login <registry>\`).`);
-		this.ref = ref;
-		this.detail = detail;
-		this.name = "RegistryUnreachable";
-	}
-};
-/**
-* Assert every image exists, before anything else happens.
-*
-* Asked all at once and reported all at once: a release missing two images is
-* one problem with two names, and finding the second only after fixing the
-* first is a slower way to learn the same thing.
-*
-* @throws {RegistryUnreachable} when the registry cannot say
-* @throws {ImageTagNotFound} listing every missing image
-*/
-async function assertImagesExist(docker, tag, images) {
-	const lookups = await Promise.all(images.map((image) => docker.lookup(image.ref)));
-	const unreachable = lookups.find((lookup) => lookup.status === "unreachable");
-	if (unreachable?.status === "unreachable") throw new RegistryUnreachable(unreachable.ref, unreachable.detail);
-	const missing = lookups.filter((lookup) => lookup.status === "missing").map((lookup) => lookup.ref);
-	if (missing.length > 0) throw new ImageTagNotFound(tag, missing);
-}
-/**
-* A push or a pull with no `deploy.registry` to push to or pull from.
-*
-* Without one an image is named `<namespace>/<project>-<app>:<tag>`, which
-* Docker resolves to Docker Hub — so a release would be pushed to, or pulled
-* from, somebody else's account. It is never a fallback.
-*/
-var RegistryRequired = class extends GkmError {
-	operation;
-	ref;
-	constructor(operation, ref) {
-		super(`${operation === "push" ? "Pushing" : "Pulling"} images needs a registry, and gkm.config.ts sets no deploy.registry: '${ref}' would be ${operation === "push" ? "pushed to" : "pulled from"} Docker Hub. Set deploy.registry (e.g. registry: 'ghcr.io/acme') in gkm.config.ts.` + (operation === "pull" ? " To run images built here instead, pass --build." : ""));
-		this.operation = operation;
-		this.ref = ref;
-		this.name = "RegistryRequired";
-	}
-};
-/** An image pinned to its digest: `<ref>@sha256:…`. */
-function pinnedRef(ref, digest) {
-	return `${ref.split("@")[0]}@${digest}`;
-}
-/** A digests file with no entry for an app the stack runs. */
-var ImageDigestMissing = class extends GkmError {
-	file;
-	apps;
-	constructor(file, apps) {
-		super(`${file} pins no digest for ${apps.join(", ")}. Use the file the same release's \`gkm compose --build --push --digests-file\` wrote, or run without --digests-file to pull by tag.`);
-		this.file = file;
-		this.apps = apps;
-		this.name = "ImageDigestMissing";
-	}
-};
-/** A digests file entry that is not this app's image. */
-var ImageDigestMismatch = class extends GkmError {
-	app;
-	expected;
-	found;
-	constructor(app, expected, found) {
-		super(`The digests file pins '${app}' to ${found}, but this release runs ${expected}. It was written for another registry, project, stage or tag; use the file this stage's push of this tag wrote.`);
-		this.app = app;
-		this.expected = expected;
-		this.found = found;
-		this.name = "ImageDigestMismatch";
-	}
-};
-/** A digests file that is not a JSON object of app to pinned ref. */
-var ImageDigestsInvalid = class extends GkmError {
-	file;
-	detail;
-	constructor(file, detail) {
-		super(`${file} is not a digests file (${detail}). It should be the JSON object \`gkm compose --build --push --digests-file\` writes: { "api": "<registry>/<image>:<tag>@sha256:…" }.`);
-		this.file = file;
-		this.detail = detail;
-		this.name = "ImageDigestsInvalid";
-	}
-};
-/** Parse a digests file's content, checking its shape. */
-function parseDigests(file, content) {
-	let parsed;
-	try {
-		parsed = JSON.parse(content);
-	} catch (error) {
-		throw new ImageDigestsInvalid(file, error instanceof Error ? error.message : String(error));
-	}
-	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new ImageDigestsInvalid(file, "not a JSON object");
-	for (const [app, value] of Object.entries(parsed)) if (typeof value !== "string" || !/@sha256:[0-9a-f]{64}$/.test(value)) throw new ImageDigestsInvalid(file, `'${app}' is not an <image>:<tag>@sha256:… ref`);
-	return parsed;
-}
-/**
-* Each image pinned to the digest the file names for it.
-*
-* @throws {ImageDigestMissing} naming every app the file has no entry for
-* @throws {ImageDigestMismatch} when an entry is another image or tag
-*/
-function pinImages(file, digests, images) {
-	const missing = images.filter((image) => !digests[image.app]).map((image) => image.app);
-	if (missing.length > 0) throw new ImageDigestMissing(file, missing);
-	return images.map((image) => {
-		const pinned = digests[image.app];
-		if (pinned.split("@")[0] !== image.ref) throw new ImageDigestMismatch(image.app, image.ref, pinned);
-		return {
-			...image,
-			ref: pinned
-		};
-	});
-}
-//#endregion
-//#region src/compose/caddyfile.ts
-/**
-* The stack's own edge, rendered for Caddy: one site block per route.
-*
-* Deployed, each host is the stage's real domain and Caddy gets it a
-* certificate from Let's Encrypt on first request — the same automatic HTTPS
-* it does anywhere, with nothing to configure but the name — or serves the
-* stage's own certificate (`deploy.compose.tls`). Locally the hosts are
-* `*.localhost` and the certificates come from Caddy's own CA, as the `gkm
-* dev` edge does, so a local stack is `https://` like a deployed one.
-*
-* Pure: the routes are data (`routes.ts`), and rendering them is one string.
-*/
-/** Where Caddy reads a stage's own certificate, inside its container. */
-const CADDY_TLS_DIR = "/etc/caddy/tls";
-/** An upstream on the stack's own network: its service name. */
-function address({ service, port }) {
-	return `${service}:${port}`;
-}
-/** The Caddyfile for a stack's edge. */
-function edgeCaddyfile(routes, options) {
-	const { tls } = options;
-	const global = tls.kind === "internal" ? `{
-	# No ACME and no public DNS: the CA is Caddy's own and the names resolve
-	# to this machine.
-	local_certs
-	auto_https disable_redirects
-}` : options.email ? `{
-	email ${options.email}
-}` : "";
-	const certificate = tls.kind === "internal" ? `
-	tls internal
-` : tls.kind === "files" ? `
-	tls ${tls.certFile} ${tls.keyFile}
-` : "";
-	const blocks = routes.map(({ host, upstreams, prefix, allow, streaming }) => `https://${host} {${certificate}
-	# gkm's own header, which only a service of this stack may send: the auth
-	# server rate-limits by the client address it carries.
-	request_header -${CLIENT_IP_HEADER}
-${allow ? `
-	# Only these addresses — the peer Caddy sees, never a header a client
-	# could set. Everything else is refused before it reaches the upstream.
-	@denied not remote_ip ${allow.join(" ")}
-	respond @denied 403
-` : ""}${prefix ? `
-	# A bucket, served at a host of its own: the bucket is a prefix on MinIO,
-	# which routes and signs on the Host header — so it is sent the upstream's.
-	reverse_proxy ${upstreams.map(address).join(" ")} {
-		rewrite ${prefix}{uri}
-		header_up Host {upstream_hostport}
-	}` : `
-	# Host and X-Forwarded-* are passed through as Caddy does by default, so
-	# an app builds redirects, cookies and links on the address a caller used.
-	reverse_proxy ${upstreams.map(address).join(" ")}${streaming ? ` {
-		# Never buffer: a streamed response — server-sent events, a Next.js
-		# RSC payload — reaches the client as each chunk is written.
-		flush_interval -1
-	}` : ""}`}
-}`);
-	return `${HEADER}${global ? `${global}\n\n` : ""}${blocks.join("\n\n")}\n`;
-}
-const HEADER = `# Generated by gkm compose from the construct manifest — do not edit.
-#
-# One host per API and site, each in front of its own container, one per
-# file server in front of the stack's MinIO, and — when its logs are served
-# publicly — one for OpenObserve, to the addresses it allows.
-`;
-//#endregion
-//#region src/compose/stack.ts
-/**
-* The stack a workspace runs as for one stage — pure.
-*
-* Everything `gkm compose` writes is decided here, as data: the compose file,
-* the Caddyfile, one env file per backend, and the image each app runs. The
-* command around it reads the workspace, asks the registry, writes the files
-* and starts Docker; none of those decide anything, so all of it can be
-* asserted without a daemon.
-*
-* The values come from the same derivations every other target uses. The
-* plan is reconcile's `planFor`, the keys an app reads are `appEnvKeys`, and
-* every URL is `envFor`'s — asked twice, once with each app at its public
-* address and once on the compose network, because a browser and a sibling
-* service reach the same API by different names.
-*/
-var stack_exports = /* @__PURE__ */ __exportAll({
-	EDGE_PORT_ENV: () => EDGE_PORT_ENV,
-	EnvValueMultiline: () => EnvValueMultiline,
-	LOGS_PORT_ENV: () => LOGS_PORT_ENV,
-	LOG_ROTATION: () => LOG_ROTATION,
-	LocalCredentialsMissing: () => LocalCredentialsMissing,
-	NothingToCompose: () => NothingToCompose,
-	StageSecretMissing: () => StageSecretMissing,
-	StageSeedMissing: () => StageSeedMissing,
-	composeProject: () => composeProject,
-	composeStack: () => composeStack,
-	derivedCredentials: () => derivedCredentials,
-	envFile: () => envFile,
-	stackDir: () => stackDir
-});
-/** Where a stack's files are written, relative to the workspace root. */
-function stackDir(stage) {
-	return `.gkm/compose/${stage}`;
-}
-/**
-* The compose project a stage's stack runs as.
-*
-* The deploy identity's scope, so two workspaces with one name in different
-* namespaces never share containers or volumes — and the stage, so a
-* machine can run two stages side by side.
-*/
-function composeProject(identity) {
-	return `${identity.scope}-${identity.stage}`;
-}
-/** The ports the edge is published on, and the variables that move them. */
-const EDGE_PORT_ENV = {
-	https: "GKM_COMPOSE_HTTPS_PORT",
-	http: "GKM_COMPOSE_HTTP_PORT"
-};
-/**
-* The variable that moves the local stage's OpenObserve off its loopback
-* port, 5080 — which the local stage takes from nowhere else, since it
-* ignores `deploy.telemetry`. Another stack, or another tool, may hold 5080.
-*/
-const LOGS_PORT_ENV = "GKM_COMPOSE_LOGS_PORT";
-/**
-* Containers this target does not run.
-*
-* The AWS emulator never applies: a stack is a server target, whose events
-* are pg-boss. Reconcile's Caddy fronts `gkm dev`'s host processes; the stack
-* brings its own edge.
-*
-* MinIO and Mailpit run on the local stage always, and on a deployed stage
-* only where `--allow-dev-services` allowed them and its secrets configure no
-* real bucket or mail server — see `devServices.ts`.
-*/
-const NOT_RUN = {
-	localstack: true,
-	caddy: true
-};
-/** The kinds a deployed stage takes from its secrets, or a dev service. */
-const SERVICE_KINDS = {
-	email: "email",
-	objects: "objects",
-	"file-server": "file-server"
-};
-/** The region MinIO is addressed with. It has no regions; the SDK wants one. */
-const MINIO_REGION = "us-east-1";
-/** The S3 client's credentials, read beside a bucket's URL when it has them. */
-const STORAGE_KEYS = [
-	"AWS_ACCESS_KEY_ID",
-	"AWS_SECRET_ACCESS_KEY",
-	"AWS_REGION"
-];
-/**
-* Every service's Docker logs, rotated. The json-file driver keeps a
-* container's output in one file that grows until the disk is full — on a
-* small server, in weeks. Three files of 10 MB each per container is enough
-* to see what happened and never fills anything. A project's own override
-* file that sets `logging` wins over it.
-*/
-const LOG_ROTATION = {
-	driver: "json-file",
-	options: {
-		"max-size": "10m",
-		"max-file": "3"
-	}
-};
-/** The local stage's stack, without the logins `gkm dev` generates. */
-var LocalCredentialsMissing = class extends GkmError {
-	stage;
-	constructor(stage) {
-		super(`The local stage '${stage}' runs with this machine's generated logins, and none were passed. Load them with loadLocalCredentials(workspace) and pass them as localCredentials.`);
-		this.stage = stage;
-		this.name = "LocalCredentialsMissing";
-	}
-};
-/**
-* A deployed stage's container logins, derived from its seed like its role
-* passwords — so every deploy of the stage computes the same ones, and no one
-* reading the repo can.
-*/
-function derivedCredentials(project, plan, seed) {
-	const derive = (purpose) => localRolePassword(project, plan, purpose, seed);
-	return {
-		postgres: {
-			user: postgresSuperuser(project),
-			password: derive("master")
-		},
-		minio: {
-			user: `${project}-minio`,
-			password: derive("minio")
-		},
-		rabbitmq: {
-			user: LOCAL_RABBITMQ_USER,
-			password: derive("rabbitmq")
-		},
-		redis: { password: derive("redis") },
-		cacheToken: derive("cache-token"),
-		emulator: {
-			accessKeyId: EMULATOR_ACCESS_KEY_ID,
-			secretAccessKey: derive("emulator")
-		},
-		logs: {
-			email: `admin@${project}`,
-			password: derive("logs")
-		}
-	};
-}
-/** A value only the stage's secrets can hold, and they do not. */
-var StageSecretMissing = class extends GkmError {
-	app;
-	key;
-	stage;
-	constructor(app, key, stage) {
-		super(`'${app}' reads ${key}, and the stage '${stage}' has none. Nothing in the stack can derive it; set it in the stage's secrets: gkm secrets:set ${key} '…' --stage ${stage}`);
-		this.app = app;
-		this.key = key;
-		this.stage = stage;
-		this.name = "StageSecretMissing";
-	}
-};
-/** A deployed stage's secrets with no seed to derive its passwords from. */
-var StageSeedMissing = class extends GkmError {
-	stage;
-	constructor(stage) {
-		super(`The stage '${stage}' has no seed in its secrets, and a deployed stage's database passwords are derived from it. Run gkm compose --stage ${stage} without --dry-run once, or gkm deploy, to generate it.`);
-		this.stage = stage;
-		this.name = "StageSeedMissing";
-	}
-};
-/** A workspace with no API and no site to run. */
-var NothingToCompose = class extends GkmError {
-	root;
-	constructor(root) {
-		super(`${root} declares no RestApi, no site and no Worker with work to do, so a stack would run nothing. Mobile apps ship through their own toolchain.`);
-		this.root = root;
-		this.name = "NothingToCompose";
-	}
-};
-/** A value that cannot be written to an env file a line at a time. */
-var EnvValueMultiline = class extends GkmError {
-	app;
-	key;
-	constructor(app, key) {
-		super(`${key} for '${app}' spans more than one line, and an env file holds one value per line. Store it on one line — base64, or JSON — and decode it where it is read.`);
-		this.app = app;
-		this.key = key;
-		this.name = "EnvValueMultiline";
-	}
-};
-/** The services a stack's apps wait on and the edge waits on in turn. */
-const HEALTHY = { condition: "service_healthy" };
-/**
-* An app's health check: its own server, asked on 127.0.0.1 — not
-* `localhost`, which resolves to `::1` first in an Alpine container while a
-* server may listen on IPv4 alone.
-*/
-function probe(port, path) {
-	return {
-		test: [
-			"CMD",
-			"wget",
-			"-q",
-			"-O",
-			"/dev/null",
-			`http://127.0.0.1:${port}${path}`
-		],
-		interval: "5s",
-		timeout: "3s",
-		retries: 20,
-		start_period: "10s"
-	};
-}
-/** The stack for one stage. */
-function composeStack(input) {
-	const { workspace, manifest, stage, identity } = input;
-	const local = stage === workspace.stages.local;
-	const project = composeProject(identity);
-	const custom = input.secrets?.custom ?? {};
-	const https = input.ports?.https ?? 443;
-	const http = input.ports?.http ?? 80;
-	const proxy = proxyFor(workspace.deploy?.compose, stage, local);
-	const certificate = local ? void 0 : certificateFor(workspace.deploy?.compose, stage, workspace.root);
-	const plan = planFor(manifest, stage, provisionOrder(manifest), {
-		localStage: workspace.stages.local,
-		events: DEFAULT_EVENTS.server,
-		cache: STACK_CACHE,
-		edge: false
-	});
-	const byId = new Map(plan.resources.map((r) => [r.id, r]));
-	if (local && !input.localCredentials) throw new LocalCredentialsMissing(stage);
-	const seed = local ? input.localCredentials.seed : input.secrets?.seed;
-	if (!seed) throw new StageSeedMissing(stage);
-	const containers = local ? input.localCredentials : derivedCredentials(workspace.name, plan, seed);
-	const credential = {
-		containers: {
-			...containers,
-			minio: {
-				user: custom.AWS_ACCESS_KEY_ID ?? containers.minio.user,
-				password: custom.AWS_SECRET_ACCESS_KEY ?? containers.minio.password
-			}
-		},
-		seed
-	};
-	const apps = stackApps(workspace, manifest, plan, {
-		local,
-		stage,
-		https,
-		identity,
-		images: input.images
-	});
-	const workers = stackWorkers(workerUnits(workspace, manifest, input.background ?? {}), {
-		stage,
-		identity,
-		images: input.images
-	});
-	if (apps.length === 0 && workers.length === 0) throw new NothingToCompose(workspace.root);
-	const owners = /* @__PURE__ */ new Map();
-	for (const resource of plan.resources) {
-		owners.set(resource.envKey, resource);
-		if (resource.kind === "email") {
-			owners.set(provideKey(resource.id, "from"), resource);
-			owners.set(provideKey(resource.id, "inboxUrl"), resource);
-		}
-		if (resource.kind === "external-api") owners.set(provideKey(resource.id, "credentials"), resource);
-	}
-	const domain = workspace.domains?.[stage];
-	const telemetry = resolveStageTelemetry({
-		...workspace.deploy?.telemetry ? { telemetry: workspace.deploy.telemetry } : {},
-		stage,
-		local,
-		target: "compose",
-		runtime: "server",
-		selfHosted: true,
-		used: usesTelemetry(manifest)
-	});
-	const logsBase = telemetry?.provider === "self-hosted" ? stackLogs({
-		config: local && input.ports?.logs ? {
-			...telemetry.selfHosted,
-			port: input.ports.logs
-		} : telemetry.selfHosted,
-		stage,
-		local,
-		project: workspace.name,
-		...domain ? { domain } : {},
-		custom,
-		https,
-		...local ? { localLogin: input.localCredentials.logs } : {}
-	}) : void 0;
-	const services = local ? {
-		missing: [],
-		minio: plan.resources.filter((r) => r.kind === "objects").map((r) => r.id),
-		mailpit: plan.resources.filter((r) => r.kind === "email").map((r) => r.id)
-	} : externalServices({
-		stage,
-		declarations: stageServiceDeclarations({
-			manifest,
-			...input.runnables ? { runnables: input.runnables } : {}
-		}),
-		supplied: custom,
-		allow: input.allowDevServices === true,
-		...domain ? { domain } : {},
-		providers: stageProviderNotes(workspace, stage)
-	});
-	const redis = stackRedis({
-		plan,
-		stage,
-		local,
-		custom,
-		...local ? { localPassword: input.localCredentials.redis.password } : {}
-	});
-	const infra = [...plan.containers.filter((c) => !NOT_RUN[c]).filter((c) => c !== LOGS_SERVICE).filter((c) => c !== "minio" || services.minio.length > 0).filter((c) => c !== "mailpit" || services.mailpit.length > 0).filter((c) => c !== "redis" || redis !== void 0), ...logsBase ? [LOGS_SERVICE] : []].sort();
-	const storage = infra.includes("minio") ? (() => {
-		const buckets = services.minio.map((id) => byId.get(id)?.name).filter((name) => Boolean(name)).sort();
-		return {
-			...credential.containers.minio,
-			buckets,
-			policies: bucketPolicies(plan).filter((p) => buckets.includes(p.bucket))
-		};
-	})() : void 0;
-	const fileServers = /* @__PURE__ */ new Map();
-	if (storage) for (const resource of plan.resources) {
-		if (resource.kind !== "file-server" || !resource.of) continue;
-		if (!services.minio.includes(resource.of)) continue;
-		if (custom[resource.envKey] !== void 0) continue;
-		const bucket = byId.get(resource.of);
-		if (!bucket) continue;
-		let host;
-		if (local) host = hostFor(resource, workspace.name);
-		else {
-			if (!domain) throw new NoDomainForStage(stage);
-			host = `${resource.subdomain ?? appKey(resource.id)}.${domain}`;
-		}
-		fileServers.set(resource.id, {
-			url: `https://${host}${local && https !== 443 ? `:${https}` : ""}`,
-			route: {
-				name: `files-${appKey(resource.id)}`,
-				host,
-				upstreams: [{
-					service: "minio",
-					port: 9e3
-				}],
-				streaming: false,
-				prefix: `/${bucket.name}`
-			}
-		});
-	}
-	const edgeServices = new Set(proxy === "traefik" ? [
-		...apps.map((app) => app.name),
-		...fileServers.size > 0 ? ["minio"] : [],
-		...logsBase?.host && logsBase.public ? [LOGS_SERVICE] : []
-	] : []);
-	const hostOf = (service) => edgeServices.has(service) ? edgeAlias(project, service) : service;
-	const logs = logsBase && {
-		...logsBase,
-		appEnv: {
-			...logsBase.appEnv,
-			OTEL_EXPORTER_OTLP_ENDPOINT: logsBase.appEnv.OTEL_EXPORTER_OTLP_ENDPOINT.replace(`//openobserve:`, `//${hostOf("openobserve")}:`)
-		}
-	};
-	const derivation = {
-		project: workspace.name,
-		credentials: credential.containers,
-		seed: credential.seed,
-		...!local && domain ? { mailFrom: `noreply@${domain}` } : {}
-	};
-	const outside = networkEnv(plan, {
-		...derivation,
-		addresses: Object.fromEntries(apps.map((app) => [app.id, app.url]))
-	}, hostOf);
-	const inside = networkEnv(plan, {
-		...derivation,
-		addresses: Object.fromEntries(apps.map((app) => [app.id, `http://${hostOf(app.name)}:${app.port}`]))
-	}, hostOf);
-	const surfaceUrls = new Map(plan.resources.filter((r) => r.kind === "rest-api" || r.kind === "site").map((r) => [r.envKey, r.id]));
-	const appById = new Map(apps.map((app) => [app.id, app]));
-	/**
-	* What a key resolves to for one app, from the stage's secrets where only
-	* they can hold it, and the derivations otherwise.
-	*/
-	const valueFor = (app, key, owner) => {
-		if (isReservedStageKey(key)) return void 0;
-		if (owner && SERVICE_KINDS[owner.kind]) {
-			if (custom[key] !== void 0) return custom[key];
-			if (owner.kind === "file-server") return fileServers.get(owner.id)?.url;
-			return outside[key];
-		}
-		if (owner && suppliedOnly(owner.kind, owner.id, key, local)) {
-			const value = custom[key];
-			if (value === void 0) throw new StageSecretMissing(app.name, key, stage);
-			return value;
-		}
-		if (custom[key] !== void 0) return custom[key];
-		if (owner?.kind === "cache") return redis?.urls[key];
-		const surface = surfaceUrls.get(key);
-		if (app.kind === "rest-api" && surface && surface !== app.id) return inside[key];
-		return outside[key];
-	};
-	const telemetryValues = logs ? telemetryEnv({
-		endpoint: logs.appEnv.OTEL_EXPORTER_OTLP_ENDPOINT,
-		headers: logs.appEnv.OTEL_EXPORTER_OTLP_HEADERS
-	}, telemetry?.sampleRate ?? 1) : telemetry?.provider === "otlp" ? otlpTelemetryEnv(telemetry) : void 0;
-	/** Each key one backend process reads, resolved for this stage. */
-	const valuesFor = (app, keys) => {
-		const values = {};
-		for (const key of [...keys].sort()) {
-			if (isTelemetryKey(key)) continue;
-			const owner = owners.get(key) ?? storageOwner(key, plan);
-			if (!local && owner?.kind === "email" && key.endsWith("_INBOX_URL")) continue;
-			if (STORAGE_KEYS.includes(key)) {
-				const value = custom[key] ?? storageValue(key, storage);
-				if (value !== void 0) values[key] = value;
-				continue;
-			}
-			const value = valueFor(app, key, owner);
-			if (value !== void 0) values[key] = value;
-		}
-		return values;
-	};
-	for (const app of apps) {
-		if (app.kind === "site") {
-			const site = manifest[app.id];
-			if (site?.kind !== "site") continue;
-			const args = {};
-			for (const [key, source] of Object.entries(publicEnvFor(site, manifest))) {
-				const value = valueFor(app, source, owners.get(source));
-				if (value !== void 0) args[key] = value;
-			}
-			if (app.build && Object.keys(args).length > 0) app.build.args = args;
-			continue;
-		}
-		if (input.buildOnly) continue;
-		const keys = appEnvKeys(manifest, app.name, input.runnables) ?? /* @__PURE__ */ new Set();
-		const values = valuesFor(app, keys);
-		const trusted = provideKey(app.id, "trustedOrigins");
-		if (keys.has(trusted)) {
-			const internal = (byId.get(app.id)?.callers ?? []).map((caller) => appById.get(caller)).filter((caller) => caller?.kind === "rest-api").map((caller) => `http://${hostOf(caller.name)}:${caller.port}`);
-			const origins = [...(values[trusted] ?? "").split(",").filter(Boolean), ...internal];
-			values[trusted] = [...new Set(origins)].join(",");
-		}
-		app.env = {
-			...scopeTelemetryEnv(values, {
-				uses: telemetryOf(manifest, app.id) !== void 0,
-				serviceName: app.name,
-				...telemetryValues ? { telemetry: telemetryValues } : {}
-			}),
-			NODE_ENV: "production",
-			PORT: String(app.port),
-			STAGE: stage
-		};
-		for (const [key, value] of Object.entries(app.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(app.name, key);
-	}
-	for (const worker of input.buildOnly ? [] : workers) {
-		const keys = workerEnvKeys(manifest, worker.id, input.runnables) ?? /* @__PURE__ */ new Set();
-		worker.env = {
-			...scopeTelemetryEnv(valuesFor({
-				name: worker.name,
-				id: worker.id,
-				kind: "rest-api"
-			}, keys), {
-				uses: telemetryOf(manifest, worker.id) !== void 0,
-				serviceName: worker.name,
-				...telemetryValues ? { telemetry: telemetryValues } : {}
-			}),
-			NODE_ENV: "production",
-			PORT: String(worker.port),
-			STAGE: stage
-		};
-		for (const [key, value] of Object.entries(worker.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(worker.name, key);
-	}
-	const deployedTls = certificate ? {
-		kind: "files",
-		...proxy === "caddy" ? {
-			certFile: `${CADDY_TLS_DIR}/cert.pem`,
-			keyFile: `${CADDY_TLS_DIR}/key.pem`
-		} : edgeCertificatePaths(project)
-	} : { kind: "acme" };
-	const tls = local ? { kind: "internal" } : deployedTls;
-	const layout = input.layout ?? defaultLayout(workspace.root);
-	const compose = stackFile({
-		project,
-		plan,
-		infra,
-		apps,
-		workers,
-		credentials: credential.containers,
-		...storage ? { storage } : {},
-		...logs ? { logs } : {},
-		...redis ? { redis } : {},
-		https,
-		http,
-		composeDir: join(workspace.root, stackDir(stage)),
-		buildRoot: layout.buildRoot,
-		workspaceRoot: workspace.root,
-		envFiles: !input.buildOnly,
-		proxy,
-		edge: new Map([...edgeServices].map((service) => [service, hostOf(service)])),
-		tls: certificate !== void 0
-	});
-	const routes = [
-		...apps.map((app) => ({
-			name: app.name,
-			host: app.host,
-			upstreams: [{
-				service: app.name,
-				port: app.port
-			}],
-			streaming: true,
-			health: app.kind === "site" ? "/" : "/health"
-		})),
-		...[...fileServers.values()].map(({ route }) => route),
-		...logs?.host && logs.public ? [{
-			name: LOGS_SERVICE,
-			host: logs.host,
-			upstreams: [{
-				service: LOGS_SERVICE,
-				port: LOGS_PORT
-			}],
-			streaming: true,
-			allow: logs.public.allow
-		}] : []
-	];
-	const dockerfiles = {};
-	for (const app of apps) {
-		if (!app.build) continue;
-		dockerfiles[app.build.dockerfile] = appDockerfile(app.name, workspace.apps[app.name], {
-			layout,
-			workspaceRoot: workspace.root,
-			apps: workspace.apps,
-			manifest,
-			cache: STACK_CACHE,
-			workspace,
-			stage
-		});
-	}
-	for (const worker of workers) {
-		if (!worker.build) continue;
-		dockerfiles[worker.build.dockerfile] = workerDockerfile({
-			id: worker.id,
-			name: worker.name,
-			app: worker.host
-		}, workspace.apps[worker.host], {
-			layout,
-			workspaceRoot: workspace.root,
-			cache: STACK_CACHE
-		});
-	}
-	return {
-		project,
-		stage,
-		local,
-		apps,
-		workers,
-		infra,
-		compose,
-		proxy,
-		routes,
-		...proxy === "caddy" ? { caddyfile: edgeCaddyfile(routes, { tls }) } : { traefik: traefikDynamicFile(routes, {
-			project,
-			tls: deployedTls
-		}) },
-		...certificate ? { tls: certificate } : {},
-		dockerfiles,
-		plan,
-		credential,
-		...storage ? { storage } : {},
-		devServices: local ? [] : devServicesUsed(services),
-		...logs ? { logs } : {},
-		...telemetry ? { telemetry } : {},
-		...redis ? { redis } : {}
-	};
-}
-/** The stack's MinIO's value for one of the S3 client's keys. */
-function storageValue(key, storage) {
-	if (!storage) return void 0;
-	if (key === "AWS_ACCESS_KEY_ID") return storage.user;
-	if (key === "AWS_SECRET_ACCESS_KEY") return storage.password;
-	if (key === "AWS_REGION") return MINIO_REGION;
-}
-/** Which bucket an S3 credential key belongs to — the first one declared. */
-function storageOwner(key, plan) {
-	if (!STORAGE_KEYS.includes(key)) return void 0;
-	return plan.resources.find((r) => r.kind === "objects");
-}
-/** The apps a stack runs: every API and every site, at its stage address. */
-function stackApps(workspace, manifest, plan, options) {
-	const apps = [];
-	const resources = new Map(plan.resources.map((r) => [r.id, r]));
-	for (const [id, declaration] of Object.entries(manifest)) {
-		if (declaration.kind !== "rest-api" && declaration.kind !== "site") continue;
-		const name = appKey(id);
-		const app = workspace.apps[name];
-		const resource = resources.get(id);
-		if (!app || !resource || !app.port) continue;
-		const host = hostOf(name, app, workspace, resource, options);
-		const tag = declaration.kind === "site" ? siteTag(options.images.tag, options.stage) : options.images.tag;
-		const ref = validateImageRef(imageRef(options.identity, name, options.images.registry, tag));
-		apps.push({
-			app: name,
-			name,
-			id,
-			kind: declaration.kind,
-			path: app.path,
-			port: app.port,
-			host,
-			url: `https://${host}${options.local && options.https !== 443 ? `:${options.https}` : ""}`,
-			ref,
-			tag,
-			...options.images.mode === "build" ? { build: { dockerfile: `${stackDir(options.stage)}/Dockerfile.${name}` } } : {}
-		});
-	}
-	return apps.sort((a, b) => a.name.localeCompare(b.name));
-}
-/** Each worker's image, and where it is built from. */
-function stackWorkers(units, options) {
-	return units.map((unit) => ({
-		app: unit.name,
-		name: unit.name,
-		id: unit.id,
-		host: unit.app,
-		port: WORKER_PORT,
-		ref: validateImageRef(imageRef(options.identity, unit.name, options.images.registry, options.images.tag)),
-		tag: options.images.tag,
-		...options.images.mode === "build" ? { build: { dockerfile: `${stackDir(options.stage)}/Dockerfile.${unit.name}` } } : {}
-	}));
-}
-/**
-* The host an app answers on for a stage: the `gkm dev` edge's
-* `*.localhost` names for the local stage, and the stage's domain — by the
-* same rule a deploy follows — for any other.
-*/
-function hostOf(name, app, workspace, resource, options) {
-	if (options.local) return hostFor(resource, workspace.name);
-	return resolveHost(name, app, options.stage, workspace.domains, isMainFrontendApp(name, app, workspace.apps));
-}
-/** The compose document: the infrastructure, the apps, and the edge. */
-function stackFile(options) {
-	const { project, plan, apps } = options;
-	const infra = options.infra.filter((name) => name !== LOGS_SERVICE);
-	const derived = composeFor({
-		...plan,
-		containers: [...infra]
-	}, {
-		project,
-		ports: Object.fromEntries(portKeys(infra, plan.fakes).map((key) => [key, 0])),
-		credentials: options.credentials
-	});
-	const services = {};
-	const volumes = {
-		...derived.volumes,
-		...options.proxy === "caddy" ? {
-			"caddy-data": {},
-			"caddy-config": {}
-		} : {},
-		...options.logs ? { "openobserve-data": {} } : {}
-	};
-	for (const name of infra) {
-		const { ports: _ports, depends_on, profiles: _profiles, ...service } = derived.services[name];
-		services[name] = {
-			...service,
-			...depends_on?.length ? { depends_on: Object.fromEntries(depends_on.map((dep) => [dep, HEALTHY])) } : {}
-		};
-	}
-	const postgres = services.postgres;
-	if (postgres) postgres.ports = ["127.0.0.1::5432"];
-	const minio = services.minio;
-	if (minio && options.storage) {
-		minio.environment = {
-			...minio.environment,
-			MINIO_ROOT_USER: options.storage.user,
-			MINIO_ROOT_PASSWORD: options.storage.password
-		};
-		minio.ports = ["127.0.0.1::9000"];
-	}
-	if (services["redis"] && options.redis) services[REDIS_SERVICE] = redisService(options.redis);
-	if (options.logs) services[LOGS_SERVICE] = logsService(options.logs);
-	for (const app of apps) services[app.name] = {
-		image: app.ref,
-		...app.build ? { build: {
-			...composeBuildPaths({
-				composeDir: options.composeDir,
-				buildRoot: options.buildRoot,
-				workspaceRoot: options.workspaceRoot,
-				dockerfile: app.build.dockerfile
-			}),
-			...app.build.args ? { args: app.build.args } : {}
-		} } : {},
-		restart: "unless-stopped",
-		...app.kind === "rest-api" ? {
-			env_file: [{
-				path: `./${app.name}.env`,
-				format: "raw"
-			}],
-			...infra.length ? { depends_on: Object.fromEntries(infra.map((name) => [name, HEALTHY])) } : {}
-		} : {},
-		healthcheck: probe(app.port, app.kind === "site" ? "/" : "/health")
-	};
-	for (const worker of options.workers) services[worker.name] = {
-		image: worker.ref,
-		...worker.build ? { build: composeBuildPaths({
-			composeDir: options.composeDir,
-			buildRoot: options.buildRoot,
-			workspaceRoot: options.workspaceRoot,
-			dockerfile: worker.build.dockerfile
-		}) } : {},
-		restart: "unless-stopped",
-		env_file: [{
-			path: `./${worker.name}.env`,
-			format: "raw"
-		}],
-		...infra.length ? { depends_on: Object.fromEntries(infra.map((name) => [name, HEALTHY])) } : {},
-		healthcheck: probe(worker.port, "/health")
-	};
-	if (options.proxy === "caddy") services.caddy = {
-		image: DEFAULT_IMAGES.caddy,
-		restart: "unless-stopped",
-		ports: [`${options.https}:443`, `${options.http}:80`],
-		volumes: [
-			"./Caddyfile:/etc/caddy/Caddyfile:ro",
-			"caddy-data:/data",
-			"caddy-config:/config",
-			...options.tls ? [`./tls:${CADDY_TLS_DIR}:ro`] : []
-		],
-		depends_on: Object.fromEntries(apps.map((app) => [app.name, HEALTHY])),
-		healthcheck: {
-			test: [
-				"CMD",
-				"caddy",
-				"version"
-			],
-			interval: "10s",
-			timeout: "5s",
-			retries: 5
-		}
-	};
-	for (const [service, alias] of options.edge) {
-		const definition = services[service];
-		if (!definition) continue;
-		definition.networks = {
-			default: { aliases: [alias] },
-			edge: { aliases: [alias] }
-		};
-	}
-	for (const service of Object.values(services)) {
-		if (!options.envFiles) delete service.env_file;
-		service.logging = {
-			driver: LOG_ROTATION.driver,
-			options: { ...LOG_ROTATION.options }
-		};
-	}
-	return {
-		name: project,
-		services,
-		volumes,
-		...options.edge.size > 0 ? { networks: { edge: {
-			name: EDGE_NETWORK,
-			external: true
-		} } } : {}
-	};
-}
-/**
-* A build without a layout: the workspace is the build root, with pnpm.
-* What a caller that never looked at the filesystem gets.
-*/
-function defaultLayout(root) {
-	return {
-		buildRoot: root,
-		gkmRoot: ".",
-		tools: {
-			packageManager: "pnpm",
-			turboVersion: TURBO_VERSION,
-			monorepo: true
-		},
-		gkmPaths: ["gkm.config.*"]
-	};
-}
-/** Render an app's env file: one `KEY=value` per line, read raw by compose. */
-function envFile(env) {
-	return `${Object.entries(env).sort(([a], [b]) => a.localeCompare(b)).map(([key, value]) => `${key}=${value}`).join("\n")}\n`;
-}
-//#endregion
-export { edgeComposeFile as _, composeStack as a, stack_exports as c, parseDigests as d, pinImages as f, EDGE_SERVICE as g, EDGE_PROJECT as h, composeProject as i, RegistryRequired as l, EDGE_NETWORK as m, LOGS_PORT_ENV as n, envFile as o, pinnedRef as p, LOG_ROTATION as r, stackDir as s, EDGE_PORT_ENV as t, assertImagesExist as u, traefikStaticFile as v };
-
-//# sourceMappingURL=stack-A6MAFZ6u.mjs.map