@geekmidas/cli 10.0.0-alpha.10 → 10.0.0-alpha.12

package/dist/index.mjs

@@ -1,25 +1,26 @@
 #!/usr/bin/env -S npx tsx
 import { __require } from "./chunk-Duj1WY3L.mjs";
-import { ConstructGenerator, DEFAULT_CACHE, discover, isPartitionedRoutes } from "./discover-CAlFgYec.mjs";
-import { derivedApps, getAppNameFromCwd, loadAppConfig, loadConfig, loadWorkspaceConfig, parseModuleConfig } from "./config-DVVph9yz.mjs";
-import { allConstructGlobs, assertDeployedStage, deployedProblems, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getPublicEnvPrefix, isDeployTargetSupported, stageProblems, stripPublicPrefix } from "./workspace-zoqRbihZ.mjs";
+import { ConstructGenerator, DEFAULT_CACHE, DEFAULT_EMAIL, discover, isPartitionedRoutes } from "./discover-BYHQwQqu.mjs";
+import { derivedApps, getAppNameFromCwd, loadAppConfig, loadConfig, loadWorkspaceConfig, parseModuleConfig } from "./config-DTsVjKZD.mjs";
+import { InvalidStages, allConstructGlobs, assertDeployedStage, deployedProblems, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getPublicEnvPrefix, isDeployTargetSupported, stageProblems, stripPublicPrefix } from "./workspace-CtnZnWsa.mjs";
 import { getCredentialsPath, getDokployCredentials, getDokployRegistryId, getDokployToken, removeDokployCredentials, storeDokployCredentials, storeDokployRegistryId, storeHostingerToken } from "./credentials-B5zRHdAl.mjs";
-import { applyPostgres, cacheBackendOf, constructGlobs, createCredentialsPreload, createEntryWrapper, derivedContainers, emailBackendOf, findAvailablePort, isPortAvailable, loadEnvFiles, loadSecretsForApp, prepareEntryCredentials, providerOf, reconcileWorkspace, resolveServicePorts, resourceName, rewriteUrlsWithPorts, startWorkspaceServices, storageBackendOf, usesConstructs } from "./credentials-dP8vRVRv.mjs";
+import { COMPOSE_PATH, applyPostgres, cacheBackendFor, constructGlobs, createCredentialsPreload, createEntryWrapper, eventsBackendFor, findAvailablePort, isPortAvailable, loadEnvFiles, loadSecretsForApp, prepareEntryCredentials, providerOf, reconcileWorkspace, resolveServicePorts, resourceName, rewriteUrlsWithPorts, startWorkspaceServices, storageBackendFor, usesConstructs } from "./credentials-jMJC63qs.mjs";
 import { createStageSecrets, rotateServicePassword } from "./generator-VE2JrFlY.mjs";
-import { getKeyPath, maskPassword, readStageSecrets, secretsExist, setCustomSecret, toEmbeddableSecrets, writeStageSecrets } from "./storage-Bi24WfoW.mjs";
-import { EndpointGenerator, OPENAPI_OUTPUT_PATH, generateOpenApi, generateOpenApiFrom, normalizeRoutes, openapiCommand, resolveOpenApiConfig, runtimeFor } from "./openapi-Xx0A7Wg0.mjs";
-import { withCompute, withRoutes } from "./emit-CiZS_5Ub.mjs";
-import { DokployApi } from "./dokploy-api-aTFPz7_4.mjs";
-import { encryptSecrets } from "./encryption-D-abyhZx.mjs";
-import { CachedStateProvider } from "./CachedStateProvider-DTniehMP.mjs";
-import { generateDbPassword, generateDbUrl, generateFullstackCustomSecrets } from "./fullstack-secrets-D1o9-G5l.mjs";
+import { getKeyPath } from "./keystore-TxeYM7an.mjs";
+import { maskPassword, readStageSecrets, secretsExist, setCustomSecret, toEmbeddableSecrets, writeStageSecrets } from "./storage-B020InPW.mjs";
+import { EndpointGenerator, OPENAPI_OUTPUT_PATH, generateOpenApi, generateOpenApiFrom, normalizeRoutes, openapiCommand, resolveOpenApiConfig, runtimeFor } from "./openapi-Bs3-5q_r.mjs";
+import { withCompute, withRoutes } from "./emit-CIlvnDvV.mjs";
+import { DokployApi } from "./dokploy-api-pdaBryoY.mjs";
+import { encryptSecrets } from "./encryption-_4zwjOAR.mjs";
+import { CachedStateProvider } from "./CachedStateProvider-Co4n5Wvs.mjs";
 import { generateReactQueryCommand } from "./openapi-react-query-Byltvm_7.mjs";
-import "./sync-CmEuNZsB.mjs";
-import { setupCommand, trustCommand } from "./setup-C8KOx8_8.mjs";
+import { generateFullstackCustomSecrets } from "./fullstack-secrets-B6KBHf-g.mjs";
+import "./sync-CzHXiR9c.mjs";
+import { setupCommand, trustCommand } from "./setup-D5-JMknk.mjs";
 import { createRequire } from "node:module";
 import { copyFileSync, existsSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve } from "node:path";
-import { DEFAULT_POSTGRES_VERSION, cacheTable, canonicalId, cloudName, cookieDomain, dependentsOf, provideKey, provisionOrder, scopedName, serviceKey } from "@geekmidas/manifest";
+import { cacheTable, canonicalId, cloudName, cookieDomain, dependentsOf, provideKey, provisionOrder, scopedName, serviceKey } from "@geekmidas/manifest";
 import fg from "fast-glob";
 import { Command } from "commander";
 import { stdin, stdout } from "node:process";
@@ -28,9 +29,9 @@ import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { execSync, spawn } from "node:child_process";
 import chokidar from "chokidar";
 import { parse as parse$1, parseDocument } from "yaml";
-import { Client } from "pg";
 import { createHash, randomBytes } from "node:crypto";
 import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
+import { Client } from "pg";
 import { cacheTableStatements } from "@geekmidas/cache/postgres";
 import { Cron } from "@geekmidas/constructs/crons";
 import { Function } from "@geekmidas/constructs/functions";
@@ -43,7 +44,7 @@ import prompts from "prompts";
 
 //#region package.json
 var name = "@geekmidas/cli";
-var version = "10.0.0-alpha.10";
+var version = "10.0.0-alpha.12";
 var description = "CLI tools for building Lambda handlers, server applications, and generating OpenAPI specs";
 var private$1 = false;
 var type = "module";
@@ -188,7 +189,7 @@ const logger$11 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi: DokployApi$1 } = await import("./dokploy-api-BS2xnJLZ.mjs");
+	const { DokployApi: DokployApi$1 } = await import("./dokploy-api-D2Ny4Jrc.mjs");
 	const api = new DokployApi$1({
 		baseUrl: endpoint,
 		token
@@ -1848,7 +1849,7 @@ async function buildServer(config, context, provider, enableOpenApi, appRoot = p
 		...context,
 		storageDrivers: driversFor({
 			appRoot,
-			cache: cacheBackendsIn(await declaredConstructs(config, appRoot), cacheBackendOf(config?.services?.cache))
+			cache: cacheBackendsIn(await declaredConstructs(config, appRoot), cacheBackendFor(providerOf(config ?? {})))
 		})
 	};
 	const endpointGenerator = new EndpointGenerator();
@@ -2458,8 +2459,8 @@ function rootGkmConfig(workspace) {
 	const only = backends.length === 1 ? backends[0] : void 0;
 	const own = only ? getAppGkmConfig(workspace, only[0]) : void 0;
 	return own ?? {
-		services: workspace.services,
 		stages: workspace.stages,
+		...workspace.deploy ? { deploy: workspace.deploy } : {},
 		constructs: allConstructGlobs(workspace)
 	};
 }
@@ -2477,8 +2478,7 @@ async function buildCommand(options) {
 	}
 	const config = loadedConfig.type !== "workspace" ? await loadConfig() : resolve(process.cwd()) === resolve(loadedConfig.workspace.root) ? rootGkmConfig(loadedConfig.workspace) : (await loadAppConfig()).gkmConfig;
 	const resolved = resolveProviders(config, options);
-	const backendConfig = config.services ?? loadedConfig.workspace?.services;
-	const cacheBackend = cacheBackendOf(backendConfig?.cache);
+	const cacheBackend = cacheBackendFor(providerOf(loadedConfig.workspace));
 	const productionConfigFromGkm = getProductionConfigFromGkm(config);
 	const production = normalizeProductionConfig(options.production ?? false, productionConfigFromGkm);
 	if (production) logger$7.log(`🏭 Building for PRODUCTION`);
@@ -2490,16 +2490,6 @@ async function buildCommand(options) {
 	if (studio) logger$7.log(`🗄️  Studio enabled at ${studio.path}`);
 	const hooks = normalizeHooksConfig(config.hooks);
 	if (hooks) logger$7.log(`🪝 Server hooks enabled`);
-	const services = config.docker?.compose?.services;
-	const dockerServices = services ? Array.isArray(services) ? {
-		postgres: services.includes("postgres"),
-		redis: services.includes("redis"),
-		rabbitmq: services.includes("rabbitmq")
-	} : {
-		postgres: Boolean(services.postgres),
-		redis: Boolean(services.redis),
-		rabbitmq: Boolean(services.rabbitmq)
-	} : void 0;
 	const constructGlobs$1 = typeof config.constructs === "string" || Array.isArray(config.constructs) ? config.constructs : void 0;
 	const constructSources = {};
 	const declared = constructGlobs$1 ? await discover({
@@ -2544,10 +2534,9 @@ async function buildCommand(options) {
 		} : studio,
 		hooks,
 		production,
-		dockerServices,
 		constructGlobs: constructGlobs$1,
 		cacheBackend,
-		emailBackend: emailBackendOf(backendConfig?.mail),
+		emailBackend: DEFAULT_EMAIL,
 		storageDrivers: driversFor({
 			appRoot: process.cwd(),
 			cache: cacheBackendsIn(declared, cacheBackend)
@@ -2639,7 +2628,7 @@ async function buildForProvider(provider, context, rootOutputDir, endpointGenera
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$7.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await import("./bundler-Be8Zg4Wd.mjs");
+			const { bundleServer } = await import("./bundler-Bux2iF-v.mjs");
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -2647,7 +2636,6 @@ async function buildForProvider(provider, context, rootOutputDir, endpointGenera
 				...subscribers.map((s) => s.construct),
 				...queues.map((q) => q.construct)
 			];
-			const dockerServices = context.dockerServices;
 			const bundleResult = await bundleServer({
 				entryPoint: join(outputDir, "server.ts"),
 				outputDir: join(outputDir, "dist"),
@@ -2655,8 +2643,7 @@ async function buildForProvider(provider, context, rootOutputDir, endpointGenera
 				sourcemap: false,
 				external: context.production.external,
 				stage,
-				constructs: allConstructs,
-				dockerServices
+				constructs: allConstructs
 			});
 			masterKey = bundleResult.masterKey;
 			logger$7.log(`✅ Bundle complete: .gkm/server/dist/server.mjs`);
@@ -2733,71 +2720,6 @@ function turboFilters(workspace) {
 	};
 }
 /**
-* The directory turbo treats as the repo root: the nearest ancestor with a
-* `turbo.json`. Its own path is what `$TURBO_ROOT$` resolves to.
-*/
-function turboRoot(from) {
-	let dir = resolve(from);
-	for (;;) {
-		if (existsSync(join(dir, "turbo.json"))) return dir;
-		const parent = dirname(dir);
-		if (parent === dir) return void 0;
-		dir = parent;
-	}
-}
-/**
-* Write each app's turbo task config, so a construct edit invalidates the build
-* that read it.
-*
-* Turbo hashes a package's own files. An app's constructs live *above* it, in
-* the workspace that declares them for everybody — so without this, editing a
-* database or a surface leaves every cached app build in place and the apps
-* keep serving a graph that no longer exists. It is a silent wrong answer,
-* which is the worst kind: the build succeeds and the output is stale.
-*
-* Generated rather than documented because the globs are already known here and
-* a hand-written copy is one more list to keep in step — the same reason the
-* apps themselves are no longer written down. A file that someone has since
-* edited by hand is left alone.
-*/
-async function writeTurboConfigs(workspace) {
-	const root = turboRoot(workspace.root);
-	if (!root) return;
-	const globs = allConstructGlobs(workspace).map((glob) => `$TURBO_ROOT$/${relative(root, glob)}`);
-	if (globs.length === 0) return;
-	const configPath = join(workspace.root, "gkm.config.ts");
-	const inputs = [
-		"$TURBO_DEFAULT$",
-		...globs,
-		...existsSync(configPath) ? [`$TURBO_ROOT$/${relative(root, configPath)}`] : []
-	];
-	for (const app of Object.values(workspace.apps)) {
-		const dir = join(workspace.root, app.path);
-		if (!existsSync(join(dir, "package.json"))) continue;
-		const file = join(dir, "turbo.json");
-		const existing = existsSync(file) ? readFileSync(file, "utf8") : void 0;
-		if (existing && !existing.includes(GENERATED_BY_GKM)) continue;
-		const content = `{
-	"$schema": "https://turborepo.com/schema.json",
-	${GENERATED_BY_GKM}
-	"extends": ["//"],
-	"tasks": {
-		"build": {
-			"inputs": [
-${inputs.map((glob) => `\t\t\t\t${JSON.stringify(glob)}`).join(",\n")}
-			],
-			"outputs": [${app.type === "backend" ? "\".gkm/**\"" : "\"dist/**\", \".next/**\", \"!.next/cache/**\""}]
-		}
-	}
-}
-`;
-		if (existing === content) continue;
-		await writeFile(file, content);
-	}
-}
-/** Marks a turbo config as gkm's to rewrite. Edit the file and it is left alone. */
-const GENERATED_BY_GKM = "// Generated by `gkm build`. Delete this line to take ownership of the file.";
-/**
 * Build all apps in a workspace using Turbo for dependency-ordered parallel builds.
 * @internal Exported for testing
 */
@@ -2815,7 +2737,6 @@ async function workspaceBuildCommand(workspace, options) {
 	const pm = detectPackageManager$2();
 	logger$7.log(`\n📦 Using ${pm} with Turbo for parallel builds...\n`);
 	try {
-		await writeTurboConfigs(workspace);
 		const { filters, unpackaged } = turboFilters(workspace);
 		if (unpackaged.length > 0) throw new Error(`No package.json for workspace app(s): ${unpackaged.join(", ")}. Each app needs one — turbo builds packages, and gkm reads the name back to know which app it is building.`);
 		const turboCommand = getTurboCommand(pm, filters);
@@ -3308,16 +3229,16 @@ var UnresolvedParent = class extends Error {
 /** A cache with nowhere to live. */
 var CacheNeedsAHome = class extends Error {
 	constructor(id, backend) {
-		super(`'${id}' is a cache and nothing says where it lives. Declare it from its database — \`orders.cache('${id}')\` — or set services.cache.` + (backend ? ` The configured backend is '${backend}'.` : ""));
+		super(`'${id}' is a cache and nothing says where it lives. Declare it from its database — \`orders.cache('${id}')\`.` + (backend ? ` The deploy target's backend is '${backend}'.` : ""));
 		this.id = id;
 		this.backend = backend;
 		this.name = "CacheNeedsAHome";
 	}
 };
-/** `services.cache: 'db'` in an app declaring more than one database. */
+/** A `'db'` cache (a server target's default) with more than one database. */
 var CacheIsAmbiguous = class extends Error {
 	constructor(databases) {
-		super(`A cache backed by the database needs to know which one, and this app declares ${databases.length}: ${databases.join(", ")}. Declare the cache from its database rather than with services.cache.`);
+		super(`A cache backed by the database needs to know which one, and this app declares ${databases.length}: ${databases.join(", ")}. Declare the cache from its database rather than as a bare new Cache().`);
 		this.databases = databases;
 		this.name = "CacheIsAmbiguous";
 	}
@@ -3333,7 +3254,7 @@ var SurfaceHasNoAddress = class extends Error {
 /** A queue or topic on a backend this target has no primitive for. */
 var UnprovisionableCarrier = class extends Error {
 	constructor(id, backend) {
-		super(`'${id}' is carried by '${backend}', which this target cannot provision. SNS needs a topic ARN that has to exist first and RabbitMQ needs a broker Dokploy has no primitive for; pg-boss is a schema tenant of a database this app already declares, which is why it is the one that works here. Set services.events to 'pgboss', or deploy this app to a target that has the backend.`);
+		super(`'${id}' is carried by '${backend}', which this target cannot provision. SNS needs a topic ARN that has to exist first and RabbitMQ needs a broker Dokploy has no primitive for; pg-boss is a schema tenant of a database this app already declares, which is why it is the one that works here. Deploy this app to a target that has the backend.`);
 		this.id = id;
 		this.backend = backend;
 		this.name = "UnprovisionableCarrier";
@@ -3342,7 +3263,7 @@ var UnprovisionableCarrier = class extends Error {
 /** A pg-boss carrier in an app that declares no database to host it. */
 var BrokerNeedsADatabase = class extends Error {
 	constructor(id) {
-		super(`'${id}' is carried by pg-boss, which lives in the database the app declares — and this app declares none. Declare a database, or set services.events to a backend that brings its own broker.`);
+		super(`'${id}' is carried by pg-boss, which lives in the database the app declares — and this app declares none. Declare a database, or deploy to a target whose broker is its own.`);
 		this.id = id;
 		this.name = "BrokerNeedsADatabase";
 	}
@@ -3350,7 +3271,7 @@ var BrokerNeedsADatabase = class extends Error {
 /** A bucket on a backend this target has no primitive for. */
 var UnprovisionableBucket = class extends Error {
 	constructor(id, backend) {
-		super(`'${id}' is stored on '${backend}', which this target cannot provision: an S3 or R2 bucket belongs to an account this deploy does not hold, the way an API key does. Set services.storage to 'minio' to run one on the box, or supply the bucket's URL.`);
+		super(`'${id}' is stored on '${backend}', which this target cannot provision: an S3 or R2 bucket belongs to an account this deploy does not hold, the way an API key does. Supply the bucket's URL.`);
 		this.id = id;
 		this.backend = backend;
 		this.name = "UnprovisionableBucket";
@@ -3388,9 +3309,9 @@ async function provisionDeclared(options) {
 		environmentId: options.environmentId,
 		stage: options.stage,
 		project: workspace.name,
-		cache: cacheBackendOf(workspace.services.cache, providerOf(workspace)),
-		...workspace.services.events ? { events: workspace.services.events } : {},
-		storage: storageBackendOf(workspace.services.storage, providerOf(workspace)),
+		cache: cacheBackendFor(providerOf(workspace)),
+		events: eventsBackendFor(providerOf(workspace)),
+		storage: storageBackendFor(providerOf(workspace)),
 		addresses: surfaceAddresses(workspace, manifest, options.appUrls),
 		...options.secrets ? { secrets: options.secrets } : {},
 		deferred: [],
@@ -3592,11 +3513,11 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await import("./HostingerProvider-Cft7lEYr.mjs");
+		const { HostingerProvider } = await import("./HostingerProvider-BcyFRbqV.mjs");
 		return new HostingerProvider();
 	}
 	if (provider === "route53") {
-		const { Route53Provider } = await import("./Route53Provider-RdpUDJQk.mjs");
+		const { Route53Provider } = await import("./Route53Provider-C0xmer8U.mjs");
 		const route53Config = config;
 		return new Route53Provider({
 			region: route53Config.region,
@@ -4029,563 +3950,6 @@ function getPublicUrlArgNames(app) {
 	return app.dependencies.map((dep) => `${prefix}${dep.toUpperCase()}_URL`);
 }
 
-//#endregion
-//#region src/docker/compose.ts
-/** Default Docker images for services */
-const DEFAULT_SERVICE_IMAGES = {
-	postgres: "postgres",
-	redis: "redis",
-	rabbitmq: "rabbitmq",
-	minio: "pgsty/minio",
-	mailpit: "axllent/mailpit",
-	localstack: "floci/floci"
-};
-/** Default Docker image versions for services */
-const DEFAULT_SERVICE_VERSIONS = {
-	postgres: `${DEFAULT_POSTGRES_VERSION}-alpine`,
-	redis: "7-alpine",
-	rabbitmq: "3-management-alpine",
-	minio: "RELEASE.2026-08-04T00-00-00Z",
-	mailpit: "latest",
-	localstack: "latest"
-};
-/** Get the default full image reference for a service */
-function getDefaultImage(serviceName$1) {
-	return `${DEFAULT_SERVICE_IMAGES[serviceName$1]}:${DEFAULT_SERVICE_VERSIONS[serviceName$1]}`;
-}
-/** Normalize services config to a consistent format - returns Map of service name to full image reference */
-function normalizeServices(services) {
-	const result = /* @__PURE__ */ new Map();
-	if (Array.isArray(services)) for (const name$1 of services) result.set(name$1, getDefaultImage(name$1));
-	else for (const [name$1, config] of Object.entries(services)) {
-		const serviceName$1 = name$1;
-		if (config === true) result.set(serviceName$1, getDefaultImage(serviceName$1));
-		else if (config && typeof config === "object") {
-			const serviceConfig = config;
-			if (serviceConfig.image) result.set(serviceName$1, serviceConfig.image);
-			else {
-				const version$1 = serviceConfig.version ?? DEFAULT_SERVICE_VERSIONS[serviceName$1];
-				result.set(serviceName$1, `${DEFAULT_SERVICE_IMAGES[serviceName$1]}:${version$1}`);
-			}
-		}
-	}
-	return result;
-}
-/**
-* Generate docker-compose.yml for production deployment
-*/
-function generateDockerCompose(options) {
-	const { imageName, registry, port, healthCheckPath, services } = options;
-	const serviceMap = normalizeServices(services);
-	const imageRef = registry ? `\${REGISTRY:-${registry}}/` : "";
-	let yaml = `# Use "gkm dev" or "gkm test" to start services.
-# Running "docker compose up" directly will not inject secrets or resolve ports.
-version: '3.8'
-
-services:
-  api:
-    build:
-      context: ../..
-      dockerfile: .gkm/docker/Dockerfile
-    image: ${imageRef}\${IMAGE_NAME:-${imageName}}:\${TAG:-latest}
-    container_name: ${imageName}
-    restart: unless-stopped
-    ports:
-      - "\${PORT:-${port}}:${port}"
-    environment:
-      - NODE_ENV=production
-`;
-	if (serviceMap.has("postgres")) yaml += `      - DATABASE_URL=\${DATABASE_URL:-postgresql://\${POSTGRES_USER:-postgres}:\${POSTGRES_PASSWORD:-postgres}@postgres:5432/\${POSTGRES_DB:-app}}
-`;
-	if (serviceMap.has("redis")) yaml += `      - REDIS_URL=\${REDIS_URL:-redis://redis:6379}
-`;
-	if (serviceMap.has("rabbitmq")) yaml += `      - RABBITMQ_URL=\${RABBITMQ_URL:-amqp://rabbitmq:5672}
-`;
-	if (serviceMap.has("minio")) yaml += `      - STORAGE_ENDPOINT=\${STORAGE_ENDPOINT:-http://minio:9000}
-      - STORAGE_ACCESS_KEY_ID=\${STORAGE_ACCESS_KEY_ID:-${imageName}}
-      - STORAGE_SECRET_ACCESS_KEY=\${STORAGE_SECRET_ACCESS_KEY:-${imageName}}
-      - STORAGE_BUCKET=\${STORAGE_BUCKET:-${imageName}}
-      - STORAGE_REGION=\${STORAGE_REGION:-eu-west-1}
-      - STORAGE_FORCE_PATH_STYLE=true
-`;
-	if (serviceMap.has("mailpit")) yaml += `      - SMTP_HOST=\${SMTP_HOST:-mailpit}
-      - SMTP_PORT=\${SMTP_PORT:-1025}
-      - SMTP_USER=\${SMTP_USER:-${imageName}}
-      - SMTP_PASS=\${SMTP_PASS:-${imageName}}
-      - SMTP_SECURE=\${SMTP_SECURE:-false}
-      - MAIL_FROM=\${MAIL_FROM:-noreply@localhost}
-`;
-	if (serviceMap.has("localstack")) yaml += `      - AWS_ACCESS_KEY_ID=\${AWS_ACCESS_KEY_ID:-localstack}
-      - AWS_SECRET_ACCESS_KEY=\${AWS_SECRET_ACCESS_KEY:-localstack}
-      - AWS_REGION=\${AWS_REGION:-us-east-1}
-      - AWS_ENDPOINT_URL=\${AWS_ENDPOINT_URL:-http://localstack:4566}
-`;
-	yaml += `    healthcheck:
-      test: ["CMD", "wget", "-q", "--spider", "http://localhost:${port}${healthCheckPath}"]
-      interval: 30s
-      timeout: 3s
-      retries: 3
-`;
-	if (serviceMap.size > 0) {
-		yaml += `    depends_on:
-`;
-		for (const serviceName$1 of serviceMap.keys()) yaml += `      ${serviceName$1}:
-        condition: service_healthy
-`;
-	}
-	yaml += `    networks:
-      - app-network
-`;
-	const postgresImage = serviceMap.get("postgres");
-	if (postgresImage) yaml += `
-  postgres:
-    image: ${postgresImage}
-    container_name: postgres
-    restart: unless-stopped
-    environment:
-      POSTGRES_USER: \${POSTGRES_USER:-postgres}
-      POSTGRES_PASSWORD: \${POSTGRES_PASSWORD:-postgres}
-      POSTGRES_DB: \${POSTGRES_DB:-app}
-    volumes:
-      - dbdata:/var/lib/postgresql
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER"]
-      interval: 5s
-      timeout: 5s
-      retries: 5
-    networks:
-      - app-network
-`;
-	const redisImage = serviceMap.get("redis");
-	if (redisImage) yaml += `
-  redis:
-    image: ${redisImage}
-    container_name: redis
-    restart: unless-stopped
-    volumes:
-      - redis_data:/data
-    healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
-      interval: 5s
-      timeout: 5s
-      retries: 5
-    networks:
-      - app-network
-`;
-	const rabbitmqImage = serviceMap.get("rabbitmq");
-	if (rabbitmqImage) yaml += `
-  rabbitmq:
-    image: ${rabbitmqImage}
-    container_name: rabbitmq
-    restart: unless-stopped
-    environment:
-      RABBITMQ_DEFAULT_USER: \${RABBITMQ_USER:-guest}
-      RABBITMQ_DEFAULT_PASS: \${RABBITMQ_PASSWORD:-guest}
-    ports:
-      - "15672:15672"  # Management UI
-    volumes:
-      - rabbitmq_data:/var/lib/rabbitmq
-    healthcheck:
-      test: ["CMD", "rabbitmq-diagnostics", "-q", "ping"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-    networks:
-      - app-network
-`;
-	const minioImage = serviceMap.get("minio");
-	if (minioImage) yaml += `
-  minio:
-    image: ${minioImage}
-    container_name: minio
-    restart: unless-stopped
-    entrypoint: sh
-    command: -c 'mkdir -p /data/\${STORAGE_BUCKET:-${imageName}} && /usr/bin/docker-entrypoint.sh server --console-address ":9001" /data'
-    environment:
-      MINIO_ROOT_USER: \${STORAGE_ACCESS_KEY_ID:-${imageName}}
-      MINIO_ROOT_PASSWORD: \${STORAGE_SECRET_ACCESS_KEY:-${imageName}}
-    ports:
-      - "\${MINIO_API_PORT:-9000}:9000"
-      - "\${MINIO_CONSOLE_PORT:-9001}:9001"
-    volumes:
-      - minio_data:/data
-    healthcheck:
-      test: ["CMD", "mc", "ready", "local"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-    networks:
-      - app-network
-`;
-	const mailpitImage = serviceMap.get("mailpit");
-	if (mailpitImage) yaml += `
-  mailpit:
-    image: ${mailpitImage}
-    container_name: mailpit
-    restart: unless-stopped
-    environment:
-      MP_SMTP_AUTH: \${SMTP_USER:-${imageName}}:\${SMTP_PASS:-${imageName}}
-      MP_SMTP_AUTH_ALLOW_INSECURE: true
-    ports:
-      - "\${MAILPIT_PORT:-8025}:8025"  # Web UI / API
-      - "\${SMTP_PORT:-1025}:1025"  # SMTP
-    healthcheck:
-      test: ["CMD", "wget", "-q", "--spider", "http://localhost:8025"]
-      interval: 5s
-      timeout: 5s
-      retries: 5
-    networks:
-      - app-network
-`;
-	const localstackImage = serviceMap.get("localstack");
-	if (localstackImage) yaml += `
-  localstack:
-    image: ${localstackImage}
-    container_name: localstack
-    restart: unless-stopped
-    environment:
-      AWS_DEFAULT_REGION: \${AWS_REGION:-us-east-1}
-      AWS_ACCESS_KEY_ID: \${AWS_ACCESS_KEY_ID:-localstack}
-      AWS_SECRET_ACCESS_KEY: \${AWS_SECRET_ACCESS_KEY:-localstack}
-    ports:
-      - "\${LOCALSTACK_PORT:-4566}:4566"
-    volumes:
-      - localstack_data:/var/lib/localstack
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:4566/_localstack/health"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-    networks:
-      - app-network
-`;
-	yaml += `
-volumes:
-`;
-	if (serviceMap.has("postgres")) yaml += `  dbdata:
-`;
-	if (serviceMap.has("redis")) yaml += `  redis_data:
-`;
-	if (serviceMap.has("rabbitmq")) yaml += `  rabbitmq_data:
-`;
-	if (serviceMap.has("minio")) yaml += `  minio_data:
-`;
-	if (serviceMap.has("localstack")) yaml += `  localstack_data:
-`;
-	yaml += `
-networks:
-  app-network:
-    driver: bridge
-`;
-	return yaml;
-}
-/**
-* Generate a minimal docker-compose.yml for API only
-*/
-function generateMinimalDockerCompose(options) {
-	const { imageName, registry, port, healthCheckPath } = options;
-	const imageRef = registry ? `\${REGISTRY:-${registry}}/` : "";
-	return `# Use "gkm dev" or "gkm test" to start services.
-# Running "docker compose up" directly will not inject secrets or resolve ports.
-version: '3.8'
-
-services:
-  api:
-    build:
-      context: ../..
-      dockerfile: .gkm/docker/Dockerfile
-    image: ${imageRef}\${IMAGE_NAME:-${imageName}}:\${TAG:-latest}
-    container_name: ${imageName}
-    restart: unless-stopped
-    ports:
-      - "\${PORT:-${port}}:${port}"
-    environment:
-      - NODE_ENV=production
-    healthcheck:
-      test: ["CMD", "wget", "-q", "--spider", "http://localhost:${port}${healthCheckPath}"]
-      interval: 30s
-      timeout: 3s
-      retries: 3
-    networks:
-      - app-network
-
-networks:
-  app-network:
-    driver: bridge
-`;
-}
-/**
-* Generate docker-compose.yml for a workspace with all apps as services.
-* Apps can communicate with each other via service names.
-* @internal Exported for testing
-*/
-function generateWorkspaceCompose(workspace, options = {}) {
-	const { registry } = options;
-	const apps = Object.entries(workspace.apps);
-	const services = workspace.services;
-	const containers = new Set(options.containers ?? []);
-	const hasPostgres = containers.has("postgres");
-	const hasRedis = containers.has("redis") || containers.has("redis-http");
-	const hasMail = containers.has("mailpit");
-	const hasMinio = containers.has("minio");
-	const hasLocalStack = containers.has("localstack");
-	const hasRabbitMQ = containers.has("rabbitmq");
-	const eventsBackend = services.events;
-	const postgresImage = getInfraServiceImage("postgres", services.images?.postgres);
-	const redisImage = getInfraServiceImage("redis", services.images?.redis);
-	const minioImage = getInfraServiceImage("minio", services.images?.minio);
-	let yaml = `# Docker Compose for ${workspace.name} workspace
-# Use "gkm dev" or "gkm test" to start services.
-# Running "docker compose up" directly will not inject secrets or resolve ports.
-
-services:
-`;
-	for (const [appName, app] of apps) {
-		if (app.type === "mobile") continue;
-		yaml += generateAppService(appName, app, apps, {
-			registry,
-			projectName: workspace.name,
-			hasPostgres,
-			hasRedis,
-			hasMinio,
-			hasMail,
-			eventsBackend
-		});
-	}
-	if (hasPostgres) yaml += `
-  postgres:
-    image: ${postgresImage}
-    container_name: ${workspace.name}-postgres
-    restart: unless-stopped
-    environment:
-      POSTGRES_USER: \${POSTGRES_USER:-postgres}
-      POSTGRES_PASSWORD: \${POSTGRES_PASSWORD:-postgres}
-      POSTGRES_DB: \${POSTGRES_DB:-app}
-    volumes:
-      - dbdata:/var/lib/postgresql
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER"]
-      interval: 5s
-      timeout: 5s
-      retries: 5
-    networks:
-      - workspace-network
-`;
-	if (hasRedis) yaml += `
-  redis:
-    image: ${redisImage}
-    container_name: ${workspace.name}-redis
-    restart: unless-stopped
-    volumes:
-      - redis_data:/data
-    healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
-      interval: 5s
-      timeout: 5s
-      retries: 5
-    networks:
-      - workspace-network
-`;
-	if (hasMail) yaml += `
-  mailpit:
-    image: axllent/mailpit:latest
-    container_name: ${workspace.name}-mailpit
-    restart: unless-stopped
-    environment:
-      MP_SMTP_AUTH: \${SMTP_USER:-${workspace.name}}:\${SMTP_PASS:-${workspace.name}}
-      MP_SMTP_AUTH_ALLOW_INSECURE: true
-    ports:
-      - "\${MAILPIT_PORT:-8025}:8025"  # Web UI / API
-      - "\${SMTP_PORT:-1025}:1025"  # SMTP
-    healthcheck:
-      test: ["CMD", "wget", "-q", "--spider", "http://localhost:8025"]
-      interval: 5s
-      timeout: 5s
-      retries: 5
-    networks:
-      - workspace-network
-`;
-	if (hasMinio) yaml += `
-  minio:
-    image: ${minioImage}
-    container_name: ${workspace.name}-minio
-    restart: unless-stopped
-    entrypoint: sh
-    command: -c 'mkdir -p /data/\${STORAGE_BUCKET:-${workspace.name}} && /usr/bin/docker-entrypoint.sh server --console-address ":9001" /data'
-    environment:
-      MINIO_ROOT_USER: \${STORAGE_ACCESS_KEY_ID:-${workspace.name}}
-      MINIO_ROOT_PASSWORD: \${STORAGE_SECRET_ACCESS_KEY:-${workspace.name}}
-    ports:
-      - "\${MINIO_API_PORT:-9000}:9000"
-      - "\${MINIO_CONSOLE_PORT:-9001}:9001"
-    volumes:
-      - minio_data:/data
-    healthcheck:
-      test: ["CMD", "mc", "ready", "local"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-    networks:
-      - workspace-network
-`;
-	if (hasLocalStack) yaml += `
-  localstack:
-    image: floci/floci:latest
-    container_name: ${workspace.name}-localstack
-    restart: unless-stopped
-    environment:
-      AWS_DEFAULT_REGION: \${AWS_REGION:-us-east-1}
-      AWS_ACCESS_KEY_ID: \${AWS_ACCESS_KEY_ID:-localstack}
-      AWS_SECRET_ACCESS_KEY: \${AWS_SECRET_ACCESS_KEY:-localstack}
-    ports:
-      - "\${LOCALSTACK_PORT:-4566}:4566"
-    volumes:
-      - localstack_data:/var/lib/localstack
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:4566/_localstack/health"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-    networks:
-      - workspace-network
-`;
-	if (hasRabbitMQ) yaml += `
-  rabbitmq:
-    image: rabbitmq:3-management-alpine
-    container_name: ${workspace.name}-rabbitmq
-    restart: unless-stopped
-    environment:
-      RABBITMQ_DEFAULT_USER: \${RABBITMQ_USER:-guest}
-      RABBITMQ_DEFAULT_PASS: \${RABBITMQ_PASSWORD:-guest}
-    ports:
-      - "\${RABBITMQ_HOST_PORT:-5672}:5672"
-      - "\${RABBITMQ_MGMT_HOST_PORT:-15672}:15672"
-    volumes:
-      - rabbitmq_data:/var/lib/rabbitmq
-    healthcheck:
-      test: ["CMD", "rabbitmq-diagnostics", "-q", "ping"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-    networks:
-      - workspace-network
-`;
-	yaml += `
-volumes:
-`;
-	if (hasPostgres) yaml += `  dbdata:
-`;
-	if (hasRedis) yaml += `  redis_data:
-`;
-	if (hasMinio) yaml += `  minio_data:
-`;
-	if (hasLocalStack) yaml += `  localstack_data:
-`;
-	if (hasRabbitMQ) yaml += `  rabbitmq_data:
-`;
-	yaml += `
-networks:
-  workspace-network:
-    driver: bridge
-`;
-	return yaml;
-}
-/**
-* Get infrastructure service image with version.
-*/
-function getInfraServiceImage(serviceName$1, pin) {
-	const defaults = {
-		postgres: "postgres:18-alpine",
-		redis: "redis:7-alpine",
-		minio: "pgsty/minio:RELEASE.2026-08-04T00-00-00Z"
-	};
-	return pin || defaults[serviceName$1];
-}
-/**
-* Generate a service definition for an app.
-*/
-function generateAppService(appName, app, allApps, options) {
-	const { registry, projectName, hasPostgres, hasRedis, hasMinio, hasMail, eventsBackend } = options;
-	const imageRef = registry ? `\${REGISTRY:-${registry}}/` : "";
-	const healthCheckPath = app.type === "web" ? "/" : "/health";
-	const healthCheckCmd = app.type === "web" ? `["CMD", "wget", "-q", "--spider", "http://localhost:${app.port}/"]` : `["CMD", "wget", "-q", "--spider", "http://localhost:${app.port}${healthCheckPath}"]`;
-	let yaml = `
-  ${appName}:
-    build:
-      context: .
-      dockerfile: .gkm/docker/Dockerfile.${appName}
-    image: ${imageRef}\${${appName.toUpperCase()}_IMAGE:-${appName}}:\${TAG:-latest}
-    container_name: ${appName}
-    restart: unless-stopped
-    ports:
-      - "\${${appName.toUpperCase()}_PORT:-${app.port}}:${app.port}"
-    environment:
-      - NODE_ENV=production
-      - PORT=${app.port}
-`;
-	for (const dep of app.dependencies) {
-		const depApp = allApps.find(([name$1]) => name$1 === dep)?.[1];
-		if (depApp) yaml += `      - ${dep.toUpperCase()}_URL=http://${dep}:${depApp.port}
-`;
-	}
-	if (app.type === "backend") {
-		if (hasPostgres) yaml += `      - DATABASE_URL=\${DATABASE_URL:-postgresql://\${POSTGRES_USER:-postgres}:\${POSTGRES_PASSWORD:-postgres}@postgres:5432/\${POSTGRES_DB:-app}}
-`;
-		if (hasRedis) yaml += `      - REDIS_URL=\${REDIS_URL:-redis://redis:6379}
-`;
-		if (hasMinio) yaml += `      - STORAGE_ENDPOINT=\${STORAGE_ENDPOINT:-http://minio:9000}
-      - STORAGE_ACCESS_KEY_ID=\${STORAGE_ACCESS_KEY_ID:-${projectName}}
-      - STORAGE_SECRET_ACCESS_KEY=\${STORAGE_SECRET_ACCESS_KEY:-${projectName}}
-      - STORAGE_BUCKET=\${STORAGE_BUCKET:-${projectName}}
-      - STORAGE_REGION=\${STORAGE_REGION:-eu-west-1}
-      - STORAGE_FORCE_PATH_STYLE=true
-`;
-		if (hasMail) yaml += `      - SMTP_HOST=\${SMTP_HOST:-mailpit}
-      - SMTP_PORT=\${SMTP_PORT:-1025}
-      - SMTP_USER=\${SMTP_USER:-${projectName}}
-      - SMTP_PASS=\${SMTP_PASS:-${projectName}}
-      - SMTP_SECURE=\${SMTP_SECURE:-false}
-      - MAIL_FROM=\${MAIL_FROM:-noreply@localhost}
-`;
-		if (eventsBackend) {
-			yaml += `      - EVENT_PUBLISHER_CONNECTION_STRING=\${EVENT_PUBLISHER_CONNECTION_STRING}
-      - EVENT_SUBSCRIBER_CONNECTION_STRING=\${EVENT_SUBSCRIBER_CONNECTION_STRING}
-`;
-			if (eventsBackend === "sns") yaml += `      - AWS_ACCESS_KEY_ID=\${AWS_ACCESS_KEY_ID:-localstack}
-      - AWS_SECRET_ACCESS_KEY=\${AWS_SECRET_ACCESS_KEY:-localstack}
-      - AWS_REGION=\${AWS_REGION:-us-east-1}
-      - AWS_ENDPOINT_URL=\${AWS_ENDPOINT_URL:-http://localstack:4566}
-`;
-		}
-	}
-	yaml += `    healthcheck:
-      test: ${healthCheckCmd}
-      interval: 30s
-      timeout: 3s
-      retries: 3
-`;
-	const dependencies$1 = [...app.dependencies];
-	if (app.type === "backend") {
-		if (hasPostgres) dependencies$1.push("postgres");
-		if (hasRedis) dependencies$1.push("redis");
-		if (hasMinio) dependencies$1.push("minio");
-		if (hasMail) dependencies$1.push("mailpit");
-		if (eventsBackend === "sns") dependencies$1.push("localstack");
-		if (eventsBackend === "rabbitmq") dependencies$1.push("rabbitmq");
-	}
-	if (dependencies$1.length > 0) {
-		yaml += `    depends_on:
-`;
-		for (const dep of dependencies$1) yaml += `      ${dep}:
-        condition: service_healthy
-`;
-	}
-	yaml += `    networks:
-      - workspace-network
-`;
-	return yaml;
-}
-
 //#endregion
 //#region src/docker/templates.ts
 const LOCKFILES = [
@@ -5016,8 +4380,7 @@ function resolveDockerConfig(config) {
 		registry: docker.registry ?? "",
 		imageName: docker.imageName ?? defaultImageName,
 		baseImage: docker.baseImage ?? "node:22-alpine",
-		port: docker.port ?? 3e3,
-		compose: docker.compose
+		port: docker.port ?? 3e3
 	};
 }
 /**
@@ -5459,7 +4822,7 @@ async function dockerCommand(options) {
 	const loadedConfig = await loadWorkspaceConfig();
 	if (loadedConfig.type === "workspace") {
 		logger$5.log("📦 Detected workspace configuration");
-		return workspaceDockerCommand(loadedConfig.workspace, options);
+		return workspaceDockerCommand(loadedConfig.workspace);
 	}
 	const config = await loadConfig();
 	const dockerConfig = resolveDockerConfig(config);
@@ -5504,18 +4867,7 @@ async function dockerCommand(options) {
 	const dockerfilePath = join(dockerDir, "Dockerfile");
 	await writeFile(dockerfilePath, dockerfile);
 	logger$5.log(`Generated: .gkm/docker/Dockerfile (${dockerMode}, ${packageManager})`);
-	const composeOptions = {
-		imageName: dockerConfig.imageName,
-		registry: options.registry ?? dockerConfig.registry,
-		port: dockerConfig.port,
-		healthCheckPath,
-		services: dockerConfig.compose?.services ?? {}
-	};
-	const hasServices = Array.isArray(composeOptions.services) ? composeOptions.services.length > 0 : Object.keys(composeOptions.services).length > 0;
-	const dockerCompose = hasServices ? generateDockerCompose(composeOptions) : generateMinimalDockerCompose(composeOptions);
-	const composePath = join(dockerDir, "docker-compose.yml");
-	await writeFile(composePath, dockerCompose);
-	logger$5.log("Generated: .gkm/docker/docker-compose.yml");
+	const composePath = await writeConstructsCompose(loadedConfig.workspace);
 	const dockerignore = generateDockerignore();
 	const dockerignorePath = join(process.cwd(), ".dockerignore");
 	await writeFile(dockerignorePath, dockerignore);
@@ -5620,7 +4972,7 @@ function getAppPackageName(appPath) {
 * Generate Dockerfiles for all apps in a workspace.
 * @internal Exported for testing
 */
-async function workspaceDockerCommand(workspace, options) {
+async function workspaceDockerCommand(workspace) {
 	const results = [];
 	const apps = Object.entries(workspace.apps);
 	logger$5.log(`\n🐳 Generating Dockerfiles for workspace: ${workspace.name}`);
@@ -5695,27 +5047,41 @@ async function workspaceDockerCommand(workspace, options) {
 	const dockerignorePath = join(workspace.root, ".dockerignore");
 	await writeFile(dockerignorePath, dockerignore);
 	logger$5.log(`\n   Generated: .dockerignore (workspace root)`);
-	const dockerCompose = generateWorkspaceCompose(workspace, {
-		registry: options.registry,
-		containers: await derivedContainers(workspace, workspace.stages.local)
-	});
-	const composePath = join(dockerDir, "docker-compose.yml");
-	await writeFile(composePath, dockerCompose);
-	logger$5.log(`   Generated: .gkm/docker/docker-compose.yml`);
-	logger$5.log(`\n✅ Generated ${results.length} Dockerfile(s) + docker-compose.yml`);
+	const composePath = await writeConstructsCompose(workspace);
+	logger$5.log(`\n✅ Generated ${results.length} Dockerfile(s) + ${COMPOSE_PATH}`);
 	logger$5.log("\n📋 Build commands:");
 	for (const result of results) {
 		const icon = result.type === "backend" ? "⚙️" : result.type === "mobile" ? "📱" : "🌐";
 		logger$5.log(`   ${icon} docker build -f .gkm/docker/Dockerfile.${result.appName} -t ${result.imageName} .`);
 	}
-	logger$5.log("\n📋 Run all services:");
-	logger$5.log("   docker compose -f .gkm/docker/docker-compose.yml up --build");
+	printRunInstructions(workspace);
 	return {
 		apps: results,
 		dockerCompose: composePath,
 		dockerignore: dockerignorePath
 	};
 }
+/**
+* Write `docker-compose.constructs.yml` — the same file `gkm dev` writes, with
+* the apps beside the containers their constructs derive.
+*
+* Through reconcile rather than a second generator, so what `gkm docker`
+* describes and what `gkm dev` runs cannot disagree. Nothing is started.
+*/
+async function writeConstructsCompose(workspace) {
+	await reconcileWorkspace(workspace, {
+		stage: workspace.stages.local,
+		start: false
+	});
+	logger$5.log(`   Generated: ${COMPOSE_PATH} (project root)`);
+	return join(workspace.root, COMPOSE_PATH);
+}
+function printRunInstructions(workspace) {
+	const project = existsSync(join(workspace.root, "docker-compose.yml")) ? " -f docker-compose.yml" : "";
+	logger$5.log("\n📋 Run everything (the apps sit behind the \"apps\" profile):");
+	logger$5.log("   gkm setup   # starts the containers and creates what they hold");
+	logger$5.log(`   docker compose -f ${COMPOSE_PATH}${project} --profile apps up --build`);
+}
 
 //#endregion
 //#region src/deploy/docker.ts
@@ -5923,20 +5289,20 @@ function isStateProvider(value) {
 async function createStateProvider(options) {
 	const { config, workspaceRoot, workspaceName } = options;
 	if (!config) {
-		const { LocalStateProvider } = await import("./LocalStateProvider-Bn6tS-oL.mjs");
+		const { LocalStateProvider } = await import("./LocalStateProvider-Bq-0C0sg.mjs");
 		return new LocalStateProvider(workspaceRoot);
 	}
 	if (isStateProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "local") {
-		const { LocalStateProvider } = await import("./LocalStateProvider-Bn6tS-oL.mjs");
+		const { LocalStateProvider } = await import("./LocalStateProvider-Bq-0C0sg.mjs");
 		return new LocalStateProvider(workspaceRoot);
 	}
 	if (provider === "ssm") {
 		if (!workspaceName) throw new Error("Workspace name is required for SSM state provider. Set \"name\" in gkm.config.ts.");
-		const { LocalStateProvider } = await import("./LocalStateProvider-Bn6tS-oL.mjs");
-		const { SSMStateProvider } = await import("./SSMStateProvider-BRt2py-A.mjs");
-		const { CachedStateProvider: CachedStateProvider$1 } = await import("./CachedStateProvider-BxoAm-B2.mjs");
+		const { LocalStateProvider } = await import("./LocalStateProvider-Bq-0C0sg.mjs");
+		const { SSMStateProvider } = await import("./SSMStateProvider-DOZifZfE.mjs");
+		const { CachedStateProvider: CachedStateProvider$1 } = await import("./CachedStateProvider-C-8wtlto.mjs");
 		const ssmConfig = config;
 		const local = new LocalStateProvider(workspaceRoot);
 		const ssm = SSMStateProvider.create({
@@ -6812,7 +6178,7 @@ async function workspaceDeployCommand(configured, options) {
 	const backupCluster = Object.values(declaredClusters)[0];
 	if (workspace.deploy?.backups && backupCluster) {
 		logger$3.log("\n💾 Provisioning backup destination...");
-		const { provisionBackupDestination } = await import("./backup-provisioner-Bgj5Vi_L.mjs");
+		const { provisionBackupDestination } = await import("./backup-provisioner-DXXg6FIL.mjs");
 		const backupState = await provisionBackupDestination({
 			api,
 			projectId: project.projectId,
@@ -7697,7 +7063,8 @@ the stale one is always the copy nobody opened.
 `;
 }
 function agentsContent(options, template) {
-	const { name: name$1, monorepo, database, telescope, studio, packageManager, services } = options;
+	const { name: name$1, monorepo, telescope, studio, packageManager } = options;
+	const { database } = options.constructs;
 	const constructsGlob = monorepo ? WORKSPACE_CONSTRUCTS_GLOB : CONSTRUCTS_GLOB;
 	const isWorker = template.name === "worker";
 	const isServerless = template.name === "serverless";
@@ -7763,7 +7130,7 @@ ${run} gkm secrets:show
 environment and fail in a way that looks like a config bug. Go through
 \`gkm exec --\`, which is what injects them.`);
 	if (!isWorker) sections.push(endpointSection(options));
-	if (isWorker || isServerless || services.events) sections.push(backgroundSection(template));
+	if (isWorker || isServerless) sections.push(backgroundSection(template));
 	if (database) sections.push(databaseSection());
 	sections.push(`## Environment
 
@@ -7811,7 +7178,8 @@ reaches — and neither shows up until something reads the graph.`);
 	return `${sections.join("\n\n")}\n`;
 }
 function layoutBlock(options, template) {
-	const { monorepo, apiPath, database } = options;
+	const { monorepo, apiPath } = options;
+	const { database } = options.constructs;
 	const isWorker = template.name === "worker";
 	if (monorepo) return `constructs/          # every construct: the surface, the database, topics
 ${apiPath}/            # the API app
@@ -7827,7 +7195,7 @@ gkm.config.ts        # name, constructs glob, secrets`;
 	return lines.join("\n");
 }
 function endpointSection(options) {
-	const { database } = options;
+	const { database } = options.constructs;
 	return `## Adding an endpoint
 
 An endpoint is built **from the surface that serves it**. That is where its
@@ -7983,26 +7351,110 @@ Run tests through \`gkm test\`, not \`vitest\` directly${database ? " — it is
 //#endregion
 //#region src/init/dependencies.ts
 /**
-* Third-party ranges a scaffold installs beside the `@geekmidas` packages.
+* Every third-party range `gkm init` writes, in one place.
 *
-* Held to the peer ranges those packages declare, in one place, because a
-* template that pinned its own copy drifted below them: `kysely ~0.28` against
-* a `~0.29.6` peer is two copies of Kysely and a `Kysely<DB>` from one that is
-* not assignable to the other's.
+* Templates used to pin their own copies, and those drifted: below the peer
+* ranges the `@geekmidas` packages declare (`kysely ~0.28` against a `~0.29.6`
+* peer is two copies of Kysely, and a `Kysely<DB>` from one is not assignable
+* to the other's), and below what the rest of the scaffold assumed (`turbo
+* ~2.3.0` ignores `$TURBO_ROOT$`, which the root `turbo.json` relies on). No
+* generator writes a version literal; a scan test holds them to that.
 *
 * Hand-maintained, unlike `versions.ts`, which `sync-versions` rewrites whole.
+* Current as of 2026-09-27, inside every `@geekmidas` peer range.
 */
 const DEPENDENCY_VERSIONS = {
-	"@tanstack/react-query": "~5.80.0",
-	"better-auth": "~1.7.5",
-	hono: "~4.13.8",
+	"better-auth": "~1.7.6",
+	hono: "~4.13.9",
+	"@hono/node-server": "~1.19.17",
 	kysely: "~0.29.6",
 	"kysely-ctl": "~0.21.0",
 	pg: "~8.23.0",
 	pino: "~10.3.1",
+	zod: "~4.6.5",
 	sst: "~4.17.1",
-	zod: "~4.6.5"
+	next: "~16.3.6",
+	react: "~19.3.0",
+	"react-dom": "~19.3.0",
+	"@tanstack/react-query": "~5.104.0",
+	"@tanstack/react-router": "~1.170.40",
+	"@tanstack/react-start": "~1.168.59",
+	"@tanstack/router-plugin": "~1.168.41",
+	tailwindcss: "~4.3.3",
+	"@tailwindcss/postcss": "~4.3.3",
+	"@tailwindcss/vite": "~4.3.3",
+	"@radix-ui/react-dialog": "~1.1.23",
+	"@radix-ui/react-label": "~2.1.15",
+	"@radix-ui/react-separator": "~1.1.15",
+	"@radix-ui/react-slot": "~1.3.3",
+	"@radix-ui/react-tabs": "~1.1.21",
+	"@radix-ui/react-tooltip": "~1.2.16",
+	"class-variance-authority": "~0.7.1",
+	clsx: "~2.1.1",
+	"lucide-react": "~0.577.0",
+	"tailwind-merge": "~3.7.0",
+	"vite-tsconfig-paths": "~5.1.4",
+	"@biomejs/biome": "~2.5.14",
+	"@faker-js/faker": "~10.6.0",
+	turbo: "~2.11.4",
+	"@types/node": "~22.20.4",
+	"@types/pg": "~8.23.1",
+	"@types/react": "~19.3.0",
+	"@types/react-dom": "~19.3.0",
+	"@types/aws-lambda": "~8.10.163"
+};
+/**
+* The build and test toolchain, at the versions it was already on.
+*
+* Held here so it moves in one place, but not moved yet: it changes how every
+* scaffold compiles and runs, and tranche 2 (#40) moves it together with the
+* repository's own toolchain.
+*/
+const TOOLCHAIN_VERSIONS = {
+	typescript: "~5.8.2",
+	tsx: "~4.20.0",
+	esbuild: "~0.27.0",
+	vitest: "~4.0.0",
+	vite: "^7.0.0",
+	"@vitejs/plugin-react": "^4.3.4",
+	storybook: "^8.4.7",
+	"@storybook/addon-a11y": "^8.4.7",
+	"@storybook/addon-essentials": "^8.4.7",
+	"@storybook/addon-interactions": "^8.4.7",
+	"@storybook/react": "^8.4.7",
+	"@storybook/react-vite": "^8.4.7",
+	"vite@storybook": "^6.0.0"
+};
+/**
+* The Expo app's packages, which track an Expo SDK release (55) rather than
+* their own latest: SDK 55 is tested against exactly these, React Native and
+* React included, so they move when the SDK does.
+*/
+const EXPO_VERSIONS = {
+	expo: "~55.0.0",
+	"expo-constants": "~55.0.0",
+	"expo-dev-client": "~55.0.0",
+	"expo-linking": "~55.0.0",
+	"expo-router": "~55.0.0",
+	"expo-splash-screen": "~55.0.0",
+	"expo-status-bar": "~55.0.0",
+	"expo-secure-store": "~14.2.0",
+	react: "19.2.0",
+	"react-dom": "19.2.0",
+	"react-native": "0.83.6",
+	"react-native-gesture-handler": "~2.30.0",
+	"react-native-reanimated": "~4.2.0",
+	"react-native-safe-area-context": "~5.6.0",
+	"react-native-screens": "~4.23.0",
+	"react-native-web": "~0.21.0",
+	"@react-navigation/native": "^7.1.0",
+	"@babel/core": "^7.25.0",
+	"@types/react": "~19.0.0",
+	nativewind: "~4.2.0",
+	tailwindcss: "~3.4.0"
 };
+/** The Biome config schema matching the Biome the scaffold installs. */
+const BIOME_SCHEMA = `https://biomejs.dev/schemas/${DEPENDENCY_VERSIONS["@biomejs/biome"].replace(/^[~^]/, "")}/schema.json`;
 
 //#endregion
 //#region src/init/versions.ts
@@ -8026,26 +7478,26 @@ const CLI_VERSION = `~${pkg.version}`;
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.10",
-	"@geekmidas/auth": "~10.0.0-alpha.10",
-	"@geekmidas/cache": "~10.0.0-alpha.10",
-	"@geekmidas/client": "~10.0.0-alpha.10",
-	"@geekmidas/cloud": "~10.0.0-alpha.10",
-	"@geekmidas/constructs": "~10.0.0-alpha.10",
-	"@geekmidas/db": "~10.0.0-alpha.10",
-	"@geekmidas/emailkit": "~10.0.0-alpha.10",
-	"@geekmidas/envkit": "~10.0.0-alpha.10",
-	"@geekmidas/errors": "~10.0.0-alpha.10",
-	"@geekmidas/events": "~10.0.0-alpha.10",
-	"@geekmidas/logger": "~10.0.0-alpha.10",
-	"@geekmidas/manifest": "~10.0.0-alpha.10",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.10",
-	"@geekmidas/schema": "~10.0.0-alpha.10",
-	"@geekmidas/services": "~10.0.0-alpha.10",
-	"@geekmidas/storage": "~10.0.0-alpha.10",
-	"@geekmidas/studio": "~10.0.0-alpha.10",
-	"@geekmidas/telescope": "~10.0.0-alpha.10",
-	"@geekmidas/testkit": "~10.0.0-alpha.10",
+	"@geekmidas/audit": "~10.0.0-alpha.12",
+	"@geekmidas/auth": "~10.0.0-alpha.12",
+	"@geekmidas/cache": "~10.0.0-alpha.12",
+	"@geekmidas/client": "~10.0.0-alpha.12",
+	"@geekmidas/cloud": "~10.0.0-alpha.12",
+	"@geekmidas/constructs": "~10.0.0-alpha.12",
+	"@geekmidas/db": "~10.0.0-alpha.12",
+	"@geekmidas/emailkit": "~10.0.0-alpha.12",
+	"@geekmidas/envkit": "~10.0.0-alpha.12",
+	"@geekmidas/errors": "~10.0.0-alpha.12",
+	"@geekmidas/events": "~10.0.0-alpha.12",
+	"@geekmidas/logger": "~10.0.0-alpha.12",
+	"@geekmidas/manifest": "~10.0.0-alpha.12",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.12",
+	"@geekmidas/schema": "~10.0.0-alpha.12",
+	"@geekmidas/services": "~10.0.0-alpha.12",
+	"@geekmidas/storage": "~10.0.0-alpha.12",
+	"@geekmidas/studio": "~10.0.0-alpha.12",
+	"@geekmidas/telescope": "~10.0.0-alpha.12",
+	"@geekmidas/testkit": "~10.0.0-alpha.12",
 	"@geekmidas/cli": CLI_VERSION
 };
 
@@ -8077,7 +7529,7 @@ function generateAuthAppFiles(options) {
 			"@geekmidas/db": GEEKMIDAS_VERSIONS["@geekmidas/db"],
 			"@geekmidas/envkit": GEEKMIDAS_VERSIONS["@geekmidas/envkit"],
 			"@geekmidas/logger": GEEKMIDAS_VERSIONS["@geekmidas/logger"],
-			"@hono/node-server": "~1.14.1",
+			"@hono/node-server": DEPENDENCY_VERSIONS["@hono/node-server"],
 			"better-auth": DEPENDENCY_VERSIONS["better-auth"],
 			hono: DEPENDENCY_VERSIONS.hono,
 			kysely: DEPENDENCY_VERSIONS.kysely,
@@ -8085,10 +7537,10 @@ function generateAuthAppFiles(options) {
 		},
 		devDependencies: {
 			"@geekmidas/cli": GEEKMIDAS_VERSIONS["@geekmidas/cli"],
-			"@types/node": "~22.0.0",
-			"@types/pg": "~8.23.1",
-			tsx: "~4.20.0",
-			typescript: "~5.8.2"
+			"@types/node": DEPENDENCY_VERSIONS["@types/node"],
+			"@types/pg": DEPENDENCY_VERSIONS["@types/pg"],
+			tsx: TOOLCHAIN_VERSIONS["tsx"],
+			typescript: TOOLCHAIN_VERSIONS["typescript"]
 		}
 	};
 	const tsConfig = {
@@ -8195,21 +7647,6 @@ export default defineConfig({${stagesBlock(options.stages)}${options.monorepo ?
   logger: './src/config/logger#logger',`;
 	if (isServerless || hasWorker) gkmConfig += `
   functions: './src/functions/**/*.ts',`;
-	if (!options.monorepo) {
-		const { cache, mail, events } = options.services;
-		if (cache || mail || events) {
-			gkmConfig += `
-  services: {`;
-			if (cache) gkmConfig += `
-    cache: true,`;
-			if (mail) gkmConfig += `
-    mail: true,`;
-			if (events) gkmConfig += `
-    events: '${events}',`;
-			gkmConfig += `
-  },`;
-		}
-	}
 	if (hasWorker) gkmConfig += `
   crons: './src/crons/**/*.ts',
   subscribers: './src/subscribers/**/*.ts',`;
@@ -8254,14 +7691,14 @@ export default defineConfig({${stagesBlock(options.stages)}${options.monorepo ?
 			path: "tsconfig.json",
 			content: `${JSON.stringify(tsConfig, null, 2)}\n`
 		}];
-		if (options.database) files$2.push({
+		if (options.constructs.database) files$2.push({
 			path: "vitest.config.ts",
 			content: vitestConfigContent
 		});
 		return files$2;
 	}
 	const biomeConfig = {
-		$schema: "https://biomejs.dev/schemas/2.3.0/schema.json",
+		$schema: BIOME_SCHEMA,
 		vcs: {
 			enabled: true,
 			clientKind: "git",
@@ -8345,7 +7782,7 @@ export default defineConfig({${stagesBlock(options.stages)}${options.monorepo ?
 			content: `${JSON.stringify(turboConfig, null, 2)}\n`
 		}
 	];
-	if (options.database) files$1.push({
+	if (options.constructs.database) files$1.push({
 		path: "vitest.config.ts",
 		content: vitestConfigContent
 	});
@@ -8382,325 +7819,13 @@ function generateSingleAppConfigFiles(options, _template, _helpers) {
 		path: "tsconfig.json",
 		content: `${JSON.stringify(tsConfig, null, 2)}\n`
 	}];
-	if (options.database) files$1.push({
+	if (options.constructs.database) files$1.push({
 		path: "vitest.config.ts",
 		content: vitestConfigContent
 	});
 	return files$1;
 }
 
-//#endregion
-//#region src/init/generators/docker.ts
-/**
-* Generate docker-compose.yml based on template and options
-*/
-function generateDockerFiles(options, template, dbApps) {
-	const { database } = options;
-	const isServerless = template.name === "serverless";
-	const hasWorker = template.name === "worker";
-	const isFullstack = options.template === "fullstack";
-	const services = [];
-	const volumes = [];
-	const files$1 = [];
-	if (database) {
-		const initVolume = isFullstack && dbApps?.length ? `
-      - ./docker/postgres/init.sh:/docker-entrypoint-initdb.d/init.sh:ro` : "";
-		const envFile = isFullstack && dbApps?.length ? `
-    env_file:
-      - ./docker/.env` : "";
-		services.push(`  postgres:
-    image: postgres:18-alpine
-    container_name: ${options.name}-postgres
-    restart: unless-stopped${envFile}
-    environment:
-      POSTGRES_USER: \${POSTGRES_USER:-postgres}
-      POSTGRES_PASSWORD: \${POSTGRES_PASSWORD:-postgres}
-      POSTGRES_DB: \${POSTGRES_DB:-${options.name.replace(/-/g, "_")}_dev}
-    ports:
-      - '\${POSTGRES_HOST_PORT:-5432}:5432'
-    volumes:
-      - dbdata:/var/lib/postgresql${initVolume}
-    healthcheck:
-      test: ['CMD-SHELL', 'pg_isready -U $$POSTGRES_USER']
-      interval: 5s
-      timeout: 5s
-      retries: 5`);
-		volumes.push("  dbdata:");
-		if (isFullstack && dbApps?.length) {
-			files$1.push({
-				path: "docker/postgres/init.sh",
-				content: generatePostgresInitScript(dbApps, options.services?.events)
-			});
-			files$1.push({
-				path: "docker/.env",
-				content: generateDockerEnv(dbApps, options.services?.events)
-			});
-		}
-	}
-	if (isServerless) {
-		services.push(`  redis:
-    image: redis:7-alpine
-    container_name: ${options.name}-redis
-    restart: unless-stopped
-    ports:
-      - '\${REDIS_HOST_PORT:-6379}:6379'
-    volumes:
-      - redis_data:/data
-    healthcheck:
-      test: ['CMD', 'redis-cli', 'ping']
-      interval: 5s
-      timeout: 5s
-      retries: 5
-
-  serverless-redis:
-    image: hiett/serverless-redis-http:latest
-    container_name: ${options.name}-serverless-redis
-    restart: unless-stopped
-    ports:
-      - '\${SRH_HOST_PORT:-8079}:80'
-    environment:
-      SRH_MODE: env
-      SRH_TOKEN: local_dev_token
-      SRH_CONNECTION_STRING: redis://redis:6379
-    depends_on:
-      redis:
-        condition: service_healthy`);
-		volumes.push("  redis_data:");
-	} else {
-		services.push(`  redis:
-    image: redis:7-alpine
-    container_name: ${options.name}-redis
-    restart: unless-stopped
-    ports:
-      - '\${REDIS_HOST_PORT:-6379}:6379'
-    volumes:
-      - redis_data:/data
-    healthcheck:
-      test: ['CMD', 'redis-cli', 'ping']
-      interval: 5s
-      timeout: 5s
-      retries: 5`);
-		volumes.push("  redis_data:");
-	}
-	if (hasWorker) {
-		services.push(`  rabbitmq:
-    image: rabbitmq:3-management-alpine
-    container_name: ${options.name}-rabbitmq
-    restart: unless-stopped
-    ports:
-      - '\${RABBITMQ_HOST_PORT:-5672}:5672'
-      - '\${RABBITMQ_MGMT_HOST_PORT:-15672}:15672'
-    environment:
-      RABBITMQ_DEFAULT_USER: guest
-      RABBITMQ_DEFAULT_PASS: guest
-    volumes:
-      - rabbitmq_data:/var/lib/rabbitmq
-    healthcheck:
-      test: ['CMD', 'rabbitmq-diagnostics', 'check_running']
-      interval: 10s
-      timeout: 5s
-      retries: 5`);
-		volumes.push("  rabbitmq_data:");
-	}
-	if (options.services?.mail) services.push(`  mailpit:
-    image: axllent/mailpit:latest
-    container_name: ${options.name}-mailpit
-    restart: unless-stopped
-    ports:
-      - '\${SMTP_PORT:-1025}:1025'
-      - '\${MAILPIT_PORT:-8025}:8025'
-    environment:
-      MP_SMTP_AUTH: \${SMTP_USER:-${options.name}}:\${SMTP_PASS:-${options.name}}`);
-	if (options.services?.storage) {
-		services.push(`  minio:
-    image: pgsty/minio:RELEASE.2026-08-04T00-00-00Z
-    container_name: ${options.name}-minio
-    restart: unless-stopped
-    entrypoint: sh
-    command: -c 'mkdir -p /data/\${STORAGE_BUCKET:-${options.name}} && /usr/bin/docker-entrypoint.sh server --console-address ":9001" /data'
-    environment:
-      MINIO_ROOT_USER: \${STORAGE_ACCESS_KEY_ID:-${options.name}}
-      MINIO_ROOT_PASSWORD: \${STORAGE_SECRET_ACCESS_KEY:-${options.name}}
-    ports:
-      - '\${MINIO_API_HOST_PORT:-9000}:9000'
-      - '\${MINIO_CONSOLE_HOST_PORT:-9001}:9001'
-    volumes:
-      - minio_data:/data
-    healthcheck:
-      test: ['CMD', 'mc', 'ready', 'local']
-      interval: 10s
-      timeout: 5s
-      retries: 5`);
-		volumes.push("  minio_data:");
-	}
-	if (options.services?.events === "sns") {
-		services.push(`  localstack:
-    image: floci/floci:latest
-    container_name: ${options.name}-localstack
-    restart: unless-stopped
-    environment:
-      AWS_DEFAULT_REGION: \${AWS_REGION:-us-east-1}
-      AWS_ACCESS_KEY_ID: \${AWS_ACCESS_KEY_ID:-localstack}
-      AWS_SECRET_ACCESS_KEY: \${AWS_SECRET_ACCESS_KEY:-localstack}
-    ports:
-      - '\${LOCALSTACK_PORT:-4566}:4566'
-    volumes:
-      - localstack_data:/var/lib/localstack
-    healthcheck:
-      test: ['CMD', 'curl', '-f', 'http://localhost:4566/_localstack/health']
-      interval: 10s
-      timeout: 5s
-      retries: 5`);
-		volumes.push("  localstack_data:");
-	}
-	if (options.services?.events === "rabbitmq" && !hasWorker) {
-		services.push(`  rabbitmq:
-    image: rabbitmq:3-management-alpine
-    container_name: ${options.name}-rabbitmq
-    restart: unless-stopped
-    ports:
-      - '\${RABBITMQ_HOST_PORT:-5672}:5672'
-      - '\${RABBITMQ_MGMT_HOST_PORT:-15672}:15672'
-    environment:
-      RABBITMQ_DEFAULT_USER: guest
-      RABBITMQ_DEFAULT_PASS: guest
-    volumes:
-      - rabbitmq_data:/var/lib/rabbitmq
-    healthcheck:
-      test: ['CMD', 'rabbitmq-diagnostics', 'check_running']
-      interval: 10s
-      timeout: 5s
-      retries: 5`);
-		if (!volumes.includes("  rabbitmq_data:")) volumes.push("  rabbitmq_data:");
-	}
-	let dockerCompose = `# Use "gkm dev" or "gkm test" to start services.
-# Running "docker compose up" directly will not inject secrets or resolve ports.
-services:
-${services.join("\n\n")}
-`;
-	if (volumes.length > 0) dockerCompose += `
-volumes:
-${volumes.join("\n")}
-`;
-	files$1.push({
-		path: "docker-compose.yml",
-		content: dockerCompose
-	});
-	return files$1;
-}
-/**
-* Generate .env file for docker-compose with database passwords
-*/
-function generateDockerEnv(apps, _eventsBackend) {
-	const envVars = apps.map((app) => {
-		const envVar = `${app.name.toUpperCase()}_DB_PASSWORD`;
-		return `${envVar}=${app.password}`;
-	});
-	envVars.push(`PGBOSS_DB_PASSWORD=pgboss-dev-password`);
-	return `# Auto-generated docker environment file
-# Contains database passwords for docker-compose postgres init
-# This file is gitignored - do not commit to version control
-${envVars.join("\n")}
-`;
-}
-/**
-* Generate PostgreSQL init shell script that creates per-app users with separate schemas.
-* Uses idempotent DO blocks so the script can be re-run safely.
-* - api user: uses public schema
-* - auth user: uses auth schema with search_path=auth
-* - pgboss user: uses pgboss schema (when events === 'pgboss')
-*/
-function generatePostgresInitScript(apps, _eventsBackend) {
-	const userCreations = apps.map((app) => {
-		const userName = app.name.replace(/-/g, "_");
-		const envVar = `${app.name.toUpperCase()}_DB_PASSWORD`;
-		const isApi = app.name === "api";
-		const schemaName = isApi ? "public" : userName;
-		if (isApi) return `
-# Create ${app.name} user (uses public schema) - idempotent
-echo "Creating user ${userName}..."
-psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<-EOSQL
-    DO \\$\\$
-    BEGIN
-        IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '${userName}') THEN
-            CREATE USER ${userName} WITH PASSWORD '$${envVar}';
-        ELSE
-            ALTER USER ${userName} WITH PASSWORD '$${envVar}';
-        END IF;
-    END
-    \\$\\$;
-    GRANT ALL ON SCHEMA public TO ${userName};
-    ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO ${userName};
-    ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO ${userName};
-EOSQL
-`;
-		return `
-# Create ${app.name} user with dedicated schema - idempotent
-echo "Creating user ${userName} with schema ${schemaName}..."
-psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<-EOSQL
-    DO \\$\\$
-    BEGIN
-        IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '${userName}') THEN
-            CREATE USER ${userName} WITH PASSWORD '$${envVar}';
-        ELSE
-            ALTER USER ${userName} WITH PASSWORD '$${envVar}';
-        END IF;
-    END
-    \\$\\$;
-    CREATE SCHEMA IF NOT EXISTS ${schemaName} AUTHORIZATION ${userName};
-    ALTER USER ${userName} SET search_path TO ${schemaName};
-    GRANT USAGE ON SCHEMA ${schemaName} TO ${userName};
-    GRANT ALL ON ALL TABLES IN SCHEMA ${schemaName} TO ${userName};
-    GRANT ALL ON ALL SEQUENCES IN SCHEMA ${schemaName} TO ${userName};
-    ALTER DEFAULT PRIVILEGES IN SCHEMA ${schemaName} GRANT ALL ON TABLES TO ${userName};
-    ALTER DEFAULT PRIVILEGES IN SCHEMA ${schemaName} GRANT ALL ON SEQUENCES TO ${userName};
-EOSQL
-`;
-	});
-	const pgbossBlock = `
-# Create pgboss user with dedicated schema - idempotent
-echo "Creating pgboss user and schema..."
-psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<-EOSQL
-    DO \\$\\$
-    BEGIN
-        IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'pgboss') THEN
-            CREATE USER pgboss WITH PASSWORD '$PGBOSS_DB_PASSWORD';
-        ELSE
-            ALTER USER pgboss WITH PASSWORD '$PGBOSS_DB_PASSWORD';
-        END IF;
-    END
-    \\$\\$;
-    CREATE SCHEMA IF NOT EXISTS pgboss AUTHORIZATION pgboss;
-    ALTER USER pgboss SET search_path TO pgboss;
-    GRANT USAGE ON SCHEMA pgboss TO pgboss;
-    GRANT ALL ON ALL TABLES IN SCHEMA pgboss TO pgboss;
-    GRANT ALL ON ALL SEQUENCES IN SCHEMA pgboss TO pgboss;
-    ALTER DEFAULT PRIVILEGES IN SCHEMA pgboss GRANT ALL ON TABLES TO pgboss;
-    ALTER DEFAULT PRIVILEGES IN SCHEMA pgboss GRANT ALL ON SEQUENCES TO pgboss;
-EOSQL
-`;
-	const extensions = `
-# Create extensions
-echo "Creating extensions..."
-psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<-EOSQL
-    CREATE EXTENSION IF NOT EXISTS pg_trgm;
-    CREATE EXTENSION IF NOT EXISTS citext;
-EOSQL
-`;
-	return `#!/bin/bash
-set -e
-
-# Auto-generated PostgreSQL init script (idempotent - safe to re-run)
-# Creates per-app users with separate schemas in a single database
-# - api: uses public schema
-# - auth: uses auth schema (search_path=auth)
-# - pgboss: uses pgboss schema for event processing
-${extensions}
-${userCreations.join("\n")}${pgbossBlock}
-echo "Database initialization complete!"
-`;
-}
-
 //#endregion
 //#region src/init/generators/env.ts
 /**
@@ -8719,6 +7844,9 @@ node_modules/
 dist/
 .gkm/
 
+# Written by gkm from the constructs; your own docker-compose.yml is not
+docker-compose.constructs.yml
+
 # Environment (legacy - use gkm secrets instead)
 .env
 .env.local
@@ -9110,32 +8238,32 @@ function generateExpoAppFiles(options) {
 			"@better-auth/expo": DEPENDENCY_VERSIONS["better-auth"],
 			"@geekmidas/client": GEEKMIDAS_VERSIONS["@geekmidas/client"],
 			"@geekmidas/envkit": GEEKMIDAS_VERSIONS["@geekmidas/envkit"],
-			"@react-navigation/native": "^7.1.0",
+			"@react-navigation/native": EXPO_VERSIONS["@react-navigation/native"],
 			"@tanstack/react-query": DEPENDENCY_VERSIONS["@tanstack/react-query"],
 			"better-auth": DEPENDENCY_VERSIONS["better-auth"],
-			expo: "~55.0.0",
-			"expo-constants": "~55.0.0",
-			"expo-dev-client": "~55.0.0",
-			"expo-linking": "~55.0.0",
-			"expo-router": "~55.0.0",
-			"expo-secure-store": "~14.2.0",
-			"expo-splash-screen": "~55.0.0",
-			"expo-status-bar": "~55.0.0",
-			nativewind: "~4.2.0",
-			react: "19.2.0",
-			"react-dom": "19.2.0",
-			"react-native": "0.83.6",
-			"react-native-gesture-handler": "~2.30.0",
-			"react-native-reanimated": "~4.2.0",
-			"react-native-safe-area-context": "~5.6.0",
-			"react-native-screens": "~4.23.0",
-			"react-native-web": "~0.21.0",
-			tailwindcss: "~3.4.0"
+			expo: EXPO_VERSIONS["expo"],
+			"expo-constants": EXPO_VERSIONS["expo-constants"],
+			"expo-dev-client": EXPO_VERSIONS["expo-dev-client"],
+			"expo-linking": EXPO_VERSIONS["expo-linking"],
+			"expo-router": EXPO_VERSIONS["expo-router"],
+			"expo-secure-store": EXPO_VERSIONS["expo-secure-store"],
+			"expo-splash-screen": EXPO_VERSIONS["expo-splash-screen"],
+			"expo-status-bar": EXPO_VERSIONS["expo-status-bar"],
+			nativewind: EXPO_VERSIONS["nativewind"],
+			react: EXPO_VERSIONS["react"],
+			"react-dom": EXPO_VERSIONS["react-dom"],
+			"react-native": EXPO_VERSIONS["react-native"],
+			"react-native-gesture-handler": EXPO_VERSIONS["react-native-gesture-handler"],
+			"react-native-reanimated": EXPO_VERSIONS["react-native-reanimated"],
+			"react-native-safe-area-context": EXPO_VERSIONS["react-native-safe-area-context"],
+			"react-native-screens": EXPO_VERSIONS["react-native-screens"],
+			"react-native-web": EXPO_VERSIONS["react-native-web"],
+			tailwindcss: EXPO_VERSIONS["tailwindcss"]
 		},
 		devDependencies: {
-			"@babel/core": "^7.25.0",
-			"@types/react": "~19.0.0",
-			typescript: "~5.8.2"
+			"@babel/core": EXPO_VERSIONS["@babel/core"],
+			"@types/react": EXPO_VERSIONS["@types/react"],
+			typescript: TOOLCHAIN_VERSIONS["typescript"]
 		}
 	};
 	const appConfig = `import type { ConfigContext, ExpoConfig } from '@expo/config';
@@ -9689,7 +8817,7 @@ function generateModelsPackage(options) {
 		exports: { "./*": "./src/*.ts" },
 		scripts: { typecheck: "tsc --noEmit" },
 		dependencies: {},
-		devDependencies: { typescript: "~5.8.2" }
+		devDependencies: { typescript: TOOLCHAIN_VERSIONS["typescript"] }
 	};
 	const tsConfig = {
 		extends: "../../tsconfig.json",
@@ -9842,14 +8970,14 @@ function deployPackage(options) {
 }
 function generateDeployFiles(options) {
 	if (options.deployTarget !== "sst") return [];
-	if (!options.region) throw new Error("An SST deploy needs a region.");
+	if (!options.region) throw new SstNeedsRegion();
 	const db = databaseFor();
 	const mail = emailFor();
-	const hasDatabase = options.template === "fullstack" || options.services.db;
+	const hasDatabase = options.constructs.database;
 	const inputs = [...hasDatabase ? [`        // RDS needs a network. Created here rather than assumed, because a
         // VPC with NAT is a monthly cost in an account that may already
         // have one — replace it with \`sst.aws.Vpc.get(…)\` if so.
-        ${db.id}: { vpc },`] : [], ...options.services.mail ? [`        // Every provider rejects an unverified sender, so there is no
+        ${db.id}: { vpc },`] : [], ...options.constructs.mail ? [`        // Every provider rejects an unverified sender, so there is no
         // default; the synth stops with \`EmailNeedsSender\` until it is set.
         ${mail.id}: { from: process.env.MAIL_FROM as string },`] : []];
 	return [{
@@ -9910,6 +9038,16 @@ ${inputs.join("\n")}
 `
 	}];
 }
+/**
+* An SST scaffold asked for without a region. `init` always resolves one —
+* asked, `--region`, or eu-west-1 under `--yes` — so this is a caller's bug.
+*/
+var SstNeedsRegion = class extends Error {
+	constructor() {
+		super("An SST deploy needs a region: pass --region, e.g. eu-west-1.");
+		this.name = "SstNeedsRegion";
+	}
+};
 
 //#endregion
 //#region src/init/generators/monorepo.ts
@@ -9929,9 +9067,9 @@ function rootConstructDependencies(options) {
 		"@geekmidas/db": v["@geekmidas/db"],
 		kysely: DEPENDENCY_VERSIONS.kysely,
 		pg: DEPENDENCY_VERSIONS.pg,
-		...options.services.storage ? { "@geekmidas/storage": v["@geekmidas/storage"] } : {},
-		...options.services.mail ? { "@geekmidas/emailkit": v["@geekmidas/emailkit"] } : {},
-		...options.services.cache ? { "@geekmidas/cache": v["@geekmidas/cache"] } : {}
+		...options.constructs.uploads ? { "@geekmidas/storage": v["@geekmidas/storage"] } : {},
+		...options.constructs.mail ? { "@geekmidas/emailkit": v["@geekmidas/emailkit"] } : {},
+		...options.constructs.cache ? { "@geekmidas/cache": v["@geekmidas/cache"] } : {}
 	};
 }
 /**
@@ -9966,13 +9104,13 @@ function generateMonorepoFiles(options, _template) {
 			...deploy$1.dependencies
 		},
 		devDependencies: {
-			"@biomejs/biome": "~2.3.0",
+			"@biomejs/biome": DEPENDENCY_VERSIONS["@biomejs/biome"],
 			"@geekmidas/cli": GEEKMIDAS_VERSIONS["@geekmidas/cli"],
-			esbuild: "~0.27.0",
-			tsx: "~4.20.0",
-			turbo: "~2.3.0",
-			typescript: "~5.8.2",
-			vitest: "~4.0.0",
+			esbuild: TOOLCHAIN_VERSIONS["esbuild"],
+			tsx: TOOLCHAIN_VERSIONS["tsx"],
+			turbo: DEPENDENCY_VERSIONS["turbo"],
+			typescript: TOOLCHAIN_VERSIONS["typescript"],
+			vitest: TOOLCHAIN_VERSIONS["vitest"],
 			...deploy$1.devDependencies
 		}
 	};
@@ -9983,7 +9121,7 @@ function generateMonorepoFiles(options, _template) {
   - 'packages/*'
 `;
 	const biomeConfig = {
-		$schema: "https://biomejs.dev/schemas/2.3.0/schema.json",
+		$schema: BIOME_SCHEMA,
 		vcs: {
 			enabled: true,
 			clientKind: "git",
@@ -10028,7 +9166,17 @@ function generateMonorepoFiles(options, _template) {
 		tasks: {
 			build: {
 				dependsOn: ["^build"],
-				outputs: ["dist/**"]
+				inputs: [
+					"$TURBO_DEFAULT$",
+					"$TURBO_ROOT$/constructs/**/*.ts",
+					"$TURBO_ROOT$/gkm.config.ts"
+				],
+				outputs: [
+					"dist/**",
+					".gkm/**",
+					".next/**",
+					"!.next/cache/**"
+				]
 			},
 			dev: {
 				cache: false,
@@ -10057,6 +9205,9 @@ node_modules/
 dist/
 .gkm/
 
+# Written by gkm from the constructs; your own docker-compose.yml is not
+docker-compose.constructs.yml
+
 # Environment
 .env
 .env.local
@@ -10222,7 +9373,7 @@ export default defineConfig({
 * table in the database that is already there, storage is MinIO, mail is SES.
 */
 function generateWorkspaceConfig(options) {
-	let config = `import { defineWorkspace } from '@geekmidas/cli/config';
+	const config = `import { defineWorkspace } from '@geekmidas/cli/config';
 
 export default defineWorkspace({
   // The scope every physical name is built from: \`Database\` becomes
@@ -10245,11 +9396,6 @@ ${workspaceConstructsGlobs(options.routesStructure, dirname(options.apiPath)).ma
   },
 });
 `;
-	if (options.services.events && options.services.events !== "pgboss") config = config.replace("  secrets: {", `  services: {
-    events: '${options.services.events}',
-  },
-
-  secrets: {`);
 	return config;
 }
 /**
@@ -10266,7 +9412,8 @@ ${workspaceConstructsGlobs(options.routesStructure, dirname(options.apiPath)).ma
 */
 function generateRootConstructs(options) {
 	if (!options.monorepo || options.template !== "fullstack") return [];
-	const { name: name$1, services, frontendFramework } = options;
+	const { name: name$1, frontendFramework } = options;
+	const { cache, uploads, mail } = options.constructs;
 	const db = databaseFor();
 	const files$1 = [];
 	files$1.push({
@@ -10381,7 +9528,7 @@ import { auth } from './auth.ts';
 export const web = new StaticSite('Web', ${variant}).dependsOn([api, auth]);
 `
 	});
-	if (services.storage) {
+	if (uploads) {
 		const bucket = storageFor();
 		files$1.push({
 			path: "constructs/storage.ts",
@@ -10392,18 +9539,18 @@ export const uploads = new ObjectStorage('${bucket.id}');
 `
 		});
 	}
-	if (services.mail) {
-		const mail = emailFor();
+	if (mail) {
+		const mail$1 = emailFor();
 		files$1.push({
 			path: "constructs/email.ts",
 			content: `import { Email } from '@geekmidas/constructs/email';
 
 /** Outbound mail — Mailpit locally, SES deployed. */
-export const email = new Email('${mail.id}', { templates: {} });
+export const email = new Email('${mail$1.id}', { templates: {} });
 `
 		});
 	}
-	if (services.cache) {
+	if (cache) {
 		const kv = cacheFor();
 		files$1.push({
 			path: "constructs/cache.ts",
@@ -10436,20 +9583,20 @@ const apiTemplate = {
 		"@geekmidas/services": GEEKMIDAS_VERSIONS["@geekmidas/services"],
 		"@geekmidas/errors": GEEKMIDAS_VERSIONS["@geekmidas/errors"],
 		"@geekmidas/auth": GEEKMIDAS_VERSIONS["@geekmidas/auth"],
-		"@hono/node-server": "~1.14.1",
+		"@hono/node-server": DEPENDENCY_VERSIONS["@hono/node-server"],
 		hono: DEPENDENCY_VERSIONS.hono,
 		pino: DEPENDENCY_VERSIONS.pino,
 		zod: DEPENDENCY_VERSIONS.zod
 	},
 	devDependencies: {
-		"@biomejs/biome": "~2.3.0",
+		"@biomejs/biome": DEPENDENCY_VERSIONS["@biomejs/biome"],
 		"@geekmidas/cli": GEEKMIDAS_VERSIONS["@geekmidas/cli"],
-		"@types/node": "~22.0.0",
-		esbuild: "~0.27.0",
-		tsx: "~4.20.0",
-		turbo: "~2.3.0",
-		typescript: "~5.8.2",
-		vitest: "~4.0.0"
+		"@types/node": DEPENDENCY_VERSIONS["@types/node"],
+		esbuild: TOOLCHAIN_VERSIONS["esbuild"],
+		tsx: TOOLCHAIN_VERSIONS["tsx"],
+		turbo: DEPENDENCY_VERSIONS["turbo"],
+		typescript: TOOLCHAIN_VERSIONS["typescript"],
+		vitest: TOOLCHAIN_VERSIONS["vitest"]
 	},
 	scripts: {
 		dev: "gkm dev",
@@ -10462,7 +9609,8 @@ const apiTemplate = {
 		"fmt:check": "biome format ."
 	},
 	files: (options) => {
-		const { loggerType, routesStructure, monorepo, name: name$1, services } = options;
+		const { loggerType, routesStructure, monorepo, name: name$1 } = options;
+		const { cache, uploads, mail: sendsMail } = options.constructs;
 		const bucket = storageFor();
 		const kv = cacheFor();
 		const db = databaseFor();
@@ -10572,7 +9720,7 @@ import { router } from '${src("router.ts")}';
 export const listUsersEndpoint = router
   .get('/users')
   .output(ListUsersResponseSchema)
-${options.database ? `  // \`db\` is here because the router named the database construct.
+${options.constructs.database ? `  // \`db\` is here because the router named the database construct.
   .handle(async ({ db }) => ({
     users: await db.selectFrom('users').select(['id', 'name']).execute(),
   }));
@@ -10595,7 +9743,7 @@ export const listUsersEndpoint = router
   .output(z.object({
     users: z.array(UserSchema),
   }))
-${options.database ? `  // \`db\` is here because the router named the database construct.
+${options.constructs.database ? `  // \`db\` is here because the router named the database construct.
   .handle(async ({ db }) => ({
     users: await db.selectFrom('users').select(['id', 'name']).execute(),
   }));
@@ -10687,18 +9835,18 @@ export const authService = {
 			files$1.push({
 				path: "src/router.ts",
 				content: `import { UnauthorizedError } from '@geekmidas/errors';
-import { api } from '${constructsImport("api")}';${options.database ? `
+import { api } from '${constructsImport("api")}';${options.constructs.database ? `
 import { database } from '${constructsImport("database")}';` : ""}
 import { authService, type Session } from './services/auth.ts';
 
 /**
  * The shared endpoint factory — no session required.
- *${options.database ? `
+ *${options.constructs.database ? `
  * Naming the database construct is what puts \`db\` in every handler built from
  * this router. Depend on other constructs per endpoint with \`.dependsOn([…])\`.` : `
  * Depend on constructs per endpoint with \`.dependsOn([…])\`.`}
  */
-export const router = api.endpoints${options.database ? ".database(database)" : ""};
+export const router = api.endpoints${options.constructs.database ? ".database(database)" : ""};
 
 // The auth client available, but the session not enforced.
 export const r = router.services([authService]);
@@ -10734,22 +9882,22 @@ export const profileEndpoint = sessionRouter
 		}
 		if (!monorepo) files$1.push({
 			path: "src/router.ts",
-			content: `import { api } from '${constructsImport("api")}';${options.database ? `
+			content: `import { api } from '${constructsImport("api")}';${options.constructs.database ? `
 import { database } from '${constructsImport("database")}';` : ""}
 
 /**
  * The shared endpoint factory.
- *${options.database ? `
+ *${options.constructs.database ? `
  * Naming the database construct is what puts \`db\` in every handler built from
  * this router. Depend on other constructs per endpoint with \`.dependsOn([…])\`.` : `
  * Depend on constructs per endpoint with \`.dependsOn([…])\`.`}
  */
-export const router = api.endpoints${options.database ? ".database(database)" : ""};
+export const router = api.endpoints${options.constructs.database ? ".database(database)" : ""};
 `
 		});
-		if (options.database && declares) files$1.push(...databaseFiles());
-		else if (options.database) files$1.push(usersMigration());
-		if (services.storage && declares) files$1.push({
+		if (options.constructs.database && declares) files$1.push(...databaseFiles());
+		else if (options.constructs.database) files$1.push(usersMigration());
+		if (uploads && declares) files$1.push({
 			path: "src/constructs/storage.ts",
 			content: `import { ObjectStorage } from '@geekmidas/constructs/object-storage';
 
@@ -10763,7 +9911,7 @@ export const router = api.endpoints${options.database ? ".database(database)" :
 export const uploads = new ObjectStorage('${bucket.id}');
 `
 		});
-		if (services.mail && declares) files$1.push({
+		if (sendsMail && declares) files$1.push({
 			path: "src/constructs/email.ts",
 			content: `import { Email } from '@geekmidas/constructs/email';
 
@@ -10772,13 +9920,13 @@ export const uploads = new ObjectStorage('${bucket.id}');
  *
  * Add React templates to \`templates\` and \`sendTemplate\` becomes typed
  * against them. Reach it with \`.dependsOn([email])\` for
- * \`services.${mail.service}\`; who delivers it is \`services.mail\` in
- * \`gkm.config.ts\`.
+ * \`services.${mail.service}\`. Who delivers it is whichever provider the
+ * stage's \`${mail.urlKey}\` points at — every one of them speaks SMTP.
  */
 export const email = new Email('${mail.id}', { templates: {} });
 `
 		});
-		if (services.cache && declares) files$1.push({
+		if (cache && declares) files$1.push({
 			path: "src/constructs/cache.ts",
 			content: `import { Cache } from '@geekmidas/constructs/cache';
 
@@ -10786,18 +9934,18 @@ export const email = new Email('${mail.id}', { templates: {} });
  * A cache, declared once.
  *
  * Reach it with \`.dependsOn([cache])\` for \`services.${kv.service}\`. This
- * form says the app caches and leaves *where* to the deployment: which backend
- * serves it — Upstash, ElastiCache, or a database — is \`services.cache\` in
- * \`gkm.config.ts\`, because the same code caches into any of them.
+ * form says the app caches and leaves *where* to the deployment: Upstash on
+ * AWS, a table in the database on a server — the same code caches into
+ * either.
  *
  * To say it caches in a particular database instead, declare it from that
  * database — \`database.cache()\` — and entries become a table in it, in its
- * schema and reached by its role, which config can no longer move.
+ * schema and reached by its role, whatever the target.
  */
 export const cache = new Cache('${kv.id}');
 `
 		});
-		if (options.database && !declares) files$1.push({
+		if (options.constructs.database && !declares) files$1.push({
 			path: "src/services/database.ts",
 			content: `import type { Service, ServiceRegisterOptions } from '@geekmidas/services';
 import { Kysely, PostgresDialect } from 'kysely';
@@ -10848,7 +9996,7 @@ export const telescope = new Telescope({
 });
 `
 		});
-		if (options.studio && options.database) files$1.push({
+		if (options.studio && options.constructs.database) files$1.push({
 			path: "src/config/studio.ts",
 			content: `import { Direction, InMemoryMonitoringStorage, Studio } from '@geekmidas/studio';
 import { Kysely, PostgresDialect } from 'kysely';
@@ -10897,20 +10045,20 @@ const minimalTemplate = {
 		"@geekmidas/logger": GEEKMIDAS_VERSIONS["@geekmidas/logger"],
 		"@geekmidas/rate-limit": GEEKMIDAS_VERSIONS["@geekmidas/rate-limit"],
 		"@geekmidas/schema": GEEKMIDAS_VERSIONS["@geekmidas/schema"],
-		"@hono/node-server": "~1.14.1",
+		"@hono/node-server": DEPENDENCY_VERSIONS["@hono/node-server"],
 		hono: DEPENDENCY_VERSIONS.hono,
 		pino: DEPENDENCY_VERSIONS.pino,
 		zod: DEPENDENCY_VERSIONS.zod
 	},
 	devDependencies: {
-		"@biomejs/biome": "~2.3.0",
+		"@biomejs/biome": DEPENDENCY_VERSIONS["@biomejs/biome"],
 		"@geekmidas/cli": GEEKMIDAS_VERSIONS["@geekmidas/cli"],
-		"@types/node": "~22.0.0",
-		esbuild: "~0.27.0",
-		tsx: "~4.20.0",
-		turbo: "~2.3.0",
-		typescript: "~5.8.2",
-		vitest: "~4.0.0"
+		"@types/node": DEPENDENCY_VERSIONS["@types/node"],
+		esbuild: TOOLCHAIN_VERSIONS["esbuild"],
+		tsx: TOOLCHAIN_VERSIONS["tsx"],
+		turbo: DEPENDENCY_VERSIONS["turbo"],
+		typescript: TOOLCHAIN_VERSIONS["typescript"],
+		vitest: TOOLCHAIN_VERSIONS["vitest"]
 	},
 	scripts: {
 		dev: "gkm dev",
@@ -10996,7 +10144,7 @@ export const healthEndpoint = api
 `
 			}
 		];
-		if (options.database) files$1.push(...databaseFiles());
+		if (options.constructs.database) files$1.push(...databaseFiles());
 		if (options.telescope) files$1.push({
 			path: "src/config/telescope.ts",
 			content: `import { Telescope } from '@geekmidas/telescope';
@@ -11008,7 +10156,7 @@ export const telescope = new Telescope({
 });
 `
 		});
-		if (options.studio && options.database) files$1.push({
+		if (options.studio && options.constructs.database) files$1.push({
 			path: "src/config/studio.ts",
 			content: `import { Direction, InMemoryMonitoringStorage, Studio } from '@geekmidas/studio';
 import { Kysely, PostgresDialect } from 'kysely';
@@ -11059,19 +10207,19 @@ const serverlessTemplate = {
 		"@geekmidas/cloud": GEEKMIDAS_VERSIONS["@geekmidas/cloud"],
 		"@geekmidas/rate-limit": GEEKMIDAS_VERSIONS["@geekmidas/rate-limit"],
 		"@geekmidas/schema": GEEKMIDAS_VERSIONS["@geekmidas/schema"],
-		"@hono/node-server": "~1.14.1",
+		"@hono/node-server": DEPENDENCY_VERSIONS["@hono/node-server"],
 		hono: DEPENDENCY_VERSIONS.hono,
 		pino: DEPENDENCY_VERSIONS.pino
 	},
 	devDependencies: {
-		"@biomejs/biome": "~2.3.0",
+		"@biomejs/biome": DEPENDENCY_VERSIONS["@biomejs/biome"],
 		"@geekmidas/cli": GEEKMIDAS_VERSIONS["@geekmidas/cli"],
-		"@types/aws-lambda": "~8.10.92",
-		"@types/node": "~22.0.0",
-		tsx: "~4.20.0",
-		turbo: "~2.3.0",
-		typescript: "~5.8.2",
-		vitest: "~4.0.0"
+		"@types/aws-lambda": DEPENDENCY_VERSIONS["@types/aws-lambda"],
+		"@types/node": DEPENDENCY_VERSIONS["@types/node"],
+		tsx: TOOLCHAIN_VERSIONS["tsx"],
+		turbo: DEPENDENCY_VERSIONS["turbo"],
+		typescript: TOOLCHAIN_VERSIONS["typescript"],
+		vitest: TOOLCHAIN_VERSIONS["vitest"]
 	},
 	scripts: {
 		dev: "gkm dev",
@@ -11179,7 +10327,7 @@ export const worker = new Worker('Jobs', { logger });
 `
 			}
 		];
-		if (options.database) files$1.push(...databaseFiles());
+		if (options.constructs.database) files$1.push(...databaseFiles());
 		if (options.telescope) files$1.push({
 			path: "src/config/telescope.ts",
 			content: `import { Telescope } from '@geekmidas/telescope';
@@ -11227,13 +10375,13 @@ const workerTemplate = {
 		pino: DEPENDENCY_VERSIONS.pino
 	},
 	devDependencies: {
-		"@biomejs/biome": "~2.3.0",
+		"@biomejs/biome": DEPENDENCY_VERSIONS["@biomejs/biome"],
 		"@geekmidas/cli": GEEKMIDAS_VERSIONS["@geekmidas/cli"],
-		"@types/node": "~22.0.0",
-		tsx: "~4.20.0",
-		turbo: "~2.3.0",
-		typescript: "~5.8.2",
-		vitest: "~4.0.0"
+		"@types/node": DEPENDENCY_VERSIONS["@types/node"],
+		tsx: TOOLCHAIN_VERSIONS["tsx"],
+		turbo: DEPENDENCY_VERSIONS["turbo"],
+		typescript: TOOLCHAIN_VERSIONS["typescript"],
+		vitest: TOOLCHAIN_VERSIONS["vitest"]
 	},
 	scripts: {
 		dev: "gkm dev",
@@ -11246,7 +10394,8 @@ const workerTemplate = {
 		"fmt:check": "biome format ."
 	},
 	files: (options) => {
-		const { loggerType, name: name$1, database } = options;
+		const { loggerType, name: name$1 } = options;
+		const { database } = options.constructs;
 		const loggerContent = `import { createLogger } from '@geekmidas/logger/${loggerType}';
 
 export const logger = createLogger();
@@ -11362,7 +10511,7 @@ export const cleanup = worker
   });
 `
 		});
-		if (options.database) files$1.push(...databaseFiles());
+		if (options.constructs.database) files$1.push(...databaseFiles());
 		if (options.telescope) files$1.push({
 			path: "src/config/telescope.ts",
 			content: `import { Telescope } from '@geekmidas/telescope';
@@ -11507,60 +10656,32 @@ const deployTargetChoices = [
 	}
 ];
 /**
-* Services choices for multi-select prompt
-*/
-/**
-* What the project declares — and therefore which containers it runs.
+* Which constructs to declare.
 *
-* Each choice scaffolds a construct rather than a container: the container is
-* what `gkm dev` derives from the declaration, which is why the descriptions
-* name the construct and the titles name the thing you will see running.
+* The containers that run them locally and the backends that serve them
+* deployed are derived from these, so the prompt names only what the code
+* will say.
 */
-const servicesChoices = [
+const constructChoices = [
 	{
-		title: "PostgreSQL",
-		value: "db",
-		description: "A declared database — KyselyDatabase construct"
+		title: "Database",
+		value: "database",
+		description: "KyselyDatabase — Postgres"
 	},
 	{
-		title: "Redis",
+		title: "Cache",
 		value: "cache",
-		description: "A declared cache — Cache construct"
+		description: "Cache — backed by what the deploy target implies"
 	},
 	{
-		title: "Mailpit",
-		value: "mail",
-		description: "Declared outbound mail — Email construct"
+		title: "Uploads",
+		value: "uploads",
+		description: "ObjectStorage — a bucket"
 	},
 	{
-		title: "MinIO",
-		value: "storage",
-		description: "A declared bucket — ObjectStorage construct"
-	}
-];
-/**
-* Event backend choices for prompts
-*/
-const eventsBackendChoices = [
-	{
-		title: "pg-boss",
-		value: "pgboss",
-		description: "PostgreSQL-based job queue (reuses postgres, no extra container)"
-	},
-	{
-		title: "SNS/SQS",
-		value: "sns",
-		description: "AWS SNS+SQS via LocalStack for local dev"
-	},
-	{
-		title: "RabbitMQ",
-		value: "rabbitmq",
-		description: "AMQP message broker"
-	},
-	{
-		title: "None",
-		value: void 0,
-		description: "Skip event backend"
+		title: "Mail",
+		value: "mail",
+		description: "Email — outbound mail over SMTP"
 	}
 ];
 /**
@@ -11585,26 +10706,27 @@ function isFullstackTemplate(name$1) {
 * Generate package.json with dependencies based on template and options
 */
 function generatePackageJson(options, template) {
-	const { name: name$1, telescope, database, studio, monorepo, services } = options;
+	const { name: name$1, telescope, studio, monorepo } = options;
+	const { database, cache, uploads, mail } = options.constructs;
 	const dependencies$1 = { ...template.dependencies };
 	const devDependencies$1 = { ...template.devDependencies };
 	const scripts$1 = { ...template.scripts };
 	if (telescope) dependencies$1["@geekmidas/telescope"] = GEEKMIDAS_VERSIONS["@geekmidas/telescope"];
 	if (studio) dependencies$1["@geekmidas/studio"] = GEEKMIDAS_VERSIONS["@geekmidas/studio"];
 	const declares = !monorepo;
-	if (declares && (database || services.storage || services.cache || services.mail)) dependencies$1["@geekmidas/manifest"] = GEEKMIDAS_VERSIONS["@geekmidas/manifest"];
-	if (declares && services.storage) dependencies$1["@geekmidas/storage"] = GEEKMIDAS_VERSIONS["@geekmidas/storage"];
-	if (declares && services.cache) dependencies$1["@geekmidas/cache"] = GEEKMIDAS_VERSIONS["@geekmidas/cache"];
-	if (declares && services.mail) dependencies$1["@geekmidas/emailkit"] = GEEKMIDAS_VERSIONS["@geekmidas/emailkit"];
+	if (declares && (database || uploads || cache || mail)) dependencies$1["@geekmidas/manifest"] = GEEKMIDAS_VERSIONS["@geekmidas/manifest"];
+	if (declares && uploads) dependencies$1["@geekmidas/storage"] = GEEKMIDAS_VERSIONS["@geekmidas/storage"];
+	if (declares && cache) dependencies$1["@geekmidas/cache"] = GEEKMIDAS_VERSIONS["@geekmidas/cache"];
+	if (declares && mail) dependencies$1["@geekmidas/emailkit"] = GEEKMIDAS_VERSIONS["@geekmidas/emailkit"];
 	if (database) {
 		dependencies$1["@geekmidas/db"] = GEEKMIDAS_VERSIONS["@geekmidas/db"];
 		dependencies$1.kysely = DEPENDENCY_VERSIONS.kysely;
 		dependencies$1.pg = DEPENDENCY_VERSIONS.pg;
-		devDependencies$1["@types/pg"] = "~8.23.1";
+		devDependencies$1["@types/pg"] = DEPENDENCY_VERSIONS["@types/pg"];
 		devDependencies$1["@geekmidas/testkit"] = GEEKMIDAS_VERSIONS["@geekmidas/testkit"];
-		devDependencies$1["@faker-js/faker"] = "~9.8.0";
+		devDependencies$1["@faker-js/faker"] = DEPENDENCY_VERSIONS["@faker-js/faker"];
 		devDependencies$1["kysely-ctl"] = DEPENDENCY_VERSIONS["kysely-ctl"];
-		devDependencies$1["vite-tsconfig-paths"] = "~5.1.0";
+		devDependencies$1["vite-tsconfig-paths"] = DEPENDENCY_VERSIONS["vite-tsconfig-paths"];
 	}
 	if (monorepo) {
 		delete devDependencies$1["@biomejs/biome"];
@@ -11661,7 +10783,7 @@ function generateSourceFiles(options, template) {
 * factory system with builders/seeds, and an example spec.
 */
 function generateTestFiles(options, _template) {
-	if (!options.database) return [];
+	if (!options.constructs.database) return [];
 	const db = databaseFor();
 	const declares = !options.monorepo;
 	const schema = declares ? "../src/constructs/database.ts" : "~/services/database.ts";
@@ -11829,32 +10951,32 @@ function generateUiPackageFiles(options) {
 			"build:storybook": "storybook build -o dist/storybook"
 		},
 		dependencies: {
-			"@radix-ui/react-dialog": "~1.1.4",
-			"@radix-ui/react-label": "~2.1.2",
-			"@radix-ui/react-separator": "~1.1.2",
-			"@radix-ui/react-slot": "~1.2.4",
-			"@radix-ui/react-tabs": "~1.1.2",
-			"@radix-ui/react-tooltip": "~1.1.6",
-			"class-variance-authority": "~0.7.1",
-			clsx: "^2.1.1",
-			"lucide-react": "~0.562.0",
-			"tailwind-merge": "~3.4.0"
+			"@radix-ui/react-dialog": DEPENDENCY_VERSIONS["@radix-ui/react-dialog"],
+			"@radix-ui/react-label": DEPENDENCY_VERSIONS["@radix-ui/react-label"],
+			"@radix-ui/react-separator": DEPENDENCY_VERSIONS["@radix-ui/react-separator"],
+			"@radix-ui/react-slot": DEPENDENCY_VERSIONS["@radix-ui/react-slot"],
+			"@radix-ui/react-tabs": DEPENDENCY_VERSIONS["@radix-ui/react-tabs"],
+			"@radix-ui/react-tooltip": DEPENDENCY_VERSIONS["@radix-ui/react-tooltip"],
+			"class-variance-authority": DEPENDENCY_VERSIONS["class-variance-authority"],
+			clsx: DEPENDENCY_VERSIONS["clsx"],
+			"lucide-react": DEPENDENCY_VERSIONS["lucide-react"],
+			"tailwind-merge": DEPENDENCY_VERSIONS["tailwind-merge"]
 		},
 		devDependencies: {
-			"@storybook/addon-a11y": "^8.4.7",
-			"@storybook/addon-essentials": "^8.4.7",
-			"@storybook/addon-interactions": "^8.4.7",
-			"@storybook/react": "^8.4.7",
-			"@storybook/react-vite": "^8.4.7",
-			"@tailwindcss/vite": "^4.0.0",
-			"@types/react": "^19.0.0",
-			"@types/react-dom": "^19.0.0",
-			react: "^19.0.0",
-			"react-dom": "^19.0.0",
-			storybook: "^8.4.7",
-			tailwindcss: "^4.0.0",
-			typescript: "^5.8.2",
-			vite: "^6.0.0"
+			"@storybook/addon-a11y": TOOLCHAIN_VERSIONS["@storybook/addon-a11y"],
+			"@storybook/addon-essentials": TOOLCHAIN_VERSIONS["@storybook/addon-essentials"],
+			"@storybook/addon-interactions": TOOLCHAIN_VERSIONS["@storybook/addon-interactions"],
+			"@storybook/react": TOOLCHAIN_VERSIONS["@storybook/react"],
+			"@storybook/react-vite": TOOLCHAIN_VERSIONS["@storybook/react-vite"],
+			"@tailwindcss/vite": DEPENDENCY_VERSIONS["@tailwindcss/vite"],
+			"@types/react": DEPENDENCY_VERSIONS["@types/react"],
+			"@types/react-dom": DEPENDENCY_VERSIONS["@types/react-dom"],
+			react: DEPENDENCY_VERSIONS["react"],
+			"react-dom": DEPENDENCY_VERSIONS["react-dom"],
+			storybook: TOOLCHAIN_VERSIONS["storybook"],
+			tailwindcss: DEPENDENCY_VERSIONS["tailwindcss"],
+			typescript: TOOLCHAIN_VERSIONS["typescript"],
+			vite: TOOLCHAIN_VERSIONS["vite@storybook"]
 		},
 		peerDependencies: {
 			react: ">=18.0.0",
@@ -13247,19 +12369,19 @@ function generateWebAppFiles(options) {
 			"@geekmidas/envkit": GEEKMIDAS_VERSIONS["@geekmidas/envkit"],
 			"@tanstack/react-query": DEPENDENCY_VERSIONS["@tanstack/react-query"],
 			"better-auth": DEPENDENCY_VERSIONS["better-auth"],
-			next: "~16.1.0",
-			react: "~19.2.0",
-			"react-dom": "~19.2.0"
+			next: DEPENDENCY_VERSIONS["next"],
+			react: DEPENDENCY_VERSIONS["react"],
+			"react-dom": DEPENDENCY_VERSIONS["react-dom"]
 		},
 		devDependencies: {
 			"@geekmidas/cli": GEEKMIDAS_VERSIONS["@geekmidas/cli"],
-			"@tailwindcss/postcss": "^4.0.0",
-			"@types/node": "~22.0.0",
-			"@types/react": "~19.0.0",
-			"@types/react-dom": "~19.0.0",
-			tailwindcss: "^4.0.0",
-			tsx: "~4.20.0",
-			typescript: "~5.8.2"
+			"@tailwindcss/postcss": DEPENDENCY_VERSIONS["@tailwindcss/postcss"],
+			"@types/node": DEPENDENCY_VERSIONS["@types/node"],
+			"@types/react": DEPENDENCY_VERSIONS["@types/react"],
+			"@types/react-dom": DEPENDENCY_VERSIONS["@types/react-dom"],
+			tailwindcss: DEPENDENCY_VERSIONS["tailwindcss"],
+			tsx: TOOLCHAIN_VERSIONS["tsx"],
+			typescript: TOOLCHAIN_VERSIONS["typescript"]
 		}
 	};
 	const nextConfig = `import type { NextConfig } from 'next';
@@ -13579,25 +12701,25 @@ function generateTanStackWebFiles(options) {
 			"@geekmidas/client": GEEKMIDAS_VERSIONS["@geekmidas/client"],
 			"@geekmidas/envkit": GEEKMIDAS_VERSIONS["@geekmidas/envkit"],
 			"@tanstack/react-query": DEPENDENCY_VERSIONS["@tanstack/react-query"],
-			"@tanstack/react-router": "^1.87.0",
-			"@tanstack/react-start": "^1.87.0",
+			"@tanstack/react-router": DEPENDENCY_VERSIONS["@tanstack/react-router"],
+			"@tanstack/react-start": DEPENDENCY_VERSIONS["@tanstack/react-start"],
 			"better-auth": DEPENDENCY_VERSIONS["better-auth"],
-			react: "~19.2.0",
-			"react-dom": "~19.2.0"
+			react: DEPENDENCY_VERSIONS["react"],
+			"react-dom": DEPENDENCY_VERSIONS["react-dom"]
 		},
 		devDependencies: {
 			"@geekmidas/cli": GEEKMIDAS_VERSIONS["@geekmidas/cli"],
-			"@tailwindcss/vite": "^4.0.0",
-			"@tanstack/router-plugin": "^1.87.0",
-			"@types/node": "~22.0.0",
-			"@types/react": "~19.0.0",
-			"@types/react-dom": "~19.0.0",
-			"@vitejs/plugin-react": "^4.3.4",
-			tailwindcss: "^4.0.0",
-			tsx: "~4.20.0",
-			typescript: "~5.8.2",
-			vite: "^7.0.0",
-			"vite-tsconfig-paths": "~5.1.0"
+			"@tailwindcss/vite": DEPENDENCY_VERSIONS["@tailwindcss/vite"],
+			"@tanstack/router-plugin": DEPENDENCY_VERSIONS["@tanstack/router-plugin"],
+			"@types/node": DEPENDENCY_VERSIONS["@types/node"],
+			"@types/react": DEPENDENCY_VERSIONS["@types/react"],
+			"@types/react-dom": DEPENDENCY_VERSIONS["@types/react-dom"],
+			"@vitejs/plugin-react": TOOLCHAIN_VERSIONS["@vitejs/plugin-react"],
+			tailwindcss: DEPENDENCY_VERSIONS["tailwindcss"],
+			tsx: TOOLCHAIN_VERSIONS["tsx"],
+			typescript: TOOLCHAIN_VERSIONS["typescript"],
+			vite: TOOLCHAIN_VERSIONS["vite"],
+			"vite-tsconfig-paths": DEPENDENCY_VERSIONS["vite-tsconfig-paths"]
 		}
 	};
 	const viteConfig = `import { Credentials } from '@geekmidas/envkit/credentials';
@@ -14091,8 +13213,8 @@ const AWS_REGION = /^[a-z]{2}(-gov)?-[a-z]+-\d$/;
 async function initCommand(projectName, options = {}) {
 	const cwd = process.cwd();
 	const detectedPkgManager = detectPackageManager(cwd);
-	if (options.deploy && !deployTargetChoices.some((choice) => choice.value === options.deploy)) throw new Error(`Unknown deploy target "${options.deploy}". Use ${deployTargetChoices.map((c) => c.value).join(", ")}.`);
-	if (options.region && !AWS_REGION.test(options.region)) throw new Error(`"${options.region}" is not an AWS region. Use one like eu-west-1.`);
+	if (options.deploy && !deployTargetChoices.some((choice) => choice.value === options.deploy)) throw new UnknownDeployTarget(options.deploy, deployTargetChoices.map((c) => c.value));
+	if (options.region && !AWS_REGION.test(options.region)) throw new NotAnAwsRegion(options.region);
 	if (options.stages || options.localStage || options.protectedStage) {
 		const deployed = stageList(options.stages ?? "");
 		const problems = [
@@ -14103,7 +13225,7 @@ async function initCommand(projectName, options = {}) {
 			}) : [],
 			...options.protectedStage && !deployed.includes(options.protectedStage) ? [`--protected-stage "${options.protectedStage}" is not in --stages`] : []
 		];
-		if (problems.length) throw new Error([...new Set(problems)].join("\n"));
+		if (problems.length) throw new InvalidStages([...new Set(problems)]);
 	}
 	let deployedSoFar = [];
 	prompts.override({});
@@ -14133,21 +13255,14 @@ async function initCommand(projectName, options = {}) {
 		},
 		{
 			type: options.yes ? null : "multiselect",
-			name: "services",
-			message: "Services (space to select, enter to confirm):",
-			choices: servicesChoices.map((c) => ({
+			name: "constructs",
+			message: "Constructs to declare (space to select, enter to confirm):",
+			choices: constructChoices.map((c) => ({
 				...c,
 				selected: true
 			})),
 			hint: "- Space to select. Return to submit"
 		},
-		{
-			type: options.yes ? null : "select",
-			name: "eventsBackend",
-			message: "Event backend:",
-			choices: eventsBackendChoices,
-			initial: 0
-		},
 		{
 			type: options.yes ? null : "select",
 			name: "packageManager",
@@ -14248,30 +13363,21 @@ async function initCommand(projectName, options = {}) {
 	const template = options.template || answers.template || "api";
 	const isFullstack = isFullstackTemplate(template);
 	const monorepo = isFullstack || options.monorepo || false;
-	const servicesArray = options.yes ? [
-		"db",
-		"cache",
-		"mail",
-		"storage"
-	] : answers.services || [];
-	const eventsBackend = options.yes ? "pgboss" : answers.eventsBackend;
-	const services = {
-		db: servicesArray.includes("db"),
-		cache: servicesArray.includes("cache"),
-		mail: servicesArray.includes("mail"),
-		storage: servicesArray.includes("storage"),
-		events: eventsBackend
+	const chosen = options.yes ? constructChoices.map((c) => c.value) : answers.constructs || [];
+	const constructs = {
+		database: isFullstack || chosen.includes("database"),
+		cache: chosen.includes("cache"),
+		uploads: chosen.includes("uploads"),
+		mail: chosen.includes("mail")
 	};
-	if (services.events === "pgboss") services.db = true;
 	const pkgManager = options.pm ? options.pm : options.yes ? "pnpm" : answers.packageManager ?? detectedPkgManager;
 	const deployTarget = options.deploy ?? (options.yes ? "none" : answers.deployTarget ?? "none");
-	const database = services.db;
+	const database = constructs.database;
 	const frontendFramework = isFullstack ? options.yes ? "nextjs" : answers.frontendFramework ?? "nextjs" : void 0;
 	const templateOptions = {
 		name: name$1,
 		template,
 		telescope: options.yes ? true : answers.telescope ?? true,
-		database,
 		studio: database,
 		loggerType: options.yes ? "pino" : answers.loggerType ?? "pino",
 		routesStructure: options.yes ? "centralized-endpoints" : answers.routesStructure ?? "centralized-endpoints",
@@ -14281,7 +13387,7 @@ async function initCommand(projectName, options = {}) {
 		deployTarget,
 		stages: resolveStages(options, answers),
 		...deployTarget === "sst" ? { region: options.region ?? (options.yes ? "eu-west-1" : answers.region?.trim()) } : {},
-		services,
+		constructs,
 		frontendFramework
 	};
 	const targetDir = join(cwd, name$1);
@@ -14292,23 +13398,13 @@ async function initCommand(projectName, options = {}) {
 	await mkdir(targetDir, { recursive: true });
 	const appDir = isMonorepo$1 ? join(targetDir, apiPath) : targetDir;
 	if (isMonorepo$1) await mkdir(appDir, { recursive: true });
-	const dbApps = [];
-	if (isFullstack && services.db) dbApps.push({
-		name: "api",
-		password: generateDbPassword()
-	}, {
-		name: "auth",
-		password: generateDbPassword()
-	});
 	const appFiles = baseTemplate ? [
 		...generatePackageJson(templateOptions, baseTemplate),
 		...generateConfigFiles(templateOptions, baseTemplate),
 		...generateEnvFiles(templateOptions, baseTemplate),
 		...generateSourceFiles(templateOptions, baseTemplate),
-		...generateTestFiles(templateOptions, baseTemplate),
-		...isMonorepo$1 ? [] : generateDockerFiles(templateOptions, baseTemplate, dbApps)
+		...generateTestFiles(templateOptions, baseTemplate)
 	] : [];
-	const dockerFiles = isMonorepo$1 && baseTemplate ? generateDockerFiles(templateOptions, baseTemplate, dbApps) : [];
 	const rootFiles = baseTemplate ? [
 		...generateAgentFiles(templateOptions, baseTemplate),
 		...generateGithubFiles(templateOptions),
@@ -14324,11 +13420,6 @@ async function initCommand(projectName, options = {}) {
 		await mkdir(dirname(fullPath), { recursive: true });
 		await writeFile(fullPath, content);
 	}
-	for (const { path, content } of dockerFiles) {
-		const fullPath = join(targetDir, path);
-		await mkdir(dirname(fullPath), { recursive: true });
-		await writeFile(fullPath, content);
-	}
 	for (const { path, content } of appFiles) {
 		const fullPath = join(appDir, path);
 		await mkdir(dirname(fullPath), { recursive: true });
@@ -14350,30 +13441,14 @@ async function initCommand(projectName, options = {}) {
 		await writeFile(fullPath, content);
 	}
 	console.log("🔐 Initializing encrypted secrets...\n");
-	const secretServices = [];
-	if (services.db) secretServices.push("postgres");
-	if (services.cache) secretServices.push("redis");
-	if (services.storage) secretServices.push("minio");
-	if (services.mail) secretServices.push("mailpit");
-	if (services.events === "sns") secretServices.push("localstack");
-	if (services.events === "rabbitmq") secretServices.push("rabbitmq");
 	const local = templateOptions.stages.local;
-	const devSecrets = createStageSecrets(local, secretServices, {
-		projectName: name$1,
-		eventsBackend: services.events
-	});
+	const devSecrets = createStageSecrets(local, [], { projectName: name$1 });
 	const customSecrets = {
 		PORT: "3000",
 		LOG_LEVEL: "debug",
 		JWT_SECRET: `dev-${Date.now()}-${Math.random().toString(36).slice(2)}`
 	};
-	if (isFullstack && dbApps.length > 0) {
-		for (const app of dbApps) {
-			const urlKey = `${app.name.toUpperCase()}_DATABASE_URL`;
-			customSecrets[urlKey] = generateDbUrl(app.name, app.password, name$1);
-			const passwordKey = `${app.name.toUpperCase()}_DB_PASSWORD`;
-			customSecrets[passwordKey] = app.password;
-		}
+	if (isFullstack) {
 		customSecrets.AUTH_PORT = "3002";
 		customSecrets.AUTH_URL = "http://localhost:3002";
 		customSecrets.BETTER_AUTH_SECRET = `better-auth-${Date.now()}-${Math.random().toString(36).slice(2)}`;
@@ -14438,12 +13513,8 @@ function printNextSteps(projectName, options, pkgManager) {
 	console.log("\n✅ Project created successfully!\n");
 	console.log("Next steps:\n");
 	console.log(`  ${cdCommand}`);
-	if (options.services.db && options.monorepo) {
-		console.log(`  # Start PostgreSQL (if not running)`);
-		console.log(`  docker compose up -d postgres`);
-	}
 	console.log(`  ${devCommand$1}`);
-	if (!options.monorepo && options.services.db) {
+	if (!options.monorepo && options.constructs.database) {
 		console.log("");
 		console.log("  # Then, once the container is up:");
 		console.log(`  gkm exec -- pnpm kysely migrate:latest`);
@@ -14489,7 +13560,7 @@ function printNextSteps(projectName, options, pkgManager) {
 		console.log("🚀 Deployment (AWS, through SST):");
 		for (const stage of deployed) console.log(`  ${getRunCommand(pkgManager, `deploy:${stage}`)}  # gkm build --provider aws, then sst deploy`);
 		console.log(`  Uses your AWS credentials, in ${options.region}.`);
-		if (options.services.mail) console.log("  Set MAIL_FROM to a sender verified in SES first.");
+		if (options.constructs.mail) console.log("  Set MAIL_FROM to a sender verified in SES first.");
 		console.log("");
 	}
 	console.log("📚 Documentation: https://geekmidas.github.io/toolbox/");
@@ -14511,22 +13582,31 @@ function resolveStages(options, answers) {
 		...kept ? { protected: [kept] } : {}
 	};
 	const problems = stageProblems(stages);
-	if (problems.length) throw new Error(problems.join("\n"));
+	if (problems.length) throw new InvalidStages(problems);
 	return stages;
 }
+/** `--deploy` naming a target init has no scaffold for. */
+var UnknownDeployTarget = class extends Error {
+	constructor(target, known) {
+		super(`Unknown deploy target "${target}". Use ${known.join(", ")}.`);
+		this.target = target;
+		this.known = known;
+		this.name = "UnknownDeployTarget";
+	}
+};
+/** `--region` that is not shaped like one, e.g. `europe` for `eu-west-1`. */
+var NotAnAwsRegion = class extends Error {
+	constructor(region) {
+		super(`"${region}" is not an AWS region. Use one like eu-west-1.`);
+		this.region = region;
+		this.name = "NotAnAwsRegion";
+	}
+};
 
 //#endregion
 //#region src/secrets/index.ts
 const logger$1 = console;
 /**
-* Extract service names from compose config.
-*/
-function getServicesFromConfig(services) {
-	if (!services) return [];
-	if (Array.isArray(services)) return services;
-	return Object.entries(services).filter(([, config]) => config).map(([name$1]) => name$1);
-}
-/**
 * Initialize secrets for a stage.
 * Generates secure random passwords for configured services.
 */
@@ -14536,9 +13616,6 @@ async function secretsInitCommand(options) {
 		logger$1.error(`Secrets already exist for stage "${stage}". Use --force to overwrite.`);
 		process.exit(1);
 	}
-	const config = await loadConfig();
-	const services = getServicesFromConfig(config.docker?.compose?.services);
-	if (services.length === 0) logger$1.warn("No services configured in docker.compose.services. Creating secrets with empty services.");
 	let projectName;
 	let workspaceSecrets;
 	try {
@@ -14550,13 +13627,11 @@ async function secretsInitCommand(options) {
 			logger$1.log("  Detected workspace mode — generating per-app secrets");
 		}
 	} catch {}
-	const secrets = createStageSecrets(stage, services, { projectName });
+	const secrets = createStageSecrets(stage, [], { projectName });
 	if (workspaceSecrets) secrets.custom = workspaceSecrets;
 	await writeStageSecrets(secrets);
 	logger$1.log(`\n✓ Secrets initialized for stage "${stage}"`);
 	logger$1.log(`  Location: .gkm/secrets/${stage}.json`);
-	logger$1.log("\n  Generated credentials for:");
-	for (const service of services) logger$1.log(`    - ${service}`);
 	if (secrets.urls.DATABASE_URL) logger$1.log(`\n  DATABASE_URL: ${maskUrl(secrets.urls.DATABASE_URL)}`);
 	if (secrets.urls.REDIS_URL) logger$1.log(`  REDIS_URL: ${maskUrl(secrets.urls.REDIS_URL)}`);
 	if (secrets.urls.RABBITMQ_URL) logger$1.log(`  RABBITMQ_URL: ${maskUrl(secrets.urls.RABBITMQ_URL)}`);
@@ -14726,11 +13801,11 @@ function maskUrl(url) {
 async function testCommand(options = {}) {
 	const cwd = process.cwd();
 	const stage = options.stage ?? await loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace.stages.local).catch(() => void 0);
-	if (!stage) throw new Error("No stage to test with: add `stages` to gkm.config.ts, or pass --stage.");
+	if (!stage) throw new NoStageToTest();
 	console.log(`\n🧪 Running tests with ${stage} environment...\n`);
 	const autoSetup = options.autoSetup || Boolean(process.env.GKM_AUTO_SETUP);
 	if (autoSetup) {
-		const { ensureStageSecrets } = await import("./setup-BA8ciTPU.mjs");
+		const { ensureStageSecrets } = await import("./setup-BmLoNrDX.mjs");
 		const generated = await ensureStageSecrets(stage, cwd);
 		if (generated) console.log(`  🔐 Generated fresh ${stage} secrets (auto-setup)`);
 	}
@@ -14817,6 +13892,13 @@ function rewriteDatabaseUrlForTests(env) {
 	}
 	return result;
 }
+/** `gkm test` outside a project that declares stages, with none named. */
+var NoStageToTest = class extends Error {
+	constructor() {
+		super("No stage to test with: add `stages` to gkm.config.ts, or pass --stage.");
+		this.name = "NoStageToTest";
+	}
+};
 
 //#endregion
 //#region src/upgrade/version.ts
@@ -15359,14 +14441,14 @@ program.command("secrets:push").description("Push secrets to remote provider (SS
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await import("./config.mjs");
-		const { pushSecrets } = await import("./sync-hOqAWHR6.mjs");
-		const { reconcileMissingSecrets } = await import("./reconcile-CFs8C_1a.mjs");
-		const { readStageSecrets: readStageSecrets$1, writeStageSecrets: writeStageSecrets$1 } = await import("./storage-CYlGwWTj.mjs");
+		const { pushSecrets } = await import("./sync-HAau6h_R.mjs");
+		const { reconcileMissingSecrets } = await import("./reconcile-BI0tWkwz.mjs");
+		const { readStageSecrets: readStageSecrets$1, writeStageSecrets: writeStageSecrets$1 } = await import("./storage-DGBzMLZa.mjs");
 		const { workspace } = await loadWorkspaceConfig$1();
 		const secrets = await readStageSecrets$1(options.stage, workspace.root);
 		if (secrets) {
-			const { derivedContainers: derivedContainers$1 } = await import("./workspace-BzrG_2SI.mjs");
-			const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers$1(workspace, options.stage));
+			const { derivedContainers } = await import("./workspace-CkJAtRIX.mjs");
+			const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, options.stage));
 			if (result) {
 				await writeStageSecrets$1(result.secrets, workspace.root);
 				console.log(`  Reconciled ${result.addedKeys.length} missing secret(s):`);
@@ -15385,17 +14467,17 @@ program.command("secrets:pull").description("Pull secrets from remote provider (
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await import("./config.mjs");
-		const { pullSecrets } = await import("./sync-hOqAWHR6.mjs");
-		const { writeStageSecrets: writeStageSecrets$1 } = await import("./storage-CYlGwWTj.mjs");
-		const { reconcileMissingSecrets } = await import("./reconcile-CFs8C_1a.mjs");
+		const { pullSecrets } = await import("./sync-HAau6h_R.mjs");
+		const { writeStageSecrets: writeStageSecrets$1 } = await import("./storage-DGBzMLZa.mjs");
+		const { reconcileMissingSecrets } = await import("./reconcile-BI0tWkwz.mjs");
 		const { workspace } = await loadWorkspaceConfig$1();
 		let secrets = await pullSecrets(options.stage, workspace);
 		if (!secrets) {
 			console.error(`No remote secrets found for stage "${options.stage}".`);
 			process.exit(1);
 		}
-		const { derivedContainers: derivedContainers$1 } = await import("./workspace-BzrG_2SI.mjs");
-		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers$1(workspace, options.stage));
+		const { derivedContainers } = await import("./workspace-CkJAtRIX.mjs");
+		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, options.stage));
 		if (result) {
 			secrets = result.secrets;
 			console.log(`  Reconciled ${result.addedKeys.length} missing secret(s):`);
@@ -15413,8 +14495,8 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await import("./config.mjs");
-		const { reconcileMissingSecrets } = await import("./reconcile-CFs8C_1a.mjs");
-		const { readStageSecrets: readStageSecrets$1, writeStageSecrets: writeStageSecrets$1 } = await import("./storage-CYlGwWTj.mjs");
+		const { reconcileMissingSecrets } = await import("./reconcile-BI0tWkwz.mjs");
+		const { readStageSecrets: readStageSecrets$1, writeStageSecrets: writeStageSecrets$1 } = await import("./storage-DGBzMLZa.mjs");
 		const { workspace } = await loadWorkspaceConfig$1();
 		const stage = options.stage ?? workspace.stages.local;
 		const secrets = await readStageSecrets$1(stage, workspace.root);
@@ -15422,8 +14504,8 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers: derivedContainers$1 } = await import("./workspace-BzrG_2SI.mjs");
-		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers$1(workspace, stage));
+		const { derivedContainers } = await import("./workspace-CkJAtRIX.mjs");
+		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
 			return;
@@ -15477,6 +14559,17 @@ program.command("deploy:init").description("Initialize Dokploy deployment (creat
 		process.exit(1);
 	}
 });
+program.command("deploy:github").description("Let GitHub Actions deploy a stage: OIDC role in the stage's AWS account, and the GitHub environment the deploy workflow uses").requiredOption("--stage <stage>", "A deployed stage from gkm.config.ts").option("--profile <profile>", "AWS profile for the stage's account").option("--repo <owner/name>", "GitHub repository (default: this one)").option("--policy-arn <arn>", "Policy for the deploy role (default: AdministratorAccess)").option("--dry-run", "Show the plan without changing AWS or GitHub").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		const { deployGithubCommand } = await import("./github-DpMZurEK.mjs");
+		await deployGithubCommand(options);
+	} catch (error) {
+		console.error(formatError(error));
+		process.exit(1);
+	}
+});
 program.command("deploy:list").description("List Dokploy resources (projects, registries)").option("--endpoint <url>", "Dokploy server URL (uses stored credentials if logged in)").option("--projects", "List projects").option("--registries", "List registries").action(async (options) => {
 	try {
 		const globalOptions = program.opts();