@geekmidas/cli 10.0.0-alpha.2 → 10.0.0-alpha.21

package/dist/{credentials-BZcp3CGx.mjs → credentials-CD8ftUS6.mjs}

@@ -1,63 +1,38 @@
-import { DEFAULT_CACHE, DEFAULT_EMAIL, DEFAULT_STORAGE, discover } from "./discover-CAlFgYec.mjs";
-import { appKey, getAppNameFromCwd, hostOf, loadWorkspaceAppInfo } from "./config-CzWnfcXM.mjs";
-import { allConstructGlobs, getDependencyEnvVars } from "./workspace-7FqprxuJ.mjs";
-import { generatePgBossUrl } from "./generator-VE2JrFlY.mjs";
-import { readStageSecrets, secretsExist, toEmbeddableSecrets } from "./storage-Bi24WfoW.mjs";
+import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
+import { a as DEFAULT_EVENTS$1, i as DEFAULT_CACHE, o as DEFAULT_STORAGE, t as discover } from "./discover-CK-n3w6b.mjs";
+import { a as loadWorkspaceAppInfo, c as appKey, n as getAppNameFromCwd, o as loadWorkspaceConfig } from "./config-DdKkoUE1.mjs";
+import { s as getDependencyEnvVars, t as allConstructGlobs, w as TEST_STAGE } from "./workspace-Bu3xNCej.mjs";
+import { r as generatePgBossUrl } from "./generator-LfZU7NlU.mjs";
+import { n as readStageSecrets, o as toEmbeddableSecrets, r as secretsExist } from "./storage-TP0x118M.mjs";
 import { existsSync, readFileSync } from "node:fs";
+import { mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
-import { DEFAULT_POSTGRES_VERSION, cacheTable, cookieDomain, dependentsOf, provideKey, providedKeyFor, provisionOrder, publicEnvFor } from "@geekmidas/manifest";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { execFile, execSync } from "node:child_process";
+import { DEFAULT_POSTGRES_VERSION, cacheTable, cookieDomain, dependentsOf, provideKey, providedKeyFor, provisionOrder, publicEnvFor } from "@geekmidas/manifest";
 import { createServer } from "node:net";
 import { config } from "dotenv";
 import { parse as parse$1, stringify } from "yaml";
+import { createHash } from "node:crypto";
+import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
 import { CreateBucketCommand, GetBucketPolicyCommand, HeadBucketCommand, PutBucketPolicyCommand, S3Client } from "@aws-sdk/client-s3";
 import { Client } from "pg";
 import { promisify } from "node:util";
-import { createHash } from "node:crypto";
-import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
 import { cacheTableStatements } from "@geekmidas/cache/postgres";
-
 //#region src/workspace/backends.ts
-const CACHE_BACKENDS = [
-	"upstash",
-	"elasticache",
-	"db"
-];
-const EMAIL_BACKENDS = [
-	"resend",
-	"ses",
-	"smtp"
-];
-const STORAGE_BACKENDS = [
-	"minio",
-	"s3",
-	"r2"
-];
-/**
-* The cache backend a workspace selected, or the one its target implies.
-*
-* Defaulted here rather than by every caller, so "what happens when nobody
-* said" is answered once and the answer is greppable — and now answered by
-* *where it deploys*, because there is no single right answer for both a
-* Lambda and a box running its own Postgres.
-*
-* `on` is the deploy target, not where this code happens to be running. A
-* local `gkm dev` for an AWS app still defaults to Upstash, because a backend
-* that differed between local and deployed would be worse than a slower one —
-* which is the property the type's own documentation asks for.
-*/
-function cacheBackendOf(value, on = "aws") {
-	return isBackend(value, CACHE_BACKENDS) ? value : DEFAULT_CACHE[on];
-}
-/** The email backend a workspace selected, defaulting to SES on every target. */
-function emailBackendOf(value) {
-	return isBackend(value, EMAIL_BACKENDS) ? value : DEFAULT_EMAIL;
-}
-/** The storage backend a workspace selected, or the one its target implies. */
-function storageBackendOf(value, on = "aws") {
-	return isBackend(value, STORAGE_BACKENDS) ? value : DEFAULT_STORAGE[on];
-}
+/**
+* Which backend each declared kind resolves to — decided by where the project
+* deploys, and by nothing else.
+*
+* These used to be read out of a `services:` block, where one key answered two
+* questions: *does this exist* and *what backs it*. The first is the manifest's
+* — a declared `Cache` is why there is a cache — and the second is the deploy
+* target's, because the right cache for a Lambda is not the right cache for a
+* box already running Postgres. With both answered elsewhere there was nothing
+* left for the block to say, so it is gone and these read the target.
+*
+* Mail has no answer here at all: every provider speaks SMTP, so the provider
+* is whichever one the stage's mail URL points at.
+*/
 /**
 * Which family of defaults a workspace's deploy target belongs to.
 *
@@ -76,17 +51,162 @@ function providerOf(workspace) {
 	return target === "dokploy" || target === "server" ? "server" : "aws";
 }
 /**
-* Whether a string names a backend, as opposed to being one of the other things
-* a `services:` value can be.
+* The cache backend a target implies.
 *
-* A misspelling falls through to the default rather than throwing, which is the
-* wrong trade for something with a cost attached — so callers that can report it
-* should use {@link unknownBackend} to say so.
+* The same answer locally and deployed: a local `gkm dev` for an AWS app still
+* uses the Upstash protocol, because a backend that differed between the two
+* would be worse than a slower one.
 */
-function isBackend(value, backends) {
-	return typeof value === "string" && backends.includes(value);
+function cacheBackendFor(on) {
+	return DEFAULT_CACHE[on];
+}
+/** Where a declared bucket lives on a target. */
+function storageBackendFor(on) {
+	return DEFAULT_STORAGE[on];
+}
+/**
+* Which broker carries declared queues and topics on a target.
+*
+* Only consulted when something declares one; a project with no `Topic` or
+* `Queue` has no events at all, whatever the target.
+*/
+function eventsBackendFor(on) {
+	return DEFAULT_EVENTS$1[on];
+}
+//#endregion
+//#region src/reconcile/containers.ts
+/**
+* What gkm knows about each container it can derive.
+*
+* Everything provider-specific about the local target lives here: the image, the
+* ports the image listens on, and whether its data is worth keeping. The plan
+* says *which* containers exist and never says any of this, which is the split
+* the design asks for — neutral facts from the declaration, provider detail
+* from here and from config.
+*
+* Shared by allocation and by the compose writer so the two cannot disagree
+* about how many ports a container needs.
+*/
+/**
+* The Postgres image for a major version.
+*
+* One place that knows the tag shape, so a declared version reaches the
+* container without anyone restating `-alpine` beside it.
+*/
+function postgresImage(version) {
+	return `postgres:${version}-alpine`;
+}
+/**
+* The default image for each container.
+*
+* Pinned to a major rather than `latest` where the image publishes one, so a
+* rebuild does not silently move a developer's Postgres a version. Overridable
+* per project: a project needing `postgis/postgis` says so in config.
+*/
+const DEFAULT_IMAGES = {
+	postgres: postgresImage(DEFAULT_POSTGRES_VERSION),
+	minio: "pgsty/minio:RELEASE.2026-08-04T00-00-00Z",
+	mailpit: "axllent/mailpit:latest",
+	redis: "redis:8-alpine",
+	"redis-http": "hiett/serverless-redis-http:latest",
+	rabbitmq: "rabbitmq:4-management-alpine",
+	localstack: "floci/floci:latest",
+	caddy: "caddy:2-alpine"
+};
+/**
+* The ports each container listens on.
+*
+* The first is always the one an app connects to; the rest are consoles and
+* management UIs, published because a bucket or an inbox you can look at is most
+* of why these are real containers rather than stubs.
+*/
+const PORTS = {
+	postgres: [{
+		key: "postgres",
+		inside: 5432,
+		label: "postgres"
+	}],
+	minio: [{
+		key: "minio",
+		inside: 9e3,
+		label: "minio api"
+	}, {
+		key: "minio-console",
+		inside: 9001,
+		label: "minio console"
+	}],
+	mailpit: [{
+		key: "mailpit",
+		inside: 1025,
+		label: "smtp"
+	}, {
+		key: "mailpit-web",
+		inside: 8025,
+		label: "mailpit inbox"
+	}],
+	redis: [{
+		key: "redis",
+		inside: 6379,
+		label: "redis"
+	}],
+	"redis-http": [{
+		key: "redis-http",
+		inside: 80,
+		label: "cache"
+	}],
+	rabbitmq: [{
+		key: "rabbitmq",
+		inside: 5672,
+		label: "amqp"
+	}, {
+		key: "rabbitmq-management",
+		inside: 15672,
+		label: "rabbitmq console"
+	}],
+	localstack: [{
+		key: "localstack",
+		inside: 4566,
+		label: "localstack"
+	}],
+	caddy: [{
+		key: "caddy",
+		inside: 443,
+		label: "https edge"
+	}]
+};
+/** The ports a container needs published. Empty for one gkm does not know. */
+function portsOf(container) {
+	return PORTS[container] ?? [];
+}
+/** The key a container's primary port is allocated under. */
+function primaryPortKey(container) {
+	return portsOf(container)[0]?.key ?? container;
+}
+/**
+* Every port key a set of containers needs, in a stable order.
+*
+* What allocation is handed: it assigns ports to names and knows nothing about
+* what listens on them.
+*/
+function portKeys(containers) {
+	return [...containers].sort().flatMap((container) => portsOf(container).map((port) => port.key));
+}
+/**
+* The named volume a container's data lives in.
+*
+* Mailpit deliberately has none: local mail is disposable, and an inbox that
+* survives days of dev is noise rather than state.
+*/
+function volumeOf(container) {
+	return {
+		postgres: "postgres-data",
+		minio: "minio-data",
+		redis: "redis-data",
+		rabbitmq: "rabbitmq-data",
+		localstack: "localstack-data",
+		caddy: "caddy-data"
+	}[container];
 }
-
 //#endregion
 //#region src/reconcile/caddyfile.ts
 /**
@@ -163,7 +283,7 @@ function portOf(address) {
 		const { port, protocol } = new URL(address);
 		return port || (protocol === "https:" ? "443" : "80");
 	} catch {
-		return void 0;
+		return;
 	}
 }
 /**
@@ -246,1139 +366,1200 @@ const GENERATED = `# Generated by gkm from the construct manifest — do not edi
 # root and point Node at it, so nothing has to be installed to use these URLs
 # from code; a browser needs the root trusted once.
 `;
-
 //#endregion
-//#region src/reconcile/clients.ts
-/** The credential local containers are brought up with. */
-const LOCAL_USER$2 = "geekmidas";
+//#region src/reconcile/plan.ts
 /**
-* A Postgres client that opens one connection per database it is asked about.
+* The reconcile plan — what a manifest wants to exist, for one stage.
 *
-* `CREATE DATABASE` cannot run from a connection to the database being created,
-* and a schema must be created from inside its own database — so the database is
-* part of each query rather than fixed when the client is built.
+* Pure. Turning the plan into running containers and provisioned resources is
+* the applier's job; deciding *what* should exist is this, so the decisions can
+* be asserted as data rather than by starting Docker.
+*
+* One plan serves every stage. `gkm dev` reconciles `development` and `gkm test`
+* reconciles `test`; they differ only in what the resources are called, never in
+* what infrastructure exists. Roles are cluster-scoped in Postgres while grants
+* are per-object, so one container and one role pair serve both.
 */
-function pgClient(port) {
-	return { async query(database, sql, values) {
-		const client = new Client({
-			host: "localhost",
-			port,
-			user: LOCAL_USER$2,
-			password: LOCAL_USER$2,
-			database: database ?? LOCAL_USER$2
-		});
-		await client.connect();
-		try {
-			const result = await client.query(sql, values);
-			return result.rows;
-		} finally {
-			await client.end();
-		}
-	} };
-}
-/** A bucket client pointed at the local MinIO. */
-function bucketClient(port) {
-	const s3 = new S3Client({
-		region: "us-east-1",
-		endpoint: `http://localhost:${port}`,
-		forcePathStyle: true,
-		credentials: {
-			accessKeyId: LOCAL_USER$2,
-			secretAccessKey: LOCAL_USER$2
-		}
-	});
-	return {
-		async exists(bucket) {
-			try {
-				await s3.send(new HeadBucketCommand({ Bucket: bucket }));
-				return true;
-			} catch {
-				return false;
-			}
-		},
-		async create(bucket) {
-			await s3.send(new CreateBucketCommand({ Bucket: bucket }));
-		},
-		async policy(bucket) {
-			try {
-				const result = await s3.send(new GetBucketPolicyCommand({ Bucket: bucket }));
-				return result.Policy;
-			} catch {
-				return void 0;
-			}
-		},
-		async setPolicy(bucket, policy) {
-			await s3.send(new PutBucketPolicyCommand({
-				Bucket: bucket,
-				Policy: policy
-			}));
-		}
-	};
-}
-
-//#endregion
-//#region src/reconcile/containers.ts
 /**
-* What gkm knows about each container it can derive.
-*
-* Everything provider-specific about the local target lives here: the image, the
-* ports the image listens on, and whether its data is worth keeping. The plan
-* says *which* containers exist and never says any of this, which is the split
-* the design asks for — neutral facts from the declaration, provider detail
-* from here and from config.
+* Which container serves a kind.
 *
-* Shared by allocation and by the compose writer so the two cannot disagree
-* about how many ports a container needs.
+* Derived kinds map to the same container as their parent — a schema tenant
+* lives in its parent's Postgres — so the set is deduplicated rather than
+* counted.
 */
+const CONTAINERS = {
+	database: "postgres",
+	"database-reader": "postgres",
+	"database-schema": "postgres",
+	objects: "minio",
+	"file-server": "caddy",
+	email: "mailpit"
+};
 /**
-* The Postgres image for a major version.
+* The container a cache backend needs locally.
 *
-* One place that knows the tag shape, so a declared version reaches the
-* container without anyone restating `-alpine` beside it.
+* Each one matches the protocol its deployed form speaks, which is the property
+* worth having: a cache that behaves differently in the two places is worse than
+* a slower one.
+*
+* `db` is deliberately absent, the same way `pgboss` is absent from
+* `EVENT_CONTAINERS`: the cache is a table in a database the manifest already
+* declares, so mapping it here would start a container for a project that needs
+* none.
 */
-function postgresImage(version) {
-	return `postgres:${version}-alpine`;
-}
+const CACHE_CONTAINERS = {
+	upstash: "redis-http",
+	elasticache: "redis"
+};
 /**
-* The default image for each container.
+* Kinds that resolve a value without anything running.
 *
-* Pinned to a major rather than `latest` where the image publishes one, so a
-* rebuild does not silently move a developer's Postgres a version. Overridable
-* per project: a project needing `postgis/postgis` says so in config.
-*/
-const DEFAULT_IMAGES = {
-	postgres: postgresImage(DEFAULT_POSTGRES_VERSION),
-	minio: "quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z",
-	mailpit: "axllent/mailpit:latest",
-	redis: "redis:8-alpine",
-	"redis-http": "hiett/serverless-redis-http:latest",
-	rabbitmq: "rabbitmq:4-management-alpine",
-	localstack: "floci/floci:latest",
-	caddy: "caddy:2-alpine"
+* A secret is the case: it has no address, so there is nothing to start and
+* nothing to connect to — but it still appears in the plan, because the target
+* still has to resolve it.
+*/
+const CONTAINERLESS = {
+	secret: true,
+	credential: true,
+	"rest-api": true,
+	site: true
 };
 /**
-* The ports each container listens on.
+* Containers that cannot run alone.
 *
-* The first is always the one an app connects to; the rest are consoles and
-* management UIs, published because a bucket or an inbox you can look at is most
-* of why these are real containers rather than stubs.
+* The one case is the cache: `serverless-redis-http` is a proxy and needs the
+* Redis it proxies. Kept here rather than in the compose definition so the plan
+* -- which is what decides what must be running -- still names everything.
 */
-const PORTS = {
-	postgres: [{
-		key: "postgres",
-		inside: 5432,
-		label: "postgres"
-	}],
-	minio: [{
-		key: "minio",
-		inside: 9e3,
-		label: "minio api"
-	}, {
-		key: "minio-console",
-		inside: 9001,
-		label: "minio console"
-	}],
-	mailpit: [{
-		key: "mailpit",
-		inside: 1025,
-		label: "smtp"
-	}, {
-		key: "mailpit-web",
-		inside: 8025,
-		label: "mailpit inbox"
-	}],
-	redis: [{
-		key: "redis",
-		inside: 6379,
-		label: "redis"
-	}],
-	"redis-http": [{
-		key: "redis-http",
-		inside: 80,
-		label: "cache"
-	}],
-	rabbitmq: [{
-		key: "rabbitmq",
-		inside: 5672,
-		label: "amqp"
-	}, {
-		key: "rabbitmq-management",
-		inside: 15672,
-		label: "rabbitmq console"
-	}],
-	localstack: [{
-		key: "localstack",
-		inside: 4566,
-		label: "localstack"
-	}],
-	caddy: [{
-		key: "caddy",
-		inside: 443,
-		label: "https edge"
-	}]
+const REQUIRES = { "redis-http": ["redis"] };
+/**
+* The role each kind's one key plays, where it is not a URL.
+*
+* The twin of `ProvidesByKind` in `@geekmidas/manifest`: that is what a
+* construct declares, this is what the local target resolves, and both derive
+* the key from the same `provideKey` so they cannot disagree.
+*/
+const ROLES = {
+	queue: "publisherConnectionString",
+	topic: "publisherConnectionString",
+	credential: "credential"
+};
+/** The kinds whose container is the events backend's rather than their own. */
+const EVENT_KINDS = {
+	queue: true,
+	topic: true
 };
-/** The ports a container needs published. Empty for one gkm does not know. */
-function portsOf(container) {
-	return PORTS[container] ?? [];
-}
-/** The key a container's primary port is allocated under. */
-function primaryPortKey(container) {
-	return portsOf(container)[0]?.key ?? container;
-}
 /**
-* Every port key a set of containers needs, in a stable order.
+* Which kinds provision something *inside* their container.
 *
-* What allocation is handed: it assigns ports to names and knows nothing about
-* what listens on them.
+* A database creates a database, a bucket creates a bucket; mail creates
+* nothing — Mailpit accepts whatever is sent to it and has no per-stage object
+* to name. Both still appear in the plan, because both still resolve a URL; the
+* flag is the difference between "must be running" and "must be created".
 */
-function portKeys(containers) {
-	return [...containers].sort().flatMap((container) => portsOf(container).map((port) => port.key));
-}
+const PROVISIONS = {
+	database: true,
+	"database-reader": true,
+	"database-schema": true,
+	objects: true,
+	cache: true,
+	"file-server": true
+};
 /**
-* The named volume a container's data lives in.
+* The container each events backend needs, where it needs one of its own.
 *
-* Mailpit deliberately has none: local mail is disposable, and an inbox that
-* survives days of dev is noise rather than state.
+* `pgboss` is deliberately absent rather than mapped to `postgres`: it is a
+* schema tenant in a database the manifest already declares, so mapping it here
+* would start a Postgres for a project that declared no database at all.
+*
+* This one comes from config rather than from a declaration because there are
+* no `topic` or `queue` kinds yet. When they land the mapping moves to
+* {@link CONTAINERS} keyed by kind, and this constant goes with them.
 */
-function volumeOf(container) {
-	const volumes = {
-		postgres: "postgres-data",
-		minio: "minio-data",
-		redis: "redis-data",
-		rabbitmq: "rabbitmq-data",
-		localstack: "localstack-data",
-		caddy: "caddy-data"
-	};
-	return volumes[container];
+const EVENT_CONTAINERS = {
+	sns: "localstack",
+	rabbitmq: "rabbitmq"
+};
+/** The backend a project gets when it declares queues or topics and says nothing. */
+const DEFAULT_EVENTS = "pgboss";
+/**
+* How a resource of each kind separates its stage suffix.
+*
+* Postgres identifiers are snake_case and a hyphen would need quoting
+* everywhere; buckets and queues are kebab and disallow underscores in some
+* providers. The suffix is the same word either way.
+*/
+const SEPARATORS = {
+	database: "_",
+	"database-reader": "_",
+	"database-schema": "_",
+	objects: "-"
+};
+/**
+* The stage-scoped name for a resource.
+*
+* The local stage carries no suffix, so `gkm dev` keeps using `orders` and a
+* developer's psql history, saved connections, and muscle memory survive a
+* change of stage name. Every other stage is suffixed.
+*/
+function resourceName(id, kind, stage, localStage) {
+	const base = id.toLowerCase();
+	if (stage === localStage) return base;
+	return `${base}${SEPARATORS[kind] ?? "-"}${stage}`;
 }
-
-//#endregion
-//#region src/reconcile/compose.ts
-/** The credential every derived container is brought up with locally. */
-const LOCAL_USER$1 = "geekmidas";
 /**
-* The token the local cache accepts.
+* The container a kind needs, or `undefined` if it needs none.
 *
-* Fixed rather than generated: it is only ever reachable on a port this project
-* published, and the URL that carries it is derived, so nothing is made safer
-* by making it unguessable and a stable one keeps `redis-cli` sessions working.
+* Queues and topics have no container of their own — they live in whichever
+* broker the project selected, which is why the backend is an argument here
+* rather than a second pass that adds containers after the fact.
 */
-const LOCAL_TOKEN$1 = "geekmidas";
+function containerFor(kind, events = DEFAULT_EVENTS, cache = DEFAULT_CACHE.aws, derived = false, edge = true) {
+	if (EVENT_KINDS[kind]) return EVENT_CONTAINERS[events] ?? CONTAINERS.database;
+	if (kind === "file-server") return edge ? "caddy" : CONTAINERS.objects;
+	if (kind === "cache") {
+		if (derived) return CONTAINERS.database;
+		return CACHE_CONTAINERS[cache] ?? CONTAINERS.database;
+	}
+	return CONTAINERS[kind];
+}
 /**
-* Build the compose document for a plan.
+* Build the plan for a manifest and stage.
 *
-* Every container is published on its assigned port, never on the image's
-* default: the point of allocation is that two projects can run at once, and
-* one container publishing 5432 puts that back.
+* `order` is the caller's provisioning order — parents before children — which
+* `provisionOrder` produces from the manifest. Passing it in keeps this
+* function free of the traversal and makes the ordering assertable on its own.
 */
-function composeFor(plan, options) {
-	const services = {};
-	const volumes = {};
-	for (const container of [...plan.containers].sort()) {
-		const declared = container === "postgres" ? plan.resources.find((r) => r.version)?.version : void 0;
-		const image = options.images?.[container] ?? (declared ? postgresImage(declared) : DEFAULT_IMAGES[container]);
-		if (!image) throw new UnknownContainer(container);
-		services[container] = define(container, image, publish(container, options.ports));
-		const volume = volumeOf(container);
-		if (volume) volumes[volume] = {};
+function planFor(manifest, stage, order, options = {}) {
+	const containers = /* @__PURE__ */ new Set();
+	const resources = [];
+	const events = options.events ?? "pgboss";
+	const cache = options.cache ?? DEFAULT_CACHE.aws;
+	for (const id of order) {
+		const declaration = manifest[id];
+		if (!declaration) continue;
+		const container = containerFor(declaration.kind, events, cache, "of" in declaration && typeof declaration.of === "string", options.edge !== false);
+		if (!container && !CONTAINERLESS[declaration.kind]) continue;
+		if (container) {
+			containers.add(container);
+			for (const required of REQUIRES[container] ?? []) containers.add(required);
+		}
+		resources.push({
+			id,
+			kind: declaration.kind,
+			...container ? { container } : {},
+			name: resourceName(id, declaration.kind, stage, options.localStage),
+			envKey: providedKeyFor(id, declaration.kind, ROLES[declaration.kind] ?? "url"),
+			provisions: PROVISIONS[declaration.kind] === true,
+			...declaration.kind === "rest-api" ? { callers: dependentsOf(manifest, id) } : {},
+			...declaration.kind === "site" ? { publicEnv: publicEnvFor(declaration, manifest) } : {},
+			...declaration.kind === "file-server" && declaration.open?.length ? { open: declaration.open } : {},
+			..."of" in declaration ? { of: declaration.of } : {},
+			..."schema" in declaration && declaration.schema ? { schema: declaration.schema } : {},
+			..."version" in declaration && declaration.version ? { version: declaration.version } : {},
+			..."roles" in declaration && declaration.roles === false ? { roles: false } : {},
+			..."table" in declaration && declaration.table ? { table: declaration.table } : {}
+		});
+	}
+	if (options.edge !== false && resources.some((r) => EDGE_KINDS[r.kind] === true)) containers.add("caddy");
+	for (const extra of options.extraContainers ?? []) containers.add(extra);
+	if (events === "pgboss" && resources.some((r) => EVENT_KINDS[r.kind]) && !resources.some((r) => r.kind === "database")) throw new PgBossNeedsDatabase(resources.filter((r) => EVENT_KINDS[r.kind]).map((r) => r.id));
+	if (cache === "db") {
+		const placeless = resources.filter((r) => r.kind === "cache" && !r.of);
+		if (placeless.length > 0) {
+			const databases = resources.filter((r) => r.kind === "database");
+			const [only] = databases;
+			if (!only) throw new CacheNeedsDatabase(resources.filter((r) => r.kind === "cache").map((r) => r.id));
+			if (databases.length > 1) throw new CacheIsAmbiguous(placeless.map((r) => r.id), databases.map((r) => r.id));
+			for (const resource of placeless) resource.of = only.id;
+		}
 	}
 	return {
-		name: options.project,
-		services,
-		...Object.keys(volumes).length ? { volumes } : {}
+		stage,
+		events,
+		cache,
+		containers: [...containers],
+		resources
 	};
 }
-/** Render a compose document as the file it becomes. */
-function toYaml(file) {
-	return `# Generated by gkm from the construct manifest — do not edit.
-# Containers are derived from what the app declares; images and anything no
-# construct implies are yours, in gkm.config.ts.
-#
-# Use "gkm dev" or "gkm test" to start these. Running "docker compose up"
-# directly will not inject secrets.
-${stringify(file, { lineWidth: 0 })}`;
-}
-/** A container with no image, from config or from the defaults. */
-var UnknownContainer = class extends Error {
-	/** The container that could not be resolved. */
-	container;
-	/** The containers that have a default, so the caller can see the set. */
-	known = Object.keys(DEFAULT_IMAGES).sort();
-	constructor(container) {
-		super("No image is known for this container; pin one in config");
-		this.name = "UnknownContainer";
-		this.container = container;
+/**
+* Queues or topics were declared with pg-boss and no database to hold them.
+*
+* Not a reconcile failure but a manifest one: the fix is a line of application
+* code either way — declare a database, or select a backend that brings its own
+* broker.
+*/
+var CacheNeedsDatabase = class extends Error {
+	ids;
+	constructor(ids) {
+		super(`A cache backed by the database needs a declared database, and none was declared, and on this deploy target that is where a cache lives. Declare one. Caches affected: ${ids.join(", ")}.`);
+		this.ids = ids;
+		this.name = "CacheNeedsDatabase";
 	}
 };
-/** One container's definition, published on the port it was assigned. */
-function define(container, image, published) {
-	switch (container) {
-		case "postgres": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			environment: {
-				POSTGRES_USER: LOCAL_USER$1,
-				POSTGRES_PASSWORD: LOCAL_USER$1,
-				POSTGRES_DB: LOCAL_USER$1
-			},
-			volumes: ["postgres-data:/var/lib/postgresql"],
-			healthcheck: {
-				test: ["CMD-SHELL", `pg_isready -U ${LOCAL_USER$1}`],
-				interval: "5s",
-				timeout: "3s",
-				retries: 10,
-				start_period: "10s"
-			}
-		};
-		case "minio": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			environment: {
-				MINIO_ROOT_USER: LOCAL_USER$1,
-				MINIO_ROOT_PASSWORD: LOCAL_USER$1
-			},
-			command: "server --console-address \":9001\" /data",
-			volumes: ["minio-data:/data"],
-			healthcheck: {
-				test: [
-					"CMD",
-					"mc",
-					"ready",
-					"local"
-				],
-				interval: "10s",
-				timeout: "5s",
-				retries: 5,
-				start_period: "10s"
-			}
-		};
-		case "caddy": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			volumes: [
-				"./Caddyfile:/etc/caddy/Caddyfile:ro",
-				"./caddy-sites:/etc/caddy/sites:ro",
-				"caddy-data:/data"
-			],
-			extra_hosts: ["host.docker.internal:host-gateway"],
-			healthcheck: {
-				test: [
-					"CMD",
-					"caddy",
-					"version"
-				],
-				interval: "10s",
-				timeout: "5s",
-				retries: 5
-			}
-		};
-		case "mailpit": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			environment: {
-				MP_SMTP_AUTH_ACCEPT_ANY: "1",
-				MP_SMTP_AUTH_ALLOW_INSECURE: "1"
-			},
-			healthcheck: {
-				test: [
-					"CMD",
-					"wget",
-					"-q",
-					"--spider",
-					"http://localhost:8025"
-				],
-				interval: "10s",
-				timeout: "5s",
-				retries: 5
-			}
-		};
-		case "redis": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			volumes: ["redis-data:/data"],
-			healthcheck: {
-				test: [
-					"CMD",
-					"redis-cli",
-					"ping"
-				],
-				interval: "5s",
-				timeout: "3s",
-				retries: 5
-			}
-		};
-		case "redis-http": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			environment: {
-				SRH_MODE: "env",
-				SRH_TOKEN: LOCAL_TOKEN$1,
-				SRH_CONNECTION_STRING: "redis://redis:6379"
-			},
-			depends_on: ["redis"],
-			healthcheck: {
-				test: [
-					"CMD",
-					"wget",
-					"-q",
-					"-O",
-					"/dev/null",
-					"http://127.0.0.1:80/"
-				],
-				interval: "5s",
-				timeout: "3s",
-				retries: 10
-			}
-		};
-		case "rabbitmq": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			environment: {
-				RABBITMQ_DEFAULT_USER: LOCAL_USER$1,
-				RABBITMQ_DEFAULT_PASS: LOCAL_USER$1
-			},
-			volumes: ["rabbitmq-data:/var/lib/rabbitmq"],
-			healthcheck: {
-				test: [
-					"CMD",
-					"rabbitmq-diagnostics",
-					"-q",
-					"ping"
-				],
-				interval: "10s",
-				timeout: "5s",
-				retries: 5
-			}
-		};
-		case "localstack": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			environment: {
-				AWS_DEFAULT_REGION: "us-east-1",
-				AWS_ACCESS_KEY_ID: "LSIAQAAAAAAVNCBMPNSG",
-				AWS_SECRET_ACCESS_KEY: LOCAL_USER$1
-			},
-			volumes: ["localstack-data:/var/lib/localstack"],
-			healthcheck: {
-				test: [
-					"CMD",
-					"curl",
-					"-f",
-					"http://localhost:4566/_localstack/health"
-				],
-				interval: "10s",
-				timeout: "5s",
-				retries: 5,
-				start_period: "10s"
-			}
-		};
-		default: throw new UnknownContainer(container);
-	}
-}
 /**
-* The published port mappings for a container.
+* A `'db'` cache — a server target's default — in an app that declares more
+* than one database.
 *
-* Every port is looked up by its own key rather than being derived as an offset
-* from the container's first, so MinIO's console cannot land on whatever was
-* allocated to the next container.
+* The target says *a* database and the graph offers several, so there is no
+* answer to give — and the wrong kind of failure would be to pick one, since a
+* cache silently landing in the wrong database is a bug that surfaces as
+* missing rows much later. The fix is a stronger statement in application code:
+* `orders.cache('Sessions')` names the database, which is a fact about the
+* application rather than a deployment choice.
 */
-function publish(container, ports) {
-	return portsOf(container).map((port) => {
-		const assigned = ports[port.key];
-		if (assigned === void 0) throw new UnassignedPort(port.key);
-		return `${assigned}:${port.inside}`;
-	});
-}
-/** A planned port that allocation never assigned. */
-var UnassignedPort = class extends Error {
-	/** The port key that went unassigned, e.g. `minio-console`. */
-	key;
-	constructor(key) {
-		super("No port was assigned for this container port");
-		this.name = "UnassignedPort";
-		this.key = key;
+var CacheIsAmbiguous = class extends Error {
+	ids;
+	databases;
+	constructor(ids, databases) {
+		super(`A cache backed by the database needs to know which one, and this app declares ${databases.length}: ${databases.join(", ")}. Declare the cache from its database — e.g. ${databases[0]}.cache('Sessions') — rather than as a bare new Cache(). Caches affected: ${ids.join(", ")}.`);
+		this.ids = ids;
+		this.databases = databases;
+		this.name = "CacheIsAmbiguous";
 	}
 };
-
-//#endregion
-//#region src/reconcile/docker.ts
-const run = promisify(execFile);
-/** How long to wait for containers to pass their health checks. */
-const HEALTH_TIMEOUT_MS = 12e4;
-const dockerCli = {
-	async publishedPort(composePath, service, inside) {
-		try {
-			const { stdout } = await run("docker", [
-				"compose",
-				"-f",
-				composePath,
-				"port",
-				service,
-				String(inside)
-			]);
-			const port = Number(stdout.trim().split(":").pop());
-			return Number.isFinite(port) && port > 0 ? port : void 0;
-		} catch {
-			return void 0;
-		}
-	},
-	async up(composePath, services) {
-		await run("docker", [
-			"compose",
-			"-f",
-			composePath,
-			"up",
-			"-d",
-			"--remove-orphans",
-			"--wait",
-			`--wait-timeout=${Math.floor(HEALTH_TIMEOUT_MS / 1e3)}`,
-			...services
-		]);
-	},
-	async copyOut(composePath, service, from, to) {
-		await mkdir(dirname(to), { recursive: true });
-		await run("docker", [
-			"compose",
-			"-f",
-			composePath,
-			"cp",
-			`${service}:${from}`,
-			to
-		]);
-	},
-	async reload(composePath, service) {
-		await run("docker", [
-			"compose",
-			"-f",
-			composePath,
-			"exec",
-			"-T",
-			service,
-			"caddy",
-			"reload",
-			"--config",
-			"/etc/caddy/Caddyfile"
-		]);
-	},
-	async healthy(composePath, services) {
-		if (services.length === 0) return true;
-		try {
-			const { stdout } = await run("docker", [
-				"compose",
-				"-f",
-				composePath,
-				"ps",
-				"--format",
-				"json",
-				...services
-			]);
-			const running = /* @__PURE__ */ new Set();
-			for (const line of stdout.trim().split("\n").filter(Boolean)) {
-				const entry = JSON.parse(line);
-				const ok = entry.State === "running" && (entry.Health === void 0 || entry.Health === "" || entry.Health === "healthy");
-				if (ok && entry.Service) running.add(entry.Service);
-			}
-			return services.every((service) => running.has(service));
-		} catch {
-			return false;
-		}
+var PgBossNeedsDatabase = class extends Error {
+	ids;
+	constructor(ids) {
+		super(`pg-boss keeps its queues in a declared database, and none was declared. Declare one: on this deploy target, events are carried by pg-boss. Queues and topics affected: ${ids.join(", ")}.`);
+		this.ids = ids;
+		this.name = "PgBossNeedsDatabase";
 	}
 };
-
 //#endregion
-//#region src/reconcile/plan.ts
-/** The stage whose resources carry no suffix. */
-const DEFAULT_STAGE = "development";
+//#region src/reconcile/env.ts
 /**
-* Which container serves a kind.
+* The URLs a reconciled stage injects.
 *
-* Derived kinds map to the same container as their parent — a schema tenant
-* lives in its parent's Postgres — so the set is deduplicated rather than
-* counted.
+* One `<NAME>_URL` per construct, and the protocol picks the driver. This is the
+* seam between the target that writes a URL and the client that parses it, so
+* every component of it is read off the resource — never inherited from ambient
+* environment. A bucket can live in a different region than the function reading
+* it, and `AWS_REGION` in a Lambda is the *function's* region, so a URL that
+* omits `?region=` breaks cross-region silently at runtime.
+*
+* Locally that self-containment is what lets the port be whatever was free: the
+* app reads `ORDERS_URL` and never sees a host or a port.
 */
-const CONTAINERS = {
-	database: "postgres",
-	"database-reader": "postgres",
-	"database-schema": "postgres",
-	objects: "minio",
-	"file-server": "caddy",
-	email: "mailpit"
-};
 /**
-* The container a cache backend needs locally.
+* The credential local containers are brought up with.
 *
-* Each one matches the protocol its deployed form speaks, which is the property
-* worth having: a cache that behaves differently in the two places is worse than
-* a slower one.
+* The design's `roles: false` case — both URLs fall back to the cluster's master
+* credential. A deliberate downgrade, not a default: it holds until the role DDL
+* lands in `@geekmidas/db`, at which point the runtime role's URL replaces this
+* and the owner URL stops being reachable from any manifest edge.
+*/
+const LOCAL_USER$2 = "geekmidas";
+/** The host containers are published on. */
+const LOCAL_HOST = "localhost";
+/** The region local buckets claim, so the client has one to sign with. */
+const LOCAL_REGION = "us-east-1";
+/**
+* The credentials the S3 client resolves for MinIO.
 *
-* `db` is deliberately absent, the same way `pgboss` is absent from
-* `EVENT_CONTAINERS`: the cache is a table in a database the manifest already
-* declares, so mapping it here would start a container for a project that needs
-* none.
+* An `s3://` URL deliberately carries none: deployed, the SDK reads them from
+* the execution role, so a URL that embedded a key would be one more thing to
+* rotate and one more thing to leak into a log. Locally there is no role, and
+* the same chain reads these — which is why they are injected beside the URL
+* rather than written into it.
 */
-const CACHE_CONTAINERS = {
-	upstash: "redis-http",
-	elasticache: "redis"
+const STORAGE_CREDENTIALS = {
+	AWS_ACCESS_KEY_ID: LOCAL_USER$2,
+	AWS_SECRET_ACCESS_KEY: LOCAL_USER$2,
+	AWS_REGION: LOCAL_REGION
 };
+/** The token the local cache proxy accepts. Matches the compose definition. */
+const LOCAL_TOKEN$1 = "geekmidas";
+/** The port Mailpit's inbox — its web UI and HTTP API — is published under. */
+const MAILPIT_INBOX_PORT = "mailpit-web";
+/** The schema pg-boss keeps its tables in, inside the declared database. */
+const PGBOSS_SCHEMA = "pgboss";
+/** The exchange every local topic and queue shares on RabbitMQ. */
+const RABBITMQ_EXCHANGE = "geekmidas.events";
 /**
-* Kinds that resolve a value without anything running.
+* Every env key a reconciled plan resolves, and its value.
 *
-* A secret is the case: it has no address, so there is nothing to start and
-* nothing to connect to — but it still appears in the plan, because the target
-* still has to resolve it.
+* Keys come from the declaration rather than being re-derived, so what the build
+* publishes and what the app reads cannot drift.
 */
-const CONTAINERLESS = {
-	secret: true,
-	credential: true,
-	"rest-api": true,
-	site: true
-};
+function envFor(plan, options) {
+	const env = {};
+	const resolved = {};
+	for (const resource of plan.resources) {
+		const url = urlFor(resource, plan, options.ports, options.project ?? "", options.addresses);
+		if (url) resolved[resource.id] = url;
+	}
+	for (const resource of plan.resources) {
+		const url = resolved[resource.id];
+		if (resource.kind === "rest-api") Object.assign(env, surfaceEnv(resource, url, resolved));
+		if (url) env[resource.envKey] = url;
+		if (isDatabase(resource.kind) && resource.roles !== false) {
+			const owner = ownerUrl(resource, plan, options.ports, options.project ?? "");
+			if (owner) env[provideKey(resource.id, "ownerUrl")] = owner;
+		}
+		if (resource.kind === "email" && url) {
+			env[provideKey(resource.id, "from")] = options.mailFrom ?? `noreply@${LOCAL_HOST}`;
+			const inbox = options.ports[MAILPIT_INBOX_PORT];
+			if (inbox !== void 0) env[provideKey(resource.id, "inboxUrl")] = `http://${LOCAL_HOST}:${inbox}`;
+		}
+	}
+	Object.assign(env, publicEnv(plan, env));
+	Object.assign(env, brokerEnv(plan, options.ports));
+	if (plan.resources.some((r) => r.kind === "objects" && env[r.envKey])) Object.assign(env, STORAGE_CREDENTIALS);
+	return env;
+}
 /**
-* Containers that cannot run alone.
+* The values a site's bundler inlines, under the names it inlines them by.
 *
-* The one case is the cache: `serverless-redis-http` is a proxy and needs the
-* Redis it proxies. Kept here rather than in the compose definition so the plan
-* -- which is what decides what must be running -- still names everything.
+* A rename and nothing more. `API_URL` was resolved once, by the same code that
+* resolved it for the server; a site reads the same value under `VITE_API_URL`
+* because that prefix is how its bundler is told to ship it. Nothing is derived
+* twice, so a site and its API cannot come to disagree about where the API is.
+*
+* A source that resolved to nothing is skipped rather than written empty: an
+* inlined empty string is a frontend that builds and then fails at runtime
+* against `http:///`, where a missing variable fails at build with the name of
+* the thing that is missing.
 */
-const REQUIRES = { "redis-http": ["redis"] };
+function publicEnv(plan, resolved) {
+	const env = {};
+	for (const resource of plan.resources) for (const [key, source] of Object.entries(resource.publicEnv ?? {})) {
+		const value = resolved[source];
+		if (value) env[key] = value;
+	}
+	return env;
+}
+/**
+* What a surface publishes beyond its own address: who may call it, and where
+* a cookie set by it is readable.
+*
+* Both are read off the same list — the constructs that declared an edge to
+* this surface — which is why neither appears in application code. A surface
+* that listed its own callers would be edited every time something new called
+* it, and the thing being edited is already recorded in the graph.
+*
+* An empty origin list is written, and a surface with no address writes nothing
+* at all. The two cases look alike and are not: "nothing depends on this yet" is
+* a real state a target should publish, while "this surface has no address here"
+* means it is not running in this stage, and keys belong with the address they
+* describe.
+*/
+function surfaceEnv(resource, url, resolved = {}) {
+	if (!url) return {};
+	const origins = [...new Set((resource.callers ?? []).map((caller) => resolved[caller]).filter((address) => Boolean(address)).map(originOf).filter((origin) => Boolean(origin)))].sort();
+	const domain = cookieDomain([url, ...origins]);
+	return {
+		[provideKey(resource.id, "trustedOrigins")]: origins.join(","),
+		...domain ? { [provideKey(resource.id, "cookieDomain")]: domain } : {}
+	};
+}
+/** An address reduced to the origin a browser compares against. */
+function originOf(address) {
+	try {
+		return new URL(address).origin;
+	} catch {
+		return;
+	}
+}
 /**
-* The role each kind's one key plays, where it is not a URL.
+* The runtime role of whatever a derived node hangs off.
 *
-* The twin of `ProvidesByKind` in `@geekmidas/manifest`: that is what a
-* construct declares, this is what the local target resolves, and both derive
-* the key from the same `provideKey` so they cannot disagree.
+* A reader's parent may itself be a schema tenant, so this follows `of` by one
+* hop rather than assuming the cluster — the reader of a tenant reads that
+* tenant's schema, not the database's.
 */
-const ROLES = {
-	queue: "publisherConnectionString",
-	topic: "publisherConnectionString",
-	credential: "credential"
-};
-/** The kinds whose container is the events backend's rather than their own. */
-const EVENT_KINDS = {
-	queue: true,
-	topic: true
-};
+function parentRole(resource, plan) {
+	const parent = plan.resources.find((r) => r.id === resource.of);
+	return parent ? localRole(parent) : resource.name;
+}
+/** Whether a kind connects to Postgres and therefore has an owner role. */
+function isDatabase(kind) {
+	return kind === "database" || kind === "database-schema";
+}
 /**
-* Which kinds provision something *inside* their container.
+* The URL a migrator connects with — the owner role, which can create, alter
+* and drop.
 *
-* A database creates a database, a bucket creates a bucket; mail creates
-* nothing — Mailpit accepts whatever is sent to it and has no per-stage object
-* to name. Both still appear in the plan, because both still resolve a URL; the
-* flag is the difference between "must be running" and "must be created".
+* Never in `provides`, which is the whole point. A handler that could reach this
+* could `DROP TABLE`, and the security property the role split exists for is
+* that it cannot: the value is injected by `gkm exec` for the migrate step and
+* by nothing else.
 */
-const PROVISIONS = {
-	database: true,
-	"database-reader": true,
-	"database-schema": true,
-	objects: true,
-	cache: true,
-	"file-server": true
-};
+function ownerUrl(resource, plan, ports, project) {
+	if (!resource.container) return void 0;
+	const port = ports[primaryPortKey(resource.container)];
+	if (port === void 0) return void 0;
+	const owner = ownerRole(localRole(resource));
+	return postgres(port, rootDatabase(resource, plan), {
+		user: owner,
+		password: localRolePassword(project, plan, owner)
+	});
+}
 /**
-* The container each events backend needs, where it needs one of its own.
-*
-* `pgboss` is deliberately absent rather than mapped to `postgres`: it is a
-* schema tenant in a database the manifest already declares, so mapping it here
-* would start a Postgres for a project that declared no database at all.
+* The shared broker keys, when anything is published or consumed.
 *
-* This one comes from config rather than from a declaration because there are
-* no `topic` or `queue` kinds yet. When they land the mapping moves to
-* {@link CONTAINERS} keyed by kind, and this constant goes with them.
+* A queue's own key is the producer's. These two are the *connection* itself,
+* which locally is one broker for every queue and topic in the project: the
+* generated pollers open a single connection and subscribe each worker by name
+* on it. Deployed there is no such thing — a Lambda is handed its own event
+* source — so this pair exists for the local target and says so.
 */
-const EVENT_CONTAINERS = {
-	sns: "localstack",
-	rabbitmq: "rabbitmq"
-};
-/** The backend a project gets when it declares queues or topics and says nothing. */
-const DEFAULT_EVENTS = "pgboss";
+function brokerEnv(plan, ports) {
+	const carrier = plan.resources.find((r) => r.kind === "queue" || r.kind === "topic");
+	if (!carrier) return {};
+	const publisher = urlFor(carrier, plan, ports, "");
+	if (!publisher) return {};
+	return {
+		EVENT_PUBLISHER_CONNECTION_STRING: publisher,
+		EVENT_SUBSCRIBER_CONNECTION_STRING: plan.events === "sns" ? publisher.replace(/^sns:/, "sqs:") : publisher
+	};
+}
 /**
-* How a resource of each kind separates its stage suffix.
+* The URL for one planned resource.
 *
-* Postgres identifiers are snake_case and a hyphen would need quoting
-* everywhere; buckets and queues are kebab and disallow underscores in some
-* providers. The suffix is the same word either way.
+* Every part of it comes from the resource and the port it was published on.
 */
-const SEPARATORS = {
-	database: "_",
-	"database-reader": "_",
-	"database-schema": "_",
-	objects: "-"
-};
+function urlFor(resource, plan, ports, project, addresses = {}) {
+	if (resource.kind === "secret") return localSecret(project, plan, resource);
+	if (resource.kind === "credential") return void 0;
+	if (resource.kind === "rest-api" || resource.kind === "site") {
+		const address = addresses[resource.id];
+		const edge = plan.containers.includes("caddy") ? ports[primaryPortKey("caddy")] : void 0;
+		return address && edge !== void 0 ? `https://${hostFor(resource, project)}:${edge}` : address;
+	}
+	if (!resource.container) return void 0;
+	const port = ports[primaryPortKey(resource.container)];
+	if (port === void 0) return void 0;
+	switch (resource.kind) {
+		case "database":
+		case "database-schema":
+		case "database-reader": {
+			const database = rootDatabase(resource, plan);
+			if (resource.roles === false) {
+				const schema = schemaOf(resource, plan);
+				return schema ? `${postgres(port, database)}?search_path=${schema}` : postgres(port, database);
+			}
+			const role = resource.kind === "database-reader" ? readerRole(parentRole(resource, plan)) : localRole(resource);
+			return postgres(port, database, {
+				user: role,
+				password: localRolePassword(project, plan, role)
+			});
+		}
+		case "email": return `smtp://${LOCAL_HOST}:${port}`;
+		case "objects": return `s3://${resource.name}?region=${LOCAL_REGION}&endpoint=http://${LOCAL_HOST}:${port}&forcePathStyle=true`;
+		case "file-server": {
+			const origin = plan.resources.find((r) => r.id === resource.of);
+			if (!origin) return void 0;
+			return plan.containers.includes("caddy") ? `https://${hostFor(resource, project)}:${port}` : `http://${LOCAL_HOST}:${port}/${origin.name}`;
+		}
+		case "cache":
+			if (resource.of) {
+				const parent = plan.resources.find((r) => r.id === resource.of);
+				const url = parent ? urlFor(parent, plan, ports, project, addresses) : void 0;
+				return url ? withTable(url, resource.table ?? cacheTable(resource.id)) : void 0;
+			}
+			switch (plan.cache) {
+				case "elasticache": return `redis://${LOCAL_HOST}:${port}`;
+				default: return `http://:${LOCAL_TOKEN$1}@${LOCAL_HOST}:${port}`;
+			}
+		case "queue":
+		case "topic": return broker(plan, port);
+		default: return;
+	}
+}
 /**
-* The stage-scoped name for a resource.
+* The producer's connection string, composed from the backend the plan chose.
 *
-* The default stage carries no suffix, so `gkm dev` keeps using `orders` and a
-* developer's psql history, saved connections, and muscle memory survive this
-* change. Every other stage is suffixed.
+* The protocol is what picks the transport, so a producer never branches: the
+* same `.publish()` reaches pg-boss here and SQS deployed because the string it
+* was handed said so.
 */
-function resourceName(id, kind, stage) {
-	const base = id.toLowerCase();
-	if (stage === DEFAULT_STAGE) return base;
-	return `${base}${SEPARATORS[kind] ?? "-"}${stage}`;
+function broker(plan, port) {
+	switch (plan.events) {
+		case "pgboss": {
+			const database = plan.resources.find((r) => r.kind === "database");
+			if (!database) throw new PgBossNeedsDatabase([]);
+			return `pgboss://${LOCAL_USER$2}:${LOCAL_USER$2}@${LOCAL_HOST}:${port}/${database.name}?schema=${PGBOSS_SCHEMA}`;
+		}
+		case "rabbitmq": return `rabbitmq://${LOCAL_USER$2}:${LOCAL_USER$2}@${LOCAL_HOST}:${port}?exchange=${RABBITMQ_EXCHANGE}`;
+		case "sns": throw new UnprovisionedEventsBackend("sns");
+	}
+}
+/** A local Postgres URL, master credential and all. */
+function postgres(port, database, credential = {
+	user: LOCAL_USER$2,
+	password: LOCAL_USER$2
+}) {
+	return `postgres://${credential.user}:${credential.password}@${LOCAL_HOST}:${port}/${database}`;
 }
 /**
-* The container a kind needs, or `undefined` if it needs none.
+* The role a handler connects as, for one database or tenant.
 *
-* Queues and topics have no container of their own — they live in whichever
-* broker the project selected, which is why the backend is an argument here
-* rather than a second pass that adds containers after the fact.
+* The construct's id, lowercased and stage-scoped exactly as its database or
+* schema is — so `Orders` in the `test` stage connects as `orders_test`, and two
+* stages sharing one cluster cannot share a credential. Roles are cluster-scoped
+* in Postgres, which is why the suffix is not optional here the way it is for a
+* schema.
 */
-function containerFor(kind, events = DEFAULT_EVENTS, cache = DEFAULT_CACHE.aws, derived = false, edge = true) {
-	if (EVENT_KINDS[kind]) return EVENT_CONTAINERS[events] ?? CONTAINERS.database;
-	if (kind === "file-server") return edge ? "caddy" : CONTAINERS.objects;
-	if (kind === "cache") {
-		if (derived) return CONTAINERS.database;
-		return CACHE_CONTAINERS[cache] ?? CONTAINERS.database;
-	}
-	return CONTAINERS[kind];
+function localRole(resource) {
+	return resource.name;
 }
 /**
-* Build the plan for a manifest and stage.
+* The password for a derived local role.
 *
-* `order` is the caller's provisioning order — parents before children — which
-* `provisionOrder` produces from the manifest. Passing it in keeps this
-* function free of the traversal and makes the ordering assertable on its own.
+* Derived rather than random, for the same reason the local secret is: a
+* password that changed on every `gkm dev` would lock a developer out of the
+* data they had a moment ago. Seeded by the project so two checkouts do not
+* share one, and by the stage so `test` and `development` do not.
+*
+* It is a *local* credential by construction — the cluster is on loopback and
+* the seed is a checkout path — and no deployed target uses this function.
 */
-function planFor(manifest, stage, order, options = {}) {
-	const containers = /* @__PURE__ */ new Set();
-	const resources = [];
-	const events = options.events ?? DEFAULT_EVENTS;
-	const cache = options.cache ?? DEFAULT_CACHE.aws;
-	for (const id of order) {
-		const declaration = manifest[id];
-		if (!declaration) continue;
-		const container = containerFor(declaration.kind, events, cache, "of" in declaration && typeof declaration.of === "string", options.edge !== false);
-		if (!container && !CONTAINERLESS[declaration.kind]) continue;
-		if (container) {
-			containers.add(container);
-			for (const required of REQUIRES[container] ?? []) containers.add(required);
-		}
-		resources.push({
-			id,
-			kind: declaration.kind,
-			...container ? { container } : {},
-			name: resourceName(id, declaration.kind, stage),
-			envKey: providedKeyFor(id, declaration.kind, ROLES[declaration.kind] ?? "url"),
-			provisions: PROVISIONS[declaration.kind] === true,
-			...declaration.kind === "rest-api" ? { callers: dependentsOf(manifest, id) } : {},
-			...declaration.kind === "site" ? { publicEnv: publicEnvFor(declaration, manifest) } : {},
-			...declaration.kind === "file-server" && declaration.open?.length ? { open: declaration.open } : {},
-			..."of" in declaration ? { of: declaration.of } : {},
-			..."schema" in declaration && declaration.schema ? { schema: declaration.schema } : {},
-			..."version" in declaration && declaration.version ? { version: declaration.version } : {},
-			..."roles" in declaration && declaration.roles === false ? { roles: false } : {},
-			..."table" in declaration && declaration.table ? { table: declaration.table } : {}
-		});
-	}
-	if (options.edge !== false && resources.some((r) => EDGE_KINDS[r.kind] === true)) containers.add("caddy");
-	for (const extra of options.extraContainers ?? []) containers.add(extra);
-	if (events === "pgboss" && resources.some((r) => EVENT_KINDS[r.kind]) && !resources.some((r) => r.kind === "database")) throw new PgBossNeedsDatabase(resources.filter((r) => EVENT_KINDS[r.kind]).map((r) => r.id));
-	if (cache === "db") {
-		const placeless = resources.filter((r) => r.kind === "cache" && !r.of);
-		if (placeless.length > 0) {
-			const databases = resources.filter((r) => r.kind === "database");
-			const [only] = databases;
-			if (!only) throw new CacheNeedsDatabase(resources.filter((r) => r.kind === "cache").map((r) => r.id));
-			if (databases.length > 1) throw new CacheIsAmbiguous(placeless.map((r) => r.id), databases.map((r) => r.id));
-			for (const resource of placeless) resource.of = only.id;
-		}
-	}
-	return {
-		stage,
-		events,
-		cache,
-		containers: [...containers],
-		resources
-	};
+function localRolePassword(project, plan, role) {
+	return createHash("sha256").update(`${project}:${plan.stage}:role:${role}`).digest("base64url").slice(0, 32);
+}
+/**
+* A cache's address: its database's URL, carrying the table it reads.
+*
+* Appended rather than kept beside the URL as a second key, for the reason the
+* design gives everywhere else — an address and what it opens are one fact, and
+* two keys are one more thing to keep in step.
+*/
+function withTable(url, table) {
+	const parsed = new URL(url);
+	parsed.searchParams.set("table", table);
+	return parsed.toString();
 }
 /**
-* Queues or topics were declared with pg-boss and no database to hold them.
+* The physical database a derived resource lives in.
 *
-* Not a reconcile failure but a manifest one: the fix is a line of application
-* code either way — declare a database, or select a backend that brings its own
-* broker.
+* Walks `of` to the top rather than reading the immediate parent, because a
+* reader's parent may itself be a schema tenant — two hops from the database
+* that actually exists.
 */
-var CacheNeedsDatabase = class extends Error {
-	constructor(ids) {
-		super(`A cache backed by the database needs a declared database, and none was declared. Declare one, or set services.cache to 'upstash' or 'elasticache'. Caches affected: ${ids.join(", ")}.`);
-		this.ids = ids;
-		this.name = "CacheNeedsDatabase";
+function rootDatabase(resource, plan) {
+	const byId = new Map(plan.resources.map((r) => [r.id, r]));
+	let current = resource;
+	while (current.of) {
+		const parent = byId.get(current.of);
+		if (!parent) break;
+		current = parent;
 	}
-};
+	return current.name;
+}
+/** The schema a derived resource puts on its search path, if it has one. */
+function schemaOf(resource, plan) {
+	const byId = new Map(plan.resources.map((r) => [r.id, r]));
+	let current = resource;
+	while (current) {
+		if (current.kind === "database-schema") return current.schema;
+		current = current.of ? byId.get(current.of) : void 0;
+	}
+}
 /**
-* `services.cache: 'db'` in an app that declares more than one database.
+* A backend whose local addresses cannot be derived yet.
 *
-* The config says *a* database and the graph offers several, so there is no
-* answer to give — and the wrong kind of failure would be to pick one, since a
-* cache silently landing in the wrong database is a bug that surfaces as
-* missing rows much later. The fix is a stronger statement in application code:
-* `orders.cache('Sessions')` names the database, which is a fact about the
-* application rather than a deployment choice.
+* SNS and SQS are addressed by ARN, which means the topic and queue have to be
+* created in LocalStack before a URL can name them. Until that provisioning
+* lands, saying so is better than handing out a string that fails on first use.
 */
-var CacheIsAmbiguous = class extends Error {
-	constructor(ids, databases) {
-		super(`A cache backed by the database needs to know which one, and this app declares ${databases.length}: ${databases.join(", ")}. Declare the cache from its database — e.g. ${databases[0]}.cache('Sessions') — rather than with services.cache. Caches affected: ${ids.join(", ")}.`);
-		this.ids = ids;
-		this.databases = databases;
-		this.name = "CacheIsAmbiguous";
-	}
-};
-var PgBossNeedsDatabase = class extends Error {
-	constructor(ids) {
-		super(`pg-boss keeps its queues in a declared database, and none was declared. Declare one, or set services.events to 'rabbitmq' or 'sns'. Queues and topics affected: ${ids.join(", ")}.`);
-		this.ids = ids;
-		this.name = "PgBossNeedsDatabase";
+var UnprovisionedEventsBackend = class extends Error {
+	backend;
+	constructor(backend) {
+		super(`The local target cannot derive addresses for '${backend}' yet — its topics and queues are named by ARN, which nothing creates locally. Use 'pgboss' (the default) or 'rabbitmq' for local development.`);
+		this.backend = backend;
+		this.name = "UnprovisionedEventsBackend";
 	}
 };
-
-//#endregion
-//#region src/reconcile/env.ts
 /**
-* The credential local containers are brought up with.
+* The value a secret resolves to locally.
 *
-* The design's `roles: false` case — both URLs fall back to the cluster's master
-* credential. A deliberate downgrade, not a default: it holds until the role DDL
-* lands in `@geekmidas/db`, at which point the runtime role's URL replaces this
-* and the owner URL stops being reachable from any manifest edge.
+* A hash of what identifies it, so it is stable, distinct per project, stage
+* and construct, and never written to disk as a literal. Deployed this is the
+* one kind whose value does *not* come from here — a secret manager generates
+* it once and the target reads it back.
 */
-const LOCAL_USER = "geekmidas";
-/** The host containers are published on. */
-const LOCAL_HOST = "localhost";
-/** The region local buckets claim, so the client has one to sign with. */
-const LOCAL_REGION = "us-east-1";
+function localSecret(project, plan, resource) {
+	return createHash("sha256").update(`${project}:${plan.stage}:${resource.id}`).digest("base64url").slice(0, 43);
+}
+//#endregion
+//#region src/reconcile/apps.ts
 /**
-* The credentials the S3 client resolves for MinIO.
+* The apps, as services beside the containers their constructs derive.
 *
-* An `s3://` URL deliberately carries none: deployed, the SDK reads them from
-* the execution role, so a URL that embedded a key would be one more thing to
-* rotate and one more thing to leak into a log. Locally there is no role, and
-* the same chain reads these — which is why they are injected beside the URL
-* rather than written into it.
+* `gkm docker` used to write these by hand: every backend got
+* `DATABASE_URL=postgresql://…@postgres:5432/app` and `REDIS_URL=redis://redis`,
+* which was right only for a project whose single database happened to be
+* called `Database` — an `Orders` database publishes `ORDERS_URL`, a schema
+* tenant has a URL of its own, and buckets and mail were not wired at all.
+*
+* Now an app's environment is exactly what reconcile hands `gkm dev`: every key
+* the declared constructs provide, from the same derivation. The only
+* difference is where the addresses point — at the containers by service name
+* on the compose network, rather than at `localhost` on the ports published for
+* the host.
+*
+* Always from the *local* stage's plan, whichever stage is being reconciled:
+* `gkm test` rewrites the same file, and running the tests must not quietly
+* point these apps at the test databases.
 */
-const STORAGE_CREDENTIALS = {
-	AWS_ACCESS_KEY_ID: LOCAL_USER,
-	AWS_SECRET_ACCESS_KEY: LOCAL_USER,
-	AWS_REGION: LOCAL_REGION
-};
-/** The token the local cache proxy accepts. Matches the compose definition. */
-const LOCAL_TOKEN = "geekmidas";
-/** The schema pg-boss keeps its tables in, inside the declared database. */
-const PGBOSS_SCHEMA = "pgboss";
-/** The exchange every local topic and queue shares on RabbitMQ. */
-const RABBITMQ_EXCHANGE = "geekmidas.events";
+/** The profile app services carry, so `gkm dev` starts only the containers. */
+const APPS_PROFILE = "apps";
 /**
-* Every env key a reconciled plan resolves, and its value.
+* Where an app's image is built from.
 *
-* Keys come from the declaration rather than being re-derived, so what the build
-* publishes and what the app reads cannot drift.
+* An app at the project root is a single-app project, whose `gkm docker`
+* writes `.gkm/docker/Dockerfile`; a workspace writes one per app.
 */
-function envFor(plan, options) {
-	const env = {};
-	const resolved = {};
-	for (const resource of plan.resources) {
-		const url = urlFor(resource, plan, options.ports, options.project ?? "", options.addresses);
-		if (url) resolved[resource.id] = url;
-	}
-	for (const resource of plan.resources) {
-		const url = resolved[resource.id];
-		if (resource.kind === "rest-api") Object.assign(env, surfaceEnv(resource, url, resolved));
-		if (url) env[resource.envKey] = url;
-		if (isDatabase(resource.kind) && resource.roles !== false) {
-			const owner = ownerUrl(resource, plan, options.ports, options.project ?? "");
-			if (owner) env[provideKey(resource.id, "ownerUrl")] = owner;
-		}
-		if (resource.kind === "email" && url) env[provideKey(resource.id, "from")] = options.mailFrom ?? `noreply@${LOCAL_HOST}`;
-	}
-	Object.assign(env, publicEnv(plan, env));
-	Object.assign(env, brokerEnv(plan, options.ports));
-	if (plan.resources.some((r) => r.kind === "objects" && env[r.envKey])) Object.assign(env, STORAGE_CREDENTIALS);
-	return env;
+function dockerfileOf(appName, path) {
+	return path === "." ? ".gkm/docker/Dockerfile" : `.gkm/docker/Dockerfile.${appName}`;
 }
 /**
-* The values a site's bundler inlines, under the names it inlines them by.
-*
-* A rename and nothing more. `API_URL` was resolved once, by the same code that
-* resolved it for the server; a site reads the same value under `VITE_API_URL`
-* because that prefix is how its bundler is told to ship it. Nothing is derived
-* twice, so a site and its API cannot come to disagree about where the API is.
+* Every construct key, addressed across the compose network.
 *
-* A source that resolved to nothing is skipped rather than written empty: an
-* inlined empty string is a frontend that builds and then fails at runtime
-* against `http:///`, where a missing variable fails at build with the name of
-* the thing that is missing.
+* `envFor` is asked with a placeholder port for every port key, so each
+* `localhost:<placeholder>` in its answer names exactly one container port —
+* two containers listening on the same port inside cannot be confused — and is
+* rewritten to `<container>:<inside>`.
 */
-function publicEnv(plan, resolved) {
-	const env = {};
-	for (const resource of plan.resources) for (const [key, source] of Object.entries(resource.publicEnv ?? {})) {
-		const value = resolved[source];
-		if (value) env[key] = value;
+function inNetworkEnv(workspace, manifest) {
+	const plan = planFor(manifest, workspace.stages.local, provisionOrder(manifest), {
+		localStage: workspace.stages.local,
+		...backendsOf(workspace)
+	});
+	const placeholders = {};
+	const targets = /* @__PURE__ */ new Map();
+	let next = 49152;
+	for (const container of [...plan.containers].sort()) for (const port of portsOf(container)) {
+		placeholders[port.key] = next;
+		targets.set(next, `${container}:${port.inside}`);
+		next += 1;
 	}
-	return env;
+	for (const key of portKeys(plan.containers)) placeholders[key] ??= next++;
+	const env = envFor(plan, {
+		ports: placeholders,
+		project: workspace.name,
+		addresses: surfaceAddresses(workspace, manifest, (app, port) => `http://${app}:${port}`)
+	});
+	const rewrite = (value) => value.replace(/(?:localhost|127\.0\.0\.1):(\d+)/g, (match, port) => {
+		return targets.get(Number(port)) ?? match;
+	});
+	return Object.fromEntries(Object.entries(env).map(([key, value]) => [key, rewrite(value)]));
+}
+/** One compose service per app the workspace runs, behind the apps profile. */
+function appServices(workspace, manifest, containers) {
+	const env = inNetworkEnv(workspace, manifest);
+	const services = {};
+	for (const [name, app] of Object.entries(workspace.apps)) {
+		if (app.type === "mobile" || !app.port) continue;
+		const key = appKey(name);
+		const health = app.type === "web" ? "/" : "/health";
+		services[key] = {
+			image: `${key}:\${TAG:-latest}`,
+			build: {
+				context: ".",
+				dockerfile: dockerfileOf(name, app.path)
+			},
+			profiles: [APPS_PROFILE],
+			ports: [`${app.port}:${app.port}`],
+			environment: {
+				NODE_ENV: "production",
+				PORT: String(app.port),
+				...env
+			},
+			...containers.some((c) => c !== "caddy") ? { depends_on: containers.filter((c) => c !== "caddy") } : {},
+			healthcheck: {
+				test: [
+					"CMD",
+					"wget",
+					"-q",
+					"--spider",
+					`http://localhost:${app.port}${health}`
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5
+			}
+		};
+	}
+	return services;
 }
+//#endregion
+//#region src/reconcile/clients.ts
 /**
-* What a surface publishes beyond its own address: who may call it, and where
-* a cookie set by it is readable.
+* The real Postgres and MinIO clients the applier runs against.
 *
-* Both are read off the same list — the constructs that declared an edge to
-* this surface — which is why neither appears in application code. A surface
-* that listed its own callers would be edited every time something new called
-* it, and the thing being edited is already recorded in the graph.
+* Kept apart from `provision.ts` so the rules there — what gets created, in what
+* order, and never dropping anything — are asserted against fakes, while the
+* drivers live here where there is nothing to assert but wiring.
 *
-* An empty origin list is written, and a surface with no address writes nothing
-* at all. The two cases look alike and are not: "nothing depends on this yet" is
-* a real state a target should publish, while "this surface has no address here"
-* means it is not running in this stage, and keys belong with the address they
-* describe.
+* Both are constructed from the same local addresses the env writer composes,
+* so the applier cannot end up talking to a different container than the app.
 */
-function surfaceEnv(resource, url, resolved = {}) {
-	if (!url) return {};
-	const origins = [...new Set((resource.callers ?? []).map((caller) => resolved[caller]).filter((address) => Boolean(address)).map(originOf).filter((origin) => Boolean(origin)))].sort();
-	const domain = cookieDomain([url, ...origins]);
-	return {
-		[provideKey(resource.id, "trustedOrigins")]: origins.join(","),
-		...domain ? { [provideKey(resource.id, "cookieDomain")]: domain } : {}
-	};
-}
-/** An address reduced to the origin a browser compares against. */
-function originOf(address) {
-	try {
-		return new URL(address).origin;
-	} catch {
-		return void 0;
-	}
-}
+/** The credential local containers are brought up with. */
+const LOCAL_USER$1 = "geekmidas";
 /**
-* The runtime role of whatever a derived node hangs off.
+* A Postgres client that opens one connection per database it is asked about.
 *
-* A reader's parent may itself be a schema tenant, so this follows `of` by one
-* hop rather than assuming the cluster — the reader of a tenant reads that
-* tenant's schema, not the database's.
+* `CREATE DATABASE` cannot run from a connection to the database being created,
+* and a schema must be created from inside its own database — so the database is
+* part of each query rather than fixed when the client is built.
 */
-function parentRole(resource, plan) {
-	const parent = plan.resources.find((r) => r.id === resource.of);
-	return parent ? localRole(parent) : resource.name;
+function pgClient(port) {
+	return { async query(database, sql, values) {
+		const client = new Client({
+			host: "localhost",
+			port,
+			user: LOCAL_USER$1,
+			password: LOCAL_USER$1,
+			database: database ?? LOCAL_USER$1
+		});
+		await client.connect();
+		try {
+			return (await client.query(sql, values)).rows;
+		} finally {
+			await client.end();
+		}
+	} };
 }
-/** Whether a kind connects to Postgres and therefore has an owner role. */
-function isDatabase(kind) {
-	return kind === "database" || kind === "database-schema";
+/** A bucket client pointed at the local MinIO. */
+function bucketClient(port) {
+	const s3 = new S3Client({
+		region: "us-east-1",
+		endpoint: `http://localhost:${port}`,
+		forcePathStyle: true,
+		credentials: {
+			accessKeyId: LOCAL_USER$1,
+			secretAccessKey: LOCAL_USER$1
+		}
+	});
+	return {
+		async exists(bucket) {
+			try {
+				await s3.send(new HeadBucketCommand({ Bucket: bucket }));
+				return true;
+			} catch {
+				return false;
+			}
+		},
+		async create(bucket) {
+			await s3.send(new CreateBucketCommand({ Bucket: bucket }));
+		},
+		async policy(bucket) {
+			try {
+				return (await s3.send(new GetBucketPolicyCommand({ Bucket: bucket }))).Policy;
+			} catch {
+				return;
+			}
+		},
+		async setPolicy(bucket, policy) {
+			await s3.send(new PutBucketPolicyCommand({
+				Bucket: bucket,
+				Policy: policy
+			}));
+		}
+	};
 }
+//#endregion
+//#region src/reconcile/compose.ts
 /**
-* The URL a migrator connects with — the owner role, which can create, alter
-* and drop.
+* The compose document a plan implies.
 *
-* Never in `provides`, which is the whole point. A handler that could reach this
-* could `DROP TABLE`, and the security property the role split exists for is
-* that it cannot: the value is injected by `gkm exec` for the migrate step and
-* by nothing else.
+* The third declaration of the same containers disappears here: today a
+* `services: ['postgres','minio']` block is kept in step with the code by hand,
+* which is the triplication this design exists to remove, in the one place you
+* touch every day. A `database` implies Postgres; the list is derived.
+*
+* Returns an object rather than a string for the same reason `plan` is pure —
+* what should exist is asserted as data, and turning it into YAML is one line at
+* the edge.
+*
+* What stays config is unchanged: images and versions are pinned explicitly, and
+* a container no construct implies is still declared by hand. Neutral facts come
+* from the declaration, provider detail from config.
 */
-function ownerUrl(resource, plan, ports, project) {
-	if (!resource.container) return void 0;
-	const port = ports[primaryPortKey(resource.container)];
-	if (port === void 0) return void 0;
-	const owner = ownerRole(localRole(resource));
-	return postgres(port, rootDatabase(resource, plan), {
-		user: owner,
-		password: localRolePassword(project, plan, owner)
-	});
-}
+/** The credential every derived container is brought up with locally. */
+const LOCAL_USER = "geekmidas";
 /**
-* The shared broker keys, when anything is published or consumed.
+* The token the local cache accepts.
 *
-* A queue's own key is the producer's. These two are the *connection* itself,
-* which locally is one broker for every queue and topic in the project: the
-* generated pollers open a single connection and subscribe each worker by name
-* on it. Deployed there is no such thing — a Lambda is handed its own event
-* source — so this pair exists for the local target and says so.
+* Fixed rather than generated: it is only ever reachable on a port this project
+* published, and the URL that carries it is derived, so nothing is made safer
+* by making it unguessable and a stable one keeps `redis-cli` sessions working.
 */
-function brokerEnv(plan, ports) {
-	const carrier = plan.resources.find((r) => r.kind === "queue" || r.kind === "topic");
-	if (!carrier) return {};
-	const publisher = urlFor(carrier, plan, ports, "");
-	if (!publisher) return {};
-	return {
-		EVENT_PUBLISHER_CONNECTION_STRING: publisher,
-		EVENT_SUBSCRIBER_CONNECTION_STRING: plan.events === "sns" ? publisher.replace(/^sns:/, "sqs:") : publisher
-	};
-}
+const LOCAL_TOKEN = "geekmidas";
 /**
-* The URL for one planned resource.
+* Build the compose document for a plan.
 *
-* Every part of it comes from the resource and the port it was published on.
+* Every container is published on its assigned port, never on the image's
+* default: the point of allocation is that two projects can run at once, and
+* one container publishing 5432 puts that back.
 */
-function urlFor(resource, plan, ports, project, addresses = {}) {
-	if (resource.kind === "secret") return localSecret(project, plan, resource);
-	if (resource.kind === "credential") return void 0;
-	if (resource.kind === "rest-api" || resource.kind === "site") {
-		const address = addresses[resource.id];
-		const edge = plan.containers.includes("caddy") ? ports[primaryPortKey("caddy")] : void 0;
-		return address && edge !== void 0 ? `https://${hostFor(resource, project)}:${edge}` : address;
+function composeFor(plan, options) {
+	const services = {};
+	const volumes = {};
+	for (const container of [...plan.containers].sort()) {
+		const declared = container === "postgres" ? plan.resources.find((r) => r.version)?.version : void 0;
+		const image = declared ? postgresImage(declared) : DEFAULT_IMAGES[container];
+		if (!image) throw new UnknownContainer(container);
+		services[container] = define(container, image, publish(container, options.ports));
+		const volume = volumeOf(container);
+		if (volume) volumes[volume] = {};
 	}
-	if (!resource.container) return void 0;
-	const port = ports[primaryPortKey(resource.container)];
-	if (port === void 0) return void 0;
-	switch (resource.kind) {
-		case "database":
-		case "database-schema":
-		case "database-reader": {
-			const database = rootDatabase(resource, plan);
-			if (resource.roles === false) {
-				const schema = schemaOf(resource, plan);
-				return schema ? `${postgres(port, database)}?search_path=${schema}` : postgres(port, database);
+	return {
+		name: options.project,
+		services: {
+			...services,
+			...options.apps
+		},
+		...Object.keys(volumes).length ? { volumes } : {}
+	};
+}
+/** Render a compose document as the file it becomes. */
+function toYaml(file) {
+	return `# Generated by gkm from the construct manifest — do not edit.
+# Containers are derived from what the app declares. Image pins and anything
+# no construct implies go in your own docker-compose.yml, which is merged over
+# this file and wins:
+#
+#   docker compose -f docker-compose.constructs.yml -f docker-compose.yml …
+#
+# "gkm dev" and "gkm test" start the containers. The apps sit behind the
+# "apps" profile: run "gkm setup", then
+#   docker compose -f docker-compose.constructs.yml --profile apps up --build
+${stringify(file, { lineWidth: 0 })}`;
+}
+/** A container with no image, from config or from the defaults. */
+var UnknownContainer = class extends Error {
+	/** The container that could not be resolved. */
+	container;
+	/** The containers that have a default, so the caller can see the set. */
+	known = Object.keys(DEFAULT_IMAGES).sort();
+	constructor(container) {
+		super("No image is known for this container; pin one in config");
+		this.name = "UnknownContainer";
+		this.container = container;
+	}
+};
+/** One container's definition, published on the port it was assigned. */
+function define(container, image, published) {
+	switch (container) {
+		case "postgres": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			environment: {
+				POSTGRES_USER: LOCAL_USER,
+				POSTGRES_PASSWORD: LOCAL_USER,
+				POSTGRES_DB: LOCAL_USER
+			},
+			volumes: ["postgres-data:/var/lib/postgresql"],
+			healthcheck: {
+				test: ["CMD-SHELL", `pg_isready -U ${LOCAL_USER}`],
+				interval: "5s",
+				timeout: "3s",
+				retries: 10,
+				start_period: "10s"
 			}
-			const role = resource.kind === "database-reader" ? readerRole(parentRole(resource, plan)) : localRole(resource);
-			return postgres(port, database, {
-				user: role,
-				password: localRolePassword(project, plan, role)
-			});
-		}
-		case "email": return `smtp://${LOCAL_HOST}:${port}`;
-		case "objects": return `s3://${resource.name}?region=${LOCAL_REGION}&endpoint=http://${LOCAL_HOST}:${port}&forcePathStyle=true`;
-		case "file-server": {
-			const origin = plan.resources.find((r) => r.id === resource.of);
-			if (!origin) return void 0;
-			return plan.containers.includes("caddy") ? `https://${hostFor(resource, project)}:${port}` : `http://${LOCAL_HOST}:${port}/${origin.name}`;
-		}
-		case "cache":
-			if (resource.of) {
-				const parent = plan.resources.find((r) => r.id === resource.of);
-				const url = parent ? urlFor(parent, plan, ports, project, addresses) : void 0;
-				return url ? withTable(url, resource.table ?? cacheTable(resource.id)) : void 0;
+		};
+		case "minio": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			environment: {
+				MINIO_ROOT_USER: LOCAL_USER,
+				MINIO_ROOT_PASSWORD: LOCAL_USER
+			},
+			command: "server --console-address \":9001\" /data",
+			volumes: ["minio-data:/data"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"mc",
+					"ready",
+					"local"
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5,
+				start_period: "10s"
 			}
-			switch (plan.cache) {
-				case "elasticache": return `redis://${LOCAL_HOST}:${port}`;
-				default: return `http://:${LOCAL_TOKEN}@${LOCAL_HOST}:${port}`;
+		};
+		case "caddy": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			volumes: [
+				"./.gkm/Caddyfile:/etc/caddy/Caddyfile:ro",
+				"./.gkm/caddy-sites:/etc/caddy/sites:ro",
+				"caddy-data:/data"
+			],
+			extra_hosts: ["host.docker.internal:host-gateway"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"caddy",
+					"version"
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5
+			}
+		};
+		case "mailpit": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			environment: {
+				MP_SMTP_AUTH_ACCEPT_ANY: "1",
+				MP_SMTP_AUTH_ALLOW_INSECURE: "1"
+			},
+			healthcheck: {
+				test: [
+					"CMD",
+					"wget",
+					"-q",
+					"--spider",
+					"http://localhost:8025"
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5
+			}
+		};
+		case "redis": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			volumes: ["redis-data:/data"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"redis-cli",
+					"ping"
+				],
+				interval: "5s",
+				timeout: "3s",
+				retries: 5
+			}
+		};
+		case "redis-http": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			environment: {
+				SRH_MODE: "env",
+				SRH_TOKEN: LOCAL_TOKEN,
+				SRH_CONNECTION_STRING: "redis://redis:6379"
+			},
+			depends_on: ["redis"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"wget",
+					"-q",
+					"-O",
+					"/dev/null",
+					"http://127.0.0.1:80/"
+				],
+				interval: "5s",
+				timeout: "3s",
+				retries: 10
+			}
+		};
+		case "rabbitmq": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			environment: {
+				RABBITMQ_DEFAULT_USER: LOCAL_USER,
+				RABBITMQ_DEFAULT_PASS: LOCAL_USER
+			},
+			volumes: ["rabbitmq-data:/var/lib/rabbitmq"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"rabbitmq-diagnostics",
+					"-q",
+					"ping"
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5
+			}
+		};
+		case "localstack": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			environment: {
+				AWS_DEFAULT_REGION: "us-east-1",
+				AWS_ACCESS_KEY_ID: "LSIAQAAAAAAVNCBMPNSG",
+				AWS_SECRET_ACCESS_KEY: LOCAL_USER
+			},
+			volumes: ["localstack-data:/var/lib/localstack"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"curl",
+					"-f",
+					"http://localhost:4566/_localstack/health"
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5,
+				start_period: "10s"
 			}
-		case "queue":
-		case "topic": return broker(plan, port);
-		default: return void 0;
-	}
-}
-/**
-* The producer's connection string, composed from the backend the plan chose.
-*
-* The protocol is what picks the transport, so a producer never branches: the
-* same `.publish()` reaches pg-boss here and SQS deployed because the string it
-* was handed said so.
-*/
-function broker(plan, port) {
-	switch (plan.events) {
-		case "pgboss": {
-			const database = plan.resources.find((r) => r.kind === "database");
-			if (!database) throw new PgBossNeedsDatabase([]);
-			return `pgboss://${LOCAL_USER}:${LOCAL_USER}@${LOCAL_HOST}:${port}/${database.name}?schema=${PGBOSS_SCHEMA}`;
-		}
-		case "rabbitmq": return `rabbitmq://${LOCAL_USER}:${LOCAL_USER}@${LOCAL_HOST}:${port}?exchange=${RABBITMQ_EXCHANGE}`;
-		case "sns": throw new UnprovisionedEventsBackend("sns");
+		};
+		default: throw new UnknownContainer(container);
 	}
 }
-/** A local Postgres URL, master credential and all. */
-function postgres(port, database, credential = {
-	user: LOCAL_USER,
-	password: LOCAL_USER
-}) {
-	return `postgres://${credential.user}:${credential.password}@${LOCAL_HOST}:${port}/${database}`;
-}
 /**
-* The role a handler connects as, for one database or tenant.
+* The published port mappings for a container.
 *
-* The construct's id, lowercased and stage-scoped exactly as its database or
-* schema is — so `Orders` in the `test` stage connects as `orders_test`, and two
-* stages sharing one cluster cannot share a credential. Roles are cluster-scoped
-* in Postgres, which is why the suffix is not optional here the way it is for a
-* schema.
+* Every port is looked up by its own key rather than being derived as an offset
+* from the container's first, so MinIO's console cannot land on whatever was
+* allocated to the next container.
 */
-function localRole(resource) {
-	return resource.name;
+function publish(container, ports) {
+	return portsOf(container).map((port) => {
+		const assigned = ports[port.key];
+		if (assigned === void 0) throw new UnassignedPort(port.key);
+		return `${assigned}:${port.inside}`;
+	});
 }
+/** A planned port that allocation never assigned. */
+var UnassignedPort = class extends Error {
+	/** The port key that went unassigned, e.g. `minio-console`. */
+	key;
+	constructor(key) {
+		super("No port was assigned for this container port");
+		this.name = "UnassignedPort";
+		this.key = key;
+	}
+};
+//#endregion
+//#region src/reconcile/docker.ts
 /**
-* The password for a derived local role.
-*
-* Derived rather than random, for the same reason the local secret is: a
-* password that changed on every `gkm dev` would lock a developer out of the
-* data they had a moment ago. Seeded by the project so two checkouts do not
-* share one, and by the stage so `test` and `development` do not.
+* The real Docker, behind the small interface reconcile needs.
 *
-* It is a *local* credential by construction — the cluster is on loopback and
-* the seed is a checkout path — and no deployed target uses this function.
-*/
-function localRolePassword(project, plan, role) {
-	return createHash("sha256").update(`${project}:${plan.stage}:role:${role}`).digest("base64url").slice(0, 32);
-}
-/**
-* A cache's address: its database's URL, carrying the table it reads.
+* Shells out to `docker compose` rather than talking to the daemon socket: it is
+* what a developer runs by hand when something is wrong, so the two cannot
+* disagree, and it keeps Docker out of this package's dependencies.
 *
-* Appended rather than kept beside the URL as a second key, for the reason the
-* design gives everywhere else — an address and what it opens are one fact, and
-* two keys are one more thing to keep in step.
+* Every call is scoped to the generated compose file. Nothing here can touch a
+* container this project did not generate.
 */
-function withTable(url, table) {
-	const parsed = new URL(url);
-	parsed.searchParams.set("table", table);
-	return parsed.toString();
-}
+const run = promisify(execFile);
 /**
-* The physical database a derived resource lives in.
+* The generated file, then the project's own if it has one.
 *
-* Walks `of` to the top rather than reading the immediate parent, because a
-* reader's parent may itself be a schema tenant — two hops from the database
-* that actually exists.
+* Merged in that order so the project's wins — an `image:` there pins a
+* container this file derived, and a service there is added beside them.
 */
-function rootDatabase(resource, plan) {
-	const byId = new Map(plan.resources.map((r) => [r.id, r]));
-	let current = resource;
-	while (current.of) {
-		const parent = byId.get(current.of);
-		if (!parent) break;
-		current = parent;
-	}
-	return current.name;
-}
-/** The schema a derived resource puts on its search path, if it has one. */
-function schemaOf(resource, plan) {
-	const byId = new Map(plan.resources.map((r) => [r.id, r]));
-	let current = resource;
-	while (current) {
-		if (current.kind === "database-schema") return current.schema;
-		current = current.of ? byId.get(current.of) : void 0;
-	}
-	return void 0;
+function composeFiles(composePath) {
+	const project = join(dirname(composePath), "docker-compose.yml");
+	return [
+		"-f",
+		composePath,
+		...existsSync(project) ? ["-f", project] : []
+	];
 }
-/**
-* A backend whose local addresses cannot be derived yet.
-*
-* SNS and SQS are addressed by ARN, which means the topic and queue have to be
-* created in LocalStack before a URL can name them. Until that provisioning
-* lands, saying so is better than handing out a string that fails on first use.
-*/
-var UnprovisionedEventsBackend = class extends Error {
-	constructor(backend) {
-		super(`The local target cannot derive addresses for '${backend}' yet — its topics and queues are named by ARN, which nothing creates locally. Use 'pgboss' (the default) or 'rabbitmq' for local development.`);
-		this.backend = backend;
-		this.name = "UnprovisionedEventsBackend";
+/** How long to wait for containers to pass their health checks. */
+const HEALTH_TIMEOUT_MS = 12e4;
+const dockerCli = {
+	async publishedPort(composePath, service, inside) {
+		try {
+			const { stdout } = await run("docker", [
+				"compose",
+				...composeFiles(composePath),
+				"port",
+				service,
+				String(inside)
+			]);
+			const port = Number(stdout.trim().split(":").pop());
+			return Number.isFinite(port) && port > 0 ? port : void 0;
+		} catch {
+			return;
+		}
+	},
+	async up(composePath, services) {
+		await run("docker", [
+			"compose",
+			...composeFiles(composePath),
+			"up",
+			"-d",
+			"--remove-orphans",
+			"--wait",
+			`--wait-timeout=${Math.floor(HEALTH_TIMEOUT_MS / 1e3)}`,
+			...services
+		]);
+	},
+	async copyOut(composePath, service, from, to) {
+		await mkdir(dirname(to), { recursive: true });
+		await run("docker", [
+			"compose",
+			...composeFiles(composePath),
+			"cp",
+			`${service}:${from}`,
+			to
+		]);
+	},
+	async reload(composePath, service) {
+		await run("docker", [
+			"compose",
+			...composeFiles(composePath),
+			"exec",
+			"-T",
+			service,
+			"caddy",
+			"reload",
+			"--config",
+			"/etc/caddy/Caddyfile"
+		]);
+	},
+	async healthy(composePath, services) {
+		if (services.length === 0) return true;
+		try {
+			const { stdout } = await run("docker", [
+				"compose",
+				...composeFiles(composePath),
+				"ps",
+				"--format",
+				"json",
+				...services
+			]);
+			const running = /* @__PURE__ */ new Set();
+			for (const line of stdout.trim().split("\n").filter(Boolean)) {
+				const entry = JSON.parse(line);
+				if (entry.State === "running" && (entry.Health === void 0 || entry.Health === "" || entry.Health === "healthy") && entry.Service) running.add(entry.Service);
+			}
+			return services.every((service) => running.has(service));
+		} catch {
+			return false;
+		}
 	}
 };
+//#endregion
+//#region src/reconcile/ports.ts
 /**
-* The value a secret resolves to locally.
+* Port allocation — why two projects can run at once.
 *
-* A hash of what identifies it, so it is stable, distinct per project, stage
-* and construct, and never written to disk as a literal. Deployed this is the
-* one kind whose value does *not* come from here — a secret manager generates
-* it once and the target reads it back.
+* Publishing `5432:5432` means the second project on your machine cannot start.
+* Nothing solves that except giving each project its own ports, and what makes
+* it *possible* is the single-`<NAME>_URL` rule: an app reads `ORDERS_URL` and
+* never sees a host or a port, so reconcile is free to bind whatever is
+* available and compose the URL from what it bound. An app reading `DB_HOST` and
+* `DB_PORT` separately could not be moved this way.
+*
+* Assignments are **persisted, not recomputed**. Recomputing means adding a
+* construct renumbers its neighbours, and every running container, saved
+* connection string, and `psql` history goes stale at once.
+*
+* Pure, with the liveness probe injected — a collision with another project's
+* stack is a fact about the machine, and keeping it a parameter is what lets the
+* rules be asserted without binding a socket.
 */
-function localSecret(project, plan, resource) {
-	return createHash("sha256").update(`${project}:${plan.stage}:${resource.id}`).digest("base64url").slice(0, 43);
-}
-
-//#endregion
-//#region src/reconcile/ports.ts
 /**
 * The window ports are drawn from.
 *
@@ -1477,17 +1658,33 @@ async function nextFree(from, taken, probe) {
 * rather than as a connection failure ten minutes later.
 */
 function isPortFree(port) {
-	return new Promise((resolve$1) => {
+	return new Promise((resolve) => {
 		const server = createServer();
-		server.once("error", () => resolve$1(false));
-		server.once("listening", () => server.close(() => resolve$1(true)));
+		server.once("error", () => resolve(false));
+		server.once("listening", () => server.close(() => resolve(true)));
 		server.listen(port, "0.0.0.0");
 	});
 }
-
 //#endregion
 //#region src/reconcile/provision.ts
 /**
+* Creating what the URLs name.
+*
+* Convergent and idempotent: every statement asks whether the thing exists
+* first, so reconciling repeatedly is free and a half-applied run recovers by
+* being run again. That property is what lets `gkm dev` do this on every start.
+*
+* The line the design draws is at data, not at side effects — this creates
+* databases, schemas, and buckets, and it never seeds, resets, or drops. A
+* developer who wants their data gone asks for it explicitly.
+*
+* Statement generation is separated from application for the reason the design
+* gives: the same DDL has to run in-process locally and from a provisioner in a
+* VPC, and one implementation is what stops "works locally, fails deployed".
+* When the role DDL lands in `@geekmidas/db` this delegates to it rather than
+* growing its own.
+*/
+/**
 * The Postgres work a plan implies.
 *
 * Databases before the schemas inside them, which `provisionOrder` already
@@ -1629,8 +1826,7 @@ async function applyPostgres(client, statements) {
 			});
 			continue;
 		}
-		const rows = await client.query(statement.database, statement.exists.sql, statement.exists.values);
-		if (rows.length > 0) {
+		if ((await client.query(statement.database, statement.exists.sql, statement.exists.values)).length > 0) {
 			applied.push({
 				id: statement.id,
 				describe: statement.describe,
@@ -1755,9 +1951,20 @@ async function applyBuckets(client, buckets) {
 	}
 	return applied;
 }
-
 //#endregion
 //#region src/reconcile/state.ts
+/**
+* What reconcile records, and the hash that lets it do nothing.
+*
+* Reconciling on every `gkm dev` is only acceptable if the converged case is
+* free, so the desired plan is hashed: matching hash plus healthy containers
+* means there is nothing to do. Without that, the automatic reconcile the design
+* asks for would tax every start.
+*
+* Almost nothing needs recording — roles are queried, migrations have their own
+* table, containers are remembered by Docker. Only ports and this hash have no
+* other owner.
+*/
 const STATE_DIR = ".gkm/reconcile";
 /**
 * The hash of everything a reconcile would act on.
@@ -1786,7 +1993,7 @@ async function loadState(root, stage) {
 		const state = JSON.parse(raw);
 		return state.stage === stage ? state : void 0;
 	} catch {
-		return void 0;
+		return;
 	}
 }
 /** Record what was applied, so the next run can skip it. */
@@ -1798,11 +2005,36 @@ async function saveState(root, state) {
 function statePath(root, stage) {
 	return join(root, STATE_DIR, `${stage}.json`);
 }
-
 //#endregion
 //#region src/reconcile/index.ts
-/** Where the generated compose file is written, relative to the project root. */
-const COMPOSE_PATH = ".gkm/docker-compose.yml";
+/**
+* Reconcile — the one convergent function `gkm dev`, `gkm test`, and `gkm setup`
+* all call.
+*
+* Three phases, and only this one has side effects: declaring is pure (`gkm
+* build` and the dev watcher), running reads `<NAME>_URL` and provisions
+* nothing. Reconcile computes the desired state, compares, and applies the
+* difference — which is what makes "when does it run" answerable with
+* *whenever, repeatedly*.
+*
+* It is safe to run automatically because its blast radius is entirely local:
+* this project's containers, this project's `.gkm/`. Nothing it does can reach a
+* cloud. The line is drawn at data, not at side effects — it allocates ports,
+* writes compose, starts containers, and creates roles; it never seeds, resets,
+* or drops.
+*
+* Docker is injected rather than imported so the rules above can be asserted
+* without a daemon. The default implementation is the real one.
+*/
+/**
+* Where the generated compose file is written, relative to the project root.
+*
+* At the root, beside the project's own `docker-compose.yml`, because the two
+* are one stack: this file is everything the constructs imply and is never
+* edited, that one is anything they cannot express — an image pin, an extra
+* service — and is merged over it, so it wins.
+*/
+const COMPOSE_PATH = "docker-compose.constructs.yml";
 /**
 * The local edge's config, beside the compose file that mounts it.
 *
@@ -1840,6 +2072,7 @@ const CADDY_ROOT_IN_CONTAINER = "/data/caddy/pki/authorities/local/root.crt";
 async function reconcile(options) {
 	const { root, project, manifest, stage, start = true, provision = true, docker = dockerCli, probe = isPortFree, sql = pgClient, buckets = bucketClient } = options;
 	const plan = planFor(manifest, stage, provisionOrder(manifest), {
+		localStage: options.localStage,
 		events: options.events,
 		cache: options.cache,
 		extraContainers: options.extraContainers,
@@ -1854,7 +2087,7 @@ async function reconcile(options) {
 	const compose = composeFor(plan, {
 		project,
 		ports,
-		...options.images ? { images: options.images } : {}
+		...options.apps ? { apps: options.apps(plan.containers) } : {}
 	});
 	const caddyfile = toCaddyfile(sitesFor(plan, project, options.addresses));
 	const hash = planHash(plan, compose, { caddyfile });
@@ -1877,13 +2110,16 @@ async function reconcile(options) {
 		hash,
 		changed: false
 	};
-	const recorded = await loadState(root, stage);
-	const converged = recorded?.hash === hash && (!start || await docker.healthy(composePath, plan.containers));
-	if (converged) return result;
+	if ((await loadState(root, stage))?.hash === hash && existsSync(composePath) && (!start || await docker.healthy(composePath, plan.containers))) return result;
 	await write(composePath, toYaml(compose));
 	if (plan.containers.includes("caddy")) {
 		await write(join(root, CADDYFILE_PATH), caddyfileRoot());
 		await write(join(root, caddySitesPath(stage)), caddyfile);
+		await pruneCaddySites(root, [
+			stage,
+			options.localStage,
+			TEST_STAGE
+		]);
 	}
 	if (start && plan.containers.length > 0) await docker.up(composePath, plan.containers);
 	if (start && plan.containers.includes("caddy")) await docker.reload(composePath, "caddy").catch(() => {});
@@ -1949,6 +2185,20 @@ function addressesFor(containers, ports) {
 	return addresses;
 }
 /** Write a file only when its content would change, so mtimes stay meaningful. */
+/**
+* Remove the routes of stages this project no longer reconciles.
+*
+* Only the local stage and `test` are ever written, so any other file is left
+* over from a stage that was renamed — `development` becoming `dev`. Caddy
+* imports every file, and the leftover declares the same hosts as its
+* replacement: it refuses the whole config as ambiguous, and every URL behind
+* the edge goes with it.
+*/
+async function pruneCaddySites(root, stages) {
+	const dir = dirname(join(root, caddySitesPath(TEST_STAGE)));
+	const keep = new Set(stages.map((stage) => stage && `${stage}.caddy`));
+	for (const file of await readdir(dir)) if (file.endsWith(".caddy") && !keep.has(file)) await rm(join(dir, file));
+}
 async function write(path, content) {
 	try {
 		if (await readFile(path, "utf-8") === content) return;
@@ -1956,10 +2206,28 @@ async function write(path, content) {
 	await mkdir(dirname(path), { recursive: true });
 	await writeFile(path, content);
 }
-
 //#endregion
 //#region src/reconcile/workspace.ts
 /**
+* Workspace config → reconcile.
+*
+* Nothing here is read from a `services:` block — there is none. Which
+* containers exist comes from the manifest; which backend a cache or a broker
+* resolves to comes from the deploy target; and an image pin is the project's
+* own `docker-compose.yml`, merged over the generated file.
+*
+* Shared by `gkm setup`, `gkm dev`, and `gkm test` so all three converge on the
+* same state, differing only in the stage they pass.
+*/
+var workspace_exports = /* @__PURE__ */ __exportAll({
+	backendsOf: () => backendsOf,
+	constructGlobs: () => constructGlobs,
+	derivedContainers: () => derivedContainers,
+	reconcileWorkspace: () => reconcileWorkspace,
+	surfaceAddresses: () => surfaceAddresses,
+	usesConstructs: () => usesConstructs
+});
+/**
 * Every constructs glob in the workspace, resolved against its app.
 *
 * Absolute because discovery globs from a single cwd while apps live in
@@ -1972,16 +2240,13 @@ function constructGlobs(workspace) {
 function usesConstructs(workspace) {
 	return constructGlobs(workspace).length > 0;
 }
-/**
-* Image pins, by container. The config half of the derived/config split.
-*
-* Read from `services.images` rather than from the backend keys beside it.
-* They used to share one key, which is how `cache: true` came to mean "start a
-* Redis" — the last way a container could exist because config asked for one
-* instead of because something declared it.
-*/
-function imagePins(workspace) {
-	return { ...workspace.services.images };
+/** The backends a workspace's target implies, as the plan takes them. */
+function backendsOf(workspace) {
+	const on = providerOf(workspace);
+	return {
+		events: eventsBackendFor(on),
+		cache: cacheBackendFor(on)
+	};
 }
 /**
 * The containers a workspace's declarations imply, without reconciling.
@@ -1999,8 +2264,8 @@ async function derivedContainers(workspace, stage, manifest) {
 		cwd: workspace.root
 	});
 	return planFor(found, stage, provisionOrder(found), {
-		events: workspace.services.events,
-		cache: cacheBackendOf(workspace.services.cache, providerOf(workspace))
+		localStage: workspace.stages.local,
+		...backendsOf(workspace)
 	}).containers;
 }
 /**
@@ -2019,11 +2284,11 @@ async function reconcileWorkspace(workspace, options) {
 		project: workspace.name,
 		manifest,
 		stage: options.stage,
-		events: workspace.services.events,
-		cache: cacheBackendOf(workspace.services.cache, providerOf(workspace)),
-		images: imagePins(workspace),
+		localStage: workspace.stages.local,
+		...backendsOf(workspace),
 		saved: await loadPortState(workspace.root),
 		addresses: surfaceAddresses(workspace, manifest),
+		apps: (containers) => appServices(workspace, manifest, containers),
 		...options.start === void 0 ? {} : { start: options.start }
 	});
 	await savePortState(workspace.root, { ...result.ports });
@@ -2045,26 +2310,20 @@ async function reconcileWorkspace(workspace, options) {
 * an app serving both its own API and an auth server publishes one address
 * twice — which is exactly what it does at runtime.
 */
-function surfaceAddresses(workspace, manifest) {
+function surfaceAddresses(workspace, manifest, at = (_app, port) => localAddress(port)) {
 	const addresses = {};
 	for (const [id, declaration] of Object.entries(manifest)) {
 		if (declaration.kind !== "rest-api" && declaration.kind !== "site") continue;
-		const host = declaration.kind === "site" ? appKey(id) : appKeyOfHost(manifest, id);
-		const app = host ? workspace.apps[host] : void 0;
-		if (app?.port) addresses[id] = localAddress(app.port);
+		const host = appKey(id);
+		const port = workspace.apps[host]?.port;
+		if (port) addresses[id] = at(host, port);
 	}
 	return addresses;
 }
-/** The app key serving a surface, following a mount to its host. */
-function appKeyOfHost(manifest, id) {
-	const host = hostOf(manifest, id);
-	return host ? appKey(host) : void 0;
-}
 /** Where a local process answers, given the port the workspace gave it. */
 function localAddress(port) {
 	return `http://localhost:${port}`;
 }
-
 //#endregion
 //#region src/credentials/index.ts
 const logger = console;
@@ -2097,15 +2356,15 @@ function loadEnvFiles(envConfig, cwd = process.cwd()) {
 * @internal Exported for testing
 */
 async function isPortAvailable(port) {
-	return new Promise((resolve$1) => {
+	return new Promise((resolve) => {
 		const server = createServer();
 		server.once("error", (err) => {
-			if (err.code === "EADDRINUSE") resolve$1(false);
-			else resolve$1(false);
+			if (err.code === "EADDRINUSE") resolve(false);
+			else resolve(false);
 		});
 		server.once("listening", () => {
 			server.close();
-			resolve$1(true);
+			resolve(true);
 		});
 		server.listen(port);
 	});
@@ -2174,11 +2433,10 @@ async function savePortState(workspaceRoot, ports) {
 */
 function getContainerHostPort(workspaceRoot, service, containerPort) {
 	try {
-		const result = execSync(`docker compose port ${service} ${containerPort}`, {
+		const match = execSync(`docker compose port ${service} ${containerPort}`, {
 			cwd: workspaceRoot,
 			stdio: "pipe"
-		}).toString().trim();
-		const match = result.match(/:(\d+)$/);
+		}).toString().trim().match(/:(\d+)$/);
 		return match ? Number(match[1]) : null;
 	} catch {
 		return null;
@@ -2191,8 +2449,7 @@ function getContainerHostPort(workspaceRoot, service, containerPort) {
 * @internal Exported for testing
 */
 async function resolveServicePorts(workspaceRoot) {
-	const composePath = join(workspaceRoot, "docker-compose.yml");
-	const mappings = parseComposePortMappings(composePath);
+	const mappings = parseComposePortMappings(join(workspaceRoot, "docker-compose.yml"));
 	if (mappings.length === 0) return {
 		dockerEnv: {},
 		ports: {},
@@ -2358,14 +2615,13 @@ async function startWorkspaceServices(workspace, portEnv, secretsEnv) {
 * For workspace app: maps {APP}_DATABASE_URL → DATABASE_URL.
 * @internal Exported for testing
 */
-async function loadSecretsForApp(secretsRoot, appName, stages = ["dev", "development"]) {
+async function loadSecretsForApp(secretsRoot, stage, appName) {
 	let secrets = {};
-	for (const stage of stages) if (secretsExist(stage, secretsRoot)) {
+	if (secretsExist(stage, secretsRoot)) {
 		const stageSecrets = await readStageSecrets(stage, secretsRoot);
 		if (stageSecrets) {
 			logger.log(`🔐 Loading secrets from stage: ${stage}`);
 			secrets = toEmbeddableSecrets(stageSecrets);
-			break;
 		}
 	}
 	if (Object.keys(secrets).length === 0) return {};
@@ -2427,13 +2683,12 @@ ${generateCredentialsInjection(secretsJsonPath)}`;
 * @internal Exported for testing
 */
 async function createEntryWrapper(wrapperPath, entryPath, secretsJsonPath) {
-	const credentialsInjection = secretsJsonPath ? `${generateCredentialsInjection(secretsJsonPath)}
-` : "";
 	const content = `#!/usr/bin/env node
 /**
  * Entry wrapper generated by 'gkm dev --entry'
  */
-${credentialsInjection}// Import and run the user's entry file (dynamic import ensures secrets load first)
+${secretsJsonPath ? `${generateCredentialsInjection(secretsJsonPath)}
+` : ""}// Import and run the user's entry file (dynamic import ensures secrets load first)
 await import('${entryPath}');
 `;
 	await writeFile(wrapperPath, content);
@@ -2446,7 +2701,7 @@ await import('${entryPath}');
 * @param options.resolveDockerPorts - How to resolve Docker ports:
 *   - `'full'` (default): probe running containers, saved state, then find available ports. Used by dev/test.
 *   - `'readonly'`: check running containers and saved state only, never probe for new ports. Used by exec.
-* @param options.stages - Secret stages to try, in order. Default: ['dev', 'development'].
+* @param options.stage - The stage whose secrets to load. Default: the project's `stages.local`.
 * @param options.startDocker - Start Docker Compose services after port resolution. Default: false.
 * @param options.secretsFileName - Custom secrets JSON filename. Default: 'dev-secrets-{appName}.json' or 'dev-secrets.json'.
 * @internal Exported for testing
@@ -2458,31 +2713,34 @@ async function prepareEntryCredentials(options) {
 	let secretsRoot = cwd;
 	let appName;
 	let appInfo;
+	let workspace;
 	try {
 		appInfo = await loadWorkspaceAppInfo(cwd);
+		workspace = appInfo.workspace;
 		workspaceAppPort = appInfo.app.port;
 		secretsRoot = appInfo.workspaceRoot;
 		appName = appInfo.appName;
 	} catch {
-		secretsRoot = findSecretsRoot(cwd);
+		workspace = await loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace).catch(() => void 0);
+		secretsRoot = workspace?.root ?? findSecretsRoot(cwd);
 		appName = getAppNameFromCwd(cwd) ?? void 0;
 	}
 	const resolvedPort = options.explicitPort ?? workspaceAppPort ?? 3e3;
-	const credentials = await loadSecretsForApp(secretsRoot, appName, options.stages);
+	const stage = options.stage ?? workspace?.stages.local;
+	const credentials = stage ? await loadSecretsForApp(secretsRoot, stage, appName) : {};
 	credentials.PORT = String(resolvedPort);
 	const declaredKeys = [];
-	if (appInfo && usesConstructs(appInfo.workspace)) {
-		const { reconcileWorkspace: reconcileWorkspace$1 } = await import("./workspace-DK4WWJIn.mjs");
-		const reconciled = await reconcileWorkspace$1(appInfo.workspace, {
-			stage: options.reconcileStage ?? "development",
+	if (workspace && usesConstructs(workspace)) {
+		const { reconcileWorkspace } = await Promise.resolve().then(() => workspace_exports);
+		const reconciled = await reconcileWorkspace(workspace, {
+			stage: options.reconcileStage ?? workspace.stages.local,
 			start: options.startDocker ?? false
 		});
 		Object.assign(credentials, reconciled.env);
 		declaredKeys.push(...Object.keys(reconciled.env));
 		if (Object.keys(reconciled.env).length > 0) logger.log(`🔌 Resolved ${Object.keys(reconciled.env).length} declared URL(s)`);
 	} else {
-		const composePath = join(secretsRoot, "docker-compose.yml");
-		const mappings = parseComposePortMappings(composePath);
+		const mappings = parseComposePortMappings(join(secretsRoot, "docker-compose.yml"));
 		if (mappings.length > 0) {
 			let resolvedPorts;
 			if (portMode === "full") resolvedPorts = await resolveServicePorts(secretsRoot);
@@ -2503,8 +2761,10 @@ async function prepareEntryCredentials(options) {
 					mappings
 				};
 			}
-			if (options.startDocker) if (appInfo) await startWorkspaceServices(appInfo.workspace, resolvedPorts.dockerEnv, credentials);
-			else await startComposeServices(secretsRoot, resolvedPorts.dockerEnv, credentials);
+			if (options.startDocker) {
+				if (appInfo) await startWorkspaceServices(appInfo.workspace, resolvedPorts.dockerEnv, credentials);
+				else await startComposeServices(secretsRoot, resolvedPorts.dockerEnv, credentials);
+			}
 			if (Object.keys(resolvedPorts.ports).length > 0) {
 				const rewritten = rewriteUrlsWithPorts(credentials, resolvedPorts);
 				Object.assign(credentials, rewritten);
@@ -2542,7 +2802,7 @@ async function prepareEntryCredentials(options) {
 		declaredKeys
 	};
 }
-
 //#endregion
-export { LOCAL_CA_PATH, applyPostgres, cacheBackendOf, constructGlobs, createCredentialsPreload, createEntryWrapper, derivedContainers, emailBackendOf, findAvailablePort, imagePins, isPortAvailable, loadEnvFiles, loadSecretsForApp, prepareEntryCredentials, providerOf, reconcileWorkspace, resolveServicePorts, resourceName, rewriteUrlsWithPorts, startWorkspaceServices, storageBackendOf, usesConstructs };
-//# sourceMappingURL=credentials-BZcp3CGx.mjs.map
+export { storageBackendFor as C, providerOf as S, LOCAL_CA_PATH as _, loadEnvFiles as a, cacheBackendFor as b, resolveServicePorts as c, constructGlobs as d, derivedContainers as f, COMPOSE_PATH as g, workspace_exports as h, isPortAvailable as i, rewriteUrlsWithPorts as l, usesConstructs as m, createEntryWrapper as n, loadSecretsForApp as o, reconcileWorkspace as p, findAvailablePort as r, prepareEntryCredentials as s, createCredentialsPreload as t, startWorkspaceServices as u, applyPostgres as v, eventsBackendFor as x, resourceName as y };
+
+//# sourceMappingURL=credentials-CD8ftUS6.mjs.map