@geekmidas/cli 10.0.0-alpha.3 → 10.0.0-alpha.30

package/dist/{credentials-BZcp3CGx.mjs → workspace-C97QUCIf.mjs}

@@ -1,63 +1,257 @@
-import { DEFAULT_CACHE, DEFAULT_EMAIL, DEFAULT_STORAGE, discover } from "./discover-CAlFgYec.mjs";
-import { appKey, getAppNameFromCwd, hostOf, loadWorkspaceAppInfo } from "./config-CzWnfcXM.mjs";
-import { allConstructGlobs, getDependencyEnvVars } from "./workspace-7FqprxuJ.mjs";
-import { generatePgBossUrl } from "./generator-VE2JrFlY.mjs";
-import { readStageSecrets, secretsExist, toEmbeddableSecrets } from "./storage-Bi24WfoW.mjs";
-import { existsSync, readFileSync } from "node:fs";
+import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
+import { a as DEFAULT_CACHE, o as DEFAULT_EVENTS$1, s as DEFAULT_STORAGE, t as discover } from "./discover-CMxesskG.mjs";
+import { l as appKey, o as loadWorkspaceAppInfo, r as getAppNameFromCwd, s as loadWorkspaceConfig } from "./config-BH3Ki69F.mjs";
+import { E as TEST_STAGE, t as allConstructGlobs } from "./workspace-T4IVGSoB.mjs";
+import { n as readStageSecrets, o as toEmbeddableSecrets, r as secretsExist } from "./storage-BjTLjDDp.mjs";
+import { existsSync } from "node:fs";
+import { mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
-import { DEFAULT_POSTGRES_VERSION, cacheTable, cookieDomain, dependentsOf, provideKey, providedKeyFor, provisionOrder, publicEnvFor } from "@geekmidas/manifest";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { execFile, execSync } from "node:child_process";
+import { execFile } from "node:child_process";
+import { DEFAULT_POSTGRES_VERSION, cacheTable, cookieDomain, dependenciesOf, dependentsOf, provideKey, providedKeyFor, provisionOrder, publicEnvFor } from "@geekmidas/manifest";
 import { createServer } from "node:net";
 import { config } from "dotenv";
-import { parse as parse$1, stringify } from "yaml";
+import { createHash } from "node:crypto";
+import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
 import { CreateBucketCommand, GetBucketPolicyCommand, HeadBucketCommand, PutBucketPolicyCommand, S3Client } from "@aws-sdk/client-s3";
 import { Client } from "pg";
+import { stringify } from "yaml";
 import { promisify } from "node:util";
-import { createHash } from "node:crypto";
-import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
 import { cacheTableStatements } from "@geekmidas/cache/postgres";
+//#region src/credentials/index.ts
+const logger = console;
+/**
+* Load environment files
+* @internal Exported for testing
+*/
+function loadEnvFiles(envConfig, cwd = process.cwd()) {
+	const loaded = [];
+	const missing = [];
+	const envFiles = envConfig ? Array.isArray(envConfig) ? envConfig : [envConfig] : [".env"];
+	for (const envFile of envFiles) {
+		const envPath = resolve(cwd, envFile);
+		if (existsSync(envPath)) {
+			config({
+				path: envPath,
+				override: true,
+				quiet: true
+			});
+			loaded.push(envFile);
+		} else if (envConfig) missing.push(envFile);
+	}
+	return {
+		loaded,
+		missing
+	};
+}
+/**
+* Check if a port is available
+* @internal Exported for testing
+*/
+async function isPortAvailable(port) {
+	return new Promise((resolve) => {
+		const server = createServer();
+		server.once("error", (err) => {
+			if (err.code === "EADDRINUSE") resolve(false);
+			else resolve(false);
+		});
+		server.once("listening", () => {
+			server.close();
+			resolve(true);
+		});
+		server.listen(port);
+	});
+}
+/**
+* Find an available port starting from the preferred port
+* @internal Exported for testing
+*/
+async function findAvailablePort(preferredPort, maxAttempts = 10) {
+	for (let i = 0; i < maxAttempts; i++) {
+		const port = preferredPort + i;
+		if (await isPortAvailable(port)) return port;
+		logger.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
+	}
+	throw new Error(`Could not find an available port after trying ${maxAttempts} ports starting from ${preferredPort}`);
+}
+const PORT_STATE_PATH = ".gkm/ports.json";
+/**
+* Load saved port state from .gkm/ports.json.
+* @internal Exported for testing
+*/
+async function loadPortState(workspaceRoot) {
+	try {
+		const raw = await readFile(join(workspaceRoot, PORT_STATE_PATH), "utf-8");
+		return JSON.parse(raw);
+	} catch {
+		return {};
+	}
+}
+/**
+* Save port state to .gkm/ports.json.
+* @internal Exported for testing
+*/
+async function savePortState(workspaceRoot, ports) {
+	const dir = join(workspaceRoot, ".gkm");
+	await mkdir(dir, { recursive: true });
+	await writeFile(join(workspaceRoot, PORT_STATE_PATH), `${JSON.stringify(ports, null, 2)}\n`);
+}
+/**
+* Load and flatten secrets for an app from encrypted storage.
+* For workspace app: maps {APP}_DATABASE_URL → DATABASE_URL.
+* @internal Exported for testing
+*/
+async function loadSecretsForApp(secretsRoot, stage, appName) {
+	let secrets = {};
+	if (secretsExist(stage, secretsRoot)) {
+		const stageSecrets = await readStageSecrets(stage, secretsRoot);
+		if (stageSecrets) {
+			logger.log(`🔐 Loading secrets from stage: ${stage}`);
+			secrets = toEmbeddableSecrets(stageSecrets);
+		}
+	}
+	if (Object.keys(secrets).length === 0) return {};
+	if (!appName) return secrets;
+	const prefix = appName.toUpperCase();
+	const mapped = { ...secrets };
+	const appDbUrl = secrets[`${prefix}_DATABASE_URL`];
+	if (appDbUrl) mapped.DATABASE_URL = appDbUrl;
+	return mapped;
+}
+/**
+* Walk up the directory tree to find the root containing .gkm/secrets/.
+* @internal Exported for testing
+*/
+function findSecretsRoot(startDir) {
+	let dir = startDir;
+	while (dir !== "/") {
+		if (existsSync(join(dir, ".gkm", "secrets"))) return dir;
+		const parent = dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return startDir;
+}
+/**
+* Generate the credentials injection code snippet.
+* This is the common logic used by both entry wrapper and exec preload.
+* @internal
+*/
+function generateCredentialsInjection(secretsJsonPath) {
+	return `import { existsSync, readFileSync } from 'node:fs';
 
-//#region src/workspace/backends.ts
-const CACHE_BACKENDS = [
-	"upstash",
-	"elasticache",
-	"db"
-];
-const EMAIL_BACKENDS = [
-	"resend",
-	"ses",
-	"smtp"
-];
-const STORAGE_BACKENDS = [
-	"minio",
-	"s3",
-	"r2"
-];
-/**
-* The cache backend a workspace selected, or the one its target implies.
-*
-* Defaulted here rather than by every caller, so "what happens when nobody
-* said" is answered once and the answer is greppable — and now answered by
-* *where it deploys*, because there is no single right answer for both a
-* Lambda and a box running its own Postgres.
-*
-* `on` is the deploy target, not where this code happens to be running. A
-* local `gkm dev` for an AWS app still defaults to Upstash, because a backend
-* that differed between local and deployed would be worse than a slower one —
-* which is the property the type's own documentation asks for.
-*/
-function cacheBackendOf(value, on = "aws") {
-	return isBackend(value, CACHE_BACKENDS) ? value : DEFAULT_CACHE[on];
-}
-/** The email backend a workspace selected, defaulting to SES on every target. */
-function emailBackendOf(value) {
-	return isBackend(value, EMAIL_BACKENDS) ? value : DEFAULT_EMAIL;
-}
-/** The storage backend a workspace selected, or the one its target implies. */
-function storageBackendOf(value, on = "aws") {
-	return isBackend(value, STORAGE_BACKENDS) ? value : DEFAULT_STORAGE[on];
+// Inject dev secrets via globalThis and process.env
+// Using globalThis.__gkm_credentials__ avoids CJS/ESM interop issues where
+// Object.assign on the Credentials export only mutates one module copy.
+const secretsPath = '${secretsJsonPath}';
+if (existsSync(secretsPath)) {
+  const secrets = JSON.parse(readFileSync(secretsPath, 'utf-8'));
+  globalThis.__gkm_credentials__ = secrets;
+  Object.assign(process.env, secrets);
 }
+`;
+}
+/**
+* Create a preload script that injects secrets into Credentials.
+* Used by `gkm exec` to inject secrets before running any command.
+* @internal Exported for testing
+*/
+async function createCredentialsPreload(preloadPath, secretsJsonPath) {
+	const content = `/**
+ * Credentials preload generated by 'gkm exec'
+ * This file is loaded via NODE_OPTIONS="--import <path>"
+ */
+${generateCredentialsInjection(secretsJsonPath)}`;
+	await writeFile(preloadPath, content);
+}
+/**
+* Create a wrapper script that injects secrets before importing the entry file.
+* @internal Exported for testing
+*/
+async function createEntryWrapper(wrapperPath, entryPath, secretsJsonPath) {
+	const content = `#!/usr/bin/env node
+/**
+ * Entry wrapper generated by 'gkm dev --entry'
+ */
+${secretsJsonPath ? `${generateCredentialsInjection(secretsJsonPath)}
+` : ""}// Import and run the user's entry file (dynamic import ensures secrets load first)
+await import('${entryPath}');
+`;
+	await writeFile(wrapperPath, content);
+}
+/**
+* Prepare credentials for dev/exec/test modes.
+* Loads workspace config, secrets, resolves Docker ports, rewrites URLs,
+* injects PORT, dependency URLs, and writes credentials JSON.
+*
+* @param options.stage - The stage whose secrets to load. Default: the project's `stages.local`.
+* @param options.startDocker - Start Docker Compose services after port resolution. Default: false.
+* @param options.secretsFileName - Custom secrets JSON filename. Default: 'dev-secrets-{appName}.json' or 'dev-secrets.json'.
+* @internal Exported for testing
+*/
+async function prepareEntryCredentials(options) {
+	const cwd = options.cwd ?? process.cwd();
+	let workspaceAppPort;
+	let secretsRoot = cwd;
+	let appName;
+	let appInfo;
+	let workspace;
+	try {
+		appInfo = await loadWorkspaceAppInfo(cwd);
+		workspace = appInfo.workspace;
+		workspaceAppPort = appInfo.app.port;
+		secretsRoot = appInfo.workspaceRoot;
+		appName = appInfo.appName;
+	} catch {
+		workspace = await loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace).catch(() => void 0);
+		secretsRoot = workspace?.root ?? findSecretsRoot(cwd);
+		appName = getAppNameFromCwd(cwd) ?? void 0;
+	}
+	const resolvedPort = options.explicitPort ?? workspaceAppPort ?? 3e3;
+	const stage = options.stage ?? workspace?.stages.local;
+	const credentials = stage ? await loadSecretsForApp(secretsRoot, stage, appName) : {};
+	credentials.PORT = String(resolvedPort);
+	const declaredKeys = [];
+	if (workspace) {
+		const { reconcileWorkspace } = await Promise.resolve().then(() => workspace_exports);
+		const reconciled = await reconcileWorkspace(workspace, {
+			stage: options.reconcileStage ?? workspace.stages.local,
+			start: options.startDocker ?? false
+		});
+		Object.assign(credentials, reconciled.env);
+		declaredKeys.push(...Object.keys(reconciled.env));
+		if (Object.keys(reconciled.env).length > 0) logger.log(`🔌 Resolved ${Object.keys(reconciled.env).length} declared URL(s)`);
+	}
+	const secretsDir = join(secretsRoot, ".gkm");
+	await mkdir(secretsDir, { recursive: true });
+	const secretsFileName = options.secretsFileName ?? (appName ? `dev-secrets-${appName}.json` : "dev-secrets.json");
+	const secretsJsonPath = join(secretsDir, secretsFileName);
+	await writeFile(secretsJsonPath, JSON.stringify(credentials, null, 2));
+	return {
+		credentials,
+		resolvedPort,
+		secretsJsonPath,
+		appName,
+		secretsRoot,
+		appInfo,
+		declaredKeys
+	};
+}
+//#endregion
+//#region src/workspace/backends.ts
+/**
+* Which backend each declared kind resolves to — decided by where the project
+* deploys, and by nothing else.
+*
+* These used to be read out of a `services:` block, where one key answered two
+* questions: *does this exist* and *what backs it*. The first is the manifest's
+* — a declared `Cache` is why there is a cache — and the second is the deploy
+* target's, because the right cache for a Lambda is not the right cache for a
+* box already running Postgres. With both answered elsewhere there was nothing
+* left for the block to say, so it is gone and these read the target.
+*
+* Mail has no answer here at all: every provider speaks SMTP, so the provider
+* is whichever one the stage's mail URL points at.
+*/
 /**
 * Which family of defaults a workspace's deploy target belongs to.
 *
@@ -76,54 +270,199 @@ function providerOf(workspace) {
 	return target === "dokploy" || target === "server" ? "server" : "aws";
 }
 /**
-* Whether a string names a backend, as opposed to being one of the other things
-* a `services:` value can be.
+* The cache backend a target implies.
 *
-* A misspelling falls through to the default rather than throwing, which is the
-* wrong trade for something with a cost attached — so callers that can report it
-* should use {@link unknownBackend} to say so.
+* The same answer locally and deployed: a local `gkm dev` for an AWS app still
+* uses the Upstash protocol, because a backend that differed between the two
+* would be worse than a slower one.
 */
-function isBackend(value, backends) {
-	return typeof value === "string" && backends.includes(value);
+function cacheBackendFor(on) {
+	return DEFAULT_CACHE[on];
+}
+/** Where a declared bucket lives on a target. */
+function storageBackendFor(on) {
+	return DEFAULT_STORAGE[on];
 }
-
-//#endregion
-//#region src/reconcile/caddyfile.ts
 /**
-* The kinds the edge serves.
-*
-* Everything that owns a *public address*. Deployed, each of these has a real
-* hostname and a certificate, so this is what makes the local shape the same
-* one rather than a near-enough one — and the application is indifferent
-* either way, because it reads whichever address was injected and never
-* composes one.
+* Which broker carries declared queues and topics on a target.
 *
-* Adding a kind here is the whole of adding it to the edge.
+* Only consulted when something declares one; a project with no `Topic` or
+* `Queue` has no events at all, whatever the target.
 */
-const EDGE_KINDS = {
-	"file-server": true,
-	"rest-api": true,
-	site: true
-};
+function eventsBackendFor(on) {
+	return DEFAULT_EVENTS$1[on];
+}
+//#endregion
+//#region src/reconcile/containers.ts
 /**
-* How the edge reaches the host, from inside its container.
+* What gkm knows about each container it can derive.
 *
-* A surface and a site are served by processes `gkm dev` starts on the host,
-* not by containers — so the edge has to leave Docker's network to reach them.
-* Docker Desktop resolves this name already; on Linux the compose definition
-* maps it to the host gateway.
+* Everything provider-specific about the local target lives here: the image, the
+* ports the image listens on, and whether its data is worth keeping. The plan
+* says *which* containers exist and never says any of this, which is the split
+* the design asks for — neutral facts from the declaration, provider detail
+* from here and from config.
+*
+* Shared by allocation and by the compose writer so the two cannot disagree
+* about how many ports a container needs.
 */
-const HOST_GATEWAY = "host.docker.internal";
 /**
-* The suffix every local host shares.
+* The Postgres image for a major version.
 *
-* `.localhost` rather than a made-up TLD because it resolves to loopback
-* without touching `/etc/hosts` — macOS and systemd-resolved both answer for
-* subdomains of it, and Caddy issues internal certificates for it by default.
+* One place that knows the tag shape, so a declared version reaches the
+* container without anyone restating `-alpine` beside it.
 */
-const LOCAL_TLD = "localhost";
+function postgresImage(version) {
+	return `postgres:${version}-alpine`;
+}
 /**
-* The sites a plan implies, one per file server.
+* The default image for each container.
+*
+* Pinned to a major rather than `latest` where the image publishes one, so a
+* rebuild does not silently move a developer's Postgres a version. Overridable
+* per project: a project needing `postgis/postgis` says so in config.
+*/
+const DEFAULT_IMAGES = {
+	postgres: postgresImage(DEFAULT_POSTGRES_VERSION),
+	minio: "pgsty/minio:RELEASE.2026-08-04T00-00-00Z",
+	mailpit: "axllent/mailpit:latest",
+	redis: "redis:8-alpine",
+	"redis-http": "hiett/serverless-redis-http:latest",
+	rabbitmq: "rabbitmq:4-management-alpine",
+	localstack: "floci/floci:latest",
+	caddy: "caddy:2-alpine"
+};
+/**
+* The ports each container listens on.
+*
+* The first is always the one an app connects to; the rest are consoles and
+* management UIs, published because a bucket or an inbox you can look at is most
+* of why these are real containers rather than stubs.
+*/
+const PORTS = {
+	postgres: [{
+		key: "postgres",
+		inside: 5432,
+		label: "postgres"
+	}],
+	minio: [{
+		key: "minio",
+		inside: 9e3,
+		label: "minio api"
+	}, {
+		key: "minio-console",
+		inside: 9001,
+		label: "minio console"
+	}],
+	mailpit: [{
+		key: "mailpit",
+		inside: 1025,
+		label: "smtp"
+	}, {
+		key: "mailpit-web",
+		inside: 8025,
+		label: "mailpit inbox"
+	}],
+	redis: [{
+		key: "redis",
+		inside: 6379,
+		label: "redis"
+	}],
+	"redis-http": [{
+		key: "redis-http",
+		inside: 80,
+		label: "cache"
+	}],
+	rabbitmq: [{
+		key: "rabbitmq",
+		inside: 5672,
+		label: "amqp"
+	}, {
+		key: "rabbitmq-management",
+		inside: 15672,
+		label: "rabbitmq console"
+	}],
+	localstack: [{
+		key: "localstack",
+		inside: 4566,
+		label: "localstack"
+	}],
+	caddy: [{
+		key: "caddy",
+		inside: 443,
+		label: "https edge"
+	}]
+};
+/** The ports a container needs published. Empty for one gkm does not know. */
+function portsOf(container) {
+	return PORTS[container] ?? [];
+}
+/** The key a container's primary port is allocated under. */
+function primaryPortKey(container) {
+	return portsOf(container)[0]?.key ?? container;
+}
+/**
+* Every port key a set of containers needs, in a stable order.
+*
+* What allocation is handed: it assigns ports to names and knows nothing about
+* what listens on them.
+*/
+function portKeys(containers) {
+	return [...containers].sort().flatMap((container) => portsOf(container).map((port) => port.key));
+}
+/**
+* The named volume a container's data lives in.
+*
+* Mailpit deliberately has none: local mail is disposable, and an inbox that
+* survives days of dev is noise rather than state.
+*/
+function volumeOf(container) {
+	return {
+		postgres: "postgres-data",
+		minio: "minio-data",
+		redis: "redis-data",
+		rabbitmq: "rabbitmq-data",
+		localstack: "localstack-data",
+		caddy: "caddy-data"
+	}[container];
+}
+//#endregion
+//#region src/reconcile/caddyfile.ts
+/**
+* The kinds the edge serves.
+*
+* Everything that owns a *public address*. Deployed, each of these has a real
+* hostname and a certificate, so this is what makes the local shape the same
+* one rather than a near-enough one — and the application is indifferent
+* either way, because it reads whichever address was injected and never
+* composes one.
+*
+* Adding a kind here is the whole of adding it to the edge.
+*/
+const EDGE_KINDS = {
+	"file-server": true,
+	"rest-api": true,
+	site: true
+};
+/**
+* How the edge reaches the host, from inside its container.
+*
+* A surface and a site are served by processes `gkm dev` starts on the host,
+* not by containers — so the edge has to leave Docker's network to reach them.
+* Docker Desktop resolves this name already; on Linux the compose definition
+* maps it to the host gateway.
+*/
+const HOST_GATEWAY = "host.docker.internal";
+/**
+* The suffix every local host shares.
+*
+* `.localhost` rather than a made-up TLD because it resolves to loopback
+* without touching `/etc/hosts` — macOS and systemd-resolved both answer for
+* subdomains of it, and Caddy issues internal certificates for it by default.
+*/
+const LOCAL_TLD = "localhost";
+/**
+* The sites a plan implies, one per file server.
 *
 * The leading label is the *server's* stage-scoped name rather than the
 * bucket's, which is the difference that matters: two servers over one bucket
@@ -163,7 +502,7 @@ function portOf(address) {
 		const { port, protocol } = new URL(address);
 		return port || (protocol === "https:" ? "443" : "80");
 	} catch {
-		return void 0;
+		return;
 	}
 }
 /**
@@ -176,11 +515,16 @@ function portOf(address) {
 */
 function hostFor(resource, project) {
 	return [
-		resource.name,
+		resource.root && project ? stageOf(resource) : resource.name,
 		project,
 		LOCAL_TLD
 	].filter(Boolean).join(".");
 }
+/** The stage a resource's name carries, or nothing for the local stage's. */
+function stageOf(resource) {
+	const base = resource.id.toLowerCase();
+	return resource.name === base ? void 0 : resource.name.slice(base.length + 1);
+}
 /**
 * The static root config, which only ever imports.
 *
@@ -246,757 +590,274 @@ const GENERATED = `# Generated by gkm from the construct manifest — do not edi
 # root and point Node at it, so nothing has to be installed to use these URLs
 # from code; a browser needs the root trusted once.
 `;
-
 //#endregion
-//#region src/reconcile/clients.ts
-/** The credential local containers are brought up with. */
-const LOCAL_USER$2 = "geekmidas";
-/**
-* A Postgres client that opens one connection per database it is asked about.
-*
-* `CREATE DATABASE` cannot run from a connection to the database being created,
-* and a schema must be created from inside its own database — so the database is
-* part of each query rather than fixed when the client is built.
-*/
-function pgClient(port) {
-	return { async query(database, sql, values) {
-		const client = new Client({
-			host: "localhost",
-			port,
-			user: LOCAL_USER$2,
-			password: LOCAL_USER$2,
-			database: database ?? LOCAL_USER$2
-		});
-		await client.connect();
-		try {
-			const result = await client.query(sql, values);
-			return result.rows;
-		} finally {
-			await client.end();
-		}
-	} };
-}
-/** A bucket client pointed at the local MinIO. */
-function bucketClient(port) {
-	const s3 = new S3Client({
-		region: "us-east-1",
-		endpoint: `http://localhost:${port}`,
-		forcePathStyle: true,
-		credentials: {
-			accessKeyId: LOCAL_USER$2,
-			secretAccessKey: LOCAL_USER$2
-		}
-	});
-	return {
-		async exists(bucket) {
-			try {
-				await s3.send(new HeadBucketCommand({ Bucket: bucket }));
-				return true;
-			} catch {
-				return false;
-			}
-		},
-		async create(bucket) {
-			await s3.send(new CreateBucketCommand({ Bucket: bucket }));
-		},
-		async policy(bucket) {
-			try {
-				const result = await s3.send(new GetBucketPolicyCommand({ Bucket: bucket }));
-				return result.Policy;
-			} catch {
-				return void 0;
-			}
-		},
-		async setPolicy(bucket, policy) {
-			await s3.send(new PutBucketPolicyCommand({
-				Bucket: bucket,
-				Policy: policy
-			}));
-		}
-	};
-}
-
+//#region src/workspace/rootSite.ts
+/**
+* Which site the base domain points at — deployed and locally alike.
+*
+* Three rules, in order, and the last one is the point:
+*
+* 1. **One site** — it is the root. Unambiguous, so nothing has to be said.
+* 2. **Named `web`** — the convention wins, because people already rely on it.
+* 3. **Declared `root: true`** — the site says so itself.
+*
+* Anything else throws. It used to take the *first* site it iterated, and that
+* order came from the manifest, which is built in glob traversal order — so two
+* sites with neither named `web` meant renaming a file could move the root
+* domain, silently.
+*
+* One rule for both targets: deployed the root site gets the base domain, and
+* locally it gets the project's bare host behind the edge. Before this was
+* shared, the local edge put every site on a subdomain, so what a developer
+* browsed was not the shape production served.
+*
+* @returns the root site's name, or `undefined` when there are no sites
+* @throws {AmbiguousRootSite} when several sites could be the root and none says it is
+*/
+function rootSite(sites) {
+	if (sites.length === 0) return void 0;
+	if (sites.length === 1) return sites[0].name;
+	if (sites.some(({ name }) => name === "web")) return "web";
+	const declared = sites.filter(({ root }) => root === true);
+	if (declared.length === 1) return declared[0].name;
+	throw new AmbiguousRootSite(sites.map(({ name }) => name), declared.length > 1);
+}
+/** Several sites could hold the base domain, and none of them says it does. */
+var AmbiguousRootSite = class extends Error {
+	sites;
+	tooMany;
+	constructor(sites, tooMany = false) {
+		super(tooMany ? `More than one site declares \`root: true\` — ${sites.join(", ")}. The base domain points at one of them.` : `${sites.length} sites and nothing says which holds the base domain: ${sites.join(", ")}. Name one of them \`web\`, or declare \`root: true\` on the one the base domain points at. It used to be whichever the glob reached first, which is not a thing to decide a hostname.`);
+		this.sites = sites;
+		this.tooMany = tooMany;
+		this.name = "AmbiguousRootSite";
+	}
+};
 //#endregion
-//#region src/reconcile/containers.ts
+//#region src/reconcile/plan.ts
 /**
-* What gkm knows about each container it can derive.
-*
-* Everything provider-specific about the local target lives here: the image, the
-* ports the image listens on, and whether its data is worth keeping. The plan
-* says *which* containers exist and never says any of this, which is the split
-* the design asks for — neutral facts from the declaration, provider detail
-* from here and from config.
+* The reconcile plan — what a manifest wants to exist, for one stage.
 *
-* Shared by allocation and by the compose writer so the two cannot disagree
-* about how many ports a container needs.
-*/
-/**
-* The Postgres image for a major version.
+* Pure. Turning the plan into running containers and provisioned resources is
+* the applier's job; deciding *what* should exist is this, so the decisions can
+* be asserted as data rather than by starting Docker.
 *
-* One place that knows the tag shape, so a declared version reaches the
-* container without anyone restating `-alpine` beside it.
+* One plan serves every stage. `gkm dev` reconciles `development` and `gkm test`
+* reconciles `test`; they differ only in what the resources are called, never in
+* what infrastructure exists. Roles are cluster-scoped in Postgres while grants
+* are per-object, so one container and one role pair serve both.
 */
-function postgresImage(version) {
-	return `postgres:${version}-alpine`;
-}
 /**
-* The default image for each container.
+* Which container serves a kind.
 *
-* Pinned to a major rather than `latest` where the image publishes one, so a
-* rebuild does not silently move a developer's Postgres a version. Overridable
-* per project: a project needing `postgis/postgis` says so in config.
+* Derived kinds map to the same container as their parent — a schema tenant
+* lives in its parent's Postgres — so the set is deduplicated rather than
+* counted.
 */
-const DEFAULT_IMAGES = {
-	postgres: postgresImage(DEFAULT_POSTGRES_VERSION),
-	minio: "quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z",
-	mailpit: "axllent/mailpit:latest",
-	redis: "redis:8-alpine",
-	"redis-http": "hiett/serverless-redis-http:latest",
-	rabbitmq: "rabbitmq:4-management-alpine",
-	localstack: "floci/floci:latest",
-	caddy: "caddy:2-alpine"
+const CONTAINERS = {
+	database: "postgres",
+	"database-reader": "postgres",
+	"database-schema": "postgres",
+	objects: "minio",
+	"file-server": "caddy",
+	email: "mailpit"
 };
 /**
-* The ports each container listens on.
+* The container a cache backend needs locally.
 *
-* The first is always the one an app connects to; the rest are consoles and
-* management UIs, published because a bucket or an inbox you can look at is most
-* of why these are real containers rather than stubs.
-*/
-const PORTS = {
-	postgres: [{
-		key: "postgres",
-		inside: 5432,
-		label: "postgres"
-	}],
-	minio: [{
-		key: "minio",
-		inside: 9e3,
-		label: "minio api"
-	}, {
-		key: "minio-console",
-		inside: 9001,
-		label: "minio console"
-	}],
-	mailpit: [{
-		key: "mailpit",
-		inside: 1025,
-		label: "smtp"
-	}, {
-		key: "mailpit-web",
-		inside: 8025,
-		label: "mailpit inbox"
-	}],
-	redis: [{
-		key: "redis",
-		inside: 6379,
-		label: "redis"
-	}],
-	"redis-http": [{
-		key: "redis-http",
-		inside: 80,
-		label: "cache"
-	}],
-	rabbitmq: [{
-		key: "rabbitmq",
-		inside: 5672,
-		label: "amqp"
-	}, {
-		key: "rabbitmq-management",
-		inside: 15672,
-		label: "rabbitmq console"
-	}],
-	localstack: [{
-		key: "localstack",
-		inside: 4566,
-		label: "localstack"
-	}],
-	caddy: [{
-		key: "caddy",
-		inside: 443,
-		label: "https edge"
-	}]
+* Each one matches the protocol its deployed form speaks, which is the property
+* worth having: a cache that behaves differently in the two places is worse than
+* a slower one.
+*
+* `db` is deliberately absent, the same way `pgboss` is absent from
+* `EVENT_CONTAINERS`: the cache is a table in a database the manifest already
+* declares, so mapping it here would start a container for a project that needs
+* none.
+*/
+const CACHE_CONTAINERS = {
+	upstash: "redis-http",
+	elasticache: "redis"
 };
-/** The ports a container needs published. Empty for one gkm does not know. */
-function portsOf(container) {
-	return PORTS[container] ?? [];
-}
-/** The key a container's primary port is allocated under. */
-function primaryPortKey(container) {
-	return portsOf(container)[0]?.key ?? container;
-}
 /**
-* Every port key a set of containers needs, in a stable order.
+* Kinds that resolve a value without anything running.
 *
-* What allocation is handed: it assigns ports to names and knows nothing about
-* what listens on them.
+* A secret is the case: it has no address, so there is nothing to start and
+* nothing to connect to — but it still appears in the plan, because the target
+* still has to resolve it.
 */
-function portKeys(containers) {
-	return [...containers].sort().flatMap((container) => portsOf(container).map((port) => port.key));
-}
+const CONTAINERLESS = {
+	secret: true,
+	credential: true,
+	"rest-api": true,
+	site: true
+};
 /**
-* The named volume a container's data lives in.
+* Containers that cannot run alone.
 *
-* Mailpit deliberately has none: local mail is disposable, and an inbox that
-* survives days of dev is noise rather than state.
+* The one case is the cache: `serverless-redis-http` is a proxy and needs the
+* Redis it proxies. Kept here rather than in the compose definition so the plan
+* -- which is what decides what must be running -- still names everything.
 */
-function volumeOf(container) {
-	const volumes = {
-		postgres: "postgres-data",
-		minio: "minio-data",
-		redis: "redis-data",
-		rabbitmq: "rabbitmq-data",
-		localstack: "localstack-data",
-		caddy: "caddy-data"
-	};
-	return volumes[container];
+const REQUIRES = { "redis-http": ["redis"] };
+/**
+* The role each kind's one key plays, where it is not a URL.
+*
+* The twin of `ProvidesByKind` in `@geekmidas/manifest`: that is what a
+* construct declares, this is what the local target resolves, and both derive
+* the key from the same `provideKey` so they cannot disagree.
+*/
+const ROLES = {
+	queue: "publisherConnectionString",
+	topic: "publisherConnectionString",
+	credential: "credential"
+};
+/** The kinds whose container is the events backend's rather than their own. */
+const EVENT_KINDS = {
+	queue: true,
+	topic: true
+};
+/**
+* Which kinds provision something *inside* their container.
+*
+* A database creates a database, a bucket creates a bucket; mail creates
+* nothing — Mailpit accepts whatever is sent to it and has no per-stage object
+* to name. Both still appear in the plan, because both still resolve a URL; the
+* flag is the difference between "must be running" and "must be created".
+*/
+const PROVISIONS = {
+	database: true,
+	"database-reader": true,
+	"database-schema": true,
+	objects: true,
+	cache: true,
+	"file-server": true
+};
+/**
+* The container each events backend needs, where it needs one of its own.
+*
+* `pgboss` is deliberately absent rather than mapped to `postgres`: it is a
+* schema tenant in a database the manifest already declares, so mapping it here
+* would start a Postgres for a project that declared no database at all.
+*
+* This one comes from config rather than from a declaration because there are
+* no `topic` or `queue` kinds yet. When they land the mapping moves to
+* {@link CONTAINERS} keyed by kind, and this constant goes with them.
+*/
+const EVENT_CONTAINERS = {
+	sns: "localstack",
+	rabbitmq: "rabbitmq"
+};
+/** The backend a project gets when it declares queues or topics and says nothing. */
+const DEFAULT_EVENTS = "pgboss";
+/**
+* How a resource of each kind separates its stage suffix.
+*
+* Postgres identifiers are snake_case and a hyphen would need quoting
+* everywhere; buckets and queues are kebab and disallow underscores in some
+* providers. The suffix is the same word either way.
+*/
+const SEPARATORS = {
+	database: "_",
+	"database-reader": "_",
+	"database-schema": "_",
+	objects: "-"
+};
+/**
+* The stage-scoped name for a resource.
+*
+* The local stage carries no suffix, so `gkm dev` keeps using `orders` and a
+* developer's psql history, saved connections, and muscle memory survive a
+* change of stage name. Every other stage is suffixed.
+*/
+function resourceName(id, kind, stage, localStage) {
+	const base = id.toLowerCase();
+	if (stage === localStage) return base;
+	return `${base}${SEPARATORS[kind] ?? "-"}${stage}`;
 }
-
-//#endregion
-//#region src/reconcile/compose.ts
-/** The credential every derived container is brought up with locally. */
-const LOCAL_USER$1 = "geekmidas";
 /**
-* The token the local cache accepts.
+* The container a kind needs, or `undefined` if it needs none.
 *
-* Fixed rather than generated: it is only ever reachable on a port this project
-* published, and the URL that carries it is derived, so nothing is made safer
-* by making it unguessable and a stable one keeps `redis-cli` sessions working.
+* Queues and topics have no container of their own — they live in whichever
+* broker the project selected, which is why the backend is an argument here
+* rather than a second pass that adds containers after the fact.
 */
-const LOCAL_TOKEN$1 = "geekmidas";
+function containerFor(kind, events = DEFAULT_EVENTS, cache = DEFAULT_CACHE.aws, derived = false, edge = true) {
+	if (EVENT_KINDS[kind]) return EVENT_CONTAINERS[events] ?? CONTAINERS.database;
+	if (kind === "file-server") return edge ? "caddy" : CONTAINERS.objects;
+	if (kind === "cache") {
+		if (derived) return CONTAINERS.database;
+		return CACHE_CONTAINERS[cache] ?? CONTAINERS.database;
+	}
+	return CONTAINERS[kind];
+}
 /**
-* Build the compose document for a plan.
+* Build the plan for a manifest and stage.
 *
-* Every container is published on its assigned port, never on the image's
-* default: the point of allocation is that two projects can run at once, and
-* one container publishing 5432 puts that back.
+* `order` is the caller's provisioning order — parents before children — which
+* `provisionOrder` produces from the manifest. Passing it in keeps this
+* function free of the traversal and makes the ordering assertable on its own.
 */
-function composeFor(plan, options) {
-	const services = {};
-	const volumes = {};
-	for (const container of [...plan.containers].sort()) {
-		const declared = container === "postgres" ? plan.resources.find((r) => r.version)?.version : void 0;
-		const image = options.images?.[container] ?? (declared ? postgresImage(declared) : DEFAULT_IMAGES[container]);
-		if (!image) throw new UnknownContainer(container);
-		services[container] = define(container, image, publish(container, options.ports));
-		const volume = volumeOf(container);
-		if (volume) volumes[volume] = {};
-	}
-	return {
-		name: options.project,
-		services,
-		...Object.keys(volumes).length ? { volumes } : {}
-	};
-}
-/** Render a compose document as the file it becomes. */
-function toYaml(file) {
-	return `# Generated by gkm from the construct manifest — do not edit.
-# Containers are derived from what the app declares; images and anything no
-# construct implies are yours, in gkm.config.ts.
-#
-# Use "gkm dev" or "gkm test" to start these. Running "docker compose up"
-# directly will not inject secrets.
-${stringify(file, { lineWidth: 0 })}`;
-}
-/** A container with no image, from config or from the defaults. */
-var UnknownContainer = class extends Error {
-	/** The container that could not be resolved. */
-	container;
-	/** The containers that have a default, so the caller can see the set. */
-	known = Object.keys(DEFAULT_IMAGES).sort();
-	constructor(container) {
-		super("No image is known for this container; pin one in config");
-		this.name = "UnknownContainer";
-		this.container = container;
-	}
-};
-/** One container's definition, published on the port it was assigned. */
-function define(container, image, published) {
-	switch (container) {
-		case "postgres": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			environment: {
-				POSTGRES_USER: LOCAL_USER$1,
-				POSTGRES_PASSWORD: LOCAL_USER$1,
-				POSTGRES_DB: LOCAL_USER$1
-			},
-			volumes: ["postgres-data:/var/lib/postgresql"],
-			healthcheck: {
-				test: ["CMD-SHELL", `pg_isready -U ${LOCAL_USER$1}`],
-				interval: "5s",
-				timeout: "3s",
-				retries: 10,
-				start_period: "10s"
-			}
-		};
-		case "minio": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			environment: {
-				MINIO_ROOT_USER: LOCAL_USER$1,
-				MINIO_ROOT_PASSWORD: LOCAL_USER$1
-			},
-			command: "server --console-address \":9001\" /data",
-			volumes: ["minio-data:/data"],
-			healthcheck: {
-				test: [
-					"CMD",
-					"mc",
-					"ready",
-					"local"
-				],
-				interval: "10s",
-				timeout: "5s",
-				retries: 5,
-				start_period: "10s"
-			}
-		};
-		case "caddy": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			volumes: [
-				"./Caddyfile:/etc/caddy/Caddyfile:ro",
-				"./caddy-sites:/etc/caddy/sites:ro",
-				"caddy-data:/data"
-			],
-			extra_hosts: ["host.docker.internal:host-gateway"],
-			healthcheck: {
-				test: [
-					"CMD",
-					"caddy",
-					"version"
-				],
-				interval: "10s",
-				timeout: "5s",
-				retries: 5
-			}
-		};
-		case "mailpit": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			environment: {
-				MP_SMTP_AUTH_ACCEPT_ANY: "1",
-				MP_SMTP_AUTH_ALLOW_INSECURE: "1"
-			},
-			healthcheck: {
-				test: [
-					"CMD",
-					"wget",
-					"-q",
-					"--spider",
-					"http://localhost:8025"
-				],
-				interval: "10s",
-				timeout: "5s",
-				retries: 5
-			}
-		};
-		case "redis": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			volumes: ["redis-data:/data"],
-			healthcheck: {
-				test: [
-					"CMD",
-					"redis-cli",
-					"ping"
-				],
-				interval: "5s",
-				timeout: "3s",
-				retries: 5
-			}
-		};
-		case "redis-http": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			environment: {
-				SRH_MODE: "env",
-				SRH_TOKEN: LOCAL_TOKEN$1,
-				SRH_CONNECTION_STRING: "redis://redis:6379"
-			},
-			depends_on: ["redis"],
-			healthcheck: {
-				test: [
-					"CMD",
-					"wget",
-					"-q",
-					"-O",
-					"/dev/null",
-					"http://127.0.0.1:80/"
-				],
-				interval: "5s",
-				timeout: "3s",
-				retries: 10
-			}
-		};
-		case "rabbitmq": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			environment: {
-				RABBITMQ_DEFAULT_USER: LOCAL_USER$1,
-				RABBITMQ_DEFAULT_PASS: LOCAL_USER$1
-			},
-			volumes: ["rabbitmq-data:/var/lib/rabbitmq"],
-			healthcheck: {
-				test: [
-					"CMD",
-					"rabbitmq-diagnostics",
-					"-q",
-					"ping"
-				],
-				interval: "10s",
-				timeout: "5s",
-				retries: 5
-			}
-		};
-		case "localstack": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			environment: {
-				AWS_DEFAULT_REGION: "us-east-1",
-				AWS_ACCESS_KEY_ID: "LSIAQAAAAAAVNCBMPNSG",
-				AWS_SECRET_ACCESS_KEY: LOCAL_USER$1
-			},
-			volumes: ["localstack-data:/var/lib/localstack"],
-			healthcheck: {
-				test: [
-					"CMD",
-					"curl",
-					"-f",
-					"http://localhost:4566/_localstack/health"
-				],
-				interval: "10s",
-				timeout: "5s",
-				retries: 5,
-				start_period: "10s"
-			}
-		};
-		default: throw new UnknownContainer(container);
-	}
-}
-/**
-* The published port mappings for a container.
-*
-* Every port is looked up by its own key rather than being derived as an offset
-* from the container's first, so MinIO's console cannot land on whatever was
-* allocated to the next container.
-*/
-function publish(container, ports) {
-	return portsOf(container).map((port) => {
-		const assigned = ports[port.key];
-		if (assigned === void 0) throw new UnassignedPort(port.key);
-		return `${assigned}:${port.inside}`;
-	});
-}
-/** A planned port that allocation never assigned. */
-var UnassignedPort = class extends Error {
-	/** The port key that went unassigned, e.g. `minio-console`. */
-	key;
-	constructor(key) {
-		super("No port was assigned for this container port");
-		this.name = "UnassignedPort";
-		this.key = key;
-	}
-};
-
-//#endregion
-//#region src/reconcile/docker.ts
-const run = promisify(execFile);
-/** How long to wait for containers to pass their health checks. */
-const HEALTH_TIMEOUT_MS = 12e4;
-const dockerCli = {
-	async publishedPort(composePath, service, inside) {
-		try {
-			const { stdout } = await run("docker", [
-				"compose",
-				"-f",
-				composePath,
-				"port",
-				service,
-				String(inside)
-			]);
-			const port = Number(stdout.trim().split(":").pop());
-			return Number.isFinite(port) && port > 0 ? port : void 0;
-		} catch {
-			return void 0;
-		}
-	},
-	async up(composePath, services) {
-		await run("docker", [
-			"compose",
-			"-f",
-			composePath,
-			"up",
-			"-d",
-			"--remove-orphans",
-			"--wait",
-			`--wait-timeout=${Math.floor(HEALTH_TIMEOUT_MS / 1e3)}`,
-			...services
-		]);
-	},
-	async copyOut(composePath, service, from, to) {
-		await mkdir(dirname(to), { recursive: true });
-		await run("docker", [
-			"compose",
-			"-f",
-			composePath,
-			"cp",
-			`${service}:${from}`,
-			to
-		]);
-	},
-	async reload(composePath, service) {
-		await run("docker", [
-			"compose",
-			"-f",
-			composePath,
-			"exec",
-			"-T",
-			service,
-			"caddy",
-			"reload",
-			"--config",
-			"/etc/caddy/Caddyfile"
-		]);
-	},
-	async healthy(composePath, services) {
-		if (services.length === 0) return true;
-		try {
-			const { stdout } = await run("docker", [
-				"compose",
-				"-f",
-				composePath,
-				"ps",
-				"--format",
-				"json",
-				...services
-			]);
-			const running = /* @__PURE__ */ new Set();
-			for (const line of stdout.trim().split("\n").filter(Boolean)) {
-				const entry = JSON.parse(line);
-				const ok = entry.State === "running" && (entry.Health === void 0 || entry.Health === "" || entry.Health === "healthy");
-				if (ok && entry.Service) running.add(entry.Service);
-			}
-			return services.every((service) => running.has(service));
-		} catch {
-			return false;
-		}
-	}
-};
-
-//#endregion
-//#region src/reconcile/plan.ts
-/** The stage whose resources carry no suffix. */
-const DEFAULT_STAGE = "development";
-/**
-* Which container serves a kind.
-*
-* Derived kinds map to the same container as their parent — a schema tenant
-* lives in its parent's Postgres — so the set is deduplicated rather than
-* counted.
-*/
-const CONTAINERS = {
-	database: "postgres",
-	"database-reader": "postgres",
-	"database-schema": "postgres",
-	objects: "minio",
-	"file-server": "caddy",
-	email: "mailpit"
-};
-/**
-* The container a cache backend needs locally.
-*
-* Each one matches the protocol its deployed form speaks, which is the property
-* worth having: a cache that behaves differently in the two places is worse than
-* a slower one.
-*
-* `db` is deliberately absent, the same way `pgboss` is absent from
-* `EVENT_CONTAINERS`: the cache is a table in a database the manifest already
-* declares, so mapping it here would start a container for a project that needs
-* none.
-*/
-const CACHE_CONTAINERS = {
-	upstash: "redis-http",
-	elasticache: "redis"
-};
-/**
-* Kinds that resolve a value without anything running.
-*
-* A secret is the case: it has no address, so there is nothing to start and
-* nothing to connect to — but it still appears in the plan, because the target
-* still has to resolve it.
-*/
-const CONTAINERLESS = {
-	secret: true,
-	credential: true,
-	"rest-api": true,
-	site: true
-};
-/**
-* Containers that cannot run alone.
-*
-* The one case is the cache: `serverless-redis-http` is a proxy and needs the
-* Redis it proxies. Kept here rather than in the compose definition so the plan
-* -- which is what decides what must be running -- still names everything.
-*/
-const REQUIRES = { "redis-http": ["redis"] };
-/**
-* The role each kind's one key plays, where it is not a URL.
-*
-* The twin of `ProvidesByKind` in `@geekmidas/manifest`: that is what a
-* construct declares, this is what the local target resolves, and both derive
-* the key from the same `provideKey` so they cannot disagree.
-*/
-const ROLES = {
-	queue: "publisherConnectionString",
-	topic: "publisherConnectionString",
-	credential: "credential"
-};
-/** The kinds whose container is the events backend's rather than their own. */
-const EVENT_KINDS = {
-	queue: true,
-	topic: true
-};
-/**
-* Which kinds provision something *inside* their container.
-*
-* A database creates a database, a bucket creates a bucket; mail creates
-* nothing — Mailpit accepts whatever is sent to it and has no per-stage object
-* to name. Both still appear in the plan, because both still resolve a URL; the
-* flag is the difference between "must be running" and "must be created".
-*/
-const PROVISIONS = {
-	database: true,
-	"database-reader": true,
-	"database-schema": true,
-	objects: true,
-	cache: true,
-	"file-server": true
-};
-/**
-* The container each events backend needs, where it needs one of its own.
-*
-* `pgboss` is deliberately absent rather than mapped to `postgres`: it is a
-* schema tenant in a database the manifest already declares, so mapping it here
-* would start a Postgres for a project that declared no database at all.
-*
-* This one comes from config rather than from a declaration because there are
-* no `topic` or `queue` kinds yet. When they land the mapping moves to
-* {@link CONTAINERS} keyed by kind, and this constant goes with them.
-*/
-const EVENT_CONTAINERS = {
-	sns: "localstack",
-	rabbitmq: "rabbitmq"
-};
-/** The backend a project gets when it declares queues or topics and says nothing. */
-const DEFAULT_EVENTS = "pgboss";
-/**
-* How a resource of each kind separates its stage suffix.
-*
-* Postgres identifiers are snake_case and a hyphen would need quoting
-* everywhere; buckets and queues are kebab and disallow underscores in some
-* providers. The suffix is the same word either way.
-*/
-const SEPARATORS = {
-	database: "_",
-	"database-reader": "_",
-	"database-schema": "_",
-	objects: "-"
-};
-/**
-* The stage-scoped name for a resource.
-*
-* The default stage carries no suffix, so `gkm dev` keeps using `orders` and a
-* developer's psql history, saved connections, and muscle memory survive this
-* change. Every other stage is suffixed.
-*/
-function resourceName(id, kind, stage) {
-	const base = id.toLowerCase();
-	if (stage === DEFAULT_STAGE) return base;
-	return `${base}${SEPARATORS[kind] ?? "-"}${stage}`;
-}
-/**
-* The container a kind needs, or `undefined` if it needs none.
-*
-* Queues and topics have no container of their own — they live in whichever
-* broker the project selected, which is why the backend is an argument here
-* rather than a second pass that adds containers after the fact.
-*/
-function containerFor(kind, events = DEFAULT_EVENTS, cache = DEFAULT_CACHE.aws, derived = false, edge = true) {
-	if (EVENT_KINDS[kind]) return EVENT_CONTAINERS[events] ?? CONTAINERS.database;
-	if (kind === "file-server") return edge ? "caddy" : CONTAINERS.objects;
-	if (kind === "cache") {
-		if (derived) return CONTAINERS.database;
-		return CACHE_CONTAINERS[cache] ?? CONTAINERS.database;
-	}
-	return CONTAINERS[kind];
-}
-/**
-* Build the plan for a manifest and stage.
-*
-* `order` is the caller's provisioning order — parents before children — which
-* `provisionOrder` produces from the manifest. Passing it in keeps this
-* function free of the traversal and makes the ordering assertable on its own.
-*/
-function planFor(manifest, stage, order, options = {}) {
-	const containers = /* @__PURE__ */ new Set();
-	const resources = [];
-	const events = options.events ?? DEFAULT_EVENTS;
-	const cache = options.cache ?? DEFAULT_CACHE.aws;
-	for (const id of order) {
-		const declaration = manifest[id];
-		if (!declaration) continue;
-		const container = containerFor(declaration.kind, events, cache, "of" in declaration && typeof declaration.of === "string", options.edge !== false);
-		if (!container && !CONTAINERLESS[declaration.kind]) continue;
-		if (container) {
-			containers.add(container);
-			for (const required of REQUIRES[container] ?? []) containers.add(required);
-		}
-		resources.push({
-			id,
-			kind: declaration.kind,
-			...container ? { container } : {},
-			name: resourceName(id, declaration.kind, stage),
-			envKey: providedKeyFor(id, declaration.kind, ROLES[declaration.kind] ?? "url"),
-			provisions: PROVISIONS[declaration.kind] === true,
-			...declaration.kind === "rest-api" ? { callers: dependentsOf(manifest, id) } : {},
-			...declaration.kind === "site" ? { publicEnv: publicEnvFor(declaration, manifest) } : {},
-			...declaration.kind === "file-server" && declaration.open?.length ? { open: declaration.open } : {},
-			..."of" in declaration ? { of: declaration.of } : {},
-			..."schema" in declaration && declaration.schema ? { schema: declaration.schema } : {},
-			..."version" in declaration && declaration.version ? { version: declaration.version } : {},
-			..."roles" in declaration && declaration.roles === false ? { roles: false } : {},
-			..."table" in declaration && declaration.table ? { table: declaration.table } : {}
-		});
-	}
-	if (options.edge !== false && resources.some((r) => EDGE_KINDS[r.kind] === true)) containers.add("caddy");
-	for (const extra of options.extraContainers ?? []) containers.add(extra);
-	if (events === "pgboss" && resources.some((r) => EVENT_KINDS[r.kind]) && !resources.some((r) => r.kind === "database")) throw new PgBossNeedsDatabase(resources.filter((r) => EVENT_KINDS[r.kind]).map((r) => r.id));
-	if (cache === "db") {
-		const placeless = resources.filter((r) => r.kind === "cache" && !r.of);
-		if (placeless.length > 0) {
-			const databases = resources.filter((r) => r.kind === "database");
-			const [only] = databases;
-			if (!only) throw new CacheNeedsDatabase(resources.filter((r) => r.kind === "cache").map((r) => r.id));
-			if (databases.length > 1) throw new CacheIsAmbiguous(placeless.map((r) => r.id), databases.map((r) => r.id));
-			for (const resource of placeless) resource.of = only.id;
-		}
+function planFor(manifest, stage, order, options = {}) {
+	const containers = /* @__PURE__ */ new Set();
+	const resources = [];
+	const events = options.events ?? "pgboss";
+	const cache = options.cache ?? DEFAULT_CACHE.aws;
+	for (const id of order) {
+		const declaration = manifest[id];
+		if (!declaration) continue;
+		const container = containerFor(declaration.kind, events, cache, "of" in declaration && typeof declaration.of === "string", options.edge !== false);
+		if (!container && !CONTAINERLESS[declaration.kind]) continue;
+		if (container) {
+			containers.add(container);
+			for (const required of REQUIRES[container] ?? []) containers.add(required);
+		}
+		resources.push({
+			id,
+			kind: declaration.kind,
+			...container ? { container } : {},
+			name: resourceName(id, declaration.kind, stage, options.localStage),
+			envKey: providedKeyFor(id, declaration.kind, ROLES[declaration.kind] ?? "url"),
+			provisions: PROVISIONS[declaration.kind] === true,
+			...declaration.kind === "rest-api" ? { callers: dependentsOf(manifest, id) } : {},
+			...declaration.kind === "site" ? { publicEnv: publicEnvFor(declaration, manifest) } : {},
+			...declaration.kind === "file-server" && declaration.open?.length ? { open: declaration.open } : {},
+			..."of" in declaration ? { of: declaration.of } : {},
+			..."schema" in declaration && declaration.schema ? { schema: declaration.schema } : {},
+			..."version" in declaration && declaration.version ? { version: declaration.version } : {},
+			..."roles" in declaration && declaration.roles === false ? { roles: false } : {},
+			..."table" in declaration && declaration.table ? { table: declaration.table } : {}
+		});
+	}
+	if (options.edge !== false && resources.some((r) => EDGE_KINDS[r.kind] === true)) containers.add("caddy");
+	for (const extra of options.extraContainers ?? []) containers.add(extra);
+	if (events === "pgboss" && resources.some((r) => EVENT_KINDS[r.kind]) && !resources.some((r) => r.kind === "database")) throw new PgBossNeedsDatabase(resources.filter((r) => EVENT_KINDS[r.kind]).map((r) => r.id));
+	if (cache === "db") {
+		const placeless = resources.filter((r) => r.kind === "cache" && !r.of);
+		if (placeless.length > 0) {
+			const databases = resources.filter((r) => r.kind === "database");
+			const [only] = databases;
+			if (!only) throw new CacheNeedsDatabase(resources.filter((r) => r.kind === "cache").map((r) => r.id));
+			if (databases.length > 1) throw new CacheIsAmbiguous(placeless.map((r) => r.id), databases.map((r) => r.id));
+			for (const resource of placeless) resource.of = only.id;
+		}
 	}
+	const sites = resources.filter((r) => r.kind === "site");
+	const root = rootSite(sites.map((r) => {
+		const declared = manifest[r.id];
+		return {
+			name: appKey(r.id),
+			...declared?.kind === "site" && declared.root ? { root: true } : {}
+		};
+	}));
+	for (const site of sites) if (appKey(site.id) === root) site.root = true;
+	const workerBroker = events === "pgboss" && Object.values(manifest).some((d) => d?.kind === "worker") && resources.some((r) => r.kind === "database");
 	return {
 		stage,
 		events,
 		cache,
 		containers: [...containers],
-		resources
+		resources,
+		...workerBroker ? { workerBroker: true } : {}
 	};
 }
 /**
@@ -1007,16 +868,18 @@ function planFor(manifest, stage, order, options = {}) {
 * broker.
 */
 var CacheNeedsDatabase = class extends Error {
+	ids;
 	constructor(ids) {
-		super(`A cache backed by the database needs a declared database, and none was declared. Declare one, or set services.cache to 'upstash' or 'elasticache'. Caches affected: ${ids.join(", ")}.`);
+		super(`A cache backed by the database needs a declared database, and none was declared, and on this deploy target that is where a cache lives. Declare one. Caches affected: ${ids.join(", ")}.`);
 		this.ids = ids;
 		this.name = "CacheNeedsDatabase";
 	}
 };
 /**
-* `services.cache: 'db'` in an app that declares more than one database.
+* A `'db'` cache — a server target's default — in an app that declares more
+* than one database.
 *
-* The config says *a* database and the graph offers several, so there is no
+* The target says *a* database and the graph offers several, so there is no
 * answer to give — and the wrong kind of failure would be to pick one, since a
 * cache silently landing in the wrong database is a bug that surfaces as
 * missing rows much later. The fix is a stronger statement in application code:
@@ -1024,24 +887,39 @@ var CacheNeedsDatabase = class extends Error {
 * application rather than a deployment choice.
 */
 var CacheIsAmbiguous = class extends Error {
+	ids;
+	databases;
 	constructor(ids, databases) {
-		super(`A cache backed by the database needs to know which one, and this app declares ${databases.length}: ${databases.join(", ")}. Declare the cache from its database — e.g. ${databases[0]}.cache('Sessions') — rather than with services.cache. Caches affected: ${ids.join(", ")}.`);
+		super(`A cache backed by the database needs to know which one, and this app declares ${databases.length}: ${databases.join(", ")}. Declare the cache from its database — e.g. ${databases[0]}.cache('Sessions') — rather than as a bare new Cache(). Caches affected: ${ids.join(", ")}.`);
 		this.ids = ids;
 		this.databases = databases;
 		this.name = "CacheIsAmbiguous";
 	}
 };
 var PgBossNeedsDatabase = class extends Error {
+	ids;
 	constructor(ids) {
-		super(`pg-boss keeps its queues in a declared database, and none was declared. Declare one, or set services.events to 'rabbitmq' or 'sns'. Queues and topics affected: ${ids.join(", ")}.`);
+		super(`pg-boss keeps its queues in a declared database, and none was declared. Declare one: on this deploy target, events are carried by pg-boss. Queues and topics affected: ${ids.join(", ")}.`);
 		this.ids = ids;
 		this.name = "PgBossNeedsDatabase";
 	}
 };
-
 //#endregion
 //#region src/reconcile/env.ts
 /**
+* The URLs a reconciled stage injects.
+*
+* One `<NAME>_URL` per construct, and the protocol picks the driver. This is the
+* seam between the target that writes a URL and the client that parses it, so
+* every component of it is read off the resource — never inherited from ambient
+* environment. A bucket can live in a different region than the function reading
+* it, and `AWS_REGION` in a Lambda is the *function's* region, so a URL that
+* omits `?region=` breaks cross-region silently at runtime.
+*
+* Locally that self-containment is what lets the port be whatever was free: the
+* app reads `ORDERS_URL` and never sees a host or a port.
+*/
+/**
 * The credential local containers are brought up with.
 *
 * The design's `roles: false` case — both URLs fall back to the cluster's master
@@ -1049,7 +927,7 @@ var PgBossNeedsDatabase = class extends Error {
 * lands in `@geekmidas/db`, at which point the runtime role's URL replaces this
 * and the owner URL stops being reachable from any manifest edge.
 */
-const LOCAL_USER = "geekmidas";
+const LOCAL_USER$2 = "geekmidas";
 /** The host containers are published on. */
 const LOCAL_HOST = "localhost";
 /** The region local buckets claim, so the client has one to sign with. */
@@ -1064,12 +942,14 @@ const LOCAL_REGION = "us-east-1";
 * rather than written into it.
 */
 const STORAGE_CREDENTIALS = {
-	AWS_ACCESS_KEY_ID: LOCAL_USER,
-	AWS_SECRET_ACCESS_KEY: LOCAL_USER,
+	AWS_ACCESS_KEY_ID: LOCAL_USER$2,
+	AWS_SECRET_ACCESS_KEY: LOCAL_USER$2,
 	AWS_REGION: LOCAL_REGION
 };
 /** The token the local cache proxy accepts. Matches the compose definition. */
-const LOCAL_TOKEN = "geekmidas";
+const LOCAL_TOKEN$1 = "geekmidas";
+/** The port Mailpit's inbox — its web UI and HTTP API — is published under. */
+const MAILPIT_INBOX_PORT = "mailpit-web";
 /** The schema pg-boss keeps its tables in, inside the declared database. */
 const PGBOSS_SCHEMA = "pgboss";
 /** The exchange every local topic and queue shares on RabbitMQ. */
@@ -1095,7 +975,11 @@ function envFor(plan, options) {
 			const owner = ownerUrl(resource, plan, options.ports, options.project ?? "");
 			if (owner) env[provideKey(resource.id, "ownerUrl")] = owner;
 		}
-		if (resource.kind === "email" && url) env[provideKey(resource.id, "from")] = options.mailFrom ?? `noreply@${LOCAL_HOST}`;
+		if (resource.kind === "email" && url) {
+			env[provideKey(resource.id, "from")] = options.mailFrom ?? `noreply@${LOCAL_HOST}`;
+			const inbox = options.ports[MAILPIT_INBOX_PORT];
+			if (inbox !== void 0) env[provideKey(resource.id, "inboxUrl")] = `http://${LOCAL_HOST}:${inbox}`;
+		}
 	}
 	Object.assign(env, publicEnv(plan, env));
 	Object.assign(env, brokerEnv(plan, options.ports));
@@ -1152,7 +1036,7 @@ function originOf(address) {
 	try {
 		return new URL(address).origin;
 	} catch {
-		return void 0;
+		return;
 	}
 }
 /**
@@ -1200,8 +1084,7 @@ function ownerUrl(resource, plan, ports, project) {
 */
 function brokerEnv(plan, ports) {
 	const carrier = plan.resources.find((r) => r.kind === "queue" || r.kind === "topic");
-	if (!carrier) return {};
-	const publisher = urlFor(carrier, plan, ports, "");
+	const publisher = carrier ? urlFor(carrier, plan, ports, "") : plan.workerBroker ? workerBroker(plan, ports) : void 0;
 	if (!publisher) return {};
 	return {
 		EVENT_PUBLISHER_CONNECTION_STRING: publisher,
@@ -1209,6 +1092,16 @@ function brokerEnv(plan, ports) {
 	};
 }
 /**
+* The broker a worker schedules its crons through, when nothing else declared
+* one — pg-boss in the declared database, on that database's port.
+*/
+function workerBroker(plan, ports) {
+	const database = plan.resources.find((r) => r.kind === "database");
+	if (!database?.container) return void 0;
+	const port = ports[primaryPortKey(database.container)];
+	return port === void 0 ? void 0 : broker(plan, port);
+}
+/**
 * The URL for one planned resource.
 *
 * Every part of it comes from the resource and the port it was published on.
@@ -1254,11 +1147,11 @@ function urlFor(resource, plan, ports, project, addresses = {}) {
 			}
 			switch (plan.cache) {
 				case "elasticache": return `redis://${LOCAL_HOST}:${port}`;
-				default: return `http://:${LOCAL_TOKEN}@${LOCAL_HOST}:${port}`;
+				default: return `http://:${LOCAL_TOKEN$1}@${LOCAL_HOST}:${port}`;
 			}
 		case "queue":
 		case "topic": return broker(plan, port);
-		default: return void 0;
+		default: return;
 	}
 }
 /**
@@ -1273,16 +1166,16 @@ function broker(plan, port) {
 		case "pgboss": {
 			const database = plan.resources.find((r) => r.kind === "database");
 			if (!database) throw new PgBossNeedsDatabase([]);
-			return `pgboss://${LOCAL_USER}:${LOCAL_USER}@${LOCAL_HOST}:${port}/${database.name}?schema=${PGBOSS_SCHEMA}`;
+			return `pgboss://${LOCAL_USER$2}:${LOCAL_USER$2}@${LOCAL_HOST}:${port}/${database.name}?schema=${PGBOSS_SCHEMA}`;
 		}
-		case "rabbitmq": return `rabbitmq://${LOCAL_USER}:${LOCAL_USER}@${LOCAL_HOST}:${port}?exchange=${RABBITMQ_EXCHANGE}`;
+		case "rabbitmq": return `rabbitmq://${LOCAL_USER$2}:${LOCAL_USER$2}@${LOCAL_HOST}:${port}?exchange=${RABBITMQ_EXCHANGE}`;
 		case "sns": throw new UnprovisionedEventsBackend("sns");
 	}
 }
 /** A local Postgres URL, master credential and all. */
 function postgres(port, database, credential = {
-	user: LOCAL_USER,
-	password: LOCAL_USER
+	user: LOCAL_USER$2,
+	password: LOCAL_USER$2
 }) {
 	return `postgres://${credential.user}:${credential.password}@${LOCAL_HOST}:${port}/${database}`;
 }
@@ -1349,7 +1242,6 @@ function schemaOf(resource, plan) {
 		if (current.kind === "database-schema") return current.schema;
 		current = current.of ? byId.get(current.of) : void 0;
 	}
-	return void 0;
 }
 /**
 * A backend whose local addresses cannot be derived yet.
@@ -1359,6 +1251,7 @@ function schemaOf(resource, plan) {
 * lands, saying so is better than handing out a string that fails on first use.
 */
 var UnprovisionedEventsBackend = class extends Error {
+	backend;
 	constructor(backend) {
 		super(`The local target cannot derive addresses for '${backend}' yet — its topics and queues are named by ARN, which nothing creates locally. Use 'pgboss' (the default) or 'rabbitmq' for local development.`);
 		this.backend = backend;
@@ -1376,1173 +1269,1400 @@ var UnprovisionedEventsBackend = class extends Error {
 function localSecret(project, plan, resource) {
 	return createHash("sha256").update(`${project}:${plan.stage}:${resource.id}`).digest("base64url").slice(0, 43);
 }
-
 //#endregion
-//#region src/reconcile/ports.ts
-/**
-* The window ports are drawn from.
-*
-* Above the registered range so nothing here needs privileges, and below the
-* ephemeral range both Linux (32768+) and macOS (49152+) allocate from — a port
-* the kernel might hand to an outgoing connection is one that is free when
-* checked and taken by the time it is bound.
-*/
-const WINDOW = {
-	min: 2e4,
-	max: 32e3
-};
+//#region src/reconcile/apps.ts
 /**
-* How far apart two projects start.
+* The apps, as services beside the containers their constructs derive.
 *
-* Wide enough that a project can add containers without walking into its
-* neighbour's block, narrow enough that the window holds many projects.
-*/
-const BLOCK = 50;
-/**
-* Where a project's ports start.
+* `gkm docker` used to write these by hand: every backend got
+* `DATABASE_URL=postgresql://…@postgres:5432/app` and `REDIS_URL=redis://redis`,
+* which was right only for a project whose single database happened to be
+* called `Database` — an `Orders` database publishes `ORDERS_URL`, a schema
+* tenant has a URL of its own, and buckets and mail were not wired at all.
 *
-* Derived from the name rather than assigned sequentially so that a fresh clone
-* of the same project on the same machine lands on the same block — the first
-* run has nothing persisted to read, and hashing is what keeps that first run
-* from colliding with whatever else is already allocated.
+* Now an app's environment is exactly what reconcile hands `gkm dev`: every key
+* the declared constructs provide, from the same derivation. The only
+* difference is where the addresses point — at the containers by service name
+* on the compose network, rather than at `localhost` on the ports published for
+* the host.
 *
-* @example startingPort('toolbox') // stable for a given name
+* Always from the *local* stage's plan, whichever stage is being reconciled:
+* `gkm test` rewrites the same file, and running the tests must not quietly
+* point these apps at the test databases.
 */
-function startingPort(project) {
-	const digest = createHash("sha256").update(project).digest();
-	const blocks = Math.floor((WINDOW.max - WINDOW.min) / BLOCK);
-	return WINDOW.min + digest.readUInt32BE(0) % blocks * BLOCK;
-}
+/** The profile app services carry, so `gkm dev` starts only the containers. */
+const APPS_PROFILE = "apps";
 /**
-* Assign a port to every container that has none, keeping the ones that do.
-*
-* Existing assignments are returned untouched even when the container is no
-* longer in the plan: removing a construct must not renumber what is left, and
-* keeping the entry means re-adding it later restores the same port rather than
-* inventing a new one.
+* Where an app's image is built from.
 *
-* @param probe - reports what is actually listening. A port assigned to this
-* project is skipped without probing, because on a converged reconcile our own
-* container is the thing listening on it.
-* @throws {NoPortAvailable} when the window is exhausted.
+* An app at the project root is a single-app project, whose `gkm docker`
+* writes `.gkm/docker/Dockerfile`; a workspace writes one per app.
 */
-async function allocate(project, containers, existing = {}, probe = isPortFree) {
-	const assignments = { ...existing };
-	const taken = new Set(Object.values(assignments));
-	for (const container of [...containers].sort()) {
-		if (assignments[container] !== void 0) continue;
-		const port = await nextFree(startingPort(project), taken, probe);
-		assignments[container] = port;
-		taken.add(port);
-	}
-	return assignments;
+function dockerfileOf(appName, path) {
+	return path === "." ? ".gkm/docker/Dockerfile" : `.gkm/docker/Dockerfile.${appName}`;
 }
-/** The window was exhausted. */
-var NoPortAvailable = class extends Error {
-	/** Where the search started. */
-	from;
-	/** The window searched, so the caller can report what was full. */
-	window = WINDOW;
-	constructor(from) {
-		super("No free port is available in the local port range");
-		this.name = "NoPortAvailable";
-		this.from = from;
-	}
-};
 /**
-* The first port at or after `from` that is neither ours nor in use.
+* Every construct key, addressed across the compose network.
 *
-* Wraps at the top of the window rather than stopping, so a project whose block
-* sits near the end is not the one that fails.
+* `envFor` is asked with a placeholder port for every port key, so each
+* `localhost:<placeholder>` in its answer names exactly one container port —
+* two containers listening on the same port inside cannot be confused — and is
+* rewritten to `<container>:<inside>`.
 */
-async function nextFree(from, taken, probe) {
-	const span = WINDOW.max - WINDOW.min;
-	for (let offset = 0; offset < span; offset++) {
-		const port = WINDOW.min + (from - WINDOW.min + offset) % span;
-		if (taken.has(port)) continue;
-		if (await probe(port)) return port;
+function inNetworkEnv(workspace, manifest) {
+	const plan = planFor(manifest, workspace.stages.local, provisionOrder(manifest), {
+		localStage: workspace.stages.local,
+		...backendsOf(workspace)
+	});
+	const placeholders = {};
+	const targets = /* @__PURE__ */ new Map();
+	let next = 49152;
+	for (const container of [...plan.containers].sort()) for (const port of portsOf(container)) {
+		placeholders[port.key] = next;
+		targets.set(next, `${container}:${port.inside}`);
+		next += 1;
 	}
-	throw new NoPortAvailable(from);
-}
-/**
-* Whether nothing is listening on a port.
-*
-* Binds rather than connects: a refused connection says nothing about whether
-* the port can be *published*, which is the question Docker will ask. Binds on
-* `0.0.0.0` for the same reason — a port free on loopback can still be taken on
-* the address Docker publishes to.
-*
-* Inherently racy, and that is acceptable: Docker failing to bind stays the real
-* check. This exists so the common case surfaces as a message at reconcile
-* rather than as a connection failure ten minutes later.
-*/
-function isPortFree(port) {
-	return new Promise((resolve$1) => {
-		const server = createServer();
-		server.once("error", () => resolve$1(false));
-		server.once("listening", () => server.close(() => resolve$1(true)));
-		server.listen(port, "0.0.0.0");
+	for (const key of portKeys(plan.containers)) placeholders[key] ??= next++;
+	const env = envFor(plan, {
+		ports: placeholders,
+		project: workspace.name,
+		addresses: surfaceAddresses(workspace, manifest, (app, port) => `http://${app}:${port}`)
 	});
-}
-
-//#endregion
-//#region src/reconcile/provision.ts
-/**
-* The Postgres work a plan implies.
-*
-* Databases before the schemas inside them, which `provisionOrder` already
-* guarantees by putting parents first.
-*/
-function postgresStatements(plan, project = "") {
-	const statements = [];
-	for (const resource of plan.resources) {
-		if (!resource.provisions || resource.container !== "postgres") continue;
-		if (resource.kind === "database") {
-			statements.push({
-				id: resource.id,
-				describe: `database ${resource.name}`,
-				exists: {
-					sql: "SELECT 1 FROM pg_database WHERE datname = $1",
-					values: [resource.name]
-				},
-				create: `CREATE DATABASE ${quoteIdentifier(resource.name)}`
-			});
-			if (resource.schema) statements.push(...rolesFor(resource, resource.schema, plan, project));
-			continue;
-		}
-		if (resource.kind === "database-schema" && resource.schema) statements.push(...rolesFor(resource, resource.schema, plan, project));
-		const cacheHome = resource.kind === "cache" && resource.of ? plan.resources.find((r) => r.id === resource.of) : void 0;
-		if (cacheHome) statements.push(...cacheTableDdl(resource, cacheHome, plan));
+	const rewrite = (value) => value.replace(/(?:localhost|127\.0\.0\.1):(\d+)/g, (match, port) => {
+		return targets.get(Number(port)) ?? match;
+	});
+	return Object.fromEntries(Object.entries(env).map(([key, value]) => [key, rewrite(value)]));
+}
+/**
+* The keys one app's environment may hold: what its own declaration provides
+* and requires, and what each construct it has an edge to provides.
+*
+* The edges, not the manifest. Every app used to be handed every key the
+* workspace resolved — a web app got the database's owner URL and the auth
+* server's signing secret, and the API got the auth server's database — which
+* is exactly what a declared edge exists to rule out. A deploy composes an
+* app's environment from its edges; so does this.
+*
+* One hop: a surface an app calls is reached over HTTP, so its URL is the
+* app's business and its database is not. A site also gets the public
+* variant of each key its bundle inlines (`NEXT_PUBLIC_API_URL`), and a surface
+* the edges of the workers whose crons and subscribers its server runs.
+*
+* `undefined` for an app no declaration describes, which gets nothing but its
+* port.
+*/
+function appEnvKeys(manifest, appName, runnables = {}) {
+	const entry = Object.entries(manifest).find(([id, d]) => (d.kind === "rest-api" || d.kind === "site") && appKey(id) === appName);
+	if (!entry) return void 0;
+	const [id, declaration] = entry;
+	const keys = /* @__PURE__ */ new Set([
+		...declaration.provides ?? [],
+		...declaration.requires ?? [],
+		...declaration.kind === "rest-api" ? declaration.endpoints.flatMap((endpoint) => endpoint.requires ?? []) : []
+	]);
+	const edges = [...dependenciesOf(declaration).map((edge) => edge.target), ...runnables[id] ?? []];
+	if (declaration.kind === "rest-api" && declaration.endpoints.length === 0) for (const [otherId, other] of Object.entries(manifest)) {
+		if (other.kind !== "worker") continue;
+		edges.push(...dependenciesOf(other).map((edge) => edge.target), ...runnables[otherId] ?? []);
+		keys.add("EVENT_PUBLISHER_CONNECTION_STRING");
+		keys.add("EVENT_SUBSCRIBER_CONNECTION_STRING");
 	}
-	return statements;
-}
-/**
-* A cache's table, in the schema the role that reads it resolves names in.
-*
-* Two things have to line up, and neither is the table's contents. The driver
-* names the table unqualified and lets the connection's `search_path` place it
-* — which the role carries — so creating it from the master connection, whose
-* path is `public`, leaves a table the application cannot see and a
-* `relation "cache" does not exist` on the first request. And the default
-* privileges that make a tenant's tables reachable are granted *for the owner
-* role*, so nothing covers a table the master created.
-*
-* Hence: qualified with the tenant's schema, handed to its owner, and granted
-* explicitly — `roleStatements` grants what exists at the time it runs, and
-* this table does not exist yet.
-*
-* A database that opted out of roles needs none of it: everything connects as
-* the master, whose `search_path` finds `public`, and the table it creates
-* there is the table it reads.
-*/
-function cacheTableDdl(cache, home, plan) {
-	const database = rootDatabase(home, plan);
-	const schema = home.roles === false ? void 0 : home.schema;
-	const name = cache.table ?? cacheTable(cache.id);
-	const table = schema ? `${schema}.${name}` : name;
-	const created = cacheTableStatements({ table }).map((statement) => ({
-		id: cache.id,
-		describe: statement.describe,
-		database,
-		...statement.exists ? { exists: statement.exists } : {},
-		create: statement.sql
-	}));
-	if (!schema) return created;
-	const runtime = localRole(home);
-	const owner = ownerRole(runtime);
-	const qualified = table.split(".").map((part) => quoteIdentifier(part)).join(".");
-	return [
-		...created,
-		{
-			id: cache.id,
-			describe: `cache table ${table} is owned by ${owner}`,
-			database,
-			create: `ALTER TABLE ${qualified} OWNER TO ${quoteIdentifier(owner)}`
-		},
-		{
-			id: cache.id,
-			describe: `${runtime} may read and write ${table}`,
-			database,
-			create: `GRANT SELECT, INSERT, UPDATE, DELETE ON ${qualified} TO ${quoteIdentifier(runtime)}`
+	for (const id of edges) {
+		const target = manifest[id];
+		if (!target) continue;
+		for (const key of target.provides ?? []) keys.add(key);
+		if (target.kind === "queue" || target.kind === "topic") {
+			keys.add("EVENT_PUBLISHER_CONNECTION_STRING");
+			keys.add("EVENT_SUBSCRIBER_CONNECTION_STRING");
 		}
-	];
+		if (target.kind === "objects") {
+			keys.add("AWS_ACCESS_KEY_ID");
+			keys.add("AWS_SECRET_ACCESS_KEY");
+			keys.add("AWS_REGION");
+		}
+	}
+	if (declaration.kind === "site") for (const key of Object.keys(publicEnvFor(declaration, manifest))) keys.add(key);
+	return keys;
+}
+/** One compose service per app the workspace runs, behind the apps profile. */
+function appServices(workspace, manifest, containers, runnables = {}) {
+	const env = inNetworkEnv(workspace, manifest);
+	const services = {};
+	for (const [name, app] of Object.entries(workspace.apps)) {
+		if (app.type === "mobile" || !app.port) continue;
+		const key = appKey(name);
+		const health = app.type === "web" ? "/" : "/health";
+		const allowed = appEnvKeys(manifest, name, runnables);
+		const own = Object.fromEntries(Object.entries(env).filter(([envKey]) => allowed?.has(envKey)));
+		services[key] = {
+			image: `${key}:\${TAG:-latest}`,
+			build: {
+				context: ".",
+				dockerfile: dockerfileOf(name, app.path)
+			},
+			profiles: [APPS_PROFILE],
+			ports: [`${app.port}:${app.port}`],
+			environment: {
+				NODE_ENV: "production",
+				PORT: String(app.port),
+				...own
+			},
+			...containers.some((c) => c !== "caddy") ? { depends_on: containers.filter((c) => c !== "caddy") } : {},
+			healthcheck: {
+				test: [
+					"CMD",
+					"wget",
+					"-q",
+					"--spider",
+					`http://localhost:${app.port}${health}`
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5
+			}
+		};
+	}
+	return services;
 }
+//#endregion
+//#region src/reconcile/clients.ts
 /**
-* The roles and schema for one database or tenant.
+* The real Postgres and MinIO clients the applier runs against.
 *
-* Skipped entirely when the construct declared `roles: false` — the documented
-* downgrade, where both URLs fall back to the cluster's master credential. It
-* is a choice someone made rather than a default they got.
+* Kept apart from `provision.ts` so the rules there — what gets created, in what
+* order, and never dropping anything — are asserted against fakes, while the
+* drivers live here where there is nothing to assert but wiring.
+*
+* Both are constructed from the same local addresses the env writer composes,
+* so the applier cannot end up talking to a different container than the app.
 */
-function rolesFor(resource, schema, plan, project) {
-	if (resource.roles === false) return [];
-	const runtime = localRole(resource);
-	const owner = ownerRole(runtime);
-	const reader = plan.resources.some((r) => r.kind === "database-reader" && r.of === resource.id) ? readerRole(runtime) : void 0;
-	return roleStatements({
-		runtime,
-		owner,
-		...reader ? { reader } : {},
-		schema,
-		passwords: {
-			runtime: localRolePassword(project, plan, runtime),
-			owner: localRolePassword(project, plan, owner),
-			...reader ? { reader: localRolePassword(project, plan, reader) } : {}
+/** The credential local containers are brought up with. */
+const LOCAL_USER$1 = "geekmidas";
+/**
+* A Postgres client that opens one connection per database it is asked about.
+*
+* `CREATE DATABASE` cannot run from a connection to the database being created,
+* and a schema must be created from inside its own database — so the database is
+* part of each query rather than fixed when the client is built.
+*/
+function pgClient(port) {
+	return { async query(database, sql, values) {
+		const client = new Client({
+			host: "localhost",
+			port,
+			user: LOCAL_USER$1,
+			password: LOCAL_USER$1,
+			database: database ?? LOCAL_USER$1
+		});
+		await client.connect();
+		try {
+			return (await client.query(sql, values)).rows;
+		} finally {
+			await client.end();
 		}
-	}).map((statement) => ({
-		id: resource.id,
-		describe: statement.describe,
-		database: rootDatabase(resource, plan),
-		...statement.exists ? { exists: statement.exists } : {},
-		create: statement.sql
-	}));
+	} };
 }
-/** The buckets a plan implies. */
-function bucketNames(plan) {
-	return plan.resources.filter((r) => r.provisions && r.kind === "objects").map((r) => r.name);
+/** A bucket client pointed at the local MinIO. */
+function bucketClient(port) {
+	const s3 = new S3Client({
+		region: "us-east-1",
+		endpoint: `http://localhost:${port}`,
+		forcePathStyle: true,
+		credentials: {
+			accessKeyId: LOCAL_USER$1,
+			secretAccessKey: LOCAL_USER$1
+		}
+	});
+	return {
+		async exists(bucket) {
+			try {
+				await s3.send(new HeadBucketCommand({ Bucket: bucket }));
+				return true;
+			} catch {
+				return false;
+			}
+		},
+		async create(bucket) {
+			await s3.send(new CreateBucketCommand({ Bucket: bucket }));
+		},
+		async policy(bucket) {
+			try {
+				return (await s3.send(new GetBucketPolicyCommand({ Bucket: bucket }))).Policy;
+			} catch {
+				return;
+			}
+		},
+		async setPolicy(bucket, policy) {
+			await s3.send(new PutBucketPolicyCommand({
+				Bucket: bucket,
+				Policy: policy
+			}));
+		}
+	};
 }
+//#endregion
+//#region src/reconcile/compose.ts
 /**
-* Quote an identifier for use in DDL.
+* The compose document a plan implies.
 *
-* Names reaching here are already canonical and stage-suffixed, so this is
-* defence rather than sanitisation — but DDL cannot be parameterised, and an
-* unquoted identifier is the one place a name could ever be more than a name.
+* The third declaration of the same containers disappears here: today a
+* `services: ['postgres','minio']` block is kept in step with the code by hand,
+* which is the triplication this design exists to remove, in the one place you
+* touch every day. A `database` implies Postgres; the list is derived.
+*
+* Returns an object rather than a string for the same reason `plan` is pure —
+* what should exist is asserted as data, and turning it into YAML is one line at
+* the edge.
+*
+* What stays config is unchanged: images and versions are pinned explicitly, and
+* a container no construct implies is still declared by hand. Neutral facts come
+* from the declaration, provider detail from config.
 */
-function quoteIdentifier(name) {
-	return `"${name.replace(/"/g, "\"\"")}"`;
-}
+/** The credential every derived container is brought up with locally. */
+const LOCAL_USER = "geekmidas";
 /**
-* Apply the plan's Postgres statements.
+* The token the local cache accepts.
 *
-* Each is checked before it is run, so this converges rather than erroring on a
-* second pass.
+* Fixed rather than generated: it is only ever reachable on a port this project
+* published, and the URL that carries it is derived, so nothing is made safer
+* by making it unguessable and a stable one keeps `redis-cli` sessions working.
 */
-async function applyPostgres(client, statements) {
-	const applied = [];
-	for (const statement of statements) {
-		if (!statement.exists) {
-			await client.query(statement.database, statement.create);
-			applied.push({
-				id: statement.id,
-				describe: statement.describe,
-				created: false
-			});
-			continue;
-		}
-		const rows = await client.query(statement.database, statement.exists.sql, statement.exists.values);
-		if (rows.length > 0) {
-			applied.push({
-				id: statement.id,
-				describe: statement.describe,
-				created: false
-			});
-			continue;
-		}
-		await client.query(statement.database, statement.create);
-		applied.push({
-			id: statement.id,
-			describe: statement.describe,
-			created: true
-		});
+const LOCAL_TOKEN = "geekmidas";
+/**
+* Build the compose document for a plan.
+*
+* Every container is published on its assigned port, never on the image's
+* default: the point of allocation is that two projects can run at once, and
+* one container publishing 5432 puts that back.
+*/
+function composeFor(plan, options) {
+	const services = {};
+	const volumes = {};
+	for (const container of [...plan.containers].sort()) {
+		const declared = container === "postgres" ? plan.resources.find((r) => r.version)?.version : void 0;
+		const image = declared ? postgresImage(declared) : DEFAULT_IMAGES[container];
+		if (!image) throw new UnknownContainer(container);
+		services[container] = define(container, image, publish(container, options.ports));
+		const volume = volumeOf(container);
+		if (volume) volumes[volume] = {};
+	}
+	return {
+		name: options.project,
+		services: {
+			...services,
+			...options.apps
+		},
+		...Object.keys(volumes).length ? { volumes } : {}
+	};
+}
+/** Render a compose document as the file it becomes. */
+function toYaml(file) {
+	return `# Generated by gkm from the construct manifest — do not edit.
+# Containers are derived from what the app declares. Image pins and anything
+# no construct implies go in your own docker-compose.yml, which is merged over
+# this file and wins:
+#
+#   docker compose -f docker-compose.constructs.yml -f docker-compose.yml …
+#
+# "gkm dev" and "gkm test" start the containers. The apps sit behind the
+# "apps" profile: run "gkm setup", then
+#   docker compose -f docker-compose.constructs.yml --profile apps up --build
+${stringify(file, { lineWidth: 0 })}`;
+}
+/** A container with no image, from config or from the defaults. */
+var UnknownContainer = class extends Error {
+	/** The container that could not be resolved. */
+	container;
+	/** The containers that have a default, so the caller can see the set. */
+	known = Object.keys(DEFAULT_IMAGES).sort();
+	constructor(container) {
+		super("No image is known for this container; pin one in config");
+		this.name = "UnknownContainer";
+		this.container = container;
+	}
+};
+/** One container's definition, published on the port it was assigned. */
+function define(container, image, published) {
+	switch (container) {
+		case "postgres": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			environment: {
+				POSTGRES_USER: LOCAL_USER,
+				POSTGRES_PASSWORD: LOCAL_USER,
+				POSTGRES_DB: LOCAL_USER
+			},
+			volumes: ["postgres-data:/var/lib/postgresql"],
+			healthcheck: {
+				test: ["CMD-SHELL", `pg_isready -U ${LOCAL_USER}`],
+				interval: "5s",
+				timeout: "3s",
+				retries: 10,
+				start_period: "10s"
+			}
+		};
+		case "minio": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			environment: {
+				MINIO_ROOT_USER: LOCAL_USER,
+				MINIO_ROOT_PASSWORD: LOCAL_USER
+			},
+			command: "server --console-address \":9001\" /data",
+			volumes: ["minio-data:/data"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"mc",
+					"ready",
+					"local"
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5,
+				start_period: "10s"
+			}
+		};
+		case "caddy": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			volumes: [
+				"./.gkm/Caddyfile:/etc/caddy/Caddyfile:ro",
+				"./.gkm/caddy-sites:/etc/caddy/sites:ro",
+				"caddy-data:/data"
+			],
+			extra_hosts: ["host.docker.internal:host-gateway"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"caddy",
+					"version"
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5
+			}
+		};
+		case "mailpit": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			environment: {
+				MP_SMTP_AUTH_ACCEPT_ANY: "1",
+				MP_SMTP_AUTH_ALLOW_INSECURE: "1"
+			},
+			healthcheck: {
+				test: [
+					"CMD",
+					"wget",
+					"-q",
+					"--spider",
+					"http://localhost:8025"
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5
+			}
+		};
+		case "redis": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			volumes: ["redis-data:/data"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"redis-cli",
+					"ping"
+				],
+				interval: "5s",
+				timeout: "3s",
+				retries: 5
+			}
+		};
+		case "redis-http": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			environment: {
+				SRH_MODE: "env",
+				SRH_TOKEN: LOCAL_TOKEN,
+				SRH_CONNECTION_STRING: "redis://redis:6379"
+			},
+			depends_on: ["redis"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"wget",
+					"-q",
+					"-O",
+					"/dev/null",
+					"http://127.0.0.1:80/"
+				],
+				interval: "5s",
+				timeout: "3s",
+				retries: 10
+			}
+		};
+		case "rabbitmq": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			environment: {
+				RABBITMQ_DEFAULT_USER: LOCAL_USER,
+				RABBITMQ_DEFAULT_PASS: LOCAL_USER
+			},
+			volumes: ["rabbitmq-data:/var/lib/rabbitmq"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"rabbitmq-diagnostics",
+					"-q",
+					"ping"
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5
+			}
+		};
+		case "localstack": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			environment: {
+				AWS_DEFAULT_REGION: "us-east-1",
+				AWS_ACCESS_KEY_ID: "LSIAQAAAAAAVNCBMPNSG",
+				AWS_SECRET_ACCESS_KEY: LOCAL_USER
+			},
+			volumes: ["localstack-data:/var/lib/localstack"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"curl",
+					"-f",
+					"http://localhost:4566/_localstack/health"
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5,
+				start_period: "10s"
+			}
+		};
+		default: throw new UnknownContainer(container);
 	}
-	return applied;
 }
 /**
-* What each bucket's open paths are, if anything serves it.
+* The published port mappings for a container.
 *
-* Keyed by the *origin*, because that is where the policy lives: two servers
-* over one bucket contribute to one policy, so the patterns are unioned rather
-* than the last one winning.
+* Every port is looked up by its own key rather than being derived as an offset
+* from the container's first, so MinIO's console cannot land on whatever was
+* allocated to the next container.
 */
-function bucketPolicies(plan) {
-	const byBucket = /* @__PURE__ */ new Map();
-	for (const resource of plan.resources) {
-		if (resource.kind !== "file-server" || !resource.open?.length) continue;
-		const origin = plan.resources.find((r) => r.id === resource.of);
-		if (!origin) continue;
-		const patterns = byBucket.get(origin.name) ?? /* @__PURE__ */ new Set();
-		for (const pattern of resource.open) patterns.add(pattern);
-		byBucket.set(origin.name, patterns);
-	}
-	return [...byBucket].map(([bucket, open]) => ({
-		bucket,
-		open: [...open].sort()
-	})).sort((a, b) => a.bucket.localeCompare(b.bucket));
+function publish(container, ports) {
+	return portsOf(container).map((port) => {
+		const assigned = ports[port.key];
+		if (assigned === void 0) throw new UnassignedPort(port.key);
+		return `${assigned}:${port.inside}`;
+	});
 }
+/** A planned port that allocation never assigned. */
+var UnassignedPort = class extends Error {
+	/** The port key that went unassigned, e.g. `minio-console`. */
+	key;
+	constructor(key) {
+		super("No port was assigned for this container port");
+		this.name = "UnassignedPort";
+		this.key = key;
+	}
+};
+//#endregion
+//#region src/reconcile/docker.ts
 /**
-* One bucket's open paths as an S3 bucket policy.
+* The real Docker, behind the small interface reconcile needs.
 *
-* Anonymous `s3:GetObject` on the named prefixes and nothing else — which is
-* what "open" means everywhere: the server serves that path without a
-* signature, and the bucket stays private for everything else.
+* Shells out to `docker compose` rather than talking to the daemon socket: it is
+* what a developer runs by hand when something is wrong, so the two cannot
+* disagree, and it keeps Docker out of this package's dependencies.
 *
-* One fidelity note, stated rather than discovered: an S3 policy resource's `*`
-* crosses `/`, so a single-star pattern is *wider* here than the construct's own
-* runtime check, which stops at a segment boundary. The construct is the
-* stricter of the two, so a key it refuses to serve unsigned is never one this
-* policy was relied on to refuse — but a key fetched directly, bypassing the
-* client, can be admitted by the policy where the client would have said no.
-* Prefer `**` where crossing segments is what you meant.
+* Every call is scoped to the generated compose file. Nothing here can touch a
+* container this project did not generate.
 */
-function bucketPolicy(bucket, open) {
-	return JSON.stringify({
-		Version: "2012-10-17",
-		Statement: [{
-			Sid: "GkmOpenPaths",
-			Effect: "Allow",
-			Principal: { AWS: ["*"] },
-			Action: ["s3:GetObject"],
-			Resource: open.map((pattern) => `arn:aws:s3:::${bucket}/${pattern.replace(/\*\*/g, "*")}`)
-		}]
-	});
-}
+const run = promisify(execFile);
 /**
-* Apply each served bucket's open-path policy, skipping those already correct.
+* The generated file, then the project's own if it has one.
 *
-* Compared as parsed JSON rather than as text: the same policy re-serialised
-* with different key order is the same policy, and rewriting it every reconcile
-* would report a change on every start.
+* Merged in that order so the project's wins — an `image:` there pins a
+* container this file derived, and a service there is added beside them.
 */
-async function applyPolicies(client, policies) {
-	const applied = [];
-	for (const { bucket, open } of policies) {
-		const wanted = bucketPolicy(bucket, open);
-		const describe = `open paths on ${bucket}`;
-		if (equivalent(await client.policy(bucket), wanted)) {
-			applied.push({
-				id: `${bucket}:policy`,
-				describe,
-				created: false
-			});
-			continue;
-		}
-		await client.setPolicy(bucket, wanted);
-		applied.push({
-			id: `${bucket}:policy`,
-			describe,
-			created: true
-		});
-	}
-	return applied;
-}
-/** Whether two policy documents say the same thing. */
-function equivalent(current, wanted) {
-	if (!current) return false;
-	try {
-		return JSON.stringify(JSON.parse(current)) === JSON.stringify(JSON.parse(wanted));
-	} catch {
-		return false;
-	}
+function composeFiles(composePath) {
+	const project = join(dirname(composePath), "docker-compose.yml");
+	return [
+		"-f",
+		composePath,
+		...existsSync(project) ? ["-f", project] : []
+	];
 }
-/** Create every bucket the plan names, skipping those that exist. */
-async function applyBuckets(client, buckets) {
-	const applied = [];
-	for (const bucket of buckets) {
-		if (await client.exists(bucket)) {
-			applied.push({
-				id: bucket,
-				describe: `bucket ${bucket}`,
-				created: false
-			});
-			continue;
+/** How long to wait for containers to pass their health checks. */
+const HEALTH_TIMEOUT_MS = 12e4;
+const dockerCli = {
+	async publishedPort(composePath, service, inside) {
+		try {
+			const { stdout } = await run("docker", [
+				"compose",
+				...composeFiles(composePath),
+				"port",
+				service,
+				String(inside)
+			]);
+			const port = Number(stdout.trim().split(":").pop());
+			return Number.isFinite(port) && port > 0 ? port : void 0;
+		} catch {
+			return;
+		}
+	},
+	async up(composePath, services) {
+		await run("docker", [
+			"compose",
+			...composeFiles(composePath),
+			"up",
+			"-d",
+			"--remove-orphans",
+			"--wait",
+			`--wait-timeout=${Math.floor(HEALTH_TIMEOUT_MS / 1e3)}`,
+			...services
+		]);
+	},
+	async copyOut(composePath, service, from, to) {
+		await mkdir(dirname(to), { recursive: true });
+		await run("docker", [
+			"compose",
+			...composeFiles(composePath),
+			"cp",
+			`${service}:${from}`,
+			to
+		]);
+	},
+	async reload(composePath, service) {
+		await run("docker", [
+			"compose",
+			...composeFiles(composePath),
+			"exec",
+			"-T",
+			service,
+			"caddy",
+			"reload",
+			"--config",
+			"/etc/caddy/Caddyfile"
+		]);
+	},
+	async healthy(composePath, services) {
+		if (services.length === 0) return true;
+		try {
+			const { stdout } = await run("docker", [
+				"compose",
+				...composeFiles(composePath),
+				"ps",
+				"--format",
+				"json",
+				...services
+			]);
+			const running = /* @__PURE__ */ new Set();
+			for (const line of stdout.trim().split("\n").filter(Boolean)) {
+				const entry = JSON.parse(line);
+				if (entry.State === "running" && (entry.Health === void 0 || entry.Health === "" || entry.Health === "healthy") && entry.Service) running.add(entry.Service);
+			}
+			return services.every((service) => running.has(service));
+		} catch {
+			return false;
 		}
-		await client.create(bucket);
-		applied.push({
-			id: bucket,
-			describe: `bucket ${bucket}`,
-			created: true
-		});
 	}
-	return applied;
-}
-
+};
 //#endregion
-//#region src/reconcile/state.ts
-const STATE_DIR = ".gkm/reconcile";
+//#region src/reconcile/ports.ts
 /**
-* The hash of everything a reconcile would act on.
+* Port allocation — why two projects can run at once.
 *
-* Covers the compose document rather than the plan alone, because the plan is
-* unchanged when only an image pin moves — and a changed image is exactly a
-* container that must be recreated. `stringify` is stable here because
-* `composeFor` sorts its containers, which is what makes the hash meaningful.
+* Publishing `5432:5432` means the second project on your machine cannot start.
+* Nothing solves that except giving each project its own ports, and what makes
+* it *possible* is the single-`<NAME>_URL` rule: an app reads `ORDERS_URL` and
+* never sees a host or a port, so reconcile is free to bind whatever is
+* available and compose the URL from what it bound. An app reading `DB_HOST` and
+* `DB_PORT` separately could not be moved this way.
 *
-* Deliberately a plain function over serialisable input: the deployed target
-* keys its provisioner invocation on the same idea, and the two must not be able
-* to disagree about what counts as a change.
-*/
-function planHash(plan, compose, generated = {}) {
-	return createHash("sha256").update(JSON.stringify({
-		stage: plan.stage,
-		plan,
-		compose,
-		generated
-	})).digest("hex");
-}
-/** Read the recorded state, or nothing if this stage has never reconciled. */
-async function loadState(root, stage) {
-	try {
-		const raw = await readFile(statePath(root, stage), "utf-8");
-		const state = JSON.parse(raw);
-		return state.stage === stage ? state : void 0;
-	} catch {
-		return void 0;
-	}
-}
-/** Record what was applied, so the next run can skip it. */
-async function saveState(root, state) {
-	const path = statePath(root, state.stage);
-	await mkdir(dirname(path), { recursive: true });
-	await writeFile(path, `${JSON.stringify(state, null, 2)}\n`);
-}
-function statePath(root, stage) {
-	return join(root, STATE_DIR, `${stage}.json`);
-}
-
-//#endregion
-//#region src/reconcile/index.ts
-/** Where the generated compose file is written, relative to the project root. */
-const COMPOSE_PATH = ".gkm/docker-compose.yml";
-/**
-* The local edge's config, beside the compose file that mounts it.
+* Assignments are **persisted, not recomputed**. Recomputing means adding a
+* construct renumbers its neighbours, and every running container, saved
+* connection string, and `psql` history goes stale at once.
 *
-* Relative in the compose volume, so it resolves against `.gkm/` wherever the
-* project lives.
+* Pure, with the liveness probe injected — a collision with another project's
+* stack is a fact about the machine, and keeping it a parameter is what lets the
+* rules be asserted without binding a socket.
 */
-const CADDYFILE_PATH = ".gkm/Caddyfile";
 /**
-* Where one stage's routes live, imported by the file above.
+* The window ports are drawn from.
 *
-* Per stage because one edge serves every stage, the same way one Postgres
-* holds `orders` and `orders_test`. A single file would mean `gkm test`
-* deleting the routes `gkm dev` is serving.
+* Above the registered range so nothing here needs privileges, and below the
+* ephemeral range both Linux (32768+) and macOS (49152+) allocate from — a port
+* the kernel might hand to an outgoing connection is one that is free when
+* checked and taken by the time it is bound.
 */
-const caddySitesPath = (stage) => `.gkm/caddy-sites/${stage}.caddy`;
+const WINDOW = {
+	min: 2e4,
+	max: 32e3
+};
 /**
-* Where the local edge's root certificate is copied to.
+* How far apart two projects start.
 *
-* Exported so a process can be pointed at it without installing anything:
-* `NODE_EXTRA_CA_CERTS` is the whole of the trust story for Node, and it needs
-* no sudo. A browser is the case that still wants the root in the system store,
-* which is a one-time `caddy trust` rather than something a reconcile should do
-* on a developer's behalf.
+* Wide enough that a project can add containers without walking into its
+* neighbour's block, narrow enough that the window holds many projects.
 */
-const LOCAL_CA_PATH = ".gkm/caddy-root.crt";
-/** Where Caddy keeps the root of the CA it generated. */
-const CADDY_ROOT_IN_CONTAINER = "/data/caddy/pki/authorities/local/root.crt";
+const BLOCK = 50;
 /**
-* Converge the local target on what the manifest declares.
+* Where a project's ports start.
 *
-* Cheap when there is nothing to do: the hash is compared before the compose
-* file is written or a container is touched, and a converged project pays one
-* hash and one health check.
-*/
-async function reconcile(options) {
-	const { root, project, manifest, stage, start = true, provision = true, docker = dockerCli, probe = isPortFree, sql = pgClient, buckets = bucketClient } = options;
-	const plan = planFor(manifest, stage, provisionOrder(manifest), {
-		events: options.events,
-		cache: options.cache,
-		extraContainers: options.extraContainers,
-		...options.edge === void 0 ? {} : { edge: options.edge }
-	});
-	const composePath = join(root, COMPOSE_PATH);
-	const observed = await observedPorts(docker, composePath, plan.containers);
-	const ports = await allocate(project, portKeys(plan.containers), {
-		...options.saved,
-		...observed
-	}, probe);
-	const compose = composeFor(plan, {
-		project,
-		ports,
-		...options.images ? { images: options.images } : {}
-	});
-	const caddyfile = toCaddyfile(sitesFor(plan, project, options.addresses));
-	const hash = planHash(plan, compose, { caddyfile });
-	const addresses = addressesFor(plan.containers, ports);
-	const env = envFor(plan, {
-		ports,
-		project,
-		...options.mailFrom ? { mailFrom: options.mailFrom } : {},
-		...options.addresses ? { addresses: options.addresses } : {}
-	});
-	if (plan.containers.includes("caddy")) env.NODE_EXTRA_CA_CERTS = join(root, LOCAL_CA_PATH);
-	const result = {
-		stage,
-		plan,
-		compose,
-		ports,
-		addresses,
-		env,
-		provisioned: [],
-		hash,
-		changed: false
-	};
-	const recorded = await loadState(root, stage);
-	const converged = recorded?.hash === hash && (!start || await docker.healthy(composePath, plan.containers));
-	if (converged) return result;
-	await write(composePath, toYaml(compose));
-	if (plan.containers.includes("caddy")) {
-		await write(join(root, CADDYFILE_PATH), caddyfileRoot());
-		await write(join(root, caddySitesPath(stage)), caddyfile);
-	}
-	if (start && plan.containers.length > 0) await docker.up(composePath, plan.containers);
-	if (start && plan.containers.includes("caddy")) await docker.reload(composePath, "caddy").catch(() => {});
-	if (start && plan.containers.includes("caddy")) await docker.copyOut(composePath, "caddy", CADDY_ROOT_IN_CONTAINER, join(root, LOCAL_CA_PATH)).catch(() => {});
-	const provisioned = start && provision ? await create(plan, ports, sql, buckets, project) : [];
-	await saveState(root, {
-		hash,
-		stage
-	});
-	return {
-		...result,
-		provisioned,
-		changed: true
-	};
-}
-/**
-* Create the databases, schemas, and buckets the plan names.
+* Derived from the name rather than assigned sequentially so that a fresh clone
+* of the same project on the same machine lands on the same block — the first
+* run has nothing persisted to read, and hashing is what keeps that first run
+* from colliding with whatever else is already allocated.
 *
-* Idempotent throughout, so this runs on every non-converged reconcile rather
-* than being something to remember.
+* @example startingPort('toolbox') // stable for a given name
 */
-async function create(plan, ports, sql, buckets, project) {
-	const applied = [];
-	const postgresPort = ports[primaryPortKey("postgres")];
-	const statements = postgresStatements(plan, project);
-	if (postgresPort !== void 0 && statements.length > 0) applied.push(...await applyPostgres(sql(postgresPort), statements));
-	const minioPort = ports[primaryPortKey("minio")];
-	const names = bucketNames(plan);
-	const policies = bucketPolicies(plan);
-	if (minioPort !== void 0 && (names.length > 0 || policies.length > 0)) {
-		const client = buckets(minioPort);
-		if (names.length > 0) applied.push(...await applyBuckets(client, names));
-		if (policies.length > 0) applied.push(...await applyPolicies(client, policies));
-	}
-	return applied;
+function startingPort(project) {
+	const digest = createHash("sha256").update(project).digest();
+	const blocks = Math.floor((WINDOW.max - WINDOW.min) / BLOCK);
+	return WINDOW.min + digest.readUInt32BE(0) % blocks * BLOCK;
 }
 /**
-* The host ports of containers already running.
+* Assign a port to every container that has none, keeping the ones that do.
 *
-* Keyed the same way allocation keys them, so the two merge without either
-* knowing about the other.
-*/
-async function observedPorts(docker, composePath, containers) {
-	const observed = {};
-	for (const container of containers) for (const port of portsOf(container)) {
-		const running = await docker.publishedPort(composePath, container, port.inside);
-		if (running !== void 0) observed[port.key] = running;
-	}
-	return observed;
-}
-/**
-* Where each container can be reached on this machine.
+* Existing assignments are returned untouched even when the container is no
+* longer in the plan: removing a construct must not renumber what is left, and
+* keeping the entry means re-adding it later restores the same port rather than
+* inventing a new one.
 *
-* The primary port only — a container's console is for a human to open, not
-* something an app connects to.
+* @param probe - reports what is actually listening. A port assigned to this
+* project is skipped without probing, because on a converged reconcile our own
+* container is the thing listening on it.
+* @throws {NoPortAvailable} when the window is exhausted.
 */
-function addressesFor(containers, ports) {
-	const addresses = {};
-	for (const container of containers) {
-		const port = ports[primaryPortKey(container)];
-		if (port !== void 0) addresses[container] = `localhost:${port}`;
+async function allocate(project, containers, existing = {}, probe = isPortFree) {
+	const assignments = { ...existing };
+	const taken = new Set(Object.values(assignments));
+	for (const container of [...containers].sort()) {
+		if (assignments[container] !== void 0) continue;
+		const port = await nextFree(startingPort(project), taken, probe);
+		assignments[container] = port;
+		taken.add(port);
 	}
-	return addresses;
-}
-/** Write a file only when its content would change, so mtimes stay meaningful. */
-async function write(path, content) {
-	try {
-		if (await readFile(path, "utf-8") === content) return;
-	} catch {}
-	await mkdir(dirname(path), { recursive: true });
-	await writeFile(path, content);
+	return assignments;
 }
-
-//#endregion
-//#region src/reconcile/workspace.ts
+/** The window was exhausted. */
+var NoPortAvailable = class extends Error {
+	/** Where the search started. */
+	from;
+	/** The window searched, so the caller can report what was full. */
+	window = WINDOW;
+	constructor(from) {
+		super("No free port is available in the local port range");
+		this.name = "NoPortAvailable";
+		this.from = from;
+	}
+};
 /**
-* Every constructs glob in the workspace, resolved against its app.
+* The first port at or after `from` that is neither ours nor in use.
 *
-* Absolute because discovery globs from a single cwd while apps live in
-* different directories.
+* Wraps at the top of the window rather than stopping, so a project whose block
+* sits near the end is not the one that fails.
 */
-function constructGlobs(workspace) {
-	return allConstructGlobs(workspace);
-}
-/** Whether any app has adopted the constructs glob. */
-function usesConstructs(workspace) {
-	return constructGlobs(workspace).length > 0;
+async function nextFree(from, taken, probe) {
+	const span = WINDOW.max - WINDOW.min;
+	for (let offset = 0; offset < span; offset++) {
+		const port = WINDOW.min + (from - WINDOW.min + offset) % span;
+		if (taken.has(port)) continue;
+		if (await probe(port)) return port;
+	}
+	throw new NoPortAvailable(from);
 }
 /**
-* Image pins, by container. The config half of the derived/config split.
+* Whether nothing is listening on a port.
 *
-* Read from `services.images` rather than from the backend keys beside it.
-* They used to share one key, which is how `cache: true` came to mean "start a
-* Redis" — the last way a container could exist because config asked for one
-* instead of because something declared it.
+* Binds rather than connects: a refused connection says nothing about whether
+* the port can be *published*, which is the question Docker will ask. Binds on
+* `0.0.0.0` for the same reason — a port free on loopback can still be taken on
+* the address Docker publishes to.
+*
+* Inherently racy, and that is acceptable: Docker failing to bind stays the real
+* check. This exists so the common case surfaces as a message at reconcile
+* rather than as a connection failure ten minutes later.
 */
-function imagePins(workspace) {
-	return { ...workspace.services.images };
+function isPortFree(port) {
+	return new Promise((resolve) => {
+		const server = createServer();
+		server.once("error", () => resolve(false));
+		server.once("listening", () => server.close(() => resolve(true)));
+		server.listen(port, "0.0.0.0");
+	});
 }
+//#endregion
+//#region src/reconcile/provision.ts
 /**
-* The containers a workspace's declarations imply, without reconciling.
+* Creating what the URLs name.
 *
-* The same derivation `reconcileWorkspace` makes, available to callers that
-* need to know *what would run* without starting anything or writing ports —
-* `gkm setup` deciding which credentials to generate, `gkm docker` writing a
-* compose file. Those used to each read a boolean per service out of config,
-* which is how a container could exist because config asked for one rather than
-* because something declared it.
+* Convergent and idempotent: every statement asks whether the thing exists
+* first, so reconciling repeatedly is free and a half-applied run recovers by
+* being run again. That property is what lets `gkm dev` do this on every start.
+*
+* The line the design draws is at data, not at side effects — this creates
+* databases, schemas, and buckets, and it never seeds, resets, or drops. A
+* developer who wants their data gone asks for it explicitly.
+*
+* Statement generation is separated from application for the reason the design
+* gives: the same DDL has to run in-process locally and from a provisioner in a
+* VPC, and one implementation is what stops "works locally, fails deployed".
+* When the role DDL lands in `@geekmidas/db` this delegates to it rather than
+* growing its own.
 */
-async function derivedContainers(workspace, stage, manifest) {
-	const found = manifest ?? await discover({
-		patterns: constructGlobs(workspace),
-		cwd: workspace.root
-	});
-	return planFor(found, stage, provisionOrder(found), {
-		events: workspace.services.events,
-		cache: cacheBackendOf(workspace.services.cache, providerOf(workspace))
-	}).containers;
-}
 /**
-* Reconcile a workspace for one stage.
+* The Postgres work a plan implies.
 *
-* Ports are loaded and saved around the call rather than inside it, so the loop
-* stays a pure-ish function of its inputs and the store keeps its single owner.
+* Databases before the schemas inside them, which `provisionOrder` already
+* guarantees by putting parents first.
 */
-async function reconcileWorkspace(workspace, options) {
-	const manifest = options.manifest ?? await discover({
-		patterns: constructGlobs(workspace),
-		cwd: workspace.root
-	});
-	const result = await reconcile({
-		root: workspace.root,
-		project: workspace.name,
-		manifest,
-		stage: options.stage,
-		events: workspace.services.events,
-		cache: cacheBackendOf(workspace.services.cache, providerOf(workspace)),
-		images: imagePins(workspace),
-		saved: await loadPortState(workspace.root),
-		addresses: surfaceAddresses(workspace, manifest),
-		...options.start === void 0 ? {} : { start: options.start }
-	});
-	await savePortState(workspace.root, { ...result.ports });
-	return result;
+function postgresStatements(plan, project = "") {
+	const statements = [];
+	for (const resource of plan.resources) {
+		if (!resource.provisions || resource.container !== "postgres") continue;
+		if (resource.kind === "database") {
+			statements.push({
+				id: resource.id,
+				describe: `database ${resource.name}`,
+				exists: {
+					sql: "SELECT 1 FROM pg_database WHERE datname = $1",
+					values: [resource.name]
+				},
+				create: `CREATE DATABASE ${quoteIdentifier(resource.name)}`
+			});
+			if (resource.schema) statements.push(...rolesFor(resource, resource.schema, plan, project));
+			continue;
+		}
+		if (resource.kind === "database-schema" && resource.schema) statements.push(...rolesFor(resource, resource.schema, plan, project));
+		const cacheHome = resource.kind === "cache" && resource.of ? plan.resources.find((r) => r.id === resource.of) : void 0;
+		if (cacheHome) statements.push(...cacheTableDdl(resource, cacheHome, plan));
+	}
+	return statements;
 }
 /**
-* Where each declared surface and site answers locally.
+* A cache's table, in the schema the role that reads it resolves names in.
 *
-* The addresses come from the ports the workspace already assigns; which
-* construct sits at which one comes from the manifest. That split is the point:
-* this used to answer "who may call whom" by listing every app the workspace
-* runs, which is a different question that happened to give the same answer in
-* a single-repo workspace and no answer at all deployed. Now it answers only
-* "where does this construct answer", and the graph answers the rest.
+* Two things have to line up, and neither is the table's contents. The driver
+* names the table unqualified and lets the connection's `search_path` place it
+* — which the role carries — so creating it from the master connection, whose
+* path is `public`, leaves a table the application cannot see and a
+* `relation "cache" does not exist` on the first request. And the default
+* privileges that make a tenant's tables reachable are granted *for the owner
+* role*, so nothing covers a table the master created.
 *
-* A site is matched to its app by `path`, because that is the one thing a site
-* declaration and a workspace app both name. Surfaces are matched to the
-* backend app: every `rest-api` in a process answers on that process's port, so
-* an app serving both its own API and an auth server publishes one address
-* twice — which is exactly what it does at runtime.
+* Hence: qualified with the tenant's schema, handed to its owner, and granted
+* explicitly — `roleStatements` grants what exists at the time it runs, and
+* this table does not exist yet.
+*
+* A database that opted out of roles needs none of it: everything connects as
+* the master, whose `search_path` finds `public`, and the table it creates
+* there is the table it reads.
 */
-function surfaceAddresses(workspace, manifest) {
-	const addresses = {};
-	for (const [id, declaration] of Object.entries(manifest)) {
-		if (declaration.kind !== "rest-api" && declaration.kind !== "site") continue;
-		const host = declaration.kind === "site" ? appKey(id) : appKeyOfHost(manifest, id);
-		const app = host ? workspace.apps[host] : void 0;
-		if (app?.port) addresses[id] = localAddress(app.port);
-	}
-	return addresses;
+function cacheTableDdl(cache, home, plan) {
+	const database = rootDatabase(home, plan);
+	const schema = home.roles === false ? void 0 : home.schema;
+	const name = cache.table ?? cacheTable(cache.id);
+	const table = schema ? `${schema}.${name}` : name;
+	const created = cacheTableStatements({ table }).map((statement) => ({
+		id: cache.id,
+		describe: statement.describe,
+		database,
+		...statement.exists ? { exists: statement.exists } : {},
+		create: statement.sql
+	}));
+	if (!schema) return created;
+	const runtime = localRole(home);
+	const owner = ownerRole(runtime);
+	const qualified = table.split(".").map((part) => quoteIdentifier(part)).join(".");
+	return [
+		...created,
+		{
+			id: cache.id,
+			describe: `cache table ${table} is owned by ${owner}`,
+			database,
+			create: `ALTER TABLE ${qualified} OWNER TO ${quoteIdentifier(owner)}`
+		},
+		{
+			id: cache.id,
+			describe: `${runtime} may read and write ${table}`,
+			database,
+			create: `GRANT SELECT, INSERT, UPDATE, DELETE ON ${qualified} TO ${quoteIdentifier(runtime)}`
+		}
+	];
 }
-/** The app key serving a surface, following a mount to its host. */
-function appKeyOfHost(manifest, id) {
-	const host = hostOf(manifest, id);
-	return host ? appKey(host) : void 0;
+/**
+* The roles and schema for one database or tenant.
+*
+* Skipped entirely when the construct declared `roles: false` — the documented
+* downgrade, where both URLs fall back to the cluster's master credential. It
+* is a choice someone made rather than a default they got.
+*/
+function rolesFor(resource, schema, plan, project) {
+	if (resource.roles === false) return [];
+	const runtime = localRole(resource);
+	const owner = ownerRole(runtime);
+	const reader = plan.resources.some((r) => r.kind === "database-reader" && r.of === resource.id) ? readerRole(runtime) : void 0;
+	return roleStatements({
+		runtime,
+		owner,
+		...reader ? { reader } : {},
+		schema,
+		passwords: {
+			runtime: localRolePassword(project, plan, runtime),
+			owner: localRolePassword(project, plan, owner),
+			...reader ? { reader: localRolePassword(project, plan, reader) } : {}
+		}
+	}).map((statement) => ({
+		id: resource.id,
+		describe: statement.describe,
+		database: rootDatabase(resource, plan),
+		...statement.exists ? { exists: statement.exists } : {},
+		create: statement.sql
+	}));
 }
-/** Where a local process answers, given the port the workspace gave it. */
-function localAddress(port) {
-	return `http://localhost:${port}`;
+/** The buckets a plan implies. */
+function bucketNames(plan) {
+	return plan.resources.filter((r) => r.provisions && r.kind === "objects").map((r) => r.name);
 }
-
-//#endregion
-//#region src/credentials/index.ts
-const logger = console;
 /**
-* Load environment files
-* @internal Exported for testing
+* Quote an identifier for use in DDL.
+*
+* Names reaching here are already canonical and stage-suffixed, so this is
+* defence rather than sanitisation — but DDL cannot be parameterised, and an
+* unquoted identifier is the one place a name could ever be more than a name.
 */
-function loadEnvFiles(envConfig, cwd = process.cwd()) {
-	const loaded = [];
-	const missing = [];
-	const envFiles = envConfig ? Array.isArray(envConfig) ? envConfig : [envConfig] : [".env"];
-	for (const envFile of envFiles) {
-		const envPath = resolve(cwd, envFile);
-		if (existsSync(envPath)) {
-			config({
-				path: envPath,
-				override: true,
-				quiet: true
-			});
-			loaded.push(envFile);
-		} else if (envConfig) missing.push(envFile);
-	}
-	return {
-		loaded,
-		missing
-	};
+function quoteIdentifier(name) {
+	return `"${name.replace(/"/g, "\"\"")}"`;
 }
 /**
-* Check if a port is available
-* @internal Exported for testing
+* Apply the plan's Postgres statements.
+*
+* Each is checked before it is run, so this converges rather than erroring on a
+* second pass.
 */
-async function isPortAvailable(port) {
-	return new Promise((resolve$1) => {
-		const server = createServer();
-		server.once("error", (err) => {
-			if (err.code === "EADDRINUSE") resolve$1(false);
-			else resolve$1(false);
-		});
-		server.once("listening", () => {
-			server.close();
-			resolve$1(true);
+async function applyPostgres(client, statements) {
+	const applied = [];
+	for (const statement of statements) {
+		if (!statement.exists) {
+			await client.query(statement.database, statement.create);
+			applied.push({
+				id: statement.id,
+				describe: statement.describe,
+				created: false
+			});
+			continue;
+		}
+		if ((await client.query(statement.database, statement.exists.sql, statement.exists.values)).length > 0) {
+			applied.push({
+				id: statement.id,
+				describe: statement.describe,
+				created: false
+			});
+			continue;
+		}
+		await client.query(statement.database, statement.create);
+		applied.push({
+			id: statement.id,
+			describe: statement.describe,
+			created: true
 		});
-		server.listen(port);
-	});
+	}
+	return applied;
 }
 /**
-* Find an available port starting from the preferred port
-* @internal Exported for testing
+* What each bucket's open paths are, if anything serves it.
+*
+* Keyed by the *origin*, because that is where the policy lives: two servers
+* over one bucket contribute to one policy, so the patterns are unioned rather
+* than the last one winning.
 */
-async function findAvailablePort(preferredPort, maxAttempts = 10) {
-	for (let i = 0; i < maxAttempts; i++) {
-		const port = preferredPort + i;
-		if (await isPortAvailable(port)) return port;
-		logger.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
+function bucketPolicies(plan) {
+	const byBucket = /* @__PURE__ */ new Map();
+	for (const resource of plan.resources) {
+		if (resource.kind !== "file-server" || !resource.open?.length) continue;
+		const origin = plan.resources.find((r) => r.id === resource.of);
+		if (!origin) continue;
+		const patterns = byBucket.get(origin.name) ?? /* @__PURE__ */ new Set();
+		for (const pattern of resource.open) patterns.add(pattern);
+		byBucket.set(origin.name, patterns);
 	}
-	throw new Error(`Could not find an available port after trying ${maxAttempts} ports starting from ${preferredPort}`);
+	return [...byBucket].map(([bucket, open]) => ({
+		bucket,
+		open: [...open].sort()
+	})).sort((a, b) => a.bucket.localeCompare(b.bucket));
 }
-const PORT_STATE_PATH = ".gkm/ports.json";
 /**
-* Parse docker-compose.yml and extract all port mappings that use env var interpolation.
-* Entries like `'${POSTGRES_HOST_PORT:-5432}:5432'` are captured.
-* Fixed port mappings like `'5050:80'` are skipped.
-* @internal Exported for testing
+* One bucket's open paths as an S3 bucket policy.
+*
+* Anonymous `s3:GetObject` on the named prefixes and nothing else — which is
+* what "open" means everywhere: the server serves that path without a
+* signature, and the bucket stays private for everything else.
+*
+* One fidelity note, stated rather than discovered: an S3 policy resource's `*`
+* crosses `/`, so a single-star pattern is *wider* here than the construct's own
+* runtime check, which stops at a segment boundary. The construct is the
+* stricter of the two, so a key it refuses to serve unsigned is never one this
+* policy was relied on to refuse — but a key fetched directly, bypassing the
+* client, can be admitted by the policy where the client would have said no.
+* Prefer `**` where crossing segments is what you meant.
 */
-function parseComposePortMappings(composePath) {
-	if (!existsSync(composePath)) return [];
-	const content = readFileSync(composePath, "utf-8");
-	const compose = parse$1(content);
-	if (!compose?.services) return [];
-	const results = [];
-	for (const [serviceName, serviceConfig] of Object.entries(compose.services)) for (const portMapping of serviceConfig?.ports ?? []) {
-		const match = String(portMapping).match(/\$\{(\w+):-(\d+)\}:(\d+)/);
-		if (match?.[1] && match[2] && match[3]) results.push({
-			service: serviceName,
-			envVar: match[1],
-			defaultPort: Number(match[2]),
-			containerPort: Number(match[3])
-		});
-	}
-	return results;
+function bucketPolicy(bucket, open) {
+	return JSON.stringify({
+		Version: "2012-10-17",
+		Statement: [{
+			Sid: "GkmOpenPaths",
+			Effect: "Allow",
+			Principal: { AWS: ["*"] },
+			Action: ["s3:GetObject"],
+			Resource: open.map((pattern) => `arn:aws:s3:::${bucket}/${pattern.replace(/\*\*/g, "*")}`)
+		}]
+	});
 }
 /**
-* Load saved port state from .gkm/ports.json.
-* @internal Exported for testing
+* Apply each served bucket's open-path policy, skipping those already correct.
+*
+* Compared as parsed JSON rather than as text: the same policy re-serialised
+* with different key order is the same policy, and rewriting it every reconcile
+* would report a change on every start.
 */
-async function loadPortState(workspaceRoot) {
+async function applyPolicies(client, policies) {
+	const applied = [];
+	for (const { bucket, open } of policies) {
+		const wanted = bucketPolicy(bucket, open);
+		const describe = `open paths on ${bucket}`;
+		if (equivalent(await client.policy(bucket), wanted)) {
+			applied.push({
+				id: `${bucket}:policy`,
+				describe,
+				created: false
+			});
+			continue;
+		}
+		await client.setPolicy(bucket, wanted);
+		applied.push({
+			id: `${bucket}:policy`,
+			describe,
+			created: true
+		});
+	}
+	return applied;
+}
+/** Whether two policy documents say the same thing. */
+function equivalent(current, wanted) {
+	if (!current) return false;
 	try {
-		const raw = await readFile(join(workspaceRoot, PORT_STATE_PATH), "utf-8");
-		return JSON.parse(raw);
+		return JSON.stringify(JSON.parse(current)) === JSON.stringify(JSON.parse(wanted));
 	} catch {
-		return {};
+		return false;
 	}
 }
+/** Create every bucket the plan names, skipping those that exist. */
+async function applyBuckets(client, buckets) {
+	const applied = [];
+	for (const bucket of buckets) {
+		if (await client.exists(bucket)) {
+			applied.push({
+				id: bucket,
+				describe: `bucket ${bucket}`,
+				created: false
+			});
+			continue;
+		}
+		await client.create(bucket);
+		applied.push({
+			id: bucket,
+			describe: `bucket ${bucket}`,
+			created: true
+		});
+	}
+	return applied;
+}
+//#endregion
+//#region src/reconcile/state.ts
 /**
-* Save port state to .gkm/ports.json.
-* @internal Exported for testing
+* What reconcile records, and the hash that lets it do nothing.
+*
+* Reconciling on every `gkm dev` is only acceptable if the converged case is
+* free, so the desired plan is hashed: matching hash plus healthy containers
+* means there is nothing to do. Without that, the automatic reconcile the design
+* asks for would tax every start.
+*
+* Almost nothing needs recording — roles are queried, migrations have their own
+* table, containers are remembered by Docker. Only ports and this hash have no
+* other owner.
 */
-async function savePortState(workspaceRoot, ports) {
-	const dir = join(workspaceRoot, ".gkm");
-	await mkdir(dir, { recursive: true });
-	await writeFile(join(workspaceRoot, PORT_STATE_PATH), `${JSON.stringify(ports, null, 2)}\n`);
-}
+const STATE_DIR = ".gkm/reconcile";
 /**
-* Check if a project's own Docker container is running and return its host port.
-* Uses `docker compose port` scoped to the project's compose file.
-* @internal Exported for testing
+* The hash of everything a reconcile would act on.
+*
+* Covers the compose document rather than the plan alone, because the plan is
+* unchanged when only an image pin moves — and a changed image is exactly a
+* container that must be recreated. `stringify` is stable here because
+* `composeFor` sorts its containers, which is what makes the hash meaningful.
+*
+* Deliberately a plain function over serialisable input: the deployed target
+* keys its provisioner invocation on the same idea, and the two must not be able
+* to disagree about what counts as a change.
 */
-function getContainerHostPort(workspaceRoot, service, containerPort) {
+function planHash(plan, compose, generated = {}) {
+	return createHash("sha256").update(JSON.stringify({
+		stage: plan.stage,
+		plan,
+		compose,
+		generated
+	})).digest("hex");
+}
+/** Read the recorded state, or nothing if this stage has never reconciled. */
+async function loadState(root, stage) {
 	try {
-		const result = execSync(`docker compose port ${service} ${containerPort}`, {
-			cwd: workspaceRoot,
-			stdio: "pipe"
-		}).toString().trim();
-		const match = result.match(/:(\d+)$/);
-		return match ? Number(match[1]) : null;
+		const raw = await readFile(statePath(root, stage), "utf-8");
+		const state = JSON.parse(raw);
+		return state.stage === stage ? state : void 0;
 	} catch {
-		return null;
+		return;
 	}
 }
+/** Record what was applied, so the next run can skip it. */
+async function saveState(root, state) {
+	const path = statePath(root, state.stage);
+	await mkdir(dirname(path), { recursive: true });
+	await writeFile(path, `${JSON.stringify(state, null, 2)}\n`);
+}
+function statePath(root, stage) {
+	return join(root, STATE_DIR, `${stage}.json`);
+}
+//#endregion
+//#region src/reconcile/index.ts
 /**
-* Resolve host ports for Docker services by parsing docker-compose.yml.
-* Priority: running container → saved state → find available port.
-* Persists resolved ports to .gkm/ports.json.
-* @internal Exported for testing
+* Reconcile — the one convergent function `gkm dev`, `gkm test`, and `gkm setup`
+* all call.
+*
+* Three phases, and only this one has side effects: declaring is pure (`gkm
+* build` and the dev watcher), running reads `<NAME>_URL` and provisions
+* nothing. Reconcile computes the desired state, compares, and applies the
+* difference — which is what makes "when does it run" answerable with
+* *whenever, repeatedly*.
+*
+* It is safe to run automatically because its blast radius is entirely local:
+* this project's containers, this project's `.gkm/`. Nothing it does can reach a
+* cloud. The line is drawn at data, not at side effects — it allocates ports,
+* writes compose, starts containers, and creates roles; it never seeds, resets,
+* or drops.
+*
+* Docker is injected rather than imported so the rules above can be asserted
+* without a daemon. The default implementation is the real one.
 */
-async function resolveServicePorts(workspaceRoot) {
-	const composePath = join(workspaceRoot, "docker-compose.yml");
-	const mappings = parseComposePortMappings(composePath);
-	if (mappings.length === 0) return {
-		dockerEnv: {},
-		ports: {},
-		mappings: []
-	};
-	const savedState = await loadPortState(workspaceRoot);
-	const dockerEnv = {};
-	const ports = {};
-	const assignedPorts = /* @__PURE__ */ new Set();
-	logger.log("\n🔌 Resolving service ports...");
-	for (const mapping of mappings) {
-		const containerPort = getContainerHostPort(workspaceRoot, mapping.service, mapping.containerPort);
-		if (containerPort !== null) {
-			ports[mapping.envVar] = containerPort;
-			dockerEnv[mapping.envVar] = String(containerPort);
-			assignedPorts.add(containerPort);
-			logger.log(`   🔄 ${mapping.service}:${mapping.containerPort}: reusing existing container on port ${containerPort}`);
-			continue;
-		}
-		const savedPort = savedState[mapping.envVar];
-		if (savedPort && !assignedPorts.has(savedPort) && await isPortAvailable(savedPort)) {
-			ports[mapping.envVar] = savedPort;
-			dockerEnv[mapping.envVar] = String(savedPort);
-			assignedPorts.add(savedPort);
-			logger.log(`   💾 ${mapping.service}:${mapping.containerPort}: using saved port ${savedPort}`);
-			continue;
-		}
-		let resolvedPort = await findAvailablePort(mapping.defaultPort);
-		while (assignedPorts.has(resolvedPort)) resolvedPort = await findAvailablePort(resolvedPort + 1);
-		ports[mapping.envVar] = resolvedPort;
-		dockerEnv[mapping.envVar] = String(resolvedPort);
-		assignedPorts.add(resolvedPort);
-		if (resolvedPort !== mapping.defaultPort) logger.log(`   ⚡ ${mapping.service}:${mapping.containerPort}: port ${mapping.defaultPort} occupied, using port ${resolvedPort}`);
-		else logger.log(`   ✅ ${mapping.service}:${mapping.containerPort}: using default port ${resolvedPort}`);
-	}
-	await savePortState(workspaceRoot, ports);
-	return {
-		dockerEnv,
-		ports,
-		mappings
-	};
-}
 /**
-* Replace a port in a URL string.
-* Handles both `hostname:port` and `localhost:port` patterns.
-* @internal Exported for testing
+* Where the generated compose file is written, relative to the project root.
+*
+* At the root, beside the project's own `docker-compose.yml`, because the two
+* are one stack: this file is everything the constructs imply and is never
+* edited, that one is anything they cannot express — an image pin, an extra
+* service — and is merged over it, so it wins.
 */
-function replacePortInUrl(url, oldPort, newPort) {
-	if (oldPort === newPort) return url;
-	let result = url.replace(new RegExp(`:${oldPort}(?=[/?#]|$)`, "g"), `:${newPort}`);
-	result = result.replace(new RegExp(`%3A${oldPort}(?=[%/?#&]|$)`, "gi"), `%3A${newPort}`);
-	return result;
-}
+const COMPOSE_PATH = "docker-compose.constructs.yml";
 /**
-* Rewrite connection URLs and port vars in secrets with resolved ports.
-* Uses the parsed compose mappings to determine which default ports to replace.
-* Pure transform — does not modify secrets on disk.
-* @internal Exported for testing
+* The local edge's config, beside the compose file that mounts it.
+*
+* Relative in the compose volume, so it resolves against `.gkm/` wherever the
+* project lives.
 */
-function rewriteUrlsWithPorts(secrets, resolvedPorts) {
-	const { ports, mappings } = resolvedPorts;
-	const result = { ...secrets };
-	const portReplacements = [];
-	const serviceNames = /* @__PURE__ */ new Set();
-	for (const mapping of mappings) {
-		serviceNames.add(mapping.service);
-		const resolved = ports[mapping.envVar];
-		if (resolved !== void 0) portReplacements.push({
-			defaultPort: mapping.defaultPort,
-			resolvedPort: resolved
-		});
-	}
-	for (const [key, value] of Object.entries(result)) {
-		if (!key.endsWith("_HOST")) continue;
-		if (serviceNames.has(value)) result[key] = "localhost";
-	}
-	for (const [key, value] of Object.entries(result)) {
-		if (!key.endsWith("_PORT")) continue;
-		for (const { defaultPort, resolvedPort } of portReplacements) if (value === String(defaultPort)) result[key] = String(resolvedPort);
-	}
-	for (const [key, value] of Object.entries(result)) {
-		if (!key.endsWith("_URL") && !key.endsWith("_ENDPOINT") && !key.endsWith("_CONNECTION_STRING") && key !== "DATABASE_URL") continue;
-		let rewritten = value;
-		for (const name of serviceNames) rewritten = rewritten.replace(new RegExp(`@${name}:`, "g"), "@localhost:");
-		for (const { defaultPort, resolvedPort } of portReplacements) rewritten = replacePortInUrl(rewritten, defaultPort, resolvedPort);
-		result[key] = rewritten;
+const CADDYFILE_PATH = ".gkm/Caddyfile";
+/**
+* Where one stage's routes live, imported by the file above.
+*
+* Per stage because one edge serves every stage, the same way one Postgres
+* holds `orders` and `orders_test`. A single file would mean `gkm test`
+* deleting the routes `gkm dev` is serving.
+*/
+const caddySitesPath = (stage) => `.gkm/caddy-sites/${stage}.caddy`;
+/**
+* Where the local edge's root certificate is copied to.
+*
+* Exported so a process can be pointed at it without installing anything:
+* `NODE_EXTRA_CA_CERTS` is the whole of the trust story for Node, and it needs
+* no sudo. A browser is the case that still wants the root in the system store,
+* which is a one-time `caddy trust` rather than something a reconcile should do
+* on a developer's behalf.
+*/
+const LOCAL_CA_PATH = ".gkm/caddy-root.crt";
+/** Where Caddy keeps the root of the CA it generated. */
+const CADDY_ROOT_IN_CONTAINER = "/data/caddy/pki/authorities/local/root.crt";
+/**
+* Converge the local target on what the manifest declares.
+*
+* Cheap when there is nothing to do: the hash is compared before the compose
+* file is written or a container is touched, and a converged project pays one
+* hash and one health check.
+*/
+async function reconcile(options) {
+	const { root, project, manifest, stage, start = true, provision = true, docker = dockerCli, probe = isPortFree, sql = pgClient, buckets = bucketClient } = options;
+	const plan = planFor(manifest, stage, provisionOrder(manifest), {
+		localStage: options.localStage,
+		events: options.events,
+		cache: options.cache,
+		extraContainers: options.extraContainers,
+		...options.edge === void 0 ? {} : { edge: options.edge }
+	});
+	const composePath = join(root, COMPOSE_PATH);
+	const observed = await observedPorts(docker, composePath, plan.containers);
+	const ports = await allocate(project, portKeys(plan.containers), {
+		...options.saved,
+		...observed
+	}, probe);
+	const compose = composeFor(plan, {
+		project,
+		ports,
+		...options.apps ? { apps: options.apps(plan.containers) } : {}
+	});
+	const caddyfile = toCaddyfile(sitesFor(plan, project, options.addresses));
+	const hash = planHash(plan, compose, { caddyfile });
+	const addresses = addressesFor(plan.containers, ports);
+	const env = envFor(plan, {
+		ports,
+		project,
+		...options.mailFrom ? { mailFrom: options.mailFrom } : {},
+		...options.addresses ? { addresses: options.addresses } : {}
+	});
+	if (plan.containers.includes("caddy")) env.NODE_EXTRA_CA_CERTS = join(root, LOCAL_CA_PATH);
+	const result = {
+		stage,
+		plan,
+		compose,
+		ports,
+		addresses,
+		env,
+		provisioned: [],
+		hash,
+		changed: false
+	};
+	if ((await loadState(root, stage))?.hash === hash && existsSync(composePath) && (!start || await docker.healthy(composePath, plan.containers))) return result;
+	await write(composePath, toYaml(compose));
+	if (plan.containers.includes("caddy")) {
+		await write(join(root, CADDYFILE_PATH), caddyfileRoot());
+		await write(join(root, caddySitesPath(stage)), caddyfile);
+		await pruneCaddySites(root, [
+			stage,
+			options.localStage,
+			TEST_STAGE
+		]);
 	}
-	return result;
-}
-/**
-* Build the environment variables to pass to `docker compose up`.
-* Merges process.env, secrets, and port mappings so that Docker Compose
-* can interpolate variables like ${POSTGRES_USER} correctly.
-* @internal Exported for testing
-*/
-function buildDockerComposeEnv(secretsEnv, portEnv) {
+	if (start && plan.containers.length > 0) await docker.up(composePath, plan.containers);
+	if (start && plan.containers.includes("caddy")) await docker.reload(composePath, "caddy").catch(() => {});
+	if (start && plan.containers.includes("caddy")) await docker.copyOut(composePath, "caddy", CADDY_ROOT_IN_CONTAINER, join(root, LOCAL_CA_PATH)).catch(() => {});
+	const provisioned = start && provision ? await create(plan, ports, sql, buckets, project) : [];
+	await saveState(root, {
+		hash,
+		stage
+	});
 	return {
-		...process.env,
-		...secretsEnv,
-		...portEnv
+		...result,
+		provisioned,
+		changed: true
 	};
 }
 /**
-* Parse all service names from a docker-compose.yml file.
-* @internal Exported for testing
+* Create the databases, schemas, and buckets the plan names.
+*
+* Idempotent throughout, so this runs on every non-converged reconcile rather
+* than being something to remember.
 */
-function parseComposeServiceNames(composePath) {
-	if (!existsSync(composePath)) return [];
-	const content = readFileSync(composePath, "utf-8");
-	const compose = parse$1(content);
-	return Object.keys(compose?.services ?? {});
+async function create(plan, ports, sql, buckets, project) {
+	const applied = [];
+	const postgresPort = ports[primaryPortKey("postgres")];
+	const statements = postgresStatements(plan, project);
+	if (postgresPort !== void 0 && statements.length > 0) applied.push(...await applyPostgres(sql(postgresPort), statements));
+	const minioPort = ports[primaryPortKey("minio")];
+	const names = bucketNames(plan);
+	const policies = bucketPolicies(plan);
+	if (minioPort !== void 0 && (names.length > 0 || policies.length > 0)) {
+		const client = buckets(minioPort);
+		if (names.length > 0) applied.push(...await applyBuckets(client, names));
+		if (policies.length > 0) applied.push(...await applyPolicies(client, policies));
+	}
+	return applied;
 }
 /**
-* Start docker-compose services for a single-app project (no workspace config).
-* Starts all services defined in docker-compose.yml.
+* The host ports of containers already running.
+*
+* Keyed the same way allocation keys them, so the two merge without either
+* knowing about the other.
 */
-async function startComposeServices(cwd, portEnv, secretsEnv) {
-	const composeFile = join(cwd, "docker-compose.yml");
-	if (!existsSync(composeFile)) return;
-	const servicesToStart = parseComposeServiceNames(composeFile);
-	if (servicesToStart.length === 0) return;
-	logger.log(`🐳 Starting services: ${servicesToStart.join(", ")}`);
-	try {
-		execSync(`docker compose up -d ${servicesToStart.join(" ")}`, {
-			cwd,
-			stdio: "inherit",
-			env: buildDockerComposeEnv(secretsEnv, portEnv)
-		});
-		logger.log("✅ Services started");
-	} catch (error) {
-		logger.error("❌ Failed to start services:", error.message);
-		throw error;
+async function observedPorts(docker, composePath, containers) {
+	const observed = {};
+	for (const container of containers) for (const port of portsOf(container)) {
+		const running = await docker.publishedPort(composePath, container, port.inside);
+		if (running !== void 0) observed[port.key] = running;
 	}
+	return observed;
 }
 /**
-* Start docker-compose services for a workspace.
-* Discovers all services from docker-compose.yml and starts everything
-* except app services (which are managed by turbo).
-* @internal Exported for testing
+* Where each container can be reached on this machine.
+*
+* The primary port only — a container's console is for a human to open, not
+* something an app connects to.
 */
-async function startWorkspaceServices(workspace, portEnv, secretsEnv) {
-	const composeFile = join(workspace.root, "docker-compose.yml");
-	if (!existsSync(composeFile)) return;
-	const allServices = parseComposeServiceNames(composeFile);
-	const appNames = new Set(Object.keys(workspace.apps));
-	const servicesToStart = allServices.filter((name) => !appNames.has(name));
-	if (servicesToStart.length === 0) return;
-	logger.log(`🐳 Starting services: ${servicesToStart.join(", ")}`);
-	try {
-		execSync(`docker compose up -d ${servicesToStart.join(" ")}`, {
-			cwd: workspace.root,
-			stdio: "inherit",
-			env: buildDockerComposeEnv(secretsEnv, portEnv)
-		});
-		logger.log("✅ Services started");
-	} catch (error) {
-		logger.error("❌ Failed to start services:", error.message);
-		throw error;
+function addressesFor(containers, ports) {
+	const addresses = {};
+	for (const container of containers) {
+		const port = ports[primaryPortKey(container)];
+		if (port !== void 0) addresses[container] = `localhost:${port}`;
 	}
+	return addresses;
 }
+/** Write a file only when its content would change, so mtimes stay meaningful. */
 /**
-* Load and flatten secrets for an app from encrypted storage.
-* For workspace app: maps {APP}_DATABASE_URL → DATABASE_URL.
-* @internal Exported for testing
+* Remove the routes of stages this project no longer reconciles.
+*
+* Only the local stage and `test` are ever written, so any other file is left
+* over from a stage that was renamed — `development` becoming `dev`. Caddy
+* imports every file, and the leftover declares the same hosts as its
+* replacement: it refuses the whole config as ambiguous, and every URL behind
+* the edge goes with it.
 */
-async function loadSecretsForApp(secretsRoot, appName, stages = ["dev", "development"]) {
-	let secrets = {};
-	for (const stage of stages) if (secretsExist(stage, secretsRoot)) {
-		const stageSecrets = await readStageSecrets(stage, secretsRoot);
-		if (stageSecrets) {
-			logger.log(`🔐 Loading secrets from stage: ${stage}`);
-			secrets = toEmbeddableSecrets(stageSecrets);
-			break;
-		}
-	}
-	if (Object.keys(secrets).length === 0) return {};
-	if (!appName) return secrets;
-	const prefix = appName.toUpperCase();
-	const mapped = { ...secrets };
-	const appDbUrl = secrets[`${prefix}_DATABASE_URL`];
-	if (appDbUrl) mapped.DATABASE_URL = appDbUrl;
-	return mapped;
+async function pruneCaddySites(root, stages) {
+	const dir = dirname(join(root, caddySitesPath(TEST_STAGE)));
+	const keep = new Set(stages.map((stage) => stage && `${stage}.caddy`));
+	for (const file of await readdir(dir)) if (file.endsWith(".caddy") && !keep.has(file)) await rm(join(dir, file));
+}
+async function write(path, content) {
+	try {
+		if (await readFile(path, "utf-8") === content) return;
+	} catch {}
+	await mkdir(dirname(path), { recursive: true });
+	await writeFile(path, content);
 }
+//#endregion
+//#region src/reconcile/workspace.ts
 /**
-* Walk up the directory tree to find the root containing .gkm/secrets/.
-* @internal Exported for testing
+* Workspace config → reconcile.
+*
+* Nothing here is read from a `services:` block — there is none. Which
+* containers exist comes from the manifest; which backend a cache or a broker
+* resolves to comes from the deploy target; and an image pin is the project's
+* own `docker-compose.yml`, merged over the generated file.
+*
+* Shared by `gkm setup`, `gkm dev`, and `gkm test` so all three converge on the
+* same state, differing only in the stage they pass.
 */
-function findSecretsRoot(startDir) {
-	let dir = startDir;
-	while (dir !== "/") {
-		if (existsSync(join(dir, ".gkm", "secrets"))) return dir;
-		const parent = dirname(dir);
-		if (parent === dir) break;
-		dir = parent;
-	}
-	return startDir;
-}
+var workspace_exports = /* @__PURE__ */ __exportAll({
+	backendsOf: () => backendsOf,
+	constructGlobs: () => constructGlobs,
+	derivedContainers: () => derivedContainers,
+	reconcileWorkspace: () => reconcileWorkspace,
+	surfaceAddresses: () => surfaceAddresses
+});
 /**
-* Generate the credentials injection code snippet.
-* This is the common logic used by both entry wrapper and exec preload.
-* @internal
+* Every constructs glob in the workspace, resolved against its app.
+*
+* Absolute because discovery globs from a single cwd while apps live in
+* different directories.
 */
-function generateCredentialsInjection(secretsJsonPath) {
-	return `import { existsSync, readFileSync } from 'node:fs';
-
-// Inject dev secrets via globalThis and process.env
-// Using globalThis.__gkm_credentials__ avoids CJS/ESM interop issues where
-// Object.assign on the Credentials export only mutates one module copy.
-const secretsPath = '${secretsJsonPath}';
-if (existsSync(secretsPath)) {
-  const secrets = JSON.parse(readFileSync(secretsPath, 'utf-8'));
-  globalThis.__gkm_credentials__ = secrets;
-  Object.assign(process.env, secrets);
+function constructGlobs(workspace) {
+	return allConstructGlobs(workspace);
 }
-`;
+/** The backends a workspace's target implies, as the plan takes them. */
+function backendsOf(workspace) {
+	const on = providerOf(workspace);
+	return {
+		events: eventsBackendFor(on),
+		cache: cacheBackendFor(on)
+	};
 }
 /**
-* Create a preload script that injects secrets into Credentials.
-* Used by `gkm exec` to inject secrets before running any command.
-* @internal Exported for testing
+* The containers a workspace's declarations imply, without reconciling.
+*
+* The same derivation `reconcileWorkspace` makes, available to callers that
+* need to know *what would run* without starting anything or writing ports —
+* `gkm setup` deciding which credentials to generate, `gkm docker` writing a
+* compose file. Those used to each read a boolean per service out of config,
+* which is how a container could exist because config asked for one rather than
+* because something declared it.
 */
-async function createCredentialsPreload(preloadPath, secretsJsonPath) {
-	const content = `/**
- * Credentials preload generated by 'gkm exec'
- * This file is loaded via NODE_OPTIONS="--import <path>"
- */
-${generateCredentialsInjection(secretsJsonPath)}`;
-	await writeFile(preloadPath, content);
+async function derivedContainers(workspace, stage, manifest) {
+	const found = manifest ?? await discover({
+		patterns: constructGlobs(workspace),
+		cwd: workspace.root
+	});
+	return planFor(found, stage, provisionOrder(found), {
+		localStage: workspace.stages.local,
+		...backendsOf(workspace)
+	}).containers;
 }
 /**
-* Create a wrapper script that injects secrets before importing the entry file.
-* @internal Exported for testing
+* Reconcile a workspace for one stage.
+*
+* Ports are loaded and saved around the call rather than inside it, so the loop
+* stays a pure-ish function of its inputs and the store keeps its single owner.
 */
-async function createEntryWrapper(wrapperPath, entryPath, secretsJsonPath) {
-	const credentialsInjection = secretsJsonPath ? `${generateCredentialsInjection(secretsJsonPath)}
-` : "";
-	const content = `#!/usr/bin/env node
-/**
- * Entry wrapper generated by 'gkm dev --entry'
- */
-${credentialsInjection}// Import and run the user's entry file (dynamic import ensures secrets load first)
-await import('${entryPath}');
-`;
-	await writeFile(wrapperPath, content);
+async function reconcileWorkspace(workspace, options) {
+	const runnables = {};
+	const discovered = await discover({
+		patterns: constructGlobs(workspace),
+		cwd: workspace.root,
+		runnables
+	});
+	const manifest = options.manifest ?? discovered;
+	const result = await reconcile({
+		root: workspace.root,
+		project: workspace.name,
+		manifest,
+		stage: options.stage,
+		localStage: workspace.stages.local,
+		...backendsOf(workspace),
+		saved: await loadPortState(workspace.root),
+		addresses: surfaceAddresses(workspace, manifest),
+		apps: (containers) => appServices(workspace, manifest, containers, runnables),
+		...options.start === void 0 ? {} : { start: options.start }
+	});
+	await savePortState(workspace.root, { ...result.ports });
+	return result;
 }
 /**
-* Prepare credentials for dev/exec/test modes.
-* Loads workspace config, secrets, resolves Docker ports, rewrites URLs,
-* injects PORT, dependency URLs, and writes credentials JSON.
+* Where each declared surface and site answers locally.
 *
-* @param options.resolveDockerPorts - How to resolve Docker ports:
-*   - `'full'` (default): probe running containers, saved state, then find available ports. Used by dev/test.
-*   - `'readonly'`: check running containers and saved state only, never probe for new ports. Used by exec.
-* @param options.stages - Secret stages to try, in order. Default: ['dev', 'development'].
-* @param options.startDocker - Start Docker Compose services after port resolution. Default: false.
-* @param options.secretsFileName - Custom secrets JSON filename. Default: 'dev-secrets-{appName}.json' or 'dev-secrets.json'.
-* @internal Exported for testing
+* The addresses come from the ports the workspace already assigns; which
+* construct sits at which one comes from the manifest. That split is the point:
+* this used to answer "who may call whom" by listing every app the workspace
+* runs, which is a different question that happened to give the same answer in
+* a single-repo workspace and no answer at all deployed. Now it answers only
+* "where does this construct answer", and the graph answers the rest.
+*
+* A site is matched to its app by `path`, because that is the one thing a site
+* declaration and a workspace app both name. Surfaces are matched to the
+* backend app: every `rest-api` in a process answers on that process's port, so
+* an app serving both its own API and an auth server publishes one address
+* twice — which is exactly what it does at runtime.
 */
-async function prepareEntryCredentials(options) {
-	const cwd = options.cwd ?? process.cwd();
-	const portMode = options.resolveDockerPorts ?? "full";
-	let workspaceAppPort;
-	let secretsRoot = cwd;
-	let appName;
-	let appInfo;
-	try {
-		appInfo = await loadWorkspaceAppInfo(cwd);
-		workspaceAppPort = appInfo.app.port;
-		secretsRoot = appInfo.workspaceRoot;
-		appName = appInfo.appName;
-	} catch {
-		secretsRoot = findSecretsRoot(cwd);
-		appName = getAppNameFromCwd(cwd) ?? void 0;
-	}
-	const resolvedPort = options.explicitPort ?? workspaceAppPort ?? 3e3;
-	const credentials = await loadSecretsForApp(secretsRoot, appName, options.stages);
-	credentials.PORT = String(resolvedPort);
-	const declaredKeys = [];
-	if (appInfo && usesConstructs(appInfo.workspace)) {
-		const { reconcileWorkspace: reconcileWorkspace$1 } = await import("./workspace-DK4WWJIn.mjs");
-		const reconciled = await reconcileWorkspace$1(appInfo.workspace, {
-			stage: options.reconcileStage ?? "development",
-			start: options.startDocker ?? false
-		});
-		Object.assign(credentials, reconciled.env);
-		declaredKeys.push(...Object.keys(reconciled.env));
-		if (Object.keys(reconciled.env).length > 0) logger.log(`🔌 Resolved ${Object.keys(reconciled.env).length} declared URL(s)`);
-	} else {
-		const composePath = join(secretsRoot, "docker-compose.yml");
-		const mappings = parseComposePortMappings(composePath);
-		if (mappings.length > 0) {
-			let resolvedPorts;
-			if (portMode === "full") resolvedPorts = await resolveServicePorts(secretsRoot);
-			else {
-				const savedPorts = await loadPortState(secretsRoot);
-				const ports = {};
-				for (const mapping of mappings) {
-					const containerPort = getContainerHostPort(secretsRoot, mapping.service, mapping.containerPort);
-					if (containerPort !== null) ports[mapping.envVar] = containerPort;
-					else {
-						const saved = savedPorts[mapping.envVar];
-						if (saved !== void 0) ports[mapping.envVar] = saved;
-					}
-				}
-				resolvedPorts = {
-					dockerEnv: {},
-					ports,
-					mappings
-				};
-			}
-			if (options.startDocker) if (appInfo) await startWorkspaceServices(appInfo.workspace, resolvedPorts.dockerEnv, credentials);
-			else await startComposeServices(secretsRoot, resolvedPorts.dockerEnv, credentials);
-			if (Object.keys(resolvedPorts.ports).length > 0) {
-				const rewritten = rewriteUrlsWithPorts(credentials, resolvedPorts);
-				Object.assign(credentials, rewritten);
-				logger.log(`🔌 Applied ${Object.keys(resolvedPorts.ports).length} port mapping(s)`);
-			}
-		}
-	}
-	if (appInfo?.appName) {
-		const depEnv = getDependencyEnvVars(appInfo.workspace, appInfo.appName);
-		Object.assign(credentials, depEnv);
-	}
-	if (!credentials.EVENT_PUBLISHER_CONNECTION_STRING && !credentials.EVENT_SUBSCRIBER_CONNECTION_STRING && credentials.PGBOSS_DB_USER) {
-		const pgbossUrl = generatePgBossUrl({
-			username: credentials.PGBOSS_DB_USER,
-			password: credentials.PGBOSS_DB_PASSWORD ?? "",
-			host: credentials.POSTGRES_HOST ?? "localhost",
-			port: Number(credentials.POSTGRES_PORT ?? "5432"),
-			database: credentials.POSTGRES_DB ?? "app"
-		});
-		credentials.EVENT_PUBLISHER_CONNECTION_STRING = pgbossUrl;
-		credentials.EVENT_SUBSCRIBER_CONNECTION_STRING = pgbossUrl;
+function surfaceAddresses(workspace, manifest, at = (_app, port) => localAddress(port)) {
+	const addresses = {};
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration.kind !== "rest-api" && declaration.kind !== "site") continue;
+		const host = appKey(id);
+		const port = workspace.apps[host]?.port;
+		if (port) addresses[id] = at(host, port);
 	}
-	const secretsDir = join(secretsRoot, ".gkm");
-	await mkdir(secretsDir, { recursive: true });
-	const secretsFileName = options.secretsFileName ?? (appName ? `dev-secrets-${appName}.json` : "dev-secrets.json");
-	const secretsJsonPath = join(secretsDir, secretsFileName);
-	await writeFile(secretsJsonPath, JSON.stringify(credentials, null, 2));
-	return {
-		credentials,
-		resolvedPort,
-		secretsJsonPath,
-		appName,
-		secretsRoot,
-		appInfo,
-		declaredKeys
-	};
+	return addresses;
+}
+/** Where a local process answers, given the port the workspace gave it. */
+function localAddress(port) {
+	return `http://localhost:${port}`;
 }
-
 //#endregion
-export { LOCAL_CA_PATH, applyPostgres, cacheBackendOf, constructGlobs, createCredentialsPreload, createEntryWrapper, derivedContainers, emailBackendOf, findAvailablePort, imagePins, isPortAvailable, loadEnvFiles, loadSecretsForApp, prepareEntryCredentials, providerOf, reconcileWorkspace, resolveServicePorts, resourceName, rewriteUrlsWithPorts, startWorkspaceServices, storageBackendOf, usesConstructs };
-//# sourceMappingURL=credentials-BZcp3CGx.mjs.map
+export { findAvailablePort as _, workspace_exports as a, loadSecretsForApp as b, applyPostgres as c, cacheBackendFor as d, eventsBackendFor as f, createEntryWrapper as g, createCredentialsPreload as h, reconcileWorkspace as i, resourceName as l, storageBackendFor as m, constructGlobs as n, COMPOSE_PATH as o, providerOf as p, derivedContainers as r, LOCAL_CA_PATH as s, backendsOf as t, rootSite as u, isPortAvailable as v, prepareEntryCredentials as x, loadEnvFiles as y };
+
+//# sourceMappingURL=workspace-C97QUCIf.mjs.map