@geekmidas/cli 10.0.0-alpha.5 → 10.0.0-alpha.50

package/dist/{credentials-BBIRJVp4.mjs → workspace-BsbxbqV-.mjs}

@@ -1,321 +1,266 @@
-import { DEFAULT_CACHE, DEFAULT_EMAIL, DEFAULT_STORAGE, discover } from "./discover-CAlFgYec.mjs";
-import { appKey, getAppNameFromCwd, hostOf, loadWorkspaceAppInfo } from "./config-WRdsQYZK.mjs";
-import { allConstructGlobs, getDependencyEnvVars } from "./workspace-BFMrAKqI.mjs";
-import { generatePgBossUrl } from "./generator-VE2JrFlY.mjs";
-import { readStageSecrets, secretsExist, toEmbeddableSecrets } from "./storage-Bi24WfoW.mjs";
-import { existsSync, readFileSync } from "node:fs";
+import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
+import { t as discover } from "./discover-Cf2jAcgF.mjs";
+import { c as loadWorkspaceAppInfo, f as appKey, l as loadWorkspaceConfig, r as NotInAnApp, t as ConfigNotFound } from "./config-D8J5rrTb.mjs";
+import { E as TEST_STAGE, t as allConstructGlobs } from "./workspace-DNzWgM1J.mjs";
+import { i as toEmbeddableSecrets } from "./storage-BzaUxmqe.mjs";
+import { i as FileSecretsStore, n as secretsStoreFor } from "./store-DeGATCS-.mjs";
+import { l as readFakes, u as DEFAULT_CACHE } from "./ready-WfT-eWlm.mjs";
+import { n as eventsBackendFor, r as providerOf, t as cacheBackendFor } from "./backends-CSuLl0YP.mjs";
+import { existsSync } from "node:fs";
+import { mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
+import { networkInterfaces } from "node:os";
 import { dirname, join, resolve } from "node:path";
-import { DEFAULT_POSTGRES_VERSION, cacheTable, cookieDomain, dependentsOf, provideKey, providedKeyFor, provisionOrder, publicEnvFor } from "@geekmidas/manifest";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { execFile, execSync } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
+import { DEFAULT_POSTGRES_VERSION, cacheTable, cookieDomain, dependenciesOf, dependentsOf, externalApiUrl, kebabCase, mobileOrigins, provideKey, providedKeyFor, provisionOrder, publicEnvFor, schemeBase } from "@geekmidas/manifest";
 import { createServer } from "node:net";
 import { config } from "dotenv";
-import { parse as parse$1, stringify } from "yaml";
+import { createHash } from "node:crypto";
+import { formatKeyring } from "@geekmidas/constructs/encryption";
+import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
+import * as snsUrl from "@geekmidas/events/sns/url";
+import * as sqsUrl from "@geekmidas/events/sqs/url";
 import { CreateBucketCommand, GetBucketPolicyCommand, HeadBucketCommand, PutBucketPolicyCommand, S3Client } from "@aws-sdk/client-s3";
+import { CreateTopicCommand, GetTopicAttributesCommand, SNSClient } from "@aws-sdk/client-sns";
+import { CreateQueueCommand, GetQueueUrlCommand, SQSClient } from "@aws-sdk/client-sqs";
 import { Client } from "pg";
+import { stringify } from "yaml";
 import { promisify } from "node:util";
-import { createHash } from "node:crypto";
-import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
 import { cacheTableStatements } from "@geekmidas/cache/postgres";
-
-//#region src/workspace/backends.ts
-const CACHE_BACKENDS = [
-	"upstash",
-	"elasticache",
-	"db"
-];
-const EMAIL_BACKENDS = [
-	"resend",
-	"ses",
-	"smtp"
-];
-const STORAGE_BACKENDS = [
-	"minio",
-	"s3",
-	"r2"
-];
-/**
-* The cache backend a workspace selected, or the one its target implies.
-*
-* Defaulted here rather than by every caller, so "what happens when nobody
-* said" is answered once and the answer is greppable — and now answered by
-* *where it deploys*, because there is no single right answer for both a
-* Lambda and a box running its own Postgres.
-*
-* `on` is the deploy target, not where this code happens to be running. A
-* local `gkm dev` for an AWS app still defaults to Upstash, because a backend
-* that differed between local and deployed would be worse than a slower one —
-* which is the property the type's own documentation asks for.
-*/
-function cacheBackendOf(value, on = "aws") {
-	return isBackend(value, CACHE_BACKENDS) ? value : DEFAULT_CACHE[on];
-}
-/** The email backend a workspace selected, defaulting to SES on every target. */
-function emailBackendOf(value) {
-	return isBackend(value, EMAIL_BACKENDS) ? value : DEFAULT_EMAIL;
-}
-/** The storage backend a workspace selected, or the one its target implies. */
-function storageBackendOf(value, on = "aws") {
-	return isBackend(value, STORAGE_BACKENDS) ? value : DEFAULT_STORAGE[on];
-}
-/**
-* Which family of defaults a workspace's deploy target belongs to.
-*
-* One question, asked once: **does this target run containers the project
-* controls?** Dokploy and a bare server do, so a bucket or a cache can live
-* beside the app; AWS, Vercel and Cloudflare do not, so the default has to be
-* something managed. That is the whole of the distinction, and it is why
-* `MainProvider` is the right axis rather than the deploy target's own name —
-* three targets share one answer.
-*
-* An AWS deploy names no `deploy.default` at all, because it goes through SST,
-* which is why the absence is what selects `aws`.
-*/
-function providerOf(workspace) {
-	const target = workspace.deploy?.default;
-	return target === "dokploy" || target === "server" ? "server" : "aws";
-}
-/**
-* Whether a string names a backend, as opposed to being one of the other things
-* a `services:` value can be.
-*
-* A misspelling falls through to the default rather than throwing, which is the
-* wrong trade for something with a cost attached — so callers that can report it
-* should use {@link unknownBackend} to say so.
-*/
-function isBackend(value, backends) {
-	return typeof value === "string" && backends.includes(value);
-}
-
-//#endregion
-//#region src/reconcile/caddyfile.ts
-/**
-* The kinds the edge serves.
-*
-* Everything that owns a *public address*. Deployed, each of these has a real
-* hostname and a certificate, so this is what makes the local shape the same
-* one rather than a near-enough one — and the application is indifferent
-* either way, because it reads whichever address was injected and never
-* composes one.
-*
-* Adding a kind here is the whole of adding it to the edge.
-*/
-const EDGE_KINDS = {
-	"file-server": true,
-	"rest-api": true,
-	site: true
-};
+//#region src/credentials/index.ts
+const logger = console;
 /**
-* How the edge reaches the host, from inside its container.
-*
-* A surface and a site are served by processes `gkm dev` starts on the host,
-* not by containers — so the edge has to leave Docker's network to reach them.
-* Docker Desktop resolves this name already; on Linux the compose definition
-* maps it to the host gateway.
+* Load environment files
+* @internal Exported for testing
 */
-const HOST_GATEWAY = "host.docker.internal";
+function loadEnvFiles(envConfig, cwd = process.cwd()) {
+	const loaded = [];
+	const missing = [];
+	const envFiles = envConfig ? Array.isArray(envConfig) ? envConfig : [envConfig] : [".env"];
+	for (const envFile of envFiles) {
+		const envPath = resolve(cwd, envFile);
+		if (existsSync(envPath)) {
+			config({
+				path: envPath,
+				override: true,
+				quiet: true
+			});
+			loaded.push(envFile);
+		} else if (envConfig) missing.push(envFile);
+	}
+	return {
+		loaded,
+		missing
+	};
+}
 /**
-* The suffix every local host shares.
-*
-* `.localhost` rather than a made-up TLD because it resolves to loopback
-* without touching `/etc/hosts` — macOS and systemd-resolved both answer for
-* subdomains of it, and Caddy issues internal certificates for it by default.
+* Check if a port is available
+* @internal Exported for testing
 */
-const LOCAL_TLD = "localhost";
+async function isPortAvailable(port) {
+	return new Promise((resolve) => {
+		const server = createServer();
+		server.once("error", (err) => {
+			if (err.code === "EADDRINUSE") resolve(false);
+			else resolve(false);
+		});
+		server.once("listening", () => {
+			server.close();
+			resolve(true);
+		});
+		server.listen(port);
+	});
+}
 /**
-* The sites a plan implies, one per file server.
-*
-* The leading label is the *server's* stage-scoped name rather than the
-* bucket's, which is the difference that matters: two servers over one bucket
-* are a legitimate arrangement — two cache behaviours, one origin — and naming
-* the host after the bucket would make them collide.
+* Find an available port starting from the preferred port
+* @internal Exported for testing
 */
-function sitesFor(plan, project, addresses = {}) {
-	const byId = new Map(plan.resources.map((r) => [r.id, r]));
-	const sites = [];
-	for (const resource of plan.resources) {
-		if (!EDGE_KINDS[resource.kind]) continue;
-		const host = hostFor(resource, project);
-		if (resource.kind === "file-server") {
-			const origin = resource.of ? byId.get(resource.of) : void 0;
-			if (!origin) continue;
-			sites.push({
-				host,
-				upstream: "http://minio:9000",
-				rewrite: `/${origin.name}{uri}`
-			});
-			continue;
-		}
-		const address = addresses[resource.id];
-		if (!address) continue;
-		const port = portOf(address);
-		if (!port) continue;
-		sites.push({
-			host,
-			upstream: `http://${HOST_GATEWAY}:${port}`
-		});
+async function findAvailablePort(preferredPort, maxAttempts = 10) {
+	for (let i = 0; i < maxAttempts; i++) {
+		const port = preferredPort + i;
+		if (await isPortAvailable(port)) return port;
+		logger.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
 	}
-	return sites;
+	throw new Error(`Could not find an available port after trying ${maxAttempts} ports starting from ${preferredPort}`);
 }
-/** The port a local address answers on, defaulting by scheme. */
-function portOf(address) {
+const PORT_STATE_PATH = ".gkm/ports.json";
+/**
+* Load saved port state from .gkm/ports.json.
+* @internal Exported for testing
+*/
+async function loadPortState(workspaceRoot) {
 	try {
-		const { port, protocol } = new URL(address);
-		return port || (protocol === "https:" ? "443" : "80");
+		const raw = await readFile(join(workspaceRoot, PORT_STATE_PATH), "utf-8");
+		return JSON.parse(raw);
 	} catch {
-		return void 0;
+		return {};
 	}
 }
 /**
-* Where one file server answers, including the stage its name carries.
-*
-* The project is a label rather than a decoration: it is what keeps two
-* checkouts from answering on one address. Omitted when there is no project to
-* name, because an empty label makes `uploads..localhost` — a host nothing
-* resolves and no certificate can be issued for.
+* Save port state to .gkm/ports.json.
+* @internal Exported for testing
 */
-function hostFor(resource, project) {
-	return [
-		resource.name,
-		project,
-		LOCAL_TLD
-	].filter(Boolean).join(".");
+async function savePortState(workspaceRoot, ports) {
+	const dir = join(workspaceRoot, ".gkm");
+	await mkdir(dir, { recursive: true });
+	await writeFile(join(workspaceRoot, PORT_STATE_PATH), `${JSON.stringify(ports, null, 2)}\n`);
 }
 /**
-* The static root config, which only ever imports.
-*
-* Written once and identical for every stage, because the *sites* are what
-* differ and they live in their own files. That split is not tidiness: one
-* container serves every stage — the same way one Postgres holds `orders` and
-* `orders_test` — so a single Caddyfile would mean `gkm test` deleting the
-* routes `gkm dev` is serving, and each command silently breaking the other.
+* Load and flatten secrets for an app from encrypted storage.
+* For workspace app: maps {APP}_DATABASE_URL → DATABASE_URL.
+* @internal Exported for testing
 */
-function caddyfileRoot() {
-	return `${GENERATED}
-{
-	# No ACME, no public DNS: the CA is local and so are the names.
-	local_certs
-	auto_https disable_redirects
+async function loadSecretsForApp(store, stage, appName) {
+	let secrets = {};
+	const stageSecrets = await store.read(stage);
+	if (stageSecrets) {
+		logger.log(`🔐 Loading secrets from stage: ${stage}`);
+		secrets = toEmbeddableSecrets(stageSecrets);
+	}
+	if (Object.keys(secrets).length === 0) return {};
+	if (!appName) return secrets;
+	const prefix = appName.toUpperCase();
+	const mapped = { ...secrets };
+	const appDbUrl = secrets[`${prefix}_DATABASE_URL`];
+	if (appDbUrl) mapped.DATABASE_URL = appDbUrl;
+	return mapped;
 }
-
-# One file per stage, so two stages share this edge the way they already share
-# one Postgres and one MinIO.
-import /etc/caddy/sites/*.caddy
-`;
+/**
+* Walk up the directory tree to find the root containing .gkm/secrets/.
+* @internal Exported for testing
+*/
+function findSecretsRoot(startDir) {
+	let dir = startDir;
+	while (dir !== "/") {
+		if (existsSync(join(dir, ".gkm", "secrets"))) return dir;
+		const parent = dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return startDir;
 }
 /**
-* One stage's sites, as the file imported above.
-*
-* `rewrite` rather than a path prefix on the address: the bucket is the
-* origin's business, and the client asks for the key it stored.
-*
-* `header_up Host {upstream_hostport}` matters more than it looks. MinIO routes
-* and signs on the Host header, so forwarding the requested hostname would make
-* it look for a bucket named after the domain.
+* Generate the credentials injection code snippet.
+* This is the common logic used by both entry wrapper and exec preload.
+* @internal
 */
-function toCaddyfile(sites) {
-	if (sites.length === 0) return `${GENERATED}
-# No file server is declared in this stage, so it routes nothing.
-`;
-	const blocks = sites.map(({ host, upstream, rewrite }) => `
-https://${host} {
-	tls internal
+function generateCredentialsInjection(secretsJsonPath) {
+	return `import { existsSync, readFileSync } from 'node:fs';
 
-	reverse_proxy ${upstream} {${rewrite ? `
-		rewrite ${rewrite}
-		# MinIO routes and signs on the Host header, so forwarding the requested
-		# hostname would make it look for a bucket named after the domain.
-		header_up Host {upstream_hostport}` : `
-		# The application reads whatever address was injected, so it has to see
-		# the one a caller used — that is what makes a redirect, a cookie domain
-		# and a generated link point back here rather than at the upstream.
-		header_up Host {host}
-		header_up X-Forwarded-Proto {scheme}`}
-	}
-}`);
-	return `${GENERATED}${blocks.join("\n")}\n`;
+// Inject dev secrets via globalThis and process.env
+// Using globalThis.__gkm_credentials__ avoids CJS/ESM interop issues where
+// Object.assign on the Credentials export only mutates one module copy.
+const secretsPath = '${secretsJsonPath}';
+if (existsSync(secretsPath)) {
+  const secrets = JSON.parse(readFileSync(secretsPath, 'utf-8'));
+  globalThis.__gkm_credentials__ = secrets;
+  Object.assign(process.env, secrets);
 }
-const GENERATED = `# Generated by gkm from the construct manifest — do not edit.
-#
-# One host per declared file server, in front of the object store that holds its
-# objects. This is the shape a file server has deployed — a domain serving a
-# bucket — which MinIO alone cannot produce: its virtual-host mode reads the
-# leading label as the bucket name.
-#
-# Certificates come from Caddy's own CA. "gkm dev" and "gkm test" export its
-# root and point Node at it, so nothing has to be installed to use these URLs
-# from code; a browser needs the root trusted once.
 `;
-
-//#endregion
-//#region src/reconcile/clients.ts
-/** The credential local containers are brought up with. */
-const LOCAL_USER$2 = "geekmidas";
+}
 /**
-* A Postgres client that opens one connection per database it is asked about.
-*
-* `CREATE DATABASE` cannot run from a connection to the database being created,
-* and a schema must be created from inside its own database — so the database is
-* part of each query rather than fixed when the client is built.
+* Create a preload script that injects secrets into Credentials.
+* Used by `gkm exec` to inject secrets before running any command.
+* @internal Exported for testing
 */
-function pgClient(port) {
-	return { async query(database, sql, values) {
-		const client = new Client({
-			host: "localhost",
-			port,
-			user: LOCAL_USER$2,
-			password: LOCAL_USER$2,
-			database: database ?? LOCAL_USER$2
-		});
-		await client.connect();
-		try {
-			const result = await client.query(sql, values);
-			return result.rows;
-		} finally {
-			await client.end();
-		}
-	} };
+async function createCredentialsPreload(preloadPath, secretsJsonPath) {
+	const content = `/**
+ * Credentials preload generated by 'gkm exec'
+ * This file is loaded via NODE_OPTIONS="--import <path>"
+ */
+${generateCredentialsInjection(secretsJsonPath)}`;
+	await writeFile(preloadPath, content);
 }
-/** A bucket client pointed at the local MinIO. */
-function bucketClient(port) {
-	const s3 = new S3Client({
-		region: "us-east-1",
-		endpoint: `http://localhost:${port}`,
-		forcePathStyle: true,
-		credentials: {
-			accessKeyId: LOCAL_USER$2,
-			secretAccessKey: LOCAL_USER$2
-		}
-	});
+/**
+* Create a wrapper script that injects secrets before importing the entry file.
+* @internal Exported for testing
+*/
+async function createEntryWrapper(wrapperPath, entryPath, secretsJsonPath) {
+	const content = `#!/usr/bin/env node
+/**
+ * Entry wrapper generated by 'gkm dev --entry'
+ */
+${secretsJsonPath ? `${generateCredentialsInjection(secretsJsonPath)}
+` : ""}// Import and run the user's entry file (dynamic import ensures secrets load first)
+await import('${entryPath}');
+`;
+	await writeFile(wrapperPath, content);
+}
+/**
+* Prepare credentials for dev/exec/test modes.
+* Loads workspace config, secrets, resolves Docker ports, rewrites URLs,
+* injects PORT, dependency URLs, and writes credentials JSON.
+*
+* @param options.stage - The stage whose secrets to load. Default: the project's `stages.local`.
+* @param options.startDocker - Start Docker Compose services after port resolution. Default: false.
+* @param options.secretsFileName - Custom secrets JSON filename. Default: 'dev-secrets-{appName}.json' or 'dev-secrets.json'.
+* @internal Exported for testing
+*/
+async function prepareEntryCredentials(options) {
+	const cwd = options.cwd ?? process.cwd();
+	let workspaceAppPort;
+	let secretsRoot = cwd;
+	let appName;
+	let appInfo;
+	let workspace;
+	try {
+		appInfo = await loadWorkspaceAppInfo(cwd);
+		workspace = appInfo.workspace;
+		workspaceAppPort = appInfo.app.port;
+		secretsRoot = appInfo.workspaceRoot;
+		appName = appInfo.appName;
+	} catch (error) {
+		if (!(error instanceof NotInAnApp || error instanceof ConfigNotFound)) throw error;
+		workspace = await loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace).catch(() => void 0);
+		secretsRoot = workspace?.root ?? findSecretsRoot(cwd);
+	}
+	if (appName && workspace && options.explicitPort === void 0) {
+		const { assignAppPorts, describeHolder, holderOf, withAppPorts } = await import("./index.mjs").then((n) => n.a);
+		const assigned = await assignAppPorts(workspace, [appName], {
+			free: isPortAvailable,
+			holder: holderOf
+		});
+		for (const { app, from, to, holder } of assigned.moved) logger.log(`↪️  ${app}: ${from} is held by ${describeHolder(holder)}, which is not this workspace's — using ${to}`);
+		workspace = withAppPorts(workspace, assigned.ports);
+		workspaceAppPort = assigned.ports[appName] ?? workspaceAppPort;
+	}
+	if (appName) {
+		const { APP_TAG_ENV, appTag } = await import("./index.mjs").then((n) => n.a);
+		process.env[APP_TAG_ENV] = appTag(secretsRoot, appName);
+	}
+	const resolvedPort = options.explicitPort ?? workspaceAppPort ?? 3e3;
+	const stage = options.stage ?? workspace?.stages.local;
+	const store = stage ? workspace ? await secretsStoreFor(workspace, stage) : new FileSecretsStore(secretsRoot) : void 0;
+	const credentials = store && stage ? await loadSecretsForApp(store, stage, appName) : {};
+	credentials.PORT = String(resolvedPort);
+	if (appInfo?.app.type === "mobile") credentials.RCT_METRO_PORT = String(resolvedPort);
+	const declaredKeys = [];
+	let reconciled;
+	if (workspace) {
+		const { reconcileWorkspace } = await Promise.resolve().then(() => workspace_exports);
+		reconciled = await reconcileWorkspace(workspace, {
+			stage: options.reconcileStage ?? workspace.stages.local,
+			start: options.startDocker ?? false
+		});
+		Object.assign(credentials, reconciled.env);
+		declaredKeys.push(...Object.keys(reconciled.env));
+		if (Object.keys(reconciled.env).length > 0) logger.log(`🔌 Resolved ${Object.keys(reconciled.env).length} declared URL(s)`);
+	}
+	const secretsDir = join(secretsRoot, ".gkm");
+	await mkdir(secretsDir, { recursive: true });
+	const secretsFileName = options.secretsFileName ?? (appName ? `dev-secrets-${appName}.json` : "dev-secrets.json");
+	const secretsJsonPath = join(secretsDir, secretsFileName);
+	await writeFile(secretsJsonPath, JSON.stringify(credentials, null, 2));
 	return {
-		async exists(bucket) {
-			try {
-				await s3.send(new HeadBucketCommand({ Bucket: bucket }));
-				return true;
-			} catch {
-				return false;
-			}
-		},
-		async create(bucket) {
-			await s3.send(new CreateBucketCommand({ Bucket: bucket }));
-		},
-		async policy(bucket) {
-			try {
-				const result = await s3.send(new GetBucketPolicyCommand({ Bucket: bucket }));
-				return result.Policy;
-			} catch {
-				return void 0;
-			}
-		},
-		async setPolicy(bucket, policy) {
-			await s3.send(new PutBucketPolicyCommand({
-				Bucket: bucket,
-				Policy: policy
-			}));
-		}
+		credentials,
+		resolvedPort,
+		secretsJsonPath,
+		appName,
+		secretsRoot,
+		appInfo,
+		declaredKeys,
+		...reconciled ? { reconciled } : {}
 	};
 }
-
 //#endregion
 //#region src/reconcile/containers.ts
 /**
@@ -348,7 +293,7 @@ function postgresImage(version) {
 */
 const DEFAULT_IMAGES = {
 	postgres: postgresImage(DEFAULT_POSTGRES_VERSION),
-	minio: "quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z",
+	minio: "pgsty/minio:RELEASE.2026-08-04T00-00-00Z",
 	mailpit: "axllent/mailpit:latest",
 	redis: "redis:8-alpine",
 	"redis-http": "hiett/serverless-redis-http:latest",
@@ -376,7 +321,8 @@ const PORTS = {
 	}, {
 		key: "minio-console",
 		inside: 9001,
-		label: "minio console"
+		label: "minio console",
+		web: true
 	}],
 	mailpit: [{
 		key: "mailpit",
@@ -385,7 +331,8 @@ const PORTS = {
 	}, {
 		key: "mailpit-web",
 		inside: 8025,
-		label: "mailpit inbox"
+		label: "mailpit inbox",
+		web: true
 	}],
 	redis: [{
 		key: "redis",
@@ -404,7 +351,8 @@ const PORTS = {
 	}, {
 		key: "rabbitmq-management",
 		inside: 15672,
-		label: "rabbitmq console"
+		label: "rabbitmq console",
+		web: true
 	}],
 	localstack: [{
 		key: "localstack",
@@ -417,10 +365,48 @@ const PORTS = {
 		label: "https edge"
 	}]
 };
-/** The ports a container needs published. Empty for one gkm does not know. */
-function portsOf(container) {
+/** The port key — and container name, for an image — of an API's fake. */
+function fakeKey(id) {
+	return `${kebabCase(id)}-fake`;
+}
+/**
+* The ports a container needs published. Empty for one gkm does not know.
+*
+* `fakes` answers for the containers no table can: an external API's fake
+* listens wherever its declaration says.
+*/
+function portsOf(container, fakes = {}) {
+	const fake = fakes[container];
+	if (fake?.port !== void 0) return [{
+		key: container,
+		inside: fake.port,
+		label: `${fake.id} fake`
+	}];
 	return PORTS[container] ?? [];
 }
+/**
+* Every port the containers publish — not only the one an app connects to.
+*
+* The consoles and the inbox are most of why these are real containers, and an
+* inbox nobody can find is an inbox nobody opens: a sign-in link gets fished
+* out of `docker ps` instead.
+*/
+function serviceAddresses(containers, ports, fakes = {}) {
+	return containers.flatMap((container) => portsOf(container, fakes).flatMap((port) => {
+		const assigned = ports[port.key];
+		if (assigned === void 0) return [];
+		return [{
+			container,
+			label: port.label,
+			address: port.web ? `http://localhost:${assigned}` : `localhost:${assigned}`
+		}];
+	}));
+}
+/** The lines `gkm dev` and `gkm setup` print under the services heading. */
+function describeServices(services) {
+	const width = Math.max(0, ...services.map(({ label }) => label.length));
+	return services.map(({ label, address }) => `   ${label.padEnd(width)}  ${address}`);
+}
 /** The key a container's primary port is allocated under. */
 function primaryPortKey(container) {
 	return portsOf(container)[0]?.key ?? container;
@@ -431,8 +417,9 @@ function primaryPortKey(container) {
 * What allocation is handed: it assigns ports to names and knows nothing about
 * what listens on them.
 */
-function portKeys(containers) {
-	return [...containers].sort().flatMap((container) => portsOf(container).map((port) => port.key));
+function portKeys(containers, fakes = {}) {
+	const keys = [...containers].sort().flatMap((container) => portsOf(container, fakes).map((port) => port.key));
+	return [.../* @__PURE__ */ new Set([...keys, ...Object.keys(fakes).sort()])];
 }
 /**
 * The named volume a container's data lives in.
@@ -441,945 +428,1705 @@ function portKeys(containers) {
 * survives days of dev is noise rather than state.
 */
 function volumeOf(container) {
-	const volumes = {
+	return {
 		postgres: "postgres-data",
 		minio: "minio-data",
 		redis: "redis-data",
 		rabbitmq: "rabbitmq-data",
 		localstack: "localstack-data",
 		caddy: "caddy-data"
-	};
-	return volumes[container];
+	}[container];
 }
-
 //#endregion
-//#region src/reconcile/compose.ts
-/** The credential every derived container is brought up with locally. */
-const LOCAL_USER$1 = "geekmidas";
+//#region src/reconcile/caddyfile.ts
 /**
-* The token the local cache accepts.
+* The kinds the edge serves.
 *
-* Fixed rather than generated: it is only ever reachable on a port this project
-* published, and the URL that carries it is derived, so nothing is made safer
-* by making it unguessable and a stable one keeps `redis-cli` sessions working.
+* Everything that owns a *public address*. Deployed, each of these has a real
+* hostname and a certificate, so this is what makes the local shape the same
+* one rather than a near-enough one — and the application is indifferent
+* either way, because it reads whichever address was injected and never
+* composes one.
+*
+* Adding a kind here is the whole of adding it to the edge.
 */
-const LOCAL_TOKEN$1 = "geekmidas";
+const EDGE_KINDS = {
+	"file-server": true,
+	"rest-api": true,
+	site: true
+};
 /**
-* Build the compose document for a plan.
+* How the edge reaches the host, from inside its container.
 *
-* Every container is published on its assigned port, never on the image's
-* default: the point of allocation is that two projects can run at once, and
-* one container publishing 5432 puts that back.
+* A surface and a site are served by processes `gkm dev` starts on the host,
+* not by containers — so the edge has to leave Docker's network to reach them.
+* Docker Desktop resolves this name already; on Linux the compose definition
+* maps it to the host gateway.
 */
-function composeFor(plan, options) {
-	const services = {};
-	const volumes = {};
-	for (const container of [...plan.containers].sort()) {
-		const declared = container === "postgres" ? plan.resources.find((r) => r.version)?.version : void 0;
-		const image = options.images?.[container] ?? (declared ? postgresImage(declared) : DEFAULT_IMAGES[container]);
-		if (!image) throw new UnknownContainer(container);
-		services[container] = define(container, image, publish(container, options.ports));
-		const volume = volumeOf(container);
-		if (volume) volumes[volume] = {};
+const HOST_GATEWAY = "host.docker.internal";
+/**
+* The suffix every local host shares.
+*
+* `.localhost` rather than a made-up TLD because it resolves to loopback
+* without touching `/etc/hosts` — macOS and systemd-resolved both answer for
+* subdomains of it, and Caddy issues internal certificates for it by default.
+*/
+const LOCAL_TLD = "localhost";
+/**
+* The sites a plan implies, one per file server.
+*
+* The leading label is the *server's* stage-scoped name rather than the
+* bucket's, which is the difference that matters: two servers over one bucket
+* are a legitimate arrangement — two cache behaviours, one origin — and naming
+* the host after the bucket would make them collide.
+*/
+function sitesFor(plan, project, addresses = {}) {
+	const byId = new Map(plan.resources.map((r) => [r.id, r]));
+	const sites = [];
+	for (const resource of plan.resources) {
+		if (!EDGE_KINDS[resource.kind]) continue;
+		const host = hostFor(resource, project);
+		if (resource.kind === "file-server") {
+			const origin = resource.of ? byId.get(resource.of) : void 0;
+			if (!origin) continue;
+			sites.push({
+				host,
+				upstream: "http://minio:9000",
+				rewrite: `/${origin.name}{uri}`
+			});
+			continue;
+		}
+		const address = addresses[resource.id];
+		if (!address) continue;
+		const port = portOf(address);
+		if (!port) continue;
+		sites.push({
+			host,
+			upstream: `http://${HOST_GATEWAY}:${port}`
+		});
 	}
-	return {
-		name: options.project,
-		services,
-		...Object.keys(volumes).length ? { volumes } : {}
-	};
-}
-/** Render a compose document as the file it becomes. */
-function toYaml(file) {
-	return `# Generated by gkm from the construct manifest — do not edit.
-# Containers are derived from what the app declares; images and anything no
-# construct implies are yours, in gkm.config.ts.
-#
-# Use "gkm dev" or "gkm test" to start these. Running "docker compose up"
-# directly will not inject secrets.
-${stringify(file, { lineWidth: 0 })}`;
+	return sites;
 }
-/** A container with no image, from config or from the defaults. */
-var UnknownContainer = class extends Error {
-	/** The container that could not be resolved. */
-	container;
-	/** The containers that have a default, so the caller can see the set. */
-	known = Object.keys(DEFAULT_IMAGES).sort();
-	constructor(container) {
-		super("No image is known for this container; pin one in config");
-		this.name = "UnknownContainer";
-		this.container = container;
+/** The port a local address answers on, defaulting by scheme. */
+function portOf(address) {
+	try {
+		const { port, protocol } = new URL(address);
+		return port || (protocol === "https:" ? "443" : "80");
+	} catch {
+		return;
 	}
-};
-/** One container's definition, published on the port it was assigned. */
-function define(container, image, published) {
-	switch (container) {
-		case "postgres": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			environment: {
-				POSTGRES_USER: LOCAL_USER$1,
-				POSTGRES_PASSWORD: LOCAL_USER$1,
-				POSTGRES_DB: LOCAL_USER$1
-			},
-			volumes: ["postgres-data:/var/lib/postgresql"],
-			healthcheck: {
-				test: ["CMD-SHELL", `pg_isready -U ${LOCAL_USER$1}`],
-				interval: "5s",
-				timeout: "3s",
-				retries: 10,
-				start_period: "10s"
-			}
-		};
-		case "minio": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			environment: {
-				MINIO_ROOT_USER: LOCAL_USER$1,
-				MINIO_ROOT_PASSWORD: LOCAL_USER$1
-			},
-			command: "server --console-address \":9001\" /data",
-			volumes: ["minio-data:/data"],
-			healthcheck: {
-				test: [
-					"CMD",
-					"mc",
-					"ready",
-					"local"
-				],
-				interval: "10s",
-				timeout: "5s",
-				retries: 5,
-				start_period: "10s"
-			}
-		};
-		case "caddy": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			volumes: [
-				"./Caddyfile:/etc/caddy/Caddyfile:ro",
-				"./caddy-sites:/etc/caddy/sites:ro",
-				"caddy-data:/data"
-			],
-			extra_hosts: ["host.docker.internal:host-gateway"],
-			healthcheck: {
-				test: [
-					"CMD",
-					"caddy",
-					"version"
-				],
-				interval: "10s",
-				timeout: "5s",
-				retries: 5
-			}
-		};
-		case "mailpit": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			environment: {
-				MP_SMTP_AUTH_ACCEPT_ANY: "1",
-				MP_SMTP_AUTH_ALLOW_INSECURE: "1"
-			},
-			healthcheck: {
-				test: [
-					"CMD",
-					"wget",
-					"-q",
-					"--spider",
-					"http://localhost:8025"
-				],
-				interval: "10s",
-				timeout: "5s",
-				retries: 5
-			}
-		};
-		case "redis": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			volumes: ["redis-data:/data"],
-			healthcheck: {
-				test: [
-					"CMD",
-					"redis-cli",
-					"ping"
-				],
-				interval: "5s",
-				timeout: "3s",
-				retries: 5
-			}
-		};
-		case "redis-http": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			environment: {
-				SRH_MODE: "env",
-				SRH_TOKEN: LOCAL_TOKEN$1,
-				SRH_CONNECTION_STRING: "redis://redis:6379"
-			},
-			depends_on: ["redis"],
-			healthcheck: {
-				test: [
-					"CMD",
-					"wget",
-					"-q",
-					"-O",
-					"/dev/null",
-					"http://127.0.0.1:80/"
-				],
-				interval: "5s",
-				timeout: "3s",
-				retries: 10
-			}
-		};
-		case "rabbitmq": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			environment: {
-				RABBITMQ_DEFAULT_USER: LOCAL_USER$1,
-				RABBITMQ_DEFAULT_PASS: LOCAL_USER$1
-			},
-			volumes: ["rabbitmq-data:/var/lib/rabbitmq"],
-			healthcheck: {
-				test: [
-					"CMD",
-					"rabbitmq-diagnostics",
-					"-q",
-					"ping"
-				],
-				interval: "10s",
-				timeout: "5s",
-				retries: 5
-			}
+}
+/**
+* Where one file server answers, including the stage its name carries.
+*
+* The project is a label rather than a decoration: it is what keeps two
+* checkouts from answering on one address. Omitted when there is no project to
+* name, because an empty label makes `uploads..localhost` — a host nothing
+* resolves and no certificate can be issued for.
+*/
+function hostFor(resource, project) {
+	return [
+		resource.root && project ? stageOf(resource) : resource.name,
+		project,
+		LOCAL_TLD
+	].filter(Boolean).join(".");
+}
+/** The stage a resource's name carries, or nothing for the local stage's. */
+function stageOf(resource) {
+	const base = resource.id.toLowerCase();
+	return resource.name === base ? void 0 : resource.name.slice(base.length + 1);
+}
+/**
+* The static root config, which only ever imports.
+*
+* Written once and identical for every stage, because the *sites* are what
+* differ and they live in their own files. That split is not tidiness: one
+* container serves every stage — the same way one Postgres holds `orders` and
+* `orders_test` — so a single Caddyfile would mean `gkm test` deleting the
+* routes `gkm dev` is serving, and each command silently breaking the other.
+*/
+function caddyfileRoot() {
+	return `${GENERATED}
+{
+	# No ACME, no public DNS: the CA is local and so are the names.
+	local_certs
+	auto_https disable_redirects
+}
+
+# One file per stage, so two stages share this edge the way they already share
+# one Postgres and one MinIO.
+import /etc/caddy/sites/*.caddy
+`;
+}
+/**
+* One stage's sites, as the file imported above.
+*
+* `rewrite` rather than a path prefix on the address: the bucket is the
+* origin's business, and the client asks for the key it stored.
+*
+* `header_up Host {upstream_hostport}` matters more than it looks. MinIO routes
+* and signs on the Host header, so forwarding the requested hostname would make
+* it look for a bucket named after the domain.
+*/
+function toCaddyfile(sites) {
+	if (sites.length === 0) return `${GENERATED}
+# No file server is declared in this stage, so it routes nothing.
+`;
+	const blocks = sites.map(({ host, upstream, rewrite }) => `
+https://${host} {
+	tls internal
+
+	reverse_proxy ${upstream} {${rewrite ? `
+		rewrite ${rewrite}
+		# MinIO routes and signs on the Host header, so forwarding the requested
+		# hostname would make it look for a bucket named after the domain.
+		header_up Host {upstream_hostport}` : `
+		# The application reads whatever address was injected, so it has to see
+		# the one a caller used — that is what makes a redirect, a cookie domain
+		# and a generated link point back here rather than at the upstream.
+		header_up Host {host}
+		header_up X-Forwarded-Proto {scheme}`}
+	}
+}`);
+	return `${GENERATED}${blocks.join("\n")}\n`;
+}
+const GENERATED = `# Generated by gkm from the construct manifest — do not edit.
+#
+# One host per declared file server, in front of the object store that holds its
+# objects. This is the shape a file server has deployed — a domain serving a
+# bucket — which MinIO alone cannot produce: its virtual-host mode reads the
+# leading label as the bucket name.
+#
+# Certificates come from Caddy's own CA. "gkm dev" and "gkm test" export its
+# root and point Node at it, so nothing has to be installed to use these URLs
+# from code; a browser needs the root trusted once.
+`;
+//#endregion
+//#region src/reconcile/emulator.ts
+/**
+* The AWS emulator (floci, LocalStack-compatible) the `sns` backend runs on
+* locally — the facts the compose file, the env writer and the applier must
+* agree on.
+*
+* The emulator has one account and answers with deterministic ARNs and queue
+* URLs, which is what lets a connection string be composed before the topic
+* or queue it names has been created.
+*/
+/** The emulator's single account. */
+const EMULATOR_ACCOUNT = "000000000000";
+const EMULATOR_REGION = "us-east-1";
+/**
+* The emulator's credential. The `LSIA` prefix is what LocalStack required on
+* issued keys; floci does not care, and keeping it means a project that pins
+* the old image still works.
+*/
+const EMULATOR_CREDENTIALS = {
+	accessKeyId: "LSIAQAAAAAAVNCBMPNSG",
+	secretAccessKey: "geekmidas"
+};
+/** The emulator's address from the host, on the port it was published on. */
+function emulatorEndpoint(port) {
+	return `http://localhost:${port}`;
+}
+function emulatorTopicArn(name) {
+	return `arn:aws:sns:${EMULATOR_REGION}:${EMULATOR_ACCOUNT}:${name}`;
+}
+function emulatorQueueUrl(name, port) {
+	return `${emulatorEndpoint(port)}/${EMULATOR_ACCOUNT}/${name}`;
+}
+//#endregion
+//#region src/workspace/rootSite.ts
+/**
+* Which site the base domain points at — deployed and locally alike.
+*
+* Three rules, in order, and the last one is the point:
+*
+* 1. **One site** — it is the root. Unambiguous, so nothing has to be said.
+* 2. **Named `web`** — the convention wins, because people already rely on it.
+* 3. **Declared `root: true`** — the site says so itself.
+*
+* Anything else throws. It used to take the *first* site it iterated, and that
+* order came from the manifest, which is built in glob traversal order — so two
+* sites with neither named `web` meant renaming a file could move the root
+* domain, silently.
+*
+* One rule for both targets: deployed the root site gets the base domain, and
+* locally it gets the project's bare host behind the edge. Before this was
+* shared, the local edge put every site on a subdomain, so what a developer
+* browsed was not the shape production served.
+*
+* @returns the root site's name, or `undefined` when there are no sites
+* @throws {AmbiguousRootSite} when several sites could be the root and none says it is
+*/
+function rootSite(sites) {
+	if (sites.length === 0) return void 0;
+	if (sites.length === 1) return sites[0].name;
+	if (sites.some(({ name }) => name === "web")) return "web";
+	const declared = sites.filter(({ root }) => root === true);
+	if (declared.length === 1) return declared[0].name;
+	throw new AmbiguousRootSite(sites.map(({ name }) => name), declared.length > 1);
+}
+/** Several sites could hold the base domain, and none of them says it does. */
+var AmbiguousRootSite = class extends Error {
+	sites;
+	tooMany;
+	constructor(sites, tooMany = false) {
+		super(tooMany ? `More than one site declares \`root: true\` — ${sites.join(", ")}. The base domain points at one of them.` : `${sites.length} sites and nothing says which holds the base domain: ${sites.join(", ")}. Name one of them \`web\`, or declare \`root: true\` on the one the base domain points at. It used to be whichever the glob reached first, which is not a thing to decide a hostname.`);
+		this.sites = sites;
+		this.tooMany = tooMany;
+		this.name = "AmbiguousRootSite";
+	}
+};
+//#endregion
+//#region src/reconcile/plan.ts
+/**
+* The reconcile plan — what a manifest wants to exist, for one stage.
+*
+* Pure. Turning the plan into running containers and provisioned resources is
+* the applier's job; deciding *what* should exist is this, so the decisions can
+* be asserted as data rather than by starting Docker.
+*
+* One plan serves every stage. `gkm dev` reconciles `development` and `gkm test`
+* reconciles `test`; they differ only in what the resources are called, never in
+* what infrastructure exists. Roles are cluster-scoped in Postgres while grants
+* are per-object, so one container and one role pair serve both.
+*/
+/**
+* Which container serves a kind.
+*
+* Derived kinds map to the same container as their parent — a schema tenant
+* lives in its parent's Postgres — so the set is deduplicated rather than
+* counted.
+*/
+const CONTAINERS = {
+	database: "postgres",
+	"database-reader": "postgres",
+	"database-schema": "postgres",
+	objects: "minio",
+	"file-server": "caddy",
+	email: "mailpit"
+};
+/**
+* The container a cache backend needs locally.
+*
+* Each one matches the protocol its deployed form speaks, which is the property
+* worth having: a cache that behaves differently in the two places is worse than
+* a slower one.
+*
+* `db` is deliberately absent, the same way `pgboss` is absent from
+* `EVENT_CONTAINERS`: the cache is a table in a database the manifest already
+* declares, so mapping it here would start a container for a project that needs
+* none.
+*/
+const CACHE_CONTAINERS = {
+	upstash: "redis-http",
+	elasticache: "redis"
+};
+/**
+* Kinds that resolve a value without anything running.
+*
+* A secret is the case: it has no address, so there is nothing to start and
+* nothing to connect to — but it still appears in the plan, because the target
+* still has to resolve it.
+*/
+const CONTAINERLESS = {
+	secret: true,
+	credential: true,
+	encryption: true,
+	"rest-api": true,
+	site: true,
+	"mobile-app": true,
+	"external-api": true
+};
+/**
+* Containers that cannot run alone.
+*
+* The one case is the cache: `serverless-redis-http` is a proxy and needs the
+* Redis it proxies. Kept here rather than in the compose definition so the plan
+* -- which is what decides what must be running -- still names everything.
+*/
+const REQUIRES = { "redis-http": ["redis"] };
+/**
+* The role each kind's one key plays, where it is not a URL.
+*
+* The twin of `ProvidesByKind` in `@geekmidas/manifest`: that is what a
+* construct declares, this is what the local target resolves, and both derive
+* the key from the same `provideKey` so they cannot disagree.
+*/
+const ROLES = {
+	queue: "publisherConnectionString",
+	topic: "publisherConnectionString",
+	credential: "credentials",
+	"mobile-app": "scheme"
+};
+/** The kinds whose container is the events backend's rather than their own. */
+const EVENT_KINDS = {
+	queue: true,
+	topic: true
+};
+/**
+* Which kinds provision something *inside* their container.
+*
+* A database creates a database, a bucket creates a bucket; mail creates
+* nothing — Mailpit accepts whatever is sent to it and has no per-stage object
+* to name. Both still appear in the plan, because both still resolve a URL; the
+* flag is the difference between "must be running" and "must be created".
+*/
+const PROVISIONS = {
+	database: true,
+	"database-reader": true,
+	"database-schema": true,
+	objects: true,
+	cache: true,
+	"file-server": true
+};
+/**
+* The container each events backend needs, where it needs one of its own.
+*
+* `pgboss` is deliberately absent rather than mapped to `postgres`: it is a
+* schema tenant in a database the manifest already declares, so mapping it here
+* would start a Postgres for a project that declared no database at all.
+*
+* This one comes from config rather than from a declaration because there are
+* no `topic` or `queue` kinds yet. When they land the mapping moves to
+* {@link CONTAINERS} keyed by kind, and this constant goes with them.
+*/
+const EVENT_CONTAINERS = {
+	sns: "localstack",
+	rabbitmq: "rabbitmq"
+};
+/** The backend a project gets when it declares queues or topics and says nothing. */
+const DEFAULT_EVENTS = "pgboss";
+/**
+* How a resource of each kind separates its stage suffix.
+*
+* Postgres identifiers are snake_case and a hyphen would need quoting
+* everywhere; buckets and queues are kebab and disallow underscores in some
+* providers. The suffix is the same word either way.
+*/
+const SEPARATORS = {
+	database: "_",
+	"database-reader": "_",
+	"database-schema": "_",
+	objects: "-"
+};
+/**
+* The stage-scoped name for a resource.
+*
+* The local stage carries no suffix, so `gkm dev` keeps using `orders` and a
+* developer's psql history, saved connections, and muscle memory survive a
+* change of stage name. Every other stage is suffixed.
+*/
+function resourceName(id, kind, stage, localStage) {
+	const base = id.toLowerCase();
+	if (stage === localStage) return base;
+	return `${base}${SEPARATORS[kind] ?? "-"}${stage}`;
+}
+/**
+* The container a kind needs, or `undefined` if it needs none.
+*
+* Queues and topics have no container of their own — they live in whichever
+* broker the project selected, which is why the backend is an argument here
+* rather than a second pass that adds containers after the fact.
+*/
+function containerFor(kind, events = DEFAULT_EVENTS, cache = DEFAULT_CACHE.aws, derived = false, edge = true) {
+	if (EVENT_KINDS[kind]) return EVENT_CONTAINERS[events] ?? CONTAINERS.database;
+	if (kind === "file-server") return edge ? "caddy" : CONTAINERS.objects;
+	if (kind === "cache") {
+		if (derived) return CONTAINERS.database;
+		return CACHE_CONTAINERS[cache] ?? CONTAINERS.database;
+	}
+	return CONTAINERS[kind];
+}
+/**
+* Build the plan for a manifest and stage.
+*
+* `order` is the caller's provisioning order — parents before children — which
+* `provisionOrder` produces from the manifest. Passing it in keeps this
+* function free of the traversal and makes the ordering assertable on its own.
+*/
+function planFor(manifest, stage, order, options = {}) {
+	const containers = /* @__PURE__ */ new Set();
+	const resources = [];
+	const fakes = {};
+	const events = options.events ?? "pgboss";
+	const cache = options.cache ?? DEFAULT_CACHE.aws;
+	for (const id of order) {
+		const declaration = manifest[id];
+		if (!declaration) continue;
+		const local = declaration.kind === "external-api" ? options.fakes?.[id] : void 0;
+		const fake = local && {
+			key: fakeKey(id),
+			...local
 		};
-		case "localstack": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			environment: {
-				AWS_DEFAULT_REGION: "us-east-1",
-				AWS_ACCESS_KEY_ID: "LSIAQAAAAAAVNCBMPNSG",
-				AWS_SECRET_ACCESS_KEY: LOCAL_USER$1
-			},
-			volumes: ["localstack-data:/var/lib/localstack"],
-			healthcheck: {
-				test: [
-					"CMD",
-					"curl",
-					"-f",
-					"http://localhost:4566/_localstack/health"
-				],
-				interval: "10s",
-				timeout: "5s",
-				retries: 5,
-				start_period: "10s"
-			}
+		if (fake) fakes[fake.key] = {
+			id,
+			...fake.image ? {
+				image: fake.image,
+				port: fake.port
+			} : {}
 		};
-		default: throw new UnknownContainer(container);
+		const container = fake?.image ? fake.key : containerFor(declaration.kind, events, cache, "of" in declaration && typeof declaration.of === "string", options.edge !== false);
+		if (!container && !CONTAINERLESS[declaration.kind]) continue;
+		if (container) {
+			containers.add(container);
+			for (const required of REQUIRES[container] ?? []) containers.add(required);
+		}
+		resources.push({
+			id,
+			kind: declaration.kind,
+			...container ? { container } : {},
+			name: resourceName(id, declaration.kind, stage, options.localStage),
+			envKey: providedKeyFor(id, declaration.kind, ROLES[declaration.kind] ?? "url"),
+			provisions: PROVISIONS[declaration.kind] === true,
+			...declaration.kind === "rest-api" ? { callers: dependentsOf(manifest, id) } : {},
+			...declaration.kind === "site" ? { publicEnv: publicEnvFor(declaration, manifest) } : {},
+			...declaration.kind === "mobile-app" ? {
+				publicEnv: publicEnvFor(declaration, manifest),
+				...declaration.scheme ? { scheme: declaration.scheme } : {}
+			} : {},
+			...declaration.kind === "file-server" && declaration.open?.length ? { open: declaration.open } : {},
+			...fake ? { fake: {
+				key: fake.key,
+				credentials: fake.credentials
+			} } : {},
+			...declaration.kind === "external-api" && !fake ? { url: declaration.url } : {},
+			..."of" in declaration ? { of: declaration.of } : {},
+			..."schema" in declaration && declaration.schema ? { schema: declaration.schema } : {},
+			..."version" in declaration && declaration.version ? { version: declaration.version } : {},
+			..."roles" in declaration && declaration.roles === false ? { roles: false } : {},
+			..."table" in declaration && declaration.table ? { table: declaration.table } : {}
+		});
+	}
+	if (options.edge !== false && resources.some((r) => EDGE_KINDS[r.kind] === true)) containers.add("caddy");
+	for (const extra of options.extraContainers ?? []) containers.add(extra);
+	if (events === "pgboss" && resources.some((r) => EVENT_KINDS[r.kind]) && !resources.some((r) => r.kind === "database")) throw new PgBossNeedsDatabase(resources.filter((r) => EVENT_KINDS[r.kind]).map((r) => r.id));
+	if (cache === "db") {
+		const placeless = resources.filter((r) => r.kind === "cache" && !r.of);
+		if (placeless.length > 0) {
+			const databases = resources.filter((r) => r.kind === "database");
+			const [only] = databases;
+			if (!only) throw new CacheNeedsDatabase(resources.filter((r) => r.kind === "cache").map((r) => r.id));
+			if (databases.length > 1) throw new CacheIsAmbiguous(placeless.map((r) => r.id), databases.map((r) => r.id));
+			for (const resource of placeless) resource.of = only.id;
+		}
 	}
+	const sites = resources.filter((r) => r.kind === "site");
+	const root = rootSite(sites.map((r) => {
+		const declared = manifest[r.id];
+		return {
+			name: appKey(r.id),
+			...declared?.kind === "site" && declared.root ? { root: true } : {}
+		};
+	}));
+	for (const site of sites) if (appKey(site.id) === root) site.root = true;
+	const workerBroker = events === "pgboss" && Object.values(manifest).some((d) => d?.kind === "worker") && resources.some((r) => r.kind === "database");
+	return {
+		stage,
+		events,
+		cache,
+		containers: [...containers],
+		resources,
+		...Object.keys(fakes).length ? { fakes } : {},
+		...workerBroker ? { workerBroker: true } : {}
+	};
 }
 /**
-* The published port mappings for a container.
+* Queues or topics were declared with pg-boss and no database to hold them.
 *
-* Every port is looked up by its own key rather than being derived as an offset
-* from the container's first, so MinIO's console cannot land on whatever was
-* allocated to the next container.
+* Not a reconcile failure but a manifest one: the fix is a line of application
+* code either way — declare a database, or select a backend that brings its own
+* broker.
 */
-function publish(container, ports) {
-	return portsOf(container).map((port) => {
-		const assigned = ports[port.key];
-		if (assigned === void 0) throw new UnassignedPort(port.key);
-		return `${assigned}:${port.inside}`;
-	});
-}
-/** A planned port that allocation never assigned. */
-var UnassignedPort = class extends Error {
-	/** The port key that went unassigned, e.g. `minio-console`. */
-	key;
-	constructor(key) {
-		super("No port was assigned for this container port");
-		this.name = "UnassignedPort";
-		this.key = key;
+var CacheNeedsDatabase = class extends Error {
+	ids;
+	constructor(ids) {
+		super(`A cache backed by the database needs a declared database, and none was declared, and on this deploy target that is where a cache lives. Declare one. Caches affected: ${ids.join(", ")}.`);
+		this.ids = ids;
+		this.name = "CacheNeedsDatabase";
 	}
 };
-
-//#endregion
-//#region src/reconcile/docker.ts
-const run = promisify(execFile);
-/** How long to wait for containers to pass their health checks. */
-const HEALTH_TIMEOUT_MS = 12e4;
-const dockerCli = {
-	async publishedPort(composePath, service, inside) {
-		try {
-			const { stdout } = await run("docker", [
-				"compose",
-				"-f",
-				composePath,
-				"port",
-				service,
-				String(inside)
-			]);
-			const port = Number(stdout.trim().split(":").pop());
-			return Number.isFinite(port) && port > 0 ? port : void 0;
-		} catch {
-			return void 0;
-		}
-	},
-	async up(composePath, services) {
-		await run("docker", [
-			"compose",
-			"-f",
-			composePath,
-			"up",
-			"-d",
-			"--remove-orphans",
-			"--wait",
-			`--wait-timeout=${Math.floor(HEALTH_TIMEOUT_MS / 1e3)}`,
-			...services
-		]);
-	},
-	async copyOut(composePath, service, from, to) {
-		await mkdir(dirname(to), { recursive: true });
-		await run("docker", [
-			"compose",
-			"-f",
-			composePath,
-			"cp",
-			`${service}:${from}`,
-			to
-		]);
-	},
-	async reload(composePath, service) {
-		await run("docker", [
-			"compose",
-			"-f",
-			composePath,
-			"exec",
-			"-T",
-			service,
-			"caddy",
-			"reload",
-			"--config",
-			"/etc/caddy/Caddyfile"
-		]);
-	},
-	async healthy(composePath, services) {
-		if (services.length === 0) return true;
-		try {
-			const { stdout } = await run("docker", [
-				"compose",
-				"-f",
-				composePath,
-				"ps",
-				"--format",
-				"json",
-				...services
-			]);
-			const running = /* @__PURE__ */ new Set();
-			for (const line of stdout.trim().split("\n").filter(Boolean)) {
-				const entry = JSON.parse(line);
-				const ok = entry.State === "running" && (entry.Health === void 0 || entry.Health === "" || entry.Health === "healthy");
-				if (ok && entry.Service) running.add(entry.Service);
-			}
-			return services.every((service) => running.has(service));
-		} catch {
-			return false;
-		}
+/**
+* A `'db'` cache — a server target's default — in an app that declares more
+* than one database.
+*
+* The target says *a* database and the graph offers several, so there is no
+* answer to give — and the wrong kind of failure would be to pick one, since a
+* cache silently landing in the wrong database is a bug that surfaces as
+* missing rows much later. The fix is a stronger statement in application code:
+* `orders.cache('Sessions')` names the database, which is a fact about the
+* application rather than a deployment choice.
+*/
+var CacheIsAmbiguous = class extends Error {
+	ids;
+	databases;
+	constructor(ids, databases) {
+		super(`A cache backed by the database needs to know which one, and this app declares ${databases.length}: ${databases.join(", ")}. Declare the cache from its database — e.g. ${databases[0]}.cache('Sessions') — rather than as a bare new Cache(). Caches affected: ${ids.join(", ")}.`);
+		this.ids = ids;
+		this.databases = databases;
+		this.name = "CacheIsAmbiguous";
+	}
+};
+var PgBossNeedsDatabase = class extends Error {
+	ids;
+	constructor(ids) {
+		super(`pg-boss keeps its queues in a declared database, and none was declared. Declare one: on this deploy target, events are carried by pg-boss. Queues and topics affected: ${ids.join(", ")}.`);
+		this.ids = ids;
+		this.name = "PgBossNeedsDatabase";
 	}
 };
-
 //#endregion
-//#region src/reconcile/plan.ts
-/** The stage whose resources carry no suffix. */
-const DEFAULT_STAGE = "development";
+//#region src/reconcile/env.ts
 /**
-* Which container serves a kind.
+* The URLs a reconciled stage injects.
 *
-* Derived kinds map to the same container as their parent — a schema tenant
-* lives in its parent's Postgres — so the set is deduplicated rather than
-* counted.
+* One `<NAME>_URL` per construct, and the protocol picks the driver. This is the
+* seam between the target that writes a URL and the client that parses it, so
+* every component of it is read off the resource — never inherited from ambient
+* environment. A bucket can live in a different region than the function reading
+* it, and `AWS_REGION` in a Lambda is the *function's* region, so a URL that
+* omits `?region=` breaks cross-region silently at runtime.
+*
+* Locally that self-containment is what lets the port be whatever was free: the
+* app reads `ORDERS_URL` and never sees a host or a port.
 */
-const CONTAINERS = {
-	database: "postgres",
-	"database-reader": "postgres",
-	"database-schema": "postgres",
-	objects: "minio",
-	"file-server": "caddy",
-	email: "mailpit"
-};
 /**
-* The container a cache backend needs locally.
+* The credential local containers are brought up with.
 *
-* Each one matches the protocol its deployed form speaks, which is the property
-* worth having: a cache that behaves differently in the two places is worse than
-* a slower one.
+* The design's `roles: false` case — both URLs fall back to the cluster's master
+* credential. A deliberate downgrade, not a default: it holds until the role DDL
+* lands in `@geekmidas/db`, at which point the runtime role's URL replaces this
+* and the owner URL stops being reachable from any manifest edge.
+*/
+const LOCAL_USER$2 = "geekmidas";
+/** The host containers are published on. */
+const LOCAL_HOST = "localhost";
+/** The region local buckets claim, so the client has one to sign with. */
+const LOCAL_REGION = "us-east-1";
+/**
+* The credentials the S3 client resolves for MinIO.
 *
-* `db` is deliberately absent, the same way `pgboss` is absent from
-* `EVENT_CONTAINERS`: the cache is a table in a database the manifest already
-* declares, so mapping it here would start a container for a project that needs
-* none.
+* An `s3://` URL deliberately carries none: deployed, the SDK reads them from
+* the execution role, so a URL that embedded a key would be one more thing to
+* rotate and one more thing to leak into a log. Locally there is no role, and
+* the same chain reads these — which is why they are injected beside the URL
+* rather than written into it.
 */
-const CACHE_CONTAINERS = {
-	upstash: "redis-http",
-	elasticache: "redis"
+const STORAGE_CREDENTIALS = {
+	AWS_ACCESS_KEY_ID: LOCAL_USER$2,
+	AWS_SECRET_ACCESS_KEY: LOCAL_USER$2,
+	AWS_REGION: LOCAL_REGION
 };
+/** The token the local cache proxy accepts. Matches the compose definition. */
+const LOCAL_TOKEN$1 = "geekmidas";
+/** The port Mailpit's inbox — its web UI and HTTP API — is published under. */
+const MAILPIT_INBOX_PORT = "mailpit-web";
+/** The schema pg-boss keeps its tables in, inside the declared database. */
+const PGBOSS_SCHEMA = "pgboss";
+/** The exchange every local topic and queue shares on RabbitMQ. */
+const RABBITMQ_EXCHANGE = "geekmidas.events";
 /**
-* Kinds that resolve a value without anything running.
+* Every env key a reconciled plan resolves, and its value.
+*
+* Keys come from the declaration rather than being re-derived, so what the build
+* publishes and what the app reads cannot drift.
+*/
+function envFor(plan, options) {
+	const env = {};
+	const resolved = {};
+	for (const resource of plan.resources) {
+		const url = urlFor(resource, plan, options.ports, options.project ?? "", options.addresses);
+		if (url) resolved[resource.id] = url;
+	}
+	for (const resource of plan.resources) {
+		const url = resolved[resource.id];
+		if (resource.kind === "rest-api") Object.assign(env, surfaceEnv(resource, url, resolved, {
+			plan,
+			...options.addresses ? { addresses: options.addresses } : {},
+			...options.lanAddress ? { lanAddress: options.lanAddress } : {},
+			...options.metroPorts ? { metroPorts: options.metroPorts } : {}
+		}));
+		if (url) env[resource.envKey] = url;
+		if (isDatabase(resource.kind) && resource.roles !== false) {
+			const owner = ownerUrl(resource, plan, options.ports, options.project ?? "");
+			if (owner) env[provideKey(resource.id, "ownerUrl")] = owner;
+		}
+		if (resource.kind === "external-api" && url && resource.fake) env[provideKey(resource.id, "credentials")] = resource.fake.credentials;
+		if (resource.kind === "email" && url) {
+			env[provideKey(resource.id, "from")] = options.mailFrom ?? `noreply@${LOCAL_HOST}`;
+			const inbox = options.ports[MAILPIT_INBOX_PORT];
+			if (inbox !== void 0) env[provideKey(resource.id, "inboxUrl")] = `http://${LOCAL_HOST}:${inbox}`;
+		}
+	}
+	Object.assign(env, publicEnv(plan, env, options.addresses));
+	Object.assign(env, brokerEnv(plan, options.ports));
+	if (plan.resources.some((r) => r.kind === "objects" && env[r.envKey])) Object.assign(env, STORAGE_CREDENTIALS);
+	return env;
+}
+/**
+* The values a site's bundler inlines, under the names it inlines them by.
+*
+* A rename and nothing more. `API_URL` was resolved once, by the same code that
+* resolved it for the server; a site reads the same value under `VITE_API_URL`
+* because that prefix is how its bundler is told to ship it. Nothing is derived
+* twice, so a site and its API cannot come to disagree about where the API is.
+*
+* A source that resolved to nothing is skipped rather than written empty: an
+* inlined empty string is a frontend that builds and then fails at runtime
+* against `http:///`, where a missing variable fails at build with the name of
+* the thing that is missing.
+*/
+function publicEnv(plan, resolved, addresses = {}) {
+	const env = {};
+	const owners = new Map(plan.resources.map((r) => [r.envKey, r.id]));
+	for (const resource of plan.resources) for (const [key, source] of Object.entries(resource.publicEnv ?? {})) {
+		const value = (resource.kind === "mobile-app" ? addresses[owners.get(source) ?? ""] : void 0) ?? resolved[source];
+		if (value) env[key] = value;
+	}
+	return env;
+}
+/**
+* What a surface publishes beyond its own address: who may call it, and where
+* a cookie set by it is readable.
 *
-* A secret is the case: it has no address, so there is nothing to start and
-* nothing to connect to — but it still appears in the plan, because the target
-* still has to resolve it.
+* Both are read off the same list — the constructs that declared an edge to
+* this surface — which is why neither appears in application code. A surface
+* that listed its own callers would be edited every time something new called
+* it, and the thing being edited is already recorded in the graph.
+*
+* An empty origin list is written, and a surface with no address writes nothing
+* at all. The two cases look alike and are not: "nothing depends on this yet" is
+* a real state a target should publish, while "this surface has no address here"
+* means it is not running in this stage, and keys belong with the address they
+* describe.
 */
-const CONTAINERLESS = {
-	secret: true,
-	credential: true,
-	"rest-api": true,
-	site: true
-};
+function surfaceEnv(resource, url, resolved = {}, local = {}) {
+	if (!url) return {};
+	const origins = [...new Set((resource.callers ?? []).map((caller) => resolved[caller]).filter((address) => Boolean(address)).map(originOf).filter((origin) => Boolean(origin)))].sort();
+	const domain = cookieDomain([url, ...origins]);
+	const mobile = (resource.callers ?? []).map((caller) => local.plan?.resources.find((r) => r.id === caller && r.kind === "mobile-app")).filter((caller) => Boolean(caller));
+	const hosts = [...local.lanAddress ? [local.lanAddress] : [], LOCAL_HOST];
+	const schemes = mobile.flatMap((caller) => {
+		const scheme = resolved[caller.id];
+		const port = local.metroPorts?.[caller.id];
+		return scheme ? mobileOrigins(scheme, {
+			hosts,
+			...port ? { port } : {}
+		}) : [];
+	});
+	const own = local.addresses?.[resource.id];
+	const device = mobile.length > 0 && local.lanAddress && own ? own.replace(/\/\/(localhost|127\.0\.0\.1)(?=[:/]|$)/, `//${local.lanAddress}`) : void 0;
+	return {
+		[provideKey(resource.id, "trustedOrigins")]: [...origins, ...new Set(schemes)].join(","),
+		...domain ? { [provideKey(resource.id, "cookieDomain")]: domain } : {},
+		...device ? { [provideKey(resource.id, "deviceUrl")]: device } : {}
+	};
+}
+/** An address reduced to the origin a browser compares against. */
+function originOf(address) {
+	try {
+		return new URL(address).origin;
+	} catch {
+		return;
+	}
+}
 /**
-* Containers that cannot run alone.
+* The runtime role of whatever a derived node hangs off.
 *
-* The one case is the cache: `serverless-redis-http` is a proxy and needs the
-* Redis it proxies. Kept here rather than in the compose definition so the plan
-* -- which is what decides what must be running -- still names everything.
+* A reader's parent may itself be a schema tenant, so this follows `of` by one
+* hop rather than assuming the cluster — the reader of a tenant reads that
+* tenant's schema, not the database's.
 */
-const REQUIRES = { "redis-http": ["redis"] };
+function parentRole(resource, plan) {
+	const parent = plan.resources.find((r) => r.id === resource.of);
+	return parent ? localRole(parent) : resource.name;
+}
+/** Whether a kind connects to Postgres and therefore has an owner role. */
+function isDatabase(kind) {
+	return kind === "database" || kind === "database-schema";
+}
 /**
-* The role each kind's one key plays, where it is not a URL.
+* The URL a migrator connects with — the owner role, which can create, alter
+* and drop.
 *
-* The twin of `ProvidesByKind` in `@geekmidas/manifest`: that is what a
-* construct declares, this is what the local target resolves, and both derive
-* the key from the same `provideKey` so they cannot disagree.
+* Never in `provides`, which is the whole point. A handler that could reach this
+* could `DROP TABLE`, and the security property the role split exists for is
+* that it cannot: the value is injected by `gkm exec` for the migrate step and
+* by nothing else.
 */
-const ROLES = {
-	queue: "publisherConnectionString",
-	topic: "publisherConnectionString",
-	credential: "credential"
-};
-/** The kinds whose container is the events backend's rather than their own. */
-const EVENT_KINDS = {
-	queue: true,
-	topic: true
-};
+function ownerUrl(resource, plan, ports, project) {
+	if (!resource.container) return void 0;
+	const port = ports[primaryPortKey(resource.container)];
+	if (port === void 0) return void 0;
+	const owner = ownerRole(localRole(resource));
+	return postgres(port, rootDatabase(resource, plan), {
+		user: owner,
+		password: localRolePassword(project, plan, owner)
+	});
+}
 /**
-* Which kinds provision something *inside* their container.
+* The shared broker keys, when anything is published or consumed.
 *
-* A database creates a database, a bucket creates a bucket; mail creates
-* nothing — Mailpit accepts whatever is sent to it and has no per-stage object
-* to name. Both still appear in the plan, because both still resolve a URL; the
-* flag is the difference between "must be running" and "must be created".
+* A queue's own key is the producer's. These two are the *connection* itself,
+* which locally is one broker for every queue and topic in the project: the
+* generated pollers open a single connection and subscribe each worker by name
+* on it. Deployed there is no such thing — a Lambda is handed its own event
+* source — so this pair exists for the local target and says so.
 */
-const PROVISIONS = {
-	database: true,
-	"database-reader": true,
-	"database-schema": true,
-	objects: true,
-	cache: true,
-	"file-server": true
-};
+function brokerEnv(plan, ports) {
+	const carrier = plan.resources.find((r) => r.kind === "queue" || r.kind === "topic");
+	const publisher = carrier ? urlFor(carrier, plan, ports, "") : plan.workerBroker ? workerBroker(plan, ports) : void 0;
+	if (!publisher) return {};
+	if (plan.events === "sns") return {};
+	return { EVENT_PUBLISHER_CONNECTION_STRING: publisher };
+}
 /**
-* The container each events backend needs, where it needs one of its own.
-*
-* `pgboss` is deliberately absent rather than mapped to `postgres`: it is a
-* schema tenant in a database the manifest already declares, so mapping it here
-* would start a Postgres for a project that declared no database at all.
-*
-* This one comes from config rather than from a declaration because there are
-* no `topic` or `queue` kinds yet. When they land the mapping moves to
-* {@link CONTAINERS} keyed by kind, and this constant goes with them.
+* The broker a worker schedules its crons through, when nothing else declared
+* one — pg-boss in the declared database, on that database's port.
 */
-const EVENT_CONTAINERS = {
-	sns: "localstack",
-	rabbitmq: "rabbitmq"
-};
-/** The backend a project gets when it declares queues or topics and says nothing. */
-const DEFAULT_EVENTS = "pgboss";
+function workerBroker(plan, ports) {
+	const database = plan.resources.find((r) => r.kind === "database");
+	if (!database?.container) return void 0;
+	const port = ports[primaryPortKey(database.container)];
+	return port === void 0 ? void 0 : broker(plan, port);
+}
 /**
-* How a resource of each kind separates its stage suffix.
+* The URL for one planned resource.
 *
-* Postgres identifiers are snake_case and a hyphen would need quoting
-* everywhere; buckets and queues are kebab and disallow underscores in some
-* providers. The suffix is the same word either way.
+* Every part of it comes from the resource and the port it was published on.
 */
-const SEPARATORS = {
-	database: "_",
-	"database-reader": "_",
-	"database-schema": "_",
-	objects: "-"
-};
+function urlFor(resource, plan, ports, project, addresses = {}) {
+	if (resource.kind === "secret") return localSecret(project, plan, resource);
+	if (resource.kind === "encryption") return localKeyring(project, plan, resource);
+	if (resource.kind === "mobile-app") return schemeBase(project, resource.scheme);
+	if (resource.kind === "credential") return void 0;
+	if (resource.kind === "external-api") {
+		if (!resource.fake) return resource.url === void 0 ? void 0 : externalApiUrl({
+			id: resource.id,
+			url: resource.url
+		}, plan.stage);
+		const port = ports[resource.fake.key];
+		return port === void 0 ? void 0 : `http://${LOCAL_HOST}:${port}`;
+	}
+	if (resource.kind === "rest-api" || resource.kind === "site") {
+		const address = addresses[resource.id];
+		const edge = plan.containers.includes("caddy") ? ports[primaryPortKey("caddy")] : void 0;
+		return address && edge !== void 0 ? `https://${hostFor(resource, project)}:${edge}` : address;
+	}
+	if (!resource.container) return void 0;
+	const port = ports[primaryPortKey(resource.container)];
+	if (port === void 0) return void 0;
+	switch (resource.kind) {
+		case "database":
+		case "database-schema":
+		case "database-reader": {
+			const database = rootDatabase(resource, plan);
+			if (resource.roles === false) {
+				const schema = schemaOf(resource, plan);
+				return schema ? `${postgres(port, database)}?search_path=${schema}` : postgres(port, database);
+			}
+			const role = resource.kind === "database-reader" ? readerRole(parentRole(resource, plan)) : localRole(resource);
+			return postgres(port, database, {
+				user: role,
+				password: localRolePassword(project, plan, role)
+			});
+		}
+		case "email": return `smtp://${LOCAL_HOST}:${port}`;
+		case "objects": return `s3://${resource.name}?region=${LOCAL_REGION}&endpoint=http://${LOCAL_HOST}:${port}&forcePathStyle=true`;
+		case "file-server": {
+			const origin = plan.resources.find((r) => r.id === resource.of);
+			if (!origin) return void 0;
+			return plan.containers.includes("caddy") ? `https://${hostFor(resource, project)}:${port}` : `http://${LOCAL_HOST}:${port}/${origin.name}`;
+		}
+		case "cache":
+			if (resource.of) {
+				const parent = plan.resources.find((r) => r.id === resource.of);
+				const url = parent ? urlFor(parent, plan, ports, project, addresses) : void 0;
+				return url ? withTable(url, resource.table ?? cacheTable(resource.id)) : void 0;
+			}
+			switch (plan.cache) {
+				case "elasticache": return `redis://${LOCAL_HOST}:${port}`;
+				default: return `http://:${LOCAL_TOKEN$1}@${LOCAL_HOST}:${port}`;
+			}
+		case "queue":
+		case "topic": return broker(plan, port, resource);
+		default: return;
+	}
+}
 /**
-* The stage-scoped name for a resource.
+* The producer's connection string, composed from the backend the plan chose.
 *
-* The default stage carries no suffix, so `gkm dev` keeps using `orders` and a
-* developer's psql history, saved connections, and muscle memory survive this
-* change. Every other stage is suffixed.
+* The protocol is what picks the transport, so a producer never branches: the
+* same `.publish()` reaches pg-boss here and SQS deployed because the string it
+* was handed said so.
 */
-function resourceName(id, kind, stage) {
-	const base = id.toLowerCase();
-	if (stage === DEFAULT_STAGE) return base;
-	return `${base}${SEPARATORS[kind] ?? "-"}${stage}`;
+function broker(plan, port, resource) {
+	switch (plan.events) {
+		case "pgboss": {
+			const database = plan.resources.find((r) => r.kind === "database");
+			if (!database) throw new PgBossNeedsDatabase([]);
+			return `pgboss://${LOCAL_USER$2}:${LOCAL_USER$2}@${LOCAL_HOST}:${port}/${database.name}?schema=${PGBOSS_SCHEMA}`;
+		}
+		case "rabbitmq": return `rabbitmq://${LOCAL_USER$2}:${LOCAL_USER$2}@${LOCAL_HOST}:${port}?exchange=${RABBITMQ_EXCHANGE}`;
+		case "sns": {
+			if (!resource) throw new UnprovisionedEventsBackend("sns");
+			const endpoint = emulatorEndpoint(port);
+			const address = resource.kind === "topic" ? snsUrl.build({
+				topicArn: emulatorTopicArn(resource.name),
+				region: EMULATOR_REGION,
+				endpoint
+			}) : sqsUrl.build({
+				queueUrl: emulatorQueueUrl(resource.name, port),
+				region: EMULATOR_REGION,
+				endpoint
+			});
+			const url = new URL(address);
+			url.searchParams.set("accessKeyId", EMULATOR_CREDENTIALS.accessKeyId);
+			url.searchParams.set("secretAccessKey", EMULATOR_CREDENTIALS.secretAccessKey);
+			return url.toString();
+		}
+	}
+}
+/** A local Postgres URL, master credential and all. */
+function postgres(port, database, credential = {
+	user: LOCAL_USER$2,
+	password: LOCAL_USER$2
+}) {
+	return `postgres://${credential.user}:${credential.password}@${LOCAL_HOST}:${port}/${database}`;
 }
 /**
-* The container a kind needs, or `undefined` if it needs none.
+* The role a handler connects as, for one database or tenant.
 *
-* Queues and topics have no container of their own — they live in whichever
-* broker the project selected, which is why the backend is an argument here
-* rather than a second pass that adds containers after the fact.
+* The construct's id, lowercased and stage-scoped exactly as its database or
+* schema is — so `Orders` in the `test` stage connects as `orders_test`, and two
+* stages sharing one cluster cannot share a credential. Roles are cluster-scoped
+* in Postgres, which is why the suffix is not optional here the way it is for a
+* schema.
 */
-function containerFor(kind, events = DEFAULT_EVENTS, cache = DEFAULT_CACHE.aws, derived = false, edge = true) {
-	if (EVENT_KINDS[kind]) return EVENT_CONTAINERS[events] ?? CONTAINERS.database;
-	if (kind === "file-server") return edge ? "caddy" : CONTAINERS.objects;
-	if (kind === "cache") {
-		if (derived) return CONTAINERS.database;
-		return CACHE_CONTAINERS[cache] ?? CONTAINERS.database;
-	}
-	return CONTAINERS[kind];
+function localRole(resource) {
+	return resource.name;
 }
 /**
-* Build the plan for a manifest and stage.
+* The password for a derived local role.
 *
-* `order` is the caller's provisioning order — parents before children — which
-* `provisionOrder` produces from the manifest. Passing it in keeps this
-* function free of the traversal and makes the ordering assertable on its own.
+* Derived rather than random, for the same reason the local secret is: a
+* password that changed on every `gkm dev` would lock a developer out of the
+* data they had a moment ago. Seeded by the project so two checkouts do not
+* share one, and by the stage so `test` and `development` do not.
+*
+* It is a *local* credential by construction — the cluster is on loopback and
+* the seed is a checkout path — and no deployed target uses this function.
 */
-function planFor(manifest, stage, order, options = {}) {
-	const containers = /* @__PURE__ */ new Set();
-	const resources = [];
-	const events = options.events ?? DEFAULT_EVENTS;
-	const cache = options.cache ?? DEFAULT_CACHE.aws;
-	for (const id of order) {
-		const declaration = manifest[id];
-		if (!declaration) continue;
-		const container = containerFor(declaration.kind, events, cache, "of" in declaration && typeof declaration.of === "string", options.edge !== false);
-		if (!container && !CONTAINERLESS[declaration.kind]) continue;
-		if (container) {
-			containers.add(container);
-			for (const required of REQUIRES[container] ?? []) containers.add(required);
-		}
-		resources.push({
-			id,
-			kind: declaration.kind,
-			...container ? { container } : {},
-			name: resourceName(id, declaration.kind, stage),
-			envKey: providedKeyFor(id, declaration.kind, ROLES[declaration.kind] ?? "url"),
-			provisions: PROVISIONS[declaration.kind] === true,
-			...declaration.kind === "rest-api" ? { callers: dependentsOf(manifest, id) } : {},
-			...declaration.kind === "site" ? { publicEnv: publicEnvFor(declaration, manifest) } : {},
-			...declaration.kind === "file-server" && declaration.open?.length ? { open: declaration.open } : {},
-			..."of" in declaration ? { of: declaration.of } : {},
-			..."schema" in declaration && declaration.schema ? { schema: declaration.schema } : {},
-			..."version" in declaration && declaration.version ? { version: declaration.version } : {},
-			..."roles" in declaration && declaration.roles === false ? { roles: false } : {},
-			..."table" in declaration && declaration.table ? { table: declaration.table } : {}
-		});
+function localRolePassword(project, plan, role) {
+	return createHash("sha256").update(`${project}:${plan.stage}:role:${role}`).digest("base64url").slice(0, 32);
+}
+/**
+* A cache's address: its database's URL, carrying the table it reads.
+*
+* Appended rather than kept beside the URL as a second key, for the reason the
+* design gives everywhere else — an address and what it opens are one fact, and
+* two keys are one more thing to keep in step.
+*/
+function withTable(url, table) {
+	const parsed = new URL(url);
+	parsed.searchParams.set("table", table);
+	return parsed.toString();
+}
+/**
+* The physical database a derived resource lives in.
+*
+* Walks `of` to the top rather than reading the immediate parent, because a
+* reader's parent may itself be a schema tenant — two hops from the database
+* that actually exists.
+*/
+function rootDatabase(resource, plan) {
+	const byId = new Map(plan.resources.map((r) => [r.id, r]));
+	let current = resource;
+	while (current.of) {
+		const parent = byId.get(current.of);
+		if (!parent) break;
+		current = parent;
 	}
-	if (options.edge !== false && resources.some((r) => EDGE_KINDS[r.kind] === true)) containers.add("caddy");
-	for (const extra of options.extraContainers ?? []) containers.add(extra);
-	if (events === "pgboss" && resources.some((r) => EVENT_KINDS[r.kind]) && !resources.some((r) => r.kind === "database")) throw new PgBossNeedsDatabase(resources.filter((r) => EVENT_KINDS[r.kind]).map((r) => r.id));
-	if (cache === "db") {
-		const placeless = resources.filter((r) => r.kind === "cache" && !r.of);
-		if (placeless.length > 0) {
-			const databases = resources.filter((r) => r.kind === "database");
-			const [only] = databases;
-			if (!only) throw new CacheNeedsDatabase(resources.filter((r) => r.kind === "cache").map((r) => r.id));
-			if (databases.length > 1) throw new CacheIsAmbiguous(placeless.map((r) => r.id), databases.map((r) => r.id));
-			for (const resource of placeless) resource.of = only.id;
-		}
+	return current.name;
+}
+/** The schema a derived resource puts on its search path, if it has one. */
+function schemaOf(resource, plan) {
+	const byId = new Map(plan.resources.map((r) => [r.id, r]));
+	let current = resource;
+	while (current) {
+		if (current.kind === "database-schema") return current.schema;
+		current = current.of ? byId.get(current.of) : void 0;
 	}
-	return {
-		stage,
-		events,
-		cache,
-		containers: [...containers],
-		resources
-	};
 }
 /**
-* Queues or topics were declared with pg-boss and no database to hold them.
+* A broker address asked for without the topic or queue it would name.
 *
-* Not a reconcile failure but a manifest one: the fix is a line of application
-* code either way — declare a database, or select a backend that brings its own
-* broker.
+* On SNS each topic and queue is its own address, so there is no project-wide
+* one to hand out — a cron's schedule store, say, cannot live there.
 */
-var CacheNeedsDatabase = class extends Error {
-	constructor(ids) {
-		super(`A cache backed by the database needs a declared database, and none was declared. Declare one, or set services.cache to 'upstash' or 'elasticache'. Caches affected: ${ids.join(", ")}.`);
-		this.ids = ids;
-		this.name = "CacheNeedsDatabase";
+var UnprovisionedEventsBackend = class extends Error {
+	backend;
+	constructor(backend) {
+		super(`'${backend}' has no single broker address: each topic and queue is addressed by its own ARN. Something asked for one without naming the topic or queue.`);
+		this.backend = backend;
+		this.name = "UnprovisionedEventsBackend";
 	}
 };
 /**
-* `services.cache: 'db'` in an app that declares more than one database.
+* The keyring an `Encryption` construct resolves to locally.
+*
+* Derived like a secret — stable across restarts, distinct per project, stage
+* and construct, never written to disk — so what `gkm dev` encrypted yesterday
+* still opens today. One key, because nothing local is worth rotating: a
+* server stage's keyring is generated and rotated in its secrets instead.
+*/
+function localKeyring(project, plan, resource) {
+	const derive = (purpose) => createHash("sha256").update(`${project}:${plan.stage}:${resource.id}:${purpose}`).digest();
+	return formatKeyring({
+		keys: [{
+			id: "k1",
+			key: derive("k1")
+		}],
+		index: derive("index")
+	});
+}
+/**
+* The value a secret resolves to locally.
 *
-* The config says *a* database and the graph offers several, so there is no
-* answer to give — and the wrong kind of failure would be to pick one, since a
-* cache silently landing in the wrong database is a bug that surfaces as
-* missing rows much later. The fix is a stronger statement in application code:
-* `orders.cache('Sessions')` names the database, which is a fact about the
-* application rather than a deployment choice.
+* A hash of what identifies it, so it is stable, distinct per project, stage
+* and construct, and never written to disk as a literal. Deployed this is the
+* one kind whose value does *not* come from here — a secret manager generates
+* it once and the target reads it back.
 */
-var CacheIsAmbiguous = class extends Error {
-	constructor(ids, databases) {
-		super(`A cache backed by the database needs to know which one, and this app declares ${databases.length}: ${databases.join(", ")}. Declare the cache from its database — e.g. ${databases[0]}.cache('Sessions') — rather than with services.cache. Caches affected: ${ids.join(", ")}.`);
-		this.ids = ids;
-		this.databases = databases;
-		this.name = "CacheIsAmbiguous";
-	}
-};
-var PgBossNeedsDatabase = class extends Error {
-	constructor(ids) {
-		super(`pg-boss keeps its queues in a declared database, and none was declared. Declare one, or set services.events to 'rabbitmq' or 'sns'. Queues and topics affected: ${ids.join(", ")}.`);
-		this.ids = ids;
-		this.name = "PgBossNeedsDatabase";
-	}
-};
-
+function localSecret(project, plan, resource) {
+	return createHash("sha256").update(`${project}:${plan.stage}:${resource.id}`).digest("base64url").slice(0, 43);
+}
 //#endregion
-//#region src/reconcile/env.ts
+//#region src/reconcile/apps.ts
 /**
-* The credential local containers are brought up with.
+* The apps, as services beside the containers their constructs derive.
 *
-* The design's `roles: false` case — both URLs fall back to the cluster's master
-* credential. A deliberate downgrade, not a default: it holds until the role DDL
-* lands in `@geekmidas/db`, at which point the runtime role's URL replaces this
-* and the owner URL stops being reachable from any manifest edge.
+* `gkm docker` used to write these by hand: every backend got
+* `DATABASE_URL=postgresql://…@postgres:5432/app` and `REDIS_URL=redis://redis`,
+* which was right only for a project whose single database happened to be
+* called `Database` — an `Orders` database publishes `ORDERS_URL`, a schema
+* tenant has a URL of its own, and buckets and mail were not wired at all.
+*
+* Now an app's environment is exactly what reconcile hands `gkm dev`: every key
+* the declared constructs provide, from the same derivation. The only
+* difference is where the addresses point — at the containers by service name
+* on the compose network, rather than at `localhost` on the ports published for
+* the host.
+*
+* Always from the *local* stage's plan, whichever stage is being reconciled:
+* `gkm test` rewrites the same file, and running the tests must not quietly
+* point these apps at the test databases.
 */
-const LOCAL_USER = "geekmidas";
-/** The host containers are published on. */
-const LOCAL_HOST = "localhost";
-/** The region local buckets claim, so the client has one to sign with. */
-const LOCAL_REGION = "us-east-1";
+/** The profile app services carry, so `gkm dev` starts only the containers. */
+const APPS_PROFILE = "apps";
 /**
-* The credentials the S3 client resolves for MinIO.
+* Where an app's image is built from.
 *
-* An `s3://` URL deliberately carries none: deployed, the SDK reads them from
-* the execution role, so a URL that embedded a key would be one more thing to
-* rotate and one more thing to leak into a log. Locally there is no role, and
-* the same chain reads these — which is why they are injected beside the URL
-* rather than written into it.
+* An app at the project root is a single-app project, whose `gkm docker`
+* writes `.gkm/docker/Dockerfile`; a workspace writes one per app.
 */
-const STORAGE_CREDENTIALS = {
-	AWS_ACCESS_KEY_ID: LOCAL_USER,
-	AWS_SECRET_ACCESS_KEY: LOCAL_USER,
-	AWS_REGION: LOCAL_REGION
-};
-/** The token the local cache proxy accepts. Matches the compose definition. */
-const LOCAL_TOKEN = "geekmidas";
-/** The schema pg-boss keeps its tables in, inside the declared database. */
-const PGBOSS_SCHEMA = "pgboss";
-/** The exchange every local topic and queue shares on RabbitMQ. */
-const RABBITMQ_EXCHANGE = "geekmidas.events";
+function dockerfileOf(appName, path) {
+	return path === "." ? ".gkm/docker/Dockerfile" : `.gkm/docker/Dockerfile.${appName}`;
+}
 /**
-* Every env key a reconciled plan resolves, and its value.
+* Every construct key, addressed across the compose network.
 *
-* Keys come from the declaration rather than being re-derived, so what the build
-* publishes and what the app reads cannot drift.
+* `envFor` is asked with a placeholder port for every port key, so each
+* `localhost:<placeholder>` in its answer names exactly one container port —
+* two containers listening on the same port inside cannot be confused — and is
+* rewritten to `<container>:<inside>`.
 */
-function envFor(plan, options) {
-	const env = {};
-	const resolved = {};
-	for (const resource of plan.resources) {
-		const url = urlFor(resource, plan, options.ports, options.project ?? "", options.addresses);
-		if (url) resolved[resource.id] = url;
+function inNetworkEnv(workspace, manifest, fakes = {}) {
+	const plan = planFor(manifest, workspace.stages.local, provisionOrder(manifest), {
+		localStage: workspace.stages.local,
+		...backendsOf(workspace),
+		fakes
+	});
+	const placeholders = {};
+	const targets = /* @__PURE__ */ new Map();
+	let next = 49152;
+	for (const container of [...plan.containers].sort()) for (const port of portsOf(container, plan.fakes)) {
+		placeholders[port.key] = next;
+		targets.set(next, `${container}:${port.inside}`);
+		next += 1;
 	}
-	for (const resource of plan.resources) {
-		const url = resolved[resource.id];
-		if (resource.kind === "rest-api") Object.assign(env, surfaceEnv(resource, url, resolved));
-		if (url) env[resource.envKey] = url;
-		if (isDatabase(resource.kind) && resource.roles !== false) {
-			const owner = ownerUrl(resource, plan, options.ports, options.project ?? "");
-			if (owner) env[provideKey(resource.id, "ownerUrl")] = owner;
+	for (const key of portKeys(plan.containers, plan.fakes)) placeholders[key] ??= next++;
+	const env = envFor(plan, {
+		ports: placeholders,
+		project: workspace.name,
+		addresses: surfaceAddresses(workspace, manifest, (app, port) => `http://${app}:${port}`)
+	});
+	const rewrite = (value) => value.replace(/(?:localhost|127\.0\.0\.1):(\d+)/g, (match, port) => {
+		return targets.get(Number(port)) ?? match;
+	});
+	return Object.fromEntries(Object.entries(env).map(([key, value]) => [key, rewrite(value)]));
+}
+/**
+* The keys one app's environment may hold: what its own declaration provides
+* and requires, and what each construct it has an edge to provides.
+*
+* The edges, not the manifest. Every app used to be handed every key the
+* workspace resolved — a web app got the database's owner URL and the auth
+* server's signing secret, and the API got the auth server's database — which
+* is exactly what a declared edge exists to rule out. A deploy composes an
+* app's environment from its edges; so does this.
+*
+* One hop: a surface an app calls is reached over HTTP, so its URL is the
+* app's business and its database is not. A site also gets the public
+* variant of each key its bundle inlines (`NEXT_PUBLIC_API_URL`), and a surface
+* the edges of the workers whose crons and subscribers its server runs.
+*
+* `undefined` for an app no declaration describes, which gets nothing but its
+* port.
+*/
+function appEnvKeys(manifest, appName, runnables = {}) {
+	const entry = Object.entries(manifest).find(([id, d]) => (d.kind === "rest-api" || d.kind === "site" || d.kind === "mobile-app") && appKey(id) === appName);
+	if (!entry) return void 0;
+	const [id, declaration] = entry;
+	const keys = /* @__PURE__ */ new Set([
+		...declaration.provides ?? [],
+		...declaration.requires ?? [],
+		...declaration.kind === "rest-api" ? declaration.endpoints.flatMap((endpoint) => endpoint.requires ?? []) : []
+	]);
+	const edges = [...dependenciesOf(declaration).map((edge) => edge.target), ...runnables[id] ?? []];
+	if (declaration.kind === "rest-api" && declaration.endpoints.length === 0) {
+		const runsWorkers = Object.values(manifest).some((other) => other.kind === "worker");
+		for (const [otherId, other] of Object.entries(manifest)) {
+			if (other.kind !== "worker") continue;
+			edges.push(...dependenciesOf(other).map((edge) => edge.target), ...runnables[otherId] ?? []);
+			keys.add("EVENT_PUBLISHER_CONNECTION_STRING");
+		}
+		if (runsWorkers) for (const other of Object.values(manifest)) {
+			if (other.kind !== "queue" && other.kind !== "topic") continue;
+			for (const key of other.provides ?? []) keys.add(key);
 		}
-		if (resource.kind === "email" && url) env[provideKey(resource.id, "from")] = options.mailFrom ?? `noreply@${LOCAL_HOST}`;
 	}
-	Object.assign(env, publicEnv(plan, env));
-	Object.assign(env, brokerEnv(plan, options.ports));
-	if (plan.resources.some((r) => r.kind === "objects" && env[r.envKey])) Object.assign(env, STORAGE_CREDENTIALS);
-	return env;
+	for (const id of edges) {
+		const target = manifest[id];
+		if (!target) continue;
+		for (const key of target.provides ?? []) keys.add(key);
+		if (target.kind === "queue" || target.kind === "topic") keys.add("EVENT_PUBLISHER_CONNECTION_STRING");
+		if (target.kind === "objects") {
+			keys.add("AWS_ACCESS_KEY_ID");
+			keys.add("AWS_SECRET_ACCESS_KEY");
+			keys.add("AWS_REGION");
+		}
+	}
+	if (declaration.kind === "site" || declaration.kind === "mobile-app") for (const key of Object.keys(publicEnvFor(declaration, manifest))) keys.add(key);
+	return keys;
+}
+/** One compose service per app the workspace runs, behind the apps profile. */
+function appServices(workspace, manifest, containers, runnables = {}, fakes = {}) {
+	const env = inNetworkEnv(workspace, manifest, fakes);
+	const services = {};
+	for (const [name, app] of Object.entries(workspace.apps)) {
+		if (app.type === "mobile" || !app.port) continue;
+		const key = appKey(name);
+		const health = app.type === "web" ? "/" : "/health";
+		const allowed = appEnvKeys(manifest, name, runnables);
+		const own = Object.fromEntries(Object.entries(env).filter(([envKey]) => allowed?.has(envKey)));
+		services[key] = {
+			image: `${key}:\${TAG:-latest}`,
+			build: {
+				context: ".",
+				dockerfile: dockerfileOf(name, app.path)
+			},
+			profiles: [APPS_PROFILE],
+			ports: [`${app.port}:${app.port}`],
+			environment: {
+				NODE_ENV: "production",
+				PORT: String(app.port),
+				...own
+			},
+			...containers.some((c) => c !== "caddy") ? { depends_on: containers.filter((c) => c !== "caddy") } : {},
+			healthcheck: {
+				test: [
+					"CMD",
+					"wget",
+					"-q",
+					"--spider",
+					`http://localhost:${app.port}${health}`
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5
+			}
+		};
+	}
+	return services;
 }
+//#endregion
+//#region src/reconcile/clients.ts
 /**
-* The values a site's bundler inlines, under the names it inlines them by.
+* The real Postgres and MinIO clients the applier runs against.
 *
-* A rename and nothing more. `API_URL` was resolved once, by the same code that
-* resolved it for the server; a site reads the same value under `VITE_API_URL`
-* because that prefix is how its bundler is told to ship it. Nothing is derived
-* twice, so a site and its API cannot come to disagree about where the API is.
+* Kept apart from `provision.ts` so the rules there — what gets created, in what
+* order, and never dropping anything — are asserted against fakes, while the
+* drivers live here where there is nothing to assert but wiring.
 *
-* A source that resolved to nothing is skipped rather than written empty: an
-* inlined empty string is a frontend that builds and then fails at runtime
-* against `http:///`, where a missing variable fails at build with the name of
-* the thing that is missing.
+* Both are constructed from the same local addresses the env writer composes,
+* so the applier cannot end up talking to a different container than the app.
 */
-function publicEnv(plan, resolved) {
-	const env = {};
-	for (const resource of plan.resources) for (const [key, source] of Object.entries(resource.publicEnv ?? {})) {
-		const value = resolved[source];
-		if (value) env[key] = value;
-	}
-	return env;
-}
+/** The credential local containers are brought up with. */
+const LOCAL_USER$1 = "geekmidas";
 /**
-* What a surface publishes beyond its own address: who may call it, and where
-* a cookie set by it is readable.
-*
-* Both are read off the same list — the constructs that declared an edge to
-* this surface — which is why neither appears in application code. A surface
-* that listed its own callers would be edited every time something new called
-* it, and the thing being edited is already recorded in the graph.
+* A Postgres client that opens one connection per database it is asked about.
 *
-* An empty origin list is written, and a surface with no address writes nothing
-* at all. The two cases look alike and are not: "nothing depends on this yet" is
-* a real state a target should publish, while "this surface has no address here"
-* means it is not running in this stage, and keys belong with the address they
-* describe.
+* `CREATE DATABASE` cannot run from a connection to the database being created,
+* and a schema must be created from inside its own database — so the database is
+* part of each query rather than fixed when the client is built.
 */
-function surfaceEnv(resource, url, resolved = {}) {
-	if (!url) return {};
-	const origins = [...new Set((resource.callers ?? []).map((caller) => resolved[caller]).filter((address) => Boolean(address)).map(originOf).filter((origin) => Boolean(origin)))].sort();
-	const domain = cookieDomain([url, ...origins]);
+function pgClient(port) {
+	return { async query(database, sql, values) {
+		const client = new Client({
+			host: "localhost",
+			port,
+			user: LOCAL_USER$1,
+			password: LOCAL_USER$1,
+			database: database ?? LOCAL_USER$1
+		});
+		await client.connect();
+		try {
+			return (await client.query(sql, values)).rows;
+		} finally {
+			await client.end();
+		}
+	} };
+}
+/** A bucket client pointed at the local MinIO. */
+function bucketClient(port) {
+	const s3 = new S3Client({
+		region: "us-east-1",
+		endpoint: `http://localhost:${port}`,
+		forcePathStyle: true,
+		credentials: {
+			accessKeyId: LOCAL_USER$1,
+			secretAccessKey: LOCAL_USER$1
+		}
+	});
+	return {
+		async exists(bucket) {
+			try {
+				await s3.send(new HeadBucketCommand({ Bucket: bucket }));
+				return true;
+			} catch {
+				return false;
+			}
+		},
+		async create(bucket) {
+			await s3.send(new CreateBucketCommand({ Bucket: bucket }));
+		},
+		async policy(bucket) {
+			try {
+				return (await s3.send(new GetBucketPolicyCommand({ Bucket: bucket }))).Policy;
+			} catch {
+				return;
+			}
+		},
+		async setPolicy(bucket, policy) {
+			await s3.send(new PutBucketPolicyCommand({
+				Bucket: bucket,
+				Policy: policy
+			}));
+		}
+	};
+}
+/** A topic and queue client pointed at the local AWS emulator. */
+function carrierClient(port) {
+	const config = {
+		region: EMULATOR_REGION,
+		endpoint: emulatorEndpoint(port),
+		credentials: EMULATOR_CREDENTIALS
+	};
+	const sns = new SNSClient(config);
+	const sqs = new SQSClient(config);
 	return {
-		[provideKey(resource.id, "trustedOrigins")]: origins.join(","),
-		...domain ? { [provideKey(resource.id, "cookieDomain")]: domain } : {}
+		async topicExists(name) {
+			try {
+				await sns.send(new GetTopicAttributesCommand({ TopicArn: emulatorTopicArn(name) }));
+				return true;
+			} catch {
+				return false;
+			}
+		},
+		async createTopic(name) {
+			await sns.send(new CreateTopicCommand({ Name: name }));
+		},
+		async queueExists(name) {
+			try {
+				await sqs.send(new GetQueueUrlCommand({ QueueName: name }));
+				return true;
+			} catch {
+				return false;
+			}
+		},
+		async createQueue(name) {
+			await sqs.send(new CreateQueueCommand({ QueueName: name }));
+		}
 	};
 }
-/** An address reduced to the origin a browser compares against. */
-function originOf(address) {
-	try {
-		return new URL(address).origin;
-	} catch {
-		return void 0;
-	}
-}
+//#endregion
+//#region src/reconcile/compose.ts
 /**
-* The runtime role of whatever a derived node hangs off.
+* The compose document a plan implies.
 *
-* A reader's parent may itself be a schema tenant, so this follows `of` by one
-* hop rather than assuming the cluster — the reader of a tenant reads that
-* tenant's schema, not the database's.
+* The third declaration of the same containers disappears here: today a
+* `services: ['postgres','minio']` block is kept in step with the code by hand,
+* which is the triplication this design exists to remove, in the one place you
+* touch every day. A `database` implies Postgres; the list is derived.
+*
+* Returns an object rather than a string for the same reason `plan` is pure —
+* what should exist is asserted as data, and turning it into YAML is one line at
+* the edge.
+*
+* What stays config is unchanged: images and versions are pinned explicitly, and
+* a container no construct implies is still declared by hand. Neutral facts come
+* from the declaration, provider detail from config.
 */
-function parentRole(resource, plan) {
-	const parent = plan.resources.find((r) => r.id === resource.of);
-	return parent ? localRole(parent) : resource.name;
-}
-/** Whether a kind connects to Postgres and therefore has an owner role. */
-function isDatabase(kind) {
-	return kind === "database" || kind === "database-schema";
-}
+/** The credential every derived container is brought up with locally. */
+const LOCAL_USER = "geekmidas";
 /**
-* The URL a migrator connects with — the owner role, which can create, alter
-* and drop.
+* The token the local cache accepts.
 *
-* Never in `provides`, which is the whole point. A handler that could reach this
-* could `DROP TABLE`, and the security property the role split exists for is
-* that it cannot: the value is injected by `gkm exec` for the migrate step and
-* by nothing else.
+* Fixed rather than generated: it is only ever reachable on a port this project
+* published, and the URL that carries it is derived, so nothing is made safer
+* by making it unguessable and a stable one keeps `redis-cli` sessions working.
 */
-function ownerUrl(resource, plan, ports, project) {
-	if (!resource.container) return void 0;
-	const port = ports[primaryPortKey(resource.container)];
-	if (port === void 0) return void 0;
-	const owner = ownerRole(localRole(resource));
-	return postgres(port, rootDatabase(resource, plan), {
-		user: owner,
-		password: localRolePassword(project, plan, owner)
-	});
-}
+const LOCAL_TOKEN = "geekmidas";
 /**
-* The shared broker keys, when anything is published or consumed.
+* Build the compose document for a plan.
 *
-* A queue's own key is the producer's. These two are the *connection* itself,
-* which locally is one broker for every queue and topic in the project: the
-* generated pollers open a single connection and subscribe each worker by name
-* on it. Deployed there is no such thing — a Lambda is handed its own event
-* source — so this pair exists for the local target and says so.
+* Every container is published on its assigned port, never on the image's
+* default: the point of allocation is that two projects can run at once, and
+* one container publishing 5432 puts that back.
 */
-function brokerEnv(plan, ports) {
-	const carrier = plan.resources.find((r) => r.kind === "queue" || r.kind === "topic");
-	if (!carrier) return {};
-	const publisher = urlFor(carrier, plan, ports, "");
-	if (!publisher) return {};
+function composeFor(plan, options) {
+	const services = {};
+	const volumes = {};
+	for (const container of [...plan.containers].sort()) {
+		const declared = container === "postgres" ? plan.resources.find((r) => r.version)?.version : void 0;
+		const fake = plan.fakes?.[container];
+		const image = declared ? postgresImage(declared) : fake?.image ?? DEFAULT_IMAGES[container];
+		if (!image) throw new UnknownContainer(container);
+		const published = publish(container, options.ports, plan.fakes);
+		services[container] = fake ? {
+			image,
+			restart: "unless-stopped",
+			ports: published
+		} : define(container, image, published);
+		const volume = volumeOf(container);
+		if (volume) volumes[volume] = {};
+	}
 	return {
-		EVENT_PUBLISHER_CONNECTION_STRING: publisher,
-		EVENT_SUBSCRIBER_CONNECTION_STRING: plan.events === "sns" ? publisher.replace(/^sns:/, "sqs:") : publisher
+		name: options.project,
+		services: {
+			...services,
+			...options.apps
+		},
+		...Object.keys(volumes).length ? { volumes } : {}
 	};
 }
-/**
-* The URL for one planned resource.
-*
-* Every part of it comes from the resource and the port it was published on.
-*/
-function urlFor(resource, plan, ports, project, addresses = {}) {
-	if (resource.kind === "secret") return localSecret(project, plan, resource);
-	if (resource.kind === "credential") return void 0;
-	if (resource.kind === "rest-api" || resource.kind === "site") {
-		const address = addresses[resource.id];
-		const edge = plan.containers.includes("caddy") ? ports[primaryPortKey("caddy")] : void 0;
-		return address && edge !== void 0 ? `https://${hostFor(resource, project)}:${edge}` : address;
+/** Render a compose document as the file it becomes. */
+function toYaml(file) {
+	return `# Generated by gkm from the construct manifest — do not edit.
+# Containers are derived from what the app declares. Image pins and anything
+# no construct implies go in your own docker-compose.yml, which is merged over
+# this file and wins:
+#
+#   docker compose -f docker-compose.constructs.yml -f docker-compose.yml …
+#
+# "gkm dev" and "gkm test" start the containers. The apps sit behind the
+# "apps" profile: run "gkm setup", then
+#   docker compose -f docker-compose.constructs.yml --profile apps up --build
+${stringify(file, { lineWidth: 0 })}`;
+}
+/** A container with no image, from config or from the defaults. */
+var UnknownContainer = class extends Error {
+	/** The container that could not be resolved. */
+	container;
+	/** The containers that have a default, so the caller can see the set. */
+	known = Object.keys(DEFAULT_IMAGES).sort();
+	constructor(container) {
+		super("No image is known for this container; pin one in config");
+		this.name = "UnknownContainer";
+		this.container = container;
 	}
-	if (!resource.container) return void 0;
-	const port = ports[primaryPortKey(resource.container)];
-	if (port === void 0) return void 0;
-	switch (resource.kind) {
-		case "database":
-		case "database-schema":
-		case "database-reader": {
-			const database = rootDatabase(resource, plan);
-			if (resource.roles === false) {
-				const schema = schemaOf(resource, plan);
-				return schema ? `${postgres(port, database)}?search_path=${schema}` : postgres(port, database);
+};
+/** One container's definition, published on the port it was assigned. */
+function define(container, image, published) {
+	switch (container) {
+		case "postgres": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			environment: {
+				POSTGRES_USER: LOCAL_USER,
+				POSTGRES_PASSWORD: LOCAL_USER,
+				POSTGRES_DB: LOCAL_USER
+			},
+			volumes: ["postgres-data:/var/lib/postgresql"],
+			healthcheck: {
+				test: ["CMD-SHELL", `pg_isready -U ${LOCAL_USER}`],
+				interval: "5s",
+				timeout: "3s",
+				retries: 10,
+				start_period: "10s"
 			}
-			const role = resource.kind === "database-reader" ? readerRole(parentRole(resource, plan)) : localRole(resource);
-			return postgres(port, database, {
-				user: role,
-				password: localRolePassword(project, plan, role)
-			});
-		}
-		case "email": return `smtp://${LOCAL_HOST}:${port}`;
-		case "objects": return `s3://${resource.name}?region=${LOCAL_REGION}&endpoint=http://${LOCAL_HOST}:${port}&forcePathStyle=true`;
-		case "file-server": {
-			const origin = plan.resources.find((r) => r.id === resource.of);
-			if (!origin) return void 0;
-			return plan.containers.includes("caddy") ? `https://${hostFor(resource, project)}:${port}` : `http://${LOCAL_HOST}:${port}/${origin.name}`;
-		}
-		case "cache":
-			if (resource.of) {
-				const parent = plan.resources.find((r) => r.id === resource.of);
-				const url = parent ? urlFor(parent, plan, ports, project, addresses) : void 0;
-				return url ? withTable(url, resource.table ?? cacheTable(resource.id)) : void 0;
+		};
+		case "minio": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			environment: {
+				MINIO_ROOT_USER: LOCAL_USER,
+				MINIO_ROOT_PASSWORD: LOCAL_USER
+			},
+			command: "server --console-address \":9001\" /data",
+			volumes: ["minio-data:/data"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"mc",
+					"ready",
+					"local"
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5,
+				start_period: "10s"
+			}
+		};
+		case "caddy": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			volumes: [
+				"./.gkm/Caddyfile:/etc/caddy/Caddyfile:ro",
+				"./.gkm/caddy-sites:/etc/caddy/sites:ro",
+				"caddy-data:/data"
+			],
+			extra_hosts: ["host.docker.internal:host-gateway"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"caddy",
+					"version"
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5
+			}
+		};
+		case "mailpit": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			environment: {
+				MP_SMTP_AUTH_ACCEPT_ANY: "1",
+				MP_SMTP_AUTH_ALLOW_INSECURE: "1"
+			},
+			healthcheck: {
+				test: [
+					"CMD",
+					"wget",
+					"-q",
+					"--spider",
+					"http://localhost:8025"
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5
+			}
+		};
+		case "redis": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			volumes: ["redis-data:/data"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"redis-cli",
+					"ping"
+				],
+				interval: "5s",
+				timeout: "3s",
+				retries: 5
+			}
+		};
+		case "redis-http": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			environment: {
+				SRH_MODE: "env",
+				SRH_TOKEN: LOCAL_TOKEN,
+				SRH_CONNECTION_STRING: "redis://redis:6379"
+			},
+			depends_on: ["redis"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"wget",
+					"-q",
+					"-O",
+					"/dev/null",
+					"http://127.0.0.1:80/"
+				],
+				interval: "5s",
+				timeout: "3s",
+				retries: 10
 			}
-			switch (plan.cache) {
-				case "elasticache": return `redis://${LOCAL_HOST}:${port}`;
-				default: return `http://:${LOCAL_TOKEN}@${LOCAL_HOST}:${port}`;
+		};
+		case "rabbitmq": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			environment: {
+				RABBITMQ_DEFAULT_USER: LOCAL_USER,
+				RABBITMQ_DEFAULT_PASS: LOCAL_USER
+			},
+			volumes: ["rabbitmq-data:/var/lib/rabbitmq"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"rabbitmq-diagnostics",
+					"-q",
+					"ping"
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5
 			}
-		case "queue":
-		case "topic": return broker(plan, port);
-		default: return void 0;
-	}
-}
-/**
-* The producer's connection string, composed from the backend the plan chose.
-*
-* The protocol is what picks the transport, so a producer never branches: the
-* same `.publish()` reaches pg-boss here and SQS deployed because the string it
-* was handed said so.
-*/
-function broker(plan, port) {
-	switch (plan.events) {
-		case "pgboss": {
-			const database = plan.resources.find((r) => r.kind === "database");
-			if (!database) throw new PgBossNeedsDatabase([]);
-			return `pgboss://${LOCAL_USER}:${LOCAL_USER}@${LOCAL_HOST}:${port}/${database.name}?schema=${PGBOSS_SCHEMA}`;
-		}
-		case "rabbitmq": return `rabbitmq://${LOCAL_USER}:${LOCAL_USER}@${LOCAL_HOST}:${port}?exchange=${RABBITMQ_EXCHANGE}`;
-		case "sns": throw new UnprovisionedEventsBackend("sns");
+		};
+		case "localstack": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			extra_hosts: ["host.docker.internal:host-gateway"],
+			environment: {
+				AWS_DEFAULT_REGION: EMULATOR_REGION,
+				AWS_ACCESS_KEY_ID: EMULATOR_CREDENTIALS.accessKeyId,
+				AWS_SECRET_ACCESS_KEY: EMULATOR_CREDENTIALS.secretAccessKey
+			},
+			volumes: ["localstack-data:/var/lib/localstack"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"bash",
+					"-c",
+					"exec 3<>/dev/tcp/localhost/4566"
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5,
+				start_period: "10s"
+			}
+		};
+		default: throw new UnknownContainer(container);
 	}
 }
-/** A local Postgres URL, master credential and all. */
-function postgres(port, database, credential = {
-	user: LOCAL_USER,
-	password: LOCAL_USER
-}) {
-	return `postgres://${credential.user}:${credential.password}@${LOCAL_HOST}:${port}/${database}`;
-}
 /**
-* The role a handler connects as, for one database or tenant.
+* The published port mappings for a container.
 *
-* The construct's id, lowercased and stage-scoped exactly as its database or
-* schema is — so `Orders` in the `test` stage connects as `orders_test`, and two
-* stages sharing one cluster cannot share a credential. Roles are cluster-scoped
-* in Postgres, which is why the suffix is not optional here the way it is for a
-* schema.
+* Every port is looked up by its own key rather than being derived as an offset
+* from the container's first, so MinIO's console cannot land on whatever was
+* allocated to the next container.
 */
-function localRole(resource) {
-	return resource.name;
+function publish(container, ports, fakes) {
+	return portsOf(container, fakes).map((port) => {
+		const assigned = ports[port.key];
+		if (assigned === void 0) throw new UnassignedPort(port.key);
+		return `${assigned}:${port.inside}`;
+	});
 }
+/** A planned port that allocation never assigned. */
+var UnassignedPort = class extends Error {
+	/** The port key that went unassigned, e.g. `minio-console`. */
+	key;
+	constructor(key) {
+		super("No port was assigned for this container port");
+		this.name = "UnassignedPort";
+		this.key = key;
+	}
+};
+//#endregion
+//#region src/reconcile/docker.ts
 /**
-* The password for a derived local role.
+* The real Docker, behind the small interface reconcile needs.
 *
-* Derived rather than random, for the same reason the local secret is: a
-* password that changed on every `gkm dev` would lock a developer out of the
-* data they had a moment ago. Seeded by the project so two checkouts do not
-* share one, and by the stage so `test` and `development` do not.
+* Shells out to `docker compose` rather than talking to the daemon socket: it is
+* what a developer runs by hand when something is wrong, so the two cannot
+* disagree, and it keeps Docker out of this package's dependencies.
 *
-* It is a *local* credential by construction — the cluster is on loopback and
-* the seed is a checkout path — and no deployed target uses this function.
+* Every call is scoped to the generated compose file. Nothing here can touch a
+* container this project did not generate.
 */
-function localRolePassword(project, plan, role) {
-	return createHash("sha256").update(`${project}:${plan.stage}:role:${role}`).digest("base64url").slice(0, 32);
-}
+const run = promisify(execFile);
 /**
-* A cache's address: its database's URL, carrying the table it reads.
+* The generated file, then the project's own if it has one.
 *
-* Appended rather than kept beside the URL as a second key, for the reason the
-* design gives everywhere else — an address and what it opens are one fact, and
-* two keys are one more thing to keep in step.
+* Merged in that order so the project's wins — an `image:` there pins a
+* container this file derived, and a service there is added beside them.
 */
-function withTable(url, table) {
-	const parsed = new URL(url);
-	parsed.searchParams.set("table", table);
-	return parsed.toString();
+function composeFiles(composePath) {
+	const project = join(dirname(composePath), "docker-compose.yml");
+	return [
+		"-f",
+		composePath,
+		...existsSync(project) ? ["-f", project] : []
+	];
 }
-/**
-* The physical database a derived resource lives in.
-*
-* Walks `of` to the top rather than reading the immediate parent, because a
-* reader's parent may itself be a schema tenant — two hops from the database
-* that actually exists.
-*/
-function rootDatabase(resource, plan) {
-	const byId = new Map(plan.resources.map((r) => [r.id, r]));
-	let current = resource;
-	while (current.of) {
-		const parent = byId.get(current.of);
-		if (!parent) break;
-		current = parent;
+/** How long to wait for containers to pass their health checks. */
+const HEALTH_TIMEOUT_MS = 12e4;
+/** `docker compose up` exited unsuccessfully; its own output said why. */
+var ComposeUpFailed = class extends Error {
+	services;
+	code;
+	constructor(services, code) {
+		super(`docker compose could not start ${services.join(", ")} (exit ${code ?? "signal"}). Its output above names the container; \`docker compose logs <service>\` shows why it stopped.`);
+		this.services = services;
+		this.code = code;
+		this.name = "ComposeUpFailed";
 	}
-	return current.name;
+};
+/** Run compose with its output on this terminal rather than captured. */
+function shown(args, services) {
+	return new Promise((resolve, reject) => {
+		const child = spawn("docker", args, { stdio: [
+			"ignore",
+			"inherit",
+			"inherit"
+		] });
+		child.on("error", reject);
+		child.on("close", (code) => code === 0 ? resolve() : reject(new ComposeUpFailed(services, code)));
+	});
 }
-/** The schema a derived resource puts on its search path, if it has one. */
-function schemaOf(resource, plan) {
-	const byId = new Map(plan.resources.map((r) => [r.id, r]));
-	let current = resource;
-	while (current) {
-		if (current.kind === "database-schema") return current.schema;
-		current = current.of ? byId.get(current.of) : void 0;
+const dockerCli = {
+	async publishedPort(composePath, service, inside) {
+		try {
+			const { stdout } = await run("docker", [
+				"compose",
+				...composeFiles(composePath),
+				"port",
+				service,
+				String(inside)
+			]);
+			const port = Number(stdout.trim().split(":").pop());
+			return Number.isFinite(port) && port > 0 ? port : void 0;
+		} catch {
+			return;
+		}
+	},
+	async up(composePath, services, options = {}) {
+		const args = [
+			"compose",
+			...composeFiles(composePath),
+			"up",
+			"-d",
+			"--remove-orphans",
+			"--wait",
+			`--wait-timeout=${Math.floor(HEALTH_TIMEOUT_MS / 1e3)}`,
+			...services
+		];
+		if (options.show) return shown(args, services);
+		await run("docker", args);
+	},
+	async copyOut(composePath, service, from, to) {
+		await mkdir(dirname(to), { recursive: true });
+		await run("docker", [
+			"compose",
+			...composeFiles(composePath),
+			"cp",
+			`${service}:${from}`,
+			to
+		]);
+	},
+	async reload(composePath, service) {
+		await run("docker", [
+			"compose",
+			...composeFiles(composePath),
+			"exec",
+			"-T",
+			service,
+			"caddy",
+			"reload",
+			"--config",
+			"/etc/caddy/Caddyfile"
+		]);
+	},
+	async healthy(composePath, services) {
+		if (services.length === 0) return true;
+		try {
+			const { stdout } = await run("docker", [
+				"compose",
+				...composeFiles(composePath),
+				"ps",
+				"--format",
+				"json",
+				...services
+			]);
+			const running = /* @__PURE__ */ new Set();
+			for (const line of stdout.trim().split("\n").filter(Boolean)) {
+				const entry = JSON.parse(line);
+				if (entry.State === "running" && (entry.Health === void 0 || entry.Health === "" || entry.Health === "healthy") && entry.Service) running.add(entry.Service);
+			}
+			return services.every((service) => running.has(service));
+		} catch {
+			return false;
+		}
 	}
-	return void 0;
-}
+};
+//#endregion
+//#region src/reconcile/lan.ts
 /**
-* A backend whose local addresses cannot be derived yet.
-*
-* SNS and SQS are addressed by ARN, which means the topic and queue have to be
-* created in LocalStack before a URL can name them. Until that provisioning
-* lands, saying so is better than handing out a string that fails on first use.
+* This machine's address on the local network — what a phone running the app
+* reaches it on.
 */
-var UnprovisionedEventsBackend = class extends Error {
-	constructor(backend) {
-		super(`The local target cannot derive addresses for '${backend}' yet — its topics and queues are named by ARN, which nothing creates locally. Use 'pgboss' (the default) or 'rabbitmq' for local development.`);
-		this.backend = backend;
-		this.name = "UnprovisionedEventsBackend";
-	}
-};
 /**
-* The value a secret resolves to locally.
+* The first private IPv4 address of an interface that is up and not loopback.
 *
-* A hash of what identifies it, so it is stable, distinct per project, stage
-* and construct, and never written to disk as a literal. Deployed this is the
-* one kind whose value does *not* come from here — a secret manager generates
-* it once and the target reads it back.
+* Private ranges only (`10/8`, `172.16/12`, `192.168/16`): a public address
+* would mean listening for a phone on the open internet, and a link-local one
+* (`169.254/16`) is what an interface has when it found no network at all.
+* Undefined when there is none — a laptop on no network still runs, its mobile
+* app reaching only a simulator.
 */
-function localSecret(project, plan, resource) {
-	return createHash("sha256").update(`${project}:${plan.stage}:${resource.id}`).digest("base64url").slice(0, 43);
+function lanAddress(interfaces = networkInterfaces()) {
+	for (const entries of Object.values(interfaces)) for (const entry of entries ?? []) {
+		if (entry.family !== "IPv4" || entry.internal) continue;
+		if (isPrivate(entry.address)) return entry.address;
+	}
+}
+function isPrivate(address) {
+	return /^10\./.test(address) || /^192\.168\./.test(address) || /^172\.(1[6-9]|2\d|3[01])\./.test(address);
 }
-
 //#endregion
 //#region src/reconcile/ports.ts
 /**
+* Port allocation — why two projects can run at once.
+*
+* Publishing `5432:5432` means the second project on your machine cannot start.
+* Nothing solves that except giving each project its own ports, and what makes
+* it *possible* is the single-`<NAME>_URL` rule: an app reads `ORDERS_URL` and
+* never sees a host or a port, so reconcile is free to bind whatever is
+* available and compose the URL from what it bound. An app reading `DB_HOST` and
+* `DB_PORT` separately could not be moved this way.
+*
+* Assignments are **persisted, not recomputed**. Recomputing means adding a
+* construct renumbers its neighbours, and every running container, saved
+* connection string, and `psql` history goes stale at once.
+*
+* Pure, with the liveness probe injected — a collision with another project's
+* stack is a fact about the machine, and keeping it a parameter is what lets the
+* rules be asserted without binding a socket.
+*/
+/**
 * The window ports are drawn from.
 *
 * Above the registered range so nothing here needs privileges, and below the
@@ -1437,6 +2184,27 @@ async function allocate(project, containers, existing = {}, probe = isPortFree)
 	}
 	return assignments;
 }
+/**
+* The ports to keep: what running containers are observed on, then what was
+* saved — minus any saved entry whose port something else already holds.
+*
+* Spreading one over the other let an observed port override its own key and
+* leave a *different* key still saved on the same number: two services on one
+* port, and whichever answered first won. Saved keys for containers the plan no
+* longer has — a backend switched and back — were the usual source. Observed
+* wins because it is what is actually bound; a dropped entry is simply
+* allocated again.
+*/
+function keptPorts(saved = {}, observed = {}) {
+	const kept = { ...observed };
+	const taken = new Set(Object.values(observed));
+	for (const [key, port] of Object.entries(saved).sort(([a], [b]) => a < b ? -1 : 1)) {
+		if (key in kept || taken.has(port)) continue;
+		kept[key] = port;
+		taken.add(port);
+	}
+	return kept;
+}
 /** The window was exhausted. */
 var NoPortAvailable = class extends Error {
 	/** Where the search started. */
@@ -1477,17 +2245,33 @@ async function nextFree(from, taken, probe) {
 * rather than as a connection failure ten minutes later.
 */
 function isPortFree(port) {
-	return new Promise((resolve$1) => {
+	return new Promise((resolve) => {
 		const server = createServer();
-		server.once("error", () => resolve$1(false));
-		server.once("listening", () => server.close(() => resolve$1(true)));
+		server.once("error", () => resolve(false));
+		server.once("listening", () => server.close(() => resolve(true)));
 		server.listen(port, "0.0.0.0");
 	});
 }
-
 //#endregion
 //#region src/reconcile/provision.ts
 /**
+* Creating what the URLs name.
+*
+* Convergent and idempotent: every statement asks whether the thing exists
+* first, so reconciling repeatedly is free and a half-applied run recovers by
+* being run again. That property is what lets `gkm dev` do this on every start.
+*
+* The line the design draws is at data, not at side effects — this creates
+* databases, schemas, and buckets, and it never seeds, resets, or drops. A
+* developer who wants their data gone asks for it explicitly.
+*
+* Statement generation is separated from application for the reason the design
+* gives: the same DDL has to run in-process locally and from a provisioner in a
+* VPC, and one implementation is what stops "works locally, fails deployed".
+* When the role DDL lands in `@geekmidas/db` this delegates to it rather than
+* growing its own.
+*/
+/**
 * The Postgres work a plan implies.
 *
 * Databases before the schemas inside them, which `provisionOrder` already
@@ -1584,6 +2368,7 @@ function rolesFor(resource, schema, plan, project) {
 		owner,
 		...reader ? { reader } : {},
 		schema,
+		...resource.kind === "database" ? { database: rootDatabase(resource, plan) } : {},
 		passwords: {
 			runtime: localRolePassword(project, plan, runtime),
 			owner: localRolePassword(project, plan, owner),
@@ -1629,8 +2414,7 @@ async function applyPostgres(client, statements) {
 			});
 			continue;
 		}
-		const rows = await client.query(statement.database, statement.exists.sql, statement.exists.values);
-		if (rows.length > 0) {
+		if ((await client.query(statement.database, statement.exists.sql, statement.exists.values)).length > 0) {
 			applied.push({
 				id: statement.id,
 				describe: statement.describe,
@@ -1697,6 +2481,66 @@ function bucketPolicy(bucket, open) {
 	});
 }
 /**
+* The topics and queues to create on the AWS emulator.
+*
+* Only on the `sns` backend: pg-boss makes its own tables on first connect and
+* a RabbitMQ exchange is declared by the client, but an SNS topic and an SQS
+* queue must exist before anything can publish to them.
+*/
+function carrierNames(plan) {
+	if (plan.events !== "sns") return {
+		topics: [],
+		queues: []
+	};
+	const named = (kind) => plan.resources.filter((r) => r.kind === kind).map((r) => r.name);
+	return {
+		topics: named("topic"),
+		queues: named("queue")
+	};
+}
+/** Create each topic and queue the plan names, skipping those that exist. */
+async function applyCarriers(client, carriers) {
+	const applied = [];
+	for (const name of carriers.topics) {
+		const created = !await client.topicExists(name);
+		if (created) await client.createTopic(name);
+		applied.push({
+			id: name,
+			describe: `topic ${name}`,
+			created
+		});
+	}
+	for (const name of carriers.queues) {
+		const created = !await client.queueExists(name);
+		if (created) await client.createQueue(name);
+		applied.push({
+			id: name,
+			describe: `queue ${name}`,
+			created
+		});
+	}
+	return applied;
+}
+/** The Postgres databases the plan creates — each is a `CREATE DATABASE`. */
+function postgresDatabaseNames(plan) {
+	return plan.resources.filter((resource) => resource.kind === "database" && resource.provisions && resource.container === "postgres").map((resource) => resource.name);
+}
+/**
+* Whether every one of these databases exists. A database dropped behind the
+* recorded state's back — by another checkout's test teardown, against the
+* same container — makes the state a lie, and only asking Postgres finds out.
+* Unreachable counts as missing: applying again is what finds out why.
+*/
+async function databasesExist(client, names) {
+	if (names.length === 0) return true;
+	try {
+		const rows = await client.query(void 0, "SELECT datname FROM pg_catalog.pg_database WHERE datname = ANY($1)", [names]);
+		return new Set(rows.map((row) => row.datname)).size === names.length;
+	} catch {
+		return false;
+	}
+}
+/**
 * Apply each served bucket's open-path policy, skipping those already correct.
 *
 * Compared as parsed JSON rather than as text: the same policy re-serialised
@@ -1755,9 +2599,20 @@ async function applyBuckets(client, buckets) {
 	}
 	return applied;
 }
-
 //#endregion
 //#region src/reconcile/state.ts
+/**
+* What reconcile records, and the hash that lets it do nothing.
+*
+* Reconciling on every `gkm dev` is only acceptable if the converged case is
+* free, so the desired plan is hashed: matching hash plus healthy containers
+* means there is nothing to do. Without that, the automatic reconcile the design
+* asks for would tax every start.
+*
+* Almost nothing needs recording — roles are queried, migrations have their own
+* table, containers are remembered by Docker. Only ports and this hash have no
+* other owner.
+*/
 const STATE_DIR = ".gkm/reconcile";
 /**
 * The hash of everything a reconcile would act on.
@@ -1786,7 +2641,7 @@ async function loadState(root, stage) {
 		const state = JSON.parse(raw);
 		return state.stage === stage ? state : void 0;
 	} catch {
-		return void 0;
+		return;
 	}
 }
 /** Record what was applied, so the next run can skip it. */
@@ -1795,14 +2650,46 @@ async function saveState(root, state) {
 	await mkdir(dirname(path), { recursive: true });
 	await writeFile(path, `${JSON.stringify(state, null, 2)}\n`);
 }
+/**
+* Forget what was applied, so the next reconcile of this stage converges from
+* nothing — creating again whatever was dropped underneath the record.
+*/
+async function forgetState(root, stage) {
+	await rm(statePath(root, stage), { force: true });
+}
 function statePath(root, stage) {
 	return join(root, STATE_DIR, `${stage}.json`);
 }
-
 //#endregion
 //#region src/reconcile/index.ts
-/** Where the generated compose file is written, relative to the project root. */
-const COMPOSE_PATH = ".gkm/docker-compose.yml";
+/**
+* Reconcile — the one convergent function `gkm dev`, `gkm test`, and `gkm setup`
+* all call.
+*
+* Three phases, and only this one has side effects: declaring is pure (`gkm
+* build` and the dev watcher), running reads `<NAME>_URL` and provisions
+* nothing. Reconcile computes the desired state, compares, and applies the
+* difference — which is what makes "when does it run" answerable with
+* *whenever, repeatedly*.
+*
+* It is safe to run automatically because its blast radius is entirely local:
+* this project's containers, this project's `.gkm/`. Nothing it does can reach a
+* cloud. The line is drawn at data, not at side effects — it allocates ports,
+* writes compose, starts containers, and creates roles; it never seeds, resets,
+* or drops.
+*
+* Docker is injected rather than imported so the rules above can be asserted
+* without a daemon. The default implementation is the real one.
+*/
+/**
+* Where the generated compose file is written, relative to the project root.
+*
+* At the root, beside the project's own `docker-compose.yml`, because the two
+* are one stack: this file is everything the constructs imply and is never
+* edited, that one is anything they cannot express — an image pin, an extra
+* service — and is merged over it, so it wins.
+*/
+const COMPOSE_PATH = "docker-compose.constructs.yml";
 /**
 * The local edge's config, beside the compose file that mounts it.
 *
@@ -1838,32 +2725,37 @@ const CADDY_ROOT_IN_CONTAINER = "/data/caddy/pki/authorities/local/root.crt";
 * hash and one health check.
 */
 async function reconcile(options) {
-	const { root, project, manifest, stage, start = true, provision = true, docker = dockerCli, probe = isPortFree, sql = pgClient, buckets = bucketClient } = options;
+	const { root, project, manifest, stage, start = true, provision = true, docker = dockerCli, probe = isPortFree, sql = pgClient, buckets = bucketClient, carriers = carrierClient } = options;
 	const plan = planFor(manifest, stage, provisionOrder(manifest), {
+		localStage: options.localStage,
 		events: options.events,
 		cache: options.cache,
 		extraContainers: options.extraContainers,
+		...options.fakes ? { fakes: options.fakes } : {},
 		...options.edge === void 0 ? {} : { edge: options.edge }
 	});
 	const composePath = join(root, COMPOSE_PATH);
-	const observed = await observedPorts(docker, composePath, plan.containers);
-	const ports = await allocate(project, portKeys(plan.containers), {
-		...options.saved,
-		...observed
-	}, probe);
+	const observed = await observedPorts(docker, composePath, plan.containers, plan.fakes);
+	const ports = await allocate(project, portKeys(plan.containers, plan.fakes), keptPorts(options.saved, observed), probe);
 	const compose = composeFor(plan, {
 		project,
 		ports,
-		...options.images ? { images: options.images } : {}
+		...options.apps ? { apps: options.apps(plan.containers) } : {}
 	});
 	const caddyfile = toCaddyfile(sitesFor(plan, project, options.addresses));
-	const hash = planHash(plan, compose, { caddyfile });
-	const addresses = addressesFor(plan.containers, ports);
+	const hash = planHash(plan, compose, {
+		caddyfile,
+		postgres: postgresStatements(plan, project).map((statement) => statement.create).join(";\n")
+	});
+	const services = serviceAddresses(plan.containers, ports, plan.fakes);
+	const lan = plan.resources.some((r) => r.kind === "mobile-app") ? options.lanAddress === void 0 ? lanAddress() : options.lanAddress ?? void 0 : void 0;
 	const env = envFor(plan, {
 		ports,
 		project,
 		...options.mailFrom ? { mailFrom: options.mailFrom } : {},
-		...options.addresses ? { addresses: options.addresses } : {}
+		...options.addresses ? { addresses: options.addresses } : {},
+		...lan ? { lanAddress: lan } : {},
+		...options.metroPorts ? { metroPorts: options.metroPorts } : {}
 	});
 	if (plan.containers.includes("caddy")) env.NODE_EXTRA_CA_CERTS = join(root, LOCAL_CA_PATH);
 	const result = {
@@ -1871,678 +2763,255 @@ async function reconcile(options) {
 		plan,
 		compose,
 		ports,
-		addresses,
+		services,
 		env,
 		provisioned: [],
+		fakes: options.fakes ?? {},
 		hash,
 		changed: false
 	};
 	const recorded = await loadState(root, stage);
-	const converged = recorded?.hash === hash && (!start || await docker.healthy(composePath, plan.containers));
-	if (converged) return result;
+	const postgresPort = ports[primaryPortKey("postgres")];
+	if (recorded?.hash === hash && existsSync(composePath) && (!start || await docker.healthy(composePath, plan.containers)) && (!start || !provision || postgresPort === void 0 || await databasesExist(sql(postgresPort), postgresDatabaseNames(plan)))) return result;
 	await write(composePath, toYaml(compose));
 	if (plan.containers.includes("caddy")) {
 		await write(join(root, CADDYFILE_PATH), caddyfileRoot());
-		await write(join(root, caddySitesPath(stage)), caddyfile);
-	}
-	if (start && plan.containers.length > 0) await docker.up(composePath, plan.containers);
-	if (start && plan.containers.includes("caddy")) await docker.reload(composePath, "caddy").catch(() => {});
-	if (start && plan.containers.includes("caddy")) await docker.copyOut(composePath, "caddy", CADDY_ROOT_IN_CONTAINER, join(root, LOCAL_CA_PATH)).catch(() => {});
-	const provisioned = start && provision ? await create(plan, ports, sql, buckets, project) : [];
-	await saveState(root, {
-		hash,
-		stage
-	});
-	return {
-		...result,
-		provisioned,
-		changed: true
-	};
-}
-/**
-* Create the databases, schemas, and buckets the plan names.
-*
-* Idempotent throughout, so this runs on every non-converged reconcile rather
-* than being something to remember.
-*/
-async function create(plan, ports, sql, buckets, project) {
-	const applied = [];
-	const postgresPort = ports[primaryPortKey("postgres")];
-	const statements = postgresStatements(plan, project);
-	if (postgresPort !== void 0 && statements.length > 0) applied.push(...await applyPostgres(sql(postgresPort), statements));
-	const minioPort = ports[primaryPortKey("minio")];
-	const names = bucketNames(plan);
-	const policies = bucketPolicies(plan);
-	if (minioPort !== void 0 && (names.length > 0 || policies.length > 0)) {
-		const client = buckets(minioPort);
-		if (names.length > 0) applied.push(...await applyBuckets(client, names));
-		if (policies.length > 0) applied.push(...await applyPolicies(client, policies));
-	}
-	return applied;
-}
-/**
-* The host ports of containers already running.
-*
-* Keyed the same way allocation keys them, so the two merge without either
-* knowing about the other.
-*/
-async function observedPorts(docker, composePath, containers) {
-	const observed = {};
-	for (const container of containers) for (const port of portsOf(container)) {
-		const running = await docker.publishedPort(composePath, container, port.inside);
-		if (running !== void 0) observed[port.key] = running;
-	}
-	return observed;
-}
-/**
-* Where each container can be reached on this machine.
-*
-* The primary port only — a container's console is for a human to open, not
-* something an app connects to.
-*/
-function addressesFor(containers, ports) {
-	const addresses = {};
-	for (const container of containers) {
-		const port = ports[primaryPortKey(container)];
-		if (port !== void 0) addresses[container] = `localhost:${port}`;
-	}
-	return addresses;
-}
-/** Write a file only when its content would change, so mtimes stay meaningful. */
-async function write(path, content) {
-	try {
-		if (await readFile(path, "utf-8") === content) return;
-	} catch {}
-	await mkdir(dirname(path), { recursive: true });
-	await writeFile(path, content);
-}
-
-//#endregion
-//#region src/reconcile/workspace.ts
-/**
-* Every constructs glob in the workspace, resolved against its app.
-*
-* Absolute because discovery globs from a single cwd while apps live in
-* different directories.
-*/
-function constructGlobs(workspace) {
-	return allConstructGlobs(workspace);
-}
-/** Whether any app has adopted the constructs glob. */
-function usesConstructs(workspace) {
-	return constructGlobs(workspace).length > 0;
-}
-/**
-* Image pins, by container. The config half of the derived/config split.
-*
-* Read from `services.images` rather than from the backend keys beside it.
-* They used to share one key, which is how `cache: true` came to mean "start a
-* Redis" — the last way a container could exist because config asked for one
-* instead of because something declared it.
-*/
-function imagePins(workspace) {
-	return { ...workspace.services.images };
-}
-/**
-* The containers a workspace's declarations imply, without reconciling.
-*
-* The same derivation `reconcileWorkspace` makes, available to callers that
-* need to know *what would run* without starting anything or writing ports —
-* `gkm setup` deciding which credentials to generate, `gkm docker` writing a
-* compose file. Those used to each read a boolean per service out of config,
-* which is how a container could exist because config asked for one rather than
-* because something declared it.
-*/
-async function derivedContainers(workspace, stage, manifest) {
-	const found = manifest ?? await discover({
-		patterns: constructGlobs(workspace),
-		cwd: workspace.root
-	});
-	return planFor(found, stage, provisionOrder(found), {
-		events: workspace.services.events,
-		cache: cacheBackendOf(workspace.services.cache, providerOf(workspace))
-	}).containers;
-}
-/**
-* Reconcile a workspace for one stage.
-*
-* Ports are loaded and saved around the call rather than inside it, so the loop
-* stays a pure-ish function of its inputs and the store keeps its single owner.
-*/
-async function reconcileWorkspace(workspace, options) {
-	const manifest = options.manifest ?? await discover({
-		patterns: constructGlobs(workspace),
-		cwd: workspace.root
-	});
-	const result = await reconcile({
-		root: workspace.root,
-		project: workspace.name,
-		manifest,
-		stage: options.stage,
-		events: workspace.services.events,
-		cache: cacheBackendOf(workspace.services.cache, providerOf(workspace)),
-		images: imagePins(workspace),
-		saved: await loadPortState(workspace.root),
-		addresses: surfaceAddresses(workspace, manifest),
-		...options.start === void 0 ? {} : { start: options.start }
-	});
-	await savePortState(workspace.root, { ...result.ports });
-	return result;
-}
-/**
-* Where each declared surface and site answers locally.
-*
-* The addresses come from the ports the workspace already assigns; which
-* construct sits at which one comes from the manifest. That split is the point:
-* this used to answer "who may call whom" by listing every app the workspace
-* runs, which is a different question that happened to give the same answer in
-* a single-repo workspace and no answer at all deployed. Now it answers only
-* "where does this construct answer", and the graph answers the rest.
-*
-* A site is matched to its app by `path`, because that is the one thing a site
-* declaration and a workspace app both name. Surfaces are matched to the
-* backend app: every `rest-api` in a process answers on that process's port, so
-* an app serving both its own API and an auth server publishes one address
-* twice — which is exactly what it does at runtime.
-*/
-function surfaceAddresses(workspace, manifest) {
-	const addresses = {};
-	for (const [id, declaration] of Object.entries(manifest)) {
-		if (declaration.kind !== "rest-api" && declaration.kind !== "site") continue;
-		const host = declaration.kind === "site" ? appKey(id) : appKeyOfHost(manifest, id);
-		const app = host ? workspace.apps[host] : void 0;
-		if (app?.port) addresses[id] = localAddress(app.port);
-	}
-	return addresses;
-}
-/** The app key serving a surface, following a mount to its host. */
-function appKeyOfHost(manifest, id) {
-	const host = hostOf(manifest, id);
-	return host ? appKey(host) : void 0;
-}
-/** Where a local process answers, given the port the workspace gave it. */
-function localAddress(port) {
-	return `http://localhost:${port}`;
-}
-
-//#endregion
-//#region src/credentials/index.ts
-const logger = console;
-/**
-* Load environment files
-* @internal Exported for testing
-*/
-function loadEnvFiles(envConfig, cwd = process.cwd()) {
-	const loaded = [];
-	const missing = [];
-	const envFiles = envConfig ? Array.isArray(envConfig) ? envConfig : [envConfig] : [".env"];
-	for (const envFile of envFiles) {
-		const envPath = resolve(cwd, envFile);
-		if (existsSync(envPath)) {
-			config({
-				path: envPath,
-				override: true,
-				quiet: true
-			});
-			loaded.push(envFile);
-		} else if (envConfig) missing.push(envFile);
-	}
-	return {
-		loaded,
-		missing
-	};
-}
-/**
-* Check if a port is available
-* @internal Exported for testing
-*/
-async function isPortAvailable(port) {
-	return new Promise((resolve$1) => {
-		const server = createServer();
-		server.once("error", (err) => {
-			if (err.code === "EADDRINUSE") resolve$1(false);
-			else resolve$1(false);
-		});
-		server.once("listening", () => {
-			server.close();
-			resolve$1(true);
-		});
-		server.listen(port);
-	});
-}
-/**
-* Find an available port starting from the preferred port
-* @internal Exported for testing
-*/
-async function findAvailablePort(preferredPort, maxAttempts = 10) {
-	for (let i = 0; i < maxAttempts; i++) {
-		const port = preferredPort + i;
-		if (await isPortAvailable(port)) return port;
-		logger.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
-	}
-	throw new Error(`Could not find an available port after trying ${maxAttempts} ports starting from ${preferredPort}`);
-}
-const PORT_STATE_PATH = ".gkm/ports.json";
-/**
-* Parse docker-compose.yml and extract all port mappings that use env var interpolation.
-* Entries like `'${POSTGRES_HOST_PORT:-5432}:5432'` are captured.
-* Fixed port mappings like `'5050:80'` are skipped.
-* @internal Exported for testing
-*/
-function parseComposePortMappings(composePath) {
-	if (!existsSync(composePath)) return [];
-	const content = readFileSync(composePath, "utf-8");
-	const compose = parse$1(content);
-	if (!compose?.services) return [];
-	const results = [];
-	for (const [serviceName, serviceConfig] of Object.entries(compose.services)) for (const portMapping of serviceConfig?.ports ?? []) {
-		const match = String(portMapping).match(/\$\{(\w+):-(\d+)\}:(\d+)/);
-		if (match?.[1] && match[2] && match[3]) results.push({
-			service: serviceName,
-			envVar: match[1],
-			defaultPort: Number(match[2]),
-			containerPort: Number(match[3])
-		});
-	}
-	return results;
-}
-/**
-* Load saved port state from .gkm/ports.json.
-* @internal Exported for testing
-*/
-async function loadPortState(workspaceRoot) {
-	try {
-		const raw = await readFile(join(workspaceRoot, PORT_STATE_PATH), "utf-8");
-		return JSON.parse(raw);
-	} catch {
-		return {};
-	}
-}
-/**
-* Save port state to .gkm/ports.json.
-* @internal Exported for testing
-*/
-async function savePortState(workspaceRoot, ports) {
-	const dir = join(workspaceRoot, ".gkm");
-	await mkdir(dir, { recursive: true });
-	await writeFile(join(workspaceRoot, PORT_STATE_PATH), `${JSON.stringify(ports, null, 2)}\n`);
-}
-/**
-* Check if a project's own Docker container is running and return its host port.
-* Uses `docker compose port` scoped to the project's compose file.
-* @internal Exported for testing
-*/
-function getContainerHostPort(workspaceRoot, service, containerPort) {
-	try {
-		const result = execSync(`docker compose port ${service} ${containerPort}`, {
-			cwd: workspaceRoot,
-			stdio: "pipe"
-		}).toString().trim();
-		const match = result.match(/:(\d+)$/);
-		return match ? Number(match[1]) : null;
-	} catch {
-		return null;
+		await write(join(root, caddySitesPath(stage)), caddyfile);
+		await pruneCaddySites(root, [
+			stage,
+			options.localStage,
+			TEST_STAGE
+		]);
 	}
-}
-/**
-* Resolve host ports for Docker services by parsing docker-compose.yml.
-* Priority: running container → saved state → find available port.
-* Persists resolved ports to .gkm/ports.json.
-* @internal Exported for testing
-*/
-async function resolveServicePorts(workspaceRoot) {
-	const composePath = join(workspaceRoot, "docker-compose.yml");
-	const mappings = parseComposePortMappings(composePath);
-	if (mappings.length === 0) return {
-		dockerEnv: {},
-		ports: {},
-		mappings: []
-	};
-	const savedState = await loadPortState(workspaceRoot);
-	const dockerEnv = {};
-	const ports = {};
-	const assignedPorts = /* @__PURE__ */ new Set();
-	logger.log("\n🔌 Resolving service ports...");
-	for (const mapping of mappings) {
-		const containerPort = getContainerHostPort(workspaceRoot, mapping.service, mapping.containerPort);
-		if (containerPort !== null) {
-			ports[mapping.envVar] = containerPort;
-			dockerEnv[mapping.envVar] = String(containerPort);
-			assignedPorts.add(containerPort);
-			logger.log(`   🔄 ${mapping.service}:${mapping.containerPort}: reusing existing container on port ${containerPort}`);
-			continue;
-		}
-		const savedPort = savedState[mapping.envVar];
-		if (savedPort && !assignedPorts.has(savedPort) && await isPortAvailable(savedPort)) {
-			ports[mapping.envVar] = savedPort;
-			dockerEnv[mapping.envVar] = String(savedPort);
-			assignedPorts.add(savedPort);
-			logger.log(`   💾 ${mapping.service}:${mapping.containerPort}: using saved port ${savedPort}`);
-			continue;
-		}
-		let resolvedPort = await findAvailablePort(mapping.defaultPort);
-		while (assignedPorts.has(resolvedPort)) resolvedPort = await findAvailablePort(resolvedPort + 1);
-		ports[mapping.envVar] = resolvedPort;
-		dockerEnv[mapping.envVar] = String(resolvedPort);
-		assignedPorts.add(resolvedPort);
-		if (resolvedPort !== mapping.defaultPort) logger.log(`   ⚡ ${mapping.service}:${mapping.containerPort}: port ${mapping.defaultPort} occupied, using port ${resolvedPort}`);
-		else logger.log(`   ✅ ${mapping.service}:${mapping.containerPort}: using default port ${resolvedPort}`);
+	if (start && plan.containers.length > 0) {
+		options.progress?.(`🐳 Starting ${plan.containers.join(", ")} — the first start pulls each image, which can take a few minutes`);
+		await docker.up(composePath, plan.containers, options.progress ? { show: true } : {});
 	}
-	await savePortState(workspaceRoot, ports);
+	if (start && plan.containers.includes("caddy")) await docker.reload(composePath, "caddy").catch(() => {});
+	if (start && plan.containers.includes("caddy")) await docker.copyOut(composePath, "caddy", CADDY_ROOT_IN_CONTAINER, join(root, LOCAL_CA_PATH)).catch(() => {});
+	if (start && provision) options.progress?.("🗄️  Creating what the constructs declare — databases, roles, buckets, topics");
+	const provisioned = start && provision ? await create(plan, ports, sql, buckets, carriers, project) : [];
+	await saveState(root, {
+		hash,
+		stage
+	});
 	return {
-		dockerEnv,
-		ports,
-		mappings
+		...result,
+		provisioned,
+		changed: true
 	};
 }
 /**
-* Replace a port in a URL string.
-* Handles both `hostname:port` and `localhost:port` patterns.
-* @internal Exported for testing
+* Create the databases, schemas, buckets, topics and queues the plan names.
+*
+* Idempotent throughout, so this runs on every non-converged reconcile rather
+* than being something to remember.
 */
-function replacePortInUrl(url, oldPort, newPort) {
-	if (oldPort === newPort) return url;
-	let result = url.replace(new RegExp(`:${oldPort}(?=[/?#]|$)`, "g"), `:${newPort}`);
-	result = result.replace(new RegExp(`%3A${oldPort}(?=[%/?#&]|$)`, "gi"), `%3A${newPort}`);
-	return result;
+async function create(plan, ports, sql, buckets, emulatorCarriers, project) {
+	const applied = [];
+	const postgresPort = ports[primaryPortKey("postgres")];
+	const statements = postgresStatements(plan, project);
+	if (postgresPort !== void 0 && statements.length > 0) applied.push(...await applyPostgres(sql(postgresPort), statements));
+	const minioPort = ports[primaryPortKey("minio")];
+	const names = bucketNames(plan);
+	const policies = bucketPolicies(plan);
+	if (minioPort !== void 0 && (names.length > 0 || policies.length > 0)) {
+		const client = buckets(minioPort);
+		if (names.length > 0) applied.push(...await applyBuckets(client, names));
+		if (policies.length > 0) applied.push(...await applyPolicies(client, policies));
+	}
+	const emulatorPort = ports[primaryPortKey("localstack")];
+	const carriers = carrierNames(plan);
+	if (emulatorPort !== void 0 && carriers.topics.length + carriers.queues.length > 0) applied.push(...await applyCarriers(emulatorCarriers(emulatorPort), carriers));
+	return applied;
 }
 /**
-* Rewrite connection URLs and port vars in secrets with resolved ports.
-* Uses the parsed compose mappings to determine which default ports to replace.
-* Pure transform — does not modify secrets on disk.
-* @internal Exported for testing
+* The host ports of containers already running.
+*
+* Keyed the same way allocation keys them, so the two merge without either
+* knowing about the other.
 */
-function rewriteUrlsWithPorts(secrets, resolvedPorts) {
-	const { ports, mappings } = resolvedPorts;
-	const result = { ...secrets };
-	const portReplacements = [];
-	const serviceNames = /* @__PURE__ */ new Set();
-	for (const mapping of mappings) {
-		serviceNames.add(mapping.service);
-		const resolved = ports[mapping.envVar];
-		if (resolved !== void 0) portReplacements.push({
-			defaultPort: mapping.defaultPort,
-			resolvedPort: resolved
-		});
-	}
-	for (const [key, value] of Object.entries(result)) {
-		if (!key.endsWith("_HOST")) continue;
-		if (serviceNames.has(value)) result[key] = "localhost";
-	}
-	for (const [key, value] of Object.entries(result)) {
-		if (!key.endsWith("_PORT")) continue;
-		for (const { defaultPort, resolvedPort } of portReplacements) if (value === String(defaultPort)) result[key] = String(resolvedPort);
-	}
-	for (const [key, value] of Object.entries(result)) {
-		if (!key.endsWith("_URL") && !key.endsWith("_ENDPOINT") && !key.endsWith("_CONNECTION_STRING") && key !== "DATABASE_URL") continue;
-		let rewritten = value;
-		for (const name of serviceNames) rewritten = rewritten.replace(new RegExp(`@${name}:`, "g"), "@localhost:");
-		for (const { defaultPort, resolvedPort } of portReplacements) rewritten = replacePortInUrl(rewritten, defaultPort, resolvedPort);
-		result[key] = rewritten;
+async function observedPorts(docker, composePath, containers, fakes) {
+	const observed = {};
+	for (const container of containers) for (const port of portsOf(container, fakes)) {
+		const running = await docker.publishedPort(composePath, container, port.inside);
+		if (running !== void 0) observed[port.key] = running;
 	}
-	return result;
+	return observed;
 }
+/** Write a file only when its content would change, so mtimes stay meaningful. */
 /**
-* Build the environment variables to pass to `docker compose up`.
-* Merges process.env, secrets, and port mappings so that Docker Compose
-* can interpolate variables like ${POSTGRES_USER} correctly.
-* @internal Exported for testing
+* Remove the routes of stages this project no longer reconciles.
+*
+* Only the local stage and `test` are ever written, so any other file is left
+* over from a stage that was renamed — `development` becoming `dev`. Caddy
+* imports every file, and the leftover declares the same hosts as its
+* replacement: it refuses the whole config as ambiguous, and every URL behind
+* the edge goes with it.
 */
-function buildDockerComposeEnv(secretsEnv, portEnv) {
-	return {
-		...process.env,
-		...secretsEnv,
-		...portEnv
-	};
+async function pruneCaddySites(root, stages) {
+	const dir = dirname(join(root, caddySitesPath(TEST_STAGE)));
+	const keep = new Set(stages.map((stage) => stage && `${stage}.caddy`));
+	for (const file of await readdir(dir)) if (file.endsWith(".caddy") && !keep.has(file)) await rm(join(dir, file));
 }
-/**
-* Parse all service names from a docker-compose.yml file.
-* @internal Exported for testing
-*/
-function parseComposeServiceNames(composePath) {
-	if (!existsSync(composePath)) return [];
-	const content = readFileSync(composePath, "utf-8");
-	const compose = parse$1(content);
-	return Object.keys(compose?.services ?? {});
+async function write(path, content) {
+	try {
+		if (await readFile(path, "utf-8") === content) return;
+	} catch {}
+	await mkdir(dirname(path), { recursive: true });
+	await writeFile(path, content);
 }
+//#endregion
+//#region src/reconcile/workspace.ts
 /**
-* Start docker-compose services for a single-app project (no workspace config).
-* Starts all services defined in docker-compose.yml.
+* Workspace config → reconcile.
+*
+* Nothing here is read from a `services:` block — there is none. Which
+* containers exist comes from the manifest; which backend a cache or a broker
+* resolves to comes from the deploy target; and an image pin is the project's
+* own `docker-compose.yml`, merged over the generated file.
+*
+* Shared by `gkm setup`, `gkm dev`, and `gkm test` so all three converge on the
+* same state, differing only in the stage they pass.
 */
-async function startComposeServices(cwd, portEnv, secretsEnv) {
-	const composeFile = join(cwd, "docker-compose.yml");
-	if (!existsSync(composeFile)) return;
-	const servicesToStart = parseComposeServiceNames(composeFile);
-	if (servicesToStart.length === 0) return;
-	logger.log(`🐳 Starting services: ${servicesToStart.join(", ")}`);
-	try {
-		execSync(`docker compose up -d ${servicesToStart.join(" ")}`, {
-			cwd,
-			stdio: "inherit",
-			env: buildDockerComposeEnv(secretsEnv, portEnv)
-		});
-		logger.log("✅ Services started");
-	} catch (error) {
-		logger.error("❌ Failed to start services:", error.message);
-		throw error;
-	}
-}
+var workspace_exports = /* @__PURE__ */ __exportAll({
+	FAKE_ENV: () => FAKE_ENV,
+	backendsOf: () => backendsOf,
+	constructGlobs: () => constructGlobs,
+	derivedContainers: () => derivedContainers,
+	fakesApply: () => fakesApply,
+	metroPorts: () => metroPorts,
+	reconcileWorkspace: () => reconcileWorkspace,
+	surfaceAddresses: () => surfaceAddresses
+});
 /**
-* Start docker-compose services for a workspace.
-* Discovers all services from docker-compose.yml and starts everything
-* except app services (which are managed by turbo).
-* @internal Exported for testing
+* Every constructs glob in the workspace, resolved against its app.
+*
+* Absolute because discovery globs from a single cwd while apps live in
+* different directories.
 */
-async function startWorkspaceServices(workspace, portEnv, secretsEnv) {
-	const composeFile = join(workspace.root, "docker-compose.yml");
-	if (!existsSync(composeFile)) return;
-	const allServices = parseComposeServiceNames(composeFile);
-	const appNames = new Set(Object.keys(workspace.apps));
-	const servicesToStart = allServices.filter((name) => !appNames.has(name));
-	if (servicesToStart.length === 0) return;
-	logger.log(`🐳 Starting services: ${servicesToStart.join(", ")}`);
-	try {
-		execSync(`docker compose up -d ${servicesToStart.join(" ")}`, {
-			cwd: workspace.root,
-			stdio: "inherit",
-			env: buildDockerComposeEnv(secretsEnv, portEnv)
-		});
-		logger.log("✅ Services started");
-	} catch (error) {
-		logger.error("❌ Failed to start services:", error.message);
-		throw error;
-	}
+function constructGlobs(workspace) {
+	return allConstructGlobs(workspace);
+}
+/** The backends a workspace's target implies, as the plan takes them. */
+function backendsOf(workspace) {
+	const on = providerOf(workspace);
+	return {
+		events: eventsBackendFor(on),
+		cache: cacheBackendFor(on)
+	};
 }
 /**
-* Load and flatten secrets for an app from encrypted storage.
-* For workspace app: maps {APP}_DATABASE_URL → DATABASE_URL.
-* @internal Exported for testing
+* The containers a workspace's declarations imply, without reconciling.
+*
+* The same derivation `reconcileWorkspace` makes, available to callers that
+* need to know *what would run* without starting anything or writing ports —
+* `gkm setup` deciding which credentials to generate, `gkm docker` writing a
+* compose file. Those used to each read a boolean per service out of config,
+* which is how a container could exist because config asked for one rather than
+* because something declared it.
 */
-async function loadSecretsForApp(secretsRoot, appName, stages = ["dev", "development"]) {
-	let secrets = {};
-	for (const stage of stages) if (secretsExist(stage, secretsRoot)) {
-		const stageSecrets = await readStageSecrets(stage, secretsRoot);
-		if (stageSecrets) {
-			logger.log(`🔐 Loading secrets from stage: ${stage}`);
-			secrets = toEmbeddableSecrets(stageSecrets);
-			break;
-		}
-	}
-	if (Object.keys(secrets).length === 0) return {};
-	if (!appName) return secrets;
-	const prefix = appName.toUpperCase();
-	const mapped = { ...secrets };
-	const appDbUrl = secrets[`${prefix}_DATABASE_URL`];
-	if (appDbUrl) mapped.DATABASE_URL = appDbUrl;
-	return mapped;
+async function derivedContainers(workspace, stage, manifest) {
+	const found = manifest ?? await discover({
+		patterns: constructGlobs(workspace),
+		cwd: workspace.root
+	});
+	return planFor(found, stage, provisionOrder(found), {
+		localStage: workspace.stages.local,
+		...backendsOf(workspace)
+	}).containers;
 }
 /**
-* Walk up the directory tree to find the root containing .gkm/secrets/.
-* @internal Exported for testing
+* Set by `gkm dev --fake` for the apps it starts. Each app's own `gkm dev`
+* reconciles too, and must answer the way the workspace did.
 */
-function findSecretsRoot(startDir) {
-	let dir = startDir;
-	while (dir !== "/") {
-		if (existsSync(join(dir, ".gkm", "secrets"))) return dir;
-		const parent = dirname(dir);
-		if (parent === dir) break;
-		dir = parent;
-	}
-	return startDir;
-}
+const FAKE_ENV = "GKM_FAKE";
 /**
-* Generate the credentials injection code snippet.
-* This is the common logic used by both entry wrapper and exec preload.
-* @internal
+* Whether external APIs are faked: always for `gkm test`, and for `gkm dev`
+* only when asked — by `--fake`, or by the workspace that started this app
+* with it. Never for anything acting on a deployed stage.
 */
-function generateCredentialsInjection(secretsJsonPath) {
-	return `import { existsSync, readFileSync } from 'node:fs';
-
-// Inject dev secrets via globalThis and process.env
-// Using globalThis.__gkm_credentials__ avoids CJS/ESM interop issues where
-// Object.assign on the Credentials export only mutates one module copy.
-const secretsPath = '${secretsJsonPath}';
-if (existsSync(secretsPath)) {
-  const secrets = JSON.parse(readFileSync(secretsPath, 'utf-8'));
-  globalThis.__gkm_credentials__ = secrets;
-  Object.assign(process.env, secrets);
-}
-`;
+function fakesApply(stage, fake, env = process.env) {
+	return fake === true || stage === "test" || env["GKM_FAKE"] === "1";
 }
 /**
-* Create a preload script that injects secrets into Credentials.
-* Used by `gkm exec` to inject secrets before running any command.
-* @internal Exported for testing
+* Reconcile a workspace for one stage.
+*
+* Ports are loaded and saved around the call rather than inside it, so the loop
+* stays a pure-ish function of its inputs and the store keeps its single owner.
 */
-async function createCredentialsPreload(preloadPath, secretsJsonPath) {
-	const content = `/**
- * Credentials preload generated by 'gkm exec'
- * This file is loaded via NODE_OPTIONS="--import <path>"
- */
-${generateCredentialsInjection(secretsJsonPath)}`;
-	await writeFile(preloadPath, content);
+async function reconcileWorkspace(workspace, options) {
+	const runnables = {};
+	const discovered = await discover({
+		patterns: constructGlobs(workspace),
+		cwd: workspace.root,
+		runnables
+	});
+	const manifest = options.manifest ?? discovered;
+	const fakes = fakesApply(options.stage, options.fake) ? await readFakes(workspace.root, manifest) : {};
+	const result = await reconcile({
+		root: workspace.root,
+		project: workspace.name,
+		manifest,
+		stage: options.stage,
+		localStage: workspace.stages.local,
+		...backendsOf(workspace),
+		saved: await loadPortState(workspace.root),
+		addresses: surfaceAddresses(workspace, manifest),
+		metroPorts: metroPorts(workspace, manifest),
+		fakes,
+		apps: (containers) => appServices(workspace, manifest, containers, runnables, fakes),
+		...options.start === void 0 ? {} : { start: options.start },
+		...options.progress ? { progress: options.progress } : {}
+	});
+	await savePortState(workspace.root, { ...result.ports });
+	return result;
 }
 /**
-* Create a wrapper script that injects secrets before importing the entry file.
-* @internal Exported for testing
+* Where each mobile app's Metro runs: its app's port, which `gkm exec` hands
+* Expo as `RCT_METRO_PORT`. Kept apart from the surfaces' addresses — a phone
+* reaches Metro by `exp://`, not through the edge.
 */
-async function createEntryWrapper(wrapperPath, entryPath, secretsJsonPath) {
-	const credentialsInjection = secretsJsonPath ? `${generateCredentialsInjection(secretsJsonPath)}
-` : "";
-	const content = `#!/usr/bin/env node
-/**
- * Entry wrapper generated by 'gkm dev --entry'
- */
-${credentialsInjection}// Import and run the user's entry file (dynamic import ensures secrets load first)
-await import('${entryPath}');
-`;
-	await writeFile(wrapperPath, content);
+function metroPorts(workspace, manifest) {
+	const ports = {};
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration.kind !== "mobile-app") continue;
+		const port = workspace.apps[appKey(id)]?.port;
+		if (port) ports[id] = port;
+	}
+	return ports;
 }
 /**
-* Prepare credentials for dev/exec/test modes.
-* Loads workspace config, secrets, resolves Docker ports, rewrites URLs,
-* injects PORT, dependency URLs, and writes credentials JSON.
+* Where each declared surface and site answers locally.
 *
-* @param options.resolveDockerPorts - How to resolve Docker ports:
-*   - `'full'` (default): probe running containers, saved state, then find available ports. Used by dev/test.
-*   - `'readonly'`: check running containers and saved state only, never probe for new ports. Used by exec.
-* @param options.stages - Secret stages to try, in order. Default: ['dev', 'development'].
-* @param options.startDocker - Start Docker Compose services after port resolution. Default: false.
-* @param options.secretsFileName - Custom secrets JSON filename. Default: 'dev-secrets-{appName}.json' or 'dev-secrets.json'.
-* @internal Exported for testing
+* The addresses come from the ports the workspace already assigns; which
+* construct sits at which one comes from the manifest. That split is the point:
+* this used to answer "who may call whom" by listing every app the workspace
+* runs, which is a different question that happened to give the same answer in
+* a single-repo workspace and no answer at all deployed. Now it answers only
+* "where does this construct answer", and the graph answers the rest.
+*
+* A site is matched to its app by `path`, because that is the one thing a site
+* declaration and a workspace app both name. Surfaces are matched to the
+* backend app: every `rest-api` in a process answers on that process's port, so
+* an app serving both its own API and an auth server publishes one address
+* twice — which is exactly what it does at runtime.
 */
-async function prepareEntryCredentials(options) {
-	const cwd = options.cwd ?? process.cwd();
-	const portMode = options.resolveDockerPorts ?? "full";
-	let workspaceAppPort;
-	let secretsRoot = cwd;
-	let appName;
-	let appInfo;
-	try {
-		appInfo = await loadWorkspaceAppInfo(cwd);
-		workspaceAppPort = appInfo.app.port;
-		secretsRoot = appInfo.workspaceRoot;
-		appName = appInfo.appName;
-	} catch {
-		secretsRoot = findSecretsRoot(cwd);
-		appName = getAppNameFromCwd(cwd) ?? void 0;
-	}
-	const resolvedPort = options.explicitPort ?? workspaceAppPort ?? 3e3;
-	const credentials = await loadSecretsForApp(secretsRoot, appName, options.stages);
-	credentials.PORT = String(resolvedPort);
-	const declaredKeys = [];
-	if (appInfo && usesConstructs(appInfo.workspace)) {
-		const { reconcileWorkspace: reconcileWorkspace$1 } = await import("./workspace-k4l3rsFh.mjs");
-		const reconciled = await reconcileWorkspace$1(appInfo.workspace, {
-			stage: options.reconcileStage ?? "development",
-			start: options.startDocker ?? false
-		});
-		Object.assign(credentials, reconciled.env);
-		declaredKeys.push(...Object.keys(reconciled.env));
-		if (Object.keys(reconciled.env).length > 0) logger.log(`🔌 Resolved ${Object.keys(reconciled.env).length} declared URL(s)`);
-	} else {
-		const composePath = join(secretsRoot, "docker-compose.yml");
-		const mappings = parseComposePortMappings(composePath);
-		if (mappings.length > 0) {
-			let resolvedPorts;
-			if (portMode === "full") resolvedPorts = await resolveServicePorts(secretsRoot);
-			else {
-				const savedPorts = await loadPortState(secretsRoot);
-				const ports = {};
-				for (const mapping of mappings) {
-					const containerPort = getContainerHostPort(secretsRoot, mapping.service, mapping.containerPort);
-					if (containerPort !== null) ports[mapping.envVar] = containerPort;
-					else {
-						const saved = savedPorts[mapping.envVar];
-						if (saved !== void 0) ports[mapping.envVar] = saved;
-					}
-				}
-				resolvedPorts = {
-					dockerEnv: {},
-					ports,
-					mappings
-				};
-			}
-			if (options.startDocker) if (appInfo) await startWorkspaceServices(appInfo.workspace, resolvedPorts.dockerEnv, credentials);
-			else await startComposeServices(secretsRoot, resolvedPorts.dockerEnv, credentials);
-			if (Object.keys(resolvedPorts.ports).length > 0) {
-				const rewritten = rewriteUrlsWithPorts(credentials, resolvedPorts);
-				Object.assign(credentials, rewritten);
-				logger.log(`🔌 Applied ${Object.keys(resolvedPorts.ports).length} port mapping(s)`);
-			}
-		}
-	}
-	if (appInfo?.appName) {
-		const depEnv = getDependencyEnvVars(appInfo.workspace, appInfo.appName);
-		Object.assign(credentials, depEnv);
-	}
-	if (!credentials.EVENT_PUBLISHER_CONNECTION_STRING && !credentials.EVENT_SUBSCRIBER_CONNECTION_STRING && credentials.PGBOSS_DB_USER) {
-		const pgbossUrl = generatePgBossUrl({
-			username: credentials.PGBOSS_DB_USER,
-			password: credentials.PGBOSS_DB_PASSWORD ?? "",
-			host: credentials.POSTGRES_HOST ?? "localhost",
-			port: Number(credentials.POSTGRES_PORT ?? "5432"),
-			database: credentials.POSTGRES_DB ?? "app"
-		});
-		credentials.EVENT_PUBLISHER_CONNECTION_STRING = pgbossUrl;
-		credentials.EVENT_SUBSCRIBER_CONNECTION_STRING = pgbossUrl;
+function surfaceAddresses(workspace, manifest, at = (_app, port) => localAddress(port)) {
+	const addresses = {};
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration.kind !== "rest-api" && declaration.kind !== "site") continue;
+		const host = appKey(id);
+		const port = workspace.apps[host]?.port;
+		if (port) addresses[id] = at(host, port);
 	}
-	const secretsDir = join(secretsRoot, ".gkm");
-	await mkdir(secretsDir, { recursive: true });
-	const secretsFileName = options.secretsFileName ?? (appName ? `dev-secrets-${appName}.json` : "dev-secrets.json");
-	const secretsJsonPath = join(secretsDir, secretsFileName);
-	await writeFile(secretsJsonPath, JSON.stringify(credentials, null, 2));
-	return {
-		credentials,
-		resolvedPort,
-		secretsJsonPath,
-		appName,
-		secretsRoot,
-		appInfo,
-		declaredKeys
-	};
+	return addresses;
+}
+/** Where a local process answers, given the port the workspace gave it. */
+function localAddress(port) {
+	return `http://localhost:${port}`;
 }
-
 //#endregion
-export { LOCAL_CA_PATH, applyPostgres, cacheBackendOf, constructGlobs, createCredentialsPreload, createEntryWrapper, derivedContainers, emailBackendOf, findAvailablePort, imagePins, isPortAvailable, loadEnvFiles, loadSecretsForApp, prepareEntryCredentials, providerOf, reconcileWorkspace, resolveServicePorts, resourceName, rewriteUrlsWithPorts, startWorkspaceServices, storageBackendOf, usesConstructs };
-//# sourceMappingURL=credentials-BBIRJVp4.mjs.map
+export { loadEnvFiles as C, isPortAvailable as S, prepareEntryCredentials as T, fakeKey as _, reconcileWorkspace as a, createEntryWrapper as b, LOCAL_CA_PATH as c, postgresDatabaseNames as d, quoteIdentifier as f, describeServices as g, rootSite as h, derivedContainers as i, forgetState as l, resourceName as m, backendsOf as n, workspace_exports as o, pgClient as p, constructGlobs as r, COMPOSE_PATH as s, FAKE_ENV as t, applyPostgres as u, primaryPortKey as v, loadSecretsForApp as w, findAvailablePort as x, createCredentialsPreload as y };
+
+//# sourceMappingURL=workspace-BsbxbqV-.mjs.map