@geekmidas/cli 10.0.0-alpha.66 → 10.0.0-alpha.68

package/dist/{state-uuYqnRVO.mjs → state-Bn5JDMFT.mjs}

@@ -1,15 +1,15 @@
-import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { s as run$1, u as gkmHome } from "./local-CWR4Y_kW.mjs";
+import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
+import { a as runOutput, i as run$1, s as gkmHome } from "./run-BJLIerMM.mjs";
 import { d as output, r as discover } from "./discover-BFoJWKGD.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
 import { O as TEST_STAGE, h as getPublicEnvPrefix, n as allConstructGlobs } from "./workspace-Be6uBhlF.mjs";
-import { ConfigNotFound, NotInAnApp, loadConfig, loadWorkspaceAppInfo, loadWorkspaceConfig } from "./config.mjs";
-import { c as runtimeOf } from "./resolve-Db0tNlrW.mjs";
+import { ConfigNotFound, NotInAnApp, loadWorkspaceAppInfo, loadWorkspaceConfig } from "./config.mjs";
+import { c as runtimeOf } from "./resolve-pIvXlZ1h.mjs";
 import { i as DEFAULT_STORAGE, n as DEFAULT_CACHE, r as DEFAULT_EVENTS$1, t as readFakes } from "./fakes-C9RiT6XG.mjs";
-import { basename, dirname, join, parse, resolve } from "node:path";
-import { constants, copyFileSync, existsSync, readFileSync, unlinkSync } from "node:fs";
-import { chmod, copyFile, mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
-import { homedir, networkInterfaces } from "node:os";
+import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
+import { constants, existsSync, readFileSync } from "node:fs";
+import { appendFile, chmod, copyFile, mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
+import { homedir, networkInterfaces, tmpdir } from "node:os";
 import { promisify } from "node:util";
 import { DEFAULT_POSTGRES_VERSION, cacheTable, cookieDomain, dependenciesOf, dependentsOf, externalApiUrl, kebabCase, mobileOrigins, provideKey, providedKeyFor, provisionOrder, publicEnvFor, schemeBase, scopedName } from "@geekmidas/manifest";
 import { execFile, spawn } from "node:child_process";
@@ -271,7 +271,7 @@ function applicationName(identity, app) {
 * old file stays, so an older CLI on the same machine keeps working.
 */
 /** Key length for AES-256 encryption */
-const KEY_LENGTH = 32;
+const KEY_LENGTH$1 = 32;
 /** A keystore project key that is not `<namespace>/<project>`. */
 var KeystoreProjectInvalid = class extends Error {
 	key;
@@ -364,7 +364,7 @@ async function generateKey(stage, project, flag = "w") {
 		recursive: true,
 		mode: 448
 	});
-	const key = randomBytes(KEY_LENGTH).toString("hex");
+	const key = randomBytes(KEY_LENGTH$1).toString("hex");
 	await writeFile(keyPath, key, {
 		mode: 384,
 		encoding: "utf-8",
@@ -433,8 +433,8 @@ async function getOrCreateKey(stage, project) {
 /** Where the files live, relative to the project root. */
 const SECRETS_DIR = ".gkm/secrets";
 /** AES-256-GCM configuration */
-const ALGORITHM = "aes-256-gcm";
-const IV_LENGTH = 12;
+const ALGORITHM$1 = "aes-256-gcm";
+const IV_LENGTH$1 = 12;
 /**
 * A stage's secrets as an encrypted file on this machine:
 * `.gkm/secrets/<stage>.json`, with its key in the CLI's home at
@@ -455,7 +455,7 @@ var FileSecretsStore = class {
 	constructor(root, project) {
 		this.root = root;
 		this.project = project ?? {
-			key: projectKey({ name: packageName(root) ?? basename(root) }),
+			key: projectKey({ name: packageName$1(root) ?? basename(root) }),
 			legacy: [basename(root)]
 		};
 	}
@@ -492,7 +492,7 @@ var MissingSecretsKey = class extends Error {
 	}
 };
 /** A project's package name without its scope, as a workspace name reads it. */
-function packageName(root) {
+function packageName$1(root) {
 	try {
 		const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf-8"));
 		return typeof pkg.name === "string" ? pkg.name.replace(/^@[^/]+\//, "") : void 0;
@@ -502,8 +502,8 @@ function packageName(root) {
 }
 function encrypt(secrets, keyHex) {
 	const key = Buffer.from(keyHex, "hex");
-	const iv = randomBytes(IV_LENGTH);
-	const cipher = createCipheriv(ALGORITHM, key, iv);
+	const iv = randomBytes(IV_LENGTH$1);
+	const cipher = createCipheriv(ALGORITHM$1, key, iv);
 	const ciphertext = Buffer.concat([cipher.update(JSON.stringify(secrets), "utf-8"), cipher.final()]);
 	return {
 		version: 1,
@@ -514,7 +514,7 @@ function encrypt(secrets, keyHex) {
 function decrypt(data, keyHex) {
 	const key = Buffer.from(keyHex, "hex");
 	const combined = Buffer.from(data.encrypted, "base64");
-	const decipher = createDecipheriv(ALGORITHM, key, Buffer.from(data.iv, "hex"));
+	const decipher = createDecipheriv(ALGORITHM$1, key, Buffer.from(data.iv, "hex"));
 	decipher.setAuthTag(combined.subarray(-16));
 	const plaintext = Buffer.concat([decipher.update(combined.subarray(0, -16)), decipher.final()]);
 	return JSON.parse(plaintext.toString("utf-8"));
@@ -551,7 +551,7 @@ function isRemoteStore(workspace, stage) {
 }
 //#endregion
 //#region src/credentials/index.ts
-const logger$1 = console;
+const logger$2 = console;
 /**
 * Load environment files
 * @internal Exported for testing
@@ -602,7 +602,7 @@ async function findAvailablePort(preferredPort, maxAttempts = 10) {
 	for (let i = 0; i < maxAttempts; i++) {
 		const port = preferredPort + i;
 		if (await isPortAvailable(port)) return port;
-		logger$1.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
+		logger$2.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
 	}
 	throw new Error(`Could not find an available port after trying ${maxAttempts} ports starting from ${preferredPort}`);
 }
@@ -637,7 +637,7 @@ async function loadSecretsForApp(store, stage, appName) {
 	let secrets = {};
 	const stageSecrets = await store.read(stage);
 	if (stageSecrets) {
-		logger$1.log(`🔐 Loading secrets from stage: ${stage}`);
+		logger$2.log(`🔐 Loading secrets from stage: ${stage}`);
 		secrets = toEmbeddableSecrets(stageSecrets);
 	}
 	if (Object.keys(secrets).length === 0) return {};
@@ -743,7 +743,7 @@ async function prepareEntryCredentials(options) {
 			free: isPortAvailable,
 			holder: holderOf
 		});
-		for (const { app, from, to, holder } of assigned.moved) logger$1.log(`↪️  ${app}: ${from} is held by ${describeHolder(holder)}, which is not this workspace's — using ${to}`);
+		for (const { app, from, to, holder } of assigned.moved) logger$2.log(`↪️  ${app}: ${from} is held by ${describeHolder(holder)}, which is not this workspace's — using ${to}`);
 		workspace = withAppPorts(workspace, assigned.ports);
 		workspaceAppPort = assigned.ports[appName] ?? workspaceAppPort;
 	}
@@ -767,7 +767,7 @@ async function prepareEntryCredentials(options) {
 		});
 		Object.assign(credentials, reconciled.env);
 		declaredKeys.push(...Object.keys(reconciled.env));
-		if (Object.keys(reconciled.env).length > 0) logger$1.log(`🔌 Resolved ${Object.keys(reconciled.env).length} declared URL(s)`);
+		if (Object.keys(reconciled.env).length > 0) logger$2.log(`🔌 Resolved ${Object.keys(reconciled.env).length} declared URL(s)`);
 	}
 	const secretsDir = join(secretsRoot, ".gkm");
 	await mkdir(secretsDir, { recursive: true });
@@ -1019,207 +1019,1049 @@ function eventsBackendFor(on) {
 	return DEFAULT_EVENTS$1[on];
 }
 //#endregion
-//#region src/reconcile/caddyfile.ts
+//#region src/docker/templates.ts
 /**
-* The kinds the edge serves.
-*
-* Everything that owns a *public address*. Deployed, each of these has a real
-* hostname and a certificate, so this is what makes the local shape the same
-* one rather than a near-enough one — and the application is indifferent
-* either way, because it reads whichever address was injected and never
-* composes one.
-*
-* Adding a kind here is the whole of adding it to the edge.
+* The turbo every image prunes and builds with when the build root resolves
+* none of its own: a repository without turbo still needs `turbo prune` to
+* cut its slice of the workspace, and an unpinned `turbo` is whatever the
+* registry says on the day of the build.
 */
-const EDGE_KINDS = {
-	"file-server": true,
-	"rest-api": true,
-	site: true
-};
+const TURBO_VERSION = "2.5.4";
 /**
-* How the edge reaches the host, from inside its container.
-*
-* A surface and a site are served by processes `gkm dev` starts on the host,
-* not by containers — so the edge has to leave Docker's network to reach them.
-* Docker Desktop resolves this name already; on Linux the compose definition
-* maps it to the host gateway.
+* Caddy, which serves a static site's files. A 2.x tag, so a rebuild picks
+* up patch releases and never a major.
 */
-const HOST_GATEWAY = "host.docker.internal";
+const STATIC_SITE_IMAGE = "caddy:2.10-alpine";
+const LOCKFILES = [
+	["pnpm-lock.yaml", "pnpm"],
+	["bun.lockb", "bun"],
+	["yarn.lock", "yarn"],
+	["package-lock.json", "npm"]
+];
 /**
-* The suffix every local host shares.
-*
-* `.localhost` rather than a made-up TLD because it resolves to loopback
-* without touching `/etc/hosts` — macOS and systemd-resolved both answer for
-* subdomains of it, and Caddy issues internal certificates for it by default.
+* Detect package manager from lockfiles
+* Walks up the directory tree to find lockfile (for monorepos)
 */
-const LOCAL_TLD = "localhost";
+function detectPackageManager(cwd = process.cwd()) {
+	const lockfile = findLockfilePath(cwd);
+	if (!lockfile) return "pnpm";
+	const name = lockfile.slice(dirname(lockfile).length + 1);
+	return LOCKFILES.find(([file]) => file === name)?.[1] ?? "pnpm";
+}
 /**
-* The sites a plan implies, one per file server.
+* Find the lockfile path by walking up the directory tree
+* Returns the full path to the lockfile, or null if not found
+*/
+function findLockfilePath(cwd = process.cwd()) {
+	for (const dir of upFrom(cwd)) for (const [lockfile] of LOCKFILES) {
+		const lockfilePath = join(dir, lockfile);
+		if (existsSync(lockfilePath)) return lockfilePath;
+	}
+	return null;
+}
+/**
+* The directory every image is built from: the nearest at or above `cwd`
+* holding a lockfile or a `pnpm-workspace.yaml` — the package manager's root,
+* which is what an install resolves the workspace's dependencies against.
 *
-* The leading label is the *server's* stage-scoped name rather than the
-* bucket's, which is the difference that matters: two servers over one bucket
-* are a legitimate arrangement — two cache behaviours, one origin — and naming
-* the host after the bucket would make them collide.
+* In a project of its own that is the gkm workspace's root. A gkm workspace
+* nested inside a monorepo, whose dependencies are the monorepo's
+* `workspace:*` packages, is built from the monorepo's root. `cwd` itself
+* when neither is found.
 */
-function sitesFor(plan, project, addresses = {}) {
-	const byId = new Map(plan.resources.map((r) => [r.id, r]));
-	const sites = [];
-	for (const resource of plan.resources) {
-		if (!EDGE_KINDS[resource.kind]) continue;
-		const host = hostFor(resource, project);
-		if (resource.kind === "file-server") {
-			const origin = resource.of ? byId.get(resource.of) : void 0;
-			if (!origin) continue;
-			sites.push({
-				host,
-				upstream: "http://minio:9000",
-				rewrite: `/${origin.name}{uri}`
-			});
-			continue;
+function findBuildRoot(cwd = process.cwd()) {
+	for (const dir of upFrom(cwd)) {
+		if (existsSync(join(dir, "pnpm-workspace.yaml"))) return dir;
+		for (const [lockfile] of LOCKFILES) if (existsSync(join(dir, lockfile))) return dir;
+	}
+	return cwd;
+}
+/** `cwd` and every directory above it, the filesystem root last. */
+function upFrom(cwd) {
+	const dirs = [];
+	const root = parse(cwd).root;
+	let dir = cwd;
+	while (dir !== root) {
+		dirs.push(dir);
+		dir = dirname(dir);
+	}
+	dirs.push(root);
+	return dirs;
+}
+/** The package manager, its version, turbo's and the shape of a build root. */
+function resolveBuildTools(buildRoot) {
+	const pkg = readJson(join(buildRoot, "package.json"));
+	const packageManager = detectPackageManager(buildRoot);
+	const field = typeof pkg?.packageManager === "string" ? pkg.packageManager : "";
+	const match = /^([a-z]+)@(\d[^+\s]*)/.exec(field);
+	const packageManagerVersion = match && match[1] === packageManager ? match[2] : void 0;
+	return {
+		packageManager,
+		...packageManagerVersion ? { packageManagerVersion } : {},
+		turboVersion: resolveTurboVersion(buildRoot) ?? "2.5.4",
+		monorepo: existsSync(join(buildRoot, "pnpm-workspace.yaml")) || pkg?.workspaces !== void 0
+	};
+}
+/**
+* The turbo version a build root resolves: what is installed, or what its
+* lockfile pins. Undefined when it has none.
+*/
+function resolveTurboVersion(buildRoot) {
+	const installed = readJson(join(buildRoot, "node_modules", "turbo", "package.json"));
+	if (typeof installed?.version === "string") return installed.version;
+	const read = (file) => {
+		try {
+			return readFileSync(join(buildRoot, file), "utf-8");
+		} catch {
+			return;
 		}
-		const address = addresses[resource.id];
-		if (!address) continue;
-		const port = portOf(address);
-		if (!port) continue;
-		sites.push({
-			host,
-			upstream: `http://${HOST_GATEWAY}:${port}`
-		});
+	};
+	const pnpm = read("pnpm-lock.yaml");
+	const fromPnpm = pnpm && /^ {2}'?turbo@(\d[^:'(\s]*)'?:/m.exec(pnpm);
+	if (fromPnpm) return fromPnpm[1];
+	const npm = read("package-lock.json");
+	if (npm) {
+		const version = safeParse(npm)?.packages?.["node_modules/turbo"]?.version;
+		if (version) return version;
 	}
-	return sites;
+	const yarn = read("yarn.lock");
+	const fromYarn = yarn && /^"?turbo@[^\n]*:\n\s+version:? "?(\d[^"\s]*)"?/m.exec(yarn);
+	if (fromYarn) return fromYarn[1];
 }
-/** The port a local address answers on, defaulting by scheme. */
-function portOf(address) {
+function readJson(path) {
 	try {
-		const { port, protocol } = new URL(address);
-		return port || (protocol === "https:" ? "443" : "80");
+		return safeParse(readFileSync(path, "utf-8"));
+	} catch {
+		return;
+	}
+}
+function safeParse(text) {
+	try {
+		const value = JSON.parse(text);
+		return value && typeof value === "object" ? value : void 0;
 	} catch {
 		return;
 	}
 }
 /**
-* Where one file server answers, including the stage its name carries.
-*
-* The project is a label rather than a decoration: it is what keeps two
-* checkouts from answering on one address. Omitted when there is no project to
-* name, because an empty label makes `uploads..localhost` — a host nothing
-* resolves and no certificate can be issued for.
+* Check if turbo.json exists (walks up directory tree)
 */
-function hostFor(resource, project) {
-	return [
-		resource.root && project ? stageOf(resource) : labelOf(resource),
-		project,
-		LOCAL_TLD
-	].filter(Boolean).join(".");
+function hasTurboConfig(cwd = process.cwd()) {
+	return upFrom(cwd).some((dir) => existsSync(join(dir, "turbo.json")));
 }
 /**
-* A resource's own label: its `subdomain` where it declared one — the label a
-* deploy uses too — with the stage it carries kept, so `gkm test` and `gkm dev`
-* still answer on different hosts.
+* Package manager specific commands. `version` pins what corepack (or npm,
+* for bun) installs; without it, the latest.
 */
-function labelOf(resource) {
-	if (!resource.subdomain) return resource.name;
-	const stage = stageOf(resource);
-	return stage ? `${resource.subdomain}-${stage}` : resource.subdomain;
+function getPmConfig(pm, version) {
+	return {
+		pnpm: {
+			install: `corepack enable && corepack prepare pnpm@${version ?? "latest"} --activate`,
+			lockfile: "pnpm-lock.yaml",
+			installCmd: "pnpm install",
+			cacheTarget: "/root/.local/share/pnpm/store",
+			cacheId: "pnpm",
+			run: "pnpm run",
+			dlx: "pnpm dlx"
+		},
+		npm: {
+			install: version ? `npm install -g npm@${version}` : "",
+			lockfile: "package-lock.json",
+			installCmd: "npm install",
+			cacheTarget: "/root/.npm",
+			cacheId: "npm",
+			run: "npm run",
+			dlx: "npx --yes"
+		},
+		yarn: {
+			install: `corepack enable && corepack prepare yarn@${version ?? "stable"} --activate`,
+			lockfile: "yarn.lock",
+			installCmd: "yarn install",
+			cacheTarget: "/root/.yarn/cache",
+			cacheId: "yarn",
+			run: "yarn run",
+			dlx: "yarn dlx"
+		},
+		bun: {
+			install: `npm install -g bun@${version ?? "latest"}`,
+			lockfile: "bun.lockb",
+			installCmd: "bun install",
+			cacheTarget: "/root/.bun/install/cache",
+			cacheId: "bun",
+			run: "bun run",
+			dlx: "bunx"
+		}
+	}[pm];
 }
-/** The stage a resource's name carries, or nothing for the local stage's. */
-function stageOf(resource) {
-	const base = resource.id.toLowerCase();
-	return resource.name === base ? void 0 : resource.name.slice(base.length + 1);
+/** What every template's first three stages need, resolved from options. */
+function layout(options) {
+	const pm = getPmConfig(options.packageManager, options.packageManagerVersion);
+	const turbo = `${pm.dlx} turbo@${options.turboVersion ?? "2.5.4"}`;
+	const gkmRoot = options.gkmRoot ?? ".";
+	return {
+		pm,
+		turbo,
+		installPm: pm.install ? `RUN ${pm.install}` : "",
+		monorepo: options.monorepo ?? true,
+		gkmRoot,
+		/** The app, absolute inside the image. */
+		app: `/app/${options.appPath}`.replace(/\/\.$/, "")
+	};
 }
 /**
-* The static root config, which only ever imports.
+* The pruner stage: the build context cut to the app's slice, in turbo's
+* `out/` layout — `out/json` for the install, `out/full` for the build.
 *
-* Written once and identical for every stage, because the *sites* are what
-* differ and they live in their own files. That split is not tidiness: one
-* container serves every stage — the same way one Postgres holds `orders` and
-* `orders_test` — so a single Caddyfile would mean `gkm test` deleting the
-* routes `gkm dev` is serving, and each command silently breaking the other.
+* `turbo prune` keeps the packages the app depends on and nothing else at
+* the root, so the root's own files (a `tsconfig.base.json` the packages
+* extend, the config their build reads) and what the gkm workspace keeps
+* outside any package are copied in beside them. A single package is copied
+* whole.
 */
-function caddyfileRoot() {
-	return `${GENERATED}
-{
-	# No ACME, no public DNS: the CA is local and so are the names.
-	local_certs
-	auto_https disable_redirects
+function prunerStage(options) {
+	const { pm, turbo, installPm, monorepo, gkmRoot } = layout(options);
+	const scopes = [options.turboPackage, ...options.prunePackages ?? []].join(" ");
+	if (!monorepo) return `# Stage 1: The build context, in the layout the stages below read
+FROM ${options.baseImage} AS pruner
+WORKDIR /app
+COPY . .
+RUN mkdir -p /tmp/out/json /tmp/out/full && \\
+    cp package.json /tmp/out/json/ && \\
+    cp ${pm.lockfile} /tmp/out/ && \\
+    cp -a . /tmp/out/full/ && \\
+    mv /tmp/out ./out`;
+	const gkmPaths = options.gkmPaths ?? [];
+	const nested = gkmRoot !== ".";
+	const dest = nested ? `/app/out/full/${gkmRoot}` : "/app/out/full";
+	const copyGkm = gkmPaths.length ? `
+
+# What the gkm workspace keeps outside any package — its config, the
+# directories its constructs are declared in — beside the slice.
+RUN ${nested ? `cd ${gkmRoot} && ` : ""}for path in ${gkmPaths.join(" ")}; do \\
+      if [ -e "$path" ]; then \\
+        mkdir -p "${dest}" && cp -rn "$path" "${dest}/"; \\
+      fi; \\
+    done` : "";
+	return `# Stage 1: Prune the monorepo to the app's slice
+FROM ${options.baseImage} AS pruner
+WORKDIR /app
+${installPm}
+COPY . .
+RUN ${turbo} prune ${scopes} --docker
+
+# The root's own files — the tsconfig the packages extend, the config their
+# build reads — which turbo prune leaves out. What the install itself reads
+# (registry config, local tarballs) goes beside the manifests too.
+RUN find . -maxdepth 1 -type f ! -name '${pm.lockfile}' ! -name package.json \\
+      -exec cp -n {} out/full/ \\; && \\
+    for file in .npmrc .yarnrc.yml .pnpmfile.cjs bunfig.toml *.tgz; do \\
+      if [ -f "$file" ]; then cp "$file" out/json/; fi; \\
+    done${copyGkm}`;
+}
+/** The deps stage: the slice's dependencies, installed from its lockfile. */
+function depsStage(options) {
+	const { pm, installPm } = layout(options);
+	return `# Stage 2: Install dependencies
+FROM ${options.baseImage} AS deps
+WORKDIR /app
+${installPm}
+COPY --from=pruner /app/out/${pm.lockfile} ./
+COPY --from=pruner /app/out/json/ ./
+RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
+    ${pm.installCmd}`;
 }
+/**
+* The start of the builder stage: the slice's source over its dependencies,
+* and every workspace package the app depends on built from it.
+*
+* Nothing built on the host reaches the image — `.dockerignore` keeps every
+* `dist` out — so a workspace package (a CLI that is a sibling package) is
+* built here: the root's `build` script if it has one, then turbo's build of
+* the app's dependencies (`^build`).
+*/
+function builderStage(options, extra = {}) {
+	const { pm, turbo, monorepo } = layout(options);
+	const args = extra.args ?? [];
+	const argLines = args.length ? `\n# Build-time args: public values the bundler inlines\n${args.map((a) => `ARG ${a}=""`).join("\n")}\n${args.map((a) => `ENV ${a}=$${a}`).join("\n")}\n` : "";
+	const scopes = [options.turboPackage, ...options.prunePackages ?? []];
+	const dependencies = monorepo ? `\nRUN ${turbo} run build ${scopes.map((s) => `--filter='${s}^...'`).join(" ")}` : "";
+	return `# Stage 3: Build
+FROM deps AS builder
+WORKDIR /app
+${argLines}
+COPY --from=pruner /app/out/full/ ./
 
-# One file per stage, so two stages share this edge the way they already share
-# one Postgres and one MinIO.
-import /etc/caddy/sites/*.caddy
-`;
+# The workspace packages the app depends on, built from source.
+RUN ${pm.run} --if-present build${dependencies}`;
 }
 /**
-* One stage's sites, as the file imported above.
-*
-* `rewrite` rather than a path prefix on the address: the bucket is the
-* origin's business, and the client asks for the key it stored.
+* The PATH a command in the app's directory runs with: the app's binaries,
+* then the gkm workspace's, then the root's — a nested workspace's apps
+* declare nothing, and its CLI is installed where its config is.
+*/
+function binPath(options) {
+	const { app, gkmRoot } = layout(options);
+	const dirs = [
+		`${app}/node_modules/.bin`,
+		gkmRoot === "." ? "" : `/app/${gkmRoot}/node_modules/.bin`,
+		"/app/node_modules/.bin"
+	].filter(Boolean);
+	return `PATH="${[...new Set(dirs)].join(":")}:$PATH"`;
+}
+/**
+* Run the gkm CLI the app resolves, from the app's directory: node on its
+* `bin/gkm.mjs`, found the way Node resolves a package — up from the app.
 *
-* `header_up Host {upstream_hostport}` matters more than it looks. MinIO routes
-* and signs on the Host header, so forwarding the requested hostname would make
-* it look for a bucket named after the domain.
+* Not through `node_modules/.bin`: a CLI that is a workspace package has no
+* bin linked, since its files were not there when the slice's dependencies
+* were installed.
 */
-function toCaddyfile(sites) {
-	if (sites.length === 0) return `${GENERATED}
-# No file server is declared in this stage, so it routes nothing.
-`;
-	const blocks = sites.map(({ host, upstream, rewrite }) => `
-https://${host} {
-	tls internal
-
-	reverse_proxy ${upstream} {${rewrite ? `
-		rewrite ${rewrite}
-		# MinIO routes and signs on the Host header, so forwarding the requested
-		# hostname would make it look for a bucket named after the domain.
-		header_up Host {upstream_hostport}` : `
-		# The application reads whatever address was injected, so it has to see
-		# the one a caller used — that is what makes a redirect, a cookie domain
-		# and a generated link point back here rather than at the upstream.
-		header_up Host {host}
-		header_up X-Forwarded-Proto {scheme}`}
-	}
-}`);
-	return `${GENERATED}${blocks.join("\n")}\n`;
+function gkmCommand(args) {
+	return `GKM_BIN="$(node -e 'let d=process.cwd();const{existsSync:e}=require("fs"),{dirname:u,join:j}=require("path");for(;;){const p=j(d,"node_modules/@geekmidas/cli/bin/gkm.mjs");if(e(p)){console.log(p);break}if(u(d)===d){console.error("@geekmidas/cli is not installed where the app can resolve it");process.exit(1)}d=u(d)}')" && node "$GKM_BIN" ${args}`;
 }
-const GENERATED = `# Generated by gkm from the construct manifest — do not edit.
-#
-# One host per declared file server, in front of the object store that holds its
-# objects. This is the shape a file server has deployed — a domain serving a
-# bucket — which MinIO alone cannot produce: its virtual-host mode reads the
-# leading label as the bucket name.
-#
-# Certificates come from Caddy's own CA. "gkm dev" and "gkm test" export its
-# root and point Node at it, so nothing has to be installed to use these URLs
-# from code; a browser needs the root trusted once.
-`;
-//#endregion
-//#region src/reconcile/emulator.ts
 /**
-* The AWS emulator (floci, LocalStack-compatible) the `sns` backend runs on
-* locally — the facts the compose file, the env writer and the applier must
-* agree on.
+* The encrypted credentials, from a build secret — never an ARG, which is
+* recorded in the image history — written where the build embeds them from.
+* Two lines, ciphertext then IV; absent when the app has no secrets.
 *
-* The emulator has one account and answers with deterministic ARNs and queue
-* URLs, which is what lets a connection string be composed before the topic
-* or queue it names has been created.
+* A BuildKit secret is not part of the cache key, so `GKM_CIPHERTEXT_HASH`
+* (a hash of the ciphertext, not a secret) is: credentials encrypted under a
+* new key rebuild the layer that embeds them.
 */
-/** The emulator's single account. */
-const EMULATOR_ACCOUNT = "000000000000";
-const EMULATOR_REGION = "us-east-1";
+function credentialsStep(appDir, then) {
+	return `ARG GKM_CIPHERTEXT_HASH=""
+RUN --mount=type=secret,id=gkm_credentials,required=false \\
+    echo "credentials: \${GKM_CIPHERTEXT_HASH:-none}" && \\
+    if [ -s /run/secrets/gkm_credentials ]; then \\
+      mkdir -p ${appDir}/.gkm && \\
+      sed -n 1p /run/secrets/gkm_credentials > ${appDir}/.gkm/credentials.enc && \\
+      sed -n 2p /run/secrets/gkm_credentials > ${appDir}/.gkm/credentials.iv; \\
+    fi && \\
+    ${then} && \\
+    rm -f ${appDir}/.gkm/credentials.enc ${appDir}/.gkm/credentials.iv`;
+}
 /**
-* The emulator's credential. The `LSIA` prefix is what LocalStack required on
-* issued keys; floci does not care, and keeping it means a project that pins
-* the old image still works.
+* The externals a backend's bundle leaves out (esbuild `--external`), each
+* installed for Linux at the version the builder resolved, so the runner has
+* exactly those beside `server.mjs`. Nothing when there are none: the runner
+* is the one file.
 */
-const EMULATOR_CREDENTIALS = {
-	accessKeyId: "LSIAQAAAAAAVNCBMPNSG",
-	secretAccessKey: "geekmidas"
-};
-/** The emulator's address from the host, on the port it was published on. */
-function emulatorEndpoint(port) {
-	return `http://localhost:${port}`;
+function externalsStages(options, appDir) {
+	const external = options.external ?? [];
+	if (external.length === 0) return {
+		stage: "",
+		copy: ""
+	};
+	return {
+		stage: `
+# Stage 4: The packages the bundle leaves external, installed for Linux at the
+# versions the build resolved — and nothing else.
+FROM builder AS externals-manifest
+WORKDIR ${appDir}
+RUN node <<'EOF'
+const { existsSync, readFileSync, writeFileSync } = require('node:fs');
+const { dirname, join } = require('node:path');
+const names = ${JSON.stringify(external)};
+const dependencies = {};
+for (const name of names) {
+  let dir = process.cwd();
+  for (;;) {
+    const manifest = join(dir, 'node_modules', name, 'package.json');
+    if (existsSync(manifest)) {
+      dependencies[name] = JSON.parse(readFileSync(manifest, 'utf-8')).version;
+      break;
+    }
+    if (dirname(dir) === dir) {
+      console.error(name + ' is external to the bundle, and is not installed: add it to the app\\'s dependencies.');
+      process.exit(1);
+    }
+    dir = dirname(dir);
+  }
+}
+writeFileSync('/tmp/externals.json', JSON.stringify({ private: true, dependencies }));
+EOF
+
+FROM ${options.baseImage} AS externals
+WORKDIR /externals
+COPY --from=externals-manifest /tmp/externals.json ./package.json
+RUN --mount=type=cache,id=npm,target=/root/.npm \\
+    npm install --omit=dev --no-package-lock --no-audit --no-fund
+`,
+		copy: "\nCOPY --from=externals --chown=hono:nodejs /externals/node_modules ./node_modules"
+	};
 }
-function emulatorTopicArn(name) {
+/**
+* Generate .dockerignore file
+*
+* Written at the build root. Nothing built on the host may reach an image —
+* every image builds its packages from source — and nothing secret may reach
+* a build context.
+*/
+function generateDockerignore() {
+	return `# Dependencies: installed in the image, for Linux
+**/node_modules
+.pnpm-store
+
+# Build output: every image builds from source, never from the host's
+**/dist
+**/.next
+**/.turbo
+**/.gkm
+
+# The key gkm build --stage encrypted secrets with: runtime env only, never
+# the build context
+**/master.key
+
+# gkm compose's stacks: each app's env file holds its stage's secrets
+**/.gkm/compose
+
+# IDE and editor
+.idea
+.vscode
+*.swp
+*.swo
+
+# Git
+.git
+
+# Logs
+*.log
+npm-debug.log*
+pnpm-debug.log*
+
+# Test files
+coverage
+
+# Environment files (handle secrets separately)
+**/.env
+**/.env.*
+!**/.env.example
+
+# Docker files (don't copy recursively)
+Dockerfile*
+docker-compose*
+.dockerignore
+`;
+}
+/**
+* Resolve Docker configuration from GkmConfig with defaults
+*/
+function resolveDockerConfig(config) {
+	const docker = config.docker ?? {};
+	return {
+		registry: docker.registry ?? "",
+		imageName: docker.imageName ?? config.name ?? "api",
+		baseImage: docker.baseImage ?? "node:22-alpine",
+		port: docker.port ?? 3e3
+	};
+}
+/** A site's root answers its health check. */
+function siteHealthcheck(port) {
+	return `# A site answers at its root; Docker, and Dokploy, read the container's
+# health from it rather than from the process merely running. 127.0.0.1, not
+# localhost: the server listens on IPv4, and localhost can resolve to ::1.
+HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
+  CMD wget -qO- http://127.0.0.1:${port}/ > /dev/null 2>&1 || exit 1`;
+}
+/**
+* Generate a Dockerfile for Next.js frontend apps using standalone output.
+*
+* Pruned at the build root, Next traces from there, so the standalone
+* server lands at `<appPath>/server.js` under `.next/standalone`.
+* @internal Exported for testing
+*/
+function generateNextjsDockerfile(options) {
+	const { port, appPath, turboPackage, publicUrlArgs = ["NEXT_PUBLIC_API_URL", "NEXT_PUBLIC_AUTH_URL"] } = options;
+	const { turbo } = layout(options);
+	return `# syntax=docker/dockerfile:1
+# Next.js standalone Dockerfile, built from a turbo-pruned slice
+
+${prunerStage(options)}
+
+${depsStage(options)}
+
+${builderStage(options, { args: publicUrlArgs })}
+
+# Ensure public directory exists (may be empty for scaffolded projects)
+RUN mkdir -p ${appPath}/public
+
+ENV NEXT_TELEMETRY_DISABLED=1
+
+# Build the application
+RUN ${turbo} run build --filter='${turboPackage}'
+
+# The runner needs the standalone server; without it there is nothing to run.
+RUN if [ ! -d ${appPath}/.next/standalone ]; then \\
+      echo "${appPath}/.next/standalone was not built: set output: 'standalone' in next.config so the image can run the app without node_modules." >&2; \\
+      exit 1; \\
+    fi
+
+# Stage 4: Production
+FROM ${options.baseImage} AS runner
+
+WORKDIR /app
+
+# Install tini for proper signal handling
+RUN apk add --no-cache tini
+
+# Create non-root user
+RUN addgroup --system --gid 1001 nodejs && \\
+    adduser --system --uid 1001 nextjs
+
+# Set environment
+ENV NODE_ENV=production
+ENV NEXT_TELEMETRY_DISABLED=1
+ENV PORT=${port}
+ENV HOSTNAME="0.0.0.0"
+
+# The standalone server, with its static files and public directory beside it
+COPY --from=builder --chown=nextjs:nodejs /app/${appPath}/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/${appPath}/.next/static ./${appPath}/.next/static
+COPY --from=builder --chown=nextjs:nodejs /app/${appPath}/public ./${appPath}/public
+
+USER nextjs
+
+EXPOSE ${port}
+
+${siteHealthcheck(port)}
+
+ENTRYPOINT ["/sbin/tini", "--"]
+CMD ["node", "${appPath}/server.js"]
+`;
+}
+/**
+* Generate a Dockerfile for a gkm backend: pruned, installed, and bundled by
+* `gkm build --provider server --production` inside the image. The runner is
+* `server.mjs` alone — plus any package the bundle leaves external.
+* @internal Exported for testing
+*/
+function generateBackendDockerfile(options) {
+	const { port, healthCheckPath = "/health" } = options;
+	const { app } = layout(options);
+	const externals = externalsStages(options, app);
+	return `# syntax=docker/dockerfile:1
+# Backend Dockerfile: a turbo-pruned slice, bundled by gkm build in the image
+
+${prunerStage(options)}
+
+${depsStage(options)}
+
+${builderStage(options)}
+
+# Bundle the production server, with the encrypted credentials embedded
+${credentialsStep(app, `cd ${app} && ${gkmCommand("build --provider server --production")}`)}
+${externals.stage}
+# Production
+FROM ${options.baseImage} AS runner
+
+WORKDIR /app
+
+RUN apk add --no-cache tini
+
+RUN addgroup --system --gid 1001 nodejs && \\
+    adduser --system --uid 1001 hono
+
+# The bundled server
+COPY --from=builder --chown=hono:nodejs ${app}/.gkm/server/dist/server.mjs ./${externals.copy}
+
+ENV NODE_ENV=production
+ENV PORT=${port}
+
+HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
+  CMD wget -qO- http://localhost:${port}${healthCheckPath} > /dev/null 2>&1 || exit 1
+
+USER hono
+
+EXPOSE ${port}
+
+ENTRYPOINT ["/sbin/tini", "--"]
+CMD ["node", "server.mjs"]
+`;
+}
+/**
+* Generate a Dockerfile for apps with a custom entry point.
+* Uses esbuild to bundle the entry point into dist/index.mjs with all dependencies.
+* This is used for apps that don't use gkm routes (e.g., Better Auth servers).
+* @internal Exported for testing
+*/
+function generateEntryDockerfile(options) {
+	const { port, entry, healthCheckPath = "/health" } = options;
+	const { app } = layout(options);
+	const esbuild = (defines) => `esbuild ${entry} --bundle --platform=node --target=node22 --format=esm \\
+        --outfile=dist/index.mjs --packages=bundle \\
+        --banner:js='import { createRequire } from "module"; const require = createRequire(import.meta.url);'${defines}`;
+	return `# syntax=docker/dockerfile:1
+# Entry-based Dockerfile: a turbo-pruned slice, bundled by esbuild in the image
+
+${prunerStage(options)}
+
+${depsStage(options)}
+
+${builderStage(options)}
+
+# Bundle the entry point with every dependency (dist/index.mjs), embedding the
+# encrypted credentials when there are any.
+ARG GKM_CIPHERTEXT_HASH=""
+RUN --mount=type=secret,id=gkm_credentials,required=false \\
+    echo "credentials: \${GKM_CIPHERTEXT_HASH:-none}" && \\
+    cd ${app} && export ${binPath(options)} && \\
+    if [ -s /run/secrets/gkm_credentials ]; then \\
+      CREDS=$(sed -n 1p /run/secrets/gkm_credentials) && \\
+      IV=$(sed -n 2p /run/secrets/gkm_credentials) && \\
+      ${esbuild(` \\
+        --define:__GKM_ENCRYPTED_CREDENTIALS__="\\"$CREDS\\"" \\
+        --define:__GKM_CREDENTIALS_IV__="\\"$IV\\""`)}; \\
+    else \\
+      ${esbuild("")}; \\
+    fi
+
+# Production
+FROM ${options.baseImage} AS runner
+
+WORKDIR /app
+
+RUN apk add --no-cache tini
+
+RUN addgroup --system --gid 1001 nodejs && \\
+    adduser --system --uid 1001 app
+
+# Copy bundled output only (no node_modules needed - fully bundled)
+COPY --from=builder --chown=app:nodejs ${app}/dist/index.mjs ./
+
+ENV NODE_ENV=production
+ENV PORT=${port}
+
+HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
+  CMD wget -qO- http://localhost:${port}${healthCheckPath} > /dev/null 2>&1 || exit 1
+
+USER app
+
+EXPOSE ${port}
+
+ENTRYPOINT ["/sbin/tini", "--"]
+CMD ["node", "index.mjs"]
+`;
+}
+/**
+* Generate a Dockerfile for Node-based SSR web frameworks (TanStack Start,
+* Remix). Builds with turbo, then runs the framework's production start
+* script.
+*
+* Public URL build args are declared so framework bundlers (Vite, Vinxi)
+* can inline them at build time. Per-framework prefix is the caller's job.
+* @internal Exported for testing
+*/
+function generateNodeWebDockerfile(options) {
+	const { port, appPath, turboPackage } = options;
+	const { turbo } = layout(options);
+	return `# syntax=docker/dockerfile:1
+# Node SSR web Dockerfile (TanStack Start / Remix), from a turbo-pruned slice
+
+${prunerStage(options)}
+
+${depsStage(options)}
+
+${builderStage(options, { args: options.publicUrlArgs ?? [] })}
+RUN ${turbo} run build --filter='${turboPackage}'
+
+FROM ${options.baseImage} AS runner
+WORKDIR /app
+RUN apk add --no-cache tini
+RUN addgroup --system --gid 1001 nodejs && \\
+    adduser --system --uid 1001 app
+
+# Copy the whole built workspace — frameworks differ on output paths
+COPY --from=builder --chown=app:nodejs /app/ ./
+
+ENV NODE_ENV=production
+ENV PORT=${port}
+ENV HOSTNAME="0.0.0.0"
+
+USER app
+EXPOSE ${port}
+
+${siteHealthcheck(port)}
+
+ENTRYPOINT ["/sbin/tini", "--"]
+# npm ships with node, and runs the start script whichever package manager
+# installed it: the runner needs no other.
+CMD ["sh", "-c", "cd ${appPath} && npm start"]
+`;
+}
+/**
+* Generate a Dockerfile for Vite SPA apps. Builds the static bundle with
+* turbo, then serves it with Caddy: Vite's hashed `/assets/*` cached for a
+* year, everything else — `index.html`, and every deep link that falls back
+* to it — revalidated on each request.
+* @internal Exported for testing
+*/
+function generateViteStaticDockerfile(options) {
+	const { port, appPath, turboPackage } = options;
+	const { turbo } = layout(options);
+	return `# syntax=docker/dockerfile:1
+# Vite SPA Dockerfile — a turbo-pruned slice built to static files, served by Caddy
+
+${prunerStage(options)}
+
+${depsStage(options)}
+
+${builderStage(options, { args: options.publicUrlArgs ?? [] })}
+RUN ${turbo} run build --filter='${turboPackage}'
+
+FROM ${STATIC_SITE_IMAGE} AS runner
+
+COPY <<'EOF' /etc/caddy/Caddyfile
+{
+	admin off
+	auto_https off
+	persist_config off
+}
+
+:${port} {
+	root * /srv
+	encode zstd gzip
+
+	# Vite names every built asset by its content hash: a changed file is a
+	# new URL, so the old one can be cached for good.
+	handle /assets/* {
+		header Cache-Control "public, max-age=31536000, immutable"
+		file_server
+	}
+
+	# index.html, and every client-side route that falls back to it, is
+	# asked for again each time so a deploy is seen at once.
+	handle {
+		header Cache-Control "no-cache"
+		try_files {path} /index.html
+		file_server
+	}
+}
+EOF
+
+COPY --from=builder /app/${appPath}/dist /srv
+
+RUN addgroup -S -g 1001 site && adduser -S -u 1001 -G site site && \\
+    chown -R site:site /data /config
+
+USER site
+
+EXPOSE ${port}
+
+${siteHealthcheck(port)}
+
+CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
+`;
+}
+//#endregion
+//#region src/docker/layout.ts
+/**
+* Where a workspace's images are built from, and what each is built with.
+*
+* Every builder of images — `gkm docker`, `gkm compose`, a Dokploy deploy —
+* builds from the same place with the same templates: the build root (the
+* package manager's root, at or above the gkm workspace), cut by `turbo
+* prune` to one app's slice. Nothing is built on the host.
+*/
+/** A workspace of packages with no turbo.json, which every image prunes with. */
+var MonorepoNeedsTurbo = class extends Error {
+	buildRoot;
+	constructor(buildRoot) {
+		super(`${buildRoot} is a workspace of packages, and its images are built from a turbo-pruned slice of it — but it has no turbo.json.\n\nTo fix this:
+  1. Install turbo: pnpm add -Dw turbo
+  2. Create turbo.json in ${buildRoot}\n  3. Run this command again
+
+See: https://turbo.build/repo/docs/guides/tools/docker`);
+		this.buildRoot = buildRoot;
+		this.name = "MonorepoNeedsTurbo";
+	}
+};
+/**
+* Where a workspace's images are built from.
+*
+* Refuses a workspace of packages with no turbo.json — every image prunes
+* with turbo — so only a caller about to generate or build images asks.
+*/
+function imageLayout(workspace) {
+	const buildRoot = findBuildRoot(workspace.root);
+	const tools = resolveBuildTools(buildRoot);
+	if (tools.monorepo && !hasTurboConfig(buildRoot)) throw new MonorepoNeedsTurbo(buildRoot);
+	const gkmRoot = toPosix(relative(buildRoot, workspace.root)) || ".";
+	const workspacePackage = gkmRoot !== "." ? packageName(workspace.root) : void 0;
+	return {
+		buildRoot,
+		gkmRoot,
+		tools,
+		...workspacePackage ? { workspacePackage } : {},
+		gkmPaths: ["gkm.config.*", ...constructRoots(workspace)]
+	};
+}
+/**
+* How a compose file builds an app: the build root as the context, relative
+* to the directory the compose file is in, and the Dockerfile — written under
+* the gkm root — relative to that context, which is what compose resolves
+* `dockerfile` against.
+*/
+function composeBuildPaths(options) {
+	const { composeDir, buildRoot, workspaceRoot, dockerfile } = options;
+	return {
+		context: toPosix(relative(composeDir, buildRoot)) || ".",
+		dockerfile: toPosix(join(relative(buildRoot, workspaceRoot), dockerfile))
+	};
+}
+/** A path under the gkm root, as the build root sees it. */
+function fromBuildRoot(layout, path) {
+	if (layout.gkmRoot === ".") return toPosix(path);
+	const joined = toPosix(join(layout.gkmRoot, path));
+	return joined === "" ? "." : joined;
+}
+/** Everything a template needs about one app, relative to the build root. */
+function appImageOptions(layout, appName, app, workspaceRoot) {
+	const turboPackage = packageName(isAbsolute(app.path) ? app.path : join(workspaceRoot, app.path)) ?? appName;
+	return {
+		imageName: appName,
+		baseImage: "node:22-alpine",
+		port: app.port,
+		appPath: fromBuildRoot(layout, app.path),
+		turboPackage,
+		packageManager: layout.tools.packageManager,
+		...layout.tools.packageManagerVersion ? { packageManagerVersion: layout.tools.packageManagerVersion } : {},
+		turboVersion: layout.tools.turboVersion,
+		monorepo: layout.tools.monorepo,
+		gkmRoot: layout.gkmRoot,
+		...app.type === "backend" ? {
+			gkmPaths: layout.gkmPaths,
+			...layout.workspacePackage && layout.workspacePackage !== turboPackage ? { prunePackages: [layout.workspacePackage] } : {}
+		} : {}
+	};
+}
+/**
+* The directories the workspace's construct globs start in, relative to its
+* root: `./constructs/**\/*.ts` reads from `constructs`.
+*/
+function constructRoots(workspace) {
+	const roots = /* @__PURE__ */ new Set();
+	for (const glob of allConstructGlobs(workspace)) {
+		const rel = toPosix(relative(workspace.root, glob));
+		if (!rel || rel.startsWith("..")) continue;
+		const first = rel.split("/")[0];
+		if (/[*?{}[\]!]/.test(first)) continue;
+		roots.add(first);
+	}
+	return [...roots].sort();
+}
+function packageName(dir) {
+	try {
+		const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf-8"));
+		return typeof pkg.name === "string" ? pkg.name : void 0;
+	} catch {
+		return;
+	}
+}
+function toPosix(path) {
+	return path.split(sep).join("/");
+}
+//#endregion
+//#region src/reconcile/caddyfile.ts
+/**
+* The kinds the edge serves.
+*
+* Everything that owns a *public address*. Deployed, each of these has a real
+* hostname and a certificate, so this is what makes the local shape the same
+* one rather than a near-enough one — and the application is indifferent
+* either way, because it reads whichever address was injected and never
+* composes one.
+*
+* Adding a kind here is the whole of adding it to the edge.
+*/
+const EDGE_KINDS = {
+	"file-server": true,
+	"rest-api": true,
+	site: true
+};
+/**
+* How the edge reaches the host, from inside its container.
+*
+* A surface and a site are served by processes `gkm dev` starts on the host,
+* not by containers — so the edge has to leave Docker's network to reach them.
+* Docker Desktop resolves this name already; on Linux the compose definition
+* maps it to the host gateway.
+*/
+const HOST_GATEWAY = "host.docker.internal";
+/**
+* The suffix every local host shares.
+*
+* `.localhost` rather than a made-up TLD because it resolves to loopback
+* without touching `/etc/hosts` — macOS and systemd-resolved both answer for
+* subdomains of it, and Caddy issues internal certificates for it by default.
+*/
+const LOCAL_TLD = "localhost";
+/**
+* The sites a plan implies, one per file server.
+*
+* The leading label is the *server's* stage-scoped name rather than the
+* bucket's, which is the difference that matters: two servers over one bucket
+* are a legitimate arrangement — two cache behaviours, one origin — and naming
+* the host after the bucket would make them collide.
+*/
+function sitesFor(plan, project, addresses = {}) {
+	const byId = new Map(plan.resources.map((r) => [r.id, r]));
+	const sites = [];
+	for (const resource of plan.resources) {
+		if (!EDGE_KINDS[resource.kind]) continue;
+		const host = hostFor(resource, project);
+		if (resource.kind === "file-server") {
+			const origin = resource.of ? byId.get(resource.of) : void 0;
+			if (!origin) continue;
+			sites.push({
+				host,
+				upstream: "http://minio:9000",
+				rewrite: `/${origin.name}{uri}`
+			});
+			continue;
+		}
+		const address = addresses[resource.id];
+		if (!address) continue;
+		const port = portOf(address);
+		if (!port) continue;
+		sites.push({
+			host,
+			upstream: `http://${HOST_GATEWAY}:${port}`
+		});
+	}
+	return sites;
+}
+/** The port a local address answers on, defaulting by scheme. */
+function portOf(address) {
+	try {
+		const { port, protocol } = new URL(address);
+		return port || (protocol === "https:" ? "443" : "80");
+	} catch {
+		return;
+	}
+}
+/**
+* Where one file server answers, including the stage its name carries.
+*
+* The project is a label rather than a decoration: it is what keeps two
+* checkouts from answering on one address. Omitted when there is no project to
+* name, because an empty label makes `uploads..localhost` — a host nothing
+* resolves and no certificate can be issued for.
+*/
+function hostFor(resource, project) {
+	return [
+		resource.root && project ? stageOf(resource) : labelOf(resource),
+		project,
+		LOCAL_TLD
+	].filter(Boolean).join(".");
+}
+/**
+* A resource's own label: its `subdomain` where it declared one — the label a
+* deploy uses too — with the stage it carries kept, so `gkm test` and `gkm dev`
+* still answer on different hosts.
+*/
+function labelOf(resource) {
+	if (!resource.subdomain) return resource.name;
+	const stage = stageOf(resource);
+	return stage ? `${resource.subdomain}-${stage}` : resource.subdomain;
+}
+/** The stage a resource's name carries, or nothing for the local stage's. */
+function stageOf(resource) {
+	const base = resource.id.toLowerCase();
+	return resource.name === base ? void 0 : resource.name.slice(base.length + 1);
+}
+/**
+* The static root config, which only ever imports.
+*
+* Written once and identical for every stage, because the *sites* are what
+* differ and they live in their own files. That split is not tidiness: one
+* container serves every stage — the same way one Postgres holds `orders` and
+* `orders_test` — so a single Caddyfile would mean `gkm test` deleting the
+* routes `gkm dev` is serving, and each command silently breaking the other.
+*/
+function caddyfileRoot() {
+	return `${GENERATED}
+{
+	# No ACME, no public DNS: the CA is local and so are the names.
+	local_certs
+	auto_https disable_redirects
+}
+
+# One file per stage, so two stages share this edge the way they already share
+# one Postgres and one MinIO.
+import /etc/caddy/sites/*.caddy
+`;
+}
+/**
+* One stage's sites, as the file imported above.
+*
+* `rewrite` rather than a path prefix on the address: the bucket is the
+* origin's business, and the client asks for the key it stored.
+*
+* `header_up Host {upstream_hostport}` matters more than it looks. MinIO routes
+* and signs on the Host header, so forwarding the requested hostname would make
+* it look for a bucket named after the domain.
+*/
+function toCaddyfile(sites) {
+	if (sites.length === 0) return `${GENERATED}
+# No file server is declared in this stage, so it routes nothing.
+`;
+	const blocks = sites.map(({ host, upstream, rewrite }) => `
+https://${host} {
+	tls internal
+
+	reverse_proxy ${upstream} {${rewrite ? `
+		rewrite ${rewrite}
+		# MinIO routes and signs on the Host header, so forwarding the requested
+		# hostname would make it look for a bucket named after the domain.
+		header_up Host {upstream_hostport}` : `
+		# The application reads whatever address was injected, so it has to see
+		# the one a caller used — that is what makes a redirect, a cookie domain
+		# and a generated link point back here rather than at the upstream.
+		header_up Host {host}
+		header_up X-Forwarded-Proto {scheme}`}
+	}
+}`);
+	return `${GENERATED}${blocks.join("\n")}\n`;
+}
+const GENERATED = `# Generated by gkm from the construct manifest — do not edit.
+#
+# One host per declared file server, in front of the object store that holds its
+# objects. This is the shape a file server has deployed — a domain serving a
+# bucket — which MinIO alone cannot produce: its virtual-host mode reads the
+# leading label as the bucket name.
+#
+# Certificates come from Caddy's own CA. "gkm dev" and "gkm test" export its
+# root and point Node at it, so nothing has to be installed to use these URLs
+# from code; a browser needs the root trusted once.
+`;
+//#endregion
+//#region src/reconcile/emulator.ts
+/**
+* The AWS emulator (floci, LocalStack-compatible) the `sns` backend runs on
+* locally — the facts the compose file, the env writer and the applier must
+* agree on.
+*
+* The emulator has one account and answers with deterministic ARNs and queue
+* URLs, which is what lets a connection string be composed before the topic
+* or queue it names has been created.
+*/
+/** The emulator's single account. */
+const EMULATOR_ACCOUNT = "000000000000";
+const EMULATOR_REGION = "us-east-1";
+/**
+* The emulator's credential. The `LSIA` prefix is what LocalStack required on
+* issued keys; floci does not care, and keeping it means a project that pins
+* the old image still works.
+*/
+const EMULATOR_CREDENTIALS = {
+	accessKeyId: "LSIAQAAAAAAVNCBMPNSG",
+	secretAccessKey: "geekmidas"
+};
+/** The emulator's address from the host, on the port it was published on. */
+function emulatorEndpoint(port) {
+	return `http://localhost:${port}`;
+}
+function emulatorTopicArn(name) {
 	return `arn:aws:sns:${EMULATOR_REGION}:${EMULATOR_ACCOUNT}:${name}`;
 }
 function emulatorQueueUrl(name, port) {
@@ -2168,19 +3010,24 @@ function appServices(workspace, manifest, containers, runnables = {}, fakes = {}
 		addresses: surfaceAddresses(workspace, manifest)
 	});
 	const services = {};
+	const buildRoot = findBuildRoot(workspace.root);
 	for (const [name, app] of Object.entries(workspace.apps)) {
 		if (app.type === "mobile" || !app.port) continue;
 		const key = appKey(name);
 		const health = app.type === "web" ? "/" : "/health";
-		const dockerfile = dockerfileOf(name, app.path);
+		const build = composeBuildPaths({
+			composeDir: workspace.root,
+			buildRoot,
+			workspaceRoot: workspace.root,
+			dockerfile: dockerfileOf(name, app.path)
+		});
 		const ports = [`${app.port}:${app.port}`];
 		if (app.type === "web") {
 			const args = sitePublicArgs(manifest, name, browser);
 			services[key] = {
 				image: `${key}:\${TAG:-latest}`,
 				build: {
-					context: ".",
-					dockerfile,
+					...build,
 					...Object.keys(args).length ? { args } : {}
 				},
 				profiles: [APPS_PROFILE],
@@ -2193,10 +3040,7 @@ function appServices(workspace, manifest, containers, runnables = {}, fakes = {}
 		const own = Object.fromEntries(Object.entries(env).filter(([envKey]) => allowed?.has(envKey)));
 		services[key] = {
 			image: `${key}:\${TAG:-latest}`,
-			build: {
-				context: ".",
-				dockerfile
-			},
+			build,
 			profiles: [APPS_PROFILE],
 			ports,
 			environment: {
@@ -2263,15 +3107,18 @@ function pgClient(port, password = LOCAL_USER$1) {
 		}
 	} };
 }
-/** A bucket client pointed at the local MinIO. */
-function bucketClient(port) {
+/** A bucket client pointed at a MinIO on this machine. */
+function bucketClient(port, credentials = {
+	user: LOCAL_USER$1,
+	password: LOCAL_USER$1
+}) {
 	const s3 = new S3Client({
 		region: "us-east-1",
 		endpoint: `http://localhost:${port}`,
 		forcePathStyle: true,
 		credentials: {
-			accessKeyId: LOCAL_USER$1,
-			secretAccessKey: LOCAL_USER$1
+			accessKeyId: credentials.user,
+			secretAccessKey: credentials.password
 		}
 	});
 	return {
@@ -3630,1007 +4477,436 @@ async function reconcileWorkspace(workspace, options) {
 		...options.progress ? { progress: options.progress } : {}
 	});
 	await savePortState(workspace.root, { ...result.ports });
-	return {
-		...result,
-		manifest
-	};
-}
-/**
-* Where each mobile app's Metro runs: its app's port, which `gkm exec` hands
-* Expo as `RCT_METRO_PORT`. Kept apart from the surfaces' addresses — a phone
-* reaches Metro by `exp://`, not through the edge.
-*/
-function metroPorts(workspace, manifest) {
-	const ports = {};
-	for (const [id, declaration] of Object.entries(manifest)) {
-		if (declaration.kind !== "mobile-app") continue;
-		const port = workspace.apps[appKey(id)]?.port;
-		if (port) ports[id] = port;
-	}
-	return ports;
-}
-/**
-* Where each declared surface and site answers locally.
-*
-* The addresses come from the ports the workspace already assigns; which
-* construct sits at which one comes from the manifest. That split is the point:
-* this used to answer "who may call whom" by listing every app the workspace
-* runs, which is a different question that happened to give the same answer in
-* a single-repo workspace and no answer at all deployed. Now it answers only
-* "where does this construct answer", and the graph answers the rest.
-*
-* A site is matched to its app by `path`, because that is the one thing a site
-* declaration and a workspace app both name. Surfaces are matched to the
-* backend app: every `rest-api` in a process answers on that process's port, so
-* an app serving both its own API and an auth server publishes one address
-* twice — which is exactly what it does at runtime.
-*/
-function surfaceAddresses(workspace, manifest, at = (_app, port) => localAddress(port)) {
-	const addresses = {};
-	for (const [id, declaration] of Object.entries(manifest)) {
-		if (declaration.kind !== "rest-api" && declaration.kind !== "site") continue;
-		const host = appKey(id);
-		const port = workspace.apps[host]?.port;
-		if (port) addresses[id] = at(host, port);
-	}
-	return addresses;
-}
-/** Where a local process answers, given the port the workspace gave it. */
-function localAddress(port) {
-	return `http://localhost:${port}`;
-}
-//#endregion
-//#region src/target/dokploy/domain.ts
-/** A stage was deployed that `deploy.domains` gives no domain. */
-var NoDomainForStage = class extends Error {
-	stage;
-	constructor(stage) {
-		super(`No domain for stage "${stage}". Add it to gkm.config.ts: deploy: { domains: { ${stage}: 'example.com' } }.`);
-		this.stage = stage;
-		this.name = "NoDomainForStage";
-	}
-};
-/**
-* The hostname an app answers on for a stage.
-*
-* 1. An explicit `app.domain` — a string, or one per stage — wins.
-* 2. Otherwise from the stage's base domain in `deploy.domains`: the root site
-*    answers on the domain itself, and every other app on
-*    `{subdomain}.{domain}` — its declaration's `subdomain`, or its own name.
-*
-* @throws {NoDomainForStage} when `deploy.domains` names no domain for it
-*/
-function resolveHost(appName, app, stage, domains, isMainFrontend) {
-	if (app.domain) {
-		if (typeof app.domain === "string") return app.domain;
-		if (app.domain[stage]) return app.domain[stage];
-	}
-	const baseDomain = domains?.[stage];
-	if (!baseDomain) throw new NoDomainForStage(stage);
-	if (isMainFrontend) return baseDomain;
-	return `${app.subdomain ?? appName}.${baseDomain}`;
-}
-/**
-* Whether this app is the site the base domain points at — see `rootSite`,
-* which the local edge asks too.
-*
-* @throws {AmbiguousRootSite} when several sites could be the root and none says it is
-*/
-function isMainFrontendApp(appName, app, allApps) {
-	if (app.type !== "web") return false;
-	return rootSite(Object.entries(allApps).filter(([, a]) => a.type === "web").map(([name, a]) => ({
-		name,
-		root: a.root
-	}))) === appName;
-}
-/**
-* Get public URL arg names from app dependencies.
-*
-* @param app - The web/mobile app configuration
-* @returns Array of arg names like 'NEXT_PUBLIC_API_URL', or [] for frameworks
-*   without a public prefix (e.g. Remix).
-*/
-function getPublicUrlArgNames(app) {
-	const prefix = getPublicEnvPrefix(app.framework);
-	if (!prefix) return [];
-	return app.dependencies.map((dep) => `${prefix}${dep.toUpperCase()}_URL`);
-}
-//#endregion
-//#region src/docker/imageRef.ts
-/**
-* An image reference, checked before it reaches `docker`.
-*
-* The parts come from the workspace — a registry in `gkm.config.ts`, an image
-* name from the project, a tag from `--tag` — and an argument array already
-* keeps them out of a shell. What it cannot do is stop `docker` reading a value
-* that starts with `-` as one of its own flags, so a ref is held to Docker's
-* own grammar (distribution/reference) and anything else is refused by name
-* before a build starts.
-*/
-const DOMAIN_COMPONENT = "(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])";
-const DOMAIN = `${DOMAIN_COMPONENT}(?:\\.${DOMAIN_COMPONENT})*(?::[0-9]+)?`;
-const PATH_COMPONENT = "[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*";
-const REFERENCE = new RegExp(`^(?:${DOMAIN}/)?${PATH_COMPONENT}(?:/${PATH_COMPONENT})*(?::[\\w][\\w.-]{0,127})?(?:@[A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*:[0-9a-fA-F]{32,})?$`);
-/** Docker refuses a repository name longer than this. */
-const MAX_NAME_LENGTH = 255;
-/** A value that is not an image reference was about to be built or pushed. */
-var ImageRefInvalid = class extends Error {
-	ref;
-	constructor(ref) {
-		super(`'${ref}' is not a valid image reference. An image is \`[registry/]name[:tag]\`: the name lowercase letters, digits and . _ - separators, the tag up to 128 of letters, digits, _ . and -, not starting with . or -. Check docker.registry in gkm.config.ts and the --tag passed.`);
-		this.ref = ref;
-		this.name = "ImageRefInvalid";
-	}
-};
-/** Throw {@link ImageRefInvalid} unless `ref` is a Docker image reference. */
-function validateImageRef(ref) {
-	const name = ref.split("@")[0].replace(/:[\w][\w.-]*$/, "");
-	if (!REFERENCE.test(ref) || name.length > MAX_NAME_LENGTH) throw new ImageRefInvalid(ref);
-	return ref;
-}
-//#endregion
-//#region src/docker/templates.ts
-const LOCKFILES = [
-	["pnpm-lock.yaml", "pnpm"],
-	["bun.lockb", "bun"],
-	["yarn.lock", "yarn"],
-	["package-lock.json", "npm"]
-];
-/**
-* Detect package manager from lockfiles
-* Walks up the directory tree to find lockfile (for monorepos)
-*/
-function detectPackageManager(cwd = process.cwd()) {
-	let dir = cwd;
-	const root = parse(dir).root;
-	while (dir !== root) {
-		for (const [lockfile, pm] of LOCKFILES) if (existsSync(join(dir, lockfile))) return pm;
-		dir = dirname(dir);
-	}
-	for (const [lockfile, pm] of LOCKFILES) if (existsSync(join(root, lockfile))) return pm;
-	return "pnpm";
+	return {
+		...result,
+		manifest
+	};
 }
 /**
-* Find the lockfile path by walking up the directory tree
-* Returns the full path to the lockfile, or null if not found
+* Where each mobile app's Metro runs: its app's port, which `gkm exec` hands
+* Expo as `RCT_METRO_PORT`. Kept apart from the surfaces' addresses — a phone
+* reaches Metro by `exp://`, not through the edge.
 */
-function findLockfilePath(cwd = process.cwd()) {
-	let dir = cwd;
-	const root = parse(dir).root;
-	while (dir !== root) {
-		for (const [lockfile] of LOCKFILES) {
-			const lockfilePath = join(dir, lockfile);
-			if (existsSync(lockfilePath)) return lockfilePath;
-		}
-		dir = dirname(dir);
-	}
-	for (const [lockfile] of LOCKFILES) {
-		const lockfilePath = join(root, lockfile);
-		if (existsSync(lockfilePath)) return lockfilePath;
+function metroPorts(workspace, manifest) {
+	const ports = {};
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration.kind !== "mobile-app") continue;
+		const port = workspace.apps[appKey(id)]?.port;
+		if (port) ports[id] = port;
 	}
-	return null;
-}
-/**
-* Check if we're in a monorepo (lockfile is in a parent directory)
-*/
-function isMonorepo(cwd = process.cwd()) {
-	const lockfilePath = findLockfilePath(cwd);
-	if (!lockfilePath) return false;
-	return dirname(lockfilePath) !== cwd;
+	return ports;
 }
 /**
-* Check if turbo.json exists (walks up directory tree)
+* Where each declared surface and site answers locally.
+*
+* The addresses come from the ports the workspace already assigns; which
+* construct sits at which one comes from the manifest. That split is the point:
+* this used to answer "who may call whom" by listing every app the workspace
+* runs, which is a different question that happened to give the same answer in
+* a single-repo workspace and no answer at all deployed. Now it answers only
+* "where does this construct answer", and the graph answers the rest.
+*
+* A site is matched to its app by `path`, because that is the one thing a site
+* declaration and a workspace app both name. Surfaces are matched to the
+* backend app: every `rest-api` in a process answers on that process's port, so
+* an app serving both its own API and an auth server publishes one address
+* twice — which is exactly what it does at runtime.
 */
-function hasTurboConfig(cwd = process.cwd()) {
-	let dir = cwd;
-	const root = parse(dir).root;
-	while (dir !== root) {
-		if (existsSync(join(dir, "turbo.json"))) return true;
-		dir = dirname(dir);
+function surfaceAddresses(workspace, manifest, at = (_app, port) => localAddress(port)) {
+	const addresses = {};
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration.kind !== "rest-api" && declaration.kind !== "site") continue;
+		const host = appKey(id);
+		const port = workspace.apps[host]?.port;
+		if (port) addresses[id] = at(host, port);
 	}
-	return existsSync(join(root, "turbo.json"));
+	return addresses;
 }
-/**
-* Get install command for turbo builds (without frozen lockfile)
-* Turbo prune creates a subset that may not perfectly match the lockfile
-*/
-function getTurboInstallCmd(pm) {
-	return {
-		pnpm: "pnpm install",
-		npm: "npm install",
-		yarn: "yarn install",
-		bun: "bun install"
-	}[pm];
+/** Where a local process answers, given the port the workspace gave it. */
+function localAddress(port) {
+	return `http://localhost:${port}`;
 }
+//#endregion
+//#region src/secrets/encryption.ts
+var encryption_exports = /* @__PURE__ */ __exportAll({
+	encryptSecrets: () => encryptSecrets,
+	generateDefineOptions: () => generateDefineOptions,
+	keyFingerprint: () => keyFingerprint
+});
+/** AES-256-GCM configuration */
+const ALGORITHM = "aes-256-gcm";
+const KEY_LENGTH = 32;
+const IV_LENGTH = 12;
 /**
-* Get package manager specific commands and paths
+* Encrypt secrets for embedding in a bundle.
+* Uses AES-256-GCM with a randomly generated ephemeral key.
+*
+* @param secrets - Key-value pairs to encrypt
+* @returns Encrypted payload with ephemeral master key
 */
-function getPmConfig(pm) {
+function encryptSecrets(secrets) {
+	const masterKey = randomBytes(KEY_LENGTH);
+	const iv = randomBytes(IV_LENGTH);
+	const plaintext = JSON.stringify(secrets);
+	const cipher = createCipheriv(ALGORITHM, masterKey, iv);
+	const ciphertext = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
+	const authTag = cipher.getAuthTag();
 	return {
-		pnpm: {
-			install: "corepack enable && corepack prepare pnpm@latest --activate",
-			lockfile: "pnpm-lock.yaml",
-			fetch: "pnpm fetch",
-			installCmd: "pnpm install --frozen-lockfile --offline",
-			cacheTarget: "/root/.local/share/pnpm/store",
-			cacheId: "pnpm",
-			run: "pnpm",
-			exec: "pnpm exec",
-			dlx: "pnpm dlx",
-			addGlobal: "pnpm add -g"
-		},
-		npm: {
-			install: "",
-			lockfile: "package-lock.json",
-			fetch: "",
-			installCmd: "npm ci",
-			cacheTarget: "/root/.npm",
-			cacheId: "npm",
-			run: "npm run",
-			exec: "npx",
-			dlx: "npx",
-			addGlobal: "npm install -g"
-		},
-		yarn: {
-			install: "corepack enable && corepack prepare yarn@stable --activate",
-			lockfile: "yarn.lock",
-			fetch: "",
-			installCmd: "yarn install --frozen-lockfile",
-			cacheTarget: "/root/.yarn/cache",
-			cacheId: "yarn",
-			run: "yarn",
-			exec: "yarn exec",
-			dlx: "yarn dlx",
-			addGlobal: "yarn global add"
-		},
-		bun: {
-			install: "npm install -g bun",
-			lockfile: "bun.lockb",
-			fetch: "",
-			installCmd: "bun install --frozen-lockfile",
-			cacheTarget: "/root/.bun/install/cache",
-			cacheId: "bun",
-			run: "bun run",
-			exec: "bunx",
-			dlx: "bunx",
-			addGlobal: "bun add -g"
-		}
-	}[pm];
-}
-/**
-* Generate a multi-stage Dockerfile for building from source
-* Optimized for build speed with:
-* - BuildKit cache mounts for package manager store
-* - pnpm fetch for better layer caching (when using pnpm)
-* - Optional turbo prune for monorepos
-*/
-function generateMultiStageDockerfile(options) {
-	const { baseImage, port, healthCheckPath, turbo, turboPackage, packageManager } = options;
-	if (turbo) return generateTurboDockerfile({
-		...options,
-		turboPackage: turboPackage ?? "api"
-	});
-	const pm = getPmConfig(packageManager);
-	return `# syntax=docker/dockerfile:1
-# Stage 1: Dependencies
-FROM ${baseImage} AS deps
-
-WORKDIR /app
-${pm.install ? `\n# Install ${packageManager}\nRUN ${pm.install}\n` : ""}
-${packageManager === "pnpm" ? `# Copy lockfile first for better caching
-COPY ${pm.lockfile} ./
-
-# Fetch dependencies (downloads to virtual store, cached separately)
-RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
-    ${pm.fetch}
-
-# Copy package.json after fetch
-COPY package.json ./
-
-# Install from cache (fast - no network needed)
-RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
-    ${pm.installCmd}` : `# Copy package files
-COPY package.json ${pm.lockfile} ./
-
-# Install dependencies with cache
-RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
-    ${pm.installCmd}`}
-
-# Stage 2: Build
-FROM deps AS builder
-
-WORKDIR /app
-
-# Copy source (deps already installed)
-COPY . .
-
-# Build any workspace packages the app depends on.
-#
-# A no-op for a project whose dependencies come from a registry, and required
-# for one whose CLI is a sibling package: \`turbo prune\` honours .gitignore, so a
-# workspace package's \`dist\` never reaches the image and its bin has nothing to
-# import. \`--if-present\` is what makes the same Dockerfile correct for both.
-RUN ${pm.run} --if-present build
-
-# Build production server using gkm
-RUN ${pm.exec} gkm build --provider server --production
-
-# Stage 3: Production
-FROM ${baseImage} AS runner
-
-WORKDIR /app
-
-# Install tini for proper signal handling as PID 1
-RUN apk add --no-cache tini
-
-# Create non-root user
-RUN addgroup --system --gid 1001 nodejs && \\
-    adduser --system --uid 1001 hono
-
-# Copy bundled server
-COPY --from=builder --chown=hono:nodejs /app/.gkm/server/dist/server.mjs ./
-
-# Environment
-ENV NODE_ENV=production
-ENV PORT=${port}
-
-# Health check
-HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
-  CMD wget -qO- http://localhost:${port}${healthCheckPath} > /dev/null 2>&1 || exit 1
-
-# Switch to non-root user
-USER hono
-
-EXPOSE ${port}
-
-# Use tini as entrypoint to handle PID 1 responsibilities
-ENTRYPOINT ["/sbin/tini", "--"]
-CMD ["node", "server.mjs"]
-`;
-}
-/**
-* Generate a Dockerfile optimized for Turbo monorepos
-* Uses turbo prune to create minimal Docker context
-*/
-function generateTurboDockerfile(options) {
-	const { baseImage, port, healthCheckPath, turboPackage, packageManager } = options;
-	const pm = getPmConfig(packageManager);
-	const installPm = pm.install ? `RUN ${pm.install}` : "";
-	const turboInstallCmd = getTurboInstallCmd(packageManager);
-	return `# syntax=docker/dockerfile:1
-# Stage 1: Prune monorepo
-FROM ${baseImage} AS pruner
-
-WORKDIR /app
-
-${installPm}
-
-COPY . .
-
-# Prune to only include necessary packages
-RUN ${packageManager === "pnpm" ? "pnpm dlx turbo" : "npx turbo"} prune ${turboPackage} --docker
-
-# Stage 2: Install dependencies
-FROM ${baseImage} AS deps
-
-WORKDIR /app
-
-${installPm}
-
-# Copy pruned lockfile and package.jsons
-COPY --from=pruner /app/out/${pm.lockfile} ./
-COPY --from=pruner /app/out/json/ ./
-
-# Install dependencies (no frozen-lockfile since turbo prune creates a subset)
-RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
-    ${turboInstallCmd}
-
-# Stage 3: Build
-FROM deps AS builder
-
-WORKDIR /app
-
-# Copy pruned source
-COPY --from=pruner /app/out/full/ ./
-
-# Build any workspace packages the app depends on.
-#
-# A no-op for a project whose dependencies come from a registry, and required
-# for one whose CLI is a sibling package: \`turbo prune\` honours .gitignore, so a
-# workspace package's \`dist\` never reaches the image and its bin has nothing to
-# import. \`--if-present\` is what makes the same Dockerfile correct for both.
-RUN ${pm.run} --if-present build
-
-# Build production server using gkm
-RUN ${pm.exec} gkm build --provider server --production
-
-# Stage 4: Production
-FROM ${baseImage} AS runner
-
-WORKDIR /app
-
-RUN apk add --no-cache tini
-
-RUN addgroup --system --gid 1001 nodejs && \\
-    adduser --system --uid 1001 hono
-
-COPY --from=builder --chown=hono:nodejs /app/.gkm/server/dist/server.mjs ./
-
-ENV NODE_ENV=production
-ENV PORT=${port}
-
-HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
-  CMD wget -qO- http://localhost:${port}${healthCheckPath} > /dev/null 2>&1 || exit 1
-
-USER hono
-
-EXPOSE ${port}
-
-ENTRYPOINT ["/sbin/tini", "--"]
-CMD ["node", "server.mjs"]
-`;
-}
-/**
-* Generate a slim Dockerfile for pre-built bundles
-*/
-function generateSlimDockerfile(options) {
-	const { baseImage, port, healthCheckPath, bundle = ".gkm/server/dist/server.mjs" } = options;
-	return `# Slim Dockerfile for pre-built production bundle
-FROM ${baseImage}
-
-WORKDIR /app
-
-# Install tini for proper signal handling as PID 1
-# Handles SIGTERM propagation and zombie process reaping
-RUN apk add --no-cache tini
-
-# Create non-root user
-RUN addgroup --system --gid 1001 nodejs && \\
-    adduser --system --uid 1001 hono
-
-# Copy pre-built bundle
-COPY ${bundle} ./
-
-# Environment
-ENV NODE_ENV=production
-ENV PORT=${port}
-
-# Health check
-HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
-  CMD wget -qO- http://localhost:${port}${healthCheckPath} > /dev/null 2>&1 || exit 1
-
-# Switch to non-root user
-USER hono
-
-EXPOSE ${port}
-
-# Use tini as entrypoint to handle PID 1 responsibilities
-ENTRYPOINT ["/sbin/tini", "--"]
-CMD ["node", "server.mjs"]
-`;
+		encrypted: Buffer.concat([ciphertext, authTag]).toString("base64"),
+		iv: iv.toString("hex"),
+		masterKey: masterKey.toString("hex")
+	};
 }
 /**
-* Generate .dockerignore file
+* Generate the define options for tsdown/esbuild.
+* These will be injected at build time.
 */
-function generateDockerignore() {
-	return `# Dependencies
-node_modules
-.pnpm-store
-
-# Build output (except what we need)
-.gkm/aws*
-.gkm/server/*.ts
-!.gkm/server/dist
-
-# The key gkm build --stage encrypted secrets with: runtime env only, never
-# the build context
-.gkm/server/master.key
-
-# gkm compose's stacks: each app's env file holds its stage's secrets
-.gkm/compose
-
-# IDE and editor
-.idea
-.vscode
-*.swp
-*.swo
-
-# Git
-.git
-.gitignore
-
-# Logs
-*.log
-npm-debug.log*
-pnpm-debug.log*
-
-# Test files
-**/*.test.ts
-**/*.spec.ts
-**/__tests__
-coverage
-
-# Documentation
-docs
-*.md
-!README.md
-
-# Environment files (handle secrets separately)
-.env
-.env.*
-!.env.example
-
-# Docker files (don't copy recursively)
-Dockerfile*
-docker-compose*
-.dockerignore
-`;
+function generateDefineOptions(payload) {
+	return {
+		__GKM_ENCRYPTED_CREDENTIALS__: JSON.stringify(payload.encrypted),
+		__GKM_CREDENTIALS_IV__: JSON.stringify(payload.iv)
+	};
 }
 /**
-* Generate docker-entrypoint.sh for custom startup logic
+* A short, one-way name for a master key: the first 8 hex characters of its
+* SHA-256.
+*
+* Printed where the key itself used to be, so a person can tell which key a
+* build used — and match it against the one they hold — without the output
+* carrying a value that decrypts every secret of the stage.
 */
-function generateDockerEntrypoint() {
-	return `#!/bin/sh
-set -e
-
-# Run any custom startup scripts here
-# Example: wait for database
-# until nc -z $DB_HOST $DB_PORT; do
-#   echo "Waiting for database..."
-#   sleep 1
-# done
-
-# Execute the main command
-exec "$@"
-`;
+function keyFingerprint(masterKey) {
+	return createHash("sha256").update(masterKey).digest("hex").slice(0, 8);
 }
+//#endregion
+//#region src/deploy/devServices.ts
+/**
+* Mail and object storage on a deployed stage: real ones, or — only when
+* someone asked — the dev services the local stage runs.
+*
+* Locally a declared `Email` is Mailpit and a declared bucket is MinIO, and
+* nobody has to configure either. Deployed, the same two containers would be
+* a stage that silently delivers no mail and keeps its files on one
+* container's disk. So a deployed stage on a server target takes both from
+* its secrets — the mail server's URL and sending address, and each bucket's
+* URL — and a stage missing any of them fails before anything is built,
+* provisioned or written, naming every key at once.
+*
+* A bucket's credentials are not checked: they are optional, and come from
+* either of two places. The bucket's URL may carry a key of its own
+* (`s3://KEY:SECRET@uploads`), which wins; otherwise the S3 client's default
+* chain applies — the stage's shared `AWS_ACCESS_KEY_ID`/
+* `AWS_SECRET_ACCESS_KEY` when it set them, or a role.
+*
+* `--allow-dev-services minio,mailpit` is the way out for a stage that is
+* not production — a preview, a demo: the target runs the dev service and
+* derives the keys from it. Keys the stage did set still win. Every run that
+* uses one says so, loudly.
+*
+* Pure: what each target runs is decided here from declarations and the
+* stage's values, and the targets do the running.
+*/
+/** The dev services a deployed stage may be allowed to run. */
+const DEV_SERVICES = ["minio", "mailpit"];
+/**
+* The S3 client's shared key pair. Optional: a bucket whose URL carries its own
+* key (`s3://KEY:SECRET@bucket`) signs with that, and one without signs with
+* this pair when the stage set it, or with whatever else the SDK's default
+* chain finds — a role.
+*/
+const STORAGE_KEY_PAIR = ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY"];
+/** A `--allow-dev-services` value that is not a dev service. */
+var UnknownDevService = class extends Error {
+	value;
+	constructor(value) {
+		super(`'${value}' is not a dev service. --allow-dev-services takes a comma-separated list of ${DEV_SERVICES.join(", ")}: --allow-dev-services ${DEV_SERVICES.join(",")}`);
+		this.value = value;
+		this.name = "UnknownDevService";
+	}
+};
+/** Dev services asked of a target that runs no containers. */
+var DevServicesNeedServerTarget = class extends Error {
+	target;
+	services;
+	constructor(target, services) {
+		super(`--allow-dev-services applies to server targets only, and '${target}' deploys to AWS, where a bucket is S3 and mail is the stage's own. Drop --allow-dev-services ${services.join(",")}.`);
+		this.target = target;
+		this.services = services;
+		this.name = "DevServicesNeedServerTarget";
+	}
+};
 /**
-* Resolve Docker configuration from GkmConfig with defaults
+* A deployed stage with mail or object storage that its secrets do not
+* configure — every missing key, across every app, at once.
 */
-function resolveDockerConfig(config) {
-	const docker = config.docker ?? {};
-	return {
-		registry: docker.registry ?? "",
-		imageName: docker.imageName ?? config.name ?? "api",
-		baseImage: docker.baseImage ?? "node:22-alpine",
-		port: docker.port ?? 3e3
-	};
+var ExternalServicesNotConfigured = class extends Error {
+	stage;
+	missing;
+	constructor(stage, missing) {
+		const services = [...new Set(missing.map((m) => m.service))].sort();
+		const lines = missing.map((m) => {
+			const by = m.apps?.length ? `, read by ${m.apps.join(", ")}` : "";
+			return `  gkm secrets:set ${m.key} '${m.example}' --stage ${stage}\n      ${m.what}${by}` + (m.note ? `\n      ${m.note}` : "");
+		});
+		super(`The stage '${stage}' is deployed, and a deployed stage's mail and object storage are real services: gkm runs no Mailpit or MinIO for it. Set ${missing.length === 1 ? "this key" : `these ${missing.length} keys`} in the stage's secrets:\n\n${lines.join("\n")}\n\nFor a stage that is not production — a preview, a demo — the dev services can run instead, with --allow-dev-services ${services.join(",")}. Mailpit delivers no mail, and MinIO keeps every object on one container's disk.`);
+		this.stage = stage;
+		this.missing = missing;
+		this.name = "ExternalServicesNotConfigured";
+	}
+};
+/**
+* The dev services a value names: `'minio,mailpit'`, or a list of them.
+*
+* @throws {UnknownDevService} for anything that is not one
+*/
+function parseDevServices(value) {
+	if (value === void 0) return [];
+	const items = (typeof value === "string" ? [value] : value).flatMap((item) => item.split(",")).map((item) => item.trim()).filter(Boolean);
+	const services = /* @__PURE__ */ new Set();
+	for (const item of items) {
+		if (!DEV_SERVICES.includes(item)) throw new UnknownDevService(item);
+		services.add(item);
+	}
+	return [...services].sort();
 }
 /**
-* Generate a Dockerfile for Next.js frontend apps using standalone output.
-* Uses turbo prune for monorepo optimization.
-* @internal Exported for testing
+* Every mail and storage construct a manifest declares, with the apps that
+* depend on each — what a target that provisions the whole manifest checks.
 */
-function generateNextjsDockerfile(options) {
-	const { baseImage, port, appPath, turboPackage, packageManager, publicUrlArgs = ["NEXT_PUBLIC_API_URL", "NEXT_PUBLIC_AUTH_URL"] } = options;
-	const pm = getPmConfig(packageManager);
-	const installPm = pm.install ? `RUN ${pm.install}` : "";
-	const turboInstallCmd = getTurboInstallCmd(packageManager);
-	const turboCmd = packageManager === "pnpm" ? "pnpm dlx turbo" : "npx turbo";
-	const publicUrlArgDeclarations = publicUrlArgs.map((arg) => `ARG ${arg}=""`).join("\n");
-	const publicUrlEnvDeclarations = publicUrlArgs.map((arg) => `ENV ${arg}=$${arg}`).join("\n");
-	return `# syntax=docker/dockerfile:1
-# Next.js standalone Dockerfile with turbo prune optimization
-
-# Stage 1: Prune monorepo
-FROM ${baseImage} AS pruner
-
-WORKDIR /app
-
-${installPm}
-
-COPY . .
-
-# Prune to only include necessary packages
-RUN ${turboCmd} prune ${turboPackage} --docker
-
-# Stage 2: Install dependencies
-FROM ${baseImage} AS deps
-
-WORKDIR /app
-
-${installPm}
-
-# Copy pruned lockfile and package.jsons
-COPY --from=pruner /app/out/${pm.lockfile} ./
-COPY --from=pruner /app/out/json/ ./
-
-# Install dependencies
-RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
-    ${turboInstallCmd}
-
-# Stage 3: Build
-FROM deps AS builder
-
-WORKDIR /app
-
-# Build-time args for public API URLs (populated by gkm deploy)
-# These get baked into the Next.js build as public environment variables
-${publicUrlArgDeclarations}
-
-# Convert ARGs to ENVs for Next.js build
-${publicUrlEnvDeclarations}
-
-# Copy pruned source
-COPY --from=pruner /app/out/full/ ./
-
-# Copy workspace root configs for turbo builds (turbo prune doesn't include root configs)
-# Using wildcard to make it optional for single-app projects
-COPY --from=pruner /app/tsconfig.* ./
-
-# Ensure public directory exists (may be empty for scaffolded projects)
-RUN mkdir -p ${appPath}/public
-
-# Set Next.js to produce standalone output
-ENV NEXT_TELEMETRY_DISABLED=1
-
-# Build the application
-RUN ${turboCmd} run build --filter=${turboPackage}
-
-# Stage 4: Production
-FROM ${baseImage} AS runner
-
-WORKDIR /app
-
-# Install tini for proper signal handling
-RUN apk add --no-cache tini
-
-# Create non-root user
-RUN addgroup --system --gid 1001 nodejs && \\
-    adduser --system --uid 1001 nextjs
-
-# Set environment
-ENV NODE_ENV=production
-ENV NEXT_TELEMETRY_DISABLED=1
-ENV PORT=${port}
-ENV HOSTNAME="0.0.0.0"
-
-# Copy static files and standalone output
-COPY --from=builder --chown=nextjs:nodejs /app/${appPath}/.next/standalone ./
-COPY --from=builder --chown=nextjs:nodejs /app/${appPath}/.next/static ./${appPath}/.next/static
-COPY --from=builder --chown=nextjs:nodejs /app/${appPath}/public ./${appPath}/public
-
-USER nextjs
-
-EXPOSE ${port}
-
-# A site answers at its root; Docker, and Dokploy, read the container's
-# health from it rather than from the process merely running. 127.0.0.1, not
-# localhost: the server listens on IPv4, and localhost can resolve to ::1.
-HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
-  CMD wget -qO- http://127.0.0.1:${port}/ > /dev/null 2>&1 || exit 1
-
-ENTRYPOINT ["/sbin/tini", "--"]
-CMD ["node", "${appPath}/server.js"]
-`;
+function manifestServiceDeclarations(manifest) {
+	return Object.entries(manifest).flatMap(([id, declaration]) => {
+		const { kind } = declaration;
+		if (kind !== "email" && kind !== "objects" && kind !== "file-server") return [];
+		const apps = dependentsOf(manifest, id).filter((caller) => {
+			const callerKind = manifest[caller]?.kind;
+			return callerKind === "rest-api" || callerKind === "site";
+		}).map(appKey);
+		return [{
+			id,
+			kind,
+			...declaration.kind === "file-server" ? { of: declaration.of } : {},
+			...apps.length ? { apps } : {}
+		}];
+	});
 }
 /**
-* Generate a Dockerfile for backend apps in a workspace.
-* Uses turbo prune for monorepo optimization.
-* @internal Exported for testing
+* Where a deployed stage's mail and storage come from, and what it lacks.
+*
+* - Mail is external once its URL is set, and then needs its sending
+*   address too. Unset, it is Mailpit where allowed — the address derived
+*   unless set — and missing otherwise.
+* - A bucket is external once its URL is set; its credentials, in the URL or
+*   the shared pair, are optional. Unset, it is MinIO where allowed, and
+*   missing otherwise.
+* - A file server's URL is derived where its bucket is MinIO, unless set;
+*   over an external bucket the stage must set it.
 */
-function generateBackendDockerfile(options) {
-	const { baseImage, port, appPath, turboPackage, packageManager, healthCheckPath = "/health" } = options;
-	const pm = getPmConfig(packageManager);
-	const installPm = pm.install ? `RUN ${pm.install}` : "";
-	const turboInstallCmd = getTurboInstallCmd(packageManager);
-	return `# syntax=docker/dockerfile:1
-# Backend Dockerfile with turbo prune optimization
-
-# Stage 1: Prune monorepo
-FROM ${baseImage} AS pruner
-
-WORKDIR /app
-
-${installPm}
-
-COPY . .
-
-# Prune to only include necessary packages
-RUN ${packageManager === "pnpm" ? "pnpm dlx turbo" : "npx turbo"} prune ${turboPackage} --docker
-
-# Stage 2: Install dependencies
-FROM ${baseImage} AS deps
-
-WORKDIR /app
-
-${installPm}
-
-# Copy pruned lockfile and package.jsons
-COPY --from=pruner /app/out/${pm.lockfile} ./
-COPY --from=pruner /app/out/json/ ./
-
-# Install dependencies
-RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
-    ${turboInstallCmd}
-
-# Stage 3: Build
-FROM deps AS builder
-
-WORKDIR /app
-
-# Copy pruned source
-COPY --from=pruner /app/out/full/ ./
-
-# Copy workspace root configs for turbo builds (turbo prune doesn't include root configs)
-# Using wildcard to make it optional for single-app projects
-COPY --from=pruner /app/gkm.config.* ./
-COPY --from=pruner /app/tsconfig.* ./
-
-# Write encrypted credentials for gkm build to embed.
-# A build secret (\`docker build --secret id=gkm_credentials,src=…\`), not an
-# ARG: an ARG is recorded in the image history. Two lines, ciphertext then IV;
-# absent when the app has no secrets.
-RUN --mount=type=secret,id=gkm_credentials,required=false \
-    if [ -s /run/secrets/gkm_credentials ]; then \
-      mkdir -p ${appPath}/.gkm && \
-      sed -n 1p /run/secrets/gkm_credentials > ${appPath}/.gkm/credentials.enc && \
-      sed -n 2p /run/secrets/gkm_credentials > ${appPath}/.gkm/credentials.iv; \
-    fi
-
-# Build any workspace packages the app depends on.
-#
-# A no-op for a project whose dependencies come from a registry, and required
-# for one whose CLI is a sibling package: \`turbo prune\` honours .gitignore, so a
-# workspace package's \`dist\` never reaches the image and its bin has nothing to
-# import. \`--if-present\` is what makes the same Dockerfile correct for both.
-RUN ${pm.run} --if-present build
-
-# Build production server using gkm
-RUN cd ${appPath} && ${pm.exec} gkm build --provider server --production
-
-# Stage 4: Production
-FROM ${baseImage} AS runner
-
-WORKDIR /app
-
-RUN apk add --no-cache tini
-
-RUN addgroup --system --gid 1001 nodejs && \\
-    adduser --system --uid 1001 hono
-
-# Copy bundled server
-COPY --from=builder --chown=hono:nodejs /app/${appPath}/.gkm/server/dist/server.mjs ./
-
-ENV NODE_ENV=production
-ENV PORT=${port}
-
-HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
-  CMD wget -qO- http://localhost:${port}${healthCheckPath} > /dev/null 2>&1 || exit 1
-
-USER hono
-
-EXPOSE ${port}
-
-ENTRYPOINT ["/sbin/tini", "--"]
-CMD ["node", "server.mjs"]
-`;
+function externalServices(input) {
+	const { supplied, allow } = input;
+	const has = (key) => supplied[key] !== void 0;
+	const domain = input.domain ?? "example.com";
+	const missing = [];
+	const minio = [];
+	const mailpit = [];
+	const add = (entry) => {
+		if (!missing.some((m) => m.key === entry.key)) missing.push(entry);
+	};
+	const declarations = [...input.declarations].sort((a, b) => a.id.localeCompare(b.id));
+	const apps = (d) => d.apps?.length ? { apps: [...d.apps].sort() } : {};
+	for (const d of declarations.filter((d) => d.kind === "email")) {
+		const url = provideKey(d.id, "url");
+		const from = provideKey(d.id, "from");
+		if (!has(url) && allow.includes("mailpit")) {
+			mailpit.push(d.id);
+			continue;
+		}
+		if (!has(url)) add({
+			key: url,
+			id: d.id,
+			what: `where '${d.id}' sends mail — any SMTP server`,
+			example: `smtp://user:password@smtp.${domain}:587`,
+			service: "mailpit",
+			...apps(d)
+		});
+		if (!has(from)) add({
+			key: from,
+			id: d.id,
+			what: `the address '${d.id}' sends from, on a domain the mail server has verified`,
+			example: `noreply@${domain}`,
+			service: "mailpit",
+			...apps(d)
+		});
+	}
+	for (const d of declarations.filter((d) => d.kind === "objects")) {
+		const url = provideKey(d.id, "url");
+		if (has(url)) continue;
+		if (allow.includes("minio")) {
+			minio.push(d.id);
+			continue;
+		}
+		add({
+			key: url,
+			id: d.id,
+			what: `the bucket '${d.id}' — S3, R2, or any S3-compatible store (add &endpoint=… for one that is not S3)`,
+			note: `credentials are optional: a key for this bucket alone in the URL (s3://KEY:SECRET@${appKey(d.id)}?…) wins; without one, the shared AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY or a role signs`,
+			example: `s3://${appKey(d.id)}?region=eu-west-1`,
+			service: "minio",
+			...apps(d)
+		});
+	}
+	for (const d of declarations.filter((d) => d.kind === "file-server")) {
+		const url = provideKey(d.id, "url");
+		if (has(url)) continue;
+		if (d.of && minio.includes(d.of)) continue;
+		add({
+			key: url,
+			id: d.id,
+			what: `the public address '${d.id}' serves its bucket on — a CDN or the bucket's own domain`,
+			example: `https://${appKey(d.id)}.${domain}`,
+			service: "minio",
+			...apps(d)
+		});
+	}
+	return {
+		missing,
+		minio,
+		mailpit
+	};
 }
 /**
-* Generate a Dockerfile for apps with a custom entry point.
-* Uses esbuild to bundle the entry point into dist/index.mjs with all dependencies.
-* This is used for apps that don't use gkm routes (e.g., Better Auth servers).
-* @internal Exported for testing
+* `externalServices`, refusing a stage that lacks anything.
+*
+* @throws {ExternalServicesNotConfigured} naming every missing key
 */
-function generateEntryDockerfile(options) {
-	const { baseImage, port, appPath, entry, turboPackage, packageManager, healthCheckPath = "/health" } = options;
-	const pm = getPmConfig(packageManager);
-	const installPm = pm.install ? `RUN ${pm.install}` : "";
-	const turboInstallCmd = getTurboInstallCmd(packageManager);
-	return `# syntax=docker/dockerfile:1
-# Entry-based Dockerfile with turbo prune + tsdown bundling
-
-# Stage 1: Prune monorepo
-FROM ${baseImage} AS pruner
-
-WORKDIR /app
-
-${installPm}
-
-COPY . .
-
-# Prune to only include necessary packages
-RUN ${packageManager === "pnpm" ? "pnpm dlx turbo" : "npx turbo"} prune ${turboPackage} --docker
-
-# Stage 2: Install dependencies
-FROM ${baseImage} AS deps
-
-WORKDIR /app
-
-${installPm}
-
-# Copy pruned lockfile and package.jsons
-COPY --from=pruner /app/out/${pm.lockfile} ./
-COPY --from=pruner /app/out/json/ ./
-
-# Install dependencies
-RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
-    ${turboInstallCmd}
-
-# Stage 3: Build with tsdown
-FROM deps AS builder
-
-WORKDIR /app
-
-# Copy pruned source
-COPY --from=pruner /app/out/full/ ./
-
-# Copy workspace root configs for turbo builds (turbo prune doesn't include root configs)
-# Using wildcard to make it optional for single-app projects
-COPY --from=pruner /app/tsconfig.* ./
-
-# Bundle entry point with esbuild (outputs to dist/index.mjs)
-# Creates a fully standalone bundle with all dependencies included
-# Use define to embed credentials if present.
-# They arrive as a build secret (\`docker build --secret id=gkm_credentials,src=…\`),
-# not an ARG: an ARG is recorded in the image history. Two lines, ciphertext
-# then IV; absent when the app has no secrets.
-RUN --mount=type=secret,id=gkm_credentials,required=false \
-    cd ${appPath} && \
-    if [ -s /run/secrets/gkm_credentials ]; then \
-      CREDS=$(sed -n 1p /run/secrets/gkm_credentials) && \
-      IV=$(sed -n 2p /run/secrets/gkm_credentials) && \
-      npx esbuild ${entry} --bundle --platform=node --target=node22 --format=esm \
-        --outfile=dist/index.mjs --packages=bundle \
-        --banner:js='import { createRequire } from "module"; const require = createRequire(import.meta.url);' \
-        --define:__GKM_ENCRYPTED_CREDENTIALS__="'\\"$CREDS\\"'" \
-        --define:__GKM_CREDENTIALS_IV__="'\\"$IV\\"'"; \
-    else \
-      npx esbuild ${entry} --bundle --platform=node --target=node22 --format=esm \
-        --outfile=dist/index.mjs --packages=bundle \
-        --banner:js='import { createRequire } from "module"; const require = createRequire(import.meta.url);'; \
-    fi
-
-# Stage 4: Production
-FROM ${baseImage} AS runner
-
-WORKDIR /app
-
-RUN apk add --no-cache tini
-
-RUN addgroup --system --gid 1001 nodejs && \\
-    adduser --system --uid 1001 app
-
-# Copy bundled output only (no node_modules needed - fully bundled)
-COPY --from=builder --chown=app:nodejs /app/${appPath}/dist/index.mjs ./
-
-ENV NODE_ENV=production
-ENV PORT=${port}
-
-HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
-  CMD wget -qO- http://localhost:${port}${healthCheckPath} > /dev/null 2>&1 || exit 1
-
-USER app
-
-EXPOSE ${port}
-
-ENTRYPOINT ["/sbin/tini", "--"]
-CMD ["node", "index.mjs"]
-`;
+function assertExternalServices(input) {
+	const services = externalServices(input);
+	if (services.missing.length > 0) throw new ExternalServicesNotConfigured(input.stage, services.missing);
+	return services;
+}
+/** The dev services a run uses, one entry per service it runs. */
+function devServicesUsed(services) {
+	const used = [];
+	if (services.mailpit.length > 0) used.push({
+		service: "mailpit",
+		ids: services.mailpit
+	});
+	if (services.minio.length > 0) used.push({
+		service: "minio",
+		ids: services.minio
+	});
+	return used;
+}
+/** The line a run prints for each dev service a deployed stage uses. */
+function devServiceWarning(stage, use) {
+	return `⚠️  DEV SERVICE ON A DEPLOYED STAGE (${stage}): ${use.service === "mailpit" ? `Mailpit is catching mail for ${use.ids.join(", ")}. It delivers NO mail: nobody receives a sign-in link, a receipt or a reset` : `MinIO is storing ${use.ids.join(", ")}. Every object is on one container's disk, with no replication and no backup`}. It is not production-grade — set the stage's own keys in its secrets for that.`;
+}
+/**
+* Report each dev service a run uses: a loud line, and a `dev-service.used`
+* event a host can act on.
+*/
+function reportDevServices(ctx, uses) {
+	for (const use of uses) {
+		ctx.logger.warn(`\n${devServiceWarning(ctx.stage, use)}`);
+		ctx.emit({
+			type: "dev-service.used",
+			service: use.service,
+			stage: ctx.stage,
+			constructs: use.ids
+		});
+	}
+}
+//#endregion
+//#region src/target/dokploy/domain.ts
+/** A stage was deployed that `deploy.domains` gives no domain. */
+var NoDomainForStage = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`No domain for stage "${stage}". Add it to gkm.config.ts: deploy: { domains: { ${stage}: 'example.com' } }.`);
+		this.stage = stage;
+		this.name = "NoDomainForStage";
+	}
+};
+/**
+* The hostname an app answers on for a stage.
+*
+* 1. An explicit `app.domain` — a string, or one per stage — wins.
+* 2. Otherwise from the stage's base domain in `deploy.domains`: the root site
+*    answers on the domain itself, and every other app on
+*    `{subdomain}.{domain}` — its declaration's `subdomain`, or its own name.
+*
+* @throws {NoDomainForStage} when `deploy.domains` names no domain for it
+*/
+function resolveHost(appName, app, stage, domains, isMainFrontend) {
+	if (app.domain) {
+		if (typeof app.domain === "string") return app.domain;
+		if (app.domain[stage]) return app.domain[stage];
+	}
+	const baseDomain = domains?.[stage];
+	if (!baseDomain) throw new NoDomainForStage(stage);
+	if (isMainFrontend) return baseDomain;
+	return `${app.subdomain ?? appName}.${baseDomain}`;
 }
 /**
-* Generate a Dockerfile for Node-based SSR web frameworks (TanStack Start,
-* Remix). Builds with turbo, then runs the framework's production start
-* script via `npm start`.
+* Whether this app is the site the base domain points at — see `rootSite`,
+* which the local edge asks too.
 *
-* Public URL build args are declared so framework bundlers (Vite, Vinxi)
-* can inline them at build time. Per-framework prefix is the caller's job.
-* @internal Exported for testing
+* @throws {AmbiguousRootSite} when several sites could be the root and none says it is
 */
-function generateNodeWebDockerfile(options) {
-	const { baseImage, port, appPath, turboPackage, packageManager, publicUrlArgs = [] } = options;
-	const pm = getPmConfig(packageManager);
-	const installPm = pm.install ? `RUN ${pm.install}` : "";
-	const turboInstallCmd = getTurboInstallCmd(packageManager);
-	const turboCmd = packageManager === "pnpm" ? "pnpm dlx turbo" : "npx turbo";
-	const startCmd = packageManager === "pnpm" ? "pnpm start" : `${pm.lockfile.startsWith("package-lock") ? "npm" : packageManager} start`;
-	const argDecls = publicUrlArgs.map((a) => `ARG ${a}=""`).join("\n");
-	const envDecls = publicUrlArgs.map((a) => `ENV ${a}=$${a}`).join("\n");
-	return `# syntax=docker/dockerfile:1
-# Node SSR web Dockerfile (TanStack Start / Remix) with turbo prune
-
-FROM ${baseImage} AS pruner
-WORKDIR /app
-${installPm}
-COPY . .
-RUN ${turboCmd} prune ${turboPackage} --docker
-
-FROM ${baseImage} AS deps
-WORKDIR /app
-${installPm}
-COPY --from=pruner /app/out/${pm.lockfile} ./
-COPY --from=pruner /app/out/json/ ./
-RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
-    ${turboInstallCmd}
-
-FROM deps AS builder
-WORKDIR /app
-${argDecls}
-${envDecls}
-COPY --from=pruner /app/out/full/ ./
-COPY --from=pruner /app/tsconfig.* ./
-RUN ${turboCmd} run build --filter=${turboPackage}
-
-FROM ${baseImage} AS runner
-WORKDIR /app
-RUN apk add --no-cache tini
-RUN addgroup --system --gid 1001 nodejs && \\
-    adduser --system --uid 1001 app
-
-# Copy the whole built workspace — frameworks differ on output paths
-COPY --from=builder --chown=app:nodejs /app/ ./
-
-ENV NODE_ENV=production
-ENV PORT=${port}
-ENV HOSTNAME="0.0.0.0"
-
-USER app
-EXPOSE ${port}
-
-# A site answers at its root; Docker, and Dokploy, read the container's
-# health from it rather than from the process merely running. 127.0.0.1, not
-# localhost: the server listens on IPv4, and localhost can resolve to ::1.
-HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
-  CMD wget -qO- http://127.0.0.1:${port}/ > /dev/null 2>&1 || exit 1
-
-ENTRYPOINT ["/sbin/tini", "--"]
-CMD ["sh", "-c", "cd ${appPath} && ${startCmd}"]
-`;
+function isMainFrontendApp(appName, app, allApps) {
+	if (app.type !== "web") return false;
+	return rootSite(Object.entries(allApps).filter(([, a]) => a.type === "web").map(([name, a]) => ({
+		name,
+		root: a.root
+	}))) === appName;
 }
 /**
-* Generate a Dockerfile for Vite SPA apps. Builds the static bundle with
-* turbo, then serves it via nginx.
-* @internal Exported for testing
+* Get public URL arg names from app dependencies.
+*
+* @param app - The web/mobile app configuration
+* @returns Array of arg names like 'NEXT_PUBLIC_API_URL', or [] for frameworks
+*   without a public prefix (e.g. Remix).
 */
-function generateViteStaticDockerfile(options) {
-	const { baseImage, port, appPath, turboPackage, packageManager, publicUrlArgs = [] } = options;
-	const pm = getPmConfig(packageManager);
-	const installPm = pm.install ? `RUN ${pm.install}` : "";
-	const turboInstallCmd = getTurboInstallCmd(packageManager);
-	const turboCmd = packageManager === "pnpm" ? "pnpm dlx turbo" : "npx turbo";
-	const argDecls = publicUrlArgs.map((a) => `ARG ${a}=""`).join("\n");
-	const envDecls = publicUrlArgs.map((a) => `ENV ${a}=$${a}`).join("\n");
-	return `# syntax=docker/dockerfile:1
-# Vite SPA Dockerfile — builds static assets, serves via nginx
-
-FROM ${baseImage} AS pruner
-WORKDIR /app
-${installPm}
-COPY . .
-RUN ${turboCmd} prune ${turboPackage} --docker
-
-FROM ${baseImage} AS deps
-WORKDIR /app
-${installPm}
-COPY --from=pruner /app/out/${pm.lockfile} ./
-COPY --from=pruner /app/out/json/ ./
-RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
-    ${turboInstallCmd}
-
-FROM deps AS builder
-WORKDIR /app
-${argDecls}
-${envDecls}
-COPY --from=pruner /app/out/full/ ./
-COPY --from=pruner /app/tsconfig.* ./
-RUN ${turboCmd} run build --filter=${turboPackage}
-
-FROM nginx:alpine AS runner
-COPY --from=builder /app/${appPath}/dist /usr/share/nginx/html
-RUN printf 'server {\\n  listen ${port};\\n  root /usr/share/nginx/html;\\n  index index.html;\\n  location / { try_files $uri $uri/ /index.html; }\\n}\\n' \\
-    > /etc/nginx/conf.d/default.conf
-EXPOSE ${port}
-# A site answers at its root; Docker, and Dokploy, read the container's
-# health from it rather than from the process merely running. 127.0.0.1, not
-# localhost: the server listens on IPv4, and localhost can resolve to ::1.
-HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
-  CMD wget -qO- http://127.0.0.1:${port}/ > /dev/null 2>&1 || exit 1
-CMD ["nginx", "-g", "daemon off;"]
-`;
+function getPublicUrlArgNames(app) {
+	const prefix = getPublicEnvPrefix(app.framework);
+	if (!prefix) return [];
+	return app.dependencies.map((dep) => `${prefix}${dep.toUpperCase()}_URL`);
+}
+//#endregion
+//#region src/docker/imageRef.ts
+/**
+* An image reference, checked before it reaches `docker`.
+*
+* The parts come from the workspace — a registry in `gkm.config.ts`, an image
+* name from the project, a tag from `--tag` — and an argument array already
+* keeps them out of a shell. What it cannot do is stop `docker` reading a value
+* that starts with `-` as one of its own flags, so a ref is held to Docker's
+* own grammar (distribution/reference) and anything else is refused by name
+* before a build starts.
+*/
+const DOMAIN_COMPONENT = "(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])";
+const DOMAIN = `${DOMAIN_COMPONENT}(?:\\.${DOMAIN_COMPONENT})*(?::[0-9]+)?`;
+const PATH_COMPONENT = "[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*";
+const REFERENCE = new RegExp(`^(?:${DOMAIN}/)?${PATH_COMPONENT}(?:/${PATH_COMPONENT})*(?::[\\w][\\w.-]{0,127})?(?:@[A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*:[0-9a-fA-F]{32,})?$`);
+/** Docker refuses a repository name longer than this. */
+const MAX_NAME_LENGTH = 255;
+/** A value that is not an image reference was about to be built or pushed. */
+var ImageRefInvalid = class extends Error {
+	ref;
+	constructor(ref) {
+		super(`'${ref}' is not a valid image reference. An image is \`[registry/]name[:tag]\`: the name lowercase letters, digits and . _ - separators, the tag up to 128 of letters, digits, _ . and -, not starting with . or -. Check docker.registry in gkm.config.ts and the --tag passed.`);
+		this.ref = ref;
+		this.name = "ImageRefInvalid";
+	}
+};
+/** Throw {@link ImageRefInvalid} unless `ref` is a Docker image reference. */
+function validateImageRef(ref) {
+	const name = ref.split("@")[0].replace(/:[\w][\w.-]*$/, "");
+	if (!REFERENCE.test(ref) || name.length > MAX_NAME_LENGTH) throw new ImageRefInvalid(ref);
+	return ref;
 }
 //#endregion
 //#region src/docker/index.ts
-const logger = output;
+const logger$1 = output;
 /** `docker build` failed; what docker printed above says why. */
 var DockerBuildFailed = class extends Error {
 	imageRef;
@@ -4659,130 +4935,45 @@ var PushNeedsRegistry = class extends Error {
 	}
 };
 /**
-* Docker command implementation
-* Generates Dockerfile, docker-compose.yml, and related files
-*
-* Default: Multi-stage Dockerfile that builds from source inside Docker
-* --slim: Slim Dockerfile that copies pre-built bundle (requires prior build)
+* Docker command implementation: one Dockerfile per deployable app, each
+* building its image inside Docker from a turbo-pruned slice of the build
+* root — nothing is built on the host — plus the build root's
+* `.dockerignore` and `docker-compose.constructs.yml`.
 */
 async function dockerCommand(options) {
 	const cwd = options.cwd ?? process.cwd();
-	const loadedConfig = await loadWorkspaceConfig(cwd);
-	if (loadedConfig.type === "workspace") {
-		logger.log("📦 Detected workspace configuration");
-		return workspaceDockerCommand(loadedConfig.workspace, loadedConfig.manifest);
-	}
-	const dockerConfig = resolveDockerConfig(await loadConfig(cwd));
-	const healthCheckPath = "/health";
-	const useSlim = options.slim === true;
-	if (useSlim) {
-		const distDir = join(cwd, ".gkm", "server", "dist");
-		if (!existsSync(join(distDir, "server.mjs"))) throw new Error("Slim Dockerfile requires a pre-built bundle. Run `gkm build --provider server --production` first, or omit --slim to use multi-stage build.");
-	}
-	const dockerDir = join(cwd, ".gkm", "docker");
-	await mkdir(dockerDir, { recursive: true });
-	const packageManager = detectPackageManager(cwd);
-	const inMonorepo = isMonorepo(cwd);
-	const hasTurbo = hasTurboConfig(cwd);
-	let useTurbo = options.turbo ?? false;
-	if (inMonorepo && !useSlim) {
-		if (hasTurbo) {
-			useTurbo = true;
-			logger.log("   Detected monorepo with turbo.json - using turbo prune");
-		} else throw new Error("Monorepo detected but turbo.json not found.\n\nDocker builds in monorepos require Turborepo for proper dependency isolation.\n\nTo fix this:\n  1. Install turbo: pnpm add -Dw turbo\n  2. Create turbo.json in your monorepo root\n  3. Run this command again\n\nSee: https://turbo.build/repo/docs/guides/tools/docker");
-	}
-	let turboPackage = options.turboPackage ?? dockerConfig.imageName;
-	if (useTurbo && !options.turboPackage) try {
-		const pkg = __require(`${cwd}/package.json`);
-		if (pkg.name) {
-			turboPackage = pkg.name;
-			logger.log(`   Turbo package: ${turboPackage}`);
-		}
-	} catch {}
-	const templateOptions = {
-		imageName: dockerConfig.imageName,
-		baseImage: dockerConfig.baseImage,
-		port: dockerConfig.port,
-		healthCheckPath,
-		prebuilt: useSlim,
-		turbo: useTurbo,
-		turboPackage,
-		packageManager
-	};
-	const dockerfile = useSlim ? generateSlimDockerfile(templateOptions) : generateMultiStageDockerfile(templateOptions);
-	const dockerMode = useSlim ? "slim" : useTurbo ? "turbo" : "multi-stage";
-	const dockerfilePath = join(dockerDir, "Dockerfile");
-	await writeFile(dockerfilePath, dockerfile);
-	logger.log(`Generated: .gkm/docker/Dockerfile (${dockerMode}, ${packageManager})`);
-	const composePath = await writeConstructsCompose(loadedConfig.workspace);
-	const dockerignore = generateDockerignore();
-	const dockerignorePath = join(cwd, ".dockerignore");
-	await writeFile(dockerignorePath, dockerignore);
-	logger.log("Generated: .dockerignore (project root)");
-	const entrypoint = generateDockerEntrypoint();
-	const entrypointPath = join(dockerDir, "docker-entrypoint.sh");
-	await writeFile(entrypointPath, entrypoint);
-	logger.log("Generated: .gkm/docker/docker-entrypoint.sh");
-	const result = {
-		dockerfile: dockerfilePath,
-		dockerCompose: composePath,
-		dockerignore: dockerignorePath,
-		entrypoint: entrypointPath
-	};
-	if (options.build) await buildDockerImage(dockerConfig.imageName, options, cwd);
-	if (options.push) await pushDockerImage(dockerConfig.imageName, options, cwd);
+	const loaded = await loadWorkspaceConfig(cwd);
+	const names = loaded.type === "single" ? Object.fromEntries(Object.keys(loaded.workspace.apps).map((name) => [name, resolveDockerConfig(loaded.raw).imageName])) : {};
+	const result = await workspaceDockerCommand(loaded.workspace, loaded.manifest, names);
+	if (options.build) for (const app of result.apps) await buildDockerImage(app, result.buildRoot, options);
+	if (options.push) for (const app of result.apps) await pushDockerImage(app.imageName, options, result.buildRoot);
 	return result;
 }
 /**
-* Ensure lockfile exists in the build context
-* For monorepos, copies from workspace root if needed
-* Returns cleanup function if file was copied
-*/
-function ensureLockfile(cwd) {
-	const lockfilePath = findLockfilePath(cwd);
-	if (!lockfilePath) {
-		logger.warn("\n⚠️  No lockfile found. Docker build may fail or use stale dependencies.");
-		return null;
-	}
-	const lockfileName = basename(lockfilePath);
-	const localLockfile = join(cwd, lockfileName);
-	if (lockfilePath === localLockfile) return null;
-	logger.log(`   Copying ${lockfileName} from monorepo root...`);
-	copyFileSync(lockfilePath, localLockfile);
-	return () => {
-		try {
-			unlinkSync(localLockfile);
-		} catch {}
-	};
-}
-/**
-* Build Docker image
+* Build one app's image, from the build root.
 * Uses BuildKit for cache mount support
 */
-async function buildDockerImage(imageName, options, cwd) {
+async function buildDockerImage(app, buildRoot, options) {
 	const tag = options.tag ?? "latest";
 	const registry = options.registry;
-	const fullImageName = validateImageRef(registry ? `${registry}/${imageName}:${tag}` : `${imageName}:${tag}`);
-	logger.log(`\n🐳 Building Docker image: ${fullImageName}`);
-	const cleanup = ensureLockfile(cwd);
+	const fullImageName = validateImageRef(registry ? `${registry}/${app.imageName}:${tag}` : `${app.imageName}:${tag}`);
+	logger$1.log(`\n🐳 Building Docker image: ${fullImageName}`);
 	try {
 		await run$1("docker", [
 			"build",
-			"--file=.gkm/docker/Dockerfile",
+			`--file=${relative(buildRoot, app.dockerfile)}`,
 			`--tag=${fullImageName}`,
 			"."
 		], {
-			cwd,
+			cwd: buildRoot,
 			env: {
 				...process.env,
 				DOCKER_BUILDKIT: "1"
 			}
 		});
-		logger.log(`✅ Docker image built: ${fullImageName}`);
+		logger$1.log(`✅ Docker image built: ${fullImageName}`);
 	} catch (error) {
 		throw new DockerBuildFailed(fullImageName, error);
-	} finally {
-		cleanup?.();
 	}
 }
 /**
@@ -4793,103 +4984,88 @@ async function pushDockerImage(imageName, options, cwd) {
 	const registry = options.registry;
 	if (!registry) throw new PushNeedsRegistry(imageName);
 	const fullImageName = validateImageRef(`${registry}/${imageName}:${tag}`);
-	logger.log(`\n🚀 Pushing Docker image: ${fullImageName}`);
+	logger$1.log(`\n🚀 Pushing Docker image: ${fullImageName}`);
 	try {
 		await run$1("docker", ["push", fullImageName], { cwd });
-		logger.log(`✅ Docker image pushed: ${fullImageName}`);
+		logger$1.log(`✅ Docker image pushed: ${fullImageName}`);
 	} catch (error) {
 		throw new DockerPushFailed(fullImageName, error);
 	}
 }
 /**
-* Get the package name from package.json in an app directory.
-*/
-function getAppPackageName(appPath) {
-	try {
-		const pkgPath = join(appPath, "package.json");
-		if (!existsSync(pkgPath)) return;
-		const content = readFileSync(pkgPath, "utf-8");
-		return JSON.parse(content).name;
-	} catch {
-		return;
-	}
-}
-/**
 * Generate Dockerfiles for all apps in a workspace.
 * @internal Exported for testing
 */
-async function workspaceDockerCommand(workspace, manifest) {
+async function workspaceDockerCommand(workspace, manifest, imageNames = {}) {
 	const results = [];
-	const apps = Object.entries(workspace.apps);
-	logger.log(`\n🐳 Generating Dockerfiles for workspace: ${workspace.name}`);
-	const dockerDir = join(workspace.root, ".gkm", "docker");
-	await mkdir(dockerDir, { recursive: true });
-	const packageManager = detectPackageManager(workspace.root);
-	logger.log(`   Package manager: ${packageManager}`);
-	for (const [appName, app] of apps) {
+	const layout = imageLayout(workspace);
+	logger$1.log(`\n🐳 Generating Dockerfiles for workspace: ${workspace.name}`);
+	logger$1.log(`   Build root: ${layout.buildRoot}`);
+	logger$1.log(`   Package manager: ${layout.tools.packageManager}${layout.tools.packageManagerVersion ? `@${layout.tools.packageManagerVersion}` : ""}, turbo@${layout.tools.turboVersion}`);
+	for (const [appName, app] of Object.entries(workspace.apps)) {
 		if (app.type === "mobile") {
-			logger.log(`\n   📱 Skipping Docker for ${appName} (mobile app — deploy via framework toolchain)`);
+			logger$1.log(`\n   📱 Skipping Docker for ${appName} (mobile app — deploy via framework toolchain)`);
 			continue;
 		}
-		const appPath = app.path;
-		const turboPackage = getAppPackageName(join(workspace.root, appPath)) ?? appName;
-		const imageName = appName;
-		const buildType = !!app.entry ? "entry" : app.type;
-		logger.log(`\n   📄 Generating Dockerfile for ${appName} (${buildType})`);
-		let dockerfile;
-		if (app.type === "web") dockerfile = siteDockerfile(appName, app, {
-			turboPackage,
-			packageManager,
+		const buildType = app.entry ? "entry" : app.type;
+		logger$1.log(`\n   📄 Generating Dockerfile for ${appName} (${buildType})`);
+		const dockerfile = appDockerfile(appName, app, {
+			layout,
+			workspaceRoot: workspace.root,
 			...manifest ? { manifest } : {}
 		});
-		else if (app.entry) dockerfile = generateEntryDockerfile({
-			imageName,
-			baseImage: "node:22-alpine",
-			port: app.port,
-			appPath,
-			entry: app.entry,
-			turboPackage,
-			packageManager,
-			healthCheckPath: "/health"
-		});
-		else dockerfile = generateBackendDockerfile({
-			imageName,
-			baseImage: "node:22-alpine",
-			port: app.port,
-			appPath,
-			turboPackage,
-			packageManager,
-			healthCheckPath: "/health"
-		});
-		const dockerfilePath = join(dockerDir, `Dockerfile.${appName}`);
+		const path = dockerfileOf(appName, app.path);
+		const dockerfilePath = join(workspace.root, path);
+		await mkdir(dirname(dockerfilePath), { recursive: true });
 		await writeFile(dockerfilePath, dockerfile);
-		logger.log(`      Generated: .gkm/docker/Dockerfile.${appName}`);
+		logger$1.log(`      Generated: ${path}`);
 		results.push({
 			appName,
 			type: app.type,
 			dockerfile: dockerfilePath,
-			imageName
+			imageName: imageNames[appName] ?? appName
 		});
 	}
-	const dockerignore = generateDockerignore();
-	const dockerignorePath = join(workspace.root, ".dockerignore");
-	await writeFile(dockerignorePath, dockerignore);
-	logger.log(`\n   Generated: .dockerignore (workspace root)`);
+	const dockerignorePath = await ensureDockerignore(layout.buildRoot);
+	logger$1.log(`\n   Ensured: ${dockerignorePath}`);
 	const composePath = await writeConstructsCompose(workspace);
-	logger.log(`\n✅ Generated ${results.length} Dockerfile(s) + ${COMPOSE_PATH}`);
-	logger.log("\n📋 Build commands:");
+	logger$1.log(`\n✅ Generated ${results.length} Dockerfile(s) + ${COMPOSE_PATH}`);
+	logger$1.log(`\n📋 Build commands (from ${layout.buildRoot}):`);
 	for (const result of results) {
 		const icon = result.type === "backend" ? "⚙️" : result.type === "mobile" ? "📱" : "🌐";
-		logger.log(`   ${icon} docker build -f .gkm/docker/Dockerfile.${result.appName} -t ${result.imageName} .`);
+		logger$1.log(`   ${icon} docker build -f ${relative(layout.buildRoot, result.dockerfile)} -t ${result.imageName} .`);
 	}
 	printRunInstructions(workspace);
 	return {
 		apps: results,
 		dockerCompose: composePath,
-		dockerignore: dockerignorePath
+		dockerignore: dockerignorePath,
+		buildRoot: layout.buildRoot
 	};
 }
 /**
+* One app's Dockerfile, by what it is: a gkm backend bundled by `gkm build`,
+* a backend with its own entry bundled by esbuild, or a site by its
+* framework. The one choice every builder of images makes.
+*/
+function appDockerfile(appName, app, options) {
+	const image = appImageOptions(options.layout, appName, app, options.workspaceRoot);
+	if (app.type === "web") return siteDockerfile(appName, app, {
+		image,
+		...options.manifest ? { manifest: options.manifest } : {},
+		...options.publicUrlArgs ? { publicUrlArgs: options.publicUrlArgs } : {}
+	});
+	if (app.entry) return generateEntryDockerfile({
+		...image,
+		entry: app.entry,
+		healthCheckPath: "/health"
+	});
+	return generateBackendDockerfile({
+		...image,
+		healthCheckPath: "/health"
+	});
+}
+/**
 * A site's Dockerfile, with an `ARG` for every key its bundler inlines.
 *
 * The keys come from the site's declaration where there is one — every
@@ -4899,14 +5075,9 @@ async function workspaceDockerCommand(workspace, manifest) {
 */
 function siteDockerfile(appName, app, options) {
 	const declared = options.manifest ? Object.entries(options.manifest).find(([id, d]) => d.kind === "site" && appKey(id) === appName)?.[1] : void 0;
-	const publicUrlArgs = declared?.kind === "site" && options.manifest ? Object.keys(publicEnvFor(declared, options.manifest)) : getPublicUrlArgNames(app);
+	const publicUrlArgs = options.publicUrlArgs ?? (declared?.kind === "site" && options.manifest ? Object.keys(publicEnvFor(declared, options.manifest)) : getPublicUrlArgNames(app));
 	const webOpts = {
-		imageName: appName,
-		baseImage: "node:22-alpine",
-		port: app.port,
-		appPath: app.path,
-		turboPackage: options.turboPackage,
-		packageManager: options.packageManager,
+		...options.image,
 		publicUrlArgs
 	};
 	switch (app.framework) {
@@ -4917,10 +5088,37 @@ function siteDockerfile(appName, app, options) {
 	}
 }
 /**
-* The package name turbo prunes an app by: its package.json's, or its name.
+* What a build root's `.dockerignore` must leave out of every image's
+* context: dependencies installed for another platform, anything built on the
+* host (every image builds from source), git, and gkm's own output —
+* `.gkm/compose`'s env files hold a stage's secrets.
 */
-function appPackageName(root, appName, path) {
-	return getAppPackageName(join(root, path)) ?? appName;
+const REQUIRED_IGNORES = [
+	"**/node_modules",
+	".git",
+	"**/dist",
+	"**/.next",
+	"**/.turbo",
+	"**/.gkm",
+	"**/.gkm/compose"
+];
+/**
+* Make sure the build root's `.dockerignore` leaves out what no image may
+* hold: written whole where there is none, and each missing line appended to
+* one the project keeps.
+*/
+async function ensureDockerignore(buildRoot) {
+	const path = join(buildRoot, ".dockerignore");
+	if (!existsSync(path)) {
+		await writeFile(path, generateDockerignore());
+		return path;
+	}
+	const current = await readFile(path, "utf-8");
+	const lines = new Set(current.split(/\r?\n/).map((line) => line.trim()));
+	const missing = REQUIRED_IGNORES.filter((line) => !lines.has(line));
+	if (missing.length === 0) return path;
+	await appendFile(path, `${current.endsWith("\n") || current === "" ? "" : "\n"}\n# gkm: images build from source, and a stack's env files hold its secrets\n${missing.join("\n")}\n`);
+	return path;
 }
 /**
 * Write `docker-compose.constructs.yml` — the same file `gkm dev` writes, with
@@ -4934,14 +5132,199 @@ async function writeConstructsCompose(workspace) {
 		stage: workspace.stages.local,
 		start: false
 	});
-	logger.log(`   Generated: ${COMPOSE_PATH} (project root)`);
+	logger$1.log(`   Generated: ${COMPOSE_PATH} (project root)`);
 	return join(workspace.root, COMPOSE_PATH);
 }
 function printRunInstructions(workspace) {
 	const project = existsSync(join(workspace.root, "docker-compose.yml")) ? " -f docker-compose.yml" : "";
-	logger.log("\n📋 Run everything (the apps sit behind the \"apps\" profile):");
-	logger.log("   gkm setup   # starts the containers and creates what they hold");
-	logger.log(`   docker compose -f ${COMPOSE_PATH}${project} --profile apps up --build`);
+	logger$1.log("\n📋 Run everything (the apps sit behind the \"apps\" profile):");
+	logger$1.log("   gkm setup   # starts the containers and creates what they hold");
+	logger$1.log(`   docker compose -f ${COMPOSE_PATH}${project} --profile apps up --build`);
+}
+//#endregion
+//#region src/deploy/docker.ts
+const logger = output;
+/**
+* The id the Dockerfile templates mount the encrypted credentials under:
+* `RUN --mount=type=secret,id=gkm_credentials`.
+*/
+const CREDENTIALS_SECRET_ID = "gkm_credentials";
+/**
+* Get the full image reference
+*/
+function getImageRef(registry, imageName, tag) {
+	if (registry) return `${registry}/${imageName}:${tag}`;
+	return `${imageName}:${tag}`;
+}
+/**
+* The `docker build` argv for an image.
+*
+* One element per value, so nothing in a ref or a build arg is read by a
+* shell, and `--opt=value` rather than `--opt value`, so a value that starts
+* with `-` cannot be taken for one of docker's own flags.
+*
+* @internal Exported for testing
+*/
+function dockerBuildArgs(options) {
+	const { dockerfilePath, imageRef, buildArgs = [], credentialsFile } = options;
+	return [
+		"build",
+		"--platform=linux/amd64",
+		`--file=${dockerfilePath}`,
+		`--tag=${imageRef}`,
+		...buildArgs.map((arg) => `--build-arg=${arg}`),
+		...credentialsFile ? [`--secret=id=${CREDENTIALS_SECRET_ID},src=${credentialsFile}`] : [],
+		"."
+	];
+}
+/**
+* The build arg that names which credentials an image embeds: a hash of the
+* ciphertext, which is not a secret. A BuildKit secret is no part of the
+* build cache's key, so without it a rebuild with credentials encrypted under
+* a new key would reuse the layer that embedded the old ones.
+*/
+function credentialsBuildArg(credentials) {
+	return `GKM_CIPHERTEXT_HASH=${createHash("sha256").update(`${credentials.encrypted}\n${credentials.iv}`).digest("hex").slice(0, 16)}`;
+}
+/** The secret file's content: ciphertext, then IV, one per line. */
+function credentialsFileContent(credentials) {
+	return `${credentials.encrypted}\n${credentials.iv}\n`;
+}
+/**
+* Write the encrypted credentials where `docker build --secret` reads them.
+*
+* Two lines — ciphertext, then IV — so a template can split them with `sed`
+* in any base image. Owner-only, in a directory of its own, and the returned
+* cleanup removes both whatever the build did.
+*
+* @internal Exported for testing
+*/
+async function writeCredentialsFile(credentials) {
+	const dir = await mkdtemp(join(tmpdir(), "gkm-credentials-"));
+	const path = join(dir, CREDENTIALS_SECRET_ID);
+	await writeFile(path, credentialsFileContent(credentials), { mode: 384 });
+	await chmod(path, 384);
+	return {
+		path,
+		cleanup: () => rm(dir, {
+			recursive: true,
+			force: true
+		})
+	};
+}
+/**
+* Build Docker image
+* @param imageRef - Full image reference (registry/name:tag)
+* @param buildArgs - Build arguments to pass to docker build
+* @param credentials - Encrypted credentials, passed as a build secret
+*/
+async function buildImage(imageRef, buildArgs, credentials, { cwd, dockerfile, signal, stdio }) {
+	logger.log(`\n🔨 Building Docker image: ${imageRef}`);
+	logger.log("   Generating Dockerfile...");
+	const { buildRoot } = await dockerCommand({ cwd });
+	const dockerfilePath = relative(buildRoot, dockerfile);
+	const secret = credentials ? await writeCredentialsFile(credentials) : void 0;
+	try {
+		await run$1("docker", dockerBuildArgs({
+			dockerfilePath,
+			imageRef,
+			buildArgs: [...buildArgs ?? [], ...credentials ? [credentialsBuildArg(credentials)] : []],
+			credentialsFile: secret?.path
+		}), {
+			cwd: buildRoot,
+			env: {
+				...process.env,
+				DOCKER_BUILDKIT: "1"
+			},
+			...signal ? { signal } : {},
+			...stdio ? { stdio } : {}
+		});
+		logger.log(`✅ Image built: ${imageRef}`);
+	} catch (error) {
+		throw new DockerBuildFailed(imageRef, error);
+	} finally {
+		await secret?.cleanup();
+	}
+}
+/**
+* Push Docker image to registry
+*/
+async function pushImage(imageRef, { cwd, signal, stdio }) {
+	logger.log(`\n☁️  Pushing image: ${imageRef}`);
+	try {
+		await run$1("docker", ["push", imageRef], {
+			cwd,
+			...signal ? { signal } : {},
+			...stdio ? { stdio } : {}
+		});
+		logger.log(`✅ Image pushed: ${imageRef}`);
+	} catch (error) {
+		throw new DockerPushFailed(imageRef, error);
+	}
+}
+/**
+* The digest the registry gave a pushed image, `sha256:…`.
+*
+* A tag can be pushed over — by the next deploy, or by anything else that
+* shares the repository — and the digest is what says which image a stage
+* actually ran. `RepoDigests` has one entry per repository the image was
+* pushed to, so the one for this ref's repository is picked by name.
+*
+* @internal Exported for testing
+*/
+async function pushedDigest(imageRef, { cwd, signal } = { cwd: process.cwd() }) {
+	const repository = imageRef.split("@")[0].replace(/:[\w][\w.-]*$/, "");
+	const output = await runOutput("docker", [
+		"image",
+		"inspect",
+		"--format={{json .RepoDigests}}",
+		imageRef
+	], {
+		cwd,
+		...signal ? { signal } : {}
+	});
+	let digests;
+	try {
+		digests = JSON.parse(output.trim() || "[]");
+	} catch {
+		return;
+	}
+	if (!Array.isArray(digests)) return void 0;
+	return digests.find((entry) => typeof entry === "string" && entry.startsWith(`${repository}@`))?.slice(repository.length + 1);
+}
+/**
+* Deploy using Docker (build and optionally push image)
+*/
+async function deployDocker(options) {
+	const { stage, tag, skipPush, masterKey, config, buildArgs, credentials } = options;
+	const imageName = config.imageName;
+	const imageRef = validateImageRef(getImageRef(config.registry, imageName, tag));
+	const cwd = options.cwd ?? process.cwd();
+	const docker = {
+		cwd,
+		dockerfile: join(cwd, dockerfileOf(config.appName ?? imageName, options.appPath ?? ".")),
+		...options.signal ? { signal: options.signal } : {},
+		...options.stdio ? { stdio: options.stdio } : {}
+	};
+	await buildImage(imageRef, buildArgs, credentials, docker);
+	let digest;
+	if (!skipPush) {
+		if (!config.registry) logger.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
+		else {
+			await pushImage(imageRef, docker);
+			digest = await pushedDigest(imageRef, docker);
+		}
+	}
+	logger.log("\n✅ Docker deployment ready!");
+	logger.log(`\n📋 Deployment details:`);
+	logger.log(`   Image: ${imageRef}`);
+	logger.log(`   Stage: ${stage}`);
+	if (masterKey) logger.log(`\n🔐 Run the container with GKM_MASTER_KEY set to the key with fingerprint ${keyFingerprint(masterKey)}.`);
+	return {
+		imageRef,
+		...digest ? { digest } : {},
+		masterKey
+	};
 }
 //#endregion
 //#region src/deploy/generated.ts
@@ -5245,6 +5628,6 @@ function setPostgresBackupId(state, backupId) {
 	if (state.backups) state.backups.postgresBackupId = backupId;
 }
 //#endregion
-export { describeServices as $, reconcileWorkspace as A, withCustomSecret as At, appEnvKeys as B, validateImageRef as C, markerOf as Ct, backendsOf as D, maskPassword as Dt, FAKE_ENV as E, initStageSecrets as Et, postgresDatabaseNames as F, planFor as G, networkEnv as H, postgresStatements as I, cacheBackendFor as J, resourceName as K, quoteIdentifier as L, LOCAL_CA_PATH as M, forgetState as N, constructGlobs as O, storage_exports as Ot, applyPostgres as P, DEFAULT_IMAGES as Q, composeFor as R, generateSlimDockerfile as S, isOwnedBy as St, resolveHost as T, projectName as Tt, envFor as U, dockerfileOf as V, localRolePassword as W, providerOf as X, eventsBackendFor as Y, storageBackendFor as Z, appPackageName as _, readKey as _t, recordRelease as a, findAvailablePort as at, detectPackageManager as b, imageName as bt, setBackupState as c, loadSecretsForApp as ct, setGeneratedSecret as d, secretsStoreFor as dt, fakeKey as et, setPostgresBackupId as f, store_exports as ft, DockerPushFailed as g, projectKey as gt, DockerBuildFailed as h, keystoreProject as ht, isDnsVerified as i, createEntryWrapper as it, workspace_exports as j, derivedContainers as k, toEmbeddableSecrets as kt, setDnsRecord as l, prepareEntryCredentials as lt, withGeneratedSecrets as m, getKeyPath as mt, getBackupState as n, primaryPortKey as nt, recordRollback as o, isPortAvailable as ot, DeployJournal as p, FileSecretsStore as pt, hostFor as q, getGeneratedSecret as r, createCredentialsPreload as rt, setApplicationId as s, loadEnvFiles as st, createEmptyState as t, portKeys as tt, setDnsVerification as u, isRemoteStore as ut, dockerCommand as v, applicationName as vt, isMainFrontendApp as w, ownershipMarker as wt, generateDockerignore as x, imageRef as xt, siteDockerfile as y, deployIdentity as yt, pgClient as z };
+export { quoteIdentifier as $, assertExternalServices as A, prepareEntryCredentials as At, backendsOf as B, deployIdentity as Bt, isMainFrontendApp as C, primaryPortKey as Ct, ExternalServicesNotConfigured as D, isPortAvailable as Dt, DevServicesNeedServerTarget as E, findAvailablePort as Et, reportDevServices as F, getKeyPath as Ft, LOCAL_CA_PATH as G, ownershipMarker as Gt, derivedContainers as H, imageRef as Ht, encryptSecrets as I, keystoreProject as It, applyPolicies as J, maskPassword as Jt, forgetState as K, projectName as Kt, encryption_exports as L, projectKey as Lt, externalServices as M, secretsStoreFor as Mt, manifestServiceDeclarations as N, store_exports as Nt, STORAGE_KEY_PAIR as O, loadEnvFiles as Ot, parseDevServices as P, FileSecretsStore as Pt, postgresStatements as Q, keyFingerprint as R, readKey as Rt, NoDomainForStage as S, portKeys as St, DEV_SERVICES as T, createEntryWrapper as Tt, reconcileWorkspace as U, isOwnedBy as Ut, constructGlobs as V, imageName as Vt, workspace_exports as W, markerOf as Wt, bucketPolicies as X, toEmbeddableSecrets as Xt, applyPostgres as Y, storage_exports as Yt, postgresDatabaseNames as Z, withCustomSecret as Zt, deployDocker as _, providerOf as _t, recordRelease as a, envFor as at, ensureDockerignore as b, describeServices as bt, setBackupState as c, resourceName as ct, setGeneratedSecret as d, imageLayout as dt, composeFor as et, setPostgresBackupId as f, TURBO_VERSION as ft, credentialsFileContent as g, eventsBackendFor as gt, credentialsBuildArg as h, cacheBackendFor as ht, isDnsVerified as i, networkEnv as it, devServicesUsed as j, isRemoteStore as jt, UnknownDevService as k, loadSecretsForApp as kt, setDnsRecord as l, hostFor as lt, withGeneratedSecrets as m, findBuildRoot as mt, getBackupState as n, pgClient as nt, recordRollback as o, localRolePassword as ot, DeployJournal as p, detectPackageManager as pt, applyBuckets as q, initStageSecrets as qt, getGeneratedSecret as r, appEnvKeys as rt, setApplicationId as s, planFor as st, createEmptyState as t, bucketClient as tt, setDnsVerification as u, composeBuildPaths as ut, appDockerfile as v, storageBackendFor as vt, resolveHost as w, createCredentialsPreload as wt, validateImageRef as x, fakeKey as xt, dockerCommand as y, DEFAULT_IMAGES as yt, FAKE_ENV as z, applicationName as zt };
 
-//# sourceMappingURL=state-uuYqnRVO.mjs.map
+//# sourceMappingURL=state-Bn5JDMFT.mjs.map