@geekmidas/cli 10.0.0-alpha.80 → 10.0.0-alpha.81

package/dist/{seeds-BdkFpW0P.mjs → seeds-B4PiO_48.mjs}

@@ -2,14 +2,14 @@ import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { i as run$1, s as gkmHome } from "./run-BJLIerMM.mjs";
 import { d as output, r as discover, u as ConstructGenerator } from "./discover-BPelzeGW.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { O as TEST_STAGE, R as UnknownSecretsStoreProvider, h as getPublicEnvPrefix, m as PUBLIC_ENV_PREFIXES, n as allConstructGlobs } from "./workspace-BBdqmkch.mjs";
+import { F as LOGS_PORT, O as TEST_STAGE, R as UnknownSecretsStoreProvider, h as getPublicEnvPrefix, m as PUBLIC_ENV_PREFIXES, n as allConstructGlobs } from "./workspace-BBdqmkch.mjs";
 import { ConfigNotFound, NotInAnApp, loadWorkspaceAppInfo, loadWorkspaceConfig } from "./config.mjs";
 import { n as runtimeFor, r as generateTelemetryModule } from "./EndpointGenerator-DftalLYg.mjs";
-import { c as runtimeOf } from "./resolve-CQPn66jr.mjs";
+import { c as runtimeOf } from "./resolve-BPIDcuQ3.mjs";
 import { a as DEFAULT_STORAGE, i as DEFAULT_EVENTS$1, n as readFakes, o as holdsEveryCache, r as DEFAULT_CACHE, t as SubscriberGenerator } from "./SubscriberGenerator-5looQ3gB.mjs";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { constants, existsSync, readFileSync } from "node:fs";
-import { appendFile, chmod, copyFile, mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
+import { appendFile, chmod, copyFile, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { homedir, networkInterfaces } from "node:os";
 import { promisify } from "node:util";
 import { Cron } from "@geekmidas/constructs/crons";
@@ -18,16 +18,16 @@ import { DEFAULT_POSTGRES_VERSION, cacheTable, cookieDomain, dependenciesOf, dep
 import { createServer } from "node:net";
 import { execFile, spawn } from "node:child_process";
 import { config } from "dotenv";
-import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+import { createCipheriv, createDecipheriv, createHash, randomBytes, randomInt } from "node:crypto";
+import { stringify } from "yaml";
 import { formatKeyring, generateKeyring } from "@geekmidas/constructs/encryption";
 import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
 import * as snsUrl from "@geekmidas/events/sns/url";
 import * as sqsUrl from "@geekmidas/events/sqs/url";
-import { CreateBucketCommand, GetBucketPolicyCommand, HeadBucketCommand, PutBucketPolicyCommand, S3Client } from "@aws-sdk/client-s3";
+import { CreateBucketCommand, GetBucketPolicyCommand, HeadBucketCommand, ListBucketsCommand, PutBucketPolicyCommand, S3Client } from "@aws-sdk/client-s3";
 import { CreateTopicCommand, GetTopicAttributesCommand, SNSClient } from "@aws-sdk/client-sns";
 import { CreateQueueCommand, GetQueueUrlCommand, SQSClient } from "@aws-sdk/client-sqs";
 import { Client } from "pg";
-import { stringify } from "yaml";
 import { cacheTableStatements } from "@geekmidas/cache/postgres";
 //#region src/secrets/storage.ts
 var storage_exports = /* @__PURE__ */ __exportAll({
@@ -499,6 +499,10 @@ function packageName$1(root) {
 		return;
 	}
 }
+/**
+* Encrypt a JSON value with a stage key: AES-256-GCM, the file format every
+* stage's secrets are kept in.
+*/
 function encrypt(secrets, keyHex) {
 	const key = Buffer.from(keyHex, "hex");
 	const iv = randomBytes(IV_LENGTH);
@@ -510,6 +514,7 @@ function encrypt(secrets, keyHex) {
 		iv: iv.toString("hex")
 	};
 }
+/** Decrypt what {@link encrypt} wrote. */
 function decrypt(data, keyHex) {
 	const key = Buffer.from(keyHex, "hex");
 	const combined = Buffer.from(data.encrypted, "base64");
@@ -984,269 +989,579 @@ function volumeOf(container) {
 	}[container];
 }
 //#endregion
-//#region src/workspace/backends.ts
-/**
-* Which backend each declared kind resolves to — decided by where the project
-* deploys, and by nothing else.
-*
-* These used to be read out of a `services:` block, where one key answered two
-* questions: *does this exist* and *what backs it*. The first is the manifest's
-* — a declared `Cache` is why there is a cache — and the second is the deploy
-* target's, because the right cache for a Lambda is not the right cache for a
-* box already running Postgres. With both answered elsewhere there was nothing
-* left for the block to say, so it is gone and these read the target.
-*
-* Mail has no answer here at all: every provider speaks SMTP, so the provider
-* is whichever one the stage's mail URL points at.
-*/
+//#region src/reconcile/emulator.ts
 /**
-* Which family of defaults a workspace's deploy target belongs to.
-*
-* One question, asked once: **does this target run containers the project
-* controls?** Dokploy does, so a bucket or a cache can live beside the app;
-* AWS, Vercel and Cloudflare do not, so the default has to be something
-* managed. That is the whole of the distinction, and it is why `MainProvider`
-* is the right axis rather than the deploy target's own name — targets share
-* answers.
+* The AWS emulator (floci, LocalStack-compatible) the `sns` backend runs on
+* locally — the facts the compose file, the env writer and the applier must
+* agree on.
 *
-* Each target declares its answer as its `runtime` — a target package in its
-* `package.json`, so this never loads one. A workspace that names no target
-* is on AWS: an SST project predates `deploy.default: 'sst'`.
+* The emulator has one account and answers with deterministic ARNs and queue
+* URLs, which is what lets a connection string be composed before the topic
+* or queue it names has been created.
 */
-function providerOf(workspace) {
-	const target = workspace.deploy?.default;
-	return target ? runtimeOf(target, workspace) : "aws";
-}
+/** The emulator's single account. */
+const EMULATOR_ACCOUNT = "000000000000";
+const EMULATOR_REGION = "us-east-1";
 /**
-* The cache backend a target implies.
-*
-* The same answer locally and deployed: a local `gkm dev` for an AWS app still
-* uses the Upstash protocol, because a backend that differed between the two
-* would be worse than a slower one.
+* The emulator's access key id. The `LSIA` prefix is what LocalStack required
+* on issued keys, and LocalStack reads the account from the id — so it is
+* fixed, where the secret key beside it is generated per machine (see
+* `localCredentials.ts`). Floci does not care; keeping it means a project
+* that pins the old image still works.
 */
-function cacheBackendFor(on) {
-	return DEFAULT_CACHE[on];
+const EMULATOR_ACCESS_KEY_ID = "LSIAQAAAAAAVNCBMPNSG";
+/** The emulator's address from the host, on the port it was published on. */
+function emulatorEndpoint(port) {
+	return `http://localhost:${port}`;
 }
-/** Where a declared bucket lives on a target. */
-function storageBackendFor(on) {
-	return DEFAULT_STORAGE[on];
+function emulatorTopicArn(name) {
+	return `arn:aws:sns:${EMULATOR_REGION}:${EMULATOR_ACCOUNT}:${name}`;
 }
-/**
-* Which broker carries declared queues and topics on a target.
-*
-* Only consulted when something declares one; a project with no `Topic` or
-* `Queue` has no events at all, whatever the target.
-*/
-function eventsBackendFor(on) {
-	return DEFAULT_EVENTS$1[on];
+function emulatorQueueUrl(name, port) {
+	return `${emulatorEndpoint(port)}/${EMULATOR_ACCOUNT}/${name}`;
 }
 //#endregion
-//#region src/exec/imageBuild.ts
+//#region src/reconcile/compose.ts
 /**
-* Set by a site's Dockerfile in its builder stage: this process is building
-* an image.
+* The compose document a plan implies.
 *
-* Inside an image there is no stage to load secrets for and no local
-* container to resolve an address from — the public URLs the bundle inlines
-* arrived as the Dockerfile's build args, already in the environment. So
-* `gkm exec -- next build` there injects exactly those, and never the
-* `localhost` addresses a workspace resolves on a developer's machine.
-*/
-const IMAGE_BUILD_ENV = "GKM_IMAGE_BUILD";
-/** Whether this process is building an image. */
-function isImageBuild(env = process.env) {
-	return env[IMAGE_BUILD_ENV] === "1";
-}
-/**
-* What `gkm exec` injects inside an image build: the public values its build
-* args set — every `NEXT_PUBLIC_*`, `VITE_*` and `EXPO_PUBLIC_*` — and
-* nothing read from a secrets store, a file or a container.
-*/
-function imageBuildCredentials(env = process.env) {
-	const credentials = {};
-	for (const [key, value] of Object.entries(env)) {
-		if (value === void 0) continue;
-		if (PUBLIC_ENV_PREFIXES.some((prefix) => key.startsWith(prefix))) credentials[key] = value;
-	}
-	return credentials;
-}
-//#endregion
-//#region src/docker/templates.ts
-/**
-* The turbo every image prunes and builds with when the build root resolves
-* none of its own: a repository without turbo still needs `turbo prune` to
-* cut its slice of the workspace, and an unpinned `turbo` is whatever the
-* registry says on the day of the build.
-*/
-const TURBO_VERSION = "2.5.4";
-/**
-* Caddy, which serves a static site's files. A 2.x tag, so a rebuild picks
-* up patch releases and never a major.
-*/
-const STATIC_SITE_IMAGE = "caddy:2.10-alpine";
-const LOCKFILES = [
-	["pnpm-lock.yaml", "pnpm"],
-	["bun.lockb", "bun"],
-	["yarn.lock", "yarn"],
-	["package-lock.json", "npm"]
-];
-/**
-* Detect package manager from lockfiles
-* Walks up the directory tree to find lockfile (for monorepos)
-*/
-function detectPackageManager(cwd = process.cwd()) {
-	const lockfile = findLockfilePath(cwd);
-	if (!lockfile) return "pnpm";
-	const name = lockfile.slice(dirname(lockfile).length + 1);
-	return LOCKFILES.find(([file]) => file === name)?.[1] ?? "pnpm";
-}
-/**
-* Find the lockfile path by walking up the directory tree
-* Returns the full path to the lockfile, or null if not found
+* The third declaration of the same containers disappears here: today a
+* `services: ['postgres','minio']` block is kept in step with the code by hand,
+* which is the triplication this design exists to remove, in the one place you
+* touch every day. A `database` implies Postgres; the list is derived.
+*
+* Returns an object rather than a string for the same reason `plan` is pure —
+* what should exist is asserted as data, and turning it into YAML is one line at
+* the edge.
+*
+* What stays config is unchanged: images and versions are pinned explicitly, and
+* a container no construct implies is still declared by hand. Neutral facts come
+* from the declaration, provider detail from config.
 */
-function findLockfilePath(cwd = process.cwd()) {
-	for (const dir of upFrom(cwd)) for (const [lockfile] of LOCKFILES) {
-		const lockfilePath = join(dir, lockfile);
-		if (existsSync(lockfilePath)) return lockfilePath;
-	}
-	return null;
-}
+/** The database every connection opens first: every cluster has it. */
+const CLUSTER_DATABASE = "postgres";
 /**
-* The directory every image is built from: the nearest at or above `cwd`
-* holding a lockfile or a `pnpm-workspace.yaml` — the package manager's root,
-* which is what an install resolves the workspace's dependencies against.
+* Build the compose document for a plan.
 *
-* In a project of its own that is the gkm workspace's root. A gkm workspace
-* nested inside a monorepo, whose dependencies are the monorepo's
-* `workspace:*` packages, is built from the monorepo's root. `cwd` itself
-* when neither is found.
+* Every container is published on its assigned port, never on the image's
+* default: the point of allocation is that two projects can run at once, and
+* one container publishing 5432 puts that back.
 */
-function findBuildRoot(cwd = process.cwd()) {
-	for (const dir of upFrom(cwd)) {
-		if (existsSync(join(dir, "pnpm-workspace.yaml"))) return dir;
-		for (const [lockfile] of LOCKFILES) if (existsSync(join(dir, lockfile))) return dir;
-	}
-	return cwd;
-}
-/** `cwd` and every directory above it, the filesystem root last. */
-function upFrom(cwd) {
-	const dirs = [];
-	const root = parse(cwd).root;
-	let dir = cwd;
-	while (dir !== root) {
-		dirs.push(dir);
-		dir = dirname(dir);
+function composeFor(plan, options) {
+	const services = {};
+	const volumes = {};
+	for (const container of [...plan.containers].sort()) {
+		const declared = container === "postgres" ? plan.resources.find((r) => r.version)?.version : void 0;
+		const fake = plan.fakes?.[container];
+		const image = declared ? postgresImage(declared) : fake?.image ?? DEFAULT_IMAGES[container];
+		if (!image) throw new UnknownContainer(container);
+		const published = publish(container, options.ports, plan.fakes);
+		services[container] = fake ? {
+			image,
+			restart: "unless-stopped",
+			ports: published
+		} : define(container, image, published, options.credentials);
+		const volume = volumeOf(container);
+		if (volume) volumes[volume] = {};
 	}
-	dirs.push(root);
-	return dirs;
-}
-/** The package manager, its version, turbo's and the shape of a build root. */
-function resolveBuildTools(buildRoot) {
-	const pkg = readJson(join(buildRoot, "package.json"));
-	const packageManager = detectPackageManager(buildRoot);
-	const field = typeof pkg?.packageManager === "string" ? pkg.packageManager : "";
-	const match = /^([a-z]+)@(\d[^+\s]*)/.exec(field);
-	const packageManagerVersion = match && match[1] === packageManager ? match[2] : void 0;
 	return {
-		packageManager,
-		...packageManagerVersion ? { packageManagerVersion } : {},
-		turboVersion: resolveTurboVersion(buildRoot) ?? "2.5.4",
-		monorepo: existsSync(join(buildRoot, "pnpm-workspace.yaml")) || pkg?.workspaces !== void 0
-	};
-}
-/**
-* The turbo version a build root resolves: what is installed, or what its
-* lockfile pins. Undefined when it has none.
-*/
-function resolveTurboVersion(buildRoot) {
-	const installed = readJson(join(buildRoot, "node_modules", "turbo", "package.json"));
-	if (typeof installed?.version === "string") return installed.version;
-	const read = (file) => {
-		try {
-			return readFileSync(join(buildRoot, file), "utf-8");
-		} catch {
-			return;
-		}
+		name: options.project,
+		services: {
+			...services,
+			...options.apps
+		},
+		...Object.keys(volumes).length ? { volumes } : {}
 	};
-	const pnpm = read("pnpm-lock.yaml");
-	const fromPnpm = pnpm && /^ {2}'?turbo@(\d[^:'(\s]*)'?:/m.exec(pnpm);
-	if (fromPnpm) return fromPnpm[1];
-	const npm = read("package-lock.json");
-	if (npm) {
-		const version = safeParse(npm)?.packages?.["node_modules/turbo"]?.version;
-		if (version) return version;
-	}
-	const yarn = read("yarn.lock");
-	const fromYarn = yarn && /^"?turbo@[^\n]*:\n\s+version:? "?(\d[^"\s]*)"?/m.exec(yarn);
-	if (fromYarn) return fromYarn[1];
 }
-function readJson(path) {
-	try {
-		return safeParse(readFileSync(path, "utf-8"));
-	} catch {
-		return;
-	}
+/** Render a compose document as the file it becomes. */
+function toYaml(file) {
+	return `# Generated by gkm from the construct manifest — do not edit.
+# Containers are derived from what the app declares. Image pins and anything
+# no construct implies go in your own docker-compose.yml, which is merged over
+# this file and wins:
+#
+#   docker compose -f docker-compose.constructs.yml -f docker-compose.yml …
+#
+# "gkm dev" and "gkm test" start the containers. The apps sit behind the
+# "apps" profile: run "gkm setup", then
+#   docker compose -f docker-compose.constructs.yml --profile apps up --build
+${stringify(file, { lineWidth: 0 })}`;
 }
-function safeParse(text) {
-	try {
-		const value = JSON.parse(text);
-		return value && typeof value === "object" ? value : void 0;
-	} catch {
-		return;
+/** A container with no image, from config or from the defaults. */
+var UnknownContainer = class extends Error {
+	/** The container that could not be resolved. */
+	container;
+	/** The containers that have a default, so the caller can see the set. */
+	known = Object.keys(DEFAULT_IMAGES).sort();
+	constructor(container) {
+		super("No image is known for this container; pin one in config");
+		this.name = "UnknownContainer";
+		this.container = container;
+	}
+};
+/** One container's definition, published on the port it was assigned. */
+function define(container, image, published, credentials) {
+	switch (container) {
+		case "postgres": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			environment: {
+				POSTGRES_USER: credentials.postgres.user,
+				POSTGRES_PASSWORD: credentials.postgres.password,
+				POSTGRES_DB: CLUSTER_DATABASE
+			},
+			volumes: ["postgres-data:/var/lib/postgresql"],
+			healthcheck: {
+				test: ["CMD-SHELL", `pg_isready -U ${credentials.postgres.user} -d ${CLUSTER_DATABASE}`],
+				interval: "5s",
+				timeout: "3s",
+				retries: 10,
+				start_period: "10s"
+			}
+		};
+		case "minio": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			environment: {
+				MINIO_ROOT_USER: credentials.minio.user,
+				MINIO_ROOT_PASSWORD: credentials.minio.password
+			},
+			command: "server --console-address \":9001\" /data",
+			volumes: ["minio-data:/data"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"mc",
+					"ready",
+					"local"
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5,
+				start_period: "10s"
+			}
+		};
+		case "caddy": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			volumes: [
+				"./.gkm/Caddyfile:/etc/caddy/Caddyfile:ro",
+				"./.gkm/caddy-sites:/etc/caddy/sites:ro",
+				"caddy-data:/data"
+			],
+			extra_hosts: ["host.docker.internal:host-gateway"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"caddy",
+					"version"
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5
+			}
+		};
+		case "mailpit": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			environment: {
+				MP_SMTP_AUTH_ACCEPT_ANY: "1",
+				MP_SMTP_AUTH_ALLOW_INSECURE: "1"
+			},
+			healthcheck: {
+				test: [
+					"CMD",
+					"wget",
+					"-q",
+					"--spider",
+					"http://localhost:8025"
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5
+			}
+		};
+		case "redis": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			command: "sh -c 'exec docker-entrypoint.sh redis-server --requirepass \"$$REDIS_PASSWORD\"'",
+			environment: {
+				REDIS_PASSWORD: credentials.redis.password,
+				REDISCLI_AUTH: credentials.redis.password
+			},
+			volumes: ["redis-data:/data"],
+			healthcheck: {
+				test: ["CMD-SHELL", "redis-cli ping | grep -q PONG"],
+				interval: "5s",
+				timeout: "3s",
+				retries: 5
+			}
+		};
+		case "redis-http": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			environment: {
+				SRH_MODE: "env",
+				SRH_TOKEN: credentials.cacheToken,
+				SRH_CONNECTION_STRING: `redis://:${encodeURIComponent(credentials.redis.password)}@redis:6379`
+			},
+			depends_on: ["redis"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"wget",
+					"-q",
+					"-O",
+					"/dev/null",
+					"http://127.0.0.1:80/"
+				],
+				interval: "5s",
+				timeout: "3s",
+				retries: 10
+			}
+		};
+		case "rabbitmq": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			environment: {
+				RABBITMQ_DEFAULT_USER: credentials.rabbitmq.user,
+				RABBITMQ_DEFAULT_PASS: credentials.rabbitmq.password
+			},
+			volumes: ["rabbitmq-data:/var/lib/rabbitmq"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"rabbitmq-diagnostics",
+					"-q",
+					"ping"
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5
+			}
+		};
+		case "localstack": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			extra_hosts: ["host.docker.internal:host-gateway"],
+			environment: {
+				AWS_DEFAULT_REGION: EMULATOR_REGION,
+				AWS_ACCESS_KEY_ID: credentials.emulator.accessKeyId,
+				AWS_SECRET_ACCESS_KEY: credentials.emulator.secretAccessKey
+			},
+			volumes: ["localstack-data:/var/lib/localstack"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"bash",
+					"-c",
+					"exec 3<>/dev/tcp/localhost/4566"
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5,
+				start_period: "10s"
+			}
+		};
+		default: throw new UnknownContainer(container);
 	}
 }
 /**
-* Check if turbo.json exists (walks up directory tree)
+* The published port mappings for a container.
+*
+* Every port is looked up by its own key rather than being derived as an offset
+* from the container's first, so MinIO's console cannot land on whatever was
+* allocated to the next container.
 */
-function hasTurboConfig(cwd = process.cwd()) {
-	return upFrom(cwd).some((dir) => existsSync(join(dir, "turbo.json")));
+function publish(container, ports, fakes) {
+	return portsOf(container, fakes).map((port) => {
+		const assigned = ports[port.key];
+		if (assigned === void 0) throw new UnassignedPort(port.key);
+		return `${assigned}:${port.inside}`;
+	});
 }
+/** A planned port that allocation never assigned. */
+var UnassignedPort = class extends Error {
+	/** The port key that went unassigned, e.g. `minio-console`. */
+	key;
+	constructor(key) {
+		super("No port was assigned for this container port");
+		this.name = "UnassignedPort";
+		this.key = key;
+	}
+};
+//#endregion
+//#region src/workspace/backends.ts
 /**
-* Package manager specific commands. `version` pins what corepack (or npm,
-* for bun) installs; without it, the latest.
+* Which backend each declared kind resolves to — decided by where the project
+* deploys, and by nothing else.
+*
+* These used to be read out of a `services:` block, where one key answered two
+* questions: *does this exist* and *what backs it*. The first is the manifest's
+* — a declared `Cache` is why there is a cache — and the second is the deploy
+* target's, because the right cache for a Lambda is not the right cache for a
+* box already running Postgres. With both answered elsewhere there was nothing
+* left for the block to say, so it is gone and these read the target.
+*
+* Mail has no answer here at all: every provider speaks SMTP, so the provider
+* is whichever one the stage's mail URL points at.
 */
-function getPmConfig(pm, version) {
-	return {
-		pnpm: {
-			install: `corepack enable && corepack prepare pnpm@${version ?? "latest"} --activate`,
-			lockfile: "pnpm-lock.yaml",
-			installCmd: "pnpm install",
-			cacheTarget: "/root/.local/share/pnpm/store",
-			cacheId: "pnpm",
-			run: "pnpm run",
-			dlx: "pnpm dlx"
-		},
-		npm: {
-			install: version ? `npm install -g npm@${version}` : "",
-			lockfile: "package-lock.json",
-			installCmd: "npm install",
-			cacheTarget: "/root/.npm",
-			cacheId: "npm",
-			run: "npm run",
-			dlx: "npx --yes"
-		},
-		yarn: {
-			install: `corepack enable && corepack prepare yarn@${version ?? "stable"} --activate`,
-			lockfile: "yarn.lock",
-			installCmd: "yarn install",
-			cacheTarget: "/root/.yarn/cache",
-			cacheId: "yarn",
-			run: "yarn run",
-			dlx: "yarn dlx"
-		},
-		bun: {
-			install: `npm install -g bun@${version ?? "latest"}`,
-			lockfile: "bun.lockb",
-			installCmd: "bun install",
-			cacheTarget: "/root/.bun/install/cache",
-			cacheId: "bun",
-			run: "bun run",
-			dlx: "bunx"
-		}
-	}[pm];
-}
-/** What every template's first three stages need, resolved from options. */
-function layout(options) {
+/**
+* Which family of defaults a workspace's deploy target belongs to.
+*
+* One question, asked once: **does this target run containers the project
+* controls?** Dokploy does, so a bucket or a cache can live beside the app;
+* AWS, Vercel and Cloudflare do not, so the default has to be something
+* managed. That is the whole of the distinction, and it is why `MainProvider`
+* is the right axis rather than the deploy target's own name — targets share
+* answers.
+*
+* Each target declares its answer as its `runtime` — a target package in its
+* `package.json`, so this never loads one. A workspace that names no target
+* is on AWS: an SST project predates `deploy.default: 'sst'`.
+*/
+function providerOf(workspace) {
+	const target = workspace.deploy?.default;
+	return target ? runtimeOf(target, workspace) : "aws";
+}
+/**
+* The cache backend a target implies.
+*
+* The same answer locally and deployed: a local `gkm dev` for an AWS app still
+* uses the Upstash protocol, because a backend that differed between the two
+* would be worse than a slower one.
+*/
+function cacheBackendFor(on) {
+	return DEFAULT_CACHE[on];
+}
+/** Where a declared bucket lives on a target. */
+function storageBackendFor(on) {
+	return DEFAULT_STORAGE[on];
+}
+/**
+* Which broker carries declared queues and topics on a target.
+*
+* Only consulted when something declares one; a project with no `Topic` or
+* `Queue` has no events at all, whatever the target.
+*/
+function eventsBackendFor(on) {
+	return DEFAULT_EVENTS$1[on];
+}
+//#endregion
+//#region src/exec/imageBuild.ts
+/**
+* Set by a site's Dockerfile in its builder stage: this process is building
+* an image.
+*
+* Inside an image there is no stage to load secrets for and no local
+* container to resolve an address from — the public URLs the bundle inlines
+* arrived as the Dockerfile's build args, already in the environment. So
+* `gkm exec -- next build` there injects exactly those, and never the
+* `localhost` addresses a workspace resolves on a developer's machine.
+*/
+const IMAGE_BUILD_ENV = "GKM_IMAGE_BUILD";
+/** Whether this process is building an image. */
+function isImageBuild(env = process.env) {
+	return env[IMAGE_BUILD_ENV] === "1";
+}
+/**
+* What `gkm exec` injects inside an image build: the public values its build
+* args set — every `NEXT_PUBLIC_*`, `VITE_*` and `EXPO_PUBLIC_*` — and
+* nothing read from a secrets store, a file or a container.
+*/
+function imageBuildCredentials(env = process.env) {
+	const credentials = {};
+	for (const [key, value] of Object.entries(env)) {
+		if (value === void 0) continue;
+		if (PUBLIC_ENV_PREFIXES.some((prefix) => key.startsWith(prefix))) credentials[key] = value;
+	}
+	return credentials;
+}
+//#endregion
+//#region src/docker/templates.ts
+/**
+* The turbo every image prunes and builds with when the build root resolves
+* none of its own: a repository without turbo still needs `turbo prune` to
+* cut its slice of the workspace, and an unpinned `turbo` is whatever the
+* registry says on the day of the build.
+*/
+const TURBO_VERSION = "2.5.4";
+/**
+* Caddy, which serves a static site's files. A 2.x tag, so a rebuild picks
+* up patch releases and never a major.
+*/
+const STATIC_SITE_IMAGE = "caddy:2.10-alpine";
+const LOCKFILES = [
+	["pnpm-lock.yaml", "pnpm"],
+	["bun.lockb", "bun"],
+	["yarn.lock", "yarn"],
+	["package-lock.json", "npm"]
+];
+/**
+* Detect package manager from lockfiles
+* Walks up the directory tree to find lockfile (for monorepos)
+*/
+function detectPackageManager(cwd = process.cwd()) {
+	const lockfile = findLockfilePath(cwd);
+	if (!lockfile) return "pnpm";
+	const name = lockfile.slice(dirname(lockfile).length + 1);
+	return LOCKFILES.find(([file]) => file === name)?.[1] ?? "pnpm";
+}
+/**
+* Find the lockfile path by walking up the directory tree
+* Returns the full path to the lockfile, or null if not found
+*/
+function findLockfilePath(cwd = process.cwd()) {
+	for (const dir of upFrom(cwd)) for (const [lockfile] of LOCKFILES) {
+		const lockfilePath = join(dir, lockfile);
+		if (existsSync(lockfilePath)) return lockfilePath;
+	}
+	return null;
+}
+/**
+* The directory every image is built from: the nearest at or above `cwd`
+* holding a lockfile or a `pnpm-workspace.yaml` — the package manager's root,
+* which is what an install resolves the workspace's dependencies against.
+*
+* In a project of its own that is the gkm workspace's root. A gkm workspace
+* nested inside a monorepo, whose dependencies are the monorepo's
+* `workspace:*` packages, is built from the monorepo's root. `cwd` itself
+* when neither is found.
+*/
+function findBuildRoot(cwd = process.cwd()) {
+	for (const dir of upFrom(cwd)) {
+		if (existsSync(join(dir, "pnpm-workspace.yaml"))) return dir;
+		for (const [lockfile] of LOCKFILES) if (existsSync(join(dir, lockfile))) return dir;
+	}
+	return cwd;
+}
+/** `cwd` and every directory above it, the filesystem root last. */
+function upFrom(cwd) {
+	const dirs = [];
+	const root = parse(cwd).root;
+	let dir = cwd;
+	while (dir !== root) {
+		dirs.push(dir);
+		dir = dirname(dir);
+	}
+	dirs.push(root);
+	return dirs;
+}
+/** The package manager, its version, turbo's and the shape of a build root. */
+function resolveBuildTools(buildRoot) {
+	const pkg = readJson(join(buildRoot, "package.json"));
+	const packageManager = detectPackageManager(buildRoot);
+	const field = typeof pkg?.packageManager === "string" ? pkg.packageManager : "";
+	const match = /^([a-z]+)@(\d[^+\s]*)/.exec(field);
+	const packageManagerVersion = match && match[1] === packageManager ? match[2] : void 0;
+	return {
+		packageManager,
+		...packageManagerVersion ? { packageManagerVersion } : {},
+		turboVersion: resolveTurboVersion(buildRoot) ?? "2.5.4",
+		monorepo: existsSync(join(buildRoot, "pnpm-workspace.yaml")) || pkg?.workspaces !== void 0
+	};
+}
+/**
+* The turbo version a build root resolves: what is installed, or what its
+* lockfile pins. Undefined when it has none.
+*/
+function resolveTurboVersion(buildRoot) {
+	const installed = readJson(join(buildRoot, "node_modules", "turbo", "package.json"));
+	if (typeof installed?.version === "string") return installed.version;
+	const read = (file) => {
+		try {
+			return readFileSync(join(buildRoot, file), "utf-8");
+		} catch {
+			return;
+		}
+	};
+	const pnpm = read("pnpm-lock.yaml");
+	const fromPnpm = pnpm && /^ {2}'?turbo@(\d[^:'(\s]*)'?:/m.exec(pnpm);
+	if (fromPnpm) return fromPnpm[1];
+	const npm = read("package-lock.json");
+	if (npm) {
+		const version = safeParse(npm)?.packages?.["node_modules/turbo"]?.version;
+		if (version) return version;
+	}
+	const yarn = read("yarn.lock");
+	const fromYarn = yarn && /^"?turbo@[^\n]*:\n\s+version:? "?(\d[^"\s]*)"?/m.exec(yarn);
+	if (fromYarn) return fromYarn[1];
+}
+function readJson(path) {
+	try {
+		return safeParse(readFileSync(path, "utf-8"));
+	} catch {
+		return;
+	}
+}
+function safeParse(text) {
+	try {
+		const value = JSON.parse(text);
+		return value && typeof value === "object" ? value : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Check if turbo.json exists (walks up directory tree)
+*/
+function hasTurboConfig(cwd = process.cwd()) {
+	return upFrom(cwd).some((dir) => existsSync(join(dir, "turbo.json")));
+}
+/**
+* Package manager specific commands. `version` pins what corepack (or npm,
+* for bun) installs; without it, the latest.
+*/
+function getPmConfig(pm, version) {
+	return {
+		pnpm: {
+			install: `corepack enable && corepack prepare pnpm@${version ?? "latest"} --activate`,
+			lockfile: "pnpm-lock.yaml",
+			installCmd: "pnpm install",
+			cacheTarget: "/root/.local/share/pnpm/store",
+			cacheId: "pnpm",
+			run: "pnpm run",
+			dlx: "pnpm dlx"
+		},
+		npm: {
+			install: version ? `npm install -g npm@${version}` : "",
+			lockfile: "package-lock.json",
+			installCmd: "npm install",
+			cacheTarget: "/root/.npm",
+			cacheId: "npm",
+			run: "npm run",
+			dlx: "npx --yes"
+		},
+		yarn: {
+			install: `corepack enable && corepack prepare yarn@${version ?? "stable"} --activate`,
+			lockfile: "yarn.lock",
+			installCmd: "yarn install",
+			cacheTarget: "/root/.yarn/cache",
+			cacheId: "yarn",
+			run: "yarn run",
+			dlx: "yarn dlx"
+		},
+		bun: {
+			install: `npm install -g bun@${version ?? "latest"}`,
+			lockfile: "bun.lockb",
+			installCmd: "bun install",
+			cacheTarget: "/root/.bun/install/cache",
+			cacheId: "bun",
+			run: "bun run",
+			dlx: "bunx"
+		}
+	}[pm];
+}
+/** What every template's first three stages need, resolved from options. */
+function layout(options) {
 	const pm = getPmConfig(options.packageManager, options.packageManagerVersion);
 	const turbo = `${pm.dlx} turbo@${options.turboVersion ?? "2.5.4"}`;
 	const gkmRoot = options.gkmRoot ?? ".";
@@ -2195,42 +2510,9 @@ const GENERATED = `# Generated by gkm from the construct manifest — do not edi
 # from code; a browser needs the root trusted once.
 `;
 //#endregion
-//#region src/reconcile/emulator.ts
+//#region src/workspace/rootSite.ts
 /**
-* The AWS emulator (floci, LocalStack-compatible) the `sns` backend runs on
-* locally — the facts the compose file, the env writer and the applier must
-* agree on.
-*
-* The emulator has one account and answers with deterministic ARNs and queue
-* URLs, which is what lets a connection string be composed before the topic
-* or queue it names has been created.
-*/
-/** The emulator's single account. */
-const EMULATOR_ACCOUNT = "000000000000";
-const EMULATOR_REGION = "us-east-1";
-/**
-* The emulator's credential. The `LSIA` prefix is what LocalStack required on
-* issued keys; floci does not care, and keeping it means a project that pins
-* the old image still works.
-*/
-const EMULATOR_CREDENTIALS = {
-	accessKeyId: "LSIAQAAAAAAVNCBMPNSG",
-	secretAccessKey: "geekmidas"
-};
-/** The emulator's address from the host, on the port it was published on. */
-function emulatorEndpoint(port) {
-	return `http://localhost:${port}`;
-}
-function emulatorTopicArn(name) {
-	return `arn:aws:sns:${EMULATOR_REGION}:${EMULATOR_ACCOUNT}:${name}`;
-}
-function emulatorQueueUrl(name, port) {
-	return `${emulatorEndpoint(port)}/${EMULATOR_ACCOUNT}/${name}`;
-}
-//#endregion
-//#region src/workspace/rootSite.ts
-/**
-* Which site the base domain points at — deployed and locally alike.
+* Which site the base domain points at — deployed and locally alike.
 *
 * Three rules, in order, and the last one is the point:
 *
@@ -2586,15 +2868,6 @@ var PgBossNeedsDatabase = class extends Error {
 * Locally that self-containment is what lets the port be whatever was free: the
 * app reads `ORDERS_URL` and never sees a host or a port.
 */
-/**
-* The credential local containers are brought up with.
-*
-* The design's `roles: false` case — both URLs fall back to the cluster's master
-* credential. A deliberate downgrade, not a default: it holds until the role DDL
-* lands in `@geekmidas/db`, at which point the runtime role's URL replaces this
-* and the owner URL stops being reachable from any manifest edge.
-*/
-const LOCAL_USER$2 = "geekmidas";
 /** The host containers are published on. */
 const LOCAL_HOST = "localhost";
 /** The region local buckets claim, so the client has one to sign with. */
@@ -2608,23 +2881,23 @@ const LOCAL_REGION = "us-east-1";
 * the same chain reads these — which is why they are injected beside the URL
 * rather than written into it.
 */
-const STORAGE_CREDENTIALS = {
-	AWS_ACCESS_KEY_ID: LOCAL_USER$2,
-	AWS_SECRET_ACCESS_KEY: LOCAL_USER$2,
-	AWS_REGION: LOCAL_REGION
-};
-/** The token the local cache proxy accepts. Matches the compose definition. */
-const LOCAL_TOKEN$1 = "geekmidas";
+function storageCredentials(credentials) {
+	return {
+		AWS_ACCESS_KEY_ID: credentials.minio.user,
+		AWS_SECRET_ACCESS_KEY: credentials.minio.password,
+		AWS_REGION: LOCAL_REGION
+	};
+}
 /** The port Mailpit's inbox — its web UI and HTTP API — is published under. */
 const MAILPIT_INBOX_PORT = "mailpit-web";
 /** The schema pg-boss keeps its tables in, inside the declared database. */
 const PGBOSS_SCHEMA = "pgboss";
 /** The exchange every local topic and queue shares on RabbitMQ. */
-const RABBITMQ_EXCHANGE = "geekmidas.events";
-/** The credential `options` describe, defaulting to the local one. */
+const RABBITMQ_EXCHANGE = "gkm.events";
+/** The credential `options` describe. */
 function credentialOf(options) {
 	return {
-		master: options.master ?? LOCAL_USER$2,
+		containers: options.credentials,
 		...options.seed ? { seed: options.seed } : {}
 	};
 }
@@ -2664,7 +2937,7 @@ function envFor(plan, options) {
 	}
 	Object.assign(env, publicEnv(plan, env, options.addresses));
 	Object.assign(env, brokerEnv(plan, options.ports, credential));
-	if (plan.resources.some((r) => r.kind === "objects" && env[r.envKey])) Object.assign(env, STORAGE_CREDENTIALS);
+	if (plan.resources.some((r) => r.kind === "objects" && env[r.envKey])) Object.assign(env, storageCredentials(options.credentials));
 	return env;
 }
 /**
@@ -2799,7 +3072,7 @@ function workerBroker(plan, ports, credential) {
 *
 * Every part of it comes from the resource and the port it was published on.
 */
-function urlFor(resource, plan, ports, project, addresses = {}, credential = { master: LOCAL_USER$2 }) {
+function urlFor(resource, plan, ports, project, addresses, credential) {
 	if (resource.kind === "secret") return localSecret(project, plan, resource);
 	if (resource.kind === "encryption") return localKeyring(project, plan, resource);
 	if (resource.kind === "mobile-app") return schemeBase(project, resource.scheme);
@@ -2813,7 +3086,7 @@ function urlFor(resource, plan, ports, project, addresses = {}, credential = { m
 		return port === void 0 ? void 0 : `http://${LOCAL_HOST}:${port}`;
 	}
 	if (resource.kind === "rest-api" || resource.kind === "site") {
-		const address = addresses[resource.id];
+		const address = addresses?.[resource.id];
 		const edge = plan.containers.includes("caddy") ? ports[primaryPortKey("caddy")] : void 0;
 		return address && edge !== void 0 ? `https://${hostFor(resource, project)}:${edge}` : address;
 	}
@@ -2827,10 +3100,7 @@ function urlFor(resource, plan, ports, project, addresses = {}, credential = { m
 			const database = rootDatabase(resource, plan);
 			if (resource.roles === false) {
 				const schema = schemaOf(resource, plan);
-				const master = {
-					user: LOCAL_USER$2,
-					password: credential.master
-				};
+				const master = credential.containers.postgres;
 				return schema ? `${postgres(port, database, master)}?search_path=${schema}` : postgres(port, database, master);
 			}
 			const role = resource.kind === "database-reader" ? readerRole(parentRole(resource, plan)) : localRole(resource);
@@ -2854,8 +3124,8 @@ function urlFor(resource, plan, ports, project, addresses = {}, credential = { m
 			}
 			switch (plan.cache) {
 				case "elasticache":
-				case "redis": return `redis://${LOCAL_HOST}:${port}`;
-				default: return `http://:${LOCAL_TOKEN$1}@${LOCAL_HOST}:${port}`;
+				case "redis": return `redis://:${encodeURIComponent(credential.containers.redis.password)}@${LOCAL_HOST}:${port}`;
+				default: return `http://:${encodeURIComponent(credential.containers.cacheToken)}@${LOCAL_HOST}:${port}`;
 			}
 		case "queue":
 		case "topic": return broker(plan, port, credential, resource);
@@ -2874,9 +3144,13 @@ function broker(plan, port, credential, resource) {
 		case "pgboss": {
 			const database = plan.resources.find((r) => r.kind === "database");
 			if (!database) throw new PgBossNeedsDatabase([]);
-			return `pgboss://${LOCAL_USER$2}:${encodeURIComponent(credential.master)}@${LOCAL_HOST}:${port}/${database.name}?schema=${PGBOSS_SCHEMA}`;
+			const { user, password } = credential.containers.postgres;
+			return `pgboss://${user}:${encodeURIComponent(password)}@${LOCAL_HOST}:${port}/${database.name}?schema=${PGBOSS_SCHEMA}`;
+		}
+		case "rabbitmq": {
+			const { user, password } = credential.containers.rabbitmq;
+			return `rabbitmq://${encodeURIComponent(user)}:${encodeURIComponent(password)}@${LOCAL_HOST}:${port}?exchange=${RABBITMQ_EXCHANGE}`;
 		}
-		case "rabbitmq": return `rabbitmq://${LOCAL_USER$2}:${LOCAL_USER$2}@${LOCAL_HOST}:${port}?exchange=${RABBITMQ_EXCHANGE}`;
 		case "sns": {
 			if (!resource) throw new UnprovisionedEventsBackend("sns");
 			const endpoint = emulatorEndpoint(port);
@@ -2890,17 +3164,15 @@ function broker(plan, port, credential, resource) {
 				endpoint
 			});
 			const url = new URL(address);
-			url.searchParams.set("accessKeyId", EMULATOR_CREDENTIALS.accessKeyId);
-			url.searchParams.set("secretAccessKey", EMULATOR_CREDENTIALS.secretAccessKey);
+			const { accessKeyId, secretAccessKey } = credential.containers.emulator;
+			url.searchParams.set("accessKeyId", accessKeyId);
+			url.searchParams.set("secretAccessKey", secretAccessKey);
 			return url.toString();
 		}
 	}
 }
-/** A local Postgres URL, master credential and all. */
-function postgres(port, database, credential = {
-	user: LOCAL_USER$2,
-	password: LOCAL_USER$2
-}) {
+/** A local Postgres URL, with the login it connects as. */
+function postgres(port, database, credential) {
 	return `postgres://${credential.user}:${encodeURIComponent(credential.password)}@${LOCAL_HOST}:${port}/${database}`;
 }
 /**
@@ -3195,14 +3467,19 @@ function addEdgeKeys(manifest, edges, keys) {
 	}
 }
 /** One compose service per app the workspace runs, behind the apps profile. */
-function appServices(workspace, manifest, containers, runnables = {}, fakes = {}) {
+function appServices(workspace, manifest, containers, credentials, runnables = {}, fakes = {}) {
 	const plan = localPlan(workspace, manifest, fakes);
-	const env = networkEnv(plan, {
+	const derivation = {
 		project: workspace.name,
+		credentials,
+		seed: credentials.seed
+	};
+	const env = networkEnv(plan, {
+		...derivation,
 		addresses: surfaceAddresses(workspace, manifest, (app, port) => `http://${app}:${port}`)
 	});
 	const browser = networkEnv(plan, {
-		project: workspace.name,
+		...derivation,
 		addresses: surfaceAddresses(workspace, manifest)
 	});
 	const services = {};
@@ -3277,8 +3554,6 @@ function healthcheck(port, path) {
 * Both are constructed from the same local addresses the env writer composes,
 * so the applier cannot end up talking to a different container than the app.
 */
-/** The credential local containers are brought up with. */
-const LOCAL_USER$1 = "geekmidas";
 /**
 * A Postgres client that opens one connection per database it is asked about.
 *
@@ -3286,14 +3561,14 @@ const LOCAL_USER$1 = "geekmidas";
 * and a schema must be created from inside its own database — so the database is
 * part of each query rather than fixed when the client is built.
 */
-function pgClient(port, password = LOCAL_USER$1) {
+function pgClient(port, login) {
 	return { async query(database, sql, values) {
 		const client = new Client({
 			host: "localhost",
 			port,
-			user: LOCAL_USER$1,
-			password,
-			database: database ?? LOCAL_USER$1
+			user: login.user,
+			password: login.password,
+			database: database ?? "postgres"
 		});
 		await client.connect();
 		try {
@@ -3304,10 +3579,7 @@ function pgClient(port, password = LOCAL_USER$1) {
 	} };
 }
 /** A bucket client pointed at a MinIO on this machine. */
-function bucketClient(port, credentials = {
-	user: LOCAL_USER$1,
-	password: LOCAL_USER$1
-}) {
+function bucketClient(port, credentials) {
 	const s3 = new S3Client({
 		region: "us-east-1",
 		endpoint: `http://localhost:${port}`,
@@ -3345,11 +3617,11 @@ function bucketClient(port, credentials = {
 	};
 }
 /** A topic and queue client pointed at the local AWS emulator. */
-function carrierClient(port) {
+function carrierClient(port, credentials) {
 	const config = {
 		region: EMULATOR_REGION,
 		endpoint: emulatorEndpoint(port),
-		credentials: EMULATOR_CREDENTIALS
+		credentials
 	};
 	const sns = new SNSClient(config);
 	const sqs = new SQSClient(config);
@@ -3379,1195 +3651,1883 @@ function carrierClient(port) {
 	};
 }
 //#endregion
-//#region src/reconcile/compose.ts
+//#region src/reconcile/docker.ts
 /**
-* The compose document a plan implies.
-*
-* The third declaration of the same containers disappears here: today a
-* `services: ['postgres','minio']` block is kept in step with the code by hand,
-* which is the triplication this design exists to remove, in the one place you
-* touch every day. A `database` implies Postgres; the list is derived.
+* The real Docker, behind the small interface reconcile needs.
 *
-* Returns an object rather than a string for the same reason `plan` is pure —
-* what should exist is asserted as data, and turning it into YAML is one line at
-* the edge.
+* Shells out to `docker compose` rather than talking to the daemon socket: it is
+* what a developer runs by hand when something is wrong, so the two cannot
+* disagree, and it keeps Docker out of this package's dependencies.
 *
-* What stays config is unchanged: images and versions are pinned explicitly, and
-* a container no construct implies is still declared by hand. Neutral facts come
-* from the declaration, provider detail from config.
+* Every call is scoped to the generated compose file. Nothing here can touch a
+* container this project did not generate.
 */
-/** The credential every derived container is brought up with locally. */
-const LOCAL_USER = "geekmidas";
+const run = promisify(execFile);
 /**
-* The token the local cache accepts.
+* The generated file, then the project's own if it has one.
 *
-* Fixed rather than generated: it is only ever reachable on a port this project
-* published, and the URL that carries it is derived, so nothing is made safer
-* by making it unguessable and a stable one keeps `redis-cli` sessions working.
+* Merged in that order so the project's wins — an `image:` there pins a
+* container this file derived, and a service there is added beside them.
+*/
+function composeFiles(composePath) {
+	const project = join(dirname(composePath), "docker-compose.yml");
+	return [
+		"-f",
+		composePath,
+		...existsSync(project) ? ["-f", project] : []
+	];
+}
+/** How long to wait for containers to pass their health checks. */
+const HEALTH_TIMEOUT_MS = 12e4;
+/** `docker compose up` exited unsuccessfully; its own output said why. */
+var ComposeUpFailed = class extends Error {
+	services;
+	code;
+	constructor(services, code) {
+		super(`docker compose could not start ${services.join(", ")} (exit ${code ?? "signal"}). Its output above names the container; \`docker compose logs <service>\` shows why it stopped.`);
+		this.services = services;
+		this.code = code;
+		this.name = "ComposeUpFailed";
+	}
+};
+/** Run compose with its output on this terminal rather than captured. */
+function shown(args, services) {
+	return new Promise((resolve, reject) => {
+		const child = spawn("docker", args, { stdio: [
+			"ignore",
+			"inherit",
+			"inherit"
+		] });
+		child.on("error", reject);
+		child.on("close", (code) => code === 0 ? resolve() : reject(new ComposeUpFailed(services, code)));
+	});
+}
+const dockerCli = {
+	async publishedPort(composePath, service, inside) {
+		try {
+			const { stdout } = await run("docker", [
+				"compose",
+				...composeFiles(composePath),
+				"port",
+				service,
+				String(inside)
+			]);
+			const port = Number(stdout.trim().split(":").pop());
+			return Number.isFinite(port) && port > 0 ? port : void 0;
+		} catch {
+			return;
+		}
+	},
+	async up(composePath, services, options = {}) {
+		const args = [
+			"compose",
+			...composeFiles(composePath),
+			"up",
+			"-d",
+			"--remove-orphans",
+			"--wait",
+			`--wait-timeout=${Math.floor(HEALTH_TIMEOUT_MS / 1e3)}`,
+			...services
+		];
+		if (options.show) return shown(args, services);
+		await run("docker", args);
+	},
+	async copyOut(composePath, service, from, to) {
+		await mkdir(dirname(to), { recursive: true });
+		await run("docker", [
+			"compose",
+			...composeFiles(composePath),
+			"cp",
+			`${service}:${from}`,
+			to
+		]);
+	},
+	async reload(composePath, service) {
+		await run("docker", [
+			"compose",
+			...composeFiles(composePath),
+			"exec",
+			"-T",
+			service,
+			"caddy",
+			"reload",
+			"--config",
+			"/etc/caddy/Caddyfile"
+		]);
+	},
+	async exec(composePath, service, argv) {
+		try {
+			const { stdout, stderr } = await run("docker", [
+				"compose",
+				...composeFiles(composePath),
+				"exec",
+				"-T",
+				service,
+				...argv
+			]);
+			return {
+				ok: true,
+				output: `${stdout}${stderr}`
+			};
+		} catch (error) {
+			const { stdout = "", stderr = "" } = error;
+			return {
+				ok: false,
+				output: `${stdout}${stderr}`
+			};
+		}
+	},
+	async healthy(composePath, services) {
+		if (services.length === 0) return true;
+		try {
+			const { stdout } = await run("docker", [
+				"compose",
+				...composeFiles(composePath),
+				"ps",
+				"--format",
+				"json",
+				...services
+			]);
+			const running = /* @__PURE__ */ new Set();
+			for (const line of stdout.trim().split("\n").filter(Boolean)) {
+				const entry = JSON.parse(line);
+				if (entry.State === "running" && (entry.Health === void 0 || entry.Health === "" || entry.Health === "healthy") && entry.Service) running.add(entry.Service);
+			}
+			return services.every((service) => running.has(service));
+		} catch {
+			return false;
+		}
+	}
+};
+//#endregion
+//#region src/reconcile/lan.ts
+/**
+* This machine's address on the local network — what a phone running the app
+* reaches it on.
 */
-const LOCAL_TOKEN = "geekmidas";
 /**
-* Build the compose document for a plan.
+* The first private IPv4 address of an interface that is up and not loopback.
 *
-* Every container is published on its assigned port, never on the image's
-* default: the point of allocation is that two projects can run at once, and
-* one container publishing 5432 puts that back.
+* Private ranges only (`10/8`, `172.16/12`, `192.168/16`): a public address
+* would mean listening for a phone on the open internet, and a link-local one
+* (`169.254/16`) is what an interface has when it found no network at all.
+* Undefined when there is none — a laptop on no network still runs, its mobile
+* app reaching only a simulator.
 */
-function composeFor(plan, options) {
-	const services = {};
-	const volumes = {};
-	for (const container of [...plan.containers].sort()) {
-		const declared = container === "postgres" ? plan.resources.find((r) => r.version)?.version : void 0;
-		const fake = plan.fakes?.[container];
-		const image = declared ? postgresImage(declared) : fake?.image ?? DEFAULT_IMAGES[container];
-		if (!image) throw new UnknownContainer(container);
-		const published = publish(container, options.ports, plan.fakes);
-		services[container] = fake ? {
-			image,
-			restart: "unless-stopped",
-			ports: published
-		} : define(container, image, published);
-		const volume = volumeOf(container);
-		if (volume) volumes[volume] = {};
+function lanAddress(interfaces = networkInterfaces()) {
+	for (const entries of Object.values(interfaces)) for (const entry of entries ?? []) {
+		if (entry.family !== "IPv4" || entry.internal) continue;
+		if (isPrivate(entry.address)) return entry.address;
 	}
-	return {
-		name: options.project,
-		services: {
-			...services,
-			...options.apps
-		},
-		...Object.keys(volumes).length ? { volumes } : {}
-	};
 }
-/** Render a compose document as the file it becomes. */
-function toYaml(file) {
-	return `# Generated by gkm from the construct manifest — do not edit.
-# Containers are derived from what the app declares. Image pins and anything
-# no construct implies go in your own docker-compose.yml, which is merged over
-# this file and wins:
-#
-#   docker compose -f docker-compose.constructs.yml -f docker-compose.yml …
-#
-# "gkm dev" and "gkm test" start the containers. The apps sit behind the
-# "apps" profile: run "gkm setup", then
-#   docker compose -f docker-compose.constructs.yml --profile apps up --build
-${stringify(file, { lineWidth: 0 })}`;
+function isPrivate(address) {
+	return /^10\./.test(address) || /^192\.168\./.test(address) || /^172\.(1[6-9]|2\d|3[01])\./.test(address);
 }
-/** A container with no image, from config or from the defaults. */
-var UnknownContainer = class extends Error {
-	/** The container that could not be resolved. */
-	container;
-	/** The containers that have a default, so the caller can see the set. */
-	known = Object.keys(DEFAULT_IMAGES).sort();
-	constructor(container) {
-		super("No image is known for this container; pin one in config");
-		this.name = "UnknownContainer";
-		this.container = container;
+//#endregion
+//#region src/reconcile/logins.ts
+/**
+* Bringing a container that already has data in line with the workspace's
+* generated logins.
+*
+* Postgres and RabbitMQ read their login from the environment once, when the
+* volume is first initialised; a volume an older gkm made was initialised
+* with the old fixed one, and a changed environment alone would lock the
+* developer out of their own data. So after the containers are up, each one
+* is asked whether the generated login opens it, and if not:
+*
+* - **Postgres**: signed in to with the old login, the generated superuser is
+*   created (or given its password), and the old one stops logging in. Where
+*   no login is accepted — another checkout of the same project rotated it —
+*   the password is set from inside the container, which trusts its own
+*   socket.
+* - **MinIO** reads its root login on every start, so recreating the
+*   container rotated it already. If the old login is still the one it takes —
+*   a project's own `docker-compose.yml` pins it — that is kept, with a note.
+* - **RabbitMQ**: the user is added, or given its password, with `rabbitmqctl`
+*   inside the container.
+*
+* Nothing is deleted: no volume, no database, no bucket.
+*/
+/**
+* The login every local container was brought up with before logins were
+* generated. Kept only to recognise — and rotate away from — a volume made
+* then.
+*/
+const LEGACY_LOCAL_LOGIN = Object.freeze({
+	user: "geekmidas",
+	password: "geekmidas"
+});
+/** No login this workspace knows opens its Postgres. */
+var PostgresLoginRefused = class extends Error {
+	port;
+	user;
+	constructor(port, user) {
+		super(`The Postgres on port ${port} accepts neither '${user}' with this workspace's generated password nor the login older gkm versions used, and could not be reset from inside its container. If it is not this project's container, stop whatever holds the port. If it is, removing its volume starts it over with the generated login — and deletes its data: docker compose -f docker-compose.constructs.yml down -v`);
+		this.port = port;
+		this.user = user;
+		this.name = "PostgresLoginRefused";
 	}
 };
-/** One container's definition, published on the port it was assigned. */
-function define(container, image, published) {
-	switch (container) {
-		case "postgres": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			environment: {
-				POSTGRES_USER: LOCAL_USER,
-				POSTGRES_PASSWORD: LOCAL_USER,
-				POSTGRES_DB: LOCAL_USER
-			},
-			volumes: ["postgres-data:/var/lib/postgresql"],
-			healthcheck: {
-				test: ["CMD-SHELL", `pg_isready -U ${LOCAL_USER}`],
-				interval: "5s",
-				timeout: "3s",
-				retries: 10,
-				start_period: "10s"
-			}
-		};
-		case "minio": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			environment: {
-				MINIO_ROOT_USER: LOCAL_USER,
-				MINIO_ROOT_PASSWORD: LOCAL_USER
-			},
-			command: "server --console-address \":9001\" /data",
-			volumes: ["minio-data:/data"],
-			healthcheck: {
-				test: [
-					"CMD",
-					"mc",
-					"ready",
-					"local"
-				],
-				interval: "10s",
-				timeout: "5s",
-				retries: 5,
-				start_period: "10s"
-			}
-		};
-		case "caddy": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			volumes: [
-				"./.gkm/Caddyfile:/etc/caddy/Caddyfile:ro",
-				"./.gkm/caddy-sites:/etc/caddy/sites:ro",
-				"caddy-data:/data"
-			],
-			extra_hosts: ["host.docker.internal:host-gateway"],
-			healthcheck: {
-				test: [
-					"CMD",
-					"caddy",
-					"version"
-				],
-				interval: "10s",
-				timeout: "5s",
-				retries: 5
-			}
-		};
-		case "mailpit": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			environment: {
-				MP_SMTP_AUTH_ACCEPT_ANY: "1",
-				MP_SMTP_AUTH_ALLOW_INSECURE: "1"
-			},
-			healthcheck: {
-				test: [
-					"CMD",
-					"wget",
-					"-q",
-					"--spider",
-					"http://localhost:8025"
-				],
-				interval: "10s",
-				timeout: "5s",
-				retries: 5
-			}
+/** No login this workspace knows opens its MinIO. */
+var MinioLoginRefused = class extends Error {
+	port;
+	user;
+	constructor(port, user) {
+		super(`The MinIO on port ${port} accepts neither '${user}' with this workspace's generated password nor the login older gkm versions used. If your docker-compose.yml sets MINIO_ROOT_USER or MINIO_ROOT_PASSWORD, remove them so the generated login applies.`);
+		this.port = port;
+		this.user = user;
+		this.name = "MinioLoginRefused";
+	}
+};
+/** Whether `login` opens the Postgres on `port`, as a connected client. */
+async function connect$1(port, login) {
+	const client = new Client({
+		host: "localhost",
+		port,
+		user: login.user,
+		password: login.password,
+		database: CLUSTER_DATABASE
+	});
+	try {
+		await client.connect();
+		return client;
+	} catch (error) {
+		await client.end().catch(() => {});
+		const code = error.code;
+		if (code === "28P01" || code === "28000" || code === "3D000") return null;
+		throw error;
+	}
+}
+/** Quote a string literal for DDL that cannot take parameters. */
+function literal(value) {
+	return `'${value.replace(/'/g, "''")}'`;
+}
+function ident(name) {
+	return `"${name.replace(/"/g, "\"\"")}"`;
+}
+/** The SQL that makes `login` a superuser with its password, new or not. */
+function superuserSql(login) {
+	return `DO $$ BEGIN IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${literal(login.user)}) THEN ALTER ROLE ${ident(login.user)} WITH SUPERUSER LOGIN PASSWORD ${literal(login.password)}; ELSE CREATE ROLE ${ident(login.user)} WITH SUPERUSER LOGIN PASSWORD ${literal(login.password)}; END IF; END \$\$`;
+}
+/**
+* Make the Postgres on `port` take `login`, rotating it from an older one
+* where that is what it takes.
+*/
+async function ensurePostgresLogin(options) {
+	const { port, login, legacy } = options;
+	const current = await connect$1(port, login);
+	if (current) {
+		await current.end();
+		return {
+			service: "postgres",
+			status: "current",
+			login
 		};
-		case "redis": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			volumes: ["redis-data:/data"],
-			healthcheck: {
-				test: [
-					"CMD",
-					"redis-cli",
-					"ping"
-				],
-				interval: "5s",
-				timeout: "3s",
-				retries: 5
-			}
+	}
+	for (const old of legacy) {
+		const client = await connect$1(port, old);
+		if (!client) continue;
+		try {
+			await client.query(superuserSql(login));
+		} catch {
+			await client.end();
+			return {
+				service: "postgres",
+				status: "kept",
+				login: old,
+				notice: `⚠️  Postgres still signs in as '${old.user}' with the old fixed password: it could not be rotated. To start over with a generated one, remove its volume (this deletes its data): docker compose -f docker-compose.constructs.yml down -v`
+			};
+		}
+		await client.end();
+		await retire(port, login, old);
+		return {
+			service: "postgres",
+			status: "rotated",
+			login,
+			notice: `🔑 Postgres moved from the old fixed login to a generated one ('${login.user}'); its data is unchanged. See it with: gkm dev:credentials`
 		};
-		case "redis-http": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			environment: {
-				SRH_MODE: "env",
-				SRH_TOKEN: LOCAL_TOKEN,
-				SRH_CONNECTION_STRING: "redis://redis:6379"
-			},
-			depends_on: ["redis"],
-			healthcheck: {
-				test: [
-					"CMD",
-					"wget",
-					"-q",
-					"-O",
-					"/dev/null",
-					"http://127.0.0.1:80/"
-				],
-				interval: "5s",
-				timeout: "3s",
-				retries: 10
-			}
+	}
+	if (options.exec) for (const user of [login.user, ...legacy.map((l) => l.user)]) {
+		if (!(await options.exec("postgres", [
+			"psql",
+			"-v",
+			"ON_ERROR_STOP=1",
+			"-U",
+			user,
+			"-d",
+			"postgres",
+			"-c",
+			superuserSql(login)
+		])).ok) continue;
+		const client = await connect$1(port, login);
+		if (!client) continue;
+		await client.end();
+		for (const old of legacy) await retire(port, login, old);
+		return {
+			service: "postgres",
+			status: "rotated",
+			login,
+			notice: `🔑 Postgres's login was reset to this workspace's generated one ('${login.user}'); its data is unchanged.`
 		};
-		case "rabbitmq": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			environment: {
-				RABBITMQ_DEFAULT_USER: LOCAL_USER,
-				RABBITMQ_DEFAULT_PASS: LOCAL_USER
-			},
-			volumes: ["rabbitmq-data:/var/lib/rabbitmq"],
-			healthcheck: {
-				test: [
-					"CMD",
-					"rabbitmq-diagnostics",
-					"-q",
-					"ping"
-				],
-				interval: "10s",
-				timeout: "5s",
-				retries: 5
-			}
+	}
+	throw new PostgresLoginRefused(port, login.user);
+}
+/** Stop an older login from opening the cluster, now another does. */
+async function retire(port, login, old) {
+	if (old.user === login.user) return;
+	const client = await connect$1(port, login);
+	if (!client) return;
+	try {
+		if ((await client.query("SELECT 1 FROM pg_roles WHERE rolname = $1", [old.user])).rowCount) await client.query(`ALTER ROLE ${ident(old.user)} WITH NOLOGIN PASSWORD NULL`);
+	} finally {
+		await client.end();
+	}
+}
+/** Whether `login` signs in to the MinIO on `port`. */
+async function minioAccepts(port, login) {
+	const s3 = new S3Client({
+		region: "us-east-1",
+		endpoint: `http://localhost:${port}`,
+		forcePathStyle: true,
+		credentials: {
+			accessKeyId: login.user,
+			secretAccessKey: login.password
+		},
+		maxAttempts: 1
+	});
+	try {
+		await s3.send(new ListBucketsCommand({}));
+		return true;
+	} catch (error) {
+		const name = error.name ?? "";
+		if (name === "InvalidAccessKeyId" || name === "SignatureDoesNotMatch" || name === "AccessDenied") return false;
+		throw error;
+	} finally {
+		s3.destroy();
+	}
+}
+/**
+* Check the MinIO on `port` takes `login`. It reads its root login on every
+* start, so a recreated container already does — unless something pins an
+* older one, which is then kept.
+*/
+async function ensureMinioLogin(options) {
+	const { port, login, legacy } = options;
+	if (await minioAccepts(port, login)) return {
+		service: "minio",
+		status: "current",
+		login
+	};
+	for (const old of legacy) if (await minioAccepts(port, old)) return {
+		service: "minio",
+		status: "kept",
+		login: old,
+		notice: `⚠️  MinIO still signs in as '${old.user}' with the old fixed password: something — usually your docker-compose.yml's MINIO_ROOT_USER/MINIO_ROOT_PASSWORD — pins it. Remove that to use the generated login.`
+	};
+	throw new MinioLoginRefused(port, login.user);
+}
+/**
+* Make the RabbitMQ in the project's container take `login`, with
+* `rabbitmqctl` inside it — which needs no password.
+*/
+async function ensureRabbitmqLogin(options) {
+	const { login, legacy, exec } = options;
+	const ctl = (...args) => exec("rabbitmq", ["rabbitmqctl", ...args]);
+	if ((await ctl("authenticate_user", login.user, login.password)).ok) return {
+		service: "rabbitmq",
+		status: "current",
+		login
+	};
+	if (!(await ctl("add_user", login.user, login.password)).ok) await ctl("change_password", login.user, login.password);
+	await ctl("set_user_tags", login.user, "administrator");
+	await ctl("set_permissions", "-p", "/", login.user, ".*", ".*", ".*");
+	for (const old of legacy) if (old.user !== login.user) await ctl("delete_user", old.user);
+	return {
+		service: "rabbitmq",
+		status: "rotated",
+		login,
+		notice: `🔑 RabbitMQ moved from the old fixed login to a generated one ('${login.user}'); its queues are unchanged.`
+	};
+}
+/**
+* Check the login of each running container that keeps one, and the
+* credentials to use from here: the generated ones, or an older login a
+* service could not be moved off.
+*/
+async function ensureLogins(options) {
+	const { containers, ports, exec } = options;
+	let credentials = options.credentials;
+	const outcomes = [];
+	const legacy = [LEGACY_LOCAL_LOGIN];
+	if (containers.includes("postgres") && ports.postgres !== void 0) {
+		const outcome = await ensurePostgresLogin({
+			port: ports.postgres,
+			login: credentials.postgres,
+			legacy,
+			...exec ? { exec } : {}
+		});
+		outcomes.push(outcome);
+		credentials = {
+			...credentials,
+			postgres: outcome.login
 		};
-		case "localstack": return {
-			image,
-			restart: "unless-stopped",
-			ports: published,
-			extra_hosts: ["host.docker.internal:host-gateway"],
-			environment: {
-				AWS_DEFAULT_REGION: EMULATOR_REGION,
-				AWS_ACCESS_KEY_ID: EMULATOR_CREDENTIALS.accessKeyId,
-				AWS_SECRET_ACCESS_KEY: EMULATOR_CREDENTIALS.secretAccessKey
-			},
-			volumes: ["localstack-data:/var/lib/localstack"],
-			healthcheck: {
-				test: [
-					"CMD",
-					"bash",
-					"-c",
-					"exec 3<>/dev/tcp/localhost/4566"
-				],
-				interval: "10s",
-				timeout: "5s",
-				retries: 5,
-				start_period: "10s"
-			}
+	}
+	if (containers.includes("minio") && ports.minio !== void 0) {
+		const outcome = await ensureMinioLogin({
+			port: ports.minio,
+			login: credentials.minio,
+			legacy
+		});
+		outcomes.push(outcome);
+		credentials = {
+			...credentials,
+			minio: outcome.login
 		};
-		default: throw new UnknownContainer(container);
 	}
+	if (containers.includes("rabbitmq") && exec) outcomes.push(await ensureRabbitmqLogin({
+		login: credentials.rabbitmq,
+		legacy,
+		exec
+	}));
+	return {
+		credentials,
+		outcomes
+	};
+}
+//#endregion
+//#region src/reconcile/ports.ts
+/**
+* Port allocation — why two projects can run at once.
+*
+* Publishing `5432:5432` means the second project on your machine cannot start.
+* Nothing solves that except giving each project its own ports, and what makes
+* it *possible* is the single-`<NAME>_URL` rule: an app reads `ORDERS_URL` and
+* never sees a host or a port, so reconcile is free to bind whatever is
+* available and compose the URL from what it bound. An app reading `DB_HOST` and
+* `DB_PORT` separately could not be moved this way.
+*
+* Assignments are **persisted, not recomputed**. Recomputing means adding a
+* construct renumbers its neighbours, and every running container, saved
+* connection string, and `psql` history goes stale at once.
+*
+* Pure, with the liveness probe injected — a collision with another project's
+* stack is a fact about the machine, and keeping it a parameter is what lets the
+* rules be asserted without binding a socket.
+*/
+/**
+* The window ports are drawn from.
+*
+* Above the registered range so nothing here needs privileges, and below the
+* ephemeral range both Linux (32768+) and macOS (49152+) allocate from — a port
+* the kernel might hand to an outgoing connection is one that is free when
+* checked and taken by the time it is bound.
+*/
+const WINDOW = {
+	min: 2e4,
+	max: 32e3
+};
+/**
+* How far apart two projects start.
+*
+* Wide enough that a project can add containers without walking into its
+* neighbour's block, narrow enough that the window holds many projects.
+*/
+const BLOCK = 50;
+/**
+* Where a project's ports start.
+*
+* Derived from the name rather than assigned sequentially so that a fresh clone
+* of the same project on the same machine lands on the same block — the first
+* run has nothing persisted to read, and hashing is what keeps that first run
+* from colliding with whatever else is already allocated.
+*
+* @example startingPort('toolbox') // stable for a given name
+*/
+function startingPort(project) {
+	const digest = createHash("sha256").update(project).digest();
+	const blocks = Math.floor((WINDOW.max - WINDOW.min) / BLOCK);
+	return WINDOW.min + digest.readUInt32BE(0) % blocks * BLOCK;
+}
+/**
+* Assign a port to every container that has none, keeping the ones that do.
+*
+* Existing assignments are returned untouched even when the container is no
+* longer in the plan: removing a construct must not renumber what is left, and
+* keeping the entry means re-adding it later restores the same port rather than
+* inventing a new one.
+*
+* @param probe - reports what is actually listening. A port assigned to this
+* project is skipped without probing, because on a converged reconcile our own
+* container is the thing listening on it.
+* @throws {NoPortAvailable} when the window is exhausted.
+*/
+async function allocate(project, containers, existing = {}, probe = isPortFree) {
+	const assignments = { ...existing };
+	const taken = new Set(Object.values(assignments));
+	for (const container of [...containers].sort()) {
+		if (assignments[container] !== void 0) continue;
+		const port = await nextFree(startingPort(project), taken, probe);
+		assignments[container] = port;
+		taken.add(port);
+	}
+	return assignments;
+}
+/**
+* The ports to keep: what running containers are observed on, then what was
+* saved — minus any saved entry whose port something else already holds.
+*
+* Spreading one over the other let an observed port override its own key and
+* leave a *different* key still saved on the same number: two services on one
+* port, and whichever answered first won. Saved keys for containers the plan no
+* longer has — a backend switched and back — were the usual source. Observed
+* wins because it is what is actually bound; a dropped entry is simply
+* allocated again.
+*/
+function keptPorts(saved = {}, observed = {}) {
+	const kept = { ...observed };
+	const taken = new Set(Object.values(observed));
+	for (const [key, port] of Object.entries(saved).sort(([a], [b]) => a < b ? -1 : 1)) {
+		if (key in kept || taken.has(port)) continue;
+		kept[key] = port;
+		taken.add(port);
+	}
+	return kept;
+}
+/** The window was exhausted. */
+var NoPortAvailable = class extends Error {
+	/** Where the search started. */
+	from;
+	/** The window searched, so the caller can report what was full. */
+	window = WINDOW;
+	constructor(from) {
+		super("No free port is available in the local port range");
+		this.name = "NoPortAvailable";
+		this.from = from;
+	}
+};
+/**
+* The first port at or after `from` that is neither ours nor in use.
+*
+* Wraps at the top of the window rather than stopping, so a project whose block
+* sits near the end is not the one that fails.
+*/
+async function nextFree(from, taken, probe) {
+	const span = WINDOW.max - WINDOW.min;
+	for (let offset = 0; offset < span; offset++) {
+		const port = WINDOW.min + (from - WINDOW.min + offset) % span;
+		if (taken.has(port)) continue;
+		if (await probe(port)) return port;
+	}
+	throw new NoPortAvailable(from);
+}
+/**
+* Whether nothing is listening on a port.
+*
+* Binds rather than connects: a refused connection says nothing about whether
+* the port can be *published*, which is the question Docker will ask. Binds on
+* `0.0.0.0` for the same reason — a port free on loopback can still be taken on
+* the address Docker publishes to.
+*
+* Inherently racy, and that is acceptable: Docker failing to bind stays the real
+* check. This exists so the common case surfaces as a message at reconcile
+* rather than as a connection failure ten minutes later.
+*/
+function isPortFree(port) {
+	return new Promise((resolve) => {
+		const server = createServer();
+		server.once("error", () => resolve(false));
+		server.once("listening", () => server.close(() => resolve(true)));
+		server.listen(port, "0.0.0.0");
+	});
+}
+//#endregion
+//#region src/reconcile/provision.ts
+/**
+* Creating what the URLs name.
+*
+* Convergent and idempotent: every statement asks whether the thing exists
+* first, so reconciling repeatedly is free and a half-applied run recovers by
+* being run again. That property is what lets `gkm dev` do this on every start.
+*
+* The line the design draws is at data, not at side effects — this creates
+* databases, schemas, and buckets, and it never seeds, resets, or drops. A
+* developer who wants their data gone asks for it explicitly.
+*
+* Statement generation is separated from application for the reason the design
+* gives: the same DDL has to run in-process locally and from a provisioner in a
+* VPC, and one implementation is what stops "works locally, fails deployed".
+* When the role DDL lands in `@geekmidas/db` this delegates to it rather than
+* growing its own.
+*/
+/**
+* The Postgres work a plan implies.
+*
+* Databases before the schemas inside them, which `provisionOrder` already
+* guarantees by putting parents first.
+*/
+function postgresStatements(plan, project = "", seed) {
+	const statements = [];
+	for (const resource of plan.resources) {
+		if (!resource.provisions || resource.container !== "postgres") continue;
+		if (resource.kind === "database") {
+			statements.push({
+				id: resource.id,
+				describe: `database ${resource.name}`,
+				exists: {
+					sql: "SELECT 1 FROM pg_database WHERE datname = $1",
+					values: [resource.name]
+				},
+				create: `CREATE DATABASE ${quoteIdentifier(resource.name)}`
+			});
+			if (resource.schema) statements.push(...rolesFor(resource, resource.schema, plan, project, seed));
+			continue;
+		}
+		if (resource.kind === "database-schema" && resource.schema) statements.push(...rolesFor(resource, resource.schema, plan, project, seed));
+		const cacheHome = resource.kind === "cache" && resource.of ? plan.resources.find((r) => r.id === resource.of) : void 0;
+		if (cacheHome) statements.push(...cacheTableDdl(resource, cacheHome, plan));
+	}
+	return statements;
+}
+/**
+* A cache's table, in the schema the role that reads it resolves names in.
+*
+* Two things have to line up, and neither is the table's contents. The driver
+* names the table unqualified and lets the connection's `search_path` place it
+* — which the role carries — so creating it from the master connection, whose
+* path is `public`, leaves a table the application cannot see and a
+* `relation "cache" does not exist` on the first request. And the default
+* privileges that make a tenant's tables reachable are granted *for the owner
+* role*, so nothing covers a table the master created.
+*
+* Hence: qualified with the tenant's schema, handed to its owner, and granted
+* explicitly — `roleStatements` grants what exists at the time it runs, and
+* this table does not exist yet.
+*
+* A database that opted out of roles needs none of it: everything connects as
+* the master, whose `search_path` finds `public`, and the table it creates
+* there is the table it reads.
+*/
+function cacheTableDdl(cache, home, plan) {
+	const database = rootDatabase(home, plan);
+	const schema = home.roles === false ? void 0 : home.schema;
+	const name = cache.table ?? cacheTable(cache.id);
+	const table = schema ? `${schema}.${name}` : name;
+	const created = cacheTableStatements({ table }).map((statement) => ({
+		id: cache.id,
+		describe: statement.describe,
+		database,
+		...statement.exists ? { exists: statement.exists } : {},
+		create: statement.sql
+	}));
+	if (!schema) return created;
+	const runtime = localRole(home);
+	const owner = ownerRole(runtime);
+	const qualified = table.split(".").map((part) => quoteIdentifier(part)).join(".");
+	return [
+		...created,
+		{
+			id: cache.id,
+			describe: `cache table ${table} is owned by ${owner}`,
+			database,
+			create: `ALTER TABLE ${qualified} OWNER TO ${quoteIdentifier(owner)}`
+		},
+		{
+			id: cache.id,
+			describe: `${runtime} may read and write ${table}`,
+			database,
+			create: `GRANT SELECT, INSERT, UPDATE, DELETE ON ${qualified} TO ${quoteIdentifier(runtime)}`
+		}
+	];
+}
+/**
+* The roles and schema for one database or tenant.
+*
+* Skipped entirely when the construct declared `roles: false` — the documented
+* downgrade, where both URLs fall back to the cluster's master credential. It
+* is a choice someone made rather than a default they got.
+*/
+function rolesFor(resource, schema, plan, project, seed) {
+	if (resource.roles === false) return [];
+	const runtime = localRole(resource);
+	const owner = ownerRole(runtime);
+	const reader = plan.resources.some((r) => r.kind === "database-reader" && r.of === resource.id) ? readerRole(runtime) : void 0;
+	return roleStatements({
+		runtime,
+		owner,
+		...reader ? { reader } : {},
+		schema,
+		...resource.kind === "database" ? { database: rootDatabase(resource, plan) } : {},
+		passwords: {
+			runtime: localRolePassword(project, plan, runtime, seed),
+			owner: localRolePassword(project, plan, owner, seed),
+			...reader ? { reader: localRolePassword(project, plan, reader, seed) } : {}
+		}
+	}).map((statement) => ({
+		id: resource.id,
+		describe: statement.describe,
+		database: rootDatabase(resource, plan),
+		...statement.exists ? { exists: statement.exists } : {},
+		create: statement.sql
+	}));
+}
+/** The buckets a plan implies. */
+function bucketNames(plan) {
+	return plan.resources.filter((r) => r.provisions && r.kind === "objects").map((r) => r.name);
+}
+/**
+* Quote an identifier for use in DDL.
+*
+* Names reaching here are already canonical and stage-suffixed, so this is
+* defence rather than sanitisation — but DDL cannot be parameterised, and an
+* unquoted identifier is the one place a name could ever be more than a name.
+*/
+function quoteIdentifier(name) {
+	return `"${name.replace(/"/g, "\"\"")}"`;
+}
+/**
+* Apply the plan's Postgres statements.
+*
+* Each is checked before it is run, so this converges rather than erroring on a
+* second pass.
+*/
+async function applyPostgres(client, statements) {
+	const applied = [];
+	for (const statement of statements) {
+		if (!statement.exists) {
+			await client.query(statement.database, statement.create);
+			applied.push({
+				id: statement.id,
+				describe: statement.describe,
+				created: false
+			});
+			continue;
+		}
+		if ((await client.query(statement.database, statement.exists.sql, statement.exists.values)).length > 0) {
+			applied.push({
+				id: statement.id,
+				describe: statement.describe,
+				created: false
+			});
+			continue;
+		}
+		await client.query(statement.database, statement.create);
+		applied.push({
+			id: statement.id,
+			describe: statement.describe,
+			created: true
+		});
+	}
+	return applied;
 }
 /**
-* The published port mappings for a container.
+* What each bucket's open paths are, if anything serves it.
 *
-* Every port is looked up by its own key rather than being derived as an offset
-* from the container's first, so MinIO's console cannot land on whatever was
-* allocated to the next container.
+* Keyed by the *origin*, because that is where the policy lives: two servers
+* over one bucket contribute to one policy, so the patterns are unioned rather
+* than the last one winning.
 */
-function publish(container, ports, fakes) {
-	return portsOf(container, fakes).map((port) => {
-		const assigned = ports[port.key];
-		if (assigned === void 0) throw new UnassignedPort(port.key);
-		return `${assigned}:${port.inside}`;
-	});
-}
-/** A planned port that allocation never assigned. */
-var UnassignedPort = class extends Error {
-	/** The port key that went unassigned, e.g. `minio-console`. */
-	key;
-	constructor(key) {
-		super("No port was assigned for this container port");
-		this.name = "UnassignedPort";
-		this.key = key;
+function bucketPolicies(plan) {
+	const byBucket = /* @__PURE__ */ new Map();
+	for (const resource of plan.resources) {
+		if (resource.kind !== "file-server" || !resource.open?.length) continue;
+		const origin = plan.resources.find((r) => r.id === resource.of);
+		if (!origin) continue;
+		const patterns = byBucket.get(origin.name) ?? /* @__PURE__ */ new Set();
+		for (const pattern of resource.open) patterns.add(pattern);
+		byBucket.set(origin.name, patterns);
 	}
-};
-//#endregion
-//#region src/reconcile/docker.ts
+	return [...byBucket].map(([bucket, open]) => ({
+		bucket,
+		open: [...open].sort()
+	})).sort((a, b) => a.bucket.localeCompare(b.bucket));
+}
 /**
-* The real Docker, behind the small interface reconcile needs.
+* One bucket's open paths as an S3 bucket policy.
 *
-* Shells out to `docker compose` rather than talking to the daemon socket: it is
-* what a developer runs by hand when something is wrong, so the two cannot
-* disagree, and it keeps Docker out of this package's dependencies.
+* Anonymous `s3:GetObject` on the named prefixes and nothing else — which is
+* what "open" means everywhere: the server serves that path without a
+* signature, and the bucket stays private for everything else.
 *
-* Every call is scoped to the generated compose file. Nothing here can touch a
-* container this project did not generate.
+* One fidelity note, stated rather than discovered: an S3 policy resource's `*`
+* crosses `/`, so a single-star pattern is *wider* here than the construct's own
+* runtime check, which stops at a segment boundary. The construct is the
+* stricter of the two, so a key it refuses to serve unsigned is never one this
+* policy was relied on to refuse — but a key fetched directly, bypassing the
+* client, can be admitted by the policy where the client would have said no.
+* Prefer `**` where crossing segments is what you meant.
 */
-const run = promisify(execFile);
+function bucketPolicy(bucket, open) {
+	return JSON.stringify({
+		Version: "2012-10-17",
+		Statement: [{
+			Sid: "GkmOpenPaths",
+			Effect: "Allow",
+			Principal: { AWS: ["*"] },
+			Action: ["s3:GetObject"],
+			Resource: open.map((pattern) => `arn:aws:s3:::${bucket}/${pattern.replace(/\*\*/g, "*")}`)
+		}]
+	});
+}
 /**
-* The generated file, then the project's own if it has one.
+* The topics and queues to create on the AWS emulator.
 *
-* Merged in that order so the project's wins — an `image:` there pins a
-* container this file derived, and a service there is added beside them.
+* Only on the `sns` backend: pg-boss makes its own tables on first connect and
+* a RabbitMQ exchange is declared by the client, but an SNS topic and an SQS
+* queue must exist before anything can publish to them.
 */
-function composeFiles(composePath) {
-	const project = join(dirname(composePath), "docker-compose.yml");
-	return [
-		"-f",
-		composePath,
-		...existsSync(project) ? ["-f", project] : []
-	];
+function carrierNames(plan) {
+	if (plan.events !== "sns") return {
+		topics: [],
+		queues: []
+	};
+	const named = (kind) => plan.resources.filter((r) => r.kind === kind).map((r) => r.name);
+	return {
+		topics: named("topic"),
+		queues: named("queue")
+	};
 }
-/** How long to wait for containers to pass their health checks. */
-const HEALTH_TIMEOUT_MS = 12e4;
-/** `docker compose up` exited unsuccessfully; its own output said why. */
-var ComposeUpFailed = class extends Error {
-	services;
-	code;
-	constructor(services, code) {
-		super(`docker compose could not start ${services.join(", ")} (exit ${code ?? "signal"}). Its output above names the container; \`docker compose logs <service>\` shows why it stopped.`);
-		this.services = services;
-		this.code = code;
-		this.name = "ComposeUpFailed";
+/** Create each topic and queue the plan names, skipping those that exist. */
+async function applyCarriers(client, carriers) {
+	const applied = [];
+	for (const name of carriers.topics) {
+		const created = !await client.topicExists(name);
+		if (created) await client.createTopic(name);
+		applied.push({
+			id: name,
+			describe: `topic ${name}`,
+			created
+		});
 	}
-};
-/** Run compose with its output on this terminal rather than captured. */
-function shown(args, services) {
-	return new Promise((resolve, reject) => {
-		const child = spawn("docker", args, { stdio: [
-			"ignore",
-			"inherit",
-			"inherit"
-		] });
-		child.on("error", reject);
-		child.on("close", (code) => code === 0 ? resolve() : reject(new ComposeUpFailed(services, code)));
-	});
+	for (const name of carriers.queues) {
+		const created = !await client.queueExists(name);
+		if (created) await client.createQueue(name);
+		applied.push({
+			id: name,
+			describe: `queue ${name}`,
+			created
+		});
+	}
+	return applied;
 }
-const dockerCli = {
-	async publishedPort(composePath, service, inside) {
-		try {
-			const { stdout } = await run("docker", [
-				"compose",
-				...composeFiles(composePath),
-				"port",
-				service,
-				String(inside)
-			]);
-			const port = Number(stdout.trim().split(":").pop());
-			return Number.isFinite(port) && port > 0 ? port : void 0;
-		} catch {
-			return;
-		}
-	},
-	async up(composePath, services, options = {}) {
-		const args = [
-			"compose",
-			...composeFiles(composePath),
-			"up",
-			"-d",
-			"--remove-orphans",
-			"--wait",
-			`--wait-timeout=${Math.floor(HEALTH_TIMEOUT_MS / 1e3)}`,
-			...services
-		];
-		if (options.show) return shown(args, services);
-		await run("docker", args);
-	},
-	async copyOut(composePath, service, from, to) {
-		await mkdir(dirname(to), { recursive: true });
-		await run("docker", [
-			"compose",
-			...composeFiles(composePath),
-			"cp",
-			`${service}:${from}`,
-			to
-		]);
-	},
-	async reload(composePath, service) {
-		await run("docker", [
-			"compose",
-			...composeFiles(composePath),
-			"exec",
-			"-T",
-			service,
-			"caddy",
-			"reload",
-			"--config",
-			"/etc/caddy/Caddyfile"
-		]);
-	},
-	async healthy(composePath, services) {
-		if (services.length === 0) return true;
-		try {
-			const { stdout } = await run("docker", [
-				"compose",
-				...composeFiles(composePath),
-				"ps",
-				"--format",
-				"json",
-				...services
-			]);
-			const running = /* @__PURE__ */ new Set();
-			for (const line of stdout.trim().split("\n").filter(Boolean)) {
-				const entry = JSON.parse(line);
-				if (entry.State === "running" && (entry.Health === void 0 || entry.Health === "" || entry.Health === "healthy") && entry.Service) running.add(entry.Service);
-			}
-			return services.every((service) => running.has(service));
-		} catch {
-			return false;
+/** The Postgres databases the plan creates — each is a `CREATE DATABASE`. */
+function postgresDatabaseNames(plan) {
+	return plan.resources.filter((resource) => resource.kind === "database" && resource.provisions && resource.container === "postgres").map((resource) => resource.name);
+}
+/**
+* Whether every one of these databases exists. A database dropped behind the
+* recorded state's back — by another checkout's test teardown, against the
+* same container — makes the state a lie, and only asking Postgres finds out.
+* Unreachable counts as missing: applying again is what finds out why.
+*/
+async function databasesExist(client, names) {
+	if (names.length === 0) return true;
+	try {
+		const rows = await client.query(void 0, "SELECT datname FROM pg_catalog.pg_database WHERE datname = ANY($1)", [names]);
+		return new Set(rows.map((row) => row.datname)).size === names.length;
+	} catch {
+		return false;
+	}
+}
+/**
+* Apply each served bucket's open-path policy, skipping those already correct.
+*
+* Compared as parsed JSON rather than as text: the same policy re-serialised
+* with different key order is the same policy, and rewriting it every reconcile
+* would report a change on every start.
+*/
+async function applyPolicies(client, policies) {
+	const applied = [];
+	for (const { bucket, open } of policies) {
+		const wanted = bucketPolicy(bucket, open);
+		const describe = `open paths on ${bucket}`;
+		if (equivalent(await client.policy(bucket), wanted)) {
+			applied.push({
+				id: `${bucket}:policy`,
+				describe,
+				created: false
+			});
+			continue;
 		}
+		await client.setPolicy(bucket, wanted);
+		applied.push({
+			id: `${bucket}:policy`,
+			describe,
+			created: true
+		});
 	}
-};
-//#endregion
-//#region src/reconcile/lan.ts
-/**
-* This machine's address on the local network — what a phone running the app
-* reaches it on.
-*/
-/**
-* The first private IPv4 address of an interface that is up and not loopback.
-*
-* Private ranges only (`10/8`, `172.16/12`, `192.168/16`): a public address
-* would mean listening for a phone on the open internet, and a link-local one
-* (`169.254/16`) is what an interface has when it found no network at all.
-* Undefined when there is none — a laptop on no network still runs, its mobile
-* app reaching only a simulator.
-*/
-function lanAddress(interfaces = networkInterfaces()) {
-	for (const entries of Object.values(interfaces)) for (const entry of entries ?? []) {
-		if (entry.family !== "IPv4" || entry.internal) continue;
-		if (isPrivate(entry.address)) return entry.address;
+	return applied;
+}
+/** Whether two policy documents say the same thing. */
+function equivalent(current, wanted) {
+	if (!current) return false;
+	try {
+		return JSON.stringify(JSON.parse(current)) === JSON.stringify(JSON.parse(wanted));
+	} catch {
+		return false;
 	}
 }
-function isPrivate(address) {
-	return /^10\./.test(address) || /^192\.168\./.test(address) || /^172\.(1[6-9]|2\d|3[01])\./.test(address);
+/** Create every bucket the plan names, skipping those that exist. */
+async function applyBuckets(client, buckets) {
+	const applied = [];
+	for (const bucket of buckets) {
+		if (await client.exists(bucket)) {
+			applied.push({
+				id: bucket,
+				describe: `bucket ${bucket}`,
+				created: false
+			});
+			continue;
+		}
+		await client.create(bucket);
+		applied.push({
+			id: bucket,
+			describe: `bucket ${bucket}`,
+			created: true
+		});
+	}
+	return applied;
 }
 //#endregion
-//#region src/reconcile/ports.ts
-/**
-* Port allocation — why two projects can run at once.
-*
-* Publishing `5432:5432` means the second project on your machine cannot start.
-* Nothing solves that except giving each project its own ports, and what makes
-* it *possible* is the single-`<NAME>_URL` rule: an app reads `ORDERS_URL` and
-* never sees a host or a port, so reconcile is free to bind whatever is
-* available and compose the URL from what it bound. An app reading `DB_HOST` and
-* `DB_PORT` separately could not be moved this way.
-*
-* Assignments are **persisted, not recomputed**. Recomputing means adding a
-* construct renumbers its neighbours, and every running container, saved
-* connection string, and `psql` history goes stale at once.
-*
-* Pure, with the liveness probe injected — a collision with another project's
-* stack is a fact about the machine, and keeping it a parameter is what lets the
-* rules be asserted without binding a socket.
-*/
+//#region src/reconcile/state.ts
 /**
-* The window ports are drawn from.
+* What reconcile records, and the hash that lets it do nothing.
 *
-* Above the registered range so nothing here needs privileges, and below the
-* ephemeral range both Linux (32768+) and macOS (49152+) allocate from — a port
-* the kernel might hand to an outgoing connection is one that is free when
-* checked and taken by the time it is bound.
-*/
-const WINDOW = {
-	min: 2e4,
-	max: 32e3
-};
-/**
-* How far apart two projects start.
+* Reconciling on every `gkm dev` is only acceptable if the converged case is
+* free, so the desired plan is hashed: matching hash plus healthy containers
+* means there is nothing to do. Without that, the automatic reconcile the design
+* asks for would tax every start.
 *
-* Wide enough that a project can add containers without walking into its
-* neighbour's block, narrow enough that the window holds many projects.
+* Almost nothing needs recording — roles are queried, migrations have their own
+* table, containers are remembered by Docker. Only ports and this hash have no
+* other owner.
 */
-const BLOCK = 50;
+const STATE_DIR = ".gkm/reconcile";
 /**
-* Where a project's ports start.
+* The hash of everything a reconcile would act on.
 *
-* Derived from the name rather than assigned sequentially so that a fresh clone
-* of the same project on the same machine lands on the same block — the first
-* run has nothing persisted to read, and hashing is what keeps that first run
-* from colliding with whatever else is already allocated.
+* Covers the compose document rather than the plan alone, because the plan is
+* unchanged when only an image pin moves — and a changed image is exactly a
+* container that must be recreated. `stringify` is stable here because
+* `composeFor` sorts its containers, which is what makes the hash meaningful.
 *
-* @example startingPort('toolbox') // stable for a given name
+* Deliberately a plain function over serialisable input: the deployed target
+* keys its provisioner invocation on the same idea, and the two must not be able
+* to disagree about what counts as a change.
 */
-function startingPort(project) {
-	const digest = createHash("sha256").update(project).digest();
-	const blocks = Math.floor((WINDOW.max - WINDOW.min) / BLOCK);
-	return WINDOW.min + digest.readUInt32BE(0) % blocks * BLOCK;
+function planHash(plan, compose, generated = {}) {
+	return createHash("sha256").update(JSON.stringify({
+		stage: plan.stage,
+		plan,
+		compose,
+		generated
+	})).digest("hex");
 }
-/**
-* Assign a port to every container that has none, keeping the ones that do.
-*
-* Existing assignments are returned untouched even when the container is no
-* longer in the plan: removing a construct must not renumber what is left, and
-* keeping the entry means re-adding it later restores the same port rather than
-* inventing a new one.
-*
-* @param probe - reports what is actually listening. A port assigned to this
-* project is skipped without probing, because on a converged reconcile our own
-* container is the thing listening on it.
-* @throws {NoPortAvailable} when the window is exhausted.
-*/
-async function allocate(project, containers, existing = {}, probe = isPortFree) {
-	const assignments = { ...existing };
-	const taken = new Set(Object.values(assignments));
-	for (const container of [...containers].sort()) {
-		if (assignments[container] !== void 0) continue;
-		const port = await nextFree(startingPort(project), taken, probe);
-		assignments[container] = port;
-		taken.add(port);
+/** Read the recorded state, or nothing if this stage has never reconciled. */
+async function loadState(root, stage) {
+	try {
+		const raw = await readFile(statePath(root, stage), "utf-8");
+		const state = JSON.parse(raw);
+		return state.stage === stage ? state : void 0;
+	} catch {
+		return;
 	}
-	return assignments;
 }
-/**
-* The ports to keep: what running containers are observed on, then what was
-* saved — minus any saved entry whose port something else already holds.
-*
-* Spreading one over the other let an observed port override its own key and
-* leave a *different* key still saved on the same number: two services on one
-* port, and whichever answered first won. Saved keys for containers the plan no
-* longer has — a backend switched and back — were the usual source. Observed
-* wins because it is what is actually bound; a dropped entry is simply
-* allocated again.
-*/
-function keptPorts(saved = {}, observed = {}) {
-	const kept = { ...observed };
-	const taken = new Set(Object.values(observed));
-	for (const [key, port] of Object.entries(saved).sort(([a], [b]) => a < b ? -1 : 1)) {
-		if (key in kept || taken.has(port)) continue;
-		kept[key] = port;
-		taken.add(port);
-	}
-	return kept;
+/** Record what was applied, so the next run can skip it. */
+async function saveState(root, state) {
+	const path = statePath(root, state.stage);
+	await mkdir(dirname(path), { recursive: true });
+	await writeFile(path, `${JSON.stringify(state, null, 2)}\n`);
 }
-/** The window was exhausted. */
-var NoPortAvailable = class extends Error {
-	/** Where the search started. */
-	from;
-	/** The window searched, so the caller can report what was full. */
-	window = WINDOW;
-	constructor(from) {
-		super("No free port is available in the local port range");
-		this.name = "NoPortAvailable";
-		this.from = from;
-	}
-};
 /**
-* The first port at or after `from` that is neither ours nor in use.
-*
-* Wraps at the top of the window rather than stopping, so a project whose block
-* sits near the end is not the one that fails.
+* Forget what was applied, so the next reconcile of this stage converges from
+* nothing — creating again whatever was dropped underneath the record.
 */
-async function nextFree(from, taken, probe) {
-	const span = WINDOW.max - WINDOW.min;
-	for (let offset = 0; offset < span; offset++) {
-		const port = WINDOW.min + (from - WINDOW.min + offset) % span;
-		if (taken.has(port)) continue;
-		if (await probe(port)) return port;
-	}
-	throw new NoPortAvailable(from);
+async function forgetState(root, stage) {
+	await rm(statePath(root, stage), { force: true });
 }
-/**
-* Whether nothing is listening on a port.
-*
-* Binds rather than connects: a refused connection says nothing about whether
-* the port can be *published*, which is the question Docker will ask. Binds on
-* `0.0.0.0` for the same reason — a port free on loopback can still be taken on
-* the address Docker publishes to.
-*
-* Inherently racy, and that is acceptable: Docker failing to bind stays the real
-* check. This exists so the common case surfaces as a message at reconcile
-* rather than as a connection failure ten minutes later.
-*/
-function isPortFree(port) {
-	return new Promise((resolve) => {
-		const server = createServer();
-		server.once("error", () => resolve(false));
-		server.once("listening", () => server.close(() => resolve(true)));
-		server.listen(port, "0.0.0.0");
-	});
+function statePath(root, stage) {
+	return join(root, STATE_DIR, `${stage}.json`);
 }
 //#endregion
-//#region src/reconcile/provision.ts
+//#region src/reconcile/index.ts
 /**
-* Creating what the URLs name.
-*
-* Convergent and idempotent: every statement asks whether the thing exists
-* first, so reconciling repeatedly is free and a half-applied run recovers by
-* being run again. That property is what lets `gkm dev` do this on every start.
+* Reconcile — the one convergent function `gkm dev`, `gkm test`, and `gkm setup`
+* all call.
 *
-* The line the design draws is at data, not at side effects — this creates
-* databases, schemas, and buckets, and it never seeds, resets, or drops. A
-* developer who wants their data gone asks for it explicitly.
+* Three phases, and only this one has side effects: declaring is pure (`gkm
+* build` and the dev watcher), running reads `<NAME>_URL` and provisions
+* nothing. Reconcile computes the desired state, compares, and applies the
+* difference — which is what makes "when does it run" answerable with
+* *whenever, repeatedly*.
 *
-* Statement generation is separated from application for the reason the design
-* gives: the same DDL has to run in-process locally and from a provisioner in a
-* VPC, and one implementation is what stops "works locally, fails deployed".
-* When the role DDL lands in `@geekmidas/db` this delegates to it rather than
-* growing its own.
+* It is safe to run automatically because its blast radius is entirely local:
+* this project's containers, this project's `.gkm/`. Nothing it does can reach a
+* cloud. The line is drawn at data, not at side effects — it allocates ports,
+* writes compose, starts containers, and creates roles; it never seeds, resets,
+* or drops.
+*
+* Docker is injected rather than imported so the rules above can be asserted
+* without a daemon. The default implementation is the real one.
 */
 /**
-* The Postgres work a plan implies.
+* Where the generated compose file is written, relative to the project root.
 *
-* Databases before the schemas inside them, which `provisionOrder` already
-* guarantees by putting parents first.
+* At the root, beside the project's own `docker-compose.yml`, because the two
+* are one stack: this file is everything the constructs imply and is never
+* edited, that one is anything they cannot express — an image pin, an extra
+* service — and is merged over it, so it wins.
 */
-function postgresStatements(plan, project = "", seed) {
-	const statements = [];
-	for (const resource of plan.resources) {
-		if (!resource.provisions || resource.container !== "postgres") continue;
-		if (resource.kind === "database") {
-			statements.push({
-				id: resource.id,
-				describe: `database ${resource.name}`,
-				exists: {
-					sql: "SELECT 1 FROM pg_database WHERE datname = $1",
-					values: [resource.name]
-				},
-				create: `CREATE DATABASE ${quoteIdentifier(resource.name)}`
-			});
-			if (resource.schema) statements.push(...rolesFor(resource, resource.schema, plan, project, seed));
-			continue;
-		}
-		if (resource.kind === "database-schema" && resource.schema) statements.push(...rolesFor(resource, resource.schema, plan, project, seed));
-		const cacheHome = resource.kind === "cache" && resource.of ? plan.resources.find((r) => r.id === resource.of) : void 0;
-		if (cacheHome) statements.push(...cacheTableDdl(resource, cacheHome, plan));
-	}
-	return statements;
-}
+const COMPOSE_PATH = "docker-compose.constructs.yml";
 /**
-* A cache's table, in the schema the role that reads it resolves names in.
-*
-* Two things have to line up, and neither is the table's contents. The driver
-* names the table unqualified and lets the connection's `search_path` place it
-* — which the role carries — so creating it from the master connection, whose
-* path is `public`, leaves a table the application cannot see and a
-* `relation "cache" does not exist` on the first request. And the default
-* privileges that make a tenant's tables reachable are granted *for the owner
-* role*, so nothing covers a table the master created.
+* The local edge's config, beside the compose file that mounts it.
 *
-* Hence: qualified with the tenant's schema, handed to its owner, and granted
-* explicitly — `roleStatements` grants what exists at the time it runs, and
-* this table does not exist yet.
+* Relative in the compose volume, so it resolves against `.gkm/` wherever the
+* project lives.
+*/
+const CADDYFILE_PATH = ".gkm/Caddyfile";
+/**
+* Where one stage's routes live, imported by the file above.
 *
-* A database that opted out of roles needs none of it: everything connects as
-* the master, whose `search_path` finds `public`, and the table it creates
-* there is the table it reads.
+* Per stage because one edge serves every stage, the same way one Postgres
+* holds `orders` and `orders_test`. A single file would mean `gkm test`
+* deleting the routes `gkm dev` is serving.
 */
-function cacheTableDdl(cache, home, plan) {
-	const database = rootDatabase(home, plan);
-	const schema = home.roles === false ? void 0 : home.schema;
-	const name = cache.table ?? cacheTable(cache.id);
-	const table = schema ? `${schema}.${name}` : name;
-	const created = cacheTableStatements({ table }).map((statement) => ({
-		id: cache.id,
-		describe: statement.describe,
-		database,
-		...statement.exists ? { exists: statement.exists } : {},
-		create: statement.sql
-	}));
-	if (!schema) return created;
-	const runtime = localRole(home);
-	const owner = ownerRole(runtime);
-	const qualified = table.split(".").map((part) => quoteIdentifier(part)).join(".");
-	return [
-		...created,
-		{
-			id: cache.id,
-			describe: `cache table ${table} is owned by ${owner}`,
-			database,
-			create: `ALTER TABLE ${qualified} OWNER TO ${quoteIdentifier(owner)}`
-		},
-		{
-			id: cache.id,
-			describe: `${runtime} may read and write ${table}`,
-			database,
-			create: `GRANT SELECT, INSERT, UPDATE, DELETE ON ${qualified} TO ${quoteIdentifier(runtime)}`
-		}
-	];
-}
+const caddySitesPath = (stage) => `.gkm/caddy-sites/${stage}.caddy`;
 /**
-* The roles and schema for one database or tenant.
+* Where the local edge's root certificate is copied to.
 *
-* Skipped entirely when the construct declared `roles: false` — the documented
-* downgrade, where both URLs fall back to the cluster's master credential. It
-* is a choice someone made rather than a default they got.
+* Exported so a process can be pointed at it without installing anything:
+* `NODE_EXTRA_CA_CERTS` is the whole of the trust story for Node, and it needs
+* no sudo. A browser is the case that still wants the root in the system store,
+* which is a one-time `caddy trust` rather than something a reconcile should do
+* on a developer's behalf.
 */
-function rolesFor(resource, schema, plan, project, seed) {
-	if (resource.roles === false) return [];
-	const runtime = localRole(resource);
-	const owner = ownerRole(runtime);
-	const reader = plan.resources.some((r) => r.kind === "database-reader" && r.of === resource.id) ? readerRole(runtime) : void 0;
-	return roleStatements({
-		runtime,
-		owner,
-		...reader ? { reader } : {},
-		schema,
-		...resource.kind === "database" ? { database: rootDatabase(resource, plan) } : {},
-		passwords: {
-			runtime: localRolePassword(project, plan, runtime, seed),
-			owner: localRolePassword(project, plan, owner, seed),
-			...reader ? { reader: localRolePassword(project, plan, reader, seed) } : {}
-		}
-	}).map((statement) => ({
-		id: resource.id,
-		describe: statement.describe,
-		database: rootDatabase(resource, plan),
-		...statement.exists ? { exists: statement.exists } : {},
-		create: statement.sql
-	}));
-}
-/** The buckets a plan implies. */
-function bucketNames(plan) {
-	return plan.resources.filter((r) => r.provisions && r.kind === "objects").map((r) => r.name);
-}
+const LOCAL_CA_PATH = ".gkm/caddy-root.crt";
+/** Where Caddy keeps the root of the CA it generated. */
+const CADDY_ROOT_IN_CONTAINER = "/data/caddy/pki/authorities/local/root.crt";
 /**
-* Quote an identifier for use in DDL.
+* Converge the local target on what the manifest declares.
 *
-* Names reaching here are already canonical and stage-suffixed, so this is
-* defence rather than sanitisation — but DDL cannot be parameterised, and an
-* unquoted identifier is the one place a name could ever be more than a name.
+* Cheap when there is nothing to do: the hash is compared before the compose
+* file is written or a container is touched, and a converged project pays one
+* hash and one health check.
 */
-function quoteIdentifier(name) {
-	return `"${name.replace(/"/g, "\"\"")}"`;
+async function reconcile(options) {
+	const { root, project, manifest, stage, start = true, provision = true, docker = dockerCli, probe = isPortFree, sql = pgClient, buckets = bucketClient, carriers = carrierClient, logins = ensureLogins } = options;
+	const { seed } = options.credentials;
+	const plan = planFor(manifest, stage, provisionOrder(manifest), {
+		localStage: options.localStage,
+		events: options.events,
+		cache: options.cache,
+		extraContainers: options.extraContainers,
+		...options.fakes ? { fakes: options.fakes } : {},
+		...options.edge === void 0 ? {} : { edge: options.edge }
+	});
+	const composePath = join(root, COMPOSE_PATH);
+	const observed = await observedPorts(docker, composePath, plan.containers, plan.fakes);
+	const ports = await allocate(project, portKeys(plan.containers, plan.fakes), keptPorts(options.saved, observed), probe);
+	const compose = composeFor(plan, {
+		project,
+		ports,
+		credentials: options.credentials,
+		...options.apps ? { apps: options.apps(plan.containers) } : {}
+	});
+	const caddyfile = toCaddyfile(sitesFor(plan, project, options.addresses));
+	const hash = planHash(plan, compose, {
+		caddyfile,
+		postgres: postgresStatements(plan, project, seed).map((statement) => statement.create).join(";\n")
+	});
+	const services = serviceAddresses(plan.containers, ports, plan.fakes);
+	const lan = plan.resources.some((r) => r.kind === "mobile-app") ? options.lanAddress === void 0 ? lanAddress() : options.lanAddress ?? void 0 : void 0;
+	const envWith = (credentials) => {
+		const env = envFor(plan, {
+			ports,
+			project,
+			credentials,
+			seed,
+			...options.mailFrom ? { mailFrom: options.mailFrom } : {},
+			...options.addresses ? { addresses: options.addresses } : {},
+			...lan ? { lanAddress: lan } : {},
+			...options.metroPorts ? { metroPorts: options.metroPorts } : {}
+		});
+		if (plan.containers.includes("caddy")) env.NODE_EXTRA_CA_CERTS = join(root, LOCAL_CA_PATH);
+		return env;
+	};
+	const result = {
+		stage,
+		plan,
+		compose,
+		ports,
+		services,
+		env: envWith(options.credentials),
+		credentials: options.credentials,
+		logins: [],
+		provisioned: [],
+		fakes: options.fakes ?? {},
+		hash,
+		changed: false
+	};
+	const recorded = await loadState(root, stage);
+	const postgresPort = ports[primaryPortKey("postgres")];
+	if (recorded?.hash === hash && existsSync(composePath) && (!start || await docker.healthy(composePath, plan.containers)) && (!start || !provision || postgresPort === void 0 || await databasesExist(sql(postgresPort, options.credentials.postgres), postgresDatabaseNames(plan)))) return result;
+	await write(composePath, toYaml(compose), 384);
+	if (plan.containers.includes("caddy")) {
+		await write(join(root, CADDYFILE_PATH), caddyfileRoot());
+		await write(join(root, caddySitesPath(stage)), caddyfile);
+		await pruneCaddySites(root, [
+			stage,
+			options.localStage,
+			TEST_STAGE
+		]);
+	}
+	if (start && plan.containers.length > 0) {
+		options.progress?.(`🐳 Starting ${plan.containers.join(", ")} — the first start pulls each image, which can take a few minutes`);
+		await docker.up(composePath, plan.containers, options.progress ? { show: true } : {});
+	}
+	if (start && plan.containers.includes("caddy")) await docker.reload(composePath, "caddy").catch(() => {});
+	if (start && plan.containers.includes("caddy")) await docker.copyOut(composePath, "caddy", CADDY_ROOT_IN_CONTAINER, join(root, LOCAL_CA_PATH)).catch(() => {});
+	const checked = start && plan.containers.length > 0 ? await logins({
+		credentials: options.credentials,
+		containers: plan.containers,
+		ports: {
+			...postgresPort !== void 0 ? { postgres: postgresPort } : {},
+			...ports[primaryPortKey("minio")] !== void 0 ? { minio: ports[primaryPortKey("minio")] } : {}
+		},
+		...docker.exec ? { exec: (service, argv) => docker.exec(composePath, service, argv) } : {}
+	}) : {
+		credentials: options.credentials,
+		outcomes: []
+	};
+	const credentials = checked.credentials;
+	if (start && provision) options.progress?.("🗄️  Creating what the constructs declare — databases, roles, buckets, topics");
+	const provisioned = start && provision ? await create(plan, ports, credentials, sql, buckets, carriers, project) : [];
+	await saveState(root, {
+		hash,
+		stage
+	});
+	return {
+		...result,
+		...credentials === options.credentials ? {} : { env: envWith(credentials) },
+		credentials,
+		logins: checked.outcomes,
+		provisioned,
+		changed: true
+	};
 }
 /**
-* Apply the plan's Postgres statements.
+* Create the databases, schemas, buckets, topics and queues the plan names.
 *
-* Each is checked before it is run, so this converges rather than erroring on a
-* second pass.
+* Idempotent throughout, so this runs on every non-converged reconcile rather
+* than being something to remember.
 */
-async function applyPostgres(client, statements) {
+async function create(plan, ports, credentials, sql, buckets, emulatorCarriers, project) {
 	const applied = [];
-	for (const statement of statements) {
-		if (!statement.exists) {
-			await client.query(statement.database, statement.create);
-			applied.push({
-				id: statement.id,
-				describe: statement.describe,
-				created: false
-			});
-			continue;
-		}
-		if ((await client.query(statement.database, statement.exists.sql, statement.exists.values)).length > 0) {
-			applied.push({
-				id: statement.id,
-				describe: statement.describe,
-				created: false
-			});
-			continue;
-		}
-		await client.query(statement.database, statement.create);
-		applied.push({
-			id: statement.id,
-			describe: statement.describe,
-			created: true
-		});
+	const postgresPort = ports[primaryPortKey("postgres")];
+	const statements = postgresStatements(plan, project, credentials.seed);
+	if (postgresPort !== void 0 && statements.length > 0) applied.push(...await applyPostgres(sql(postgresPort, credentials.postgres), statements));
+	const minioPort = ports[primaryPortKey("minio")];
+	const names = bucketNames(plan);
+	const policies = bucketPolicies(plan);
+	if (minioPort !== void 0 && (names.length > 0 || policies.length > 0)) {
+		const client = buckets(minioPort, credentials.minio);
+		if (names.length > 0) applied.push(...await applyBuckets(client, names));
+		if (policies.length > 0) applied.push(...await applyPolicies(client, policies));
 	}
+	const emulatorPort = ports[primaryPortKey("localstack")];
+	const carriers = carrierNames(plan);
+	if (emulatorPort !== void 0 && carriers.topics.length + carriers.queues.length > 0) applied.push(...await applyCarriers(emulatorCarriers(emulatorPort, credentials.emulator), carriers));
 	return applied;
 }
 /**
-* What each bucket's open paths are, if anything serves it.
+* The host ports of containers already running.
 *
-* Keyed by the *origin*, because that is where the policy lives: two servers
-* over one bucket contribute to one policy, so the patterns are unioned rather
-* than the last one winning.
+* Keyed the same way allocation keys them, so the two merge without either
+* knowing about the other.
 */
-function bucketPolicies(plan) {
-	const byBucket = /* @__PURE__ */ new Map();
-	for (const resource of plan.resources) {
-		if (resource.kind !== "file-server" || !resource.open?.length) continue;
-		const origin = plan.resources.find((r) => r.id === resource.of);
-		if (!origin) continue;
-		const patterns = byBucket.get(origin.name) ?? /* @__PURE__ */ new Set();
-		for (const pattern of resource.open) patterns.add(pattern);
-		byBucket.set(origin.name, patterns);
+async function observedPorts(docker, composePath, containers, fakes) {
+	const observed = {};
+	for (const container of containers) for (const port of portsOf(container, fakes)) {
+		const running = await docker.publishedPort(composePath, container, port.inside);
+		if (running !== void 0) observed[port.key] = running;
 	}
-	return [...byBucket].map(([bucket, open]) => ({
-		bucket,
-		open: [...open].sort()
-	})).sort((a, b) => a.bucket.localeCompare(b.bucket));
+	return observed;
 }
+/** Write a file only when its content would change, so mtimes stay meaningful. */
 /**
-* One bucket's open paths as an S3 bucket policy.
-*
-* Anonymous `s3:GetObject` on the named prefixes and nothing else — which is
-* what "open" means everywhere: the server serves that path without a
-* signature, and the bucket stays private for everything else.
+* Remove the routes of stages this project no longer reconciles.
 *
-* One fidelity note, stated rather than discovered: an S3 policy resource's `*`
-* crosses `/`, so a single-star pattern is *wider* here than the construct's own
-* runtime check, which stops at a segment boundary. The construct is the
-* stricter of the two, so a key it refuses to serve unsigned is never one this
-* policy was relied on to refuse — but a key fetched directly, bypassing the
-* client, can be admitted by the policy where the client would have said no.
-* Prefer `**` where crossing segments is what you meant.
+* Only the local stage and `test` are ever written, so any other file is left
+* over from a stage that was renamed — `development` becoming `dev`. Caddy
+* imports every file, and the leftover declares the same hosts as its
+* replacement: it refuses the whole config as ambiguous, and every URL behind
+* the edge goes with it.
 */
-function bucketPolicy(bucket, open) {
-	return JSON.stringify({
-		Version: "2012-10-17",
-		Statement: [{
-			Sid: "GkmOpenPaths",
-			Effect: "Allow",
-			Principal: { AWS: ["*"] },
-			Action: ["s3:GetObject"],
-			Resource: open.map((pattern) => `arn:aws:s3:::${bucket}/${pattern.replace(/\*\*/g, "*")}`)
-		}]
-	});
+async function pruneCaddySites(root, stages) {
+	const dir = dirname(join(root, caddySitesPath(TEST_STAGE)));
+	const keep = new Set(stages.map((stage) => stage && `${stage}.caddy`));
+	for (const file of await readdir(dir)) if (file.endsWith(".caddy") && !keep.has(file)) await rm(join(dir, file));
+}
+async function write(path, content, mode) {
+	try {
+		if (await readFile(path, "utf-8") === content) {
+			if (mode !== void 0) await chmod(path, mode);
+			return;
+		}
+	} catch {}
+	await mkdir(dirname(path), { recursive: true });
+	await writeFile(path, content, mode === void 0 ? {} : { mode });
+	if (mode !== void 0) await chmod(path, mode);
 }
+//#endregion
+//#region src/deploy/otel.ts
 /**
-* The topics and queues to create on the AWS emulator.
+* The OpenTelemetry variables a stage's secrets pass to every backend.
 *
-* Only on the `sns` backend: pg-boss makes its own tables on first connect and
-* a RabbitMQ exchange is declared by the client, but an SNS topic and an SQS
-* queue must exist before anything can publish to them.
+* A production server starts OpenTelemetry when `OTEL_EXPORTER_OTLP_ENDPOINT`
+* is set (`generators/telemetry.ts`), and the SDK reads the rest of its
+* configuration from the standard `OTEL_*` variables. No construct declares
+* them — they say where the telemetry goes, not what the app is — so a target
+* that writes each backend only the keys it reads would never hand them over.
+* Every target that runs backends asks this module instead.
+*
+* Which keys pass is a pattern over the `OTEL_` prefix rather than the prefix
+* alone or a list:
+*
+* - The bare prefix would forward anything a stage happened to name `OTEL_*`
+*   — `OTEL_LOG_LEVEL=debug`, `OTEL_SDK_DISABLED` — to every backend, without
+*   anyone choosing to.
+* - A list would have to spell out the exporter's five settings once for all
+*   signals and once per signal — twenty keys — and would miss the next one.
+*
+* The pattern names the families the server uses: the OTLP exporter's
+* endpoint, headers, protocol, timeout and compression, for every signal or
+* for one (`OTEL_EXPORTER_OTLP_LOGS_ENDPOINT`); sampling; and the resource's
+* identity.
+*
+* Sites get none of it: a site's environment is inlined into a bundle that
+* every browser downloads, and an exporter's headers are a credential.
 */
-function carrierNames(plan) {
-	if (plan.events !== "sns") return {
-		topics: [],
-		queues: []
-	};
-	const named = (kind) => plan.resources.filter((r) => r.kind === kind).map((r) => r.name);
-	return {
-		topics: named("topic"),
-		queues: named("queue")
-	};
-}
-/** Create each topic and queue the plan names, skipping those that exist. */
-async function applyCarriers(client, carriers) {
-	const applied = [];
-	for (const name of carriers.topics) {
-		const created = !await client.topicExists(name);
-		if (created) await client.createTopic(name);
-		applied.push({
-			id: name,
-			describe: `topic ${name}`,
-			created
-		});
-	}
-	for (const name of carriers.queues) {
-		const created = !await client.queueExists(name);
-		if (created) await client.createQueue(name);
-		applied.push({
-			id: name,
-			describe: `queue ${name}`,
-			created
-		});
-	}
-	return applied;
+/** The `OTEL_*` variables a backend is handed from the stage's secrets. */
+const OTEL_PASSTHROUGH = /^OTEL_(?:EXPORTER_OTLP_(?:(?:TRACES|LOGS|METRICS)_)?(?:ENDPOINT|HEADERS|PROTOCOL|TIMEOUT|COMPRESSION)|TRACES_SAMPLER(?:_ARG)?|RESOURCE_ATTRIBUTES|SERVICE_NAME)$/;
+/** Whether a stage secret is one of the passed-through `OTEL_*` variables. */
+function isOtelVariable(key) {
+	return OTEL_PASSTHROUGH.test(key);
 }
-/** The Postgres databases the plan creates — each is a `CREATE DATABASE`. */
-function postgresDatabaseNames(plan) {
-	return plan.resources.filter((resource) => resource.kind === "database" && resource.provisions && resource.container === "postgres").map((resource) => resource.name);
+/** Whether a variable says where an OTLP exporter sends, or how it signs. */
+function isOtlpDestination(key) {
+	return /^OTEL_EXPORTER_OTLP_(?:(?:TRACES|LOGS|METRICS)_)?(?:ENDPOINT|HEADERS)$/.test(key);
 }
 /**
-* Whether every one of these databases exists. A database dropped behind the
-* recorded state's back — by another checkout's test teardown, against the
-* same container — makes the state a lie, and only asking Postgres finds out.
-* Unreachable counts as missing: applying again is what finds out why.
+* The `OTEL_*` variables one backend runs with: every one the stage's secrets
+* hold, and `OTEL_SERVICE_NAME` — the app's name — where the stage set
+* telemetry up without naming the service. Empty when the stage set none.
 */
-async function databasesExist(client, names) {
-	if (names.length === 0) return true;
-	try {
-		const rows = await client.query(void 0, "SELECT datname FROM pg_catalog.pg_database WHERE datname = ANY($1)", [names]);
-		return new Set(rows.map((row) => row.datname)).size === names.length;
-	} catch {
-		return false;
-	}
+function otelEnv(custom, app) {
+	const env = {};
+	for (const [key, value] of Object.entries(custom)) if (isOtelVariable(key) && value !== "") env[key] = value;
+	if (Object.keys(env).length > 0 && !env.OTEL_SERVICE_NAME) env.OTEL_SERVICE_NAME = app;
+	return env;
 }
+//#endregion
+//#region src/target/dokploy/domain.ts
+/** A stage was deployed that `deploy.domains` gives no domain. */
+var NoDomainForStage = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`No domain for stage "${stage}". Add it to gkm.config.ts: deploy: { domains: { ${stage}: 'example.com' } }.`);
+		this.stage = stage;
+		this.name = "NoDomainForStage";
+	}
+};
 /**
-* Apply each served bucket's open-path policy, skipping those already correct.
+* The hostname an app answers on for a stage.
 *
-* Compared as parsed JSON rather than as text: the same policy re-serialised
-* with different key order is the same policy, and rewriting it every reconcile
-* would report a change on every start.
+* 1. An explicit `app.domain` — a string, or one per stage — wins.
+* 2. Otherwise from the stage's base domain in `deploy.domains`: the root site
+*    answers on the domain itself, and every other app on
+*    `{subdomain}.{domain}` — its declaration's `subdomain`, or its own name.
+*
+* @throws {NoDomainForStage} when `deploy.domains` names no domain for it
 */
-async function applyPolicies(client, policies) {
-	const applied = [];
-	for (const { bucket, open } of policies) {
-		const wanted = bucketPolicy(bucket, open);
-		const describe = `open paths on ${bucket}`;
-		if (equivalent(await client.policy(bucket), wanted)) {
-			applied.push({
-				id: `${bucket}:policy`,
-				describe,
-				created: false
-			});
-			continue;
-		}
-		await client.setPolicy(bucket, wanted);
-		applied.push({
-			id: `${bucket}:policy`,
-			describe,
-			created: true
-		});
+function resolveHost(appName, app, stage, domains, isMainFrontend) {
+	if (app.domain) {
+		if (typeof app.domain === "string") return app.domain;
+		if (app.domain[stage]) return app.domain[stage];
 	}
-	return applied;
+	const baseDomain = domains?.[stage];
+	if (!baseDomain) throw new NoDomainForStage(stage);
+	if (isMainFrontend) return baseDomain;
+	return `${app.subdomain ?? appName}.${baseDomain}`;
 }
-/** Whether two policy documents say the same thing. */
-function equivalent(current, wanted) {
-	if (!current) return false;
-	try {
-		return JSON.stringify(JSON.parse(current)) === JSON.stringify(JSON.parse(wanted));
-	} catch {
-		return false;
-	}
+/**
+* Whether this app is the site the base domain points at — see `rootSite`,
+* which the local edge asks too.
+*
+* @throws {AmbiguousRootSite} when several sites could be the root and none says it is
+*/
+function isMainFrontendApp(appName, app, allApps) {
+	if (app.type !== "web") return false;
+	return rootSite(Object.entries(allApps).filter(([, a]) => a.type === "web").map(([name, a]) => ({
+		name,
+		root: a.root
+	}))) === appName;
 }
-/** Create every bucket the plan names, skipping those that exist. */
-async function applyBuckets(client, buckets) {
-	const applied = [];
-	for (const bucket of buckets) {
-		if (await client.exists(bucket)) {
-			applied.push({
-				id: bucket,
-				describe: `bucket ${bucket}`,
-				created: false
-			});
-			continue;
-		}
-		await client.create(bucket);
-		applied.push({
-			id: bucket,
-			describe: `bucket ${bucket}`,
-			created: true
-		});
-	}
-	return applied;
+/**
+* Get public URL arg names from app dependencies.
+*
+* @param app - The web/mobile app configuration
+* @returns Array of arg names like 'NEXT_PUBLIC_API_URL', or [] for frameworks
+*   without a public prefix (e.g. Remix).
+*/
+function getPublicUrlArgNames(app) {
+	const prefix = getPublicEnvPrefix(app.framework);
+	if (!prefix) return [];
+	return app.dependencies.map((dep) => `${prefix}${dep.toUpperCase()}_URL`);
 }
 //#endregion
-//#region src/reconcile/state.ts
+//#region src/compose/logs.ts
 /**
-* What reconcile records, and the hash that lets it do nothing.
+* The stack's log UI: OpenObserve, run beside the apps when
+* `deploy.compose.logs` asks for it, and every backend's OpenTelemetry
+* pointed at it.
 *
-* Reconciling on every `gkm dev` is only acceptable if the converged case is
-* free, so the desired plan is hashed: matching hash plus healthy containers
-* means there is nothing to do. Without that, the automatic reconcile the design
-* asks for would tax every start.
+* The production server already exports its traces and pino logs over
+* OTLP/HTTP when `OTEL_EXPORTER_OTLP_ENDPOINT` is set. OpenObserve takes OTLP
+* at `/api/<org>/v1/{logs,traces}` with HTTP basic auth, so wiring an app is
+* two variables: the endpoint, `http://openobserve:5080/api/default`, and
+* the header that signs in as the root user.
 *
-* Almost nothing needs recording — roles are queried, migrations have their own
-* table, containers are remembered by Docker. Only ports and this hash have no
-* other owner.
+* It is reached, by default, through an SSH tunnel: published on 127.0.0.1
+* only, because a port Docker publishes on every interface is opened in the
+* firewall by Docker itself, past ufw's rules. Served publicly, it is a host
+* on the stack's Caddy that refuses every address not allowed.
+*
+* Pure: the stack decides it, and the phases print and check it.
 */
-const STATE_DIR = ".gkm/reconcile";
 /**
-* The hash of everything a reconcile would act on.
-*
-* Covers the compose document rather than the plan alone, because the plan is
-* unchanged when only an image pin moves — and a changed image is exactly a
-* container that must be recreated. `stringify` is stable here because
-* `composeFor` sorts its containers, which is what makes the hash meaningful.
-*
-* Deliberately a plain function over serialisable input: the deployed target
-* keys its provisioner invocation on the same idea, and the two must not be able
-* to disagree about what counts as a change.
+* The image, pinned. A log store's on-disk format is the thing that must not
+* move under a running stack, so a new version is a change to this line.
 */
-function planHash(plan, compose, generated = {}) {
-	return createHash("sha256").update(JSON.stringify({
-		stage: plan.stage,
-		plan,
-		compose,
-		generated
-	})).digest("hex");
-}
-/** Read the recorded state, or nothing if this stage has never reconciled. */
-async function loadState(root, stage) {
-	try {
-		const raw = await readFile(statePath(root, stage), "utf-8");
-		const state = JSON.parse(raw);
-		return state.stage === stage ? state : void 0;
-	} catch {
-		return;
+const OPENOBSERVE_IMAGE = "public.ecr.aws/zinclabs/openobserve:v1.0.4";
+/** Its compose service name — the host the apps send to. */
+const LOGS_SERVICE = "openobserve";
+/** The organisation every app's telemetry lands in. */
+const LOGS_ORG = "default";
+/** The stage secrets that sign in as OpenObserve's root user. */
+const LOGS_EMAIL_KEY = "ZO_ROOT_USER_EMAIL";
+const LOGS_PASSWORD_KEY = "ZO_ROOT_USER_PASSWORD";
+/**
+* The local stage's root user. Its password is generated per machine with
+* the other local logins — see `reconcile/localCredentials.ts`.
+*/
+const LOCAL_LOGS_EMAIL = "admin@gkm.localhost";
+/** The stage sends its telemetry somewhere already, and logs are on too. */
+var LogsEndpointConflict = class extends Error {
+	stage;
+	keys;
+	constructor(stage, keys) {
+		super(`The stage '${stage}' sets ${keys.join(", ")} in its secrets, and deploy.compose.logs also runs OpenObserve for it — each backend can send its telemetry to one place. Either keep your own OTLP backend: remove logs from deploy.compose in gkm.config.ts; or use the bundled OpenObserve: remove ${keys.join(", ")} from the stage's secrets, and every backend is pointed at it.`);
+		this.stage = stage;
+		this.keys = keys;
+		this.name = "LogsEndpointConflict";
+	}
+};
+/** A root password OpenObserve would refuse to start with. */
+var LogsPasswordWeak = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`The stage '${stage}' sets ${LOGS_PASSWORD_KEY}, and OpenObserve refuses it: a root password must be 8 to 128 characters with a lowercase letter, an uppercase letter, a digit and a symbol. Set another with gkm secrets:set ${LOGS_PASSWORD_KEY} '…' --stage ${stage}, or unset it to have one generated.`);
+		this.stage = stage;
+		this.name = "LogsPasswordWeak";
+	}
+};
+/** A deployed stage with logs on and no root password generated yet. */
+var LogsPasswordMissing = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`The stage '${stage}' runs OpenObserve and has no ${LOGS_PASSWORD_KEY} in its secrets. Run gkm compose --stage ${stage} without --dry-run once to generate it, or set one: gkm secrets:set ${LOGS_PASSWORD_KEY} '…' --stage ${stage}`);
+		this.stage = stage;
+		this.name = "LogsPasswordMissing";
 	}
+};
+/** Whether OpenObserve accepts `password` for its root user. */
+function isStrongLogsPassword(password) {
+	return password.length >= 8 && password.length <= 128 && /[a-z]/.test(password) && /[A-Z]/.test(password) && /\d/.test(password) && /[^A-Za-z0-9]/.test(password);
 }
-/** Record what was applied, so the next run can skip it. */
-async function saveState(root, state) {
-	const path = statePath(root, state.stage);
-	await mkdir(dirname(path), { recursive: true });
-	await writeFile(path, `${JSON.stringify(state, null, 2)}\n`);
+/**
+* A root password: 192 random bits, with a fixed tail so every class
+* OpenObserve requires is present whatever the random part drew.
+*/
+function generateLogsPassword() {
+	return `${randomBytes(24).toString("base64url")}-Zo1`;
 }
 /**
-* Forget what was applied, so the next reconcile of this stage converges from
-* nothing — creating again whatever was dropped underneath the record.
+* The stage's secrets with a generated root password, where it has none.
+* Pure, like `withGeneratedSecrets`: the caller keeps the result once the
+* run goes ahead.
 */
-async function forgetState(root, stage) {
-	await rm(statePath(root, stage), { force: true });
+function withLogsPassword(secrets) {
+	if (secrets.custom?.["ZO_ROOT_USER_PASSWORD"]) return {
+		secrets,
+		generated: []
+	};
+	return {
+		secrets: {
+			...secrets,
+			custom: {
+				...secrets.custom,
+				[LOGS_PASSWORD_KEY]: generateLogsPassword()
+			},
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		},
+		generated: [LOGS_PASSWORD_KEY]
+	};
 }
-function statePath(root, stage) {
-	return join(root, STATE_DIR, `${stage}.json`);
+/**
+* `OTEL_EXPORTER_OTLP_HEADERS` signing in as `email`.
+*
+* The variable's values are percent-decoded by the SDK (they follow the W3C
+* baggage format), so the space after `Basic` is written `%20`. Base64's own
+* `+`, `/` and `=` pass through decoding unchanged.
+*/
+function otlpHeaders(email, password) {
+	return `Authorization=Basic%20${Buffer.from(`${email}:${password}`).toString("base64")}`;
+}
+/** The stack's OpenObserve for one stage. */
+function stackLogs(options) {
+	const { config, stage, local, custom } = options;
+	const conflicting = Object.keys(custom).filter(isOtlpDestination).sort();
+	if (conflicting.length > 0) throw new LogsEndpointConflict(stage, conflicting);
+	if (!local && !options.domain) throw new NoDomainForStage(stage);
+	const email = custom["ZO_ROOT_USER_EMAIL"] ?? (local ? options.localLogin?.email ?? "admin@gkm.localhost" : `admin@${options.domain}`);
+	const set = custom[LOGS_PASSWORD_KEY];
+	const password = set ?? (local ? options.localLogin?.password : void 0);
+	if (!password) throw new LogsPasswordMissing(stage);
+	if (!isStrongLogsPassword(password)) throw new LogsPasswordWeak(stage);
+	const host = config.public ? local ? `logs.${options.project}.localhost` : `logs.${options.domain}` : void 0;
+	const url = host ? `https://${host}${local && options.https !== 443 ? `:${options.https}` : ""}` : `http://localhost:${config.port}`;
+	return {
+		...config,
+		email,
+		password,
+		passwordFromSecrets: Boolean(set),
+		url,
+		...host ? { host } : {},
+		env: {
+			[LOGS_EMAIL_KEY]: email,
+			[LOGS_PASSWORD_KEY]: password,
+			ZO_DATA_DIR: "/data",
+			ZO_COMPACT_DATA_RETENTION_DAYS: String(config.retentionDays),
+			ZO_TELEMETRY: "false"
+		},
+		appEnv: {
+			OTEL_EXPORTER_OTLP_ENDPOINT: `http://${LOGS_SERVICE}:${LOGS_PORT}/api/${LOGS_ORG}`,
+			OTEL_EXPORTER_OTLP_HEADERS: otlpHeaders(email, password)
+		}
+	};
+}
+/**
+* OpenObserve's service. The image has no shell, `wget` or `curl`, so its
+* health check is its own binary asking the running server for its status —
+* which exits non-zero when nothing answers on its port.
+*/
+function logsService(logs) {
+	return {
+		image: OPENOBSERVE_IMAGE,
+		restart: "unless-stopped",
+		env_file: [{
+			path: `./${LOGS_SERVICE}.env`,
+			format: "raw"
+		}],
+		volumes: ["openobserve-data:/data"],
+		...logs.public ? {} : { ports: [`127.0.0.1:${logs.port}:${LOGS_PORT}`] },
+		healthcheck: {
+			test: [
+				"CMD",
+				"/openobserve",
+				"node",
+				"status"
+			],
+			interval: "10s",
+			timeout: "5s",
+			retries: 12,
+			start_period: "20s"
+		}
+	};
+}
+/** What `gkm compose` prints once the stack is up: how to open the logs. */
+function logsAccess(logs, ctx) {
+	const login = `login: ${logs.email}, password: ${ctx.local && !logs.passwordFromSecrets ? logs.password : `gkm secrets:show --stage ${ctx.stage} --reveal → ${LOGS_PASSWORD_KEY}`}`;
+	if (logs.public) return [`📜 Logs (OpenObserve): ${logs.url}  (${login})`, `     answered only for ${logs.public.allow.join(", ")}; every other address gets 403`];
+	return [
+		`📜 Logs (OpenObserve) on 127.0.0.1:${logs.port} — from your computer:`,
+		...ctx.local ? [`     on this machine, open http://localhost:${logs.port} directly; from another:`] : [],
+		`     ssh -N -L ${logs.port}:localhost:${logs.port} ${ctx.user}@${ctx.hostname}   (user and host are guesses: this machine's)`,
+		`     then open http://localhost:${logs.port}  (${login})`,
+		`⚠️  Docker-published ports bypass ufw, so OpenObserve is bound to 127.0.0.1 only — reach it through the tunnel, not by opening the port.`
+	];
 }
 //#endregion
-//#region src/reconcile/index.ts
+//#region src/compose/redis.ts
+/**
+* The stack's Redis: what every declared cache lives in when a workspace runs
+* as a `gkm compose` stack, on the local stage and on a deployed one alike.
+*
+* A cache is the one store whose contents can always be rebuilt, so unlike
+* Mailpit and MinIO it is a production service, not a dev stand-in: it runs
+* for every stage, on the compose network only, with nothing published. It
+* is bounded (`maxmemory`, evicting the least recently used key), persisted
+* (an append-only file on a named volume, kept by `--down`) and password
+* protected — the stage's own password, generated once like its seed.
+*
+* A stage that sets a cache's URL in its secrets — a managed Redis — keeps
+* it, and a stack whose every cache is set that way runs no Redis at all.
+*
+* Pure: the stack decides it, and the phases keep the password.
+*/
+/**
+* Where a stack's caches live: its own Redis, whatever the deploy target's
+* default is. A stack is one machine running containers, and a Redis beside
+* the apps is cheaper for a cache than a table in the database they share.
+*/
+const STACK_CACHE = "redis";
+/** Its compose service name — the host every cache URL points at. */
+const REDIS_SERVICE = "redis";
+/** The port it answers on, inside the network. */
+const REDIS_PORT = 6379;
+/** Reconcile's pin, so `gkm dev` and the stack run one Redis. */
+const REDIS_IMAGE = DEFAULT_IMAGES.redis;
+/**
+* How much it may hold before it evicts. A cache that grows until the box
+* runs out of memory takes the apps with it; 256 MB is a lot of sessions and
+* little of a small server. A project's `docker-compose.<stage>.yml` can
+* replace the command to change it.
+*/
+const REDIS_MAXMEMORY = "256mb";
+/** The stage secret holding its password. */
+const REDIS_PASSWORD_KEY = "REDIS_PASSWORD";
+/** Redis's own count of logical databases, before `--databases` raises it. */
+const REDIS_DATABASES = 16;
+/** A deployed stage that runs the stack's Redis and has no password yet. */
+var RedisPasswordMissing = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`The stage '${stage}' runs the stack's Redis and has no ${REDIS_PASSWORD_KEY} in its secrets. Run gkm compose --stage ${stage} without --dry-run once to generate it, or set one: gkm secrets:set ${REDIS_PASSWORD_KEY} '…' --stage ${stage}`);
+		this.stage = stage;
+		this.name = "RedisPasswordMissing";
+	}
+};
 /**
-* Reconcile — the one convergent function `gkm dev`, `gkm test`, and `gkm setup`
-* all call.
-*
-* Three phases, and only this one has side effects: declaring is pure (`gkm
-* build` and the dev watcher), running reads `<NAME>_URL` and provisions
-* nothing. Reconcile computes the desired state, compares, and applies the
-* difference — which is what makes "when does it run" answerable with
-* *whenever, repeatedly*.
-*
-* It is safe to run automatically because its blast radius is entirely local:
-* this project's containers, this project's `.gkm/`. Nothing it does can reach a
-* cloud. The line is drawn at data, not at side effects — it allocates ports,
-* writes compose, starts containers, and creates roles; it never seeds, resets,
-* or drops.
-*
-* Docker is injected rather than imported so the rules above can be asserted
-* without a daemon. The default implementation is the real one.
+* Whether a stage's stack runs Redis: a cache is declared and the stage's
+* secrets do not set the URL of every one.
 */
+function runsRedis(manifest, custom) {
+	return Object.values(manifest).some((declaration) => declaration?.kind === "cache" && (declaration.provides ?? []).some((key) => custom[key] === void 0));
+}
+/** A password: 256 random bits, URL-safe, so it sits in a URL unescaped. */
+function generateRedisPassword() {
+	return randomBytes(32).toString("base64url");
+}
 /**
-* Where the generated compose file is written, relative to the project root.
-*
-* At the root, beside the project's own `docker-compose.yml`, because the two
-* are one stack: this file is everything the constructs imply and is never
-* edited, that one is anything they cannot express — an image pin, an extra
-* service — and is merged over it, so it wins.
+* The stage's secrets with a generated Redis password, where it has none.
+* Pure, like `withGeneratedSecrets`: the caller keeps the result once the run
+* goes ahead.
 */
-const COMPOSE_PATH = "docker-compose.constructs.yml";
+function withRedisPassword(secrets) {
+	if (secrets.custom?.["REDIS_PASSWORD"]) return {
+		secrets,
+		generated: []
+	};
+	return {
+		secrets: {
+			...secrets,
+			custom: {
+				...secrets.custom,
+				[REDIS_PASSWORD_KEY]: generateRedisPassword()
+			},
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		},
+		generated: [REDIS_PASSWORD_KEY]
+	};
+}
 /**
-* The local edge's config, beside the compose file that mounts it.
+* The stack's Redis for one stage, or nothing where no cache needs it.
 *
-* Relative in the compose volume, so it resolves against `.gkm/` wherever the
-* project lives.
+* Each cache it holds gets a logical database of its own, by the order of
+* their ids, so two caches never read each other's keys.
 */
-const CADDYFILE_PATH = ".gkm/Caddyfile";
+function stackRedis(options) {
+	const { plan, stage, local, custom } = options;
+	const caches = plan.resources.filter((r) => r.kind === "cache" && custom[r.envKey] === void 0).sort((a, b) => a.id.localeCompare(b.id));
+	if (caches.length === 0) return void 0;
+	const set = custom[REDIS_PASSWORD_KEY];
+	const password = set ?? (local ? options.localPassword : void 0);
+	if (!password) throw new RedisPasswordMissing(stage);
+	const auth = encodeURIComponent(password);
+	return {
+		password,
+		passwordFromSecrets: Boolean(set),
+		urls: Object.fromEntries(caches.map((cache, index) => [cache.envKey, `redis://:${auth}@${REDIS_SERVICE}:${REDIS_PORT}/${index}`])),
+		env: {
+			[REDIS_PASSWORD_KEY]: password,
+			REDISCLI_AUTH: password
+		},
+		databases: Math.max(REDIS_DATABASES, caches.length)
+	};
+}
 /**
-* Where one stage's routes live, imported by the file above.
+* Redis's service: bounded, persisted and password protected, on the
+* network alone.
 *
-* Per stage because one edge serves every stage, the same way one Postgres
-* holds `orders` and `orders_test`. A single file would mean `gkm test`
-* deleting the routes `gkm dev` is serving.
+* The command runs the image's own entrypoint with `redis-server` first, so
+* it still drops to the `redis` user and owns `/data`; the password is read
+* from the env file by the shell (`$$` is compose's escape for `$`), so
+* neither the compose file nor the container's command holds it.
 */
-const caddySitesPath = (stage) => `.gkm/caddy-sites/${stage}.caddy`;
+function redisService(redis) {
+	const flags = [
+		`--requirepass "$$${REDIS_PASSWORD_KEY}"`,
+		`--maxmemory ${REDIS_MAXMEMORY}`,
+		"--maxmemory-policy allkeys-lru",
+		"--appendonly yes",
+		...redis.databases > REDIS_DATABASES ? [`--databases ${redis.databases}`] : []
+	];
+	return {
+		image: REDIS_IMAGE,
+		restart: "unless-stopped",
+		command: [
+			"sh",
+			"-c",
+			`exec docker-entrypoint.sh redis-server ${flags.join(" ")}`
+		],
+		env_file: [{
+			path: `./${REDIS_SERVICE}.env`,
+			format: "raw"
+		}],
+		volumes: ["redis-data:/data"],
+		healthcheck: {
+			test: ["CMD-SHELL", "redis-cli ping | grep -q PONG"],
+			interval: "5s",
+			timeout: "3s",
+			retries: 10
+		}
+	};
+}
+//#endregion
+//#region src/deploy/generated.ts
 /**
-* Where the local edge's root certificate is copied to.
+* The values a deployed stage generates once and keeps: what nothing can
+* provision and nobody else issues.
 *
-* Exported so a process can be pointed at it without installing anything:
-* `NODE_EXTRA_CA_CERTS` is the whole of the trust story for Node, and it needs
-* no sudo. A browser is the case that still wants the root in the system store,
-* which is a one-time `caddy trust` rather than something a reconcile should do
-* on a developer's behalf.
+* - **A seed**, which salts every password a deploy derives — a database's
+*   master and roles, a bucket's root user. Derived from repo facts alone
+*   (project, stage, construct id), those passwords were computable by anyone
+*   who could read the repo.
+* - **Each `secret` construct's value** — an auth server's signing secret —
+*   random, rather than derived.
+* - **Each `encryption` construct's keyring** — one random key and an index
+*   key. Later keys are added by `gkm encryption:rotate`, never by a deploy.
+*
+* Both are generated on the first deploy that needs them and written to the
+* stage's store, so every later deploy reads the same values: sessions survive
+* a redeploy, and a role's password does not move. A value set by hand with
+* `gkm secrets:set` is kept, never replaced.
 */
-const LOCAL_CA_PATH = ".gkm/caddy-root.crt";
-/** Where Caddy keeps the root of the CA it generated. */
-const CADDY_ROOT_IN_CONTAINER = "/data/caddy/pki/authorities/local/root.crt";
 /**
-* Converge the local target on what the manifest declares.
-*
-* Cheap when there is nothing to do: the hash is compared before the compose
-* file is written or a container is touched, and a converged project pays one
-* hash and one health check.
+* The stage's secrets with its seed and every declared `secret`'s value
+* present, generating what is missing. Pure: the caller writes the result
+* back to the stage's store when `generated` is not empty.
 */
-async function reconcile(options) {
-	const { root, project, manifest, stage, start = true, provision = true, docker = dockerCli, probe = isPortFree, sql = pgClient, buckets = bucketClient, carriers = carrierClient } = options;
-	const plan = planFor(manifest, stage, provisionOrder(manifest), {
-		localStage: options.localStage,
-		events: options.events,
-		cache: options.cache,
-		extraContainers: options.extraContainers,
-		...options.fakes ? { fakes: options.fakes } : {},
-		...options.edge === void 0 ? {} : { edge: options.edge }
-	});
-	const composePath = join(root, COMPOSE_PATH);
-	const observed = await observedPorts(docker, composePath, plan.containers, plan.fakes);
-	const ports = await allocate(project, portKeys(plan.containers, plan.fakes), keptPorts(options.saved, observed), probe);
-	const compose = composeFor(plan, {
-		project,
-		ports,
-		...options.apps ? { apps: options.apps(plan.containers) } : {}
-	});
-	const caddyfile = toCaddyfile(sitesFor(plan, project, options.addresses));
-	const hash = planHash(plan, compose, {
-		caddyfile,
-		postgres: postgresStatements(plan, project).map((statement) => statement.create).join(";\n")
-	});
-	const services = serviceAddresses(plan.containers, ports, plan.fakes);
-	const lan = plan.resources.some((r) => r.kind === "mobile-app") ? options.lanAddress === void 0 ? lanAddress() : options.lanAddress ?? void 0 : void 0;
-	const env = envFor(plan, {
-		ports,
-		project,
-		...options.mailFrom ? { mailFrom: options.mailFrom } : {},
-		...options.addresses ? { addresses: options.addresses } : {},
-		...lan ? { lanAddress: lan } : {},
-		...options.metroPorts ? { metroPorts: options.metroPorts } : {}
-	});
-	if (plan.containers.includes("caddy")) env.NODE_EXTRA_CA_CERTS = join(root, LOCAL_CA_PATH);
-	const result = {
-		stage,
-		plan,
-		compose,
-		ports,
-		services,
-		env,
-		provisioned: [],
-		fakes: options.fakes ?? {},
-		hash,
-		changed: false
-	};
-	const recorded = await loadState(root, stage);
-	const postgresPort = ports[primaryPortKey("postgres")];
-	if (recorded?.hash === hash && existsSync(composePath) && (!start || await docker.healthy(composePath, plan.containers)) && (!start || !provision || postgresPort === void 0 || await databasesExist(sql(postgresPort), postgresDatabaseNames(plan)))) return result;
-	await write(composePath, toYaml(compose));
-	if (plan.containers.includes("caddy")) {
-		await write(join(root, CADDYFILE_PATH), caddyfileRoot());
-		await write(join(root, caddySitesPath(stage)), caddyfile);
-		await pruneCaddySites(root, [
-			stage,
-			options.localStage,
-			TEST_STAGE
-		]);
-	}
-	if (start && plan.containers.length > 0) {
-		options.progress?.(`🐳 Starting ${plan.containers.join(", ")} — the first start pulls each image, which can take a few minutes`);
-		await docker.up(composePath, plan.containers, options.progress ? { show: true } : {});
-	}
-	if (start && plan.containers.includes("caddy")) await docker.reload(composePath, "caddy").catch(() => {});
-	if (start && plan.containers.includes("caddy")) await docker.copyOut(composePath, "caddy", CADDY_ROOT_IN_CONTAINER, join(root, LOCAL_CA_PATH)).catch(() => {});
-	if (start && provision) options.progress?.("🗄️  Creating what the constructs declare — databases, roles, buckets, topics");
-	const provisioned = start && provision ? await create(plan, ports, sql, buckets, carriers, project) : [];
-	await saveState(root, {
-		hash,
-		stage
-	});
+function withGeneratedSecrets(secrets, manifest) {
+	const generated = [];
+	const custom = { ...secrets.custom };
+	for (const declaration of Object.values(manifest)) {
+		if (declaration?.kind !== "secret" && declaration?.kind !== "encryption") continue;
+		const key = declaration.provides?.[0];
+		if (!key || custom[key]) continue;
+		custom[key] = declaration.kind === "encryption" ? generateKeyring() : random();
+		generated.push(key);
+	}
+	const seed = secrets.seed ?? generateSeed();
+	if (!secrets.seed) generated.push("seed");
 	return {
-		...result,
-		provisioned,
-		changed: true
+		secrets: generated.length ? {
+			...secrets,
+			seed,
+			custom,
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		} : secrets,
+		generated
 	};
 }
+/** A stage's seed: 256 random bits, URL-safe. */
+function generateSeed() {
+	return random();
+}
+/** 256 bits, URL-safe. */
+function random() {
+	return randomBytes(32).toString("base64url");
+}
+/** MinIO's root user, the same for every workspace: it is not a secret. */
+const LOCAL_MINIO_USER = "minio";
+/** RabbitMQ's administrator, the same way. */
+const LOCAL_RABBITMQ_USER = "rabbitmq";
 /**
-* Create the databases, schemas, buckets, topics and queues the plan names.
-*
-* Idempotent throughout, so this runs on every non-converged reconcile rather
-* than being something to remember.
+* The Postgres superuser for a workspace: its name as an identifier, with
+* `_admin` — never the bare name, which a database construct of the same
+* name would claim as its runtime role.
 */
-async function create(plan, ports, sql, buckets, emulatorCarriers, project) {
-	const applied = [];
-	const postgresPort = ports[primaryPortKey("postgres")];
-	const statements = postgresStatements(plan, project);
-	if (postgresPort !== void 0 && statements.length > 0) applied.push(...await applyPostgres(sql(postgresPort), statements));
-	const minioPort = ports[primaryPortKey("minio")];
-	const names = bucketNames(plan);
-	const policies = bucketPolicies(plan);
-	if (minioPort !== void 0 && (names.length > 0 || policies.length > 0)) {
-		const client = buckets(minioPort);
-		if (names.length > 0) applied.push(...await applyBuckets(client, names));
-		if (policies.length > 0) applied.push(...await applyPolicies(client, policies));
-	}
-	const emulatorPort = ports[primaryPortKey("localstack")];
-	const carriers = carrierNames(plan);
-	if (emulatorPort !== void 0 && carriers.topics.length + carriers.queues.length > 0) applied.push(...await applyCarriers(emulatorCarriers(emulatorPort), carriers));
-	return applied;
+function postgresSuperuser(project) {
+	return `${project.toLowerCase().replace(/^@[^/]+\//, "").replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "").replace(/^(\d)/, "_$1") || "gkm"}_admin`;
+}
+/** 256 random bits, URL-safe. */
+function token() {
+	return randomBytes(32).toString("base64url");
+}
+/** `length` characters of letters and digits, which every client takes as is. */
+function alphanumeric(length) {
+	const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+	let out = "";
+	for (let i = 0; i < length; i++) out += alphabet[randomInt(62)];
+	return out;
+}
+/** A fresh set of local logins for a workspace. */
+function generateLocalCredentials(project) {
+	return {
+		seed: generateSeed(),
+		postgres: {
+			user: postgresSuperuser(project),
+			password: token()
+		},
+		minio: {
+			user: LOCAL_MINIO_USER,
+			password: alphanumeric(32)
+		},
+		rabbitmq: {
+			user: LOCAL_RABBITMQ_USER,
+			password: token()
+		},
+		redis: { password: generateRedisPassword() },
+		cacheToken: token(),
+		emulator: {
+			accessKeyId: EMULATOR_ACCESS_KEY_ID,
+			secretAccessKey: alphanumeric(40)
+		},
+		logs: {
+			email: LOCAL_LOGS_EMAIL,
+			password: generateLogsPassword()
+		}
+	};
 }
 /**
-* The host ports of containers already running.
-*
-* Keyed the same way allocation keys them, so the two merge without either
-* knowing about the other.
+* The stored logins with anything missing generated — a file an older gkm
+* wrote before a service existed. Pure: the caller writes the result back
+* when `generated` is not empty.
 */
-async function observedPorts(docker, composePath, containers, fakes) {
-	const observed = {};
-	for (const container of containers) for (const port of portsOf(container, fakes)) {
-		const running = await docker.publishedPort(composePath, container, port.inside);
-		if (running !== void 0) observed[port.key] = running;
+function withLocalCredentials(stored, project) {
+	const fresh = generateLocalCredentials(project);
+	const generated = Object.keys(fresh).filter((key) => stored?.[key] === void 0);
+	return {
+		credentials: {
+			...fresh,
+			...stored
+		},
+		generated
+	};
+}
+/** Where a workspace's local logins are kept on this machine. */
+function localCredentialsPath(project) {
+	const keys = getKeystoreDir(project);
+	const name = keys.split(/[\\/]/).at(-1);
+	const namespace = keys.split(/[\\/]/).at(-2);
+	return join(project.home ?? gkmHome(), "local", namespace, `${name}.json`);
+}
+/** The local stage's logins file is there, and its key is not. */
+var LocalCredentialsKeyMissing = class extends Error {
+	path;
+	stage;
+	constructor(path, stage) {
+		super(`The local logins at ${path} are encrypted with the '${stage}' stage's key, and this machine has none. Remove the file to generate new ones — the containers' volumes are rotated to them on the next gkm dev.`);
+		this.path = path;
+		this.stage = stage;
+		this.name = "LocalCredentialsKeyMissing";
 	}
-	return observed;
+};
+/** Another gkm held the logins file's lock for longer than any write takes. */
+var LocalCredentialsLocked = class extends Error {
+	lock;
+	constructor(lock) {
+		super(`Another gkm has been writing the local logins for over ${LOCK_TIMEOUT_MS / 1e3}s. If none is running, remove ${lock} and run the command again.`);
+		this.lock = lock;
+		this.name = "LocalCredentialsLocked";
+	}
+};
+/** Read the stored logins, or `null` where none were generated yet. */
+async function readLocalCredentials(workspace, home) {
+	const project = keystoreProject(workspace, home);
+	const path = localCredentialsPath(project);
+	if (!existsSync(path)) return null;
+	const stage = workspace.stages.local;
+	const key = await readKey(stage, project);
+	if (!key) throw new LocalCredentialsKeyMissing(path, stage);
+	return decrypt(JSON.parse(await readFile(path, "utf-8")), key);
+}
+/** Write the logins, encrypted with the local stage's key, owner-only. */
+async function saveLocalCredentials(workspace, credentials, home) {
+	const project = keystoreProject(workspace, home);
+	const path = localCredentialsPath(project);
+	const key = await getOrCreateKey(workspace.stages.local, project);
+	await mkdir(dirname(path), {
+		recursive: true,
+		mode: 448
+	});
+	await writeFile(path, JSON.stringify(encrypt(credentials, key), null, 2), { mode: 384 });
 }
-/** Write a file only when its content would change, so mtimes stay meaningful. */
 /**
-* Remove the routes of stages this project no longer reconciles.
+* The workspace's local logins: read back, or generated and kept the first
+* time anything needs them.
 *
-* Only the local stage and `test` are ever written, so any other file is left
-* over from a stage that was renamed — `development` becoming `dev`. Caddy
-* imports every file, and the leftover declares the same hosts as its
-* replacement: it refuses the whole config as ambiguous, and every URL behind
-* the edge goes with it.
+* Under a lock, because a workspace's `gkm dev` starts one per app and the
+* first run of each would otherwise generate — and keep — its own.
 */
-async function pruneCaddySites(root, stages) {
-	const dir = dirname(join(root, caddySitesPath(TEST_STAGE)));
-	const keep = new Set(stages.map((stage) => stage && `${stage}.caddy`));
-	for (const file of await readdir(dir)) if (file.endsWith(".caddy") && !keep.has(file)) await rm(join(dir, file));
+async function loadLocalCredentials(workspace, home) {
+	return withLock(`${localCredentialsPath(keystoreProject(workspace, home))}.lock`, async () => {
+		const result = withLocalCredentials(await readLocalCredentials(workspace, home), workspace.name);
+		if (result.generated.length > 0) await saveLocalCredentials(workspace, result.credentials, home);
+		return result;
+	});
 }
-async function write(path, content) {
+/** How long a lock may be held before it is someone else's problem. */
+const LOCK_TIMEOUT_MS = 15e3;
+async function withLock(lock, body) {
+	await mkdir(dirname(lock), {
+		recursive: true,
+		mode: 448
+	});
+	const started = Date.now();
+	for (;;) try {
+		await mkdir(lock);
+		break;
+	} catch (error) {
+		if (error.code !== "EEXIST") throw error;
+		if (await stat(lock).then((s) => Date.now() - s.mtimeMs).catch(() => 0) > LOCK_TIMEOUT_MS) {
+			await rm(lock, {
+				recursive: true,
+				force: true
+			});
+			continue;
+		}
+		if (Date.now() - started > LOCK_TIMEOUT_MS) throw new LocalCredentialsLocked(lock);
+		await new Promise((resolve) => setTimeout(resolve, 50));
+	}
 	try {
-		if (await readFile(path, "utf-8") === content) return;
-	} catch {}
-	await mkdir(dirname(path), { recursive: true });
-	await writeFile(path, content);
+		return await body();
+	} finally {
+		await rm(lock, {
+			recursive: true,
+			force: true
+		});
+	}
 }
 //#endregion
 //#region src/reconcile/workspace.ts
@@ -4657,7 +5617,9 @@ async function reconcileWorkspace(workspace, options) {
 	});
 	const manifest = options.manifest ?? discovered;
 	const fakes = fakesApply(options.stage, options.fake) ? await readFakes(workspace.root, manifest) : {};
+	const { credentials } = await loadLocalCredentials(workspace);
 	const result = await reconcile({
+		credentials,
 		root: workspace.root,
 		project: workspace.name,
 		manifest,
@@ -4668,11 +5630,13 @@ async function reconcileWorkspace(workspace, options) {
 		addresses: surfaceAddresses(workspace, manifest),
 		metroPorts: metroPorts(workspace, manifest),
 		fakes,
-		apps: (containers) => appServices(workspace, manifest, containers, runnables, fakes),
+		apps: (containers) => appServices(workspace, manifest, containers, credentials, runnables, fakes),
 		...options.start === void 0 ? {} : { start: options.start },
 		...options.progress ? { progress: options.progress } : {}
 	});
 	await savePortState(workspace.root, { ...result.ports });
+	if (result.credentials !== credentials) await saveLocalCredentials(workspace, result.credentials);
+	for (const outcome of result.logins) if (outcome.notice) console.log(outcome.notice);
 	return {
 		...result,
 		manifest
@@ -5771,112 +6735,6 @@ function reportDevServices(ctx, uses) {
 	}
 }
 //#endregion
-//#region src/deploy/otel.ts
-/**
-* The OpenTelemetry variables a stage's secrets pass to every backend.
-*
-* A production server starts OpenTelemetry when `OTEL_EXPORTER_OTLP_ENDPOINT`
-* is set (`generators/telemetry.ts`), and the SDK reads the rest of its
-* configuration from the standard `OTEL_*` variables. No construct declares
-* them — they say where the telemetry goes, not what the app is — so a target
-* that writes each backend only the keys it reads would never hand them over.
-* Every target that runs backends asks this module instead.
-*
-* Which keys pass is a pattern over the `OTEL_` prefix rather than the prefix
-* alone or a list:
-*
-* - The bare prefix would forward anything a stage happened to name `OTEL_*`
-*   — `OTEL_LOG_LEVEL=debug`, `OTEL_SDK_DISABLED` — to every backend, without
-*   anyone choosing to.
-* - A list would have to spell out the exporter's five settings once for all
-*   signals and once per signal — twenty keys — and would miss the next one.
-*
-* The pattern names the families the server uses: the OTLP exporter's
-* endpoint, headers, protocol, timeout and compression, for every signal or
-* for one (`OTEL_EXPORTER_OTLP_LOGS_ENDPOINT`); sampling; and the resource's
-* identity.
-*
-* Sites get none of it: a site's environment is inlined into a bundle that
-* every browser downloads, and an exporter's headers are a credential.
-*/
-/** The `OTEL_*` variables a backend is handed from the stage's secrets. */
-const OTEL_PASSTHROUGH = /^OTEL_(?:EXPORTER_OTLP_(?:(?:TRACES|LOGS|METRICS)_)?(?:ENDPOINT|HEADERS|PROTOCOL|TIMEOUT|COMPRESSION)|TRACES_SAMPLER(?:_ARG)?|RESOURCE_ATTRIBUTES|SERVICE_NAME)$/;
-/** Whether a stage secret is one of the passed-through `OTEL_*` variables. */
-function isOtelVariable(key) {
-	return OTEL_PASSTHROUGH.test(key);
-}
-/** Whether a variable says where an OTLP exporter sends, or how it signs. */
-function isOtlpDestination(key) {
-	return /^OTEL_EXPORTER_OTLP_(?:(?:TRACES|LOGS|METRICS)_)?(?:ENDPOINT|HEADERS)$/.test(key);
-}
-/**
-* The `OTEL_*` variables one backend runs with: every one the stage's secrets
-* hold, and `OTEL_SERVICE_NAME` — the app's name — where the stage set
-* telemetry up without naming the service. Empty when the stage set none.
-*/
-function otelEnv(custom, app) {
-	const env = {};
-	for (const [key, value] of Object.entries(custom)) if (isOtelVariable(key) && value !== "") env[key] = value;
-	if (Object.keys(env).length > 0 && !env.OTEL_SERVICE_NAME) env.OTEL_SERVICE_NAME = app;
-	return env;
-}
-//#endregion
-//#region src/target/dokploy/domain.ts
-/** A stage was deployed that `deploy.domains` gives no domain. */
-var NoDomainForStage = class extends Error {
-	stage;
-	constructor(stage) {
-		super(`No domain for stage "${stage}". Add it to gkm.config.ts: deploy: { domains: { ${stage}: 'example.com' } }.`);
-		this.stage = stage;
-		this.name = "NoDomainForStage";
-	}
-};
-/**
-* The hostname an app answers on for a stage.
-*
-* 1. An explicit `app.domain` — a string, or one per stage — wins.
-* 2. Otherwise from the stage's base domain in `deploy.domains`: the root site
-*    answers on the domain itself, and every other app on
-*    `{subdomain}.{domain}` — its declaration's `subdomain`, or its own name.
-*
-* @throws {NoDomainForStage} when `deploy.domains` names no domain for it
-*/
-function resolveHost(appName, app, stage, domains, isMainFrontend) {
-	if (app.domain) {
-		if (typeof app.domain === "string") return app.domain;
-		if (app.domain[stage]) return app.domain[stage];
-	}
-	const baseDomain = domains?.[stage];
-	if (!baseDomain) throw new NoDomainForStage(stage);
-	if (isMainFrontend) return baseDomain;
-	return `${app.subdomain ?? appName}.${baseDomain}`;
-}
-/**
-* Whether this app is the site the base domain points at — see `rootSite`,
-* which the local edge asks too.
-*
-* @throws {AmbiguousRootSite} when several sites could be the root and none says it is
-*/
-function isMainFrontendApp(appName, app, allApps) {
-	if (app.type !== "web") return false;
-	return rootSite(Object.entries(allApps).filter(([, a]) => a.type === "web").map(([name, a]) => ({
-		name,
-		root: a.root
-	}))) === appName;
-}
-/**
-* Get public URL arg names from app dependencies.
-*
-* @param app - The web/mobile app configuration
-* @returns Array of arg names like 'NEXT_PUBLIC_API_URL', or [] for frameworks
-*   without a public prefix (e.g. Remix).
-*/
-function getPublicUrlArgNames(app) {
-	const prefix = getPublicEnvPrefix(app.framework);
-	if (!prefix) return [];
-	return app.dependencies.map((dep) => `${prefix}${dep.toUpperCase()}_URL`);
-}
-//#endregion
 //#region src/docker/imageRef.ts
 /**
 * An image reference, checked before it reaches `docker`.
@@ -6186,57 +7044,6 @@ function printRunInstructions(workspace) {
 	logger.log(`   docker compose -f ${COMPOSE_PATH}${project} --profile apps up --build`);
 }
 //#endregion
-//#region src/deploy/generated.ts
-/**
-* The values a deployed stage generates once and keeps: what nothing can
-* provision and nobody else issues.
-*
-* - **A seed**, which salts every password a deploy derives — a database's
-*   master and roles, a bucket's root user. Derived from repo facts alone
-*   (project, stage, construct id), those passwords were computable by anyone
-*   who could read the repo.
-* - **Each `secret` construct's value** — an auth server's signing secret —
-*   random, rather than derived.
-* - **Each `encryption` construct's keyring** — one random key and an index
-*   key. Later keys are added by `gkm encryption:rotate`, never by a deploy.
-*
-* Both are generated on the first deploy that needs them and written to the
-* stage's store, so every later deploy reads the same values: sessions survive
-* a redeploy, and a role's password does not move. A value set by hand with
-* `gkm secrets:set` is kept, never replaced.
-*/
-/**
-* The stage's secrets with its seed and every declared `secret`'s value
-* present, generating what is missing. Pure: the caller writes the result
-* back to the stage's store when `generated` is not empty.
-*/
-function withGeneratedSecrets(secrets, manifest) {
-	const generated = [];
-	const custom = { ...secrets.custom };
-	for (const declaration of Object.values(manifest)) {
-		if (declaration?.kind !== "secret" && declaration?.kind !== "encryption") continue;
-		const key = declaration.provides?.[0];
-		if (!key || custom[key]) continue;
-		custom[key] = declaration.kind === "encryption" ? generateKeyring() : random();
-		generated.push(key);
-	}
-	const seed = secrets.seed ?? random();
-	if (!secrets.seed) generated.push("seed");
-	return {
-		secrets: generated.length ? {
-			...secrets,
-			seed,
-			custom,
-			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-		} : secrets,
-		generated
-	};
-}
-/** 256 bits, URL-safe. */
-function random() {
-	return randomBytes(32).toString("base64url");
-}
-//#endregion
 //#region src/deploy/journal.ts
 var DeployJournal = class DeployJournal {
 	store;
@@ -6635,6 +7442,6 @@ function reportPlannedSeeds(planned, log) {
 	for (const { folder, seeds } of planned) log(`🌱 ${folder}: would run ${seeds.length} (${seeds.join(", ")})`);
 }
 //#endregion
-export { constructGlobs as $, getKeyPath as $t, isOtlpDestination as A, imageBuildCredentials as At, manifestServiceDeclarations as B, primaryPortKey as Bt, ensureDockerignore as C, hostFor as Ct, NoDomainForStage as D, WORKER_PORT as Dt, validateImageRef as E, TURBO_VERSION as Et, STORAGE_KEY_PAIR as F, storageBackendFor as Ft, workerUnits as G, loadEnvFiles as Gt, reportDevServices as H, createEntryWrapper as Ht, UnknownDevService as I, DEFAULT_IMAGES as It, workerEntryDir as J, isRemoteStore as Jt, WorkerGenerator as K, loadSecretsForApp as Kt, assertExternalServices as L, describeServices as Lt, DEV_SERVICES as M, cacheBackendFor as Mt, DevServicesNeedServerTarget as N, eventsBackendFor as Nt, isMainFrontendApp as O, detectPackageManager as Ot, ExternalServicesNotConfigured as P, providerOf as Pt, backendsOf as Q, FileSecretsStore as Qt, devServicesUsed as R, fakeKey as Rt, dockerCommand as S, resourceName as St, workerDockerfileOf as T, imageLayout as Tt, requiredStageKeys as U, findAvailablePort as Ut, parseDevServices as V, createCredentialsPreload as Vt, suppliedOnly as W, isPortAvailable as Wt, CronGenerator as X, storeFromConfig as Xt, QueueGenerator as Y, secretsStoreFor as Yt, FAKE_ENV as Z, store_exports as Zt, DeployJournal as _, networkEnv as _t, createEmptyState as a, imageName as an, applyBuckets as at, DockerPushFailed as b, localRolePassword as bt, isDnsVerified as c, markerOf as cn, bucketPolicies as ct, setApplicationId as d, initStageSecrets as dn, quoteIdentifier as dt, keystoreProject as en, derivedContainers as et, setBackupState as f, maskPassword as fn, composeFor as ft, setPostgresBackupId as g, dockerfileOf as gt, setGeneratedSecret as h, withCustomSecret as hn, appEnvKeys as ht, assertNoStaleSecrets as i, deployIdentity as in, forgetState as it, otelEnv as j, isImageBuild as jt, resolveHost as k, findBuildRoot as kt, recordRelease as l, ownershipMarker as ln, postgresDatabaseNames as lt, setDnsVerification as m, toEmbeddableSecrets as mn, pgClient as mt, reportDatabaseRuns as n, readKey as nn, workspace_exports as nt, getBackupState as o, imageRef as on, applyPolicies as ot, setDnsRecord as p, storage_exports as pn, bucketClient as pt, workerBundleName as q, prepareEntryCredentials as qt, reportPlannedSeeds as r, applicationName as rn, LOCAL_CA_PATH as rt, getGeneratedSecret as s, isOwnedBy as sn, applyPostgres as st, DeploySeedsFailed as t, projectKey as tn, reconcileWorkspace as tt, recordRollback as u, projectName as un, postgresStatements as ut, withGeneratedSecrets as v, workerEnvKeys as vt, workerDockerfile as w, composeBuildPaths as wt, appDockerfile as x, planFor as xt, DockerBuildFailed as y, envFor as yt, externalServices as z, portKeys as zt };
+export { postgresSuperuser as $, EMULATOR_ACCESS_KEY_ID as $t, UnknownDevService as A, projectName as An, appEnvKeys as At, WorkerGenerator as B, imageLayout as Bt, workerDockerfile as C, applicationName as Cn, postgresDatabaseNames as Ct, DevServicesNeedServerTarget as D, isOwnedBy as Dn, ensurePostgresLogin as Dt, DEV_SERVICES as E, imageRef as En, LEGACY_LOCAL_LOGIN as Et, parseDevServices as F, withCustomSecret as Fn, localRolePassword as Ft, FAKE_ENV as G, imageBuildCredentials as Gt, workerEntryDir as H, WORKER_PORT as Ht, reportDevServices as I, planFor as It, derivedContainers as J, eventsBackendFor as Jt, backendsOf as K, isImageBuild as Kt, requiredStageKeys as L, resourceName as Lt, devServicesUsed as M, maskPassword as Mn, networkEnv as Mt, externalServices as N, storage_exports as Nn, workerEnvKeys as Nt, ExternalServicesNotConfigured as O, markerOf as On, bucketClient as Ot, manifestServiceDeclarations as P, toEmbeddableSecrets as Pn, envFor as Pt, loadLocalCredentials as Q, composeFor as Qt, suppliedOnly as R, hostFor as Rt, ensureDockerignore as S, readKey as Sn, bucketPolicies as St, validateImageRef as T, imageName as Tn, quoteIdentifier as Tt, QueueGenerator as U, detectPackageManager as Ut, workerBundleName as V, TURBO_VERSION as Vt, CronGenerator as W, findBuildRoot as Wt, workspace_exports as X, storageBackendFor as Xt, reconcileWorkspace as Y, providerOf as Yt, LOCAL_RABBITMQ_USER as Z, CLUSTER_DATABASE as Zt, DeployJournal as _, store_exports as _n, LOCAL_CA_PATH as _t, createEmptyState as a, primaryPortKey as an, runsRedis as at, appDockerfile as b, keystoreProject as bn, applyPolicies as bt, isDnsVerified as c, findAvailablePort as cn, LOGS_SERVICE as ct, setApplicationId as d, loadPortState as dn, stackLogs as dt, DEFAULT_IMAGES as en, readLocalCredentials as et, setBackupState as f, loadSecretsForApp as fn, withLogsPassword as ft, setPostgresBackupId as g, storeFromConfig as gn, otelEnv as gt, setGeneratedSecret as h, secretsStoreFor as hn, resolveHost as ht, assertNoStaleSecrets as i, portsOf as in, redisService as it, assertExternalServices as j, initStageSecrets as jn, dockerfileOf as jt, STORAGE_KEY_PAIR as k, ownershipMarker as kn, pgClient as kt, recordRelease as l, isPortAvailable as ln, logsAccess as lt, setDnsVerification as m, isRemoteStore as mn, isMainFrontendApp as mt, reportDatabaseRuns as n, fakeKey as nn, REDIS_SERVICE as nt, getBackupState as o, createCredentialsPreload as on, stackRedis as ot, setDnsRecord as p, prepareEntryCredentials as pn, NoDomainForStage as pt, constructGlobs as q, cacheBackendFor as qt, reportPlannedSeeds as r, portKeys as rn, STACK_CACHE as rt, getGeneratedSecret as s, createEntryWrapper as sn, withRedisPassword as st, DeploySeedsFailed as t, describeServices as tn, withGeneratedSecrets as tt, recordRollback as u, loadEnvFiles as un, logsService as ut, DockerBuildFailed as v, FileSecretsStore as vn, forgetState as vt, workerDockerfileOf as w, deployIdentity as wn, postgresStatements as wt, dockerCommand as x, projectKey as xn, applyPostgres as xt, DockerPushFailed as y, getKeyPath as yn, applyBuckets as yt, workerUnits as z, composeBuildPaths as zt };
 
-//# sourceMappingURL=seeds-BdkFpW0P.mjs.map
+//# sourceMappingURL=seeds-B4PiO_48.mjs.map