@geekmidas/cli 10.0.0-alpha.83 → 10.0.0-alpha.84

package/dist/{seeds-BoKQ74Od.mjs → seeds-BK8caVMm.mjs}

@@ -2,11 +2,11 @@ import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { i as run$1, s as gkmHome } from "./run-BJLIerMM.mjs";
 import { d as output, r as discover, u as ConstructGenerator } from "./discover-BPelzeGW.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { B as UnknownSecretsStoreProvider, L as LOGS_PORT, g as getPublicEnvPrefix, h as PUBLIC_ENV_PREFIXES, k as TEST_STAGE, r as allConstructGlobs } from "./workspace-DD9mtPy8.mjs";
+import { I as stageSampleRate, L as telemetryEnv, R as LOGS_PORT, U as UnknownSecretsStoreProvider, g as getPublicEnvPrefix, h as PUBLIC_ENV_PREFIXES, k as TEST_STAGE, r as allConstructGlobs } from "./workspace-Drz4jsvy.mjs";
 import { ConfigNotFound, NotInAnApp, loadWorkspaceAppInfo, loadWorkspaceConfig } from "./config.mjs";
-import { n as runtimeFor, r as generateTelemetryModule, s as telemetryArgs } from "./EndpointGenerator-DtnIGafh.mjs";
-import { c as runtimeOf } from "./resolve-y1PkSZrF.mjs";
-import { a as DEFAULT_STORAGE, i as DEFAULT_EVENTS$1, n as readFakes, o as holdsEveryCache, r as DEFAULT_CACHE, t as SubscriberGenerator } from "./SubscriberGenerator-DQZeGkDW.mjs";
+import { a as telemetryArgs, c as startTelemetryCode, n as runtimeFor, u as writeTelemetryModule } from "./EndpointGenerator-CVc6Oi1Y.mjs";
+import { a as DEFAULT_STORAGE, i as DEFAULT_EVENTS$1, n as readFakes, o as holdsEveryCache, r as DEFAULT_CACHE, t as SubscriberGenerator } from "./SubscriberGenerator-BPqQf8fB.mjs";
+import { c as runtimeOf } from "./resolve-r7PAs6ng.mjs";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { constants, existsSync, readFileSync } from "node:fs";
 import { appendFile, chmod, copyFile, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
@@ -14,11 +14,11 @@ import { homedir, networkInterfaces } from "node:os";
 import { promisify } from "node:util";
 import { Cron } from "@geekmidas/constructs/crons";
 import { Queue } from "@geekmidas/constructs/queue";
-import { DEFAULT_POSTGRES_VERSION, cacheTable, cookieDomain, dependenciesOf, dependentsOf, externalApiUrl, kebabCase, mobileOrigins, provideKey, providedKeyFor, provisionOrder, publicEnvFor, schemeBase, scopedName } from "@geekmidas/manifest";
+import { DEFAULT_POSTGRES_VERSION, TELEMETRY_KEYS, cacheTable, cookieDomain, dependenciesOf, dependentsOf, externalApiUrl, kebabCase, mobileOrigins, provideKey, providedKeyFor, provisionOrder, publicEnvFor, schemeBase, scopedName } from "@geekmidas/manifest";
 import { createServer } from "node:net";
 import { execFile, spawn } from "node:child_process";
-import { config } from "dotenv";
 import { createCipheriv, createDecipheriv, createHash, randomBytes, randomInt } from "node:crypto";
+import { config } from "dotenv";
 import { stringify } from "yaml";
 import { formatKeyring, generateKeyring } from "@geekmidas/constructs/encryption";
 import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
@@ -29,425 +29,694 @@ import { CreateTopicCommand, GetTopicAttributesCommand, SNSClient } from "@aws-s
 import { CreateQueueCommand, GetQueueUrlCommand, SQSClient } from "@aws-sdk/client-sqs";
 import { Client } from "pg";
 import { cacheTableStatements } from "@geekmidas/cache/postgres";
-//#region src/secrets/storage.ts
-var storage_exports = /* @__PURE__ */ __exportAll({
-	initStageSecrets: () => initStageSecrets,
-	maskPassword: () => maskPassword,
-	toEmbeddableSecrets: () => toEmbeddableSecrets,
-	validateEnvironmentVariables: () => validateEnvironmentVariables,
-	withCustomSecret: () => withCustomSecret
-});
+//#region src/workspace/rootSite.ts
 /**
-* Initialize an empty StageSecrets object for a stage.
+* Which site the base domain points at — deployed and locally alike.
+*
+* Three rules, in order, and the last one is the point:
+*
+* 1. **One site** — it is the root. Unambiguous, so nothing has to be said.
+* 2. **Named `web`** — the convention wins, because people already rely on it.
+* 3. **Declared `root: true`** — the site says so itself.
+*
+* Anything else throws. It used to take the *first* site it iterated, and that
+* order came from the manifest, which is built in glob traversal order — so two
+* sites with neither named `web` meant renaming a file could move the root
+* domain, silently.
+*
+* One rule for both targets: deployed the root site gets the base domain, and
+* locally it gets the project's bare host behind the edge. Before this was
+* shared, the local edge put every site on a subdomain, so what a developer
+* browsed was not the shape production served.
+*
+* @returns the root site's name, or `undefined` when there are no sites
+* @throws {AmbiguousRootSite} when several sites could be the root and none says it is
 */
-function initStageSecrets(stage) {
-	const now = (/* @__PURE__ */ new Date()).toISOString();
-	return {
-		stage,
-		createdAt: now,
-		updatedAt: now,
-		services: {},
-		urls: {},
-		custom: {}
-	};
+function rootSite(sites) {
+	if (sites.length === 0) return void 0;
+	if (sites.length === 1) return sites[0].name;
+	if (sites.some(({ name }) => name === "web")) return "web";
+	const declared = sites.filter(({ root }) => root === true);
+	if (declared.length === 1) return declared[0].name;
+	throw new AmbiguousRootSite(sites.map(({ name }) => name), declared.length > 1);
 }
+/** Several sites could hold the base domain, and none of them says it does. */
+var AmbiguousRootSite = class extends Error {
+	sites;
+	tooMany;
+	constructor(sites, tooMany = false) {
+		super(tooMany ? `More than one site declares \`root: true\` — ${sites.join(", ")}. The base domain points at one of them.` : `${sites.length} sites and nothing says which holds the base domain: ${sites.join(", ")}. Name one of them \`web\`, or declare \`root: true\` on the one the base domain points at. It used to be whichever the glob reached first, which is not a thing to decide a hostname.`);
+		this.sites = sites;
+		this.tooMany = tooMany;
+		this.name = "AmbiguousRootSite";
+	}
+};
+//#endregion
+//#region src/target/dokploy/domain.ts
+/** A stage was deployed that `deploy.domains` gives no domain. */
+var NoDomainForStage = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`No domain for stage "${stage}". Add it to gkm.config.ts: deploy: { domains: { ${stage}: 'example.com' } }.`);
+		this.stage = stage;
+		this.name = "NoDomainForStage";
+	}
+};
 /**
-* Convert StageSecrets to embeddable format (flat key-value pairs).
-* This is what gets encrypted and embedded in the bundle.
+* The hostname an app answers on for a stage.
+*
+* 1. An explicit `app.domain` — a string, or one per stage — wins.
+* 2. Otherwise from the stage's base domain in `deploy.domains`: the root site
+*    answers on the domain itself, and every other app on
+*    `{subdomain}.{domain}` — its declaration's `subdomain`, or its own name.
+*
+* @throws {NoDomainForStage} when `deploy.domains` names no domain for it
 */
-function toEmbeddableSecrets(secrets) {
-	return {
-		...secrets.urls,
-		...secrets.custom,
-		...secrets.services.postgres && {
-			POSTGRES_USER: secrets.services.postgres.username,
-			POSTGRES_PASSWORD: secrets.services.postgres.password,
-			POSTGRES_DB: secrets.services.postgres.database ?? "app",
-			POSTGRES_HOST: secrets.services.postgres.host,
-			POSTGRES_PORT: String(secrets.services.postgres.port)
-		},
-		...secrets.services.redis && {
-			REDIS_PASSWORD: secrets.services.redis.password,
-			REDIS_HOST: secrets.services.redis.host,
-			REDIS_PORT: String(secrets.services.redis.port)
-		},
-		...secrets.services.minio && {
-			STORAGE_ACCESS_KEY_ID: secrets.services.minio.username,
-			STORAGE_SECRET_ACCESS_KEY: secrets.services.minio.password,
-			STORAGE_BUCKET: secrets.services.minio.bucket ?? "app",
-			STORAGE_REGION: "eu-west-1",
-			STORAGE_FORCE_PATH_STYLE: "true"
-		},
-		...secrets.services.mailpit && {
-			SMTP_HOST: secrets.services.mailpit.host,
-			SMTP_PORT: String(secrets.services.mailpit.port),
-			SMTP_USER: secrets.services.mailpit.username,
-			SMTP_PASS: secrets.services.mailpit.password,
-			SMTP_SECURE: "false",
-			MAIL_FROM: "noreply@localhost"
-		},
-		...secrets.services.localstack && {
-			AWS_ACCESS_KEY_ID: secrets.services.localstack.accessKeyId ?? secrets.services.localstack.username,
-			AWS_SECRET_ACCESS_KEY: secrets.services.localstack.password,
-			AWS_REGION: secrets.services.localstack.region ?? "us-east-1",
-			AWS_ENDPOINT_URL: `http://${secrets.services.localstack.host}:${secrets.services.localstack.port}`
-		}
-	};
-}
-/** The same secrets with one custom value set, and `updatedAt` moved on. */
-function withCustomSecret(secrets, key, value) {
-	return {
-		...secrets,
-		updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-		custom: {
-			...secrets.custom,
-			[key]: value
-		}
-	};
+function resolveHost(appName, app, stage, domains, isMainFrontend) {
+	if (app.domain) {
+		if (typeof app.domain === "string") return app.domain;
+		if (app.domain[stage]) return app.domain[stage];
+	}
+	const baseDomain = domains?.[stage];
+	if (!baseDomain) throw new NoDomainForStage(stage);
+	if (isMainFrontend) return baseDomain;
+	return `${app.subdomain ?? appName}.${baseDomain}`;
 }
 /**
-* Mask a password for display (show first 4 and last 2 chars).
+* Whether this app is the site the base domain points at — see `rootSite`,
+* which the local edge asks too.
+*
+* @throws {AmbiguousRootSite} when several sites could be the root and none says it is
 */
-function maskPassword(password) {
-	if (password.length <= 8) return "********";
-	return `${password.slice(0, 4)}${"*".repeat(password.length - 6)}${password.slice(-2)}`;
+function isMainFrontendApp(appName, app, allApps) {
+	if (app.type !== "web") return false;
+	return rootSite(Object.entries(allApps).filter(([, a]) => a.type === "web").map(([name, a]) => ({
+		name,
+		root: a.root
+	}))) === appName;
 }
 /**
-* Validate that all required environment variables are present in secrets.
-*
-* @param requiredVars - Array of environment variable names required by the application
-* @param secrets - Stage secrets to validate against
-* @returns Validation result with missing and provided variables
-*
-* @example
-* ```typescript
-* const required = ['DATABASE_URL', 'API_KEY', 'JWT_SECRET'];
-* const secrets = await secretsStoreFor(workspace, 'production').then((s) => s.read('production'));
-* const result = validateEnvironmentVariables(required, secrets);
+* Get public URL arg names from app dependencies.
 *
-* if (!result.valid) {
-*   console.error(`Missing environment variables: ${result.missing.join(', ')}`);
-* }
-* ```
+* @param app - The web/mobile app configuration
+* @returns Array of arg names like 'NEXT_PUBLIC_API_URL', or [] for frameworks
+*   without a public prefix (e.g. Remix).
 */
-function validateEnvironmentVariables(requiredVars, secrets) {
-	const embeddable = toEmbeddableSecrets(secrets);
-	const availableVars = new Set(Object.keys(embeddable));
-	const missing = [];
-	const provided = [];
-	for (const varName of requiredVars) if (availableVars.has(varName)) provided.push(varName);
-	else missing.push(varName);
-	return {
-		valid: missing.length === 0,
-		missing: missing.sort(),
-		provided: provided.sort(),
-		required: [...requiredVars].sort()
-	};
+function getPublicUrlArgNames(app) {
+	const prefix = getPublicEnvPrefix(app.framework);
+	if (!prefix) return [];
+	return app.dependencies.map((dep) => `${prefix}${dep.toUpperCase()}_URL`);
 }
 //#endregion
-//#region src/deploy/identity.ts
+//#region src/compose/logs.ts
 /**
-* Who a deploy is, on a target it shares with other workspaces.
+* The stack's log UI: OpenObserve, run beside the apps as telemetry's
+* self-hosted provider, and every process with a `Telemetry` edge pointed at
+* it.
 *
-* A Dokploy server is one flat namespace of projects, images and Docker
-* service names. Deploys used to identify everything they made by the
-* workspace name alone, so two workspaces called `shop` — or `Shop` and
-* `shop` — deploying to one server landed in the same project, pushed over
-* each other's images and redeployed each other's applications. A
-* `DeployIdentity` is what a deploy names and claims its resources by instead.
+* The production server already exports its traces and pino logs over
+* OTLP/HTTP when `OTEL_EXPORTER_OTLP_ENDPOINT` is set. OpenObserve takes OTLP
+* at `/api/<org>/v1/{logs,traces}` with HTTP basic auth, so wiring an app is
+* two variables: the endpoint, `http://openobserve:5080/api/default`, and
+* the header that signs in as the root user.
+*
+* It is reached, by default, through an SSH tunnel: published on 127.0.0.1
+* only, because a port Docker publishes on every interface is opened in the
+* firewall by Docker itself, past ufw's rules. Served publicly, it is a host
+* on the stack's Caddy that refuses every address not allowed.
+*
+* Pure: the stack decides it, and the phases print and check it.
 */
-/** A namespace that cannot be part of a Dokploy name or an image path. */
-var DeployNamespaceInvalid = class extends Error {
-	namespace;
-	constructor(namespace) {
-		super(`deploy.namespace '${namespace}' is not usable as a name: use lowercase letters, digits and single '-' between them (e.g. 'acme' or 'acme-platform') in gkm.config.ts.`);
-		this.namespace = namespace;
-		this.name = "DeployNamespaceInvalid";
+/**
+* The image, pinned. A log store's on-disk format is the thing that must not
+* move under a running stack, so a new version is a change to this line.
+*/
+const OPENOBSERVE_IMAGE = "public.ecr.aws/zinclabs/openobserve:v1.0.4";
+/** Its compose service name — the host the apps send to. */
+const LOGS_SERVICE = "openobserve";
+/** The organisation every app's telemetry lands in. */
+const LOGS_ORG = "default";
+/** The stage secrets that sign in as OpenObserve's root user. */
+const LOGS_EMAIL_KEY = "ZO_ROOT_USER_EMAIL";
+const LOGS_PASSWORD_KEY = "ZO_ROOT_USER_PASSWORD";
+/**
+* The local stage's root user. Its password is generated per machine with
+* the other local logins — see `reconcile/localCredentials.ts`.
+*/
+const LOCAL_LOGS_EMAIL = "admin@gkm.localhost";
+/** A root password OpenObserve would refuse to start with. */
+var LogsPasswordWeak = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`The stage '${stage}' sets ${LOGS_PASSWORD_KEY}, and OpenObserve refuses it: a root password must be 8 to 128 characters with a lowercase letter, an uppercase letter, a digit and a symbol. Set another with gkm secrets:set ${LOGS_PASSWORD_KEY} '…' --stage ${stage}, or unset it to have one generated.`);
+		this.stage = stage;
+		this.name = "LogsPasswordWeak";
 	}
 };
-/** A workspace name with nothing a target can name a resource by. */
-var DeployProjectNameInvalid = class extends Error {
-	workspaceName;
-	constructor(workspaceName) {
-		super(`The workspace name '${workspaceName}' has no letters or digits to name deployed resources by. Set "name" in gkm.config.ts.`);
-		this.workspaceName = workspaceName;
-		this.name = "DeployProjectNameInvalid";
+/** A deployed stage with logs on and no root password generated yet. */
+var LogsPasswordMissing = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`The stage '${stage}' runs OpenObserve and has no ${LOGS_PASSWORD_KEY} in its secrets. Run gkm compose --stage ${stage} without --dry-run once to generate it, or set one: gkm secrets:set ${LOGS_PASSWORD_KEY} '…' --stage ${stage}`);
+		this.stage = stage;
+		this.name = "LogsPasswordMissing";
 	}
 };
-const NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+/** Whether OpenObserve accepts `password` for its root user. */
+function isStrongLogsPassword(password) {
+	return password.length >= 8 && password.length <= 128 && /[a-z]/.test(password) && /[A-Z]/.test(password) && /\d/.test(password) && /[^A-Za-z0-9]/.test(password);
+}
 /**
-* Lowercase `[a-z0-9-]`, runs of anything else collapsed to one `-`: valid as
-* a Docker image path component, a Docker service name and a Dokploy name.
+* A root password: 192 random bits, with a fixed tail so every class
+* OpenObserve requires is present whatever the random part drew.
 */
-function slug(value) {
-	return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-}
-/** The namespace a workspace is in when it does not name one. */
-function defaultNamespace(workspaceName) {
-	return slug(kebabCase(workspaceName));
-}
-function deployIdentity(workspace, stage) {
-	const project = slug(workspace.name);
-	if (!project) throw new DeployProjectNameInvalid(workspace.name);
-	const fallback = defaultNamespace(workspace.name);
-	const namespace = workspace.deploy?.namespace ?? fallback;
-	if (!NAME.test(namespace)) throw new DeployNamespaceInvalid(namespace);
-	return {
-		namespace,
-		project,
-		stage,
-		key: `${namespace}/${project}`,
-		scope: namespace === fallback ? project : `${namespace}-${project}`
-	};
+function generateLogsPassword() {
+	return `${randomBytes(24).toString("base64url")}-Zo1`;
 }
 /**
-* The token a Dokploy project's description carries to say which identity
-* created it. A project with the right name and no marker belongs to someone
-* else, and a deploy never adopts it.
+* The stage's secrets with a generated root password, where it has none.
+* Pure, like `withGeneratedSecrets`: the caller keeps the result once the
+* run goes ahead.
 */
-function ownershipMarker(identity) {
-	return `gkm:${identity.key}`;
-}
-/** Whether a project description carries `identity`'s marker. */
-function isOwnedBy(description, identity) {
-	const marker = ownershipMarker(identity);
-	return (description ?? "").split(/\s+/).includes(marker);
-}
-/** Any `gkm:` marker a description carries — whoever's it is. */
-function markerOf(description) {
-	return (description ?? "").split(/\s+/).find((t) => t.startsWith("gkm:"));
-}
-/** What the Dokploy project is called. */
-function projectName(identity) {
-	return identity.scope;
+function withLogsPassword(secrets) {
+	if (secrets.custom?.["ZO_ROOT_USER_PASSWORD"]) return {
+		secrets,
+		generated: []
+	};
+	return {
+		secrets: {
+			...secrets,
+			custom: {
+				...secrets.custom,
+				[LOGS_PASSWORD_KEY]: generateLogsPassword()
+			},
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		},
+		generated: [LOGS_PASSWORD_KEY]
+	};
 }
 /**
-* The repository an app's image is pushed to, below the registry:
-* `<namespace>/<project>-<app>`.
+* `OTEL_EXPORTER_OTLP_HEADERS` signing in as `email`.
 *
-* The namespace is a path segment of its own so that a registry that maps
-* paths to owners (an organisation's packages, a Harbor project) can grant it
-* as one; the app is joined to the project so the two read as one name.
+* The variable's values are percent-decoded by the SDK (they follow the W3C
+* baggage format), so the space after `Basic` is written `%20`. Base64's own
+* `+`, `/` and `=` pass through decoding unchanged.
 */
-function imageName(identity, app) {
-	return `${identity.namespace}/${identity.project}-${slug(kebabCase(app))}`;
+function otlpHeaders(email, password) {
+	return `Authorization=Basic%20${Buffer.from(`${email}:${password}`).toString("base64")}`;
 }
-/** The full image ref an app is built, pushed and deployed as. */
-function imageRef(identity, app, registry, tag) {
-	const name = imageName(identity, app);
-	return registry ? `${registry.replace(/\/+$/, "")}/${name}:${tag}` : `${name}:${tag}`;
+/** The stack's OpenObserve for one stage. */
+function stackLogs(options) {
+	const { config, stage, local, custom } = options;
+	if (!local && !options.domain) throw new NoDomainForStage(stage);
+	const email = custom["ZO_ROOT_USER_EMAIL"] ?? (local ? options.localLogin?.email ?? "admin@gkm.localhost" : `admin@${options.domain}`);
+	const set = custom[LOGS_PASSWORD_KEY];
+	const password = set ?? (local ? options.localLogin?.password : void 0);
+	if (!password) throw new LogsPasswordMissing(stage);
+	if (!isStrongLogsPassword(password)) throw new LogsPasswordWeak(stage);
+	const host = config.public ? local ? `logs.${options.project}.localhost` : `logs.${options.domain}` : void 0;
+	const url = host ? `https://${host}${local && options.https !== 443 ? `:${options.https}` : ""}` : `http://localhost:${config.port}`;
+	return {
+		...config,
+		email,
+		password,
+		passwordFromSecrets: Boolean(set),
+		url,
+		...host ? { host } : {},
+		env: {
+			[LOGS_EMAIL_KEY]: email,
+			[LOGS_PASSWORD_KEY]: password,
+			ZO_DATA_DIR: "/data",
+			ZO_COMPACT_DATA_RETENTION_DAYS: String(config.retentionDays),
+			ZO_TELEMETRY: "false"
+		},
+		appEnv: {
+			OTEL_EXPORTER_OTLP_ENDPOINT: `http://${LOGS_SERVICE}:${LOGS_PORT}/api/${LOGS_ORG}`,
+			OTEL_EXPORTER_OTLP_HEADERS: otlpHeaders(email, password)
+		}
+	};
 }
 /**
-* What one application is called on the target.
-*
-* The same rule the constructs use, through the same `scopedName`, scoped by
-* the stage and the identity: the application beside
-* `production-kitchen-sink-database` is `production-kitchen-sink-api`. A
-* Dokploy application's name is also its Docker service name, which is unique
-* on the whole server, so the namespace has to be in it too — `acme`'s and
-* `globex`'s `shop` would otherwise both run `production-shop-api`.
-*
-* The app id is dropped when it repeats the project, so a project named for its
-* one application is `production-kitchen-sink` rather than
-* `production-kitchen-sink-kitchen-sink`.
+* OpenObserve's service. The image has no shell, `wget` or `curl`, so its
+* health check is its own binary asking the running server for its status —
+* which exits non-zero when nothing answers on its port.
 */
-function applicationName(identity, app) {
-	return slug(app) === identity.project ? `${identity.stage}-${identity.scope}` : scopedName([identity.stage, identity.scope], app);
+function logsService(logs) {
+	return {
+		image: OPENOBSERVE_IMAGE,
+		restart: "unless-stopped",
+		env_file: [{
+			path: `./${LOGS_SERVICE}.env`,
+			format: "raw"
+		}],
+		volumes: ["openobserve-data:/data"],
+		...logs.public ? {} : { ports: [`127.0.0.1:${logs.port}:${LOGS_PORT}`] },
+		healthcheck: {
+			test: [
+				"CMD",
+				"/openobserve",
+				"node",
+				"status"
+			],
+			interval: "10s",
+			timeout: "5s",
+			retries: 12,
+			start_period: "20s"
+		}
+	};
+}
+/** What `gkm compose` prints once the stack is up: how to open the logs. */
+function logsAccess(logs, ctx) {
+	const login = `login: ${logs.email}, password: ${ctx.local && !logs.passwordFromSecrets ? logs.password : `gkm secrets:show --stage ${ctx.stage} --reveal → ${LOGS_PASSWORD_KEY}`}`;
+	if (logs.public) return [`📜 Logs (OpenObserve): ${logs.url}  (${login})`, `     answered only for ${logs.public.allow.join(", ")}; every other address gets 403`];
+	return [
+		`📜 Logs (OpenObserve) on 127.0.0.1:${logs.port} — from your computer:`,
+		...ctx.local ? [`     on this machine, open http://localhost:${logs.port} directly; from another:`] : [],
+		`     ssh -N -L ${logs.port}:localhost:${logs.port} ${ctx.user}@${ctx.hostname}   (user and host are guesses: this machine's)`,
+		`     then open http://localhost:${logs.port}  (${login})`,
+		`⚠️  Docker-published ports bypass ufw, so OpenObserve is bound to 127.0.0.1 only — reach it through the tunnel, not by opening the port.`
+	];
 }
 //#endregion
-//#region src/secrets/keystore.ts
-/**
-* The keys that open each stage's encrypted secrets file, kept outside the
-* project in the CLI's home.
-*
-* Keys were kept at `~/.gkm/<folder>/<stage>.key`, named after the project
-* directory — so two checkouts in folders with the same name (`~/work/api`
-* and `~/oss/api`) shared one key, and the second `gkm secrets:init`
-* overwrote the first project's. They are now kept under the project's
-* identity, `<home>/keys/<namespace>/<project>/<stage>.key`, the same
-* `<namespace>/<project>` a deploy claims its Dokploy project by. A key still
-* at the old place is copied to the new one the first time it is read; the
-* old file stays, so an older CLI on the same machine keeps working.
-*/
-/** Key length for AES-256 encryption */
-const KEY_LENGTH = 32;
-/** A keystore project key that is not `<namespace>/<project>`. */
-var KeystoreProjectInvalid = class extends Error {
-	key;
-	constructor(key) {
-		super(`'${key}' is not a keystore project: expected '<namespace>/<project>' in lowercase letters, digits and '-', as deployIdentity() produces. Pass the workspace's identity key.`);
-		this.key = key;
-		this.name = "KeystoreProjectInvalid";
-	}
-};
-/** A stage has no key, here or at the place keys used to be kept. */
-var KeyNotFound = class extends Error {
-	stage;
-	project;
-	path;
-	constructor(stage, project, path) {
-		super(`Encryption key not found for stage "${stage}" in project "${project}". Expected key at: ${path}. Run \`gkm secrets:init --stage ${stage}\` to create one, or copy the stage's key there.`);
-		this.stage = stage;
-		this.project = project;
-		this.path = path;
-		this.name = "KeyNotFound";
-	}
-};
-const PROJECT_KEY = /^[a-z0-9]+(?:-[a-z0-9]+)*\/[a-z0-9]+(?:-[a-z0-9]+)*$/;
+//#region src/secrets/storage.ts
+var storage_exports = /* @__PURE__ */ __exportAll({
+	initStageSecrets: () => initStageSecrets,
+	maskPassword: () => maskPassword,
+	toEmbeddableSecrets: () => toEmbeddableSecrets,
+	validateEnvironmentVariables: () => validateEnvironmentVariables,
+	withCustomSecret: () => withCustomSecret
+});
 /**
-* The keystore key of a workspace: its deploy identity without the stage, so
-* a project's keys and its Dokploy project are named by the same thing.
+* Initialize an empty StageSecrets object for a stage.
 */
-function projectKey(workspace) {
-	return deployIdentity(workspace, "").key;
-}
-/** The keystore project of a loaded workspace. */
-function keystoreProject(workspace, home) {
-	const key = projectKey(workspace);
-	const unscoped = projectKey({ name: workspace.name });
+function initStageSecrets(stage) {
+	const now = (/* @__PURE__ */ new Date()).toISOString();
 	return {
-		key,
-		legacy: [.../* @__PURE__ */ new Set([folderName(workspace.root), workspace.name])].filter((name) => !!name),
-		...unscoped !== key ? { aliases: [unscoped] } : {},
-		...home ? { home } : {}
+		stage,
+		createdAt: now,
+		updatedAt: now,
+		services: {},
+		urls: {},
+		custom: {}
 	};
 }
 /**
-* Whether `name` stays inside the home it is joined to. A workspace name was
-* joined as is — `@acme/shop` is `~/.gkm/@acme/shop` — but never upwards.
-*/
-function isLegacyName(name) {
-	return name.split(/[\\/]/).every((part) => part !== ".." && part !== "");
-}
-/** The last segment of a path, as the old keystore named projects. */
-function folderName(path) {
-	const name = path.split(/[\\/]/).filter(Boolean).at(-1);
-	return name && name !== "." && name !== ".." ? name : void 0;
-}
-/**
-* Get the keystore directory for a project:
-* `<home>/keys/<namespace>/<project>`.
+* Convert StageSecrets to embeddable format (flat key-value pairs).
+* This is what gets encrypted and embedded in the bundle.
 */
-function getKeystoreDir(project) {
-	if (!PROJECT_KEY.test(project.key)) throw new KeystoreProjectInvalid(project.key);
-	const [namespace, name] = project.key.split("/");
-	return join(project.home ?? gkmHome(), "keys", namespace, name);
-}
-/** Get the path to a stage's encryption key. */
-function getKeyPath(stage, project) {
-	return join(getKeystoreDir(project), `${stage}.key`);
+function toEmbeddableSecrets(secrets) {
+	return {
+		...secrets.urls,
+		...secrets.custom,
+		...secrets.services.postgres && {
+			POSTGRES_USER: secrets.services.postgres.username,
+			POSTGRES_PASSWORD: secrets.services.postgres.password,
+			POSTGRES_DB: secrets.services.postgres.database ?? "app",
+			POSTGRES_HOST: secrets.services.postgres.host,
+			POSTGRES_PORT: String(secrets.services.postgres.port)
+		},
+		...secrets.services.redis && {
+			REDIS_PASSWORD: secrets.services.redis.password,
+			REDIS_HOST: secrets.services.redis.host,
+			REDIS_PORT: String(secrets.services.redis.port)
+		},
+		...secrets.services.minio && {
+			STORAGE_ACCESS_KEY_ID: secrets.services.minio.username,
+			STORAGE_SECRET_ACCESS_KEY: secrets.services.minio.password,
+			STORAGE_BUCKET: secrets.services.minio.bucket ?? "app",
+			STORAGE_REGION: "eu-west-1",
+			STORAGE_FORCE_PATH_STYLE: "true"
+		},
+		...secrets.services.mailpit && {
+			SMTP_HOST: secrets.services.mailpit.host,
+			SMTP_PORT: String(secrets.services.mailpit.port),
+			SMTP_USER: secrets.services.mailpit.username,
+			SMTP_PASS: secrets.services.mailpit.password,
+			SMTP_SECURE: "false",
+			MAIL_FROM: "noreply@localhost"
+		},
+		...secrets.services.localstack && {
+			AWS_ACCESS_KEY_ID: secrets.services.localstack.accessKeyId ?? secrets.services.localstack.username,
+			AWS_SECRET_ACCESS_KEY: secrets.services.localstack.password,
+			AWS_REGION: secrets.services.localstack.region ?? "us-east-1",
+			AWS_ENDPOINT_URL: `http://${secrets.services.localstack.host}:${secrets.services.localstack.port}`
+		}
+	};
+}
+/** The same secrets with one custom value set, and `updatedAt` moved on. */
+function withCustomSecret(secrets, key, value) {
+	return {
+		...secrets,
+		updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		custom: {
+			...secrets.custom,
+			[key]: value
+		}
+	};
 }
 /**
-* Where else a stage's key may be, most likely first: under an alias of the
-* project, then where keys were kept before they were keyed by identity —
-* under the configured home, then under `~/.gkm`, which is where every CLI
-* before `GKM_HOME` wrote.
+* Mask a password for display (show first 4 and last 2 chars).
 */
-function legacyKeyPaths(stage, project) {
-	const aliases = (project.aliases ?? []).map((key) => getKeyPath(stage, {
-		key,
-		home: project.home
-	}));
-	const homes = [.../* @__PURE__ */ new Set([project.home ?? gkmHome(), join(homedir(), ".gkm")])];
-	const names = (project.legacy ?? []).filter(isLegacyName);
-	return [...aliases, ...names.flatMap((name) => homes.map((home) => join(home, name, `${stage}.key`)))];
+function maskPassword(password) {
+	if (password.length <= 8) return "********";
+	return `${password.slice(0, 4)}${"*".repeat(password.length - 6)}${password.slice(-2)}`;
 }
 /**
-* Generate a new encryption key for a stage, stored owner-only at
-* `<home>/keys/<namespace>/<project>/<stage>.key`.
+* Validate that all required environment variables are present in secrets.
+*
+* @param requiredVars - Array of environment variable names required by the application
+* @param secrets - Stage secrets to validate against
+* @returns Validation result with missing and provided variables
+*
+* @example
+* ```typescript
+* const required = ['DATABASE_URL', 'API_KEY', 'JWT_SECRET'];
+* const secrets = await secretsStoreFor(workspace, 'production').then((s) => s.read('production'));
+* const result = validateEnvironmentVariables(required, secrets);
+*
+* if (!result.valid) {
+*   console.error(`Missing environment variables: ${result.missing.join(', ')}`);
+* }
+* ```
 */
-async function generateKey(stage, project, flag = "w") {
-	const keyDir = getKeystoreDir(project);
-	const keyPath = getKeyPath(stage, project);
-	await mkdir(keyDir, {
-		recursive: true,
-		mode: 448
-	});
-	const key = randomBytes(KEY_LENGTH).toString("hex");
-	await writeFile(keyPath, key, {
-		mode: 384,
-		encoding: "utf-8",
-		flag
-	});
-	await chmod(keyPath, 384);
-	return key;
+function validateEnvironmentVariables(requiredVars, secrets) {
+	const embeddable = toEmbeddableSecrets(secrets);
+	const availableVars = new Set(Object.keys(embeddable));
+	const missing = [];
+	const provided = [];
+	for (const varName of requiredVars) if (availableVars.has(varName)) provided.push(varName);
+	else missing.push(varName);
+	return {
+		valid: missing.length === 0,
+		missing: missing.sort(),
+		provided: provided.sort(),
+		required: [...requiredVars].sort()
+	};
 }
+//#endregion
+//#region src/deploy/identity.ts
 /**
-* Copy a key from where it used to be kept to where it is kept now.
+* Who a deploy is, on a target it shares with other workspaces.
 *
-* Copied, not moved: an older CLI on the same machine still reads the old
-* place. Exclusive, so two processes migrating at once cannot overwrite a key
-* one of them already put there.
+* A Dokploy server is one flat namespace of projects, images and Docker
+* service names. Deploys used to identify everything they made by the
+* workspace name alone, so two workspaces called `shop` — or `Shop` and
+* `shop` — deploying to one server landed in the same project, pushed over
+* each other's images and redeployed each other's applications. A
+* `DeployIdentity` is what a deploy names and claims its resources by instead.
 */
-async function migrateLegacyKey(stage, project) {
-	const legacy = legacyKeyPaths(stage, project).find((path) => existsSync(path));
-	if (!legacy) return false;
-	const keyPath = getKeyPath(stage, project);
-	await mkdir(getKeystoreDir(project), {
-		recursive: true,
-		mode: 448
-	});
-	try {
-		await copyFile(legacy, keyPath, constants.COPYFILE_EXCL);
-	} catch (error) {
-		if (error.code !== "EEXIST") throw error;
+/** A namespace that cannot be part of a Dokploy name or an image path. */
+var DeployNamespaceInvalid = class extends Error {
+	namespace;
+	constructor(namespace) {
+		super(`deploy.namespace '${namespace}' is not usable as a name: use lowercase letters, digits and single '-' between them (e.g. 'acme' or 'acme-platform') in gkm.config.ts.`);
+		this.namespace = namespace;
+		this.name = "DeployNamespaceInvalid";
 	}
-	await chmod(keyPath, 384);
-	return true;
-}
+};
+/** A workspace name with nothing a target can name a resource by. */
+var DeployProjectNameInvalid = class extends Error {
+	workspaceName;
+	constructor(workspaceName) {
+		super(`The workspace name '${workspaceName}' has no letters or digits to name deployed resources by. Set "name" in gkm.config.ts.`);
+		this.workspaceName = workspaceName;
+		this.name = "DeployProjectNameInvalid";
+	}
+};
+const NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 /**
-* Read an encryption key for a stage, or `null` when there is none — after
-* copying it over from where keys used to be kept, if it is still there.
+* Lowercase `[a-z0-9-]`, runs of anything else collapsed to one `-`: valid as
+* a Docker image path component, a Docker service name and a Dokploy name.
 */
-async function readKey(stage, project) {
-	const keyPath = getKeyPath(stage, project);
-	if (!existsSync(keyPath) && !await migrateLegacyKey(stage, project)) return null;
-	return (await readFile(keyPath, "utf-8")).trim();
+function slug(value) {
+	return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+/** The namespace a workspace is in when it does not name one. */
+function defaultNamespace(workspaceName) {
+	return slug(kebabCase(workspaceName));
+}
+function deployIdentity(workspace, stage) {
+	const project = slug(workspace.name);
+	if (!project) throw new DeployProjectNameInvalid(workspace.name);
+	const fallback = defaultNamespace(workspace.name);
+	const namespace = workspace.deploy?.namespace ?? fallback;
+	if (!NAME.test(namespace)) throw new DeployNamespaceInvalid(namespace);
+	return {
+		namespace,
+		project,
+		stage,
+		key: `${namespace}/${project}`,
+		scope: namespace === fallback ? project : `${namespace}-${project}`
+	};
 }
 /**
-* Read an encryption key for a stage, throwing {@link KeyNotFound} if there
-* is none.
+* The token a Dokploy project's description carries to say which identity
+* created it. A project with the right name and no marker belongs to someone
+* else, and a deploy never adopts it.
 */
-async function requireKey(stage, project) {
-	const key = await readKey(stage, project);
-	if (!key) throw new KeyNotFound(stage, project.key, getKeyPath(stage, project));
-	return key;
+function ownershipMarker(identity) {
+	return `gkm:${identity.key}`;
+}
+/** Whether a project description carries `identity`'s marker. */
+function isOwnedBy(description, identity) {
+	const marker = ownershipMarker(identity);
+	return (description ?? "").split(/\s+/).includes(marker);
+}
+/** Any `gkm:` marker a description carries — whoever's it is. */
+function markerOf(description) {
+	return (description ?? "").split(/\s+/).find((t) => t.startsWith("gkm:"));
+}
+/** What the Dokploy project is called. */
+function projectName(identity) {
+	return identity.scope;
 }
 /**
-* Get or create a key for a stage.
-* If the key already exists, it is returned. Otherwise, a new key is generated.
+* The repository an app's image is pushed to, below the registry:
+* `<namespace>/<project>-<app>`.
+*
+* The namespace is a path segment of its own so that a registry that maps
+* paths to owners (an organisation's packages, a Harbor project) can grant it
+* as one; the app is joined to the project so the two read as one name.
 */
-async function getOrCreateKey(stage, project) {
-	const existingKey = await readKey(stage, project);
-	if (existingKey) return existingKey;
-	try {
-		return await generateKey(stage, project, "wx");
-	} catch (error) {
-		if (error.code !== "EEXIST") throw error;
-		return requireKey(stage, project);
-	}
+function imageName(identity, app) {
+	return `${identity.namespace}/${identity.project}-${slug(kebabCase(app))}`;
+}
+/** The full image ref an app is built, pushed and deployed as. */
+function imageRef(identity, app, registry, tag) {
+	const name = imageName(identity, app);
+	return registry ? `${registry.replace(/\/+$/, "")}/${name}:${tag}` : `${name}:${tag}`;
 }
-//#endregion
-//#region src/secrets/file.ts
-/** Where the files live, relative to the project root. */
-const SECRETS_DIR = ".gkm/secrets";
-/** AES-256-GCM configuration */
-const ALGORITHM = "aes-256-gcm";
-const IV_LENGTH = 12;
 /**
-* A stage's secrets as an encrypted file on this machine:
-* `.gkm/secrets/<stage>.json`, with its key in the CLI's home at
-* `keys/<namespace>/<project>/<stage>.key`.
+* What one application is called on the target.
 *
-* The local stage's store, always — its secrets belong to the machine running
-* `gkm dev` — and a deployed stage's when `secrets.store` is `'file'`.
-*/
-var FileSecretsStore = class {
-	root;
-	name = "file";
-	project;
-	/**
-	* @param project - Whose keys: a workspace's `keystoreProject()`. Outside a
+* The same rule the constructs use, through the same `scopedName`, scoped by
+* the stage and the identity: the application beside
+* `production-kitchen-sink-database` is `production-kitchen-sink-api`. A
+* Dokploy application's name is also its Docker service name, which is unique
+* on the whole server, so the namespace has to be in it too — `acme`'s and
+* `globex`'s `shop` would otherwise both run `production-shop-api`.
+*
+* The app id is dropped when it repeats the project, so a project named for its
+* one application is `production-kitchen-sink` rather than
+* `production-kitchen-sink-kitchen-sink`.
+*/
+function applicationName(identity, app) {
+	return slug(app) === identity.project ? `${identity.stage}-${identity.scope}` : scopedName([identity.stage, identity.scope], app);
+}
+//#endregion
+//#region src/secrets/keystore.ts
+/**
+* The keys that open each stage's encrypted secrets file, kept outside the
+* project in the CLI's home.
+*
+* Keys were kept at `~/.gkm/<folder>/<stage>.key`, named after the project
+* directory — so two checkouts in folders with the same name (`~/work/api`
+* and `~/oss/api`) shared one key, and the second `gkm secrets:init`
+* overwrote the first project's. They are now kept under the project's
+* identity, `<home>/keys/<namespace>/<project>/<stage>.key`, the same
+* `<namespace>/<project>` a deploy claims its Dokploy project by. A key still
+* at the old place is copied to the new one the first time it is read; the
+* old file stays, so an older CLI on the same machine keeps working.
+*/
+/** Key length for AES-256 encryption */
+const KEY_LENGTH = 32;
+/** A keystore project key that is not `<namespace>/<project>`. */
+var KeystoreProjectInvalid = class extends Error {
+	key;
+	constructor(key) {
+		super(`'${key}' is not a keystore project: expected '<namespace>/<project>' in lowercase letters, digits and '-', as deployIdentity() produces. Pass the workspace's identity key.`);
+		this.key = key;
+		this.name = "KeystoreProjectInvalid";
+	}
+};
+/** A stage has no key, here or at the place keys used to be kept. */
+var KeyNotFound = class extends Error {
+	stage;
+	project;
+	path;
+	constructor(stage, project, path) {
+		super(`Encryption key not found for stage "${stage}" in project "${project}". Expected key at: ${path}. Run \`gkm secrets:init --stage ${stage}\` to create one, or copy the stage's key there.`);
+		this.stage = stage;
+		this.project = project;
+		this.path = path;
+		this.name = "KeyNotFound";
+	}
+};
+const PROJECT_KEY = /^[a-z0-9]+(?:-[a-z0-9]+)*\/[a-z0-9]+(?:-[a-z0-9]+)*$/;
+/**
+* The keystore key of a workspace: its deploy identity without the stage, so
+* a project's keys and its Dokploy project are named by the same thing.
+*/
+function projectKey(workspace) {
+	return deployIdentity(workspace, "").key;
+}
+/** The keystore project of a loaded workspace. */
+function keystoreProject(workspace, home) {
+	const key = projectKey(workspace);
+	const unscoped = projectKey({ name: workspace.name });
+	return {
+		key,
+		legacy: [.../* @__PURE__ */ new Set([folderName(workspace.root), workspace.name])].filter((name) => !!name),
+		...unscoped !== key ? { aliases: [unscoped] } : {},
+		...home ? { home } : {}
+	};
+}
+/**
+* Whether `name` stays inside the home it is joined to. A workspace name was
+* joined as is — `@acme/shop` is `~/.gkm/@acme/shop` — but never upwards.
+*/
+function isLegacyName(name) {
+	return name.split(/[\\/]/).every((part) => part !== ".." && part !== "");
+}
+/** The last segment of a path, as the old keystore named projects. */
+function folderName(path) {
+	const name = path.split(/[\\/]/).filter(Boolean).at(-1);
+	return name && name !== "." && name !== ".." ? name : void 0;
+}
+/**
+* Get the keystore directory for a project:
+* `<home>/keys/<namespace>/<project>`.
+*/
+function getKeystoreDir(project) {
+	if (!PROJECT_KEY.test(project.key)) throw new KeystoreProjectInvalid(project.key);
+	const [namespace, name] = project.key.split("/");
+	return join(project.home ?? gkmHome(), "keys", namespace, name);
+}
+/** Get the path to a stage's encryption key. */
+function getKeyPath(stage, project) {
+	return join(getKeystoreDir(project), `${stage}.key`);
+}
+/**
+* Where else a stage's key may be, most likely first: under an alias of the
+* project, then where keys were kept before they were keyed by identity —
+* under the configured home, then under `~/.gkm`, which is where every CLI
+* before `GKM_HOME` wrote.
+*/
+function legacyKeyPaths(stage, project) {
+	const aliases = (project.aliases ?? []).map((key) => getKeyPath(stage, {
+		key,
+		home: project.home
+	}));
+	const homes = [.../* @__PURE__ */ new Set([project.home ?? gkmHome(), join(homedir(), ".gkm")])];
+	const names = (project.legacy ?? []).filter(isLegacyName);
+	return [...aliases, ...names.flatMap((name) => homes.map((home) => join(home, name, `${stage}.key`)))];
+}
+/**
+* Generate a new encryption key for a stage, stored owner-only at
+* `<home>/keys/<namespace>/<project>/<stage>.key`.
+*/
+async function generateKey(stage, project, flag = "w") {
+	const keyDir = getKeystoreDir(project);
+	const keyPath = getKeyPath(stage, project);
+	await mkdir(keyDir, {
+		recursive: true,
+		mode: 448
+	});
+	const key = randomBytes(KEY_LENGTH).toString("hex");
+	await writeFile(keyPath, key, {
+		mode: 384,
+		encoding: "utf-8",
+		flag
+	});
+	await chmod(keyPath, 384);
+	return key;
+}
+/**
+* Copy a key from where it used to be kept to where it is kept now.
+*
+* Copied, not moved: an older CLI on the same machine still reads the old
+* place. Exclusive, so two processes migrating at once cannot overwrite a key
+* one of them already put there.
+*/
+async function migrateLegacyKey(stage, project) {
+	const legacy = legacyKeyPaths(stage, project).find((path) => existsSync(path));
+	if (!legacy) return false;
+	const keyPath = getKeyPath(stage, project);
+	await mkdir(getKeystoreDir(project), {
+		recursive: true,
+		mode: 448
+	});
+	try {
+		await copyFile(legacy, keyPath, constants.COPYFILE_EXCL);
+	} catch (error) {
+		if (error.code !== "EEXIST") throw error;
+	}
+	await chmod(keyPath, 384);
+	return true;
+}
+/**
+* Read an encryption key for a stage, or `null` when there is none — after
+* copying it over from where keys used to be kept, if it is still there.
+*/
+async function readKey(stage, project) {
+	const keyPath = getKeyPath(stage, project);
+	if (!existsSync(keyPath) && !await migrateLegacyKey(stage, project)) return null;
+	return (await readFile(keyPath, "utf-8")).trim();
+}
+/**
+* Read an encryption key for a stage, throwing {@link KeyNotFound} if there
+* is none.
+*/
+async function requireKey(stage, project) {
+	const key = await readKey(stage, project);
+	if (!key) throw new KeyNotFound(stage, project.key, getKeyPath(stage, project));
+	return key;
+}
+/**
+* Get or create a key for a stage.
+* If the key already exists, it is returned. Otherwise, a new key is generated.
+*/
+async function getOrCreateKey(stage, project) {
+	const existingKey = await readKey(stage, project);
+	if (existingKey) return existingKey;
+	try {
+		return await generateKey(stage, project, "wx");
+	} catch (error) {
+		if (error.code !== "EEXIST") throw error;
+		return requireKey(stage, project);
+	}
+}
+//#endregion
+//#region src/secrets/file.ts
+/** Where the files live, relative to the project root. */
+const SECRETS_DIR = ".gkm/secrets";
+/** AES-256-GCM configuration */
+const ALGORITHM = "aes-256-gcm";
+const IV_LENGTH = 12;
+/**
+* A stage's secrets as an encrypted file on this machine:
+* `.gkm/secrets/<stage>.json`, with its key in the CLI's home at
+* `keys/<namespace>/<project>/<stage>.key`.
+*
+* The local stage's store, always — its secrets belong to the machine running
+* `gkm dev` — and a deployed stage's when `secrets.store` is `'file'`.
+*/
+var FileSecretsStore = class {
+	root;
+	name = "file";
+	project;
+	/**
+	* @param project - Whose keys: a workspace's `keystoreProject()`. Outside a
 	*   workspace there is no config to name the project, so it is named the
 	*   way a workspace without `name` is — its package name, else its folder.
 	*/
@@ -850,7 +1119,8 @@ const DEFAULT_IMAGES = {
 	"redis-http": "hiett/serverless-redis-http:latest",
 	rabbitmq: "rabbitmq:4-management-alpine",
 	localstack: "floci/floci:2.1.0",
-	caddy: "caddy:2-alpine"
+	caddy: "caddy:2-alpine",
+	openobserve: OPENOBSERVE_IMAGE
 };
 /**
 * The ports each container listens on.
@@ -914,6 +1184,12 @@ const PORTS = {
 		key: "caddy",
 		inside: 443,
 		label: "https edge"
+	}],
+	openobserve: [{
+		key: "openobserve",
+		inside: LOGS_PORT,
+		label: "openobserve",
+		web: true
 	}]
 };
 /** The port key — and container name, for an image — of an API's fake. */
@@ -985,50 +1261,630 @@ function volumeOf(container) {
 		redis: "redis-data",
 		rabbitmq: "rabbitmq-data",
 		localstack: "localstack-data",
-		caddy: "caddy-data"
+		caddy: "caddy-data",
+		openobserve: "openobserve-data"
 	}[container];
 }
 //#endregion
-//#region src/reconcile/emulator.ts
+//#region src/telemetry/edges.ts
+/**
+* Which processes use a `Telemetry` node — read off the manifest's edges.
+*
+* A process uses telemetry when its own declaration names the node: a
+* surface's `telemetry`, a worker's. The server the build generates for a
+* surface whose endpoints a glob finds also runs the workers' crons and
+* consumers under `gkm dev`, and is handed their edges' keys by `appEnvKeys`,
+* so a worker's edge counts for it too — the same rule, read the same way.
+*
+* A site's edge is recorded and never followed here: a site is handed none of
+* the node's keys (see `PUBLIC.telemetry`).
+*/
+/** The `OTEL_*` keys a `Telemetry` node provides. */
+const TELEMETRY_ENV_KEYS = TELEMETRY_KEYS;
+/** Whether `key` is one of the keys a `Telemetry` node provides. */
+function isTelemetryKey(key) {
+	return TELEMETRY_ENV_KEYS.includes(key);
+}
+/** The node a declaration's `telemetry` edge names, when it names one. */
+function nodeOf(manifest, id) {
+	if (!id) return void 0;
+	const node = manifest[id];
+	return node?.kind === "telemetry" ? node : void 0;
+}
+/**
+* The `Telemetry` node the process for `id` — a surface or a worker, by
+* construct id — emits through, or undefined when it has no edge to one.
+*/
+function telemetryOf(manifest, id) {
+	const declaration = manifest[id];
+	if (!declaration) return void 0;
+	if (declaration.kind === "worker") return nodeOf(manifest, declaration.telemetry);
+	if (declaration.kind !== "rest-api") return void 0;
+	const own = nodeOf(manifest, declaration.telemetry);
+	if (own) return own;
+	if (declaration.endpoints.length > 0) return void 0;
+	for (const other of Object.values(manifest)) {
+		if (other.kind !== "worker") continue;
+		const node = nodeOf(manifest, other.telemetry);
+		if (node) return node;
+	}
+}
 /**
-* The AWS emulator (floci, LocalStack-compatible) the `sns` backend runs on
-* locally — the facts the compose file, the env writer and the applier must
-* agree on.
-*
-* The emulator has one account and answers with deterministic ARNs and queue
-* URLs, which is what lets a connection string be composed before the topic
-* or queue it names has been created.
+* The `Telemetry` node the app `appName` emits through — its surface's, or
+* undefined for a site, an app without one, or one with no edge.
 */
-/** The emulator's single account. */
-const EMULATOR_ACCOUNT = "000000000000";
-const EMULATOR_REGION = "us-east-1";
+function appTelemetry(manifest, appName) {
+	const id = Object.entries(manifest).find(([id, d]) => d.kind === "rest-api" && appKey(id) === appName)?.[0];
+	return id ? telemetryOf(manifest, id) : void 0;
+}
+/** Whether any process in the manifest emits through a `Telemetry` node. */
+function usesTelemetry(manifest) {
+	return Object.entries(manifest).some(([id, d]) => (d.kind === "rest-api" || d.kind === "worker") && telemetryOf(manifest, id) !== void 0);
+}
 /**
-* The emulator's access key id. The `LSIA` prefix is what LocalStack required
-* on issued keys, and LocalStack reads the account from the id — so it is
-* fixed, where the secret key beside it is generated per machine (see
-* `localCredentials.ts`). Floci does not care; keeping it means a project
-* that pins the old image still works.
+* One process's share of the telemetry keys a stage resolved: all of them,
+* named for the process, when it has an edge to the node — and none
+* otherwise.
+*
+* `env` is everything else the process is handed; its `OTEL_*` keys are
+* replaced, never merged, so a process without the edge cannot inherit them.
 */
-const EMULATOR_ACCESS_KEY_ID = "LSIAQAAAAAAVNCBMPNSG";
-/** The emulator's address from the host, on the port it was published on. */
-function emulatorEndpoint(port) {
-	return `http://localhost:${port}`;
+function scopeTelemetryEnv(env, options) {
+	const scoped = Object.fromEntries(Object.entries(env).filter(([key]) => !isTelemetryKey(key)));
+	if (!options.uses || !options.telemetry) return scoped;
+	const values = Object.fromEntries(Object.entries(options.telemetry).filter(([key]) => isTelemetryKey(key)));
+	if (!values.OTEL_EXPORTER_OTLP_ENDPOINT) return scoped;
+	return {
+		...scoped,
+		...values,
+		OTEL_SERVICE_NAME: options.serviceName
+	};
 }
-function emulatorTopicArn(name) {
-	return `arn:aws:sns:${EMULATOR_REGION}:${EMULATOR_ACCOUNT}:${name}`;
+/** Whether the site `siteId` has an edge to a `Telemetry` node. */
+function siteUsesTelemetry(manifest, siteId) {
+	const site = manifest[siteId];
+	return site?.kind === "site" && nodeOf(manifest, site.telemetry) !== void 0;
 }
-function emulatorQueueUrl(name, port) {
-	return `${emulatorEndpoint(port)}/${EMULATOR_ACCOUNT}/${name}`;
+/**
+* Whether the client of the surface `surfaceId` propagates trace context:
+* when a site that calls it has an edge to a `Telemetry` node. One client
+* serves every site that calls the surface on the host, so one with the
+* edge turns it on; a site's image generates its own, from its own edge.
+*/
+function surfaceClientTraced(manifest, surfaceId) {
+	return Object.entries(manifest).some(([id, d]) => d.kind === "site" && siteUsesTelemetry(manifest, id) && d.dependencies.some((edge) => edge.target === surfaceId));
+}
+/**
+* Whether the site app `appName`'s clients propagate trace context, and at
+* what rate: when the site has an edge to a `Telemetry` construct, at the
+* stage's sample rate — a public value, every trace locally — and not at all
+* for a stage that sends no telemetry.
+*/
+function siteClientTelemetry(manifest, appName, workspace, stage) {
+	const id = Object.entries(manifest).find(([id, d]) => d.kind === "site" && appKey(id) === appName)?.[0];
+	if (!id || !siteUsesTelemetry(manifest, id)) return void 0;
+	const sampleRate = stageSampleRate(workspace.deploy?.telemetry, stage ?? workspace.stages.local, !stage || stage === workspace.stages.local);
+	return sampleRate === void 0 ? void 0 : { sampleRate };
 }
 //#endregion
-//#region src/reconcile/compose.ts
+//#region src/reconcile/caddyfile.ts
 /**
-* The compose document a plan implies.
-*
-* The third declaration of the same containers disappears here: today a
-* `services: ['postgres','minio']` block is kept in step with the code by hand,
-* which is the triplication this design exists to remove, in the one place you
-* touch every day. A `database` implies Postgres; the list is derived.
+* The kinds the edge serves.
+*
+* Everything that owns a *public address*. Deployed, each of these has a real
+* hostname and a certificate, so this is what makes the local shape the same
+* one rather than a near-enough one — and the application is indifferent
+* either way, because it reads whichever address was injected and never
+* composes one.
+*
+* Adding a kind here is the whole of adding it to the edge.
+*/
+const EDGE_KINDS = {
+	"file-server": true,
+	"rest-api": true,
+	site: true
+};
+/**
+* How the edge reaches the host, from inside its container.
+*
+* A surface and a site are served by processes `gkm dev` starts on the host,
+* not by containers — so the edge has to leave Docker's network to reach them.
+* Docker Desktop resolves this name already; on Linux the compose definition
+* maps it to the host gateway.
+*/
+const HOST_GATEWAY = "host.docker.internal";
+/**
+* The suffix every local host shares.
+*
+* `.localhost` rather than a made-up TLD because it resolves to loopback
+* without touching `/etc/hosts` — macOS and systemd-resolved both answer for
+* subdomains of it, and Caddy issues internal certificates for it by default.
+*/
+const LOCAL_TLD = "localhost";
+/**
+* The sites a plan implies, one per file server.
+*
+* The leading label is the *server's* stage-scoped name rather than the
+* bucket's, which is the difference that matters: two servers over one bucket
+* are a legitimate arrangement — two cache behaviours, one origin — and naming
+* the host after the bucket would make them collide.
+*/
+function sitesFor(plan, project, addresses = {}) {
+	const byId = new Map(plan.resources.map((r) => [r.id, r]));
+	const sites = [];
+	for (const resource of plan.resources) {
+		if (!EDGE_KINDS[resource.kind]) continue;
+		const host = hostFor(resource, project);
+		if (resource.kind === "file-server") {
+			const origin = resource.of ? byId.get(resource.of) : void 0;
+			if (!origin) continue;
+			sites.push({
+				host,
+				upstream: "http://minio:9000",
+				rewrite: `/${origin.name}{uri}`
+			});
+			continue;
+		}
+		const address = addresses[resource.id];
+		if (!address) continue;
+		const port = portOf(address);
+		if (!port) continue;
+		sites.push({
+			host,
+			upstream: `http://${HOST_GATEWAY}:${port}`
+		});
+	}
+	return sites;
+}
+/** The port a local address answers on, defaulting by scheme. */
+function portOf(address) {
+	try {
+		const { port, protocol } = new URL(address);
+		return port || (protocol === "https:" ? "443" : "80");
+	} catch {
+		return;
+	}
+}
+/**
+* Where one file server answers, including the stage its name carries.
+*
+* The project is a label rather than a decoration: it is what keeps two
+* checkouts from answering on one address. Omitted when there is no project to
+* name, because an empty label makes `uploads..localhost` — a host nothing
+* resolves and no certificate can be issued for.
+*/
+function hostFor(resource, project) {
+	return [
+		resource.root && project ? stageOf(resource) : labelOf(resource),
+		project,
+		LOCAL_TLD
+	].filter(Boolean).join(".");
+}
+/**
+* A resource's own label: its `subdomain` where it declared one — the label a
+* deploy uses too — with the stage it carries kept, so `gkm test` and `gkm dev`
+* still answer on different hosts.
+*/
+function labelOf(resource) {
+	if (!resource.subdomain) return resource.name;
+	const stage = stageOf(resource);
+	return stage ? `${resource.subdomain}-${stage}` : resource.subdomain;
+}
+/** The stage a resource's name carries, or nothing for the local stage's. */
+function stageOf(resource) {
+	const base = resource.id.toLowerCase();
+	return resource.name === base ? void 0 : resource.name.slice(base.length + 1);
+}
+/**
+* The static root config, which only ever imports.
+*
+* Written once and identical for every stage, because the *sites* are what
+* differ and they live in their own files. That split is not tidiness: one
+* container serves every stage — the same way one Postgres holds `orders` and
+* `orders_test` — so a single Caddyfile would mean `gkm test` deleting the
+* routes `gkm dev` is serving, and each command silently breaking the other.
+*/
+function caddyfileRoot() {
+	return `${GENERATED}
+{
+	# No ACME, no public DNS: the CA is local and so are the names.
+	local_certs
+	auto_https disable_redirects
+}
+
+# One file per stage, so two stages share this edge the way they already share
+# one Postgres and one MinIO.
+import /etc/caddy/sites/*.caddy
+`;
+}
+/**
+* One stage's sites, as the file imported above.
+*
+* `rewrite` rather than a path prefix on the address: the bucket is the
+* origin's business, and the client asks for the key it stored.
+*
+* `header_up Host {upstream_hostport}` matters more than it looks. MinIO routes
+* and signs on the Host header, so forwarding the requested hostname would make
+* it look for a bucket named after the domain.
+*/
+function toCaddyfile(sites) {
+	if (sites.length === 0) return `${GENERATED}
+# No file server is declared in this stage, so it routes nothing.
+`;
+	const blocks = sites.map(({ host, upstream, rewrite }) => `
+https://${host} {
+	tls internal
+
+	reverse_proxy ${upstream} {${rewrite ? `
+		rewrite ${rewrite}
+		# MinIO routes and signs on the Host header, so forwarding the requested
+		# hostname would make it look for a bucket named after the domain.
+		header_up Host {upstream_hostport}` : `
+		# The application reads whatever address was injected, so it has to see
+		# the one a caller used — that is what makes a redirect, a cookie domain
+		# and a generated link point back here rather than at the upstream.
+		header_up Host {host}
+		header_up X-Forwarded-Proto {scheme}`}
+	}
+}`);
+	return `${GENERATED}${blocks.join("\n")}\n`;
+}
+const GENERATED = `# Generated by gkm from the construct manifest — do not edit.
+#
+# One host per declared file server, in front of the object store that holds its
+# objects. This is the shape a file server has deployed — a domain serving a
+# bucket — which MinIO alone cannot produce: its virtual-host mode reads the
+# leading label as the bucket name.
+#
+# Certificates come from Caddy's own CA. "gkm dev" and "gkm test" export its
+# root and point Node at it, so nothing has to be installed to use these URLs
+# from code; a browser needs the root trusted once.
+`;
+//#endregion
+//#region src/reconcile/plan.ts
+/**
+* The reconcile plan — what a manifest wants to exist, for one stage.
+*
+* Pure. Turning the plan into running containers and provisioned resources is
+* the applier's job; deciding *what* should exist is this, so the decisions can
+* be asserted as data rather than by starting Docker.
+*
+* One plan serves every stage. `gkm dev` reconciles `development` and `gkm test`
+* reconciles `test`; they differ only in what the resources are called, never in
+* what infrastructure exists. Roles are cluster-scoped in Postgres while grants
+* are per-object, so one container and one role pair serve both.
+*/
+/**
+* Which container serves a kind.
+*
+* Derived kinds map to the same container as their parent — a schema tenant
+* lives in its parent's Postgres — so the set is deduplicated rather than
+* counted.
+*/
+const CONTAINERS = {
+	database: "postgres",
+	"database-reader": "postgres",
+	"database-schema": "postgres",
+	objects: "minio",
+	"file-server": "caddy",
+	email: "mailpit"
+};
+/**
+* The container a cache backend needs locally.
+*
+* Each one matches the protocol its deployed form speaks, which is the property
+* worth having: a cache that behaves differently in the two places is worse than
+* a slower one.
+*
+* `db` is deliberately absent, the same way `pgboss` is absent from
+* `EVENT_CONTAINERS`: the cache is a table in a database the manifest already
+* declares, so mapping it here would start a container for a project that needs
+* none.
+*/
+const CACHE_CONTAINERS = {
+	upstash: "redis-http",
+	elasticache: "redis",
+	redis: "redis"
+};
+/**
+* Kinds that resolve a value without anything running.
+*
+* A secret is the case: it has no address, so there is nothing to start and
+* nothing to connect to — but it still appears in the plan, because the target
+* still has to resolve it.
+*/
+const CONTAINERLESS = {
+	secret: true,
+	credential: true,
+	encryption: true,
+	"rest-api": true,
+	site: true,
+	"mobile-app": true,
+	"external-api": true,
+	telemetry: true
+};
+/** The container that collects telemetry locally, and serves its UI. */
+const TELEMETRY_CONTAINER = "openobserve";
+/**
+* Containers that cannot run alone.
+*
+* The one case is the cache: `serverless-redis-http` is a proxy and needs the
+* Redis it proxies. Kept here rather than in the compose definition so the plan
+* -- which is what decides what must be running -- still names everything.
+*/
+const REQUIRES = { "redis-http": ["redis"] };
+/**
+* The role each kind's one key plays, where it is not a URL.
+*
+* The twin of `ProvidesByKind` in `@geekmidas/manifest`: that is what a
+* construct declares, this is what the local target resolves, and both derive
+* the key from the same `provideKey` so they cannot disagree.
+*/
+const ROLES = {
+	queue: "publisherConnectionString",
+	topic: "publisherConnectionString",
+	credential: "credentials",
+	"mobile-app": "scheme"
+};
+/** The kinds whose container is the events backend's rather than their own. */
+const EVENT_KINDS = {
+	queue: true,
+	topic: true
+};
+/**
+* Which kinds provision something *inside* their container.
+*
+* A database creates a database, a bucket creates a bucket; mail creates
+* nothing — Mailpit accepts whatever is sent to it and has no per-stage object
+* to name. Both still appear in the plan, because both still resolve a URL; the
+* flag is the difference between "must be running" and "must be created".
+*/
+const PROVISIONS = {
+	database: true,
+	"database-reader": true,
+	"database-schema": true,
+	objects: true,
+	cache: true,
+	"file-server": true
+};
+/**
+* The container each events backend needs, where it needs one of its own.
+*
+* `pgboss` is deliberately absent rather than mapped to `postgres`: it is a
+* schema tenant in a database the manifest already declares, so mapping it here
+* would start a Postgres for a project that declared no database at all.
+*
+* This one comes from config rather than from a declaration because there are
+* no `topic` or `queue` kinds yet. When they land the mapping moves to
+* {@link CONTAINERS} keyed by kind, and this constant goes with them.
+*/
+const EVENT_CONTAINERS = {
+	sns: "localstack",
+	rabbitmq: "rabbitmq"
+};
+/** The backend a project gets when it declares queues or topics and says nothing. */
+const DEFAULT_EVENTS = "pgboss";
+/**
+* How a resource of each kind separates its stage suffix.
+*
+* Postgres identifiers are snake_case and a hyphen would need quoting
+* everywhere; buckets and queues are kebab and disallow underscores in some
+* providers. The suffix is the same word either way.
+*/
+const SEPARATORS = {
+	database: "_",
+	"database-reader": "_",
+	"database-schema": "_",
+	objects: "-"
+};
+/**
+* The stage-scoped name for a resource.
+*
+* The local stage carries no suffix, so `gkm dev` keeps using `orders` and a
+* developer's psql history, saved connections, and muscle memory survive a
+* change of stage name. Every other stage is suffixed.
+*/
+function resourceName(id, kind, stage, localStage) {
+	const base = id.toLowerCase();
+	if (stage === localStage) return base;
+	return `${base}${SEPARATORS[kind] ?? "-"}${stage}`;
+}
+/**
+* The container a kind needs, or `undefined` if it needs none.
+*
+* Queues and topics have no container of their own — they live in whichever
+* broker the project selected, which is why the backend is an argument here
+* rather than a second pass that adds containers after the fact.
+*/
+function containerFor(kind, events = DEFAULT_EVENTS, cache = DEFAULT_CACHE.aws, derived = false, edge = true) {
+	if (EVENT_KINDS[kind]) return EVENT_CONTAINERS[events] ?? CONTAINERS.database;
+	if (kind === "file-server") return edge ? "caddy" : CONTAINERS.objects;
+	if (kind === "cache") {
+		if (derived && !holdsEveryCache(cache)) return CONTAINERS.database;
+		return CACHE_CONTAINERS[cache] ?? CONTAINERS.database;
+	}
+	return CONTAINERS[kind];
+}
+/**
+* Build the plan for a manifest and stage.
+*
+* `order` is the caller's provisioning order — parents before children — which
+* `provisionOrder` produces from the manifest. Passing it in keeps this
+* function free of the traversal and makes the ordering assertable on its own.
+*/
+function planFor(manifest, stage, order, options = {}) {
+	const containers = /* @__PURE__ */ new Set();
+	const resources = [];
+	const fakes = {};
+	const events = options.events ?? "pgboss";
+	const cache = options.cache ?? DEFAULT_CACHE.aws;
+	for (const id of order) {
+		const declaration = manifest[id];
+		if (!declaration) continue;
+		const local = declaration.kind === "external-api" ? options.fakes?.[id] : void 0;
+		const fake = local && {
+			key: fakeKey(id),
+			...local
+		};
+		if (fake) fakes[fake.key] = {
+			id,
+			...fake.image ? {
+				image: fake.image,
+				port: fake.port
+			} : {}
+		};
+		const detached = declaration.kind === "cache" && holdsEveryCache(cache);
+		const container = fake?.image ? fake.key : declaration.kind === "telemetry" ? usesTelemetry(manifest) ? TELEMETRY_CONTAINER : void 0 : containerFor(declaration.kind, events, cache, "of" in declaration && typeof declaration.of === "string", options.edge !== false);
+		if (!container && !CONTAINERLESS[declaration.kind]) continue;
+		if (container) {
+			containers.add(container);
+			for (const required of REQUIRES[container] ?? []) containers.add(required);
+		}
+		resources.push({
+			id,
+			kind: declaration.kind,
+			...container ? { container } : {},
+			name: resourceName(id, declaration.kind, stage, options.localStage),
+			envKey: providedKeyFor(id, declaration.kind, ROLES[declaration.kind] ?? "url"),
+			provisions: PROVISIONS[declaration.kind] === true,
+			...declaration.kind === "rest-api" ? { callers: dependentsOf(manifest, id) } : {},
+			...declaration.kind === "site" ? { publicEnv: publicEnvFor(declaration, manifest) } : {},
+			...declaration.kind === "mobile-app" ? {
+				publicEnv: publicEnvFor(declaration, manifest),
+				...declaration.scheme ? { scheme: declaration.scheme } : {}
+			} : {},
+			...declaration.kind === "file-server" && declaration.open?.length ? { open: declaration.open } : {},
+			...(declaration.kind === "rest-api" || declaration.kind === "site") && declaration.subdomain ? { subdomain: declaration.subdomain } : {},
+			...fake ? { fake: {
+				key: fake.key,
+				credentials: fake.credentials
+			} } : {},
+			...declaration.kind === "external-api" && !fake ? { url: declaration.url } : {},
+			..."of" in declaration && !detached ? { of: declaration.of } : {},
+			..."schema" in declaration && declaration.schema ? { schema: declaration.schema } : {},
+			..."version" in declaration && declaration.version ? { version: declaration.version } : {},
+			..."roles" in declaration && declaration.roles === false ? { roles: false } : {},
+			..."table" in declaration && declaration.table && !detached ? { table: declaration.table } : {}
+		});
+	}
+	if (options.edge !== false && resources.some((r) => EDGE_KINDS[r.kind] === true)) containers.add("caddy");
+	for (const extra of options.extraContainers ?? []) containers.add(extra);
+	if (events === "pgboss" && resources.some((r) => EVENT_KINDS[r.kind]) && !resources.some((r) => r.kind === "database")) throw new PgBossNeedsDatabase(resources.filter((r) => EVENT_KINDS[r.kind]).map((r) => r.id));
+	if (cache === "db") {
+		const placeless = resources.filter((r) => r.kind === "cache" && !r.of);
+		if (placeless.length > 0) {
+			const databases = resources.filter((r) => r.kind === "database");
+			const [only] = databases;
+			if (!only) throw new CacheNeedsDatabase(resources.filter((r) => r.kind === "cache").map((r) => r.id));
+			if (databases.length > 1) throw new CacheIsAmbiguous(placeless.map((r) => r.id), databases.map((r) => r.id));
+			for (const resource of placeless) resource.of = only.id;
+		}
+	}
+	const sites = resources.filter((r) => r.kind === "site");
+	const root = rootSite(sites.map((r) => {
+		const declared = manifest[r.id];
+		return {
+			name: appKey(r.id),
+			...declared?.kind === "site" && declared.root ? { root: true } : {}
+		};
+	}));
+	for (const site of sites) if (appKey(site.id) === root) site.root = true;
+	const workerBroker = events === "pgboss" && Object.values(manifest).some((d) => d?.kind === "worker") && resources.some((r) => r.kind === "database");
+	return {
+		stage,
+		events,
+		cache,
+		containers: [...containers],
+		resources,
+		...Object.keys(fakes).length ? { fakes } : {},
+		...workerBroker ? { workerBroker: true } : {}
+	};
+}
+/**
+* Queues or topics were declared with pg-boss and no database to hold them.
+*
+* Not a reconcile failure but a manifest one: the fix is a line of application
+* code either way — declare a database, or select a backend that brings its own
+* broker.
+*/
+var CacheNeedsDatabase = class extends Error {
+	ids;
+	constructor(ids) {
+		super(`A cache backed by the database needs a declared database, and none was declared, and on this deploy target that is where a cache lives. Declare one. Caches affected: ${ids.join(", ")}.`);
+		this.ids = ids;
+		this.name = "CacheNeedsDatabase";
+	}
+};
+/**
+* A `'db'` cache — a server target's default — in an app that declares more
+* than one database.
+*
+* The target says *a* database and the graph offers several, so there is no
+* answer to give — and the wrong kind of failure would be to pick one, since a
+* cache silently landing in the wrong database is a bug that surfaces as
+* missing rows much later. The fix is a stronger statement in application code:
+* `orders.cache('Sessions')` names the database, which is a fact about the
+* application rather than a deployment choice.
+*/
+var CacheIsAmbiguous = class extends Error {
+	ids;
+	databases;
+	constructor(ids, databases) {
+		super(`A cache backed by the database needs to know which one, and this app declares ${databases.length}: ${databases.join(", ")}. Declare the cache from its database — e.g. ${databases[0]}.cache('Sessions') — rather than as a bare new Cache(). Caches affected: ${ids.join(", ")}.`);
+		this.ids = ids;
+		this.databases = databases;
+		this.name = "CacheIsAmbiguous";
+	}
+};
+var PgBossNeedsDatabase = class extends Error {
+	ids;
+	constructor(ids) {
+		super(`pg-boss keeps its queues in a declared database, and none was declared. Declare one: on this deploy target, events are carried by pg-boss. Queues and topics affected: ${ids.join(", ")}.`);
+		this.ids = ids;
+		this.name = "PgBossNeedsDatabase";
+	}
+};
+//#endregion
+//#region src/reconcile/emulator.ts
+/**
+* The AWS emulator (floci, LocalStack-compatible) the `sns` backend runs on
+* locally — the facts the compose file, the env writer and the applier must
+* agree on.
+*
+* The emulator has one account and answers with deterministic ARNs and queue
+* URLs, which is what lets a connection string be composed before the topic
+* or queue it names has been created.
+*/
+/** The emulator's single account. */
+const EMULATOR_ACCOUNT = "000000000000";
+const EMULATOR_REGION = "us-east-1";
+/**
+* The emulator's access key id. The `LSIA` prefix is what LocalStack required
+* on issued keys, and LocalStack reads the account from the id — so it is
+* fixed, where the secret key beside it is generated per machine (see
+* `localCredentials.ts`). Floci does not care; keeping it means a project
+* that pins the old image still works.
+*/
+const EMULATOR_ACCESS_KEY_ID = "LSIAQAAAAAAVNCBMPNSG";
+/** The emulator's address from the host, on the port it was published on. */
+function emulatorEndpoint(port) {
+	return `http://localhost:${port}`;
+}
+function emulatorTopicArn(name) {
+	return `arn:aws:sns:${EMULATOR_REGION}:${EMULATOR_ACCOUNT}:${name}`;
+}
+function emulatorQueueUrl(name, port) {
+	return `${emulatorEndpoint(port)}/${EMULATOR_ACCOUNT}/${name}`;
+}
+//#endregion
+//#region src/reconcile/compose.ts
+/**
+* The compose document a plan implies.
+*
+* The third declaration of the same containers disappears here: today a
+* `services: ['postgres','minio']` block is kept in step with the code by hand,
+* which is the triplication this design exists to remove, in the one place you
+* touch every day. A `database` implies Postgres; the list is derived.
 *
 * Returns an object rather than a string for the same reason `plan` is pure —
 * what should exist is asserted as data, and turning it into YAML is one line at
@@ -1271,6 +2127,34 @@ function define(container, image, published, credentials) {
 				start_period: "10s"
 			}
 		};
+		case "openobserve": {
+			const login = credentials.logs;
+			return {
+				image,
+				restart: "unless-stopped",
+				ports: published,
+				environment: {
+					[LOGS_EMAIL_KEY]: login.email,
+					[LOGS_PASSWORD_KEY]: login.password,
+					ZO_DATA_DIR: "/data",
+					ZO_COMPACT_DATA_RETENTION_DAYS: String(30),
+					ZO_TELEMETRY: "false"
+				},
+				volumes: ["openobserve-data:/data"],
+				healthcheck: {
+					test: [
+						"CMD",
+						"/openobserve",
+						"node",
+						"status"
+					],
+					interval: "10s",
+					timeout: "5s",
+					retries: 12,
+					start_period: "20s"
+				}
+			};
+		}
 		default: throw new UnknownContainer(container);
 	}
 }
@@ -1881,987 +2765,470 @@ HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
 }
 /**
 * Generate a Dockerfile for Next.js frontend apps using standalone output.
-*
-* Pruned at the build root, Next traces from there, so the standalone
-* server lands at `<appPath>/server.js` under `.next/standalone`.
-* @internal Exported for testing
-*/
-function generateNextjsDockerfile(options) {
-	const { port, appPath, publicUrlArgs = ["NEXT_PUBLIC_API_URL", "NEXT_PUBLIC_AUTH_URL"] } = options;
-	return `# syntax=docker/dockerfile:1
-# Next.js standalone Dockerfile, built from a turbo-pruned slice
-
-${prunerStage(options)}
-
-${depsStage(options)}
-
-${builderStage(options, { args: publicUrlArgs })}
-
-${siteWorkspaceSteps(options)}
-
-# Ensure public directory exists (may be empty for scaffolded projects)
-RUN mkdir -p ${appPath}/public
-
-ENV NEXT_TELEMETRY_DISABLED=1
-
-# Build the application
-${siteBuild(options)}
-
-# The runner needs the standalone server; without it there is nothing to run.
-RUN if [ ! -d ${appPath}/.next/standalone ]; then \\
-      echo "${appPath}/.next/standalone was not built: set output: 'standalone' in next.config so the image can run the app without node_modules." >&2; \\
-      exit 1; \\
-    fi
-
-# Stage 4: Production
-FROM ${options.baseImage} AS runner
-
-WORKDIR /app
-
-# Install tini for proper signal handling
-RUN apk add --no-cache tini
-
-# Create non-root user
-RUN addgroup --system --gid 1001 nodejs && \\
-    adduser --system --uid 1001 nextjs
-
-# Set environment
-ENV NODE_ENV=production
-ENV NEXT_TELEMETRY_DISABLED=1
-ENV PORT=${port}
-ENV HOSTNAME="0.0.0.0"
-
-# The standalone server, with its static files and public directory beside it
-COPY --from=builder --chown=nextjs:nodejs /app/${appPath}/.next/standalone ./
-COPY --from=builder --chown=nextjs:nodejs /app/${appPath}/.next/static ./${appPath}/.next/static
-COPY --from=builder --chown=nextjs:nodejs /app/${appPath}/public ./${appPath}/public
-
-USER nextjs
-
-EXPOSE ${port}
-
-${siteHealthcheck(port)}
-
-ENTRYPOINT ["/sbin/tini", "--"]
-CMD ["node", "${appPath}/server.js"]
-`;
-}
-/**
-* Generate a Dockerfile for a gkm backend: pruned, installed, and bundled by
-* `gkm build --provider server --production` inside the image. The runner is
-* `server.mjs` alone — plus any package the bundle leaves external.
-* @internal Exported for testing
-*/
-function generateBackendDockerfile(options) {
-	return gkmBundleDockerfile(options, {
-		title: "Backend Dockerfile",
-		bundle: "server.mjs",
-		as: "server.mjs",
-		expose: true
-	});
-}
-/** The port a worker answers its health check on, inside its container. */
-const WORKER_PORT = 3e3;
-/**
-* A Worker's image: the same build as its host app's backend — a pruned
-* slice, `gkm build --provider server --production` in the image, with the
-* encrypted credentials from the `gkm_credentials` secret — and a runner that
-* is the worker's bundle alone. It publishes nothing: its one route is the
-* health check the HEALTHCHECK asks.
-* @internal Exported for testing
-*/
-function generateWorkerDockerfile(options) {
-	return gkmBundleDockerfile(options, {
-		title: `Worker Dockerfile (${options.worker})`,
-		bundle: options.bundle,
-		as: "worker.mjs",
-		expose: false
-	});
-}
-function gkmBundleDockerfile(options, runner) {
-	const { port, healthCheckPath = "/health" } = options;
-	const { app } = layout(options);
-	const externals = externalsStages(options, app);
-	return `# syntax=docker/dockerfile:1
-# ${runner.title}: a turbo-pruned slice, bundled by gkm build in the image
-
-${prunerStage(options)}
-
-${depsStage(options)}
-
-${builderStage(options)}
-
-# Bundle the production server, with the encrypted credentials embedded
-${credentialsStep(app, `cd ${app} && ${gkmCommand(`build --provider server --production${options.cache ? ` --cache ${options.cache}` : ""}`)}`)}
-${externals.stage}
-# Production
-FROM ${options.baseImage} AS runner
-
-WORKDIR /app
-
-RUN apk add --no-cache tini
-
-RUN addgroup --system --gid 1001 nodejs && \\
-    adduser --system --uid 1001 hono
-
-# The bundled ${runner.as === "server.mjs" ? "server" : "worker"}
-COPY --from=builder --chown=hono:nodejs ${app}/.gkm/server/dist/${runner.bundle} ./${runner.as === runner.bundle ? "" : runner.as}${externals.copy}
-
-ENV NODE_ENV=production
-ENV PORT=${port}
-
-HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
-  CMD wget -qO- http://localhost:${port}${healthCheckPath} > /dev/null 2>&1 || exit 1
-
-USER hono
-${runner.expose ? `\nEXPOSE ${port}\n` : ""}
-ENTRYPOINT ["/sbin/tini", "--"]
-CMD ["node", "${runner.as}"]
-`;
-}
-/**
-* Generate a Dockerfile for apps with a custom entry point.
-* Uses esbuild to bundle the entry point into dist/index.mjs with all dependencies.
-* This is used for apps that don't use gkm routes (e.g., Better Auth servers).
-* @internal Exported for testing
-*/
-function generateEntryDockerfile(options) {
-	const { port, entry, healthCheckPath = "/health" } = options;
-	const { app } = layout(options);
-	const esbuild = (defines) => `esbuild ${entry} --bundle --platform=node --target=node22 --format=esm \\
-        --outfile=dist/index.mjs --packages=bundle \\
-        --banner:js='import { createRequire } from "module"; const require = createRequire(import.meta.url);'${defines}`;
-	return `# syntax=docker/dockerfile:1
-# Entry-based Dockerfile: a turbo-pruned slice, bundled by esbuild in the image
-
-${prunerStage(options)}
-
-${depsStage(options)}
-
-${builderStage(options)}
-
-# Bundle the entry point with every dependency (dist/index.mjs), embedding the
-# encrypted credentials when there are any.
-ARG GKM_CIPHERTEXT_HASH=""
-RUN --mount=type=secret,id=gkm_credentials,required=false \\
-    echo "credentials: \${GKM_CIPHERTEXT_HASH:-none}" && \\
-    cd ${app} && export ${binPath(options)} && \\
-    if [ -s /run/secrets/gkm_credentials ]; then \\
-      CREDS=$(sed -n 1p /run/secrets/gkm_credentials) && \\
-      IV=$(sed -n 2p /run/secrets/gkm_credentials) && \\
-      ${esbuild(` \\
-        --define:__GKM_ENCRYPTED_CREDENTIALS__="\\"$CREDS\\"" \\
-        --define:__GKM_CREDENTIALS_IV__="\\"$IV\\""`)}; \\
-    else \\
-      ${esbuild("")}; \\
-    fi
-
-# Production
-FROM ${options.baseImage} AS runner
-
-WORKDIR /app
-
-RUN apk add --no-cache tini
-
-RUN addgroup --system --gid 1001 nodejs && \\
-    adduser --system --uid 1001 app
-
-# Copy bundled output only (no node_modules needed - fully bundled)
-COPY --from=builder --chown=app:nodejs ${app}/dist/index.mjs ./
-
-ENV NODE_ENV=production
-ENV PORT=${port}
-
-HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
-  CMD wget -qO- http://localhost:${port}${healthCheckPath} > /dev/null 2>&1 || exit 1
-
-USER app
-
-EXPOSE ${port}
-
-ENTRYPOINT ["/sbin/tini", "--"]
-CMD ["node", "index.mjs"]
-`;
-}
-/**
-* Generate a Dockerfile for Node-based SSR web frameworks (TanStack Start,
-* Remix). Builds with turbo, then runs the framework's production start
-* script.
-*
-* Public URL build args are declared so framework bundlers (Vite, Vinxi)
-* can inline them at build time. Per-framework prefix is the caller's job.
-* @internal Exported for testing
-*/
-function generateNodeWebDockerfile(options) {
-	const { port, appPath } = options;
-	return `# syntax=docker/dockerfile:1
-# Node SSR web Dockerfile (TanStack Start / Remix), from a turbo-pruned slice
-
-${prunerStage(options)}
-
-${depsStage(options)}
-
-${builderStage(options, { args: options.publicUrlArgs ?? [] })}
-
-${siteWorkspaceSteps(options)}
-
-${siteBuild(options)}
-
-FROM ${options.baseImage} AS runner
-WORKDIR /app
-RUN apk add --no-cache tini
-RUN addgroup --system --gid 1001 nodejs && \\
-    adduser --system --uid 1001 app
-
-# Copy the whole built workspace — frameworks differ on output paths
-COPY --from=builder --chown=app:nodejs /app/ ./
-
-ENV NODE_ENV=production
-ENV PORT=${port}
-ENV HOSTNAME="0.0.0.0"
-
-USER app
-EXPOSE ${port}
-
-${siteHealthcheck(port)}
-
-ENTRYPOINT ["/sbin/tini", "--"]
-# npm ships with node, and runs the start script whichever package manager
-# installed it: the runner needs no other.
-CMD ["sh", "-c", "cd ${appPath} && npm start"]
-`;
-}
-/**
-* Generate a Dockerfile for Vite SPA apps. Builds the static bundle with
-* turbo, then serves it with Caddy: Vite's hashed `/assets/*` cached for a
-* year, everything else — `index.html`, and every deep link that falls back
-* to it — revalidated on each request.
+*
+* Pruned at the build root, Next traces from there, so the standalone
+* server lands at `<appPath>/server.js` under `.next/standalone`.
 * @internal Exported for testing
 */
-function generateViteStaticDockerfile(options) {
-	const { port, appPath } = options;
+function generateNextjsDockerfile(options) {
+	const { port, appPath, publicUrlArgs = ["NEXT_PUBLIC_API_URL", "NEXT_PUBLIC_AUTH_URL"] } = options;
 	return `# syntax=docker/dockerfile:1
-# Vite SPA Dockerfile — a turbo-pruned slice built to static files, served by Caddy
+# Next.js standalone Dockerfile, built from a turbo-pruned slice
 
 ${prunerStage(options)}
 
 ${depsStage(options)}
 
-${builderStage(options, { args: options.publicUrlArgs ?? [] })}
+${builderStage(options, { args: publicUrlArgs })}
 
 ${siteWorkspaceSteps(options)}
 
+# Ensure public directory exists (may be empty for scaffolded projects)
+RUN mkdir -p ${appPath}/public
+
+ENV NEXT_TELEMETRY_DISABLED=1
+
+# Build the application
 ${siteBuild(options)}
 
-FROM ${STATIC_SITE_IMAGE} AS runner
+# The runner needs the standalone server; without it there is nothing to run.
+RUN if [ ! -d ${appPath}/.next/standalone ]; then \\
+      echo "${appPath}/.next/standalone was not built: set output: 'standalone' in next.config so the image can run the app without node_modules." >&2; \\
+      exit 1; \\
+    fi
 
-COPY <<'EOF' /etc/caddy/Caddyfile
-{
-	admin off
-	auto_https off
-	persist_config off
-}
+# Stage 4: Production
+FROM ${options.baseImage} AS runner
 
-:${port} {
-	root * /srv
-	encode zstd gzip
+WORKDIR /app
 
-	# Vite names every built asset by its content hash: a changed file is a
-	# new URL, so the old one can be cached for good.
-	handle /assets/* {
-		header Cache-Control "public, max-age=31536000, immutable"
-		file_server
-	}
+# Install tini for proper signal handling
+RUN apk add --no-cache tini
 
-	# index.html, and every client-side route that falls back to it, is
-	# asked for again each time so a deploy is seen at once.
-	handle {
-		header Cache-Control "no-cache"
-		try_files {path} /index.html
-		file_server
-	}
-}
-EOF
+# Create non-root user
+RUN addgroup --system --gid 1001 nodejs && \\
+    adduser --system --uid 1001 nextjs
 
-COPY --from=builder /app/${appPath}/dist /srv
+# Set environment
+ENV NODE_ENV=production
+ENV NEXT_TELEMETRY_DISABLED=1
+ENV PORT=${port}
+ENV HOSTNAME="0.0.0.0"
 
-RUN addgroup -S -g 1001 site && adduser -S -u 1001 -G site site && \\
-    chown -R site:site /data /config
+# The standalone server, with its static files and public directory beside it
+COPY --from=builder --chown=nextjs:nodejs /app/${appPath}/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/${appPath}/.next/static ./${appPath}/.next/static
+COPY --from=builder --chown=nextjs:nodejs /app/${appPath}/public ./${appPath}/public
 
-USER site
+USER nextjs
 
 EXPOSE ${port}
 
 ${siteHealthcheck(port)}
 
-CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
+ENTRYPOINT ["/sbin/tini", "--"]
+CMD ["node", "${appPath}/server.js"]
 `;
 }
-//#endregion
-//#region src/docker/layout.ts
-/**
-* Where a workspace's images are built from, and what each is built with.
-*
-* Every builder of images — `gkm docker`, `gkm compose`, a Dokploy deploy —
-* builds from the same place with the same templates: the build root (the
-* package manager's root, at or above the gkm workspace), cut by `turbo
-* prune` to one app's slice. Nothing is built on the host.
-*/
-/** A workspace of packages with no turbo.json, which every image prunes with. */
-var MonorepoNeedsTurbo = class extends Error {
-	buildRoot;
-	constructor(buildRoot) {
-		super(`${buildRoot} is a workspace of packages, and its images are built from a turbo-pruned slice of it — but it has no turbo.json.\n\nTo fix this:
-  1. Install turbo: pnpm add -Dw turbo
-  2. Create turbo.json in ${buildRoot}\n  3. Run this command again
-
-See: https://turbo.build/repo/docs/guides/tools/docker`);
-		this.buildRoot = buildRoot;
-		this.name = "MonorepoNeedsTurbo";
-	}
-};
-/**
-* Where a workspace's images are built from.
-*
-* Refuses a workspace of packages with no turbo.json — every image prunes
-* with turbo — so only a caller about to generate or build images asks.
-*/
-function imageLayout(workspace) {
-	const buildRoot = findBuildRoot(workspace.root);
-	const tools = resolveBuildTools(buildRoot);
-	if (tools.monorepo && !hasTurboConfig(buildRoot)) throw new MonorepoNeedsTurbo(buildRoot);
-	const gkmRoot = toPosix(relative(buildRoot, workspace.root)) || ".";
-	const workspacePackage = gkmRoot !== "." ? packageName(workspace.root) : void 0;
-	return {
-		buildRoot,
-		gkmRoot,
-		tools,
-		...workspacePackage ? { workspacePackage } : {},
-		gkmPaths: ["gkm.config.*", ...constructRoots(workspace)]
-	};
-}
-/**
-* How a compose file builds an app: the build root as the context, relative
-* to the directory the compose file is in, and the Dockerfile — written under
-* the gkm root — relative to that context, which is what compose resolves
-* `dockerfile` against.
-*/
-function composeBuildPaths(options) {
-	const { composeDir, buildRoot, workspaceRoot, dockerfile } = options;
-	return {
-		context: toPosix(relative(composeDir, buildRoot)) || ".",
-		dockerfile: toPosix(join(relative(buildRoot, workspaceRoot), dockerfile))
-	};
-}
-/** A path under the gkm root, as the build root sees it. */
-function fromBuildRoot(layout, path) {
-	if (layout.gkmRoot === ".") return toPosix(path);
-	const joined = toPosix(join(layout.gkmRoot, path));
-	return joined === "" ? "." : joined;
-}
-/** Everything a template needs about one app, relative to the build root. */
-function appImageOptions(layout, appName, app, workspaceRoot, apps = {}) {
-	const turboPackage = packageName(isAbsolute(app.path) ? app.path : join(workspaceRoot, app.path)) ?? appName;
-	return {
-		imageName: appName,
-		baseImage: "node:22-alpine",
-		port: app.port,
-		appPath: fromBuildRoot(layout, app.path),
-		turboPackage,
-		packageManager: layout.tools.packageManager,
-		...layout.tools.packageManagerVersion ? { packageManagerVersion: layout.tools.packageManagerVersion } : {},
-		turboVersion: layout.tools.turboVersion,
-		monorepo: layout.tools.monorepo,
-		gkmRoot: layout.gkmRoot,
-		...app.type === "backend" ? {
-			gkmPaths: layout.gkmPaths,
-			...layout.workspacePackage && layout.workspacePackage !== turboPackage ? { prunePackages: [layout.workspacePackage] } : {}
-		} : app.type === "web" ? siteWorkspace(layout, app, apps, workspaceRoot, turboPackage) : {}
-	};
-}
-/**
-* What a site's image carries of the gkm workspace: its config and construct
-* directories, the workspace's own package where it is nested in a monorepo
-* (it holds the CLI), and each backend the site calls — whose endpoints its
-* client is generated from, and whose package their imports resolve in.
-*/
-function siteWorkspace(layout, site, apps, workspaceRoot, turboPackage) {
-	const clients = siteClients(site, apps);
-	const packages = /* @__PURE__ */ new Set();
-	if (layout.workspacePackage) packages.add(layout.workspacePackage);
-	for (const { app } of clients) {
-		const backend = apps[app];
-		const name = packageName(isAbsolute(backend.path) ? backend.path : join(workspaceRoot, backend.path));
-		if (name) packages.add(name);
-	}
-	packages.delete(turboPackage);
-	return {
-		gkmPaths: layout.gkmPaths,
-		...packages.size > 0 ? { prunePackages: [...packages].sort() } : {},
-		...clients.length > 0 ? { clients: clients.map(({ app }) => ({
-			app,
-			path: fromBuildRoot(layout, apps[app].path)
-		})) } : {}
-	};
-}
-/**
-* The backends whose clients a site imports: each it depends on that gkm
-* builds from endpoints — not one with an entry of its own, and not one that
-* turned OpenAPI off.
-*/
-function siteClients(site, apps) {
-	return site.dependencies.filter((name) => {
-		const app = apps[name];
-		if (!app || app.type !== "backend" || app.entry) return false;
-		if (app.openapi === false) return false;
-		if (typeof app.openapi === "object" && app.openapi.enabled === false) return false;
-		return true;
-	}).sort().map((app) => ({ app }));
-}
-/**
-* The directories the workspace's construct globs start in, relative to its
-* root: `./constructs/**\/*.ts` reads from `constructs`.
-*/
-function constructRoots(workspace) {
-	const roots = /* @__PURE__ */ new Set();
-	for (const glob of allConstructGlobs(workspace)) {
-		const rel = toPosix(relative(workspace.root, glob));
-		if (!rel || rel.startsWith("..")) continue;
-		const first = rel.split("/")[0];
-		if (/[*?{}[\]!]/.test(first)) continue;
-		roots.add(first);
-	}
-	return [...roots].sort();
-}
-function packageName(dir) {
-	try {
-		const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf-8"));
-		return typeof pkg.name === "string" ? pkg.name : void 0;
-	} catch {
-		return;
-	}
-}
-function toPosix(path) {
-	return path.split(sep).join("/");
-}
-//#endregion
-//#region src/reconcile/caddyfile.ts
-/**
-* The kinds the edge serves.
-*
-* Everything that owns a *public address*. Deployed, each of these has a real
-* hostname and a certificate, so this is what makes the local shape the same
-* one rather than a near-enough one — and the application is indifferent
-* either way, because it reads whichever address was injected and never
-* composes one.
-*
-* Adding a kind here is the whole of adding it to the edge.
-*/
-const EDGE_KINDS = {
-	"file-server": true,
-	"rest-api": true,
-	site: true
-};
-/**
-* How the edge reaches the host, from inside its container.
-*
-* A surface and a site are served by processes `gkm dev` starts on the host,
-* not by containers — so the edge has to leave Docker's network to reach them.
-* Docker Desktop resolves this name already; on Linux the compose definition
-* maps it to the host gateway.
-*/
-const HOST_GATEWAY = "host.docker.internal";
 /**
-* The suffix every local host shares.
-*
-* `.localhost` rather than a made-up TLD because it resolves to loopback
-* without touching `/etc/hosts` — macOS and systemd-resolved both answer for
-* subdomains of it, and Caddy issues internal certificates for it by default.
+* Generate a Dockerfile for a gkm backend: pruned, installed, and bundled by
+* `gkm build --provider server --production` inside the image. The runner is
+* `server.mjs` alone — plus any package the bundle leaves external.
+* @internal Exported for testing
 */
-const LOCAL_TLD = "localhost";
+function generateBackendDockerfile(options) {
+	return gkmBundleDockerfile(options, {
+		title: "Backend Dockerfile",
+		bundle: "server.mjs",
+		as: "server.mjs",
+		expose: true
+	});
+}
+/** The port a worker answers its health check on, inside its container. */
+const WORKER_PORT = 3e3;
 /**
-* The sites a plan implies, one per file server.
-*
-* The leading label is the *server's* stage-scoped name rather than the
-* bucket's, which is the difference that matters: two servers over one bucket
-* are a legitimate arrangement — two cache behaviours, one origin — and naming
-* the host after the bucket would make them collide.
+* A Worker's image: the same build as its host app's backend — a pruned
+* slice, `gkm build --provider server --production` in the image, with the
+* encrypted credentials from the `gkm_credentials` secret — and a runner that
+* is the worker's bundle alone. It publishes nothing: its one route is the
+* health check the HEALTHCHECK asks.
+* @internal Exported for testing
 */
-function sitesFor(plan, project, addresses = {}) {
-	const byId = new Map(plan.resources.map((r) => [r.id, r]));
-	const sites = [];
-	for (const resource of plan.resources) {
-		if (!EDGE_KINDS[resource.kind]) continue;
-		const host = hostFor(resource, project);
-		if (resource.kind === "file-server") {
-			const origin = resource.of ? byId.get(resource.of) : void 0;
-			if (!origin) continue;
-			sites.push({
-				host,
-				upstream: "http://minio:9000",
-				rewrite: `/${origin.name}{uri}`
-			});
-			continue;
-		}
-		const address = addresses[resource.id];
-		if (!address) continue;
-		const port = portOf(address);
-		if (!port) continue;
-		sites.push({
-			host,
-			upstream: `http://${HOST_GATEWAY}:${port}`
-		});
-	}
-	return sites;
+function generateWorkerDockerfile(options) {
+	return gkmBundleDockerfile(options, {
+		title: `Worker Dockerfile (${options.worker})`,
+		bundle: options.bundle,
+		as: "worker.mjs",
+		expose: false
+	});
 }
-/** The port a local address answers on, defaulting by scheme. */
-function portOf(address) {
-	try {
-		const { port, protocol } = new URL(address);
-		return port || (protocol === "https:" ? "443" : "80");
-	} catch {
-		return;
-	}
+function gkmBundleDockerfile(options, runner) {
+	const { port, healthCheckPath = "/health" } = options;
+	const { app } = layout(options);
+	const externals = externalsStages(options, app);
+	return `# syntax=docker/dockerfile:1
+# ${runner.title}: a turbo-pruned slice, bundled by gkm build in the image
+
+${prunerStage(options)}
+
+${depsStage(options)}
+
+${builderStage(options)}
+
+# Bundle the production server, with the encrypted credentials embedded
+${credentialsStep(app, `cd ${app} && ${gkmCommand(`build --provider server --production${options.cache ? ` --cache ${options.cache}` : ""}`)}`)}
+${externals.stage}
+# Production
+FROM ${options.baseImage} AS runner
+
+WORKDIR /app
+
+RUN apk add --no-cache tini
+
+RUN addgroup --system --gid 1001 nodejs && \\
+    adduser --system --uid 1001 hono
+
+# The bundled ${runner.as === "server.mjs" ? "server" : "worker"}
+COPY --from=builder --chown=hono:nodejs ${app}/.gkm/server/dist/${runner.bundle} ./${runner.as === runner.bundle ? "" : runner.as}${externals.copy}
+
+ENV NODE_ENV=production
+ENV PORT=${port}
+
+HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
+  CMD wget -qO- http://localhost:${port}${healthCheckPath} > /dev/null 2>&1 || exit 1
+
+USER hono
+${runner.expose ? `\nEXPOSE ${port}\n` : ""}
+ENTRYPOINT ["/sbin/tini", "--"]
+CMD ["node", "${runner.as}"]
+`;
 }
 /**
-* Where one file server answers, including the stage its name carries.
-*
-* The project is a label rather than a decoration: it is what keeps two
-* checkouts from answering on one address. Omitted when there is no project to
-* name, because an empty label makes `uploads..localhost` — a host nothing
-* resolves and no certificate can be issued for.
+* Generate a Dockerfile for apps with a custom entry point.
+* Uses esbuild to bundle the entry point into dist/index.mjs with all dependencies.
+* This is used for apps that don't use gkm routes (e.g., Better Auth servers).
+* @internal Exported for testing
 */
-function hostFor(resource, project) {
-	return [
-		resource.root && project ? stageOf(resource) : labelOf(resource),
-		project,
-		LOCAL_TLD
-	].filter(Boolean).join(".");
+function generateEntryDockerfile(options) {
+	const { port, entry, healthCheckPath = "/health" } = options;
+	const { app } = layout(options);
+	const esbuild = (defines) => `esbuild ${entry} --bundle --platform=node --target=node22 --format=esm \\
+        --outfile=dist/index.mjs --packages=bundle \\
+        --banner:js='import { createRequire } from "module"; const require = createRequire(import.meta.url);'${defines}`;
+	return `# syntax=docker/dockerfile:1
+# Entry-based Dockerfile: a turbo-pruned slice, bundled by esbuild in the image
+
+${prunerStage(options)}
+
+${depsStage(options)}
+
+${builderStage(options)}
+
+# Bundle the entry point with every dependency (dist/index.mjs), embedding the
+# encrypted credentials when there are any.
+ARG GKM_CIPHERTEXT_HASH=""
+RUN --mount=type=secret,id=gkm_credentials,required=false \\
+    echo "credentials: \${GKM_CIPHERTEXT_HASH:-none}" && \\
+    cd ${app} && export ${binPath(options)} && \\
+    if [ -s /run/secrets/gkm_credentials ]; then \\
+      CREDS=$(sed -n 1p /run/secrets/gkm_credentials) && \\
+      IV=$(sed -n 2p /run/secrets/gkm_credentials) && \\
+      ${esbuild(` \\
+        --define:__GKM_ENCRYPTED_CREDENTIALS__="\\"$CREDS\\"" \\
+        --define:__GKM_CREDENTIALS_IV__="\\"$IV\\""`)}; \\
+    else \\
+      ${esbuild("")}; \\
+    fi
+
+# Production
+FROM ${options.baseImage} AS runner
+
+WORKDIR /app
+
+RUN apk add --no-cache tini
+
+RUN addgroup --system --gid 1001 nodejs && \\
+    adduser --system --uid 1001 app
+
+# Copy bundled output only (no node_modules needed - fully bundled)
+COPY --from=builder --chown=app:nodejs ${app}/dist/index.mjs ./
+
+ENV NODE_ENV=production
+ENV PORT=${port}
+
+HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
+  CMD wget -qO- http://localhost:${port}${healthCheckPath} > /dev/null 2>&1 || exit 1
+
+USER app
+
+EXPOSE ${port}
+
+ENTRYPOINT ["/sbin/tini", "--"]
+CMD ["node", "index.mjs"]
+`;
 }
 /**
-* A resource's own label: its `subdomain` where it declared one — the label a
-* deploy uses too — with the stage it carries kept, so `gkm test` and `gkm dev`
-* still answer on different hosts.
+* Generate a Dockerfile for Node-based SSR web frameworks (TanStack Start,
+* Remix). Builds with turbo, then runs the framework's production start
+* script.
+*
+* Public URL build args are declared so framework bundlers (Vite, Vinxi)
+* can inline them at build time. Per-framework prefix is the caller's job.
+* @internal Exported for testing
 */
-function labelOf(resource) {
-	if (!resource.subdomain) return resource.name;
-	const stage = stageOf(resource);
-	return stage ? `${resource.subdomain}-${stage}` : resource.subdomain;
-}
-/** The stage a resource's name carries, or nothing for the local stage's. */
-function stageOf(resource) {
-	const base = resource.id.toLowerCase();
-	return resource.name === base ? void 0 : resource.name.slice(base.length + 1);
+function generateNodeWebDockerfile(options) {
+	const { port, appPath } = options;
+	return `# syntax=docker/dockerfile:1
+# Node SSR web Dockerfile (TanStack Start / Remix), from a turbo-pruned slice
+
+${prunerStage(options)}
+
+${depsStage(options)}
+
+${builderStage(options, { args: options.publicUrlArgs ?? [] })}
+
+${siteWorkspaceSteps(options)}
+
+${siteBuild(options)}
+
+FROM ${options.baseImage} AS runner
+WORKDIR /app
+RUN apk add --no-cache tini
+RUN addgroup --system --gid 1001 nodejs && \\
+    adduser --system --uid 1001 app
+
+# Copy the whole built workspace — frameworks differ on output paths
+COPY --from=builder --chown=app:nodejs /app/ ./
+
+ENV NODE_ENV=production
+ENV PORT=${port}
+ENV HOSTNAME="0.0.0.0"
+
+USER app
+EXPOSE ${port}
+
+${siteHealthcheck(port)}
+
+ENTRYPOINT ["/sbin/tini", "--"]
+# npm ships with node, and runs the start script whichever package manager
+# installed it: the runner needs no other.
+CMD ["sh", "-c", "cd ${appPath} && npm start"]
+`;
 }
 /**
-* The static root config, which only ever imports.
-*
-* Written once and identical for every stage, because the *sites* are what
-* differ and they live in their own files. That split is not tidiness: one
-* container serves every stage — the same way one Postgres holds `orders` and
-* `orders_test` — so a single Caddyfile would mean `gkm test` deleting the
-* routes `gkm dev` is serving, and each command silently breaking the other.
+* Generate a Dockerfile for Vite SPA apps. Builds the static bundle with
+* turbo, then serves it with Caddy: Vite's hashed `/assets/*` cached for a
+* year, everything else — `index.html`, and every deep link that falls back
+* to it — revalidated on each request.
+* @internal Exported for testing
 */
-function caddyfileRoot() {
-	return `${GENERATED}
+function generateViteStaticDockerfile(options) {
+	const { port, appPath } = options;
+	return `# syntax=docker/dockerfile:1
+# Vite SPA Dockerfile — a turbo-pruned slice built to static files, served by Caddy
+
+${prunerStage(options)}
+
+${depsStage(options)}
+
+${builderStage(options, { args: options.publicUrlArgs ?? [] })}
+
+${siteWorkspaceSteps(options)}
+
+${siteBuild(options)}
+
+FROM ${STATIC_SITE_IMAGE} AS runner
+
+COPY <<'EOF' /etc/caddy/Caddyfile
 {
-	# No ACME, no public DNS: the CA is local and so are the names.
-	local_certs
-	auto_https disable_redirects
+	admin off
+	auto_https off
+	persist_config off
 }
 
-# One file per stage, so two stages share this edge the way they already share
-# one Postgres and one MinIO.
-import /etc/caddy/sites/*.caddy
-`;
-}
-/**
-* One stage's sites, as the file imported above.
-*
-* `rewrite` rather than a path prefix on the address: the bucket is the
-* origin's business, and the client asks for the key it stored.
-*
-* `header_up Host {upstream_hostport}` matters more than it looks. MinIO routes
-* and signs on the Host header, so forwarding the requested hostname would make
-* it look for a bucket named after the domain.
-*/
-function toCaddyfile(sites) {
-	if (sites.length === 0) return `${GENERATED}
-# No file server is declared in this stage, so it routes nothing.
-`;
-	const blocks = sites.map(({ host, upstream, rewrite }) => `
-https://${host} {
-	tls internal
+:${port} {
+	root * /srv
+	encode zstd gzip
 
-	reverse_proxy ${upstream} {${rewrite ? `
-		rewrite ${rewrite}
-		# MinIO routes and signs on the Host header, so forwarding the requested
-		# hostname would make it look for a bucket named after the domain.
-		header_up Host {upstream_hostport}` : `
-		# The application reads whatever address was injected, so it has to see
-		# the one a caller used — that is what makes a redirect, a cookie domain
-		# and a generated link point back here rather than at the upstream.
-		header_up Host {host}
-		header_up X-Forwarded-Proto {scheme}`}
+	# Vite names every built asset by its content hash: a changed file is a
+	# new URL, so the old one can be cached for good.
+	handle /assets/* {
+		header Cache-Control "public, max-age=31536000, immutable"
+		file_server
+	}
+
+	# index.html, and every client-side route that falls back to it, is
+	# asked for again each time so a deploy is seen at once.
+	handle {
+		header Cache-Control "no-cache"
+		try_files {path} /index.html
+		file_server
 	}
-}`);
-	return `${GENERATED}${blocks.join("\n")}\n`;
 }
-const GENERATED = `# Generated by gkm from the construct manifest — do not edit.
-#
-# One host per declared file server, in front of the object store that holds its
-# objects. This is the shape a file server has deployed — a domain serving a
-# bucket — which MinIO alone cannot produce: its virtual-host mode reads the
-# leading label as the bucket name.
-#
-# Certificates come from Caddy's own CA. "gkm dev" and "gkm test" export its
-# root and point Node at it, so nothing has to be installed to use these URLs
-# from code; a browser needs the root trusted once.
+EOF
+
+COPY --from=builder /app/${appPath}/dist /srv
+
+RUN addgroup -S -g 1001 site && adduser -S -u 1001 -G site site && \\
+    chown -R site:site /data /config
+
+USER site
+
+EXPOSE ${port}
+
+${siteHealthcheck(port)}
+
+CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
 `;
-//#endregion
-//#region src/workspace/rootSite.ts
-/**
-* Which site the base domain points at — deployed and locally alike.
-*
-* Three rules, in order, and the last one is the point:
-*
-* 1. **One site** — it is the root. Unambiguous, so nothing has to be said.
-* 2. **Named `web`** — the convention wins, because people already rely on it.
-* 3. **Declared `root: true`** — the site says so itself.
-*
-* Anything else throws. It used to take the *first* site it iterated, and that
-* order came from the manifest, which is built in glob traversal order — so two
-* sites with neither named `web` meant renaming a file could move the root
-* domain, silently.
-*
-* One rule for both targets: deployed the root site gets the base domain, and
-* locally it gets the project's bare host behind the edge. Before this was
-* shared, the local edge put every site on a subdomain, so what a developer
-* browsed was not the shape production served.
-*
-* @returns the root site's name, or `undefined` when there are no sites
-* @throws {AmbiguousRootSite} when several sites could be the root and none says it is
-*/
-function rootSite(sites) {
-	if (sites.length === 0) return void 0;
-	if (sites.length === 1) return sites[0].name;
-	if (sites.some(({ name }) => name === "web")) return "web";
-	const declared = sites.filter(({ root }) => root === true);
-	if (declared.length === 1) return declared[0].name;
-	throw new AmbiguousRootSite(sites.map(({ name }) => name), declared.length > 1);
 }
-/** Several sites could hold the base domain, and none of them says it does. */
-var AmbiguousRootSite = class extends Error {
-	sites;
-	tooMany;
-	constructor(sites, tooMany = false) {
-		super(tooMany ? `More than one site declares \`root: true\` — ${sites.join(", ")}. The base domain points at one of them.` : `${sites.length} sites and nothing says which holds the base domain: ${sites.join(", ")}. Name one of them \`web\`, or declare \`root: true\` on the one the base domain points at. It used to be whichever the glob reached first, which is not a thing to decide a hostname.`);
-		this.sites = sites;
-		this.tooMany = tooMany;
-		this.name = "AmbiguousRootSite";
-	}
-};
 //#endregion
-//#region src/reconcile/plan.ts
-/**
-* The reconcile plan — what a manifest wants to exist, for one stage.
-*
-* Pure. Turning the plan into running containers and provisioned resources is
-* the applier's job; deciding *what* should exist is this, so the decisions can
-* be asserted as data rather than by starting Docker.
-*
-* One plan serves every stage. `gkm dev` reconciles `development` and `gkm test`
-* reconciles `test`; they differ only in what the resources are called, never in
-* what infrastructure exists. Roles are cluster-scoped in Postgres while grants
-* are per-object, so one container and one role pair serve both.
-*/
-/**
-* Which container serves a kind.
-*
-* Derived kinds map to the same container as their parent — a schema tenant
-* lives in its parent's Postgres — so the set is deduplicated rather than
-* counted.
-*/
-const CONTAINERS = {
-	database: "postgres",
-	"database-reader": "postgres",
-	"database-schema": "postgres",
-	objects: "minio",
-	"file-server": "caddy",
-	email: "mailpit"
-};
-/**
-* The container a cache backend needs locally.
-*
-* Each one matches the protocol its deployed form speaks, which is the property
-* worth having: a cache that behaves differently in the two places is worse than
-* a slower one.
-*
-* `db` is deliberately absent, the same way `pgboss` is absent from
-* `EVENT_CONTAINERS`: the cache is a table in a database the manifest already
-* declares, so mapping it here would start a container for a project that needs
-* none.
-*/
-const CACHE_CONTAINERS = {
-	upstash: "redis-http",
-	elasticache: "redis",
-	redis: "redis"
-};
-/**
-* Kinds that resolve a value without anything running.
-*
-* A secret is the case: it has no address, so there is nothing to start and
-* nothing to connect to — but it still appears in the plan, because the target
-* still has to resolve it.
-*/
-const CONTAINERLESS = {
-	secret: true,
-	credential: true,
-	encryption: true,
-	"rest-api": true,
-	site: true,
-	"mobile-app": true,
-	"external-api": true
-};
-/**
-* Containers that cannot run alone.
-*
-* The one case is the cache: `serverless-redis-http` is a proxy and needs the
-* Redis it proxies. Kept here rather than in the compose definition so the plan
-* -- which is what decides what must be running -- still names everything.
-*/
-const REQUIRES = { "redis-http": ["redis"] };
-/**
-* The role each kind's one key plays, where it is not a URL.
-*
-* The twin of `ProvidesByKind` in `@geekmidas/manifest`: that is what a
-* construct declares, this is what the local target resolves, and both derive
-* the key from the same `provideKey` so they cannot disagree.
-*/
-const ROLES = {
-	queue: "publisherConnectionString",
-	topic: "publisherConnectionString",
-	credential: "credentials",
-	"mobile-app": "scheme"
-};
-/** The kinds whose container is the events backend's rather than their own. */
-const EVENT_KINDS = {
-	queue: true,
-	topic: true
-};
-/**
-* Which kinds provision something *inside* their container.
-*
-* A database creates a database, a bucket creates a bucket; mail creates
-* nothing — Mailpit accepts whatever is sent to it and has no per-stage object
-* to name. Both still appear in the plan, because both still resolve a URL; the
-* flag is the difference between "must be running" and "must be created".
-*/
-const PROVISIONS = {
-	database: true,
-	"database-reader": true,
-	"database-schema": true,
-	objects: true,
-	cache: true,
-	"file-server": true
-};
-/**
-* The container each events backend needs, where it needs one of its own.
-*
-* `pgboss` is deliberately absent rather than mapped to `postgres`: it is a
-* schema tenant in a database the manifest already declares, so mapping it here
-* would start a Postgres for a project that declared no database at all.
-*
-* This one comes from config rather than from a declaration because there are
-* no `topic` or `queue` kinds yet. When they land the mapping moves to
-* {@link CONTAINERS} keyed by kind, and this constant goes with them.
-*/
-const EVENT_CONTAINERS = {
-	sns: "localstack",
-	rabbitmq: "rabbitmq"
-};
-/** The backend a project gets when it declares queues or topics and says nothing. */
-const DEFAULT_EVENTS = "pgboss";
+//#region src/docker/layout.ts
 /**
-* How a resource of each kind separates its stage suffix.
+* Where a workspace's images are built from, and what each is built with.
 *
-* Postgres identifiers are snake_case and a hyphen would need quoting
-* everywhere; buckets and queues are kebab and disallow underscores in some
-* providers. The suffix is the same word either way.
+* Every builder of images — `gkm docker`, `gkm compose`, a Dokploy deploy —
+* builds from the same place with the same templates: the build root (the
+* package manager's root, at or above the gkm workspace), cut by `turbo
+* prune` to one app's slice. Nothing is built on the host.
 */
-const SEPARATORS = {
-	database: "_",
-	"database-reader": "_",
-	"database-schema": "_",
-	objects: "-"
+/** A workspace of packages with no turbo.json, which every image prunes with. */
+var MonorepoNeedsTurbo = class extends Error {
+	buildRoot;
+	constructor(buildRoot) {
+		super(`${buildRoot} is a workspace of packages, and its images are built from a turbo-pruned slice of it — but it has no turbo.json.\n\nTo fix this:
+  1. Install turbo: pnpm add -Dw turbo
+  2. Create turbo.json in ${buildRoot}\n  3. Run this command again
+
+See: https://turbo.build/repo/docs/guides/tools/docker`);
+		this.buildRoot = buildRoot;
+		this.name = "MonorepoNeedsTurbo";
+	}
 };
 /**
-* The stage-scoped name for a resource.
+* Where a workspace's images are built from.
 *
-* The local stage carries no suffix, so `gkm dev` keeps using `orders` and a
-* developer's psql history, saved connections, and muscle memory survive a
-* change of stage name. Every other stage is suffixed.
+* Refuses a workspace of packages with no turbo.json — every image prunes
+* with turbo — so only a caller about to generate or build images asks.
 */
-function resourceName(id, kind, stage, localStage) {
-	const base = id.toLowerCase();
-	if (stage === localStage) return base;
-	return `${base}${SEPARATORS[kind] ?? "-"}${stage}`;
+function imageLayout(workspace) {
+	const buildRoot = findBuildRoot(workspace.root);
+	const tools = resolveBuildTools(buildRoot);
+	if (tools.monorepo && !hasTurboConfig(buildRoot)) throw new MonorepoNeedsTurbo(buildRoot);
+	const gkmRoot = toPosix(relative(buildRoot, workspace.root)) || ".";
+	const workspacePackage = gkmRoot !== "." ? packageName(workspace.root) : void 0;
+	return {
+		buildRoot,
+		gkmRoot,
+		tools,
+		...workspacePackage ? { workspacePackage } : {},
+		gkmPaths: ["gkm.config.*", ...constructRoots(workspace)]
+	};
 }
 /**
-* The container a kind needs, or `undefined` if it needs none.
-*
-* Queues and topics have no container of their own — they live in whichever
-* broker the project selected, which is why the backend is an argument here
-* rather than a second pass that adds containers after the fact.
+* How a compose file builds an app: the build root as the context, relative
+* to the directory the compose file is in, and the Dockerfile — written under
+* the gkm root — relative to that context, which is what compose resolves
+* `dockerfile` against.
 */
-function containerFor(kind, events = DEFAULT_EVENTS, cache = DEFAULT_CACHE.aws, derived = false, edge = true) {
-	if (EVENT_KINDS[kind]) return EVENT_CONTAINERS[events] ?? CONTAINERS.database;
-	if (kind === "file-server") return edge ? "caddy" : CONTAINERS.objects;
-	if (kind === "cache") {
-		if (derived && !holdsEveryCache(cache)) return CONTAINERS.database;
-		return CACHE_CONTAINERS[cache] ?? CONTAINERS.database;
-	}
-	return CONTAINERS[kind];
+function composeBuildPaths(options) {
+	const { composeDir, buildRoot, workspaceRoot, dockerfile } = options;
+	return {
+		context: toPosix(relative(composeDir, buildRoot)) || ".",
+		dockerfile: toPosix(join(relative(buildRoot, workspaceRoot), dockerfile))
+	};
+}
+/** A path under the gkm root, as the build root sees it. */
+function fromBuildRoot(layout, path) {
+	if (layout.gkmRoot === ".") return toPosix(path);
+	const joined = toPosix(join(layout.gkmRoot, path));
+	return joined === "" ? "." : joined;
+}
+/** Everything a template needs about one app, relative to the build root. */
+function appImageOptions(layout, appName, app, workspaceRoot, apps = {}, clientTelemetry) {
+	const turboPackage = packageName(isAbsolute(app.path) ? app.path : join(workspaceRoot, app.path)) ?? appName;
+	return {
+		imageName: appName,
+		baseImage: "node:22-alpine",
+		port: app.port,
+		appPath: fromBuildRoot(layout, app.path),
+		turboPackage,
+		packageManager: layout.tools.packageManager,
+		...layout.tools.packageManagerVersion ? { packageManagerVersion: layout.tools.packageManagerVersion } : {},
+		turboVersion: layout.tools.turboVersion,
+		monorepo: layout.tools.monorepo,
+		gkmRoot: layout.gkmRoot,
+		...app.type === "backend" ? {
+			gkmPaths: layout.gkmPaths,
+			...layout.workspacePackage && layout.workspacePackage !== turboPackage ? { prunePackages: [layout.workspacePackage] } : {}
+		} : app.type === "web" ? siteWorkspace(layout, app, apps, workspaceRoot, turboPackage, clientTelemetry) : {}
+	};
 }
 /**
-* Build the plan for a manifest and stage.
-*
-* `order` is the caller's provisioning order — parents before children — which
-* `provisionOrder` produces from the manifest. Passing it in keeps this
-* function free of the traversal and makes the ordering assertable on its own.
+* What a site's image carries of the gkm workspace: its config and construct
+* directories, the workspace's own package where it is nested in a monorepo
+* (it holds the CLI), and each backend the site calls — whose endpoints its
+* client is generated from, and whose package their imports resolve in.
 */
-function planFor(manifest, stage, order, options = {}) {
-	const containers = /* @__PURE__ */ new Set();
-	const resources = [];
-	const fakes = {};
-	const events = options.events ?? "pgboss";
-	const cache = options.cache ?? DEFAULT_CACHE.aws;
-	for (const id of order) {
-		const declaration = manifest[id];
-		if (!declaration) continue;
-		const local = declaration.kind === "external-api" ? options.fakes?.[id] : void 0;
-		const fake = local && {
-			key: fakeKey(id),
-			...local
-		};
-		if (fake) fakes[fake.key] = {
-			id,
-			...fake.image ? {
-				image: fake.image,
-				port: fake.port
-			} : {}
-		};
-		const detached = declaration.kind === "cache" && holdsEveryCache(cache);
-		const container = fake?.image ? fake.key : containerFor(declaration.kind, events, cache, "of" in declaration && typeof declaration.of === "string", options.edge !== false);
-		if (!container && !CONTAINERLESS[declaration.kind]) continue;
-		if (container) {
-			containers.add(container);
-			for (const required of REQUIRES[container] ?? []) containers.add(required);
-		}
-		resources.push({
-			id,
-			kind: declaration.kind,
-			...container ? { container } : {},
-			name: resourceName(id, declaration.kind, stage, options.localStage),
-			envKey: providedKeyFor(id, declaration.kind, ROLES[declaration.kind] ?? "url"),
-			provisions: PROVISIONS[declaration.kind] === true,
-			...declaration.kind === "rest-api" ? { callers: dependentsOf(manifest, id) } : {},
-			...declaration.kind === "site" ? { publicEnv: publicEnvFor(declaration, manifest) } : {},
-			...declaration.kind === "mobile-app" ? {
-				publicEnv: publicEnvFor(declaration, manifest),
-				...declaration.scheme ? { scheme: declaration.scheme } : {}
-			} : {},
-			...declaration.kind === "file-server" && declaration.open?.length ? { open: declaration.open } : {},
-			...(declaration.kind === "rest-api" || declaration.kind === "site") && declaration.subdomain ? { subdomain: declaration.subdomain } : {},
-			...fake ? { fake: {
-				key: fake.key,
-				credentials: fake.credentials
-			} } : {},
-			...declaration.kind === "external-api" && !fake ? { url: declaration.url } : {},
-			..."of" in declaration && !detached ? { of: declaration.of } : {},
-			..."schema" in declaration && declaration.schema ? { schema: declaration.schema } : {},
-			..."version" in declaration && declaration.version ? { version: declaration.version } : {},
-			..."roles" in declaration && declaration.roles === false ? { roles: false } : {},
-			..."table" in declaration && declaration.table && !detached ? { table: declaration.table } : {}
-		});
-	}
-	if (options.edge !== false && resources.some((r) => EDGE_KINDS[r.kind] === true)) containers.add("caddy");
-	for (const extra of options.extraContainers ?? []) containers.add(extra);
-	if (events === "pgboss" && resources.some((r) => EVENT_KINDS[r.kind]) && !resources.some((r) => r.kind === "database")) throw new PgBossNeedsDatabase(resources.filter((r) => EVENT_KINDS[r.kind]).map((r) => r.id));
-	if (cache === "db") {
-		const placeless = resources.filter((r) => r.kind === "cache" && !r.of);
-		if (placeless.length > 0) {
-			const databases = resources.filter((r) => r.kind === "database");
-			const [only] = databases;
-			if (!only) throw new CacheNeedsDatabase(resources.filter((r) => r.kind === "cache").map((r) => r.id));
-			if (databases.length > 1) throw new CacheIsAmbiguous(placeless.map((r) => r.id), databases.map((r) => r.id));
-			for (const resource of placeless) resource.of = only.id;
-		}
+function siteWorkspace(layout, site, apps, workspaceRoot, turboPackage, clientTelemetry) {
+	const clients = siteClients(site, apps);
+	const packages = /* @__PURE__ */ new Set();
+	if (layout.workspacePackage) packages.add(layout.workspacePackage);
+	for (const { app } of clients) {
+		const backend = apps[app];
+		const name = packageName(isAbsolute(backend.path) ? backend.path : join(workspaceRoot, backend.path));
+		if (name) packages.add(name);
 	}
-	const sites = resources.filter((r) => r.kind === "site");
-	const root = rootSite(sites.map((r) => {
-		const declared = manifest[r.id];
-		return {
-			name: appKey(r.id),
-			...declared?.kind === "site" && declared.root ? { root: true } : {}
-		};
-	}));
-	for (const site of sites) if (appKey(site.id) === root) site.root = true;
-	const workerBroker = events === "pgboss" && Object.values(manifest).some((d) => d?.kind === "worker") && resources.some((r) => r.kind === "database");
+	packages.delete(turboPackage);
 	return {
-		stage,
-		events,
-		cache,
-		containers: [...containers],
-		resources,
-		...Object.keys(fakes).length ? { fakes } : {},
-		...workerBroker ? { workerBroker: true } : {}
+		gkmPaths: layout.gkmPaths,
+		...packages.size > 0 ? { prunePackages: [...packages].sort() } : {},
+		...clients.length > 0 ? { clients: clients.map(({ app }) => ({
+			app,
+			path: fromBuildRoot(layout, apps[app].path),
+			...clientTelemetry ? { telemetry: clientTelemetry } : {}
+		})) } : {}
 	};
 }
 /**
-* Queues or topics were declared with pg-boss and no database to hold them.
-*
-* Not a reconcile failure but a manifest one: the fix is a line of application
-* code either way — declare a database, or select a backend that brings its own
-* broker.
+* The backends whose clients a site imports: each it depends on that gkm
+* builds from endpoints — not one with an entry of its own, and not one that
+* turned OpenAPI off.
 */
-var CacheNeedsDatabase = class extends Error {
-	ids;
-	constructor(ids) {
-		super(`A cache backed by the database needs a declared database, and none was declared, and on this deploy target that is where a cache lives. Declare one. Caches affected: ${ids.join(", ")}.`);
-		this.ids = ids;
-		this.name = "CacheNeedsDatabase";
-	}
-};
+function siteClients(site, apps) {
+	return site.dependencies.filter((name) => {
+		const app = apps[name];
+		if (!app || app.type !== "backend" || app.entry) return false;
+		if (app.openapi === false) return false;
+		if (typeof app.openapi === "object" && app.openapi.enabled === false) return false;
+		return true;
+	}).sort().map((app) => ({ app }));
+}
 /**
-* A `'db'` cache — a server target's default — in an app that declares more
-* than one database.
-*
-* The target says *a* database and the graph offers several, so there is no
-* answer to give — and the wrong kind of failure would be to pick one, since a
-* cache silently landing in the wrong database is a bug that surfaces as
-* missing rows much later. The fix is a stronger statement in application code:
-* `orders.cache('Sessions')` names the database, which is a fact about the
-* application rather than a deployment choice.
+* The directories the workspace's construct globs start in, relative to its
+* root: `./constructs/**\/*.ts` reads from `constructs`.
 */
-var CacheIsAmbiguous = class extends Error {
-	ids;
-	databases;
-	constructor(ids, databases) {
-		super(`A cache backed by the database needs to know which one, and this app declares ${databases.length}: ${databases.join(", ")}. Declare the cache from its database — e.g. ${databases[0]}.cache('Sessions') — rather than as a bare new Cache(). Caches affected: ${ids.join(", ")}.`);
-		this.ids = ids;
-		this.databases = databases;
-		this.name = "CacheIsAmbiguous";
+function constructRoots(workspace) {
+	const roots = /* @__PURE__ */ new Set();
+	for (const glob of allConstructGlobs(workspace)) {
+		const rel = toPosix(relative(workspace.root, glob));
+		if (!rel || rel.startsWith("..")) continue;
+		const first = rel.split("/")[0];
+		if (/[*?{}[\]!]/.test(first)) continue;
+		roots.add(first);
 	}
-};
-var PgBossNeedsDatabase = class extends Error {
-	ids;
-	constructor(ids) {
-		super(`pg-boss keeps its queues in a declared database, and none was declared. Declare one: on this deploy target, events are carried by pg-boss. Queues and topics affected: ${ids.join(", ")}.`);
-		this.ids = ids;
-		this.name = "PgBossNeedsDatabase";
+	return [...roots].sort();
+}
+function packageName(dir) {
+	try {
+		const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf-8"));
+		return typeof pkg.name === "string" ? pkg.name : void 0;
+	} catch {
+		return;
 	}
-};
+}
+function toPosix(path) {
+	return path.split(sep).join("/");
+}
 //#endregion
 //#region src/reconcile/env.ts
 /**
@@ -2938,6 +3305,13 @@ function envFor(plan, options) {
 			if (owner) env[provideKey(resource.id, "ownerUrl")] = owner;
 		}
 		if (resource.kind === "external-api" && url && resource.fake) env[provideKey(resource.id, "credentials")] = resource.fake.credentials;
+		if (resource.kind === "telemetry" && url) {
+			const login = options.credentials.logs;
+			Object.assign(env, telemetryEnv({
+				endpoint: url,
+				headers: otlpHeaders(login.email, login.password)
+			}, 1));
+		}
 		if (resource.kind === "email" && url) {
 			env[provideKey(resource.id, "from")] = options.mailFrom ?? `noreply@${LOCAL_HOST}`;
 			const inbox = options.ports[MAILPIT_INBOX_PORT];
@@ -3118,6 +3492,7 @@ function urlFor(resource, plan, ports, project, addresses, credential) {
 				password: localRolePassword(project, plan, role, credential.seed)
 			});
 		}
+		case "telemetry": return `http://${LOCAL_HOST}:${port}/api/${LOGS_ORG}`;
 		case "email": return `smtp://${LOCAL_HOST}:${port}`;
 		case "objects": return `s3://${resource.name}?region=${LOCAL_REGION}&endpoint=http://${LOCAL_HOST}:${port}&forcePathStyle=true`;
 		case "file-server": {
@@ -3429,7 +3804,10 @@ function appEnvKeys(manifest, appName, runnables = {}) {
 		}
 	}
 	addEdgeKeys(manifest, edges, keys);
-	if (declaration.kind === "site" || declaration.kind === "mobile-app") for (const key of Object.keys(publicEnvFor(declaration, manifest))) keys.add(key);
+	if (declaration.kind === "site" || declaration.kind === "mobile-app") {
+		for (const key of TELEMETRY_KEYS) keys.delete(key);
+		for (const key of Object.keys(publicEnvFor(declaration, manifest))) keys.add(key);
+	}
 	return keys;
 }
 /**
@@ -3519,7 +3897,11 @@ function appServices(workspace, manifest, containers, credentials, runnables = {
 			continue;
 		}
 		const allowed = appEnvKeys(manifest, name, runnables);
-		const own = Object.fromEntries(Object.entries(env).filter(([envKey]) => allowed?.has(envKey)));
+		const own = scopeTelemetryEnv(Object.fromEntries(Object.entries(env).filter(([envKey]) => allowed?.has(envKey))), {
+			uses: appTelemetry(manifest, name) !== void 0,
+			serviceName: name,
+			telemetry: env
+		});
 		services[key] = {
 			image: `${key}:\${TAG:-latest}`,
 			build,
@@ -4732,6 +5114,8 @@ async function reconcile(options) {
 		...options.fakes ? { fakes: options.fakes } : {},
 		...options.edge === void 0 ? {} : { edge: options.edge }
 	});
+	const exports = stage !== TEST_STAGE;
+	const running = exports ? plan.containers : plan.containers.filter((c) => c !== TELEMETRY_CONTAINER);
 	const composePath = join(root, COMPOSE_PATH);
 	const observed = await observedPorts(docker, composePath, plan.containers, plan.fakes);
 	const ports = await allocate(project, portKeys(plan.containers, plan.fakes), keptPorts(options.saved, observed), probe);
@@ -4746,10 +5130,10 @@ async function reconcile(options) {
 		caddyfile,
 		postgres: postgresStatements(plan, project, seed).map((statement) => statement.create).join(";\n")
 	});
-	const services = serviceAddresses(plan.containers, ports, plan.fakes);
+	const services = serviceAddresses(running, ports, plan.fakes);
 	const lan = plan.resources.some((r) => r.kind === "mobile-app") ? options.lanAddress === void 0 ? lanAddress() : options.lanAddress ?? void 0 : void 0;
 	const envWith = (credentials) => {
-		const env = envFor(plan, {
+		const resolved = envFor(plan, {
 			ports,
 			project,
 			credentials,
@@ -4759,6 +5143,10 @@ async function reconcile(options) {
 			...lan ? { lanAddress: lan } : {},
 			...options.metroPorts ? { metroPorts: options.metroPorts } : {}
 		});
+		const env = exports ? resolved : scopeTelemetryEnv(resolved, {
+			uses: false,
+			serviceName: project
+		});
 		if (plan.containers.includes("caddy")) env.NODE_EXTRA_CA_CERTS = join(root, LOCAL_CA_PATH);
 		return env;
 	};
@@ -4778,7 +5166,7 @@ async function reconcile(options) {
 	};
 	const recorded = await loadState(root, stage);
 	const postgresPort = ports[primaryPortKey("postgres")];
-	if (recorded?.hash === hash && existsSync(composePath) && (!start || await docker.healthy(composePath, plan.containers)) && (!start || !provision || postgresPort === void 0 || await databasesExist(sql(postgresPort, options.credentials.postgres), postgresDatabaseNames(plan)))) return result;
+	if (recorded?.hash === hash && existsSync(composePath) && (!start || await docker.healthy(composePath, running)) && (!start || !provision || postgresPort === void 0 || await databasesExist(sql(postgresPort, options.credentials.postgres), postgresDatabaseNames(plan)))) return result;
 	await write(composePath, toYaml(compose), 384);
 	if (plan.containers.includes("caddy")) {
 		await write(join(root, CADDYFILE_PATH), caddyfileRoot());
@@ -4789,9 +5177,9 @@ async function reconcile(options) {
 			TEST_STAGE
 		]);
 	}
-	if (start && plan.containers.length > 0) {
-		options.progress?.(`🐳 Starting ${plan.containers.join(", ")} — the first start pulls each image, which can take a few minutes`);
-		await docker.up(composePath, plan.containers, options.progress ? { show: true } : {});
+	if (start && running.length > 0) {
+		options.progress?.(`🐳 Starting ${running.join(", ")} — the first start pulls each image, which can take a few minutes`);
+		await docker.up(composePath, running, options.progress ? { show: true } : {});
 	}
 	if (start && plan.containers.includes("caddy")) await docker.reload(composePath, "caddy").catch(() => {});
 	if (start && plan.containers.includes("caddy")) await docker.copyOut(composePath, "caddy", CADDY_ROOT_IN_CONTAINER, join(root, LOCAL_CA_PATH)).catch(() => {});
@@ -4888,295 +5276,6 @@ async function write(path, content, mode) {
 	if (mode !== void 0) await chmod(path, mode);
 }
 //#endregion
-//#region src/deploy/otel.ts
-/**
-* The OpenTelemetry variables a stage's secrets pass to every backend.
-*
-* A production server starts OpenTelemetry when `OTEL_EXPORTER_OTLP_ENDPOINT`
-* is set (`generators/telemetry.ts`), and the SDK reads the rest of its
-* configuration from the standard `OTEL_*` variables. No construct declares
-* them — they say where the telemetry goes, not what the app is — so a target
-* that writes each backend only the keys it reads would never hand them over.
-* Every target that runs backends asks this module instead.
-*
-* Which keys pass is a pattern over the `OTEL_` prefix rather than the prefix
-* alone or a list:
-*
-* - The bare prefix would forward anything a stage happened to name `OTEL_*`
-*   — `OTEL_LOG_LEVEL=debug`, `OTEL_SDK_DISABLED` — to every backend, without
-*   anyone choosing to.
-* - A list would have to spell out the exporter's five settings once for all
-*   signals and once per signal — twenty keys — and would miss the next one.
-*
-* The pattern names the families the server uses: the OTLP exporter's
-* endpoint, headers, protocol, timeout and compression, for every signal or
-* for one (`OTEL_EXPORTER_OTLP_LOGS_ENDPOINT`); sampling; and the resource's
-* identity.
-*
-* Sites get none of it: a site's environment is inlined into a bundle that
-* every browser downloads, and an exporter's headers are a credential.
-*/
-/** The `OTEL_*` variables a backend is handed from the stage's secrets. */
-const OTEL_PASSTHROUGH = /^OTEL_(?:EXPORTER_OTLP_(?:(?:TRACES|LOGS|METRICS)_)?(?:ENDPOINT|HEADERS|PROTOCOL|TIMEOUT|COMPRESSION)|TRACES_SAMPLER(?:_ARG)?|RESOURCE_ATTRIBUTES|SERVICE_NAME)$/;
-/** Whether a stage secret is one of the passed-through `OTEL_*` variables. */
-function isOtelVariable(key) {
-	return OTEL_PASSTHROUGH.test(key);
-}
-/** Whether a variable says where an OTLP exporter sends, or how it signs. */
-function isOtlpDestination(key) {
-	return /^OTEL_EXPORTER_OTLP_(?:(?:TRACES|LOGS|METRICS)_)?(?:ENDPOINT|HEADERS)$/.test(key);
-}
-/**
-* The `OTEL_*` variables one backend runs with: every one the stage's secrets
-* hold, and `OTEL_SERVICE_NAME` — the app's name — where the stage set
-* telemetry up without naming the service. Empty when the stage set none.
-*/
-function otelEnv(custom, app) {
-	const env = {};
-	for (const [key, value] of Object.entries(custom)) if (isOtelVariable(key) && value !== "") env[key] = value;
-	if (Object.keys(env).length > 0 && !env.OTEL_SERVICE_NAME) env.OTEL_SERVICE_NAME = app;
-	return env;
-}
-//#endregion
-//#region src/target/dokploy/domain.ts
-/** A stage was deployed that `deploy.domains` gives no domain. */
-var NoDomainForStage = class extends Error {
-	stage;
-	constructor(stage) {
-		super(`No domain for stage "${stage}". Add it to gkm.config.ts: deploy: { domains: { ${stage}: 'example.com' } }.`);
-		this.stage = stage;
-		this.name = "NoDomainForStage";
-	}
-};
-/**
-* The hostname an app answers on for a stage.
-*
-* 1. An explicit `app.domain` — a string, or one per stage — wins.
-* 2. Otherwise from the stage's base domain in `deploy.domains`: the root site
-*    answers on the domain itself, and every other app on
-*    `{subdomain}.{domain}` — its declaration's `subdomain`, or its own name.
-*
-* @throws {NoDomainForStage} when `deploy.domains` names no domain for it
-*/
-function resolveHost(appName, app, stage, domains, isMainFrontend) {
-	if (app.domain) {
-		if (typeof app.domain === "string") return app.domain;
-		if (app.domain[stage]) return app.domain[stage];
-	}
-	const baseDomain = domains?.[stage];
-	if (!baseDomain) throw new NoDomainForStage(stage);
-	if (isMainFrontend) return baseDomain;
-	return `${app.subdomain ?? appName}.${baseDomain}`;
-}
-/**
-* Whether this app is the site the base domain points at — see `rootSite`,
-* which the local edge asks too.
-*
-* @throws {AmbiguousRootSite} when several sites could be the root and none says it is
-*/
-function isMainFrontendApp(appName, app, allApps) {
-	if (app.type !== "web") return false;
-	return rootSite(Object.entries(allApps).filter(([, a]) => a.type === "web").map(([name, a]) => ({
-		name,
-		root: a.root
-	}))) === appName;
-}
-/**
-* Get public URL arg names from app dependencies.
-*
-* @param app - The web/mobile app configuration
-* @returns Array of arg names like 'NEXT_PUBLIC_API_URL', or [] for frameworks
-*   without a public prefix (e.g. Remix).
-*/
-function getPublicUrlArgNames(app) {
-	const prefix = getPublicEnvPrefix(app.framework);
-	if (!prefix) return [];
-	return app.dependencies.map((dep) => `${prefix}${dep.toUpperCase()}_URL`);
-}
-//#endregion
-//#region src/compose/logs.ts
-/**
-* The stack's log UI: OpenObserve, run beside the apps when
-* `deploy.compose.logs` asks for it, and every backend's OpenTelemetry
-* pointed at it.
-*
-* The production server already exports its traces and pino logs over
-* OTLP/HTTP when `OTEL_EXPORTER_OTLP_ENDPOINT` is set. OpenObserve takes OTLP
-* at `/api/<org>/v1/{logs,traces}` with HTTP basic auth, so wiring an app is
-* two variables: the endpoint, `http://openobserve:5080/api/default`, and
-* the header that signs in as the root user.
-*
-* It is reached, by default, through an SSH tunnel: published on 127.0.0.1
-* only, because a port Docker publishes on every interface is opened in the
-* firewall by Docker itself, past ufw's rules. Served publicly, it is a host
-* on the stack's Caddy that refuses every address not allowed.
-*
-* Pure: the stack decides it, and the phases print and check it.
-*/
-/**
-* The image, pinned. A log store's on-disk format is the thing that must not
-* move under a running stack, so a new version is a change to this line.
-*/
-const OPENOBSERVE_IMAGE = "public.ecr.aws/zinclabs/openobserve:v1.0.4";
-/** Its compose service name — the host the apps send to. */
-const LOGS_SERVICE = "openobserve";
-/** The organisation every app's telemetry lands in. */
-const LOGS_ORG = "default";
-/** The stage secrets that sign in as OpenObserve's root user. */
-const LOGS_EMAIL_KEY = "ZO_ROOT_USER_EMAIL";
-const LOGS_PASSWORD_KEY = "ZO_ROOT_USER_PASSWORD";
-/**
-* The local stage's root user. Its password is generated per machine with
-* the other local logins — see `reconcile/localCredentials.ts`.
-*/
-const LOCAL_LOGS_EMAIL = "admin@gkm.localhost";
-/** The stage sends its telemetry somewhere already, and logs are on too. */
-var LogsEndpointConflict = class extends Error {
-	stage;
-	keys;
-	constructor(stage, keys) {
-		super(`The stage '${stage}' sets ${keys.join(", ")} in its secrets, and deploy.compose.logs also runs OpenObserve for it — each backend can send its telemetry to one place. Either keep your own OTLP backend: remove logs from deploy.compose in gkm.config.ts; or use the bundled OpenObserve: remove ${keys.join(", ")} from the stage's secrets, and every backend is pointed at it.`);
-		this.stage = stage;
-		this.keys = keys;
-		this.name = "LogsEndpointConflict";
-	}
-};
-/** A root password OpenObserve would refuse to start with. */
-var LogsPasswordWeak = class extends Error {
-	stage;
-	constructor(stage) {
-		super(`The stage '${stage}' sets ${LOGS_PASSWORD_KEY}, and OpenObserve refuses it: a root password must be 8 to 128 characters with a lowercase letter, an uppercase letter, a digit and a symbol. Set another with gkm secrets:set ${LOGS_PASSWORD_KEY} '…' --stage ${stage}, or unset it to have one generated.`);
-		this.stage = stage;
-		this.name = "LogsPasswordWeak";
-	}
-};
-/** A deployed stage with logs on and no root password generated yet. */
-var LogsPasswordMissing = class extends Error {
-	stage;
-	constructor(stage) {
-		super(`The stage '${stage}' runs OpenObserve and has no ${LOGS_PASSWORD_KEY} in its secrets. Run gkm compose --stage ${stage} without --dry-run once to generate it, or set one: gkm secrets:set ${LOGS_PASSWORD_KEY} '…' --stage ${stage}`);
-		this.stage = stage;
-		this.name = "LogsPasswordMissing";
-	}
-};
-/** Whether OpenObserve accepts `password` for its root user. */
-function isStrongLogsPassword(password) {
-	return password.length >= 8 && password.length <= 128 && /[a-z]/.test(password) && /[A-Z]/.test(password) && /\d/.test(password) && /[^A-Za-z0-9]/.test(password);
-}
-/**
-* A root password: 192 random bits, with a fixed tail so every class
-* OpenObserve requires is present whatever the random part drew.
-*/
-function generateLogsPassword() {
-	return `${randomBytes(24).toString("base64url")}-Zo1`;
-}
-/**
-* The stage's secrets with a generated root password, where it has none.
-* Pure, like `withGeneratedSecrets`: the caller keeps the result once the
-* run goes ahead.
-*/
-function withLogsPassword(secrets) {
-	if (secrets.custom?.["ZO_ROOT_USER_PASSWORD"]) return {
-		secrets,
-		generated: []
-	};
-	return {
-		secrets: {
-			...secrets,
-			custom: {
-				...secrets.custom,
-				[LOGS_PASSWORD_KEY]: generateLogsPassword()
-			},
-			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-		},
-		generated: [LOGS_PASSWORD_KEY]
-	};
-}
-/**
-* `OTEL_EXPORTER_OTLP_HEADERS` signing in as `email`.
-*
-* The variable's values are percent-decoded by the SDK (they follow the W3C
-* baggage format), so the space after `Basic` is written `%20`. Base64's own
-* `+`, `/` and `=` pass through decoding unchanged.
-*/
-function otlpHeaders(email, password) {
-	return `Authorization=Basic%20${Buffer.from(`${email}:${password}`).toString("base64")}`;
-}
-/** The stack's OpenObserve for one stage. */
-function stackLogs(options) {
-	const { config, stage, local, custom } = options;
-	const conflicting = Object.keys(custom).filter(isOtlpDestination).sort();
-	if (conflicting.length > 0) throw new LogsEndpointConflict(stage, conflicting);
-	if (!local && !options.domain) throw new NoDomainForStage(stage);
-	const email = custom["ZO_ROOT_USER_EMAIL"] ?? (local ? options.localLogin?.email ?? "admin@gkm.localhost" : `admin@${options.domain}`);
-	const set = custom[LOGS_PASSWORD_KEY];
-	const password = set ?? (local ? options.localLogin?.password : void 0);
-	if (!password) throw new LogsPasswordMissing(stage);
-	if (!isStrongLogsPassword(password)) throw new LogsPasswordWeak(stage);
-	const host = config.public ? local ? `logs.${options.project}.localhost` : `logs.${options.domain}` : void 0;
-	const url = host ? `https://${host}${local && options.https !== 443 ? `:${options.https}` : ""}` : `http://localhost:${config.port}`;
-	return {
-		...config,
-		email,
-		password,
-		passwordFromSecrets: Boolean(set),
-		url,
-		...host ? { host } : {},
-		env: {
-			[LOGS_EMAIL_KEY]: email,
-			[LOGS_PASSWORD_KEY]: password,
-			ZO_DATA_DIR: "/data",
-			ZO_COMPACT_DATA_RETENTION_DAYS: String(config.retentionDays),
-			ZO_TELEMETRY: "false"
-		},
-		appEnv: {
-			OTEL_EXPORTER_OTLP_ENDPOINT: `http://${LOGS_SERVICE}:${LOGS_PORT}/api/${LOGS_ORG}`,
-			OTEL_EXPORTER_OTLP_HEADERS: otlpHeaders(email, password)
-		}
-	};
-}
-/**
-* OpenObserve's service. The image has no shell, `wget` or `curl`, so its
-* health check is its own binary asking the running server for its status —
-* which exits non-zero when nothing answers on its port.
-*/
-function logsService(logs) {
-	return {
-		image: OPENOBSERVE_IMAGE,
-		restart: "unless-stopped",
-		env_file: [{
-			path: `./${LOGS_SERVICE}.env`,
-			format: "raw"
-		}],
-		volumes: ["openobserve-data:/data"],
-		...logs.public ? {} : { ports: [`127.0.0.1:${logs.port}:${LOGS_PORT}`] },
-		healthcheck: {
-			test: [
-				"CMD",
-				"/openobserve",
-				"node",
-				"status"
-			],
-			interval: "10s",
-			timeout: "5s",
-			retries: 12,
-			start_period: "20s"
-		}
-	};
-}
-/** What `gkm compose` prints once the stack is up: how to open the logs. */
-function logsAccess(logs, ctx) {
-	const login = `login: ${logs.email}, password: ${ctx.local && !logs.passwordFromSecrets ? logs.password : `gkm secrets:show --stage ${ctx.stage} --reveal → ${LOGS_PASSWORD_KEY}`}`;
-	if (logs.public) return [`📜 Logs (OpenObserve): ${logs.url}  (${login})`, `     answered only for ${logs.public.allow.join(", ")}; every other address gets 403`];
-	return [
-		`📜 Logs (OpenObserve) on 127.0.0.1:${logs.port} — from your computer:`,
-		...ctx.local ? [`     on this machine, open http://localhost:${logs.port} directly; from another:`] : [],
-		`     ssh -N -L ${logs.port}:localhost:${logs.port} ${ctx.user}@${ctx.hostname}   (user and host are guesses: this machine's)`,
-		`     then open http://localhost:${logs.port}  (${login})`,
-		`⚠️  Docker-published ports bypass ufw, so OpenObserve is bound to 127.0.0.1 only — reach it through the tunnel, not by opening the port.`
-	];
-}
-//#endregion
 //#region src/compose/redis.ts
 /**
 * The stack's Redis: what every declared cache lives in when a workspace runs
@@ -6212,10 +6311,7 @@ var WorkerGenerator = class {
 			this.generators.subscriber.build(context, input.subscribers, outputDir, options)
 		]);
 		await writeFile(join(outputDir, "app.ts"), workerApp(context, workerId, outputDir));
-		await writeFile(join(outputDir, "telemetry.ts"), generateTelemetryModule(context.telemetry ? {
-			...context.telemetry,
-			serviceName: workerId
-		} : void 0));
+		await writeTelemetryModule(outputDir, input.telemetry);
 		const entry = join(outputDir, "worker.ts");
 		await writeFile(entry, workerEntry(context.production?.healthCheck ?? "/health"));
 		return entry;
@@ -6339,11 +6435,8 @@ function workerEntry(healthCheck) {
  */
 import { createServer } from 'node:http';
 import { runShutdownHooks } from '@geekmidas/constructs';
-import { startTelemetry } from './telemetry.js';
-
-// Before the worker is imported, so the libraries it loads are instrumented.
-await startTelemetry({ ignorePaths: [${JSON.stringify(healthCheck)}] });
 
+${startTelemetryCode([healthCheck])}
 const { startWorker, logger } = await import('./app.js');
 
 const port = Number(process.env.PORT) || 3000;
@@ -6816,7 +6909,7 @@ async function dockerCommand(options) {
 	const cwd = options.cwd ?? process.cwd();
 	const loaded = await loadWorkspaceConfig(cwd);
 	const names = loaded.type === "single" ? Object.fromEntries(Object.keys(loaded.workspace.apps).map((name) => [name, resolveDockerConfig(loaded.raw).imageName])) : {};
-	const result = await workspaceDockerCommand(loaded.workspace, loaded.manifest, names, loaded.background);
+	const result = await workspaceDockerCommand(loaded.workspace, loaded.manifest, names, loaded.background, options.stage);
 	if (options.build) for (const app of result.apps) await buildDockerImage(app, result.buildRoot, options);
 	if (options.push) for (const app of result.apps) await pushDockerImage(app.imageName, options, result.buildRoot);
 	return result;
@@ -6868,7 +6961,7 @@ async function pushDockerImage(imageName, options, cwd) {
 * Generate Dockerfiles for all apps in a workspace.
 * @internal Exported for testing
 */
-async function workspaceDockerCommand(workspace, manifest, imageNames = {}, background = {}) {
+async function workspaceDockerCommand(workspace, manifest, imageNames = {}, background = {}, stage) {
 	const results = [];
 	const layout = imageLayout(workspace);
 	logger.log(`\n🐳 Generating Dockerfiles for workspace: ${workspace.name}`);
@@ -6885,7 +6978,9 @@ async function workspaceDockerCommand(workspace, manifest, imageNames = {}, back
 			layout,
 			workspaceRoot: workspace.root,
 			apps: workspace.apps,
-			...manifest ? { manifest } : {}
+			...manifest ? { manifest } : {},
+			workspace,
+			...stage ? { stage } : {}
 		});
 		const path = dockerfileOf(appName, app.path);
 		const dockerfilePath = join(workspace.root, path);
@@ -6940,7 +7035,7 @@ async function workspaceDockerCommand(workspace, manifest, imageNames = {}, back
 * framework. The one choice every builder of images makes.
 */
 function appDockerfile(appName, app, options) {
-	const image = appImageOptions(options.layout, appName, app, options.workspaceRoot, options.apps);
+	const image = appImageOptions(options.layout, appName, app, options.workspaceRoot, options.apps, app.type === "web" && options.manifest && options.workspace ? siteClientTelemetry(options.manifest, appName, options.workspace, options.stage) : void 0);
 	if (app.type === "web") return siteDockerfile(appName, app, {
 		image,
 		...options.manifest ? { manifest: options.manifest } : {},
@@ -7451,6 +7546,6 @@ function reportPlannedSeeds(planned, log) {
 	for (const { folder, seeds } of planned) log(`🌱 ${folder}: would run ${seeds.length} (${seeds.join(", ")})`);
 }
 //#endregion
-export { postgresSuperuser as $, EMULATOR_ACCESS_KEY_ID as $t, UnknownDevService as A, projectName as An, appEnvKeys as At, WorkerGenerator as B, imageLayout as Bt, workerDockerfile as C, applicationName as Cn, postgresDatabaseNames as Ct, DevServicesNeedServerTarget as D, isOwnedBy as Dn, ensurePostgresLogin as Dt, DEV_SERVICES as E, imageRef as En, LEGACY_LOCAL_LOGIN as Et, parseDevServices as F, withCustomSecret as Fn, localRolePassword as Ft, FAKE_ENV as G, imageBuildCredentials as Gt, workerEntryDir as H, WORKER_PORT as Ht, reportDevServices as I, planFor as It, derivedContainers as J, eventsBackendFor as Jt, backendsOf as K, isImageBuild as Kt, requiredStageKeys as L, resourceName as Lt, devServicesUsed as M, maskPassword as Mn, networkEnv as Mt, externalServices as N, storage_exports as Nn, workerEnvKeys as Nt, ExternalServicesNotConfigured as O, markerOf as On, bucketClient as Ot, manifestServiceDeclarations as P, toEmbeddableSecrets as Pn, envFor as Pt, loadLocalCredentials as Q, composeFor as Qt, suppliedOnly as R, hostFor as Rt, ensureDockerignore as S, readKey as Sn, bucketPolicies as St, validateImageRef as T, imageName as Tn, quoteIdentifier as Tt, QueueGenerator as U, detectPackageManager as Ut, workerBundleName as V, TURBO_VERSION as Vt, CronGenerator as W, findBuildRoot as Wt, workspace_exports as X, storageBackendFor as Xt, reconcileWorkspace as Y, providerOf as Yt, LOCAL_RABBITMQ_USER as Z, CLUSTER_DATABASE as Zt, DeployJournal as _, store_exports as _n, LOCAL_CA_PATH as _t, createEmptyState as a, primaryPortKey as an, runsRedis as at, appDockerfile as b, keystoreProject as bn, applyPolicies as bt, isDnsVerified as c, findAvailablePort as cn, LOGS_SERVICE as ct, setApplicationId as d, loadPortState as dn, stackLogs as dt, DEFAULT_IMAGES as en, readLocalCredentials as et, setBackupState as f, loadSecretsForApp as fn, withLogsPassword as ft, setPostgresBackupId as g, storeFromConfig as gn, otelEnv as gt, setGeneratedSecret as h, secretsStoreFor as hn, resolveHost as ht, assertNoStaleSecrets as i, portsOf as in, redisService as it, assertExternalServices as j, initStageSecrets as jn, dockerfileOf as jt, STORAGE_KEY_PAIR as k, ownershipMarker as kn, pgClient as kt, recordRelease as l, isPortAvailable as ln, logsAccess as lt, setDnsVerification as m, isRemoteStore as mn, isMainFrontendApp as mt, reportDatabaseRuns as n, fakeKey as nn, REDIS_SERVICE as nt, getBackupState as o, createCredentialsPreload as on, stackRedis as ot, setDnsRecord as p, prepareEntryCredentials as pn, NoDomainForStage as pt, constructGlobs as q, cacheBackendFor as qt, reportPlannedSeeds as r, portKeys as rn, STACK_CACHE as rt, getGeneratedSecret as s, createEntryWrapper as sn, withRedisPassword as st, DeploySeedsFailed as t, describeServices as tn, withGeneratedSecrets as tt, recordRollback as u, loadEnvFiles as un, logsService as ut, DockerBuildFailed as v, FileSecretsStore as vn, forgetState as vt, workerDockerfileOf as w, deployIdentity as wn, postgresStatements as wt, dockerCommand as x, projectKey as xn, applyPostgres as xt, DockerPushFailed as y, getKeyPath as yn, applyBuckets as yt, workerUnits as z, composeBuildPaths as zt };
+export { postgresSuperuser as $, describeServices as $t, UnknownDevService as A, maskPassword as An, WORKER_PORT as At, WorkerGenerator as B, NoDomainForStage as Bn, composeFor as Bt, workerDockerfile as C, imageName as Cn, networkEnv as Ct, DevServicesNeedServerTarget as D, ownershipMarker as Dn, composeBuildPaths as Dt, DEV_SERVICES as E, markerOf as En, localRolePassword as Et, parseDevServices as F, LOGS_SERVICE as Fn, cacheBackendFor as Ft, FAKE_ENV as G, hostFor as Gt, workerEntryDir as H, resolveHost as Hn, TELEMETRY_CONTAINER as Ht, reportDevServices as I, logsAccess as In, eventsBackendFor as It, derivedContainers as J, scopeTelemetryEnv as Jt, backendsOf as K, appTelemetry as Kt, requiredStageKeys as L, logsService as Ln, providerOf as Lt, devServicesUsed as M, toEmbeddableSecrets as Mn, findBuildRoot as Mt, externalServices as N, withCustomSecret as Nn, imageBuildCredentials as Nt, ExternalServicesNotConfigured as O, projectName as On, imageLayout as Ot, manifestServiceDeclarations as P, LOCAL_LOGS_EMAIL as Pn, isImageBuild as Pt, loadLocalCredentials as Q, DEFAULT_IMAGES as Qt, suppliedOnly as R, stackLogs as Rn, storageBackendFor as Rt, ensureDockerignore as S, deployIdentity as Sn, dockerfileOf as St, validateImageRef as T, isOwnedBy as Tn, envFor as Tt, QueueGenerator as U, planFor as Ut, workerBundleName as V, isMainFrontendApp as Vn, EMULATOR_ACCESS_KEY_ID as Vt, CronGenerator as W, resourceName as Wt, workspace_exports as X, telemetryOf as Xt, reconcileWorkspace as Y, surfaceClientTraced as Yt, LOCAL_RABBITMQ_USER as Z, usesTelemetry as Zt, DeployJournal as _, getKeyPath as _n, LEGACY_LOCAL_LOGIN as _t, createEmptyState as a, createEntryWrapper as an, runsRedis as at, appDockerfile as b, readKey as bn, pgClient as bt, isDnsVerified as c, loadEnvFiles as cn, LOCAL_CA_PATH as ct, setApplicationId as d, prepareEntryCredentials as dn, applyPolicies as dt, fakeKey as en, readLocalCredentials as et, setBackupState as f, isRemoteStore as fn, applyPostgres as ft, setPostgresBackupId as g, FileSecretsStore as gn, quoteIdentifier as gt, setGeneratedSecret as h, store_exports as hn, postgresStatements as ht, assertNoStaleSecrets as i, createCredentialsPreload as in, redisService as it, assertExternalServices as j, storage_exports as jn, detectPackageManager as jt, STORAGE_KEY_PAIR as k, initStageSecrets as kn, TURBO_VERSION as kt, recordRelease as l, loadPortState as ln, forgetState as lt, setDnsVerification as m, storeFromConfig as mn, postgresDatabaseNames as mt, reportDatabaseRuns as n, portsOf as nn, REDIS_SERVICE as nt, getBackupState as o, findAvailablePort as on, stackRedis as ot, setDnsRecord as p, secretsStoreFor as pn, bucketPolicies as pt, constructGlobs as q, isTelemetryKey as qt, reportPlannedSeeds as r, primaryPortKey as rn, STACK_CACHE as rt, getGeneratedSecret as s, isPortAvailable as sn, withRedisPassword as st, DeploySeedsFailed as t, portKeys as tn, withGeneratedSecrets as tt, recordRollback as u, loadSecretsForApp as un, applyBuckets as ut, DockerBuildFailed as v, keystoreProject as vn, ensurePostgresLogin as vt, workerDockerfileOf as w, imageRef as wn, workerEnvKeys as wt, dockerCommand as x, applicationName as xn, appEnvKeys as xt, DockerPushFailed as y, projectKey as yn, bucketClient as yt, workerUnits as z, withLogsPassword as zn, CLUSTER_DATABASE as zt };
 
-//# sourceMappingURL=seeds-BoKQ74Od.mjs.map
+//# sourceMappingURL=seeds-BK8caVMm.mjs.map