@geekmidas/cli 9.0.2 → 10.0.0-alpha.0

package/dist/credentials-K961ThG3.cjs

@@ -0,0 +1,2680 @@
+const require_chunk = require('./chunk-CUT6urMc.cjs');
+const require_discover = require('./discover-DTmFeloL.cjs');
+const require_config = require('./config-DbPE1KXF.cjs');
+const require_workspace = require('./workspace-XvqO9jIv.cjs');
+const require_generator = require('./generator-CNzBw7g5.cjs');
+const require_storage = require('./storage-BJmzYxt8.cjs');
+const node_fs = require_chunk.__toESM(require("node:fs"));
+const node_path = require_chunk.__toESM(require("node:path"));
+const __geekmidas_manifest = require_chunk.__toESM(require("@geekmidas/manifest"));
+const node_fs_promises = require_chunk.__toESM(require("node:fs/promises"));
+const node_child_process = require_chunk.__toESM(require("node:child_process"));
+const node_net = require_chunk.__toESM(require("node:net"));
+const dotenv = require_chunk.__toESM(require("dotenv"));
+const yaml = require_chunk.__toESM(require("yaml"));
+const __aws_sdk_client_s3 = require_chunk.__toESM(require("@aws-sdk/client-s3"));
+const pg = require_chunk.__toESM(require("pg"));
+const node_util = require_chunk.__toESM(require("node:util"));
+const node_crypto = require_chunk.__toESM(require("node:crypto"));
+const __geekmidas_db_pg_roles = require_chunk.__toESM(require("@geekmidas/db/pg/roles"));
+const __geekmidas_cache_postgres = require_chunk.__toESM(require("@geekmidas/cache/postgres"));
+
+//#region src/workspace/backends.ts
+const CACHE_BACKENDS = [
+	"upstash",
+	"elasticache",
+	"db"
+];
+const EMAIL_BACKENDS = [
+	"resend",
+	"ses",
+	"smtp"
+];
+const STORAGE_BACKENDS = [
+	"minio",
+	"s3",
+	"r2"
+];
+/**
+* The cache backend a workspace selected, or the one its target implies.
+*
+* Defaulted here rather than by every caller, so "what happens when nobody
+* said" is answered once and the answer is greppable — and now answered by
+* *where it deploys*, because there is no single right answer for both a
+* Lambda and a box running its own Postgres.
+*
+* `on` is the deploy target, not where this code happens to be running. A
+* local `gkm dev` for an AWS app still defaults to Upstash, because a backend
+* that differed between local and deployed would be worse than a slower one —
+* which is the property the type's own documentation asks for.
+*/
+function cacheBackendOf(value, on = "aws") {
+	return isBackend(value, CACHE_BACKENDS) ? value : require_discover.DEFAULT_CACHE[on];
+}
+/** The email backend a workspace selected, defaulting to SES on every target. */
+function emailBackendOf(value) {
+	return isBackend(value, EMAIL_BACKENDS) ? value : require_discover.DEFAULT_EMAIL;
+}
+/** The storage backend a workspace selected, or the one its target implies. */
+function storageBackendOf(value, on = "aws") {
+	return isBackend(value, STORAGE_BACKENDS) ? value : require_discover.DEFAULT_STORAGE[on];
+}
+/**
+* Which family of defaults a workspace's deploy target belongs to.
+*
+* One question, asked once: **does this target run containers the project
+* controls?** Dokploy and a bare server do, so a bucket or a cache can live
+* beside the app; AWS, Vercel and Cloudflare do not, so the default has to be
+* something managed. That is the whole of the distinction, and it is why
+* `MainProvider` is the right axis rather than the deploy target's own name —
+* three targets share one answer.
+*
+* An AWS deploy names no `deploy.default` at all, because it goes through SST,
+* which is why the absence is what selects `aws`.
+*/
+function providerOf(workspace) {
+	const target = workspace.deploy?.default;
+	return target === "dokploy" || target === "server" ? "server" : "aws";
+}
+/**
+* Whether a string names a backend, as opposed to being one of the other things
+* a `services:` value can be.
+*
+* A misspelling falls through to the default rather than throwing, which is the
+* wrong trade for something with a cost attached — so callers that can report it
+* should use {@link unknownBackend} to say so.
+*/
+function isBackend(value, backends) {
+	return typeof value === "string" && backends.includes(value);
+}
+
+//#endregion
+//#region src/reconcile/caddyfile.ts
+/**
+* The kinds the edge serves.
+*
+* Everything that owns a *public address*. Deployed, each of these has a real
+* hostname and a certificate, so this is what makes the local shape the same
+* one rather than a near-enough one — and the application is indifferent
+* either way, because it reads whichever address was injected and never
+* composes one.
+*
+* Adding a kind here is the whole of adding it to the edge.
+*/
+const EDGE_KINDS = {
+	"file-server": true,
+	"rest-api": true,
+	site: true
+};
+/**
+* How the edge reaches the host, from inside its container.
+*
+* A surface and a site are served by processes `gkm dev` starts on the host,
+* not by containers — so the edge has to leave Docker's network to reach them.
+* Docker Desktop resolves this name already; on Linux the compose definition
+* maps it to the host gateway.
+*/
+const HOST_GATEWAY = "host.docker.internal";
+/**
+* The suffix every local host shares.
+*
+* `.localhost` rather than a made-up TLD because it resolves to loopback
+* without touching `/etc/hosts` — macOS and systemd-resolved both answer for
+* subdomains of it, and Caddy issues internal certificates for it by default.
+*/
+const LOCAL_TLD = "localhost";
+/**
+* The sites a plan implies, one per file server.
+*
+* The leading label is the *server's* stage-scoped name rather than the
+* bucket's, which is the difference that matters: two servers over one bucket
+* are a legitimate arrangement — two cache behaviours, one origin — and naming
+* the host after the bucket would make them collide.
+*/
+function sitesFor(plan, project, addresses = {}) {
+	const byId = new Map(plan.resources.map((r) => [r.id, r]));
+	const sites = [];
+	for (const resource of plan.resources) {
+		if (!EDGE_KINDS[resource.kind]) continue;
+		const host = hostFor(resource, project);
+		if (resource.kind === "file-server") {
+			const origin = resource.of ? byId.get(resource.of) : void 0;
+			if (!origin) continue;
+			sites.push({
+				host,
+				upstream: "http://minio:9000",
+				rewrite: `/${origin.name}{uri}`
+			});
+			continue;
+		}
+		const address = addresses[resource.id];
+		if (!address) continue;
+		const port = portOf(address);
+		if (!port) continue;
+		sites.push({
+			host,
+			upstream: `http://${HOST_GATEWAY}:${port}`
+		});
+	}
+	return sites;
+}
+/** The port a local address answers on, defaulting by scheme. */
+function portOf(address) {
+	try {
+		const { port, protocol } = new URL(address);
+		return port || (protocol === "https:" ? "443" : "80");
+	} catch {
+		return void 0;
+	}
+}
+/**
+* Where one file server answers, including the stage its name carries.
+*
+* The project is a label rather than a decoration: it is what keeps two
+* checkouts from answering on one address. Omitted when there is no project to
+* name, because an empty label makes `uploads..localhost` — a host nothing
+* resolves and no certificate can be issued for.
+*/
+function hostFor(resource, project) {
+	return [
+		resource.name,
+		project,
+		LOCAL_TLD
+	].filter(Boolean).join(".");
+}
+/**
+* The static root config, which only ever imports.
+*
+* Written once and identical for every stage, because the *sites* are what
+* differ and they live in their own files. That split is not tidiness: one
+* container serves every stage — the same way one Postgres holds `orders` and
+* `orders_test` — so a single Caddyfile would mean `gkm test` deleting the
+* routes `gkm dev` is serving, and each command silently breaking the other.
+*/
+function caddyfileRoot() {
+	return `${GENERATED}
+{
+	# No ACME, no public DNS: the CA is local and so are the names.
+	local_certs
+	auto_https disable_redirects
+}
+
+# One file per stage, so two stages share this edge the way they already share
+# one Postgres and one MinIO.
+import /etc/caddy/sites/*.caddy
+`;
+}
+/**
+* One stage's sites, as the file imported above.
+*
+* `rewrite` rather than a path prefix on the address: the bucket is the
+* origin's business, and the client asks for the key it stored.
+*
+* `header_up Host {upstream_hostport}` matters more than it looks. MinIO routes
+* and signs on the Host header, so forwarding the requested hostname would make
+* it look for a bucket named after the domain.
+*/
+function toCaddyfile(sites) {
+	if (sites.length === 0) return `${GENERATED}
+# No file server is declared in this stage, so it routes nothing.
+`;
+	const blocks = sites.map(({ host, upstream, rewrite }) => `
+https://${host} {
+	tls internal
+
+	reverse_proxy ${upstream} {${rewrite ? `
+		rewrite ${rewrite}
+		# MinIO routes and signs on the Host header, so forwarding the requested
+		# hostname would make it look for a bucket named after the domain.
+		header_up Host {upstream_hostport}` : `
+		# The application reads whatever address was injected, so it has to see
+		# the one a caller used — that is what makes a redirect, a cookie domain
+		# and a generated link point back here rather than at the upstream.
+		header_up Host {host}
+		header_up X-Forwarded-Proto {scheme}`}
+	}
+}`);
+	return `${GENERATED}${blocks.join("\n")}\n`;
+}
+const GENERATED = `# Generated by gkm from the construct manifest — do not edit.
+#
+# One host per declared file server, in front of the object store that holds its
+# objects. This is the shape a file server has deployed — a domain serving a
+# bucket — which MinIO alone cannot produce: its virtual-host mode reads the
+# leading label as the bucket name.
+#
+# Certificates come from Caddy's own CA. "gkm dev" and "gkm test" export its
+# root and point Node at it, so nothing has to be installed to use these URLs
+# from code; a browser needs the root trusted once.
+`;
+
+//#endregion
+//#region src/reconcile/clients.ts
+/** The credential local containers are brought up with. */
+const LOCAL_USER$2 = "geekmidas";
+/**
+* A Postgres client that opens one connection per database it is asked about.
+*
+* `CREATE DATABASE` cannot run from a connection to the database being created,
+* and a schema must be created from inside its own database — so the database is
+* part of each query rather than fixed when the client is built.
+*/
+function pgClient(port) {
+	return { async query(database, sql, values) {
+		const client = new pg.Client({
+			host: "localhost",
+			port,
+			user: LOCAL_USER$2,
+			password: LOCAL_USER$2,
+			database: database ?? LOCAL_USER$2
+		});
+		await client.connect();
+		try {
+			const result = await client.query(sql, values);
+			return result.rows;
+		} finally {
+			await client.end();
+		}
+	} };
+}
+/** A bucket client pointed at the local MinIO. */
+function bucketClient(port) {
+	const s3 = new __aws_sdk_client_s3.S3Client({
+		region: "us-east-1",
+		endpoint: `http://localhost:${port}`,
+		forcePathStyle: true,
+		credentials: {
+			accessKeyId: LOCAL_USER$2,
+			secretAccessKey: LOCAL_USER$2
+		}
+	});
+	return {
+		async exists(bucket) {
+			try {
+				await s3.send(new __aws_sdk_client_s3.HeadBucketCommand({ Bucket: bucket }));
+				return true;
+			} catch {
+				return false;
+			}
+		},
+		async create(bucket) {
+			await s3.send(new __aws_sdk_client_s3.CreateBucketCommand({ Bucket: bucket }));
+		},
+		async policy(bucket) {
+			try {
+				const result = await s3.send(new __aws_sdk_client_s3.GetBucketPolicyCommand({ Bucket: bucket }));
+				return result.Policy;
+			} catch {
+				return void 0;
+			}
+		},
+		async setPolicy(bucket, policy) {
+			await s3.send(new __aws_sdk_client_s3.PutBucketPolicyCommand({
+				Bucket: bucket,
+				Policy: policy
+			}));
+		}
+	};
+}
+
+//#endregion
+//#region src/reconcile/containers.ts
+/**
+* What gkm knows about each container it can derive.
+*
+* Everything provider-specific about the local target lives here: the image, the
+* ports the image listens on, and whether its data is worth keeping. The plan
+* says *which* containers exist and never says any of this, which is the split
+* the design asks for — neutral facts from the declaration, provider detail
+* from here and from config.
+*
+* Shared by allocation and by the compose writer so the two cannot disagree
+* about how many ports a container needs.
+*/
+/**
+* The Postgres image for a major version.
+*
+* One place that knows the tag shape, so a declared version reaches the
+* container without anyone restating `-alpine` beside it.
+*/
+function postgresImage(version) {
+	return `postgres:${version}-alpine`;
+}
+/**
+* The default image for each container.
+*
+* Pinned to a major rather than `latest` where the image publishes one, so a
+* rebuild does not silently move a developer's Postgres a version. Overridable
+* per project: a project needing `postgis/postgis` says so in config.
+*/
+const DEFAULT_IMAGES = {
+	postgres: postgresImage(__geekmidas_manifest.DEFAULT_POSTGRES_VERSION),
+	minio: "quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z",
+	mailpit: "axllent/mailpit:latest",
+	redis: "redis:8-alpine",
+	"redis-http": "hiett/serverless-redis-http:latest",
+	rabbitmq: "rabbitmq:4-management-alpine",
+	localstack: "floci/floci:latest",
+	caddy: "caddy:2-alpine"
+};
+/**
+* The ports each container listens on.
+*
+* The first is always the one an app connects to; the rest are consoles and
+* management UIs, published because a bucket or an inbox you can look at is most
+* of why these are real containers rather than stubs.
+*/
+const PORTS = {
+	postgres: [{
+		key: "postgres",
+		inside: 5432,
+		label: "postgres"
+	}],
+	minio: [{
+		key: "minio",
+		inside: 9e3,
+		label: "minio api"
+	}, {
+		key: "minio-console",
+		inside: 9001,
+		label: "minio console"
+	}],
+	mailpit: [{
+		key: "mailpit",
+		inside: 1025,
+		label: "smtp"
+	}, {
+		key: "mailpit-web",
+		inside: 8025,
+		label: "mailpit inbox"
+	}],
+	redis: [{
+		key: "redis",
+		inside: 6379,
+		label: "redis"
+	}],
+	"redis-http": [{
+		key: "redis-http",
+		inside: 80,
+		label: "cache"
+	}],
+	rabbitmq: [{
+		key: "rabbitmq",
+		inside: 5672,
+		label: "amqp"
+	}, {
+		key: "rabbitmq-management",
+		inside: 15672,
+		label: "rabbitmq console"
+	}],
+	localstack: [{
+		key: "localstack",
+		inside: 4566,
+		label: "localstack"
+	}],
+	caddy: [{
+		key: "caddy",
+		inside: 443,
+		label: "https edge"
+	}]
+};
+/** The ports a container needs published. Empty for one gkm does not know. */
+function portsOf(container) {
+	return PORTS[container] ?? [];
+}
+/** The key a container's primary port is allocated under. */
+function primaryPortKey(container) {
+	return portsOf(container)[0]?.key ?? container;
+}
+/**
+* Every port key a set of containers needs, in a stable order.
+*
+* What allocation is handed: it assigns ports to names and knows nothing about
+* what listens on them.
+*/
+function portKeys(containers) {
+	return [...containers].sort().flatMap((container) => portsOf(container).map((port) => port.key));
+}
+/**
+* The named volume a container's data lives in.
+*
+* Mailpit deliberately has none: local mail is disposable, and an inbox that
+* survives days of dev is noise rather than state.
+*/
+function volumeOf(container) {
+	const volumes = {
+		postgres: "postgres-data",
+		minio: "minio-data",
+		redis: "redis-data",
+		rabbitmq: "rabbitmq-data",
+		localstack: "localstack-data",
+		caddy: "caddy-data"
+	};
+	return volumes[container];
+}
+
+//#endregion
+//#region src/reconcile/compose.ts
+/** The credential every derived container is brought up with locally. */
+const LOCAL_USER$1 = "geekmidas";
+/**
+* The token the local cache accepts.
+*
+* Fixed rather than generated: it is only ever reachable on a port this project
+* published, and the URL that carries it is derived, so nothing is made safer
+* by making it unguessable and a stable one keeps `redis-cli` sessions working.
+*/
+const LOCAL_TOKEN$1 = "geekmidas";
+/**
+* Build the compose document for a plan.
+*
+* Every container is published on its assigned port, never on the image's
+* default: the point of allocation is that two projects can run at once, and
+* one container publishing 5432 puts that back.
+*/
+function composeFor(plan, options) {
+	const services = {};
+	const volumes = {};
+	for (const container of [...plan.containers].sort()) {
+		const declared = container === "postgres" ? plan.resources.find((r) => r.version)?.version : void 0;
+		const image = options.images?.[container] ?? (declared ? postgresImage(declared) : DEFAULT_IMAGES[container]);
+		if (!image) throw new UnknownContainer(container);
+		services[container] = define(container, image, publish(container, options.ports));
+		const volume = volumeOf(container);
+		if (volume) volumes[volume] = {};
+	}
+	return {
+		name: options.project,
+		services,
+		...Object.keys(volumes).length ? { volumes } : {}
+	};
+}
+/** Render a compose document as the file it becomes. */
+function toYaml(file) {
+	return `# Generated by gkm from the construct manifest — do not edit.
+# Containers are derived from what the app declares; images and anything no
+# construct implies are yours, in gkm.config.ts.
+#
+# Use "gkm dev" or "gkm test" to start these. Running "docker compose up"
+# directly will not inject secrets.
+${(0, yaml.stringify)(file, { lineWidth: 0 })}`;
+}
+/** A container with no image, from config or from the defaults. */
+var UnknownContainer = class extends Error {
+	/** The container that could not be resolved. */
+	container;
+	/** The containers that have a default, so the caller can see the set. */
+	known = Object.keys(DEFAULT_IMAGES).sort();
+	constructor(container) {
+		super("No image is known for this container; pin one in config");
+		this.name = "UnknownContainer";
+		this.container = container;
+	}
+};
+/** One container's definition, published on the port it was assigned. */
+function define(container, image, published) {
+	switch (container) {
+		case "postgres": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			environment: {
+				POSTGRES_USER: LOCAL_USER$1,
+				POSTGRES_PASSWORD: LOCAL_USER$1,
+				POSTGRES_DB: LOCAL_USER$1
+			},
+			volumes: ["postgres-data:/var/lib/postgresql"],
+			healthcheck: {
+				test: ["CMD-SHELL", `pg_isready -U ${LOCAL_USER$1}`],
+				interval: "5s",
+				timeout: "3s",
+				retries: 10,
+				start_period: "10s"
+			}
+		};
+		case "minio": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			environment: {
+				MINIO_ROOT_USER: LOCAL_USER$1,
+				MINIO_ROOT_PASSWORD: LOCAL_USER$1
+			},
+			command: "server --console-address \":9001\" /data",
+			volumes: ["minio-data:/data"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"mc",
+					"ready",
+					"local"
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5,
+				start_period: "10s"
+			}
+		};
+		case "caddy": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			volumes: [
+				"./Caddyfile:/etc/caddy/Caddyfile:ro",
+				"./caddy-sites:/etc/caddy/sites:ro",
+				"caddy-data:/data"
+			],
+			extra_hosts: ["host.docker.internal:host-gateway"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"caddy",
+					"version"
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5
+			}
+		};
+		case "mailpit": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			environment: {
+				MP_SMTP_AUTH_ACCEPT_ANY: "1",
+				MP_SMTP_AUTH_ALLOW_INSECURE: "1"
+			},
+			healthcheck: {
+				test: [
+					"CMD",
+					"wget",
+					"-q",
+					"--spider",
+					"http://localhost:8025"
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5
+			}
+		};
+		case "redis": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			volumes: ["redis-data:/data"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"redis-cli",
+					"ping"
+				],
+				interval: "5s",
+				timeout: "3s",
+				retries: 5
+			}
+		};
+		case "redis-http": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			environment: {
+				SRH_MODE: "env",
+				SRH_TOKEN: LOCAL_TOKEN$1,
+				SRH_CONNECTION_STRING: "redis://redis:6379"
+			},
+			depends_on: ["redis"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"wget",
+					"-q",
+					"-O",
+					"/dev/null",
+					"http://127.0.0.1:80/"
+				],
+				interval: "5s",
+				timeout: "3s",
+				retries: 10
+			}
+		};
+		case "rabbitmq": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			environment: {
+				RABBITMQ_DEFAULT_USER: LOCAL_USER$1,
+				RABBITMQ_DEFAULT_PASS: LOCAL_USER$1
+			},
+			volumes: ["rabbitmq-data:/var/lib/rabbitmq"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"rabbitmq-diagnostics",
+					"-q",
+					"ping"
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5
+			}
+		};
+		case "localstack": return {
+			image,
+			restart: "unless-stopped",
+			ports: published,
+			environment: {
+				AWS_DEFAULT_REGION: "us-east-1",
+				AWS_ACCESS_KEY_ID: "LSIAQAAAAAAVNCBMPNSG",
+				AWS_SECRET_ACCESS_KEY: LOCAL_USER$1
+			},
+			volumes: ["localstack-data:/var/lib/localstack"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"curl",
+					"-f",
+					"http://localhost:4566/_localstack/health"
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5,
+				start_period: "10s"
+			}
+		};
+		default: throw new UnknownContainer(container);
+	}
+}
+/**
+* The published port mappings for a container.
+*
+* Every port is looked up by its own key rather than being derived as an offset
+* from the container's first, so MinIO's console cannot land on whatever was
+* allocated to the next container.
+*/
+function publish(container, ports) {
+	return portsOf(container).map((port) => {
+		const assigned = ports[port.key];
+		if (assigned === void 0) throw new UnassignedPort(port.key);
+		return `${assigned}:${port.inside}`;
+	});
+}
+/** A planned port that allocation never assigned. */
+var UnassignedPort = class extends Error {
+	/** The port key that went unassigned, e.g. `minio-console`. */
+	key;
+	constructor(key) {
+		super("No port was assigned for this container port");
+		this.name = "UnassignedPort";
+		this.key = key;
+	}
+};
+
+//#endregion
+//#region src/reconcile/docker.ts
+const run = (0, node_util.promisify)(node_child_process.execFile);
+/** How long to wait for containers to pass their health checks. */
+const HEALTH_TIMEOUT_MS = 12e4;
+const dockerCli = {
+	async publishedPort(composePath, service, inside) {
+		try {
+			const { stdout } = await run("docker", [
+				"compose",
+				"-f",
+				composePath,
+				"port",
+				service,
+				String(inside)
+			]);
+			const port = Number(stdout.trim().split(":").pop());
+			return Number.isFinite(port) && port > 0 ? port : void 0;
+		} catch {
+			return void 0;
+		}
+	},
+	async up(composePath, services) {
+		await run("docker", [
+			"compose",
+			"-f",
+			composePath,
+			"up",
+			"-d",
+			"--remove-orphans",
+			"--wait",
+			`--wait-timeout=${Math.floor(HEALTH_TIMEOUT_MS / 1e3)}`,
+			...services
+		]);
+	},
+	async copyOut(composePath, service, from, to) {
+		await (0, node_fs_promises.mkdir)((0, node_path.dirname)(to), { recursive: true });
+		await run("docker", [
+			"compose",
+			"-f",
+			composePath,
+			"cp",
+			`${service}:${from}`,
+			to
+		]);
+	},
+	async reload(composePath, service) {
+		await run("docker", [
+			"compose",
+			"-f",
+			composePath,
+			"exec",
+			"-T",
+			service,
+			"caddy",
+			"reload",
+			"--config",
+			"/etc/caddy/Caddyfile"
+		]);
+	},
+	async healthy(composePath, services) {
+		if (services.length === 0) return true;
+		try {
+			const { stdout } = await run("docker", [
+				"compose",
+				"-f",
+				composePath,
+				"ps",
+				"--format",
+				"json",
+				...services
+			]);
+			const running = /* @__PURE__ */ new Set();
+			for (const line of stdout.trim().split("\n").filter(Boolean)) {
+				const entry = JSON.parse(line);
+				const ok = entry.State === "running" && (entry.Health === void 0 || entry.Health === "" || entry.Health === "healthy");
+				if (ok && entry.Service) running.add(entry.Service);
+			}
+			return services.every((service) => running.has(service));
+		} catch {
+			return false;
+		}
+	}
+};
+
+//#endregion
+//#region src/reconcile/plan.ts
+/** The stage whose resources carry no suffix. */
+const DEFAULT_STAGE = "development";
+/**
+* Which container serves a kind.
+*
+* Derived kinds map to the same container as their parent — a schema tenant
+* lives in its parent's Postgres — so the set is deduplicated rather than
+* counted.
+*/
+const CONTAINERS = {
+	database: "postgres",
+	"database-reader": "postgres",
+	"database-schema": "postgres",
+	objects: "minio",
+	"file-server": "caddy",
+	email: "mailpit"
+};
+/**
+* The container a cache backend needs locally.
+*
+* Each one matches the protocol its deployed form speaks, which is the property
+* worth having: a cache that behaves differently in the two places is worse than
+* a slower one.
+*
+* `db` is deliberately absent, the same way `pgboss` is absent from
+* `EVENT_CONTAINERS`: the cache is a table in a database the manifest already
+* declares, so mapping it here would start a container for a project that needs
+* none.
+*/
+const CACHE_CONTAINERS = {
+	upstash: "redis-http",
+	elasticache: "redis"
+};
+/**
+* Kinds that resolve a value without anything running.
+*
+* A secret is the case: it has no address, so there is nothing to start and
+* nothing to connect to — but it still appears in the plan, because the target
+* still has to resolve it.
+*/
+const CONTAINERLESS = {
+	secret: true,
+	credential: true,
+	"rest-api": true,
+	site: true
+};
+/**
+* Containers that cannot run alone.
+*
+* The one case is the cache: `serverless-redis-http` is a proxy and needs the
+* Redis it proxies. Kept here rather than in the compose definition so the plan
+* -- which is what decides what must be running -- still names everything.
+*/
+const REQUIRES = { "redis-http": ["redis"] };
+/**
+* The role each kind's one key plays, where it is not a URL.
+*
+* The twin of `ProvidesByKind` in `@geekmidas/manifest`: that is what a
+* construct declares, this is what the local target resolves, and both derive
+* the key from the same `provideKey` so they cannot disagree.
+*/
+const ROLES = {
+	queue: "publisherConnectionString",
+	topic: "publisherConnectionString",
+	credential: "credential"
+};
+/** The kinds whose container is the events backend's rather than their own. */
+const EVENT_KINDS = {
+	queue: true,
+	topic: true
+};
+/**
+* Which kinds provision something *inside* their container.
+*
+* A database creates a database, a bucket creates a bucket; mail creates
+* nothing — Mailpit accepts whatever is sent to it and has no per-stage object
+* to name. Both still appear in the plan, because both still resolve a URL; the
+* flag is the difference between "must be running" and "must be created".
+*/
+const PROVISIONS = {
+	database: true,
+	"database-reader": true,
+	"database-schema": true,
+	objects: true,
+	cache: true,
+	"file-server": true
+};
+/**
+* The container each events backend needs, where it needs one of its own.
+*
+* `pgboss` is deliberately absent rather than mapped to `postgres`: it is a
+* schema tenant in a database the manifest already declares, so mapping it here
+* would start a Postgres for a project that declared no database at all.
+*
+* This one comes from config rather than from a declaration because there are
+* no `topic` or `queue` kinds yet. When they land the mapping moves to
+* {@link CONTAINERS} keyed by kind, and this constant goes with them.
+*/
+const EVENT_CONTAINERS = {
+	sns: "localstack",
+	rabbitmq: "rabbitmq"
+};
+/** The backend a project gets when it declares queues or topics and says nothing. */
+const DEFAULT_EVENTS = "pgboss";
+/**
+* How a resource of each kind separates its stage suffix.
+*
+* Postgres identifiers are snake_case and a hyphen would need quoting
+* everywhere; buckets and queues are kebab and disallow underscores in some
+* providers. The suffix is the same word either way.
+*/
+const SEPARATORS = {
+	database: "_",
+	"database-reader": "_",
+	"database-schema": "_",
+	objects: "-"
+};
+/**
+* The stage-scoped name for a resource.
+*
+* The default stage carries no suffix, so `gkm dev` keeps using `orders` and a
+* developer's psql history, saved connections, and muscle memory survive this
+* change. Every other stage is suffixed.
+*/
+function resourceName(id, kind, stage) {
+	const base = id.toLowerCase();
+	if (stage === DEFAULT_STAGE) return base;
+	return `${base}${SEPARATORS[kind] ?? "-"}${stage}`;
+}
+/**
+* The container a kind needs, or `undefined` if it needs none.
+*
+* Queues and topics have no container of their own — they live in whichever
+* broker the project selected, which is why the backend is an argument here
+* rather than a second pass that adds containers after the fact.
+*/
+function containerFor(kind, events = DEFAULT_EVENTS, cache = require_discover.DEFAULT_CACHE.aws, derived = false, edge = true) {
+	if (EVENT_KINDS[kind]) return EVENT_CONTAINERS[events] ?? CONTAINERS.database;
+	if (kind === "file-server") return edge ? "caddy" : CONTAINERS.objects;
+	if (kind === "cache") {
+		if (derived) return CONTAINERS.database;
+		return CACHE_CONTAINERS[cache] ?? CONTAINERS.database;
+	}
+	return CONTAINERS[kind];
+}
+/**
+* Build the plan for a manifest and stage.
+*
+* `order` is the caller's provisioning order — parents before children — which
+* `provisionOrder` produces from the manifest. Passing it in keeps this
+* function free of the traversal and makes the ordering assertable on its own.
+*/
+function planFor(manifest, stage, order, options = {}) {
+	const containers = /* @__PURE__ */ new Set();
+	const resources = [];
+	const events = options.events ?? DEFAULT_EVENTS;
+	const cache = options.cache ?? require_discover.DEFAULT_CACHE.aws;
+	for (const id of order) {
+		const declaration = manifest[id];
+		if (!declaration) continue;
+		const container = containerFor(declaration.kind, events, cache, "of" in declaration && typeof declaration.of === "string", options.edge !== false);
+		if (!container && !CONTAINERLESS[declaration.kind]) continue;
+		if (container) {
+			containers.add(container);
+			for (const required of REQUIRES[container] ?? []) containers.add(required);
+		}
+		resources.push({
+			id,
+			kind: declaration.kind,
+			...container ? { container } : {},
+			name: resourceName(id, declaration.kind, stage),
+			envKey: (0, __geekmidas_manifest.providedKeyFor)(id, declaration.kind, ROLES[declaration.kind] ?? "url"),
+			provisions: PROVISIONS[declaration.kind] === true,
+			...declaration.kind === "rest-api" ? { callers: (0, __geekmidas_manifest.dependentsOf)(manifest, id) } : {},
+			...declaration.kind === "site" ? { publicEnv: (0, __geekmidas_manifest.publicEnvFor)(declaration, manifest) } : {},
+			...declaration.kind === "file-server" && declaration.open?.length ? { open: declaration.open } : {},
+			..."of" in declaration ? { of: declaration.of } : {},
+			..."schema" in declaration && declaration.schema ? { schema: declaration.schema } : {},
+			..."version" in declaration && declaration.version ? { version: declaration.version } : {},
+			..."roles" in declaration && declaration.roles === false ? { roles: false } : {},
+			..."table" in declaration && declaration.table ? { table: declaration.table } : {}
+		});
+	}
+	if (options.edge !== false && resources.some((r) => EDGE_KINDS[r.kind] === true)) containers.add("caddy");
+	for (const extra of options.extraContainers ?? []) containers.add(extra);
+	if (events === "pgboss" && resources.some((r) => EVENT_KINDS[r.kind]) && !resources.some((r) => r.kind === "database")) throw new PgBossNeedsDatabase(resources.filter((r) => EVENT_KINDS[r.kind]).map((r) => r.id));
+	if (cache === "db") {
+		const placeless = resources.filter((r) => r.kind === "cache" && !r.of);
+		if (placeless.length > 0) {
+			const databases = resources.filter((r) => r.kind === "database");
+			const [only] = databases;
+			if (!only) throw new CacheNeedsDatabase(resources.filter((r) => r.kind === "cache").map((r) => r.id));
+			if (databases.length > 1) throw new CacheIsAmbiguous(placeless.map((r) => r.id), databases.map((r) => r.id));
+			for (const resource of placeless) resource.of = only.id;
+		}
+	}
+	return {
+		stage,
+		events,
+		cache,
+		containers: [...containers],
+		resources
+	};
+}
+/**
+* Queues or topics were declared with pg-boss and no database to hold them.
+*
+* Not a reconcile failure but a manifest one: the fix is a line of application
+* code either way — declare a database, or select a backend that brings its own
+* broker.
+*/
+var CacheNeedsDatabase = class extends Error {
+	constructor(ids) {
+		super(`A cache backed by the database needs a declared database, and none was declared. Declare one, or set services.cache to 'upstash' or 'elasticache'. Caches affected: ${ids.join(", ")}.`);
+		this.ids = ids;
+		this.name = "CacheNeedsDatabase";
+	}
+};
+/**
+* `services.cache: 'db'` in an app that declares more than one database.
+*
+* The config says *a* database and the graph offers several, so there is no
+* answer to give — and the wrong kind of failure would be to pick one, since a
+* cache silently landing in the wrong database is a bug that surfaces as
+* missing rows much later. The fix is a stronger statement in application code:
+* `orders.cache('Sessions')` names the database, which is a fact about the
+* application rather than a deployment choice.
+*/
+var CacheIsAmbiguous = class extends Error {
+	constructor(ids, databases) {
+		super(`A cache backed by the database needs to know which one, and this app declares ${databases.length}: ${databases.join(", ")}. Declare the cache from its database — e.g. ${databases[0]}.cache('Sessions') — rather than with services.cache. Caches affected: ${ids.join(", ")}.`);
+		this.ids = ids;
+		this.databases = databases;
+		this.name = "CacheIsAmbiguous";
+	}
+};
+var PgBossNeedsDatabase = class extends Error {
+	constructor(ids) {
+		super(`pg-boss keeps its queues in a declared database, and none was declared. Declare one, or set services.events to 'rabbitmq' or 'sns'. Queues and topics affected: ${ids.join(", ")}.`);
+		this.ids = ids;
+		this.name = "PgBossNeedsDatabase";
+	}
+};
+
+//#endregion
+//#region src/reconcile/env.ts
+/**
+* The credential local containers are brought up with.
+*
+* The design's `roles: false` case — both URLs fall back to the cluster's master
+* credential. A deliberate downgrade, not a default: it holds until the role DDL
+* lands in `@geekmidas/db`, at which point the runtime role's URL replaces this
+* and the owner URL stops being reachable from any manifest edge.
+*/
+const LOCAL_USER = "geekmidas";
+/** The host containers are published on. */
+const LOCAL_HOST = "localhost";
+/** The region local buckets claim, so the client has one to sign with. */
+const LOCAL_REGION = "us-east-1";
+/**
+* The credentials the S3 client resolves for MinIO.
+*
+* An `s3://` URL deliberately carries none: deployed, the SDK reads them from
+* the execution role, so a URL that embedded a key would be one more thing to
+* rotate and one more thing to leak into a log. Locally there is no role, and
+* the same chain reads these — which is why they are injected beside the URL
+* rather than written into it.
+*/
+const STORAGE_CREDENTIALS = {
+	AWS_ACCESS_KEY_ID: LOCAL_USER,
+	AWS_SECRET_ACCESS_KEY: LOCAL_USER,
+	AWS_REGION: LOCAL_REGION
+};
+/** The token the local cache proxy accepts. Matches the compose definition. */
+const LOCAL_TOKEN = "geekmidas";
+/** The schema pg-boss keeps its tables in, inside the declared database. */
+const PGBOSS_SCHEMA = "pgboss";
+/** The exchange every local topic and queue shares on RabbitMQ. */
+const RABBITMQ_EXCHANGE = "geekmidas.events";
+/**
+* Every env key a reconciled plan resolves, and its value.
+*
+* Keys come from the declaration rather than being re-derived, so what the build
+* publishes and what the app reads cannot drift.
+*/
+function envFor(plan, options) {
+	const env = {};
+	const resolved = {};
+	for (const resource of plan.resources) {
+		const url = urlFor(resource, plan, options.ports, options.project ?? "", options.addresses);
+		if (url) resolved[resource.id] = url;
+	}
+	for (const resource of plan.resources) {
+		const url = resolved[resource.id];
+		if (resource.kind === "rest-api") Object.assign(env, surfaceEnv(resource, url, resolved));
+		if (url) env[resource.envKey] = url;
+		if (isDatabase(resource.kind) && resource.roles !== false) {
+			const owner = ownerUrl(resource, plan, options.ports, options.project ?? "");
+			if (owner) env[(0, __geekmidas_manifest.provideKey)(resource.id, "ownerUrl")] = owner;
+		}
+		if (resource.kind === "email" && url) env[(0, __geekmidas_manifest.provideKey)(resource.id, "from")] = options.mailFrom ?? `noreply@${LOCAL_HOST}`;
+	}
+	Object.assign(env, publicEnv(plan, env));
+	Object.assign(env, brokerEnv(plan, options.ports));
+	if (plan.resources.some((r) => r.kind === "objects" && env[r.envKey])) Object.assign(env, STORAGE_CREDENTIALS);
+	return env;
+}
+/**
+* The values a site's bundler inlines, under the names it inlines them by.
+*
+* A rename and nothing more. `API_URL` was resolved once, by the same code that
+* resolved it for the server; a site reads the same value under `VITE_API_URL`
+* because that prefix is how its bundler is told to ship it. Nothing is derived
+* twice, so a site and its API cannot come to disagree about where the API is.
+*
+* A source that resolved to nothing is skipped rather than written empty: an
+* inlined empty string is a frontend that builds and then fails at runtime
+* against `http:///`, where a missing variable fails at build with the name of
+* the thing that is missing.
+*/
+function publicEnv(plan, resolved) {
+	const env = {};
+	for (const resource of plan.resources) for (const [key, source] of Object.entries(resource.publicEnv ?? {})) {
+		const value = resolved[source];
+		if (value) env[key] = value;
+	}
+	return env;
+}
+/**
+* What a surface publishes beyond its own address: who may call it, and where
+* a cookie set by it is readable.
+*
+* Both are read off the same list — the constructs that declared an edge to
+* this surface — which is why neither appears in application code. A surface
+* that listed its own callers would be edited every time something new called
+* it, and the thing being edited is already recorded in the graph.
+*
+* An empty origin list is written, and a surface with no address writes nothing
+* at all. The two cases look alike and are not: "nothing depends on this yet" is
+* a real state a target should publish, while "this surface has no address here"
+* means it is not running in this stage, and keys belong with the address they
+* describe.
+*/
+function surfaceEnv(resource, url, resolved = {}) {
+	if (!url) return {};
+	const origins = [...new Set((resource.callers ?? []).map((caller) => resolved[caller]).filter((address) => Boolean(address)).map(originOf).filter((origin) => Boolean(origin)))].sort();
+	const domain = (0, __geekmidas_manifest.cookieDomain)([url, ...origins]);
+	return {
+		[(0, __geekmidas_manifest.provideKey)(resource.id, "trustedOrigins")]: origins.join(","),
+		...domain ? { [(0, __geekmidas_manifest.provideKey)(resource.id, "cookieDomain")]: domain } : {}
+	};
+}
+/** An address reduced to the origin a browser compares against. */
+function originOf(address) {
+	try {
+		return new URL(address).origin;
+	} catch {
+		return void 0;
+	}
+}
+/**
+* The runtime role of whatever a derived node hangs off.
+*
+* A reader's parent may itself be a schema tenant, so this follows `of` by one
+* hop rather than assuming the cluster — the reader of a tenant reads that
+* tenant's schema, not the database's.
+*/
+function parentRole(resource, plan) {
+	const parent = plan.resources.find((r) => r.id === resource.of);
+	return parent ? localRole(parent) : resource.name;
+}
+/** Whether a kind connects to Postgres and therefore has an owner role. */
+function isDatabase(kind) {
+	return kind === "database" || kind === "database-schema";
+}
+/**
+* The URL a migrator connects with — the owner role, which can create, alter
+* and drop.
+*
+* Never in `provides`, which is the whole point. A handler that could reach this
+* could `DROP TABLE`, and the security property the role split exists for is
+* that it cannot: the value is injected by `gkm exec` for the migrate step and
+* by nothing else.
+*/
+function ownerUrl(resource, plan, ports, project) {
+	if (!resource.container) return void 0;
+	const port = ports[primaryPortKey(resource.container)];
+	if (port === void 0) return void 0;
+	const owner = (0, __geekmidas_db_pg_roles.ownerRole)(localRole(resource));
+	return postgres(port, rootDatabase(resource, plan), {
+		user: owner,
+		password: localRolePassword(project, plan, owner)
+	});
+}
+/**
+* The shared broker keys, when anything is published or consumed.
+*
+* A queue's own key is the producer's. These two are the *connection* itself,
+* which locally is one broker for every queue and topic in the project: the
+* generated pollers open a single connection and subscribe each worker by name
+* on it. Deployed there is no such thing — a Lambda is handed its own event
+* source — so this pair exists for the local target and says so.
+*/
+function brokerEnv(plan, ports) {
+	const carrier = plan.resources.find((r) => r.kind === "queue" || r.kind === "topic");
+	if (!carrier) return {};
+	const publisher = urlFor(carrier, plan, ports, "");
+	if (!publisher) return {};
+	return {
+		EVENT_PUBLISHER_CONNECTION_STRING: publisher,
+		EVENT_SUBSCRIBER_CONNECTION_STRING: plan.events === "sns" ? publisher.replace(/^sns:/, "sqs:") : publisher
+	};
+}
+/**
+* The URL for one planned resource.
+*
+* Every part of it comes from the resource and the port it was published on.
+*/
+function urlFor(resource, plan, ports, project, addresses = {}) {
+	if (resource.kind === "secret") return localSecret(project, plan, resource);
+	if (resource.kind === "credential") return void 0;
+	if (resource.kind === "rest-api" || resource.kind === "site") {
+		const address = addresses[resource.id];
+		const edge = plan.containers.includes("caddy") ? ports[primaryPortKey("caddy")] : void 0;
+		return address && edge !== void 0 ? `https://${hostFor(resource, project)}:${edge}` : address;
+	}
+	if (!resource.container) return void 0;
+	const port = ports[primaryPortKey(resource.container)];
+	if (port === void 0) return void 0;
+	switch (resource.kind) {
+		case "database":
+		case "database-schema":
+		case "database-reader": {
+			const database = rootDatabase(resource, plan);
+			if (resource.roles === false) {
+				const schema = schemaOf(resource, plan);
+				return schema ? `${postgres(port, database)}?search_path=${schema}` : postgres(port, database);
+			}
+			const role = resource.kind === "database-reader" ? (0, __geekmidas_db_pg_roles.readerRole)(parentRole(resource, plan)) : localRole(resource);
+			return postgres(port, database, {
+				user: role,
+				password: localRolePassword(project, plan, role)
+			});
+		}
+		case "email": return `smtp://${LOCAL_HOST}:${port}`;
+		case "objects": return `s3://${resource.name}?region=${LOCAL_REGION}&endpoint=http://${LOCAL_HOST}:${port}&forcePathStyle=true`;
+		case "file-server": {
+			const origin = plan.resources.find((r) => r.id === resource.of);
+			if (!origin) return void 0;
+			return plan.containers.includes("caddy") ? `https://${hostFor(resource, project)}:${port}` : `http://${LOCAL_HOST}:${port}/${origin.name}`;
+		}
+		case "cache":
+			if (resource.of) {
+				const parent = plan.resources.find((r) => r.id === resource.of);
+				const url = parent ? urlFor(parent, plan, ports, project, addresses) : void 0;
+				return url ? withTable(url, resource.table ?? (0, __geekmidas_manifest.cacheTable)(resource.id)) : void 0;
+			}
+			switch (plan.cache) {
+				case "elasticache": return `redis://${LOCAL_HOST}:${port}`;
+				default: return `http://:${LOCAL_TOKEN}@${LOCAL_HOST}:${port}`;
+			}
+		case "queue":
+		case "topic": return broker(plan, port);
+		default: return void 0;
+	}
+}
+/**
+* The producer's connection string, composed from the backend the plan chose.
+*
+* The protocol is what picks the transport, so a producer never branches: the
+* same `.publish()` reaches pg-boss here and SQS deployed because the string it
+* was handed said so.
+*/
+function broker(plan, port) {
+	switch (plan.events) {
+		case "pgboss": {
+			const database = plan.resources.find((r) => r.kind === "database");
+			if (!database) throw new PgBossNeedsDatabase([]);
+			return `pgboss://${LOCAL_USER}:${LOCAL_USER}@${LOCAL_HOST}:${port}/${database.name}?schema=${PGBOSS_SCHEMA}`;
+		}
+		case "rabbitmq": return `rabbitmq://${LOCAL_USER}:${LOCAL_USER}@${LOCAL_HOST}:${port}?exchange=${RABBITMQ_EXCHANGE}`;
+		case "sns": throw new UnprovisionedEventsBackend("sns");
+	}
+}
+/** A local Postgres URL, master credential and all. */
+function postgres(port, database, credential = {
+	user: LOCAL_USER,
+	password: LOCAL_USER
+}) {
+	return `postgres://${credential.user}:${credential.password}@${LOCAL_HOST}:${port}/${database}`;
+}
+/**
+* The role a handler connects as, for one database or tenant.
+*
+* The construct's id, lowercased and stage-scoped exactly as its database or
+* schema is — so `Orders` in the `test` stage connects as `orders_test`, and two
+* stages sharing one cluster cannot share a credential. Roles are cluster-scoped
+* in Postgres, which is why the suffix is not optional here the way it is for a
+* schema.
+*/
+function localRole(resource) {
+	return resource.name;
+}
+/**
+* The password for a derived local role.
+*
+* Derived rather than random, for the same reason the local secret is: a
+* password that changed on every `gkm dev` would lock a developer out of the
+* data they had a moment ago. Seeded by the project so two checkouts do not
+* share one, and by the stage so `test` and `development` do not.
+*
+* It is a *local* credential by construction — the cluster is on loopback and
+* the seed is a checkout path — and no deployed target uses this function.
+*/
+function localRolePassword(project, plan, role) {
+	return (0, node_crypto.createHash)("sha256").update(`${project}:${plan.stage}:role:${role}`).digest("base64url").slice(0, 32);
+}
+/**
+* A cache's address: its database's URL, carrying the table it reads.
+*
+* Appended rather than kept beside the URL as a second key, for the reason the
+* design gives everywhere else — an address and what it opens are one fact, and
+* two keys are one more thing to keep in step.
+*/
+function withTable(url, table) {
+	const parsed = new URL(url);
+	parsed.searchParams.set("table", table);
+	return parsed.toString();
+}
+/**
+* The physical database a derived resource lives in.
+*
+* Walks `of` to the top rather than reading the immediate parent, because a
+* reader's parent may itself be a schema tenant — two hops from the database
+* that actually exists.
+*/
+function rootDatabase(resource, plan) {
+	const byId = new Map(plan.resources.map((r) => [r.id, r]));
+	let current = resource;
+	while (current.of) {
+		const parent = byId.get(current.of);
+		if (!parent) break;
+		current = parent;
+	}
+	return current.name;
+}
+/** The schema a derived resource puts on its search path, if it has one. */
+function schemaOf(resource, plan) {
+	const byId = new Map(plan.resources.map((r) => [r.id, r]));
+	let current = resource;
+	while (current) {
+		if (current.kind === "database-schema") return current.schema;
+		current = current.of ? byId.get(current.of) : void 0;
+	}
+	return void 0;
+}
+/**
+* A backend whose local addresses cannot be derived yet.
+*
+* SNS and SQS are addressed by ARN, which means the topic and queue have to be
+* created in LocalStack before a URL can name them. Until that provisioning
+* lands, saying so is better than handing out a string that fails on first use.
+*/
+var UnprovisionedEventsBackend = class extends Error {
+	constructor(backend) {
+		super(`The local target cannot derive addresses for '${backend}' yet — its topics and queues are named by ARN, which nothing creates locally. Use 'pgboss' (the default) or 'rabbitmq' for local development.`);
+		this.backend = backend;
+		this.name = "UnprovisionedEventsBackend";
+	}
+};
+/**
+* The value a secret resolves to locally.
+*
+* A hash of what identifies it, so it is stable, distinct per project, stage
+* and construct, and never written to disk as a literal. Deployed this is the
+* one kind whose value does *not* come from here — a secret manager generates
+* it once and the target reads it back.
+*/
+function localSecret(project, plan, resource) {
+	return (0, node_crypto.createHash)("sha256").update(`${project}:${plan.stage}:${resource.id}`).digest("base64url").slice(0, 43);
+}
+
+//#endregion
+//#region src/reconcile/ports.ts
+/**
+* The window ports are drawn from.
+*
+* Above the registered range so nothing here needs privileges, and below the
+* ephemeral range both Linux (32768+) and macOS (49152+) allocate from — a port
+* the kernel might hand to an outgoing connection is one that is free when
+* checked and taken by the time it is bound.
+*/
+const WINDOW = {
+	min: 2e4,
+	max: 32e3
+};
+/**
+* How far apart two projects start.
+*
+* Wide enough that a project can add containers without walking into its
+* neighbour's block, narrow enough that the window holds many projects.
+*/
+const BLOCK = 50;
+/**
+* Where a project's ports start.
+*
+* Derived from the name rather than assigned sequentially so that a fresh clone
+* of the same project on the same machine lands on the same block — the first
+* run has nothing persisted to read, and hashing is what keeps that first run
+* from colliding with whatever else is already allocated.
+*
+* @example startingPort('toolbox') // stable for a given name
+*/
+function startingPort(project) {
+	const digest = (0, node_crypto.createHash)("sha256").update(project).digest();
+	const blocks = Math.floor((WINDOW.max - WINDOW.min) / BLOCK);
+	return WINDOW.min + digest.readUInt32BE(0) % blocks * BLOCK;
+}
+/**
+* Assign a port to every container that has none, keeping the ones that do.
+*
+* Existing assignments are returned untouched even when the container is no
+* longer in the plan: removing a construct must not renumber what is left, and
+* keeping the entry means re-adding it later restores the same port rather than
+* inventing a new one.
+*
+* @param probe - reports what is actually listening. A port assigned to this
+* project is skipped without probing, because on a converged reconcile our own
+* container is the thing listening on it.
+* @throws {NoPortAvailable} when the window is exhausted.
+*/
+async function allocate(project, containers, existing = {}, probe = isPortFree) {
+	const assignments = { ...existing };
+	const taken = new Set(Object.values(assignments));
+	for (const container of [...containers].sort()) {
+		if (assignments[container] !== void 0) continue;
+		const port = await nextFree(startingPort(project), taken, probe);
+		assignments[container] = port;
+		taken.add(port);
+	}
+	return assignments;
+}
+/** The window was exhausted. */
+var NoPortAvailable = class extends Error {
+	/** Where the search started. */
+	from;
+	/** The window searched, so the caller can report what was full. */
+	window = WINDOW;
+	constructor(from) {
+		super("No free port is available in the local port range");
+		this.name = "NoPortAvailable";
+		this.from = from;
+	}
+};
+/**
+* The first port at or after `from` that is neither ours nor in use.
+*
+* Wraps at the top of the window rather than stopping, so a project whose block
+* sits near the end is not the one that fails.
+*/
+async function nextFree(from, taken, probe) {
+	const span = WINDOW.max - WINDOW.min;
+	for (let offset = 0; offset < span; offset++) {
+		const port = WINDOW.min + (from - WINDOW.min + offset) % span;
+		if (taken.has(port)) continue;
+		if (await probe(port)) return port;
+	}
+	throw new NoPortAvailable(from);
+}
+/**
+* Whether nothing is listening on a port.
+*
+* Binds rather than connects: a refused connection says nothing about whether
+* the port can be *published*, which is the question Docker will ask. Binds on
+* `0.0.0.0` for the same reason — a port free on loopback can still be taken on
+* the address Docker publishes to.
+*
+* Inherently racy, and that is acceptable: Docker failing to bind stays the real
+* check. This exists so the common case surfaces as a message at reconcile
+* rather than as a connection failure ten minutes later.
+*/
+function isPortFree(port) {
+	return new Promise((resolve$1) => {
+		const server = (0, node_net.createServer)();
+		server.once("error", () => resolve$1(false));
+		server.once("listening", () => server.close(() => resolve$1(true)));
+		server.listen(port, "0.0.0.0");
+	});
+}
+
+//#endregion
+//#region src/reconcile/provision.ts
+/**
+* The Postgres work a plan implies.
+*
+* Databases before the schemas inside them, which `provisionOrder` already
+* guarantees by putting parents first.
+*/
+function postgresStatements(plan, project = "") {
+	const statements = [];
+	for (const resource of plan.resources) {
+		if (!resource.provisions || resource.container !== "postgres") continue;
+		if (resource.kind === "database") {
+			statements.push({
+				id: resource.id,
+				describe: `database ${resource.name}`,
+				exists: {
+					sql: "SELECT 1 FROM pg_database WHERE datname = $1",
+					values: [resource.name]
+				},
+				create: `CREATE DATABASE ${quoteIdentifier(resource.name)}`
+			});
+			if (resource.schema) statements.push(...rolesFor(resource, resource.schema, plan, project));
+			continue;
+		}
+		if (resource.kind === "database-schema" && resource.schema) statements.push(...rolesFor(resource, resource.schema, plan, project));
+		const cacheHome = resource.kind === "cache" && resource.of ? plan.resources.find((r) => r.id === resource.of) : void 0;
+		if (cacheHome) statements.push(...cacheTableDdl(resource, cacheHome, plan));
+	}
+	return statements;
+}
+/**
+* A cache's table, in the schema the role that reads it resolves names in.
+*
+* Two things have to line up, and neither is the table's contents. The driver
+* names the table unqualified and lets the connection's `search_path` place it
+* — which the role carries — so creating it from the master connection, whose
+* path is `public`, leaves a table the application cannot see and a
+* `relation "cache" does not exist` on the first request. And the default
+* privileges that make a tenant's tables reachable are granted *for the owner
+* role*, so nothing covers a table the master created.
+*
+* Hence: qualified with the tenant's schema, handed to its owner, and granted
+* explicitly — `roleStatements` grants what exists at the time it runs, and
+* this table does not exist yet.
+*
+* A database that opted out of roles needs none of it: everything connects as
+* the master, whose `search_path` finds `public`, and the table it creates
+* there is the table it reads.
+*/
+function cacheTableDdl(cache, home, plan) {
+	const database = rootDatabase(home, plan);
+	const schema = home.roles === false ? void 0 : home.schema;
+	const name = cache.table ?? (0, __geekmidas_manifest.cacheTable)(cache.id);
+	const table = schema ? `${schema}.${name}` : name;
+	const created = (0, __geekmidas_cache_postgres.cacheTableStatements)({ table }).map((statement) => ({
+		id: cache.id,
+		describe: statement.describe,
+		database,
+		...statement.exists ? { exists: statement.exists } : {},
+		create: statement.sql
+	}));
+	if (!schema) return created;
+	const runtime = localRole(home);
+	const owner = (0, __geekmidas_db_pg_roles.ownerRole)(runtime);
+	const qualified = table.split(".").map((part) => quoteIdentifier(part)).join(".");
+	return [
+		...created,
+		{
+			id: cache.id,
+			describe: `cache table ${table} is owned by ${owner}`,
+			database,
+			create: `ALTER TABLE ${qualified} OWNER TO ${quoteIdentifier(owner)}`
+		},
+		{
+			id: cache.id,
+			describe: `${runtime} may read and write ${table}`,
+			database,
+			create: `GRANT SELECT, INSERT, UPDATE, DELETE ON ${qualified} TO ${quoteIdentifier(runtime)}`
+		}
+	];
+}
+/**
+* The roles and schema for one database or tenant.
+*
+* Skipped entirely when the construct declared `roles: false` — the documented
+* downgrade, where both URLs fall back to the cluster's master credential. It
+* is a choice someone made rather than a default they got.
+*/
+function rolesFor(resource, schema, plan, project) {
+	if (resource.roles === false) return [];
+	const runtime = localRole(resource);
+	const owner = (0, __geekmidas_db_pg_roles.ownerRole)(runtime);
+	const reader = plan.resources.some((r) => r.kind === "database-reader" && r.of === resource.id) ? (0, __geekmidas_db_pg_roles.readerRole)(runtime) : void 0;
+	return (0, __geekmidas_db_pg_roles.roleStatements)({
+		runtime,
+		owner,
+		...reader ? { reader } : {},
+		schema,
+		passwords: {
+			runtime: localRolePassword(project, plan, runtime),
+			owner: localRolePassword(project, plan, owner),
+			...reader ? { reader: localRolePassword(project, plan, reader) } : {}
+		}
+	}).map((statement) => ({
+		id: resource.id,
+		describe: statement.describe,
+		database: rootDatabase(resource, plan),
+		...statement.exists ? { exists: statement.exists } : {},
+		create: statement.sql
+	}));
+}
+/** The buckets a plan implies. */
+function bucketNames(plan) {
+	return plan.resources.filter((r) => r.provisions && r.kind === "objects").map((r) => r.name);
+}
+/**
+* Quote an identifier for use in DDL.
+*
+* Names reaching here are already canonical and stage-suffixed, so this is
+* defence rather than sanitisation — but DDL cannot be parameterised, and an
+* unquoted identifier is the one place a name could ever be more than a name.
+*/
+function quoteIdentifier(name) {
+	return `"${name.replace(/"/g, "\"\"")}"`;
+}
+/**
+* Apply the plan's Postgres statements.
+*
+* Each is checked before it is run, so this converges rather than erroring on a
+* second pass.
+*/
+async function applyPostgres(client, statements) {
+	const applied = [];
+	for (const statement of statements) {
+		if (!statement.exists) {
+			await client.query(statement.database, statement.create);
+			applied.push({
+				id: statement.id,
+				describe: statement.describe,
+				created: false
+			});
+			continue;
+		}
+		const rows = await client.query(statement.database, statement.exists.sql, statement.exists.values);
+		if (rows.length > 0) {
+			applied.push({
+				id: statement.id,
+				describe: statement.describe,
+				created: false
+			});
+			continue;
+		}
+		await client.query(statement.database, statement.create);
+		applied.push({
+			id: statement.id,
+			describe: statement.describe,
+			created: true
+		});
+	}
+	return applied;
+}
+/**
+* What each bucket's open paths are, if anything serves it.
+*
+* Keyed by the *origin*, because that is where the policy lives: two servers
+* over one bucket contribute to one policy, so the patterns are unioned rather
+* than the last one winning.
+*/
+function bucketPolicies(plan) {
+	const byBucket = /* @__PURE__ */ new Map();
+	for (const resource of plan.resources) {
+		if (resource.kind !== "file-server" || !resource.open?.length) continue;
+		const origin = plan.resources.find((r) => r.id === resource.of);
+		if (!origin) continue;
+		const patterns = byBucket.get(origin.name) ?? /* @__PURE__ */ new Set();
+		for (const pattern of resource.open) patterns.add(pattern);
+		byBucket.set(origin.name, patterns);
+	}
+	return [...byBucket].map(([bucket, open]) => ({
+		bucket,
+		open: [...open].sort()
+	})).sort((a, b) => a.bucket.localeCompare(b.bucket));
+}
+/**
+* One bucket's open paths as an S3 bucket policy.
+*
+* Anonymous `s3:GetObject` on the named prefixes and nothing else — which is
+* what "open" means everywhere: the server serves that path without a
+* signature, and the bucket stays private for everything else.
+*
+* One fidelity note, stated rather than discovered: an S3 policy resource's `*`
+* crosses `/`, so a single-star pattern is *wider* here than the construct's own
+* runtime check, which stops at a segment boundary. The construct is the
+* stricter of the two, so a key it refuses to serve unsigned is never one this
+* policy was relied on to refuse — but a key fetched directly, bypassing the
+* client, can be admitted by the policy where the client would have said no.
+* Prefer `**` where crossing segments is what you meant.
+*/
+function bucketPolicy(bucket, open) {
+	return JSON.stringify({
+		Version: "2012-10-17",
+		Statement: [{
+			Sid: "GkmOpenPaths",
+			Effect: "Allow",
+			Principal: { AWS: ["*"] },
+			Action: ["s3:GetObject"],
+			Resource: open.map((pattern) => `arn:aws:s3:::${bucket}/${pattern.replace(/\*\*/g, "*")}`)
+		}]
+	});
+}
+/**
+* Apply each served bucket's open-path policy, skipping those already correct.
+*
+* Compared as parsed JSON rather than as text: the same policy re-serialised
+* with different key order is the same policy, and rewriting it every reconcile
+* would report a change on every start.
+*/
+async function applyPolicies(client, policies) {
+	const applied = [];
+	for (const { bucket, open } of policies) {
+		const wanted = bucketPolicy(bucket, open);
+		const describe = `open paths on ${bucket}`;
+		if (equivalent(await client.policy(bucket), wanted)) {
+			applied.push({
+				id: `${bucket}:policy`,
+				describe,
+				created: false
+			});
+			continue;
+		}
+		await client.setPolicy(bucket, wanted);
+		applied.push({
+			id: `${bucket}:policy`,
+			describe,
+			created: true
+		});
+	}
+	return applied;
+}
+/** Whether two policy documents say the same thing. */
+function equivalent(current, wanted) {
+	if (!current) return false;
+	try {
+		return JSON.stringify(JSON.parse(current)) === JSON.stringify(JSON.parse(wanted));
+	} catch {
+		return false;
+	}
+}
+/** Create every bucket the plan names, skipping those that exist. */
+async function applyBuckets(client, buckets) {
+	const applied = [];
+	for (const bucket of buckets) {
+		if (await client.exists(bucket)) {
+			applied.push({
+				id: bucket,
+				describe: `bucket ${bucket}`,
+				created: false
+			});
+			continue;
+		}
+		await client.create(bucket);
+		applied.push({
+			id: bucket,
+			describe: `bucket ${bucket}`,
+			created: true
+		});
+	}
+	return applied;
+}
+
+//#endregion
+//#region src/reconcile/state.ts
+const STATE_DIR = ".gkm/reconcile";
+/**
+* The hash of everything a reconcile would act on.
+*
+* Covers the compose document rather than the plan alone, because the plan is
+* unchanged when only an image pin moves — and a changed image is exactly a
+* container that must be recreated. `stringify` is stable here because
+* `composeFor` sorts its containers, which is what makes the hash meaningful.
+*
+* Deliberately a plain function over serialisable input: the deployed target
+* keys its provisioner invocation on the same idea, and the two must not be able
+* to disagree about what counts as a change.
+*/
+function planHash(plan, compose, generated = {}) {
+	return (0, node_crypto.createHash)("sha256").update(JSON.stringify({
+		stage: plan.stage,
+		plan,
+		compose,
+		generated
+	})).digest("hex");
+}
+/** Read the recorded state, or nothing if this stage has never reconciled. */
+async function loadState(root, stage) {
+	try {
+		const raw = await (0, node_fs_promises.readFile)(statePath(root, stage), "utf-8");
+		const state = JSON.parse(raw);
+		return state.stage === stage ? state : void 0;
+	} catch {
+		return void 0;
+	}
+}
+/** Record what was applied, so the next run can skip it. */
+async function saveState(root, state) {
+	const path = statePath(root, state.stage);
+	await (0, node_fs_promises.mkdir)((0, node_path.dirname)(path), { recursive: true });
+	await (0, node_fs_promises.writeFile)(path, `${JSON.stringify(state, null, 2)}\n`);
+}
+function statePath(root, stage) {
+	return (0, node_path.join)(root, STATE_DIR, `${stage}.json`);
+}
+
+//#endregion
+//#region src/reconcile/index.ts
+/** Where the generated compose file is written, relative to the project root. */
+const COMPOSE_PATH = ".gkm/docker-compose.yml";
+/**
+* The local edge's config, beside the compose file that mounts it.
+*
+* Relative in the compose volume, so it resolves against `.gkm/` wherever the
+* project lives.
+*/
+const CADDYFILE_PATH = ".gkm/Caddyfile";
+/**
+* Where one stage's routes live, imported by the file above.
+*
+* Per stage because one edge serves every stage, the same way one Postgres
+* holds `orders` and `orders_test`. A single file would mean `gkm test`
+* deleting the routes `gkm dev` is serving.
+*/
+const caddySitesPath = (stage) => `.gkm/caddy-sites/${stage}.caddy`;
+/**
+* Where the local edge's root certificate is copied to.
+*
+* Exported so a process can be pointed at it without installing anything:
+* `NODE_EXTRA_CA_CERTS` is the whole of the trust story for Node, and it needs
+* no sudo. A browser is the case that still wants the root in the system store,
+* which is a one-time `caddy trust` rather than something a reconcile should do
+* on a developer's behalf.
+*/
+const LOCAL_CA_PATH = ".gkm/caddy-root.crt";
+/** Where Caddy keeps the root of the CA it generated. */
+const CADDY_ROOT_IN_CONTAINER = "/data/caddy/pki/authorities/local/root.crt";
+/**
+* Converge the local target on what the manifest declares.
+*
+* Cheap when there is nothing to do: the hash is compared before the compose
+* file is written or a container is touched, and a converged project pays one
+* hash and one health check.
+*/
+async function reconcile(options) {
+	const { root, project, manifest, stage, start = true, provision = true, docker = dockerCli, probe = isPortFree, sql = pgClient, buckets = bucketClient } = options;
+	const plan = planFor(manifest, stage, (0, __geekmidas_manifest.provisionOrder)(manifest), {
+		events: options.events,
+		cache: options.cache,
+		extraContainers: options.extraContainers,
+		...options.edge === void 0 ? {} : { edge: options.edge }
+	});
+	const composePath = (0, node_path.join)(root, COMPOSE_PATH);
+	const observed = await observedPorts(docker, composePath, plan.containers);
+	const ports = await allocate(project, portKeys(plan.containers), {
+		...options.saved,
+		...observed
+	}, probe);
+	const compose = composeFor(plan, {
+		project,
+		ports,
+		...options.images ? { images: options.images } : {}
+	});
+	const caddyfile = toCaddyfile(sitesFor(plan, project, options.addresses));
+	const hash = planHash(plan, compose, { caddyfile });
+	const addresses = addressesFor(plan.containers, ports);
+	const env = envFor(plan, {
+		ports,
+		project,
+		...options.mailFrom ? { mailFrom: options.mailFrom } : {},
+		...options.addresses ? { addresses: options.addresses } : {}
+	});
+	if (plan.containers.includes("caddy")) env.NODE_EXTRA_CA_CERTS = (0, node_path.join)(root, LOCAL_CA_PATH);
+	const result = {
+		stage,
+		plan,
+		compose,
+		ports,
+		addresses,
+		env,
+		provisioned: [],
+		hash,
+		changed: false
+	};
+	const recorded = await loadState(root, stage);
+	const converged = recorded?.hash === hash && (!start || await docker.healthy(composePath, plan.containers));
+	if (converged) return result;
+	await write(composePath, toYaml(compose));
+	if (plan.containers.includes("caddy")) {
+		await write((0, node_path.join)(root, CADDYFILE_PATH), caddyfileRoot());
+		await write((0, node_path.join)(root, caddySitesPath(stage)), caddyfile);
+	}
+	if (start && plan.containers.length > 0) await docker.up(composePath, plan.containers);
+	if (start && plan.containers.includes("caddy")) await docker.reload(composePath, "caddy").catch(() => {});
+	if (start && plan.containers.includes("caddy")) await docker.copyOut(composePath, "caddy", CADDY_ROOT_IN_CONTAINER, (0, node_path.join)(root, LOCAL_CA_PATH)).catch(() => {});
+	const provisioned = start && provision ? await create(plan, ports, sql, buckets, project) : [];
+	await saveState(root, {
+		hash,
+		stage
+	});
+	return {
+		...result,
+		provisioned,
+		changed: true
+	};
+}
+/**
+* Create the databases, schemas, and buckets the plan names.
+*
+* Idempotent throughout, so this runs on every non-converged reconcile rather
+* than being something to remember.
+*/
+async function create(plan, ports, sql, buckets, project) {
+	const applied = [];
+	const postgresPort = ports[primaryPortKey("postgres")];
+	const statements = postgresStatements(plan, project);
+	if (postgresPort !== void 0 && statements.length > 0) applied.push(...await applyPostgres(sql(postgresPort), statements));
+	const minioPort = ports[primaryPortKey("minio")];
+	const names = bucketNames(plan);
+	const policies = bucketPolicies(plan);
+	if (minioPort !== void 0 && (names.length > 0 || policies.length > 0)) {
+		const client = buckets(minioPort);
+		if (names.length > 0) applied.push(...await applyBuckets(client, names));
+		if (policies.length > 0) applied.push(...await applyPolicies(client, policies));
+	}
+	return applied;
+}
+/**
+* The host ports of containers already running.
+*
+* Keyed the same way allocation keys them, so the two merge without either
+* knowing about the other.
+*/
+async function observedPorts(docker, composePath, containers) {
+	const observed = {};
+	for (const container of containers) for (const port of portsOf(container)) {
+		const running = await docker.publishedPort(composePath, container, port.inside);
+		if (running !== void 0) observed[port.key] = running;
+	}
+	return observed;
+}
+/**
+* Where each container can be reached on this machine.
+*
+* The primary port only — a container's console is for a human to open, not
+* something an app connects to.
+*/
+function addressesFor(containers, ports) {
+	const addresses = {};
+	for (const container of containers) {
+		const port = ports[primaryPortKey(container)];
+		if (port !== void 0) addresses[container] = `localhost:${port}`;
+	}
+	return addresses;
+}
+/** Write a file only when its content would change, so mtimes stay meaningful. */
+async function write(path, content) {
+	try {
+		if (await (0, node_fs_promises.readFile)(path, "utf-8") === content) return;
+	} catch {}
+	await (0, node_fs_promises.mkdir)((0, node_path.dirname)(path), { recursive: true });
+	await (0, node_fs_promises.writeFile)(path, content);
+}
+
+//#endregion
+//#region src/reconcile/workspace.ts
+/**
+* Every constructs glob in the workspace, resolved against its app.
+*
+* Absolute because discovery globs from a single cwd while apps live in
+* different directories.
+*/
+function constructGlobs(workspace) {
+	return require_workspace.allConstructGlobs(workspace);
+}
+/** Whether any app has adopted the constructs glob. */
+function usesConstructs(workspace) {
+	return constructGlobs(workspace).length > 0;
+}
+/**
+* Image pins, by container. The config half of the derived/config split.
+*
+* Read from `services.images` rather than from the backend keys beside it.
+* They used to share one key, which is how `cache: true` came to mean "start a
+* Redis" — the last way a container could exist because config asked for one
+* instead of because something declared it.
+*/
+function imagePins(workspace) {
+	return { ...workspace.services.images };
+}
+/**
+* The containers a workspace's declarations imply, without reconciling.
+*
+* The same derivation `reconcileWorkspace` makes, available to callers that
+* need to know *what would run* without starting anything or writing ports —
+* `gkm setup` deciding which credentials to generate, `gkm docker` writing a
+* compose file. Those used to each read a boolean per service out of config,
+* which is how a container could exist because config asked for one rather than
+* because something declared it.
+*/
+async function derivedContainers(workspace, stage, manifest) {
+	const found = manifest ?? await require_discover.discover({
+		patterns: constructGlobs(workspace),
+		cwd: workspace.root
+	});
+	return planFor(found, stage, (0, __geekmidas_manifest.provisionOrder)(found), {
+		events: workspace.services.events,
+		cache: cacheBackendOf(workspace.services.cache, providerOf(workspace))
+	}).containers;
+}
+/**
+* Reconcile a workspace for one stage.
+*
+* Ports are loaded and saved around the call rather than inside it, so the loop
+* stays a pure-ish function of its inputs and the store keeps its single owner.
+*/
+async function reconcileWorkspace(workspace, options) {
+	const manifest = options.manifest ?? await require_discover.discover({
+		patterns: constructGlobs(workspace),
+		cwd: workspace.root
+	});
+	const result = await reconcile({
+		root: workspace.root,
+		project: workspace.name,
+		manifest,
+		stage: options.stage,
+		events: workspace.services.events,
+		cache: cacheBackendOf(workspace.services.cache, providerOf(workspace)),
+		images: imagePins(workspace),
+		saved: await loadPortState(workspace.root),
+		addresses: surfaceAddresses(workspace, manifest),
+		...options.start === void 0 ? {} : { start: options.start }
+	});
+	await savePortState(workspace.root, { ...result.ports });
+	return result;
+}
+/**
+* Where each declared surface and site answers locally.
+*
+* The addresses come from the ports the workspace already assigns; which
+* construct sits at which one comes from the manifest. That split is the point:
+* this used to answer "who may call whom" by listing every app the workspace
+* runs, which is a different question that happened to give the same answer in
+* a single-repo workspace and no answer at all deployed. Now it answers only
+* "where does this construct answer", and the graph answers the rest.
+*
+* A site is matched to its app by `path`, because that is the one thing a site
+* declaration and a workspace app both name. Surfaces are matched to the
+* backend app: every `rest-api` in a process answers on that process's port, so
+* an app serving both its own API and an auth server publishes one address
+* twice — which is exactly what it does at runtime.
+*/
+function surfaceAddresses(workspace, manifest) {
+	const addresses = {};
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration.kind !== "rest-api" && declaration.kind !== "site") continue;
+		const host = declaration.kind === "site" ? require_config.appKey(id) : appKeyOfHost(manifest, id);
+		const app = host ? workspace.apps[host] : void 0;
+		if (app?.port) addresses[id] = localAddress(app.port);
+	}
+	return addresses;
+}
+/** The app key serving a surface, following a mount to its host. */
+function appKeyOfHost(manifest, id) {
+	const host = require_config.hostOf(manifest, id);
+	return host ? require_config.appKey(host) : void 0;
+}
+/** Where a local process answers, given the port the workspace gave it. */
+function localAddress(port) {
+	return `http://localhost:${port}`;
+}
+
+//#endregion
+//#region src/credentials/index.ts
+const logger = console;
+/**
+* Load environment files
+* @internal Exported for testing
+*/
+function loadEnvFiles(envConfig, cwd = process.cwd()) {
+	const loaded = [];
+	const missing = [];
+	const envFiles = envConfig ? Array.isArray(envConfig) ? envConfig : [envConfig] : [".env"];
+	for (const envFile of envFiles) {
+		const envPath = (0, node_path.resolve)(cwd, envFile);
+		if ((0, node_fs.existsSync)(envPath)) {
+			(0, dotenv.config)({
+				path: envPath,
+				override: true,
+				quiet: true
+			});
+			loaded.push(envFile);
+		} else if (envConfig) missing.push(envFile);
+	}
+	return {
+		loaded,
+		missing
+	};
+}
+/**
+* Check if a port is available
+* @internal Exported for testing
+*/
+async function isPortAvailable(port) {
+	return new Promise((resolve$1) => {
+		const server = (0, node_net.createServer)();
+		server.once("error", (err) => {
+			if (err.code === "EADDRINUSE") resolve$1(false);
+			else resolve$1(false);
+		});
+		server.once("listening", () => {
+			server.close();
+			resolve$1(true);
+		});
+		server.listen(port);
+	});
+}
+/**
+* Find an available port starting from the preferred port
+* @internal Exported for testing
+*/
+async function findAvailablePort(preferredPort, maxAttempts = 10) {
+	for (let i = 0; i < maxAttempts; i++) {
+		const port = preferredPort + i;
+		if (await isPortAvailable(port)) return port;
+		logger.log(`⚠️  Port ${port} is in use, trying ${port + 1}...`);
+	}
+	throw new Error(`Could not find an available port after trying ${maxAttempts} ports starting from ${preferredPort}`);
+}
+const PORT_STATE_PATH = ".gkm/ports.json";
+/**
+* Parse docker-compose.yml and extract all port mappings that use env var interpolation.
+* Entries like `'${POSTGRES_HOST_PORT:-5432}:5432'` are captured.
+* Fixed port mappings like `'5050:80'` are skipped.
+* @internal Exported for testing
+*/
+function parseComposePortMappings(composePath) {
+	if (!(0, node_fs.existsSync)(composePath)) return [];
+	const content = (0, node_fs.readFileSync)(composePath, "utf-8");
+	const compose = (0, yaml.parse)(content);
+	if (!compose?.services) return [];
+	const results = [];
+	for (const [serviceName, serviceConfig] of Object.entries(compose.services)) for (const portMapping of serviceConfig?.ports ?? []) {
+		const match = String(portMapping).match(/\$\{(\w+):-(\d+)\}:(\d+)/);
+		if (match?.[1] && match[2] && match[3]) results.push({
+			service: serviceName,
+			envVar: match[1],
+			defaultPort: Number(match[2]),
+			containerPort: Number(match[3])
+		});
+	}
+	return results;
+}
+/**
+* Load saved port state from .gkm/ports.json.
+* @internal Exported for testing
+*/
+async function loadPortState(workspaceRoot) {
+	try {
+		const raw = await (0, node_fs_promises.readFile)((0, node_path.join)(workspaceRoot, PORT_STATE_PATH), "utf-8");
+		return JSON.parse(raw);
+	} catch {
+		return {};
+	}
+}
+/**
+* Save port state to .gkm/ports.json.
+* @internal Exported for testing
+*/
+async function savePortState(workspaceRoot, ports) {
+	const dir = (0, node_path.join)(workspaceRoot, ".gkm");
+	await (0, node_fs_promises.mkdir)(dir, { recursive: true });
+	await (0, node_fs_promises.writeFile)((0, node_path.join)(workspaceRoot, PORT_STATE_PATH), `${JSON.stringify(ports, null, 2)}\n`);
+}
+/**
+* Check if a project's own Docker container is running and return its host port.
+* Uses `docker compose port` scoped to the project's compose file.
+* @internal Exported for testing
+*/
+function getContainerHostPort(workspaceRoot, service, containerPort) {
+	try {
+		const result = (0, node_child_process.execSync)(`docker compose port ${service} ${containerPort}`, {
+			cwd: workspaceRoot,
+			stdio: "pipe"
+		}).toString().trim();
+		const match = result.match(/:(\d+)$/);
+		return match ? Number(match[1]) : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Resolve host ports for Docker services by parsing docker-compose.yml.
+* Priority: running container → saved state → find available port.
+* Persists resolved ports to .gkm/ports.json.
+* @internal Exported for testing
+*/
+async function resolveServicePorts(workspaceRoot) {
+	const composePath = (0, node_path.join)(workspaceRoot, "docker-compose.yml");
+	const mappings = parseComposePortMappings(composePath);
+	if (mappings.length === 0) return {
+		dockerEnv: {},
+		ports: {},
+		mappings: []
+	};
+	const savedState = await loadPortState(workspaceRoot);
+	const dockerEnv = {};
+	const ports = {};
+	const assignedPorts = /* @__PURE__ */ new Set();
+	logger.log("\n🔌 Resolving service ports...");
+	for (const mapping of mappings) {
+		const containerPort = getContainerHostPort(workspaceRoot, mapping.service, mapping.containerPort);
+		if (containerPort !== null) {
+			ports[mapping.envVar] = containerPort;
+			dockerEnv[mapping.envVar] = String(containerPort);
+			assignedPorts.add(containerPort);
+			logger.log(`   🔄 ${mapping.service}:${mapping.containerPort}: reusing existing container on port ${containerPort}`);
+			continue;
+		}
+		const savedPort = savedState[mapping.envVar];
+		if (savedPort && !assignedPorts.has(savedPort) && await isPortAvailable(savedPort)) {
+			ports[mapping.envVar] = savedPort;
+			dockerEnv[mapping.envVar] = String(savedPort);
+			assignedPorts.add(savedPort);
+			logger.log(`   💾 ${mapping.service}:${mapping.containerPort}: using saved port ${savedPort}`);
+			continue;
+		}
+		let resolvedPort = await findAvailablePort(mapping.defaultPort);
+		while (assignedPorts.has(resolvedPort)) resolvedPort = await findAvailablePort(resolvedPort + 1);
+		ports[mapping.envVar] = resolvedPort;
+		dockerEnv[mapping.envVar] = String(resolvedPort);
+		assignedPorts.add(resolvedPort);
+		if (resolvedPort !== mapping.defaultPort) logger.log(`   ⚡ ${mapping.service}:${mapping.containerPort}: port ${mapping.defaultPort} occupied, using port ${resolvedPort}`);
+		else logger.log(`   ✅ ${mapping.service}:${mapping.containerPort}: using default port ${resolvedPort}`);
+	}
+	await savePortState(workspaceRoot, ports);
+	return {
+		dockerEnv,
+		ports,
+		mappings
+	};
+}
+/**
+* Replace a port in a URL string.
+* Handles both `hostname:port` and `localhost:port` patterns.
+* @internal Exported for testing
+*/
+function replacePortInUrl(url, oldPort, newPort) {
+	if (oldPort === newPort) return url;
+	let result = url.replace(new RegExp(`:${oldPort}(?=[/?#]|$)`, "g"), `:${newPort}`);
+	result = result.replace(new RegExp(`%3A${oldPort}(?=[%/?#&]|$)`, "gi"), `%3A${newPort}`);
+	return result;
+}
+/**
+* Rewrite connection URLs and port vars in secrets with resolved ports.
+* Uses the parsed compose mappings to determine which default ports to replace.
+* Pure transform — does not modify secrets on disk.
+* @internal Exported for testing
+*/
+function rewriteUrlsWithPorts(secrets, resolvedPorts) {
+	const { ports, mappings } = resolvedPorts;
+	const result = { ...secrets };
+	const portReplacements = [];
+	const serviceNames = /* @__PURE__ */ new Set();
+	for (const mapping of mappings) {
+		serviceNames.add(mapping.service);
+		const resolved = ports[mapping.envVar];
+		if (resolved !== void 0) portReplacements.push({
+			defaultPort: mapping.defaultPort,
+			resolvedPort: resolved
+		});
+	}
+	for (const [key, value] of Object.entries(result)) {
+		if (!key.endsWith("_HOST")) continue;
+		if (serviceNames.has(value)) result[key] = "localhost";
+	}
+	for (const [key, value] of Object.entries(result)) {
+		if (!key.endsWith("_PORT")) continue;
+		for (const { defaultPort, resolvedPort } of portReplacements) if (value === String(defaultPort)) result[key] = String(resolvedPort);
+	}
+	for (const [key, value] of Object.entries(result)) {
+		if (!key.endsWith("_URL") && !key.endsWith("_ENDPOINT") && !key.endsWith("_CONNECTION_STRING") && key !== "DATABASE_URL") continue;
+		let rewritten = value;
+		for (const name of serviceNames) rewritten = rewritten.replace(new RegExp(`@${name}:`, "g"), "@localhost:");
+		for (const { defaultPort, resolvedPort } of portReplacements) rewritten = replacePortInUrl(rewritten, defaultPort, resolvedPort);
+		result[key] = rewritten;
+	}
+	return result;
+}
+/**
+* Build the environment variables to pass to `docker compose up`.
+* Merges process.env, secrets, and port mappings so that Docker Compose
+* can interpolate variables like ${POSTGRES_USER} correctly.
+* @internal Exported for testing
+*/
+function buildDockerComposeEnv(secretsEnv, portEnv) {
+	return {
+		...process.env,
+		...secretsEnv,
+		...portEnv
+	};
+}
+/**
+* Parse all service names from a docker-compose.yml file.
+* @internal Exported for testing
+*/
+function parseComposeServiceNames(composePath) {
+	if (!(0, node_fs.existsSync)(composePath)) return [];
+	const content = (0, node_fs.readFileSync)(composePath, "utf-8");
+	const compose = (0, yaml.parse)(content);
+	return Object.keys(compose?.services ?? {});
+}
+/**
+* Start docker-compose services for a single-app project (no workspace config).
+* Starts all services defined in docker-compose.yml.
+*/
+async function startComposeServices(cwd, portEnv, secretsEnv) {
+	const composeFile = (0, node_path.join)(cwd, "docker-compose.yml");
+	if (!(0, node_fs.existsSync)(composeFile)) return;
+	const servicesToStart = parseComposeServiceNames(composeFile);
+	if (servicesToStart.length === 0) return;
+	logger.log(`🐳 Starting services: ${servicesToStart.join(", ")}`);
+	try {
+		(0, node_child_process.execSync)(`docker compose up -d ${servicesToStart.join(" ")}`, {
+			cwd,
+			stdio: "inherit",
+			env: buildDockerComposeEnv(secretsEnv, portEnv)
+		});
+		logger.log("✅ Services started");
+	} catch (error) {
+		logger.error("❌ Failed to start services:", error.message);
+		throw error;
+	}
+}
+/**
+* Start docker-compose services for a workspace.
+* Discovers all services from docker-compose.yml and starts everything
+* except app services (which are managed by turbo).
+* @internal Exported for testing
+*/
+async function startWorkspaceServices(workspace, portEnv, secretsEnv) {
+	const composeFile = (0, node_path.join)(workspace.root, "docker-compose.yml");
+	if (!(0, node_fs.existsSync)(composeFile)) return;
+	const allServices = parseComposeServiceNames(composeFile);
+	const appNames = new Set(Object.keys(workspace.apps));
+	const servicesToStart = allServices.filter((name) => !appNames.has(name));
+	if (servicesToStart.length === 0) return;
+	logger.log(`🐳 Starting services: ${servicesToStart.join(", ")}`);
+	try {
+		(0, node_child_process.execSync)(`docker compose up -d ${servicesToStart.join(" ")}`, {
+			cwd: workspace.root,
+			stdio: "inherit",
+			env: buildDockerComposeEnv(secretsEnv, portEnv)
+		});
+		logger.log("✅ Services started");
+	} catch (error) {
+		logger.error("❌ Failed to start services:", error.message);
+		throw error;
+	}
+}
+/**
+* Load and flatten secrets for an app from encrypted storage.
+* For workspace app: maps {APP}_DATABASE_URL → DATABASE_URL.
+* @internal Exported for testing
+*/
+async function loadSecretsForApp(secretsRoot, appName, stages = ["dev", "development"]) {
+	let secrets = {};
+	for (const stage of stages) if (require_storage.secretsExist(stage, secretsRoot)) {
+		const stageSecrets = await require_storage.readStageSecrets(stage, secretsRoot);
+		if (stageSecrets) {
+			logger.log(`🔐 Loading secrets from stage: ${stage}`);
+			secrets = require_storage.toEmbeddableSecrets(stageSecrets);
+			break;
+		}
+	}
+	if (Object.keys(secrets).length === 0) return {};
+	if (!appName) return secrets;
+	const prefix = appName.toUpperCase();
+	const mapped = { ...secrets };
+	const appDbUrl = secrets[`${prefix}_DATABASE_URL`];
+	if (appDbUrl) mapped.DATABASE_URL = appDbUrl;
+	return mapped;
+}
+/**
+* Walk up the directory tree to find the root containing .gkm/secrets/.
+* @internal Exported for testing
+*/
+function findSecretsRoot(startDir) {
+	let dir = startDir;
+	while (dir !== "/") {
+		if ((0, node_fs.existsSync)((0, node_path.join)(dir, ".gkm", "secrets"))) return dir;
+		const parent = (0, node_path.dirname)(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return startDir;
+}
+/**
+* Generate the credentials injection code snippet.
+* This is the common logic used by both entry wrapper and exec preload.
+* @internal
+*/
+function generateCredentialsInjection(secretsJsonPath) {
+	return `import { existsSync, readFileSync } from 'node:fs';
+
+// Inject dev secrets via globalThis and process.env
+// Using globalThis.__gkm_credentials__ avoids CJS/ESM interop issues where
+// Object.assign on the Credentials export only mutates one module copy.
+const secretsPath = '${secretsJsonPath}';
+if (existsSync(secretsPath)) {
+  const secrets = JSON.parse(readFileSync(secretsPath, 'utf-8'));
+  globalThis.__gkm_credentials__ = secrets;
+  Object.assign(process.env, secrets);
+}
+`;
+}
+/**
+* Create a preload script that injects secrets into Credentials.
+* Used by `gkm exec` to inject secrets before running any command.
+* @internal Exported for testing
+*/
+async function createCredentialsPreload(preloadPath, secretsJsonPath) {
+	const content = `/**
+ * Credentials preload generated by 'gkm exec'
+ * This file is loaded via NODE_OPTIONS="--import <path>"
+ */
+${generateCredentialsInjection(secretsJsonPath)}`;
+	await (0, node_fs_promises.writeFile)(preloadPath, content);
+}
+/**
+* Create a wrapper script that injects secrets before importing the entry file.
+* @internal Exported for testing
+*/
+async function createEntryWrapper(wrapperPath, entryPath, secretsJsonPath) {
+	const credentialsInjection = secretsJsonPath ? `${generateCredentialsInjection(secretsJsonPath)}
+` : "";
+	const content = `#!/usr/bin/env node
+/**
+ * Entry wrapper generated by 'gkm dev --entry'
+ */
+${credentialsInjection}// Import and run the user's entry file (dynamic import ensures secrets load first)
+await import('${entryPath}');
+`;
+	await (0, node_fs_promises.writeFile)(wrapperPath, content);
+}
+/**
+* Prepare credentials for dev/exec/test modes.
+* Loads workspace config, secrets, resolves Docker ports, rewrites URLs,
+* injects PORT, dependency URLs, and writes credentials JSON.
+*
+* @param options.resolveDockerPorts - How to resolve Docker ports:
+*   - `'full'` (default): probe running containers, saved state, then find available ports. Used by dev/test.
+*   - `'readonly'`: check running containers and saved state only, never probe for new ports. Used by exec.
+* @param options.stages - Secret stages to try, in order. Default: ['dev', 'development'].
+* @param options.startDocker - Start Docker Compose services after port resolution. Default: false.
+* @param options.secretsFileName - Custom secrets JSON filename. Default: 'dev-secrets-{appName}.json' or 'dev-secrets.json'.
+* @internal Exported for testing
+*/
+async function prepareEntryCredentials(options) {
+	const cwd = options.cwd ?? process.cwd();
+	const portMode = options.resolveDockerPorts ?? "full";
+	let workspaceAppPort;
+	let secretsRoot = cwd;
+	let appName;
+	let appInfo;
+	try {
+		appInfo = await require_config.loadWorkspaceAppInfo(cwd);
+		workspaceAppPort = appInfo.app.port;
+		secretsRoot = appInfo.workspaceRoot;
+		appName = appInfo.appName;
+	} catch {
+		secretsRoot = findSecretsRoot(cwd);
+		appName = require_config.getAppNameFromCwd(cwd) ?? void 0;
+	}
+	const resolvedPort = options.explicitPort ?? workspaceAppPort ?? 3e3;
+	const credentials = await loadSecretsForApp(secretsRoot, appName, options.stages);
+	credentials.PORT = String(resolvedPort);
+	const declaredKeys = [];
+	if (appInfo && usesConstructs(appInfo.workspace)) {
+		const { reconcileWorkspace: reconcileWorkspace$1 } = await Promise.resolve().then(() => require("./workspace-8acupeaI.cjs"));
+		const reconciled = await reconcileWorkspace$1(appInfo.workspace, {
+			stage: options.reconcileStage ?? "development",
+			start: options.startDocker ?? false
+		});
+		Object.assign(credentials, reconciled.env);
+		declaredKeys.push(...Object.keys(reconciled.env));
+		if (Object.keys(reconciled.env).length > 0) logger.log(`🔌 Resolved ${Object.keys(reconciled.env).length} declared URL(s)`);
+	} else {
+		const composePath = (0, node_path.join)(secretsRoot, "docker-compose.yml");
+		const mappings = parseComposePortMappings(composePath);
+		if (mappings.length > 0) {
+			let resolvedPorts;
+			if (portMode === "full") resolvedPorts = await resolveServicePorts(secretsRoot);
+			else {
+				const savedPorts = await loadPortState(secretsRoot);
+				const ports = {};
+				for (const mapping of mappings) {
+					const containerPort = getContainerHostPort(secretsRoot, mapping.service, mapping.containerPort);
+					if (containerPort !== null) ports[mapping.envVar] = containerPort;
+					else {
+						const saved = savedPorts[mapping.envVar];
+						if (saved !== void 0) ports[mapping.envVar] = saved;
+					}
+				}
+				resolvedPorts = {
+					dockerEnv: {},
+					ports,
+					mappings
+				};
+			}
+			if (options.startDocker) if (appInfo) await startWorkspaceServices(appInfo.workspace, resolvedPorts.dockerEnv, credentials);
+			else await startComposeServices(secretsRoot, resolvedPorts.dockerEnv, credentials);
+			if (Object.keys(resolvedPorts.ports).length > 0) {
+				const rewritten = rewriteUrlsWithPorts(credentials, resolvedPorts);
+				Object.assign(credentials, rewritten);
+				logger.log(`🔌 Applied ${Object.keys(resolvedPorts.ports).length} port mapping(s)`);
+			}
+		}
+	}
+	if (appInfo?.appName) {
+		const depEnv = require_workspace.getDependencyEnvVars(appInfo.workspace, appInfo.appName);
+		Object.assign(credentials, depEnv);
+	}
+	if (!credentials.EVENT_PUBLISHER_CONNECTION_STRING && !credentials.EVENT_SUBSCRIBER_CONNECTION_STRING && credentials.PGBOSS_DB_USER) {
+		const pgbossUrl = require_generator.generatePgBossUrl({
+			username: credentials.PGBOSS_DB_USER,
+			password: credentials.PGBOSS_DB_PASSWORD ?? "",
+			host: credentials.POSTGRES_HOST ?? "localhost",
+			port: Number(credentials.POSTGRES_PORT ?? "5432"),
+			database: credentials.POSTGRES_DB ?? "app"
+		});
+		credentials.EVENT_PUBLISHER_CONNECTION_STRING = pgbossUrl;
+		credentials.EVENT_SUBSCRIBER_CONNECTION_STRING = pgbossUrl;
+	}
+	const secretsDir = (0, node_path.join)(secretsRoot, ".gkm");
+	await (0, node_fs_promises.mkdir)(secretsDir, { recursive: true });
+	const secretsFileName = options.secretsFileName ?? (appName ? `dev-secrets-${appName}.json` : "dev-secrets.json");
+	const secretsJsonPath = (0, node_path.join)(secretsDir, secretsFileName);
+	await (0, node_fs_promises.writeFile)(secretsJsonPath, JSON.stringify(credentials, null, 2));
+	return {
+		credentials,
+		resolvedPort,
+		secretsJsonPath,
+		appName,
+		secretsRoot,
+		appInfo,
+		declaredKeys
+	};
+}
+
+//#endregion
+Object.defineProperty(exports, 'LOCAL_CA_PATH', {
+  enumerable: true,
+  get: function () {
+    return LOCAL_CA_PATH;
+  }
+});
+Object.defineProperty(exports, 'applyPostgres', {
+  enumerable: true,
+  get: function () {
+    return applyPostgres;
+  }
+});
+Object.defineProperty(exports, 'cacheBackendOf', {
+  enumerable: true,
+  get: function () {
+    return cacheBackendOf;
+  }
+});
+Object.defineProperty(exports, 'constructGlobs', {
+  enumerable: true,
+  get: function () {
+    return constructGlobs;
+  }
+});
+Object.defineProperty(exports, 'createCredentialsPreload', {
+  enumerable: true,
+  get: function () {
+    return createCredentialsPreload;
+  }
+});
+Object.defineProperty(exports, 'createEntryWrapper', {
+  enumerable: true,
+  get: function () {
+    return createEntryWrapper;
+  }
+});
+Object.defineProperty(exports, 'derivedContainers', {
+  enumerable: true,
+  get: function () {
+    return derivedContainers;
+  }
+});
+Object.defineProperty(exports, 'emailBackendOf', {
+  enumerable: true,
+  get: function () {
+    return emailBackendOf;
+  }
+});
+Object.defineProperty(exports, 'findAvailablePort', {
+  enumerable: true,
+  get: function () {
+    return findAvailablePort;
+  }
+});
+Object.defineProperty(exports, 'imagePins', {
+  enumerable: true,
+  get: function () {
+    return imagePins;
+  }
+});
+Object.defineProperty(exports, 'isPortAvailable', {
+  enumerable: true,
+  get: function () {
+    return isPortAvailable;
+  }
+});
+Object.defineProperty(exports, 'loadEnvFiles', {
+  enumerable: true,
+  get: function () {
+    return loadEnvFiles;
+  }
+});
+Object.defineProperty(exports, 'loadSecretsForApp', {
+  enumerable: true,
+  get: function () {
+    return loadSecretsForApp;
+  }
+});
+Object.defineProperty(exports, 'prepareEntryCredentials', {
+  enumerable: true,
+  get: function () {
+    return prepareEntryCredentials;
+  }
+});
+Object.defineProperty(exports, 'providerOf', {
+  enumerable: true,
+  get: function () {
+    return providerOf;
+  }
+});
+Object.defineProperty(exports, 'reconcileWorkspace', {
+  enumerable: true,
+  get: function () {
+    return reconcileWorkspace;
+  }
+});
+Object.defineProperty(exports, 'resolveServicePorts', {
+  enumerable: true,
+  get: function () {
+    return resolveServicePorts;
+  }
+});
+Object.defineProperty(exports, 'resourceName', {
+  enumerable: true,
+  get: function () {
+    return resourceName;
+  }
+});
+Object.defineProperty(exports, 'rewriteUrlsWithPorts', {
+  enumerable: true,
+  get: function () {
+    return rewriteUrlsWithPorts;
+  }
+});
+Object.defineProperty(exports, 'startWorkspaceServices', {
+  enumerable: true,
+  get: function () {
+    return startWorkspaceServices;
+  }
+});
+Object.defineProperty(exports, 'storageBackendOf', {
+  enumerable: true,
+  get: function () {
+    return storageBackendOf;
+  }
+});
+Object.defineProperty(exports, 'usesConstructs', {
+  enumerable: true,
+  get: function () {
+    return usesConstructs;
+  }
+});
+//# sourceMappingURL=credentials-K961ThG3.cjs.map