@opengroundplan/core 0.1.1

package/templates/layers/db-sqlite/files/tests/test_db_sqlite.py

@@ -0,0 +1,50 @@
+"""Runs under plain pytest — no pytest-asyncio needed. Run from the repo root."""
+
+import asyncio
+
+from {{ solutionName | snake }}.db.sqlite.connection import connection
+from {{ solutionName | snake }}.db.sqlite.health import check_health, check_integrity
+from {{ solutionName | snake }}.db.sqlite.migrate import migrate
+from {{ solutionName | snake }}.db.sqlite.settings import SqliteSettings, load_sqlite_settings
+
+MEMORY = SqliteSettings(file=":memory:")
+
+
+def test_settings_prefer_env_over_defaults() -> None:
+    settings = load_sqlite_settings({"SQLITE_FILE": "/tmp/x.db", "SQLITE_BUSY_TIMEOUT_MS": "250"})
+    assert settings.file == "/tmp/x.db"
+    assert settings.busy_timeout_ms == 250
+    assert settings.journal_mode == SqliteSettings().journal_mode
+
+
+def test_foreign_keys_are_enforced() -> None:
+    async def scenario() -> int:
+        async with connection(MEMORY) as handle:
+            async with handle.execute("PRAGMA foreign_keys") as cursor:
+                return (await cursor.fetchone())[0]
+
+    assert asyncio.run(scenario()) == 1
+
+
+def test_migrations_apply_once_and_are_recorded() -> None:
+    directory = load_sqlite_settings().migrations_dir
+
+    async def scenario() -> tuple[int, int]:
+        async with connection(MEMORY) as handle:
+            first = await migrate(handle, directory)
+            second = await migrate(handle, directory)
+            return len(first.applied), len(second.applied)
+
+    applied, reapplied = asyncio.run(scenario())
+    assert applied >= 1
+    assert reapplied == 0
+
+
+def test_health_and_integrity() -> None:
+    async def scenario() -> tuple[bool, bool]:
+        async with connection(MEMORY) as handle:
+            health = await check_health(handle)
+            return health.ok, await check_integrity(handle)
+
+    ok, intact = asyncio.run(scenario())
+    assert ok and intact

package/templates/layers/devcontainer/blueprint.yaml

@@ -0,0 +1,130 @@
+# VS Code / Codespaces dev container.
+#
+# The layer ships ONE devcontainer.json for every stack. That is deliberate: the engine
+# derives a destination path from the template's own path (plan.ts stripFilesRoot), so
+# `.devcontainer/devcontainer.json` can only ever come from a single template file. Stack
+# variance therefore lives in `setup-<stack>.sh` siblings — distinct basenames, each gated
+# by `when:` — which the shared post-create hook discovers and runs.
+id: devcontainer
+kind: layer
+name: Dev Container
+description: >-
+  Reproducible VS Code / GitHub Codespaces development environment: a pinned toolchain
+  image, Docker-in-Docker so the repo's own compose files run inside the container, and a
+  post-create hook that installs dependencies with the stack's package manager. Every
+  tunable is a devcontainer.json value or a containerEnv variable — no script inlines an
+  image, a port, or a package manager.
+
+tags:
+  - devcontainer
+  - vscode
+  - codespaces
+  - docker
+  - developer-experience
+  - onboarding
+  - reproducibility
+
+# Nothing to require. The layer adds `.devcontainer/` and reads only what the base already
+# put on disk (package.json / pyproject.toml / go.mod / *.sln), so it composes with any base
+# and needs no persistence, auth, or CI layer present.
+requires: []
+
+# Nothing to declare. A rival environment layer (nix-shell, docker-compose-dev, gitpod) must
+# name `devcontainer` from its own blueprint — naming an id that does not exist yet makes the
+# whole catalog fail to load (loader.assertReferencesResolve), and conflicts are symmetric.
+conflicts: []
+
+# Virtual capabilities other layers key off. `docker-in-dev` is the load-bearing one: the
+# db / cache layers ship compose files that are only runnable from inside this container
+# because Docker-in-Docker puts their published ports on the container's own localhost.
+provides:
+  - devcontainer
+  - dev-environment
+  - containerized-dev
+  - docker-in-dev
+  - editor-settings
+
+# A dev container wraps the repo; it never dictates the repo's folder layout.
+supportsArchitectures: []
+
+variables:
+  # One knob for the whole toolchain. Kept as an explicit choice rather than derived from
+  # `stack` because the destination path forces a single shared devcontainer.json, and a
+  # wrong-by-default image is worse than one deliberate question.
+  - name: devcontainerImage
+    prompt: Dev container base image (pick the one matching your stack)
+    type: select
+    default: mcr.microsoft.com/devcontainers/base:trixie
+    required: true
+    choices:
+      - { value: 'mcr.microsoft.com/devcontainers/typescript-node:24-trixie', label: 'TypeScript / Node 24 (Debian trixie)' }
+      - { value: 'mcr.microsoft.com/devcontainers/python:3.13-trixie', label: 'Python 3.13 (Debian trixie)' }
+      - { value: 'mcr.microsoft.com/devcontainers/go:1.25-trixie', label: 'Go 1.25 (Debian trixie)' }
+      - { value: 'mcr.microsoft.com/devcontainers/dotnet:10.0-noble', label: '.NET 10 (Ubuntu noble)' }
+      - { value: 'mcr.microsoft.com/devcontainers/base:trixie', label: 'Polyglot / other (Debian trixie, no toolchain)' }
+
+  - name: devcontainerForwardPort
+    prompt: Application port to forward out of the container
+    type: number
+    default: 3000
+    required: true
+
+  - name: devcontainerInstallOnCreate
+    prompt: Install dependencies automatically when the container is created
+    type: boolean
+    default: true
+
+  # Declared here as well as on the node/typescript bases. `askBlueprintVariables` dedupes by
+  # name and the base is asked first, so the base's answer wins where it exists and this
+  # declaration only fills the gap (polyglot / custom bases).
+  - name: packageManager
+    prompt: Node package manager
+    type: select
+    default: pnpm
+    when: "stack == 'typescript' || stack == 'node' || stack == 'polyglot'"
+    choices:
+      - { value: pnpm, label: pnpm }
+      - { value: npm, label: npm }
+      - { value: yarn, label: yarn }
+      - { value: bun, label: bun }
+
+  - name: pythonPackageManager
+    prompt: Python package manager
+    type: select
+    default: uv
+    when: "stack == 'python'"
+    choices:
+      - { value: uv, label: uv }
+      - { value: pip, label: pip }
+      - { value: poetry, label: poetry }
+
+files:
+  # ── every stack ─────────────────────────────────────────────────────────────
+  - from: files/.devcontainer/devcontainer.json
+    to: .
+  - from: files/.devcontainer/post-create.sh
+    to: .
+  - from: files/docs/devcontainer.md
+    to: .
+
+  # ── stack setup hooks ───────────────────────────────────────────────────────
+  # Exactly one of these lands in `.devcontainer/`; post-create.sh runs whatever is there.
+  - from: files/.devcontainer/setup-node.sh
+    to: .
+    when: "stack == 'typescript' || stack == 'node' || stack == 'polyglot'"
+
+  - from: files/.devcontainer/setup-python.sh
+    to: .
+    when: "stack == 'python'"
+
+  - from: files/.devcontainer/setup-go.sh
+    to: .
+    when: "stack == 'go'"
+
+  - from: files/.devcontainer/setup-dotnet.sh
+    to: .
+    when: "stack == 'dotnet'"
+
+# No postApply. Everything this layer installs happens inside the container via
+# postCreateCommand, so `groundplan apply` never has to run a toolchain on the host.
+postApply: []

package/templates/layers/devcontainer/files/.devcontainer/devcontainer.json

@@ -0,0 +1,61 @@
+// Dev container for {{ solutionName | title }}.
+// This file is the single source of truth for the dev environment: image, ports and the
+// values the setup scripts read. Scripts never inline any of it — see containerEnv below.
+// Reference: https://containers.dev/implementors/json_reference/
+{
+  "name": "{{ solutionName | title }}",
+  "image": "{{ devcontainerImage }}",
+
+  "features": {
+    "ghcr.io/devcontainers/features/common-utils:2": {
+      "installZsh": true,
+      "configureZshAsDefaultShell": true,
+      "upgradePackages": true
+    },
+    "ghcr.io/devcontainers/features/github-cli:1": {},
+    // Sibling containers would not be reachable on this container's localhost, so the
+    // repo's own compose files (db, cache, queue) need docker *in* docker, not outside.
+    "ghcr.io/devcontainers/features/docker-in-docker:4": {}
+  },
+
+  "forwardPorts": [{{ devcontainerForwardPort }}],
+  "portsAttributes": {
+    "{{ devcontainerForwardPort }}": {
+      "label": "{{ solutionName | kebab }}",
+      "onAutoForward": "notify"
+    }
+  },
+
+  // The only place a dev-environment value is defined. Setup scripts read these and fall
+  // back to the same literals only when the variable is unset outside the container.
+  "containerEnv": {
+    "DEVCONTAINER_APP_PORT": "{{ devcontainerForwardPort }}",
+    "DEVCONTAINER_INSTALL_ON_CREATE": "{{ devcontainerInstallOnCreate }}"
+  },
+
+  "postCreateCommand": "bash .devcontainer/post-create.sh",
+
+  "customizations": {
+    "vscode": {
+      // Language extensions arrive with the toolchain image and its features; only
+      // stack-independent tooling is listed here.
+      "extensions": [
+        "editorconfig.editorconfig",
+        "ms-azuretools.vscode-docker",
+        "github.vscode-github-actions",
+        "github.vscode-pull-request-github",
+        "davidanson.vscode-markdownlint",
+        "mikestead.dotenv",
+        "streetsidesoftware.code-spell-checker"
+      ],
+      "settings": {
+        "files.eol": "\n",
+        "files.insertFinalNewline": true,
+        "files.trimTrailingWhitespace": true,
+        "editor.formatOnSave": true
+      }
+    }
+  },
+
+  "remoteUser": "vscode"
+}

package/templates/layers/devcontainer/files/.devcontainer/post-create.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Runs once, inside the container, after it is created. Stack-agnostic: it only dispatches
+# to whichever setup-<stack>.sh shipped with this repo. Every value comes from containerEnv
+# in devcontainer.json.
+set -euo pipefail
+
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# The bind mount is owned by the host user, so git refuses the repo until it is trusted.
+git config --global --add safe.directory "$PWD" || true
+
+if [ "${DEVCONTAINER_INSTALL_ON_CREATE:-true}" != "true" ]; then
+  echo "post-create: dependency install disabled (DEVCONTAINER_INSTALL_ON_CREATE)"
+  exit 0
+fi
+
+ran=0
+for script in "$here"/setup-*.sh; do
+  [ -f "$script" ] || continue
+  echo "post-create: running $(basename "$script")"
+  bash "$script"
+  ran=1
+done
+
+if [ "$ran" -eq 0 ]; then
+  echo "post-create: no setup-<stack>.sh present, nothing to install"
+fi
+
+echo "post-create: ready — app port ${DEVCONTAINER_APP_PORT:-unset} is forwarded"

package/templates/layers/devcontainer/files/.devcontainer/setup-dotnet.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# .NET restore. Restores the solution when there is one so every project in the repo is
+# covered, not just whichever csproj happens to sort first.
+set -euo pipefail
+
+solution="$(find . -maxdepth 2 \( -name '*.slnx' -o -name '*.sln' \) -print -quit)"
+
+if [ -n "$solution" ]; then
+  echo "setup-dotnet: restoring $solution"
+  dotnet restore "$solution"
+elif find . -maxdepth 3 -name '*.csproj' -print -quit | grep -q .; then
+  echo "setup-dotnet: restoring projects"
+  dotnet restore
+else
+  echo "setup-dotnet: no solution or project found, skipping"
+fi
+
+# HTTPS dev certificate — without it every local https launch profile fails on first run.
+dotnet dev-certs https >/dev/null 2>&1 || true

package/templates/layers/devcontainer/files/.devcontainer/setup-go.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# Go module download. Warms the build cache too, so the first `go test` in the container is
+# not a cold compile of the whole dependency graph.
+set -euo pipefail
+
+if [ ! -f go.mod ]; then
+  echo "setup-go: no go.mod, skipping"
+  exit 0
+fi
+
+echo "setup-go: downloading modules"
+go mod download
+go build ./... >/dev/null 2>&1 || true

package/templates/layers/devcontainer/files/.devcontainer/setup-node.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Node / TypeScript dependency install. The package manager is chosen at generation time and
+# can be overridden per-container without editing this script.
+set -euo pipefail
+
+default_package_manager="{{ packageManager }}"
+package_manager="${DEVCONTAINER_NODE_PACKAGE_MANAGER:-$default_package_manager}"
+
+if [ ! -f package.json ]; then
+  echo "setup-node: no package.json, skipping"
+  exit 0
+fi
+
+# pnpm and yarn ship with Node as corepack shims; enabling it honours packageManager in package.json.
+case "$package_manager" in
+  pnpm | yarn) corepack enable >/dev/null 2>&1 || true ;;
+esac
+
+echo "setup-node: installing with $package_manager"
+case "$package_manager" in
+  pnpm) pnpm install --frozen-lockfile || pnpm install ;;
+  npm) npm ci || npm install ;;
+  yarn) yarn install --immutable || yarn install ;;
+  bun) command -v bun >/dev/null 2>&1 || npm install -g bun; bun install ;;
+  *)
+    echo "setup-node: unknown package manager '$package_manager'" >&2
+    exit 1
+    ;;
+esac

package/templates/layers/devcontainer/files/.devcontainer/setup-python.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# Python dependency install. The package manager is chosen at generation time and can be
+# overridden per-container without editing this script.
+set -euo pipefail
+
+default_package_manager="{{ pythonPackageManager }}"
+package_manager="${DEVCONTAINER_PYTHON_PACKAGE_MANAGER:-$default_package_manager}"
+
+if [ ! -f pyproject.toml ] && [ ! -f requirements.txt ]; then
+  echo "setup-python: no pyproject.toml or requirements.txt, skipping"
+  exit 0
+fi
+
+echo "setup-python: installing with $package_manager"
+case "$package_manager" in
+  uv)
+    command -v uv >/dev/null 2>&1 || python -m pip install --user --quiet uv
+    if [ -f pyproject.toml ]; then uv sync --all-extras; else uv pip install --system -r requirements.txt; fi
+    ;;
+  pip)
+    python -m pip install --upgrade --quiet pip
+    if [ -f requirements.txt ]; then python -m pip install -r requirements.txt; else python -m pip install -e '.[dev]' || python -m pip install -e .; fi
+    ;;
+  poetry)
+    command -v poetry >/dev/null 2>&1 || python -m pip install --user --quiet poetry
+    poetry install --no-interaction
+    ;;
+  *)
+    echo "setup-python: unknown package manager '$package_manager'" >&2
+    exit 1
+    ;;
+esac

package/templates/layers/devcontainer/files/docs/devcontainer.md

@@ -0,0 +1,75 @@
+# Dev container
+
+`{{ solutionName | title }}` ships a [dev container](https://containers.dev) so a clone,
+a Codespace, and CI all get the same toolchain.
+
+## Open it
+
+| Where | How |
+|---|---|
+| VS Code | `Dev Containers: Reopen in Container` (install the Dev Containers extension) |
+| GitHub Codespaces | **Code → Codespaces → Create codespace** |
+| CLI | `npx @devcontainers/cli up --workspace-folder .` |
+
+First build pulls the image and runs `.devcontainer/post-create.sh`. Later opens reuse it.
+
+## What is inside
+
+- **Image** — `{{ devcontainerImage }}`, pinned in `.devcontainer/devcontainer.json`.
+- **Features** — `common-utils` (zsh, non-root `vscode` user), `github-cli`, and
+  `docker-in-docker`.
+- **Port `{{ devcontainerForwardPort }}`** — forwarded automatically.
+
+Docker runs *inside* the container rather than against the host daemon, so any
+`docker-compose.*.yml` this repo ships (database, cache, queue) publishes its ports on the
+container's own `localhost` — the same address the app's configuration already uses. No
+host-network special-casing, and nothing leaks onto the host's port space.
+
+## Configuration
+
+`.devcontainer/devcontainer.json` is the single source of truth. The setup scripts read
+values from `containerEnv` and never hardcode them.
+
+| Variable | Default | Effect |
+|---|---|---|
+| `DEVCONTAINER_APP_PORT` | `{{ devcontainerForwardPort }}` | Forwarded application port |
+| `DEVCONTAINER_INSTALL_ON_CREATE` | `{{ devcontainerInstallOnCreate }}` | Set `false` to skip the dependency install |
+| `DEVCONTAINER_NODE_PACKAGE_MANAGER` | value baked into `setup-node.sh` | Override the Node package manager |
+| `DEVCONTAINER_PYTHON_PACKAGE_MANAGER` | value baked into `setup-python.sh` | Override the Python package manager |
+
+To change one, edit `containerEnv` in `devcontainer.json` and rebuild
+(`Dev Containers: Rebuild Container`).
+
+## Post-create
+
+`post-create.sh` trusts the bind-mounted working tree with git, then runs every
+`.devcontainer/setup-*.sh` it finds. One setup script ships per stack:
+
+| Script | Does |
+|---|---|
+| `setup-node.sh` | `corepack enable`, then install with pnpm / npm / yarn / bun |
+| `setup-python.sh` | `uv sync`, `pip install`, or `poetry install` |
+| `setup-go.sh` | `go mod download` and a cache-warming build |
+| `setup-dotnet.sh` | `dotnet restore` on the solution, plus the HTTPS dev certificate |
+
+Add your own step by appending another `setup-*.sh` — the dispatcher picks it up with no
+change to `devcontainer.json`.
+
+## Changing the toolchain
+
+Swap the `image` field. Official images live under `mcr.microsoft.com/devcontainers/`:
+
+| Stack | Image |
+|---|---|
+| TypeScript / Node | `mcr.microsoft.com/devcontainers/typescript-node:24-trixie` |
+| Python | `mcr.microsoft.com/devcontainers/python:3.13-trixie` |
+| Go | `mcr.microsoft.com/devcontainers/go:1.25-trixie` |
+| .NET | `mcr.microsoft.com/devcontainers/dotnet:10.0-noble` |
+| Polyglot | `mcr.microsoft.com/devcontainers/base:trixie` |
+
+Keep the image's language version in step with the one the project's own manifest declares
+(`package.json` engines, `pyproject.toml` `requires-python`, `go.mod`, `global.json`); a
+mismatch is the usual cause of "works in the container, fails in CI".
+
+Features are pinned to a major (`:2`, `:1`, `:4`) so patch fixes arrive without a manual
+bump while breaking changes stay opt-in.

package/templates/layers/docker/blueprint.yaml

@@ -0,0 +1,168 @@
+id: docker
+kind: layer
+name: Docker container image
+description: >-
+  Production container image per stack: multi-stage build, a distroless or slim runtime that
+  carries no compiler, package manager, or shell, and a non-root user. Ships a shared
+  .dockerignore, a Compose harness for running the built image locally, and the ARG table that
+  makes every base image tag and build path overridable without editing the Dockerfile.
+
+tags: [docker, container, oci, packaging, deployment, distroless, non-root, compose]
+
+# Nothing to depend on: the layer only adds build files and reads the base's own env-driven
+# config, so it composes with any base and with or without db / cache / auth layers.
+requires: []
+# No alternative packaging layer exists yet. A future `buildpacks` or `nix-image` layer must
+# name `docker` from its own blueprint — naming an id that does not exist here makes the whole
+# catalog fail to load (loader.assertReferencesResolve), and conflicts are symmetric anyway.
+conflicts: []
+# Virtual capabilities other layers key off: a CI layer wants to know an image can be built,
+# a deploy layer wants to know a compose harness exists.
+provides: [container-image, dockerfile, docker-compose, containerization]
+
+# Packaging is orthogonal to folder layout — every architecture overlay is fine.
+supportsArchitectures: []
+# Framework packages these templates import are installed by the base itself.
+peerProvidedBy: [nextjs-app]
+
+
+variables:
+  # The engine derives a destination from the source path and cannot rename a file, so each
+  # stack's Dockerfile keeps its own suffix (`Dockerfile.go`, `Dockerfile.dotnet`, ...) and
+  # exactly one of them is written. Which one follows from `stack`, so it is not asked:
+  # a user who answered "nodejs" on a .NET base used to get compose and an ignore file with
+  # no Dockerfile at all, and nothing said so.
+  #
+  # Not asked: the base already determines it, and asking invited the answer to disagree with
+  # the stack — a .NET repo that answered "nodejs" got compose and an ignore file with no
+  # Dockerfile at all, silently. Each declaration below is guarded by the base or stack it
+  # belongs to, and the interview takes the first whose condition holds.
+  - name: dockerTarget
+    prompt: "Container target"
+    type: string
+    default: spa
+    when: "base == 'react-vite-spa'"
+
+  - name: dockerTarget
+    prompt: "Container target"
+    type: string
+    default: nextjs
+    when: "stack == 'typescript'"
+
+  # `nodejs`, not `node`: a file ending in .node reads as a native binary to git and editors.
+  - name: dockerTarget
+    prompt: "Container target"
+    type: string
+    default: nodejs
+    when: "stack == 'node'"
+
+  - name: dockerTarget
+    prompt: "Container target"
+    type: string
+    default: python
+    when: "stack == 'python'"
+
+  - name: dockerTarget
+    prompt: "Container target"
+    type: string
+    default: go
+    when: "stack == 'go'"
+
+  - name: dockerTarget
+    prompt: "Container target"
+    type: string
+    default: dotnet
+    when: "stack == 'dotnet'"
+
+  - name: dockerPort
+    prompt: Port the container listens on
+    type: number
+    default: 8080
+    required: true
+
+  - name: dockerHealthPath
+    prompt: "Liveness path the image probes (go-api uses /healthz, nextjs-app uses /api/health)"
+    type: string
+    default: /health
+    required: true
+
+  # Install/build/prune are single shell strings so one Dockerfile serves every package
+  # manager: swap in `npm i -g pnpm && pnpm install --frozen-lockfile` and nothing else moves.
+  - name: dockerNodeInstallCommand
+    prompt: Install command run in the builder stage
+    type: string
+    default: npm ci
+    required: true
+    when: "stack == 'typescript' || stack == 'node'"
+
+  - name: dockerNodeBuildCommand
+    prompt: Build command run in the builder stage
+    type: string
+    default: npm run build
+    required: true
+    when: "stack == 'typescript' || stack == 'node'"
+
+  - name: dockerNodePruneCommand
+    prompt: Command that strips devDependencies before the runtime stage copies node_modules
+    type: string
+    default: npm prune --omit=dev
+    required: true
+    when: "stack == 'node'"
+
+  - name: dockerNodeEntry
+    prompt: "Compiled entry script (hono-api: dist/index.js, nestjs-api: dist/main.js)"
+    type: string
+    default: dist/index.js
+    required: true
+    when: "stack == 'node'"
+
+  - name: dockerPythonInstallCommand
+    prompt: Dependency install command run in the builder stage
+    type: string
+    default: uv sync --no-dev
+    required: true
+    when: "stack == 'python'"
+
+files:
+  # ── every stack ─────────────────────────────────────────────────────────────
+  # Verbatim copy: an ignore file carries no groundplan tokens, so skip the content-token scan.
+  - from: files/.dockerignore
+    raw: true
+  - from: files/compose.yaml
+  - from: files/.env.docker.example
+  - from: files/docs/docker.md
+
+  # ── typescript: Next.js standalone server ───────────────────────────────────
+  - from: files/Dockerfile.nextjs
+    when: "stack == 'typescript' && dockerTarget == 'nextjs'"
+  # The standalone bundle only exists when next.config sets it, and the base cannot know a
+  # container layer is coming — so this layer owns the file and says so.
+  - from: files/next.config.ts
+    when: "stack == 'typescript' && dockerTarget == 'nextjs'"
+    onConflict: overwrite
+
+  # ── typescript: prebuilt SPA served by nginx ────────────────────────────────
+  - from: files/Dockerfile.spa
+    when: "stack == 'typescript' && dockerTarget == 'spa'"
+  - from: files/docker/nginx.conf
+    when: "stack == 'typescript' && dockerTarget == 'spa'"
+
+  # ── node ────────────────────────────────────────────────────────────────────
+  - from: files/Dockerfile.nodejs
+    when: "stack == 'node'"
+
+  # ── python ──────────────────────────────────────────────────────────────────
+  - from: files/Dockerfile.python
+    when: "stack == 'python'"
+
+  # ── go ──────────────────────────────────────────────────────────────────────
+  - from: files/Dockerfile.go
+    when: "stack == 'go'"
+
+  # ── dotnet ──────────────────────────────────────────────────────────────────
+  - from: files/Dockerfile.dotnet
+    when: "stack == 'dotnet'"
+
+# No postApply: building an image needs a running daemon and pulls hundreds of megabytes,
+# which is not safe to run unattended straight after generation.
+postApply: []