@geekmidas/cli 10.0.0-alpha.124 → 10.0.0-alpha.126

package/dist/{compose-DJvvmF3X.mjs → compose-CvHIjMDd.mjs}

@@ -1,16 +1,16 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
 import { c as runOutput, s as run } from "./credentials-DpfnUvIR.mjs";
-import { B as LOGS_PORT, I as otlpTelemetryEnv, L as resolveStageTelemetry, at as certificateFor, ft as SERVER_IPV4_KEY, ht as isReservedStageKey, it as ComposeTlsFileMissing, ot as proxyFor, z as telemetryEnv } from "./workspace-DUnnVjqC.mjs";
-import { A as stackBackups, C as siteNames, I as stageBackups, O as backupsRoleStatements, S as siteAuth, T as BACKUPS_SERVICE, a as subscriptionKey, c as HostNotPointingAtServer, d as requiredServerAddress, f as serverAddressHint, g as systemLookup, i as recordedPushSubscriptions, k as backupsService, m as stageDns, n as SUBSCRIPTION_TYPE, o as subscriptionResource, p as stackHosts, r as confirmPendingSubscriptions, s as topicConnection, t as PushSubscriptionsUnconfirmed, u as isLocalHost, w as withSitePasswords, x as passwordSites } from "./snsSubscriptions-CvBIGGp0.mjs";
+import { B as LOGS_PORT, I as otlpTelemetryEnv, L as resolveStageTelemetry, at as certificateFor, ft as SERVER_IPV4_KEY, ht as isReservedStageKey, it as ComposeTlsFileMissing, ot as proxyFor, z as telemetryEnv } from "./workspace-DBHF9Gba.mjs";
+import { A as backupsRoleStatements, C as passwordSites, D as BACKUPS_SERVICE, E as withSitePasswords, M as stackBackups, R as stageBackups, T as siteNames, a as subscriptionKey, c as HostNotPointingAtServer, f as requiredServerAddress, g as stageDns, h as stackHosts, i as recordedPushSubscriptions, j as backupsService, n as SUBSCRIPTION_TYPE, o as subscriptionResource, p as serverAddressHint, r as confirmPendingSubscriptions, s as topicConnection, t as PushSubscriptionsUnconfirmed, u as isLocalHost, v as systemLookup, w as siteAuth } from "./snsSubscriptions-R_AKBZYK.mjs";
 import { t as defineTarget } from "./define-6poNqm5O.mjs";
-import { $n as LOGS_SERVICE, $t as publicBuildValues, An as envFor, B as workerDockerfile, Bn as usesTelemetry, Bt as initStageSecrets, Cn as withGeneratedSecrets, Ct as composeFor, Dn as runsRedis, En as redisService, Gn as DEFAULT_IMAGES, Gt as composeBuildPaths, Hn as watchedBuckets, In as isTelemetryKey, Jn as portKeys, Jt as WORKER_PORT, Kt as imageLayout, L as appDockerfile, Ln as scopeTelemetryEnv, N as stageProviderNotes, Nn as planFor, On as stackRedis, S as recordRelease, Tn as STACK_CACHE, Un as EMULATOR_ACCESS_KEY_ID, Vn as minioWebhookEnv, Wn as hostFor, Xt as findBuildRoot, Zn as primaryPortKey, a as dnsResources, an as applyPolicies, ar as isMainFrontendApp, at as suppliedOnly, bt as bucketClient, c as currentActor, cn as bucketPolicies, ct as networkEnv, d as DeployJournal, er as logsAccess, et as devServicesUsed, ft as constructGlobs, gn as postgresSuperuser, in as applyNotifications, ir as NoDomainForStage, it as stageServiceDeclarations, jn as localRolePassword, kn as withRedisPassword, lt as workerEnvKeys, mn as loadLocalCredentials, n as reportDatabaseRuns, nn as applyBuckets, nr as stackLogs, o as forgetDnsResource, on as applyPostgres, or as resolveHost, ot as appEnvKeys, pn as LOCAL_RABBITMQ_USER, q as validateImageRef, qt as TURBO_VERSION, r as reportPlannedSeeds, rn as applyLifecycles, rr as withLogsPassword, s as recordDnsChanges, sn as bucketLifecycles, t as DeploySeedsFailed, tn as workerUnits, tr as logsService, tt as externalServices, un as postgresStatements, v as createComposeState, vt as LEGACY_LOCAL_LOGIN, wn as REDIS_SERVICE, xt as pgClient, yt as ensurePostgresLogin, z as ensureDockerignore, zn as telemetryOf } from "./seeds-rG-Evfz9.mjs";
+import { $ as ORIGIN_VERIFY_HEADER, $n as telemetryOf, An as postgresSuperuser, At as LEGACY_LOCAL_LOGIN, B as processorDockerfile, Bn as redisService, Ct as backendsOf, Dn as LOCAL_RABBITMQ_USER, Ft as composeFor, Gn as localRolePassword, H as workerDockerfile, Hn as stackRedis, L as appDockerfile, Ln as withGeneratedSecrets, Mt as bucketClient, N as stageProviderNotes, Nt as pgClient, On as loadLocalCredentials, Qt as initStageSecrets, Rn as REDIS_SERVICE, S as recordRelease, Sn as bucketPolicies, Un as withRedisPassword, V as processorNative, Vn as runsRedis, Wn as envFor, Xn as isTelemetryKey, Zn as scopeTelemetryEnv, _n as applyLifecycles, _r as withLogsPassword, _t as appEnvKeys, a as dnsResources, an as PROCESSOR_PORT, ar as DEFAULT_IMAGES, bn as applyPostgres, br as resolveHost, bt as processorEnvKeys, c as currentActor, cr as portKeys, d as DeployJournal, dr as primaryPortKey, dt as devServicesUsed, er as usesTelemetry, fn as publicBuildValues, ft as externalServices, gn as applyBuckets, gr as stackLogs, gt as suppliedOnly, hn as workerUnits, hr as logsService, ht as stageServiceDeclarations, in as imageLayout, ir as hostFor, it as validateImageRef, jt as ensurePostgresLogin, ln as findBuildRoot, mn as processorUnits, mr as logsAccess, n as reportDatabaseRuns, nr as watchedBuckets, nt as originSecretKey, o as forgetDnsResource, on as TURBO_VERSION, pr as LOGS_SERVICE, qn as planFor, r as reportPlannedSeeds, rn as composeBuildPaths, rr as EMULATOR_ACCESS_KEY_ID, rt as processorOriginHost, s as recordDnsChanges, sn as WORKER_PORT, t as DeploySeedsFailed, tr as minioWebhookEnv, v as createComposeState, vn as applyNotifications, vr as NoDomainForStage, wn as postgresStatements, wt as constructGlobs, xn as bucketLifecycles, xt as workerEnvKeys, yn as applyPolicies, yr as isMainFrontendApp, yt as networkEnv, z as ensureDockerignore, zn as STACK_CACHE } from "./seeds-Cfejy8wj.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { a as SNS_SUBSCRIPTIONS_KEY, l as DEFAULT_EVENTS, o as objectsRoute, s as subscriberRoute } from "./SubscriberGenerator-COAVPgM-.mjs";
+import { i as installedFrom, s as DEFAULT_EVENTS } from "./drivers-CDjpjakg.mjs";
 import { a as imageRef } from "./identity-CBXr4wNi.mjs";
-import { i as discover } from "./discover-BvJOVsYG.mjs";
-import { i as installedFrom } from "./drivers-Chb5Akov.mjs";
-import { f as plannedSeeds, o as SeedFailed, p as seedDatabases, u as migrateDatabases } from "./databases-BPOgTn1u.mjs";
+import { i as discover } from "./discover-CzGM5P3p.mjs";
+import { a as SNS_SUBSCRIPTIONS_KEY, o as objectsRoute, s as subscriberRoute } from "./SubscriberGenerator-BALddfuW.mjs";
+import { f as plannedSeeds, o as SeedFailed, p as seedDatabases, u as migrateDatabases } from "./databases-6GD0tI2F.mjs";
 import { dirname, join } from "node:path";
 import { existsSync } from "node:fs";
 import { chmod, mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
@@ -649,6 +649,21 @@ const sshAccess = {
 	}
 };
 //#endregion
+//#region src/compose/routes.ts
+/** A route with handlers and a check that would have to hold for each of them. */
+var EdgeRouteConflict = class extends Error {
+	route;
+	constructor(route) {
+		super(`The edge route '${route}' sends some paths to other upstreams and also restricts who or what it answers. The two are not combined: give the restricted paths a host of their own.`);
+		this.route = route;
+		this.name = "EdgeRouteConflict";
+	}
+};
+/** @throws {EdgeRouteConflict} */
+function assertRouteRenderable(route) {
+	if (route.handlers?.length && (route.allow || route.paths || route.prefixes || route.requireHeader)) throw new EdgeRouteConflict(route.name);
+}
+//#endregion
 //#region src/compose/caddyfile.ts
 /**
 * The stack's own edge, rendered for Caddy: one site block per route.
@@ -684,26 +699,55 @@ function edgeCaddyfile(routes, options) {
 ` : tls.kind === "files" ? `
 	tls ${tls.certFile} ${tls.keyFile}
 ` : "";
-	const blocks = routes.map(({ host, upstreams, prefix, allow, auth, paths, streaming }) => `https://${host} {${certificate}
-	# gkm's own header, which only a service of this stack may send: the auth
-	# server rate-limits by the client address it carries.
-	request_header -${CLIENT_IP_HEADER}
-${allow ? `
+	const blocks = routes.map((route) => siteBlock(route, certificate));
+	return `${HEADER}${global ? `${global}\n\n` : ""}${blocks.join("\n\n")}\n`;
+}
+/** One route's site block. */
+function siteBlock(route, certificate) {
+	assertRouteRenderable(route);
+	const { host, allow, auth, paths, prefixes, requireHeader, handlers } = route;
+	const allowed = [...paths ?? [], ...(prefixes ?? []).map((prefix) => `${prefix}*`)];
+	const checks = `${allow ? `
 	# Only these addresses — the peer Caddy sees, never a header a client
 	# could set. Everything else is refused before it reaches the upstream.
 	@denied not remote_ip ${allow.join(" ")}
 	respond @denied 403
+` : ""}${requireHeader ? `
+	# Only what the CDN sends: it adds this header to every request, and this
+	# host would be reached around the CDN otherwise.
+	@forged not header ${requireHeader.name} "${requireHeader.value}"
+	respond @forged 403
 ` : ""}${auth ? `
 	# The stage's login, asked for before anything reaches the upstream.
 	basic_auth {
 		${auth.user} ${auth.hash}
 	}
-` : ""}${paths ? `
+` : ""}${allowed.length ? `
 	# Only these paths answer. Everything else on this host is refused before
 	# it reaches the upstream.
-	@elsewhere not path ${paths.join(" ")}
+	@elsewhere not path ${allowed.join(" ")}
 	respond @elsewhere 404
-` : ""}${prefix ? `
+` : ""}`;
+	const proxy = proxyBlock(route);
+	const body = handlers?.length ? `${handlers.map((handler, index) => `
+	# Answered by another service: ${handler.name}.
+	@handler${index} path ${handler.prefixes.map((prefix) => `${prefix}*`).join(" ")}
+	handle @handler${index} {
+		reverse_proxy ${handler.upstreams.map(address).join(" ")}
+	}
+`).join("")}
+	handle {${proxy.replace(/\n/g, "\n	")}
+	}` : proxy;
+	return `https://${host} {${certificate}
+	# gkm's own header, which only a service of this stack may send: the auth
+	# server rate-limits by the client address it carries.
+	request_header -${CLIENT_IP_HEADER}
+${checks}${body}
+}`;
+}
+/** Where a route's requests go, when no handler took them. */
+function proxyBlock({ upstreams, prefix, streaming }) {
+	return prefix ? `
 	# A bucket, served at a host of its own: the bucket is a prefix on MinIO,
 	# which routes and signs on the Host header — so it is sent the upstream's.
 	reverse_proxy ${upstreams.map(address).join(" ")} {
@@ -716,17 +760,16 @@ ${allow ? `
 		# Never buffer: a streamed response — server-sent events, a Next.js
 		# RSC payload — reaches the client as each chunk is written.
 		flush_interval -1
-	}` : ""}`}
-}`);
-	return `${HEADER}${global ? `${global}\n\n` : ""}${blocks.join("\n\n")}\n`;
+	}` : ""}`;
 }
 const HEADER = `# Generated by gkm compose from the construct manifest — do not edit.
 #
 # One host per API and site, each in front of its own container, one per
-# file server in front of the stack's MinIO, one per worker SNS pushes to,
-# answering only those routes, and — when its logs are served publicly — one
-# for OpenObserve, to the addresses it allows. A site the stage puts behind a
-# password asks for its login first.
+# file server in front of the stack's MinIO — its processors' paths sent to
+# their own service — one per worker SNS pushes to and per processor unit a
+# CDN reaches, answering only those paths, and — when its logs are served
+# publicly — one for OpenObserve, to the addresses it allows. A site the
+# stage puts behind a password asks for its login first.
 `;
 //#endregion
 //#region src/compose/images.ts
@@ -1029,9 +1072,24 @@ function traefikDynamic(routes, options) {
 			middlewares[name(route, "prefix")] = { addPrefix: { prefix: route.prefix } };
 			chain.push(name(route, "prefix"));
 		}
-		const paths = route.paths ? ` && (${route.paths.map((path) => `Path(\`${path}\`)`).join(" || ")})` : "";
+		assertRouteRenderable(route);
+		const allowed = [...(route.paths ?? []).map((path) => `Path(\`${path}\`)`), ...(route.prefixes ?? []).map((prefix) => `PathPrefix(\`${prefix}\`)`)];
+		const paths = allowed.length ? ` && (${allowed.join(" || ")})` : "";
+		const header = route.requireHeader ? ` && Header(\`${route.requireHeader.name}\`, \`${route.requireHeader.value}\`)` : "";
+		for (const handler of route.handlers ?? []) {
+			const handlerName = name(route, handler.name);
+			routers[handlerName] = {
+				rule: `Host(\`${route.host}\`) && (${handler.prefixes.map((prefix) => `PathPrefix(\`${prefix}\`)`).join(" || ")})`,
+				priority: 1e4,
+				entryPoints: ["websecure"],
+				service: handlerName,
+				middlewares: [strip],
+				tls: tls.kind === "acme" ? { certResolver: ACME_RESOLVER } : {}
+			};
+			services[handlerName] = { loadBalancer: { servers: handler.upstreams.map((upstream) => ({ url: url(upstream) })) } };
+		}
 		routers[name(route)] = {
-			rule: `Host(\`${route.host}\`)${paths}`,
+			rule: `Host(\`${route.host}\`)${paths}${header}`,
 			entryPoints: ["websecure"],
 			service: name(route),
 			middlewares: chain,
@@ -1173,6 +1231,19 @@ const LOG_ROTATION = {
 		"max-file": "3"
 	}
 };
+/** A CDN serves the bucket, and the secret it sends the processors is not in the stage. */
+var ProcessorOriginSecretMissing = class extends GkmError {
+	fileServer;
+	key;
+	stage;
+	constructor(fileServer, key, stage) {
+		super(`'${fileServer}' has processors, and its bucket is not the stack's MinIO, so they are reached through the CDN in front of it — which sends ${key}, and stage '${stage}' has none. It is written by the deploy that creates the CDN (\`deploy.objects.${stage}\` on s3, cdn on): run gkm deploy --stage ${stage}.`);
+		this.fileServer = fileServer;
+		this.key = key;
+		this.stage = stage;
+		this.name = "ProcessorOriginSecretMissing";
+	}
+};
 /**
 * The stack with Caddy's files inline: its Caddyfile and, where the stage has
 * one, its own certificate — `configs` with their `content`, which compose
@@ -1381,7 +1452,13 @@ function composeStack(input) {
 		identity,
 		images: input.images
 	});
-	if (apps.length === 0 && workers.length === 0) throw new NothingToCompose(workspace.root);
+	const processors = stackProcessors(processorUnits(workspace, manifest), {
+		manifest,
+		stage,
+		identity,
+		images: input.images
+	});
+	if (apps.length === 0 && workers.length === 0 && processors.length === 0) throw new NothingToCompose(workspace.root);
 	const owners = /* @__PURE__ */ new Map();
 	for (const resource of plan.resources) {
 		owners.set(resource.envKey, resource);
@@ -1633,6 +1710,48 @@ function composeStack(input) {
 		};
 		for (const [key, value] of Object.entries(worker.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(worker.name, key);
 	}
+	for (const unit of processors) {
+		const served = fileServers.get(unit.id);
+		if (served) served.route = {
+			...served.route,
+			handlers: [{
+				name: unit.name,
+				prefixes: unit.prefixes,
+				upstreams: [{
+					service: unit.name,
+					port: unit.port
+				}]
+			}]
+		};
+		else if (!local && !input.buildOnly) {
+			if (!domain) throw new NoDomainForStage(stage);
+			const key = originSecretKey(unit.id);
+			const secret = custom[key];
+			if (!secret) throw new ProcessorOriginSecretMissing(unit.id, key, stage);
+			unit.origin = {
+				host: processorOriginHost(unit.id, domain),
+				secret
+			};
+		}
+		if (proxy === "traefik" && (served || unit.origin)) edgeServices.add(unit.name);
+		if (input.buildOnly) continue;
+		const keys = processorEnvKeys(manifest, unit.id, input.runnables) ?? /* @__PURE__ */ new Set();
+		unit.env = {
+			...scopeTelemetryEnv(valuesFor({
+				name: unit.name,
+				id: unit.id,
+				kind: "rest-api"
+			}, keys), {
+				uses: telemetryOf(manifest, unit.id) !== void 0,
+				serviceName: unit.name,
+				...telemetryValues ? { telemetry: telemetryValues } : {}
+			}),
+			NODE_ENV: "production",
+			PORT: String(unit.port),
+			STAGE: stage
+		};
+		for (const [key, value] of Object.entries(unit.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(unit.name, key);
+	}
 	if (storage && !input.buildOnly) {
 		const watched = watchedBuckets(manifest, input.subscribers ?? {});
 		for (const [bucket, workerId] of watched) {
@@ -1675,6 +1794,7 @@ function composeStack(input) {
 		infra,
 		apps,
 		workers,
+		processors,
 		credentials: credential.containers,
 		...storage ? { storage } : {},
 		...logs ? { logs } : {},
@@ -1710,6 +1830,21 @@ function composeStack(input) {
 			health: app.kind === "site" ? "/" : "/health"
 		})),
 		...[...fileServers.values()].map(({ route }) => route),
+		...processors.flatMap(({ name, port, prefixes, origin }) => origin ? [{
+			name,
+			host: origin.host,
+			upstreams: [{
+				service: name,
+				port
+			}],
+			streaming: false,
+			prefixes,
+			requireHeader: {
+				name: ORIGIN_VERIFY_HEADER,
+				value: origin.secret
+			},
+			health: "/health"
+		}] : []),
 		...workers.flatMap(({ name, port, push }) => push ? [{
 			name,
 			host: push.host,
@@ -1759,12 +1894,26 @@ function composeStack(input) {
 			cache: STACK_CACHE
 		});
 	}
+	for (const unit of processors) {
+		if (!unit.build) continue;
+		dockerfiles[unit.build.dockerfile] = processorDockerfile({
+			id: unit.id,
+			name: unit.name,
+			app: unit.host
+		}, workspace.apps[unit.host], {
+			layout,
+			workspaceRoot: workspace.root,
+			native: unit.native,
+			cache: STACK_CACHE
+		});
+	}
 	return {
 		project,
 		stage,
 		local,
 		apps,
 		workers,
+		processors,
 		mobileApps,
 		infra,
 		compose,
@@ -1904,6 +2053,25 @@ function assertHostsUnique(routes) {
 		claimed.set(host, name);
 	}
 }
+/** Each processor unit's image, and where it is built from. */
+function stackProcessors(units, options) {
+	return units.map((unit) => {
+		const server = options.manifest[unit.id];
+		const processors = server?.kind === "file-server" ? server.processors ?? [] : [];
+		return {
+			app: unit.name,
+			name: unit.name,
+			id: unit.id,
+			host: unit.app,
+			port: PROCESSOR_PORT,
+			prefixes: [...new Set(processors.map((p) => p.prefix))].sort(),
+			native: processorNative(options.manifest, unit.id),
+			ref: validateImageRef(imageRef(options.identity, unit.name, options.images.registry, options.images.tag)),
+			tag: options.images.tag,
+			...options.images.mode === "build" ? { build: { dockerfile: `${stackDir(options.stage)}/Dockerfile.${unit.name}` } } : {}
+		};
+	});
+}
 /** Each worker's image, and where it is built from. */
 function stackWorkers(units, options) {
 	return units.map((unit) => ({
@@ -1990,7 +2158,7 @@ function stackFile(options) {
 		} : {},
 		healthcheck: probe(app.port, app.kind === "site" ? "/" : "/health")
 	};
-	for (const worker of options.workers) services[worker.name] = {
+	for (const worker of [...options.workers, ...options.processors]) services[worker.name] = {
 		image: worker.ref,
 		...worker.build ? { build: composeBuildPaths({
 			composeDir: options.composeDir,
@@ -2011,7 +2179,11 @@ function stackFile(options) {
 		restart: "unless-stopped",
 		ports: [`${options.https}:443`, `${options.http}:80`],
 		volumes: ["caddy-data:/data", "caddy-config:/config"],
-		depends_on: Object.fromEntries([...apps.map((app) => app.name), ...options.workers.filter((w) => w.push).map((w) => w.name)].map((name) => [name, HEALTHY])),
+		depends_on: Object.fromEntries([
+			...apps.map((app) => app.name),
+			...options.workers.filter((w) => w.push).map((w) => w.name),
+			...options.processors.map((p) => p.name)
+		].map((name) => [name, HEALTHY])),
 		healthcheck: {
 			test: [
 				"CMD",
@@ -2632,7 +2804,11 @@ async function validateCompose(ctx, deps, options = {}) {
 	if (mode === "build") assertRedisClient(workspace, composed, manifest, runnables);
 	const pinned = (unpinned) => options.pin ? withPinnedImages(unpinned, options.pin.file, options.pin.digests) : unpinned;
 	const stack = pinned(composed);
-	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, [...stack.apps, ...stack.workers]);
+	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, [
+		...stack.apps,
+		...stack.workers,
+		...stack.processors
+	]);
 	if (stack.redis && !stack.local) ctx.secrets.mask(stack.redis.password);
 	if (stack.logs && (!stack.local || stack.logs.passwordFromSecrets)) {
 		ctx.secrets.mask(stack.logs.password);
@@ -2838,8 +3014,13 @@ async function stageSecrets(ctx, manifest) {
 function withPinnedImages(stack, file, digests) {
 	const apps = pinImages(file, digests, stack.apps);
 	const workers = pinImages(file, digests, stack.workers);
+	const processors = pinImages(file, digests, stack.processors);
 	const services = { ...stack.compose.services };
-	for (const image of [...apps, ...workers]) services[image.name] = {
+	for (const image of [
+		...apps,
+		...workers,
+		...processors
+	]) services[image.name] = {
 		...services[image.name],
 		image: image.ref
 	};
@@ -2847,6 +3028,7 @@ function withPinnedImages(stack, file, digests) {
 		...stack,
 		apps,
 		workers,
+		processors,
 		compose: {
 			...stack.compose,
 			services
@@ -2895,7 +3077,7 @@ async function planCompose(ctx, run) {
 			action: run.previous[app.name] ? "reuse" : "create"
 		});
 	}
-	for (const worker of run.stack.workers) {
+	for (const worker of [...run.stack.workers, ...run.stack.processors]) {
 		planned({
 			key: `image:${worker.name}`,
 			resourceType: "image",
@@ -3109,7 +3291,8 @@ async function migrateAndSeed(ctx, run, deps, port) {
 	const runs = await deps.migrate(options);
 	const seeds = await deps.seed({
 		...options,
-		stage: ctx.stage
+		stage: ctx.stage,
+		backends: backendsOf(workspace)
 	}).catch((error) => {
 		if (error instanceof SeedFailed) throw new DeploySeedsFailed(ctx.stage, error.construct, error.seed, error);
 		throw error;
@@ -3131,7 +3314,11 @@ async function migrateAndSeed(ctx, run, deps, port) {
 */
 async function buildCompose(ctx, run, deps) {
 	const { stack, ref } = run;
-	const images = [...stack.apps, ...stack.workers];
+	const images = [
+		...stack.apps,
+		...stack.workers,
+		...stack.processors
+	];
 	const apps = images.map((image) => image.app);
 	if (run.push) {
 		run.files = await writeStack(ctx.cwd, run.dir, stack);
@@ -3203,7 +3390,7 @@ async function releaseCompose(ctx, run, deps) {
 			url: app.url
 		});
 	}
-	for (const worker of stack.workers) applied(ctx, run, {
+	for (const worker of [...stack.workers, ...stack.processors]) applied(ctx, run, {
 		key: `service:${worker.name}`,
 		resourceType: "service",
 		action: "ensure",
@@ -3213,6 +3400,7 @@ async function releaseCompose(ctx, run, deps) {
 	ctx.logger.info(`\n✅ ${stack.project} is running:`);
 	for (const app of stack.apps) ctx.logger.info(`   ${app.name.padEnd(12)} ${app.url}${app.auth ? `  🔒 user: ${app.auth.user}, password: gkm secrets:show --stage ${ctx.stage} --reveal → ${app.auth.key}` : ""}`);
 	for (const worker of stack.workers) ctx.logger.info(`   ${worker.name.padEnd(12)} worker ${worker.id}`);
+	for (const unit of stack.processors) ctx.logger.info(`   ${unit.name.padEnd(12)} processors of ${unit.id}`);
 	if (stack.local) ctx.logger.info(`\n🔐 Certificates are from Caddy's local CA: NODE_EXTRA_CA_CERTS=${join(stackDir(ctx.stage), "caddy-root.crt")}`);
 }
 /**
@@ -3223,7 +3411,11 @@ async function releaseCompose(ctx, run, deps) {
 async function recordImages(ctx, run) {
 	const journal = await DeployJournal.open(ctx.state, ctx.stage, () => createComposeState(ctx.stage));
 	const by = currentActor();
-	for (const app of [...run.stack.apps, ...run.stack.workers]) {
+	for (const app of [
+		...run.stack.apps,
+		...run.stack.workers,
+		...run.stack.processors
+	]) {
 		const image = run.images[app.app] ?? {
 			ref: app.ref,
 			tag: app.tag
@@ -3252,7 +3444,7 @@ async function verifyCompose(ctx, run, deps) {
 		ca,
 		edge
 	})));
-	results.push(...await Promise.all(stack.workers.map((worker) => checkContainer(ctx, run, deps, worker.name))));
+	results.push(...await Promise.all([...stack.workers, ...stack.processors].map((worker) => checkContainer(ctx, run, deps, worker.name))));
 	if (stack.logs) results.push(await checkContainer(ctx, run, deps, LOGS_SERVICE));
 	const down = results.filter((result) => !result.healthy).map(({ app, url, last }) => ({
 		app,
@@ -3417,7 +3609,7 @@ function composeResult(ctx, run) {
 			...image?.digest ? { digest: image.digest } : {},
 			url: app.url
 		};
-	}), ...run.stack.workers.map((worker) => {
+	}), ...[...run.stack.workers, ...run.stack.processors].map((worker) => {
 		const image = run.images[worker.name];
 		return {
 			appName: worker.name,
@@ -3491,7 +3683,11 @@ async function writeStack(root, dir, stack) {
 		recursive: true,
 		force: true
 	});
-	for (const app of [...stack.apps, ...stack.workers]) if (app.env) await write(join(dir, `${app.name}.env`), envFile(app.env), 384);
+	for (const app of [
+		...stack.apps,
+		...stack.workers,
+		...stack.processors
+	]) if (app.env) await write(join(dir, `${app.name}.env`), envFile(app.env), 384);
 	if (stack.logs && stack.compose.services["openobserve"]?.env_file) await write(join(dir, `${LOGS_SERVICE}.env`), envFile(stack.logs.env), 384);
 	if (stack.redis && stack.compose.services["redis"]?.env_file) await write(join(dir, `${REDIS_SERVICE}.env`), envFile(stack.redis.env), 384);
 	if (stack.backups) {
@@ -3529,6 +3725,7 @@ function printPlan(ctx, run) {
 	if (run.server) ctx.logger.info(`   → ${sshTarget(run.server)} (docker over ssh)`);
 	for (const app of stack.apps) ctx.logger.info(`   ${app.name.padEnd(12)} ${app.url.padEnd(40)} ${mode} ${app.ref}`);
 	for (const worker of stack.workers) ctx.logger.info(`   ${worker.name.padEnd(12)} ${`worker ${worker.id} (no route)`.padEnd(40)} ${mode} ${worker.ref}`);
+	for (const unit of stack.processors) ctx.logger.info(`   ${unit.name.padEnd(12)} ${`processors of ${unit.id}`.padEnd(40)} ${mode} ${unit.ref}`);
 	if (stack.infra.length > 0) ctx.logger.info(`   infrastructure: ${stack.infra.join(", ")}`);
 	if (stack.backups) ctx.logger.info(`   ${BACKUPS_SERVICE.padEnd(12)} ${stack.backups.databases.map((d) => d.file).join(", ")} — ${stack.backups.backups.describe}, to ${stack.backups.prefix}/`);
 	ctx.logger.info(`\n📝 Wrote ${files.length} file(s) under ${stackDir(stack.stage)}/`);
@@ -3607,4 +3804,4 @@ function composeTarget(options = {}) {
 //#endregion
 export { dockerCompose as C, sshTarget as S, parseDigests as _, edgePorts as a, dockerHost as b, edgeRef as c, composeStack as d, derivedCredentials as f, edgeAlias as g, EDGE_PROJECT as h, ComposePushNeedsBuild as i, removeEdgeRoutes as l, stackPlan as m, compose_exports as n, stackOverrideFile as o, stackDir as p, ComposePinNeedsPull as r, deployedStackSecrets as s, composeTarget as t, composeProject as u, pinnedRef as v, projectNetwork as w, sshAccess as x, composeServer as y };
 
-//# sourceMappingURL=compose-DJvvmF3X.mjs.map
+//# sourceMappingURL=compose-CvHIjMDd.mjs.map