@geekmidas/cli 10.0.0-alpha.72 → 10.0.0-alpha.73

package/dist/{cli-MMgBrHx7.cjs → cli-DJVL2sL9.cjs}

@@ -1,9 +1,9 @@
 const require_credentials = require("./credentials-BVs7mrtw.cjs");
-const require_state = require("./state-CCuTJNRH.cjs");
-const require_deploy = require("./deploy-CZE0m6jd.cjs");
+const require_state = require("./state-DMjFPOhf.cjs");
+const require_deploy = require("./deploy-BitZLdnY.cjs");
 const require_index = require("./index.cjs");
 const require_provider = require("./provider-C9_-45d5.cjs");
-const require_terminal = require("./terminal-CFO3xWoF.cjs");
+const require_terminal = require("./terminal-BL5E0xbR.cjs");
 //#region src/deploy/cli.ts
 /**
 * `gkm deploy`: the terminal around `deploy()`. CLI layer only.
@@ -73,4 +73,4 @@ async function deployCli(options, streams = { stdout: process.stdout }) {
 //#endregion
 exports.deployCli = deployCli;
 
-//# sourceMappingURL=cli-MMgBrHx7.cjs.map
+//# sourceMappingURL=cli-DJVL2sL9.cjs.map

package/dist/{cli-MMgBrHx7.cjs.map → cli-DJVL2sL9.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"cli-MMgBrHx7.cjs","names":["targetForProvider","formatError","parseDevServices","deploy","storedCredentials","terminalCredentials"],"sources":["../src/deploy/cli.ts"],"sourcesContent":["/**\n * `gkm deploy`: the terminal around `deploy()`. CLI layer only.\n *\n * Everything that belongs to a person at a terminal lives here and nowhere\n * below it: prompting for a missing login (and storing it), printing progress,\n * and turning the outcome into an exit code. The deploy itself is the same\n * `deploy()` a host calls.\n */\n\nimport { formatError } from '../debug';\nimport { targetForProvider } from '../target/provider';\nimport { storedCredentials } from './credentials';\nimport { deploy } from './deploy';\nimport { type DevService, parseDevServices } from './devServices';\nimport { terminalCredentials } from './terminal';\n\nexport interface DeployCliOptions {\n\t/** The project directory: `--cwd`, else where the command was run. */\n\tcwd: string;\n\t/** `--target`: where to deploy. Defaults to `deploy.default`. */\n\ttarget?: string;\n\t/** `--provider`, deprecated: `dokploy` means `--target dokploy`. */\n\tprovider?: string;\n\tstage: string;\n\ttag?: string;\n\t/**\n\t * Print each event as one JSON object per line on stdout, instead of the\n\t * progress lines. Nothing prompts: a missing credential fails the run.\n\t */\n\tjson?: boolean;\n\t/** Plan only: create, change, build and push nothing. */\n\tdryRun?: boolean;\n\t/** On a failed release, roll back every app, not only the failed ones. */\n\tatomic?: boolean;\n\t/** `--allow-dev-services minio,mailpit`, as typed. */\n\tallowDevServices?: string;\n}\n\n/** Where the command writes. The process's own streams, outside tests. */\nexport interface DeployCliStreams {\n\tstdout: Pick<NodeJS.WriteStream, 'write'>;\n}\n\n/**\n * Run `gkm deploy` and resolve with its exit code: 0 when the run finished,\n * 1 when anything stopped it.\n */\nexport async function deployCli(\n\toptions: DeployCliOptions,\n\tstreams: DeployCliStreams = { stdout: process.stdout },\n): Promise<number> {\n\tlet target = options.target;\n\tif (options.provider !== undefined && target === undefined) {\n\t\ttry {\n\t\t\t// On stderr, so a `--json` run's stdout still carries only events.\n\t\t\ttarget = targetForProvider(options.provider, (message) =>\n\t\t\t\tconsole.warn(message),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tconsole.error(formatError(error));\n\t\t\treturn 1;\n\t\t}\n\t}\n\n\tlet allowDevServices: DevService[];\n\ttry {\n\t\tallowDevServices = parseDevServices(options.allowDevServices);\n\t} catch (error) {\n\t\tconsole.error(formatError(error));\n\t\treturn 1;\n\t}\n\n\tconst input = {\n\t\tcwd: options.cwd,\n\t\tstage: options.stage,\n\t\t...(target ? { target } : {}),\n\t\t...(options.tag ? { tag: options.tag } : {}),\n\t\t...(options.dryRun ? { dryRun: true } : {}),\n\t\t...(options.atomic ? { atomic: true } : {}),\n\t\t...(allowDevServices.length > 0 ? { allowDevServices } : {}),\n\t};\n\n\tif (options.json) {\n\t\t// stdout carries the events and nothing else: docker's own output goes\n\t\t// to stderr, and nobody is asked anything — a prompt would be written\n\t\t// into the stream a program is parsing.\n\t\tconst run = deploy({\n\t\t\t...input,\n\t\t\tcredentials: storedCredentials(),\n\t\t\tchildOutput: 'stderr',\n\t\t});\n\t\tfor await (const event of run) {\n\t\t\tstreams.stdout.write(`${JSON.stringify(event)}\\n`);\n\t\t}\n\t\treturn run.result.then(\n\t\t\t() => 0,\n\t\t\t(error) => {\n\t\t\t\tconsole.error(formatError(error));\n\t\t\t\treturn 1;\n\t\t\t},\n\t\t);\n\t}\n\n\t// The lines arrive as they are written, rather than as events read back a\n\t// tick later, so they interleave with a prompt exactly as they always did.\n\tconst run = deploy({\n\t\t...input,\n\t\tcredentials: terminalCredentials(storedCredentials()),\n\t\tlogger: {\n\t\t\tinfo: (message) => console.log(message),\n\t\t\twarn: (message) => console.warn(message),\n\t\t\terror: (message) => console.error(message),\n\t\t},\n\t});\n\n\ttry {\n\t\tawait run.result;\n\t\treturn 0;\n\t} catch (error) {\n\t\tconsole.error(formatError(error));\n\t\treturn 1;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA+CA,eAAsB,UACrB,SACA,UAA4B,EAAE,QAAQ,QAAQ,OAAO,GACnC;CAClB,IAAI,SAAS,QAAQ;CACrB,IAAI,QAAQ,aAAa,KAAA,KAAa,WAAW,KAAA,GAChD,IAAI;EAEH,SAASA,iBAAAA,kBAAkB,QAAQ,WAAW,YAC7C,QAAQ,KAAK,OAAO,CACrB;CACD,SAAS,OAAO;EACf,QAAQ,MAAMC,cAAAA,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;CAGD,IAAI;CACJ,IAAI;EACH,mBAAmBC,cAAAA,iBAAiB,QAAQ,gBAAgB;CAC7D,SAAS,OAAO;EACf,QAAQ,MAAMD,cAAAA,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;CAEA,MAAM,QAAQ;EACb,KAAK,QAAQ;EACb,OAAO,QAAQ;EACf,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC3B,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;EAC1C,GAAI,QAAQ,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;EACzC,GAAI,QAAQ,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;EACzC,GAAI,iBAAiB,SAAS,IAAI,EAAE,iBAAiB,IAAI,CAAC;CAC3D;CAEA,IAAI,QAAQ,MAAM;EAIjB,MAAM,MAAME,eAAAA,OAAO;GAClB,GAAG;GACH,aAAaC,oBAAAA,kBAAkB;GAC/B,aAAa;EACd,CAAC;EACD,WAAW,MAAM,SAAS,KACzB,QAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,KAAK,EAAE,GAAG;EAElD,OAAO,IAAI,OAAO,WACX,IACL,UAAU;GACV,QAAQ,MAAMH,cAAAA,YAAY,KAAK,CAAC;GAChC,OAAO;EACR,CACD;CACD;CAIA,MAAM,MAAME,eAAAA,OAAO;EAClB,GAAG;EACH,aAAaE,iBAAAA,oBAAoBD,oBAAAA,kBAAkB,CAAC;EACpD,QAAQ;GACP,OAAO,YAAY,QAAQ,IAAI,OAAO;GACtC,OAAO,YAAY,QAAQ,KAAK,OAAO;GACvC,QAAQ,YAAY,QAAQ,MAAM,OAAO;EAC1C;CACD,CAAC;CAED,IAAI;EACH,MAAM,IAAI;EACV,OAAO;CACR,SAAS,OAAO;EACf,QAAQ,MAAMH,cAAAA,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;AACD"}
+{"version":3,"file":"cli-DJVL2sL9.cjs","names":["targetForProvider","formatError","parseDevServices","deploy","storedCredentials","terminalCredentials"],"sources":["../src/deploy/cli.ts"],"sourcesContent":["/**\n * `gkm deploy`: the terminal around `deploy()`. CLI layer only.\n *\n * Everything that belongs to a person at a terminal lives here and nowhere\n * below it: prompting for a missing login (and storing it), printing progress,\n * and turning the outcome into an exit code. The deploy itself is the same\n * `deploy()` a host calls.\n */\n\nimport { formatError } from '../debug';\nimport { targetForProvider } from '../target/provider';\nimport { storedCredentials } from './credentials';\nimport { deploy } from './deploy';\nimport { type DevService, parseDevServices } from './devServices';\nimport { terminalCredentials } from './terminal';\n\nexport interface DeployCliOptions {\n\t/** The project directory: `--cwd`, else where the command was run. */\n\tcwd: string;\n\t/** `--target`: where to deploy. Defaults to `deploy.default`. */\n\ttarget?: string;\n\t/** `--provider`, deprecated: `dokploy` means `--target dokploy`. */\n\tprovider?: string;\n\tstage: string;\n\ttag?: string;\n\t/**\n\t * Print each event as one JSON object per line on stdout, instead of the\n\t * progress lines. Nothing prompts: a missing credential fails the run.\n\t */\n\tjson?: boolean;\n\t/** Plan only: create, change, build and push nothing. */\n\tdryRun?: boolean;\n\t/** On a failed release, roll back every app, not only the failed ones. */\n\tatomic?: boolean;\n\t/** `--allow-dev-services minio,mailpit`, as typed. */\n\tallowDevServices?: string;\n}\n\n/** Where the command writes. The process's own streams, outside tests. */\nexport interface DeployCliStreams {\n\tstdout: Pick<NodeJS.WriteStream, 'write'>;\n}\n\n/**\n * Run `gkm deploy` and resolve with its exit code: 0 when the run finished,\n * 1 when anything stopped it.\n */\nexport async function deployCli(\n\toptions: DeployCliOptions,\n\tstreams: DeployCliStreams = { stdout: process.stdout },\n): Promise<number> {\n\tlet target = options.target;\n\tif (options.provider !== undefined && target === undefined) {\n\t\ttry {\n\t\t\t// On stderr, so a `--json` run's stdout still carries only events.\n\t\t\ttarget = targetForProvider(options.provider, (message) =>\n\t\t\t\tconsole.warn(message),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tconsole.error(formatError(error));\n\t\t\treturn 1;\n\t\t}\n\t}\n\n\tlet allowDevServices: DevService[];\n\ttry {\n\t\tallowDevServices = parseDevServices(options.allowDevServices);\n\t} catch (error) {\n\t\tconsole.error(formatError(error));\n\t\treturn 1;\n\t}\n\n\tconst input = {\n\t\tcwd: options.cwd,\n\t\tstage: options.stage,\n\t\t...(target ? { target } : {}),\n\t\t...(options.tag ? { tag: options.tag } : {}),\n\t\t...(options.dryRun ? { dryRun: true } : {}),\n\t\t...(options.atomic ? { atomic: true } : {}),\n\t\t...(allowDevServices.length > 0 ? { allowDevServices } : {}),\n\t};\n\n\tif (options.json) {\n\t\t// stdout carries the events and nothing else: docker's own output goes\n\t\t// to stderr, and nobody is asked anything — a prompt would be written\n\t\t// into the stream a program is parsing.\n\t\tconst run = deploy({\n\t\t\t...input,\n\t\t\tcredentials: storedCredentials(),\n\t\t\tchildOutput: 'stderr',\n\t\t});\n\t\tfor await (const event of run) {\n\t\t\tstreams.stdout.write(`${JSON.stringify(event)}\\n`);\n\t\t}\n\t\treturn run.result.then(\n\t\t\t() => 0,\n\t\t\t(error) => {\n\t\t\t\tconsole.error(formatError(error));\n\t\t\t\treturn 1;\n\t\t\t},\n\t\t);\n\t}\n\n\t// The lines arrive as they are written, rather than as events read back a\n\t// tick later, so they interleave with a prompt exactly as they always did.\n\tconst run = deploy({\n\t\t...input,\n\t\tcredentials: terminalCredentials(storedCredentials()),\n\t\tlogger: {\n\t\t\tinfo: (message) => console.log(message),\n\t\t\twarn: (message) => console.warn(message),\n\t\t\terror: (message) => console.error(message),\n\t\t},\n\t});\n\n\ttry {\n\t\tawait run.result;\n\t\treturn 0;\n\t} catch (error) {\n\t\tconsole.error(formatError(error));\n\t\treturn 1;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA+CA,eAAsB,UACrB,SACA,UAA4B,EAAE,QAAQ,QAAQ,OAAO,GACnC;CAClB,IAAI,SAAS,QAAQ;CACrB,IAAI,QAAQ,aAAa,KAAA,KAAa,WAAW,KAAA,GAChD,IAAI;EAEH,SAASA,iBAAAA,kBAAkB,QAAQ,WAAW,YAC7C,QAAQ,KAAK,OAAO,CACrB;CACD,SAAS,OAAO;EACf,QAAQ,MAAMC,cAAAA,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;CAGD,IAAI;CACJ,IAAI;EACH,mBAAmBC,cAAAA,iBAAiB,QAAQ,gBAAgB;CAC7D,SAAS,OAAO;EACf,QAAQ,MAAMD,cAAAA,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;CAEA,MAAM,QAAQ;EACb,KAAK,QAAQ;EACb,OAAO,QAAQ;EACf,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC3B,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;EAC1C,GAAI,QAAQ,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;EACzC,GAAI,QAAQ,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;EACzC,GAAI,iBAAiB,SAAS,IAAI,EAAE,iBAAiB,IAAI,CAAC;CAC3D;CAEA,IAAI,QAAQ,MAAM;EAIjB,MAAM,MAAME,eAAAA,OAAO;GAClB,GAAG;GACH,aAAaC,oBAAAA,kBAAkB;GAC/B,aAAa;EACd,CAAC;EACD,WAAW,MAAM,SAAS,KACzB,QAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,KAAK,EAAE,GAAG;EAElD,OAAO,IAAI,OAAO,WACX,IACL,UAAU;GACV,QAAQ,MAAMH,cAAAA,YAAY,KAAK,CAAC;GAChC,OAAO;EACR,CACD;CACD;CAIA,MAAM,MAAME,eAAAA,OAAO;EAClB,GAAG;EACH,aAAaE,iBAAAA,oBAAoBD,oBAAAA,kBAAkB,CAAC;EACpD,QAAQ;GACP,OAAO,YAAY,QAAQ,IAAI,OAAO;GACtC,OAAO,YAAY,QAAQ,KAAK,OAAO;GACvC,QAAQ,YAAY,QAAQ,MAAM,OAAO;EAC1C;CACD,CAAC;CAED,IAAI;EACH,MAAM,IAAI;EACV,OAAO;CACR,SAAS,OAAO;EACf,QAAQ,MAAMH,cAAAA,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;AACD"}

package/dist/{compose-T3hnnjKZ.mjs → compose-9II-0IsK.mjs}

@@ -1,13 +1,13 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { a as runOutput, i as run } from "./run-BJLIerMM.mjs";
-import { r as discover } from "./discover-Buwf1z4P.mjs";
+import { r as discover } from "./discover-BPelzeGW.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
 import { M as LOGS_PORT, N as resolveLogs } from "./workspace-C7NqCsQF.mjs";
 import { t as defineTarget } from "./define-DR8xGYfL.mjs";
-import { $ as applyPostgres, B as encryptSecrets, C as isMainFrontendApp, Ct as DEFAULT_IMAGES, Dt as primaryPortKey, E as otelEnv, Et as portKeys, G as constructGlobs, Kt as imageRef, L as reportDevServices, M as assertExternalServices, N as devServicesUsed, Q as applyPolicies, S as NoDomainForStage, T as isOtlpDestination, Z as applyBuckets, Zt as initStageSecrets, a as recordRelease, at as bucketClient, b as ensureDockerignore, ct as networkEnv, dt as planFor, et as bucketPolicies, g as credentialsFileContent, gt as TURBO_VERSION, h as credentialsBuildArg, ht as imageLayout, it as composeFor, lt as envFor, m as withGeneratedSecrets, mt as composeBuildPaths, nt as postgresStatements, ot as pgClient, p as DeployJournal, pt as hostFor, st as appEnvKeys, t as createEmptyState, ut as localRolePassword, v as appDockerfile, vt as findBuildRoot, w as resolveHost, x as validateImageRef, z as suppliedOnly } from "./state-BJFherj1.mjs";
-import { n as DEFAULT_CACHE, r as DEFAULT_EVENTS } from "./fakes-C9RiT6XG.mjs";
+import { $ as constructGlobs, C as validateImageRef, Ct as composeBuildPaths, D as isOtlpDestination, E as resolveHost, Et as WORKER_PORT, F as devServicesUsed, H as workerUnits, It as portKeys, Lt as primaryPortKey, Nt as DEFAULT_IMAGES, O as otelEnv, Ot as findBuildRoot, P as assertExternalServices, St as hostFor, T as isMainFrontendApp, Tt as TURBO_VERSION, U as encryptSecrets, V as suppliedOnly, _t as workerEnvKeys, a as recordRelease, at as applyBuckets, b as ensureDockerignore, bt as planFor, ct as bucketPolicies, ft as composeFor, g as credentialsFileContent, gt as networkEnv, h as credentialsBuildArg, ht as appEnvKeys, m as withGeneratedSecrets, mt as pgClient, nn as imageRef, ot as applyPolicies, p as DeployJournal, pt as bucketClient, sn as initStageSecrets, st as applyPostgres, t as createEmptyState, ut as postgresStatements, v as appDockerfile, vt as envFor, w as NoDomainForStage, wt as imageLayout, x as workerDockerfile, yt as localRolePassword, z as reportDevServices } from "./state-DtS2HEfi.mjs";
+import { i as DEFAULT_EVENTS, r as DEFAULT_CACHE } from "./SubscriberGenerator-DZk_pKDh.mjs";
 import { u as migrateDatabases } from "./databases-hUHTuwhx.mjs";
-import { n as assertStageCredentials } from "./credentialSchemas-BmYxnEz_.mjs";
+import { n as assertStageCredentials } from "./credentialSchemas-BJqRJNK4.mjs";
 import { dirname, join } from "node:path";
 import { existsSync } from "node:fs";
 import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
@@ -590,7 +590,7 @@ var StageSeedMissing = class extends Error {
 var NothingToCompose = class extends Error {
 	root;
 	constructor(root) {
-		super(`${root} declares no RestApi and no site, so a stack would run nothing. Workers and mobile apps are not run by gkm compose yet.`);
+		super(`${root} declares no RestApi, no site and no Worker with work to do, so a stack would run nothing. Mobile apps ship through their own toolchain.`);
 		this.root = root;
 		this.name = "NothingToCompose";
 	}
@@ -657,7 +657,12 @@ function composeStack(input) {
 		identity,
 		images: input.images
 	});
-	if (apps.length === 0) throw new NothingToCompose(workspace.root);
+	const workers = stackWorkers(workerUnits(workspace, manifest, input.background ?? {}), {
+		stage,
+		identity,
+		images: input.images
+	});
+	if (apps.length === 0 && workers.length === 0) throw new NothingToCompose(workspace.root);
 	const owners = /* @__PURE__ */ new Map();
 	for (const resource of plan.resources) {
 		owners.set(resource.envKey, resource);
@@ -672,6 +677,7 @@ function composeStack(input) {
 		const site = manifest[app.id];
 		reads.set(app.name, site?.kind === "site" ? Object.values(publicEnvFor(site, manifest)) : [...appEnvKeys(manifest, app.name, input.runnables) ?? []]);
 	}
+	for (const worker of workers) reads.set(worker.name, [...workerEnvKeys(manifest, worker.id, input.runnables) ?? []]);
 	const domain = workspace.deploy?.domains?.[stage];
 	const logsConfig = resolveLogs(workspace.deploy?.compose?.logs);
 	const logs = logsConfig ? stackLogs({
@@ -762,6 +768,22 @@ function composeStack(input) {
 		if (app.kind === "rest-api" && surface && surface !== app.id) return inside[key];
 		return outside[key];
 	};
+	/** Each key one backend process reads, resolved for this stage. */
+	const valuesFor = (app, keys) => {
+		const values = {};
+		for (const key of [...keys].sort()) {
+			const owner = owners.get(key) ?? storageOwner(key, plan);
+			if (!local && owner?.kind === "email" && key.endsWith("_INBOX_URL")) continue;
+			if (STORAGE_KEYS.includes(key)) {
+				const value = custom[key] ?? storageValue(key, storage);
+				if (value !== void 0) values[key] = value;
+				continue;
+			}
+			const value = valueFor(app, key, owner);
+			if (value !== void 0) values[key] = value;
+		}
+		return values;
+	};
 	for (const app of apps) {
 		if (app.kind === "site") {
 			const site = manifest[app.id];
@@ -775,18 +797,7 @@ function composeStack(input) {
 			continue;
 		}
 		const keys = appEnvKeys(manifest, app.name, input.runnables) ?? /* @__PURE__ */ new Set();
-		const values = {};
-		for (const key of [...keys].sort()) {
-			const owner = owners.get(key) ?? storageOwner(key, plan);
-			if (!local && owner?.kind === "email" && key.endsWith("_INBOX_URL")) continue;
-			if (STORAGE_KEYS.includes(key)) {
-				const value = custom[key] ?? storageValue(key, storage);
-				if (value !== void 0) values[key] = value;
-				continue;
-			}
-			const value = valueFor(app, key, owner);
-			if (value !== void 0) values[key] = value;
-		}
+		const values = valuesFor(app, keys);
 		const trusted = provideKey(app.id, "trustedOrigins");
 		if (keys.has(trusted)) {
 			const internal = (byId.get(app.id)?.callers ?? []).map((caller) => appById.get(caller)).filter((caller) => caller?.kind === "rest-api").map((caller) => `http://${caller.name}:${caller.port}`);
@@ -805,12 +816,31 @@ function composeStack(input) {
 		};
 		for (const [key, value] of Object.entries(app.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(app.name, key);
 	}
+	for (const worker of workers) {
+		const keys = workerEnvKeys(manifest, worker.id, input.runnables) ?? /* @__PURE__ */ new Set();
+		worker.env = {
+			...valuesFor({
+				name: worker.name,
+				id: worker.id,
+				kind: "rest-api"
+			}, keys),
+			...otelEnv({
+				...custom,
+				...logs?.appEnv
+			}, worker.name),
+			NODE_ENV: "production",
+			PORT: String(worker.port),
+			STAGE: stage
+		};
+		for (const [key, value] of Object.entries(worker.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(worker.name, key);
+	}
 	const layout = input.layout ?? defaultLayout(workspace.root);
 	const compose = stackFile({
 		project,
 		plan,
 		infra,
 		apps,
+		workers,
 		master: credential.master,
 		...storage ? { storage } : {},
 		...logs ? { logs } : {},
@@ -841,11 +871,23 @@ function composeStack(input) {
 			manifest
 		});
 	}
+	for (const worker of workers) {
+		if (!worker.build) continue;
+		dockerfiles[worker.build.dockerfile] = workerDockerfile({
+			id: worker.id,
+			name: worker.name,
+			app: worker.host
+		}, workspace.apps[worker.host], {
+			layout,
+			workspaceRoot: workspace.root
+		});
+	}
 	return {
 		project,
 		stage,
 		local,
 		apps,
+		workers,
 		infra,
 		compose,
 		caddyfile,
@@ -930,6 +972,19 @@ function stackApps(workspace, manifest, plan, options) {
 	}
 	return apps.sort((a, b) => a.name.localeCompare(b.name));
 }
+/** Each worker's image, and where it is built from. */
+function stackWorkers(units, options) {
+	return units.map((unit) => ({
+		app: unit.name,
+		name: unit.name,
+		id: unit.id,
+		host: unit.app,
+		port: WORKER_PORT,
+		ref: validateImageRef(imageRef(options.identity, unit.name, options.images.registry, options.images.tag)),
+		tag: options.images.tag,
+		...options.images.mode === "build" ? { build: { dockerfile: `${stackDir(options.stage)}/Dockerfile.${unit.name}` } } : {}
+	}));
+}
 /**
 * The host an app answers on for a stage: the `gkm dev` edge's
 * `*.localhost` names for the local stage, and the stage's domain — by the
@@ -1003,6 +1058,22 @@ function stackFile(options) {
 		} : {},
 		healthcheck: probe(app.port, app.kind === "site" ? "/" : "/health")
 	};
+	for (const worker of options.workers) services[worker.name] = {
+		image: worker.ref,
+		...worker.build ? { build: composeBuildPaths({
+			composeDir: options.composeDir,
+			buildRoot: options.buildRoot,
+			workspaceRoot: options.workspaceRoot,
+			dockerfile: worker.build.dockerfile
+		}) } : {},
+		restart: "unless-stopped",
+		env_file: [{
+			path: `./${worker.name}.env`,
+			format: "raw"
+		}],
+		...infra.length ? { depends_on: Object.fromEntries(infra.map((name) => [name, HEALTHY])) } : {},
+		healthcheck: probe(worker.port, "/health")
+	};
 	services.caddy = {
 		image: DEFAULT_IMAGES.caddy,
 		restart: "unless-stopped",
@@ -1098,9 +1169,38 @@ function withBuildCredentials(stack, credentials) {
 			}
 		};
 	});
+	const workers = stack.workers.map((worker) => {
+		const own = credentials[worker.name];
+		const service = services[worker.name];
+		if (!own || !service?.build) return worker;
+		const [key, value] = own.buildArg.split("=");
+		services[worker.name] = {
+			...service,
+			build: {
+				...service.build,
+				args: {
+					...service.build.args,
+					[key]: value
+				},
+				secrets: [{
+					source: credentialsSecret(worker.name),
+					target: "gkm_credentials"
+				}]
+			}
+		};
+		secrets[credentialsSecret(worker.name)] = { file: `./${credentialsFile(worker.name)}` };
+		return {
+			...worker,
+			env: {
+				...worker.env,
+				GKM_MASTER_KEY: own.masterKey
+			}
+		};
+	});
 	return {
 		...stack,
 		apps,
+		workers,
 		compose: {
 			...stack.compose,
 			services,
@@ -1286,10 +1386,12 @@ async function validateCompose(ctx, deps, forced) {
 	const root = workspace.root;
 	const mode = forced ?? (ctx.tagGiven ? "pull" : "build");
 	const runnables = {};
+	const background = {};
 	const manifest = await discover({
 		patterns: constructGlobs(workspace),
 		cwd: root,
-		runnables
+		runnables,
+		background
 	});
 	const { secrets, generated } = await stageSecrets(ctx, manifest);
 	await assertStageCredentials({
@@ -1305,6 +1407,7 @@ async function validateCompose(ctx, deps, forced) {
 		workspace,
 		manifest,
 		runnables,
+		background,
 		stage,
 		identity,
 		images: {
@@ -1319,24 +1422,42 @@ async function validateCompose(ctx, deps, forced) {
 	});
 	reportDevServices(ctx, composed.devServices);
 	const credentials = {};
-	if (mode === "build") for (const app of composed.apps) {
-		if (app.kind !== "rest-api" || !app.env || !app.build) continue;
-		const { encrypted, iv, masterKey } = encryptSecrets(app.env);
-		credentials[app.name] = {
-			encrypted,
-			iv
-		};
-		ctx.secrets.mask(masterKey);
-		masterKeys[app.name] = {
-			masterKey,
-			buildArg: credentialsBuildArg({
+	if (mode === "build") {
+		for (const app of composed.apps) {
+			if (app.kind !== "rest-api" || !app.env || !app.build) continue;
+			const { encrypted, iv, masterKey } = encryptSecrets(app.env);
+			credentials[app.name] = {
 				encrypted,
 				iv
-			})
-		};
+			};
+			ctx.secrets.mask(masterKey);
+			masterKeys[app.name] = {
+				masterKey,
+				buildArg: credentialsBuildArg({
+					encrypted,
+					iv
+				})
+			};
+		}
+		for (const worker of composed.workers) {
+			if (!worker.env || !worker.build) continue;
+			const { encrypted, iv, masterKey } = encryptSecrets(worker.env);
+			credentials[worker.name] = {
+				encrypted,
+				iv
+			};
+			ctx.secrets.mask(masterKey);
+			masterKeys[worker.name] = {
+				masterKey,
+				buildArg: credentialsBuildArg({
+					encrypted,
+					iv
+				})
+			};
+		}
 	}
 	const stack = withBuildCredentials(composed, masterKeys);
-	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, stack.apps);
+	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, [...stack.apps, ...stack.workers]);
 	if (stack.logs && (!stack.local || stack.logs.passwordFromSecrets)) {
 		ctx.secrets.mask(stack.logs.password);
 		ctx.secrets.mask(stack.logs.appEnv.OTEL_EXPORTER_OTLP_HEADERS);
@@ -1434,6 +1555,19 @@ async function planCompose(ctx, run) {
 			action: run.previous[app.name] ? "reuse" : "create"
 		});
 	}
+	for (const worker of run.stack.workers) {
+		planned({
+			key: `image:${worker.name}`,
+			resourceType: "image",
+			action: run.mode === "build" ? "build" : "reuse",
+			id: worker.ref
+		});
+		planned({
+			key: `service:${worker.name}`,
+			resourceType: "service",
+			action: run.previous[worker.name] ? "reuse" : "create"
+		});
+	}
 	planned({
 		key: "service:caddy",
 		resourceType: "service",
@@ -1517,7 +1651,8 @@ async function prepareDatabases(ctx, run, deps) {
 */
 async function buildCompose(ctx, run, deps) {
 	const { stack, ref } = run;
-	const apps = stack.apps.map((app) => app.name);
+	const images = [...stack.apps, ...stack.workers];
+	const apps = images.map((image) => image.app);
 	if (run.mode === "build") {
 		ctx.logger.info("\n🐳 Building images…");
 		await deps.docker.build(ref, apps);
@@ -1525,24 +1660,24 @@ async function buildCompose(ctx, run, deps) {
 		ctx.logger.info(`\n🐳 Pulling ${ctx.tag}…`);
 		await deps.docker.pull(ref, apps);
 	}
-	for (const app of stack.apps) {
-		const digest = await deps.docker.digest(app.ref);
-		run.images[app.name] = {
-			ref: app.ref,
-			tag: app.tag,
+	for (const image of images) {
+		const digest = await deps.docker.digest(image.ref);
+		run.images[image.app] = {
+			ref: image.ref,
+			tag: image.tag,
 			...digest ? { digest } : {}
 		};
 		ctx.emit({
 			type: "artifact.built",
-			app: app.name,
-			imageRef: app.ref,
+			app: image.app,
+			imageRef: image.ref,
 			...digest ? { digest } : {}
 		});
 		run.changes.push({
-			key: `image:${app.name}`,
+			key: `image:${image.app}`,
 			resourceType: "image",
 			action: run.mode === "build" ? "build" : "reuse",
-			id: digest ?? app.ref
+			id: digest ?? image.ref
 		});
 	}
 }
@@ -1573,8 +1708,16 @@ async function releaseCompose(ctx, run, deps) {
 			url: app.url
 		});
 	}
+	for (const worker of stack.workers) applied(ctx, run, {
+		key: `service:${worker.name}`,
+		resourceType: "service",
+		action: "ensure",
+		id: `${stack.project}/${worker.name}`,
+		via: run.previous[worker.name] ? "recorded" : "created"
+	});
 	ctx.logger.info(`\n✅ ${stack.project} is running:`);
 	for (const app of stack.apps) ctx.logger.info(`   ${app.name.padEnd(12)} ${app.url}`);
+	for (const worker of stack.workers) ctx.logger.info(`   ${worker.name.padEnd(12)} worker ${worker.id}`);
 	if (stack.local) ctx.logger.info(`\n🔐 Certificates are from Caddy's local CA: NODE_EXTRA_CA_CERTS=${join(stackDir(ctx.stage), "caddy-root.crt")}`);
 }
 /**
@@ -1584,12 +1727,12 @@ async function releaseCompose(ctx, run, deps) {
 */
 async function recordImages(ctx, run) {
 	const journal = await DeployJournal.open(ctx.state, ctx.stage, () => createEmptyState(ctx.stage, "", ""));
-	for (const app of run.stack.apps) {
-		const image = run.images[app.name] ?? {
+	for (const app of [...run.stack.apps, ...run.stack.workers]) {
+		const image = run.images[app.app] ?? {
 			ref: app.ref,
 			tag: app.tag
 		};
-		recordRelease(journal.state, app.name, image);
+		recordRelease(journal.state, app.app, image);
 	}
 	journal.state.identity = ctx.identity.key;
 	await journal.save();
@@ -1608,7 +1751,8 @@ async function verifyCompose(ctx, run, deps) {
 		ca,
 		local: stack.local
 	})));
-	if (stack.logs) results.push(await checkLogs(ctx, run, deps));
+	results.push(...await Promise.all(stack.workers.map((worker) => checkContainer(ctx, run, deps, worker.name))));
+	if (stack.logs) results.push(await checkContainer(ctx, run, deps, LOGS_SERVICE));
 	const down = results.filter((result) => !result.healthy).map(({ app, url, last }) => ({
 		app,
 		url,
@@ -1618,29 +1762,30 @@ async function verifyCompose(ctx, run, deps) {
 	if (stack.logs) reportLogs(ctx, stack.logs, stack.local);
 }
 /**
-* OpenObserve's own health check, as Docker reports it. It is not asked
-* through the edge: by default it has no host there, and served publicly it
-* answers only the addresses it allows — which need not include this one.
+* A container's own health check, as Docker reports it: a worker's, which
+* has no route through the edge, and OpenObserve's — by default it has no
+* host there, and served publicly it answers only the addresses it allows,
+* which need not include this one.
 */
-async function checkLogs(ctx, run, deps) {
-	const url = `docker:${LOGS_SERVICE}`;
+async function checkContainer(ctx, run, deps, service) {
+	const url = `docker:${service}`;
 	let last = "not asked";
 	for (let attempt = 1; attempt <= deps.healthAttempts; attempt++) {
 		ctx.signal.throwIfAborted();
-		const health = await deps.docker.health(run.ref, LOGS_SERVICE).catch((error) => error instanceof Error ? error.message : String(error));
+		const health = await deps.docker.health(run.ref, service).catch((error) => error instanceof Error ? error.message : String(error));
 		last = health ?? "not running";
 		const healthy = health === "healthy";
 		ctx.emit({
 			type: "health.checked",
-			app: LOGS_SERVICE,
+			app: service,
 			url,
 			healthy,
 			attempt
 		});
 		if (healthy) {
-			ctx.logger.info(`   ✓ ${LOGS_SERVICE.padEnd(12)} ${url} (${last})`);
+			ctx.logger.info(`   ✓ ${service.padEnd(12)} ${url} (${last})`);
 			return {
-				app: LOGS_SERVICE,
+				app: service,
 				url,
 				last,
 				healthy
@@ -1648,9 +1793,9 @@ async function checkLogs(ctx, run, deps) {
 		}
 		if (attempt < deps.healthAttempts) await new Promise((resolve) => setTimeout(resolve, deps.healthIntervalMs));
 	}
-	ctx.logger.warn(`   ✗ ${LOGS_SERVICE.padEnd(12)} ${url} (${last})`);
+	ctx.logger.warn(`   ✗ ${service.padEnd(12)} ${url} (${last})`);
 	return {
-		app: LOGS_SERVICE,
+		app: service,
 		url,
 		last,
 		healthy: false
@@ -1729,7 +1874,7 @@ async function checkApp(ctx, app, deps, options) {
 	};
 }
 function composeResult(ctx, run) {
-	const apps = run.stack.apps.map((app) => {
+	const apps = [...run.stack.apps.map((app) => {
 		const image = run.images[app.name];
 		return {
 			appName: app.name,
@@ -1740,7 +1885,17 @@ function composeResult(ctx, run) {
 			...image?.digest ? { digest: image.digest } : {},
 			url: app.url
 		};
-	});
+	}), ...run.stack.workers.map((worker) => {
+		const image = run.images[worker.name];
+		return {
+			appName: worker.name,
+			type: "backend",
+			success: !ctx.dryRun,
+			applicationId: `${run.stack.project}/${worker.name}`,
+			imageRef: image?.ref ?? worker.ref,
+			...image?.digest ? { digest: image.digest } : {}
+		};
+	})];
 	return {
 		apps,
 		projectId: run.stack.project,
@@ -1784,7 +1939,7 @@ async function writeStack(root, dir, stack, credentials = {}) {
 	};
 	await write(join(dir, "docker-compose.yml"), composeYaml(stack));
 	await write(join(dir, "Caddyfile"), stack.caddyfile);
-	for (const app of stack.apps) if (app.env) await write(join(dir, `${app.name}.env`), envFile(app.env), 384);
+	for (const app of [...stack.apps, ...stack.workers]) if (app.env) await write(join(dir, `${app.name}.env`), envFile(app.env), 384);
 	if (stack.logs) await write(join(dir, `${LOGS_SERVICE}.env`), envFile(stack.logs.env), 384);
 	for (const [name, payload] of Object.entries(credentials)) await write(join(dir, credentialsFile(name)), credentialsFileContent(payload), 384);
 	for (const [path, content] of Object.entries(stack.dockerfiles)) await write(join(root, path), content);
@@ -1794,8 +1949,9 @@ async function writeStack(root, dir, stack, credentials = {}) {
 function composeYaml(stack) {
 	const stage = ` --stage ${stack.stage}`;
 	return `# Generated by gkm compose from the construct manifest — do not edit.
-# The ${stack.stage} stage's APIs and sites behind one Caddy. Each backend
-# reads exactly the keys in its own env file beside this one.
+# The ${stack.stage} stage's APIs and sites behind one Caddy, and its workers.
+# Each backend and worker reads exactly the keys in its own env file beside
+# this one.
 #
 #   gkm compose${stage}          start or update it
 #   gkm compose${stage} --down   stop it
@@ -1808,6 +1964,7 @@ function printPlan(ctx, run) {
 	const { stack, mode, files } = run;
 	ctx.logger.info(`\n🧱 ${stack.project} — stage ${stack.stage}`);
 	for (const app of stack.apps) ctx.logger.info(`   ${app.name.padEnd(12)} ${app.url.padEnd(40)} ${mode} ${app.ref}`);
+	for (const worker of stack.workers) ctx.logger.info(`   ${worker.name.padEnd(12)} ${`worker ${worker.id} (no route)`.padEnd(40)} ${mode} ${worker.ref}`);
 	if (stack.infra.length > 0) ctx.logger.info(`   infrastructure: ${stack.infra.join(", ")}`);
 	ctx.logger.info(`\n📝 Wrote ${files.length} file(s) under ${stackDir(stack.stage)}/`);
 }
@@ -1871,4 +2028,4 @@ function composeTarget(options = {}) {
 //#endregion
 export { stackDir as a, composeProject as i, compose_exports as n, dockerCompose as o, stackOverrideFile as r, composeTarget as t };
 
-//# sourceMappingURL=compose-T3hnnjKZ.mjs.map
+//# sourceMappingURL=compose-9II-0IsK.mjs.map