@geekmidas/cli 10.0.0-alpha.72 → 10.0.0-alpha.74

package/dist/{compose-T3hnnjKZ.mjs → compose-DZp8DJ0A.mjs}

@@ -1,13 +1,14 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { a as runOutput, i as run } from "./run-BJLIerMM.mjs";
-import { r as discover } from "./discover-Buwf1z4P.mjs";
+import { r as discover } from "./discover-BPelzeGW.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
 import { M as LOGS_PORT, N as resolveLogs } from "./workspace-C7NqCsQF.mjs";
 import { t as defineTarget } from "./define-DR8xGYfL.mjs";
-import { $ as applyPostgres, B as encryptSecrets, C as isMainFrontendApp, Ct as DEFAULT_IMAGES, Dt as primaryPortKey, E as otelEnv, Et as portKeys, G as constructGlobs, Kt as imageRef, L as reportDevServices, M as assertExternalServices, N as devServicesUsed, Q as applyPolicies, S as NoDomainForStage, T as isOtlpDestination, Z as applyBuckets, Zt as initStageSecrets, a as recordRelease, at as bucketClient, b as ensureDockerignore, ct as networkEnv, dt as planFor, et as bucketPolicies, g as credentialsFileContent, gt as TURBO_VERSION, h as credentialsBuildArg, ht as imageLayout, it as composeFor, lt as envFor, m as withGeneratedSecrets, mt as composeBuildPaths, nt as postgresStatements, ot as pgClient, p as DeployJournal, pt as hostFor, st as appEnvKeys, t as createEmptyState, ut as localRolePassword, v as appDockerfile, vt as findBuildRoot, w as resolveHost, x as validateImageRef, z as suppliedOnly } from "./state-BJFherj1.mjs";
-import { n as DEFAULT_CACHE, r as DEFAULT_EVENTS } from "./fakes-C9RiT6XG.mjs";
+import { $ as constructGlobs, C as validateImageRef, Ct as composeBuildPaths, D as isOtlpDestination, E as resolveHost, Et as WORKER_PORT, F as devServicesUsed, H as workerUnits, It as portKeys, Lt as primaryPortKey, Nt as DEFAULT_IMAGES, O as otelEnv, Ot as findBuildRoot, P as assertExternalServices, St as hostFor, T as isMainFrontendApp, Tt as TURBO_VERSION, U as encryptSecrets, V as suppliedOnly, _t as workerEnvKeys, a as recordRelease, at as applyBuckets, b as ensureDockerignore, bt as planFor, ct as bucketPolicies, ft as composeFor, g as credentialsFileContent, gt as networkEnv, h as credentialsBuildArg, ht as appEnvKeys, m as withGeneratedSecrets, mt as pgClient, nn as imageRef, ot as applyPolicies, p as DeployJournal, pt as bucketClient, sn as initStageSecrets, st as applyPostgres, t as createEmptyState, ut as postgresStatements, v as appDockerfile, vt as envFor, w as NoDomainForStage, wt as imageLayout, x as workerDockerfile, yt as localRolePassword, z as reportDevServices } from "./state-DpkxSwzI.mjs";
+import { i as DEFAULT_EVENTS } from "./SubscriberGenerator-5looQ3gB.mjs";
+import { i as installedFrom } from "./drivers-Ch1rJitn.mjs";
 import { u as migrateDatabases } from "./databases-hUHTuwhx.mjs";
-import { n as assertStageCredentials } from "./credentialSchemas-BmYxnEz_.mjs";
+import { n as assertStageCredentials } from "./credentialSchemas-BJqRJNK4.mjs";
 import { dirname, join } from "node:path";
 import { existsSync } from "node:fs";
 import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
@@ -444,6 +445,152 @@ function logsAccess(logs, ctx) {
 	];
 }
 //#endregion
+//#region src/compose/redis.ts
+/**
+* The stack's Redis: what every declared cache lives in when a workspace runs
+* as a `gkm compose` stack, on the local stage and on a deployed one alike.
+*
+* A cache is the one store whose contents can always be rebuilt, so unlike
+* Mailpit and MinIO it is a production service, not a dev stand-in: it runs
+* for every stage, on the compose network only, with nothing published. It
+* is bounded (`maxmemory`, evicting the least recently used key), persisted
+* (an append-only file on a named volume, kept by `--down`) and password
+* protected — the stage's own password, generated once like its seed.
+*
+* A stage that sets a cache's URL in its secrets — a managed Redis — keeps
+* it, and a stack whose every cache is set that way runs no Redis at all.
+*
+* Pure: the stack decides it, and the phases keep the password.
+*/
+/**
+* Where a stack's caches live: its own Redis, whatever the deploy target's
+* default is. A stack is one machine running containers, and a Redis beside
+* the apps is cheaper for a cache than a table in the database they share.
+*/
+const STACK_CACHE = "redis";
+/** Its compose service name — the host every cache URL points at. */
+const REDIS_SERVICE = "redis";
+/** The port it answers on, inside the network. */
+const REDIS_PORT = 6379;
+/** Reconcile's pin, so `gkm dev` and the stack run one Redis. */
+const REDIS_IMAGE = DEFAULT_IMAGES.redis;
+/**
+* How much it may hold before it evicts. A cache that grows until the box
+* runs out of memory takes the apps with it; 256 MB is a lot of sessions and
+* little of a small server. A project's `docker-compose.<stage>.yml` can
+* replace the command to change it.
+*/
+const REDIS_MAXMEMORY = "256mb";
+/** The stage secret holding its password. */
+const REDIS_PASSWORD_KEY = "REDIS_PASSWORD";
+/** Redis's own count of logical databases, before `--databases` raises it. */
+const REDIS_DATABASES = 16;
+/** A deployed stage that runs the stack's Redis and has no password yet. */
+var RedisPasswordMissing = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`The stage '${stage}' runs the stack's Redis and has no ${REDIS_PASSWORD_KEY} in its secrets. Run gkm compose --stage ${stage} without --dry-run once to generate it, or set one: gkm secrets:set ${REDIS_PASSWORD_KEY} '…' --stage ${stage}`);
+		this.stage = stage;
+		this.name = "RedisPasswordMissing";
+	}
+};
+/**
+* Whether a stage's stack runs Redis: a cache is declared and the stage's
+* secrets do not set the URL of every one.
+*/
+function runsRedis(manifest, custom) {
+	return Object.values(manifest).some((declaration) => declaration?.kind === "cache" && (declaration.provides ?? []).some((key) => custom[key] === void 0));
+}
+/** A password: 256 random bits, URL-safe, so it sits in a URL unescaped. */
+function generateRedisPassword() {
+	return randomBytes(32).toString("base64url");
+}
+/**
+* The stage's secrets with a generated Redis password, where it has none.
+* Pure, like `withGeneratedSecrets`: the caller keeps the result once the run
+* goes ahead.
+*/
+function withRedisPassword(secrets) {
+	if (secrets.custom?.["REDIS_PASSWORD"]) return {
+		secrets,
+		generated: []
+	};
+	return {
+		secrets: {
+			...secrets,
+			custom: {
+				...secrets.custom,
+				[REDIS_PASSWORD_KEY]: generateRedisPassword()
+			},
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		},
+		generated: [REDIS_PASSWORD_KEY]
+	};
+}
+/**
+* The stack's Redis for one stage, or nothing where no cache needs it.
+*
+* Each cache it holds gets a logical database of its own, by the order of
+* their ids, so two caches never read each other's keys.
+*/
+function stackRedis(options) {
+	const { plan, stage, local, custom } = options;
+	const caches = plan.resources.filter((r) => r.kind === "cache" && custom[r.envKey] === void 0).sort((a, b) => a.id.localeCompare(b.id));
+	if (caches.length === 0) return void 0;
+	const set = custom[REDIS_PASSWORD_KEY];
+	if (!set && !local) throw new RedisPasswordMissing(stage);
+	const password = set ?? "geekmidas";
+	const auth = encodeURIComponent(password);
+	return {
+		password,
+		passwordFromSecrets: Boolean(set),
+		urls: Object.fromEntries(caches.map((cache, index) => [cache.envKey, `redis://:${auth}@${REDIS_SERVICE}:${REDIS_PORT}/${index}`])),
+		env: {
+			[REDIS_PASSWORD_KEY]: password,
+			REDISCLI_AUTH: password
+		},
+		databases: Math.max(REDIS_DATABASES, caches.length)
+	};
+}
+/**
+* Redis's service: bounded, persisted and password protected, on the
+* network alone.
+*
+* The command runs the image's own entrypoint with `redis-server` first, so
+* it still drops to the `redis` user and owns `/data`; the password is read
+* from the env file by the shell (`$$` is compose's escape for `$`), so
+* neither the compose file nor the container's command holds it.
+*/
+function redisService(redis) {
+	const flags = [
+		`--requirepass "$$${REDIS_PASSWORD_KEY}"`,
+		`--maxmemory ${REDIS_MAXMEMORY}`,
+		"--maxmemory-policy allkeys-lru",
+		"--appendonly yes",
+		...redis.databases > REDIS_DATABASES ? [`--databases ${redis.databases}`] : []
+	];
+	return {
+		image: REDIS_IMAGE,
+		restart: "unless-stopped",
+		command: [
+			"sh",
+			"-c",
+			`exec docker-entrypoint.sh redis-server ${flags.join(" ")}`
+		],
+		env_file: [{
+			path: `./${REDIS_SERVICE}.env`,
+			format: "raw"
+		}],
+		volumes: ["redis-data:/data"],
+		healthcheck: {
+			test: ["CMD-SHELL", "redis-cli ping | grep -q PONG"],
+			interval: "5s",
+			timeout: "3s",
+			retries: 10
+		}
+	};
+}
+//#endregion
 //#region src/compose/caddyfile.ts
 /** The Caddyfile for a stack's edge. */
 function edgeCaddyfile(sites, options) {
@@ -590,7 +737,7 @@ var StageSeedMissing = class extends Error {
 var NothingToCompose = class extends Error {
 	root;
 	constructor(root) {
-		super(`${root} declares no RestApi and no site, so a stack would run nothing. Workers and mobile apps are not run by gkm compose yet.`);
+		super(`${root} declares no RestApi, no site and no Worker with work to do, so a stack would run nothing. Mobile apps ship through their own toolchain.`);
 		this.root = root;
 		this.name = "NothingToCompose";
 	}
@@ -640,7 +787,7 @@ function composeStack(input) {
 	const plan = planFor(manifest, stage, provisionOrder(manifest), {
 		localStage: workspace.stages.local,
 		events: DEFAULT_EVENTS.server,
-		cache: DEFAULT_CACHE.server,
+		cache: STACK_CACHE,
 		edge: false
 	});
 	const byId = new Map(plan.resources.map((r) => [r.id, r]));
@@ -657,7 +804,12 @@ function composeStack(input) {
 		identity,
 		images: input.images
 	});
-	if (apps.length === 0) throw new NothingToCompose(workspace.root);
+	const workers = stackWorkers(workerUnits(workspace, manifest, input.background ?? {}), {
+		stage,
+		identity,
+		images: input.images
+	});
+	if (apps.length === 0 && workers.length === 0) throw new NothingToCompose(workspace.root);
 	const owners = /* @__PURE__ */ new Map();
 	for (const resource of plan.resources) {
 		owners.set(resource.envKey, resource);
@@ -672,6 +824,7 @@ function composeStack(input) {
 		const site = manifest[app.id];
 		reads.set(app.name, site?.kind === "site" ? Object.values(publicEnvFor(site, manifest)) : [...appEnvKeys(manifest, app.name, input.runnables) ?? []]);
 	}
+	for (const worker of workers) reads.set(worker.name, [...workerEnvKeys(manifest, worker.id, input.runnables) ?? []]);
 	const domain = workspace.deploy?.domains?.[stage];
 	const logsConfig = resolveLogs(workspace.deploy?.compose?.logs);
 	const logs = logsConfig ? stackLogs({
@@ -694,7 +847,13 @@ function composeStack(input) {
 		allow: input.allowDevServices ?? [],
 		...domain ? { domain } : {}
 	});
-	const infra = [...plan.containers.filter((c) => !NOT_RUN[c]).filter((c) => c !== "minio" || services.minio.length > 0).filter((c) => c !== "mailpit" || services.mailpit.length > 0), ...logs ? [LOGS_SERVICE] : []].sort();
+	const redis = stackRedis({
+		plan,
+		stage,
+		local,
+		custom
+	});
+	const infra = [...plan.containers.filter((c) => !NOT_RUN[c]).filter((c) => c !== "minio" || services.minio.length > 0).filter((c) => c !== "mailpit" || services.mailpit.length > 0).filter((c) => c !== "redis" || redis !== void 0), ...logs ? [LOGS_SERVICE] : []].sort();
 	const storage = infra.includes("minio") ? (() => {
 		const buckets = services.minio.map((id) => byId.get(id)?.name).filter((name) => Boolean(name)).sort();
 		return {
@@ -758,10 +917,27 @@ function composeStack(input) {
 			return value;
 		}
 		if (custom[key] !== void 0) return custom[key];
+		if (owner?.kind === "cache") return redis?.urls[key];
 		const surface = surfaceUrls.get(key);
 		if (app.kind === "rest-api" && surface && surface !== app.id) return inside[key];
 		return outside[key];
 	};
+	/** Each key one backend process reads, resolved for this stage. */
+	const valuesFor = (app, keys) => {
+		const values = {};
+		for (const key of [...keys].sort()) {
+			const owner = owners.get(key) ?? storageOwner(key, plan);
+			if (!local && owner?.kind === "email" && key.endsWith("_INBOX_URL")) continue;
+			if (STORAGE_KEYS.includes(key)) {
+				const value = custom[key] ?? storageValue(key, storage);
+				if (value !== void 0) values[key] = value;
+				continue;
+			}
+			const value = valueFor(app, key, owner);
+			if (value !== void 0) values[key] = value;
+		}
+		return values;
+	};
 	for (const app of apps) {
 		if (app.kind === "site") {
 			const site = manifest[app.id];
@@ -775,18 +951,7 @@ function composeStack(input) {
 			continue;
 		}
 		const keys = appEnvKeys(manifest, app.name, input.runnables) ?? /* @__PURE__ */ new Set();
-		const values = {};
-		for (const key of [...keys].sort()) {
-			const owner = owners.get(key) ?? storageOwner(key, plan);
-			if (!local && owner?.kind === "email" && key.endsWith("_INBOX_URL")) continue;
-			if (STORAGE_KEYS.includes(key)) {
-				const value = custom[key] ?? storageValue(key, storage);
-				if (value !== void 0) values[key] = value;
-				continue;
-			}
-			const value = valueFor(app, key, owner);
-			if (value !== void 0) values[key] = value;
-		}
+		const values = valuesFor(app, keys);
 		const trusted = provideKey(app.id, "trustedOrigins");
 		if (keys.has(trusted)) {
 			const internal = (byId.get(app.id)?.callers ?? []).map((caller) => appById.get(caller)).filter((caller) => caller?.kind === "rest-api").map((caller) => `http://${caller.name}:${caller.port}`);
@@ -805,15 +970,35 @@ function composeStack(input) {
 		};
 		for (const [key, value] of Object.entries(app.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(app.name, key);
 	}
+	for (const worker of workers) {
+		const keys = workerEnvKeys(manifest, worker.id, input.runnables) ?? /* @__PURE__ */ new Set();
+		worker.env = {
+			...valuesFor({
+				name: worker.name,
+				id: worker.id,
+				kind: "rest-api"
+			}, keys),
+			...otelEnv({
+				...custom,
+				...logs?.appEnv
+			}, worker.name),
+			NODE_ENV: "production",
+			PORT: String(worker.port),
+			STAGE: stage
+		};
+		for (const [key, value] of Object.entries(worker.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(worker.name, key);
+	}
 	const layout = input.layout ?? defaultLayout(workspace.root);
 	const compose = stackFile({
 		project,
 		plan,
 		infra,
 		apps,
+		workers,
 		master: credential.master,
 		...storage ? { storage } : {},
 		...logs ? { logs } : {},
+		...redis ? { redis } : {},
 		https,
 		http,
 		composeDir: join(workspace.root, stackDir(stage)),
@@ -838,7 +1023,20 @@ function composeStack(input) {
 		dockerfiles[app.build.dockerfile] = appDockerfile(app.name, workspace.apps[app.name], {
 			layout,
 			workspaceRoot: workspace.root,
-			manifest
+			manifest,
+			cache: STACK_CACHE
+		});
+	}
+	for (const worker of workers) {
+		if (!worker.build) continue;
+		dockerfiles[worker.build.dockerfile] = workerDockerfile({
+			id: worker.id,
+			name: worker.name,
+			app: worker.host
+		}, workspace.apps[worker.host], {
+			layout,
+			workspaceRoot: workspace.root,
+			cache: STACK_CACHE
 		});
 	}
 	return {
@@ -846,6 +1044,7 @@ function composeStack(input) {
 		stage,
 		local,
 		apps,
+		workers,
 		infra,
 		compose,
 		caddyfile,
@@ -854,7 +1053,8 @@ function composeStack(input) {
 		credential,
 		...storage ? { storage } : {},
 		devServices: local ? [] : devServicesUsed(services),
-		...logs ? { logs } : {}
+		...logs ? { logs } : {},
+		...redis ? { redis } : {}
 	};
 }
 /**
@@ -930,6 +1130,19 @@ function stackApps(workspace, manifest, plan, options) {
 	}
 	return apps.sort((a, b) => a.name.localeCompare(b.name));
 }
+/** Each worker's image, and where it is built from. */
+function stackWorkers(units, options) {
+	return units.map((unit) => ({
+		app: unit.name,
+		name: unit.name,
+		id: unit.id,
+		host: unit.app,
+		port: WORKER_PORT,
+		ref: validateImageRef(imageRef(options.identity, unit.name, options.images.registry, options.images.tag)),
+		tag: options.images.tag,
+		...options.images.mode === "build" ? { build: { dockerfile: `${stackDir(options.stage)}/Dockerfile.${unit.name}` } } : {}
+	}));
+}
 /**
 * The host an app answers on for a stage: the `gkm dev` edge's
 * `*.localhost` names for the local stage, and the stage's domain — by the
@@ -981,6 +1194,7 @@ function stackFile(options) {
 		};
 		minio.ports = ["127.0.0.1::9000"];
 	}
+	if (services["redis"] && options.redis) services[REDIS_SERVICE] = redisService(options.redis);
 	if (options.logs) services[LOGS_SERVICE] = logsService(options.logs);
 	for (const app of apps) services[app.name] = {
 		image: app.ref,
@@ -1003,6 +1217,22 @@ function stackFile(options) {
 		} : {},
 		healthcheck: probe(app.port, app.kind === "site" ? "/" : "/health")
 	};
+	for (const worker of options.workers) services[worker.name] = {
+		image: worker.ref,
+		...worker.build ? { build: composeBuildPaths({
+			composeDir: options.composeDir,
+			buildRoot: options.buildRoot,
+			workspaceRoot: options.workspaceRoot,
+			dockerfile: worker.build.dockerfile
+		}) } : {},
+		restart: "unless-stopped",
+		env_file: [{
+			path: `./${worker.name}.env`,
+			format: "raw"
+		}],
+		...infra.length ? { depends_on: Object.fromEntries(infra.map((name) => [name, HEALTHY])) } : {},
+		healthcheck: probe(worker.port, "/health")
+	};
 	services.caddy = {
 		image: DEFAULT_IMAGES.caddy,
 		restart: "unless-stopped",
@@ -1098,9 +1328,38 @@ function withBuildCredentials(stack, credentials) {
 			}
 		};
 	});
+	const workers = stack.workers.map((worker) => {
+		const own = credentials[worker.name];
+		const service = services[worker.name];
+		if (!own || !service?.build) return worker;
+		const [key, value] = own.buildArg.split("=");
+		services[worker.name] = {
+			...service,
+			build: {
+				...service.build,
+				args: {
+					...service.build.args,
+					[key]: value
+				},
+				secrets: [{
+					source: credentialsSecret(worker.name),
+					target: "gkm_credentials"
+				}]
+			}
+		};
+		secrets[credentialsSecret(worker.name)] = { file: `./${credentialsFile(worker.name)}` };
+		return {
+			...worker,
+			env: {
+				...worker.env,
+				GKM_MASTER_KEY: own.masterKey
+			}
+		};
+	});
 	return {
 		...stack,
 		apps,
+		workers,
 		compose: {
 			...stack.compose,
 			services,
@@ -1286,10 +1545,12 @@ async function validateCompose(ctx, deps, forced) {
 	const root = workspace.root;
 	const mode = forced ?? (ctx.tagGiven ? "pull" : "build");
 	const runnables = {};
+	const background = {};
 	const manifest = await discover({
 		patterns: constructGlobs(workspace),
 		cwd: root,
-		runnables
+		runnables,
+		background
 	});
 	const { secrets, generated } = await stageSecrets(ctx, manifest);
 	await assertStageCredentials({
@@ -1305,6 +1566,7 @@ async function validateCompose(ctx, deps, forced) {
 		workspace,
 		manifest,
 		runnables,
+		background,
 		stage,
 		identity,
 		images: {
@@ -1318,25 +1580,45 @@ async function validateCompose(ctx, deps, forced) {
 		...layout ? { layout } : {}
 	});
 	reportDevServices(ctx, composed.devServices);
+	if (mode === "build") assertRedisClient(workspace, composed);
 	const credentials = {};
-	if (mode === "build") for (const app of composed.apps) {
-		if (app.kind !== "rest-api" || !app.env || !app.build) continue;
-		const { encrypted, iv, masterKey } = encryptSecrets(app.env);
-		credentials[app.name] = {
-			encrypted,
-			iv
-		};
-		ctx.secrets.mask(masterKey);
-		masterKeys[app.name] = {
-			masterKey,
-			buildArg: credentialsBuildArg({
+	if (mode === "build") {
+		for (const app of composed.apps) {
+			if (app.kind !== "rest-api" || !app.env || !app.build) continue;
+			const { encrypted, iv, masterKey } = encryptSecrets(app.env);
+			credentials[app.name] = {
 				encrypted,
 				iv
-			})
-		};
+			};
+			ctx.secrets.mask(masterKey);
+			masterKeys[app.name] = {
+				masterKey,
+				buildArg: credentialsBuildArg({
+					encrypted,
+					iv
+				})
+			};
+		}
+		for (const worker of composed.workers) {
+			if (!worker.env || !worker.build) continue;
+			const { encrypted, iv, masterKey } = encryptSecrets(worker.env);
+			credentials[worker.name] = {
+				encrypted,
+				iv
+			};
+			ctx.secrets.mask(masterKey);
+			masterKeys[worker.name] = {
+				masterKey,
+				buildArg: credentialsBuildArg({
+					encrypted,
+					iv
+				})
+			};
+		}
 	}
 	const stack = withBuildCredentials(composed, masterKeys);
-	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, stack.apps);
+	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, [...stack.apps, ...stack.workers]);
+	if (stack.redis && !stack.local) ctx.secrets.mask(stack.redis.password);
 	if (stack.logs && (!stack.local || stack.logs.passwordFromSecrets)) {
 		ctx.secrets.mask(stack.logs.password);
 		ctx.secrets.mask(stack.logs.appEnv.OTEL_EXPORTER_OTLP_HEADERS);
@@ -1374,6 +1656,28 @@ async function validateCompose(ctx, deps, forced) {
 		changes: []
 	};
 }
+/** A stack whose caches are in Redis, built for an app that has no client. */
+var RedisClientMissing = class extends Error {
+	apps;
+	constructor(apps) {
+		super(`The stack keeps every cache in Redis, and ${apps.join(", ")} ${apps.length === 1 ? "does" : "do"} not depend on ioredis, the client the generated server reaches it with. Add it to the workspace: pnpm add ioredis`);
+		this.apps = apps;
+		this.name = "RedisClientMissing";
+	}
+};
+/**
+* Every backend and worker image built for a stack with a cache can resolve
+* `ioredis` — listed by its app or a directory above it, the way Node and
+* the image's install find it.
+*/
+function assertRedisClient(workspace, stack) {
+	if (!stack.plan.resources.some((r) => r.kind === "cache")) return;
+	const missing = [.../* @__PURE__ */ new Set([...stack.apps.filter((app) => app.kind === "rest-api").map((a) => a.name), ...stack.workers.map((worker) => worker.host)])].filter((name) => {
+		const app = workspace.apps[name];
+		return app && !installedFrom(join(workspace.root, app.path), "ioredis");
+	}).sort();
+	if (missing.length > 0) throw new RedisClientMissing(missing);
+}
 /**
 * The stage's secrets — and, for a deployed stage, everything it generates
 * once: its seed, and each declared secret and keyring. Kept only once the
@@ -1391,8 +1695,16 @@ async function stageSecrets(ctx, manifest) {
 		secrets: withSeed.secrets,
 		generated: []
 	};
-	const secrets = withLogs.secrets;
-	const generated = [...withSeed.generated, ...withLogs.generated];
+	const withRedis = runsRedis(manifest, withLogs.secrets.custom ?? {}) ? withRedisPassword(withLogs.secrets) : {
+		secrets: withLogs.secrets,
+		generated: []
+	};
+	const secrets = withRedis.secrets;
+	const generated = [
+		...withSeed.generated,
+		...withLogs.generated,
+		...withRedis.generated
+	];
 	if (secrets.seed) ctx.secrets.mask(secrets.seed);
 	for (const value of Object.values(secrets.custom ?? {})) ctx.secrets.mask(value);
 	return {
@@ -1434,6 +1746,19 @@ async function planCompose(ctx, run) {
 			action: run.previous[app.name] ? "reuse" : "create"
 		});
 	}
+	for (const worker of run.stack.workers) {
+		planned({
+			key: `image:${worker.name}`,
+			resourceType: "image",
+			action: run.mode === "build" ? "build" : "reuse",
+			id: worker.ref
+		});
+		planned({
+			key: `service:${worker.name}`,
+			resourceType: "service",
+			action: run.previous[worker.name] ? "reuse" : "create"
+		});
+	}
 	planned({
 		key: "service:caddy",
 		resourceType: "service",
@@ -1517,7 +1842,8 @@ async function prepareDatabases(ctx, run, deps) {
 */
 async function buildCompose(ctx, run, deps) {
 	const { stack, ref } = run;
-	const apps = stack.apps.map((app) => app.name);
+	const images = [...stack.apps, ...stack.workers];
+	const apps = images.map((image) => image.app);
 	if (run.mode === "build") {
 		ctx.logger.info("\n🐳 Building images…");
 		await deps.docker.build(ref, apps);
@@ -1525,24 +1851,24 @@ async function buildCompose(ctx, run, deps) {
 		ctx.logger.info(`\n🐳 Pulling ${ctx.tag}…`);
 		await deps.docker.pull(ref, apps);
 	}
-	for (const app of stack.apps) {
-		const digest = await deps.docker.digest(app.ref);
-		run.images[app.name] = {
-			ref: app.ref,
-			tag: app.tag,
+	for (const image of images) {
+		const digest = await deps.docker.digest(image.ref);
+		run.images[image.app] = {
+			ref: image.ref,
+			tag: image.tag,
 			...digest ? { digest } : {}
 		};
 		ctx.emit({
 			type: "artifact.built",
-			app: app.name,
-			imageRef: app.ref,
+			app: image.app,
+			imageRef: image.ref,
 			...digest ? { digest } : {}
 		});
 		run.changes.push({
-			key: `image:${app.name}`,
+			key: `image:${image.app}`,
 			resourceType: "image",
 			action: run.mode === "build" ? "build" : "reuse",
-			id: digest ?? app.ref
+			id: digest ?? image.ref
 		});
 	}
 }
@@ -1573,8 +1899,16 @@ async function releaseCompose(ctx, run, deps) {
 			url: app.url
 		});
 	}
+	for (const worker of stack.workers) applied(ctx, run, {
+		key: `service:${worker.name}`,
+		resourceType: "service",
+		action: "ensure",
+		id: `${stack.project}/${worker.name}`,
+		via: run.previous[worker.name] ? "recorded" : "created"
+	});
 	ctx.logger.info(`\n✅ ${stack.project} is running:`);
 	for (const app of stack.apps) ctx.logger.info(`   ${app.name.padEnd(12)} ${app.url}`);
+	for (const worker of stack.workers) ctx.logger.info(`   ${worker.name.padEnd(12)} worker ${worker.id}`);
 	if (stack.local) ctx.logger.info(`\n🔐 Certificates are from Caddy's local CA: NODE_EXTRA_CA_CERTS=${join(stackDir(ctx.stage), "caddy-root.crt")}`);
 }
 /**
@@ -1584,12 +1918,12 @@ async function releaseCompose(ctx, run, deps) {
 */
 async function recordImages(ctx, run) {
 	const journal = await DeployJournal.open(ctx.state, ctx.stage, () => createEmptyState(ctx.stage, "", ""));
-	for (const app of run.stack.apps) {
-		const image = run.images[app.name] ?? {
+	for (const app of [...run.stack.apps, ...run.stack.workers]) {
+		const image = run.images[app.app] ?? {
 			ref: app.ref,
 			tag: app.tag
 		};
-		recordRelease(journal.state, app.name, image);
+		recordRelease(journal.state, app.app, image);
 	}
 	journal.state.identity = ctx.identity.key;
 	await journal.save();
@@ -1608,7 +1942,8 @@ async function verifyCompose(ctx, run, deps) {
 		ca,
 		local: stack.local
 	})));
-	if (stack.logs) results.push(await checkLogs(ctx, run, deps));
+	results.push(...await Promise.all(stack.workers.map((worker) => checkContainer(ctx, run, deps, worker.name))));
+	if (stack.logs) results.push(await checkContainer(ctx, run, deps, LOGS_SERVICE));
 	const down = results.filter((result) => !result.healthy).map(({ app, url, last }) => ({
 		app,
 		url,
@@ -1618,29 +1953,30 @@ async function verifyCompose(ctx, run, deps) {
 	if (stack.logs) reportLogs(ctx, stack.logs, stack.local);
 }
 /**
-* OpenObserve's own health check, as Docker reports it. It is not asked
-* through the edge: by default it has no host there, and served publicly it
-* answers only the addresses it allows — which need not include this one.
+* A container's own health check, as Docker reports it: a worker's, which
+* has no route through the edge, and OpenObserve's — by default it has no
+* host there, and served publicly it answers only the addresses it allows,
+* which need not include this one.
 */
-async function checkLogs(ctx, run, deps) {
-	const url = `docker:${LOGS_SERVICE}`;
+async function checkContainer(ctx, run, deps, service) {
+	const url = `docker:${service}`;
 	let last = "not asked";
 	for (let attempt = 1; attempt <= deps.healthAttempts; attempt++) {
 		ctx.signal.throwIfAborted();
-		const health = await deps.docker.health(run.ref, LOGS_SERVICE).catch((error) => error instanceof Error ? error.message : String(error));
+		const health = await deps.docker.health(run.ref, service).catch((error) => error instanceof Error ? error.message : String(error));
 		last = health ?? "not running";
 		const healthy = health === "healthy";
 		ctx.emit({
 			type: "health.checked",
-			app: LOGS_SERVICE,
+			app: service,
 			url,
 			healthy,
 			attempt
 		});
 		if (healthy) {
-			ctx.logger.info(`   ✓ ${LOGS_SERVICE.padEnd(12)} ${url} (${last})`);
+			ctx.logger.info(`   ✓ ${service.padEnd(12)} ${url} (${last})`);
 			return {
-				app: LOGS_SERVICE,
+				app: service,
 				url,
 				last,
 				healthy
@@ -1648,9 +1984,9 @@ async function checkLogs(ctx, run, deps) {
 		}
 		if (attempt < deps.healthAttempts) await new Promise((resolve) => setTimeout(resolve, deps.healthIntervalMs));
 	}
-	ctx.logger.warn(`   ✗ ${LOGS_SERVICE.padEnd(12)} ${url} (${last})`);
+	ctx.logger.warn(`   ✗ ${service.padEnd(12)} ${url} (${last})`);
 	return {
-		app: LOGS_SERVICE,
+		app: service,
 		url,
 		last,
 		healthy: false
@@ -1729,7 +2065,7 @@ async function checkApp(ctx, app, deps, options) {
 	};
 }
 function composeResult(ctx, run) {
-	const apps = run.stack.apps.map((app) => {
+	const apps = [...run.stack.apps.map((app) => {
 		const image = run.images[app.name];
 		return {
 			appName: app.name,
@@ -1740,7 +2076,17 @@ function composeResult(ctx, run) {
 			...image?.digest ? { digest: image.digest } : {},
 			url: app.url
 		};
-	});
+	}), ...run.stack.workers.map((worker) => {
+		const image = run.images[worker.name];
+		return {
+			appName: worker.name,
+			type: "backend",
+			success: !ctx.dryRun,
+			applicationId: `${run.stack.project}/${worker.name}`,
+			imageRef: image?.ref ?? worker.ref,
+			...image?.digest ? { digest: image.digest } : {}
+		};
+	})];
 	return {
 		apps,
 		projectId: run.stack.project,
@@ -1784,8 +2130,9 @@ async function writeStack(root, dir, stack, credentials = {}) {
 	};
 	await write(join(dir, "docker-compose.yml"), composeYaml(stack));
 	await write(join(dir, "Caddyfile"), stack.caddyfile);
-	for (const app of stack.apps) if (app.env) await write(join(dir, `${app.name}.env`), envFile(app.env), 384);
+	for (const app of [...stack.apps, ...stack.workers]) if (app.env) await write(join(dir, `${app.name}.env`), envFile(app.env), 384);
 	if (stack.logs) await write(join(dir, `${LOGS_SERVICE}.env`), envFile(stack.logs.env), 384);
+	if (stack.redis) await write(join(dir, `${REDIS_SERVICE}.env`), envFile(stack.redis.env), 384);
 	for (const [name, payload] of Object.entries(credentials)) await write(join(dir, credentialsFile(name)), credentialsFileContent(payload), 384);
 	for (const [path, content] of Object.entries(stack.dockerfiles)) await write(join(root, path), content);
 	await ensureDockerignore(findBuildRoot(root));
@@ -1794,8 +2141,9 @@ async function writeStack(root, dir, stack, credentials = {}) {
 function composeYaml(stack) {
 	const stage = ` --stage ${stack.stage}`;
 	return `# Generated by gkm compose from the construct manifest — do not edit.
-# The ${stack.stage} stage's APIs and sites behind one Caddy. Each backend
-# reads exactly the keys in its own env file beside this one.
+# The ${stack.stage} stage's APIs and sites behind one Caddy, and its workers.
+# Each backend and worker reads exactly the keys in its own env file beside
+# this one.
 #
 #   gkm compose${stage}          start or update it
 #   gkm compose${stage} --down   stop it
@@ -1808,6 +2156,7 @@ function printPlan(ctx, run) {
 	const { stack, mode, files } = run;
 	ctx.logger.info(`\n🧱 ${stack.project} — stage ${stack.stage}`);
 	for (const app of stack.apps) ctx.logger.info(`   ${app.name.padEnd(12)} ${app.url.padEnd(40)} ${mode} ${app.ref}`);
+	for (const worker of stack.workers) ctx.logger.info(`   ${worker.name.padEnd(12)} ${`worker ${worker.id} (no route)`.padEnd(40)} ${mode} ${worker.ref}`);
 	if (stack.infra.length > 0) ctx.logger.info(`   infrastructure: ${stack.infra.join(", ")}`);
 	ctx.logger.info(`\n📝 Wrote ${files.length} file(s) under ${stackDir(stack.stage)}/`);
 }
@@ -1871,4 +2220,4 @@ function composeTarget(options = {}) {
 //#endregion
 export { stackDir as a, composeProject as i, compose_exports as n, dockerCompose as o, stackOverrideFile as r, composeTarget as t };
 
-//# sourceMappingURL=compose-T3hnnjKZ.mjs.map
+//# sourceMappingURL=compose-DZp8DJ0A.mjs.map