@geekmidas/cli 10.0.0-alpha.80 → 10.0.0-alpha.82

package/dist/{cli-BkNZBe_-.cjs.map → cli-CWee1-wU.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"cli-BkNZBe_-.cjs","names":["targetForProvider","formatError","parseDevServices","deploy","storedCredentials","terminalCredentials"],"sources":["../src/deploy/cli.ts"],"sourcesContent":["/**\n * `gkm deploy`: the terminal around `deploy()`. CLI layer only.\n *\n * Everything that belongs to a person at a terminal lives here and nowhere\n * below it: prompting for a missing login (and storing it), printing progress,\n * and turning the outcome into an exit code. The deploy itself is the same\n * `deploy()` a host calls.\n */\n\nimport { formatError } from '../debug';\nimport { targetForProvider } from '../target/provider';\nimport { storedCredentials } from './credentials';\nimport { deploy } from './deploy';\nimport { type DevService, parseDevServices } from './devServices';\nimport { terminalCredentials } from './terminal';\n\nexport interface DeployCliOptions {\n\t/** The project directory: `--cwd`, else where the command was run. */\n\tcwd: string;\n\t/** `--target`: where to deploy. Defaults to `deploy.default`. */\n\ttarget?: string;\n\t/** `--provider`, deprecated: `dokploy` means `--target dokploy`. */\n\tprovider?: string;\n\tstage: string;\n\ttag?: string;\n\t/**\n\t * Print each event as one JSON object per line on stdout, instead of the\n\t * progress lines. Nothing prompts: a missing credential fails the run.\n\t */\n\tjson?: boolean;\n\t/** Plan only: create, change, build and push nothing. */\n\tdryRun?: boolean;\n\t/** On a failed release, roll back every app, not only the failed ones. */\n\tatomic?: boolean;\n\t/** `--allow-dev-services minio,mailpit`, as typed. */\n\tallowDevServices?: string;\n}\n\n/** Where the command writes. The process's own streams, outside tests. */\nexport interface DeployCliStreams {\n\tstdout: Pick<NodeJS.WriteStream, 'write'>;\n}\n\n/**\n * Run `gkm deploy` and resolve with its exit code: 0 when the run finished,\n * 1 when anything stopped it.\n */\nexport async function deployCli(\n\toptions: DeployCliOptions,\n\tstreams: DeployCliStreams = { stdout: process.stdout },\n): Promise<number> {\n\tlet target = options.target;\n\tif (options.provider !== undefined && target === undefined) {\n\t\ttry {\n\t\t\t// On stderr, so a `--json` run's stdout still carries only events.\n\t\t\ttarget = targetForProvider(options.provider, (message) =>\n\t\t\t\tconsole.warn(message),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tconsole.error(formatError(error));\n\t\t\treturn 1;\n\t\t}\n\t}\n\n\tlet allowDevServices: DevService[];\n\ttry {\n\t\tallowDevServices = parseDevServices(options.allowDevServices);\n\t} catch (error) {\n\t\tconsole.error(formatError(error));\n\t\treturn 1;\n\t}\n\n\tconst input = {\n\t\tcwd: options.cwd,\n\t\tstage: options.stage,\n\t\t...(target ? { target } : {}),\n\t\t...(options.tag ? { tag: options.tag } : {}),\n\t\t...(options.dryRun ? { dryRun: true } : {}),\n\t\t...(options.atomic ? { atomic: true } : {}),\n\t\t...(allowDevServices.length > 0 ? { allowDevServices } : {}),\n\t};\n\n\tif (options.json) {\n\t\t// stdout carries the events and nothing else: docker's own output goes\n\t\t// to stderr, and nobody is asked anything — a prompt would be written\n\t\t// into the stream a program is parsing.\n\t\tconst run = deploy({\n\t\t\t...input,\n\t\t\tcredentials: storedCredentials(),\n\t\t\tchildOutput: 'stderr',\n\t\t});\n\t\tfor await (const event of run) {\n\t\t\tstreams.stdout.write(`${JSON.stringify(event)}\\n`);\n\t\t}\n\t\treturn run.result.then(\n\t\t\t() => 0,\n\t\t\t(error) => {\n\t\t\t\tconsole.error(formatError(error));\n\t\t\t\treturn 1;\n\t\t\t},\n\t\t);\n\t}\n\n\t// The lines arrive as they are written, rather than as events read back a\n\t// tick later, so they interleave with a prompt exactly as they always did.\n\tconst run = deploy({\n\t\t...input,\n\t\tcredentials: terminalCredentials(storedCredentials()),\n\t\tlogger: {\n\t\t\tinfo: (message) => console.log(message),\n\t\t\twarn: (message) => console.warn(message),\n\t\t\terror: (message) => console.error(message),\n\t\t},\n\t});\n\n\ttry {\n\t\tawait run.result;\n\t\treturn 0;\n\t} catch (error) {\n\t\tconsole.error(formatError(error));\n\t\treturn 1;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA+CA,eAAsB,UACrB,SACA,UAA4B,EAAE,QAAQ,QAAQ,OAAO,GACnC;CAClB,IAAI,SAAS,QAAQ;CACrB,IAAI,QAAQ,aAAa,KAAA,KAAa,WAAW,KAAA,GAChD,IAAI;EAEH,SAASA,iBAAAA,kBAAkB,QAAQ,WAAW,YAC7C,QAAQ,KAAK,OAAO,CACrB;CACD,SAAS,OAAO;EACf,QAAQ,MAAMC,cAAAA,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;CAGD,IAAI;CACJ,IAAI;EACH,mBAAmBC,cAAAA,iBAAiB,QAAQ,gBAAgB;CAC7D,SAAS,OAAO;EACf,QAAQ,MAAMD,cAAAA,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;CAEA,MAAM,QAAQ;EACb,KAAK,QAAQ;EACb,OAAO,QAAQ;EACf,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC3B,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;EAC1C,GAAI,QAAQ,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;EACzC,GAAI,QAAQ,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;EACzC,GAAI,iBAAiB,SAAS,IAAI,EAAE,iBAAiB,IAAI,CAAC;CAC3D;CAEA,IAAI,QAAQ,MAAM;EAIjB,MAAM,MAAME,eAAAA,OAAO;GAClB,GAAG;GACH,aAAaC,oBAAAA,kBAAkB;GAC/B,aAAa;EACd,CAAC;EACD,WAAW,MAAM,SAAS,KACzB,QAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,KAAK,EAAE,GAAG;EAElD,OAAO,IAAI,OAAO,WACX,IACL,UAAU;GACV,QAAQ,MAAMH,cAAAA,YAAY,KAAK,CAAC;GAChC,OAAO;EACR,CACD;CACD;CAIA,MAAM,MAAME,eAAAA,OAAO;EAClB,GAAG;EACH,aAAaE,iBAAAA,oBAAoBD,oBAAAA,kBAAkB,CAAC;EACpD,QAAQ;GACP,OAAO,YAAY,QAAQ,IAAI,OAAO;GACtC,OAAO,YAAY,QAAQ,KAAK,OAAO;GACvC,QAAQ,YAAY,QAAQ,MAAM,OAAO;EAC1C;CACD,CAAC;CAED,IAAI;EACH,MAAM,IAAI;EACV,OAAO;CACR,SAAS,OAAO;EACf,QAAQ,MAAMH,cAAAA,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;AACD"}
+{"version":3,"file":"cli-CWee1-wU.cjs","names":["targetForProvider","formatError","parseDevServices","deploy","storedCredentials","terminalCredentials"],"sources":["../src/deploy/cli.ts"],"sourcesContent":["/**\n * `gkm deploy`: the terminal around `deploy()`. CLI layer only.\n *\n * Everything that belongs to a person at a terminal lives here and nowhere\n * below it: prompting for a missing login (and storing it), printing progress,\n * and turning the outcome into an exit code. The deploy itself is the same\n * `deploy()` a host calls.\n */\n\nimport { formatError } from '../debug';\nimport { targetForProvider } from '../target/provider';\nimport { storedCredentials } from './credentials';\nimport { deploy } from './deploy';\nimport { type DevService, parseDevServices } from './devServices';\nimport { terminalCredentials } from './terminal';\n\nexport interface DeployCliOptions {\n\t/** The project directory: `--cwd`, else where the command was run. */\n\tcwd: string;\n\t/** `--target`: where to deploy. Defaults to `deploy.default`. */\n\ttarget?: string;\n\t/** `--provider`, deprecated: `dokploy` means `--target dokploy`. */\n\tprovider?: string;\n\tstage: string;\n\ttag?: string;\n\t/**\n\t * Print each event as one JSON object per line on stdout, instead of the\n\t * progress lines. Nothing prompts: a missing credential fails the run.\n\t */\n\tjson?: boolean;\n\t/** Plan only: create, change, build and push nothing. */\n\tdryRun?: boolean;\n\t/** On a failed release, roll back every app, not only the failed ones. */\n\tatomic?: boolean;\n\t/** `--allow-dev-services minio,mailpit`, as typed. */\n\tallowDevServices?: string;\n}\n\n/** Where the command writes. The process's own streams, outside tests. */\nexport interface DeployCliStreams {\n\tstdout: Pick<NodeJS.WriteStream, 'write'>;\n}\n\n/**\n * Run `gkm deploy` and resolve with its exit code: 0 when the run finished,\n * 1 when anything stopped it.\n */\nexport async function deployCli(\n\toptions: DeployCliOptions,\n\tstreams: DeployCliStreams = { stdout: process.stdout },\n): Promise<number> {\n\tlet target = options.target;\n\tif (options.provider !== undefined && target === undefined) {\n\t\ttry {\n\t\t\t// On stderr, so a `--json` run's stdout still carries only events.\n\t\t\ttarget = targetForProvider(options.provider, (message) =>\n\t\t\t\tconsole.warn(message),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tconsole.error(formatError(error));\n\t\t\treturn 1;\n\t\t}\n\t}\n\n\tlet allowDevServices: DevService[];\n\ttry {\n\t\tallowDevServices = parseDevServices(options.allowDevServices);\n\t} catch (error) {\n\t\tconsole.error(formatError(error));\n\t\treturn 1;\n\t}\n\n\tconst input = {\n\t\tcwd: options.cwd,\n\t\tstage: options.stage,\n\t\t...(target ? { target } : {}),\n\t\t...(options.tag ? { tag: options.tag } : {}),\n\t\t...(options.dryRun ? { dryRun: true } : {}),\n\t\t...(options.atomic ? { atomic: true } : {}),\n\t\t...(allowDevServices.length > 0 ? { allowDevServices } : {}),\n\t};\n\n\tif (options.json) {\n\t\t// stdout carries the events and nothing else: docker's own output goes\n\t\t// to stderr, and nobody is asked anything — a prompt would be written\n\t\t// into the stream a program is parsing.\n\t\tconst run = deploy({\n\t\t\t...input,\n\t\t\tcredentials: storedCredentials(),\n\t\t\tchildOutput: 'stderr',\n\t\t});\n\t\tfor await (const event of run) {\n\t\t\tstreams.stdout.write(`${JSON.stringify(event)}\\n`);\n\t\t}\n\t\treturn run.result.then(\n\t\t\t() => 0,\n\t\t\t(error) => {\n\t\t\t\tconsole.error(formatError(error));\n\t\t\t\treturn 1;\n\t\t\t},\n\t\t);\n\t}\n\n\t// The lines arrive as they are written, rather than as events read back a\n\t// tick later, so they interleave with a prompt exactly as they always did.\n\tconst run = deploy({\n\t\t...input,\n\t\tcredentials: terminalCredentials(storedCredentials()),\n\t\tlogger: {\n\t\t\tinfo: (message) => console.log(message),\n\t\t\twarn: (message) => console.warn(message),\n\t\t\terror: (message) => console.error(message),\n\t\t},\n\t});\n\n\ttry {\n\t\tawait run.result;\n\t\treturn 0;\n\t} catch (error) {\n\t\tconsole.error(formatError(error));\n\t\treturn 1;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA+CA,eAAsB,UACrB,SACA,UAA4B,EAAE,QAAQ,QAAQ,OAAO,GACnC;CAClB,IAAI,SAAS,QAAQ;CACrB,IAAI,QAAQ,aAAa,KAAA,KAAa,WAAW,KAAA,GAChD,IAAI;EAEH,SAASA,iBAAAA,kBAAkB,QAAQ,WAAW,YAC7C,QAAQ,KAAK,OAAO,CACrB;CACD,SAAS,OAAO;EACf,QAAQ,MAAMC,cAAAA,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;CAGD,IAAI;CACJ,IAAI;EACH,mBAAmBC,cAAAA,iBAAiB,QAAQ,gBAAgB;CAC7D,SAAS,OAAO;EACf,QAAQ,MAAMD,cAAAA,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;CAEA,MAAM,QAAQ;EACb,KAAK,QAAQ;EACb,OAAO,QAAQ;EACf,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC3B,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;EAC1C,GAAI,QAAQ,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;EACzC,GAAI,QAAQ,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;EACzC,GAAI,iBAAiB,SAAS,IAAI,EAAE,iBAAiB,IAAI,CAAC;CAC3D;CAEA,IAAI,QAAQ,MAAM;EAIjB,MAAM,MAAME,eAAAA,OAAO;GAClB,GAAG;GACH,aAAaC,oBAAAA,kBAAkB;GAC/B,aAAa;EACd,CAAC;EACD,WAAW,MAAM,SAAS,KACzB,QAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,KAAK,EAAE,GAAG;EAElD,OAAO,IAAI,OAAO,WACX,IACL,UAAU;GACV,QAAQ,MAAMH,cAAAA,YAAY,KAAK,CAAC;GAChC,OAAO;EACR,CACD;CACD;CAIA,MAAM,MAAME,eAAAA,OAAO;EAClB,GAAG;EACH,aAAaE,iBAAAA,oBAAoBD,oBAAAA,kBAAkB,CAAC;EACpD,QAAQ;GACP,OAAO,YAAY,QAAQ,IAAI,OAAO;GACtC,OAAO,YAAY,QAAQ,KAAK,OAAO;GACvC,QAAQ,YAAY,QAAQ,MAAM,OAAO;EAC1C;CACD,CAAC;CAED,IAAI;EACH,MAAM,IAAI;EACV,OAAO;CACR,SAAS,OAAO;EACf,QAAQ,MAAMH,cAAAA,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;AACD"}

package/dist/{cli-7aLfgIGt.mjs → cli-qMszGvDu.mjs}

@@ -1,6 +1,6 @@
 import { r as storedCredentials } from "./credentials-pAtB70k3.mjs";
-import { V as parseDevServices } from "./seeds-BdkFpW0P.mjs";
-import { t as deploy } from "./deploy-DK4Y6ev4.mjs";
+import { F as parseDevServices } from "./seeds-DbyqaXW4.mjs";
+import { t as deploy } from "./deploy-C00DAKOt.mjs";
 import { i as formatError } from "./index.mjs";
 import { n as targetForProvider } from "./provider-q4lsYzYG.mjs";
 import { terminalCredentials } from "./terminal-BdvrmkaC.mjs";
@@ -73,4 +73,4 @@ async function deployCli(options, streams = { stdout: process.stdout }) {
 //#endregion
 export { deployCli };
 
-//# sourceMappingURL=cli-7aLfgIGt.mjs.map
+//# sourceMappingURL=cli-qMszGvDu.mjs.map

package/dist/{cli-7aLfgIGt.mjs.map → cli-qMszGvDu.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"cli-7aLfgIGt.mjs","names":[],"sources":["../src/deploy/cli.ts"],"sourcesContent":["/**\n * `gkm deploy`: the terminal around `deploy()`. CLI layer only.\n *\n * Everything that belongs to a person at a terminal lives here and nowhere\n * below it: prompting for a missing login (and storing it), printing progress,\n * and turning the outcome into an exit code. The deploy itself is the same\n * `deploy()` a host calls.\n */\n\nimport { formatError } from '../debug';\nimport { targetForProvider } from '../target/provider';\nimport { storedCredentials } from './credentials';\nimport { deploy } from './deploy';\nimport { type DevService, parseDevServices } from './devServices';\nimport { terminalCredentials } from './terminal';\n\nexport interface DeployCliOptions {\n\t/** The project directory: `--cwd`, else where the command was run. */\n\tcwd: string;\n\t/** `--target`: where to deploy. Defaults to `deploy.default`. */\n\ttarget?: string;\n\t/** `--provider`, deprecated: `dokploy` means `--target dokploy`. */\n\tprovider?: string;\n\tstage: string;\n\ttag?: string;\n\t/**\n\t * Print each event as one JSON object per line on stdout, instead of the\n\t * progress lines. Nothing prompts: a missing credential fails the run.\n\t */\n\tjson?: boolean;\n\t/** Plan only: create, change, build and push nothing. */\n\tdryRun?: boolean;\n\t/** On a failed release, roll back every app, not only the failed ones. */\n\tatomic?: boolean;\n\t/** `--allow-dev-services minio,mailpit`, as typed. */\n\tallowDevServices?: string;\n}\n\n/** Where the command writes. The process's own streams, outside tests. */\nexport interface DeployCliStreams {\n\tstdout: Pick<NodeJS.WriteStream, 'write'>;\n}\n\n/**\n * Run `gkm deploy` and resolve with its exit code: 0 when the run finished,\n * 1 when anything stopped it.\n */\nexport async function deployCli(\n\toptions: DeployCliOptions,\n\tstreams: DeployCliStreams = { stdout: process.stdout },\n): Promise<number> {\n\tlet target = options.target;\n\tif (options.provider !== undefined && target === undefined) {\n\t\ttry {\n\t\t\t// On stderr, so a `--json` run's stdout still carries only events.\n\t\t\ttarget = targetForProvider(options.provider, (message) =>\n\t\t\t\tconsole.warn(message),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tconsole.error(formatError(error));\n\t\t\treturn 1;\n\t\t}\n\t}\n\n\tlet allowDevServices: DevService[];\n\ttry {\n\t\tallowDevServices = parseDevServices(options.allowDevServices);\n\t} catch (error) {\n\t\tconsole.error(formatError(error));\n\t\treturn 1;\n\t}\n\n\tconst input = {\n\t\tcwd: options.cwd,\n\t\tstage: options.stage,\n\t\t...(target ? { target } : {}),\n\t\t...(options.tag ? { tag: options.tag } : {}),\n\t\t...(options.dryRun ? { dryRun: true } : {}),\n\t\t...(options.atomic ? { atomic: true } : {}),\n\t\t...(allowDevServices.length > 0 ? { allowDevServices } : {}),\n\t};\n\n\tif (options.json) {\n\t\t// stdout carries the events and nothing else: docker's own output goes\n\t\t// to stderr, and nobody is asked anything — a prompt would be written\n\t\t// into the stream a program is parsing.\n\t\tconst run = deploy({\n\t\t\t...input,\n\t\t\tcredentials: storedCredentials(),\n\t\t\tchildOutput: 'stderr',\n\t\t});\n\t\tfor await (const event of run) {\n\t\t\tstreams.stdout.write(`${JSON.stringify(event)}\\n`);\n\t\t}\n\t\treturn run.result.then(\n\t\t\t() => 0,\n\t\t\t(error) => {\n\t\t\t\tconsole.error(formatError(error));\n\t\t\t\treturn 1;\n\t\t\t},\n\t\t);\n\t}\n\n\t// The lines arrive as they are written, rather than as events read back a\n\t// tick later, so they interleave with a prompt exactly as they always did.\n\tconst run = deploy({\n\t\t...input,\n\t\tcredentials: terminalCredentials(storedCredentials()),\n\t\tlogger: {\n\t\t\tinfo: (message) => console.log(message),\n\t\t\twarn: (message) => console.warn(message),\n\t\t\terror: (message) => console.error(message),\n\t\t},\n\t});\n\n\ttry {\n\t\tawait run.result;\n\t\treturn 0;\n\t} catch (error) {\n\t\tconsole.error(formatError(error));\n\t\treturn 1;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA+CA,eAAsB,UACrB,SACA,UAA4B,EAAE,QAAQ,QAAQ,OAAO,GACnC;CAClB,IAAI,SAAS,QAAQ;CACrB,IAAI,QAAQ,aAAa,KAAA,KAAa,WAAW,KAAA,GAChD,IAAI;EAEH,SAAS,kBAAkB,QAAQ,WAAW,YAC7C,QAAQ,KAAK,OAAO,CACrB;CACD,SAAS,OAAO;EACf,QAAQ,MAAM,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;CAGD,IAAI;CACJ,IAAI;EACH,mBAAmB,iBAAiB,QAAQ,gBAAgB;CAC7D,SAAS,OAAO;EACf,QAAQ,MAAM,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;CAEA,MAAM,QAAQ;EACb,KAAK,QAAQ;EACb,OAAO,QAAQ;EACf,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC3B,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;EAC1C,GAAI,QAAQ,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;EACzC,GAAI,QAAQ,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;EACzC,GAAI,iBAAiB,SAAS,IAAI,EAAE,iBAAiB,IAAI,CAAC;CAC3D;CAEA,IAAI,QAAQ,MAAM;EAIjB,MAAM,MAAM,OAAO;GAClB,GAAG;GACH,aAAa,kBAAkB;GAC/B,aAAa;EACd,CAAC;EACD,WAAW,MAAM,SAAS,KACzB,QAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,KAAK,EAAE,GAAG;EAElD,OAAO,IAAI,OAAO,WACX,IACL,UAAU;GACV,QAAQ,MAAM,YAAY,KAAK,CAAC;GAChC,OAAO;EACR,CACD;CACD;CAIA,MAAM,MAAM,OAAO;EAClB,GAAG;EACH,aAAa,oBAAoB,kBAAkB,CAAC;EACpD,QAAQ;GACP,OAAO,YAAY,QAAQ,IAAI,OAAO;GACtC,OAAO,YAAY,QAAQ,KAAK,OAAO;GACvC,QAAQ,YAAY,QAAQ,MAAM,OAAO;EAC1C;CACD,CAAC;CAED,IAAI;EACH,MAAM,IAAI;EACV,OAAO;CACR,SAAS,OAAO;EACf,QAAQ,MAAM,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;AACD"}
+{"version":3,"file":"cli-qMszGvDu.mjs","names":[],"sources":["../src/deploy/cli.ts"],"sourcesContent":["/**\n * `gkm deploy`: the terminal around `deploy()`. CLI layer only.\n *\n * Everything that belongs to a person at a terminal lives here and nowhere\n * below it: prompting for a missing login (and storing it), printing progress,\n * and turning the outcome into an exit code. The deploy itself is the same\n * `deploy()` a host calls.\n */\n\nimport { formatError } from '../debug';\nimport { targetForProvider } from '../target/provider';\nimport { storedCredentials } from './credentials';\nimport { deploy } from './deploy';\nimport { type DevService, parseDevServices } from './devServices';\nimport { terminalCredentials } from './terminal';\n\nexport interface DeployCliOptions {\n\t/** The project directory: `--cwd`, else where the command was run. */\n\tcwd: string;\n\t/** `--target`: where to deploy. Defaults to `deploy.default`. */\n\ttarget?: string;\n\t/** `--provider`, deprecated: `dokploy` means `--target dokploy`. */\n\tprovider?: string;\n\tstage: string;\n\ttag?: string;\n\t/**\n\t * Print each event as one JSON object per line on stdout, instead of the\n\t * progress lines. Nothing prompts: a missing credential fails the run.\n\t */\n\tjson?: boolean;\n\t/** Plan only: create, change, build and push nothing. */\n\tdryRun?: boolean;\n\t/** On a failed release, roll back every app, not only the failed ones. */\n\tatomic?: boolean;\n\t/** `--allow-dev-services minio,mailpit`, as typed. */\n\tallowDevServices?: string;\n}\n\n/** Where the command writes. The process's own streams, outside tests. */\nexport interface DeployCliStreams {\n\tstdout: Pick<NodeJS.WriteStream, 'write'>;\n}\n\n/**\n * Run `gkm deploy` and resolve with its exit code: 0 when the run finished,\n * 1 when anything stopped it.\n */\nexport async function deployCli(\n\toptions: DeployCliOptions,\n\tstreams: DeployCliStreams = { stdout: process.stdout },\n): Promise<number> {\n\tlet target = options.target;\n\tif (options.provider !== undefined && target === undefined) {\n\t\ttry {\n\t\t\t// On stderr, so a `--json` run's stdout still carries only events.\n\t\t\ttarget = targetForProvider(options.provider, (message) =>\n\t\t\t\tconsole.warn(message),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tconsole.error(formatError(error));\n\t\t\treturn 1;\n\t\t}\n\t}\n\n\tlet allowDevServices: DevService[];\n\ttry {\n\t\tallowDevServices = parseDevServices(options.allowDevServices);\n\t} catch (error) {\n\t\tconsole.error(formatError(error));\n\t\treturn 1;\n\t}\n\n\tconst input = {\n\t\tcwd: options.cwd,\n\t\tstage: options.stage,\n\t\t...(target ? { target } : {}),\n\t\t...(options.tag ? { tag: options.tag } : {}),\n\t\t...(options.dryRun ? { dryRun: true } : {}),\n\t\t...(options.atomic ? { atomic: true } : {}),\n\t\t...(allowDevServices.length > 0 ? { allowDevServices } : {}),\n\t};\n\n\tif (options.json) {\n\t\t// stdout carries the events and nothing else: docker's own output goes\n\t\t// to stderr, and nobody is asked anything — a prompt would be written\n\t\t// into the stream a program is parsing.\n\t\tconst run = deploy({\n\t\t\t...input,\n\t\t\tcredentials: storedCredentials(),\n\t\t\tchildOutput: 'stderr',\n\t\t});\n\t\tfor await (const event of run) {\n\t\t\tstreams.stdout.write(`${JSON.stringify(event)}\\n`);\n\t\t}\n\t\treturn run.result.then(\n\t\t\t() => 0,\n\t\t\t(error) => {\n\t\t\t\tconsole.error(formatError(error));\n\t\t\t\treturn 1;\n\t\t\t},\n\t\t);\n\t}\n\n\t// The lines arrive as they are written, rather than as events read back a\n\t// tick later, so they interleave with a prompt exactly as they always did.\n\tconst run = deploy({\n\t\t...input,\n\t\tcredentials: terminalCredentials(storedCredentials()),\n\t\tlogger: {\n\t\t\tinfo: (message) => console.log(message),\n\t\t\twarn: (message) => console.warn(message),\n\t\t\terror: (message) => console.error(message),\n\t\t},\n\t});\n\n\ttry {\n\t\tawait run.result;\n\t\treturn 0;\n\t} catch (error) {\n\t\tconsole.error(formatError(error));\n\t\treturn 1;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA+CA,eAAsB,UACrB,SACA,UAA4B,EAAE,QAAQ,QAAQ,OAAO,GACnC;CAClB,IAAI,SAAS,QAAQ;CACrB,IAAI,QAAQ,aAAa,KAAA,KAAa,WAAW,KAAA,GAChD,IAAI;EAEH,SAAS,kBAAkB,QAAQ,WAAW,YAC7C,QAAQ,KAAK,OAAO,CACrB;CACD,SAAS,OAAO;EACf,QAAQ,MAAM,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;CAGD,IAAI;CACJ,IAAI;EACH,mBAAmB,iBAAiB,QAAQ,gBAAgB;CAC7D,SAAS,OAAO;EACf,QAAQ,MAAM,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;CAEA,MAAM,QAAQ;EACb,KAAK,QAAQ;EACb,OAAO,QAAQ;EACf,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC3B,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;EAC1C,GAAI,QAAQ,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;EACzC,GAAI,QAAQ,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;EACzC,GAAI,iBAAiB,SAAS,IAAI,EAAE,iBAAiB,IAAI,CAAC;CAC3D;CAEA,IAAI,QAAQ,MAAM;EAIjB,MAAM,MAAM,OAAO;GAClB,GAAG;GACH,aAAa,kBAAkB;GAC/B,aAAa;EACd,CAAC;EACD,WAAW,MAAM,SAAS,KACzB,QAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,KAAK,EAAE,GAAG;EAElD,OAAO,IAAI,OAAO,WACX,IACL,UAAU;GACV,QAAQ,MAAM,YAAY,KAAK,CAAC;GAChC,OAAO;EACR,CACD;CACD;CAIA,MAAM,MAAM,OAAO;EAClB,GAAG;EACH,aAAa,oBAAoB,kBAAkB,CAAC;EACpD,QAAQ;GACP,OAAO,YAAY,QAAQ,IAAI,OAAO;GACtC,OAAO,YAAY,QAAQ,KAAK,OAAO;GACvC,QAAQ,YAAY,QAAQ,MAAM,OAAO;EAC1C;CACD,CAAC;CAED,IAAI;EACH,MAAM,IAAI;EACV,OAAO;CACR,SAAS,OAAO;EACf,QAAQ,MAAM,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;AACD"}

package/dist/{compose-n7K8H5j8.mjs → compose-D4sD4Lgr.mjs}

@@ -4,9 +4,9 @@ import { r as discover } from "./discover-BPelzeGW.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
 import { F as LOGS_PORT, I as resolveLogs, M as ComposeTlsFileMissing, N as certificateFor, P as proxyFor } from "./workspace-BBdqmkch.mjs";
 import { t as defineTarget } from "./define-DR8xGYfL.mjs";
-import { $ as constructGlobs, A as isOtlpDestination, Bt as primaryPortKey, C as ensureDockerignore, Ct as hostFor, D as NoDomainForStage, Dt as WORKER_PORT, E as validateImageRef, Et as TURBO_VERSION, G as workerUnits, H as reportDevServices, It as DEFAULT_IMAGES, L as assertExternalServices, O as isMainFrontendApp, R as devServicesUsed, Tt as imageLayout, W as suppliedOnly, _ as DeployJournal, _t as networkEnv, a as createEmptyState, at as applyBuckets, bt as localRolePassword, ct as bucketPolicies, dn as initStageSecrets, ft as composeFor, ht as appEnvKeys, i as assertNoStaleSecrets, j as otelEnv, k as resolveHost, kt as findBuildRoot, l as recordRelease, mt as pgClient, n as reportDatabaseRuns, on as imageRef, ot as applyPolicies, pt as bucketClient, r as reportPlannedSeeds, st as applyPostgres, t as DeploySeedsFailed, ut as postgresStatements, v as withGeneratedSecrets, vt as workerEnvKeys, w as workerDockerfile, wt as composeBuildPaths, x as appDockerfile, xt as planFor, yt as envFor, zt as portKeys } from "./seeds-BdkFpW0P.mjs";
-import { i as DEFAULT_EVENTS } from "./SubscriberGenerator-5looQ3gB.mjs";
-import { i as installedFrom } from "./drivers-Ch1rJitn.mjs";
+import { $ as postgresSuperuser, $t as EMULATOR_ACCESS_KEY_ID, At as appEnvKeys, Bt as imageLayout, C as workerDockerfile, Dt as ensurePostgresLogin, En as imageRef, Et as LEGACY_LOCAL_LOGIN, Ft as localRolePassword, Ht as WORKER_PORT, I as reportDevServices, It as planFor, M as devServicesUsed, Mt as networkEnv, Nt as workerEnvKeys, Ot as bucketClient, Pt as envFor, Q as loadLocalCredentials, Qt as composeFor, R as suppliedOnly, Rt as hostFor, S as ensureDockerignore, St as bucketPolicies, T as validateImageRef, Vt as TURBO_VERSION, Wt as findBuildRoot, Z as LOCAL_RABBITMQ_USER, _ as DeployJournal, a as createEmptyState, an as primaryPortKey, at as runsRedis, b as appDockerfile, bt as applyPolicies, ct as LOGS_SERVICE, dt as stackLogs, en as DEFAULT_IMAGES, ft as withLogsPassword, gt as otelEnv, ht as resolveHost, i as assertNoStaleSecrets, it as redisService, j as assertExternalServices, jn as initStageSecrets, kt as pgClient, l as recordRelease, lt as logsAccess, mt as isMainFrontendApp, n as reportDatabaseRuns, nt as REDIS_SERVICE, ot as stackRedis, pt as NoDomainForStage, q as constructGlobs, r as reportPlannedSeeds, rn as portKeys, rt as STACK_CACHE, st as withRedisPassword, t as DeploySeedsFailed, tt as withGeneratedSecrets, ut as logsService, wt as postgresStatements, xt as applyPostgres, yt as applyBuckets, z as workerUnits, zt as composeBuildPaths } from "./seeds-DbyqaXW4.mjs";
+import { i as DEFAULT_EVENTS } from "./SubscriberGenerator-DQZeGkDW.mjs";
+import { i as installedFrom } from "./drivers-B4RP2B2O.mjs";
 import { f as plannedSeeds, o as SeedFailed, p as seedDatabases, u as migrateDatabases } from "./databases-CzszQV0N.mjs";
 import { n as assertStageCredentials } from "./credentialSchemas-BJqRJNK4.mjs";
 import { dirname, join } from "node:path";
@@ -15,7 +15,7 @@ import { chmod, copyFile, mkdir, readFile, readdir, rename, rm, writeFile } from
 import { hostname, userInfo } from "node:os";
 import { provideKey, provisionOrder, publicEnvFor } from "@geekmidas/manifest";
 import { spawn } from "node:child_process";
-import { createHash, randomBytes } from "node:crypto";
+import { createHash } from "node:crypto";
 import { stringify } from "yaml";
 import { request } from "node:https";
 //#region src/compose/docker.ts
@@ -792,330 +792,6 @@ function pinImages(file, digests, images) {
 	});
 }
 //#endregion
-//#region src/compose/logs.ts
-/**
-* The stack's log UI: OpenObserve, run beside the apps when
-* `deploy.compose.logs` asks for it, and every backend's OpenTelemetry
-* pointed at it.
-*
-* The production server already exports its traces and pino logs over
-* OTLP/HTTP when `OTEL_EXPORTER_OTLP_ENDPOINT` is set. OpenObserve takes OTLP
-* at `/api/<org>/v1/{logs,traces}` with HTTP basic auth, so wiring an app is
-* two variables: the endpoint, `http://openobserve:5080/api/default`, and
-* the header that signs in as the root user.
-*
-* It is reached, by default, through an SSH tunnel: published on 127.0.0.1
-* only, because a port Docker publishes on every interface is opened in the
-* firewall by Docker itself, past ufw's rules. Served publicly, it is a host
-* on the stack's Caddy that refuses every address not allowed.
-*
-* Pure: the stack decides it, and the phases print and check it.
-*/
-/**
-* The image, pinned. A log store's on-disk format is the thing that must not
-* move under a running stack, so a new version is a change to this line.
-*/
-const OPENOBSERVE_IMAGE = "public.ecr.aws/zinclabs/openobserve:v1.0.4";
-/** Its compose service name — the host the apps send to. */
-const LOGS_SERVICE = "openobserve";
-/** The organisation every app's telemetry lands in. */
-const LOGS_ORG = "default";
-/** The stage secrets that sign in as OpenObserve's root user. */
-const LOGS_EMAIL_KEY = "ZO_ROOT_USER_EMAIL";
-const LOGS_PASSWORD_KEY = "ZO_ROOT_USER_PASSWORD";
-/** The stage sends its telemetry somewhere already, and logs are on too. */
-var LogsEndpointConflict = class extends Error {
-	stage;
-	keys;
-	constructor(stage, keys) {
-		super(`The stage '${stage}' sets ${keys.join(", ")} in its secrets, and deploy.compose.logs also runs OpenObserve for it — each backend can send its telemetry to one place. Either keep your own OTLP backend: remove logs from deploy.compose in gkm.config.ts; or use the bundled OpenObserve: remove ${keys.join(", ")} from the stage's secrets, and every backend is pointed at it.`);
-		this.stage = stage;
-		this.keys = keys;
-		this.name = "LogsEndpointConflict";
-	}
-};
-/** A root password OpenObserve would refuse to start with. */
-var LogsPasswordWeak = class extends Error {
-	stage;
-	constructor(stage) {
-		super(`The stage '${stage}' sets ${LOGS_PASSWORD_KEY}, and OpenObserve refuses it: a root password must be 8 to 128 characters with a lowercase letter, an uppercase letter, a digit and a symbol. Set another with gkm secrets:set ${LOGS_PASSWORD_KEY} '…' --stage ${stage}, or unset it to have one generated.`);
-		this.stage = stage;
-		this.name = "LogsPasswordWeak";
-	}
-};
-/** A deployed stage with logs on and no root password generated yet. */
-var LogsPasswordMissing = class extends Error {
-	stage;
-	constructor(stage) {
-		super(`The stage '${stage}' runs OpenObserve and has no ${LOGS_PASSWORD_KEY} in its secrets. Run gkm compose --stage ${stage} without --dry-run once to generate it, or set one: gkm secrets:set ${LOGS_PASSWORD_KEY} '…' --stage ${stage}`);
-		this.stage = stage;
-		this.name = "LogsPasswordMissing";
-	}
-};
-/** Whether OpenObserve accepts `password` for its root user. */
-function isStrongLogsPassword(password) {
-	return password.length >= 8 && password.length <= 128 && /[a-z]/.test(password) && /[A-Z]/.test(password) && /\d/.test(password) && /[^A-Za-z0-9]/.test(password);
-}
-/**
-* A root password: 192 random bits, with a fixed tail so every class
-* OpenObserve requires is present whatever the random part drew.
-*/
-function generateLogsPassword() {
-	return `${randomBytes(24).toString("base64url")}-Zo1`;
-}
-/**
-* The stage's secrets with a generated root password, where it has none.
-* Pure, like `withGeneratedSecrets`: the caller keeps the result once the
-* run goes ahead.
-*/
-function withLogsPassword(secrets) {
-	if (secrets.custom?.["ZO_ROOT_USER_PASSWORD"]) return {
-		secrets,
-		generated: []
-	};
-	return {
-		secrets: {
-			...secrets,
-			custom: {
-				...secrets.custom,
-				[LOGS_PASSWORD_KEY]: generateLogsPassword()
-			},
-			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-		},
-		generated: [LOGS_PASSWORD_KEY]
-	};
-}
-/**
-* `OTEL_EXPORTER_OTLP_HEADERS` signing in as `email`.
-*
-* The variable's values are percent-decoded by the SDK (they follow the W3C
-* baggage format), so the space after `Basic` is written `%20`. Base64's own
-* `+`, `/` and `=` pass through decoding unchanged.
-*/
-function otlpHeaders(email, password) {
-	return `Authorization=Basic%20${Buffer.from(`${email}:${password}`).toString("base64")}`;
-}
-/** The stack's OpenObserve for one stage. */
-function stackLogs(options) {
-	const { config, stage, local, custom } = options;
-	const conflicting = Object.keys(custom).filter(isOtlpDestination).sort();
-	if (conflicting.length > 0) throw new LogsEndpointConflict(stage, conflicting);
-	if (!local && !options.domain) throw new NoDomainForStage(stage);
-	const email = custom["ZO_ROOT_USER_EMAIL"] ?? (local ? "admin@gkm.localhost" : `admin@${options.domain}`);
-	const set = custom[LOGS_PASSWORD_KEY];
-	if (!set && !local) throw new LogsPasswordMissing(stage);
-	const password = set ?? "Geekmidas-1";
-	if (!isStrongLogsPassword(password)) throw new LogsPasswordWeak(stage);
-	const host = config.public ? local ? `logs.${options.project}.localhost` : `logs.${options.domain}` : void 0;
-	const url = host ? `https://${host}${local && options.https !== 443 ? `:${options.https}` : ""}` : `http://localhost:${config.port}`;
-	return {
-		...config,
-		email,
-		password,
-		passwordFromSecrets: Boolean(set),
-		url,
-		...host ? { host } : {},
-		env: {
-			[LOGS_EMAIL_KEY]: email,
-			[LOGS_PASSWORD_KEY]: password,
-			ZO_DATA_DIR: "/data",
-			ZO_COMPACT_DATA_RETENTION_DAYS: String(config.retentionDays),
-			ZO_TELEMETRY: "false"
-		},
-		appEnv: {
-			OTEL_EXPORTER_OTLP_ENDPOINT: `http://${LOGS_SERVICE}:${LOGS_PORT}/api/${LOGS_ORG}`,
-			OTEL_EXPORTER_OTLP_HEADERS: otlpHeaders(email, password)
-		}
-	};
-}
-/**
-* OpenObserve's service. The image has no shell, `wget` or `curl`, so its
-* health check is its own binary asking the running server for its status —
-* which exits non-zero when nothing answers on its port.
-*/
-function logsService(logs) {
-	return {
-		image: OPENOBSERVE_IMAGE,
-		restart: "unless-stopped",
-		env_file: [{
-			path: `./${LOGS_SERVICE}.env`,
-			format: "raw"
-		}],
-		volumes: ["openobserve-data:/data"],
-		...logs.public ? {} : { ports: [`127.0.0.1:${logs.port}:${LOGS_PORT}`] },
-		healthcheck: {
-			test: [
-				"CMD",
-				"/openobserve",
-				"node",
-				"status"
-			],
-			interval: "10s",
-			timeout: "5s",
-			retries: 12,
-			start_period: "20s"
-		}
-	};
-}
-/** What `gkm compose` prints once the stack is up: how to open the logs. */
-function logsAccess(logs, ctx) {
-	const login = `login: ${logs.email}, password: ${ctx.local && !logs.passwordFromSecrets ? logs.password : `gkm secrets:show --stage ${ctx.stage} --reveal → ${LOGS_PASSWORD_KEY}`}`;
-	if (logs.public) return [`📜 Logs (OpenObserve): ${logs.url}  (${login})`, `     answered only for ${logs.public.allow.join(", ")}; every other address gets 403`];
-	return [
-		`📜 Logs (OpenObserve) on 127.0.0.1:${logs.port} — from your computer:`,
-		...ctx.local ? [`     on this machine, open http://localhost:${logs.port} directly; from another:`] : [],
-		`     ssh -N -L ${logs.port}:localhost:${logs.port} ${ctx.user}@${ctx.hostname}   (user and host are guesses: this machine's)`,
-		`     then open http://localhost:${logs.port}  (${login})`,
-		`⚠️  Docker-published ports bypass ufw, so OpenObserve is bound to 127.0.0.1 only — reach it through the tunnel, not by opening the port.`
-	];
-}
-//#endregion
-//#region src/compose/redis.ts
-/**
-* The stack's Redis: what every declared cache lives in when a workspace runs
-* as a `gkm compose` stack, on the local stage and on a deployed one alike.
-*
-* A cache is the one store whose contents can always be rebuilt, so unlike
-* Mailpit and MinIO it is a production service, not a dev stand-in: it runs
-* for every stage, on the compose network only, with nothing published. It
-* is bounded (`maxmemory`, evicting the least recently used key), persisted
-* (an append-only file on a named volume, kept by `--down`) and password
-* protected — the stage's own password, generated once like its seed.
-*
-* A stage that sets a cache's URL in its secrets — a managed Redis — keeps
-* it, and a stack whose every cache is set that way runs no Redis at all.
-*
-* Pure: the stack decides it, and the phases keep the password.
-*/
-/**
-* Where a stack's caches live: its own Redis, whatever the deploy target's
-* default is. A stack is one machine running containers, and a Redis beside
-* the apps is cheaper for a cache than a table in the database they share.
-*/
-const STACK_CACHE = "redis";
-/** Its compose service name — the host every cache URL points at. */
-const REDIS_SERVICE = "redis";
-/** The port it answers on, inside the network. */
-const REDIS_PORT = 6379;
-/** Reconcile's pin, so `gkm dev` and the stack run one Redis. */
-const REDIS_IMAGE = DEFAULT_IMAGES.redis;
-/**
-* How much it may hold before it evicts. A cache that grows until the box
-* runs out of memory takes the apps with it; 256 MB is a lot of sessions and
-* little of a small server. A project's `docker-compose.<stage>.yml` can
-* replace the command to change it.
-*/
-const REDIS_MAXMEMORY = "256mb";
-/** The stage secret holding its password. */
-const REDIS_PASSWORD_KEY = "REDIS_PASSWORD";
-/** Redis's own count of logical databases, before `--databases` raises it. */
-const REDIS_DATABASES = 16;
-/** A deployed stage that runs the stack's Redis and has no password yet. */
-var RedisPasswordMissing = class extends Error {
-	stage;
-	constructor(stage) {
-		super(`The stage '${stage}' runs the stack's Redis and has no ${REDIS_PASSWORD_KEY} in its secrets. Run gkm compose --stage ${stage} without --dry-run once to generate it, or set one: gkm secrets:set ${REDIS_PASSWORD_KEY} '…' --stage ${stage}`);
-		this.stage = stage;
-		this.name = "RedisPasswordMissing";
-	}
-};
-/**
-* Whether a stage's stack runs Redis: a cache is declared and the stage's
-* secrets do not set the URL of every one.
-*/
-function runsRedis(manifest, custom) {
-	return Object.values(manifest).some((declaration) => declaration?.kind === "cache" && (declaration.provides ?? []).some((key) => custom[key] === void 0));
-}
-/** A password: 256 random bits, URL-safe, so it sits in a URL unescaped. */
-function generateRedisPassword() {
-	return randomBytes(32).toString("base64url");
-}
-/**
-* The stage's secrets with a generated Redis password, where it has none.
-* Pure, like `withGeneratedSecrets`: the caller keeps the result once the run
-* goes ahead.
-*/
-function withRedisPassword(secrets) {
-	if (secrets.custom?.["REDIS_PASSWORD"]) return {
-		secrets,
-		generated: []
-	};
-	return {
-		secrets: {
-			...secrets,
-			custom: {
-				...secrets.custom,
-				[REDIS_PASSWORD_KEY]: generateRedisPassword()
-			},
-			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-		},
-		generated: [REDIS_PASSWORD_KEY]
-	};
-}
-/**
-* The stack's Redis for one stage, or nothing where no cache needs it.
-*
-* Each cache it holds gets a logical database of its own, by the order of
-* their ids, so two caches never read each other's keys.
-*/
-function stackRedis(options) {
-	const { plan, stage, local, custom } = options;
-	const caches = plan.resources.filter((r) => r.kind === "cache" && custom[r.envKey] === void 0).sort((a, b) => a.id.localeCompare(b.id));
-	if (caches.length === 0) return void 0;
-	const set = custom[REDIS_PASSWORD_KEY];
-	if (!set && !local) throw new RedisPasswordMissing(stage);
-	const password = set ?? "geekmidas";
-	const auth = encodeURIComponent(password);
-	return {
-		password,
-		passwordFromSecrets: Boolean(set),
-		urls: Object.fromEntries(caches.map((cache, index) => [cache.envKey, `redis://:${auth}@${REDIS_SERVICE}:${REDIS_PORT}/${index}`])),
-		env: {
-			[REDIS_PASSWORD_KEY]: password,
-			REDISCLI_AUTH: password
-		},
-		databases: Math.max(REDIS_DATABASES, caches.length)
-	};
-}
-/**
-* Redis's service: bounded, persisted and password protected, on the
-* network alone.
-*
-* The command runs the image's own entrypoint with `redis-server` first, so
-* it still drops to the `redis` user and owns `/data`; the password is read
-* from the env file by the shell (`$$` is compose's escape for `$`), so
-* neither the compose file nor the container's command holds it.
-*/
-function redisService(redis) {
-	const flags = [
-		`--requirepass "$$${REDIS_PASSWORD_KEY}"`,
-		`--maxmemory ${REDIS_MAXMEMORY}`,
-		"--maxmemory-policy allkeys-lru",
-		"--appendonly yes",
-		...redis.databases > REDIS_DATABASES ? [`--databases ${redis.databases}`] : []
-	];
-	return {
-		image: REDIS_IMAGE,
-		restart: "unless-stopped",
-		command: [
-			"sh",
-			"-c",
-			`exec docker-entrypoint.sh redis-server ${flags.join(" ")}`
-		],
-		env_file: [{
-			path: `./${REDIS_SERVICE}.env`,
-			format: "raw"
-		}],
-		volumes: ["redis-data:/data"],
-		healthcheck: {
-			test: ["CMD-SHELL", "redis-cli ping | grep -q PONG"],
-			interval: "5s",
-			timeout: "3s",
-			retries: 10
-		}
-	};
-}
-//#endregion
 //#region src/compose/caddyfile.ts
 /** Where Caddy reads a stage's own certificate, inside its container. */
 const CADDY_TLS_DIR = "/etc/caddy/tls";
@@ -1246,6 +922,43 @@ const LOG_ROTATION = {
 		"max-file": "3"
 	}
 };
+/** The local stage's stack, without the logins `gkm dev` generates. */
+var LocalCredentialsMissing = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`The local stage '${stage}' runs with this machine's generated logins, and none were passed. Load them with loadLocalCredentials(workspace) and pass them as localCredentials.`);
+		this.stage = stage;
+		this.name = "LocalCredentialsMissing";
+	}
+};
+/**
+* A deployed stage's container logins, derived from its seed like its role
+* passwords — so every deploy of the stage computes the same ones, and no one
+* reading the repo can.
+*/
+function derivedCredentials(project, plan, seed) {
+	const derive = (purpose) => localRolePassword(project, plan, purpose, seed);
+	return {
+		postgres: {
+			user: postgresSuperuser(project),
+			password: derive("master")
+		},
+		minio: {
+			user: `${project}-minio`,
+			password: derive("minio")
+		},
+		rabbitmq: {
+			user: LOCAL_RABBITMQ_USER,
+			password: derive("rabbitmq")
+		},
+		redis: { password: derive("redis") },
+		cacheToken: derive("cache-token"),
+		emulator: {
+			accessKeyId: EMULATOR_ACCESS_KEY_ID,
+			secretAccessKey: derive("emulator")
+		}
+	};
+}
 /** A value only the stage's secrets can hold, and they do not. */
 var StageSecretMissing = class extends Error {
 	app;
@@ -1328,11 +1041,19 @@ function composeStack(input) {
 		edge: false
 	});
 	const byId = new Map(plan.resources.map((r) => [r.id, r]));
-	const seed = local ? void 0 : input.secrets?.seed;
-	if (!local && !seed) throw new StageSeedMissing(stage);
+	if (local && !input.localCredentials) throw new LocalCredentialsMissing(stage);
+	const seed = local ? input.localCredentials.seed : input.secrets?.seed;
+	if (!seed) throw new StageSeedMissing(stage);
+	const containers = local ? input.localCredentials : derivedCredentials(workspace.name, plan, seed);
 	const credential = {
-		master: local ? "geekmidas" : localRolePassword(workspace.name, plan, "master", seed),
-		...seed ? { seed } : {}
+		containers: {
+			...containers,
+			minio: {
+				user: custom.AWS_ACCESS_KEY_ID ?? containers.minio.user,
+				password: custom.AWS_SECRET_ACCESS_KEY ?? containers.minio.password
+			}
+		},
+		seed
 	};
 	const apps = stackApps(workspace, manifest, plan, {
 		local,
@@ -1371,7 +1092,8 @@ function composeStack(input) {
 		project: workspace.name,
 		...domain ? { domain } : {},
 		custom,
-		https
+		https,
+		...local ? { localLogin: input.localCredentials.logs } : {}
 	}) : void 0;
 	const services = local ? {
 		missing: [],
@@ -1388,14 +1110,14 @@ function composeStack(input) {
 		plan,
 		stage,
 		local,
-		custom
+		custom,
+		...local ? { localPassword: input.localCredentials.redis.password } : {}
 	});
 	const infra = [...plan.containers.filter((c) => !NOT_RUN[c]).filter((c) => c !== "minio" || services.minio.length > 0).filter((c) => c !== "mailpit" || services.mailpit.length > 0).filter((c) => c !== "redis" || redis !== void 0), ...logsBase ? [LOGS_SERVICE] : []].sort();
 	const storage = infra.includes("minio") ? (() => {
 		const buckets = services.minio.map((id) => byId.get(id)?.name).filter((name) => Boolean(name)).sort();
 		return {
-			user: custom.AWS_ACCESS_KEY_ID ?? (local ? "geekmidas" : `${workspace.name}-minio`),
-			password: custom.AWS_SECRET_ACCESS_KEY ?? (local ? "geekmidas" : localRolePassword(workspace.name, plan, "minio", seed)),
+			...credential.containers.minio,
 			buckets,
 			policies: bucketPolicies(plan).filter((p) => buckets.includes(p.bucket))
 		};
@@ -1442,8 +1164,8 @@ function composeStack(input) {
 	};
 	const derivation = {
 		project: workspace.name,
-		master: credential.master,
-		...credential.seed ? { seed: credential.seed } : {},
+		credentials: credential.containers,
+		seed: credential.seed,
 		...!local && domain ? { mailFrom: `noreply@${domain}` } : {}
 	};
 	const outside = networkEnv(plan, {
@@ -1559,7 +1281,7 @@ function composeStack(input) {
 		infra,
 		apps,
 		workers,
-		master: credential.master,
+		credentials: credential.containers,
 		...storage ? { storage } : {},
 		...logs ? { logs } : {},
 		...redis ? { redis } : {},
@@ -1747,7 +1469,8 @@ function stackFile(options) {
 		containers: [...infra]
 	}, {
 		project,
-		ports: Object.fromEntries(portKeys(infra, plan.fakes).map((key) => [key, 0]))
+		ports: Object.fromEntries(portKeys(infra, plan.fakes).map((key) => [key, 0])),
+		credentials: options.credentials
 	});
 	const services = {};
 	const volumes = {
@@ -1766,13 +1489,7 @@ function stackFile(options) {
 		};
 	}
 	const postgres = services.postgres;
-	if (postgres) {
-		postgres.environment = {
-			...postgres.environment,
-			POSTGRES_PASSWORD: options.master
-		};
-		postgres.ports = ["127.0.0.1::5432"];
-	}
+	if (postgres) postgres.ports = ["127.0.0.1::5432"];
 	const minio = services.minio;
 	if (minio && options.storage) {
 		minio.environment = {
@@ -2064,6 +1781,7 @@ const defaultDeps = {
 	revision: gitRevision,
 	sql: pgClient,
 	buckets: bucketClient,
+	logins: ensurePostgresLogin,
 	migrate: migrateDatabases,
 	seed: seedDatabases,
 	probe: httpsProbe,
@@ -2122,6 +1840,7 @@ async function validateCompose(ctx, deps, options = {}) {
 			...registry ? { registry } : {}
 		},
 		secrets,
+		...stage === workspace.stages.local ? { localCredentials: (await loadLocalCredentials(workspace)).credentials } : {},
 		allowDevServices: ctx.allowDevServices,
 		ports: edgePorts(deps.env),
 		...layout ? { layout } : {},
@@ -2390,10 +2109,20 @@ async function prepareDatabases(ctx, run, deps) {
 	const { stack } = run;
 	const workspace = ctx.workspace;
 	const port = await deps.docker.port(run.ref, "postgres", 5432);
+	const superuser = stack.credential.containers.postgres;
+	const login = await deps.logins({
+		port,
+		login: superuser,
+		legacy: [{
+			user: LEGACY_LOCAL_LOGIN.user,
+			password: superuser.password
+		}, ...stack.local ? [LEGACY_LOCAL_LOGIN] : []]
+	});
+	if (login.notice) ctx.logger.info(login.notice);
 	const statements = postgresStatements(stack.plan, workspace.name, stack.credential.seed);
 	if (statements.length > 0) {
 		ctx.logger.info("🗄️  Creating databases, roles and grants…");
-		await applyPostgres(deps.sql(port, stack.credential.master), statements);
+		await applyPostgres(deps.sql(port, login.login), statements);
 	}
 	const sources = {};
 	const manifest = await discover({
@@ -2404,8 +2133,11 @@ async function prepareDatabases(ctx, run, deps) {
 	const env = envFor(stack.plan, {
 		ports: { [primaryPortKey("postgres")]: port },
 		project: workspace.name,
-		master: stack.credential.master,
-		...stack.credential.seed ? { seed: stack.credential.seed } : {}
+		credentials: {
+			...stack.credential.containers,
+			postgres: login.login
+		},
+		seed: stack.credential.seed
 	});
 	const options = {
 		root: workspace.root,
@@ -2856,4 +2588,4 @@ function composeTarget(options = {}) {
 //#endregion
 export { stackOverrideFile as a, parseDigests as c, removeEdgeRoutes as d, EDGE_PROJECT as f, ComposePushNeedsBuild as i, pinnedRef as l, compose_exports as n, composeProject as o, dockerCompose as p, ComposePinNeedsPull as r, stackDir as s, composeTarget as t, edgeDir as u };
 
-//# sourceMappingURL=compose-n7K8H5j8.mjs.map
+//# sourceMappingURL=compose-D4sD4Lgr.mjs.map