@omnitron-dev/omnitron 0.1.3 → 0.3.0

package/dist/project/build-decision.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Whether an application has to be compiled again.
+ *
+ * A deployment stops shipping what the node already has. What it did not
+ * stop was producing it: every autostart of the master ran
+ * `rm -rf dist && tsc` for each of six applications, and only afterwards
+ * asked whether the result differed from what the node was running.
+ * Measured on one restart with nothing changed — three minutes thirty-nine
+ * seconds of compilers, then eleven seconds of deployment that transferred
+ * nothing and restarted nothing.
+ *
+ * `rm -rf dist` stays where it is. `tsc` only writes, it never removes, so a
+ * deleted source leaves its compiled file in `dist` forever — measured on
+ * `@daos/paysys`, 34 migrations in `src` against 40 in `dist`, one of them a
+ * migration whose source had been replaced and which the artifact then ran.
+ * That is also why the question cannot be "is dist newer than src": a
+ * deletion makes nothing newer. It is "is this dist the one these inputs
+ * produce", which is a question about content and is answered by comparing
+ * hashes against what was recorded when that dist was built.
+ *
+ * Every unknown compiles. The cost of compiling again is minutes; the cost
+ * of shipping a dist that these sources did not produce is a node running
+ * code nobody wrote.
+ */
+/** What was true of an application the last time it was compiled. */
+export interface BuildRecord {
+    /** Everything that decides what the compiler emits — see `buildInputsChecksum`. */
+    readonly inputs: string;
+    /** What the `dist` it produced hashed to, so a changed one is not reused. */
+    readonly dist: string;
+}
+export interface BuildQuestion {
+    /** What the last build of this application recorded, or null if nothing did. */
+    readonly recorded: BuildRecord | null;
+    /** What the inputs hash to now, or null when they could not be read. */
+    readonly inputs: string | null;
+    /** What `dist` hashes to now, or null when there is none. */
+    readonly distChecksum: string | null;
+}
+export type BuildDecision = {
+    action: 'build';
+    because: string;
+} | {
+    action: 'reuse';
+    because: string;
+};
+export declare function decideBuild(question: BuildQuestion): BuildDecision;
+/**
+ * Where the record of one application's build is kept.
+ *
+ * Outside the application, because an artifact build runs against a project
+ * that is not omnitron's and leaving files in somebody else's repository is
+ * not ours to do. Named by the directory rather than by the package, so two
+ * checkouts of one project — and two applications called `main` in two
+ * repositories — do not read each other's record.
+ */
+export declare function buildRecordPath(cacheRoot: string, appDir: string): string;
+//# sourceMappingURL=build-decision.d.ts.map

package/dist/project/build-decision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-decision.d.ts","sourceRoot":"","sources":["../../src/project/build-decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,EAAE,WAAW,GAAG,IAAI,CAAC;IACtC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC,wBAAgB,WAAW,CAAC,QAAQ,EAAE,aAAa,GAAG,aAAa,CAiBlE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAIzE"}

package/dist/project/build-decision.js

@@ -0,0 +1,59 @@
+/**
+ * Whether an application has to be compiled again.
+ *
+ * A deployment stops shipping what the node already has. What it did not
+ * stop was producing it: every autostart of the master ran
+ * `rm -rf dist && tsc` for each of six applications, and only afterwards
+ * asked whether the result differed from what the node was running.
+ * Measured on one restart with nothing changed — three minutes thirty-nine
+ * seconds of compilers, then eleven seconds of deployment that transferred
+ * nothing and restarted nothing.
+ *
+ * `rm -rf dist` stays where it is. `tsc` only writes, it never removes, so a
+ * deleted source leaves its compiled file in `dist` forever — measured on
+ * `@daos/paysys`, 34 migrations in `src` against 40 in `dist`, one of them a
+ * migration whose source had been replaced and which the artifact then ran.
+ * That is also why the question cannot be "is dist newer than src": a
+ * deletion makes nothing newer. It is "is this dist the one these inputs
+ * produce", which is a question about content and is answered by comparing
+ * hashes against what was recorded when that dist was built.
+ *
+ * Every unknown compiles. The cost of compiling again is minutes; the cost
+ * of shipping a dist that these sources did not produce is a node running
+ * code nobody wrote.
+ */
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+export function decideBuild(question) {
+    if (!question.inputs) {
+        return { action: 'build', because: 'the build inputs could not be read' };
+    }
+    if (!question.recorded) {
+        return { action: 'build', because: 'nothing records what this dist was built from' };
+    }
+    if (!question.distChecksum) {
+        return { action: 'build', because: 'there is no dist to reuse' };
+    }
+    if (question.recorded.inputs !== question.inputs) {
+        return { action: 'build', because: 'the inputs changed since that dist was built' };
+    }
+    if (question.recorded.dist !== question.distChecksum) {
+        return { action: 'build', because: 'dist is not what that build produced' };
+    }
+    return { action: 'reuse', because: 'dist is what these inputs produce — not compiling it again' };
+}
+/**
+ * Where the record of one application's build is kept.
+ *
+ * Outside the application, because an artifact build runs against a project
+ * that is not omnitron's and leaving files in somebody else's repository is
+ * not ours to do. Named by the directory rather than by the package, so two
+ * checkouts of one project — and two applications called `main` in two
+ * repositories — do not read each other's record.
+ */
+export function buildRecordPath(cacheRoot, appDir) {
+    const resolved = path.resolve(appDir);
+    const key = createHash('sha256').update(resolved).digest('hex').slice(0, 16);
+    return path.join(cacheRoot, `${path.basename(resolved)}-${key}.json`);
+}
+//# sourceMappingURL=build-decision.js.map

package/dist/project/build-decision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-decision.js","sourceRoot":"","sources":["../../src/project/build-decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAuBzC,MAAM,UAAU,WAAW,CAAC,QAAuB;IACjD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;IACnE,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACjD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC;IACtF,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC;QACrD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;IAC9E,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,4DAA4D,EAAE,CAAC;AACpG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,MAAc;IAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,OAAO,CAAC,CAAC;AACxE,CAAC"}

package/dist/project/config-resolver.d.ts

@@ -56,7 +56,10 @@ export interface GenericServiceAddresses {
 export declare function resolveGenericServiceAddresses(normalizedServices: Record<string, IServiceRequirement>, stackConfig: IStackConfig, portAllocation?: StackPortAllocation): GenericServiceAddresses;
 /**
  * Convert resolved config to standardized URL-based environment variables.
- * Produces DATABASE_URL, REDIS_URL, S3_*, JWT_SECRET — no app-specific prefix.
+ * Produces DATABASE_URL, REDIS_URL, S3_* — no app-specific prefix.
+ *
+ * No JWT_SECRET: see `resolveStack` — an address is derived from what the
+ * stack provisions, and an app's signing key is derived from nothing here.
  */
 export declare function resolvedConfigToEnv(config: IResolvedAppConfig, appName: string, stackName: string): Record<string, string>;
 /**
@@ -73,7 +76,7 @@ export declare function resolveServiceSecretsAsync(secrets: Record<string, strin
  *   ${port:name}     — resolved port for named port
  *   ${secret:name}   — resolved secret value
  */
-export declare function resolveCustomServiceEnv(requirement: IServiceRequirement, address: IResolvedServiceAddress): Record<string, string>;
+export declare function resolveCustomServiceEnv(requirement: IServiceRequirement, address: IResolvedServiceAddress, networkMode?: string): Record<string, string>;
 /**
  * Resolve all app configs for a stack deployment.
  *
@@ -90,9 +93,8 @@ export declare function resolveCustomServiceEnv(requirement: IServiceRequirement
  * @param stackConfig - Stack configuration
  * @param appDefinitions - Bootstrap definitions with `requires` fields
  * @param portAllocation - Port allocation for this stack (from StackInfrastructureManager)
- * @param jwtSecret - Shared JWT secret
  */
-export declare function resolveStack(config: IEcosystemConfig, project: string, stackName: StackName, stackConfig: IStackConfig, appDefinitions: Map<string, IAppDefinition>, portAllocation?: StackPortAllocation, jwtSecret?: string, normalizedServices?: Record<string, IServiceRequirement>): ResolvedStack;
+export declare function resolveStack(config: IEcosystemConfig, project: string, stackName: StackName, stackConfig: IStackConfig, appDefinitions: Map<string, IAppDefinition>, portAllocation?: StackPortAllocation, normalizedServices?: Record<string, IServiceRequirement>): ResolvedStack;
 export interface ResolvedStack {
     project: string;
     stack: StackName;

package/dist/project/config-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-resolver.d.ts","sourceRoot":"","sources":["../../src/project/config-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,YAAY,EACZ,SAAS,EAEV,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAMpF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACzE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;IACrE,EAAE,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC5E,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CACtD;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,CAAC,WAAW,EAAE,MAAM,GAAG,uBAAuB,CAAC;CAChD;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,EACvD,WAAW,EAAE,YAAY,EACzB,cAAc,CAAC,EAAE,mBAAmB,GACnC,uBAAuB,CA0BzB;AAMD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAwExB;AAsBD;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,4BAA4B,EAAE,SAAS,CAAC,EAChF,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GACjD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAWjC;AAMD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,mBAAmB,EAChC,OAAO,EAAE,uBAAuB,GAC/B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAoBxB;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,YAAY,EACzB,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,EAC3C,cAAc,CAAC,EAAE,mBAAmB,EACpC,SAAS,CAAC,EAAE,MAAM,EAClB,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,GACvD,aAAa,CA0Pf;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;IACrC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC5C,uBAAuB,EAAE,uBAAuB,CAAC;IACjD,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAClC,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAsJD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GACjD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAoBlC"}
+{"version":3,"file":"config-resolver.d.ts","sourceRoot":"","sources":["../../src/project/config-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,YAAY,EACZ,SAAS,EAEV,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAUpF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACzE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;IACrE,EAAE,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC5E,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CACtD;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,CAAC,WAAW,EAAE,MAAM,GAAG,uBAAuB,CAAC;CAChD;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,EACvD,WAAW,EAAE,YAAY,EACzB,cAAc,CAAC,EAAE,mBAAmB,GACnC,uBAAuB,CA0BzB;AAMD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAoExB;AAsBD;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,4BAA4B,EAAE,SAAS,CAAC,EAChF,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GACjD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAWjC;AAMD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,mBAAmB,EAChC,OAAO,EAAE,uBAAuB,EAChC,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAmCxB;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,YAAY,EACzB,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,EAC3C,cAAc,CAAC,EAAE,mBAAmB,EACpC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,GACvD,aAAa,CAqQf;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;IACrC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC5C,uBAAuB,EAAE,uBAAuB,CAAC;IACjD,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAClC,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAwMD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GACjD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAoBlC"}

package/dist/project/config-resolver.js

@@ -15,6 +15,10 @@
  *   - infra/.env.dev
  *   - Hardcoded localhost:5432 in every app
  */
+import { getEnv } from '../shared/env-config.js';
+import { LOCAL_INFRA_HOST } from '../shared/local-infra-host.js';
+import { bindService } from '../infrastructure/service-binding.js';
+import { gatewayRedisDb } from '../infrastructure/gateway-redis-db.js';
 /**
  * Resolve addresses for all normalized services.
  * Uses StackPortAllocation.servicePorts for port allocation.
@@ -24,8 +28,8 @@
 export function resolveGenericServiceAddresses(normalizedServices, stackConfig, portAllocation) {
     const addresses = {};
     const host = stackConfig.type === 'local'
-        ? 'localhost'
-        : stackConfig.nodes?.[0]?.host ?? 'localhost';
+        ? LOCAL_INFRA_HOST
+        : stackConfig.nodes?.[0]?.host ?? LOCAL_INFRA_HOST;
     for (const [name, svc] of Object.entries(normalizedServices)) {
         // Resolve ports: use stack port allocation if available, else service defaults
         const allocatedPorts = portAllocation?.servicePorts[name];
@@ -49,7 +53,10 @@ export function resolveGenericServiceAddresses(normalizedServices, stackConfig,
 // =============================================================================
 /**
  * Convert resolved config to standardized URL-based environment variables.
- * Produces DATABASE_URL, REDIS_URL, S3_*, JWT_SECRET — no app-specific prefix.
+ * Produces DATABASE_URL, REDIS_URL, S3_* — no app-specific prefix.
+ *
+ * No JWT_SECRET: see `resolveStack` — an address is derived from what the
+ * stack provisions, and an app's signing key is derived from nothing here.
  */
 export function resolvedConfigToEnv(config, appName, stackName) {
     const env = {};
@@ -81,9 +88,6 @@ export function resolvedConfigToEnv(config, appName, stackName) {
         env[`${prefix}_STORAGE__S3__BUCKET`] = config.s3.bucket;
         env[`${prefix}_STORAGE__S3__FORCE_PATH_STYLE`] = 'true';
     }
-    if (config.auth?.jwtSecret) {
-        env['JWT_SECRET'] = config.auth.jwtSecret;
-    }
     // Titan service module Redis URLs
     if (config['discoveryRedis']) {
         const dr = config['discoveryRedis'];
@@ -95,10 +99,10 @@ export function resolvedConfigToEnv(config, appName, stackName) {
         const password = nr.password ? `:${nr.password}@` : '';
         env['NOTIFICATIONS_REDIS_URL'] = `redis://${password}${nr.host}:${nr.port}/${nr.db}`;
     }
-    if (config['priceverseRedis']) {
-        const pr = config['priceverseRedis'];
+    if (config['pricingRedis']) {
+        const pr = config['pricingRedis'];
         const password = pr.password ? `:${pr.password}@` : '';
-        env['PRICEVERSE_REDIS_URL'] = `redis://${password}${pr.host}:${pr.port}/${pr.db}`;
+        env['PRICING_REDIS_URL'] = `redis://${password}${pr.host}:${pr.port}/${pr.db}`;
     }
     // Gateway Redis — main app writes maintenance state to gateway's dedicated Redis DB
     if (config['gatewayRedis']) {
@@ -158,11 +162,25 @@ export async function resolveServiceSecretsAsync(secrets, getSecret) {
  *   ${port:name}     — resolved port for named port
  *   ${secret:name}   — resolved secret value
  */
-export function resolveCustomServiceEnv(requirement, address) {
+export function resolveCustomServiceEnv(requirement, address, networkMode) {
     const env = {};
     for (const [key, template] of Object.entries(requirement.env)) {
         let value = template;
         value = value.replace(/\$\{host\}/g, address.host);
+        // The chain this stack is actually on.
+        //
+        // `networkMode` used to reach only `docker.variants`, so a stack that
+        // redirected an app to an external MAINNET daemon still handed it the
+        // network its own declaration named. Measured on the test node, where
+        // the stack says `mainnet` for both chains:
+        //
+        //     BITCOIN_RPC_URL  http://192.168.100.2:8332   (mainnet)
+        //     BITCOIN_NETWORK  regtest
+        //
+        // An application that believes it is on regtest while talking to mainnet
+        // gets address validation, confirmation depths and fee policy wrong, and
+        // every one of those is somebody's money.
+        value = value.replace(/\$\{network\}/g, networkMode ?? requirement.networkMode ?? '');
         value = value.replace(/\$\{port:(\w[\w-]*)\}/g, (_match, portName) => String(address.ports[portName] ?? requirement.ports[portName] ?? ''));
         value = value.replace(/\$\{secret:(\w[\w-]*)\}/g, (_match, secretName) => address.secrets?.[secretName] ?? '');
         env[key] = value;
@@ -188,9 +206,8 @@ export function resolveCustomServiceEnv(requirement, address) {
  * @param stackConfig - Stack configuration
  * @param appDefinitions - Bootstrap definitions with `requires` fields
  * @param portAllocation - Port allocation for this stack (from StackInfrastructureManager)
- * @param jwtSecret - Shared JWT secret
  */
-export function resolveStack(config, project, stackName, stackConfig, appDefinitions, portAllocation, jwtSecret, normalizedServices) {
+export function resolveStack(config, project, stackName, stackConfig, appDefinitions, portAllocation, normalizedServices) {
     // Determine which apps run in this stack
     const enabledApps = stackConfig.apps === 'all' || !stackConfig.apps
         ? config.apps.filter((a) => a.enabled !== false)
@@ -213,12 +230,23 @@ export function resolveStack(config, project, stackName, stackConfig, appDefinit
     }
     // Allocate Redis DBs with stack offset
     const redisDbOffset = stackConfig.settings?.redisDbOffset ?? portAllocation?.redisDbStart ?? 0;
+    const declaredRedisDbs = stackConfig.infrastructure?.redis?.databases;
     const redisAllocation = useNewPath
-        ? allocateRedisDBs(enabledApps.map((a) => a.name), omnitronConfigs, redisDbOffset)
+        ? allocateRedisDBs(enabledApps.map((a) => a.name), omnitronConfigs, redisDbOffset, declaredRedisDbs)
         : allocateRedisDBsLegacy(enabledApps, appDefinitions, redisDbOffset);
     // Generate per-app resolved config
     const appConfigs = new Map();
-    const sharedJwtSecret = jwtSecret ?? 'dev-omnitron-secret-key-minimum-32-chars-long!!';
+    // No signing key is resolved here. There used to be one — every app was
+    // given `auth.jwtSecret` = a literal written in this file, the same for
+    // every project and every stack, because no caller ever passed its own.
+    // On a laptop the project's own `JWT_SECRET` hid it: a local stack merges
+    // what the project states over what is computed. A node merges the other
+    // way — the master's computed values over the app's declared env, which is
+    // right for an address and was wrong for this — so a deployed stack could
+    // run on a key anyone with this repository can read. An address is derived
+    // from what the stack provisions; a signing key is derived from nothing
+    // here. It belongs to the project (`env`) or to the stack (`settings.env`,
+    // from the vault), and an app that has neither refuses to boot.
     for (const entry of enabledApps) {
         const definition = appDefinitions.get(entry.name);
         const omnitronCfg = omnitronConfigs.get(entry.name);
@@ -260,7 +288,7 @@ export function resolveStack(config, project, stackName, stackConfig, appDefinit
                 const s3Cfg = typeof omnitronCfg.s3 === 'object' ? omnitronCfg.s3 : {};
                 const storageAddr = genericAddresses?.['minio'];
                 const s3Port = storageAddr?.ports['api'] ?? 9000;
-                const s3Host = storageAddr?.host ?? 'localhost';
+                const s3Host = storageAddr?.host ?? LOCAL_INFRA_HOST;
                 resolved.s3 = {
                     endpoint: addresses.s3?.endpoint ?? `http://${s3Host}:${s3Port}`,
                     accessKey: storageAddr?.secrets?.['accessKey'] ?? addresses.s3?.accessKey ?? 'minioadmin',
@@ -269,11 +297,6 @@ export function resolveStack(config, project, stackName, stackConfig, appDefinit
                     forcePathStyle: true,
                 };
             }
-            // Auth — always inject shared JWT secret
-            resolved.auth = {
-                jwtSecret: sharedJwtSecret,
-                algorithm: 'HS256',
-            };
             // Titan service module Redis — discovery
             if (omnitronCfg.services?.discovery) {
                 const discoveryDb = redisAllocation.get(`${entry.name}:discovery`) ?? redisDbOffset;
@@ -294,26 +317,27 @@ export function resolveStack(config, project, stackName, stackConfig, appDefinit
                     password: addresses.redis.password,
                 };
             }
-            // Cross-app Redis — priceverse price data (read-through from paysys/swap)
-            if (omnitronCfg.services?.priceverse) {
-                // Priceverse app's Redis DB — look up from allocation or use known offset
-                const priceverseDb = redisAllocation.get('priceverse') ?? (redisDbOffset + 2);
-                resolved['priceverseRedis'] = {
+            // Cross-app Redis — pricing price data (read-through from payments/swap)
+            if (omnitronCfg.services?.pricing) {
+                // Pricing app's Redis DB — look up from allocation or use known offset
+                const pricingDb = redisAllocation.get('pricing') ?? (redisDbOffset + 2);
+                resolved['pricingRedis'] = {
                     host: addresses.redis.host,
                     port: addresses.redis.port,
-                    db: priceverseDb,
+                    db: pricingDb,
                     password: addresses.redis.password,
                 };
             }
-            // Gateway Redis — main app writes maintenance state to gateway's dedicated Redis DB
-            // DB index is auto-allocated by omnitron (redisDbEnd + 1, after app range)
+            // Gateway Redis — main writes the administrators' maintenance lock into
+            // the gateway's own database. The same number the gateway container is
+            // given (`gateway-redis-db.ts`); this was `redisDbOffset + 5`, which on
+            // daos is geo's database, while a node's gateway read 1, storage's.
             const hasGateway = config.gateway || config.infrastructure?.services?.['gateway'] || normalizedServices?.['gateway'];
             if (entry.name === 'main' && hasGateway) {
-                const gatewayRedisDb = redisDbOffset + 5; // After app DBs (0-4 range)
                 resolved['gatewayRedis'] = {
                     host: addresses.redis.host,
                     port: addresses.redis.port,
-                    db: gatewayRedisDb,
+                    db: gatewayRedisDb(declaredRedisDbs),
                     password: addresses.redis.password,
                 };
             }
@@ -323,32 +347,45 @@ export function resolveStack(config, project, stackName, stackConfig, appDefinit
                     // Check for stack-level override (app-specific or global)
                     const override = stackConfig.serviceOverrides?.[`${entry.name}/${serviceName}`]
                         ?? stackConfig.serviceOverrides?.[serviceName];
-                    if (override?.disabled)
+                    // Where and how the stack runs it, with its own credentials when it
+                    // runs another network than the declaration names (`bindService`).
+                    const binding = bindService(requirement, override);
+                    if (binding.provisioning === 'disabled')
                         continue;
                     let address;
-                    if (override?.external) {
-                        // External service — use provided address directly
+                    if (binding.provisioning === 'external') {
+                        address = {
+                            host: binding.host ?? LOCAL_INFRA_HOST,
+                            ports: binding.ports,
+                            secrets: resolveServiceSecrets(binding.secrets),
+                        };
+                    }
+                    else if (binding.provisioning === 'bareMetal') {
+                        // A system service on the machine the app runs on: loopback — the
+                        // declared RPC binds nothing else — on the ports the stack runs it
+                        // on. This read the declaration, and gave a mainnet node's
+                        // applications the regtest port and the regtest password.
                         address = {
-                            host: override.external.host,
-                            ports: override.external.ports,
-                            secrets: resolveServiceSecrets(override.external.secrets ?? requirement.secrets ?? {}),
+                            host: LOCAL_INFRA_HOST,
+                            ports: binding.ports,
+                            secrets: resolveServiceSecrets(binding.secrets),
                         };
                     }
                     else {
-                        // Docker-provisioned — localhost with mapped ports
+                        // A container — localhost with its published ports.
                         const docker = requirement.docker;
                         const hostPorts = {};
-                        for (const [portName, containerPort] of Object.entries(requirement.ports)) {
+                        for (const [portName, containerPort] of Object.entries(binding.ports)) {
                             hostPorts[portName] = docker?.portMappings?.[portName] ?? containerPort;
                         }
                         address = {
-                            host: 'localhost',
+                            host: LOCAL_INFRA_HOST,
                             ports: hostPorts,
-                            secrets: resolveServiceSecrets(requirement.secrets ?? {}),
+                            secrets: resolveServiceSecrets(binding.secrets),
                         };
                     }
                     // Generate env vars from templates and merge into resolved config
-                    const serviceEnv = resolveCustomServiceEnv(requirement, address);
+                    const serviceEnv = resolveCustomServiceEnv(requirement, address, binding.networkMode);
                     if (!resolved['_customEnv'])
                         resolved['_customEnv'] = {};
                     Object.assign(resolved['_customEnv'], serviceEnv);
@@ -394,12 +431,6 @@ export function resolveStack(config, project, stackName, stackConfig, appDefinit
                 forcePathStyle: true,
             };
         }
-        if (definition?.auth?.jwt?.enabled) {
-            resolved.auth = {
-                jwtSecret: sharedJwtSecret,
-                algorithm: 'HS256',
-            };
-        }
         appConfigs.set(entry.name, resolved);
     }
     return {
@@ -417,6 +448,17 @@ export function resolveStack(config, project, stackName, stackConfig, appDefinit
  */
 function resolveStackAddresses(config, stackConfig, portAllocation) {
     const infra = config.infrastructure;
+    // Default credentials: prefer explicit infra config, then env vars, then insecure hardcoded defaults.
+    // The env-var fallback means production deployments can override without touching config files.
+    const defaultPgPassword = (typeof infra?.postgres?.password === 'string' ? infra.postgres.password : undefined) ??
+        getEnv().POSTGRES_PASSWORD ??
+        'postgres';
+    const defaultMinioAccessKey = infra?.minio?.accessKey ?? process.env['MINIO_ACCESS_KEY'] ?? 'minioadmin';
+    const defaultMinioSecretKey = (typeof infra?.minio?.secretKey === 'string' ? infra.minio.secretKey : undefined) ??
+        process.env['MINIO_SECRET_KEY'] ??
+        'minioadmin';
+    const defaultRedisPassword = (typeof infra?.redis?.password === 'string' ? infra.redis.password : undefined) ??
+        getEnv().REDIS_PASSWORD;
     if (stackConfig.type === 'local') {
         // Local stack: all services on localhost with port allocation (or defaults).
         // S3/MinIO is always assumed available for local stacks (omnitron auto-provisions
@@ -424,29 +466,38 @@ function resolveStackAddresses(config, stackConfig, portAllocation) {
         const minioPort = portAllocation?.minioPort ?? infra?.minio?.ports?.api ?? 9000;
         return {
             postgres: {
-                host: 'localhost',
+                host: LOCAL_INFRA_HOST,
                 port: portAllocation?.postgresPort ?? infra?.postgres?.port ?? 5432,
-                user: infra?.postgres?.user ?? 'postgres',
-                password: typeof infra?.postgres?.password === 'string' ? infra.postgres.password : 'postgres',
+                user: infra?.postgres?.user ?? getEnv().POSTGRES_USER ?? 'postgres',
+                password: defaultPgPassword,
             },
             redis: {
-                host: 'localhost',
+                host: LOCAL_INFRA_HOST,
                 port: portAllocation?.redisPort ?? infra?.redis?.port ?? 6379,
-                password: typeof infra?.redis?.password === 'string' ? infra.redis.password : undefined,
+                password: defaultRedisPassword,
             },
             s3: {
-                endpoint: `http://localhost:${minioPort}`,
-                accessKey: infra?.minio?.accessKey ?? 'minioadmin',
-                secretKey: typeof infra?.minio?.secretKey === 'string' ? infra.minio.secretKey : 'minioadmin',
+                endpoint: `http://${LOCAL_INFRA_HOST}:${minioPort}`,
+                accessKey: defaultMinioAccessKey,
+                secretKey: defaultMinioSecretKey,
             },
         };
     }
     if (stackConfig.type === 'remote' && stackConfig.nodes?.length) {
         const node = stackConfig.nodes[0];
         return {
-            postgres: { host: node.host, port: 5432, user: 'postgres', password: 'postgres' },
-            redis: { host: node.host, port: 6379 },
-            s3: { endpoint: `http://${node.host}:9000`, accessKey: 'minioadmin', secretKey: 'minioadmin' },
+            postgres: {
+                host: node.host,
+                port: 5432,
+                user: getEnv().POSTGRES_USER ?? 'postgres',
+                password: defaultPgPassword,
+            },
+            redis: { host: node.host, port: 6379, password: defaultRedisPassword },
+            s3: {
+                endpoint: `http://${node.host}:9000`,
+                accessKey: defaultMinioAccessKey,
+                secretKey: defaultMinioSecretKey,
+            },
         };
     }
     if (stackConfig.type === 'cluster' && stackConfig.nodes?.length) {
@@ -455,47 +506,76 @@ function resolveStackAddresses(config, stackConfig, portAllocation) {
         const gwNode = stackConfig.nodes.find((n) => n.role === 'gateway');
         return {
             postgres: {
-                host: dbNode?.host ?? 'localhost',
+                host: dbNode?.host ?? LOCAL_INFRA_HOST,
                 port: dbNode?.port ?? 5432,
-                user: 'postgres',
-                password: 'postgres',
+                user: getEnv().POSTGRES_USER ?? 'postgres',
+                password: defaultPgPassword,
             },
             redis: {
-                host: cacheNode?.host ?? 'localhost',
+                host: cacheNode?.host ?? LOCAL_INFRA_HOST,
                 port: cacheNode?.port ?? 6379,
+                password: defaultRedisPassword,
             },
             gateway: gwNode ? { host: gwNode.host, port: gwNode.port ?? 8080 } : undefined,
         };
     }
     // Fallback: localhost
     return {
-        postgres: { host: 'localhost', port: 5432, user: 'postgres', password: 'postgres' },
-        redis: { host: 'localhost', port: 6379 },
+        postgres: {
+            host: LOCAL_INFRA_HOST,
+            port: 5432,
+            user: getEnv().POSTGRES_USER ?? 'postgres',
+            password: defaultPgPassword,
+        },
+        redis: { host: LOCAL_INFRA_HOST, port: 6379, password: defaultRedisPassword },
     };
 }
 /**
  * Allocate Redis DB indexes sequentially from a stack-specific offset.
  * Handles both app-level Redis and Titan service module Redis (discovery, notifications).
  */
-function allocateRedisDBs(apps, omnitronConfigs, offset) {
+function allocateRedisDBs(apps, omnitronConfigs, offset, declared) {
     const allocation = new Map();
-    let nextDb = offset;
-    // App Redis DBs
+    const taken = new Set();
+    // Every key this allocation will contain, in the order it is handed out:
+    // apps first, then the Titan service modules.
+    const keys = [];
     for (const appName of apps) {
-        const config = omnitronConfigs.get(appName);
-        if (config?.redis) {
-            allocation.set(appName, nextDb++);
-        }
+        if (omnitronConfigs.get(appName)?.redis)
+            keys.push(appName);
     }
-    // Titan service module Redis DBs
     for (const appName of apps) {
         const config = omnitronConfigs.get(appName);
-        if (config?.services?.discovery) {
-            allocation.set(`${appName}:discovery`, nextDb++);
-        }
-        if (config?.services?.notifications) {
-            allocation.set(`${appName}:notifications`, nextDb++);
-        }
+        if (config?.services?.discovery)
+            keys.push(`${appName}:discovery`);
+        if (config?.services?.notifications)
+            keys.push(`${appName}:notifications`);
+    }
+    // What the stack states comes first. Until this pass existed, the
+    // `infrastructure.redis.databases` block was written by an operator,
+    // printed back as a count, and never executed — every app was handed the
+    // database its POSITION in the list happened to name. `allocateRedisDBsLegacy`
+    // below honoured an explicit index; this returns the ability to the new path.
+    for (const key of keys) {
+        const stated = declared?.[key];
+        if (stated === undefined)
+            continue;
+        allocation.set(key, stated);
+        taken.add(stated);
+    }
+    // The gateway's database is nobody else's — see `gateway-redis-db.ts`.
+    taken.add(gatewayRedisDb(declared));
+    // The counter fills the rest, stepping over every number already spoken
+    // for — including one stated for a key that comes later in the list.
+    let nextDb = offset;
+    for (const key of keys) {
+        if (allocation.has(key))
+            continue;
+        while (taken.has(nextDb))
+            nextDb++;
+        allocation.set(key, nextDb);
+        taken.add(nextDb);
+        nextDb++;
     }
     return allocation;
 }