@geekmidas/cli 10.0.0-alpha.73 → 10.0.0-alpha.75

package/dist/{compose-9II-0IsK.mjs → compose-DdH2JQJD.mjs}

@@ -4,13 +4,14 @@ import { r as discover } from "./discover-BPelzeGW.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
 import { M as LOGS_PORT, N as resolveLogs } from "./workspace-C7NqCsQF.mjs";
 import { t as defineTarget } from "./define-DR8xGYfL.mjs";
-import { $ as constructGlobs, C as validateImageRef, Ct as composeBuildPaths, D as isOtlpDestination, E as resolveHost, Et as WORKER_PORT, F as devServicesUsed, H as workerUnits, It as portKeys, Lt as primaryPortKey, Nt as DEFAULT_IMAGES, O as otelEnv, Ot as findBuildRoot, P as assertExternalServices, St as hostFor, T as isMainFrontendApp, Tt as TURBO_VERSION, U as encryptSecrets, V as suppliedOnly, _t as workerEnvKeys, a as recordRelease, at as applyBuckets, b as ensureDockerignore, bt as planFor, ct as bucketPolicies, ft as composeFor, g as credentialsFileContent, gt as networkEnv, h as credentialsBuildArg, ht as appEnvKeys, m as withGeneratedSecrets, mt as pgClient, nn as imageRef, ot as applyPolicies, p as DeployJournal, pt as bucketClient, sn as initStageSecrets, st as applyPostgres, t as createEmptyState, ut as postgresStatements, v as appDockerfile, vt as envFor, w as NoDomainForStage, wt as imageLayout, x as workerDockerfile, yt as localRolePassword, z as reportDevServices } from "./state-DtS2HEfi.mjs";
-import { i as DEFAULT_EVENTS, r as DEFAULT_CACHE } from "./SubscriberGenerator-DZk_pKDh.mjs";
+import { $t as imageRef, At as DEFAULT_IMAGES, B as suppliedOnly, C as NoDomainForStage, Ct as WORKER_PORT, D as otelEnv, E as isOtlpDestination, N as assertExternalServices, Nt as portKeys, P as devServicesUsed, Pt as primaryPortKey, R as reportDevServices, S as validateImageRef, St as TURBO_VERSION, T as resolveHost, Tt as findBuildRoot, V as workerUnits, Y as constructGlobs, _ as appDockerfile, _t as planFor, a as recordRelease, b as workerDockerfile, bt as composeBuildPaths, ct as composeFor, dt as appEnvKeys, gt as localRolePassword, ht as envFor, in as initStageSecrets, it as bucketPolicies, lt as bucketClient, m as withGeneratedSecrets, mt as workerEnvKeys, nt as applyPolicies, ot as postgresStatements, p as DeployJournal, pt as networkEnv, rt as applyPostgres, t as createEmptyState, tt as applyBuckets, ut as pgClient, w as isMainFrontendApp, xt as imageLayout, y as ensureDockerignore, yt as hostFor } from "./state-BrWIOce_.mjs";
+import { i as DEFAULT_EVENTS } from "./SubscriberGenerator-5looQ3gB.mjs";
+import { i as installedFrom } from "./drivers-Ch1rJitn.mjs";
 import { u as migrateDatabases } from "./databases-hUHTuwhx.mjs";
 import { n as assertStageCredentials } from "./credentialSchemas-BJqRJNK4.mjs";
 import { dirname, join } from "node:path";
 import { existsSync } from "node:fs";
-import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { chmod, mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { hostname, userInfo } from "node:os";
 import { provideKey, provisionOrder, publicEnvFor } from "@geekmidas/manifest";
 import { spawn } from "node:child_process";
@@ -63,6 +64,33 @@ var ServicePortUnknown = class extends Error {
 		this.name = "ServicePortUnknown";
 	}
 };
+/**
+* Whether `ref` names a registry on this machine's loopback — which the
+* daemon pulls from and pushes to over plain HTTP by default, and `docker
+* manifest inspect` reaches only when told `--insecure` (without it, a local
+* registry's image is reported as no such manifest).
+*/
+function isLoopbackRegistry(ref) {
+	const first = ref.split("/")[0];
+	if (!ref.includes("/") || !/[.:]|^localhost$/.test(first)) return false;
+	const host = first.replace(/:\d+$/, "");
+	return host === "localhost" || /^127(?:\.\d{1,3}){3}$/.test(host);
+}
+/** `docker push` finished without saying what digest the registry stored. */
+var PushDigestUnknown = class extends Error {
+	ref;
+	output;
+	constructor(ref, output) {
+		super(`Pushed ${ref}, but docker did not say which digest the registry stored (it said: ${output.trim().split("\n").slice(-3).join(" / ") || "nothing"}). Check the push with \`docker buildx imagetools inspect ${ref}\`.`);
+		this.ref = ref;
+		this.output = output;
+		this.name = "PushDigestUnknown";
+	}
+};
+/** The digest `docker push` reports last: `<tag>: digest: sha256:… size: …`. */
+function pushedDigest(output) {
+	return [...output.matchAll(/digest: (sha256:[0-9a-f]{64})/g)].at(-1)?.[1];
+}
 function compose(stack, args) {
 	return [
 		"compose",
@@ -126,6 +154,7 @@ const dockerCompose = {
 		const { code, stdout, stderr } = await capture("docker", [
 			"manifest",
 			"inspect",
+			...isLoopbackRegistry(ref) ? ["--insecure"] : [],
 			ref
 		]);
 		if (code === 0) return {
@@ -195,6 +224,15 @@ const dockerCompose = {
 			to
 		]), runOptions(stack));
 	},
+	async push(stack, ref) {
+		const output = await runOutput("docker", ["push", ref], {
+			cwd: stack.cwd,
+			...stack.signal ? { signal: stack.signal } : {}
+		});
+		const digest = pushedDigest(output);
+		if (!digest) throw new PushDigestUnknown(ref, output);
+		return digest;
+	},
 	async digest(ref) {
 		const { code, stdout } = await capture("docker", [
 			"image",
@@ -265,6 +303,92 @@ async function assertImagesExist(docker, tag, images) {
 	const missing = lookups.filter((lookup) => lookup.status === "missing").map((lookup) => lookup.ref);
 	if (missing.length > 0) throw new ImageTagNotFound(tag, missing);
 }
+/**
+* A push or a pull with no `deploy.registry` to push to or pull from.
+*
+* Without one an image is named `<namespace>/<project>-<app>:<tag>`, which
+* Docker resolves to Docker Hub — so a release would be pushed to, or pulled
+* from, somebody else's account. It is never a fallback.
+*/
+var RegistryRequired = class extends Error {
+	operation;
+	ref;
+	constructor(operation, ref) {
+		super(`${operation === "push" ? "Pushing" : "Pulling"} images needs a registry, and gkm.config.ts sets no deploy.registry: '${ref}' would be ${operation === "push" ? "pushed to" : "pulled from"} Docker Hub. Set deploy.registry (e.g. registry: 'ghcr.io/acme') in gkm.config.ts.` + (operation === "pull" ? " To run images built here instead, pass --build." : ""));
+		this.operation = operation;
+		this.ref = ref;
+		this.name = "RegistryRequired";
+	}
+};
+/** An image pinned to its digest: `<ref>@sha256:…`. */
+function pinnedRef(ref, digest) {
+	return `${ref.split("@")[0]}@${digest}`;
+}
+/** A digests file with no entry for an app the stack runs. */
+var ImageDigestMissing = class extends Error {
+	file;
+	apps;
+	constructor(file, apps) {
+		super(`${file} pins no digest for ${apps.join(", ")}. Use the file the same release's \`gkm compose --build --push --digests-file\` wrote, or run without --digests-file to pull by tag.`);
+		this.file = file;
+		this.apps = apps;
+		this.name = "ImageDigestMissing";
+	}
+};
+/** A digests file entry that is not this app's image. */
+var ImageDigestMismatch = class extends Error {
+	app;
+	expected;
+	found;
+	constructor(app, expected, found) {
+		super(`The digests file pins '${app}' to ${found}, but this release runs ${expected}. It was written for another registry, project, stage or tag; use the file this stage's push of this tag wrote.`);
+		this.app = app;
+		this.expected = expected;
+		this.found = found;
+		this.name = "ImageDigestMismatch";
+	}
+};
+/** A digests file that is not a JSON object of app to pinned ref. */
+var ImageDigestsInvalid = class extends Error {
+	file;
+	detail;
+	constructor(file, detail) {
+		super(`${file} is not a digests file (${detail}). It should be the JSON object \`gkm compose --build --push --digests-file\` writes: { "api": "<registry>/<image>:<tag>@sha256:…" }.`);
+		this.file = file;
+		this.detail = detail;
+		this.name = "ImageDigestsInvalid";
+	}
+};
+/** Parse a digests file's content, checking its shape. */
+function parseDigests(file, content) {
+	let parsed;
+	try {
+		parsed = JSON.parse(content);
+	} catch (error) {
+		throw new ImageDigestsInvalid(file, error instanceof Error ? error.message : String(error));
+	}
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new ImageDigestsInvalid(file, "not a JSON object");
+	for (const [app, value] of Object.entries(parsed)) if (typeof value !== "string" || !/@sha256:[0-9a-f]{64}$/.test(value)) throw new ImageDigestsInvalid(file, `'${app}' is not an <image>:<tag>@sha256:… ref`);
+	return parsed;
+}
+/**
+* Each image pinned to the digest the file names for it.
+*
+* @throws {ImageDigestMissing} naming every app the file has no entry for
+* @throws {ImageDigestMismatch} when an entry is another image or tag
+*/
+function pinImages(file, digests, images) {
+	const missing = images.filter((image) => !digests[image.app]).map((image) => image.app);
+	if (missing.length > 0) throw new ImageDigestMissing(file, missing);
+	return images.map((image) => {
+		const pinned = digests[image.app];
+		if (pinned.split("@")[0] !== image.ref) throw new ImageDigestMismatch(image.app, image.ref, pinned);
+		return {
+			...image,
+			ref: pinned
+		};
+	});
+}
 //#endregion
 //#region src/compose/logs.ts
 /**
@@ -444,6 +568,152 @@ function logsAccess(logs, ctx) {
 	];
 }
 //#endregion
+//#region src/compose/redis.ts
+/**
+* The stack's Redis: what every declared cache lives in when a workspace runs
+* as a `gkm compose` stack, on the local stage and on a deployed one alike.
+*
+* A cache is the one store whose contents can always be rebuilt, so unlike
+* Mailpit and MinIO it is a production service, not a dev stand-in: it runs
+* for every stage, on the compose network only, with nothing published. It
+* is bounded (`maxmemory`, evicting the least recently used key), persisted
+* (an append-only file on a named volume, kept by `--down`) and password
+* protected — the stage's own password, generated once like its seed.
+*
+* A stage that sets a cache's URL in its secrets — a managed Redis — keeps
+* it, and a stack whose every cache is set that way runs no Redis at all.
+*
+* Pure: the stack decides it, and the phases keep the password.
+*/
+/**
+* Where a stack's caches live: its own Redis, whatever the deploy target's
+* default is. A stack is one machine running containers, and a Redis beside
+* the apps is cheaper for a cache than a table in the database they share.
+*/
+const STACK_CACHE = "redis";
+/** Its compose service name — the host every cache URL points at. */
+const REDIS_SERVICE = "redis";
+/** The port it answers on, inside the network. */
+const REDIS_PORT = 6379;
+/** Reconcile's pin, so `gkm dev` and the stack run one Redis. */
+const REDIS_IMAGE = DEFAULT_IMAGES.redis;
+/**
+* How much it may hold before it evicts. A cache that grows until the box
+* runs out of memory takes the apps with it; 256 MB is a lot of sessions and
+* little of a small server. A project's `docker-compose.<stage>.yml` can
+* replace the command to change it.
+*/
+const REDIS_MAXMEMORY = "256mb";
+/** The stage secret holding its password. */
+const REDIS_PASSWORD_KEY = "REDIS_PASSWORD";
+/** Redis's own count of logical databases, before `--databases` raises it. */
+const REDIS_DATABASES = 16;
+/** A deployed stage that runs the stack's Redis and has no password yet. */
+var RedisPasswordMissing = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`The stage '${stage}' runs the stack's Redis and has no ${REDIS_PASSWORD_KEY} in its secrets. Run gkm compose --stage ${stage} without --dry-run once to generate it, or set one: gkm secrets:set ${REDIS_PASSWORD_KEY} '…' --stage ${stage}`);
+		this.stage = stage;
+		this.name = "RedisPasswordMissing";
+	}
+};
+/**
+* Whether a stage's stack runs Redis: a cache is declared and the stage's
+* secrets do not set the URL of every one.
+*/
+function runsRedis(manifest, custom) {
+	return Object.values(manifest).some((declaration) => declaration?.kind === "cache" && (declaration.provides ?? []).some((key) => custom[key] === void 0));
+}
+/** A password: 256 random bits, URL-safe, so it sits in a URL unescaped. */
+function generateRedisPassword() {
+	return randomBytes(32).toString("base64url");
+}
+/**
+* The stage's secrets with a generated Redis password, where it has none.
+* Pure, like `withGeneratedSecrets`: the caller keeps the result once the run
+* goes ahead.
+*/
+function withRedisPassword(secrets) {
+	if (secrets.custom?.["REDIS_PASSWORD"]) return {
+		secrets,
+		generated: []
+	};
+	return {
+		secrets: {
+			...secrets,
+			custom: {
+				...secrets.custom,
+				[REDIS_PASSWORD_KEY]: generateRedisPassword()
+			},
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		},
+		generated: [REDIS_PASSWORD_KEY]
+	};
+}
+/**
+* The stack's Redis for one stage, or nothing where no cache needs it.
+*
+* Each cache it holds gets a logical database of its own, by the order of
+* their ids, so two caches never read each other's keys.
+*/
+function stackRedis(options) {
+	const { plan, stage, local, custom } = options;
+	const caches = plan.resources.filter((r) => r.kind === "cache" && custom[r.envKey] === void 0).sort((a, b) => a.id.localeCompare(b.id));
+	if (caches.length === 0) return void 0;
+	const set = custom[REDIS_PASSWORD_KEY];
+	if (!set && !local) throw new RedisPasswordMissing(stage);
+	const password = set ?? "geekmidas";
+	const auth = encodeURIComponent(password);
+	return {
+		password,
+		passwordFromSecrets: Boolean(set),
+		urls: Object.fromEntries(caches.map((cache, index) => [cache.envKey, `redis://:${auth}@${REDIS_SERVICE}:${REDIS_PORT}/${index}`])),
+		env: {
+			[REDIS_PASSWORD_KEY]: password,
+			REDISCLI_AUTH: password
+		},
+		databases: Math.max(REDIS_DATABASES, caches.length)
+	};
+}
+/**
+* Redis's service: bounded, persisted and password protected, on the
+* network alone.
+*
+* The command runs the image's own entrypoint with `redis-server` first, so
+* it still drops to the `redis` user and owns `/data`; the password is read
+* from the env file by the shell (`$$` is compose's escape for `$`), so
+* neither the compose file nor the container's command holds it.
+*/
+function redisService(redis) {
+	const flags = [
+		`--requirepass "$$${REDIS_PASSWORD_KEY}"`,
+		`--maxmemory ${REDIS_MAXMEMORY}`,
+		"--maxmemory-policy allkeys-lru",
+		"--appendonly yes",
+		...redis.databases > REDIS_DATABASES ? [`--databases ${redis.databases}`] : []
+	];
+	return {
+		image: REDIS_IMAGE,
+		restart: "unless-stopped",
+		command: [
+			"sh",
+			"-c",
+			`exec docker-entrypoint.sh redis-server ${flags.join(" ")}`
+		],
+		env_file: [{
+			path: `./${REDIS_SERVICE}.env`,
+			format: "raw"
+		}],
+		volumes: ["redis-data:/data"],
+		healthcheck: {
+			test: ["CMD-SHELL", "redis-cli ping | grep -q PONG"],
+			interval: "5s",
+			timeout: "3s",
+			retries: 10
+		}
+	};
+}
+//#endregion
 //#region src/compose/caddyfile.ts
 /** The Caddyfile for a stack's edge. */
 function edgeCaddyfile(sites, options) {
@@ -640,7 +910,7 @@ function composeStack(input) {
 	const plan = planFor(manifest, stage, provisionOrder(manifest), {
 		localStage: workspace.stages.local,
 		events: DEFAULT_EVENTS.server,
-		cache: DEFAULT_CACHE.server,
+		cache: STACK_CACHE,
 		edge: false
 	});
 	const byId = new Map(plan.resources.map((r) => [r.id, r]));
@@ -700,7 +970,13 @@ function composeStack(input) {
 		allow: input.allowDevServices ?? [],
 		...domain ? { domain } : {}
 	});
-	const infra = [...plan.containers.filter((c) => !NOT_RUN[c]).filter((c) => c !== "minio" || services.minio.length > 0).filter((c) => c !== "mailpit" || services.mailpit.length > 0), ...logs ? [LOGS_SERVICE] : []].sort();
+	const redis = stackRedis({
+		plan,
+		stage,
+		local,
+		custom
+	});
+	const infra = [...plan.containers.filter((c) => !NOT_RUN[c]).filter((c) => c !== "minio" || services.minio.length > 0).filter((c) => c !== "mailpit" || services.mailpit.length > 0).filter((c) => c !== "redis" || redis !== void 0), ...logs ? [LOGS_SERVICE] : []].sort();
 	const storage = infra.includes("minio") ? (() => {
 		const buckets = services.minio.map((id) => byId.get(id)?.name).filter((name) => Boolean(name)).sort();
 		return {
@@ -764,6 +1040,7 @@ function composeStack(input) {
 			return value;
 		}
 		if (custom[key] !== void 0) return custom[key];
+		if (owner?.kind === "cache") return redis?.urls[key];
 		const surface = surfaceUrls.get(key);
 		if (app.kind === "rest-api" && surface && surface !== app.id) return inside[key];
 		return outside[key];
@@ -796,6 +1073,7 @@ function composeStack(input) {
 			if (app.build && Object.keys(args).length > 0) app.build.args = args;
 			continue;
 		}
+		if (input.buildOnly) continue;
 		const keys = appEnvKeys(manifest, app.name, input.runnables) ?? /* @__PURE__ */ new Set();
 		const values = valuesFor(app, keys);
 		const trusted = provideKey(app.id, "trustedOrigins");
@@ -816,7 +1094,7 @@ function composeStack(input) {
 		};
 		for (const [key, value] of Object.entries(app.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(app.name, key);
 	}
-	for (const worker of workers) {
+	for (const worker of input.buildOnly ? [] : workers) {
 		const keys = workerEnvKeys(manifest, worker.id, input.runnables) ?? /* @__PURE__ */ new Set();
 		worker.env = {
 			...valuesFor({
@@ -844,11 +1122,13 @@ function composeStack(input) {
 		master: credential.master,
 		...storage ? { storage } : {},
 		...logs ? { logs } : {},
+		...redis ? { redis } : {},
 		https,
 		http,
 		composeDir: join(workspace.root, stackDir(stage)),
 		buildRoot: layout.buildRoot,
-		workspaceRoot: workspace.root
+		workspaceRoot: workspace.root,
+		envFiles: !input.buildOnly
 	});
 	const caddyfile = edgeCaddyfile([
 		...apps.map((app) => ({
@@ -868,7 +1148,8 @@ function composeStack(input) {
 		dockerfiles[app.build.dockerfile] = appDockerfile(app.name, workspace.apps[app.name], {
 			layout,
 			workspaceRoot: workspace.root,
-			manifest
+			manifest,
+			cache: STACK_CACHE
 		});
 	}
 	for (const worker of workers) {
@@ -879,7 +1160,8 @@ function composeStack(input) {
 			app: worker.host
 		}, workspace.apps[worker.host], {
 			layout,
-			workspaceRoot: workspace.root
+			workspaceRoot: workspace.root,
+			cache: STACK_CACHE
 		});
 	}
 	return {
@@ -896,7 +1178,8 @@ function composeStack(input) {
 		credential,
 		...storage ? { storage } : {},
 		devServices: local ? [] : devServicesUsed(services),
-		...logs ? { logs } : {}
+		...logs ? { logs } : {},
+		...redis ? { redis } : {}
 	};
 }
 /**
@@ -1036,6 +1319,7 @@ function stackFile(options) {
 		};
 		minio.ports = ["127.0.0.1::9000"];
 	}
+	if (services["redis"] && options.redis) services[REDIS_SERVICE] = redisService(options.redis);
 	if (options.logs) services[LOGS_SERVICE] = logsService(options.logs);
 	for (const app of apps) services[app.name] = {
 		image: app.ref,
@@ -1095,10 +1379,13 @@ function stackFile(options) {
 			retries: 5
 		}
 	};
-	for (const service of Object.values(services)) service.logging = {
-		driver: LOG_ROTATION.driver,
-		options: { ...LOG_ROTATION.options }
-	};
+	for (const service of Object.values(services)) {
+		if (!options.envFiles) delete service.env_file;
+		service.logging = {
+			driver: LOG_ROTATION.driver,
+			options: { ...LOG_ROTATION.options }
+		};
+	}
 	return {
 		name: project,
 		services,
@@ -1121,93 +1408,6 @@ function defaultLayout(root) {
 		gkmPaths: ["gkm.config.*"]
 	};
 }
-/** The id the stack's compose file names an app's build credentials by. */
-function credentialsSecret(app) {
-	return `${app}_credentials`;
-}
-/** The file beside the compose file an app's build credentials are read from. */
-function credentialsFile(app) {
-	return `${app}.credentials`;
-}
-/**
-* The stack with each backend's image built with its encrypted credentials:
-* a BuildKit secret per app — the file `credentialsFile` names, mounted as
-* `gkm_credentials` — and the hash naming them as a build arg, so a new key
-* rebuilds the layer that embeds them. Each backend's env file gains the
-* `GKM_MASTER_KEY` that decrypts them, the way a Dokploy deploy injects it.
-*
-* Pure: the caller encrypted them.
-*/
-function withBuildCredentials(stack, credentials) {
-	const services = { ...stack.compose.services };
-	const secrets = { ...stack.compose.secrets };
-	const apps = stack.apps.map((app) => {
-		const own = credentials[app.name];
-		const service = services[app.name];
-		if (!own || !service?.build) return app;
-		const [key, value] = own.buildArg.split("=");
-		services[app.name] = {
-			...service,
-			build: {
-				...service.build,
-				args: {
-					...service.build.args,
-					[key]: value
-				},
-				secrets: [{
-					source: credentialsSecret(app.name),
-					target: "gkm_credentials"
-				}]
-			}
-		};
-		secrets[credentialsSecret(app.name)] = { file: `./${credentialsFile(app.name)}` };
-		return {
-			...app,
-			env: {
-				...app.env,
-				GKM_MASTER_KEY: own.masterKey
-			}
-		};
-	});
-	const workers = stack.workers.map((worker) => {
-		const own = credentials[worker.name];
-		const service = services[worker.name];
-		if (!own || !service?.build) return worker;
-		const [key, value] = own.buildArg.split("=");
-		services[worker.name] = {
-			...service,
-			build: {
-				...service.build,
-				args: {
-					...service.build.args,
-					[key]: value
-				},
-				secrets: [{
-					source: credentialsSecret(worker.name),
-					target: "gkm_credentials"
-				}]
-			}
-		};
-		secrets[credentialsSecret(worker.name)] = { file: `./${credentialsFile(worker.name)}` };
-		return {
-			...worker,
-			env: {
-				...worker.env,
-				GKM_MASTER_KEY: own.masterKey
-			}
-		};
-	});
-	return {
-		...stack,
-		apps,
-		workers,
-		compose: {
-			...stack.compose,
-			services,
-			...Object.keys(secrets).length ? { secrets } : {}
-		}
-	};
-}
 /** Render an app's env file: one `KEY=value` per line, read raw by compose. */
 function envFile(env) {
 	return `${Object.entries(env).sort(([a], [b]) => a.localeCompare(b)).map(([key, value]) => `${key}=${value}`).join("\n")}\n`;
@@ -1303,6 +1503,20 @@ var ComposeAppsUnhealthy = class extends Error {
 * injected, so the rules are asserted without a daemon; the defaults are the
 * real ones.
 */
+/** `--push` without `--build`: there is nothing built here to push. */
+var ComposePushNeedsBuild = class extends Error {
+	constructor() {
+		super("--push pushes the images this checkout builds, so it needs --build (and never --pull): gkm compose --stage <stage> --build --push --tag <tag>.");
+		this.name = "ComposePushNeedsBuild";
+	}
+};
+/** Digests to run by, on a run that pulls nothing. */
+var ComposePinNeedsPull = class extends Error {
+	constructor() {
+		super("--digests-file pins the images a release pulls, so it needs --tag (or --pull) — or, with --build --push, it is where the pushed digests are written.");
+		this.name = "ComposePinNeedsPull";
+	}
+};
 /** A port variable that does not hold a port. */
 var EdgePortInvalid = class extends Error {
 	variable;
@@ -1381,10 +1595,15 @@ const defaultDeps = {
 * every image it names exists. Nothing is written: a missing image stops the
 * run here, before a file, a secret or a container is touched.
 */
-async function validateCompose(ctx, deps, forced) {
+async function validateCompose(ctx, deps, options = {}) {
 	const { workspace, stage, identity, tag } = ctx;
 	const root = workspace.root;
-	const mode = forced ?? (ctx.tagGiven ? "pull" : "build");
+	const mode = options.mode ?? (ctx.tagGiven ? "pull" : "build");
+	const push = options.push === true;
+	if (push && mode !== "build") throw new ComposePushNeedsBuild();
+	if (options.pin && mode !== "pull") throw new ComposePinNeedsPull();
+	const registry = workspace.deploy?.registry;
+	if (!registry && (push || mode === "pull")) throw new RegistryRequired(push ? "push" : "pull", imageRef(identity, ctx.apps[0] ?? workspace.name, void 0, tag));
 	const runnables = {};
 	const background = {};
 	const manifest = await discover({
@@ -1394,14 +1613,13 @@ async function validateCompose(ctx, deps, forced) {
 		background
 	});
 	const { secrets, generated } = await stageSecrets(ctx, manifest);
-	await assertStageCredentials({
+	if (!push) await assertStageCredentials({
 		root,
 		patterns: constructGlobs(workspace),
 		manifest,
 		stage,
 		supplied: secrets?.custom ?? {}
 	});
-	const masterKeys = {};
 	const layout = mode === "build" ? imageLayout(workspace) : void 0;
 	const composed = composeStack({
 		workspace,
@@ -1413,51 +1631,19 @@ async function validateCompose(ctx, deps, forced) {
 		images: {
 			mode,
 			tag,
-			...workspace.deploy?.registry ? { registry: workspace.deploy.registry } : {}
+			...registry ? { registry } : {}
 		},
 		secrets,
 		allowDevServices: ctx.allowDevServices,
 		ports: edgePorts(deps.env),
-		...layout ? { layout } : {}
+		...layout ? { layout } : {},
+		...push ? { buildOnly: true } : {}
 	});
 	reportDevServices(ctx, composed.devServices);
-	const credentials = {};
-	if (mode === "build") {
-		for (const app of composed.apps) {
-			if (app.kind !== "rest-api" || !app.env || !app.build) continue;
-			const { encrypted, iv, masterKey } = encryptSecrets(app.env);
-			credentials[app.name] = {
-				encrypted,
-				iv
-			};
-			ctx.secrets.mask(masterKey);
-			masterKeys[app.name] = {
-				masterKey,
-				buildArg: credentialsBuildArg({
-					encrypted,
-					iv
-				})
-			};
-		}
-		for (const worker of composed.workers) {
-			if (!worker.env || !worker.build) continue;
-			const { encrypted, iv, masterKey } = encryptSecrets(worker.env);
-			credentials[worker.name] = {
-				encrypted,
-				iv
-			};
-			ctx.secrets.mask(masterKey);
-			masterKeys[worker.name] = {
-				masterKey,
-				buildArg: credentialsBuildArg({
-					encrypted,
-					iv
-				})
-			};
-		}
-	}
-	const stack = withBuildCredentials(composed, masterKeys);
+	if (mode === "build") assertRedisClient(workspace, composed);
+	const stack = options.pin ? withPinnedImages(composed, options.pin.file, options.pin.digests) : composed;
 	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, [...stack.apps, ...stack.workers]);
+	if (stack.redis && !stack.local) ctx.secrets.mask(stack.redis.password);
 	if (stack.logs && (!stack.local || stack.logs.passwordFromSecrets)) {
 		ctx.secrets.mask(stack.logs.password);
 		ctx.secrets.mask(stack.logs.appEnv.OTEL_EXPORTER_OTLP_HEADERS);
@@ -1466,7 +1652,8 @@ async function validateCompose(ctx, deps, forced) {
 	const override = stackOverrideFile(root, stage);
 	const overrides = existsSync(override) ? [override] : [];
 	if (overrides.length > 0) ctx.logger.info(`🧩 Merging docker-compose.${stage}.yml over the generated stack`);
-	const previous = Object.fromEntries(Object.entries((await ctx.state.read(stage))?.state.releases ?? {}).map(([name, releases]) => {
+	const recorded = push ? void 0 : await ctx.state.read(stage);
+	const previous = Object.fromEntries(Object.entries(recorded?.state.releases ?? {}).map(([name, releases]) => {
 		const { ref, tag, digest } = releases.current;
 		return [name, {
 			ref,
@@ -1476,6 +1663,7 @@ async function validateCompose(ctx, deps, forced) {
 	}));
 	return {
 		mode,
+		push,
 		stack,
 		dir,
 		ref: {
@@ -1490,11 +1678,32 @@ async function validateCompose(ctx, deps, forced) {
 		generated,
 		previous,
 		files: [],
-		credentials,
 		images: {},
 		changes: []
 	};
 }
+/** A stack whose caches are in Redis, built for an app that has no client. */
+var RedisClientMissing = class extends Error {
+	apps;
+	constructor(apps) {
+		super(`The stack keeps every cache in Redis, and ${apps.join(", ")} ${apps.length === 1 ? "does" : "do"} not depend on ioredis, the client the generated server reaches it with. Add it to the workspace: pnpm add ioredis`);
+		this.apps = apps;
+		this.name = "RedisClientMissing";
+	}
+};
+/**
+* Every backend and worker image built for a stack with a cache can resolve
+* `ioredis` — listed by its app or a directory above it, the way Node and
+* the image's install find it.
+*/
+function assertRedisClient(workspace, stack) {
+	if (!stack.plan.resources.some((r) => r.kind === "cache")) return;
+	const missing = [.../* @__PURE__ */ new Set([...stack.apps.filter((app) => app.kind === "rest-api").map((a) => a.name), ...stack.workers.map((worker) => worker.host)])].filter((name) => {
+		const app = workspace.apps[name];
+		return app && !installedFrom(join(workspace.root, app.path), "ioredis");
+	}).sort();
+	if (missing.length > 0) throw new RedisClientMissing(missing);
+}
 /**
 * The stage's secrets — and, for a deployed stage, everything it generates
 * once: its seed, and each declared secret and keyring. Kept only once the
@@ -1512,8 +1721,16 @@ async function stageSecrets(ctx, manifest) {
 		secrets: withSeed.secrets,
 		generated: []
 	};
-	const secrets = withLogs.secrets;
-	const generated = [...withSeed.generated, ...withLogs.generated];
+	const withRedis = runsRedis(manifest, withLogs.secrets.custom ?? {}) ? withRedisPassword(withLogs.secrets) : {
+		secrets: withLogs.secrets,
+		generated: []
+	};
+	const secrets = withRedis.secrets;
+	const generated = [
+		...withSeed.generated,
+		...withLogs.generated,
+		...withRedis.generated
+	];
 	if (secrets.seed) ctx.secrets.mask(secrets.seed);
 	for (const value of Object.values(secrets.custom ?? {})) ctx.secrets.mask(value);
 	return {
@@ -1522,13 +1739,36 @@ async function stageSecrets(ctx, manifest) {
 	};
 }
 /**
+* The stack with each app's and worker's image pinned to the digest the file
+* names: the refs it is checked, pulled and recorded by, and the image each
+* compose service runs.
+*/
+function withPinnedImages(stack, file, digests) {
+	const apps = pinImages(file, digests, stack.apps);
+	const workers = pinImages(file, digests, stack.workers);
+	const services = { ...stack.compose.services };
+	for (const image of [...apps, ...workers]) services[image.name] = {
+		...services[image.name],
+		image: image.ref
+	};
+	return {
+		...stack,
+		apps,
+		workers,
+		compose: {
+			...stack.compose,
+			services
+		}
+	};
+}
+/**
 * A dry run: the stack's files, written so they can be read, and what a real
 * run would do — no image is built or pulled, no container touched, nothing
 * recorded and no secret kept.
 */
 async function planCompose(ctx, run) {
 	if (run.generated.length > 0) ctx.logger.info(`🔑 "${ctx.stage}" has no ${run.generated.join(", ")} yet; this dry run used values it did not keep.`);
-	run.files = await writeStack(ctx.cwd, run.dir, run.stack, run.credentials);
+	run.files = await writeStack(ctx.cwd, run.dir, run.stack);
 	printPlan(ctx, run);
 	const planned = (change) => {
 		run.changes.push(change);
@@ -1537,7 +1777,7 @@ async function planCompose(ctx, run) {
 			...change
 		});
 	};
-	for (const service of run.stack.infra) planned({
+	for (const service of run.push ? [] : run.stack.infra) planned({
 		key: `service:${service}`,
 		resourceType: "service",
 		action: "ensure"
@@ -1549,6 +1789,7 @@ async function planCompose(ctx, run) {
 			action: run.mode === "build" ? "build" : "reuse",
 			id: app.ref
 		});
+		if (run.push) continue;
 		planned({
 			key: `service:${app.name}`,
 			resourceType: "service",
@@ -1562,13 +1803,14 @@ async function planCompose(ctx, run) {
 			action: run.mode === "build" ? "build" : "reuse",
 			id: worker.ref
 		});
+		if (run.push) continue;
 		planned({
 			key: `service:${worker.name}`,
 			resourceType: "service",
 			action: run.previous[worker.name] ? "reuse" : "create"
 		});
 	}
-	planned({
+	if (!run.push) planned({
 		key: "service:caddy",
 		resourceType: "service",
 		action: "ensure"
@@ -1581,11 +1823,12 @@ async function planCompose(ctx, run) {
 */
 async function provisionCompose(ctx, run, deps) {
 	const { stack, ref } = run;
+	if (run.push) return;
 	if (run.generated.length > 0 && run.secrets) {
 		await ctx.secrets.write(run.secrets);
 		ctx.logger.info(`🔑 Generated for "${ctx.stage}" (${ctx.secrets.store}): ${run.generated.join(", ")}`);
 	}
-	run.files = await writeStack(ctx.cwd, run.dir, stack, run.credentials);
+	run.files = await writeStack(ctx.cwd, run.dir, stack);
 	printPlan(ctx, run);
 	if (stack.infra.length > 0) {
 		ctx.logger.info(`\n🗄️  Starting ${stack.infra.join(", ")}…`);
@@ -1653,6 +1896,10 @@ async function buildCompose(ctx, run, deps) {
 	const { stack, ref } = run;
 	const images = [...stack.apps, ...stack.workers];
 	const apps = images.map((image) => image.app);
+	if (run.push) {
+		run.files = await writeStack(ctx.cwd, run.dir, stack);
+		printPlan(ctx, run);
+	}
 	if (run.mode === "build") {
 		ctx.logger.info("\n🐳 Building images…");
 		await deps.docker.build(ref, apps);
@@ -1660,8 +1907,10 @@ async function buildCompose(ctx, run, deps) {
 		ctx.logger.info(`\n🐳 Pulling ${ctx.tag}…`);
 		await deps.docker.pull(ref, apps);
 	}
+	if (run.push) ctx.logger.info("\n📤 Pushing images…");
 	for (const image of images) {
-		const digest = await deps.docker.digest(image.ref);
+		const digest = run.push ? await deps.docker.push(ref, image.ref) : await deps.docker.digest(image.ref);
+		if (run.push) ctx.logger.info(`   ${image.app.padEnd(12)} ${image.ref}@${digest}`);
 		run.images[image.app] = {
 			ref: image.ref,
 			tag: image.tag,
@@ -1687,6 +1936,7 @@ async function buildCompose(ctx, run, deps) {
 */
 async function releaseCompose(ctx, run, deps) {
 	const { stack, ref } = run;
+	if (run.push) return;
 	ctx.logger.info("\n🚀 Starting the stack…");
 	await deps.docker.up(ref);
 	if (stack.local) await deps.docker.copyOut(ref, "caddy", "/data/caddy/pki/authorities/local/root.crt", caFile(run)).catch(() => {});
@@ -1745,6 +1995,7 @@ async function recordImages(ctx, run) {
 */
 async function verifyCompose(ctx, run, deps) {
 	const { stack } = run;
+	if (run.push) return;
 	const ca = stack.local ? await readFile(caFile(run), "utf-8").catch(() => void 0) : void 0;
 	ctx.logger.info("\n🩺 Checking each app through Caddy…");
 	const results = await Promise.all(stack.apps.map((app) => checkApp(ctx, app, deps, {
@@ -1924,7 +2175,7 @@ function applied(ctx, run, change) {
 	});
 }
 /** Write the stack's files: owner-only, since the env files hold secrets. */
-async function writeStack(root, dir, stack, credentials = {}) {
+async function writeStack(root, dir, stack) {
 	await mkdir(dir, {
 		recursive: true,
 		mode: 448
@@ -1940,8 +2191,9 @@ async function writeStack(root, dir, stack, credentials = {}) {
 	await write(join(dir, "docker-compose.yml"), composeYaml(stack));
 	await write(join(dir, "Caddyfile"), stack.caddyfile);
 	for (const app of [...stack.apps, ...stack.workers]) if (app.env) await write(join(dir, `${app.name}.env`), envFile(app.env), 384);
-	if (stack.logs) await write(join(dir, `${LOGS_SERVICE}.env`), envFile(stack.logs.env), 384);
-	for (const [name, payload] of Object.entries(credentials)) await write(join(dir, credentialsFile(name)), credentialsFileContent(payload), 384);
+	if (stack.logs && stack.compose.services["openobserve"]?.env_file) await write(join(dir, `${LOGS_SERVICE}.env`), envFile(stack.logs.env), 384);
+	if (stack.redis && stack.compose.services["redis"]?.env_file) await write(join(dir, `${REDIS_SERVICE}.env`), envFile(stack.redis.env), 384);
+	for (const entry of await readdir(dir)) if (entry.endsWith(".credentials")) await rm(join(dir, entry));
 	for (const [path, content] of Object.entries(stack.dockerfiles)) await write(join(root, path), content);
 	await ensureDockerignore(findBuildRoot(root));
 	return files;
@@ -1991,13 +2243,16 @@ function printPlan(ctx, run) {
 *   digest in the stage's state
 * - `verify`: each app asked through Caddy over HTTPS
 *
+* With `push` (`gkm compose --build --push`), run with `buildOnly`, it builds
+* every image and pushes it to `deploy.registry`, and does nothing else.
+*
 * `gkm compose` is this target with a few more switches (`--build`, `--pull`,
 * `--down`), run through the same `deploy()`.
 */
 var compose_exports = /* @__PURE__ */ __exportAll({ composeTarget: () => composeTarget });
 /** The compose target, with its Docker, bundler and probe as given. */
 function composeTarget(options = {}) {
-	const { mode, report, ...given } = options;
+	const { mode, push, pin, report, ...given } = options;
 	const deps = {
 		...defaultDeps,
 		...given
@@ -2013,7 +2268,11 @@ function composeTarget(options = {}) {
 		},
 		credentials: [],
 		tag: ({ cwd }) => deps.revision(cwd),
-		validate: (ctx) => validateCompose(ctx, deps, mode),
+		validate: (ctx) => validateCompose(ctx, deps, {
+			...mode ? { mode } : {},
+			...push ? { push } : {},
+			...pin ? { pin } : {}
+		}),
 		plan: (ctx, run) => planCompose(ctx, run),
 		provision: (ctx, run) => provisionCompose(ctx, run, deps),
 		build: (ctx, run) => buildCompose(ctx, run, deps),
@@ -2026,6 +2285,6 @@ function composeTarget(options = {}) {
 	});
 }
 //#endregion
-export { stackDir as a, composeProject as i, compose_exports as n, dockerCompose as o, stackOverrideFile as r, composeTarget as t };
+export { stackOverrideFile as a, parseDigests as c, ComposePushNeedsBuild as i, pinnedRef as l, compose_exports as n, composeProject as o, ComposePinNeedsPull as r, stackDir as s, composeTarget as t, dockerCompose as u };
 
-//# sourceMappingURL=compose-9II-0IsK.mjs.map
+//# sourceMappingURL=compose-DdH2JQJD.mjs.map