@geekmidas/cli 10.0.0-alpha.74 → 10.0.0-alpha.76

package/dist/{compose-iuw8wfHk.cjs → compose-h_6oNnHC.cjs}

@@ -2,9 +2,9 @@ const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_run = require("./run-fVZ-rLnc.cjs");
 const require_discover = require("./discover-D1It5r_h.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_workspace = require("./workspace-vdrcRI-m.cjs");
+const require_workspace = require("./workspace-DOm81oUo.cjs");
 const require_define = require("./define-DzRz8FgH.cjs");
-const require_state = require("./state-DCwRWyh-.cjs");
+const require_state = require("./state-C2qi0iQw.cjs");
 const require_SubscriberGenerator = require("./SubscriberGenerator-CajwOa5W.cjs");
 const require_drivers = require("./drivers-BdvtCKc7.cjs");
 const require_databases = require("./databases-C2p5LGAp.cjs");
@@ -64,6 +64,33 @@ var ServicePortUnknown = class extends Error {
 		this.name = "ServicePortUnknown";
 	}
 };
+/**
+* Whether `ref` names a registry on this machine's loopback — which the
+* daemon pulls from and pushes to over plain HTTP by default, and `docker
+* manifest inspect` reaches only when told `--insecure` (without it, a local
+* registry's image is reported as no such manifest).
+*/
+function isLoopbackRegistry(ref) {
+	const first = ref.split("/")[0];
+	if (!ref.includes("/") || !/[.:]|^localhost$/.test(first)) return false;
+	const host = first.replace(/:\d+$/, "");
+	return host === "localhost" || /^127(?:\.\d{1,3}){3}$/.test(host);
+}
+/** `docker push` finished without saying what digest the registry stored. */
+var PushDigestUnknown = class extends Error {
+	ref;
+	output;
+	constructor(ref, output) {
+		super(`Pushed ${ref}, but docker did not say which digest the registry stored (it said: ${output.trim().split("\n").slice(-3).join(" / ") || "nothing"}). Check the push with \`docker buildx imagetools inspect ${ref}\`.`);
+		this.ref = ref;
+		this.output = output;
+		this.name = "PushDigestUnknown";
+	}
+};
+/** The digest `docker push` reports last: `<tag>: digest: sha256:… size: …`. */
+function pushedDigest(output) {
+	return [...output.matchAll(/digest: (sha256:[0-9a-f]{64})/g)].at(-1)?.[1];
+}
 function compose(stack, args) {
 	return [
 		"compose",
@@ -127,6 +154,7 @@ const dockerCompose = {
 		const { code, stdout, stderr } = await capture("docker", [
 			"manifest",
 			"inspect",
+			...isLoopbackRegistry(ref) ? ["--insecure"] : [],
 			ref
 		]);
 		if (code === 0) return {
@@ -196,6 +224,15 @@ const dockerCompose = {
 			to
 		]), runOptions(stack));
 	},
+	async push(stack, ref) {
+		const output = await require_run.runOutput("docker", ["push", ref], {
+			cwd: stack.cwd,
+			...stack.signal ? { signal: stack.signal } : {}
+		});
+		const digest = pushedDigest(output);
+		if (!digest) throw new PushDigestUnknown(ref, output);
+		return digest;
+	},
 	async digest(ref) {
 		const { code, stdout } = await capture("docker", [
 			"image",
@@ -266,6 +303,92 @@ async function assertImagesExist(docker, tag, images) {
 	const missing = lookups.filter((lookup) => lookup.status === "missing").map((lookup) => lookup.ref);
 	if (missing.length > 0) throw new ImageTagNotFound(tag, missing);
 }
+/**
+* A push or a pull with no `deploy.registry` to push to or pull from.
+*
+* Without one an image is named `<namespace>/<project>-<app>:<tag>`, which
+* Docker resolves to Docker Hub — so a release would be pushed to, or pulled
+* from, somebody else's account. It is never a fallback.
+*/
+var RegistryRequired = class extends Error {
+	operation;
+	ref;
+	constructor(operation, ref) {
+		super(`${operation === "push" ? "Pushing" : "Pulling"} images needs a registry, and gkm.config.ts sets no deploy.registry: '${ref}' would be ${operation === "push" ? "pushed to" : "pulled from"} Docker Hub. Set deploy.registry (e.g. registry: 'ghcr.io/acme') in gkm.config.ts.` + (operation === "pull" ? " To run images built here instead, pass --build." : ""));
+		this.operation = operation;
+		this.ref = ref;
+		this.name = "RegistryRequired";
+	}
+};
+/** An image pinned to its digest: `<ref>@sha256:…`. */
+function pinnedRef(ref, digest) {
+	return `${ref.split("@")[0]}@${digest}`;
+}
+/** A digests file with no entry for an app the stack runs. */
+var ImageDigestMissing = class extends Error {
+	file;
+	apps;
+	constructor(file, apps) {
+		super(`${file} pins no digest for ${apps.join(", ")}. Use the file the same release's \`gkm compose --build --push --digests-file\` wrote, or run without --digests-file to pull by tag.`);
+		this.file = file;
+		this.apps = apps;
+		this.name = "ImageDigestMissing";
+	}
+};
+/** A digests file entry that is not this app's image. */
+var ImageDigestMismatch = class extends Error {
+	app;
+	expected;
+	found;
+	constructor(app, expected, found) {
+		super(`The digests file pins '${app}' to ${found}, but this release runs ${expected}. It was written for another registry, project, stage or tag; use the file this stage's push of this tag wrote.`);
+		this.app = app;
+		this.expected = expected;
+		this.found = found;
+		this.name = "ImageDigestMismatch";
+	}
+};
+/** A digests file that is not a JSON object of app to pinned ref. */
+var ImageDigestsInvalid = class extends Error {
+	file;
+	detail;
+	constructor(file, detail) {
+		super(`${file} is not a digests file (${detail}). It should be the JSON object \`gkm compose --build --push --digests-file\` writes: { "api": "<registry>/<image>:<tag>@sha256:…" }.`);
+		this.file = file;
+		this.detail = detail;
+		this.name = "ImageDigestsInvalid";
+	}
+};
+/** Parse a digests file's content, checking its shape. */
+function parseDigests(file, content) {
+	let parsed;
+	try {
+		parsed = JSON.parse(content);
+	} catch (error) {
+		throw new ImageDigestsInvalid(file, error instanceof Error ? error.message : String(error));
+	}
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new ImageDigestsInvalid(file, "not a JSON object");
+	for (const [app, value] of Object.entries(parsed)) if (typeof value !== "string" || !/@sha256:[0-9a-f]{64}$/.test(value)) throw new ImageDigestsInvalid(file, `'${app}' is not an <image>:<tag>@sha256:… ref`);
+	return parsed;
+}
+/**
+* Each image pinned to the digest the file names for it.
+*
+* @throws {ImageDigestMissing} naming every app the file has no entry for
+* @throws {ImageDigestMismatch} when an entry is another image or tag
+*/
+function pinImages(file, digests, images) {
+	const missing = images.filter((image) => !digests[image.app]).map((image) => image.app);
+	if (missing.length > 0) throw new ImageDigestMissing(file, missing);
+	return images.map((image) => {
+		const pinned = digests[image.app];
+		if (pinned.split("@")[0] !== image.ref) throw new ImageDigestMismatch(image.app, image.ref, pinned);
+		return {
+			...image,
+			ref: pinned
+		};
+	});
+}
 //#endregion
 //#region src/compose/logs.ts
 /**
@@ -950,6 +1073,7 @@ function composeStack(input) {
 			if (app.build && Object.keys(args).length > 0) app.build.args = args;
 			continue;
 		}
+		if (input.buildOnly) continue;
 		const keys = require_state.appEnvKeys(manifest, app.name, input.runnables) ?? /* @__PURE__ */ new Set();
 		const values = valuesFor(app, keys);
 		const trusted = (0, _geekmidas_manifest.provideKey)(app.id, "trustedOrigins");
@@ -970,7 +1094,7 @@ function composeStack(input) {
 		};
 		for (const [key, value] of Object.entries(app.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(app.name, key);
 	}
-	for (const worker of workers) {
+	for (const worker of input.buildOnly ? [] : workers) {
 		const keys = require_state.workerEnvKeys(manifest, worker.id, input.runnables) ?? /* @__PURE__ */ new Set();
 		worker.env = {
 			...valuesFor({
@@ -1003,7 +1127,8 @@ function composeStack(input) {
 		http,
 		composeDir: (0, node_path.join)(workspace.root, stackDir(stage)),
 		buildRoot: layout.buildRoot,
-		workspaceRoot: workspace.root
+		workspaceRoot: workspace.root,
+		envFiles: !input.buildOnly
 	});
 	const caddyfile = edgeCaddyfile([
 		...apps.map((app) => ({
@@ -1023,6 +1148,7 @@ function composeStack(input) {
 		dockerfiles[app.build.dockerfile] = require_state.appDockerfile(app.name, workspace.apps[app.name], {
 			layout,
 			workspaceRoot: workspace.root,
+			apps: workspace.apps,
 			manifest,
 			cache: STACK_CACHE
 		});
@@ -1254,10 +1380,13 @@ function stackFile(options) {
 			retries: 5
 		}
 	};
-	for (const service of Object.values(services)) service.logging = {
-		driver: LOG_ROTATION.driver,
-		options: { ...LOG_ROTATION.options }
-	};
+	for (const service of Object.values(services)) {
+		if (!options.envFiles) delete service.env_file;
+		service.logging = {
+			driver: LOG_ROTATION.driver,
+			options: { ...LOG_ROTATION.options }
+		};
+	}
 	return {
 		name: project,
 		services,
@@ -1280,93 +1409,6 @@ function defaultLayout(root) {
 		gkmPaths: ["gkm.config.*"]
 	};
 }
-/** The id the stack's compose file names an app's build credentials by. */
-function credentialsSecret(app) {
-	return `${app}_credentials`;
-}
-/** The file beside the compose file an app's build credentials are read from. */
-function credentialsFile(app) {
-	return `${app}.credentials`;
-}
-/**
-* The stack with each backend's image built with its encrypted credentials:
-* a BuildKit secret per app — the file `credentialsFile` names, mounted as
-* `gkm_credentials` — and the hash naming them as a build arg, so a new key
-* rebuilds the layer that embeds them. Each backend's env file gains the
-* `GKM_MASTER_KEY` that decrypts them, the way a Dokploy deploy injects it.
-*
-* Pure: the caller encrypted them.
-*/
-function withBuildCredentials(stack, credentials) {
-	const services = { ...stack.compose.services };
-	const secrets = { ...stack.compose.secrets };
-	const apps = stack.apps.map((app) => {
-		const own = credentials[app.name];
-		const service = services[app.name];
-		if (!own || !service?.build) return app;
-		const [key, value] = own.buildArg.split("=");
-		services[app.name] = {
-			...service,
-			build: {
-				...service.build,
-				args: {
-					...service.build.args,
-					[key]: value
-				},
-				secrets: [{
-					source: credentialsSecret(app.name),
-					target: "gkm_credentials"
-				}]
-			}
-		};
-		secrets[credentialsSecret(app.name)] = { file: `./${credentialsFile(app.name)}` };
-		return {
-			...app,
-			env: {
-				...app.env,
-				GKM_MASTER_KEY: own.masterKey
-			}
-		};
-	});
-	const workers = stack.workers.map((worker) => {
-		const own = credentials[worker.name];
-		const service = services[worker.name];
-		if (!own || !service?.build) return worker;
-		const [key, value] = own.buildArg.split("=");
-		services[worker.name] = {
-			...service,
-			build: {
-				...service.build,
-				args: {
-					...service.build.args,
-					[key]: value
-				},
-				secrets: [{
-					source: credentialsSecret(worker.name),
-					target: "gkm_credentials"
-				}]
-			}
-		};
-		secrets[credentialsSecret(worker.name)] = { file: `./${credentialsFile(worker.name)}` };
-		return {
-			...worker,
-			env: {
-				...worker.env,
-				GKM_MASTER_KEY: own.masterKey
-			}
-		};
-	});
-	return {
-		...stack,
-		apps,
-		workers,
-		compose: {
-			...stack.compose,
-			services,
-			...Object.keys(secrets).length ? { secrets } : {}
-		}
-	};
-}
 /** Render an app's env file: one `KEY=value` per line, read raw by compose. */
 function envFile(env) {
 	return `${Object.entries(env).sort(([a], [b]) => a.localeCompare(b)).map(([key, value]) => `${key}=${value}`).join("\n")}\n`;
@@ -1462,6 +1504,20 @@ var ComposeAppsUnhealthy = class extends Error {
 * injected, so the rules are asserted without a daemon; the defaults are the
 * real ones.
 */
+/** `--push` without `--build`: there is nothing built here to push. */
+var ComposePushNeedsBuild = class extends Error {
+	constructor() {
+		super("--push pushes the images this checkout builds, so it needs --build (and never --pull): gkm compose --stage <stage> --build --push --tag <tag>.");
+		this.name = "ComposePushNeedsBuild";
+	}
+};
+/** Digests to run by, on a run that pulls nothing. */
+var ComposePinNeedsPull = class extends Error {
+	constructor() {
+		super("--digests-file pins the images a release pulls, so it needs --tag (or --pull) — or, with --build --push, it is where the pushed digests are written.");
+		this.name = "ComposePinNeedsPull";
+	}
+};
 /** A port variable that does not hold a port. */
 var EdgePortInvalid = class extends Error {
 	variable;
@@ -1540,10 +1596,15 @@ const defaultDeps = {
 * every image it names exists. Nothing is written: a missing image stops the
 * run here, before a file, a secret or a container is touched.
 */
-async function validateCompose(ctx, deps, forced) {
+async function validateCompose(ctx, deps, options = {}) {
 	const { workspace, stage, identity, tag } = ctx;
 	const root = workspace.root;
-	const mode = forced ?? (ctx.tagGiven ? "pull" : "build");
+	const mode = options.mode ?? (ctx.tagGiven ? "pull" : "build");
+	const push = options.push === true;
+	if (push && mode !== "build") throw new ComposePushNeedsBuild();
+	if (options.pin && mode !== "pull") throw new ComposePinNeedsPull();
+	const registry = workspace.deploy?.registry;
+	if (!registry && (push || mode === "pull")) throw new RegistryRequired(push ? "push" : "pull", require_state.imageRef(identity, ctx.apps[0] ?? workspace.name, void 0, tag));
 	const runnables = {};
 	const background = {};
 	const manifest = await require_discover.discover({
@@ -1553,14 +1614,13 @@ async function validateCompose(ctx, deps, forced) {
 		background
 	});
 	const { secrets, generated } = await stageSecrets(ctx, manifest);
-	await require_credentialSchemas.assertStageCredentials({
+	if (!push) await require_credentialSchemas.assertStageCredentials({
 		root,
 		patterns: require_state.constructGlobs(workspace),
 		manifest,
 		stage,
 		supplied: secrets?.custom ?? {}
 	});
-	const masterKeys = {};
 	const layout = mode === "build" ? require_state.imageLayout(workspace) : void 0;
 	const composed = composeStack({
 		workspace,
@@ -1572,51 +1632,17 @@ async function validateCompose(ctx, deps, forced) {
 		images: {
 			mode,
 			tag,
-			...workspace.deploy?.registry ? { registry: workspace.deploy.registry } : {}
+			...registry ? { registry } : {}
 		},
 		secrets,
 		allowDevServices: ctx.allowDevServices,
 		ports: edgePorts(deps.env),
-		...layout ? { layout } : {}
+		...layout ? { layout } : {},
+		...push ? { buildOnly: true } : {}
 	});
 	require_state.reportDevServices(ctx, composed.devServices);
 	if (mode === "build") assertRedisClient(workspace, composed);
-	const credentials = {};
-	if (mode === "build") {
-		for (const app of composed.apps) {
-			if (app.kind !== "rest-api" || !app.env || !app.build) continue;
-			const { encrypted, iv, masterKey } = require_state.encryptSecrets(app.env);
-			credentials[app.name] = {
-				encrypted,
-				iv
-			};
-			ctx.secrets.mask(masterKey);
-			masterKeys[app.name] = {
-				masterKey,
-				buildArg: require_state.credentialsBuildArg({
-					encrypted,
-					iv
-				})
-			};
-		}
-		for (const worker of composed.workers) {
-			if (!worker.env || !worker.build) continue;
-			const { encrypted, iv, masterKey } = require_state.encryptSecrets(worker.env);
-			credentials[worker.name] = {
-				encrypted,
-				iv
-			};
-			ctx.secrets.mask(masterKey);
-			masterKeys[worker.name] = {
-				masterKey,
-				buildArg: require_state.credentialsBuildArg({
-					encrypted,
-					iv
-				})
-			};
-		}
-	}
-	const stack = withBuildCredentials(composed, masterKeys);
+	const stack = options.pin ? withPinnedImages(composed, options.pin.file, options.pin.digests) : composed;
 	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, [...stack.apps, ...stack.workers]);
 	if (stack.redis && !stack.local) ctx.secrets.mask(stack.redis.password);
 	if (stack.logs && (!stack.local || stack.logs.passwordFromSecrets)) {
@@ -1627,7 +1653,8 @@ async function validateCompose(ctx, deps, forced) {
 	const override = stackOverrideFile(root, stage);
 	const overrides = (0, node_fs.existsSync)(override) ? [override] : [];
 	if (overrides.length > 0) ctx.logger.info(`🧩 Merging docker-compose.${stage}.yml over the generated stack`);
-	const previous = Object.fromEntries(Object.entries((await ctx.state.read(stage))?.state.releases ?? {}).map(([name, releases]) => {
+	const recorded = push ? void 0 : await ctx.state.read(stage);
+	const previous = Object.fromEntries(Object.entries(recorded?.state.releases ?? {}).map(([name, releases]) => {
 		const { ref, tag, digest } = releases.current;
 		return [name, {
 			ref,
@@ -1637,6 +1664,7 @@ async function validateCompose(ctx, deps, forced) {
 	}));
 	return {
 		mode,
+		push,
 		stack,
 		dir,
 		ref: {
@@ -1651,7 +1679,6 @@ async function validateCompose(ctx, deps, forced) {
 		generated,
 		previous,
 		files: [],
-		credentials,
 		images: {},
 		changes: []
 	};
@@ -1713,13 +1740,36 @@ async function stageSecrets(ctx, manifest) {
 	};
 }
 /**
+* The stack with each app's and worker's image pinned to the digest the file
+* names: the refs it is checked, pulled and recorded by, and the image each
+* compose service runs.
+*/
+function withPinnedImages(stack, file, digests) {
+	const apps = pinImages(file, digests, stack.apps);
+	const workers = pinImages(file, digests, stack.workers);
+	const services = { ...stack.compose.services };
+	for (const image of [...apps, ...workers]) services[image.name] = {
+		...services[image.name],
+		image: image.ref
+	};
+	return {
+		...stack,
+		apps,
+		workers,
+		compose: {
+			...stack.compose,
+			services
+		}
+	};
+}
+/**
 * A dry run: the stack's files, written so they can be read, and what a real
 * run would do — no image is built or pulled, no container touched, nothing
 * recorded and no secret kept.
 */
 async function planCompose(ctx, run) {
 	if (run.generated.length > 0) ctx.logger.info(`🔑 "${ctx.stage}" has no ${run.generated.join(", ")} yet; this dry run used values it did not keep.`);
-	run.files = await writeStack(ctx.cwd, run.dir, run.stack, run.credentials);
+	run.files = await writeStack(ctx.cwd, run.dir, run.stack);
 	printPlan(ctx, run);
 	const planned = (change) => {
 		run.changes.push(change);
@@ -1728,7 +1778,7 @@ async function planCompose(ctx, run) {
 			...change
 		});
 	};
-	for (const service of run.stack.infra) planned({
+	for (const service of run.push ? [] : run.stack.infra) planned({
 		key: `service:${service}`,
 		resourceType: "service",
 		action: "ensure"
@@ -1740,6 +1790,7 @@ async function planCompose(ctx, run) {
 			action: run.mode === "build" ? "build" : "reuse",
 			id: app.ref
 		});
+		if (run.push) continue;
 		planned({
 			key: `service:${app.name}`,
 			resourceType: "service",
@@ -1753,13 +1804,14 @@ async function planCompose(ctx, run) {
 			action: run.mode === "build" ? "build" : "reuse",
 			id: worker.ref
 		});
+		if (run.push) continue;
 		planned({
 			key: `service:${worker.name}`,
 			resourceType: "service",
 			action: run.previous[worker.name] ? "reuse" : "create"
 		});
 	}
-	planned({
+	if (!run.push) planned({
 		key: "service:caddy",
 		resourceType: "service",
 		action: "ensure"
@@ -1772,11 +1824,12 @@ async function planCompose(ctx, run) {
 */
 async function provisionCompose(ctx, run, deps) {
 	const { stack, ref } = run;
+	if (run.push) return;
 	if (run.generated.length > 0 && run.secrets) {
 		await ctx.secrets.write(run.secrets);
 		ctx.logger.info(`🔑 Generated for "${ctx.stage}" (${ctx.secrets.store}): ${run.generated.join(", ")}`);
 	}
-	run.files = await writeStack(ctx.cwd, run.dir, stack, run.credentials);
+	run.files = await writeStack(ctx.cwd, run.dir, stack);
 	printPlan(ctx, run);
 	if (stack.infra.length > 0) {
 		ctx.logger.info(`\n🗄️  Starting ${stack.infra.join(", ")}…`);
@@ -1844,6 +1897,10 @@ async function buildCompose(ctx, run, deps) {
 	const { stack, ref } = run;
 	const images = [...stack.apps, ...stack.workers];
 	const apps = images.map((image) => image.app);
+	if (run.push) {
+		run.files = await writeStack(ctx.cwd, run.dir, stack);
+		printPlan(ctx, run);
+	}
 	if (run.mode === "build") {
 		ctx.logger.info("\n🐳 Building images…");
 		await deps.docker.build(ref, apps);
@@ -1851,8 +1908,10 @@ async function buildCompose(ctx, run, deps) {
 		ctx.logger.info(`\n🐳 Pulling ${ctx.tag}…`);
 		await deps.docker.pull(ref, apps);
 	}
+	if (run.push) ctx.logger.info("\n📤 Pushing images…");
 	for (const image of images) {
-		const digest = await deps.docker.digest(image.ref);
+		const digest = run.push ? await deps.docker.push(ref, image.ref) : await deps.docker.digest(image.ref);
+		if (run.push) ctx.logger.info(`   ${image.app.padEnd(12)} ${image.ref}@${digest}`);
 		run.images[image.app] = {
 			ref: image.ref,
 			tag: image.tag,
@@ -1878,6 +1937,7 @@ async function buildCompose(ctx, run, deps) {
 */
 async function releaseCompose(ctx, run, deps) {
 	const { stack, ref } = run;
+	if (run.push) return;
 	ctx.logger.info("\n🚀 Starting the stack…");
 	await deps.docker.up(ref);
 	if (stack.local) await deps.docker.copyOut(ref, "caddy", "/data/caddy/pki/authorities/local/root.crt", caFile(run)).catch(() => {});
@@ -1936,6 +1996,7 @@ async function recordImages(ctx, run) {
 */
 async function verifyCompose(ctx, run, deps) {
 	const { stack } = run;
+	if (run.push) return;
 	const ca = stack.local ? await (0, node_fs_promises.readFile)(caFile(run), "utf-8").catch(() => void 0) : void 0;
 	ctx.logger.info("\n🩺 Checking each app through Caddy…");
 	const results = await Promise.all(stack.apps.map((app) => checkApp(ctx, app, deps, {
@@ -2115,7 +2176,7 @@ function applied(ctx, run, change) {
 	});
 }
 /** Write the stack's files: owner-only, since the env files hold secrets. */
-async function writeStack(root, dir, stack, credentials = {}) {
+async function writeStack(root, dir, stack) {
 	await (0, node_fs_promises.mkdir)(dir, {
 		recursive: true,
 		mode: 448
@@ -2131,9 +2192,9 @@ async function writeStack(root, dir, stack, credentials = {}) {
 	await write((0, node_path.join)(dir, "docker-compose.yml"), composeYaml(stack));
 	await write((0, node_path.join)(dir, "Caddyfile"), stack.caddyfile);
 	for (const app of [...stack.apps, ...stack.workers]) if (app.env) await write((0, node_path.join)(dir, `${app.name}.env`), envFile(app.env), 384);
-	if (stack.logs) await write((0, node_path.join)(dir, `${LOGS_SERVICE}.env`), envFile(stack.logs.env), 384);
-	if (stack.redis) await write((0, node_path.join)(dir, `${REDIS_SERVICE}.env`), envFile(stack.redis.env), 384);
-	for (const [name, payload] of Object.entries(credentials)) await write((0, node_path.join)(dir, credentialsFile(name)), require_state.credentialsFileContent(payload), 384);
+	if (stack.logs && stack.compose.services["openobserve"]?.env_file) await write((0, node_path.join)(dir, `${LOGS_SERVICE}.env`), envFile(stack.logs.env), 384);
+	if (stack.redis && stack.compose.services["redis"]?.env_file) await write((0, node_path.join)(dir, `${REDIS_SERVICE}.env`), envFile(stack.redis.env), 384);
+	for (const entry of await (0, node_fs_promises.readdir)(dir)) if (entry.endsWith(".credentials")) await (0, node_fs_promises.rm)((0, node_path.join)(dir, entry));
 	for (const [path, content] of Object.entries(stack.dockerfiles)) await write((0, node_path.join)(root, path), content);
 	await require_state.ensureDockerignore(require_state.findBuildRoot(root));
 	return files;
@@ -2183,13 +2244,16 @@ function printPlan(ctx, run) {
 *   digest in the stage's state
 * - `verify`: each app asked through Caddy over HTTPS
 *
+* With `push` (`gkm compose --build --push`), run with `buildOnly`, it builds
+* every image and pushes it to `deploy.registry`, and does nothing else.
+*
 * `gkm compose` is this target with a few more switches (`--build`, `--pull`,
 * `--down`), run through the same `deploy()`.
 */
 var compose_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({ composeTarget: () => composeTarget });
 /** The compose target, with its Docker, bundler and probe as given. */
 function composeTarget(options = {}) {
-	const { mode, report, ...given } = options;
+	const { mode, push, pin, report, ...given } = options;
 	const deps = {
 		...defaultDeps,
 		...given
@@ -2205,7 +2269,11 @@ function composeTarget(options = {}) {
 		},
 		credentials: [],
 		tag: ({ cwd }) => deps.revision(cwd),
-		validate: (ctx) => validateCompose(ctx, deps, mode),
+		validate: (ctx) => validateCompose(ctx, deps, {
+			...mode ? { mode } : {},
+			...push ? { push } : {},
+			...pin ? { pin } : {}
+		}),
 		plan: (ctx, run) => planCompose(ctx, run),
 		provision: (ctx, run) => provisionCompose(ctx, run, deps),
 		build: (ctx, run) => buildCompose(ctx, run, deps),
@@ -2218,6 +2286,18 @@ function composeTarget(options = {}) {
 	});
 }
 //#endregion
+Object.defineProperty(exports, "ComposePinNeedsPull", {
+	enumerable: true,
+	get: function() {
+		return ComposePinNeedsPull;
+	}
+});
+Object.defineProperty(exports, "ComposePushNeedsBuild", {
+	enumerable: true,
+	get: function() {
+		return ComposePushNeedsBuild;
+	}
+});
 Object.defineProperty(exports, "composeProject", {
 	enumerable: true,
 	get: function() {
@@ -2242,6 +2322,18 @@ Object.defineProperty(exports, "dockerCompose", {
 		return dockerCompose;
 	}
 });
+Object.defineProperty(exports, "parseDigests", {
+	enumerable: true,
+	get: function() {
+		return parseDigests;
+	}
+});
+Object.defineProperty(exports, "pinnedRef", {
+	enumerable: true,
+	get: function() {
+		return pinnedRef;
+	}
+});
 Object.defineProperty(exports, "stackDir", {
 	enumerable: true,
 	get: function() {
@@ -2255,4 +2347,4 @@ Object.defineProperty(exports, "stackOverrideFile", {
 	}
 });
 
-//# sourceMappingURL=compose-iuw8wfHk.cjs.map
+//# sourceMappingURL=compose-h_6oNnHC.cjs.map