@wpelevator/tug 0.3.0 → 0.5.0

package/dist/build.d.ts

@@ -12,11 +12,10 @@ export interface BuildSpec {
 }
 export declare function run(cmd: string, args: string[], opts?: RunOptions): Promise<RunResult>;
 export declare function unpackContext(tarball: string, dest: string): Promise<void>;
-export interface BuildAndPushOptions {
+export interface BuildImageOptions {
     contextDir: string;
     service: string;
     buildSpec: string | BuildSpec;
     imageRef: string;
-    push?: boolean;
 }
-export declare function buildAndPush({ contextDir, service, buildSpec, imageRef, push, }: BuildAndPushOptions): Promise<void>;
+export declare function buildImage({ contextDir, service, buildSpec, imageRef, }: BuildImageOptions): Promise<void>;

package/dist/build.js

@@ -33,7 +33,7 @@ export async function unpackContext(tarball, dest) {
     });
     await tar.x({ file: tarball, cwd: dest, strict: true });
 }
-export async function buildAndPush({ contextDir, service, buildSpec, imageRef, push = true, }) {
+export async function buildImage({ contextDir, service, buildSpec, imageRef, }) {
     const buildPath = typeof buildSpec === 'string' ? buildSpec : buildSpec?.context || '.';
     const dockerfilePath = typeof buildSpec === 'object' && buildSpec.dockerfile
         ? path.resolve(contextDir, buildPath, buildSpec.dockerfile)
@@ -48,6 +48,4 @@ export async function buildAndPush({ contextDir, service, buildSpec, imageRef, p
     if (!(await exists(fullContext)))
         throw new Error(`build context not found for ${service}: ${buildPath}`);
     await run('docker', ['build', ...dockerfile, '-t', imageRef, fullContext]);
-    if (push)
-        await run('docker', ['push', imageRef]);
 }

package/dist/cli-build.d.ts

@@ -1,8 +1,8 @@
-import { buildAndPush } from './build.ts';
+import { buildImage } from './build.ts';
 import { saveImageArchive } from './artifacts.ts';
 import type { ComposeFile, LocalImageUpload } from './protocol.ts';
 export interface LocalBuildDependencies {
-    build: typeof buildAndPush;
+    build: typeof buildImage;
     save: typeof saveImageArchive;
     nonce: () => string;
     remove: (imageRef: string) => Promise<void>;

package/dist/cli-build.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import fs from 'node:fs/promises';
 import { randomUUID } from 'node:crypto';
 import * as tar from 'tar';
-import { buildAndPush, run } from "./build.js";
+import { buildImage, run } from "./build.js";
 import { saveImageArchive } from "./artifacts.js";
 /** Credential exclusions are mandatory and cannot be re-included by source ignore rules. */
 export function sourceArchiveFilter(entry, configPaths, ignores) {
@@ -18,7 +18,7 @@ export async function createSourceArchive(contextDir, archive, configFiles) {
     const configPaths = configFiles
         .map((file) => path.relative(contextDir, file).split(path.sep).join('/'))
         .filter((file) => file !== '..' && !file.startsWith('../') && !path.isAbsolute(file));
-    const ignores = ['node_modules', 'data', 'registry-data'];
+    const ignores = ['node_modules', 'data'];
     try {
         ignores.push(...(await fs.readFile(path.join(contextDir, '.dockerignore'), 'utf8'))
             .split(/\r?\n/)
@@ -38,7 +38,7 @@ export async function createSourceArchive(contextDir, archive, configFiles) {
 }
 /** Build only application build services; callers own temporary files and upload transport. */
 export async function prepareLocalImages(compose, contextDir, directory, dependencies = {
-    build: buildAndPush,
+    build: buildImage,
     save: saveImageArchive,
     nonce: randomUUID,
     remove: async (imageRef) => {
@@ -58,7 +58,6 @@ export async function prepareLocalImages(compose, contextDir, directory, depende
                 service,
                 buildSpec: spec.build,
                 imageRef,
-                push: false,
             });
             const archive = await dependencies.save(imageRef, path.join(directory, `${field}.tar.gz`));
             images.push({ service, imageRef, ...archive, field });

package/dist/cli.js

@@ -10,7 +10,8 @@ import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { readCompose, composeHash } from "./compose.js";
+import { composeHash } from "./compose.js";
+import { normalizeCompose } from "./normalize.js";
 import { errMessage, token, loadTemplate } from "./util.js";
 import { PROJECT_NAME_PATTERN, ROLES, TOKEN_NAME_PATTERN } from "./tokens.js";
 import { packageVersion, resolveImage } from "./image.js";
@@ -74,14 +75,22 @@ function assertHttps(url, allowHttp) {
     if (!allowHttp && !String(url).startsWith('https://'))
         throw new Error(`${url} must use https:// outside local development (pass --http-only-dev to override)`);
 }
-function preflightRemote(target, { controlUrl, ports = [], udpPorts = [], minDiskMb = 1024, mesh = false, } = {}) {
+function preflightRemote(target, { controlUrl, ports = [], udpPorts = [], minDiskMb = 1024, mesh = false, compose = false, } = {}) {
     const checks = [
         [
             'docker.version',
             'docker version >/dev/null',
             'Install Docker Engine and ensure the SSH user can access it.',
         ],
-        ['docker.compose.version', 'docker compose version >/dev/null', 'Install Docker Compose v2.'],
+        ...(compose
+            ? [
+                [
+                    'docker.compose.version',
+                    'docker compose version >/dev/null',
+                    'Install Docker Compose v2.',
+                ],
+            ]
+            : []),
         [
             'paths',
             'mkdir -p /opt/tug-preflight /var/lib/tug-preflight /etc/tug && test -w /opt/tug-preflight && test -w /var/lib/tug-preflight && test -w /etc/tug',
@@ -147,8 +156,13 @@ async function transferTugImage(target, imageTag) {
 async function dockerBootstrap() {
     return fs.readFile(path.join(templatesDir, 'install-docker.sh'), 'utf8');
 }
-async function bootstrapDocker(target) {
-    runLocal('ssh', ['--', target, `sh -eu -c ${sh(await dockerBootstrap())}`]);
+/** Installs Docker over SSH; `compose` also installs the Compose plugin, which only the control host needs. */
+async function bootstrapDocker(target, compose = false) {
+    runLocal('ssh', [
+        '--',
+        target,
+        `${compose ? 'TUG_INSTALL_COMPOSE=1 ' : ''}sh -eu -c ${sh(await dockerBootstrap())}`,
+    ]);
 }
 async function waitForDeployment(deploymentId, timeoutSeconds = 300) {
     const deadline = Date.now() + timeoutSeconds * 1000;
@@ -187,12 +201,6 @@ program
     });
     console.log(JSON.stringify(r, null, 2));
 });
-program
-    .command('node-rotate-registry-token <name>')
-    .description('issue a new registry pull token for a node, invalidating the old one')
-    .action(async (name) => {
-    console.log(JSON.stringify(await request('POST', `/api/v1/nodes/${encodeURIComponent(name)}/rotate-registry-token`, {}), null, 2));
-});
 program
     .command('node-rotate-wg-key <name>')
     .description('generate a new WireGuard keypair on the node; peers pick up the new public key on their next poll')
@@ -220,12 +228,6 @@ program
         enabled: !o.disable,
     }), null, 2));
 });
-program
-    .command('node-revoke-registry-token <name>')
-    .description("revoke a node's registry pull token, blocking future pulls until rotated")
-    .action(async (name) => {
-    console.log(JSON.stringify(await request('POST', `/api/v1/nodes/${encodeURIComponent(name)}/revoke-registry-token`, {}), null, 2));
-});
 program
     .command('scale <service> <replicas>')
     .description('scale a service to N replicas across matching nodes')
@@ -249,27 +251,20 @@ program
     .option('--token <token>', 'operator token')
     .option('--port <port>', 'published API port', '8080')
     .option('--mesh', 'enable the WireGuard mesh on control (TUG_MESH=true); install nodes with --mesh too')
-    .option('--registry <host>', 'registry host used in desired images; bring your own registry, Tug does not provision one')
-    .option('--registry-auth-path <path>', 'container path to an htpasswd file tug-control should manage credentials in, if your registry uses one')
-    .option('--registry-container <name>', "docker container name to restart when a node's registry credentials change, if your registry uses an htpasswd file")
     .action(async (sshTarget, o) => {
     const operatorToken = o.token || process.env.TUG_TOKEN || token('tug_op');
     if (o.installDocker)
-        await bootstrapDocker(sshTarget);
-    preflightRemote(sshTarget, { ports: [Number(o.port)], minDiskMb: 2048 });
+        await bootstrapDocker(sshTarget, true);
+    preflightRemote(sshTarget, { ports: [Number(o.port)], minDiskMb: 2048, compose: true });
     const image = resolveImage(o.image, o.buildLocalImage);
     if (o.buildLocalImage)
         await transferTugImage(sshTarget, image);
-    const registryHost = o.registry || '';
     const yamlValue = (value) => JSON.stringify(value);
     const compose = await loadTemplate(templatesDir, 'control-compose.yml', {
         IMAGE: yamlValue(image),
         OPERATOR_TOKEN: yamlValue(operatorToken),
-        REGISTRY_HOST: yamlValue(registryHost),
         PORT: o.port,
         MESH: yamlValue(o.mesh ? 'true' : 'false'),
-        REGISTRY_AUTH_PATH: yamlValue(o.registryAuthPath || ''),
-        REGISTRY_CONTAINER: yamlValue(o.registryContainer || ''),
     });
     const remote = await loadTemplate(templatesDir, 'control-install.sh', {
         COMPOSE: compose,
@@ -281,7 +276,6 @@ program
         sshTarget,
         operatorToken,
         url: `http://${remoteHost(sshTarget)}:${o.port}`,
-        registry: registryHost,
     }, null, 2));
 });
 program
@@ -292,7 +286,6 @@ program
     .option('--public-address <addr>')
     .option('--label <label>', 'node label (repeatable)', collect, [])
     .option('--agent-control-url <url>', 'control URL reachable by the agent (default: resolved operator control URL)')
-    .option('--registry <host>', 'registry host for docker login')
     .option('--http-only-dev', 'allow plaintext HTTP control URL for local/private development')
     .option('--mesh', 'join the WireGuard mesh (agent runs with host networking and NET_ADMIN; control needs TUG_MESH=true)')
     .option('--wg-port <port>', 'WireGuard UDP port checked by preflight', '51820')
@@ -324,17 +317,13 @@ program
         NODE_NAME: o.name,
         AGENT_TOKEN: registered.agentToken,
     })) + (o.mesh ? 'TUG_MESH=true\n' : '');
-    const dockerLogin = o.registry
-        ? `printf %s ${sh(registered.registryToken)} | docker login ${sh(o.registry)} --username ${sh(o.name)} --password-stdin`
-        : 'true';
     const remote = await loadTemplate(templatesDir, 'node-install.sh', {
         ENV: env,
-        DOCKER_LOGIN: dockerLogin,
         IMAGE_SH: sh(image),
         RUN_FLAGS: `${o.mesh ? MESH_RUN_FLAGS : HOST_NETWORK_FLAG} `,
     });
     runLocal('ssh', ['--', sshTarget, remote]);
-    console.log(JSON.stringify({ ok: true, node: registered.node, registryToken: registered.registryToken }, null, 2));
+    console.log(JSON.stringify({ ok: true, node: registered.node }, null, 2));
 });
 program
     .command('node-enroll')
@@ -449,13 +438,14 @@ program
     .option('-f, --file <file>', 'compose file', 'docker-compose.yml')
     .option('--version <version>', 'display version (default: git-<Compose hash>)')
     .option('--build-local', 'build application images locally and upload them without source')
-    .option('--no-build-upload', 'deploy published images without uploading source; conflicts with --build-local')
     .option('--no-wait', 'return after desired state is created')
     .option('--timeout <seconds>', 'wait timeout in seconds', '300')
     .action(async (o) => {
     const cfg = await loadCfg();
-    const compose = await readCompose(o.file);
     const project = o.project || cfg.project || 'site';
+    // Control secrets are interpolated as sentinels; the agent substitutes the node's released values.
+    const { secrets } = await request('GET', `/api/v1/secrets?project=${encodeURIComponent(project)}`);
+    const compose = await normalizeCompose(o.file, secrets.map((secret) => secret.name), { project });
     const version = o.version || `git-${composeHash(compose)}`;
     let response;
     if (o.buildLocal) {
@@ -472,8 +462,7 @@ program
             await fs.rm(directory, { recursive: true, force: true });
         }
     }
-    else if (o.buildUpload &&
-        Object.values(compose.services).some((service) => service.build)) {
+    else if (Object.values(compose.services).some((service) => service.build)) {
         const tarball = await makeContext();
         try {
             const form = new FormData();
@@ -689,10 +678,6 @@ program.hook('preAction', async (_root, command) => {
         if (options[key] !== undefined)
             integerOption(String(options[key]), '--' + key.replace(/[A-Z]/g, (c) => '-' + c.toLowerCase()), min, max);
     }
-    if (options.buildLocal && options.buildUpload === false)
-        throw new Error('--build-local and --no-build-upload cannot be combined');
-    if ((options.registryAuthPath || options.registryContainer) && !options.registry)
-        throw new Error('--registry-auth-path and --registry-container require --registry');
     if (command.name() === 'control-restore' && !options.confirm)
         throw new Error('control-restore requires --confirm');
     const positional = command.name() === 'exec' ? command.args.slice(0, 1) : command.args;

package/dist/compose.d.ts

@@ -1,5 +1,4 @@
 import type { ComposeFile, ComposeService, DesiredState, ServiceEndpoint } from './protocol.ts';
-export declare function readCompose(file?: string): Promise<ComposeFile>;
 export declare function composeHash(compose: ComposeFile): string;
 type PortEntry = NonNullable<ComposeService['ports']>[number];
 /**
@@ -33,12 +32,13 @@ export interface PortBind {
 export declare function addressBoundServices(compose: ComposeFile, names: Iterable<string>, loopback?: ReadonlySet<string>): string[];
 /** True when the service opted in to `x-tug.rollout.strategy: rolling`. */
 export declare function isRolling(svc: ComposeService | undefined): boolean;
+/** Service keys the agent can create a container from; anything else is rejected with its name. */
+export declare const SUPPORTED_SERVICE_KEYS: readonly string[];
 export declare function validateCompose(compose: ComposeFile | undefined, nodes?: string[]): asserts compose is ComposeFile;
 export interface BuildDesiredStateOptions {
     project: string;
     version: string;
     compose: ComposeFile;
-    registry: string;
     revision?: string;
     defaultNode?: string | null;
     nodes?: Array<{
@@ -46,27 +46,13 @@ export interface BuildDesiredStateOptions {
         labels?: string[];
     }>;
 }
-export declare function buildDesiredState({ project, version, compose, registry, revision, defaultNode, nodes, }: BuildDesiredStateOptions): DesiredState;
+export declare function buildDesiredState({ project, version, compose, revision, defaultNode, nodes, }: BuildDesiredStateOptions): DesiredState;
 /** `extra_hosts` entries (`name:ip`) for services that run on other nodes, from health-aware endpoints. */
 export declare function crossNodeHosts(project: string, endpoints: Record<string, ServiceEndpoint[]>, local: Set<string>): string[];
-/** Removes `depends_on` references to `names` (services that live in another Compose project). */
-export declare function dropDependsOn(svc: ComposeService, names: ReadonlySet<string>): void;
-export interface NodeComposeOptions {
-    secrets?: Record<string, string>;
-    endpoints?: Record<string, ServiceEndpoint[]>;
-    /**
-     * Services placed here that are managed outside the node's main project (rolling services run in
-     * their own revision projects); they still count as local, so they get no cross-node `extra_hosts`
-     * entry, and `depends_on` references to them are dropped.
-     */
-    exclude?: ReadonlySet<string>;
-    nodeAddresses?: Record<string, string>;
-    /** Host IP for published ports that name none; without it `ports` stay as written. */
-    bind?: PortBind;
-}
-/** The Compose file for one node. */
-export declare function composeForNode(desiredState: DesiredState, nodeName: string, { secrets, endpoints, exclude, nodeAddresses, bind, }?: NodeComposeOptions): ComposeFile;
+/**
+ * Control secrets a service uses: the sentinels in its definition. Their versions decide whether the
+ * service is recreated, so a secret change touches exactly the services that reference it.
+ */
 export declare function serviceSecretNames(compose: ComposeFile | undefined, serviceNames: Iterable<string>): Set<string>;
 export declare function serviceSecretVersions(compose: ComposeFile | undefined, serviceNames: Iterable<string>, versions?: Record<string, number>): Record<string, Record<string, number>>;
-export declare function dumpYaml(obj: unknown): string;
 export {};

package/dist/compose.js

@@ -1,10 +1,6 @@
-import fs from 'node:fs/promises';
-import yaml from 'js-yaml';
 import crypto from 'node:crypto';
 import { isDuration } from "./util.js";
-export async function readCompose(file = 'docker-compose.yml') {
-    return yaml.load(await fs.readFile(file, 'utf8'));
-}
+import { sentinelNames } from "./normalize.js";
 export function composeHash(compose) {
     return crypto.createHash('sha1').update(JSON.stringify(compose)).digest('hex').slice(0, 12);
 }
@@ -175,16 +171,119 @@ function validateProjectExtension(compose, errors) {
     if (ext.rollback !== undefined && !['auto', 'manual'].includes(ext.rollback))
         errors.push('x-tug.rollback must be auto or manual');
 }
+/** Service keys the agent can create a container from; anything else is rejected with its name. */
+export const SUPPORTED_SERVICE_KEYS = [
+    'image',
+    'build',
+    'command',
+    'entrypoint',
+    'environment',
+    'ports',
+    'expose',
+    'volumes',
+    'tmpfs',
+    'healthcheck',
+    'restart',
+    'labels',
+    'depends_on',
+    'extra_hosts',
+    'user',
+    'working_dir',
+    'hostname',
+    'init',
+    'read_only',
+    'shm_size',
+    'mem_limit',
+    'mem_reservation',
+    'cpus',
+    'pids_limit',
+    'cap_add',
+    'cap_drop',
+    'ulimits',
+    'logging',
+    'stop_grace_period',
+    'stop_signal',
+    'x-tug',
+];
+/** Keys Compose adds or that Tug ignores on purpose: the default network, and `pull_policy` because Tug decides when images change. */
+const IGNORED_SERVICE_KEYS = ['networks', 'pull_policy'];
+const SUPPORTED_TOP_LEVEL = ['services', 'volumes', 'networks', 'name', 'x-tug'];
+const SUPPORTED_VOLUME_KEYS = ['name', 'driver', 'driver_opts', 'labels', 'external', 'x-tug'];
+const isObject = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const isExtension = (key) => key.startsWith('x-');
+function validateSubset(name, svc, compose, errors) {
+    for (const key of Object.keys(svc)) {
+        if (SUPPORTED_SERVICE_KEYS.includes(key) || IGNORED_SERVICE_KEYS.includes(key))
+            continue;
+        if (isExtension(key))
+            continue;
+        errors.push(key === 'deploy'
+            ? `${name}: deploy (swarm) is not supported; use x-tug placement`
+            : `${name}: ${key} is not supported`);
+    }
+    if (svc.networks !== undefined && svc.networks !== null) {
+        const nets = svc.networks;
+        const names = Array.isArray(nets) ? nets.map(String) : isObject(nets) ? Object.keys(nets) : [];
+        if (names.some((n) => n !== 'default'))
+            errors.push(`${name}: networks other than the default network are not supported`);
+    }
+    if (!svc.image && !svc.build)
+        errors.push(`${name}: image or build is required`);
+    for (const mount of svc.volumes || []) {
+        if (typeof mount === 'string') {
+            errors.push(`${name}: volumes must be normalized by docker compose config (got "${mount}")`);
+            continue;
+        }
+        const type = String(mount.type ?? '');
+        if (type === 'bind') {
+            if (!String(mount.source ?? '').startsWith('/'))
+                errors.push(`${name}: bind mount source ${JSON.stringify(mount.source)} must be an absolute path on the node`);
+        }
+        else if (type === 'volume') {
+            const source = String(mount.source ?? '');
+            if (!source)
+                errors.push(`${name}: anonymous volumes are not supported; name the volume`);
+            else if (!compose.volumes?.[source])
+                errors.push(`${name}: volume ${source} is not defined in top-level volumes`);
+        }
+        else if (type !== 'tmpfs')
+            errors.push(`${name}: volume type ${JSON.stringify(type)} is not supported`);
+    }
+    const deps = svc.depends_on;
+    if (isObject(deps))
+        for (const [dep, spec] of Object.entries(deps)) {
+            const condition = isObject(spec) ? String(spec.condition ?? 'service_started') : '';
+            if (!compose.services[dep])
+                errors.push(`${name}: depends_on ${dep} is not a service`);
+            else if (!['service_started', 'service_healthy'].includes(condition))
+                errors.push(`${name}: depends_on condition ${JSON.stringify(condition)} is not supported`);
+        }
+}
+function validateTopLevel(compose, errors) {
+    for (const key of Object.keys(compose))
+        if (!SUPPORTED_TOP_LEVEL.includes(key) && !isExtension(key))
+            errors.push(`${key} is not supported at the top level of the Compose file`);
+    const networks = compose.networks;
+    if (isObject(networks)) {
+        for (const [key, def] of Object.entries(networks))
+            if (key !== 'default' || (isObject(def) && def.external))
+                errors.push(`networks.${key}: custom networks are not supported`);
+    }
+    for (const [key, def] of Object.entries(compose.volumes || {})) {
+        if (!isObject(def))
+            continue;
+        for (const field of Object.keys(def))
+            if (!SUPPORTED_VOLUME_KEYS.includes(field) && !isExtension(field))
+                errors.push(`volumes.${key}: ${field} is not supported`);
+    }
+}
 export function validateCompose(compose, nodes = []) {
     if (!compose?.services || typeof compose.services !== 'object')
         throw new Error('compose file must define services');
     const errors = [];
     const ingressHosts = new Map();
     for (const [name, svc] of Object.entries(compose.services)) {
-        if (svc.container_name)
-            errors.push(`${name}: container_name is not supported`);
-        if (svc.deploy)
-            errors.push(`${name}: swarm deploy semantics are not supported`);
+        validateSubset(name, svc, compose, errors);
         const lp = svc['x-tug'] || {};
         const placement = lp.placement || {};
         const selected = placement.nodes || [];
@@ -201,11 +300,12 @@ export function validateCompose(compose, nodes = []) {
         validateIngress(name, svc, ingressHosts, errors);
         validateRollout(name, svc, errors);
     }
+    validateTopLevel(compose, errors);
     validateProjectExtension(compose, errors);
     if (errors.length)
         throw new Error(errors.join('; '));
 }
-export function buildDesiredState({ project, version, compose, registry, revision, defaultNode = null, nodes, }) {
+export function buildDesiredState({ project, version, compose, revision, defaultNode = null, nodes, }) {
     const services = {};
     for (const [name, src] of Object.entries(compose.services || {})) {
         const lp = src['x-tug'] || {};
@@ -223,9 +323,7 @@ export function buildDesiredState({ project, version, compose, registry, revisio
             }
             placement = { ...placement, nodes: selected.map((node) => node.name) };
         }
-        const image = src.build
-            ? `${registry ? `${registry}/` : 'tug-build/'}${project}/${name}:${revision || version}`
-            : src.image;
+        const image = src.build ? `tug-build/${project}/${name}:${revision || version}` : src.image;
         services[name] = {
             image,
             build: src.build || null,
@@ -247,141 +345,16 @@ export function crossNodeHosts(project, endpoints, local) {
     }
     return hosts;
 }
-/** Removes `depends_on` references to `names` (services that live in another Compose project). */
-export function dropDependsOn(svc, names) {
-    const deps = svc.depends_on;
-    if (Array.isArray(deps)) {
-        const kept = deps.filter((d) => !names.has(String(d)));
-        if (kept.length)
-            svc.depends_on = kept;
-        else
-            delete svc.depends_on;
-    }
-    else if (deps && typeof deps === 'object') {
-        const kept = Object.fromEntries(Object.entries(deps).filter(([dep]) => !names.has(dep)));
-        if (Object.keys(kept).length)
-            svc.depends_on = kept;
-        else
-            delete svc.depends_on;
-    }
-}
-function extraHostsList(value) {
-    if (!value)
-        return [];
-    return Array.isArray(value)
-        ? value.map(String)
-        : Object.entries(value).map(([k, v]) => `${k}:${v}`);
-}
-/** The Compose file for one node. */
-export function composeForNode(desiredState, nodeName, { secrets = {}, endpoints = {}, exclude = new Set(), nodeAddresses = {}, bind, } = {}) {
-    const out = {
-        services: {},
-        volumes: {},
-    };
-    const outVolumes = out.volumes;
-    const usedVolumes = new Set();
-    const placed = new Set();
-    for (const [name, src] of Object.entries(desiredState.compose.services || {})) {
-        const nodes = desiredState.services[name].placement?.nodes || [];
-        if (nodes.length && !nodes.includes(nodeName))
-            continue;
-        placed.add(name);
-        if (exclude.has(name))
-            continue;
-        const svc = { ...src, image: desiredState.services[name].image };
-        delete svc.build;
-        delete svc['x-tug'];
-        delete svc.deploy;
-        delete svc.container_name;
-        if (desiredState.services[name].artifact)
-            svc.pull_policy = 'never';
-        if (Object.keys(secrets).length)
-            svc.env_file = Array.from(new Set([
-                ...(Array.isArray(svc.env_file) ? svc.env_file : svc.env_file ? [svc.env_file] : []),
-                '.env',
-            ]));
-        for (const vol of svc.volumes || []) {
-            const source = typeof vol === 'string' ? vol.split(':')[0] : vol.source;
-            if (source && desiredState.compose?.volumes?.[source])
-                usedVolumes.add(source);
-        }
-        if (exclude.size)
-            dropDependsOn(svc, exclude);
-        if (bind && svc.ports)
-            svc.ports = bindPorts(svc.ports, bind.address, bind.loopback?.has(name) ? src['x-tug']?.ingress?.port : undefined);
-        out.services[name] = svc;
-    }
-    const hosts = crossNodeHosts(desiredState.project, endpoints, placed);
-    if (hosts.length) {
-        for (const svc of Object.values(out.services)) {
-            const existing = extraHostsList(svc.extra_hosts);
-            const taken = new Set(existing.map((h) => h.split(':')[0]));
-            svc.extra_hosts = [...existing, ...hosts.filter((h) => !taken.has(h.split(':')[0]))];
-        }
-    }
-    for (const name of usedVolumes) {
-        const vol = desiredState.compose.volumes?.[name] || {};
-        const xe = vol['x-tug'] || {};
-        const nodes = xe.placement?.nodes || [];
-        const isNfs = xe.type === 'nfs' || xe.driver === 'nfs' || (xe.type === 'shared' && xe.driver === 'nfs');
-        if (isNfs) {
-            const exporter = nodes[0];
-            const exportPath = xe.export || `/srv/tug/${name}`;
-            if (!exporter) {
-                // unplaced: nothing to export, plain local volume
-                const cleaned = { ...vol };
-                delete cleaned['x-tug'];
-                outVolumes[name] = cleaned;
-            }
-            else if (nodes.includes(nodeName)) {
-                // The exporter mounts the exported directory directly; an NFS server on this node must export it.
-                outVolumes[name] = {
-                    driver: 'local',
-                    driver_opts: { type: 'none', o: 'bind', device: exportPath },
-                };
-            }
-            else {
-                const addr = xe.address || nodeAddresses[exporter] || exporter;
-                outVolumes[name] = {
-                    driver: 'local',
-                    driver_opts: { type: 'nfs', o: `addr=${addr},rw,nolock,soft`, device: `:${exportPath}` },
-                };
-            }
-            continue;
-        }
-        if (!nodes.length || nodes.includes(nodeName))
-            outVolumes[name] = vol;
-    }
-    if (!Object.keys(outVolumes).length)
-        delete out.volumes;
-    return out;
-}
+/**
+ * Control secrets a service uses: the sentinels in its definition. Their versions decide whether the
+ * service is recreated, so a secret change touches exactly the services that reference it.
+ */
 export function serviceSecretNames(compose, serviceNames) {
-    const allowed = new Set();
-    for (const serviceName of serviceNames) {
-        const env = compose?.services?.[serviceName]?.environment || {};
-        if (Array.isArray(env)) {
-            for (const entry of env) {
-                const [key, value = ''] = String(entry).split('=');
-                if (key)
-                    allowed.add(key);
-                for (const match of String(value).matchAll(/\$\{?([A-Z_][A-Z0-9_]*)[^}]*\}?/g))
-                    allowed.add(match[1]);
-            }
-        }
-        else {
-            for (const [key, value] of Object.entries(env)) {
-                if (typeof value === 'string' && value.match(/^\$\{?[A-Z_][A-Z0-9_]*(?::-[^}]*)?\}?$/)) {
-                    const m = value.match(/^\$\{?([A-Z_][A-Z0-9_]*)/);
-                    if (m)
-                        allowed.add(m[1]);
-                }
-                else
-                    allowed.add(key);
-            }
-        }
-    }
-    return allowed;
+    const names = new Set();
+    for (const service of serviceNames)
+        for (const name of sentinelNames(compose?.services?.[service]))
+            names.add(name);
+    return names;
 }
 export function serviceSecretVersions(compose, serviceNames, versions = {}) {
     const out = {};
@@ -391,6 +364,3 @@ export function serviceSecretVersions(compose, serviceNames, versions = {}) {
     }
     return out;
 }
-export function dumpYaml(obj) {
-    return yaml.dump(obj, { noRefs: true, lineWidth: 120 });
-}