@0xmaxma/claude-gateway 1.1.9 → 1.2.0

package/dist/apps/compose-generator.js

@@ -0,0 +1,687 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseAppYaml = parseAppYaml;
+exports.generateCompose = generateCompose;
+exports.processAppYaml = processAppYaml;
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const yaml = __importStar(require("js-yaml"));
+// ─── Constants ────────────────────────────────────────────────────────────────
+const BANNED_PORTS = new Set([22, 80, 443, 10850]);
+const ALLOWED_SERVICE_FIELDS = new Set([
+    'build', 'image', 'command', 'entrypoint', 'working_dir', 'user',
+    'environment', 'volumes', 'ports', 'depends_on', 'healthcheck', 'gateway_api',
+    'cap_add', 'resources',
+]);
+// Capabilities that are safe to grant back after cap_drop ALL.
+// Needed by e.g. postgres (CHOWN, SETUID, SETGID) and services that bind low ports (NET_BIND_SERVICE).
+const ALLOWED_CAPS = new Set([
+    'CHOWN', 'DAC_OVERRIDE', 'DAC_READ_SEARCH', 'FOWNER', 'SETUID', 'SETGID',
+    'NET_BIND_SERVICE', 'KILL', 'AUDIT_WRITE',
+]);
+const ENV_KEY_RE = /^[A-Z_][A-Z0-9_]*$/;
+const IMAGE_RE = /^[a-z0-9._\-/:@]+$/;
+const NAMED_VOLUME_RE = /^[a-z0-9_-]+$/;
+const AGENT_NAME_RE = /^[a-z][a-z0-9-]{1,63}$/;
+const APP_NAME_RE = /^[a-z0-9][a-z0-9-]{1,63}$/;
+// Use homedir so the socket path is on the host-mounted volume and accessible
+// to remote Docker daemons (e.g. docker-builder DinD) via a shared bind mount.
+const SOCKET_DIR = path.join(os.homedir(), '.claude-gateway', 'sockets');
+const DEFAULT_CPU = 1.0;
+const DEFAULT_MEMORY = '256M';
+const MAX_CPU = 4.0;
+const MAX_MEMORY_MB = 2048;
+// ─── Parsing ─────────────────────────────────────────────────────────────────
+/**
+ * Parse and validate app.yaml content.
+ * appDir is used to resolve and range-check build/script paths.
+ */
+function parseAppYaml(content, appDir) {
+    let raw;
+    try {
+        raw = yaml.load(content, { schema: yaml.DEFAULT_SCHEMA });
+    }
+    catch (e) {
+        throw new Error(`Failed to parse app.yaml: ${e.message}`);
+    }
+    if (typeof raw !== 'object' || raw === null) {
+        throw new Error('app.yaml must be a YAML object');
+    }
+    const obj = raw;
+    requireString(obj, 'apiVersion');
+    requireString(obj, 'name');
+    requireString(obj, 'version');
+    if (typeof obj['services'] !== 'object' || obj['services'] === null) {
+        throw new Error('app.yaml: "services" must be an object');
+    }
+    const services = obj['services'];
+    for (const [svcName, svcDef] of Object.entries(services)) {
+        if (svcName === 'agent') {
+            validateAgentServiceDecl(svcDef);
+        }
+        else {
+            validateService(svcName, svcDef, appDir);
+        }
+    }
+    if (obj['resources'] !== undefined) {
+        validateResources(obj['resources']);
+    }
+    return raw;
+}
+// ─── Generation ───────────────────────────────────────────────────────────────
+/**
+ * Generate docker-compose.yml from a parsed app.yaml.
+ * Writes the file to outputPath and returns metadata for the installer.
+ */
+function generateCompose(appYaml, appName, appDir, outputPath) {
+    if (!APP_NAME_RE.test(appName)) {
+        throw new Error(`Invalid app name: "${appName}"`);
+    }
+    const result = {
+        ports: [],
+        sockets: [],
+        secretKeys: [],
+        agentDeclaration: null,
+        warnings: [],
+    };
+    const namedVolumes = new Set();
+    const composeServices = {};
+    // Defense-in-depth: re-validate resource limits even if parseAppYaml was skipped
+    if (appYaml.resources !== undefined) {
+        validateResources(appYaml.resources);
+    }
+    const cpu = Math.min(appYaml.resources?.cpu ?? DEFAULT_CPU, MAX_CPU);
+    const rawMem = appYaml.resources?.memory ?? DEFAULT_MEMORY;
+    const memMB = parseMemoryMB(rawMem);
+    if (memMB > MAX_MEMORY_MB) {
+        throw new Error(`resources.memory ${rawMem} exceeds maximum of 2G`);
+    }
+    const memStr = rawMem;
+    // Two-pass: collect healthcheck presence for depends_on resolution
+    const hasHealthcheck = new Set();
+    for (const [svcName, svcDef] of Object.entries(appYaml.services)) {
+        if (svcName !== 'agent') {
+            const svc = svcDef;
+            if (svc.healthcheck)
+                hasHealthcheck.add(svcName);
+        }
+    }
+    for (const [svcName, svcDef] of Object.entries(appYaml.services)) {
+        if (svcName === 'agent') {
+            const agentSvc = svcDef;
+            result.agentDeclaration = { path: agentSvc.path, name: agentSvc.name };
+            continue;
+        }
+        const svc = svcDef;
+        const containerName = `${appName}-${svcName}`;
+        const composeSvc = {
+            container_name: containerName,
+            restart: 'unless-stopped',
+            cap_drop: ['ALL'],
+            env_file: '.env',
+        };
+        // Allow explicitly declared caps back (whitelist only)
+        if (svc.cap_add && svc.cap_add.length > 0) {
+            const denied = svc.cap_add.filter((c) => !ALLOWED_CAPS.has(c));
+            if (denied.length > 0) {
+                throw new Error(`Service "${svcName}".cap_add contains disallowed capabilities: ${denied.join(', ')}. Allowed: ${[...ALLOWED_CAPS].join(', ')}`);
+            }
+            composeSvc.cap_add = svc.cap_add;
+        }
+        // build or image
+        if (svc.build) {
+            const resolved = path.resolve(appDir, svc.build);
+            if (!resolved.startsWith(appDir + path.sep) && resolved !== appDir) {
+                throw new Error(`Service "${svcName}".build must be within the app directory`);
+            }
+            try {
+                const realResolved = fs.realpathSync(resolved);
+                const realAppDir = fs.realpathSync(appDir);
+                if (!realResolved.startsWith(realAppDir + path.sep) && realResolved !== realAppDir) {
+                    throw new Error(`Service "${svcName}".build escapes the app directory via a symlink`);
+                }
+            }
+            catch (e) {
+                if (e.code !== 'ENOENT')
+                    throw e;
+            }
+            const buildConfig = { context: svc.build, network: 'host' };
+            const webPort = (svc.ports ?? []).find((p) => (p.type ?? 'api') === 'web');
+            if (webPort) {
+                buildConfig.args = { BASE_PATH: `/app/${appName}/${webPort.name}` };
+            }
+            composeSvc.build = buildConfig;
+        }
+        else if (svc.image) {
+            if (svc.image.endsWith(':latest')) {
+                result.warnings.push(`Service "${svcName}" uses floating image tag ":latest" — pin to a specific version for reproducible installs`);
+            }
+            composeSvc.image = svc.image;
+        }
+        // command / entrypoint (pass through; already validated in parse)
+        if (svc.command !== undefined)
+            composeSvc.command = svc.command;
+        if (svc.entrypoint !== undefined)
+            composeSvc.entrypoint = svc.entrypoint;
+        if (svc.working_dir !== undefined)
+            composeSvc.working_dir = svc.working_dir;
+        if (svc.user !== undefined)
+            composeSvc.user = svc.user;
+        // environment — static vars only (secrets go to .env via env_file)
+        const staticEnv = [];
+        for (const envEntry of svc.environment ?? []) {
+            const eqIdx = envEntry.indexOf('=');
+            if (eqIdx === -1) {
+                // Secret key — not in compose, recorded for installer to prompt
+                const key = envEntry.trim();
+                if (!result.secretKeys.includes(key)) {
+                    result.secretKeys.push(key);
+                }
+            }
+            else {
+                staticEnv.push(envEntry);
+            }
+        }
+        if (staticEnv.length > 0)
+            composeSvc.environment = staticEnv;
+        // volumes
+        const composeVolumes = [];
+        for (const vol of svc.volumes ?? []) {
+            const [src, ...rest] = vol.split(':');
+            if (src.startsWith('./') || src.startsWith('../')) {
+                // Relative bind mount — resolve to absolute path so Docker daemon gets a real path
+                const absPath = path.resolve(appDir, src);
+                composeVolumes.push([absPath, ...rest].join(':'));
+            }
+            else {
+                composeVolumes.push(vol);
+                if (!src.startsWith('/') && !src.startsWith('${')) {
+                    namedVolumes.add(src);
+                }
+            }
+        }
+        if (composeVolumes.length > 0)
+            composeSvc.volumes = composeVolumes;
+        for (const portDef of svc.ports ?? []) {
+            const containerPort = portDef.container;
+            const hostPort = portDef.host;
+            composeSvc.ports = composeSvc.ports ?? [];
+            composeSvc.ports.push(`${hostPort}:${containerPort}`);
+            result.ports.push({
+                name: portDef.name,
+                service: svcName,
+                hostPort,
+                containerPort,
+                type: portDef.type ?? 'api',
+                rateLimit: portDef.rate_limit ?? 200,
+            });
+        }
+        // depends_on
+        if (svc.depends_on && svc.depends_on.length > 0) {
+            const dependsObj = {};
+            for (const dep of svc.depends_on) {
+                dependsObj[dep] = {
+                    condition: hasHealthcheck.has(dep) ? 'service_healthy' : 'service_started',
+                };
+            }
+            composeSvc.depends_on = dependsObj;
+        }
+        // healthcheck
+        if (svc.healthcheck) {
+            let healthTest = svc.healthcheck.test;
+            const webPort = (svc.ports ?? []).find((p) => (p.type ?? 'api') === 'web');
+            if (webPort) {
+                const basePath = `/app/${appName}/${webPort.name}`;
+                healthTest = healthTest.replace(/(https?:\/\/(?:127\.0\.0\.1|localhost):\d+)(\/)/g, `$1${basePath}/`);
+            }
+            composeSvc.healthcheck = {
+                test: ['CMD-SHELL', healthTest],
+                interval: svc.healthcheck.interval ?? '30s',
+                timeout: svc.healthcheck.timeout ?? '10s',
+                retries: svc.healthcheck.retries ?? 3,
+            };
+        }
+        // gateway_api — inject socket directory volume, record for installer
+        if (svc.gateway_api) {
+            const hostSockDir = path.join(SOCKET_DIR, `${appName}-${svcName}`);
+            const hostSockPath = path.join(hostSockDir, 'gateway.sock');
+            const containerSockPath = svc.gateway_api.socket;
+            // Mount the parent directory so Docker bind-mount captures the directory inode
+            // (stable), not the socket file inode (recreated on each gateway restart).
+            const containerSockDir = containerSockPath.replace(/\/[^/]+$/, '') || '/';
+            const sockVol = `${hostSockDir}:${containerSockDir}`;
+            composeSvc.volumes = [
+                ...(composeSvc.volumes ?? []),
+                sockVol,
+            ];
+            const scripts = {};
+            for (const [scriptName, scriptDef] of Object.entries(svc.gateway_api.scripts ?? {})) {
+                scripts[scriptName] = {
+                    path: scriptDef.path,
+                    timeout: scriptDef.timeout ?? '30s',
+                    args: scriptDef.args,
+                };
+            }
+            result.sockets.push({
+                service: svcName,
+                hostSocketPath: hostSockPath,
+                scripts,
+            });
+        }
+        // Resource limits: per-service overrides global default
+        const svcCpu = svc.resources?.cpu !== undefined
+            ? Math.min(svc.resources.cpu, MAX_CPU)
+            : cpu;
+        const svcMemRaw = svc.resources?.memory ?? memStr;
+        const svcMemMB = parseMemoryMB(svcMemRaw);
+        if (svcMemMB > MAX_MEMORY_MB) {
+            throw new Error(`Service "${svcName}".resources.memory ${svcMemRaw} exceeds maximum of 2G`);
+        }
+        composeSvc.deploy = {
+            resources: {
+                limits: {
+                    cpus: String(svcCpu),
+                    memory: svcMemRaw,
+                },
+            },
+        };
+        composeServices[svcName] = composeSvc;
+    }
+    // Top-level volumes for named volumes
+    const composeDoc = {
+        services: composeServices,
+    };
+    if (namedVolumes.size > 0) {
+        const volsObj = {};
+        for (const v of namedVolumes)
+            volsObj[v] = null;
+        composeDoc.volumes = volsObj;
+    }
+    const banner = '# generated by claude-gateway — do not edit\n';
+    const composeYaml = banner + yaml.dump(composeDoc, { lineWidth: 120 });
+    fs.mkdirSync(path.dirname(outputPath), { recursive: true });
+    fs.writeFileSync(outputPath, composeYaml, 'utf-8');
+    return result;
+}
+// ─── Convenience wrapper ─────────────────────────────────────────────────────
+/** Read app.yaml from appDir, parse, validate, and generate docker-compose.yml. */
+function processAppYaml(appDir, appName, outputPath) {
+    const content = fs.readFileSync(path.join(appDir, 'app.yaml'), 'utf-8');
+    const appYaml = parseAppYaml(content, appDir);
+    return generateCompose(appYaml, appName, appDir, outputPath);
+}
+// ─── Validators ───────────────────────────────────────────────────────────────
+function requireString(obj, key) {
+    if (typeof obj[key] !== 'string' || !obj[key]) {
+        throw new Error(`app.yaml: "${key}" is required and must be a non-empty string`);
+    }
+}
+function validateAgentServiceDecl(svcDef) {
+    if (typeof svcDef !== 'object' || svcDef === null) {
+        throw new Error('Agent service declaration must be an object');
+    }
+    const obj = svcDef;
+    const allowed = new Set(['path', 'name']);
+    for (const k of Object.keys(obj)) {
+        if (!allowed.has(k)) {
+            throw new Error(`Agent service declaration has invalid field "${k}" — only "path" and "name" are allowed`);
+        }
+    }
+    if (typeof obj['path'] !== 'string' || !obj['path']) {
+        throw new Error('Agent service declaration: "path" is required');
+    }
+    if (typeof obj['name'] !== 'string' || !AGENT_NAME_RE.test(obj['name'])) {
+        throw new Error(`Agent service declaration: "name" must match ${AGENT_NAME_RE} (got "${obj['name']}")`);
+    }
+}
+function validateService(svcName, svcDef, appDir) {
+    if (typeof svcDef !== 'object' || svcDef === null) {
+        throw new Error(`Service "${svcName}" must be an object`);
+    }
+    const obj = svcDef;
+    for (const key of Object.keys(obj)) {
+        if (!ALLOWED_SERVICE_FIELDS.has(key)) {
+            throw new Error(`Service "${svcName}" has banned field: "${key}"`);
+        }
+    }
+    if (!obj['build'] && !obj['image']) {
+        throw new Error(`Service "${svcName}" must have "build" or "image"`);
+    }
+    if (obj['build'] && obj['image']) {
+        throw new Error(`Service "${svcName}" cannot have both "build" and "image"`);
+    }
+    if (obj['build'] !== undefined) {
+        if (typeof obj['build'] !== 'string') {
+            throw new Error(`Service "${svcName}".build must be a string`);
+        }
+        const resolved = path.resolve(appDir, obj['build']);
+        if (!resolved.startsWith(appDir + path.sep) && resolved !== appDir) {
+            throw new Error(`Service "${svcName}".build must be within the app directory`);
+        }
+        // Resolve symlinks to prevent path traversal via symlinks inside the app dir
+        try {
+            const realResolved = fs.realpathSync(resolved);
+            const realAppDir = fs.realpathSync(appDir);
+            if (!realResolved.startsWith(realAppDir + path.sep) && realResolved !== realAppDir) {
+                throw new Error(`Service "${svcName}".build escapes the app directory via a symlink`);
+            }
+        }
+        catch (e) {
+            if (e.code !== 'ENOENT')
+                throw e;
+        }
+    }
+    if (obj['image'] !== undefined) {
+        if (typeof obj['image'] !== 'string') {
+            throw new Error(`Service "${svcName}".image must be a string`);
+        }
+        if (!IMAGE_RE.test(obj['image'])) {
+            throw new Error(`Service "${svcName}".image contains invalid characters (only lowercase, digits, ._-/:@ allowed)`);
+        }
+    }
+    validateCommand(svcName, 'command', obj['command']);
+    validateCommand(svcName, 'entrypoint', obj['entrypoint']);
+    if (obj['working_dir'] !== undefined && typeof obj['working_dir'] !== 'string') {
+        throw new Error(`Service "${svcName}".working_dir must be a string`);
+    }
+    if (obj['user'] !== undefined && typeof obj['user'] !== 'string') {
+        throw new Error(`Service "${svcName}".user must be a string`);
+    }
+    if (obj['environment'] !== undefined) {
+        validateEnvironment(svcName, obj['environment']);
+    }
+    if (obj['volumes'] !== undefined) {
+        validateVolumes(svcName, obj['volumes']);
+    }
+    if (obj['ports'] !== undefined) {
+        validatePorts(svcName, obj['ports']);
+    }
+    if (obj['depends_on'] !== undefined) {
+        if (!Array.isArray(obj['depends_on'])) {
+            throw new Error(`Service "${svcName}".depends_on must be an array`);
+        }
+        for (const dep of obj['depends_on']) {
+            if (typeof dep !== 'string') {
+                throw new Error(`Service "${svcName}".depends_on entries must be strings`);
+            }
+        }
+    }
+    if (obj['healthcheck'] !== undefined) {
+        validateHealthcheck(svcName, obj['healthcheck']);
+    }
+    if (obj['gateway_api'] !== undefined) {
+        validateGatewayApi(svcName, obj['gateway_api'], appDir);
+    }
+    if (obj['cap_add'] !== undefined) {
+        if (!Array.isArray(obj['cap_add'])) {
+            throw new Error(`Service "${svcName}".cap_add must be an array`);
+        }
+        for (const cap of obj['cap_add']) {
+            if (typeof cap !== 'string') {
+                throw new Error(`Service "${svcName}".cap_add entries must be strings`);
+            }
+        }
+    }
+    if (obj['resources'] !== undefined) {
+        try {
+            validateResources(obj['resources']);
+        }
+        catch (e) {
+            throw new Error(`Service "${svcName}".${e.message.replace(/^app\.yaml: /, '')}`);
+        }
+    }
+    return svcDef;
+}
+function validateCommand(svcName, field, val) {
+    if (val === undefined)
+        return;
+    const tokens = Array.isArray(val) ? val : [val];
+    for (const token of tokens) {
+        if (typeof token !== 'string') {
+            throw new Error(`Service "${svcName}".${field} tokens must be strings`);
+        }
+        if (/[\n\r\x00]/.test(token)) {
+            throw new Error(`Service "${svcName}".${field} contains invalid characters (newline/null)`);
+        }
+    }
+}
+function validateEnvironment(svcName, envList) {
+    if (!Array.isArray(envList)) {
+        throw new Error(`Service "${svcName}".environment must be an array`);
+    }
+    for (const entry of envList) {
+        if (typeof entry !== 'string') {
+            throw new Error(`Service "${svcName}".environment entries must be strings`);
+        }
+        const key = entry.includes('=') ? entry.slice(0, entry.indexOf('=')).trim() : entry.trim();
+        if (!ENV_KEY_RE.test(key)) {
+            throw new Error(`Service "${svcName}".environment key "${key}" must match ${ENV_KEY_RE}`);
+        }
+        // Strip any newlines from value (value after =)
+        if (entry.includes('=') && /[\n\r]/.test(entry.slice(entry.indexOf('=') + 1))) {
+            throw new Error(`Service "${svcName}".environment entry "${key}" value contains newline characters`);
+        }
+    }
+}
+function validateVolumes(svcName, volList) {
+    if (!Array.isArray(volList)) {
+        throw new Error(`Service "${svcName}".volumes must be an array`);
+    }
+    for (const vol of volList) {
+        if (typeof vol !== 'string') {
+            throw new Error(`Service "${svcName}".volumes entries must be strings`);
+        }
+        const parts = vol.split(':');
+        if (parts.length < 2 || parts.length > 3) {
+            throw new Error(`Service "${svcName}".volumes entry is malformed: "${vol}"`);
+        }
+        const [src, target, mode] = parts;
+        if (!src || !target) {
+            throw new Error(`Service "${svcName}".volumes entry is malformed: "${vol}"`);
+        }
+        if (src.startsWith('/')) {
+            // Host mount — validate absolute, no traversal, no symlinks
+            const resolved = path.resolve(src);
+            if (resolved !== src) {
+                throw new Error(`Service "${svcName}".volumes source contains path traversal: "${src}"`);
+            }
+            try {
+                if (fs.lstatSync(src).isSymbolicLink()) {
+                    throw new Error(`Service "${svcName}".volumes source must not be a symlink: "${src}"`);
+                }
+            }
+            catch (err) {
+                const e = err;
+                if (e.code !== 'ENOENT')
+                    throw e; // path doesn't exist yet — OK
+            }
+        }
+        else if (/^\$\{[A-Z_][A-Z0-9_]*(:-[^}]*)?\}(\/[^.][^:]*)?(\/\.\.)?/.test(src) && src.startsWith('${')) {
+            // Env var substitution: ${VAR} or ${VAR:-default} — Docker Compose expands at runtime.
+            // Reject if the suffix contains traversal sequences.
+            const suffix = src.replace(/^\$\{[^}]+\}/, '');
+            if (suffix.includes('..')) {
+                throw new Error(`Service "${svcName}".volumes source contains path traversal: "${src}"`);
+            }
+        }
+        else if (src.startsWith('./') || src.startsWith('../')) {
+            // Relative bind mount (e.g. ./postgres) — validate no double traversal beyond ./
+            if (src.includes('/../') || src.endsWith('/..')) {
+                throw new Error(`Service "${svcName}".volumes source contains path traversal: "${src}"`);
+            }
+        }
+        else {
+            // Named volume
+            if (!NAMED_VOLUME_RE.test(src)) {
+                throw new Error(`Service "${svcName}".volumes named volume must match ${NAMED_VOLUME_RE}: "${src}"`);
+            }
+        }
+        if (!target.startsWith('/')) {
+            throw new Error(`Service "${svcName}".volumes target must be an absolute path: "${target}"`);
+        }
+        if (target.includes('..')) {
+            throw new Error(`Service "${svcName}".volumes target contains path traversal: "${target}"`);
+        }
+        if (mode !== undefined && mode !== 'ro' && mode !== 'rw') {
+            throw new Error(`Service "${svcName}".volumes mode must be "ro" or "rw": "${mode}"`);
+        }
+    }
+}
+function validatePorts(svcName, portList) {
+    if (!Array.isArray(portList)) {
+        throw new Error(`Service "${svcName}".ports must be an array`);
+    }
+    const seenContainer = new Set();
+    const seenHost = new Set();
+    for (const portDef of portList) {
+        if (typeof portDef !== 'object' || portDef === null) {
+            throw new Error(`Service "${svcName}".ports entries must be objects`);
+        }
+        const p = portDef;
+        if (typeof p['name'] !== 'string' || !p['name']) {
+            throw new Error(`Service "${svcName}".ports entry missing "name"`);
+        }
+        if (typeof p['container'] !== 'number' || !Number.isInteger(p['container'])) {
+            throw new Error(`Service "${svcName}".ports["${p['name']}"].container must be an integer`);
+        }
+        const containerPort = p['container'];
+        if (containerPort < 1024 || BANNED_PORTS.has(containerPort)) {
+            throw new Error(`Service "${svcName}".ports["${p['name']}"].container ${containerPort} is banned`);
+        }
+        if (seenContainer.has(containerPort)) {
+            throw new Error(`Service "${svcName}".ports has duplicate container port ${containerPort}`);
+        }
+        seenContainer.add(containerPort);
+        if (typeof p['host'] !== 'number' || !Number.isInteger(p['host'])) {
+            throw new Error(`Service "${svcName}".ports["${p['name']}"].host is required and must be an integer`);
+        }
+        const hostPort = p['host'];
+        if (hostPort < 1024 || BANNED_PORTS.has(hostPort)) {
+            throw new Error(`Service "${svcName}".ports["${p['name']}"].host ${hostPort} is banned`);
+        }
+        if (seenHost.has(hostPort)) {
+            throw new Error(`Service "${svcName}".ports has duplicate host port ${hostPort}`);
+        }
+        seenHost.add(hostPort);
+        if (p['type'] !== undefined && p['type'] !== 'api' && p['type'] !== 'web') {
+            throw new Error(`Service "${svcName}".ports["${p['name']}"].type must be "api" or "web"`);
+        }
+        if (p['rate_limit'] !== undefined) {
+            if (typeof p['rate_limit'] !== 'number' || p['rate_limit'] <= 0) {
+                throw new Error(`Service "${svcName}".ports["${p['name']}"].rate_limit must be a positive number`);
+            }
+        }
+    }
+}
+function validateHealthcheck(svcName, hc) {
+    if (typeof hc !== 'object' || hc === null) {
+        throw new Error(`Service "${svcName}".healthcheck must be an object`);
+    }
+    const obj = hc;
+    if (typeof obj['test'] !== 'string' || !obj['test']) {
+        throw new Error(`Service "${svcName}".healthcheck.test must be a non-empty string`);
+    }
+}
+function validateGatewayApi(svcName, gatewayApi, appDir) {
+    if (typeof gatewayApi !== 'object' || gatewayApi === null) {
+        throw new Error(`Service "${svcName}".gateway_api must be an object`);
+    }
+    const obj = gatewayApi;
+    if (typeof obj['socket'] !== 'string' || !obj['socket']) {
+        throw new Error(`Service "${svcName}".gateway_api.socket must be a non-empty string`);
+    }
+    if (obj['scripts'] !== undefined) {
+        if (typeof obj['scripts'] !== 'object' || obj['scripts'] === null) {
+            throw new Error(`Service "${svcName}".gateway_api.scripts must be an object`);
+        }
+        for (const [scriptName, scriptDef] of Object.entries(obj['scripts'])) {
+            validateScript(svcName, scriptName, scriptDef, appDir);
+        }
+    }
+}
+function validateScript(svcName, scriptName, scriptDef, appDir) {
+    if (typeof scriptDef !== 'object' || scriptDef === null) {
+        throw new Error(`Service "${svcName}".gateway_api.scripts["${scriptName}"] must be an object`);
+    }
+    const obj = scriptDef;
+    if (typeof obj['path'] !== 'string' || !obj['path']) {
+        throw new Error(`Service "${svcName}".gateway_api.scripts["${scriptName}"].path must be a string`);
+    }
+    const scriptPath = obj['path'];
+    if (scriptPath.startsWith('/')) {
+        throw new Error(`Service "${svcName}".gateway_api.scripts["${scriptName}"].path must be relative (not absolute)`);
+    }
+    if (!scriptPath.endsWith('.sh')) {
+        throw new Error(`Service "${svcName}".gateway_api.scripts["${scriptName}"].path must be a .sh file`);
+    }
+    const resolved = path.resolve(appDir, scriptPath);
+    if (!resolved.startsWith(appDir + path.sep) && resolved !== appDir) {
+        throw new Error(`Service "${svcName}".gateway_api.scripts["${scriptName}"].path must be within the app directory`);
+    }
+}
+function validateResources(resources) {
+    if (typeof resources !== 'object' || resources === null) {
+        throw new Error('app.yaml: "resources" must be an object');
+    }
+    const obj = resources;
+    if (obj['cpu'] !== undefined) {
+        if (typeof obj['cpu'] !== 'number' || obj['cpu'] <= 0) {
+            throw new Error('app.yaml: resources.cpu must be a positive number');
+        }
+        if (obj['cpu'] > MAX_CPU) {
+            throw new Error(`app.yaml: resources.cpu ${obj['cpu']} exceeds maximum of ${MAX_CPU}`);
+        }
+    }
+    if (obj['memory'] !== undefined) {
+        if (typeof obj['memory'] !== 'string') {
+            throw new Error('app.yaml: resources.memory must be a string (e.g. "256M", "1G")');
+        }
+        const mb = parseMemoryMB(obj['memory']);
+        if (mb > MAX_MEMORY_MB) {
+            throw new Error(`app.yaml: resources.memory ${obj['memory']} exceeds maximum of 2G`);
+        }
+    }
+}
+function parseMemoryMB(mem) {
+    const m = mem.match(/^(\d+(?:\.\d+)?)\s*([MG])$/i);
+    if (!m) {
+        throw new Error(`Invalid memory format: "${mem}" (expected e.g. "256M", "1G")`);
+    }
+    const [, num, unit] = m;
+    return unit.toUpperCase() === 'G' ? parseFloat(num) * 1024 : parseFloat(num);
+}
+//# sourceMappingURL=compose-generator.js.map