@agentage/extension 0.1.2 → 0.2.1

package/dist/tool/stage.js

@@ -1,11 +1,14 @@
 import { access, cp, mkdir, mkdtemp, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
-import { basename, dirname, isAbsolute, join, normalize, sep } from 'node:path';
+import { dirname, isAbsolute, join, normalize, sep } from 'node:path';
 import {} from '../manifest/manifest.schema.js';
-import { entryOf } from '../manifest/parts.js';
+import { entryOf, hasPostgres } from '../manifest/parts.js';
 import {} from '../manifest/primitives.schema.js';
+import { OPENAPI_FILE } from '../discovery/openapi.js';
 import { serverPartRecipe } from './recipe.js';
 export const RECORD_FILE = 'agentage-extension.json';
+// The api image's migrate entry: `node dist/store/migrate.js` in /app runs the kit's migration runner.
+export const MIGRATE_SHIM = "// Generated by @agentage/extension build.\nimport '@agentage/extension/migrate';\n";
 const dependencySpecs = (pkg) => {
     const deps = pkg.dependencies;
     if (typeof deps !== 'object' || deps === null)
@@ -22,44 +25,59 @@ export const localTarballs = (pkg) => dependencySpecs(pkg)
     }
     return path;
 });
+export const exists = (path) => access(path).then(() => true, () => false);
 const copyInto = async (from, to) => {
     await mkdir(dirname(to), { recursive: true });
     await cp(from, to, { recursive: true });
 };
 const copyDeps = async (dir, root, pkg) => {
-    await access(join(dir, 'package-lock.json')).catch(() => {
+    if (!(await exists(join(dir, 'package-lock.json')))) {
         throw new Error('package-lock.json is missing: the image installs with npm ci');
-    });
+    }
     await copyInto(join(dir, 'package.json'), join(root, 'deps', 'package.json'));
     await copyInto(join(dir, 'package-lock.json'), join(root, 'deps', 'package-lock.json'));
     for (const path of localTarballs(pkg))
         await copyInto(join(dir, path), join(root, 'deps', path));
 };
-const copyApp = async (dir, root) => {
-    await copyInto(join(dir, 'package.json'), join(root, 'app', 'package.json'));
-    await cp(join(dir, 'dist'), join(root, 'app', 'dist'), {
-        recursive: true,
-        filter: (source) => basename(source) !== RECORD_FILE,
-    });
+// The api image runs the migrate job, so it alone carries the migrations; seeds never ship.
+const migrates = (pkg, part) => part === 'api' && hasPostgres(pkg);
+// What a part image carries: its own dist/{part}, the shared dist/lib, and for api the migrations.
+export const appPaths = async (dir, pkg, part) => {
+    const paths = ['package.json', join('dist', part)];
+    if (part === 'api' && (await exists(join(dir, OPENAPI_FILE))))
+        paths.push(OPENAPI_FILE);
+    if (await exists(join(dir, 'dist', 'lib')))
+        paths.push(join('dist', 'lib'));
+    if (migrates(pkg, part) && (await exists(join(dir, 'migrations'))))
+        paths.push('migrations');
+    return paths;
+};
+const copyApp = async (dir, root, pkg, part) => {
+    for (const path of await appPaths(dir, pkg, part))
+        await copyInto(join(dir, path), join(root, 'app', path));
+    if (migrates(pkg, part)) {
+        await mkdir(join(root, 'app', 'dist', 'store'), { recursive: true });
+        await writeFile(join(root, 'app', 'dist', 'store', 'migrate.js'), MIGRATE_SHIM);
+    }
 };
+// ui is a bundle, not an entry: the widget bundler writes dist/ui/widgets.json beside it.
+const builtFile = (pkg, part) => normalize(part === 'ui' ? './dist/ui/widgets.json' : entryOf(pkg, part));
 // The image carries dist/ only, so an entry outside it, or never built, would not start.
-const assertBuiltEntry = async (dir, pkg, part) => {
-    const entry = normalize(entryOf(pkg, part));
-    if (!entry.startsWith(`dist${sep}`))
-        throw new Error(`the ${part} entry ${entry} is not in dist/`);
-    try {
-        await access(join(dir, entry));
+export const assertBuilt = async (dir, pkg, part) => {
+    const file = builtFile(pkg, part);
+    if (!file.startsWith(`dist${sep}${part}${sep}`)) {
+        throw new Error(`the ${part} entry ${file} is not in dist/${part}/`);
     }
-    catch {
-        throw new Error(`${entry} not found: the package build must write the ${part} entry there`);
+    if (!(await exists(join(dir, file)))) {
+        throw new Error(`${file} not found: the package build must write the ${part} part there`);
     }
 };
-// A clean build context per part: only the manifest, the lockfile, local tarballs and dist/.
+// A clean build context per part: the manifest, the lockfile, local tarballs and the part's files.
 export const stageContext = async (dir, pkg, part, tmpRoot = tmpdir()) => {
-    await assertBuiltEntry(dir, pkg, part);
+    await assertBuilt(dir, pkg, part);
     const root = await mkdtemp(join(tmpRoot, `agentage-${pkg.agentage.id}-${part}-`));
     await copyDeps(dir, root, pkg);
-    await copyApp(dir, root);
+    await copyApp(dir, root, pkg, part);
     await writeFile(join(root, 'Dockerfile'), serverPartRecipe(part));
     return root;
 };

package/dist/tool/timeouts.d.ts

@@ -0,0 +1,10 @@
+export declare const TIMEOUTS: {
+    readonly command: 120000;
+    readonly compile: 600000;
+    readonly build: 1200000;
+    readonly push: 600000;
+    readonly start: 600000;
+    readonly migrate: 300000;
+    readonly issuer: 5000;
+};
+export declare const KILL_GRACE_MS = 5000;

package/dist/tool/timeouts.js

@@ -0,0 +1,19 @@
+// Every outbound call the tool makes and its bound; none retries, since a re-run is safe.
+export const TIMEOUTS = {
+    // git rev-parse, docker image inspect, compose ps, logs and down, the port check
+    command: 120_000,
+    // the package's own npm run build
+    compile: 600_000,
+    // docker build: a cold cache pulls the node base image and runs npm ci
+    build: 1_200_000,
+    // docker push to the registry
+    push: 600_000,
+    // compose up: the store and gateway images are pulled on first use
+    start: 600_000,
+    // compose run migrate: the store's migrations and seeds
+    migrate: 300_000,
+    // POST /token to the dev issuer
+    issuer: 5_000,
+};
+// SIGTERM first; a command that ignores it is killed this long after.
+export const KILL_GRACE_MS = 5_000;

package/dist/tool/up/compose-run.d.ts

@@ -0,0 +1,15 @@
+import { type Run } from '../exec.js';
+export interface ComposeTarget {
+    file?: string;
+    project: string;
+}
+export interface ServiceState {
+    service: string;
+    state: string;
+    health: string;
+    exitCode: number;
+}
+export declare const composeArgs: (target: ComposeTarget, args: string[]) => string[];
+export declare const compose: (run: Run, target: ComposeTarget, args: string[], timeoutMs?: number) => Promise<string>;
+export declare const parsePs: (stdout: string) => ServiceState[];
+export declare const states: (run: Run, target: ComposeTarget) => Promise<ServiceState[]>;

package/dist/tool/up/compose-run.js

@@ -0,0 +1,25 @@
+import { mustRun } from '../exec.js';
+export const composeArgs = (target, args) => [
+    'compose',
+    ...(target.file ? ['-f', target.file] : []),
+    '-p',
+    target.project,
+    ...args,
+];
+export const compose = (run, target, args, timeoutMs) => mustRun(run, 'docker', composeArgs(target, args), { timeoutMs });
+// `compose ps --format json` prints one object per line (older releases: one array).
+export const parsePs = (stdout) => {
+    const text = stdout.trim();
+    if (text === '')
+        return [];
+    const rows = text.startsWith('[')
+        ? JSON.parse(text)
+        : text.split('\n').map((line) => JSON.parse(line));
+    return rows.map((row) => ({
+        service: row.Service ?? '',
+        state: row.State ?? '',
+        health: row.Health ?? '',
+        exitCode: row.ExitCode ?? 0,
+    }));
+};
+export const states = async (run, target) => parsePs(await compose(run, target, ['ps', '-a', '--format', 'json']));

package/dist/tool/up/compose.d.ts

@@ -0,0 +1,19 @@
+import { type ExtensionPackage } from '../../manifest/manifest.schema.js';
+export declare const STORE_IMAGE = "postgres:18-alpine";
+export interface ComposeInput {
+    pkg: ExtensionPackage;
+    project: string;
+    tags: Record<string, string>;
+    recordFile: string;
+    gatewayFile: string;
+    seedsDir?: string;
+}
+export declare const composeFile: (input: ComposeInput) => {
+    name: string;
+    services: Record<string, unknown>;
+    volumes: {
+        store: {};
+    } | {
+        store?: undefined;
+    };
+};

package/dist/tool/up/compose.js

@@ -0,0 +1,80 @@
+import {} from '../../manifest/manifest.schema.js';
+import { hasPostgres, imageParts } from '../../manifest/parts.js';
+import {} from '../../manifest/primitives.schema.js';
+import { DEV_ISSUER } from './dev-issuer-app.js';
+import { GATEWAY_PORT, ISSUER_PORT, PART_PORT, TRAEFIK_COMMAND, TRAEFIK_IMAGE } from './gateway.js';
+export const STORE_IMAGE = 'postgres:18-alpine';
+const RECORD_TARGET = '/run/agentage/agentage-extension.json';
+const ISSUER_ENTRY = 'node_modules/@agentage/extension/dist/tool/up/dev-issuer.js';
+// A local-only credential: the store has no published port, only the parts' network reaches it.
+const STORE_PASSWORD = 'agentage-local';
+const storeUrl = (id) => `postgres://${id}:${STORE_PASSWORD}@store:5432/${id}`;
+// Only the ui under `up` names the dev issuer: its CSP then lets the harness ask it for a token.
+const partEnv = (pkg, part) => ({
+    AGENTAGE_ORIGIN: `http://localhost:${GATEWAY_PORT}`,
+    AGENTAGE_RECORD_FILE: RECORD_TARGET,
+    ...(hasPostgres(pkg) && part !== 'ui' ? { AGENTAGE_STORE_URL: storeUrl(pkg.agentage.id) } : {}),
+    ...(part === 'ui' ? { AGENTAGE_DEV_ISSUER: DEV_ISSUER } : {}),
+});
+const storeService = (id) => ({
+    image: STORE_IMAGE,
+    environment: { POSTGRES_USER: id, POSTGRES_PASSWORD: STORE_PASSWORD, POSTGRES_DB: id },
+    volumes: ['store:/var/lib/postgresql'],
+    healthcheck: {
+        test: ['CMD-SHELL', `pg_isready -U ${id} -d ${id}`],
+        interval: '2s',
+        timeout: '3s',
+        retries: 30,
+    },
+});
+const partService = (input, part) => ({
+    image: input.tags[part],
+    environment: partEnv(input.pkg, part),
+    volumes: [`${input.recordFile}:${RECORD_TARGET}:ro`],
+    ...(hasPostgres(input.pkg) && part !== 'ui'
+        ? { depends_on: { store: { condition: 'service_healthy' } } }
+        : {}),
+});
+const fixedServices = (input, anyImage) => ({
+    gateway: {
+        image: TRAEFIK_IMAGE,
+        command: TRAEFIK_COMMAND,
+        ports: [`127.0.0.1:${GATEWAY_PORT}:80`],
+        volumes: [`${input.gatewayFile}:/etc/traefik/dynamic.yml:ro`],
+        healthcheck: {
+            test: ['CMD', 'wget', '-qO-', 'http://127.0.0.1:8082/ping'],
+            interval: '2s',
+            timeout: '3s',
+            retries: 30,
+        },
+    },
+    issuer: {
+        image: anyImage,
+        command: ['node', ISSUER_ENTRY],
+        ports: [`127.0.0.1:${ISSUER_PORT}:${PART_PORT}`],
+    },
+});
+const migrateService = (input) => ({
+    image: input.tags['api'],
+    command: ['node', 'dist/store/migrate.js'],
+    environment: partEnv(input.pkg, 'migrate'),
+    ...(input.seedsDir ? { volumes: [`${input.seedsDir}:/app/seeds:ro`] } : {}),
+    depends_on: { store: { condition: 'service_healthy' } },
+    profiles: ['jobs'],
+    restart: 'no',
+});
+// One compose file: gateway, dev issuer, the store and its migrate job, one service per part.
+export const composeFile = (input) => {
+    const parts = imageParts(input.pkg);
+    const services = {};
+    for (const part of parts)
+        services[part] = partService(input, part);
+    Object.assign(services, fixedServices(input, input.tags[parts[0] ?? 'api'] ?? ''));
+    if (hasPostgres(input.pkg)) {
+        services['store'] = storeService(input.pkg.agentage.id);
+        if (input.tags['api'])
+            services['migrate'] = migrateService(input);
+    }
+    const volumes = hasPostgres(input.pkg) ? { store: {} } : {};
+    return { name: input.project, services, volumes };
+};

package/dist/tool/up/dev-issuer-app.d.ts

@@ -0,0 +1,22 @@
+import { type KeyObject } from 'node:crypto';
+import { type Server } from 'node:http';
+import { z } from 'zod';
+export declare const DEV_ISSUER = "http://localhost:4281";
+export declare const DEV_AUDIENCE = "*.agentage.io";
+declare const TokenRequestSchema: z.ZodObject<{
+    scope: z.ZodString;
+    sub: z.ZodOptional<z.ZodString>;
+    ttlSeconds: z.ZodOptional<z.ZodInt>;
+}, z.core.$strict>;
+interface Keys {
+    kid: string;
+    privateKey: KeyObject;
+    jwk: Record<string, unknown>;
+}
+export declare const newKeys: () => Keys;
+export declare const mint: (keys: Keys, request: z.infer<typeof TokenRequestSchema>, now?: number) => {
+    token: string;
+    expiresAt: string;
+};
+export declare const createIssuer: (keys?: Keys) => Server;
+export {};

package/dist/tool/up/dev-issuer-app.js

@@ -0,0 +1,80 @@
+import { generateKeyPairSync, randomUUID, sign } from 'node:crypto';
+import { createServer } from 'node:http';
+import { z } from 'zod';
+export const DEV_ISSUER = 'http://localhost:4281';
+export const DEV_AUDIENCE = '*.agentage.io';
+const TokenRequestSchema = z.strictObject({
+    scope: z
+        .string()
+        .max(512)
+        .regex(/^[a-z][a-z0-9-]*:(read|write|admin)( [a-z][a-z0-9-]*:(read|write|admin))*$/),
+    sub: z
+        .string()
+        .regex(/^[A-Za-z0-9_-]{1,64}$/)
+        .optional(),
+    ttlSeconds: z.int().min(60).max(86_400).optional(),
+});
+export const newKeys = () => {
+    const { privateKey, publicKey } = generateKeyPairSync('ed25519');
+    const kid = `dev-${randomUUID().slice(0, 8)}`;
+    return {
+        kid,
+        privateKey,
+        jwk: { ...publicKey.export({ format: 'jwk' }), kid, alg: 'EdDSA', use: 'sig' },
+    };
+};
+const b64 = (value) => Buffer.from(JSON.stringify(value)).toString('base64url');
+// The api-standards token shape: aga_<jwt>, typ at+jwt, EdDSA, scope {id}:{verb}, a jti.
+export const mint = (keys, request, now = Date.now()) => {
+    const iat = Math.floor(now / 1000);
+    const exp = iat + (request.ttlSeconds ?? 3600);
+    const claims = {
+        iss: DEV_ISSUER,
+        sub: request.sub ?? 'usr_dev',
+        aud: DEV_AUDIENCE,
+        scope: request.scope,
+        iat,
+        exp,
+        jti: `tok_${randomUUID()}`,
+    };
+    const input = `${b64({ alg: 'EdDSA', typ: 'at+jwt', kid: keys.kid })}.${b64(claims)}`;
+    const signature = sign(null, Buffer.from(input), keys.privateKey).toString('base64url');
+    return { token: `aga_${input}.${signature}`, expiresAt: new Date(exp * 1000).toISOString() };
+};
+const reply = (res, status, body) => {
+    res.writeHead(status, {
+        'content-type': 'application/json',
+        'cache-control': 'no-store',
+        'access-control-allow-origin': '*',
+        'access-control-allow-headers': 'content-type',
+        'access-control-allow-methods': 'GET, POST, OPTIONS',
+    });
+    res.end(body === undefined ? undefined : JSON.stringify(body));
+};
+const readBody = async (req) => {
+    let text = '';
+    for await (const chunk of req)
+        text += String(chunk);
+    if (text.length > 4096)
+        throw new Error('body too large');
+    return JSON.parse(text || '{}');
+};
+const tokenRoute = async (keys, req, res) => {
+    const parsed = TokenRequestSchema.safeParse(await readBody(req).catch(() => null));
+    if (!parsed.success)
+        return reply(res, 400, { error: 'scope must be {id}:{read|write|admin}, space-separated' });
+    reply(res, 200, mint(keys, parsed.data));
+};
+// Mints only: the kit does not verify tokens yet. Never part of a deployed estate.
+export const createIssuer = (keys = newKeys()) => createServer((req, res) => {
+    const path = (req.url ?? '/').split('?')[0];
+    if (req.method === 'OPTIONS')
+        return reply(res, 204, undefined);
+    if (req.method === 'GET' && path === '/health')
+        return reply(res, 200, { status: 'ok' });
+    if (req.method === 'GET' && path === '/.well-known/jwks.json')
+        return reply(res, 200, { keys: [keys.jwk] });
+    if (req.method === 'POST' && path === '/token')
+        return void tokenRoute(keys, req, res);
+    reply(res, 404, { error: 'not found' });
+});

package/dist/tool/up/dev-issuer.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/tool/up/dev-issuer.js

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+import { portFromEnv } from '../../runtime/build-info.js';
+import { createIssuer } from './dev-issuer-app.js';
+// The dev issuer of `up`: run from a part image, on the image's port so its HEALTHCHECK answers.
+const port = portFromEnv(process.env);
+createIssuer().listen(port, () => process.stderr.write(`dev issuer on :${port}\n`));

package/dist/tool/up/down.d.ts

@@ -0,0 +1,13 @@
+import { type Run } from '../exec.js';
+export interface DownOptions {
+    dir?: string;
+    keepData?: boolean;
+    onLine?: (line: string) => void;
+}
+export interface DownResult {
+    project: string;
+    containers: number;
+    networks: number;
+    volumes: number;
+}
+export declare const down: (options?: DownOptions, run?: Run) => Promise<DownResult>;

package/dist/tool/up/down.js

@@ -0,0 +1,47 @@
+import { join } from 'node:path';
+import { readManifest } from '../../manifest/read-manifest.js';
+import { quietly, runCommand } from '../exec.js';
+import { composeArgs } from './compose-run.js';
+import { plural, stepLine } from './lines.js';
+import { LOCAL_DIR } from './local-record.js';
+import { legacyProject, projectName, renderedProject, workingCopy } from './project.js';
+const count = (log, kind) => log.split('\n').filter((line) => new RegExp(`\\b${kind}\\b.*\\bRemoved\\b`).test(line)).length;
+const removedOf = (log) => ({
+    containers: count(log, 'Container'),
+    networks: count(log, 'Network'),
+    volumes: count(log, 'Volume'),
+});
+const summary = (removed, keepData) => {
+    if (removed.containers + removed.networks + removed.volumes === 0)
+        return 'nothing was running';
+    const counts = [
+        plural(removed.containers, 'container'),
+        plural(removed.networks, 'network'),
+        plural(removed.volumes, 'volume'),
+    ];
+    return counts.join(' · ') + (keepData ? ' (the store volume kept)' : '');
+};
+// This folder's own project; a copied compose.json naming another copy's project is ignored.
+const targetOf = async (dir) => {
+    const { id } = (await readManifest(dir)).agentage;
+    const file = join(dir, LOCAL_DIR, 'compose.json');
+    const rendered = await renderedProject(file);
+    const project = projectName(id, dir);
+    if (rendered === project)
+        return { file, project };
+    return { project: rendered === legacyProject(id) ? rendered : project };
+};
+// Everything `up` started in this working copy goes, and only that; --keep-data keeps the store.
+export const down = async (options = {}, run = runCommand) => {
+    const dir = await workingCopy(options.dir);
+    const target = await targetOf(dir);
+    const volumes = options.keepData ? [] : ['--volumes'];
+    const args = composeArgs(target, ['--profile', 'jobs', 'down', '--remove-orphans', ...volumes]);
+    const result = await quietly(run)('docker', args);
+    const log = result.stderr ?? '';
+    if (result.code !== 0)
+        throw new Error(`docker compose down failed: ${log.trim()}`);
+    const removed = removedOf(log);
+    options.onLine?.(stepLine('removed', summary(removed, options.keepData), target.project));
+    return { project: target.project, ...removed };
+};

package/dist/tool/up/gateway.d.ts

@@ -0,0 +1,36 @@
+import { type ImagePartKind } from '../../manifest/primitives.schema.js';
+export declare const GATEWAY_PORT = 4280;
+export declare const ISSUER_PORT = 4281;
+export declare const PART_PORT = 3000;
+export declare const TRAEFIK_IMAGE = "traefik:v3.7.17@sha256:68ae5fe5b64ca166704b746a9e8afcd385e36b3f569a5691401bf652d57b3748";
+export declare const PART_PATHS: {
+    pages: string;
+    ui: string;
+    api: string;
+    mcp: string;
+};
+type RoutedPart = keyof typeof PART_PATHS;
+export declare const partPath: (part: RoutedPart, version: string) => string;
+export declare const gatewayConfig: (parts: ImagePartKind[], version: string) => {
+    http: {
+        middlewares: {
+            'gateway-headers': {
+                headers: {
+                    contentTypeNosniff: boolean;
+                    referrerPolicy: string;
+                    frameDeny: boolean;
+                };
+            };
+        };
+        services: Record<string, unknown>;
+        routers: Record<string, {
+            rule: string;
+            priority: number;
+            service: string;
+            entryPoints: string[];
+            middlewares: string[];
+        }>;
+    };
+};
+export declare const TRAEFIK_COMMAND: string[];
+export {};

package/dist/tool/up/gateway.js

@@ -0,0 +1,60 @@
+import {} from '../../manifest/primitives.schema.js';
+export const GATEWAY_PORT = 4280;
+export const ISSUER_PORT = 4281;
+export const PART_PORT = 3000;
+export const TRAEFIK_IMAGE = 'traefik:v3.7.17@sha256:68ae5fe5b64ca166704b746a9e8afcd385e36b3f569a5691401bf652d57b3748';
+// The URL layout of api-standards section 1, as the estate's gateway renders it.
+const RESERVED = 'PathPrefix(`/api/`) || Path(`/mcp`) || PathPrefix(`/mcp/`) || PathPrefix(`/ui/`) || PathPrefix(`/.well-known/`) || PathPrefix(`/git/`) || Path(`/health`)';
+// Each routed part's path, in the order `up` prints them; /mcp is exact, the rest are prefixes.
+export const PART_PATHS = { pages: '/', ui: '/ui/{version}/', api: '/api/v1/', mcp: '/mcp' };
+// In this order, so the first present serves /.well-known/ (api-standards section 1).
+const ROUTED = ['api', 'mcp', 'pages', 'ui'];
+export const partPath = (part, version) => PART_PATHS[part].replace('{version}', version);
+const ruleOf = (part, version) => part === 'mcp' ? 'Path(`/mcp`)' : `PathPrefix(\`${partPath(part, version)}\`)`;
+const router = (rule, priority, service) => ({
+    rule,
+    priority,
+    service,
+    entryPoints: ['web'],
+    middlewares: ['gateway-headers'],
+});
+const partRouters = (routed, version) => {
+    const routers = {};
+    for (const part of routed)
+        routers[part] = router(ruleOf(part, version), part === 'pages' ? 1 : 100, part);
+    if (routed[0])
+        routers['well-known'] = router('PathPrefix(`/.well-known/`)', 100, routed[0]);
+    return routers;
+};
+// Traefik's file provider: a reserved-prefix miss is Traefik's own 404, like the estate gateway.
+export const gatewayConfig = (parts, version) => {
+    const routed = ROUTED.filter((part) => parts.includes(part));
+    const services = {
+        'gateway-miss': { loadBalancer: { servers: [{ url: 'http://127.0.0.1:8081' }] } },
+    };
+    for (const part of routed)
+        services[part] = { loadBalancer: { servers: [{ url: `http://${part}:${PART_PORT}` }] } };
+    const routers = {
+        reserved: router(RESERVED, 50, 'gateway-miss'),
+        ...partRouters(routed, version),
+    };
+    if (!routed.includes('pages'))
+        routers['host'] = router('PathPrefix(`/`)', 1, 'gateway-miss');
+    const headers = {
+        contentTypeNosniff: true,
+        referrerPolicy: 'strict-origin-when-cross-origin',
+        frameDeny: true,
+    };
+    return { http: { middlewares: { 'gateway-headers': { headers } }, services, routers } };
+};
+export const TRAEFIK_COMMAND = [
+    '--global.checkNewVersion=false',
+    '--global.sendAnonymousUsage=false',
+    '--log.format=json',
+    '--providers.file.filename=/etc/traefik/dynamic.yml',
+    '--entryPoints.web.address=:80',
+    // No routers listen here, so every request it receives gets Traefik's own 404.
+    '--entryPoints.miss.address=:8081',
+    '--entryPoints.ping.address=127.0.0.1:8082',
+    '--ping.entryPoint=ping',
+];

package/dist/tool/up/lines.d.ts

@@ -0,0 +1,2 @@
+export declare const stepLine: (label: string, what: string, detail?: string) => string;
+export declare const plural: (n: number, word: string) => string;

package/dist/tool/up/lines.js

@@ -0,0 +1,3 @@
+// What `up` and `down` print: a label, what it is, the detail; the columns line up as in a terminal.
+export const stepLine = (label, what, detail = '') => `${label.padEnd(9)}${what.padEnd(Math.max(45, what.length + 2))}${detail}`.trimEnd();
+export const plural = (n, word) => `${n} ${word}${n === 1 ? '' : 's'}`;

package/dist/tool/up/local-record.d.ts

@@ -0,0 +1,44 @@
+import { type ExtensionRecord } from '../../discovery/discovery.schema.js';
+import { type ExtensionPackage } from '../../manifest/manifest.schema.js';
+import { type BuildResult } from '../build.js';
+import { type Run } from '../exec.js';
+export declare const LOCAL_DIR = ".agentage";
+export declare const assertDiscoverable: (record: ExtensionRecord, origin: string) => void;
+export declare const writeLocalRecord: (dir: string, pkg: ExtensionPackage, built: BuildResult, run: Run) => Promise<{
+    file: string;
+    record: {
+        id: string;
+        version: string;
+        commit: string;
+        buildTime: string;
+        parts: {
+            pages?: {
+                image: string;
+            } | undefined;
+            ui?: {
+                image: string;
+            } | undefined;
+            api?: {
+                image: string;
+            } | undefined;
+            mcp?: {
+                image: string;
+            } | undefined;
+            worker?: {
+                image: string;
+            } | undefined;
+            store?: {
+                kind: "postgres" | "git" | "signoz";
+                migrations?: number | undefined;
+            } | undefined;
+        };
+        openapi?: string | undefined;
+        tools?: string[] | undefined;
+        widgets?: {
+            name: string;
+            element: string;
+            module: string;
+        }[] | undefined;
+        commands?: string[] | undefined;
+    };
+}>;

package/dist/tool/up/local-record.js

@@ -0,0 +1,28 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { discoveryDocument } from '../../discovery/discovery.js';
+import { DiscoveryDocumentSchema } from '../../discovery/discovery.schema.js';
+import { formatIssues } from '../../manifest/read-manifest.js';
+import {} from '../../manifest/manifest.schema.js';
+import { recordFor } from '../build.js';
+import { mustRun } from '../exec.js';
+export const LOCAL_DIR = '.agentage';
+// A local build has no registry digest; the image id from the daemon stands in for it (Q4).
+const localImage = async (run, built) => {
+    const id = (await mustRun(run, 'docker', ['image', 'inspect', '-f', '{{.Id}}', built.tag])).trim();
+    const repository = built.tag.slice(0, built.tag.lastIndexOf(':'));
+    return { ...built, digest: id, image: `${repository}@${id}` };
+};
+export const assertDiscoverable = (record, origin) => {
+    const result = DiscoveryDocumentSchema.safeParse(discoveryDocument(record, origin));
+    if (!result.success)
+        throw new Error(`discovery would be invalid: ${formatIssues(result.error.issues)}`);
+};
+export const writeLocalRecord = async (dir, pkg, built, run) => {
+    const images = await Promise.all(built.images.map((image) => localImage(run, image)));
+    const record = await recordFor(dir, pkg, built, images);
+    await mkdir(join(dir, LOCAL_DIR), { recursive: true });
+    const file = join(dir, LOCAL_DIR, 'record.json');
+    await writeFile(file, `${JSON.stringify(record, null, 2)}\n`);
+    return { file, record };
+};

package/dist/tool/up/ports.d.ts

@@ -0,0 +1,2 @@
+import { type Run } from '../exec.js';
+export declare const assertPortsFree: (run: Run, project: string) => Promise<void>;