@alchemy.run/docker 2.0.0-beta.84 → 2.0.0-beta.86

package/README.md

@@ -43,6 +43,22 @@ export default Alchemy.Stack(
 
 `alchemy deploy` pulls the image and starts the container. Change a prop and the next deploy replaces only what changed; `alchemy destroy` removes all of it.
 
+## Network configuration
+
+A network can be internal, attachable, and pinned to an explicit subnet:
+
+```typescript
+const internalNetwork = yield* Docker.Network("InternalNetwork", {
+  internal: true,
+  attachable: true,
+  ipam: {
+    config: [{ subnet: "10.50.0.0/24", gateway: "10.50.0.1" }],
+  },
+});
+```
+
+Without `ipam`, Docker picks the subnet and gateway. Network settings are fixed at creation, so changing one replaces the network. See [local services](https://alchemy.run/docker/local-services) for dual-stack networks and driver options.
+
 ## Learn more
 
 - [Docker on alchemy.run](https://alchemy.run/docker)

package/lib/Bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Bootstrap.d.ts","sourceRoot":"","sources":["../src/Bootstrap.ts"],"names":[],"mappings":"AAoBA;;;;GAIG;AACH,eAAO,MAAM,SAAS,eAAgB,OAAO,KAAG,OAAO,CAAC,IAAI,CAyB3D,CAAC"}
+{"version":3,"file":"Bootstrap.d.ts","sources":["../src/Bootstrap.ts"],"names":[],"mappings":"AAqBA;;;;GAIG;AACH,eAAO,MAAM,SAAS,eAAgB,OAAO,KAAG,OAAO,CAAC,IAAI,CA0B3D,CAAC"}

package/lib/Bootstrap.js

@@ -8,6 +8,7 @@ import { BunHttpServer } from "alchemy/Http";
 import { reifyBoundConfigProvider } from "alchemy/Runtime";
 import { entrypointLayer, resolveProgram, runProcess, stackFromEnv, } from "alchemy/Runtime/Bootstrap";
 import * as ConfigProvider from "effect/ConfigProvider";
+import * as SecureRandom from "effect/crypto/SecureRandom";
 import * as Effect from "effect/Effect";
 import * as FetchHttpClient from "effect/http/FetchHttpClient";
 import * as Layer from "effect/Layer";
@@ -18,7 +19,7 @@ import * as Logger from "effect/Logger";
  * `{ fetch }` handler is actually served and `host.run` loops stay alive.
  */
 export const bootstrap = (entrypoint) => {
-    const platform = Layer.mergeAll(BunServices.layer, FetchHttpClient.layer, Logger.layer([Logger.consolePretty()]));
+    const platform = Layer.mergeAll(BunServices.layer, FetchHttpClient.layer, SecureRandom.layerWebCrypto, Logger.layer([Logger.consolePretty()]));
     const program = resolveProgram("program").pipe(Effect.provide(entrypointLayer(entrypoint).pipe(Layer.provideMerge(stackFromEnv), Layer.provideMerge(BunHttpServer()), Layer.provideMerge(platform), Layer.provideMerge(Layer.succeed(ConfigProvider.ConfigProvider, reifyBoundConfigProvider(ConfigProvider.fromEnv(), process.env))))), Effect.scoped);
     return runProcess("Docker service", program);
 };

package/lib/Bootstrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"Bootstrap.js","sourceRoot":"","sources":["../src/Bootstrap.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EACL,eAAe,EACf,cAAc,EACd,UAAU,EACV,YAAY,GACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,cAAc,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,eAAe,MAAM,6BAA6B,CAAC;AAC/D,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,UAAmB,EAAiB,EAAE;IAC9D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAC7B,WAAW,CAAC,KAAK,EACjB,eAAe,CAAC,KAAK,EACrB,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CACvC,CAAC;IAEF,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC,IAAI,CAC5C,MAAM,CAAC,OAAO,CACZ,eAAe,CAAC,UAAU,CAAC,CAAC,IAAI,CAC9B,KAAK,CAAC,YAAY,CAAC,YAAY,CAAC,EAChC,KAAK,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC,EACnC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,EAC5B,KAAK,CAAC,YAAY,CAChB,KAAK,CAAC,OAAO,CACX,cAAc,CAAC,cAAc,EAC7B,wBAAwB,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAChE,CACF,CACF,CACF,EACD,MAAM,CAAC,MAAM,CACd,CAAC;IAEF,OAAO,UAAU,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;AAC/C,CAAC,CAAC"}
+{"version":3,"file":"Bootstrap.js","sources":["../src/Bootstrap.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EACL,eAAe,EACf,cAAc,EACd,UAAU,EACV,YAAY,GACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,cAAc,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,YAAY,MAAM,4BAA4B,CAAC;AAC3D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,eAAe,MAAM,6BAA6B,CAAC;AAC/D,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,UAAmB,EAAiB,EAAE;IAC9D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAC7B,WAAW,CAAC,KAAK,EACjB,eAAe,CAAC,KAAK,EACrB,YAAY,CAAC,cAAc,EAC3B,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CACvC,CAAC;IAEF,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC,IAAI,CAC5C,MAAM,CAAC,OAAO,CACZ,eAAe,CAAC,UAAU,CAAC,CAAC,IAAI,CAC9B,KAAK,CAAC,YAAY,CAAC,YAAY,CAAC,EAChC,KAAK,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC,EACnC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,EAC5B,KAAK,CAAC,YAAY,CAChB,KAAK,CAAC,OAAO,CACX,cAAc,CAAC,cAAc,EAC7B,wBAAwB,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAChE,CACF,CACF,CACF,EACD,MAAM,CAAC,MAAM,CACd,CAAC;IAEF,OAAO,UAAU,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;AAC/C,CAAC,CAAC"}

package/lib/BuildCache.d.ts

@@ -0,0 +1,87 @@
+/**
+ * BuildKit layer-cache configuration shared by every Alchemy resource that
+ * builds a container image: `Docker.Image`, `Cloudflare.Container`, the
+ * `AWS.ECS`/`AWS.EKS`/`Kubernetes` image sources, `GCP.Run`, `AWS.ECR.Image`
+ * and `AWS.Lambda` image functions.
+ */
+import * as Schema from "effect/Schema";
+import type { RegistryCredentials } from "./Docker.ts";
+/**
+ * Where an image build imports layer caches from and exports them to, as
+ * BuildKit's own `--cache-from` / `--cache-to` values, e.g.
+ * `"type=gha,scope=app,mode=max"`. See
+ * [cache backends](https://docs.docker.com/build/cache/backends/).
+ *
+ * Exporting a cache needs a builder that supports it: a `docker-container`
+ * Buildx builder (what `docker/setup-buildx-action` creates in CI), or the
+ * `docker` driver with the containerd image store. Backends such as `gha`
+ * and `s3` take credentials from the environment; values reach `docker`'s
+ * argv, so never put secrets in them.
+ */
+export interface BuildCache {
+    /** Cache sources (`--cache-from`), imported in order. */
+    from?: ReadonlyArray<string>;
+    /** Cache destinations (`--cache-to`). */
+    to?: ReadonlyArray<string>;
+}
+/** Decodes a `cache` option: `true`/`false` or a {@link BuildCache}. */
+export declare const BuildCacheSchema: Schema.Union<readonly [Schema.Boolean, Schema.Struct<{
+    readonly from: Schema.optionalKey<Schema.$Array<Schema.String>>;
+    readonly to: Schema.optionalKey<Schema.$Array<Schema.String>>;
+}>]>;
+/** The `cache` option of an image build. */
+export interface BuildCacheOptions {
+    /**
+     * Keep the image's build layers in a remote cache, so a builder that has
+     * never built it (a fresh CI runner, another machine) skips unchanged
+     * steps. Without it, builds reuse only the local BuildKit cache of the
+     * machine they run on.
+     *
+     * `true` imports and exports a registry cache at the `:buildcache` tag of
+     * the repository the image is published to, keeping every stage's layers
+     * (`mode=max`), not only the final image's. For another backend, pass
+     * BuildKit's own `--cache-from` / `--cache-to` values as `from` and `to`.
+     * The cache is never part of the image's content hash, so changing it
+     * never rebuilds an image.
+     *
+     * @default false
+     *
+     * @example
+     * ```typescript
+     * // Registry cache next to the image:
+     * build: { cache: true }
+     *
+     * // GitHub Actions cache:
+     * build: {
+     *   cache: {
+     *     from: ["type=gha,scope=app"],
+     *     to: ["type=gha,scope=app,mode=max"],
+     *   },
+     * }
+     * ```
+     */
+    cache?: boolean | BuildCache;
+}
+/**
+ * `--cache-from` / `--cache-to` values for a `cache` option. `true` uses a
+ * registry cache at `ref` (the target repository's `:buildcache`), stored as
+ * an OCI image manifest, the format every registry accepts (ECR rejects
+ * BuildKit's default cache index).
+ */
+export declare const resolveBuildCache: (cache: boolean | BuildCache | undefined, ref: string) => {
+    "cache-from": string[];
+    "cache-to": string[];
+};
+/** The `:buildcache` ref in the repository of an image ref (`repo:tag` or `repo@digest`). */
+export declare const buildCacheRef: (imageRef: string) => string;
+/**
+ * `docker.image.build` options for the `cache` option of an image published
+ * to `imageUri`. The build authenticates with the push `credentials`, so it
+ * can import and export a cache in the target registry.
+ */
+export declare const imageBuildCacheOptions: (options: BuildCacheOptions | undefined, imageUri: string, credentials: RegistryCredentials | undefined) => {
+    "cache-from"?: string[];
+    "cache-to"?: string[];
+    credentials?: RegistryCredentials;
+};
+//# sourceMappingURL=BuildCache.d.ts.map

package/lib/BuildCache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BuildCache.d.ts","sources":["../src/BuildCache.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAGvD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,UAAU;IACzB,yDAAyD;IACzD,IAAI,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7B,yCAAyC;IACzC,EAAE,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC5B;AAED,wEAAwE;AACxE,eAAO,MAAM,gBAAgB;;;IAM3B,CAAC;AAEH,4CAA4C;AAC5C,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,KAAK,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,UACrB,OAAO,GAAG,UAAU,GAAG,SAAS,OAClC,MAAM,KACV;IAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAMiD,CAAC;AAEnG,6FAA6F;AAC7F,eAAO,MAAM,aAAa,aAAc,MAAM,KAAG,MACC,CAAC;AAEnD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,YACxB,iBAAiB,GAAG,SAAS,YAC5B,MAAM,eACH,mBAAmB,GAAG,SAAS,KAC3C;IACD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,CAAC,EAAE,mBAAmB,CAAC;CAI5B,CAAC"}

package/lib/BuildCache.js

@@ -0,0 +1,39 @@
+/**
+ * BuildKit layer-cache configuration shared by every Alchemy resource that
+ * builds a container image: `Docker.Image`, `Cloudflare.Container`, the
+ * `AWS.ECS`/`AWS.EKS`/`Kubernetes` image sources, `GCP.Run`, `AWS.ECR.Image`
+ * and `AWS.Lambda` image functions.
+ */
+import * as Schema from "effect/Schema";
+import { repositoryFromImageRef } from "./Registry.js";
+/** Decodes a `cache` option: `true`/`false` or a {@link BuildCache}. */
+export const BuildCacheSchema = Schema.Union([
+    Schema.Boolean,
+    Schema.Struct({
+        from: Schema.String.pipe(Schema.Array, Schema.optionalKey),
+        to: Schema.String.pipe(Schema.Array, Schema.optionalKey),
+    }),
+]);
+/**
+ * `--cache-from` / `--cache-to` values for a `cache` option. `true` uses a
+ * registry cache at `ref` (the target repository's `:buildcache`), stored as
+ * an OCI image manifest, the format every registry accepts (ECR rejects
+ * BuildKit's default cache index).
+ */
+export const resolveBuildCache = (cache, ref) => cache === true
+    ? {
+        "cache-from": [`type=registry,ref=${ref}`],
+        "cache-to": [`type=registry,ref=${ref},mode=max,image-manifest=true,oci-mediatypes=true`],
+    }
+    : { "cache-from": [...((cache || {}).from ?? [])], "cache-to": [...((cache || {}).to ?? [])] };
+/** The `:buildcache` ref in the repository of an image ref (`repo:tag` or `repo@digest`). */
+export const buildCacheRef = (imageRef) => `${repositoryFromImageRef(imageRef)}:buildcache`;
+/**
+ * `docker.image.build` options for the `cache` option of an image published
+ * to `imageUri`. The build authenticates with the push `credentials`, so it
+ * can import and export a cache in the target registry.
+ */
+export const imageBuildCacheOptions = (options, imageUri, credentials) => options?.cache
+    ? { ...resolveBuildCache(options.cache, buildCacheRef(imageUri)), credentials }
+    : {};
+//# sourceMappingURL=BuildCache.js.map

package/lib/BuildCache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BuildCache.js","sources":["../src/BuildCache.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAqBvD,wEAAwE;AACxE,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3C,MAAM,CAAC,OAAO;IACd,MAAM,CAAC,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC;QAC1D,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC;KACzD,CAAC;CACH,CAAC,CAAC;AAoCH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,KAAuC,EACvC,GAAW,EACuC,EAAE,CACpD,KAAK,KAAK,IAAI;IACZ,CAAC,CAAC;QACE,YAAY,EAAE,CAAC,qBAAqB,GAAG,EAAE,CAAC;QAC1C,UAAU,EAAE,CAAC,qBAAqB,GAAG,mDAAmD,CAAC;KAC1F;IACH,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;AAEnG,6FAA6F;AAC7F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,QAAgB,EAAU,EAAE,CACxD,GAAG,sBAAsB,CAAC,QAAQ,CAAC,aAAa,CAAC;AAEnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,OAAsC,EACtC,QAAgB,EAChB,WAA4C,EAK5C,EAAE,CACF,OAAO,EAAE,KAAK;IACZ,CAAC,CAAC,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC,EAAE,WAAW,EAAE;IAC/E,CAAC,CAAC,EAAE,CAAC"}

package/lib/BuildHash.d.ts

@@ -8,6 +8,14 @@
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
+declare const BuildHashInvalidProps_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "BuildHashInvalidProps";
+} & Readonly<A>;
+export declare class BuildHashInvalidProps extends BuildHashInvalidProps_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
 export interface DockerBuildSource {
     context: string;
     dockerfile: string;
@@ -23,7 +31,7 @@ export type DockerBuildHashMode = "all" | "effective";
 export declare const resolveDockerBuildPaths: (source: Pick<DockerBuildSource, "context" | "dockerfile">) => Effect.Effect<{
     context: string;
     dockerfile: string;
-}, Error | import("effect/PlatformError").PlatformError, FileSystem.FileSystem | Path.Path>;
+}, BuildHashInvalidProps | import("effect/PlatformError").PlatformError, FileSystem.FileSystem | Path.Path>;
 /**
  * Select the effective files sent for a Docker build.
  *
@@ -36,12 +44,21 @@ export declare const selectDockerBuildContext: (source: Pick<DockerBuildSource,
     dockerfile: string;
     dockerfilePath: string | undefined;
     includes: (relativePath: string) => boolean;
-}, Error | import("effect/PlatformError").PlatformError, FileSystem.FileSystem | Path.Path>;
+}, BuildHashInvalidProps | import("effect/PlatformError").PlatformError, FileSystem.FileSystem | Path.Path>;
 /**
  * Hash a Docker build context together with the Dockerfile, platform, and
  * build arguments. In `effective` mode, the selected `.dockerignore` is
  * applied exactly once before files are hashed. Absolute paths do not
  * participate.
  */
-export declare const hashDockerBuildInputs: (source: DockerBuildSource, mode: DockerBuildHashMode) => Effect.Effect<string, Error | import("effect/PlatformError").PlatformError, FileSystem.FileSystem | Path.Path>;
+export declare const hashDockerBuildInputs: (source: DockerBuildSource, mode: DockerBuildHashMode, options?: {
+    /**
+     * Directory names left out of the hash at any depth, on top of
+     * `.dockerignore` and `.alchemy` — e.g. `.git` and `node_modules` for a
+     * dev watcher that must not restart on git's index writes or re-hash
+     * installed dependencies on every edit.
+     */
+    readonly excludeNames?: ReadonlyArray<string>;
+} | undefined) => Effect.Effect<string, BuildHashInvalidProps | import("effect/PlatformError").PlatformError, FileSystem.FileSystem | Path.Path>;
+export {};
 //# sourceMappingURL=BuildHash.d.ts.map

package/lib/BuildHash.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BuildHash.d.ts","sourceRoot":"","sources":["../src/BuildHash.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AAIpC,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAED,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG,WAAW,CAAC;AAQtD;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;2FAkBlC,CAAC;AA8CH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB;;;;6BAkBR,MAAM;2FAQjC,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,0KA2GhC,CAAC"}
+{"version":3,"file":"BuildHash.d.ts","sources":["../src/BuildHash.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAaH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;;;;AAGpC,qBAAa,qBAAsB,SAAQ,2BAA0C;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAEL,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAED,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG,WAAW,CAAC;AAQtD;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;2GAsBlC,CAAC;AA8CH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB;;;;6BAkBR,MAAM;2GAQjC,CAAC;AAqBH;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;IAI9B;;;;;OAKG;4BACqB,aAAa,CAAC,MAAM,CAAC;gJA8H/C,CAAC"}

package/lib/BuildHash.js

@@ -6,12 +6,16 @@
  * image packaging; NOT exported from the Docker barrel.
  */
 import * as crypto from "node:crypto";
+import { dotAlchemyDirectory } from "alchemy/AlchemyContext";
 import { listFileSystemDirectory, normalizeRelativePath, parseIgnoreRules, walkIgnoring, } from "alchemy/Util/Ignore";
+import { initialCwd } from "alchemy/Util/Node";
+import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
-import * as Result from "effect/Result";
 import * as Stream from "effect/Stream";
+export class BuildHashInvalidProps extends Data.TaggedError("BuildHashInvalidProps") {
+}
 /**
  * Resolve and validate a Docker build context and Dockerfile.
  *
@@ -25,10 +29,14 @@ export const resolveDockerBuildPaths = Effect.fn(function* (source) {
         ? source.dockerfile
         : path.resolve(context, source.dockerfile);
     if (!(yield* fs.exists(context))) {
-        return yield* Effect.fail(new Error(`Docker build context does not exist: ${context}`));
+        return yield* new BuildHashInvalidProps({
+            message: `Docker build context does not exist: ${context}`,
+        });
     }
     if (!(yield* fs.exists(dockerfile))) {
-        return yield* Effect.fail(new Error(`Dockerfile does not exist: ${dockerfile}`));
+        return yield* new BuildHashInvalidProps({
+            message: `Dockerfile does not exist: ${dockerfile}`,
+        });
     }
     return { context, dockerfile };
 });
@@ -85,13 +93,30 @@ export const selectDockerBuildContext = Effect.fn(function* (source) {
         },
     };
 });
+/**
+ * The context-relative path of Alchemy's `.alchemy` directory when it lies
+ * strictly inside `context`, otherwise `undefined`.
+ */
+const containedRuntimeDirectory = Effect.fn(function* (context) {
+    const path = yield* Path.Path;
+    const runtime = path.resolve(initialCwd, yield* dotAlchemyDirectory);
+    const relative = normalizeRelativePath(path.relative(context, runtime));
+    return relative === "" ||
+        relative === ".." ||
+        relative.startsWith("../") ||
+        path.isAbsolute(relative)
+        ? undefined
+        : relative;
+});
+/** Files below this size are read in one call instead of streamed. */
+const SMALL_FILE_BYTES = 1024 * 1024;
 /**
  * Hash a Docker build context together with the Dockerfile, platform, and
  * build arguments. In `effective` mode, the selected `.dockerignore` is
  * applied exactly once before files are hashed. Absolute paths do not
  * participate.
  */
-export const hashDockerBuildInputs = Effect.fn(function* (source, mode) {
+export const hashDockerBuildInputs = Effect.fn(function* (source, mode, options = {}) {
     const fs = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
     const { context, dockerfile } = yield* resolveDockerBuildPaths(source);
@@ -116,14 +141,25 @@ export const hashDockerBuildInputs = Effect.fn(function* (source, mode) {
         dockerignore?.path,
         normalizeRelativePath(path.relative(context, dockerfile)),
     ].filter((entry) => entry !== undefined && entry !== ".." && !entry.startsWith("../") && !path.isAbsolute(entry));
+    // Alchemy writes run logs and local state to `.alchemy` on every run. When a
+    // context contains it (e.g. `context: "."` at the project root), hashing it
+    // would give the image a new tag on every deploy. A context inside
+    // `.alchemy` (a generated one) is still hashed in full.
+    const runtimeDirectory = yield* containedRuntimeDirectory(context);
+    const excludedNames = new Set(options.excludeNames ?? []);
+    const listDirectory = yield* listFileSystemDirectory(context);
     // Walk one level at a time so an excluded directory is discarded before
     // its contents are read; entries come back sorted, preserving hash order.
     const entries = yield* walkIgnoring({
-        list: yield* listFileSystemDirectory(context),
+        list: runtimeDirectory === undefined && excludedNames.size === 0
+            ? listDirectory
+            : (directory) => listDirectory(directory).pipe(Effect.map((children) => children.filter((child) => !(child.type === "Directory" && excludedNames.has(child.name)) &&
+                (directory.length === 0 ? child.name : `${directory}/${child.name}`) !==
+                    runtimeDirectory))),
         rules: dockerignore?.rules,
         force: forcedPaths,
     });
-    for (const { path: entry } of entries) {
+    for (const { path: entry, type } of entries) {
         // The ignore file and Dockerfile contents are hashed above; excluded
         // entries were only walked so re-included descendants could be found.
         if (dockerignore !== undefined &&
@@ -131,17 +167,13 @@ export const hashDockerBuildInputs = Effect.fn(function* (source, mode) {
             continue;
         }
         const fullPath = path.join(context, entry);
-        const hashedEntry = entry;
-        // FileSystem.stat follows symbolic links, so probe the link itself first.
-        // Docker preserves the link in the build context; hashing the target file
-        // would miss retargets between files with identical contents and metadata.
-        const link = yield* Effect.result(fs.readLink(fullPath));
-        if (Result.isSuccess(link)) {
-            yield* Effect.sync(() => hasher.update(`${JSON.stringify({
-                path: hashedEntry,
-                type: "SymbolicLink",
-                target: link.success,
-            })}\0`));
+        // Docker preserves a symbolic link in the build context; hashing the
+        // target file would miss retargets between files with identical
+        // contents and metadata. The walk reports the entry's own type, so only
+        // links are read as links.
+        if (type === "SymbolicLink") {
+            const target = yield* fs.readLink(fullPath);
+            yield* Effect.sync(() => hasher.update(`${JSON.stringify({ path: entry, type: "SymbolicLink", target })}\0`));
             continue;
         }
         const info = yield* fs.stat(fullPath);
@@ -149,15 +181,22 @@ export const hashDockerBuildInputs = Effect.fn(function* (source, mode) {
         // directories. Include that metadata before any file bytes so changes such
         // as making a Lambda bootstrap executable invalidate the image tag.
         yield* Effect.sync(() => hasher.update(`${JSON.stringify({
-            path: hashedEntry,
+            path: entry,
             type: info.type,
             mode: info.mode & 0o7777,
             size: info.type === "File" ? String(info.size) : undefined,
         })}\0`));
         if (info.type === "File") {
-            yield* fs.stream(fullPath).pipe(Stream.runForEach((chunk) => Effect.sync(() => {
-                hasher.update(chunk);
-            })));
+            // Read small files whole (one call); stream large ones so memory stays flat.
+            if (info.size < SMALL_FILE_BYTES) {
+                const bytes = yield* fs.readFile(fullPath);
+                yield* Effect.sync(() => hasher.update(bytes));
+            }
+            else {
+                yield* fs.stream(fullPath).pipe(Stream.runForEach((chunk) => Effect.sync(() => {
+                    hasher.update(chunk);
+                })));
+            }
         }
     }
     return (yield* Effect.sync(() => hasher.digest("hex"))).slice(0, 32);

package/lib/BuildHash.js.map

@@ -1 +1 @@
-{"version":3,"file":"BuildHash.js","sourceRoot":"","sources":["../src/BuildHash.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAEL,uBAAuB,EACvB,qBAAqB,EACrB,gBAAgB,EAChB,YAAY,GACb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAiBxC;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EACxD,MAAyD;IAEzD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC;QACnD,CAAC,CAAC,MAAM,CAAC,UAAU;QACnB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAE7C,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,wCAAwC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,8BAA8B,UAAU,EAAE,CAAC,CAAC,CAAC;IACnF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACjC,CAAC,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAC/C,OAAO,EACP,UAAU,GAIX;IACC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC9B,MAAM,gBAAgB,GAAG,GAAG,UAAU,eAAe,CAAC;IACtD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACrD,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YACjC,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,SAAS,CAAC;IAEhB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;IAC/E,OAAO;QACL,OAAO;QACP,IAAI,EACF,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;YACtF,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,YAAY;QAClB,KAAK,EAAE,gBAAgB,CAAC,OAAO,EAAE,cAAc,CAAC;KAC1B,CAAC;AAC3B,CAAC,CAAC,CAAC;AAaH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EACzD,MAAyD;IAEzD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC9B,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACvE,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IACzE,MAAM,kBAAkB,GAAG,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;IACrF,MAAM,cAAc,GAClB,kBAAkB,KAAK,IAAI;QAC3B,kBAAkB,CAAC,UAAU,CAAC,KAAK,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC;QACjC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,kBAAkB,CAAC;IAEzB,OAAO;QACL,OAAO;QACP,UAAU;QACV,cAAc;QACd,QAAQ,EAAE,CAAC,YAAoB,EAAE,EAAE;YACjC,MAAM,UAAU,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;YACvD,IAAI,UAAU,KAAK,cAAc,IAAI,UAAU,KAAK,YAAY,EAAE,IAAI,EAAE,CAAC;gBACvE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,YAAY,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/E,CAAC;KACoC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EACtD,MAAyB,EACzB,IAAyB;IAEzB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC9B,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACvE,MAAM,YAAY,GAChB,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IAErE,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CACtB,MAAM,CAAC,MAAM,CACX,IAAI,CAAC,SAAS,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAClE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC3B;QACD,YAAY,EACV,YAAY,KAAK,SAAS;YACxB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC;gBACE,OAAO,EAAE,YAAY,CAAC,OAAO;gBAC7B,IAAI,EAAE,YAAY,CAAC,IAAI;aACxB;KACR,CAAC,CACH,CACF,CAAC;IAEF,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzD,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;QACtB,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG;QAClB,YAAY,EAAE,IAAI;QAClB,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;KAC1D,CAAC,MAAM,CACN,CAAC,KAAK,EAAmB,EAAE,CACzB,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAC/F,CAAC;IACF,wEAAwE;IACxE,0EAA0E;IAC1E,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;QAClC,IAAI,EAAE,KAAK,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC;QAC7C,KAAK,EAAE,YAAY,EAAE,KAAK;QAC1B,KAAK,EAAE,WAAW;KACnB,CAAC,CAAC;IAEH,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;QACtC,qEAAqE;QACrE,sEAAsE;QACtE,IACE,YAAY,KAAK,SAAS;YAC1B,CAAC,KAAK,KAAK,YAAY,CAAC,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAClE,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,KAAK,CAAC;QAC1B,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzD,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CACtB,MAAM,CAAC,MAAM,CACX,GAAG,IAAI,CAAC,SAAS,CAAC;gBAChB,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,IAAI,CAAC,OAAO;aACrB,CAAC,IAAI,CACP,CACF,CAAC;YACF,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEtC,yEAAyE;QACzE,2EAA2E;QAC3E,oEAAoE;QACpE,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CACtB,MAAM,CAAC,MAAM,CACX,GAAG,IAAI,CAAC,SAAS,CAAC;YAChB,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,MAAM;YACxB,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC3D,CAAC,IAAI,CACP,CACF,CAAC;QAEF,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACzB,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC7B,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;gBACf,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC,CAAC,CACH,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACvE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"BuildHash.js","sources":["../src/BuildHash.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAEL,uBAAuB,EACvB,qBAAqB,EACrB,gBAAgB,EAChB,YAAY,GACb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,MAAM,OAAO,qBAAsB,SAAQ,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAGjF;CAAG;AAiBL;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EACxD,MAAyD;IAEzD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC;QACnD,CAAC,CAAC,MAAM,CAAC,UAAU;QACnB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAE7C,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC,CAAC,IAAI,qBAAqB,CAAC;YACtC,OAAO,EAAE,wCAAwC,OAAO,EAAE;SAC3D,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC,CAAC,IAAI,qBAAqB,CAAC;YACtC,OAAO,EAAE,8BAA8B,UAAU,EAAE;SACpD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACjC,CAAC,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAC/C,OAAO,EACP,UAAU,GAIX;IACC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC9B,MAAM,gBAAgB,GAAG,GAAG,UAAU,eAAe,CAAC;IACtD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACrD,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YACjC,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,SAAS,CAAC;IAEhB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;IAC/E,OAAO;QACL,OAAO;QACP,IAAI,EACF,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;YACtF,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,YAAY;QAClB,KAAK,EAAE,gBAAgB,CAAC,OAAO,EAAE,cAAc,CAAC;KAC1B,CAAC;AAC3B,CAAC,CAAC,CAAC;AAaH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EACzD,MAAyD;IAEzD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC9B,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACvE,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IACzE,MAAM,kBAAkB,GAAG,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;IACrF,MAAM,cAAc,GAClB,kBAAkB,KAAK,IAAI;QAC3B,kBAAkB,CAAC,UAAU,CAAC,KAAK,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC;QACjC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,kBAAkB,CAAC;IAEzB,OAAO;QACL,OAAO;QACP,UAAU;QACV,cAAc;QACd,QAAQ,EAAE,CAAC,YAAoB,EAAE,EAAE;YACjC,MAAM,UAAU,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;YACvD,IAAI,UAAU,KAAK,cAAc,IAAI,UAAU,KAAK,YAAY,EAAE,IAAI,EAAE,CAAC;gBACvE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,YAAY,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/E,CAAC;KACoC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,yBAAyB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAe;IACpE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,mBAAmB,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACxE,OAAO,QAAQ,KAAK,EAAE;QACpB,QAAQ,KAAK,IAAI;QACjB,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QACzB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,QAAQ,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAAC;AAErC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EACtD,MAAyB,EACzB,IAAyB,EACzB,OAAO,GAQH,EAAE;IAEN,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC9B,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACvE,MAAM,YAAY,GAChB,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IAErE,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CACtB,MAAM,CAAC,MAAM,CACX,IAAI,CAAC,SAAS,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAClE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC3B;QACD,YAAY,EACV,YAAY,KAAK,SAAS;YACxB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC;gBACE,OAAO,EAAE,YAAY,CAAC,OAAO;gBAC7B,IAAI,EAAE,YAAY,CAAC,IAAI;aACxB;KACR,CAAC,CACH,CACF,CAAC;IAEF,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzD,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;QACtB,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG;QAClB,YAAY,EAAE,IAAI;QAClB,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;KAC1D,CAAC,MAAM,CACN,CAAC,KAAK,EAAmB,EAAE,CACzB,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAC/F,CAAC;IACF,6EAA6E;IAC7E,4EAA4E;IAC5E,mEAAmE;IACnE,wDAAwD;IACxD,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC9D,wEAAwE;IACxE,0EAA0E;IAC1E,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;QAClC,IAAI,EACF,gBAAgB,KAAK,SAAS,IAAI,aAAa,CAAC,IAAI,KAAK,CAAC;YACxD,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,CAAC,SAAiB,EAAE,EAAE,CACpB,aAAa,CAAC,SAAS,CAAC,CAAC,IAAI,CAC3B,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CACtB,QAAQ,CAAC,MAAM,CACb,CAAC,KAAK,EAAE,EAAE,CACR,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC9D,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;oBAClE,gBAAgB,CACrB,CACF,CACF;QACT,KAAK,EAAE,YAAY,EAAE,KAAK;QAC1B,KAAK,EAAE,WAAW;KACnB,CAAC,CAAC;IAEH,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,CAAC;QAC5C,qEAAqE;QACrE,sEAAsE;QACtE,IACE,YAAY,KAAK,SAAS;YAC1B,CAAC,KAAK,KAAK,YAAY,CAAC,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAClE,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3C,qEAAqE;QACrE,gEAAgE;QAChE,wEAAwE;QACxE,2BAA2B;QAC3B,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC5C,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CACtB,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,CACpF,CAAC;YACF,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEtC,yEAAyE;QACzE,2EAA2E;QAC3E,oEAAoE;QACpE,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CACtB,MAAM,CAAC,MAAM,CACX,GAAG,IAAI,CAAC,SAAS,CAAC;YAChB,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,MAAM;YACxB,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC3D,CAAC,IAAI,CACP,CACF,CAAC;QAEF,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACzB,6EAA6E;YAC7E,IAAI,IAAI,CAAC,IAAI,GAAG,gBAAgB,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC3C,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC7B,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;oBACf,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvB,CAAC,CAAC,CACH,CACF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACvE,CAAC,CAAC,CAAC"}

package/lib/BuildPlan.d.ts

@@ -0,0 +1,202 @@
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import type * as Redacted from "effect/Redacted";
+import { Docker } from "./Docker.ts";
+import * as DockerfileParser from "./DockerfileParser.ts";
+import type { CopyInstruction, Instruction, InstructionName, ParsedDockerfile } from "./DockerfileParser.ts";
+import { type ImageSourceProps } from "./ImageSource.ts";
+import { type ImageRegistry } from "./Registry.ts";
+/**
+ * A build plan: an image source (`image`, `context` + `dockerfile`, inline
+ * `dockerfile`, plus an optional bundled `main`) resolved into data that any
+ * builder can consume, Docker or not.
+ *
+ * Platforms with their own builders (E2B templates, Modal images, Daytona
+ * snapshots) lower a plan into their build API; the Docker path can render
+ * it back into a Dockerfile and build context. Every platform declares
+ * {@link Capabilities}, and a Dockerfile it cannot build fails at plan time
+ * with the offending lines, before any upload or remote build.
+ */
+export interface BuildPlan {
+    /** Content hash of everything that determines the image: rebuild only when it changes. */
+    readonly hash: string;
+    /** Target platform, e.g. `linux/amd64`. */
+    readonly platform: string;
+    /** Every stage, including the generated `main` layer. */
+    readonly dockerfile: ParsedDockerfile;
+    /** The final stage's base: an image reference, an earlier stage's name, or `scratch`. */
+    readonly base: string;
+    /** Credentials for pulling a private base image. */
+    readonly pull: ImageRegistry | undefined;
+    /** The final stage's instructions. */
+    readonly instructions: ReadonlyArray<Instruction>;
+    /**
+     * Files the build reads from its context: everything a `COPY`/`ADD`
+     * source reaches (after `.dockerignore`), plus the bundled `main` under
+     * {@link BUNDLE_DIR}. Paths are relative to the context, `/`-separated.
+     */
+    readonly files: ReadonlyArray<ContextFile>;
+    /**
+     * Build arguments (`ARG` values) the builder must pass. Empty when the
+     * builder takes none ({@link Capabilities.buildArgs}): the values are then
+     * written into the `ARG` defaults of {@link dockerfile}.
+     */
+    readonly args: Readonly<Record<string, string>>;
+    /** BuildKit secrets, by id (`RUN --mount=type=secret,id=…`). */
+    readonly secrets: Readonly<Record<string, Redacted.Redacted<string>>>;
+    /** Instructions the platform ignores (see {@link Capabilities.instructions}). */
+    readonly warnings: ReadonlyArray<string>;
+}
+/** A file in a plan's build context. */
+export interface ContextFile {
+    /** Context-relative, `/`-separated. */
+    readonly path: string;
+    /** Permission bits. */
+    readonly mode: number;
+    readonly size: number;
+    /** Hex SHA-256 of the contents. */
+    readonly sha256: string;
+    readonly source: {
+        readonly _tag: "Path";
+        readonly absolutePath: string;
+    } | {
+        readonly _tag: "Bytes";
+        readonly bytes: Uint8Array;
+    };
+}
+/**
+ * What a builder supports. Anything not listed is supported.
+ */
+export interface Capabilities {
+    /** The resource the plan is for, used in error messages, e.g. `"E2B.Template"`. */
+    readonly target: string;
+    /** More than one `FROM`, or `COPY --from`. @default true */
+    readonly multiStage?: boolean;
+    /** `RUN <<EOF` / `COPY <<EOF`. @default true */
+    readonly heredocs?: boolean;
+    /** `RUN --mount=…` (secrets, caches). @default true */
+    readonly runMounts?: boolean;
+    /** `ADD <url>`. @default true */
+    readonly remoteAdd?: boolean;
+    /**
+     * Build arguments passed to the builder. When `false`, the plan writes
+     * the values into the Dockerfile's `ARG` defaults instead. @default true
+     */
+    readonly buildArgs?: boolean;
+    /** BuildKit secrets (`build.secrets`, `RUN --mount=type=secret`). @default true */
+    readonly secrets?: boolean;
+    /** Platforms the builder targets, also checked against `FROM --platform=`. @default any */
+    readonly platforms?: ReadonlyArray<string>;
+    /** Instructions the builder ignores (a warning) or rejects (an error). */
+    readonly instructions?: Partial<Record<InstructionName, "ignored" | "unsupported">>;
+}
+/** One reason a builder cannot build a plan. */
+export interface Violation {
+    /** 1-based Dockerfile line; `0` for the generated `main` layer or the platform. */
+    readonly line: number;
+    readonly instruction: string;
+    readonly reason: string;
+}
+declare const UnsupportedDockerfile_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "UnsupportedDockerfile";
+} & Readonly<A>;
+/** The Dockerfile uses something the target builder cannot build. */
+export declare class UnsupportedDockerfile extends UnsupportedDockerfile_base<{
+    readonly target: string;
+    readonly violations: ReadonlyArray<Violation>;
+    readonly message: string;
+}> {
+}
+declare const BuildPlanError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "BuildPlanError";
+} & Readonly<A>;
+/** The image source cannot be planned (a missing file, an unresolved input, an inline Dockerfile that copies from a context). */
+export declare class BuildPlanError extends BuildPlanError_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+/** The context directory a plan's bundled `main` files live under. */
+export declare const BUNDLE_DIR = "__alchemy__";
+/** Default base for a `main` program with no environment: Docker Hub's bun image. */
+export declare const DEFAULT_MAIN_BASE = "oven/bun:1";
+export interface PlanOptions {
+    readonly capabilities: Capabilities;
+    /** @default "linux/amd64" */
+    readonly platform?: string;
+    /** Port a `main` program listens on; written to `ENV PORT`. */
+    readonly port?: number;
+    /**
+     * Bootstrap wrapped around an Effect-native `main` (the host's virtual
+     * entry). Omit it to bundle `main` as-is.
+     */
+    readonly bootstrap?: (importPath: string) => string;
+    /** Credentials for pulling a private base image. */
+    readonly pull?: ImageRegistry;
+    /**
+     * Dockerfile lines a host's bindings contribute, e.g. the clients of
+     * `alchemy/Mount` capabilities (`mountInstallLines`). They go after the
+     * final stage's own instructions and before the bundled `main`, so a
+     * program change doesn't reinstall them.
+     */
+    readonly install?: ReadonlyArray<string>;
+}
+/** The context files one `COPY`/`ADD` reads. */
+export declare const filesFor: (plan: BuildPlan, instruction: CopyInstruction) => ContextFile[];
+/** Check a parsed Dockerfile against a builder's capabilities. */
+export declare const check: (dockerfile: ParsedDockerfile, capabilities: Capabilities, platform: string) => {
+    violations: Violation[];
+    warnings: string[];
+};
+/**
+ * Resolve an image source into a {@link BuildPlan} for one builder.
+ */
+export declare const plan: (source: ImageSourceProps, options: PlanOptions) => Effect.Effect<{
+    hash: string;
+    platform: string;
+    dockerfile: ParsedDockerfile;
+    base: string;
+    pull: ImageRegistry | undefined;
+    instructions: readonly Instruction[];
+    files: ContextFile[];
+    args: Record<string, string>;
+    secrets: Record<string, Redacted.Redacted<string>>;
+    warnings: string[];
+}, import("./BuildHash.ts").BuildHashInvalidProps | BuildPlanError | import("alchemy/Bundle/Bundle").BundleError | DockerfileParser.DockerfileSyntaxError | import("effect/PlatformError").PlatformError | UnsupportedDockerfile, FileSystem.FileSystem | Path.Path>;
+/** A context file's contents. */
+export declare const readContextFile: (file: ContextFile) => Effect.Effect<Uint8Array<ArrayBufferLike>, import("effect/PlatformError").PlatformError, FileSystem.FileSystem>;
+/** The plan as Dockerfile text. */
+export declare const render: (plan: BuildPlan) => string;
+/** The plan as one entry per instruction (for APIs that take a list of Dockerfile commands). */
+export declare const renderLines: (plan: BuildPlan) => string[];
+/**
+ * The argv the image starts with, from the final stage's `ENTRYPOINT` and
+ * `CMD` (Docker's rules: a shell-form `ENTRYPOINT` ignores `CMD`).
+ * `undefined` when the final stage sets neither (the base image's applies).
+ */
+export declare const startCommand: (plan: BuildPlan) => ReadonlyArray<string> | undefined;
+/**
+ * Check Dockerfile text against a builder's capabilities, without reading a
+ * build context or bundling anything: usable where there is no filesystem
+ * (a Worker creating images at run time). Returns the warnings.
+ */
+export declare const checkContent: (text: string, options: Pick<PlanOptions, "capabilities" | "platform">) => Effect.Effect<string[], DockerfileParser.DockerfileSyntaxError | UnsupportedDockerfile, never>;
+/** Where {@link push} publishes a plan. */
+export interface PushTarget {
+    /** Repository to push to, without a tag, e.g. `ghcr.io/acme/agent`. The plan's hash is the tag. */
+    readonly repository: string;
+    /** Credentials for the registry the repository lives in. */
+    readonly push: ImageRegistry;
+}
+/**
+ * Build a plan with the local Docker engine and push it, for platforms that
+ * only pull images (Archil). Tagged with the plan's hash, so an unchanged
+ * plan pushes the same tag. Returns the pushed reference, `repository@digest`
+ * when the registry reports a digest, else `repository:hash`.
+ */
+export declare const push: (plan: BuildPlan, target: PushTarget) => Effect.Effect<{
+    imageRef: string;
+}, import("./RegistryError.ts").DockerImagePublicationError, Docker | FileSystem.FileSystem | Path.Path | import("effect/Scope").Scope>;
+export {};
+//# sourceMappingURL=BuildPlan.d.ts.map