@crewhaus/docker-images 0.5.0 → 0.5.2

package/dist/embedded.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Build-time-baked bodies of the per-shape `docker/<target>/Dockerfile`
+ * files.
+ *
+ * Reading them package-relative broke `crewhaus build-image` on every
+ * PUBLISHED channel — `dockerfile missing for target cli (expected at
+ * /$bunfs/docker/cli/Dockerfile)` from the compiled binary, and the same miss
+ * against an npm tarball whose `files` array omitted `docker/`. Both are now
+ * fixed: the bodies live here, and `docker/` ships in `files` so the real
+ * files are still present for a build context.
+ *
+ * These are literals rather than `with { type: "text" }` imports because Bun's
+ * `--compile` does not embed EXTENSIONLESS files: a bare `Dockerfile` inlines
+ * fine under the interpreter and resolves to `undefined` in the standalone
+ * binary. `digests.json` is deliberately absent — `loadDigests` already
+ * returns an empty file when it is missing, and it is only read or written
+ * from a source checkout during the release workflow.
+ */
+export declare const DOCKERFILE_BODIES: Readonly<Record<string, string>>;

package/dist/embedded.js

@@ -0,0 +1,35 @@
+// GENERATED by scripts/gen-dockerfile-bodies.ts — do not edit by hand.
+// Re-run that script after changing any docker/<target>/Dockerfile;
+// docker-images' tests assert these bodies match the files byte-for-byte.
+/**
+ * Build-time-baked bodies of the per-shape `docker/<target>/Dockerfile`
+ * files.
+ *
+ * Reading them package-relative broke `crewhaus build-image` on every
+ * PUBLISHED channel — `dockerfile missing for target cli (expected at
+ * /$bunfs/docker/cli/Dockerfile)` from the compiled binary, and the same miss
+ * against an npm tarball whose `files` array omitted `docker/`. Both are now
+ * fixed: the bodies live here, and `docker/` ships in `files` so the real
+ * files are still present for a build context.
+ *
+ * These are literals rather than `with { type: "text" }` imports because Bun's
+ * `--compile` does not embed EXTENSIONLESS files: a bare `Dockerfile` inlines
+ * fine under the interpreter and resolves to `undefined` in the standalone
+ * binary. `digests.json` is deliberately absent — `loadDigests` already
+ * returns an empty file when it is missing, and it is only read or written
+ * from a source checkout during the release workflow.
+ */
+export const DOCKERFILE_BODIES = {
+    batch: '# Section 32 — docker-images: batch target shape (queue worker daemon).\n# Section 23 BATCH worker pulls from queue-protocol, runs one runChatLoop per job.\nFROM oven/bun:1.2-alpine AS deps\nWORKDIR /app\nCOPY bun.lock package.json ./\nCOPY packages packages\nCOPY apps apps\nRUN bun install --frozen-lockfile\n\nFROM deps AS build\nWORKDIR /app\nCOPY tsconfig.base.json tsconfig.json ./\nRUN bun run typecheck\nRUN bun build apps/cli/src/index.ts --target=bun --outfile=/app/dist/crewhaus.js\n\nFROM oven/bun:1.2-alpine AS runtime\nRUN addgroup -S crewhaus && adduser -S crewhaus -G crewhaus -u 10001 && \\\n    mkdir -p /app/.crewhaus && chown crewhaus:crewhaus /app/.crewhaus\nWORKDIR /app\nCOPY --from=build --chown=crewhaus:crewhaus /app/dist/crewhaus.js /app/crewhaus.js\nCOPY --from=deps --chown=crewhaus:crewhaus /app/node_modules /app/node_modules\nUSER crewhaus\nENV NODE_ENV=production CREWHAUS_TARGET=batch\nEXPOSE 0\n# Batch worker is a long-running consumer; healthcheck just verifies the process is alive.\nHEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \\\n  CMD pgrep -f crewhaus.js > /dev/null || exit 1\nENTRYPOINT ["bun", "/app/crewhaus.js"]\nCMD ["run", "/spec/crewhaus.yaml"]\n',
+    browser: '# Section 32 — docker-images: browser target shape (computer-use agent).\n# Adds chromium + Playwright runtime so the BROW driver can spawn real browsers.\nFROM oven/bun:1.2-alpine AS deps\nWORKDIR /app\nCOPY bun.lock package.json ./\nCOPY packages packages\nCOPY apps apps\nRUN bun install --frozen-lockfile\n\nFROM deps AS build\nWORKDIR /app\nCOPY tsconfig.base.json tsconfig.json ./\nRUN bun run typecheck\nRUN bun build apps/cli/src/index.ts --target=bun --outfile=/app/dist/crewhaus.js\n\nFROM oven/bun:1.2-alpine AS runtime\n# chromium + the libs Playwright\'s bundled chromium needs at runtime\nRUN apk add --no-cache \\\n      chromium \\\n      nss \\\n      freetype \\\n      harfbuzz \\\n      ca-certificates \\\n      ttf-freefont \\\n      dbus \\\n      curl && \\\n    addgroup -S crewhaus && adduser -S crewhaus -G crewhaus -u 10001 && \\\n    mkdir -p /app/.crewhaus && chown crewhaus:crewhaus /app/.crewhaus\nWORKDIR /app\nCOPY --from=build --chown=crewhaus:crewhaus /app/dist/crewhaus.js /app/crewhaus.js\nCOPY --from=deps --chown=crewhaus:crewhaus /app/node_modules /app/node_modules\nUSER crewhaus\nENV NODE_ENV=production CREWHAUS_TARGET=browser \\\n    PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 \\\n    PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH=/usr/bin/chromium-browser \\\n    PORT=8080\nEXPOSE 8080\nHEALTHCHECK --interval=20s --timeout=10s --start-period=10s --retries=3 \\\n  CMD curl -fsS http://localhost:${PORT:-8080}/healthz || exit 1\nENTRYPOINT ["bun", "/app/crewhaus.js"]\nCMD ["run", "/spec/crewhaus.yaml"]\n',
+    channel: '# Section 32 — docker-images: channel target shape (long-running daemon).\n# Section 12 daemon listens on $PORT (default 3000) for inbound webhooks.\nFROM oven/bun:1.2-alpine AS deps\nWORKDIR /app\nCOPY bun.lock package.json ./\nCOPY packages packages\nCOPY apps apps\nRUN bun install --frozen-lockfile\n\nFROM deps AS build\nWORKDIR /app\nCOPY tsconfig.base.json tsconfig.json ./\nRUN bun run typecheck\nRUN bun build apps/cli/src/index.ts --target=bun --outfile=/app/dist/crewhaus.js\n\nFROM oven/bun:1.2-alpine AS runtime\nRUN apk add --no-cache curl ca-certificates && \\\n    addgroup -S crewhaus && adduser -S crewhaus -G crewhaus -u 10001 && \\\n    mkdir -p /app/.crewhaus && chown crewhaus:crewhaus /app/.crewhaus\nWORKDIR /app\nCOPY --from=build --chown=crewhaus:crewhaus /app/dist/crewhaus.js /app/crewhaus.js\nCOPY --from=deps --chown=crewhaus:crewhaus /app/node_modules /app/node_modules\nUSER crewhaus\nENV NODE_ENV=production CREWHAUS_TARGET=channel PORT=3000\nEXPOSE 3000\nHEALTHCHECK --interval=15s --timeout=3s --start-period=5s --retries=3 \\\n  CMD curl -fsS http://localhost:${PORT:-3000}/healthz || exit 1\nENTRYPOINT ["bun", "/app/crewhaus.js"]\nCMD ["run", "/spec/crewhaus.yaml"]\n',
+    cli: '# Section 32 — docker-images: CLI target shape (interactive REPL).\n# Multi-stage: deps → build → runtime. Non-root user, read-only root, HEALTHCHECK.\n\n# ──────────────────────────────────────────────────────────────────────────────\n# Stage 1: deps (cached layer for node_modules)\n# ──────────────────────────────────────────────────────────────────────────────\nFROM oven/bun:1.2-alpine AS deps\nWORKDIR /app\nCOPY bun.lock package.json ./\nCOPY packages packages\nCOPY apps apps\nRUN bun install --frozen-lockfile\n\n# ──────────────────────────────────────────────────────────────────────────────\n# Stage 2: build (typecheck + bundle the CLI entrypoint)\n# ──────────────────────────────────────────────────────────────────────────────\nFROM deps AS build\nWORKDIR /app\nCOPY tsconfig.base.json tsconfig.json ./\nRUN bun run typecheck\nRUN bun build apps/cli/src/index.ts --target=bun --outfile=/app/dist/crewhaus.js\n\n# ──────────────────────────────────────────────────────────────────────────────\n# Stage 3: runtime (minimal — only what the CLI needs at boot)\n# ──────────────────────────────────────────────────────────────────────────────\nFROM oven/bun:1.2-alpine AS runtime\nRUN addgroup -S crewhaus && adduser -S crewhaus -G crewhaus -u 10001\nWORKDIR /app\nCOPY --from=build --chown=crewhaus:crewhaus /app/dist/crewhaus.js /app/crewhaus.js\nCOPY --from=deps --chown=crewhaus:crewhaus /app/node_modules /app/node_modules\nUSER crewhaus\nENV NODE_ENV=production CREWHAUS_TARGET=cli\nEXPOSE 0\nHEALTHCHECK --interval=30s --timeout=5s --start-period=2s --retries=3 \\\n  CMD bun /app/crewhaus.js doctor --liveness || exit 1\nENTRYPOINT ["bun", "/app/crewhaus.js"]\nCMD ["--help"]\n',
+    crew: '# Section 32 — docker-images: crew target shape (multi-agent A2A daemon).\nFROM oven/bun:1.2-alpine AS deps\nWORKDIR /app\nCOPY bun.lock package.json ./\nCOPY packages packages\nCOPY apps apps\nRUN bun install --frozen-lockfile\n\nFROM deps AS build\nWORKDIR /app\nCOPY tsconfig.base.json tsconfig.json ./\nRUN bun run typecheck\nRUN bun build apps/cli/src/index.ts --target=bun --outfile=/app/dist/crewhaus.js\n\nFROM oven/bun:1.2-alpine AS runtime\nRUN apk add --no-cache curl ca-certificates && \\\n    addgroup -S crewhaus && adduser -S crewhaus -G crewhaus -u 10001 && \\\n    mkdir -p /app/.crewhaus && chown crewhaus:crewhaus /app/.crewhaus\nWORKDIR /app\nCOPY --from=build --chown=crewhaus:crewhaus /app/dist/crewhaus.js /app/crewhaus.js\nCOPY --from=deps --chown=crewhaus:crewhaus /app/node_modules /app/node_modules\nUSER crewhaus\nENV NODE_ENV=production CREWHAUS_TARGET=crew PORT=3000\nEXPOSE 3000\nHEALTHCHECK --interval=15s --timeout=3s --start-period=5s --retries=3 \\\n  CMD curl -fsS http://localhost:${PORT:-3000}/healthz || exit 1\nENTRYPOINT ["bun", "/app/crewhaus.js"]\nCMD ["run", "/spec/crewhaus.yaml"]\n',
+    eval: '# Section 32 — docker-images: eval target shape (deployable eval bundle).\nFROM oven/bun:1.2-alpine AS deps\nWORKDIR /app\nCOPY bun.lock package.json ./\nCOPY packages packages\nCOPY apps apps\nRUN bun install --frozen-lockfile\n\nFROM deps AS build\nWORKDIR /app\nCOPY tsconfig.base.json tsconfig.json ./\nRUN bun run typecheck\nRUN bun build apps/cli/src/index.ts --target=bun --outfile=/app/dist/crewhaus.js\n\nFROM oven/bun:1.2-alpine AS runtime\nRUN addgroup -S crewhaus && adduser -S crewhaus -G crewhaus -u 10001 && \\\n    mkdir -p /app/.crewhaus/evals && chown -R crewhaus:crewhaus /app/.crewhaus\nWORKDIR /app\nCOPY --from=build --chown=crewhaus:crewhaus /app/dist/crewhaus.js /app/crewhaus.js\nCOPY --from=deps --chown=crewhaus:crewhaus /app/node_modules /app/node_modules\nUSER crewhaus\nENV NODE_ENV=production CREWHAUS_TARGET=eval\nEXPOSE 0\nHEALTHCHECK --interval=30s --timeout=5s --start-period=2s --retries=3 \\\n  CMD bun /app/crewhaus.js doctor --liveness || exit 1\nENTRYPOINT ["bun", "/app/crewhaus.js"]\nCMD ["eval", "/spec/crewhaus.yaml"]\n',
+    graph: '# Section 32 — docker-images: graph target shape (durable graph runtime).\nFROM oven/bun:1.2-alpine AS deps\nWORKDIR /app\nCOPY bun.lock package.json ./\nCOPY packages packages\nCOPY apps apps\nRUN bun install --frozen-lockfile\n\nFROM deps AS build\nWORKDIR /app\nCOPY tsconfig.base.json tsconfig.json ./\nRUN bun run typecheck\nRUN bun build apps/cli/src/index.ts --target=bun --outfile=/app/dist/crewhaus.js\n\nFROM oven/bun:1.2-alpine AS runtime\nRUN addgroup -S crewhaus && adduser -S crewhaus -G crewhaus -u 10001 && \\\n    mkdir -p /app/.crewhaus/graphs && chown -R crewhaus:crewhaus /app/.crewhaus\nWORKDIR /app\nCOPY --from=build --chown=crewhaus:crewhaus /app/dist/crewhaus.js /app/crewhaus.js\nCOPY --from=deps --chown=crewhaus:crewhaus /app/node_modules /app/node_modules\nUSER crewhaus\nENV NODE_ENV=production CREWHAUS_TARGET=graph\nEXPOSE 0\nHEALTHCHECK --interval=30s --timeout=5s --start-period=2s --retries=3 \\\n  CMD bun /app/crewhaus.js doctor --liveness || exit 1\nENTRYPOINT ["bun", "/app/crewhaus.js"]\nCMD ["run", "/spec/crewhaus.yaml"]\n',
+    managed: '# Section 32 — docker-images: managed target shape (multi-tenant gateway daemon).\n# Section 20 daemon listens on $PORT (default 8080) for tenant API traffic.\nFROM oven/bun:1.2-alpine AS deps\nWORKDIR /app\nCOPY bun.lock package.json ./\nCOPY packages packages\nCOPY apps apps\nRUN bun install --frozen-lockfile\n\nFROM deps AS build\nWORKDIR /app\nCOPY tsconfig.base.json tsconfig.json ./\nRUN bun run typecheck\nRUN bun build apps/cli/src/index.ts --target=bun --outfile=/app/dist/crewhaus.js\n\nFROM oven/bun:1.2-alpine AS runtime\nRUN apk add --no-cache curl ca-certificates && \\\n    addgroup -S crewhaus && adduser -S crewhaus -G crewhaus -u 10001 && \\\n    mkdir -p /app/.crewhaus/audit && chown -R crewhaus:crewhaus /app/.crewhaus\nWORKDIR /app\nCOPY --from=build --chown=crewhaus:crewhaus /app/dist/crewhaus.js /app/crewhaus.js\nCOPY --from=deps --chown=crewhaus:crewhaus /app/node_modules /app/node_modules\nUSER crewhaus\nENV NODE_ENV=production CREWHAUS_TARGET=managed PORT=8080\nEXPOSE 8080\nHEALTHCHECK --interval=15s --timeout=3s --start-period=5s --retries=3 \\\n  CMD curl -fsS http://localhost:${PORT:-8080}/healthz || exit 1\nENTRYPOINT ["bun", "/app/crewhaus.js"]\nCMD ["run", "/spec/crewhaus.yaml"]\n',
+    pipeline: '# Section 32 — docker-images: pipeline target shape (RAG ingest pipeline).\nFROM oven/bun:1.2-alpine AS deps\nWORKDIR /app\nCOPY bun.lock package.json ./\nCOPY packages packages\nCOPY apps apps\nRUN bun install --frozen-lockfile\n\nFROM deps AS build\nWORKDIR /app\nCOPY tsconfig.base.json tsconfig.json ./\nRUN bun run typecheck\nRUN bun build apps/cli/src/index.ts --target=bun --outfile=/app/dist/crewhaus.js\n\nFROM oven/bun:1.2-alpine AS runtime\nRUN addgroup -S crewhaus && adduser -S crewhaus -G crewhaus -u 10001 && \\\n    mkdir -p /app/.crewhaus/vector && chown -R crewhaus:crewhaus /app/.crewhaus\nWORKDIR /app\nCOPY --from=build --chown=crewhaus:crewhaus /app/dist/crewhaus.js /app/crewhaus.js\nCOPY --from=deps --chown=crewhaus:crewhaus /app/node_modules /app/node_modules\nUSER crewhaus\nENV NODE_ENV=production CREWHAUS_TARGET=pipeline\nEXPOSE 0\nHEALTHCHECK --interval=30s --timeout=5s --start-period=2s --retries=3 \\\n  CMD bun /app/crewhaus.js doctor --liveness || exit 1\nENTRYPOINT ["bun", "/app/crewhaus.js"]\nCMD ["run", "/spec/crewhaus.yaml"]\n',
+    research: '# Section 32 — docker-images: research target shape (autonomous research agent).\nFROM oven/bun:1.2-alpine AS deps\nWORKDIR /app\nCOPY bun.lock package.json ./\nCOPY packages packages\nCOPY apps apps\nRUN bun install --frozen-lockfile\n\nFROM deps AS build\nWORKDIR /app\nCOPY tsconfig.base.json tsconfig.json ./\nRUN bun run typecheck\nRUN bun build apps/cli/src/index.ts --target=bun --outfile=/app/dist/crewhaus.js\n\nFROM oven/bun:1.2-alpine AS runtime\nRUN addgroup -S crewhaus && adduser -S crewhaus -G crewhaus -u 10001 && \\\n    mkdir -p /app/.crewhaus/research && chown -R crewhaus:crewhaus /app/.crewhaus\nWORKDIR /app\nCOPY --from=build --chown=crewhaus:crewhaus /app/dist/crewhaus.js /app/crewhaus.js\nCOPY --from=deps --chown=crewhaus:crewhaus /app/node_modules /app/node_modules\nUSER crewhaus\nENV NODE_ENV=production CREWHAUS_TARGET=research\nEXPOSE 0\nHEALTHCHECK --interval=30s --timeout=5s --start-period=2s --retries=3 \\\n  CMD bun /app/crewhaus.js doctor --liveness || exit 1\nENTRYPOINT ["bun", "/app/crewhaus.js"]\nCMD ["run", "/spec/crewhaus.yaml"]\n',
+    voice: '# Section 32 — docker-images: voice target shape (realtime telephony agent).\n# Adds opus (PCM ↔ Opus codec for telephony codecs) on top of the base.\nFROM oven/bun:1.2-alpine AS deps\nWORKDIR /app\nCOPY bun.lock package.json ./\nCOPY packages packages\nCOPY apps apps\nRUN bun install --frozen-lockfile\n\nFROM deps AS build\nWORKDIR /app\nCOPY tsconfig.base.json tsconfig.json ./\nRUN bun run typecheck\nRUN bun build apps/cli/src/index.ts --target=bun --outfile=/app/dist/crewhaus.js\n\nFROM oven/bun:1.2-alpine AS runtime\nRUN apk add --no-cache curl ca-certificates opus opus-tools && \\\n    addgroup -S crewhaus && adduser -S crewhaus -G crewhaus -u 10001 && \\\n    mkdir -p /app/.crewhaus && chown crewhaus:crewhaus /app/.crewhaus\nWORKDIR /app\nCOPY --from=build --chown=crewhaus:crewhaus /app/dist/crewhaus.js /app/crewhaus.js\nCOPY --from=deps --chown=crewhaus:crewhaus /app/node_modules /app/node_modules\nUSER crewhaus\nENV NODE_ENV=production CREWHAUS_TARGET=voice PORT=8080\nEXPOSE 8080\nHEALTHCHECK --interval=15s --timeout=5s --start-period=10s --retries=3 \\\n  CMD curl -fsS http://localhost:${PORT:-8080}/healthz || exit 1\nENTRYPOINT ["bun", "/app/crewhaus.js"]\nCMD ["run", "/spec/crewhaus.yaml"]\n',
+    workflow: '# Section 32 — docker-images: workflow target shape (sequential multi-step agent).\nFROM oven/bun:1.2-alpine AS deps\nWORKDIR /app\nCOPY bun.lock package.json ./\nCOPY packages packages\nCOPY apps apps\nRUN bun install --frozen-lockfile\n\nFROM deps AS build\nWORKDIR /app\nCOPY tsconfig.base.json tsconfig.json ./\nRUN bun run typecheck\nRUN bun build apps/cli/src/index.ts --target=bun --outfile=/app/dist/crewhaus.js\n\nFROM oven/bun:1.2-alpine AS runtime\nRUN addgroup -S crewhaus && adduser -S crewhaus -G crewhaus -u 10001\nWORKDIR /app\nCOPY --from=build --chown=crewhaus:crewhaus /app/dist/crewhaus.js /app/crewhaus.js\nCOPY --from=deps --chown=crewhaus:crewhaus /app/node_modules /app/node_modules\nUSER crewhaus\nENV NODE_ENV=production CREWHAUS_TARGET=workflow\nEXPOSE 0\nHEALTHCHECK --interval=30s --timeout=5s --start-period=2s --retries=3 \\\n  CMD bun /app/crewhaus.js doctor --liveness || exit 1\nENTRYPOINT ["bun", "/app/crewhaus.js"]\nCMD ["run", "/spec/crewhaus.yaml"]\n',
+};

package/dist/index.d.ts

@@ -40,6 +40,15 @@ export declare function isTargetShape(value: unknown): value is TargetShape;
 export declare function dockerRoot(): string;
 export declare function digestsPath(): string;
 export declare function dockerfilePath(target: TargetShape): string;
+/**
+ * The Dockerfile body for a shape, served from {@link DOCKERFILE_BODIES}.
+ *
+ * Reading it from disk broke `build-image` on both published channels — under
+ * `/$bunfs` in the compiled binary and against an npm tarball that omitted
+ * `docker/`. See `embedded.ts`. {@link dockerfilePath} still returns a real
+ * path for the build CONTEXT and for humans; only the body comes from the
+ * embedded map.
+ */
 export declare function readDockerfile(target: TargetShape): string;
 export declare function dockerfileSize(target: TargetShape): number;
 export declare function listAvailableTargets(): readonly TargetShape[];

package/dist/index.js

@@ -1,4 +1,6 @@
+import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 /**
@@ -27,6 +29,7 @@ import { fileURLToPath } from "node:url";
  *     the lockfile would hand users an unpullable pin.
  */
 import { CrewhausError } from "@crewhaus/errors";
+import { DOCKERFILE_BODIES } from "./embedded";
 export class DockerImagesError extends CrewhausError {
     name = "DockerImagesError";
     constructor(message, cause) {
@@ -68,18 +71,29 @@ export function digestsPath() {
 export function dockerfilePath(target) {
     return join(DOCKER_ROOT, target, "Dockerfile");
 }
+/**
+ * The Dockerfile body for a shape, served from {@link DOCKERFILE_BODIES}.
+ *
+ * Reading it from disk broke `build-image` on both published channels — under
+ * `/$bunfs` in the compiled binary and against an npm tarball that omitted
+ * `docker/`. See `embedded.ts`. {@link dockerfilePath} still returns a real
+ * path for the build CONTEXT and for humans; only the body comes from the
+ * embedded map.
+ */
 export function readDockerfile(target) {
-    const path = dockerfilePath(target);
-    if (!existsSync(path)) {
-        throw new DockerImagesError(`dockerfile missing for target ${target} (expected at ${path})`);
+    const body = DOCKERFILE_BODIES[target];
+    if (body === undefined) {
+        throw new DockerImagesError(`dockerfile missing for target ${target} (expected at ${dockerfilePath(target)})`);
     }
-    return readFileSync(path, "utf8");
+    return body;
 }
 export function dockerfileSize(target) {
-    return statSync(dockerfilePath(target)).size;
+    // Byte length of the embedded body — `statSync` would fail wherever the file
+    // is not on disk, which is every shipped artifact.
+    return Buffer.byteLength(readDockerfile(target), "utf8");
 }
 export function listAvailableTargets() {
-    return TARGET_SHAPES.filter((t) => existsSync(dockerfilePath(t)));
+    return TARGET_SHAPES.filter((t) => DOCKERFILE_BODIES[t] !== undefined);
 }
 export async function buildImage(opts) {
     if (!isTargetShape(opts.target)) {
@@ -88,10 +102,14 @@ export async function buildImage(opts) {
     if (!opts.tag || /[\s\n\r]/.test(opts.tag)) {
         throw new DockerImagesError(`invalid tag: ${JSON.stringify(opts.tag)} — must be non-empty and contain no whitespace`);
     }
-    const dockerfile = dockerfilePath(opts.target);
-    if (!existsSync(dockerfile)) {
-        throw new DockerImagesError(`dockerfile missing for target ${opts.target} (expected at ${dockerfile})`);
-    }
+    // `docker build --file` needs a REAL path, and the checked-in Dockerfile is
+    // absent from every shipped artifact — `/$bunfs` in the compiled binary, and
+    // (before this release) an npm tarball without `docker/`. The body is
+    // embedded, so materialize it when the file is not on disk and hand docker
+    // the temp copy. Prefer the real file when present: a source checkout then
+    // builds from exactly what the developer is editing.
+    const onDisk = dockerfilePath(opts.target);
+    const dockerfile = existsSync(onDisk) ? onDisk : materializeDockerfile(opts.target);
     const contextPath = opts.contextPath ?? resolve(PACKAGE_ROOT, "..", "..");
     const argv = [
         "docker",
@@ -114,6 +132,25 @@ export async function buildImage(opts) {
     }
     return { tag: opts.tag, target: opts.target, buildArgv: argv };
 }
+/**
+ * Write the embedded Dockerfile for a shape to a temp file and return its
+ * path, for the one caller that needs a real one: `docker build --file`.
+ *
+ * Only reached where the checked-in file is absent — i.e. every shipped
+ * artifact. Deterministic per (target, body) so repeat builds reuse one file
+ * instead of littering tmp, and content-addressed so a changed body never
+ * reuses a stale copy.
+ */
+function materializeDockerfile(target) {
+    const body = readDockerfile(target);
+    const stamp = createHash("sha256").update(body).digest("hex").slice(0, 16);
+    const dir = join(tmpdir(), `crewhaus-dockerfiles-${stamp}`);
+    mkdirSync(dir, { recursive: true });
+    const path = join(dir, `${target}.Dockerfile`);
+    if (!existsSync(path))
+        writeFileSync(path, body, { mode: 0o644 });
+    return path;
+}
 export const defaultRunner = async (argv, cwd) => {
     const { spawn } = await import("node:child_process");
     return new Promise((resolve_) => {

package/docker/batch/Dockerfile

@@ -0,0 +1,29 @@
+# Section 32 — docker-images: batch target shape (queue worker daemon).
+# Section 23 BATCH worker pulls from queue-protocol, runs one runChatLoop per job.
+FROM oven/bun:1.2-alpine AS deps
+WORKDIR /app
+COPY bun.lock package.json ./
+COPY packages packages
+COPY apps apps
+RUN bun install --frozen-lockfile
+
+FROM deps AS build
+WORKDIR /app
+COPY tsconfig.base.json tsconfig.json ./
+RUN bun run typecheck
+RUN bun build apps/cli/src/index.ts --target=bun --outfile=/app/dist/crewhaus.js
+
+FROM oven/bun:1.2-alpine AS runtime
+RUN addgroup -S crewhaus && adduser -S crewhaus -G crewhaus -u 10001 && \
+    mkdir -p /app/.crewhaus && chown crewhaus:crewhaus /app/.crewhaus
+WORKDIR /app
+COPY --from=build --chown=crewhaus:crewhaus /app/dist/crewhaus.js /app/crewhaus.js
+COPY --from=deps --chown=crewhaus:crewhaus /app/node_modules /app/node_modules
+USER crewhaus
+ENV NODE_ENV=production CREWHAUS_TARGET=batch
+EXPOSE 0
+# Batch worker is a long-running consumer; healthcheck just verifies the process is alive.
+HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
+  CMD pgrep -f crewhaus.js > /dev/null || exit 1
+ENTRYPOINT ["bun", "/app/crewhaus.js"]
+CMD ["run", "/spec/crewhaus.yaml"]

package/docker/browser/Dockerfile

@@ -0,0 +1,41 @@
+# Section 32 — docker-images: browser target shape (computer-use agent).
+# Adds chromium + Playwright runtime so the BROW driver can spawn real browsers.
+FROM oven/bun:1.2-alpine AS deps
+WORKDIR /app
+COPY bun.lock package.json ./
+COPY packages packages
+COPY apps apps
+RUN bun install --frozen-lockfile
+
+FROM deps AS build
+WORKDIR /app
+COPY tsconfig.base.json tsconfig.json ./
+RUN bun run typecheck
+RUN bun build apps/cli/src/index.ts --target=bun --outfile=/app/dist/crewhaus.js
+
+FROM oven/bun:1.2-alpine AS runtime
+# chromium + the libs Playwright's bundled chromium needs at runtime
+RUN apk add --no-cache \
+      chromium \
+      nss \
+      freetype \
+      harfbuzz \
+      ca-certificates \
+      ttf-freefont \
+      dbus \
+      curl && \
+    addgroup -S crewhaus && adduser -S crewhaus -G crewhaus -u 10001 && \
+    mkdir -p /app/.crewhaus && chown crewhaus:crewhaus /app/.crewhaus
+WORKDIR /app
+COPY --from=build --chown=crewhaus:crewhaus /app/dist/crewhaus.js /app/crewhaus.js
+COPY --from=deps --chown=crewhaus:crewhaus /app/node_modules /app/node_modules
+USER crewhaus
+ENV NODE_ENV=production CREWHAUS_TARGET=browser \
+    PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 \
+    PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH=/usr/bin/chromium-browser \
+    PORT=8080
+EXPOSE 8080
+HEALTHCHECK --interval=20s --timeout=10s --start-period=10s --retries=3 \
+  CMD curl -fsS http://localhost:${PORT:-8080}/healthz || exit 1
+ENTRYPOINT ["bun", "/app/crewhaus.js"]
+CMD ["run", "/spec/crewhaus.yaml"]

package/docker/channel/Dockerfile

@@ -0,0 +1,29 @@
+# Section 32 — docker-images: channel target shape (long-running daemon).
+# Section 12 daemon listens on $PORT (default 3000) for inbound webhooks.
+FROM oven/bun:1.2-alpine AS deps
+WORKDIR /app
+COPY bun.lock package.json ./
+COPY packages packages
+COPY apps apps
+RUN bun install --frozen-lockfile
+
+FROM deps AS build
+WORKDIR /app
+COPY tsconfig.base.json tsconfig.json ./
+RUN bun run typecheck
+RUN bun build apps/cli/src/index.ts --target=bun --outfile=/app/dist/crewhaus.js
+
+FROM oven/bun:1.2-alpine AS runtime
+RUN apk add --no-cache curl ca-certificates && \
+    addgroup -S crewhaus && adduser -S crewhaus -G crewhaus -u 10001 && \
+    mkdir -p /app/.crewhaus && chown crewhaus:crewhaus /app/.crewhaus
+WORKDIR /app
+COPY --from=build --chown=crewhaus:crewhaus /app/dist/crewhaus.js /app/crewhaus.js
+COPY --from=deps --chown=crewhaus:crewhaus /app/node_modules /app/node_modules
+USER crewhaus
+ENV NODE_ENV=production CREWHAUS_TARGET=channel PORT=3000
+EXPOSE 3000
+HEALTHCHECK --interval=15s --timeout=3s --start-period=5s --retries=3 \
+  CMD curl -fsS http://localhost:${PORT:-3000}/healthz || exit 1
+ENTRYPOINT ["bun", "/app/crewhaus.js"]
+CMD ["run", "/spec/crewhaus.yaml"]

package/docker/cli/Dockerfile

@@ -0,0 +1,37 @@
+# Section 32 — docker-images: CLI target shape (interactive REPL).
+# Multi-stage: deps → build → runtime. Non-root user, read-only root, HEALTHCHECK.
+
+# ──────────────────────────────────────────────────────────────────────────────
+# Stage 1: deps (cached layer for node_modules)
+# ──────────────────────────────────────────────────────────────────────────────
+FROM oven/bun:1.2-alpine AS deps
+WORKDIR /app
+COPY bun.lock package.json ./
+COPY packages packages
+COPY apps apps
+RUN bun install --frozen-lockfile
+
+# ──────────────────────────────────────────────────────────────────────────────
+# Stage 2: build (typecheck + bundle the CLI entrypoint)
+# ──────────────────────────────────────────────────────────────────────────────
+FROM deps AS build
+WORKDIR /app
+COPY tsconfig.base.json tsconfig.json ./
+RUN bun run typecheck
+RUN bun build apps/cli/src/index.ts --target=bun --outfile=/app/dist/crewhaus.js
+
+# ──────────────────────────────────────────────────────────────────────────────
+# Stage 3: runtime (minimal — only what the CLI needs at boot)
+# ──────────────────────────────────────────────────────────────────────────────
+FROM oven/bun:1.2-alpine AS runtime
+RUN addgroup -S crewhaus && adduser -S crewhaus -G crewhaus -u 10001
+WORKDIR /app
+COPY --from=build --chown=crewhaus:crewhaus /app/dist/crewhaus.js /app/crewhaus.js
+COPY --from=deps --chown=crewhaus:crewhaus /app/node_modules /app/node_modules
+USER crewhaus
+ENV NODE_ENV=production CREWHAUS_TARGET=cli
+EXPOSE 0
+HEALTHCHECK --interval=30s --timeout=5s --start-period=2s --retries=3 \
+  CMD bun /app/crewhaus.js doctor --liveness || exit 1
+ENTRYPOINT ["bun", "/app/crewhaus.js"]
+CMD ["--help"]

package/docker/crew/Dockerfile

@@ -0,0 +1,28 @@
+# Section 32 — docker-images: crew target shape (multi-agent A2A daemon).
+FROM oven/bun:1.2-alpine AS deps
+WORKDIR /app
+COPY bun.lock package.json ./
+COPY packages packages
+COPY apps apps
+RUN bun install --frozen-lockfile
+
+FROM deps AS build
+WORKDIR /app
+COPY tsconfig.base.json tsconfig.json ./
+RUN bun run typecheck
+RUN bun build apps/cli/src/index.ts --target=bun --outfile=/app/dist/crewhaus.js
+
+FROM oven/bun:1.2-alpine AS runtime
+RUN apk add --no-cache curl ca-certificates && \
+    addgroup -S crewhaus && adduser -S crewhaus -G crewhaus -u 10001 && \
+    mkdir -p /app/.crewhaus && chown crewhaus:crewhaus /app/.crewhaus
+WORKDIR /app
+COPY --from=build --chown=crewhaus:crewhaus /app/dist/crewhaus.js /app/crewhaus.js
+COPY --from=deps --chown=crewhaus:crewhaus /app/node_modules /app/node_modules
+USER crewhaus
+ENV NODE_ENV=production CREWHAUS_TARGET=crew PORT=3000
+EXPOSE 3000
+HEALTHCHECK --interval=15s --timeout=3s --start-period=5s --retries=3 \
+  CMD curl -fsS http://localhost:${PORT:-3000}/healthz || exit 1
+ENTRYPOINT ["bun", "/app/crewhaus.js"]
+CMD ["run", "/spec/crewhaus.yaml"]

package/docker/digests.json

@@ -0,0 +1,652 @@
+{
+  "_comment": "Pinned image digests for reproducible builds. Every entry is a REGISTRY MANIFEST digest (the only digest `docker pull repo@sha256:...` accepts), recorded from pushed builds only: `crewhaus build-image --push` records here by default (opt out with --no-record), and the Release workflow's docker-digests job records the pushed ghcr.io/crewhaus/<target> digests for each v* tag. Local --load builds record nothing — a local image ID is a config digest, not a pullable pin. Format: `{ \"<target>\": { \"<tag>\": { \"sha256\": \"<digest>\", \"builtAt\": \"<iso>\" } } }`.",
+  "_format_version": 1,
+  "batch": {
+    "0.2.0": {
+      "sha256": "sha256:4eea75fe9147aad30c11339b1291215a6136ceb1e97d59010a91304cf2a6031a",
+      "builtAt": "2026-07-03T06:44:26.432Z"
+    },
+    "0.2.1": {
+      "sha256": "sha256:77078a1c2d1e43866d8f54253c81ae569207271413200dae68d66433a96ff7fd",
+      "builtAt": "2026-07-05T08:53:49.137Z"
+    },
+    "0.2.2": {
+      "sha256": "sha256:a002490668de740a1b662fc35fd71f492f56c6fb04503857c5c5b84fa16552cc",
+      "builtAt": "2026-07-06T01:44:26.315Z"
+    },
+    "0.2.3": {
+      "sha256": "sha256:ee0c2e2cb77e0dc0286e088f500b2cfa2b4e885f6f86b45dc227881da07af256",
+      "builtAt": "2026-07-07T20:18:48.437Z"
+    },
+    "0.2.4": {
+      "sha256": "sha256:62f9122abc1efbb3d7ce813cc3b54330803ce59ffdab15b12f723518a8847cb9",
+      "builtAt": "2026-07-08T20:06:58.038Z"
+    },
+    "0.3.0": {
+      "sha256": "sha256:8944ed96795b2552141e1499526ce6fedfbe1478cc085f4f4eee090943382db0",
+      "builtAt": "2026-07-14T18:22:51.756Z"
+    },
+    "0.3.1": {
+      "sha256": "sha256:5fa99182fa2e018196147669871ae81f6b67f7c4d8a7d80e04ea10e27a16230e",
+      "builtAt": "2026-07-16T05:03:06.490Z"
+    },
+    "0.3.2": {
+      "sha256": "sha256:9a3be0cb23cc2b31661edaa998edaf557243357a162fb13785e5ffef76e37cfc",
+      "builtAt": "2026-07-17T00:31:58.504Z"
+    },
+    "0.4.0": {
+      "sha256": "sha256:9cf3655cbb174998c6b3ed9c5d40caa1aace5f31e030a5a4ff915d9509b81429",
+      "builtAt": "2026-07-18T16:42:04.878Z"
+    },
+    "0.4.1": {
+      "sha256": "sha256:bf7b417c198651537e76b6f56d7135d09f722e001e3bdfaabbd65daa54e853e6",
+      "builtAt": "2026-07-27T04:03:47.176Z"
+    },
+    "0.4.2": {
+      "sha256": "sha256:50fbad6647d56da45582873b33ccdfae071550d8b468cf482a0d2c7ee273ab28",
+      "builtAt": "2026-07-27T21:28:50.474Z"
+    },
+    "0.5.0": {
+      "sha256": "sha256:6a563a125b589a997f8a5830bf09bbfb0a757b0a35ecf8e914f146c567bbd013",
+      "builtAt": "2026-08-05T21:56:10.633Z"
+    },
+    "0.5.1": {
+      "sha256": "sha256:f6f507560dfeb9156fee2c7a7054002e1a6dc97e1f93fa05879e07d468e2ded3",
+      "builtAt": "2026-08-06T02:20:15.769Z"
+    }
+  },
+  "browser": {
+    "0.2.0": {
+      "sha256": "sha256:55db38c2e88ac16b95a349fc69172669984a061f2b8af9a95660e15c27663e96",
+      "builtAt": "2026-07-03T06:44:27.172Z"
+    },
+    "0.2.1": {
+      "sha256": "sha256:6d19322d045fc9a7344975ec34a14b8d80c2ea14257256c81df3860763e7c6f5",
+      "builtAt": "2026-07-05T08:53:49.483Z"
+    },
+    "0.2.2": {
+      "sha256": "sha256:5cee7018195cc239c11db4bb15c6e63af5c7050f85022d5ffa69cc5bd054f643",
+      "builtAt": "2026-07-06T01:44:27.048Z"
+    },
+    "0.2.3": {
+      "sha256": "sha256:241cd53ab49dd7a4276a3c4e2cd06c871c8a24e8563c14e75d24b0074be5a1df",
+      "builtAt": "2026-07-07T20:18:48.687Z"
+    },
+    "0.2.4": {
+      "sha256": "sha256:3f68dd265233a3dce348e2b0aa471a705664fb3b6a9f5b47a170271763d888c1",
+      "builtAt": "2026-07-08T20:06:58.427Z"
+    },
+    "0.3.0": {
+      "sha256": "sha256:c3bf518930a57916e0fed7b2959c56a99c352f3f26ef2128266d272ef2a91410",
+      "builtAt": "2026-07-14T18:22:52.283Z"
+    },
+    "0.3.1": {
+      "sha256": "sha256:a6a901d2a264652fe02a30100c0f2eed5a17de99bed48490d58dc7fdc8b8e76e",
+      "builtAt": "2026-07-16T05:03:07.190Z"
+    },
+    "0.3.2": {
+      "sha256": "sha256:8f7d3405cf627e6a6b773444e2a5cf45aa2a53a9dc732e9b7e039b84be34b003",
+      "builtAt": "2026-07-17T00:31:58.880Z"
+    },
+    "0.4.0": {
+      "sha256": "sha256:399e7a52f9734718641cc6c218aa6fd0275d7f1e4c92f75ed8cc4c4aee2b3f12",
+      "builtAt": "2026-07-18T16:42:05.216Z"
+    },
+    "0.4.1": {
+      "sha256": "sha256:b890726bbcdf68ef600129332dcb78a10d89287458ae7f3c8f83c27dfce11807",
+      "builtAt": "2026-07-27T04:03:47.867Z"
+    },
+    "0.4.2": {
+      "sha256": "sha256:e886333333da8047babe095b2200b00e920c43d270541162045b7dc14ba26ac1",
+      "builtAt": "2026-07-27T21:28:50.721Z"
+    },
+    "0.5.0": {
+      "sha256": "sha256:99cc56dc44cb1283151b46f40e28fcad0966908fcf527070d8169a9c0b201c2d",
+      "builtAt": "2026-08-05T21:56:11.339Z"
+    },
+    "0.5.1": {
+      "sha256": "sha256:c67666d971f2b2580325e069d80b2c0f6a0f5c1508cc7664c2a30a76145c8cb0",
+      "builtAt": "2026-08-06T02:20:15.989Z"
+    }
+  },
+  "channel": {
+    "0.2.0": {
+      "sha256": "sha256:3917cbdda86a401b72767c57e3307a01bae3a8b5467436be69b1c0d43a00e732",
+      "builtAt": "2026-07-03T06:44:27.959Z"
+    },
+    "0.2.1": {
+      "sha256": "sha256:78de16e1d83eb8b0128cd02f079f5649a421249d68f8c8f77e014759cac7b75c",
+      "builtAt": "2026-07-05T08:53:49.811Z"
+    },
+    "0.2.2": {
+      "sha256": "sha256:2123ff2ea1e9329ad9121ca8909353dba3b5cfe14ee0830fbf747a9fc6fab500",
+      "builtAt": "2026-07-06T01:44:27.705Z"
+    },
+    "0.2.3": {
+      "sha256": "sha256:62bc930603aed1a7ada76757691ae04d3642a433da48325092e49cb76bb4095f",
+      "builtAt": "2026-07-07T20:18:48.931Z"
+    },
+    "0.2.4": {
+      "sha256": "sha256:e7bfc3eb7378d39cb5d81e8d9dd6df3143b778076336d497f35413fbdd5cc9ff",
+      "builtAt": "2026-07-08T20:06:58.816Z"
+    },
+    "0.3.0": {
+      "sha256": "sha256:fc5b00a5621b3db2dfbc38bf4c51b19d1673492ceebc7a9c52781230070ce75b",
+      "builtAt": "2026-07-14T18:22:52.792Z"
+    },
+    "0.3.1": {
+      "sha256": "sha256:4da0a91d7361dbb5cac452f34510ee7ddfe1341bc0439e4f3d871cdae949ff17",
+      "builtAt": "2026-07-16T05:03:07.880Z"
+    },
+    "0.3.2": {
+      "sha256": "sha256:856f66aa6f2cda183279873b2eb86548d2500458327f176da52226e2162fc2d4",
+      "builtAt": "2026-07-17T00:31:59.266Z"
+    },
+    "0.4.0": {
+      "sha256": "sha256:510cdf19d78b34fb3650a122cd09951350f6f71c7617a0b8fd8b686f88360ab2",
+      "builtAt": "2026-07-18T16:42:05.540Z"
+    },
+    "0.4.1": {
+      "sha256": "sha256:df101d4bfd7e69b767d90b587f427ce3f6684073cc73fa6973bf3862b04184af",
+      "builtAt": "2026-07-27T04:03:48.719Z"
+    },
+    "0.4.2": {
+      "sha256": "sha256:4f96169a3b14a526e98b1364eee8cfbb418023f7dbb8b0d0585f72c960856580",
+      "builtAt": "2026-07-27T21:28:50.979Z"
+    },
+    "0.5.0": {
+      "sha256": "sha256:cbcdb755b75eb2b2f1823859e4d40ac15d979ea4b7f3b0be605c98042fa3490b",
+      "builtAt": "2026-08-05T21:56:12.021Z"
+    },
+    "0.5.1": {
+      "sha256": "sha256:8b864f4a4c97caf5ff348088c1b2d2d21a0110af4326afa81a870b895d9a00fe",
+      "builtAt": "2026-08-06T02:20:16.194Z"
+    }
+  },
+  "cli": {
+    "0.2.0": {
+      "sha256": "sha256:072dabd488f3d24568ba7a76bce13f55d39493fb5f5b79b8ca272190f75fa2be",
+      "builtAt": "2026-07-03T06:44:28.759Z"
+    },
+    "0.2.1": {
+      "sha256": "sha256:76d6c765c0120278a02fc175b9ed6c3ee70e58531ea6c95b6007538f818cad36",
+      "builtAt": "2026-07-05T08:53:50.149Z"
+    },
+    "0.2.2": {
+      "sha256": "sha256:795d1623022060d03b1b433f435ec370354a582ec0510cc3398b6f60038fb932",
+      "builtAt": "2026-07-06T01:44:28.447Z"
+    },
+    "0.2.3": {
+      "sha256": "sha256:d2eb6e402619f48756d8c11fb45f951a1881fbdb870bb3acec07d464ceafb3f6",
+      "builtAt": "2026-07-07T20:18:49.174Z"
+    },
+    "0.2.4": {
+      "sha256": "sha256:7cbdf2513df47e8bb53f6c966ba1a0df7c020567faceefbecb303ebc227ca02c",
+      "builtAt": "2026-07-08T20:06:59.207Z"
+    },
+    "0.3.0": {
+      "sha256": "sha256:39565e54cce2ab284745b337538128928feea5c2c0521a287168d8338064af80",
+      "builtAt": "2026-07-14T18:22:53.220Z"
+    },
+    "0.3.1": {
+      "sha256": "sha256:e568887ddc71d4a63da922d27472d986540d194c5d6777ef78bf674da595ad7d",
+      "builtAt": "2026-07-16T05:03:08.598Z"
+    },
+    "0.3.2": {
+      "sha256": "sha256:d4db54c13bc3cf3b250ad24b8739e32383781bbd9d83e96e1d72eb2027806087",
+      "builtAt": "2026-07-17T00:31:59.634Z"
+    },
+    "0.4.0": {
+      "sha256": "sha256:136db43058a878fddfa7c4fa2b20cc14016ba3d0a7218181697dcb14c3fc6c36",
+      "builtAt": "2026-07-18T16:42:05.857Z"
+    },
+    "0.4.1": {
+      "sha256": "sha256:7c83b0197350948111cfd89e07978e7183e82fb67df7148c772ed422ae6e8cda",
+      "builtAt": "2026-07-27T04:03:49.439Z"
+    },
+    "0.4.2": {
+      "sha256": "sha256:3376a5566f08c3530d19e61ad1800e2770c353948341a0882ea0a9dc501c9a08",
+      "builtAt": "2026-07-27T21:28:51.266Z"
+    },
+    "0.5.0": {
+      "sha256": "sha256:988e65d61c9a6a0beb15a0504ec56f286e7ad8d149461bf9bed716e97fbce14f",
+      "builtAt": "2026-08-05T21:56:12.772Z"
+    },
+    "0.5.1": {
+      "sha256": "sha256:b859ca9b048f718293b46dd1a39dd4e06ed231d48b77b7359c6719dc9a2f04af",
+      "builtAt": "2026-08-06T02:20:16.414Z"
+    }
+  },
+  "crew": {
+    "0.2.0": {
+      "sha256": "sha256:bf82a585954fc35bd4b2af6ae2d5b866bf478f9abbcd9d77c8b47ddde610ffde",
+      "builtAt": "2026-07-03T06:44:29.458Z"
+    },
+    "0.2.1": {
+      "sha256": "sha256:42e6ec750e0eca70ac7ce222ee14cf6b4a6c09a26220f0a8b9d043a95a9c61cf",
+      "builtAt": "2026-07-05T08:53:50.493Z"
+    },
+    "0.2.2": {
+      "sha256": "sha256:14362221ee7b1d540aaa88f166c64bfbb24fa5aeb70066c99fafb5e0ecc4a6c8",
+      "builtAt": "2026-07-06T01:44:29.168Z"
+    },
+    "0.2.3": {
+      "sha256": "sha256:3e9ec8d9805413e8b3e8c0b37d06ee76a338ee344c41f06dfd2ba6f185539e30",
+      "builtAt": "2026-07-07T20:18:49.435Z"
+    },
+    "0.2.4": {
+      "sha256": "sha256:a381333d3a7aa6060734a31acd55d9333098903abf43f18fd11143213942436f",
+      "builtAt": "2026-07-08T20:06:59.647Z"
+    },
+    "0.3.0": {
+      "sha256": "sha256:932ed93eac40ded1de5afa2d18c99204aa961ad2983f2f207cb1a332802ad4eb",
+      "builtAt": "2026-07-14T18:22:54.786Z"
+    },
+    "0.3.1": {
+      "sha256": "sha256:6bd56c07ac646cda925cd68c74e99bbc52720851d722d3ec886fa9c1bc2401c2",
+      "builtAt": "2026-07-16T05:03:09.273Z"
+    },
+    "0.3.2": {
+      "sha256": "sha256:ccf3628ae078d3a43f62e52d1b12748fff9836710f48100e5782256f20a39583",
+      "builtAt": "2026-07-17T00:32:00.004Z"
+    },
+    "0.4.0": {
+      "sha256": "sha256:be1b617fe7386a543d656aa7255ee086b68a26e37463e89ac733ad72415f66c8",
+      "builtAt": "2026-07-18T16:42:06.196Z"
+    },
+    "0.4.1": {
+      "sha256": "sha256:2c35ccbe99272eef3a5efe616ff722b44c48333e6494ed5f99bf12a916094e7e",
+      "builtAt": "2026-07-27T04:03:50.283Z"
+    },
+    "0.4.2": {
+      "sha256": "sha256:c80305416de1fecd4c6054109a1f55f26db7d29afcfa13c65344585642ca2b1e",
+      "builtAt": "2026-07-27T21:28:51.507Z"
+    },
+    "0.5.0": {
+      "sha256": "sha256:d8eba3a4beaf303e07eac7381b467058781d450eda4165fe002adc565913c9e4",
+      "builtAt": "2026-08-05T21:56:13.513Z"
+    },
+    "0.5.1": {
+      "sha256": "sha256:dff3fc477fc11df151c98f9d9c61590958ae847310aec3ad5595bf93095cc391",
+      "builtAt": "2026-08-06T02:20:16.612Z"
+    }
+  },
+  "eval": {
+    "0.2.0": {
+      "sha256": "sha256:7cf684200e60c0985aee9fab5c35140483baee0bcb62fb983d987d70e593d3d7",
+      "builtAt": "2026-07-03T06:44:30.149Z"
+    },
+    "0.2.1": {
+      "sha256": "sha256:52aab14cf9531f80b4d51e0e1b5d1afed46bec5c423478f7161b1aaec06dbcba",
+      "builtAt": "2026-07-05T08:53:50.821Z"
+    },
+    "0.2.2": {
+      "sha256": "sha256:6368a67b518ea9e833137f15e13b1374c8540a26f1b9565869c0b626e33e25b0",
+      "builtAt": "2026-07-06T01:44:29.860Z"
+    },
+    "0.2.3": {
+      "sha256": "sha256:0f6e719ce9d5032155d71e2873f09602bf39ab814967d4a5eb519dee3aafe69f",
+      "builtAt": "2026-07-07T20:18:49.679Z"
+    },
+    "0.2.4": {
+      "sha256": "sha256:f83f91e9c283ec7aa5d60c01d00ceafaf8d37381e5711017eba4c9239e068a37",
+      "builtAt": "2026-07-08T20:07:00.028Z"
+    },
+    "0.3.0": {
+      "sha256": "sha256:03b1c8022984ce7b8f0661a3082267341a0b7ce99a91b80ebb81d884034363b7",
+      "builtAt": "2026-07-14T18:22:55.230Z"
+    },
+    "0.3.1": {
+      "sha256": "sha256:322ca2330de21b06f899d1d5f0ac4d84c5d26d6f445cd73b93662c6a160ff22b",
+      "builtAt": "2026-07-16T05:03:09.981Z"
+    },
+    "0.3.2": {
+      "sha256": "sha256:bd819a19e132c7630a73250d463a733e4ecf1de47a41ace20acebc1486bc2e98",
+      "builtAt": "2026-07-17T00:32:00.361Z"
+    },
+    "0.4.0": {
+      "sha256": "sha256:5d83618073af91fcd0483aa5405ed885b65fb5fdcf692f80a26e5da0abaf7975",
+      "builtAt": "2026-07-18T16:42:06.511Z"
+    },
+    "0.4.1": {
+      "sha256": "sha256:2bc8603e39780a320f7b667b5f90142a6ad2d5055b4cfc6d2c25ae899de09eb6",
+      "builtAt": "2026-07-27T04:03:50.979Z"
+    },
+    "0.4.2": {
+      "sha256": "sha256:1443f6c3d491319d3e80561790788a701eb8ef6e077572ba8637064031634c39",
+      "builtAt": "2026-07-27T21:28:51.742Z"
+    },
+    "0.5.0": {
+      "sha256": "sha256:372c6b477b4e3f09b6dd1721ef5b8eb28cf29ab49ed478decc376b51f2823d9f",
+      "builtAt": "2026-08-05T21:56:14.193Z"
+    },
+    "0.5.1": {
+      "sha256": "sha256:41c5e1446b2b3757077824881b323ba6492ea396c962b3d8f19090c098d670df",
+      "builtAt": "2026-08-06T02:20:16.837Z"
+    }
+  },
+  "graph": {
+    "0.2.0": {
+      "sha256": "sha256:c78e2a76ac4cfe86066554671dc835d9b94b217fdd73254f9a15ba55b9ef3765",
+      "builtAt": "2026-07-03T06:44:30.846Z"
+    },
+    "0.2.1": {
+      "sha256": "sha256:f31628b0541fb1a396c38b9caf4767e6d7af0a273e4c79042539ae88b4563c45",
+      "builtAt": "2026-07-05T08:53:51.136Z"
+    },
+    "0.2.2": {
+      "sha256": "sha256:2848579399ad91e40233b01f10319f221d0e9e25079bf3a4a80af5218525475b",
+      "builtAt": "2026-07-06T01:44:30.489Z"
+    },
+    "0.2.3": {
+      "sha256": "sha256:8eef79d1fcff0315925488f5fcc4288f467b144ab61bda2d8d79154b9756a5b2",
+      "builtAt": "2026-07-07T20:18:49.907Z"
+    },
+    "0.2.4": {
+      "sha256": "sha256:a50c3160c40534756c66648664cd0253bd4faf57d7e6884cc6dfca6a88247aa7",
+      "builtAt": "2026-07-08T20:07:00.397Z"
+    },
+    "0.3.0": {
+      "sha256": "sha256:957dc0ab466b6b4aee9657f675bef381e6fcb03d295c1e912c4a2be2a3a3a61f",
+      "builtAt": "2026-07-14T18:22:55.650Z"
+    },
+    "0.3.1": {
+      "sha256": "sha256:bc8cf728ea700d529f3c2fa09834ccc206d6a2110a148c2153c0f2165f5eb587",
+      "builtAt": "2026-07-16T05:03:11.046Z"
+    },
+    "0.3.2": {
+      "sha256": "sha256:d4f0a1f48bd06e7582b9f3992c27202725cd984509ff4e2a6f7f6956198044e1",
+      "builtAt": "2026-07-17T00:32:00.735Z"
+    },
+    "0.4.0": {
+      "sha256": "sha256:216f2890e5e10d249a31a53489b4bd0eed9a0341d39ef7a557a8303a678ba578",
+      "builtAt": "2026-07-18T16:42:06.830Z"
+    },
+    "0.4.1": {
+      "sha256": "sha256:bad88d2e12a6c42f0c04fa00ced1d1b41533822830e291bb57a1eebef3f13fd7",
+      "builtAt": "2026-07-27T04:03:51.768Z"
+    },
+    "0.4.2": {
+      "sha256": "sha256:459c4eab5378b99ebc5b79a891f7fc9e1d6c65b466270fbd9fa772de37f57d8b",
+      "builtAt": "2026-07-27T21:28:51.965Z"
+    },
+    "0.5.0": {
+      "sha256": "sha256:9690f2386c40f8375087ea1f7f46ec2d9ed4a03207030bd4cbe9037a60096d80",
+      "builtAt": "2026-08-05T21:56:14.881Z"
+    },
+    "0.5.1": {
+      "sha256": "sha256:b241f458399a8098482d0dcfdb383bd1cfd87804ea5cb0a39063e18aa4202e3f",
+      "builtAt": "2026-08-06T02:20:17.052Z"
+    }
+  },
+  "managed": {
+    "0.2.0": {
+      "sha256": "sha256:d6ac46d7268435028c3327b345b420ae234901fe43480cdcbba17c3688fab43c",
+      "builtAt": "2026-07-03T06:44:31.735Z"
+    },
+    "0.2.1": {
+      "sha256": "sha256:a6acaa654bce50657fb22ea6b5b1033c885d25d28a46645dcfd351ed1c36c6ff",
+      "builtAt": "2026-07-05T08:53:51.445Z"
+    },
+    "0.2.2": {
+      "sha256": "sha256:3ffa3c58f12f3b1fc4198a9ff10898b7d4fcd5129dc49ea3d33020409e8d4e10",
+      "builtAt": "2026-07-06T01:44:31.213Z"
+    },
+    "0.2.3": {
+      "sha256": "sha256:5e2a67f3043e3961da2ecbdb7e1a19a26a3de25fade8e371566a94ebc9eb37e0",
+      "builtAt": "2026-07-07T20:18:50.165Z"
+    },
+    "0.2.4": {
+      "sha256": "sha256:0f68a6329d6244101a6f356c08a0121fd51a62fd1c58b7f116755b32324028a6",
+      "builtAt": "2026-07-08T20:07:00.840Z"
+    },
+    "0.3.0": {
+      "sha256": "sha256:3700113f07fb44ed1d4070cc1bc98b00d1e23f55b841a41adf8476523b52df44",
+      "builtAt": "2026-07-14T18:22:56.559Z"
+    },
+    "0.3.1": {
+      "sha256": "sha256:c78e4f625e084b5e788103840a0d99d864475aa8e09898460d0cff74ecec2201",
+      "builtAt": "2026-07-16T05:03:11.708Z"
+    },
+    "0.3.2": {
+      "sha256": "sha256:168cba60b72a674595e738771a4b2a4cb612e97275f07afdfc1d40f0b7cb68e2",
+      "builtAt": "2026-07-17T00:32:01.105Z"
+    },
+    "0.4.0": {
+      "sha256": "sha256:0727f0648f451cc174b72899874e7976bd9952d7151f00117c6996094fa6d62d",
+      "builtAt": "2026-07-18T16:42:07.148Z"
+    },
+    "0.4.1": {
+      "sha256": "sha256:89a6f689999db404a42019e1f7e7bc0e70931545d5ec41018beafe15491306ef",
+      "builtAt": "2026-07-27T04:03:52.515Z"
+    },
+    "0.4.2": {
+      "sha256": "sha256:7b0753264744a44ca8856a5a5e4a4d675016f8209fcc2322ad842be2db3e1f6b",
+      "builtAt": "2026-07-27T21:28:52.190Z"
+    },
+    "0.5.0": {
+      "sha256": "sha256:2c7fcf9b7014ad4c2a2845b4e1d68c71fd7eddc5db53ca53b8eeaebdf094381c",
+      "builtAt": "2026-08-05T21:56:15.645Z"
+    },
+    "0.5.1": {
+      "sha256": "sha256:148fba2b2d827e782c060f6b459cbd3437aa97a6d0cdb1850beb73c2aec939ac",
+      "builtAt": "2026-08-06T02:20:17.272Z"
+    }
+  },
+  "pipeline": {
+    "0.2.0": {
+      "sha256": "sha256:78a94fd966bd9e49f5549b4bfb0477a4547355bb65bfff4882ab7920a0c228dc",
+      "builtAt": "2026-07-03T06:44:32.481Z"
+    },
+    "0.2.1": {
+      "sha256": "sha256:ddc47e70afc81c79f50672fd91a9b3d5f6087bf3ed4a2ae7661318983c2e584c",
+      "builtAt": "2026-07-05T08:53:51.764Z"
+    },
+    "0.2.2": {
+      "sha256": "sha256:fefb46fc21ea494154aeece445a92ba95536aea4a4852fdc863e8cbae21f9589",
+      "builtAt": "2026-07-06T01:44:31.918Z"
+    },
+    "0.2.3": {
+      "sha256": "sha256:30251cb349d7c538972dc4576a021f73e0eceb130ab81770362df4d55be02c72",
+      "builtAt": "2026-07-07T20:18:50.431Z"
+    },
+    "0.2.4": {
+      "sha256": "sha256:261b9e2b3dff244116a7689e185125bf3edae23b49f15cfd558e55e706967fdc",
+      "builtAt": "2026-07-08T20:07:01.205Z"
+    },
+    "0.3.0": {
+      "sha256": "sha256:f77e514314f48ade0e86cf7a376cfae1885087b09db1bb52ead0dd010be8cfb0",
+      "builtAt": "2026-07-14T18:22:57.216Z"
+    },
+    "0.3.1": {
+      "sha256": "sha256:b043c866bff7c7484d5b16272482315b9533f56ed740f1245c178c013a3661c0",
+      "builtAt": "2026-07-16T05:03:12.417Z"
+    },
+    "0.3.2": {
+      "sha256": "sha256:33c06933cb534b1720231d2d1dd0478490be404c5ef6ce9a2a04033b727f5224",
+      "builtAt": "2026-07-17T00:32:01.488Z"
+    },
+    "0.4.0": {
+      "sha256": "sha256:252f1d6a4398c9e242753b262b5251345afdecac70edaefdbf0596cbb2afdfb1",
+      "builtAt": "2026-07-18T16:42:07.468Z"
+    },
+    "0.4.1": {
+      "sha256": "sha256:7579be73ed62acf1fb3e0e34d1f1e4645a584d81c1c832f00452087be83862fc",
+      "builtAt": "2026-07-27T04:03:53.221Z"
+    },
+    "0.4.2": {
+      "sha256": "sha256:02a87272da885ed71813ac0217cf9e7e9407f1749658712a4f2649dc9abf7362",
+      "builtAt": "2026-07-27T21:28:52.445Z"
+    },
+    "0.5.0": {
+      "sha256": "sha256:094304916dbbcc71e7263988b6838f564270c67b398346a9df9d36b74eb872bd",
+      "builtAt": "2026-08-05T21:56:16.311Z"
+    },
+    "0.5.1": {
+      "sha256": "sha256:a2140946ad704fa2d2dc780e956bb61ce756b59dedde39e537ca617636f29ef0",
+      "builtAt": "2026-08-06T02:20:17.519Z"
+    }
+  },
+  "research": {
+    "0.2.0": {
+      "sha256": "sha256:a104f567eb676633b09d490af30579d60b1eb80e74c3ac86e6931f25f8012968",
+      "builtAt": "2026-07-03T06:44:33.178Z"
+    },
+    "0.2.1": {
+      "sha256": "sha256:bf37b93e260ada2892b5886fd7986b32cc431aa5b034dba8245d5a6c0d70d770",
+      "builtAt": "2026-07-05T08:53:52.071Z"
+    },
+    "0.2.2": {
+      "sha256": "sha256:aec31336824dbb43287503b8655f288218c69df6ceb4113f42328228565a3513",
+      "builtAt": "2026-07-06T01:44:32.612Z"
+    },
+    "0.2.3": {
+      "sha256": "sha256:f8e629041a3c8ec4530712591d4d15f51301e1cce9c7d13617df4c8f4e82fe78",
+      "builtAt": "2026-07-07T20:18:50.688Z"
+    },
+    "0.2.4": {
+      "sha256": "sha256:e8ac59c0428520d95de14d57f48331ceb136308a7aa74377798ebefa625ccfec",
+      "builtAt": "2026-07-08T20:07:01.622Z"
+    },
+    "0.3.0": {
+      "sha256": "sha256:1a1161eb192e6e14e61f85f45c4257cde6689779434e891e11b408dd9536654b",
+      "builtAt": "2026-07-14T18:22:58.004Z"
+    },
+    "0.3.1": {
+      "sha256": "sha256:e7d80ecd10aa2b43544754668b9921618c8983c6c85cbc1832c590711f82ac23",
+      "builtAt": "2026-07-16T05:03:13.184Z"
+    },
+    "0.3.2": {
+      "sha256": "sha256:3f4a5f6f57aeebbc0dd3b08fe7396bcee153ae520a61587c5a4dff359bdaa553",
+      "builtAt": "2026-07-17T00:32:01.882Z"
+    },
+    "0.4.0": {
+      "sha256": "sha256:fa9eadfb3e024e110c959e56e0bf6454dfc4ef46b1dfc4e43f7365935289cfd0",
+      "builtAt": "2026-07-18T16:42:07.865Z"
+    },
+    "0.4.1": {
+      "sha256": "sha256:eef65cae7553982141b99d76b4b1f751e488274b0b07371f07ac50e161588fef",
+      "builtAt": "2026-07-27T04:03:53.935Z"
+    },
+    "0.4.2": {
+      "sha256": "sha256:54f1d0714143455ef67f1f218be26da8b3ed7adff1065f45f58b600bc4a9d6ac",
+      "builtAt": "2026-07-27T21:28:52.691Z"
+    },
+    "0.5.0": {
+      "sha256": "sha256:43700f5b194800dd952d2d0068f2898ddd6b95757c87e3e1bfd839b4a2297290",
+      "builtAt": "2026-08-05T21:56:16.948Z"
+    },
+    "0.5.1": {
+      "sha256": "sha256:fabbd43b7e51e725adc758bb1c17da0f04500d208be54f252240444fb71cf528",
+      "builtAt": "2026-08-06T02:20:17.734Z"
+    }
+  },
+  "voice": {
+    "0.2.0": {
+      "sha256": "sha256:ac1da178f6c97ba26531da552de2305ff1f620b95803a463dd98b09a2e3d1c0b",
+      "builtAt": "2026-07-03T06:44:33.893Z"
+    },
+    "0.2.1": {
+      "sha256": "sha256:92de309973c808727a72116fccb1bb4484fe2fe78432ed9020697b9a5b3531de",
+      "builtAt": "2026-07-05T08:53:52.403Z"
+    },
+    "0.2.2": {
+      "sha256": "sha256:187a434ff2e9f7c4393c9aa19c86ddce6ef027a82961a03023978bcc2ff908fa",
+      "builtAt": "2026-07-06T01:44:33.306Z"
+    },
+    "0.2.3": {
+      "sha256": "sha256:9b69f2b9bfcdaa89dcde73d37f189c01a62eaf40c5a29be428230a6ba89042f0",
+      "builtAt": "2026-07-07T20:18:50.907Z"
+    },
+    "0.2.4": {
+      "sha256": "sha256:0d8ca4cfa955ec92d3a36267b6fc1aa3bf1d9726fb0451b625e82387b38d67e0",
+      "builtAt": "2026-07-08T20:07:02.072Z"
+    },
+    "0.3.0": {
+      "sha256": "sha256:1962b786a831e0bb16befbe0530a68fe0e9d1bb525a16ebcf78ce896e00751d5",
+      "builtAt": "2026-07-14T18:22:59.033Z"
+    },
+    "0.3.1": {
+      "sha256": "sha256:fb0443bccfc54986192a991d6e42cfc3bf5045ab769f6919a178aae91210c2d0",
+      "builtAt": "2026-07-16T05:03:13.931Z"
+    },
+    "0.3.2": {
+      "sha256": "sha256:93629a24e5aed89958d5e3a438b72808b90dca2de58938e84393336e34581a47",
+      "builtAt": "2026-07-17T00:32:02.321Z"
+    },
+    "0.4.0": {
+      "sha256": "sha256:8a0ce9db10a30ad2ae3898eab8098eac840f027a9c59f82ef3310d2ffce29368",
+      "builtAt": "2026-07-18T16:42:08.189Z"
+    },
+    "0.4.1": {
+      "sha256": "sha256:9ee3ce7c7680a95bfe56032d537b8ea3de3693aaba9f7cd1ab655321d14e3402",
+      "builtAt": "2026-07-27T04:03:54.645Z"
+    },
+    "0.4.2": {
+      "sha256": "sha256:2107cc4b960a88e60756b5a7a29ba88c22aba99ede460002f20113d17d8be83b",
+      "builtAt": "2026-07-27T21:28:52.914Z"
+    },
+    "0.5.0": {
+      "sha256": "sha256:27e28326cf727c57594c530eee806df0ef848eddd9e27c7465bd739d337c01c0",
+      "builtAt": "2026-08-05T21:56:17.661Z"
+    },
+    "0.5.1": {
+      "sha256": "sha256:3575d1a7ed1f1293545b1fbe77734e41eb1dac200d15feed0c3eafcc0a3c86c7",
+      "builtAt": "2026-08-06T02:20:17.933Z"
+    }
+  },
+  "workflow": {
+    "0.2.0": {
+      "sha256": "sha256:850568bc4aa59ded05f30dcb71e0a62a8e0116d1c9dd897d85cd5bc93cbf8e42",
+      "builtAt": "2026-07-03T06:44:34.581Z"
+    },
+    "0.2.1": {
+      "sha256": "sha256:77ef9b30a2e772b3298cb91ad97e3bfed9c150f3666f1847cceb89c12b70d722",
+      "builtAt": "2026-07-05T08:53:52.770Z"
+    },
+    "0.2.2": {
+      "sha256": "sha256:c8704f399af2b4e5732b27ac32a1650063e448914f0bf31d3e6f9dacd082c801",
+      "builtAt": "2026-07-06T01:44:34.047Z"
+    },
+    "0.2.3": {
+      "sha256": "sha256:f934f3cc311b615963bd8bf19ca894cb708a3d440cf201b9469290b04816b5e0",
+      "builtAt": "2026-07-07T20:18:51.136Z"
+    },
+    "0.2.4": {
+      "sha256": "sha256:710356166c9365b6dc3be49ccbb64a72fc846058559b09ed91be22954b3cda9e",
+      "builtAt": "2026-07-08T20:07:02.467Z"
+    },
+    "0.3.0": {
+      "sha256": "sha256:dd24d95339c4fd393594ab6d991015513586c7d58ffc37ef9b4dff02c6ca16c3",
+      "builtAt": "2026-07-14T18:22:59.812Z"
+    },
+    "0.3.1": {
+      "sha256": "sha256:2ab7034d26c4029209c56d99fd9a10d9f7fa299e09799a720439c906d8f7fbcd",
+      "builtAt": "2026-07-16T05:03:14.796Z"
+    },
+    "0.3.2": {
+      "sha256": "sha256:a7c4a9d3368f513969748c8384c0531e541dc1fd24f294c14bc8b24c4a8560b0",
+      "builtAt": "2026-07-17T00:32:02.711Z"
+    },
+    "0.4.0": {
+      "sha256": "sha256:8dd14a3020e0f766be2b77f93886c5d550cc857e2f4eb6fec0e386fc3e6180f8",
+      "builtAt": "2026-07-18T16:42:08.526Z"
+    },
+    "0.4.1": {
+      "sha256": "sha256:414d4bdcd33ebfc920dd8d3b8730bab23b694bf1fabb61d6d3b444ec4ec588c1",
+      "builtAt": "2026-07-27T04:03:55.350Z"
+    },
+    "0.4.2": {
+      "sha256": "sha256:8f9a5174e3b9f6abfb9bce626845dc297dc293458c2428f5bb58e3c64ca9efed",
+      "builtAt": "2026-07-27T21:28:53.124Z"
+    },
+    "0.5.0": {
+      "sha256": "sha256:56badbd1ac660314c875ba3e942826cacc103c059b1475a4dbd8384329427a0c",
+      "builtAt": "2026-08-05T21:56:18.397Z"
+    },
+    "0.5.1": {
+      "sha256": "sha256:55732a9a0614cbb7dec286851700cf8c7dc0211815d971dbff9d05bf5d839a72",
+      "builtAt": "2026-08-06T02:20:18.156Z"
+    }
+  }
+}

package/docker/eval/Dockerfile

@@ -0,0 +1,27 @@
+# Section 32 — docker-images: eval target shape (deployable eval bundle).
+FROM oven/bun:1.2-alpine AS deps
+WORKDIR /app
+COPY bun.lock package.json ./
+COPY packages packages
+COPY apps apps
+RUN bun install --frozen-lockfile
+
+FROM deps AS build
+WORKDIR /app
+COPY tsconfig.base.json tsconfig.json ./
+RUN bun run typecheck
+RUN bun build apps/cli/src/index.ts --target=bun --outfile=/app/dist/crewhaus.js
+
+FROM oven/bun:1.2-alpine AS runtime
+RUN addgroup -S crewhaus && adduser -S crewhaus -G crewhaus -u 10001 && \
+    mkdir -p /app/.crewhaus/evals && chown -R crewhaus:crewhaus /app/.crewhaus
+WORKDIR /app
+COPY --from=build --chown=crewhaus:crewhaus /app/dist/crewhaus.js /app/crewhaus.js
+COPY --from=deps --chown=crewhaus:crewhaus /app/node_modules /app/node_modules
+USER crewhaus
+ENV NODE_ENV=production CREWHAUS_TARGET=eval
+EXPOSE 0
+HEALTHCHECK --interval=30s --timeout=5s --start-period=2s --retries=3 \
+  CMD bun /app/crewhaus.js doctor --liveness || exit 1
+ENTRYPOINT ["bun", "/app/crewhaus.js"]
+CMD ["eval", "/spec/crewhaus.yaml"]

package/docker/graph/Dockerfile

@@ -0,0 +1,27 @@
+# Section 32 — docker-images: graph target shape (durable graph runtime).
+FROM oven/bun:1.2-alpine AS deps
+WORKDIR /app
+COPY bun.lock package.json ./
+COPY packages packages
+COPY apps apps
+RUN bun install --frozen-lockfile
+
+FROM deps AS build
+WORKDIR /app
+COPY tsconfig.base.json tsconfig.json ./
+RUN bun run typecheck
+RUN bun build apps/cli/src/index.ts --target=bun --outfile=/app/dist/crewhaus.js
+
+FROM oven/bun:1.2-alpine AS runtime
+RUN addgroup -S crewhaus && adduser -S crewhaus -G crewhaus -u 10001 && \
+    mkdir -p /app/.crewhaus/graphs && chown -R crewhaus:crewhaus /app/.crewhaus
+WORKDIR /app
+COPY --from=build --chown=crewhaus:crewhaus /app/dist/crewhaus.js /app/crewhaus.js
+COPY --from=deps --chown=crewhaus:crewhaus /app/node_modules /app/node_modules
+USER crewhaus
+ENV NODE_ENV=production CREWHAUS_TARGET=graph
+EXPOSE 0
+HEALTHCHECK --interval=30s --timeout=5s --start-period=2s --retries=3 \
+  CMD bun /app/crewhaus.js doctor --liveness || exit 1
+ENTRYPOINT ["bun", "/app/crewhaus.js"]
+CMD ["run", "/spec/crewhaus.yaml"]

package/docker/managed/Dockerfile

@@ -0,0 +1,29 @@
+# Section 32 — docker-images: managed target shape (multi-tenant gateway daemon).
+# Section 20 daemon listens on $PORT (default 8080) for tenant API traffic.
+FROM oven/bun:1.2-alpine AS deps
+WORKDIR /app
+COPY bun.lock package.json ./
+COPY packages packages
+COPY apps apps
+RUN bun install --frozen-lockfile
+
+FROM deps AS build
+WORKDIR /app
+COPY tsconfig.base.json tsconfig.json ./
+RUN bun run typecheck
+RUN bun build apps/cli/src/index.ts --target=bun --outfile=/app/dist/crewhaus.js
+
+FROM oven/bun:1.2-alpine AS runtime
+RUN apk add --no-cache curl ca-certificates && \
+    addgroup -S crewhaus && adduser -S crewhaus -G crewhaus -u 10001 && \
+    mkdir -p /app/.crewhaus/audit && chown -R crewhaus:crewhaus /app/.crewhaus
+WORKDIR /app
+COPY --from=build --chown=crewhaus:crewhaus /app/dist/crewhaus.js /app/crewhaus.js
+COPY --from=deps --chown=crewhaus:crewhaus /app/node_modules /app/node_modules
+USER crewhaus
+ENV NODE_ENV=production CREWHAUS_TARGET=managed PORT=8080
+EXPOSE 8080
+HEALTHCHECK --interval=15s --timeout=3s --start-period=5s --retries=3 \
+  CMD curl -fsS http://localhost:${PORT:-8080}/healthz || exit 1
+ENTRYPOINT ["bun", "/app/crewhaus.js"]
+CMD ["run", "/spec/crewhaus.yaml"]

package/docker/pipeline/Dockerfile

@@ -0,0 +1,27 @@
+# Section 32 — docker-images: pipeline target shape (RAG ingest pipeline).
+FROM oven/bun:1.2-alpine AS deps
+WORKDIR /app
+COPY bun.lock package.json ./
+COPY packages packages
+COPY apps apps
+RUN bun install --frozen-lockfile
+
+FROM deps AS build
+WORKDIR /app
+COPY tsconfig.base.json tsconfig.json ./
+RUN bun run typecheck
+RUN bun build apps/cli/src/index.ts --target=bun --outfile=/app/dist/crewhaus.js
+
+FROM oven/bun:1.2-alpine AS runtime
+RUN addgroup -S crewhaus && adduser -S crewhaus -G crewhaus -u 10001 && \
+    mkdir -p /app/.crewhaus/vector && chown -R crewhaus:crewhaus /app/.crewhaus
+WORKDIR /app
+COPY --from=build --chown=crewhaus:crewhaus /app/dist/crewhaus.js /app/crewhaus.js
+COPY --from=deps --chown=crewhaus:crewhaus /app/node_modules /app/node_modules
+USER crewhaus
+ENV NODE_ENV=production CREWHAUS_TARGET=pipeline
+EXPOSE 0
+HEALTHCHECK --interval=30s --timeout=5s --start-period=2s --retries=3 \
+  CMD bun /app/crewhaus.js doctor --liveness || exit 1
+ENTRYPOINT ["bun", "/app/crewhaus.js"]
+CMD ["run", "/spec/crewhaus.yaml"]

package/docker/research/Dockerfile

@@ -0,0 +1,27 @@
+# Section 32 — docker-images: research target shape (autonomous research agent).
+FROM oven/bun:1.2-alpine AS deps
+WORKDIR /app
+COPY bun.lock package.json ./
+COPY packages packages
+COPY apps apps
+RUN bun install --frozen-lockfile
+
+FROM deps AS build
+WORKDIR /app
+COPY tsconfig.base.json tsconfig.json ./
+RUN bun run typecheck
+RUN bun build apps/cli/src/index.ts --target=bun --outfile=/app/dist/crewhaus.js
+
+FROM oven/bun:1.2-alpine AS runtime
+RUN addgroup -S crewhaus && adduser -S crewhaus -G crewhaus -u 10001 && \
+    mkdir -p /app/.crewhaus/research && chown -R crewhaus:crewhaus /app/.crewhaus
+WORKDIR /app
+COPY --from=build --chown=crewhaus:crewhaus /app/dist/crewhaus.js /app/crewhaus.js
+COPY --from=deps --chown=crewhaus:crewhaus /app/node_modules /app/node_modules
+USER crewhaus
+ENV NODE_ENV=production CREWHAUS_TARGET=research
+EXPOSE 0
+HEALTHCHECK --interval=30s --timeout=5s --start-period=2s --retries=3 \
+  CMD bun /app/crewhaus.js doctor --liveness || exit 1
+ENTRYPOINT ["bun", "/app/crewhaus.js"]
+CMD ["run", "/spec/crewhaus.yaml"]

package/docker/voice/Dockerfile

@@ -0,0 +1,29 @@
+# Section 32 — docker-images: voice target shape (realtime telephony agent).
+# Adds opus (PCM ↔ Opus codec for telephony codecs) on top of the base.
+FROM oven/bun:1.2-alpine AS deps
+WORKDIR /app
+COPY bun.lock package.json ./
+COPY packages packages
+COPY apps apps
+RUN bun install --frozen-lockfile
+
+FROM deps AS build
+WORKDIR /app
+COPY tsconfig.base.json tsconfig.json ./
+RUN bun run typecheck
+RUN bun build apps/cli/src/index.ts --target=bun --outfile=/app/dist/crewhaus.js
+
+FROM oven/bun:1.2-alpine AS runtime
+RUN apk add --no-cache curl ca-certificates opus opus-tools && \
+    addgroup -S crewhaus && adduser -S crewhaus -G crewhaus -u 10001 && \
+    mkdir -p /app/.crewhaus && chown crewhaus:crewhaus /app/.crewhaus
+WORKDIR /app
+COPY --from=build --chown=crewhaus:crewhaus /app/dist/crewhaus.js /app/crewhaus.js
+COPY --from=deps --chown=crewhaus:crewhaus /app/node_modules /app/node_modules
+USER crewhaus
+ENV NODE_ENV=production CREWHAUS_TARGET=voice PORT=8080
+EXPOSE 8080
+HEALTHCHECK --interval=15s --timeout=5s --start-period=10s --retries=3 \
+  CMD curl -fsS http://localhost:${PORT:-8080}/healthz || exit 1
+ENTRYPOINT ["bun", "/app/crewhaus.js"]
+CMD ["run", "/spec/crewhaus.yaml"]

package/docker/workflow/Dockerfile

@@ -0,0 +1,26 @@
+# Section 32 — docker-images: workflow target shape (sequential multi-step agent).
+FROM oven/bun:1.2-alpine AS deps
+WORKDIR /app
+COPY bun.lock package.json ./
+COPY packages packages
+COPY apps apps
+RUN bun install --frozen-lockfile
+
+FROM deps AS build
+WORKDIR /app
+COPY tsconfig.base.json tsconfig.json ./
+RUN bun run typecheck
+RUN bun build apps/cli/src/index.ts --target=bun --outfile=/app/dist/crewhaus.js
+
+FROM oven/bun:1.2-alpine AS runtime
+RUN addgroup -S crewhaus && adduser -S crewhaus -G crewhaus -u 10001
+WORKDIR /app
+COPY --from=build --chown=crewhaus:crewhaus /app/dist/crewhaus.js /app/crewhaus.js
+COPY --from=deps --chown=crewhaus:crewhaus /app/node_modules /app/node_modules
+USER crewhaus
+ENV NODE_ENV=production CREWHAUS_TARGET=workflow
+EXPOSE 0
+HEALTHCHECK --interval=30s --timeout=5s --start-period=2s --retries=3 \
+  CMD bun /app/crewhaus.js doctor --liveness || exit 1
+ENTRYPOINT ["bun", "/app/crewhaus.js"]
+CMD ["run", "/spec/crewhaus.yaml"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crewhaus/docker-images",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "type": "module",
   "description": "Per-target-shape Docker images (multi-stage, non-root, healthchecked) + crewhaus build-image CLI wrapper (Section 32)",
   "main": "dist/index.js",
@@ -15,7 +15,7 @@
     "test": "bun test src"
   },
   "dependencies": {
-    "@crewhaus/errors": "0.5.0"
+    "@crewhaus/errors": "0.5.2"
   },
   "license": "Apache-2.0",
   "author": {
@@ -35,5 +35,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "files": ["dist", "README.md", "LICENSE", "NOTICE"]
+  "files": ["LICENSE", "NOTICE", "README.md", "docker", "dist"]
 }