@gfdelarue/testkit 0.4.5 → 0.5.0

package/dist/config/loader/validation.js

@@ -1 +1 @@
-import{finalizeConfiguredInputs as l,finalizeConfiguredSteps as v,validateConfiguredCollection as f}from"../../steps/configured-steps.js";import{findDatabasePlaceholders as m}from"../../steps/environment.js";import{resolveEngineProfile as u}from"../../engines/catalog.js";import{ensureExistingContainedPath as h,ensureExistingPath as S}from"./paths.js";const w=["migrate","seed","verify"];export function validateConfigCoverage(e){const i=new Set(e.map(r=>r.name));for(const r of e){for(const t of r.testkit.dependsOn)if(!i.has(t))throw new Error(`Service "${r.name}" depends on "${t}", but ${t} is not defined`);const n=r.testkit.databaseFrom;if(n&&!i.has(n))throw new Error(`Service "${r.name}" databaseFrom "${n}" is not defined`)}}export function validateServiceConfig({name:e,local:i,database:r,databaseFrom:n,runtime:t,dependsOn:c,suites:p,productDir:s}){for(const[a,$]of Object.entries(p))for(const o of $||[]){if(o.testType!==a)throw new Error(`Service "${e}" suite ${a}:${o.name} declares conflicting test type ${o.testType}`);const d=u(o.testType,o.engineId);if(d.id!==o.profileId)throw new Error(`Service "${e}" suite ${o.testType}:${o.name} declares conflicting engine profile ${o.profileId}; expected ${d.id}`)}if(r&&n)throw new Error(`Service "${e}" cannot define both database and databaseFrom`);if(t.instances<1)throw new Error(`Service "${e}" runtime.instances must be a positive integer`);if(t.maxConcurrentTasks<=0)throw new Error(`Service "${e}" runtime.maxConcurrentTasks must be a positive integer when provided`);for(const a of c)if(a===e)throw new Error(`Service "${e}" cannot depend on itself`);if(g({name:e,local:i,database:r,runtime:t}),i?.cwd&&S(s,i.cwd,`Service "${e}" local.cwd`),t.toolchain?.cwd&&h(s,t.toolchain.cwd,`Service "${e}" runtime.toolchain.cwd`),r)for(const a of w)f({productDir:s,label:`Service "${e}" database.template.${a}`,steps:r.template[a]});f({productDir:s,label:`Service "${e}" database.template`,inputs:r?.template.inputs||[]}),f({productDir:s,label:`Service "${e}" runtime.prepare`,inputs:t.prepare.inputs,steps:t.prepare.steps})}function g({name:e,local:i,database:r,runtime:n}){const t=c=>p=>{const s=m(p).at(0);if(s)throw new Error(`Service "${e}" ${c} uses ${s.placeholder}. Database placeholders resolve only in env values; commands read DATABASE_URL or a service env entry at run time.`);return p};if(i&&(t("local.start")(i.start),t("local.cwd")(i.cwd)),l(n.prepare.inputs,t("runtime.prepare.inputs")),v(n.prepare.steps,t("runtime.prepare.steps")),r){l(r.template.inputs,t("database.template.inputs"));for(const c of w)v(r.template[c],t(`database.template.${c}`))}}
+import{finalizeConfiguredInputs as c,finalizeConfiguredSteps as f,validateConfiguredCollection as p}from"../../steps/configured-steps.js";import{findDatabasePlaceholders as l}from"../../steps/environment.js";import{ensureExistingContainedPath as v,ensureExistingPath as m}from"./paths.js";const d=["migrate","seed","verify"];export function validateConfigCoverage(t){const n=new Set(t.map(r=>r.name));for(const r of t){for(const e of r.testkit.dependsOn)if(!n.has(e))throw new Error(`Service "${r.name}" depends on "${e}", but ${e} is not defined`);const o=r.testkit.databaseFrom;if(o&&!n.has(o))throw new Error(`Service "${r.name}" databaseFrom "${o}" is not defined`)}}export function validateServiceConfig({name:t,local:n,database:r,databaseFrom:o,runtime:e,dependsOn:s,productDir:i}){if(r&&o)throw new Error(`Service "${t}" cannot define both database and databaseFrom`);if(e.instances<1)throw new Error(`Service "${t}" runtime.instances must be a positive integer`);if(e.maxConcurrentTasks<=0)throw new Error(`Service "${t}" runtime.maxConcurrentTasks must be a positive integer when provided`);for(const a of s)if(a===t)throw new Error(`Service "${t}" cannot depend on itself`);if(w({name:t,local:n,database:r,runtime:e}),n?.cwd&&m(i,n.cwd,`Service "${t}" local.cwd`),e.toolchain?.cwd&&v(i,e.toolchain.cwd,`Service "${t}" runtime.toolchain.cwd`),r)for(const a of d)p({productDir:i,label:`Service "${t}" database.template.${a}`,steps:r.template[a]});p({productDir:i,label:`Service "${t}" database.template`,inputs:r?.template.inputs||[]}),p({productDir:i,label:`Service "${t}" runtime.prepare`,inputs:e.prepare.inputs,steps:e.prepare.steps})}function w({name:t,local:n,database:r,runtime:o}){const e=s=>i=>{const a=l(i).at(0);if(a)throw new Error(`Service "${t}" ${s} uses ${a.placeholder}. Database placeholders resolve only in env values; commands read DATABASE_URL or a service env entry at run time.`);return i};if(n&&(e("local.start")(n.start),e("local.cwd")(n.cwd)),c(o.prepare.inputs,e("runtime.prepare.inputs")),f(o.prepare.steps,e("runtime.prepare.steps")),r){c(r.template.inputs,e("database.template.inputs"));for(const s of d)f(r.template[s],e(`database.template.${s}`))}}

package/dist/database/admin.js

@@ -1,2 +1,2 @@
-import{randomUUID as T}from"node:crypto";import{managedHostProcessInfrastructureError as g,runManagedHostProcess as E}from"../process/index.js";import{LOCAL_ADMIN_DB as u,LOCAL_ADMIN_QUERY_RETRY_INTERVAL_MS as S,LOCAL_ADMIN_QUERY_RETRY_MS as O,LOCAL_DROP_DATABASE_POLL_INTERVAL_MS as R,LOCAL_DROP_DATABASE_TIMEOUT_MS as y}from"./constants.js";import{buildDatabaseUrl as b,escapeIdentifier as c,escapeSqlLiteral as l}from"./naming.js";import{runDockerPsql as f}from"./postgres/index.js";import{readDynamicProperty as C}from"../kernel/unknown-values.js";export{b as buildDatabaseUrl};export const ADMIN_QUERY_COMMAND_TIMEOUT_MS=15e3;export async function databaseExists(t,e,o={}){return(await runAdminQuery(t,["-tAc",`SELECT 1 FROM pg_database WHERE datname = '${l(e)}'`],o)).trim()==="1"}export async function createEmptyDatabase(t,e,o={}){await runAdminQuery(t,["-c",`CREATE DATABASE "${c(e)}"`],o)}export async function cloneDatabaseFromTemplate(t,e,o,n={}){await runAdminQuery(t,["-c",`CREATE DATABASE "${c(e)}" TEMPLATE "${c(o)}"`],n)}export async function dropDatabaseIfExists(t,e,o={}){await dropDatabaseWithForceOrDrain(t,e,o)}export async function dropDatabaseWithForceOrDrain(t,e,o={}){const n={signal:o.signal};try{await runAdminQuery(t,["-c",`DROP DATABASE IF EXISTS "${c(e)}" WITH (FORCE)`],n);return}catch(r){if(!x(r))throw r}if(!await databaseExists(t,e,n))return;let s=!1;try{await runAdminQuery(t,["-c",`ALTER DATABASE "${c(e)}" WITH ALLOW_CONNECTIONS false`],n),s=!0,await waitForDatabaseConnectionsToDrain(t,e,{signal:o.signal}),await runAdminQuery(t,["-c",`DROP DATABASE IF EXISTS "${c(e)}"`],n),s=!1}finally{s&&await databaseExists(t,e)&&await runAdminQuery(t,["-c",`ALTER DATABASE "${c(e)}" WITH ALLOW_CONNECTIONS true`]).catch(()=>{})}}export async function waitForDatabaseConnectionsToDrain(t,e,o={}){const n=o.timeoutMs??y,s=Date.now()+n,r={signal:o.signal};for(;;){D(o.signal),await L(t,e,r);const i=await M(t,e,r);if(i===0)return;if(Date.now()>=s)throw new Error(`Timed out waiting for database "${e}" connections to close (${String(i)} remaining)`);await A(R,o.signal)}}export async function runAdminQuery(t,e,o={}){const n=buildAdminQueryCommandArgs(t,e),s=Date.now();for(;;){D(o.signal);try{let r;if(_(t)){const a=`testkit-admin-${T()}`,d=await E({args:["exec","-e",`PGAPPNAME=${a}`,...n.slice(1)],cwd:process.cwd(),displayLabel:`Docker Postgres admin query for ${t.containerName}`,env:process.env,executable:"docker",signal:o.signal,timeoutMs:ADMIN_QUERY_COMMAND_TIMEOUT_MS});d.cancelled&&await E({args:buildAdminQueryCommandArgs(t,["-tAc",`SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE application_name = '${a}'`]),cwd:process.cwd(),displayLabel:`Docker Postgres admin query cancellation for ${t.containerName}`,env:process.env,executable:"docker",timeoutMs:ADMIN_QUERY_COMMAND_TIMEOUT_MS});const m=g(`Docker Postgres admin query for ${t.containerName}`,d);if(m)throw m;r={exitCode:d.exitCode,stderr:d.stderr,stdout:d.stdout}}else{const a={...process.env,PGPASSWORD:t.password,...t.sslMode?{PGSSLMODE:t.sslMode}:{}};r=await f({args:n,env:a,timeoutMs:ADMIN_QUERY_COMMAND_TIMEOUT_MS,connection:{host:t.host,port:t.port,user:t.user,password:t.password,database:t.adminDatabase||u,sslMode:t.sslMode},signal:o.signal})}if(r.exitCode!=null&&r.exitCode!==0){const a=new Error(r.shortMessage||r.stderr||r.stdout||`psql failed with exit code ${String(r.exitCode)}`);throw Reflect.set(a,"stdout",r.stdout||""),Reflect.set(a,"stderr",r.stderr||""),a}const{stdout:i}=r;return i}catch(r){if(Date.now()-s>=O||!isTransientAdminQueryConnectionError(r))throw r;await A(S,o.signal)}}}export function buildAdminQueryCommandArgs(t,e){return _(t)?["exec","-e",`PGPASSWORD=${t.password}`,t.containerId,"psql","-v","ON_ERROR_STOP=1","-U",t.user,"-d",t.adminDatabase||u,"-p",String(t.containerPort||5432),...e]:["-v","ON_ERROR_STOP=1","-h",t.host,"-p",String(t.port),"-U",t.user,"-d",t.adminDatabase||u,...e]}export function isTransientAdminQueryConnectionError(t){const e=w(t);return e.includes('connection to server on socket "/var/run/postgresql/.s.PGSQL.5432" failed')||e.includes("No such file or directory")||e.includes("the database system is starting up")||e.includes("could not connect to server")||e.includes("connection refused")||e.includes("Connection timed out")||e.includes("connection timed out")||e.includes("Operation timed out")||e.includes("i/o timeout")||e.includes("server closed the connection unexpectedly")||e.includes("terminating connection due to administrator command")}async function L(t,e,o){await runAdminQuery(t,["-c",["SELECT pg_terminate_backend(pid)","FROM pg_stat_activity",`WHERE datname = '${l(e)}' AND pid <> pg_backend_pid();`].join(" ")],o)}async function M(t,e,o){const n=await runAdminQuery(t,["-tAc",["SELECT COUNT(*)","FROM pg_stat_activity",`WHERE datname = '${l(e)}' AND pid <> pg_backend_pid();`].join(" ")],o);return Number.parseInt(n.trim(),10)||0}function x(t){const e=w(t);return e.includes('syntax error at or near "WITH"')||e.includes('option "force"')}function A(t,e){return new Promise((o,n)=>{if(e?.aborted){n(p(e));return}const s=setTimeout(r,t);e?.addEventListener("abort",i,{once:!0});function r(){e?.removeEventListener("abort",i),o()}function i(){clearTimeout(s),n(e?p(e):new Error("Database administration aborted"))}})}function D(t){if(t?.aborted)throw p(t)}function p(t){return t.reason instanceof Error?t.reason:new Error("Database administration aborted",{cause:t.reason})}function w(t){return["shortMessage","stderr","stdout","message"].map(e=>P(C(t,e)||"")).join(`
-`)}function P(t){if(typeof t=="symbol")throw new TypeError("Cannot convert a Symbol value to a string");return String(t)}function _(t){return!!t.containerName}
+import{randomUUID as y}from"node:crypto";import{managedHostProcessInfrastructureError as R,runManagedHostProcess as C,startManagedHostProcess as M}from"../process/index.js";import{LOCAL_ADMIN_DB as p,LOCAL_ADMIN_QUERY_RETRY_INTERVAL_MS as L,LOCAL_ADMIN_QUERY_RETRY_MS as x,LOCAL_DROP_DATABASE_POLL_INTERVAL_MS as P,LOCAL_DROP_DATABASE_TIMEOUT_MS as h}from"./constants.js";import{buildDatabaseUrl as I,escapeIdentifier as c,escapeSqlLiteral as E}from"./naming.js";import{runDockerPsql as $}from"./postgres/index.js";import{readDynamicProperty as v}from"../kernel/unknown-values.js";export{I as buildDatabaseUrl};export const ADMIN_QUERY_COMMAND_TIMEOUT_MS=15e3;export async function databaseExists(t,e,o={}){return(await runAdminQuery(t,["-tAc",`SELECT 1 FROM pg_database WHERE datname = '${E(e)}'`],o)).trim()==="1"}export async function createEmptyDatabase(t,e,o={}){await runAdminQuery(t,["-c",`CREATE DATABASE "${c(e)}"`],o)}export async function cloneDatabaseFromTemplate(t,e,o,r={}){await runAdminQuery(t,["-c",`CREATE DATABASE "${c(e)}" TEMPLATE "${c(o)}"`],r)}export async function dropDatabaseWithForceOrDrain(t,e,o={}){const r={signal:o.signal};try{await runAdminQuery(t,["-c",`DROP DATABASE IF EXISTS "${c(e)}" WITH (FORCE)`],r);return}catch(n){if(!W(n))throw n}if(!await databaseExists(t,e,r))return;let s=!1;try{await runAdminQuery(t,["-c",`ALTER DATABASE "${c(e)}" WITH ALLOW_CONNECTIONS false`],r),s=!0,await waitForDatabaseConnectionsToDrain(t,e,{signal:o.signal}),await runAdminQuery(t,["-c",`DROP DATABASE IF EXISTS "${c(e)}"`],r),s=!1}finally{s&&await databaseExists(t,e)&&await runAdminQuery(t,["-c",`ALTER DATABASE "${c(e)}" WITH ALLOW_CONNECTIONS true`]).catch(()=>{})}}export async function waitForDatabaseConnectionsToDrain(t,e,o={}){const r=o.timeoutMs??h,s=Date.now()+r,n={signal:o.signal};for(;;){O(o.signal),await N(t,e,n);const i=await k(t,e,n);if(i===0)return;if(Date.now()>=s)throw new Error(`Timed out waiting for database "${e}" connections to close (${String(i)} remaining)`);await A(P,o.signal)}}export async function runAdminQuery(t,e,o={}){const r=buildAdminQueryCommandArgs(t,e),s=Date.now();for(;;){O(o.signal);try{let n;if(b(t)){const a=`testkit-admin-${y()}`,D=(l,m)=>C({args:buildAdminQueryCommandArgs(t,["-tAc",`SELECT ${l} FROM pg_stat_activity WHERE application_name = '${a}'`]),cwd:process.cwd(),displayLabel:`Docker Postgres admin session for ${t.containerName}`,env:process.env,executable:"docker",signal:m,timeoutMs:ADMIN_QUERY_COMMAND_TIMEOUT_MS}),_=M({args:["exec","-e",`PGAPPNAME=${a}`,...r.slice(1)],cwd:process.cwd(),displayLabel:`Docker Postgres admin query for ${t.containerName}`,env:process.env,executable:"docker",outputMode:"bounded-capture",recoveryIdentity:"none",signal:o.signal,timeoutMs:null}),d=new AbortController,f=(async()=>{for(let l=0;l<2;){await A(ADMIN_QUERY_COMMAND_TIMEOUT_MS,d.signal);const m=await D("count(*)",d.signal);if(d.signal.aborted)return;if(m.timedOut||m.exitCode!==0)break;l=m.stdout.trim()==="0"?l+1:0}d.abort("stalled"),await _.stop()})().catch(()=>{}),u=await _.completion.finally(()=>{d.abort()});await f;const g=d.signal.reason==="stalled";(u.cancelled||g)&&await D("pg_terminate_backend(pid)");const T=R(`Docker Postgres admin query for ${t.containerName}`,g?{...u,timedOut:!0}:u);if(T)throw T;n={exitCode:u.exitCode,stderr:u.stderr,stdout:u.stdout}}else{const a={...process.env,PGPASSWORD:t.password,...t.sslMode?{PGSSLMODE:t.sslMode}:{}};n=await $({args:r,env:a,timeoutMs:ADMIN_QUERY_COMMAND_TIMEOUT_MS,connection:{host:t.host,port:t.port,user:t.user,password:t.password,database:t.adminDatabase||p,sslMode:t.sslMode},signal:o.signal})}if(n.exitCode!=null&&n.exitCode!==0){const a=new Error(n.shortMessage||n.stderr||n.stdout||`psql failed with exit code ${String(n.exitCode)}`);throw Reflect.set(a,"stdout",n.stdout||""),Reflect.set(a,"stderr",n.stderr||""),a}const{stdout:i}=n;return i}catch(n){if(Date.now()-s>=x||!isTransientAdminQueryConnectionError(n))throw n;await A(L,o.signal)}}}export function buildAdminQueryCommandArgs(t,e){return b(t)?["exec","-e",`PGPASSWORD=${t.password}`,t.containerId,"psql","-v","ON_ERROR_STOP=1","-U",t.user,"-d",t.adminDatabase||p,"-p",String(t.containerPort||5432),...e]:["-v","ON_ERROR_STOP=1","-h",t.host,"-p",String(t.port),"-U",t.user,"-d",t.adminDatabase||p,...e]}export function isTransientAdminQueryConnectionError(t){const e=S(t);return e.includes('connection to server on socket "/var/run/postgresql/.s.PGSQL.5432" failed')||e.includes("No such file or directory")||e.includes("the database system is starting up")||e.includes("could not connect to server")||e.includes("connection refused")||e.includes("Connection timed out")||e.includes("connection timed out")||e.includes("Operation timed out")||e.includes("i/o timeout")||e.includes("server closed the connection unexpectedly")||e.includes("terminating connection due to administrator command")}async function N(t,e,o){await runAdminQuery(t,["-c",["SELECT pg_terminate_backend(pid)","FROM pg_stat_activity",`WHERE datname = '${E(e)}' AND pid <> pg_backend_pid();`].join(" ")],o)}async function k(t,e,o){const r=await runAdminQuery(t,["-tAc",["SELECT COUNT(*)","FROM pg_stat_activity",`WHERE datname = '${E(e)}' AND pid <> pg_backend_pid();`].join(" ")],o);return Number.parseInt(r.trim(),10)||0}function W(t){const e=S(t);return e.includes('syntax error at or near "WITH"')||e.includes('option "force"')}function A(t,e){return new Promise((o,r)=>{if(e?.aborted){r(w(e));return}const s=setTimeout(n,t);e?.addEventListener("abort",i,{once:!0});function n(){e?.removeEventListener("abort",i),o()}function i(){clearTimeout(s),r(e?w(e):new Error("Database administration aborted"))}})}function O(t){if(t?.aborted)throw w(t)}function w(t){return t.reason instanceof Error?t.reason:new Error("Database administration aborted",{cause:t.reason})}function S(t){return["shortMessage","stderr","stdout","message"].map(e=>U(v(t,e)||"")).join(`
+`)}function U(t){if(typeof t=="symbol")throw new TypeError("Cannot convert a Symbol value to a string");return String(t)}function b(t){return!!t.containerName}

package/dist/database/bindings.js

@@ -0,0 +1 @@
+export function bindDatabaseUrl(n){const e=new URL(n),s=e.searchParams.get("sslmode")||"disable";return{url:n,host:e.hostname,port:Number(e.port||"5432"),database:e.pathname.replace(/^\//,""),user:decodeURIComponent(e.username),password:decodeURIComponent(e.password),sslMode:s,ssl:s!=="disable"}}export function lendDatabases(n,e){const s=new Map(e);for(const t of n){const a=t.testkit.databaseFrom,o=a?e.get(a):void 0;o&&s.set(t.name,o)}return s}

package/dist/database/cleanup.js

@@ -1 +1 @@
-import{hasActiveRunManifest as A,hasActiveRunManifestWithTerminalAuthority as v}from"../process/runs/ownership.js";import{observeProcessCreationIdentity as l}from"../process/index.js";import{TESTKIT_PRODUCT_ID_LABEL as y,TESTKIT_RESOURCE_KIND_LABEL as g,TESTKIT_SCOPE_LABEL as k,buildProductIdentity as T,listManagedDockerContainers as L,listManagedDockerVolumes as P,removeDockerContainer as C,removeDockerVolume as w,stopDockerContainer as E}from"./docker.js";import{requireProductLifecycleFenceProductDir as i}from"../process/lifecycle-fence.js";import{hasRemainingLocalArtifacts as D,readOwnedStateValues as R}from"./state.js";export async function cleanupLocalPostgresDockerResources(e={}){return f({...e,force:!1})}export async function destroyLocalPostgresDockerResources(e,r={}){const t=i(e);return f({...r,assertMutationAuthority:()=>{if(i(e)!==t)throw new Error("Database destroy lifecycle authority changed products")},force:!0,productDir:t})}export async function cleanupTerminalRunLocalPostgresDockerResources(e,r,t={}){const s=i(e),a=()=>{assertTerminalRunDatabaseCleanupAuthority(e,r)};return a(),f({...t,assertMutationAuthority:a,force:!1,productDir:s,terminalRunAuthority:r})}export function assertTerminalRunDatabaseCleanupAuthority(e,r){const t=i(e);if(v(t,l,r))throw new Error(`Cannot clean terminal Testkit run ${r.runId} database resources while another product run is active or its terminal ownership is invalid`)}async function f(e){e.assertMutationAuthority?.();const r=T(e.productDir||process.cwd()),t=await L(r),s=await P(r),a=[],u=[],d=[],c=[],h=[];for(const o of t){if(!I(o))continue;const n=M(o,r,e);n.action==="remove"?a.push({...o,action:"remove",reason:n.reason}):n.action==="stop"?a.push({...o,action:"stop",reason:n.reason}):n.reason&&u.push({...o,reason:n.reason})}for(const o of s){if(!S(o))continue;const n=_(o,r,e);n.action==="remove"?a.push({...o,action:"remove",reason:n.reason,resourceType:"volume"}):n.reason&&u.push({...o,reason:n.reason,resourceType:"volume"})}if(!e.dryRun)for(const o of a)e.assertMutationAuthority?.(),o.action==="stop"?await E(o.id,o.name)?h.push(o):c.push(p(o)):o.resourceType==="volume"?await w(o.name,o)?d.push(o):c.push(p(o)):await C(o.id,o.name)?d.push(o):c.push(p(o));return{removed:e.dryRun?[]:d,stopped:e.dryRun?[]:h,skipped:e.dryRun?[]:c,targets:a,kept:u}}function p(e){return e.resourceType==="volume"?{...e,action:"skip",intendedAction:"remove",reason:"resource-changed-or-disappeared-before-mutation",selectionReason:e.reason}:{...e,action:"skip",intendedAction:e.action==="stop"?"stop":"remove",reason:"resource-changed-or-disappeared-before-mutation",selectionReason:e.reason}}function M(e,r,t){return e.labels[y]!==r.id?{action:"keep",reason:"different-product"}:t.force?{action:"remove",reason:"destroy-current-product"}:m(r.dir,t)?{action:"keep",reason:"current-product-active"}:D(r.dir)?R(r.dir,["container_name","local_container_name"]).has(e.name)?b(e,r.dir,t)?{action:"stop",reason:"current-product-idle"}:{action:"keep",reason:"current-product-referenced"}:{action:"remove",reason:"current-product-unreferenced"}:{action:"remove",reason:"current-product-no-local-artifacts"}}function _(e,r,t){return e.labels[y]!==r.id?{action:"keep",reason:"different-product"}:t.force?{action:"remove",reason:"destroy-current-product"}:m(r.dir,t)?{action:"keep",reason:"current-product-active"}:D(r.dir)?R(r.dir,["volume_name"]).has(e.name)?{action:"keep",reason:"current-product-referenced"}:{action:"remove",reason:"current-product-unreferenced"}:{action:"remove",reason:"current-product-no-local-artifacts"}}function b(e,r,t){return!!(t.stopIdle&&e.running&&!m(r,t))}function I(e){const{labels:r}=e;return r[g]==="postgres-container"&&r[k]==="local-postgres"}function S(e){const{labels:r}=e;return r[g]==="postgres-volume"&&r[k]==="local-postgres"}export function hasActiveProductRuntime(e){return A(e,l)}function m(e,r){return r.terminalRunAuthority===void 0?hasActiveProductRuntime(e):v(e,l,r.terminalRunAuthority)}
+import{hasActiveRunManifest as A,hasActiveRunManifestWithTerminalAuthority as v}from"../process/runs/ownership.js";import{observeProcessCreationIdentity as l}from"../process/index.js";import{TESTKIT_PRODUCT_ID_LABEL as y,TESTKIT_RESOURCE_KIND_LABEL as g,TESTKIT_SCOPE_LABEL as k,buildProductIdentity as T,listManagedDockerContainers as L,listManagedDockerVolumes as P,removeDockerContainer as C,removeDockerVolume as w,stopDockerContainer as E}from"./docker.js";import{requireProductLifecycleFenceProductDir as i}from"../process/lifecycle-fence.js";import{hasRemainingLocalArtifacts as D,readOwnedStateValues as R}from"./state.js";export async function cleanupLocalPostgresDockerResources(e={}){return f({...e,force:!1})}export async function destroyLocalPostgresDockerResources(e,r={}){const t=i(e);return f({...r,assertMutationAuthority:()=>{if(i(e)!==t)throw new Error("Database destroy lifecycle authority changed products")},force:!0,productDir:t})}export async function cleanupTerminalRunLocalPostgresDockerResources(e,r,t={}){const s=i(e),a=()=>{assertTerminalRunDatabaseCleanupAuthority(e,r)};return a(),f({...t,assertMutationAuthority:a,force:!1,productDir:s,terminalRunAuthority:r})}export function assertTerminalRunDatabaseCleanupAuthority(e,r){const t=i(e);if(v(t,l,r))throw new Error(`Cannot clean terminal Testkit run ${r.runId} database resources while another product run is active or its terminal ownership is invalid`)}async function f(e){e.assertMutationAuthority?.();const r=T(e.productDir||process.cwd()),t=await L(r),s=await P(r),a=[],u=[],d=[],c=[],h=[];for(const o of t){if(!b(o))continue;const n=M(o,r,e);n.action==="remove"?a.push({...o,action:"remove",reason:n.reason}):n.action==="stop"?a.push({...o,action:"stop",reason:n.reason}):n.reason&&u.push({...o,reason:n.reason})}for(const o of s){if(!I(o))continue;const n=_(o,r,e);n.action==="remove"?a.push({...o,action:"remove",reason:n.reason,resourceType:"volume"}):n.reason&&u.push({...o,reason:n.reason,resourceType:"volume"})}if(!e.dryRun)for(const o of a)e.assertMutationAuthority?.(),o.action==="stop"?await E(o.id,o.name)?h.push(o):c.push(p(o)):o.resourceType==="volume"?await w(o.name,o)?d.push(o):c.push(p(o)):await C(o.id,o.name)?d.push(o):c.push(p(o));return{removed:e.dryRun?[]:d,stopped:e.dryRun?[]:h,skipped:e.dryRun?[]:c,targets:a,kept:u}}function p(e){return e.resourceType==="volume"?{...e,action:"skip",intendedAction:"remove",reason:"resource-changed-or-disappeared-before-mutation",selectionReason:e.reason}:{...e,action:"skip",intendedAction:e.action==="stop"?"stop":"remove",reason:"resource-changed-or-disappeared-before-mutation",selectionReason:e.reason}}function M(e,r,t){return e.labels[y]!==r.id?{action:"keep",reason:"different-product"}:t.force?{action:"remove",reason:"destroy-current-product"}:m(r.dir,t)?{action:"keep",reason:"current-product-active"}:D(r.dir)?R(r.dir,["container_name","local_container_name"]).has(e.name)?t.stopIdle&&e.running&&!m(r.dir,t)?{action:"stop",reason:"current-product-idle"}:{action:"keep",reason:"current-product-referenced"}:{action:"remove",reason:"current-product-unreferenced"}:{action:"remove",reason:"current-product-no-local-artifacts"}}function _(e,r,t){return e.labels[y]!==r.id?{action:"keep",reason:"different-product"}:t.force?{action:"remove",reason:"destroy-current-product"}:m(r.dir,t)?{action:"keep",reason:"current-product-active"}:D(r.dir)?R(r.dir,["volume_name"]).has(e.name)?{action:"keep",reason:"current-product-referenced"}:{action:"remove",reason:"current-product-unreferenced"}:{action:"remove",reason:"current-product-no-local-artifacts"}}function b(e){const{labels:r}=e;return r[g]==="postgres-container"&&r[k]==="local-postgres"}function I(e){const{labels:r}=e;return r[g]==="postgres-volume"&&r[k]==="local-postgres"}export function hasActiveProductRuntime(e){return A(e,l)}function m(e,r){return r.terminalRunAuthority===void 0?hasActiveProductRuntime(e):v(e,l,r.terminalRunAuthority)}

package/dist/database/docker-metadata.js

@@ -1,3 +1,3 @@
-import V from"node:crypto";import O from"node:fs";import A from"node:http";import k from"node:path";import{MAX_SUPERVISED_PROCESS_CAPTURE_BYTES as H}from"../process/process-limits.js";import{managedHostProcessInfrastructureError as I,normalizeManagedHostEnvironment as $,resolveManagedHostExecutable as j,runManagedHostProcess as L}from"../process/index.js";const N=5e3,B=256*1024,U=8*1024*1024,_=H/2,K=["DOCKER_HOST","DOCKER_TLS","DOCKER_TLS_VERIFY","DOCKER_CERT_PATH","DOCKER_API_VERSION","DOCKER_CUSTOM_HEADERS"];let b;export async function runDockerMetadataCommand(e,t,n,r,u){const o=performance.now()+n,h=()=>Math.floor(o-performance.now()),S=()=>{const s=R("");throw I(t,{...s,exitCode:null,cancelled:r?.aborted===!0,timedOut:r?.aborted!==!0})??new Error(`${t} exceeded its managed deadline`)};if(r?.aborted)return u(Math.max(1,h()));const m=new AbortController,y=()=>{m.abort(r?.reason)};r?.addEventListener("abort",y,{once:!0});const i=setTimeout(()=>{m.abort(new Error("Docker metadata probe timed out"))},Math.min(N,n));let l;try{const s=await v(m.signal);if(s!==null){let c=b?.key===s.key?b.value:void 0;c===void 0&&(c=await J(s,h,m.signal),m.signal.aborted||(b={key:s.key,value:c})),c!==null&&(l=await Y(c,e,m.signal),l!==void 0&&(await v(m.signal))?.key!==s.key&&(l=void 0,b=void 0))}}catch(s){if(d(d(s)?.result)?.terminationError)throw s;l=void 0}finally{clearTimeout(i),r?.removeEventListener("abort",y)}const a=h();return(r?.aborted||a<=0)&&S(),l!==void 0&&!m.signal.aborted?R(l):u(a)}async function v(e){e.throwIfAborted();const t=process.cwd(),n=$(process.env),r=j("docker",t,n),u=f=>q(n,f);if(K.some(f=>u(f)!==""))return null;const o=u(process.platform==="win32"?"USERPROFILE":"HOME"),h=u("DOCKER_CONFIG");if(!h&&(!o||!k.isAbsolute(o)))return null;const S=k.resolve(t,h||k.join(o,".docker")),m=await D(k.join(S,"config.json"),e),y=m?.toString("utf8"),i=y===void 0?{}:d(JSON.parse(y));if(i===null||y!==void 0&&W(y))return null;for(const f of Object.keys(i))if(f.toLowerCase()==="httpheaders"&&(d(i[f])===null||Object.keys(i[f]).length>0)||f.toLowerCase()==="currentcontext"&&f!=="currentContext")return null;if(i.currentContext!==void 0&&typeof i.currentContext!="string")return null;const l=u("DOCKER_CONTEXT")||i.currentContext||"default";let a=null,s=null,c=null,g=null;if(l!=="default"){const f=V.createHash("sha256").update(l).digest("hex");if(a=k.join(S,"contexts","meta",f),s=await D(k.join(a,"meta.json"),e),s===null)return null;const E=d(JSON.parse(s.toString("utf8"))),C=d(d(E?.Endpoints)?.docker);if(E?.Name!==l||typeof C?.Host!="string"||C.SkipTLSVerify!==!1)return null;c=C.Host;try{if(g=await O.promises.readdir(k.join(S,"contexts","tls",f)),g.length!==0)return null}catch(M){if(!P(M,"ENOENT"))return null}}const w=await O.promises.realpath(r),p=await O.promises.stat(w,{bigint:!0});return e.throwIfAborted(),{executable:r,cwd:t,env:n,context:l,metadataPath:a,endpoint:c,key:JSON.stringify([t,Object.entries(n).sort(([f],[E])=>f<E?-1:f>E?1:0),r,w,p.dev.toString(),p.ino.toString(),p.size.toString(),p.mtimeNs.toString(),p.ctimeNs.toString(),S,m?.toString("base64")??null,s?.toString("base64")??null,g])}}async function J(e,t,n){const r=async l=>{n.throwIfAborted();const a=Math.min(N,t());if(a<=0)return null;const s=await L({executable:e.executable,args:l,cwd:e.cwd,env:e.env,displayLabel:"Docker metadata transport resolution",timeoutMs:a,signal:n}),c=I("Docker metadata transport resolution",s);if(s.terminationError&&c!==null)throw c;return s.exitCode!==0||c!==null?null:JSON.parse(s.stdout)},u=await r(["context","inspect"]),o=Array.isArray(u)&&u.length===1?d(u[0]):null,h=d(d(o?.Endpoints)?.docker),S=d(o?.TLSMaterial),m=d(o?.Storage);if(o?.Name!==e.context||typeof h?.Host!="string"||h.SkipTLSVerify!==!1||S===null||Object.keys(S).length!==0||e.metadataPath!==null&&(m?.MetadataPath!==e.metadataPath||h.Host!==e.endpoint))return null;const y=F(h.Host);if(y===null)return null;const i=d(await r(["version","--format","{{json .Client}}"]));return typeof i?.Version!="string"||!/^29\.\d+\.\d+$/u.test(i.Version)||i.Context!==e.context||typeof i.Os!="string"||!x(i.DefaultAPIVersion)||!x(i.ApiVersion)?null:{key:e.key,socketPath:y,userAgent:`Docker-Client/${i.Version} (${i.Os})`,maximum:i.DefaultAPIVersion,negotiated:i.ApiVersion,server:null}}async function Y(e,t,n){const r=z(t);if(r===null)return;const u=new A.Agent({keepAlive:!0,maxSockets:1}),o=new Map;let h;const S=m=>new Promise((y,i)=>{const l=A.get({socketPath:e.socketPath,path:m,agent:u,signal:n,headers:{Host:"api.moby.localhost","User-Agent":e.userAgent}},a=>{const s=[];let c=0;a.on("data",g=>{c+=g.length,c>U?l.destroy(new Error("Docker metadata response exceeded its byte limit")):s.push(g)}),a.once("error",i),a.once("end",()=>{a.statusCode!==200||!a.complete?i(new Error("Docker metadata response was not a complete success")):y({headers:a.headers,body:Buffer.concat(s,c)})})});l.once("error",i),l.once("socket",a=>{o.has(a)||o.set(a,new Promise(s=>a.once("close",()=>{s()}))),h!==void 0&&a!==h&&l.destroy(new Error("Docker metadata connection changed during negotiation")),h=a})});try{const m=await S("/_ping"),y=d(JSON.parse((await S("/version")).body.toString("utf8"))),i=y?.ApiVersion,l=y?.MinAPIVersion;if(!x(i)||!x(l)||m.headers["api-version"]!==i)return;const a=T(e.maximum,i)<=0?e.maximum:i;if(a!==e.negotiated||T(a,l)<0){b=void 0;return}const s=JSON.stringify(y);if(e.server!==null&&e.server!==s){b=void 0;return}e.server=s;const c=await S(`/v${a}${r.path}`),g=JSON.parse(c.body.toString("utf8"));let w;if(r.kind==="container"||r.kind==="volume"){const p=d(g)?.[r.kind==="container"?"Id":"Name"];if(typeof p!="string"||p.length===0)return;const f=JSON.stringify([g],null,4).replace(/[<>&\u2028\u2029]/gu,E=>`\\u${E.charCodeAt(0).toString(16).padStart(4,"0")}`);if(c.body.length+Buffer.byteLength(f)+16>_)return;w=`[${c.body.toString("utf8")}]`}else if(r.kind==="containers"){if(!Array.isArray(g)||g.some(p=>typeof d(p)?.Id!="string"||!/^[a-f0-9]{64}$/u.test(d(p)?.Id)))return;w=g.map(p=>(d(p)?.Id).slice(0,12)).join(`
-`)}else{const p=d(g)?.Volumes;if(p===null)w="";else{if(!Array.isArray(p)||p.length>1)return;const f=p.map(E=>d(E)?.Name);if(f.some(E=>typeof E!="string"||E.length===0))return;w=f.join(`
-`)}}return Buffer.byteLength(w)+1<=_?w:void 0}finally{u.destroy();for(const m of o.keys())m.destroy();await Promise.all(o.values())}}function z(e){if(e.length===2&&e[0]==="inspect"&&e[1]&&!e[1].startsWith("-"))return{kind:"container",path:`/containers/${encodeURIComponent(e[1])}/json`};if(e.length===3&&e[0]==="volume"&&e[1]==="inspect"&&e[2]&&!e[2].startsWith("-"))return{kind:"volume",path:`/volumes/${encodeURIComponent(e[2])}`};let t,n;if(e[0]==="ps"&&e[1]==="-a"&&e[2]==="--format"&&e[3]==="{{.ID}}")t="containers",n=e.slice(4);else if(e[0]==="volume"&&e[1]==="ls"&&e[2]==="-q")t="volumes",n=e.slice(3);else return null;const r=[];for(let o=0;o<n.length;o+=2){if(n[o]!=="--filter"||!n[o+1]?.startsWith("label="))return null;r.push(n[o+1].slice(6))}const u=encodeURIComponent(JSON.stringify({label:r}));return{kind:t,path:t==="containers"?`/containers/json?all=true&filters=${u}`:`/volumes?filters=${u}`}}async function D(e,t){const n=O.createReadStream(e,{signal:t,highWaterMark:65536}),r=[];let u=0;try{for await(const o of n){if(u+=o.length,u>B)throw new Error("Docker metadata configuration exceeded its byte limit");r.push(o)}return Buffer.concat(r,u)}catch(o){if(P(o,"ENOENT"))return null;throw o}finally{n.destroy(),n.closed||await new Promise(o=>n.once("close",o))}}function F(e){if(process.platform==="win32"){const n=/^npipe:\/\/\/\/\.\/pipe\/([a-z0-9_.-]+)$/iu.exec(e);return n===null?null:`\\\\.\\pipe\\${n[1]}`}if(!e.startsWith("unix:///"))return null;const t=e.slice(7);return t.includes("\0")||t.includes("?")||t.includes("#")?null:t}function W(e){for(const t of e.matchAll(/"(?:\\.|[^"\\])*"/gu)){let n=t.index+t[0].length;for(;n<e.length&&/\s/u.test(e[n]);)n+=1;if(e[n]!==":")continue;const r=JSON.parse(t[0]);if(typeof r=="string"&&/^httpheaders$/iu.test(r))return!0}return!1}function q(e,t){return process.platform!=="win32"?e[t]||"":Object.entries(e).find(([n])=>n.toUpperCase()===t)?.[1]||""}function d(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)?e:null}function P(e,t){return d(e)?.code===t}function x(e){return typeof e=="string"&&/^1\.[1-9]\d*$/u.test(e)&&Number.isSafeInteger(Number(e.slice(2)))}function T(e,t){return Number(e.slice(2))-Number(t.slice(2))}function R(e){return{cancelled:!1,error:null,exitCode:0,exitSignal:null,outputLimitExceeded:!1,stderr:"",stdout:e,terminationError:null,timedOut:!1}}
+import H from"node:crypto";import O from"node:fs";import I from"node:http";import E from"node:path";import{MAX_SUPERVISED_PROCESS_CAPTURE_BYTES as L}from"../process/process-limits.js";import{managedHostProcessInfrastructureError as _,normalizeManagedHostEnvironment as B,resolveManagedHostExecutable as U,runManagedHostProcess as K}from"../process/index.js";const v=5e3,F=256*1024,J=8*1024*1024,N=L/2,Y=["DOCKER_HOST","DOCKER_TLS","DOCKER_TLS_VERIFY","DOCKER_CERT_PATH","DOCKER_API_VERSION","DOCKER_CUSTOM_HEADERS"];let b,D=!1;export async function runDockerMetadataCommand(e,r,t,o,f){const i=performance.now(),S=i+t,y=()=>Math.floor(S-performance.now()),k=async(d,s)=>{const u=performance.now();try{return await f(d)}catch(w){throw P(w,`the direct read ${s}, then the docker CLI ran ${A(u)}`)}},g=()=>{const d=V(""),s=_(r,{...d,exitCode:null,cancelled:o?.aborted===!0,timedOut:o?.aborted!==!0});throw P(s??new Error(`${r} exceeded its managed deadline`),`the direct read took ${A(i)}, and the docker CLI did not run`)};if(o?.aborted||D)return k(Math.max(1,y()),"was skipped after an earlier one timed out");const n=new AbortController,m=()=>{n.abort(o?.reason)};o?.addEventListener("abort",m,{once:!0});const a=setTimeout(()=>{n.signal.aborted||(D=!0,n.abort(new Error("Docker metadata probe timed out")))},Math.min(v,t));let c;try{const d=await R(n.signal);if(d!==null){let s=b?.key===d.key?b.value:void 0;s===void 0&&(s=await z(d,y,n.signal),n.signal.aborted||(b={key:d.key,value:s})),s!==null&&(c=await W(s,e,n.signal),c!==void 0&&(await R(n.signal))?.key!==d.key&&(c=void 0,b=void 0))}}catch(d){if(l(l(d)?.result)?.terminationError)throw d;c=void 0}finally{clearTimeout(a),o?.removeEventListener("abort",m)}const p=`took ${A(i)}`,h=y();return(o?.aborted||h<=0)&&g(),c!==void 0&&!n.signal.aborted?V(c):k(h,p)}function A(e){return`${((performance.now()-e)/1e3).toFixed(1)} s`}function P(e,r){const t=l(l(e)?.result);if(t?.timedOut!==!0||!(e instanceof Error))return e;const o=new Error(`${e.message}: ${r}`,{cause:e});return Object.defineProperty(o,"result",{enumerable:!1,value:t}),o}async function R(e){e.throwIfAborted();const r=process.cwd(),t=B(process.env),o=U("docker",r,t),f=u=>Q(t,u);if(Y.some(u=>f(u)!==""))return null;const i=f(process.platform==="win32"?"USERPROFILE":"HOME"),S=f("DOCKER_CONFIG");if(!S&&(!i||!E.isAbsolute(i)))return null;const y=E.resolve(r,S||E.join(i,".docker")),k=await T(E.join(y,"config.json"),e),g=k?.toString("utf8"),n=g===void 0?{}:l(JSON.parse(g));if(n===null||g!==void 0&&G(g))return null;for(const u of Object.keys(n))if(u.toLowerCase()==="httpheaders"&&(l(n[u])===null||Object.keys(n[u]).length>0)||u.toLowerCase()==="currentcontext"&&u!=="currentContext")return null;if(n.currentContext!==void 0&&typeof n.currentContext!="string")return null;const m=f("DOCKER_CONTEXT")||n.currentContext||"default";let a=null,c=null,p=null,h=null;if(m!=="default"){const u=H.createHash("sha256").update(m).digest("hex");if(a=E.join(y,"contexts","meta",u),c=await T(E.join(a,"meta.json"),e),c===null)return null;const w=l(JSON.parse(c.toString("utf8"))),C=l(l(w?.Endpoints)?.docker);if(w?.Name!==m||typeof C?.Host!="string"||C.SkipTLSVerify!==!1)return null;p=C.Host;try{if(h=await O.promises.readdir(E.join(y,"contexts","tls",u)),h.length!==0)return null}catch(j){if(!$(j,"ENOENT"))return null}}const d=await O.promises.realpath(o),s=await O.promises.stat(d,{bigint:!0});return e.throwIfAborted(),{executable:o,cwd:r,env:t,context:m,metadataPath:a,endpoint:p,key:JSON.stringify([r,Object.entries(t).sort(([u],[w])=>u<w?-1:u>w?1:0),o,d,s.dev.toString(),s.ino.toString(),s.size.toString(),s.mtimeNs.toString(),s.ctimeNs.toString(),y,k?.toString("base64")??null,c?.toString("base64")??null,h])}}async function z(e,r,t){const o=async m=>{t.throwIfAborted();const a=Math.min(v,r());if(a<=0)return null;const c=await K({executable:e.executable,args:m,cwd:e.cwd,env:e.env,displayLabel:"Docker metadata transport resolution",timeoutMs:a,signal:t}),p=_("Docker metadata transport resolution",c);if(c.terminationError&&p!==null)throw p;return c.exitCode!==0||p!==null?null:JSON.parse(c.stdout)},f=await o(["context","inspect"]),i=Array.isArray(f)&&f.length===1?l(f[0]):null,S=l(l(i?.Endpoints)?.docker),y=l(i?.TLSMaterial),k=l(i?.Storage);if(i?.Name!==e.context||typeof S?.Host!="string"||S.SkipTLSVerify!==!1||y===null||Object.keys(y).length!==0||e.metadataPath!==null&&(k?.MetadataPath!==e.metadataPath||S.Host!==e.endpoint))return null;const g=X(S.Host);if(g===null)return null;const n=l(await o(["version","--format","{{json .Client}}"]));return typeof n?.Version!="string"||!/^29\.\d+\.\d+$/u.test(n.Version)||n.Context!==e.context||typeof n.Os!="string"||!x(n.DefaultAPIVersion)||!x(n.ApiVersion)?null:{key:e.key,socketPath:g,userAgent:`Docker-Client/${n.Version} (${n.Os})`,maximum:n.DefaultAPIVersion,negotiated:n.ApiVersion,server:null}}async function W(e,r,t){const o=q(r);if(o===null)return;const f=new I.Agent({keepAlive:!0,maxSockets:1}),i=new Map;let S;const y=k=>new Promise((g,n)=>{const m=I.get({socketPath:e.socketPath,path:k,agent:f,signal:t,headers:{Host:"api.moby.localhost","User-Agent":e.userAgent}},a=>{const c=[];let p=0;a.on("data",h=>{p+=h.length,p>J?m.destroy(new Error("Docker metadata response exceeded its byte limit")):c.push(h)}),a.once("error",n),a.once("end",()=>{a.statusCode!==200||!a.complete?n(new Error("Docker metadata response was not a complete success")):g({headers:a.headers,body:Buffer.concat(c,p)})})});m.once("error",n),m.once("socket",a=>{i.has(a)||i.set(a,new Promise(c=>a.once("close",()=>{c()}))),S!==void 0&&a!==S&&m.destroy(new Error("Docker metadata connection changed during negotiation")),S=a})});try{const k=await y("/_ping"),g=l(JSON.parse((await y("/version")).body.toString("utf8"))),n=g?.ApiVersion,m=g?.MinAPIVersion;if(!x(n)||!x(m)||k.headers["api-version"]!==n)return;const a=M(e.maximum,n)<=0?e.maximum:n;if(a!==e.negotiated||M(a,m)<0){b=void 0;return}const c=JSON.stringify(g);if(e.server!==null&&e.server!==c){b=void 0;return}e.server=c;const p=await y(`/v${a}${o.path}`),h=JSON.parse(p.body.toString("utf8"));let d;if(o.kind==="container"||o.kind==="volume"){const s=l(h)?.[o.kind==="container"?"Id":"Name"];if(typeof s!="string"||s.length===0)return;const u=JSON.stringify([h],null,4).replace(/[<>&\u2028\u2029]/gu,w=>`\\u${w.charCodeAt(0).toString(16).padStart(4,"0")}`);if(p.body.length+Buffer.byteLength(u)+16>N)return;d=`[${p.body.toString("utf8")}]`}else if(o.kind==="containers"){if(!Array.isArray(h)||h.some(s=>typeof l(s)?.Id!="string"||!/^[a-f0-9]{64}$/u.test(l(s)?.Id)))return;d=h.map(s=>(l(s)?.Id).slice(0,12)).join(`
+`)}else{const s=l(h)?.Volumes;if(s===null)d="";else{if(!Array.isArray(s)||s.length>1)return;const u=s.map(w=>l(w)?.Name);if(u.some(w=>typeof w!="string"||w.length===0))return;d=u.join(`
+`)}}return Buffer.byteLength(d)+1<=N?d:void 0}finally{f.destroy();for(const k of i.keys())k.destroy();await Promise.all(i.values())}}function q(e){if(e.length===2&&e[0]==="inspect"&&e[1]&&!e[1].startsWith("-"))return{kind:"container",path:`/containers/${encodeURIComponent(e[1])}/json`};if(e.length===3&&e[0]==="volume"&&e[1]==="inspect"&&e[2]&&!e[2].startsWith("-"))return{kind:"volume",path:`/volumes/${encodeURIComponent(e[2])}`};let r,t;if(e[0]==="ps"&&e[1]==="-a"&&e[2]==="--format"&&e[3]==="{{.ID}}")r="containers",t=e.slice(4);else if(e[0]==="volume"&&e[1]==="ls"&&e[2]==="-q")r="volumes",t=e.slice(3);else return null;const o=[];for(let i=0;i<t.length;i+=2){if(t[i]!=="--filter"||!t[i+1]?.startsWith("label="))return null;o.push(t[i+1].slice(6))}const f=encodeURIComponent(JSON.stringify({label:o}));return{kind:r,path:r==="containers"?`/containers/json?all=true&filters=${f}`:`/volumes?filters=${f}`}}async function T(e,r){const t=O.createReadStream(e,{signal:r,highWaterMark:65536}),o=[];let f=0;try{for await(const i of t){if(f+=i.length,f>F)throw new Error("Docker metadata configuration exceeded its byte limit");o.push(i)}return Buffer.concat(o,f)}catch(i){if($(i,"ENOENT"))return null;throw i}finally{t.destroy(),t.closed||await new Promise(i=>t.once("close",i))}}function X(e){if(process.platform==="win32"){const t=/^npipe:\/\/\/\/\.\/pipe\/([a-z0-9_.-]+)$/iu.exec(e);return t===null?null:`\\\\.\\pipe\\${t[1]}`}if(!e.startsWith("unix:///"))return null;const r=e.slice(7);return r.includes("\0")||r.includes("?")||r.includes("#")?null:r}function G(e){for(const r of e.matchAll(/"(?:\\.|[^"\\])*"/gu)){let t=r.index+r[0].length;for(;t<e.length&&/\s/u.test(e[t]);)t+=1;if(e[t]!==":")continue;const o=JSON.parse(r[0]);if(typeof o=="string"&&/^httpheaders$/iu.test(o))return!0}return!1}function Q(e,r){return process.platform!=="win32"?e[r]||"":Object.entries(e).find(([t])=>t.toUpperCase()===r)?.[1]||""}function l(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)?e:null}function $(e,r){return l(e)?.code===r}function x(e){return typeof e=="string"&&/^1\.[1-9]\d*$/u.test(e)&&Number.isSafeInteger(Number(e.slice(2)))}function M(e,r){return Number(e.slice(2))-Number(r.slice(2))}function V(e){return{cancelled:!1,error:null,exitCode:0,exitSignal:null,outputLimitExceeded:!1,stderr:"",stdout:e,terminationError:null,timedOut:!1}}

package/dist/database/docker.js

@@ -1,5 +1,5 @@
-import{runDockerMetadataCommand as f}from"./docker-metadata.js";import C from"crypto";import T from"fs";import w from"path";import{managedHostProcessInfrastructureError as I,runManagedHostProcess as y}from"../process/index.js";export const TESTKIT_MANAGED_LABEL="com.elench.testkit.managed",TESTKIT_RESOURCE_KIND_LABEL="com.elench.testkit.resource.kind",TESTKIT_RESOURCE_NAME_LABEL="com.elench.testkit.resource.name",TESTKIT_PRODUCT_DIR_LABEL="com.elench.testkit.product.dir",TESTKIT_PRODUCT_ID_LABEL="com.elench.testkit.product.id",TESTKIT_SCOPE_LABEL="com.elench.testkit.scope",TESTKIT_CACHE_POLICY_LABEL="com.elench.testkit.cache.policy",TESTKIT_CREATED_AT_LABEL="com.elench.testkit.created-at",TESTKIT_RESOURCE_GENERATION_LABEL="com.elench.testkit.resource.generation";const _=4e3,m=String;export const DOCKER_OWNERSHIP_OPERATION_TIMEOUTS_MS=Object.freeze({inspect:3e4,list:3e4,remove:12e4,stop:3e4});export function buildProductIdentity(t){const e=S(t);return{dir:e,id:v(e,24)}}export function buildDockerResourceLabels(t,e){if(!e.generation)throw new Error("Docker resource generation must be non-empty");const n=buildProductIdentity(t);return{[TESTKIT_MANAGED_LABEL]:"true",[TESTKIT_RESOURCE_KIND_LABEL]:e.kind,[TESTKIT_RESOURCE_NAME_LABEL]:e.name,[TESTKIT_PRODUCT_DIR_LABEL]:n.dir,[TESTKIT_PRODUCT_ID_LABEL]:n.id,[TESTKIT_SCOPE_LABEL]:e.scope||e.kind,[TESTKIT_CACHE_POLICY_LABEL]:e.cachePolicy||"ephemeral",[TESTKIT_CREATED_AT_LABEL]:e.createdAt||new Date().toISOString(),[TESTKIT_RESOURCE_GENERATION_LABEL]:e.generation}}export function dockerLabelArgs(t){return Object.entries(t).flatMap(([e,n])=>["--label",`${e}=${m(n)}`])}export async function inspectDockerContainer(t,e={}){const n=`Docker container inspect for ${t}`,r=["inspect",t],o=await f(r,n,DOCKER_OWNERSHIP_OPERATION_TIMEOUTS_MS.inspect,e.signal,c=>runDockerCommand(r,n,c,e.signal));if(o.exitCode!==0){if(g(o))return null;throw a(n,o)}return h(o,n,"Id")}export async function listManagedDockerContainers(t){return x(["--filter",`label=${TESTKIT_MANAGED_LABEL}=true`,"--filter",`label=${TESTKIT_PRODUCT_ID_LABEL}=${t.id}`])}export async function inspectDockerVolume(t,e={}){const n=`Docker volume inspect for ${t}`,r=["volume","inspect",t],o=await f(r,n,DOCKER_OWNERSHIP_OPERATION_TIMEOUTS_MS.inspect,e.signal,c=>runDockerCommand(r,n,c,e.signal));if(o.exitCode!==0){if(D(o))return null;throw a(n,o)}return h(o,n,"Name")}export async function listManagedDockerVolumes(t){return L(["--filter",`label=${TESTKIT_MANAGED_LABEL}=true`,"--filter",`label=${TESTKIT_PRODUCT_ID_LABEL}=${t.id}`])}export async function removeDockerContainer(t,e=t){const n=`Docker container removal for ${e}`,r=await runDockerCommand(["rm","-f","-v",t],n,DOCKER_OWNERSHIP_OPERATION_TIMEOUTS_MS.remove);if(r.exitCode===0)return r.stdout.trim().length>0;if(g(r))return!1;throw a(n,r)}export async function removeDockerVolume(t,e,n={}){const r=normalizeDockerVolumeInspect(await inspectDockerVolume(t,n));if(r===null||!sameDockerVolumeGeneration(r,e))return!1;const o=`Docker volume removal for ${t}`,c=await runDockerCommand(["volume","rm","-f",t],o,DOCKER_OWNERSHIP_OPERATION_TIMEOUTS_MS.remove,n.signal);if(c.exitCode===0)return!0;if(D(c))return!1;throw a(o,c)}export function sameDockerVolumeGeneration(t,e){return t.name===e.name&&t.createdAt===e.createdAt&&t.driver===e.driver&&t.mountpoint===e.mountpoint&&A(t.labels,e.labels)}export async function stopDockerContainer(t,e=t){const n=`Docker container stop for ${e}`,r=await runDockerCommand(["stop","--time","5",t],n,DOCKER_OWNERSHIP_OPERATION_TIMEOUTS_MS.stop);if(r.exitCode===0)return!0;if(g(r))return!1;throw a(n,r)}async function x(t){const e="Docker container inventory",n=["ps","-a","--format","{{.ID}}",...t],r=await f(n,e,DOCKER_OWNERSHIP_OPERATION_TIMEOUTS_MS.list,void 0,s=>runDockerCommand(n,e,s,void 0));if(r.exitCode!==0)throw a(e,r);const{stdout:o}=r,c=o.split(/\r?\n/).map(s=>s.trim()).filter(Boolean);if(c.length===0)return[];const i=[];for(const s of c){const p=await inspectDockerContainer(s),d=normalizeDockerContainerInspect(p);d&&i.push(d)}return i}async function L(t){const e="Docker volume inventory",n=["volume","ls","-q",...t],r=await f(n,e,DOCKER_OWNERSHIP_OPERATION_TIMEOUTS_MS.list,void 0,s=>runDockerCommand(n,e,s,void 0));if(r.exitCode!==0)throw a(e,r);const{stdout:o}=r,c=o.split(/\r?\n/).map(s=>s.trim()).filter(Boolean);if(c.length===0)return[];const i=[];for(const s of c){const p=await inspectDockerVolume(s),d=normalizeDockerVolumeInspect(p);d&&i.push(d)}return i}export function normalizeDockerContainerInspect(t){const e=l(t);if(!e||typeof e.Id!="string"||!e.Id)return null;const n=l(e.Config),r=l(e.State),o=m(e.Name||"").replace(/^\//,"");return{id:e.Id,shortId:e.Id.slice(0,12),name:o,image:u(n?.Image)||"",createdAt:u(e.Created),running:!!r?.Running,status:u(r?.Status)||"unknown",labels:k(n?.Labels)}}export function normalizeDockerVolumeInspect(t){const e=l(t);return!e||typeof e.Name!="string"||!e.Name?null:{name:e.Name,driver:u(e.Driver)||"",mountpoint:u(e.Mountpoint)||"",labels:k(e.Labels),createdAt:u(e.CreatedAt)}}function h(t,e,n){let r;try{r=JSON.parse(t.stdout)}catch(i){throw b(e,n,t,i)}const o=Array.isArray(r)?r:null,c=o?l(o[0]):null;if(o?.length!==1||!c||typeof c[n]!="string"||c[n].length===0)throw b(e,n,t);return c}function k(t){const e={},n=l(t);if(!n)return e;for(const[r,o]of Object.entries(n))typeof o=="string"&&(e[r]=o);return e}function A(t,e){const n=Object.entries(t).sort(([o],[c])=>o.localeCompare(c)),r=Object.entries(e).sort(([o],[c])=>o.localeCompare(c));return n.length===r.length&&n.every(([o,c],i)=>r[i]?.[0]===o&&r[i]?.[1]===c)}function l(t){return E(t)?t:null}function E(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)}function u(t){return typeof t=="string"&&t?t:null}function O(t,e){return E(t)&&t.code===e}function S(t){const e=w.resolve(t||process.cwd());try{return T.realpathSync.native(e)}catch(n){if(O(n,"ENOENT"))return e;throw n}}function v(t,e=24){return C.createHash("sha256").update(m(t)).digest("hex").slice(0,e)}export async function runDockerCommand(t,e,n,r){const o=await y({args:t,cwd:process.cwd(),displayLabel:e,env:process.env,executable:"docker",signal:r,timeoutMs:n}),c=I(e,o);if(c)throw c;return o}function g(t){const e=`${t.stderr}
-${t.stdout}`.toLowerCase();return/\bno such (?:container|object)\b/u.test(e)}function D(t){const e=`${t.stderr}
+import{runDockerMetadataCommand as f}from"./docker-metadata.js";import{managedHostProcessInfrastructureError as h,runManagedHostProcess as C}from"../process/index.js";import{canonicalizeProductDir as I,hashString as T}from"./naming.js";export const TESTKIT_MANAGED_LABEL="com.elench.testkit.managed",TESTKIT_RESOURCE_KIND_LABEL="com.elench.testkit.resource.kind",TESTKIT_RESOURCE_NAME_LABEL="com.elench.testkit.resource.name",TESTKIT_PRODUCT_DIR_LABEL="com.elench.testkit.product.dir",TESTKIT_PRODUCT_ID_LABEL="com.elench.testkit.product.id",TESTKIT_SCOPE_LABEL="com.elench.testkit.scope",TESTKIT_CACHE_POLICY_LABEL="com.elench.testkit.cache.policy",TESTKIT_CREATED_AT_LABEL="com.elench.testkit.created-at",TESTKIT_RESOURCE_GENERATION_LABEL="com.elench.testkit.resource.generation";const w=4e3,g=String;export const DOCKER_OWNERSHIP_OPERATION_TIMEOUTS_MS=Object.freeze({inspect:3e4,list:3e4,remove:12e4,stop:3e4});export function buildProductIdentity(t){const e=I(t||process.cwd());return{dir:e,id:T(e,24)}}export function buildDockerResourceLabels(t,e){if(!e.generation)throw new Error("Docker resource generation must be non-empty");const n=buildProductIdentity(t);return{[TESTKIT_MANAGED_LABEL]:"true",[TESTKIT_RESOURCE_KIND_LABEL]:e.kind,[TESTKIT_RESOURCE_NAME_LABEL]:e.name,[TESTKIT_PRODUCT_DIR_LABEL]:n.dir,[TESTKIT_PRODUCT_ID_LABEL]:n.id,[TESTKIT_SCOPE_LABEL]:e.scope||e.kind,[TESTKIT_CACHE_POLICY_LABEL]:e.cachePolicy||"ephemeral",[TESTKIT_CREATED_AT_LABEL]:e.createdAt||new Date().toISOString(),[TESTKIT_RESOURCE_GENERATION_LABEL]:e.generation}}export function dockerLabelArgs(t){return Object.entries(t).flatMap(([e,n])=>["--label",`${e}=${g(n)}`])}export async function inspectDockerContainer(t,e={}){const n=`Docker container inspect for ${t}`,r=["inspect",t],o=await f(r,n,DOCKER_OWNERSHIP_OPERATION_TIMEOUTS_MS.inspect,e.signal,c=>runDockerCommand(r,n,c,e.signal));if(o.exitCode!==0){if(m(o))return null;throw a(n,o)}return k(o,n,"Id")}export async function listManagedDockerContainers(t){return _(["--filter",`label=${TESTKIT_MANAGED_LABEL}=true`,"--filter",`label=${TESTKIT_PRODUCT_ID_LABEL}=${t.id}`])}export async function inspectDockerVolume(t,e={}){const n=`Docker volume inspect for ${t}`,r=["volume","inspect",t],o=await f(r,n,DOCKER_OWNERSHIP_OPERATION_TIMEOUTS_MS.inspect,e.signal,c=>runDockerCommand(r,n,c,e.signal));if(o.exitCode!==0){if(E(o))return null;throw a(n,o)}return k(o,n,"Name")}export async function listManagedDockerVolumes(t){return y(["--filter",`label=${TESTKIT_MANAGED_LABEL}=true`,"--filter",`label=${TESTKIT_PRODUCT_ID_LABEL}=${t.id}`])}export async function removeDockerContainer(t,e=t){const n=`Docker container removal for ${e}`,r=await runDockerCommand(["rm","-f","-v",t],n,DOCKER_OWNERSHIP_OPERATION_TIMEOUTS_MS.remove);if(r.exitCode===0)return r.stdout.trim().length>0;if(m(r))return!1;throw a(n,r)}export async function removeDockerVolume(t,e,n={}){const r=normalizeDockerVolumeInspect(await inspectDockerVolume(t,n));if(r===null||!sameDockerVolumeGeneration(r,e))return!1;const o=`Docker volume removal for ${t}`,c=await runDockerCommand(["volume","rm","-f",t],o,DOCKER_OWNERSHIP_OPERATION_TIMEOUTS_MS.remove,n.signal);if(c.exitCode===0)return!0;if(E(c))return!1;throw a(o,c)}export function sameDockerVolumeGeneration(t,e){return t.name===e.name&&t.createdAt===e.createdAt&&t.driver===e.driver&&t.mountpoint===e.mountpoint&&L(t.labels,e.labels)}export async function stopDockerContainer(t,e=t){const n=`Docker container stop for ${e}`,r=await runDockerCommand(["stop","--time","5",t],n,DOCKER_OWNERSHIP_OPERATION_TIMEOUTS_MS.stop);if(r.exitCode===0)return!0;if(m(r))return!1;throw a(n,r)}async function _(t){const e="Docker container inventory",n=["ps","-a","--format","{{.ID}}",...t],r=await f(n,e,DOCKER_OWNERSHIP_OPERATION_TIMEOUTS_MS.list,void 0,s=>runDockerCommand(n,e,s,void 0));if(r.exitCode!==0)throw a(e,r);const{stdout:o}=r,c=o.split(/\r?\n/).map(s=>s.trim()).filter(Boolean);if(c.length===0)return[];const i=[];for(const s of c){const p=await inspectDockerContainer(s),d=normalizeDockerContainerInspect(p);d&&i.push(d)}return i}async function y(t){const e="Docker volume inventory",n=["volume","ls","-q",...t],r=await f(n,e,DOCKER_OWNERSHIP_OPERATION_TIMEOUTS_MS.list,void 0,s=>runDockerCommand(n,e,s,void 0));if(r.exitCode!==0)throw a(e,r);const{stdout:o}=r,c=o.split(/\r?\n/).map(s=>s.trim()).filter(Boolean);if(c.length===0)return[];const i=[];for(const s of c){const p=await inspectDockerVolume(s),d=normalizeDockerVolumeInspect(p);d&&i.push(d)}return i}export function normalizeDockerContainerInspect(t){const e=l(t);if(!e||typeof e.Id!="string"||!e.Id)return null;const n=l(e.Config),r=l(e.State),o=g(e.Name||"").replace(/^\//,"");return{id:e.Id,shortId:e.Id.slice(0,12),name:o,image:u(n?.Image)||"",createdAt:u(e.Created),running:!!r?.Running,status:u(r?.Status)||"unknown",labels:D(n?.Labels)}}export function normalizeDockerVolumeInspect(t){const e=l(t);return!e||typeof e.Name!="string"||!e.Name?null:{name:e.Name,driver:u(e.Driver)||"",mountpoint:u(e.Mountpoint)||"",labels:D(e.Labels),createdAt:u(e.CreatedAt)}}function k(t,e,n){let r;try{r=JSON.parse(t.stdout)}catch(i){throw b(e,n,t,i)}const o=Array.isArray(r)?r:null,c=o?l(o[0]):null;if(o?.length!==1||!c||typeof c[n]!="string"||c[n].length===0)throw b(e,n,t);return c}function D(t){const e={},n=l(t);if(!n)return e;for(const[r,o]of Object.entries(n))typeof o=="string"&&(e[r]=o);return e}function L(t,e){const n=Object.entries(t).sort(([o],[c])=>o.localeCompare(c)),r=Object.entries(e).sort(([o],[c])=>o.localeCompare(c));return n.length===r.length&&n.every(([o,c],i)=>r[i]?.[0]===o&&r[i]?.[1]===c)}function l(t){return x(t)?t:null}function x(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)}function u(t){return typeof t=="string"&&t?t:null}export async function runDockerCommand(t,e,n,r){const o=await C({args:t,cwd:process.cwd(),displayLabel:e,env:process.env,executable:"docker",signal:r,timeoutMs:n}),c=h(e,o);if(c)throw c;return o}function m(t){const e=`${t.stderr}
+${t.stdout}`.toLowerCase();return/\bno such (?:container|object)\b/u.test(e)}function E(t){const e=`${t.stderr}
 ${t.stdout}`.toLowerCase();return/\bno such (?:object|volume)\b/u.test(e)}function a(t,e){const n=[e.stderr,e.stdout].filter(Boolean).join(`
 `).trim(),r=n?`
-${n.slice(-_)}`:"",o=new Error(`${t} exited with code ${String(e.exitCode)}${r}`);return Object.defineProperty(o,"result",{enumerable:!1,value:Object.freeze({...e})}),o}function b(t,e,n,r){const o=new Error(`${t} returned malformed Docker inspect output; expected exactly one record with a non-empty ${e}`,r===void 0?void 0:{cause:r});return Object.defineProperty(o,"result",{enumerable:!1,value:Object.freeze({...n})}),o}
+${n.slice(-w)}`:"",o=new Error(`${t} exited with code ${String(e.exitCode)}${r}`);return Object.defineProperty(o,"result",{enumerable:!1,value:Object.freeze({...e})}),o}function b(t,e,n,r){const o=new Error(`${t} returned malformed Docker inspect output; expected exactly one record with a non-empty ${e}`,r===void 0?void 0:{cause:r});return Object.defineProperty(o,"result",{enumerable:!1,value:Object.freeze({...n})}),o}

package/dist/database/index.js

@@ -1 +1 @@
-export{cleanupOrphanedLocalInfrastructure,cleanupTerminalRunLocalInfrastructure}from"./lifecycle-cleanup.js";import p from"fs";import u from"path";import{computeTemplateFingerprint as M}from"./fingerprint.js";import{buildDatabaseUrl as w,buildRuntimeDatabaseName as O,buildTemplateDatabaseName as P,hashString as $}from"./naming.js";import{getLocalLocksDir as R,getLocalServiceCacheDir as _,requireContainedDatabaseStateDirectory as N,readStateValue as y}from"./state.js";import{createOwnedPgDumpClientImageResolver as E,runTemplateStage as q,runTemplateStep as V}from"./template-steps.js";import{materializeDatabaseConfig as A}from"../config/loader/index.js";import{applySourceSchemaCache as B,createSourceSchemaMismatchError as U,forceRefreshSourceSchemaCache as W,prepareSourceSchemaCache as z,verifyLocalSchemaMatchesSource as H}from"./schema-source.js";import{cloneDatabaseFromTemplate as Q,createEmptyDatabase as G,databaseExists as g,dropDatabaseIfExists as b}from"./admin.js";import{withUserHostLocalPostgresActivity as D}from"./activity-gate.js";import{ensureLocalContainer as J,loadExistingLocalContainer as x}from"./local-postgres.js";import{writeCacheState as L,writeStateValue as h}from"./state-files.js";import{withProcessLock as v}from"../process/locks.js";import{ensureDatabaseRoles as K}from"./roles.js";import{cleanupLocalPostgresDockerResources as X,destroyLocalPostgresDockerResources as Y}from"./cleanup.js";import{requireProductLifecycleFenceProductDir as j}from"../process/lifecycle-fence.js";export{dropDatabaseWithForceOrDrain,isTransientAdminQueryConnectionError,waitForDatabaseConnectionsToDrain}from"./admin.js";export{readDatabaseInfo,readDatabaseUrl}from"./state.js";export{refreshDatabaseSchema,verifyDatabaseSchema}from"./schema-operations.js";export async function provisionDatabase(e,a={}){const r=e.testkit.database;if(!r)return null;const s=A(r),t={...e,stateDir:N(e.productDir,e.stateDir,`Service "${e.name}" database runtime state directory`),testkit:{...e.testkit,database:s}},c={reporter:a.progress?.reporter||null,setupRegistry:a.progress?.setupRegistry||null,signal:a.signal,skipSchemaSourceVerify:a.skipSchemaSourceVerify};return D(t.productDir,async()=>(p.mkdirSync(t.stateDir,{recursive:!0}),ae(t,c)),{signal:a.signal})}export async function destroyRuntimeDatabase({productDir:e,stateDir:a},r={}){const s=N(e,a,"Runtime database state directory");await D(e,async()=>{await ce(e,s)},r)}export async function destroyServiceDatabaseCache(e,a,r={}){await D(e,()=>Z(e,a),r)}async function Z(e,a){const r=_(e,a);if(!p.existsSync(r))return;const s=R(e);p.mkdirSync(s,{recursive:!0}),await v(u.join(s,`template-${a}.lock`),async()=>{const t=await x(e);if(!t){p.rmSync(r,{recursive:!0,force:!0});return}const c=y(u.join(r,"template_database_name"));c&&await b(t,c),p.rmSync(r,{recursive:!0,force:!0})})}export async function destroyOwnedLocalDatabaseResources(e,a={}){const r=j(e);return D(r,()=>(j(e),Y(e,a)))}export async function cleanupOwnedLocalDatabaseResources(e,a={}){return D(e,()=>ee(e,a))}async function ee(e,a){return X({productDir:e,dryRun:!!a.dryRun,stopIdle:a.stopIdle!==!1})}export function isDatabaseStateDir(e){return p.existsSync(e)?p.existsSync(u.join(e,"database_backend")):!1}async function ae(e,a={}){const r=e.testkit.database,s=e.productDir,t=e.name,c=ie(e),i=R(s),m=_(s,t);p.mkdirSync(i,{recursive:!0}),p.mkdirSync(m,{recursive:!0});const n=await J(s,r,{signal:a.signal}),d=await v(u.join(i,`template-${t}.lock`),async()=>{const o=await z(e,a),f=await C(e,{sourceSchemaState:o});return await K(e,n,a),te(e,n,m,f,{...a,sourceSchemaState:o})},{signal:a.signal,timeoutMs:null}),l=await v(u.join(i,`runtime-${t}-${$(c,10)}.lock`),()=>se(e,n,m,d,c,a.signal),{signal:a.signal,timeoutMs:null});return{container:n.containerName,databaseName:l.databaseName,templateFingerprint:l.templateFingerprint,url:w(n,l.databaseName)}}async function te(e,a,r,s,t={}){const c=e.name;let i=s,m=t.sourceSchemaState||null,n=!1;for(;;){const d=y(u.join(r,"template_fingerprint")),l=y(u.join(r,"template_database_name")),o=P(c,i);if(d===i&&l&&await g(a,l,{signal:t.signal}))return t.setupRegistry?.recordCached({config:e,stage:"template",kind:"database-template",summary:"template cache hit"}),L(r,a,l,i),i;l&&l!==o&&await b(a,l,{signal:t.signal}),await g(a,o,{signal:t.signal})&&await b(a,o,{signal:t.signal});const f=w(a,o);if(await G(a,o,{signal:t.signal}),(await re(e,a,o,f,{...t,sourceSchemaState:m,refreshedSourceAfterMismatch:n})).refreshSourceSchema){await b(a,o,{signal:t.signal}),m=await W(e,m,t),n=!0,i=await C(e,{sourceSchemaState:m});continue}return L(r,a,o,i),i}}async function re(e,a,r,s,t={}){const c=t.setupRegistry?.start({config:e,stage:"template",kind:"database-template",summary:"template rebuild",recordLog:!1}),i={ownedContainer:{containerId:a.containerId,containerPort:a.containerPort},parentOperation:c,reporter:t.reporter||null,setupRegistry:t.setupRegistry||null,signal:t.signal},m=E(e,s,i);try{await B(e,s,t.sourceSchemaState,i);const n=async()=>{const S=await H(e,s,t.sourceSchemaState,{...i,resolveLocalSnapshotImage:m,skipSchemaSourceVerify:t.skipSchemaSourceVerify});if(S.status!=="mismatch")return null;if(t.refreshedSourceAfterMismatch)throw U(e,ue(t.sourceSchemaState),S);return S},d=e.testkit.database?.template,l=!!(d?.migrate?.length||d?.seed?.length),o=async S=>{const T=d?.[S]||[];for(const[F,I]of T.entries())if(await V(e,S,I,F,s,i),await n())return!0;return!1};return await o("migrate")||await o("seed")||!l&&!!await n()?(k(c,t,{status:"passed",summary:"source schema refresh requested"}),{refreshSourceSchema:!0}):(await q(e,"verify",s,i),k(c,t,{status:"passed",summary:"template rebuild"}),{refreshSourceSchema:!1})}catch(n){throw k(c,t,{status:"failed",summary:"template rebuild",error:oe(n)||n}),await b(a,r),n}}function k(e,a,r){const s=e&&a.setupRegistry?a.setupRegistry.finish(e,r):null;s&&a.reporter?.setupOperationFinished?.(s)}async function se(e,a,r,s,t,c){const i=e.name,m=y(u.join(r,"template_database_name"));if(!m)throw new Error(`Missing template database for service "${i}"`);const n=O(i,t,s),d=y(u.join(e.stateDir,"local_database_name")),l=y(u.join(e.stateDir,"local_template_fingerprint")),o=me(e.testkit.database.reset)||l!==s||d!==n||!await g(a,n,{signal:c});return d&&d!==n&&await b(a,d,{signal:c}),o&&(await b(a,n,{signal:c}),await Q(a,n,m,{signal:c})),p.mkdirSync(e.stateDir,{recursive:!0}),ne(e,a,{bindingKey:t,databaseName:n,templateFingerprint:s,templateDbName:m}),{bindingKey:t,databaseName:n,templateFingerprint:s,templateDbName:m}}function ne(e,a,r){h(u.join(e.stateDir,"database_backend"),""),h(u.join(e.stateDir,"database_url"),w(a,r.databaseName)),h(u.join(e.stateDir,"local_database_name"),r.databaseName),h(u.join(e.stateDir,"local_template_fingerprint"),r.templateFingerprint),h(u.join(e.stateDir,"local_template_database_name"),r.templateDbName),h(u.join(e.stateDir,"local_container_name"),a.containerName),a.volumeName&&h(u.join(e.stateDir,"volume_name"),a.volumeName),a.volumeMountPath&&h(u.join(e.stateDir,"volume_mount_path"),a.volumeMountPath)}function ie(e){return le(e.testkit.database.binding)==="shared"?`${e.name}:shared`:e.runtimeId?`${e.name}:${String(e.runtimeId)}`:`${e.name}:${e.stateDir}`}async function ce(e,a){const r=y(u.join(a,"local_database_name"));if(!r)return;const s=await x(e);s&&await b(s,r)}function C(e,a={}){return M(e,a)}function ue(e){if(!e?.active)throw new Error("Source schema mismatch requires active source schema state");return e}function oe(e){return typeof e!="object"&&typeof e!="function"||e===null?void 0:Reflect.get(e,"message")}function me(e){return e!==!1}function le(e){return e||"per-runtime"}function Le(e){return e}
+import{requireContainedTestkitStateDirectory as w}from"../process/runs/product-state.js";export{cleanupOrphanedLocalInfrastructure,cleanupTerminalRunLocalInfrastructure}from"./lifecycle-cleanup.js";import l from"fs";import i from"path";import{computeTemplateFingerprint as C}from"./fingerprint.js";import{buildDatabaseUrl as v,buildRuntimeDatabaseName as E,buildTaskDatabaseName as M,buildTemplateDatabaseName as q,hashString as B}from"./naming.js";import{getLocalLocksDir as L,getLocalServiceCacheDir as T,readStateValue as h}from"./state.js";import{createOwnedPgDumpClientImageResolver as V,runTemplateStage as W,runTemplateStep as K}from"./template-steps.js";import{materializeDatabaseConfig as U}from"../config/loader/index.js";import{applySourceSchemaCache as z,createSourceSchemaMismatchError as H,forceRefreshSourceSchemaCache as Q,prepareSourceSchemaCache as G,verifyLocalSchemaMatchesSource as J}from"./schema-source.js";import{cloneDatabaseFromTemplate as F,createEmptyDatabase as X,databaseExists as _,dropDatabaseWithForceOrDrain as p}from"./admin.js";import{withUserHostLocalPostgresActivity as f}from"./activity-gate.js";import{ensureLocalContainer as Y,loadExistingLocalContainer as g}from"./local-postgres.js";import{beginTemplateCacheRebuild as Z,writeCacheState as O,writeStateValue as D}from"./state-files.js";import{withProcessLock as N}from"../process/locks.js";import{ensureDatabaseRoles as ee}from"./roles.js";import{cleanupLocalPostgresDockerResources as ae,destroyLocalPostgresDockerResources as te}from"./cleanup.js";import{requireProductLifecycleFenceProductDir as I}from"../process/lifecycle-fence.js";export{dropDatabaseWithForceOrDrain,isTransientAdminQueryConnectionError,waitForDatabaseConnectionsToDrain}from"./admin.js";export{refreshDatabaseSchema,verifyDatabaseSchema}from"./schema-operations.js";const k="task-databases";export async function provisionDatabase(e,a={}){const t=e.testkit.database;if(!t)return null;const s=U(t),r={...e,stateDir:w(e.productDir,e.stateDir,`Service "${e.name}" database runtime state directory`),testkit:{...e.testkit,database:s}},c={reporter:a.progress?.reporter||null,setupRegistry:a.progress?.setupRegistry||null,signal:a.signal,skipSchemaSourceVerify:a.skipSchemaSourceVerify};return f(r.productDir,async()=>(l.mkdirSync(r.stateDir,{recursive:!0}),ne(r,c,a.provisionedSharedDatabases)),{signal:a.signal})}export async function destroyRuntimeDatabase({productDir:e,stateDir:a},t={}){const s=w(e,a,"Runtime database state directory");await f(e,async()=>{await le(e,s)},t)}export async function destroyServiceDatabaseCache(e,a,t={}){await f(e,()=>re(e,a),t)}async function re(e,a){const t=T(e,a);if(!l.existsSync(t))return;const s=L(e);l.mkdirSync(s,{recursive:!0}),await N(i.join(s,`template-${a}.lock`),async()=>{const r=await g(e);if(!r){l.rmSync(t,{recursive:!0,force:!0});return}const c=h(i.join(t,"template_database_name"));c&&await p(r,c),l.rmSync(t,{recursive:!0,force:!0})})}export async function destroyOwnedLocalDatabaseResources(e,a={}){const t=I(e);return f(t,()=>(I(e),te(e,a)))}export async function cleanupOwnedLocalDatabaseResources(e,a={}){return f(e,()=>se(e,a))}async function se(e,a){return ae({productDir:e,dryRun:!!a.dryRun,stopIdle:a.stopIdle!==!1})}export function isDatabaseStateDir(e){return l.existsSync(e)?l.existsSync(i.join(e,"database_backend")):!1}async function ne(e,a={},t){const s=e.testkit.database,r=e.productDir,c=e.name,u=me(e),d=L(r),n=T(r,c);l.mkdirSync(d,{recursive:!0}),l.mkdirSync(n,{recursive:!0});const o=await Y(r,s,{signal:a.signal}),b=await N(i.join(d,`template-${c}.lock`),async()=>{const y=await G(e,a),R=await C(e,{sourceSchemaState:y});return await ee(e,o,a),ie(e,o,n,R,{...a,sourceSchemaState:y})},{signal:a.signal,timeoutMs:null}),m=P(s.binding)==="shared"?t:void 0,S=await N(i.join(d,`runtime-${c}-${B(u,10)}.lock`),()=>oe(e,o,b,u,m,a.signal),{signal:a.signal,timeoutMs:null});return{container:o.containerName,databaseName:S.databaseName,templateFingerprint:S.templateFingerprint,url:v(o,S.databaseName)}}async function ie(e,a,t,s,r={}){const c=e.name;let u=s,d=r.sourceSchemaState||null,n=!1;for(;;){const o=h(i.join(t,"template_fingerprint")),b=h(i.join(t,"template_database_name")),m=q(c,u);if(o===u&&b&&await _(a,b,{signal:r.signal}))return r.setupRegistry?.recordCached({config:e,stage:"template",kind:"database-template",summary:"template cache hit"}),O(t,a,b,u),{databaseName:b,fingerprint:u};b&&b!==m&&await p(a,b,{signal:r.signal}),await _(a,m,{signal:r.signal})&&await p(a,m,{signal:r.signal}),Z(t,m);const S=v(a,m);if(await X(a,m,{signal:r.signal}),(await ce(e,a,m,S,{...r,sourceSchemaState:d,refreshedSourceAfterMismatch:n})).refreshSourceSchema){await p(a,m,{signal:r.signal}),d=await Q(e,d,r),n=!0,u=await C(e,{sourceSchemaState:d});continue}return O(t,a,m,u),{databaseName:m,fingerprint:u}}}async function ce(e,a,t,s,r={}){const c=r.setupRegistry?.start({config:e,stage:"template",kind:"database-template",summary:"template rebuild",recordLog:!1}),u={ownedContainer:{containerId:a.containerId,containerPort:a.containerPort},parentOperation:c,reporter:r.reporter||null,setupRegistry:r.setupRegistry||null,signal:r.signal},d=V(e,s,u);try{await z(e,s,r.sourceSchemaState,u);const n=async()=>{const y=await J(e,s,r.sourceSchemaState,{...u,resolveLocalSnapshotImage:d,skipSchemaSourceVerify:r.skipSchemaSourceVerify});if(y.status!=="mismatch")return null;if(r.refreshedSourceAfterMismatch)throw H(e,de(r.sourceSchemaState),y);return y},o=e.testkit.database?.template,b=!!(o?.migrate?.length||o?.seed?.length),m=async y=>{const R=o?.[y]||[];for(const[$,A]of R.entries())if(await K(e,y,A,$,s,u),await n())return!0;return!1};return await m("migrate")||await m("seed")||!b&&!!await n()?(j(c,r,{status:"passed",summary:"source schema refresh requested"}),{refreshSourceSchema:!0}):(await W(e,"verify",s,u),j(c,r,{status:"passed",summary:"template rebuild"}),{refreshSourceSchema:!1})}catch(n){throw j(c,r,{status:"failed",summary:"template rebuild",error:be(n)||n}),await p(a,t),n}}function j(e,a,t){const s=e&&a.setupRegistry?a.setupRegistry.finish(e,t):null;s&&a.reporter?.setupOperationFinished?.(s)}async function oe(e,a,t,s,r,c){const u=e.name,d=t.fingerprint,n=E(u,s,d);await x(a,e.stateDir);const o=h(i.join(e.stateDir,"local_database_name")),b=h(i.join(e.stateDir,"local_template_fingerprint")),m=!r?.has(n)&&(pe(e.testkit.database.reset)||b!==d||o!==n)||!await _(a,n,{signal:c});o&&o!==n&&await p(a,o,{signal:c}),m&&(await p(a,n,{signal:c}),await F(a,n,t.databaseName,{signal:c})),r?.add(n),l.mkdirSync(e.stateDir,{recursive:!0});const S={bindingKey:s,databaseName:n,templateDatabaseName:t.databaseName,templateFingerprint:d};return ue(e,a,S),S}function ue(e,a,t){D(i.join(e.stateDir,"database_backend"),""),D(i.join(e.stateDir,"local_database_name"),t.databaseName),D(i.join(e.stateDir,"local_template_fingerprint"),t.templateFingerprint),D(i.join(e.stateDir,"local_template_database_name"),t.templateDatabaseName),D(i.join(e.stateDir,"local_container_name"),a.containerName),a.volumeName&&D(i.join(e.stateDir,"volume_name"),a.volumeName),a.volumeMountPath&&D(i.join(e.stateDir,"volume_mount_path"),a.volumeMountPath)}function me(e){return P(e.testkit.database.binding)==="shared"?`${e.name}:shared`:e.runtimeId?`${e.name}:${String(e.runtimeId)}`:`${e.name}:${e.stateDir}`}async function le(e,a){const t=h(i.join(a,"local_database_name"));if(!t)return;const s=await g(e);s&&(await x(s,a),await p(s,t))}export async function cloneTaskDatabase({productDir:e,stateDir:a},t,s,r={}){const c=w(e,a,"Runtime database state directory");return f(e,async()=>{const u=h(i.join(c,"local_database_name")),d=h(i.join(c,"local_template_database_name")),n=await g(e,{signal:r.signal});if(!u||!d||!n)throw new Error(`Service "${t}" has no provisioned database to clone for this task`);const o=M(t,u,s),b=i.join(c,k,o);l.mkdirSync(i.dirname(b),{recursive:!0}),l.writeFileSync(b,"");try{await F(n,o,d,{signal:r.signal})}catch(m){throw await p(n,o),l.rmSync(b,{force:!0}),m}return{databaseName:o,url:v(n,o)}},{signal:r.signal})}export async function dropTaskDatabase({productDir:e,stateDir:a},t){const s=w(e,a,"Runtime database state directory");await f(e,async()=>{const r=await g(e);r&&await p(r,t),l.rmSync(i.join(s,k,t),{force:!0})})}export async function dropRecordedTaskDatabases({productDir:e,stateDir:a}){const t=w(e,a,"Runtime database state directory");l.existsSync(i.join(t,k))&&await f(e,async()=>{const s=await g(e);s&&await x(s,t)})}async function x(e,a){const t=i.join(a,k);if(l.existsSync(t))for(const s of l.readdirSync(t))await p(e,s),l.rmSync(i.join(t,s),{force:!0})}function de(e){if(!e?.active)throw new Error("Source schema mismatch requires active source schema state");return e}function be(e){return typeof e!="object"&&typeof e!="function"||e===null?void 0:Reflect.get(e,"message")}function pe(e){return e!==!1}function P(e){return e||"per-runtime"}function Fe(e){return e}

package/dist/database/local-postgres.js

@@ -1,2 +1,2 @@
-import{recordWork as M}from"../kernel/work-metrics.js";import{runDockerMetadataCommand as oe}from"./docker-metadata.js";import{randomUUID as C}from"node:crypto";import ie from"fs";import u from"path";import{LOCAL_ADMIN_DB as D,LOCAL_IMAGE as R,LOCAL_MAX_CONNECTIONS as N,LOCAL_PASSWORD as $,LOCAL_POLL_INTERVAL_MS as ae,LOCAL_READY_TIMEOUT_MS as j,LOCAL_USER as V}from"./constants.js";import{buildContainerName as se,buildVolumeName as x}from"./naming.js";import{getLocalInfraDir as U,readStateValue as l}from"./state.js";import{TESTKIT_CREATED_AT_LABEL as z,TESTKIT_RESOURCE_GENERATION_LABEL as v,buildDockerResourceLabels as G,dockerLabelArgs as H,inspectDockerVolume as h,normalizeDockerVolumeInspect as E,removeDockerVolume as ce,runDockerCommand as L}from"./docker.js";import{writeLocalInfraState as ue}from"./state-files.js";import{isUnknownArray as P,isUnknownRecord as m}from"../kernel/unknown-values.js";const le="/var/lib/postgresql/data",fe="/var/lib/postgresql",I=String;export const LOCAL_POSTGRES_DOCKER_TIMEOUTS_MS=Object.freeze({inspect:3e4,readinessAttempt:1e4,remove:12e4,run:10*6e4,start:12e4,volumeCreate:12e4});export async function ensureLocalContainer(e,n={},r={}){const o=U(e);ie.mkdirSync(o,{recursive:!0});const t=l(u.join(o,"container_name"))||se(e),i=l(u.join(o,"volume_name")),a=n.image||l(u.join(o,"image"))||R,c=l(u.join(o,"image")),f=resolveLocalPostgresVolumeTarget(a),w=n.user||l(u.join(o,"user"))||V,b=n.password||l(u.join(o,"password"))||$,_=F(n.maxConnections||l(u.join(o,"max_connections"))||N);let s=await inspectContainer(t,r);s&&p(s,e,t);const te=!s&&!i;let d=Y(s,f)||i||x(e,C());s&&await W(e,d,r);const A=s?.Config?.Image||c||null;if(s&&!isReusableLocalPostgresContainer(s,{image:a,maxConnections:_,volumeMountPath:f,volumeName:d})&&(await stopAndRemoveContainer(s.Id,t,r),A&&A!==a&&(await be(e,d,r),d=x(e,C())),s=null),s)s.State?.Running||(await y(["start",s.Id],`Docker local Postgres container start for ${t}`,LOCAL_POSTGRES_DOCKER_TIMEOUTS_MS.start,r.signal),s=await inspectContainer(t,r),s&&p(s,e,t));else{d=te?await K(e,r):await ge(e,d,r);const re=X(e,t,C());await y(buildDockerRunArgs({containerName:t,labels:re,volumeName:d,volumeMountPath:f,user:w,password:b,image:a,maxConnections:_}),`Docker local Postgres container creation for ${t}`,LOCAL_POSTGRES_DOCKER_TIMEOUTS_MS.run,r.signal),s=await inspectContainer(t,r),s&&p(s,e,t)}const O=q(s);if(!s||!O)throw new Error(`Could not determine host port for local database container ${t}`);const S={containerName:t,containerId:s.Id,volumeName:d,volumeMountPath:f,image:a,user:w,password:b,maxConnections:_,host:"127.0.0.1",port:Number(O),containerPort:5432};return await J(S,r),ue(o,S),S}export function buildDockerRunArgs({containerName:e,labels:n,volumeName:r,volumeMountPath:o,user:t,password:i,image:a,maxConnections:c}){return["run","-d","--name",e,...H(n),"-p","127.0.0.1::5432","--mount",`type=volume,source=${r},target=${o}`,"-e",`POSTGRES_USER=${t}`,"-e",`POSTGRES_PASSWORD=${i}`,"-e",`POSTGRES_DB=${D}`,a,"postgres","-c",`max_connections=${String(c)}`]}export async function loadExistingLocalContainer(e,n={}){const r=U(e),o=l(u.join(r,"container_name"));if(!o)return null;const t=await inspectContainer(o,n);if(!t)return null;p(t,e,o);const i=t.Config?.Image||l(u.join(r,"image"))||R,a=l(u.join(r,"volume_mount_path"))||resolveLocalPostgresVolumeTarget(i),c=Y(t,a)||l(u.join(r,"volume_name"));if(!c)return null;await W(e,c,n),t.State?.Running||await y(["start",t.Id],`Docker local Postgres container start for ${o}`,LOCAL_POSTGRES_DOCKER_TIMEOUTS_MS.start,n.signal);const f=t.State?.Running?t:await inspectContainer(t.Id,n);f&&p(f,e,o);const w=q(f);if(!f||!w)return null;const b={containerName:o,containerId:f.Id,volumeName:c,volumeMountPath:a,image:i,user:l(u.join(r,"user"))||V,password:l(u.join(r,"password"))||$,maxConnections:F(l(u.join(r,"max_connections"))||N),host:"127.0.0.1",port:Number(w),containerPort:B(f)==="host"?Number(w):5432};return await J(b,n),b}function me(e,n){const r=e.Config?.Cmd;return Array.isArray(r)?r.includes("-c")&&r.includes(`max_connections=${String(n)}`):!1}function de(e,n,r){return(Array.isArray(e.Mounts)?e.Mounts:[]).some(t=>t?.Type==="volume"&&t.Name===n&&t.Destination===r)}export function isReusableLocalPostgresContainer(e,n){return e.Config?.Image===n.image&&me(e,n.maxConnections)&&de(e,n.volumeName,n.volumeMountPath)&&B(e)==="bridge"}function B(e){return e.HostConfig?.NetworkMode==="host"?"host":"bridge"}function q(e){return e?.NetworkSettings?.Ports?.["5432/tcp"]?.[0]?.HostPort||null}function F(e){const n=Number(e);if(!Number.isInteger(n)||n<10)throw new Error("database.maxConnections must be an integer greater than or equal to 10");return n}export async function inspectContainer(e,n={}){M("database.containerInspections");const r=`Docker local Postgres container inspect for ${e}`,o=["inspect",e],t=await oe(o,r,LOCAL_POSTGRES_DOCKER_TIMEOUTS_MS.inspect,n.signal,c=>L(o,r,c,n.signal));if(t.exitCode!==0){if(ne(t))return null;throw T(r,t)}let i;try{i=JSON.parse(t.stdout)}catch(c){throw ee(r,t,c)}const a=P(i)&&i.length===1?normalizeLocalPostgresContainerInspect(i[0]):null;if(!a?.Id)throw ee(r,t);return{...a,Id:a.Id}}export function normalizeLocalPostgresContainerInspect(e){return m(e)?{Config:he(e.Config),HostConfig:Pe(e.HostConfig),Id:g(e.Id),Mounts:ke(e.Mounts),NetworkSettings:ye(e.NetworkSettings),State:_e(e.State)}:null}export async function stopAndRemoveContainer(e,n=e,r={}){const o=`Docker local Postgres container removal for ${n}`,t=await L(["rm","-f","-v",e],o,LOCAL_POSTGRES_DOCKER_TIMEOUTS_MS.remove,r.signal);if(!(t.exitCode===0||ne(t)))throw T(o,t)}async function ge(e,n,r={}){const o=k(e,n,"existing-generation"),t=await h(n,r);if(t){if(!matchesStableDockerLabels(Z(t)||{},o))throw new Error(`Docker volume ${n} already exists but is not owned by this Testkit product. Remove or rename it before running Testkit.`);return n}return K(e,r)}async function K(e,n){const r=C(),o=x(e,r),t=k(e,o,r);await y(["volume","create",...H(t),o],`Docker local Postgres volume creation for ${o}`,LOCAL_POSTGRES_DOCKER_TIMEOUTS_MS.volumeCreate,n.signal);const i=E(await h(o,n));if(i===null||!we(i.labels,t))throw new Error(`Docker volume ${o} was not published with the expected Testkit generation identity`);return o}async function W(e,n,r){const o=k(e,n,"existing-generation"),t=E(await h(n,r));if(t===null||!matchesStableDockerLabels(t.labels,o))throw new Error(`Docker volume ${n} is missing or is not owned by this Testkit product`);return t}export function matchesStableDockerLabels(e,n){const r=e[z],o=e[v];return typeof r=="string"&&r.length>0&&typeof o=="string"&&o.length>0&&Object.entries(n).every(([t,i])=>t===z||t===v||e[t]===I(i))}function we(e,n){const r=Object.entries(e).sort(([t],[i])=>t.localeCompare(i)),o=Object.entries(n).map(([t,i])=>[t,I(i)]).sort(([t],[i])=>t.localeCompare(i));return r.length===o.length&&r.every(([t,i],a)=>o[a]?.[0]===t&&o[a]?.[1]===i)}async function be(e,n,r={}){const o=k(e,n,"existing-generation"),t=await h(n,r);if(!t)return;const i=Z(t)||{};if(!matchesStableDockerLabels(i,o))return;const c=E(t);c!==null&&await ce(n,c,r)}function Y(e,n){return(Array.isArray(e?.Mounts)?e.Mounts:[]).find(t=>t?.Type==="volume"&&typeof t.Name=="string"&&t.Name.length>0&&t.Destination===n)?.Name||null}function p(e,n,r){const o=X(n,r);if(!matchesStableDockerLabels(e.Config?.Labels||{},o))throw new Error(`Docker container ${r} already exists but is not owned by this Testkit product. Remove or rename it before running Testkit.`)}export function resolveLocalPostgresVolumeTarget(e){return pe(e)>=18?fe:le}function pe(e){const r=I(e||"").match(/(?:^|[:@/-])(?:pg|postgres)?(\d{2})(?:\D|$)/i);return r?Number(r[1]):16}async function J(e,n={}){M("database.hostReadinessChecks");const r=Date.now();let o=10;for(;Date.now()-r<j;){const t=Math.max(1,j-(Date.now()-r));if((await L(["exec",e.containerId,"pg_isready","-h","127.0.0.1","-U",e.user,"-d",D,"-p",String(e.containerPort||5432)],`Docker local Postgres readiness probe for ${e.containerName}`,Math.min(LOCAL_POSTGRES_DOCKER_TIMEOUTS_MS.readinessAttempt,t),n.signal)).exitCode===0)return;await Ce(Math.min(o,t),n.signal),o=Math.min(o*2,ae)}throw new Error(`Timed out waiting for local database container ${e.containerName}`)}function X(e,n,r="existing-generation"){return G(e,{generation:r,kind:"postgres-container",name:n,scope:"local-postgres",cachePolicy:"product-cache"})}function k(e,n,r){return G(e,{generation:r,kind:"postgres-volume",name:n,scope:"local-postgres",cachePolicy:"product-cache"})}function Ce(e,n){return new Promise((r,o)=>{if(n?.aborted){o(Q(n));return}const t=setTimeout(i,e);n?.addEventListener("abort",a,{once:!0});function i(){n?.removeEventListener("abort",a),r()}function a(){clearTimeout(t),o(n?Q(n):new Error("Local Postgres operation aborted"))}})}function Q(e){return e.reason instanceof Error?e.reason:new Error("Local Postgres operation aborted",{cause:e.reason})}function Z(e){if(!m(e))return null;const n=e.Labels;return m(n)?n:null}function he(e){if(e===null)return null;if(m(e))return{Cmd:Se(e.Cmd),Image:g(e.Image),Labels:Le(e.Labels)}}function Le(e){if(!m(e))return null;const n={};for(const[r,o]of Object.entries(e))typeof o=="string"&&(n[r]=o);return n}function Pe(e){if(e===null)return null;if(m(e))return{NetworkMode:g(e.NetworkMode)}}function ke(e){if(e===null)return null;if(P(e))return e.flatMap(n=>m(n)?[{Destination:g(n.Destination),Name:g(n.Name),Type:g(n.Type)}]:[])}function ye(e){if(e===null)return null;if(!m(e))return;const n=e.Ports;if(n===null)return{Ports:null};if(!m(n))return{};const r={};for(const[o,t]of Object.entries(n)){if(t===null){r[o]=null;continue}P(t)&&(r[o]=t.flatMap(i=>{if(!m(i))return[];const a=g(i.HostPort);return i.HostPort!==void 0&&a===void 0?[]:[{HostPort:a}]}))}return{Ports:r}}function _e(e){if(e===null)return null;if(m(e))return{Running:e.Running===null||typeof e.Running=="boolean"?e.Running:void 0}}function g(e){if(e===null||typeof e=="string")return e}function Se(e){if(e===null)return null;if(P(e))return e.filter(n=>typeof n=="string")}async function y(e,n,r,o){const t=await L(e,n,r,o);if(t.exitCode===0)return t;throw T(n,t)}function T(e,n){const r=n.stderr.trim()||n.stdout.trim(),o=new Error(`${e} failed with exit code ${String(n.exitCode)}${r?`: ${r}`:""}`);return Object.defineProperty(o,"result",{enumerable:!1,value:Object.freeze({...n})}),o}function ee(e,n,r){const o=new Error(`${e} returned malformed Docker inspect output; expected exactly one container record with a non-empty Id`,r===void 0?void 0:{cause:r});return Object.defineProperty(o,"result",{enumerable:!1,value:Object.freeze({...n})}),o}function ne(e){return/\bno such (?:container|object)\b/iu.test(`${e.stderr}
+import{recordWork as D}from"../kernel/work-metrics.js";import{runDockerMetadataCommand as oe}from"./docker-metadata.js";import{randomUUID as C}from"node:crypto";import ie from"fs";import u from"path";import{LOCAL_ADMIN_DB as M,LOCAL_IMAGE as R,LOCAL_MAX_CONNECTIONS as N,LOCAL_PASSWORD as $,LOCAL_POLL_INTERVAL_MS as se,LOCAL_READY_TIMEOUT_MS as j,LOCAL_USER as V}from"./constants.js";import{buildContainerName as ae,buildVolumeName as E}from"./naming.js";import{getLocalInfraDir as U,readStateValue as l}from"./state.js";import{TESTKIT_CREATED_AT_LABEL as z,TESTKIT_RESOURCE_GENERATION_LABEL as v,buildDockerResourceLabels as G,dockerLabelArgs as H,inspectDockerVolume as h,normalizeDockerVolumeInspect as S,removeDockerVolume as ce,runDockerCommand as L}from"./docker.js";import{writeLocalInfraState as ue}from"./state-files.js";import{isUnknownArray as P,isUnknownRecord as f}from"../kernel/unknown-values.js";const le="/var/lib/postgresql/data",fe="/var/lib/postgresql",O=String;export const LOCAL_POSTGRES_DOCKER_TIMEOUTS_MS=Object.freeze({inspect:3e4,readinessAttempt:1e4,remove:12e4,run:10*6e4,start:12e4,volumeCreate:12e4});export async function ensureLocalContainer(e,n={},r={}){const o=U(e);ie.mkdirSync(o,{recursive:!0});const t=l(u.join(o,"container_name"))||ae(e),i=l(u.join(o,"volume_name")),s=n.image||l(u.join(o,"image"))||R,c=l(u.join(o,"image")),m=resolveLocalPostgresVolumeTarget(s),w=n.user||l(u.join(o,"user"))||V,b=n.password||l(u.join(o,"password"))||$,_=F(n.maxConnections||l(u.join(o,"max_connections"))||N);let a=await inspectContainer(t,r);a&&p(a,e,t);const te=!a&&!i;let d=Y(a,m)||i||E(e,C());a&&await W(e,d,r);const A=a?.Config?.Image||c||null;if(a&&!isReusableLocalPostgresContainer(a,{image:s,maxConnections:_,volumeMountPath:m,volumeName:d})&&(await stopAndRemoveContainer(a.Id,t,r),A&&A!==s&&(await be(e,d,r),d=E(e,C())),a=null),a)a.State?.Running||(await y(["start",a.Id],`Docker local Postgres container start for ${t}`,LOCAL_POSTGRES_DOCKER_TIMEOUTS_MS.start,r.signal),a=await inspectContainer(t,r),a&&p(a,e,t));else{d=te?await K(e,r):await ge(e,d,r);const re=X(e,t,C());await y(buildDockerRunArgs({containerName:t,labels:re,volumeName:d,volumeMountPath:m,user:w,password:b,image:s,maxConnections:_}),`Docker local Postgres container creation for ${t}`,LOCAL_POSTGRES_DOCKER_TIMEOUTS_MS.run,r.signal),a=await inspectContainer(t,r),a&&p(a,e,t)}const I=q(a);if(!a||!I)throw new Error(`Could not determine host port for local database container ${t}`);const x={containerName:t,containerId:a.Id,volumeName:d,volumeMountPath:m,image:s,user:w,password:b,maxConnections:_,host:"127.0.0.1",port:Number(I),containerPort:5432};return await J(x,r),ue(o,x),x}export function buildDockerRunArgs({containerName:e,labels:n,volumeName:r,volumeMountPath:o,user:t,password:i,image:s,maxConnections:c}){return["run","-d","--name",e,...H(n),"-p","127.0.0.1::5432","--mount",`type=volume,source=${r},target=${o}`,"-e",`POSTGRES_USER=${t}`,"-e",`POSTGRES_PASSWORD=${i}`,"-e",`POSTGRES_DB=${M}`,s,"postgres","-c",`max_connections=${String(c)}`]}export async function loadExistingLocalContainer(e,n={}){const r=U(e),o=l(u.join(r,"container_name"));if(!o)return null;const t=await inspectContainer(o,n);if(!t)return null;p(t,e,o);const i=t.Config?.Image||l(u.join(r,"image"))||R,s=l(u.join(r,"volume_mount_path"))||resolveLocalPostgresVolumeTarget(i),c=Y(t,s)||l(u.join(r,"volume_name"));if(!c)return null;await W(e,c,n),t.State?.Running||await y(["start",t.Id],`Docker local Postgres container start for ${o}`,LOCAL_POSTGRES_DOCKER_TIMEOUTS_MS.start,n.signal);const m=t.State?.Running?t:await inspectContainer(t.Id,n);m&&p(m,e,o);const w=q(m);if(!m||!w)return null;const b={containerName:o,containerId:m.Id,volumeName:c,volumeMountPath:s,image:i,user:l(u.join(r,"user"))||V,password:l(u.join(r,"password"))||$,maxConnections:F(l(u.join(r,"max_connections"))||N),host:"127.0.0.1",port:Number(w),containerPort:B(m)==="host"?Number(w):5432};return await J(b,n),b}function me(e,n){const r=e.Config?.Cmd;return Array.isArray(r)?r.includes("-c")&&r.includes(`max_connections=${String(n)}`):!1}function de(e,n,r){return(Array.isArray(e.Mounts)?e.Mounts:[]).some(t=>t?.Type==="volume"&&t.Name===n&&t.Destination===r)}export function isReusableLocalPostgresContainer(e,n){return e.Config?.Image===n.image&&me(e,n.maxConnections)&&de(e,n.volumeName,n.volumeMountPath)&&B(e)==="bridge"}function B(e){return e.HostConfig?.NetworkMode==="host"?"host":"bridge"}function q(e){return e?.NetworkSettings?.Ports?.["5432/tcp"]?.[0]?.HostPort||null}function F(e){const n=Number(e);if(!Number.isInteger(n)||n<10)throw new Error("database.maxConnections must be an integer greater than or equal to 10");return n}export async function inspectContainer(e,n={}){D("database.containerInspections");const r=`Docker local Postgres container inspect for ${e}`,o=["inspect",e],t=await oe(o,r,LOCAL_POSTGRES_DOCKER_TIMEOUTS_MS.inspect,n.signal,c=>L(o,r,c,n.signal));if(t.exitCode!==0){if(ne(t))return null;throw T(r,t)}let i;try{i=JSON.parse(t.stdout)}catch(c){throw ee(r,t,c)}const s=P(i)&&i.length===1?normalizeLocalPostgresContainerInspect(i[0]):null;if(!s?.Id)throw ee(r,t);return{...s,Id:s.Id}}export function normalizeLocalPostgresContainerInspect(e){return f(e)?{Config:Le(e.Config),HostConfig:ke(e.HostConfig),Id:g(e.Id),Mounts:ye(e.Mounts),NetworkSettings:_e(e.NetworkSettings),State:xe(e.State)}:null}export async function stopAndRemoveContainer(e,n=e,r={}){const o=`Docker local Postgres container removal for ${n}`,t=await L(["rm","-f","-v",e],o,LOCAL_POSTGRES_DOCKER_TIMEOUTS_MS.remove,r.signal);if(!(t.exitCode===0||ne(t)))throw T(o,t)}async function ge(e,n,r={}){const o=k(e,n,"existing-generation"),t=await h(n,r);if(t){if(!matchesStableDockerLabels(Z(t)||{},o))throw new Error(`Docker volume ${n} already exists but is not owned by this Testkit product. Remove or rename it before running Testkit.`);return n}return K(e,r)}async function K(e,n){const r=C(),o=E(e,r),t=k(e,o,r);await y(["volume","create",...H(t),o],`Docker local Postgres volume creation for ${o}`,LOCAL_POSTGRES_DOCKER_TIMEOUTS_MS.volumeCreate,n.signal);const i=S(await h(o,n));if(i===null||!we(i.labels,t))throw new Error(`Docker volume ${o} was not published with the expected Testkit generation identity`);return o}async function W(e,n,r){const o=k(e,n,"existing-generation"),t=S(await h(n,r));if(t===null||!matchesStableDockerLabels(t.labels,o))throw new Error(`Docker volume ${n} is missing or is not owned by this Testkit product`);return t}export function matchesStableDockerLabels(e,n){const r=e[z],o=e[v];return typeof r=="string"&&r.length>0&&typeof o=="string"&&o.length>0&&Object.entries(n).every(([t,i])=>t===z||t===v||e[t]===O(i))}function we(e,n){const r=Object.entries(e).sort(([t],[i])=>t.localeCompare(i)),o=Object.entries(n).map(([t,i])=>[t,O(i)]).sort(([t],[i])=>t.localeCompare(i));return r.length===o.length&&r.every(([t,i],s)=>o[s]?.[0]===t&&o[s]?.[1]===i)}async function be(e,n,r={}){const o=k(e,n,"existing-generation"),t=await h(n,r);if(!t)return;const i=Z(t)||{};if(!matchesStableDockerLabels(i,o))return;const c=S(t);c!==null&&await ce(n,c,r)}function Y(e,n){return(Array.isArray(e?.Mounts)?e.Mounts:[]).find(t=>t?.Type==="volume"&&typeof t.Name=="string"&&t.Name.length>0&&t.Destination===n)?.Name||null}function p(e,n,r){const o=X(n,r);if(!matchesStableDockerLabels(e.Config?.Labels||{},o))throw new Error(`Docker container ${r} already exists but is not owned by this Testkit product. Remove or rename it before running Testkit.`)}export function resolveLocalPostgresVolumeTarget(e){return pe(e)>=18?fe:le}function pe(e){const r=O(e||"").match(/(?:^|[:@/-])(?:pg|postgres)?(\d{2})(?:\D|$)/i);return r?Number(r[1]):16}async function J(e,n={}){D("database.hostReadinessChecks");const r=Date.now();let o=10;for(;Date.now()-r<j;){const t=Math.max(1,j-(Date.now()-r));if((await L(["exec",e.containerId,"pg_isready","-h","127.0.0.1","-U",e.user,"-d",M,"-p",String(e.containerPort||5432)],`Docker local Postgres readiness probe for ${e.containerName}`,Math.min(LOCAL_POSTGRES_DOCKER_TIMEOUTS_MS.readinessAttempt,t),n.signal).catch(s=>{if(Ce(s))return null;throw s}))?.exitCode===0)return;await he(Math.min(o,t),n.signal),o=Math.min(o*2,se)}throw new Error(`Timed out waiting for local database container ${e.containerName}`)}function Ce(e){const n=f(e)?Reflect.get(e,"result"):void 0;return f(n)&&n.timedOut===!0&&n.cancelled===!1&&n.error===null&&n.terminationError===null&&n.outputLimitExceeded===!1}function X(e,n,r="existing-generation"){return G(e,{generation:r,kind:"postgres-container",name:n,scope:"local-postgres",cachePolicy:"product-cache"})}function k(e,n,r){return G(e,{generation:r,kind:"postgres-volume",name:n,scope:"local-postgres",cachePolicy:"product-cache"})}function he(e,n){return new Promise((r,o)=>{if(n?.aborted){o(Q(n));return}const t=setTimeout(i,e);n?.addEventListener("abort",s,{once:!0});function i(){n?.removeEventListener("abort",s),r()}function s(){clearTimeout(t),o(n?Q(n):new Error("Local Postgres operation aborted"))}})}function Q(e){return e.reason instanceof Error?e.reason:new Error("Local Postgres operation aborted",{cause:e.reason})}function Z(e){if(!f(e))return null;const n=e.Labels;return f(n)?n:null}function Le(e){if(e===null)return null;if(f(e))return{Cmd:Ee(e.Cmd),Image:g(e.Image),Labels:Pe(e.Labels)}}function Pe(e){if(!f(e))return null;const n={};for(const[r,o]of Object.entries(e))typeof o=="string"&&(n[r]=o);return n}function ke(e){if(e===null)return null;if(f(e))return{NetworkMode:g(e.NetworkMode)}}function ye(e){if(e===null)return null;if(P(e))return e.flatMap(n=>f(n)?[{Destination:g(n.Destination),Name:g(n.Name),Type:g(n.Type)}]:[])}function _e(e){if(e===null)return null;if(!f(e))return;const n=e.Ports;if(n===null)return{Ports:null};if(!f(n))return{};const r={};for(const[o,t]of Object.entries(n)){if(t===null){r[o]=null;continue}P(t)&&(r[o]=t.flatMap(i=>{if(!f(i))return[];const s=g(i.HostPort);return i.HostPort!==void 0&&s===void 0?[]:[{HostPort:s}]}))}return{Ports:r}}function xe(e){if(e===null)return null;if(f(e))return{Running:e.Running===null||typeof e.Running=="boolean"?e.Running:void 0}}function g(e){if(e===null||typeof e=="string")return e}function Ee(e){if(e===null)return null;if(P(e))return e.filter(n=>typeof n=="string")}async function y(e,n,r,o){const t=await L(e,n,r,o);if(t.exitCode===0)return t;throw T(n,t)}function T(e,n){const r=n.stderr.trim()||n.stdout.trim(),o=new Error(`${e} failed with exit code ${String(n.exitCode)}${r?`: ${r}`:""}`);return Object.defineProperty(o,"result",{enumerable:!1,value:Object.freeze({...n})}),o}function ee(e,n,r){const o=new Error(`${e} returned malformed Docker inspect output; expected exactly one container record with a non-empty Id`,r===void 0?void 0:{cause:r});return Object.defineProperty(o,"result",{enumerable:!1,value:Object.freeze({...n})}),o}function ne(e){return/\bno such (?:container|object)\b/iu.test(`${e.stderr}
 ${e.stdout}`)}

package/dist/database/naming.js

@@ -1 +1 @@
-import p from"crypto";import f from"fs";import s from"path";import{hasErrorCode as m}from"../kernel/error-serialization.js";export function buildDatabaseUrl(e,t){const r=e.sslMode||"disable";return`postgresql://${encodeURIComponent(e.user)}:${encodeURIComponent(e.password)}@${e.host}:${String(e.port)}/${t}?sslmode=${encodeURIComponent(r)}`}export function buildContainerName(e){const t=u(e);return i("testkit_pg",s.basename(t),[hashString(t,10)],63)}export function buildVolumeName(e,t){const r=u(e);if(!t)throw new Error("Local Postgres volume generation must be non-empty");return i("testkit_pgdata",s.basename(r),[hashString(r,10),hashString(t,32)],128)}export function buildTemplateDatabaseName(e,t){return i("tk_tpl",e,[t.slice(0,16)],63)}export function buildRuntimeDatabaseName(e,t,r){return i("tk",e,[hashString(t,10),r.slice(0,12)],63)}function i(e,t,r,a){const c=`${e}_`,l=slugSegment(t);let n=`_${r.join("_")}`,o=a-c.length-n.length;if(l.length>o&&(n=`_${hashString(t,10)}${n}`,o=a-c.length-n.length),o<1)throw new Error(`Cannot retain the identity suffix within a ${String(a)}-character identifier`);const d=limitIdentifier(l,o);return`${c}${d}${n}`}function u(e){const t=s.resolve(e);try{return f.realpathSync.native(t)}catch(r){if(m(r,"ENOENT"))return t;throw r}}export function hashString(e,t=12){return p.createHash("sha256").update(e).digest("hex").slice(0,t)}export function slugSegment(e){return e.toLowerCase().replace(/[^a-z0-9]+/g,"_").replace(/^_+|_+$/g,"")||"db"}export function limitIdentifier(e,t){return e.length<=t?e:e.slice(0,t)}export function escapeIdentifier(e){return String(e).replace(/"/g,'""')}export function escapeSqlLiteral(e){return String(e).replace(/'/g,"''")}
+import d from"crypto";import p from"fs";import s from"path";import{hasErrorCode as f}from"../kernel/error-serialization.js";export function buildDatabaseUrl(e,t){const r=e.sslMode||"disable";return`postgresql://${encodeURIComponent(e.user)}:${encodeURIComponent(e.password)}@${e.host}:${String(e.port)}/${t}?sslmode=${encodeURIComponent(r)}`}export function buildContainerName(e){const t=canonicalizeProductDir(e);return o("testkit_pg",s.basename(t),[hashString(t,10)],63)}export function buildVolumeName(e,t){const r=canonicalizeProductDir(e);if(!t)throw new Error("Local Postgres volume generation must be non-empty");return o("testkit_pgdata",s.basename(r),[hashString(r,10),hashString(t,32)],128)}export function buildTemplateDatabaseName(e,t){return o("tk_tpl",e,[t.slice(0,16)],63)}export function buildRuntimeDatabaseName(e,t,r){return o("tk",e,[hashString(t,10),r.slice(0,12)],63)}export function buildTaskDatabaseName(e,t,r){return o("tk_task",e,[hashString(t,8),hashString(r,10)],63)}function o(e,t,r,a){const c=`${e}_`,l=slugSegment(t);let n=`_${r.join("_")}`,i=a-c.length-n.length;if(l.length>i&&(n=`_${hashString(t,10)}${n}`,i=a-c.length-n.length),i<1)throw new Error(`Cannot retain the identity suffix within a ${String(a)}-character identifier`);const u=limitIdentifier(l,i);return`${c}${u}${n}`}export function canonicalizeProductDir(e){const t=s.resolve(e);try{return p.realpathSync.native(t)}catch(r){if(f(r,"ENOENT"))return t;throw r}}export function hashString(e,t=12){return d.createHash("sha256").update(e).digest("hex").slice(0,t)}export function slugSegment(e){return e.toLowerCase().replace(/[^a-z0-9]+/g,"_").replace(/^_+|_+$/g,"")||"db"}export function limitIdentifier(e,t){return e.length<=t?e:e.slice(0,t)}export function escapeIdentifier(e){return String(e).replace(/"/g,'""')}export function escapeSqlLiteral(e){return String(e).replace(/'/g,"''")}

package/dist/database/postgres/connection-check.js

@@ -0,0 +1 @@
+import{randomBytes as C}from"node:crypto";import R from"node:fs";import v from"node:net";import M from"node:os";import E from"node:tls";import{NotPostgresError as b,PostgresCheckError as n,cstring as g,errorFields as U,frontendMessage as S,int32 as I,md5PasswordResponse as x,parseBackendMessage as F,scramClientFinal as Q,scramClientFirst as B,scramServerVerified as _,sslRequest as D,startupMessage as N}from"./protocol.js";const A=["disable","allow","prefer","require","verify-ca","verify-full"],O={2:"Kerberos V5",7:"GSSAPI",9:"SSPI"},j=new Set("08004 08P01 0A000 42501 53100 53200 53300 57P01 57P02 57P03".split(" ")),W={disable:[!1],allow:[!1,!0],prefer:[!0,!1],require:[!0],"verify-ca":[!0],"verify-full":[!0]};export function parsePostgresUrl(t){try{return H(t)}catch(e){throw T(e,"could not be read")}}export async function checkPostgresConnection(t,e){e.signal?.throwIfAborted();const r=AbortSignal.timeout(e.timeoutMs),i=e.signal===void 0?r:AbortSignal.any([e.signal,r]);try{const o=parsePostgresUrl(t),c=o.host.startsWith("/")?[!1]:W[o.sslmode];for(const[s,a]of c.entries()){const l={retryable:!1,tls:!1};try{await V(o,a,l,i);return}catch(f){const h=l.retryable&&(o.sslmode!=="prefer"||l.tls);if(s===c.length-1||i.aborted||!h)throw f}}}catch(o){throw e.signal?.aborted?e.signal.reason:r.aborted?new n(`there was no PostgreSQL answer within ${String(e.timeoutMs)} ms`,{cause:T(o,"the check failed unexpectedly")}):T(o,"the check failed unexpectedly")}}function H(t){const e=z(t),r=G(e.query);for(const l of["sslcert","sslkey"])if(r.has(l))throw new n(`sets ${l}, and Testkit's database check presents no client certificate`);if(r.get("channel_binding")==="require")throw new n("requires channel binding, which Testkit's database check does not offer");const i=r.get("host")||e.host;if(i==="")throw new n("names no host");if(i.includes(","))throw new n("names more than one host, and Testkit's database check connects to one");const o=Number(r.get("port")||e.port||"5432");if(!Number.isInteger(o)||o<1||o>65535)throw new n("names a port outside 1 to 65535");const c=r.get("sslrootcert")||null,s=r.get("sslmode")??(c==="system"?"verify-full":"prefer");if(!J(s))throw new n(`sets an sslmode that is not one of ${A.join(", ")}`);if(c==="system"&&s!=="verify-full")throw new n(`sets sslrootcert=system with sslmode=${s}, and libpq allows only verify-full`);if(!i.startsWith("/")&&(s==="verify-ca"||s==="verify-full")&&c===null)throw new n(`sets sslmode=${s} without sslrootcert, a CA file or "system", to verify against`);const a=r.get("user")||e.user||X();return{database:r.get("dbname")||e.database||a,host:i,password:r.get("password")??e.password,port:o,sslmode:s,sslrootcert:c,user:a}}function z(t){const e=/^postgres(?:ql)?:\/\//u.exec(t);if(e===null)throw new n("must be a postgres:// or postgresql:// URL");let r=t.slice(e[0].length),i="",o=null;const c=r.search(/[@/]/u);if(r[c]==="@"){const[u,...m]=r.slice(0,c).split(":");i=y(u),o=m.length===0?null:y(m.join(":")),r=r.slice(c+1)}const s=r.search(/[/?]/u),a=s<0?r:r.slice(0,s);r=s<0?"":r.slice(s);const l=/^\[([^\]]*)\](?::(.*))?$/su.exec(a);if(a.startsWith("[")&&l===null)throw new n("names a malformed IPv6 host");const f=a.lastIndexOf(":"),[h,w]=l?[l[1],l[2]||""]:f<0?[a,""]:[a.slice(0,f),a.slice(f+1)],d=r.indexOf("?");return{database:y((d<0?r:r.slice(0,d)).slice(1)),host:y(h),password:o,port:y(w),query:d<0?"":r.slice(d+1),user:i}}function G(t){const e=new Map,r=t.split("&");r.at(-1)===""&&r.pop();for(const i of r){const[o,c,s]=i.split("=");if(o===""||c===void 0||s!==void 0)throw new n("has a query parameter that is not one name=value pair");e.set(y(o),y(c))}return e}async function V(t,e,r,i){const o=t.host.startsWith("/")?v.connect(`${t.host}/.s.PGSQL.${String(t.port)}`):v.connect(t.port,t.host),c=[o],s=()=>{for(const a of c)a.destroy(new n("The database check stopped"))};i.addEventListener("abort",s,{once:!0});try{let a=L(o);await new Promise((f,h)=>{o.once("connect",f),o.once("error",w=>{h($(w))})});let l=o;if(e){o.write(D());const f=await a.byte();if(f==="S"){r.tls=!0,a.release();try{l=await Z(o,t,c)}catch(h){throw r.retryable=!0,h}a=L(l)}else{if(f!=="N")throw new b;if(t.sslmode!=="allow"&&t.sslmode!=="prefer")throw new n(`TLS failed: the server does not offer TLS, which sslmode=${t.sslmode} needs`)}}l.write(N({user:t.user,database:t.database,application_name:"testkit"})),await K(l,a,t,r,i),l.write(S("Q",g("SELECT 1")));for(let f=await a.message();f.type!=="Z";f=await a.message())if(f.type==="E")throw q(f.body);await new Promise(f=>{l.end(S("X"),()=>{f()})})}finally{i.removeEventListener("abort",s);for(const a of c)a.destroy()}}function Z(t,e,r){const i=e.sslrootcert,o=i!==null&&e.sslmode!=="allow"&&e.sslmode!=="prefer";let c;if(o&&i!=="system")try{c=R.readFileSync(i)}catch(a){return Promise.reject(new n(`TLS failed: sslrootcert could not be read (${k(a,"unreadable")})`))}const s=E.connect({ca:c,checkServerIdentity:(a,l)=>e.sslmode==="verify-full"?E.checkServerIdentity(e.host,l):void 0,rejectUnauthorized:o,socket:t,...v.isIP(e.host)===0?{servername:e.host}:{}});return r.push(s),new Promise((a,l)=>{s.once("secureConnect",()=>{a(s)}),s.on("error",f=>{l(new n(`TLS failed (${k(f,"handshake")})`))})})}async function K(t,e,r,i,o){const c=`n=,r=${C(18).toString("base64")}`;let s=null,a=null,l=!1,f=!1;for(let h=!0;;h=!1){const{body:w,type:d}=await e.message();if(h&&d!=="R"&&d!=="E"&&d!=="v")throw new b;if(d==="E")throw i.retryable=!f,q(w);if(d==="Z"){if(!f)throw new n("authentication failed: the server reported ready before it accepted the client");return}if(d!=="R")continue;if(w.length<4)throw new b;const u=w.readInt32BE(0),m=w.subarray(4);if(f)throw new n("authentication failed: the server asked again after it accepted the client");if(u===0){if(s===10&&!l)throw new n("authentication failed: the server ended SCRAM without proving it holds the password");f=!0}else if(s===null&&u===3)s=u,t.write(S("p",g(P(r))));else if(s===null&&u===5){s=u;const p=x(r.user,P(r),m.subarray(0,4));t.write(S("p",g(p)))}else if(s===null&&u===10){if(s=u,!m.toString("utf8").split("\0").includes("SCRAM-SHA-256"))throw new n("the server offers no SASL mechanism that Testkit's database check supports");const p=Buffer.from(B(c));t.write(S("p",g("SCRAM-SHA-256"),I(p.length),p))}else if(s===10&&u===11&&a===null){const p=await Q(P(r),c,m.toString("utf8"),o);a=p.serverSignature,t.write(S("p",Buffer.from(p.clientFinal)))}else if(s===10&&u===12&&a!==null&&!l){if(!_(m.toString("utf8"),a))throw new n("authentication failed: the server's SCRAM signature does not verify");l=!0}else throw s===null&&u!==11&&u!==12?new n(`the server asks for ${O[u]??`method ${String(u)}`} authentication, which Testkit's database check does not support`):new n("authentication failed: the server sent authentication requests out of order")}}function L(t){let e=Buffer.alloc(0),r=null,i=()=>{};const o=s=>{e=Buffer.concat([e,s]),i()};t.on("data",o),t.on("error",s=>{r??=$(s),i()}),t.on("close",()=>{r??=new n("the server closed the connection before startup finished"),i()});const c=async()=>{if(r!==null)throw r;await new Promise(s=>{i=s})};return{async byte(){for(;e.length===0;)await c();const s=e.toString("latin1",0,1);return e=e.subarray(1),s},async message(){for(;;){const s=F(e);if(s!==null)return e=s.rest,s.message;await c()}},release(){if(e.length>0)throw new b;t.off("data",o)}}}function q(t){const e=U(t).C;return e==="28P01"||e==="28000"?new n(`authentication failed (SQLSTATE ${e})`):e==="3D000"?new n("the database does not exist (SQLSTATE 3D000)"):new n(e!==void 0&&j.has(e)?`the server refused the connection (SQLSTATE ${e})`:"the server refused the connection")}function $(t){return new n(`the connection failed (${k(t,"socket error")})`)}function k(t,e){return t instanceof Error&&"code"in t&&typeof t.code=="string"?t.code:e}function T(t,e){return t instanceof n?t:new n(e)}function P(t){if(t.password===null)throw new n("authentication failed: the server asks for a password the URL lacks");return t.password}function X(){try{return M.userInfo().username}catch{throw new n("names no user, and the operating system's user name is unavailable")}}function J(t){return A.some(e=>e===t)}function y(t){if(/%(?![0-9A-Fa-f]{2})/u.test(t))throw new n("holds a malformed percent-encoding");if(/%00|\0/u.test(t))throw new n("holds a NUL");try{return decodeURIComponent(t)}catch{throw new n("holds percent-encoded bytes that are not UTF-8, and Testkit's database check reads only UTF-8")}}

package/dist/database/postgres/protocol.js

@@ -0,0 +1,2 @@
+import{createHash as a,createHmac as C,pbkdf2 as T,timingSafeEqual as R}from"node:crypto";import{once as B}from"node:events";import{promisify as A}from"node:util";import{Worker as x}from"node:worker_threads";const I=196608,O=80877103,w=1024*1024,E="n,,",S=1e7,$=1e5,D=`const { parentPort, workerData: input } = require("node:worker_threads");
+parentPort.postMessage(require("node:crypto").pbkdf2Sync(input.password, input.salt, input.iterations, 32, "sha256"));`,c="\\p{Script=Hebrew}\\p{Script=Arabic}\\p{Script=Syriac}\\p{Script=Thaana}\\p{Script=Nko}",N=/[\u00A0\u1680\u2000-\u200B\u202F\u205F\u3000]/gu,k=/\u00AD|\u034F|\u1806|[\u180B-\u180D]|\u200C|\u200D|\u2060|[\uFE00-\uFE0F]|\uFEFF/gu,y=/[\p{Cc}\p{Cn}\p{Co}\p{Cs}\u0340\u0341\u06DD\u070F\u180E\u200E\u200F\u2028-\u202E\u2061-\u2063\u206A-\u206F\u2FF0-\u2FFB\uFFF9-\uFFFD\u{1D173}-\u{1D17A}\u{E0001}\u{E0020}-\u{E007F}]/u,M=new RegExp(`[${c}]`,"u"),P=new RegExp(`(?![${c}])\\p{L}`,"u"),b=new RegExp(`^[${c}](?:.*[${c}])?$`,"su"),v=A(T);export class PostgresCheckError extends Error{name="PostgresCheckError"}export class NotPostgresError extends PostgresCheckError{constructor(){super("the server did not answer as PostgreSQL")}}export function sslRequest(){return Buffer.concat([int32(8),int32(O)])}export function startupMessage(t){const e=Buffer.concat([int32(I),...Object.entries(t).flatMap(([r,n])=>[cstring(r),cstring(n)]),Buffer.from([0])]);return Buffer.concat([int32(4+e.length),e])}export function frontendMessage(t,...e){const r=Buffer.concat(e);return Buffer.concat([Buffer.from(t,"latin1"),int32(4+r.length),r])}export function cstring(t){return Buffer.concat([Buffer.from(t,"utf8"),Buffer.from([0])])}export function int32(t){const e=Buffer.alloc(4);return e.writeInt32BE(t),e}export function parseBackendMessage(t){if(t.length<5)return null;const e=t.readInt32BE(1);if(e<4||e>w)throw new NotPostgresError;return t.length<1+e?null:{message:{type:String.fromCharCode(t[0]),body:t.subarray(5,1+e)},rest:t.subarray(1+e)}}export function errorFields(t){const e={};for(let r=0;r<t.length&&t[r]!==0;){const n=t.indexOf(0,r+1);if(n<0)break;e[String.fromCharCode(t[r])]=t.toString("utf8",r+1,n),r=n+1}return e}export function md5PasswordResponse(t,e,r){const n=a("md5").update(e).update(t).digest("hex");return`md5${a("md5").update(n).update(r).digest("hex")}`}export function scramClientFirst(t){return`${E}${t}`}export async function scramClientFinal(t,e,r,n){const o=g(r),s=g(e).r??"",u=Number(o.i);if(!o.r?.startsWith(s)||!o.s||!Number.isSafeInteger(u)||u<1)throw new PostgresCheckError("the server sent a malformed SCRAM challenge");if(u>S)throw new PostgresCheckError(`the server asks for ${String(u)} SCRAM iterations, more than the ${String(S)} Testkit's database check computes`);const f=await H(saslprep(t),Buffer.from(o.s,"base64"),u,n),p=i(f,"Client Key"),l=`c=${Buffer.from(E).toString("base64")},r=${o.r}`,m=`${e},${r},${l}`,d=i(a("sha256").update(p).digest(),m),_=Buffer.from(p.map((h,F)=>h^d[F]));return{clientFinal:`${l},p=${_.toString("base64")}`,serverSignature:i(i(f,"Server Key"),m)}}export function scramServerVerified(t,e){const[r,...n]=t.split(",");if(!r.startsWith("v=")||n.some(s=>/^[ev]=/u.test(s)))return!1;const o=Buffer.from(r.slice(2),"base64");return o.length===e.length&&R(o,e)}export function saslprep(t){if(/^[\0-\x7F]*$/u.test(t))return t;const e=t.replace(N," ").replace(k,"").normalize("NFKC");return(!M.test(e)||!P.test(e)&&b.test(e))&&!y.test(e)?e:t}async function H(t,e,r,n){if(n?.throwIfAborted(),r<=$)return v(t,e,r,32,"sha256");const o=new x(D,{eval:!0,workerData:{iterations:r,password:t,salt:e}});try{const[s]=await B(o,"message",{signal:n});return Buffer.from(s)}finally{o.terminate()}}function g(t){return Object.fromEntries(t.split(",").map(e=>[e.slice(0,1),e.slice(2)]))}function i(t,e){return C("sha256",t).update(e).digest()}

package/dist/database/schema-operations.js

@@ -1 +1 @@
-import u from"fs";import{resolveContainedTestkitStateDirectory as f}from"../process/runs/product-state.js";import{makeTempDir as p,removeTempDir as h}from"../process/files/temp-dir.js";import{cleanupOrphanedLocalInfrastructure as y,destroyRuntimeDatabase as l,provisionDatabase as g}from"./index.js";import{forceRefreshSourceSchemaCache as S}from"./schema-source.js";export async function verifyDatabaseSchema(r,o,t={}){await m(r,"verify",o,t,async(e,s)=>{for(const a of e.configs)await s(a)})}export async function refreshDatabaseSchema(r,o,t={}){return m(r,"refresh",o,t,async(e,s)=>{for(const a of e.configs){if(a.name===e.target.name)break;await s(a)}return S(e.target,null,{reporter:t.progress?.reporter||null,setupRegistry:t.progress?.setupRegistry||null,signal:t.signal})})}async function m(r,o,t,e,s){const a=v(r,o),c=[];try{const n=await t(a.path);return await s(n,async i=>{i.testkit.database&&(c.push(i.stateDir),await g(i,{progress:e.progress,signal:e.signal,skipSchemaSourceVerify:e.skipSchemaSourceVerify}))})}finally{for(const n of c.reverse())await l({productDir:r,stateDir:n}).catch(()=>{});await y(r).catch(()=>{}),a.remove()}}function v(r,o){const t=f(r);u.mkdirSync(t,{recursive:!0});const e=f(r),s=p(`_schema-${o}-`,{parentDir:e});let a=!1;return{path:s,remove(){a||(a=!0,h(s))}}}
+import l from"fs";import{resolveContainedTestkitStateDirectory as p}from"../process/runs/product-state.js";import{makeTempDir as y,removeTempDir as g}from"../process/files/temp-dir.js";import{cleanupOrphanedLocalInfrastructure as S,destroyRuntimeDatabase as b,provisionDatabase as v}from"./index.js";import{forceRefreshSourceSchemaCache as d}from"./schema-source.js";import{bindDatabaseUrl as D,lendDatabases as w}from"./bindings.js";import{withDatabaseBindings as R}from"../steps/index.js";export async function verifyDatabaseSchema(r,o,t={}){await h(r,"verify",o,t,async(e,s)=>{for(const a of e.configs)await s(a)})}export async function refreshDatabaseSchema(r,o,t={}){return h(r,"refresh",o,t,async(e,s,a)=>{for(const i of e.configs){if(i.name===e.target.name)break;await s(i)}return d(a(e.target),null,{reporter:t.progress?.reporter||null,setupRegistry:t.progress?.setupRegistry||null,signal:t.signal})})}async function h(r,o,t,e,s){const a=k(r,o),i=[],m=new Map;try{const c=await t(a.path),f=n=>R(n,w(c.configs,m));return await s(c,async n=>{if(!n.testkit.database)return;i.push(n.stateDir);const u=await v(f(n),{progress:e.progress,signal:e.signal,skipSchemaSourceVerify:e.skipSchemaSourceVerify});u&&m.set(n.name,D(u.url))},f)}finally{for(const c of i.reverse())await b({productDir:r,stateDir:c}).catch(()=>{});await S(r).catch(()=>{}),a.remove()}}function k(r,o){const t=p(r);l.mkdirSync(t,{recursive:!0});const e=p(r),s=y(`_schema-${o}-`,{parentDir:e});let a=!1;return{path:s,remove(){a||(a=!0,g(s))}}}

package/dist/database/schema-source.js

@@ -1,3 +1,3 @@
-import{recordWork as l}from"../kernel/work-metrics.js";import o from"fs";import s from"path";import{createRequire as J}from"node:module";import{collectRepoState as V,summarizeRepoStateForMetadata as _}from"../repo/state.js";import{findDatabasePlaceholders as X,resolveExecutionEnvValues as Z}from"../steps/index.js";import{dumpPostgresSchemaToFile as G,captureTemplateSnapshotText as Q,resolvePgDumpClientImage as Y,runTemplateStep as ee,sanitizeSnapshotText as re}from"./template-steps.js";import{getSourceSchemaRefreshLockPath as te,withSourceSchemaRefreshLock as ae}from"./source-refresh-lock.js";import{resolveSourceSchemaDumpUrl as ce}from"./source-url.js";import{makeTempDir as ne,removeTempDir as se}from"../process/files/temp-dir.js";import{requireContainedDatabaseStateDirectory as k,resolveContainedDatabaseStateDirectory as D}from"./state.js";import{isNullableString as ie,isUnknownRecord as f}from"../kernel/unknown-values.js";const K=J(import.meta.url);let P;function oe(){if(P)return P;const e=K.resolve("diff/package.json"),t=JSON.parse(o.readFileSync(e,"utf8"))?.exports?.["."]?.import?.default;if(typeof t!="string"||!t.startsWith("./"))throw new Error("The diff package must declare a local ESM import entry");const c=s.dirname(e),a=s.resolve(c,t),n=s.relative(c,a);if(!n||n===".."||n.startsWith(`..${s.sep}`)||s.isAbsolute(n))throw new Error("The diff package ESM import entry must stay within its package directory");return P=K(a)}const U="db",$="source-schemas",b="source-schema.sql",E="source-schema.meta.json",he="index.json",M=20,y=String;export function getSourceSchemaRootDir(e){return D(e.productDir,U,e.name,$)}export async function getSourceSchemaCachePath(e,r={}){return(await resolveSourceSchemaCacheLocation(e,r)).cachePath}export async function resolveSourceSchemaCacheLocation(e,r={}){const t=r.repoState||await V(e.productDir,{fingerprints:e.testkit?.fingerprints}),c=getSourceSchemaRootDir(e),a=D(e.productDir,U,e.name,$,...t.cacheKey.split("/").map(w));return{rootDir:c,cacheDir:a,cachePath:s.join(a,b),metadataPath:s.join(a,E),indexPath:s.join(c,he),cacheKey:t.cacheKey,cacheKind:t.kind,repoState:t}}export async function resolveSourceSchemaState(e,r={}){const t=e.testkit.database?.sourceSchema||null;if(!t)return{active:!1};const c=await resolveSourceSchemaCacheLocation(e,r),a=c.cachePath,n=o.existsSync(a);n&&x(a);const i=r.env||process.env,h=t.kind==="env"?[t.env]:[j(e.name),"TESTKIT_SCHEMA_SOURCE_DATABASE_URL"];xe(e,h);const u=Z(e,[...h,"CI"],i),m=h.find(z=>{const R=u[z];return typeof R=="string"&&R.trim().length>0})||null,S=m?u[m]:void 0,p=typeof S=="string"?S.trim():null;return t.kind==="env"||!!p||n?{active:!0,cachePath:a,metadataPath:c.metadataPath,indexPath:c.indexPath,rootDir:c.rootDir,cacheDir:c.cacheDir,cacheKey:c.cacheKey,cacheKind:c.cacheKind,repoState:c.repoState,envName:m,sourceUrl:p,sourceSchema:t,cacheExists:n,refreshed:!1,ci:u.CI==="true",unavailableMode:Ae(t.unavailable,i)}:{active:!1,cachePath:a}}export async function prepareSourceSchemaCache(e,r={}){r.signal?.throwIfAborted();const t=await resolveSourceSchemaState(e,r);if(!t.active)return t;if(B(t)){if(Se(t))try{const a=await L(e,t,r),n={...t,refreshed:!0,cacheExists:!0,refreshInfo:a};return v(e,n,{refreshed:!0}),n}catch(a){r.signal?.throwIfAborted();const n=ue(e,t,a,r);if(n)return n;throw a}return v(e,t),r.setupRegistry?.recordCached({config:e,stage:"source-schema",kind:"database-source-schema",summary:"source schema cache hit"}),t}if(t.cacheExists&&t.unavailableMode==="warn-cache")return v(e,t),r.setupRegistry?.recordCached({config:e,stage:"source-schema",kind:"database-source-schema",summary:"source unavailable; using cached source schema"}),t;const c=t.sourceSchema.kind==="env"?t.sourceSchema.env:`${j(e.name)} or TESTKIT_SCHEMA_SOURCE_DATABASE_URL`;throw new Error(`Source schema database URL is unavailable for service "${e.name}". Set ${c}.`)}function ue(e,r,t,c={}){if(r.unavailableMode!=="warn-cache")return null;const a=me(e,r);if(!a)return null;const n={...r,...a,cacheExists:!0,refreshed:!1,refreshError:Re(t)};return c.setupRegistry?.recordCached({config:e,stage:"source-schema",kind:"database-source-schema",summary:`source unavailable; using cached source schema: ${s.relative(e.productDir,a.cachePath)}`}),n}function me(e,r){const t=F(e,r,{cachePath:r.cachePath,metadataPath:r.metadataPath,cacheKey:r.cacheKey,cacheKind:r.cacheKind});if(t)return t;const c=O(r.indexPath);c.sort((a,n)=>Date.parse(n.lastUsedAt||n.refreshedAt||"0")-Date.parse(a.lastUsedAt||a.refreshedAt||"0"));for(const a of c){if(!a.cachePath)continue;const n=s.resolve(e.productDir,a.cachePath),i=F(e,r,{cachePath:n,metadataPath:s.join(s.dirname(n),E),cacheKey:a.cacheKey,cacheKind:a.kind||"unknown"});if(i)return i}return null}function F(e,r,t){const c=s.resolve(t.cachePath);if(s.basename(c)!==b)return null;const a=k(e.productDir,s.dirname(c),`Service "${e.name}" source schema cache directory`),n=s.join(a,b),i=s.resolve(r.rootDir);if(n!==i&&!n.startsWith(`${i}${s.sep}`)||!o.existsSync(n))return null;const h=o.lstatSync(n);if(h.isSymbolicLink()||!h.isFile())throw new Error(`Refusing unsafe source schema cache file at ${n}`);return{cachePath:n,metadataPath:s.join(a,E),cacheDir:a,cacheKey:t.cacheKey,cacheKind:t.cacheKind,indexPath:r.indexPath,rootDir:r.rootDir}}export async function forceRefreshSourceSchemaCache(e,r,t={}){const c=await resolveSourceSchemaState(e,t);if(!c.active||!B(c)){const i=r?.active?r.envName:null,h=r?.active&&r.sourceSchema.kind==="env"?r.sourceSchema.env:null,u=i||h||"source schema env";throw new Error(`Cannot refresh source schema for service "${e.name}" because ${u} is unavailable.`)}const a=await L(e,c,t),n={...c,refreshed:!0,cacheExists:!0,refreshInfo:a};return v(e,n,{refreshed:!0}),n}export async function applySourceSchemaCache(e,r,t,c={}){if(!t?.active)return!1;if(!o.existsSync(t.cachePath))throw new Error(`Missing source schema cache for service "${e.name}": ${t.cachePath}`);const a={kind:"sql-file",path:s.relative(e.productDir,t.cachePath).split(s.sep).join("/"),cwd:null,inputs:[]};return l("schema.sourceReplays"),await ee(e,"source-schema",a,0,r,c),!0}export async function verifyLocalSchemaMatchesSource(e,r,t,c={}){if(!t?.active)return{status:"disabled"};if(!t.sourceSchema.verify||c.skipSchemaSourceVerify)return c.setupRegistry?.recordCached({config:e,stage:"source-schema:verify",kind:"database-source-schema",summary:"source schema verification skipped"}),{status:"skipped"};De(e);const a=pe(t.cachePath);l("schema.verificationDumps");const n=await Q(e,r,{image:await c.resolveLocalSnapshotImage?.(),ownedContainer:c.ownedContainer||null,reporter:c.reporter||null,signal:c.signal});return l("schema.comparisons"),l("schema.bytesCompared",Buffer.byteLength(a)+Buffer.byteLength(n)),n===a?{status:"matched"}:{status:"mismatch",diagnostics:await be(e,t,a,n)}}export function createSourceSchemaMismatchError(e,r,t){const c=[`Local schema replay does not match source schema for service "${e.name}".`,`Source cache: ${s.relative(e.productDir,r.cachePath)}`];return t?.status==="mismatch"&&c.push(`Diff: ${s.relative(e.productDir,t.diagnostics.diffPath)}`),new Error(c.join(`
-`))}export async function appendSourceSchemaCacheToHash(e,r,t=null){if(!(r.testkit.database?.sourceSchema||null))return;const a=t?.cachePath||await getSourceSchemaCachePath(r),n=t?.active&&t.cacheKey?t.cacheKey:s.relative(getSourceSchemaRootDir(r),s.dirname(a));if(e.update(`source-schema-key:${n}`),e.update(`source-schema-cache:${s.relative(r.productDir,a)}`),!o.existsSync(a)){e.update(":missing");return}const i=o.statSync(a);e.update(`:${i.size.toString()}:${i.mtimeMs.toString()}`);const h=o.readFileSync(a);l("schema.cacheHashFilesRead"),l("schema.cacheHashBytesRead",h.length),e.update(h)}async function L(e,r,t={}){const c=t.setupRegistry,a=c?.start({config:e,stage:"source-schema:refresh",kind:"database-source-schema",summary:`source schema refresh: ${s.relative(e.productDir,r.cachePath)}`});try{const n=await ae(te(r.cachePath),async({waited:h,requestedAt:u})=>{const m=fe(r,u);if(m)return{reusedExistingRefresh:!0,waitedForLock:h,metadata:m};const S=await le(e,r.sourceUrl,r.cachePath,{reporter:t.reporter||null,logRecord:a?._logRecord||null,env:t.env||process.env,signal:t.signal}),p=de(e,r,S);return ve(r.metadataPath,p),{reusedExistingRefresh:!1,waitedForLock:h,metadata:p}},{signal:t.signal}),i=a&&c?c.finish(a,{status:"passed",summary:`source schema refresh: ${s.relative(e.productDir,r.cachePath)}`}):null;return i&&t.reporter?.setupOperationFinished?.(i),n}catch(n){const i=a?c?.finish(a,{status:"failed",summary:`source schema refresh: ${s.relative(e.productDir,r.cachePath)}`,error:_e(n)}):null;throw i&&t.reporter?.setupOperationFinished?.(i),n}}async function le(e,r,t,c={}){const a=ce(r);o.mkdirSync(s.dirname(t),{recursive:!0});const n=ne(".source-schema-",{parentDir:s.dirname(t)}),i=s.join(n,s.basename(t));try{const h=await Y(e,a.dumpUrl,{env:c.env||process.env,pgApplicationName:g(e.name),signal:c.signal});return l("schema.sourceDumps"),await G(e,i,a.dumpUrl,{...c,image:h,pgApplicationName:g(e.name)}),o.renameSync(i,t),{resolution:a,pgDump:{args:["--schema-only","--no-owner","--no-privileges"],applicationName:g(e.name),image:h}}}finally{se(n)}}function de(e,r,t){return{refreshedAt:new Date().toISOString(),serviceName:e.name,envName:r.envName,cacheKey:r.cacheKey,cacheKind:r.cacheKind,cachePath:s.relative(e.productDir,r.cachePath),repo:_(r.repoState),sourceUrl:t.resolution.metadata,pgDump:t.pgDump}}function fe(e,r){if(!o.existsSync(e.cachePath))return null;const t=A(e.metadataPath);if(!Ue(t))return null;const c=Date.parse(t.refreshedAt);return!Number.isFinite(c)||c<r?null:t}function g(e){return`testkit:schema-source:${e.replace(/[^a-zA-Z0-9._:-]+/g,"-").slice(0,24)||"service"}`}function pe(e){const r=o.readFileSync(e);return l("schema.cacheFilesRead"),l("schema.cacheBytesRead",r.length),re(r.toString("utf8"))}function Se(e){if(!e.cacheExists)return!0;if(e.sourceSchema.refresh.mode==="auto")return e.ci;if(e.sourceSchema.refresh.mode==="ttl"){const r=C(e.metadataPath),t=r?Date.parse(r):0;return!Number.isFinite(t)||t<=0?!0:Date.now()-t>=e.sourceSchema.refresh.ttlSeconds*1e3}return!0}function v(e,r,t={}){if(!r?.active)return;const c=new Date().toISOString(),a=O(r.indexPath).filter(h=>h.cacheKey!==r.cacheKey),n=C(r.metadataPath);a.push({cacheKey:r.cacheKey,kind:r.cacheKind,commitSha:r.repoState.commitSha||null,branch:r.repoState.branch||null,detached:r.repoState.detached,dirty:r.repoState.dirty,dirtyFingerprint:r.repoState.dirtyFingerprint||null,contentFingerprint:r.repoState.contentFingerprint||null,remoteUrl:r.repoState.remoteUrl||null,repository:r.repoState.repository,cachePath:s.relative(e.productDir,r.cachePath),refreshedAt:t.refreshed?c:n,lastUsedAt:c});const i=ye(e,r,a);N(r.indexPath,{version:1,entries:i})}function ye(e,r,t){if(t.length<=M)return t;const c=[...t].sort((n,i)=>Date.parse(i.lastUsedAt||"0")-Date.parse(n.lastUsedAt||"0")),a=new Set(c.slice(0,M).map(n=>n.cacheKey));a.add(r.cacheKey);for(const n of t){if(a.has(n.cacheKey))continue;const i=n.cachePath?s.join(e.productDir,n.cachePath):null,h=i?s.resolve(i):null,u=s.resolve(r.rootDir);if(!i||!h||h!==u&&!h.startsWith(`${u}${s.sep}`))continue;const m=k(e.productDir,s.dirname(i),`Service "${e.name}" pruned source schema cache directory`);o.rmSync(m,{recursive:!0,force:!0})}return t.filter(n=>a.has(n.cacheKey))}function ve(e,r){I(e,r)}function N(e,r){I(e,r)}function I(e,r){o.mkdirSync(s.dirname(e),{recursive:!0}),x(e),o.writeFileSync(e,Ce(r))}function A(e){if(!e||!o.existsSync(e))return null;x(e);try{return JSON.parse(o.readFileSync(e,"utf8"))}catch{return null}}function T(e){return D(e.productDir,"results","schema")}function x(e){if(!o.existsSync(e))return;const r=o.lstatSync(e);if(r.isSymbolicLink()||!r.isFile())throw new Error(`Refusing unsafe source schema state file at ${e}`)}function we(e){return`${w(e.runtimeLabel||e.name)}__${w(e.name)}`}function De(e){const r=T(e);if(!o.existsSync(r))return;const t=w(e.name);for(const c of o.readdirSync(r))Pe(c,t)&&o.rmSync(s.join(r,c),{force:!0})}function Pe(e,r){for(const t of["__source-schema.sql","__local-replay-schema.sql","__schema.diff","__schema.meta.json"])if(e.endsWith(t))return e.slice(0,-t.length).endsWith(`__${r}`);return!1}async function be(e,r,t,c){const a=T(e);o.mkdirSync(a,{recursive:!0});const n=we(e),i=s.join(a,`${n}__source-schema.sql`),h=s.join(a,`${n}__local-replay-schema.sql`),u=s.join(a,`${n}__schema.diff`),m=s.join(a,`${n}__schema.meta.json`);return o.writeFileSync(i,t),o.writeFileSync(h,c),o.writeFileSync(u,await ge(i,h)),N(m,Ee(e,r)),{sourceCachePath:r.cachePath,sourcePath:i,localPath:h,diffPath:u,metaPath:m}}function Ee(e,r){const t=C(r.metadataPath);return{version:1,createdAt:new Date().toISOString(),serviceName:e.name,runtimeLabel:e.runtimeLabel||e.name,sourceSchema:{envName:r.envName||null,cacheKey:r.cacheKey||null,cacheKind:r.cacheKind||null,cachePath:s.relative(e.productDir,r.cachePath),refreshedAt:t},repo:_(r.repoState)}}function ge(e,r){return new Promise(t=>{t(buildUnifiedDiffText(o.readFileSync(e,"utf8"),o.readFileSync(r,"utf8"),e,r))})}export function buildUnifiedDiffText(e,r,t="source",c="target"){if(e===r)return"";const{createTwoFilesPatch:a}=oe();return a(t,c,y(e),y(r),"","",{context:3})}function Ae(e,r){return e==="fail"||e==="warn-cache"?e:r.CI==="true"?"fail":"warn-cache"}function j(e){return`TESTKIT_${e.toUpperCase().replace(/[^A-Z0-9]+/g,"_")}_SCHEMA_SOURCE_DATABASE_URL`}function xe(e,r){const t={...e.testkit.serviceEnv,...e.testkit.local?.env};for(const c of r){const a=t[c];if(typeof a!="string")continue;const n=X(a).find(i=>(i.serviceName??e.name)===e.name);if(n)throw new Error(`Service "${e.name}" env ${c} uses ${n.placeholder}, which is the database the source schema verifies. Point it at another service's database or an external database URL.`)}}function w(e){return e.trim().toLowerCase().replace(/[^a-z0-9._-]+/g,"-").replace(/^-+|-+$/g,"")||"schema"}function O(e){const r=A(e);return!f(r)||!Array.isArray(r.entries)?[]:r.entries.filter(ke)}function C(e){const r=A(e);return f(r)&&typeof r.refreshedAt=="string"?r.refreshedAt:null}function Ce(e){return`${y(JSON.stringify(e,null,2))}
-`}function Re(e){const r=H(e,"message");return!!r?r:y(e)}function _e(e){const r=H(e,"message");return!!r?r:e}function H(e,r){if(!(e===null||typeof e!="object"&&typeof e!="function"))return Reflect.get(e,r)}function B(e){return!!e.sourceUrl}function ke(e){return!f(e)||typeof e.cacheKey!="string"||e.cacheKey.length===0?!1:d(e.branch)&&d(e.cachePath)&&d(e.commitSha)&&d(e.contentFingerprint)&&W(e.detached)&&W(e.dirty)&&d(e.dirtyFingerprint)&&d(e.kind)&&d(e.lastUsedAt)&&d(e.refreshedAt)&&d(e.remoteUrl)&&Ke(e.repository)}function Ke(e){return e==null||f(e)&&typeof e.host=="string"&&typeof e.owner=="string"&&typeof e.name=="string"}function Ue(e){return f(e)&&typeof e.refreshedAt=="string"&&(e.sourceUrl===void 0||$e(e.sourceUrl))}function $e(e){return f(e)&&typeof e.originalHost=="string"&&q(e.originalClassification)&&typeof e.resolvedHost=="string"&&q(e.resolvedClassification)&&typeof e.rewritten=="boolean"}function q(e){return e==="neon-pooler"||e==="neon-direct"||e==="unsupported-pooler"||e==="unknown-direct"}function d(e){return e===void 0||ie(e)}function W(e){return e===void 0||typeof e=="boolean"}
+import{recordWork as l}from"../kernel/work-metrics.js";import o from"fs";import s from"path";import{createRequire as z}from"node:module";import{collectRepoState as J,summarizeRepoStateForMetadata as K}from"../repo/state.js";import{findDatabasePlaceholders as V,resolveExecutionEnvValues as X}from"../steps/index.js";import{sourceSchemaEnvNames as F}from"./source-schema-env.js";import{dumpPostgresSchemaToFile as G,captureTemplateSnapshotText as Z,resolvePgDumpClientImage as Q,runTemplateStep as Y,sanitizeSnapshotText as ee}from"./template-steps.js";import{getSourceSchemaRefreshLockPath as re,withSourceSchemaRefreshLock as te}from"./source-refresh-lock.js";import{resolveSourceSchemaDumpUrl as ae}from"./source-url.js";import{makeTempDir as ce,removeTempDir as ne}from"../process/files/temp-dir.js";import{isNullableString as se,isUnknownRecord as f}from"../kernel/unknown-values.js";import{requireContainedTestkitStateDirectory as _,resolveContainedTestkitStateDirectory as D}from"../process/runs/product-state.js";const $=z(import.meta.url);let P;function ie(){if(P)return P;const e=$.resolve("diff/package.json"),t=JSON.parse(o.readFileSync(e,"utf8"))?.exports?.["."]?.import?.default;if(typeof t!="string"||!t.startsWith("./"))throw new Error("The diff package must declare a local ESM import entry");const c=s.dirname(e),a=s.resolve(c,t),n=s.relative(c,a);if(!n||n===".."||n.startsWith(`..${s.sep}`)||s.isAbsolute(n))throw new Error("The diff package ESM import entry must stay within its package directory");return P=$(a)}const M="db",U="source-schemas",b="source-schema.sql",g="source-schema.meta.json",oe="index.json",N=20,y=String;export function getSourceSchemaRootDir(e){return D(e.productDir,M,e.name,U)}export async function getSourceSchemaCachePath(e,r={}){return(await resolveSourceSchemaCacheLocation(e,r)).cachePath}export async function resolveSourceSchemaCacheLocation(e,r={}){const t=r.repoState||await J(e.productDir,{fingerprints:e.testkit?.fingerprints}),c=getSourceSchemaRootDir(e),a=D(e.productDir,M,e.name,U,...t.cacheKey.split("/").map(w));return{rootDir:c,cacheDir:a,cachePath:s.join(a,b),metadataPath:s.join(a,g),indexPath:s.join(c,oe),cacheKey:t.cacheKey,cacheKind:t.kind,repoState:t}}export async function resolveSourceSchemaState(e,r={}){const t=e.testkit.database?.sourceSchema||null;if(!t)return{active:!1};const c=await resolveSourceSchemaCacheLocation(e,r),a=c.cachePath,n=o.existsSync(a);n&&R(a);const i=r.env||process.env,h=F(e);Ee(e,h);const u=X(e,[...h,"CI"],i),m=h.find(W=>{const A=u[W];return typeof A=="string"&&A.trim().length>0})||null,S=m?u[m]:void 0,p=typeof S=="string"?S.trim():null;return t.kind==="env"||!!p||n?{active:!0,cachePath:a,metadataPath:c.metadataPath,indexPath:c.indexPath,rootDir:c.rootDir,cacheDir:c.cacheDir,cacheKey:c.cacheKey,cacheKind:c.cacheKind,repoState:c.repoState,envName:m,sourceUrl:p,sourceSchema:t,cacheExists:n,refreshed:!1,ci:u.CI==="true",unavailableMode:xe(t.unavailable,i)}:{active:!1,cachePath:a}}export async function prepareSourceSchemaCache(e,r={}){r.signal?.throwIfAborted();const t=await resolveSourceSchemaState(e,r);if(!t.active)return t;if(H(t)){if(pe(t))try{const a=await j(e,t,r),n={...t,refreshed:!0,cacheExists:!0,refreshInfo:a};return v(e,n,{refreshed:!0}),n}catch(a){r.signal?.throwIfAborted();const n=he(e,t,a,r);if(n)return n;throw a}return v(e,t),r.setupRegistry?.recordCached({config:e,stage:"source-schema",kind:"database-source-schema",summary:"source schema cache hit"}),t}if(t.cacheExists&&t.unavailableMode==="warn-cache")return v(e,t),r.setupRegistry?.recordCached({config:e,stage:"source-schema",kind:"database-source-schema",summary:"source unavailable; using cached source schema"}),t;const c=F(e).join(" or ");throw new Error(`Source schema database URL is unavailable for service "${e.name}". Set ${c}.`)}function he(e,r,t,c={}){if(r.unavailableMode!=="warn-cache")return null;const a=ue(e,r);if(!a)return null;const n={...r,...a,cacheExists:!0,refreshed:!1,refreshError:Re(t)};return c.setupRegistry?.recordCached({config:e,stage:"source-schema",kind:"database-source-schema",summary:`source unavailable; using cached source schema: ${s.relative(e.productDir,a.cachePath)}`}),n}function ue(e,r){const t=L(e,r,{cachePath:r.cachePath,metadataPath:r.metadataPath,cacheKey:r.cacheKey,cacheKind:r.cacheKind});if(t)return t;const c=O(r.indexPath);c.sort((a,n)=>Date.parse(n.lastUsedAt||n.refreshedAt||"0")-Date.parse(a.lastUsedAt||a.refreshedAt||"0"));for(const a of c){if(!a.cachePath)continue;const n=s.resolve(e.productDir,a.cachePath),i=L(e,r,{cachePath:n,metadataPath:s.join(s.dirname(n),g),cacheKey:a.cacheKey,cacheKind:a.kind||"unknown"});if(i)return i}return null}function L(e,r,t){const c=s.resolve(t.cachePath);if(s.basename(c)!==b)return null;const a=_(e.productDir,s.dirname(c),`Service "${e.name}" source schema cache directory`),n=s.join(a,b),i=s.resolve(r.rootDir);if(n!==i&&!n.startsWith(`${i}${s.sep}`)||!o.existsSync(n))return null;const h=o.lstatSync(n);if(h.isSymbolicLink()||!h.isFile())throw new Error(`Refusing unsafe source schema cache file at ${n}`);return{cachePath:n,metadataPath:s.join(a,g),cacheDir:a,cacheKey:t.cacheKey,cacheKind:t.cacheKind,indexPath:r.indexPath,rootDir:r.rootDir}}export async function forceRefreshSourceSchemaCache(e,r,t={}){const c=await resolveSourceSchemaState(e,t);if(!c.active||!H(c)){const i=r?.active?r.envName:null,h=r?.active&&r.sourceSchema.kind==="env"?r.sourceSchema.env:null,u=i||h||"source schema env";throw new Error(`Cannot refresh source schema for service "${e.name}" because ${u} is unavailable.`)}const a=await j(e,c,t),n={...c,refreshed:!0,cacheExists:!0,refreshInfo:a};return v(e,n,{refreshed:!0}),n}export async function applySourceSchemaCache(e,r,t,c={}){if(!t?.active)return!1;if(!o.existsSync(t.cachePath))throw new Error(`Missing source schema cache for service "${e.name}": ${t.cachePath}`);const a={kind:"sql-file",path:s.relative(e.productDir,t.cachePath).split(s.sep).join("/"),cwd:null,inputs:[]};return l("schema.sourceReplays"),await Y(e,"source-schema",a,0,r,c),!0}export async function verifyLocalSchemaMatchesSource(e,r,t,c={}){if(!t?.active)return{status:"disabled"};if(!t.sourceSchema.verify||c.skipSchemaSourceVerify)return c.setupRegistry?.recordCached({config:e,stage:"source-schema:verify",kind:"database-source-schema",summary:"source schema verification skipped"}),{status:"skipped"};we(e);const a=fe(t.cachePath);l("schema.verificationDumps");const n=await Z(e,r,{image:await c.resolveLocalSnapshotImage?.(),ownedContainer:c.ownedContainer||null,reporter:c.reporter||null,signal:c.signal});return l("schema.comparisons"),l("schema.bytesCompared",Buffer.byteLength(a)+Buffer.byteLength(n)),n===a?{status:"matched"}:{status:"mismatch",diagnostics:await Pe(e,t,a,n)}}export function createSourceSchemaMismatchError(e,r,t){const c=[`Local schema replay does not match source schema for service "${e.name}".`,`Source cache: ${s.relative(e.productDir,r.cachePath)}`];return t?.status==="mismatch"&&c.push(`Diff: ${s.relative(e.productDir,t.diagnostics.diffPath)}`),new Error(c.join(`
+`))}export async function appendSourceSchemaCacheToHash(e,r,t=null){if(!(r.testkit.database?.sourceSchema||null))return;const a=t?.cachePath||await getSourceSchemaCachePath(r),n=t?.active&&t.cacheKey?t.cacheKey:s.relative(getSourceSchemaRootDir(r),s.dirname(a));if(e.update(`source-schema-key:${n}`),e.update(`source-schema-cache:${s.relative(r.productDir,a)}`),!o.existsSync(a)){e.update(":missing");return}const i=o.statSync(a);e.update(`:${i.size.toString()}:${i.mtimeMs.toString()}`);const h=o.readFileSync(a);l("schema.cacheHashFilesRead"),l("schema.cacheHashBytesRead",h.length),e.update(h)}async function j(e,r,t={}){const c=t.setupRegistry,a=c?.start({config:e,stage:"source-schema:refresh",kind:"database-source-schema",summary:`source schema refresh: ${s.relative(e.productDir,r.cachePath)}`});try{const n=await te(re(r.cachePath),async({waited:h,requestedAt:u})=>{const m=de(r,u);if(m)return{reusedExistingRefresh:!0,waitedForLock:h,metadata:m};const S=await me(e,r.sourceUrl,r.cachePath,{reporter:t.reporter||null,logRecord:a?._logRecord||null,env:t.env||process.env,signal:t.signal}),p=le(e,r,S);return ye(r.metadataPath,p),{reusedExistingRefresh:!1,waitedForLock:h,metadata:p}},{signal:t.signal}),i=a&&c?c.finish(a,{status:"passed",summary:`source schema refresh: ${s.relative(e.productDir,r.cachePath)}`}):null;return i&&t.reporter?.setupOperationFinished?.(i),n}catch(n){const i=a?c?.finish(a,{status:"failed",summary:`source schema refresh: ${s.relative(e.productDir,r.cachePath)}`,error:Ce(n)}):null;throw i&&t.reporter?.setupOperationFinished?.(i),n}}async function me(e,r,t,c={}){const a=ae(r);o.mkdirSync(s.dirname(t),{recursive:!0});const n=ce(".source-schema-",{parentDir:s.dirname(t)}),i=s.join(n,s.basename(t));try{const h=await Q(e,a.dumpUrl,{env:c.env||process.env,pgApplicationName:x(e.name),signal:c.signal});return l("schema.sourceDumps"),await G(e,i,a.dumpUrl,{...c,image:h,pgApplicationName:x(e.name)}),o.renameSync(i,t),{resolution:a,pgDump:{args:["--schema-only","--no-owner","--no-privileges"],applicationName:x(e.name),image:h}}}finally{ne(n)}}function le(e,r,t){return{refreshedAt:new Date().toISOString(),serviceName:e.name,envName:r.envName,cacheKey:r.cacheKey,cacheKind:r.cacheKind,cachePath:s.relative(e.productDir,r.cachePath),repo:K(r.repoState),sourceUrl:t.resolution.metadata,pgDump:t.pgDump}}function de(e,r){if(!o.existsSync(e.cachePath))return null;const t=k(e.metadataPath);if(!Fe(t))return null;const c=Date.parse(t.refreshedAt);return!Number.isFinite(c)||c<r?null:t}function x(e){return`testkit:schema-source:${e.replace(/[^a-zA-Z0-9._:-]+/g,"-").slice(0,24)||"service"}`}function fe(e){const r=o.readFileSync(e);return l("schema.cacheFilesRead"),l("schema.cacheBytesRead",r.length),ee(r.toString("utf8"))}function pe(e){if(!e.cacheExists)return!0;if(e.sourceSchema.refresh.mode==="auto")return e.ci;if(e.sourceSchema.refresh.mode==="ttl"){const r=C(e.metadataPath),t=r?Date.parse(r):0;return!Number.isFinite(t)||t<=0?!0:Date.now()-t>=e.sourceSchema.refresh.ttlSeconds*1e3}return!0}function v(e,r,t={}){if(!r?.active)return;const c=new Date().toISOString(),a=O(r.indexPath).filter(h=>h.cacheKey!==r.cacheKey),n=C(r.metadataPath);a.push({cacheKey:r.cacheKey,kind:r.cacheKind,commitSha:r.repoState.commitSha||null,branch:r.repoState.branch||null,detached:r.repoState.detached,dirty:r.repoState.dirty,dirtyFingerprint:r.repoState.dirtyFingerprint||null,contentFingerprint:r.repoState.contentFingerprint||null,remoteUrl:r.repoState.remoteUrl||null,repository:r.repoState.repository,cachePath:s.relative(e.productDir,r.cachePath),refreshedAt:t.refreshed?c:n,lastUsedAt:c});const i=Se(e,r,a);E(r.indexPath,{version:1,entries:i})}function Se(e,r,t){if(t.length<=N)return t;const c=[...t].sort((n,i)=>Date.parse(i.lastUsedAt||"0")-Date.parse(n.lastUsedAt||"0")),a=new Set(c.slice(0,N).map(n=>n.cacheKey));a.add(r.cacheKey);for(const n of t){if(a.has(n.cacheKey))continue;const i=n.cachePath?s.join(e.productDir,n.cachePath):null,h=i?s.resolve(i):null,u=s.resolve(r.rootDir);if(!i||!h||h!==u&&!h.startsWith(`${u}${s.sep}`))continue;const m=_(e.productDir,s.dirname(i),`Service "${e.name}" pruned source schema cache directory`);o.rmSync(m,{recursive:!0,force:!0})}return t.filter(n=>a.has(n.cacheKey))}function ye(e,r){E(e,r)}function E(e,r){o.mkdirSync(s.dirname(e),{recursive:!0}),R(e),o.writeFileSync(e,ke(r))}function k(e){if(!e||!o.existsSync(e))return null;R(e);try{return JSON.parse(o.readFileSync(e,"utf8"))}catch{return null}}function I(e){return D(e.productDir,"results","schema")}function R(e){if(!o.existsSync(e))return;const r=o.lstatSync(e);if(r.isSymbolicLink()||!r.isFile())throw new Error(`Refusing unsafe source schema state file at ${e}`)}function ve(e){return`${w(e.runtimeLabel||e.name)}__${w(e.name)}`}function we(e){const r=I(e);if(!o.existsSync(r))return;const t=w(e.name);for(const c of o.readdirSync(r))De(c,t)&&o.rmSync(s.join(r,c),{force:!0})}function De(e,r){for(const t of["__source-schema.sql","__local-replay-schema.sql","__schema.diff","__schema.meta.json"])if(e.endsWith(t))return e.slice(0,-t.length).endsWith(`__${r}`);return!1}async function Pe(e,r,t,c){const a=I(e);o.mkdirSync(a,{recursive:!0});const n=ve(e),i=s.join(a,`${n}__source-schema.sql`),h=s.join(a,`${n}__local-replay-schema.sql`),u=s.join(a,`${n}__schema.diff`),m=s.join(a,`${n}__schema.meta.json`);return o.writeFileSync(i,t),o.writeFileSync(h,c),o.writeFileSync(u,await ge(i,h)),E(m,be(e,r)),{sourceCachePath:r.cachePath,sourcePath:i,localPath:h,diffPath:u,metaPath:m}}function be(e,r){const t=C(r.metadataPath);return{version:1,createdAt:new Date().toISOString(),serviceName:e.name,runtimeLabel:e.runtimeLabel||e.name,sourceSchema:{envName:r.envName||null,cacheKey:r.cacheKey||null,cacheKind:r.cacheKind||null,cachePath:s.relative(e.productDir,r.cachePath),refreshedAt:t},repo:K(r.repoState)}}function ge(e,r){return new Promise(t=>{t(buildUnifiedDiffText(o.readFileSync(e,"utf8"),o.readFileSync(r,"utf8"),e,r))})}export function buildUnifiedDiffText(e,r,t="source",c="target"){if(e===r)return"";const{createTwoFilesPatch:a}=ie();return a(t,c,y(e),y(r),"","",{context:3})}function xe(e,r){return e==="fail"||e==="warn-cache"?e:r.CI==="true"?"fail":"warn-cache"}function Ee(e,r){const t={...e.testkit.serviceEnv,...e.testkit.local?.env};for(const c of r){const a=t[c];if(typeof a!="string")continue;const n=V(a).find(i=>(i.serviceName??e.name)===e.name);if(n)throw new Error(`Service "${e.name}" env ${c} uses ${n.placeholder}, which is the database the source schema verifies. Point it at another service's database or an external database URL.`)}}function w(e){return e.trim().toLowerCase().replace(/[^a-z0-9._-]+/g,"-").replace(/^-+|-+$/g,"")||"schema"}function O(e){const r=k(e);return!f(r)||!Array.isArray(r.entries)?[]:r.entries.filter(Ae)}function C(e){const r=k(e);return f(r)&&typeof r.refreshedAt=="string"?r.refreshedAt:null}function ke(e){return`${y(JSON.stringify(e,null,2))}
+`}function Re(e){const r=T(e,"message");return!!r?r:y(e)}function Ce(e){const r=T(e,"message");return!!r?r:e}function T(e,r){if(!(e===null||typeof e!="object"&&typeof e!="function"))return Reflect.get(e,r)}function H(e){return!!e.sourceUrl}function Ae(e){return!f(e)||typeof e.cacheKey!="string"||e.cacheKey.length===0?!1:d(e.branch)&&d(e.cachePath)&&d(e.commitSha)&&d(e.contentFingerprint)&&B(e.detached)&&B(e.dirty)&&d(e.dirtyFingerprint)&&d(e.kind)&&d(e.lastUsedAt)&&d(e.refreshedAt)&&d(e.remoteUrl)&&Ke(e.repository)}function Ke(e){return e==null||f(e)&&typeof e.host=="string"&&typeof e.owner=="string"&&typeof e.name=="string"}function Fe(e){return f(e)&&typeof e.refreshedAt=="string"&&(e.sourceUrl===void 0||_e(e.sourceUrl))}function _e(e){return f(e)&&typeof e.originalHost=="string"&&q(e.originalClassification)&&typeof e.resolvedHost=="string"&&q(e.resolvedClassification)&&typeof e.rewritten=="boolean"}function q(e){return e==="neon-pooler"||e==="neon-direct"||e==="unsupported-pooler"||e==="unknown-direct"}function d(e){return e===void 0||se(e)}function B(e){return e===void 0||typeof e=="boolean"}

package/dist/database/source-schema-env.js

@@ -0,0 +1 @@
+export function sourceSchemaEnvNames(e){const n=e.testkit.database?.sourceSchema;return n?.kind==="env"?[n.env]:a(e.name)}export function sourceSchemaCredentialEnvNames(e){return[...new Set([...a(e.name),...sourceSchemaEnvNames(e)])]}function a(e){return[`TESTKIT_${e.toUpperCase().replace(/[^A-Z0-9]+/g,"_")}_SCHEMA_SOURCE_DATABASE_URL`,"TESTKIT_SCHEMA_SOURCE_DATABASE_URL"]}

package/dist/database/state-files.js

@@ -1 +1 @@
-import m from"fs";import e from"path";import{buildProductIdentity as p}from"./docker.js";const s=String;export function writeLocalInfraState(o,t){const n=p(e.resolve(o,"..","..",".."));writeStateValue(e.join(o,"database_backend"),""),writeStateValue(e.join(o,"container_name"),t.containerName),writeStateValue(e.join(o,"container_id"),t.containerId),t.volumeName&&writeStateValue(e.join(o,"volume_name"),t.volumeName),t.volumeMountPath&&writeStateValue(e.join(o,"volume_mount_path"),t.volumeMountPath),writeStateValue(e.join(o,"ownership_product_id"),n.id),writeStateValue(e.join(o,"image"),t.image),writeStateValue(e.join(o,"user"),t.user),writeStateValue(e.join(o,"password"),t.password),writeStateValue(e.join(o,"max_connections"),String(t.maxConnections)),writeStateValue(e.join(o,"host"),t.host),writeStateValue(e.join(o,"port"),String(t.port))}export function writeCacheState(o,t,n,u){writeStateValue(e.join(o,"database_backend"),""),writeStateValue(e.join(o,"template_database_name"),n),writeStateValue(e.join(o,"template_fingerprint"),u),writeStateValue(e.join(o,"container_name"),t.containerName),t.volumeName&&writeStateValue(e.join(o,"volume_name"),t.volumeName),t.volumeMountPath&&writeStateValue(e.join(o,"volume_mount_path"),t.volumeMountPath)}export function writeStateValue(o,t){m.writeFileSync(o,s(t??""),{mode:384}),m.chmodSync(o,384)}
+import m from"fs";import e from"path";import{buildProductIdentity as a}from"./docker.js";const p=String;export function writeLocalInfraState(o,t){const n=a(e.resolve(o,"..","..",".."));writeStateValue(e.join(o,"database_backend"),""),writeStateValue(e.join(o,"container_name"),t.containerName),writeStateValue(e.join(o,"container_id"),t.containerId),t.volumeName&&writeStateValue(e.join(o,"volume_name"),t.volumeName),t.volumeMountPath&&writeStateValue(e.join(o,"volume_mount_path"),t.volumeMountPath),writeStateValue(e.join(o,"ownership_product_id"),n.id),writeStateValue(e.join(o,"image"),t.image),writeStateValue(e.join(o,"user"),t.user),writeStateValue(e.join(o,"password"),t.password),writeStateValue(e.join(o,"max_connections"),String(t.maxConnections)),writeStateValue(e.join(o,"host"),t.host),writeStateValue(e.join(o,"port"),String(t.port))}export function writeCacheState(o,t,n,u){writeStateValue(e.join(o,"database_backend"),""),writeStateValue(e.join(o,"template_database_name"),n),writeStateValue(e.join(o,"template_fingerprint"),u),writeStateValue(e.join(o,"container_name"),t.containerName),t.volumeName&&writeStateValue(e.join(o,"volume_name"),t.volumeName),t.volumeMountPath&&writeStateValue(e.join(o,"volume_mount_path"),t.volumeMountPath)}export function beginTemplateCacheRebuild(o,t){m.rmSync(e.join(o,"template_fingerprint"),{force:!0}),writeStateValue(e.join(o,"template_database_name"),t)}export function writeStateValue(o,t){m.writeFileSync(o,p(t??""),{mode:384}),m.chmodSync(o,384)}

package/dist/database/state.js

@@ -1 +1 @@
-import u from"fs";import o from"path";import{requireContainedTestkitStateDirectory as D,resolveContainedTestkitStateDirectory as b}from"../process/runs/product-state.js";const y=new Set(["_bundles","_config","_dbcache","_execution","_graphs","_infra","_locks","_runs","_template-steps","_toolchains","_typecheck","engines","history","lint","results"]);export function getLocalInfraDir(e){return resolveContainedDatabaseStateDirectory(e,"_infra","local-postgres")}export function getLocalLocksDir(e){return resolveContainedDatabaseStateDirectory(e,"_locks","local-postgres")}export function getLocalServiceCacheDir(e,t){return resolveContainedDatabaseStateDirectory(e,"_dbcache",t)}export function listOwnedDatabaseStateDirs(e){const t=resolveContainedDatabaseStateDirectory(e),r=[],n=getLocalInfraDir(e);u.existsSync(n)&&r.push({dir:n,kind:"infra"});const l=o.join(t,"_dbcache");for(const a of f(l))r.push({dir:a,kind:"cache"});const s=o.join(t,"_graphs");for(const a of f(s))for(const c of f(o.join(a,"runtimes")))for(const m of f(o.join(c,"services")))r.push({dir:m,kind:"runtime"});for(const a of p(t)){if(y.has(a.name)||!a.isDirectory())continue;const c=o.join(t,a.name);d(o.join(c,"database_backend"))&&r.push({dir:c,kind:"legacy"})}return r}export function hasRemainingLocalArtifacts(e){return listOwnedDatabaseStateDirs(e).map(({dir:t,kind:r})=>{const n=d(o.join(t,"database_backend"));return r!=="infra"&&(r==="cache"||n)}).some(Boolean)}export function readOwnedStateValues(e,t){const r=new Set;for(const{dir:n}of listOwnedDatabaseStateDirs(e))for(const l of t){const s=readStateValue(o.join(n,l));s&&r.add(s)}return r}function f(e){return p(e).flatMap(t=>{const r=o.join(e,t.name);if(t.isSymbolicLink())throw i(r,"symlink");if(!t.isDirectory()&&!t.isFile())throw i(r,"special node");return t.isDirectory()?[r]:[]})}function p(e){const t=h(e);if(!t)return[];if(!t.isDirectory())throw i(e,"non-directory node");return u.readdirSync(e,{withFileTypes:!0}).sort((r,n)=>r.name.localeCompare(n.name))}function d(e){const t=h(e);if(t&&!t.isFile())throw i(e,"non-file node");return!!t}function h(e){const t=u.lstatSync(e,{throwIfNoEntry:!1});if(t?.isSymbolicLink())throw i(e,"symlink");return t}export function readStateValue(e){return d(e)?u.readFileSync(e,"utf8").trim():null}export function readDatabaseUrl(e){return readStateValue(o.join(e,"database_url"))}export function readDatabaseInfo(e){return S(readDatabaseUrl(e))}function S(e){if(!e)return null;try{const t=new URL(e),r=Number(t.port||"5432"),n=t.searchParams.get("sslmode")||"disable";return{url:e,host:t.hostname,port:Number.isInteger(r)&&r>0?r:5432,database:t.pathname.replace(/^\//,""),user:decodeURIComponent(t.username||""),password:decodeURIComponent(t.password||""),sslMode:n,ssl:n!=="disable"}}catch{return null}}export function resolveContainedDatabaseStateDirectory(e,...t){return b(e,...t)}export function requireContainedDatabaseStateDirectory(e,t,r="Testkit database state directory"){return D(e,t,r)}function i(e,t){return new Error(`Refusing unsafe Testkit database state ${t} at ${e}`)}
+import f from"fs";import o from"path";import{resolveContainedTestkitStateDirectory as u}from"../process/runs/product-state.js";const k=new Set(["_bundles","_config","_dbcache","_execution","_graphs","_infra","_locks","_runs","_template-steps","_toolchains","_typecheck","engines","history","lint","results"]);export function getLocalInfraDir(t){return u(t,"_infra","local-postgres")}export function getLocalLocksDir(t){return u(t,"_locks","local-postgres")}export function getLocalServiceCacheDir(t,e){return u(t,"_dbcache",e)}export function listOwnedDatabaseStateDirs(t){const e=u(t),n=[],r=getLocalInfraDir(t);f.existsSync(r)&&n.push({dir:r,kind:"infra"});const d=o.join(e,"_dbcache");for(const i of l(d))n.push({dir:i,kind:"cache"});const a=o.join(e,"_graphs");for(const i of l(a))for(const c of l(o.join(i,"runtimes")))for(const _ of l(o.join(c,"services")))n.push({dir:_,kind:"runtime"});for(const i of p(e)){if(k.has(i.name)||!i.isDirectory())continue;const c=o.join(e,i.name);h(o.join(c,"database_backend"))&&n.push({dir:c,kind:"legacy"})}return n}export function hasRemainingLocalArtifacts(t){return listOwnedDatabaseStateDirs(t).map(({dir:e,kind:n})=>{const r=h(o.join(e,"database_backend"));return n!=="infra"&&(n==="cache"||r)}).some(Boolean)}export function readOwnedStateValues(t,e){const n=new Set;for(const{dir:r}of listOwnedDatabaseStateDirs(t))for(const d of e){const a=readStateValue(o.join(r,d));a&&n.add(a)}return n}function l(t){return p(t).flatMap(e=>{const n=o.join(t,e.name);if(e.isSymbolicLink())throw s(n,"symlink");if(!e.isDirectory()&&!e.isFile())throw s(n,"special node");return e.isDirectory()?[n]:[]})}function p(t){const e=m(t);if(!e)return[];if(!e.isDirectory())throw s(t,"non-directory node");return f.readdirSync(t,{withFileTypes:!0}).sort((n,r)=>n.name.localeCompare(r.name))}function h(t){const e=m(t);if(e&&!e.isFile())throw s(t,"non-file node");return!!e}function m(t){const e=f.lstatSync(t,{throwIfNoEntry:!1});if(e?.isSymbolicLink())throw s(t,"symlink");return e}export function readStateValue(t){return h(t)?f.readFileSync(t,"utf8").trim():null}function s(t,e){return new Error(`Refusing unsafe Testkit database state ${e} at ${t}`)}