@hyperbrowser/sdk 0.92.7 → 1.0.0

package/dist/sandbox/image-build/context.js

@@ -0,0 +1,599 @@
+"use strict";
+/** Remote Dockerfile build context selection, fingerprinting, and packaging. */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.packageDockerBuildContextManifest = exports.writeManifestArtifact = exports.canonicalManifestJson = exports.dockerBuildContextFingerprint = exports.collectContextEntries = exports.loadDockerignore = exports.DockerBuildContextChangedError = void 0;
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path = __importStar(require("path"));
+const artifacts_1 = require("./artifacts");
+const common_1 = require("./common");
+const dockerfile_analysis_1 = require("./dockerfile-analysis");
+const dockerignore_1 = require("./dockerignore");
+const gzip_1 = require("./gzip");
+const MAX_CONTEXT_SOURCE_GROUPS = 511;
+const MAX_CONTEXT_ENTRIES = 1000000;
+/** The packaged context no longer matches the caller's cache fingerprint. */
+class DockerBuildContextChangedError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "DockerBuildContextChangedError";
+    }
+}
+exports.DockerBuildContextChangedError = DockerBuildContextChangedError;
+const selectionFingerprint = (selection, bundleHashes) => {
+    // Hash entry metadata and contents, not transport encoding: cache identity
+    // must not depend on tar headers or a compression library.
+    const identity = {
+        version: 1,
+        dockerfile: selection.dockerfile,
+        contextMode: selection.mode,
+        bundles: Array.from(new Set(bundleHashes)).sort(common_1.compareCodePoints),
+    };
+    return (0, crypto_1.createHash)("sha256")
+        .update((0, common_1.compactJson)(identity, { sortKeys: true }))
+        .digest("hex");
+};
+const expandUser = (value) => {
+    if (value === "~" || value.startsWith("~/")) {
+        return path.join((0, os_1.homedir)(), value.slice(1));
+    }
+    return value;
+};
+const lstatOrNull = (target) => {
+    try {
+        return (0, fs_1.lstatSync)(target);
+    }
+    catch {
+        return null;
+    }
+};
+const statOrNull = (target) => {
+    try {
+        return (0, fs_1.statSync)(target);
+    }
+    catch {
+        return null;
+    }
+};
+const pathExistsOrSymlink = (target) => lstatOrNull(target) !== null;
+const pathIsWithin = (parent, candidate) => {
+    const relative = path.relative(parent, candidate);
+    return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+};
+const cleanContextRelativePath = (value, fallback) => {
+    let normalized = (value ?? "").trim() || fallback;
+    normalized = normalized.split(path.sep).join("/");
+    if (normalized.includes("\\") ||
+        normalized.includes("\x00") ||
+        normalized.includes("\r") ||
+        normalized.includes("\n") ||
+        normalized.startsWith("/")) {
+        throw new Error("Dockerfile path must be relative to the build context");
+    }
+    if (normalized.split("/").includes("..")) {
+        throw new Error("Dockerfile path must be a relative path inside the build context");
+    }
+    const cleaned = (0, common_1.posixNormpath)(normalized);
+    if (cleaned === "." || cleaned === ".." || cleaned.startsWith("../")) {
+        throw new Error("Dockerfile path must be a relative path inside the build context");
+    }
+    return cleaned;
+};
+const selectDockerignore = (contextRoot, dockerfileRelative) => {
+    const dockerfileIgnore = `${dockerfileRelative}.dockerignore`;
+    const candidate = path.join(contextRoot, dockerfileIgnore);
+    if ((0, fs_1.existsSync)(candidate)) {
+        if (!(0, fs_1.statSync)(candidate).isFile()) {
+            throw new Error(`Dockerfile-specific ignore file "${dockerfileIgnore}" is not a regular file`);
+        }
+        return dockerfileIgnore;
+    }
+    return ".dockerignore";
+};
+const loadDockerignore = (ignorePath) => {
+    if (!(0, fs_1.existsSync)(ignorePath)) {
+        return null;
+    }
+    try {
+        return dockerignore_1.DockerIgnoreMatcher.fromFile(ignorePath);
+    }
+    catch (error) {
+        throw new Error(`parse .dockerignore: ${error instanceof Error ? error.message : error}`);
+    }
+};
+exports.loadDockerignore = loadDockerignore;
+const normalizeContextSource = (source) => {
+    if (source.includes("\x00")) {
+        throw new Error("Dockerfile source path contains a NUL byte");
+    }
+    const normalized = String(source).trim().replace(/\\/g, "/");
+    if (normalized === "" || normalized === "." || normalized === "/") {
+        return ".";
+    }
+    return (0, common_1.posixNormpath)("/" + normalized).replace(/^\/+/, "") || ".";
+};
+const deduplicateSourceGroups = (groups) => {
+    const result = [];
+    const seen = new Set();
+    for (const group of groups) {
+        const normalized = group.map(normalizeContextSource).sort(common_1.compareCodePoints);
+        const key = JSON.stringify(normalized);
+        if (!seen.has(key)) {
+            seen.add(key);
+            result.push(normalized);
+        }
+    }
+    return result;
+};
+const isIgnored = (relative, matcher) => matcher !== null && matcher.matches(relative);
+const addContextEntryWithParents = (entries, relative) => {
+    let current = relative;
+    while (current !== "" && current !== ".") {
+        entries.add(current);
+        current = (0, common_1.posixDirname)(current);
+    }
+};
+const toRelative = (contextRoot, target) => {
+    const relative = path.relative(contextRoot, target).split(path.sep).join("/");
+    return relative === "" ? "." : relative;
+};
+/**
+ * Return a sparse source plus symlinks and their in-context targets.
+ *
+ * This mirrors fsutil `FollowPaths`: symlink targets are interpreted inside
+ * the context root, including absolute or `..` targets, and cycles terminate
+ * after retaining every symlink encountered.
+ */
+const followContextSourceSymlinks = (contextRoot, relativeSource) => {
+    const pending = [normalizeContextSource(relativeSource)];
+    const resolved = [];
+    const seen = new Set();
+    while (pending.length > 0) {
+        const relative = pending.pop();
+        if (seen.has(relative)) {
+            continue;
+        }
+        seen.add(relative);
+        const parts = relative === "." ? [] : relative.split("/");
+        const currentParts = [];
+        let followed = false;
+        for (let index = 0; index < parts.length; index += 1) {
+            currentParts.push(parts[index]);
+            const currentRelative = currentParts.join("/");
+            const currentPath = path.join(contextRoot, currentRelative);
+            const metadata = lstatOrNull(currentPath);
+            if (metadata === null || !metadata.isSymbolicLink()) {
+                continue;
+            }
+            resolved.push(currentRelative);
+            let target;
+            try {
+                target = (0, fs_1.readlinkSync)(currentPath);
+            }
+            catch (error) {
+                throw new Error(`read build context symlink "${currentRelative}": ${error instanceof Error ? error.message : error}`);
+            }
+            if (!target || target.includes("\x00")) {
+                throw new Error(`build context symlink "${currentRelative}" has an invalid target`);
+            }
+            const remainder = parts.slice(index + 1);
+            const combined = target.startsWith("/")
+                ? (0, common_1.posixJoin)(target, ...remainder)
+                : (0, common_1.posixJoin)((0, common_1.posixDirname)(currentRelative), target, ...remainder);
+            const normalizedTarget = (0, common_1.posixNormpath)("/" + combined).replace(/^\/+/, "");
+            pending.push(normalizedTarget || ".");
+            followed = true;
+            break;
+        }
+        if (!followed) {
+            resolved.push(relative);
+        }
+    }
+    return resolved;
+};
+const walkDirectory = (contextRoot, directory, entries, ignoreMatcher, canPruneIgnoredDirectories) => {
+    const children = (0, fs_1.readdirSync)(directory, { withFileTypes: true });
+    const directories = children
+        .filter((child) => child.isDirectory())
+        .map((child) => child.name)
+        .sort(common_1.compareCodePoints);
+    const files = children
+        .filter((child) => !child.isDirectory())
+        .map((child) => child.name)
+        .sort(common_1.compareCodePoints);
+    const retainedDirectories = [];
+    for (const name of directories) {
+        const childRelative = toRelative(contextRoot, path.join(directory, name));
+        if (isIgnored(childRelative, ignoreMatcher)) {
+            if (!canPruneIgnoredDirectories) {
+                retainedDirectories.push(name);
+            }
+            continue;
+        }
+        addContextEntryWithParents(entries, childRelative);
+        retainedDirectories.push(name);
+    }
+    for (const name of files) {
+        const childRelative = toRelative(contextRoot, path.join(directory, name));
+        if (isIgnored(childRelative, ignoreMatcher)) {
+            continue;
+        }
+        addContextEntryWithParents(entries, childRelative);
+    }
+    for (const name of retainedDirectories) {
+        walkDirectory(contextRoot, path.join(directory, name), entries, ignoreMatcher, canPruneIgnoredDirectories);
+    }
+};
+const collectContextPath = (contextRoot, target, entries, ignoreMatcher) => {
+    const relative = toRelative(contextRoot, target);
+    const pathIsIgnored = relative !== "." && isIgnored(relative, ignoreMatcher);
+    const canPruneIgnoredDirectories = !(ignoreMatcher?.hasNegations ?? false);
+    if (relative !== "." && !pathIsIgnored) {
+        addContextEntryWithParents(entries, relative);
+    }
+    const metadata = lstatOrNull(target);
+    if (metadata === null || metadata.isSymbolicLink() || !metadata.isDirectory()) {
+        return;
+    }
+    if (pathIsIgnored && canPruneIgnoredDirectories) {
+        return;
+    }
+    walkDirectory(contextRoot, target, entries, ignoreMatcher, canPruneIgnoredDirectories);
+};
+const collectContextEntries = (contextRoot, sources, options) => {
+    const entries = new Set();
+    for (const rawSource of sources) {
+        const source = normalizeContextSource(rawSource);
+        const candidate = source === "." ? contextRoot : path.join(contextRoot, source);
+        const existingMatches = pathExistsOrSymlink(candidate) ? [candidate] : [];
+        if (options.required && existingMatches.length === 0) {
+            throw new Error(`Docker build context source not found: "${source}"`);
+        }
+        for (const match of existingMatches) {
+            const relativeMatch = toRelative(contextRoot, match);
+            for (const followedRelative of followContextSourceSymlinks(contextRoot, relativeMatch)) {
+                const followedPath = followedRelative === "." ? contextRoot : path.join(contextRoot, followedRelative);
+                if (pathExistsOrSymlink(followedPath)) {
+                    collectContextPath(contextRoot, followedPath, entries, options.ignoreMatcher);
+                }
+            }
+        }
+    }
+    return entries;
+};
+exports.collectContextEntries = collectContextEntries;
+const isSubset = (left, right) => {
+    for (const item of left) {
+        if (!right.has(item)) {
+            return false;
+        }
+    }
+    return true;
+};
+const removeSubsumedEntryGroups = (groups) => {
+    const result = [];
+    groups.forEach((entries, index) => {
+        const subsumed = groups.some((candidate, candidateIndex) => {
+            if (index === candidateIndex || !isSubset(entries, candidate)) {
+                return false;
+            }
+            const equal = entries.size === candidate.size;
+            return !equal || index > candidateIndex;
+        });
+        if (!subsumed) {
+            result.push(entries);
+        }
+    });
+    return result;
+};
+const selectDockerBuildContext = (contextPath, options) => {
+    const dockerfile = options.dockerfile ?? "Dockerfile";
+    const contextRoot = (0, fs_1.realpathSync)(path.resolve(expandUser(contextPath)));
+    if (!(0, fs_1.statSync)(contextRoot).isDirectory()) {
+        throw new Error("Docker build context must be a directory");
+    }
+    const dockerfileRelative = cleanContextRelativePath(dockerfile, "Dockerfile");
+    const dockerfilePath = path.join(contextRoot, dockerfileRelative);
+    const dockerfileMetadata = lstatOrNull(dockerfilePath);
+    const dockerfileStat = statOrNull(dockerfilePath);
+    if (dockerfileMetadata === null ||
+        !((dockerfileStat?.isFile() ?? false) || dockerfileMetadata.isSymbolicLink())) {
+        throw new Error(`Dockerfile "${dockerfileRelative}" must be a regular file or symlink`);
+    }
+    let resolvedDockerfile;
+    try {
+        resolvedDockerfile = (0, fs_1.realpathSync)(dockerfilePath);
+    }
+    catch {
+        throw new Error(`Dockerfile "${dockerfileRelative}" must resolve to a regular file inside the build context`);
+    }
+    if (!(0, fs_1.statSync)(resolvedDockerfile).isFile() || !pathIsWithin(contextRoot, resolvedDockerfile)) {
+        throw new Error(`Dockerfile "${dockerfileRelative}" must resolve to a regular file inside the build context`);
+    }
+    const dockerfileBytes = (0, fs_1.readFileSync)(dockerfilePath);
+    const ignoreRelative = selectDockerignore(contextRoot, dockerfileRelative);
+    const ignoreMatcher = (0, exports.loadDockerignore)(path.join(contextRoot, ignoreRelative));
+    let { groups: sourceGroups, fallbackReason } = (0, dockerfile_analysis_1.analyzeDockerfileSources)(dockerfileBytes);
+    if (options.forceFullContext) {
+        sourceGroups = [];
+        fallbackReason = "requested_full_context";
+    }
+    sourceGroups = deduplicateSourceGroups(sourceGroups);
+    if (sourceGroups.length > MAX_CONTEXT_SOURCE_GROUPS) {
+        sourceGroups = [];
+        fallbackReason = "too_many_context_source_groups";
+    }
+    const usesWholeContext = sourceGroups.some((group) => group.includes("."));
+    let contextMode = fallbackReason || usesWholeContext ? "full" : "sparse";
+    const controlSources = [
+        dockerfileRelative,
+        ignoreRelative,
+        toRelative(contextRoot, resolvedDockerfile),
+    ];
+    const collectFullContext = () => [
+        new Set([
+            ...(0, exports.collectContextEntries)(contextRoot, ["."], { ignoreMatcher, required: false }),
+            ...(0, exports.collectContextEntries)(contextRoot, controlSources, {
+                ignoreMatcher: null,
+                required: false,
+            }),
+        ]),
+    ];
+    let entryGroups;
+    if (contextMode === "full") {
+        entryGroups = collectFullContext();
+    }
+    else {
+        entryGroups = [
+            (0, exports.collectContextEntries)(contextRoot, controlSources, { ignoreMatcher: null, required: false }),
+        ];
+        for (const group of sourceGroups) {
+            entryGroups.push((0, exports.collectContextEntries)(contextRoot, group, { ignoreMatcher, required: true }));
+        }
+        const total = entryGroups.reduce((sum, entries) => sum + entries.size, 0);
+        if (total > MAX_CONTEXT_ENTRIES) {
+            contextMode = "full";
+            fallbackReason = "context_selection_too_large";
+            entryGroups = collectFullContext();
+        }
+    }
+    return {
+        root: contextRoot,
+        dockerfile: dockerfileRelative,
+        mode: contextMode,
+        fallbackReason: fallbackReason || null,
+        entryGroups: removeSubsumedEntryGroups(entryGroups),
+    };
+};
+const validateArchiveRelativePath = (relative) => {
+    if (!relative ||
+        relative.startsWith("/") ||
+        relative.includes("\x00") ||
+        (0, common_1.posixNormpath)(relative) !== relative ||
+        relative === ".." ||
+        relative.startsWith("../")) {
+        throw new Error(`invalid build context path "${relative}"`);
+    }
+};
+const contextEntryInfo = (contextRoot, relative) => {
+    validateArchiveRelativePath(relative);
+    const absolute = path.join(contextRoot, relative);
+    // Every regular path must be present with its own contents (no hard-link
+    // entries); preserve symlinks without following them.
+    const metadata = (0, fs_1.lstatSync)(absolute);
+    const mode = metadata.mode & 0o7777;
+    if (metadata.isFile()) {
+        return { name: relative, type: "file", mode, size: metadata.size, linkname: "" };
+    }
+    if (metadata.isDirectory()) {
+        return { name: `${relative}/`, type: "directory", mode, size: 0, linkname: "" };
+    }
+    if (metadata.isSymbolicLink()) {
+        const linkname = (0, fs_1.readlinkSync)(absolute);
+        if (!linkname) {
+            throw new Error(`build context symlink "${relative}" has an invalid target`);
+        }
+        return { name: relative, type: "symlink", mode, size: 0, linkname };
+    }
+    return null;
+};
+const hashContextEntryMetadata = (hasher, info) => {
+    const metadata = Buffer.from((0, common_1.compactJson)([
+        info.type === "directory" ? info.name.replace(/\/+$/, "") : info.name,
+        info.type,
+        info.mode,
+        info.size,
+        info.linkname,
+    ]), "utf8");
+    const length = Buffer.alloc(8);
+    length.writeBigUInt64BE(BigInt(metadata.length));
+    hasher.update(length);
+    hasher.update(metadata);
+};
+async function* hashingFileChunks(filePath, hasher, size) {
+    let remaining = size;
+    if (remaining === 0) {
+        return;
+    }
+    const stream = (0, fs_1.createReadStream)(filePath, { highWaterMark: 64 * 1024 });
+    try {
+        for await (const chunk of stream) {
+            const buffer = chunk;
+            if (buffer.length > remaining) {
+                throw new Error(`build context file "${filePath}" changed size while reading`);
+            }
+            remaining -= buffer.length;
+            hasher.update(buffer);
+            yield buffer;
+        }
+    }
+    finally {
+        stream.destroy();
+    }
+    if (remaining !== 0) {
+        throw new Error(`build context file "${filePath}" was truncated`);
+    }
+}
+/**
+ * Fingerprint the effective remote context without compressing or staging it.
+ *
+ * Uses the same Dockerfile source selection, ignore rules, and normalized tar
+ * entries as remote packaging. Pass the result as `expectedContextFingerprint`
+ * when building to detect context changes. Build options outside the context
+ * (e.g. platform or imageInit) must also be included in the caller's cache
+ * key. Mutable base tags and network resources are not resolved.
+ */
+const dockerBuildContextFingerprint = async (contextPath, options = {}) => {
+    const selection = selectDockerBuildContext(contextPath, options);
+    const hashes = [];
+    for (const entries of selection.entryGroups) {
+        const hasher = (0, crypto_1.createHash)("sha256");
+        for (const relative of Array.from(entries).sort(common_1.compareCodePoints)) {
+            const info = contextEntryInfo(selection.root, relative);
+            if (info === null) {
+                continue;
+            }
+            hashContextEntryMetadata(hasher, info);
+            if (info.type === "file") {
+                // eslint-disable-next-line @typescript-eslint/no-unused-vars
+                for await (const _chunk of hashingFileChunks(path.join(selection.root, relative), hasher, info.size)) {
+                    // hashing only
+                }
+            }
+        }
+        hashes.push(hasher.digest("hex"));
+    }
+    return selectionFingerprint(selection, hashes);
+};
+exports.dockerBuildContextFingerprint = dockerBuildContextFingerprint;
+const packageContextBundle = async (contextRoot, entries, workspace, index) => {
+    const bundlePath = path.join(workspace, `bundle-${String(index).padStart(4, "0")}.tar.gz`);
+    const contextHasher = (0, crypto_1.createHash)("sha256");
+    let entryCount = 0;
+    let uncompressedSize = 0;
+    const result = await (0, gzip_1.writeGzipTar)(bundlePath, async (writer) => {
+        for (const relative of entries) {
+            const info = contextEntryInfo(contextRoot, relative);
+            if (info === null) {
+                continue;
+            }
+            hashContextEntryMetadata(contextHasher, info);
+            if (info.type === "file") {
+                await writer.addEntry(info, hashingFileChunks(path.join(contextRoot, relative), contextHasher, info.size));
+                uncompressedSize += info.size;
+            }
+            else {
+                await writer.addEntry(info);
+            }
+            entryCount += 1;
+        }
+    });
+    const artifact = {
+        path: bundlePath,
+        sha256Hex: result.sha256Hex,
+        sizeBytes: result.sizeBytes,
+        inputFormat: artifacts_1.CONTEXT_MANIFEST_INPUT_FORMAT,
+        sourcePlatform: artifacts_1.IMAGE_BUILD_SOURCE_PLATFORM,
+        imageConfigUser: "",
+    };
+    const descriptor = {
+        sha256: result.sha256Hex,
+        sizeBytes: result.sizeBytes,
+        uncompressedSizeBytes: uncompressedSize,
+        entryCount,
+    };
+    return [artifact, descriptor, contextHasher.digest("hex")];
+};
+/** Serialize a manifest exactly as the Python SDK does (field order, no nulls). */
+const canonicalManifestJson = (value) => Buffer.from((0, common_1.compactJson)(value, { ensureAscii: false }), "utf8");
+exports.canonicalManifestJson = canonicalManifestJson;
+const writeManifestArtifact = (workspace, filename, data, inputFormat, extras = {
+    imageConfigUser: "",
+}) => {
+    const filePath = path.join(workspace, filename);
+    (0, fs_1.writeFileSync)(filePath, data, { flag: "wx" });
+    return {
+        path: filePath,
+        sha256Hex: (0, crypto_1.createHash)("sha256").update(data).digest("hex"),
+        sizeBytes: data.length,
+        inputFormat,
+        sourcePlatform: artifacts_1.IMAGE_BUILD_SOURCE_PLATFORM,
+        imageConfigUser: extras.imageConfigUser,
+        imageInit: extras.imageInit,
+    };
+};
+exports.writeManifestArtifact = writeManifestArtifact;
+const packageDockerBuildContextManifest = async (contextPath, options = {}) => {
+    const expected = options.expectedContextFingerprint;
+    if (expected !== undefined && !common_1.SHA256_HEX_PATTERN.test(expected)) {
+        throw new Error("expectedContextFingerprint must be a SHA-256 hex digest");
+    }
+    const selection = selectDockerBuildContext(contextPath, options);
+    const workspace = (0, fs_1.mkdtempSync)(path.join(options.tempDir ?? (0, os_1.tmpdir)(), "hb-docker-context-"));
+    try {
+        const bundles = {};
+        const descriptors = [];
+        const bundleHashes = [];
+        for (const [index, entries] of selection.entryGroups.entries()) {
+            const [artifact, descriptor, bundleHash] = await packageContextBundle(selection.root, Array.from(entries).sort(common_1.compareCodePoints), workspace, index);
+            bundleHashes.push(bundleHash);
+            if (descriptor.sha256 in bundles) {
+                (0, artifacts_1.removeArtifact)(artifact);
+                continue;
+            }
+            bundles[descriptor.sha256] = artifact;
+            descriptors.push(descriptor);
+        }
+        descriptors.sort((left, right) => (0, common_1.compareCodePoints)(left.sha256, right.sha256));
+        const fingerprint = selectionFingerprint(selection, bundleHashes);
+        if (expected !== undefined && fingerprint !== expected) {
+            throw new DockerBuildContextChangedError("Docker build context changed after its cache fingerprint was computed. " +
+                "Retry the build with a fresh fingerprint.");
+        }
+        const manifest = {
+            version: 1,
+            dockerfilePath: selection.dockerfile,
+            contextMode: selection.mode,
+            ...(selection.fallbackReason ? { fallbackReason: selection.fallbackReason } : {}),
+            bundles: descriptors,
+        };
+        const artifact = (0, exports.writeManifestArtifact)(workspace, "context-manifest.json", (0, exports.canonicalManifestJson)(manifest), artifacts_1.CONTEXT_MANIFEST_INPUT_FORMAT);
+        return {
+            artifact,
+            manifest,
+            bundles,
+            workspace,
+            fingerprint,
+            cleanup: () => (0, artifacts_1.removeWorkspace)(workspace),
+        };
+    }
+    catch (error) {
+        (0, artifacts_1.removeWorkspace)(workspace);
+        throw error;
+    }
+};
+exports.packageDockerBuildContextManifest = packageDockerBuildContextManifest;

package/dist/sandbox/image-build/docker-image.d.ts

@@ -0,0 +1,34 @@
+/** Local Docker image inspection and layer-manifest packaging for prebuilt imports. */
+import { SandboxDockerImageManifest, SandboxImageInit } from "../../types/sandbox";
+import { DockerImageBuildArtifact } from "./artifacts";
+export interface DockerImageManifestSource {
+    imageDigest: string;
+    config: Record<string, unknown>;
+    imageConfigUser: string;
+    imageInit?: SandboxImageInit;
+    cleanup(): Promise<void>;
+}
+export interface PackagedDockerImage {
+    artifact: DockerImageBuildArtifact;
+    manifest: SandboxDockerImageManifest;
+    layers: Record<string, DockerImageBuildArtifact>;
+    workspace: string;
+    cleanup(): void;
+}
+export declare class DockerCommandError extends Error {
+    constructor(message: string);
+}
+export declare const runDockerCommand: (args: string[]) => Promise<string>;
+/** Inspect platform identity with Docker API 1.49+, without temporary resources. */
+export declare const dockerImageDigest: (dockerImage: string, options?: {
+    platform?: string;
+}) => Promise<string>;
+export declare const prepareDockerImageManifestSource: (dockerImage: string, options?: {
+    platform?: string;
+}) => Promise<DockerImageManifestSource>;
+export interface PackageDockerImageManifestOptions {
+    platform?: string;
+    tempDir?: string;
+}
+/** Stream `docker image save` into verified layer artifacts plus a manifest. */
+export declare const packageDockerImageManifest: (dockerImage: string, imageDigest: string, config: Record<string, unknown>, options?: PackageDockerImageManifestOptions) => Promise<PackagedDockerImage>;