@inquir/compute 0.4.2 → 0.4.5

package/dist/system-packages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-packages.d.ts","sourceRoot":"","sources":["../src/system-packages.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;GAkBG;AAEH,+CAA+C;AAC/C,eAAO,MAAM,mBAAmB,+FAEtB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE,4EAA4E;AAC5E,eAAO,MAAM,eAAe,oSAIlB,CAAC;AAEX,oGAAoG;AACpG,eAAO,MAAM,2BAA2B,oFAAoF,CAAC;AAE7H,MAAM,MAAM,eAAe,GAAG,gBAAgB,GAAG;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAE9F,+CAA+C;AAC/C,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,eAAe,EAAE,CAAC;IAC5B,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,KAAK,CAAC;AACtC,2CAA2C;AAC3C,eAAO,MAAM,kBAAkB,IAAI,CAAC;AACpC,uFAAuF;AACvF,eAAO,MAAM,2BAA2B,wBAAyB,CAAC;AAElE;;;;GAIG;AACH,eAAO,MAAM,+BAA+B,0MAC6J,CAAC;AAY1M,0DAA0D;AAC1D,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAMjB,CAAC;AAEvB;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,gDAA0D,CAAC;AAO/F,2HAA2H;AAC3H,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAK3B,CAAC;AAEZ;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,GAAG,SAAS,CAOrH;AAkBD,6GAA6G;AAC7G,eAAO,MAAM,0BAA0B,wDAAyD,CAAC;AAEjG;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,IAAI,CAAC;AACpC,eAAO,MAAM,mBAAmB,IAAI,CAAC;AACrC,eAAO,MAAM,kBAAkB,2BAA2B,CAAC;AAC3D,eAAO,MAAM,8BAA8B,iEAAiE,CAAC;AAC7G,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAa7D,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuGpB,CAAC;AAyEX;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAC1C,eAAO,MAAM,6BAA6B,QAAoB,CAAC;AAC/D,eAAO,MAAM,yCAAyC,OAAO,CAAC;AAC9D,eAAO,MAAM,iCAAiC,oBAAqB,CAAC;AACpE,eAAO,MAAM,+BAA+B,QAAS,CAAC;AACtD,eAAO,MAAM,sBAAsB,IAAI,CAAC;AACxC,eAAO,MAAM,mCAAmC,qBAAsB,CAAC;AACvE,8EAA8E;AAC9E,eAAO,MAAM,wBAAwB,uDAAuD,CAAC;AAqD7F;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+G1B,CAAC;AAEX,oGAAoG;AACpG,eAAO,MAAM,mBAAmB,mGAAoG,CAAC;AACrI,uFAAuF;AACvF,eAAO,MAAM,kBAAkB,mEAAoE,CAAC;AAWpG;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6FlC,CAAC;AAEX,mDAAmD;AACnD,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,KAAK,GAAG,QAAQ,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,CAAC,oBAAoB,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAC5D,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;IACxC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;IACtF,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,oCAAoC;AACpC,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,KAAK,GAAG,QAAQ,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5I"}

package/dist/system-packages.js

@@ -0,0 +1,605 @@
+import { z } from 'zod';
+/**
+ * System packages (OS packages such as ffmpeg) are declared in inquir.yaml —
+ * the one config format for every language — and applied by a deploy:
+ *
+ *   build:
+ *     system:
+ *       presets: [ffmpeg]
+ *       packages: [poppler-utils, chromium]
+ *   functions:
+ *     transcode:           # per-function override; replaces the default (no merge)
+ *       build:
+ *         system:
+ *           presets: [ffmpeg]
+ *
+ * This module only reads and validates that schema (INQUIR_YAML_JSON_SCHEMA
+ * is what editors use for completion); it is never a second config source.
+ * The platform is the authority: GET /functions/system-presets lists its
+ * catalog, and the deploy validates the block again.
+ */
+/** Presets of catalog v1 (Debian bookworm). */
+export const SYSTEM_PRESET_NAMES = [
+    'ffmpeg', 'fonts', 'ghostscript', 'imagemagick', 'libvips', 'poppler', 'tesseract',
+];
+/** tesseract `langs` values (tesseract-ocr-<lang> packages in bookworm). */
+export const TESSERACT_LANGS = [
+    'ara', 'bul', 'ces', 'chi-sim', 'chi-tra', 'dan', 'deu', 'ell', 'eng', 'est', 'fin', 'fra', 'heb', 'hin', 'hrv',
+    'hun', 'ind', 'ita', 'jpn', 'kat', 'kaz', 'kor', 'lav', 'lit', 'nld', 'nor', 'pol', 'por', 'ron', 'rus', 'slk',
+    'slv', 'spa', 'srp', 'swe', 'tha', 'tur', 'ukr', 'vie',
+];
+/** Debian package name with an optional apt `=version` pin (the platform applies the same rule). */
+export const SYSTEM_PACKAGE_NAME_PATTERN = '^(?!.*\\.\\.)[a-z0-9](?:[a-z0-9+.-]{0,61}[a-z0-9])?(=[A-Za-z0-9.+~:_-]{1,64})?$';
+/** The free-form package cap the platform applies by default (the Free plan figure). */
+export const SYSTEM_MAX_PACKAGES = 10;
+/** At most this many presets per block. */
+export const SYSTEM_MAX_PRESETS = 8;
+/** Presets that take options (an object entry); every other preset is a plain name. */
+export const SYSTEM_PRESETS_WITH_OPTIONS = ['tesseract'];
+/**
+ * Package names a function image refuses (daemons, privilege tools, kernels,
+ * package tooling); an optional `=version` pin does not change that. The
+ * platform's validator uses the same list (a test keeps them in step).
+ */
+export const SYSTEM_PACKAGE_DENYLIST_PATTERN = '^(systemd.*|init|sudo|sudo-ldap|doas|openssh-server|docker.*|containerd.*|podman.*|runc|crun|linux-image-.*|linux-headers-.*|.*-dkms|apt-transport-.*|apt|dpkg|cron|anacron|rsyslog|udev|dbus)(=.*)?$';
+const packageNameRegex = new RegExp(SYSTEM_PACKAGE_NAME_PATTERN);
+const denylistRegex = new RegExp(SYSTEM_PACKAGE_DENYLIST_PATTERN);
+const unique = (values) => new Set(values.map((value) => JSON.stringify(value))).size === values.length;
+const presetRefSchema = z.union([
+    z.enum(SYSTEM_PRESET_NAMES.filter((name) => !SYSTEM_PRESETS_WITH_OPTIONS.includes(name))),
+    z.literal('tesseract'),
+    z.object({ name: z.literal('tesseract'), langs: z.array(z.enum(TESSERACT_LANGS)).max(8).refine(unique, 'languages must be unique').nullable().optional() }).strict(),
+]);
+/** zod twin of INQUIR_YAML_JSON_SCHEMA's system block. */
+export const functionSystemConfigSchema = z.object({
+    presets: z.array(presetRefSchema).max(SYSTEM_MAX_PRESETS).refine(unique, 'presets must be unique').nullable().optional(),
+    packages: z.array(z.string()
+        .regex(packageNameRegex, 'Debian package name (optional =version)')
+        .refine((name) => !denylistRegex.test(name), 'this package is not allowed in a function image'))
+        .max(SYSTEM_MAX_PACKAGES).refine(unique, 'packages must be unique').nullable().optional(),
+}).strict().nullable();
+/**
+ * `build.dependencies`: language packages, the same key for every runtime
+ * (node `name@version`, python a pip requirement such as `name==version`, go
+ * `module@version`). Only the shape is checked here; the platform validates
+ * each entry by the function's runtime and merges the list into its build
+ * workspace's package.json / requirements.txt / go.mod
+ * (docs/FUNCTION_BUILD_DEPENDENCIES.md; FUNCTIONS_INQUIR_YAML_DEPENDENCIES).
+ */
+export const buildDependenciesSchema = z.array(z.string().min(1).max(512)).max(200).nullable();
+const buildSchema = z.object({
+    system: functionSystemConfigSchema.optional(),
+    dependencies: buildDependenciesSchema.optional(),
+}).strict().nullable();
+/** The parts of an inquir.yaml document the functions read; apps' `version` and `services` are checked by the platform. */
+export const inquirYamlFunctionsSchema = z.object({
+    version: z.unknown().optional(),
+    services: z.unknown().optional(),
+    build: buildSchema.optional(),
+    functions: z.record(z.string().min(1), z.object({ build: buildSchema.optional() }).strict().nullable()).nullable().optional(),
+}).strict();
+/**
+ * The system block one inquir.yaml document declares for `functionName`:
+ * functions.<name>.build.system first, then build.system; undefined when it
+ * declares neither (null: declared as none). Throws a ZodError on a malformed
+ * document. The platform resolves a deploy the same way, the function's own
+ * inquir.yaml before the project's.
+ */
+export function declaredSystemConfig(document, functionName) {
+    if (document === null || document === undefined)
+        return undefined;
+    const parsed = inquirYamlFunctionsSchema.parse(document);
+    const own = parsed.functions?.[functionName]?.build?.system;
+    const declared = own !== undefined ? own : parsed.build?.system;
+    if (!declared)
+        return declared;
+    return { presets: declared.presets ?? [], packages: declared.packages ?? [] };
+}
+const presetItemSchema = {
+    anyOf: [
+        { enum: [...SYSTEM_PRESET_NAMES], description: 'A platform preset (Debian bookworm packages plus env)' },
+        {
+            type: 'object',
+            required: ['name'],
+            additionalProperties: false,
+            description: 'A preset with options (tesseract only)',
+            properties: {
+                name: { enum: [...SYSTEM_PRESETS_WITH_OPTIONS] },
+                langs: { type: ['array', 'null'], maxItems: 8, uniqueItems: true, items: { enum: [...TESSERACT_LANGS] }, description: 'Extra OCR languages' },
+            },
+        },
+    ],
+};
+/** The keys inquir.yaml may hold at the top level (apps: version, services; functions: build, functions). */
+export const INQUIR_YAML_TOP_LEVEL_KEYS = ['version', 'services', 'build', 'functions'];
+/**
+ * `services.web.scale` (docs/roadmap/STATEFUL_REPLICAS.md §7): the platform's
+ * validator is src/apps/app-scale-spec.ts; these constants and the schema
+ * below are its twin, kept equal by src/services/inquir-yaml-schema-parity.test.ts.
+ * Cross-field rules JSON Schema cannot express (an ordinal below `replicas`,
+ * a `fallback` or `public` that names an existing endpoint) are the platform's.
+ */
+export const SCALE_MAX_REPLICAS = 8;
+export const SCALE_MAX_ENDPOINTS = 8;
+export const SCALE_NAME_PATTERN = '^[a-z][a-z0-9-]{0,30}$';
+export const SCALE_ORDINAL_SELECTOR_PATTERN = '^[0-9]{1,2}(-([0-9]{1,2})?)?(,[0-9]{1,2}(-([0-9]{1,2})?)?)*$';
+export const SCALE_ORDINAL_KEY_PATTERN = '^(0|[1-9][0-9]?)$';
+const scaleName = { type: 'string', pattern: SCALE_NAME_PATTERN };
+const scaleInt = (minimum, maximum) => ({ type: 'integer', minimum, ...(maximum === undefined ? {} : { maximum }) });
+/** A failover command (rank, promote, rejoin): run in the replica's container, bounded by timeoutSeconds. */
+const scaleCommand = {
+    type: 'object', additionalProperties: false, required: ['command'],
+    properties: {
+        command: { type: 'array', minItems: 1, maxItems: 32, items: { type: 'string', minLength: 1, maxLength: 2048 } },
+        timeoutSeconds: { type: 'integer', minimum: 1, maximum: 3600 },
+    },
+};
+export const SCALE_JSON_SCHEMA = {
+    description: 'Alpha: stateful replicas may still change and have limits; keep backups of the data they hold. Replica intent: stateless (identical replicas) or stateful (ordered replicas 0..N-1, each with its own volumes, private name and address). Where stateful replicas are not enabled for the workspace, a deploy that declares it is refused. Keys declared here are managed by this file: other surfaces change them only with an explicit override.',
+    type: 'object',
+    additionalProperties: false,
+    properties: {
+        mode: { enum: ['stateless', 'stateful'] },
+        replicas: scaleInt(1, SCALE_MAX_REPLICAS),
+        podManagement: { enum: ['ordered', 'parallel'] },
+        update: {
+            type: 'object', additionalProperties: false,
+            properties: {
+                order: { enum: ['reverse', 'forward'] },
+                partition: scaleInt(0, SCALE_MAX_REPLICAS),
+                maxUnavailable: scaleInt(1, SCALE_MAX_REPLICAS),
+                minReadySeconds: scaleInt(0, 3600),
+                progressDeadlineSeconds: scaleInt(30, 86400),
+            },
+        },
+        placement: {
+            type: 'object', additionalProperties: false,
+            properties: { spread: { enum: ['host', 'location'] }, allowSameHost: { type: 'boolean' } },
+        },
+        hostLoss: { enum: ['wait', 'rebuild'] },
+        hostLossGraceSeconds: scaleInt(60, 86400),
+        retention: {
+            type: 'object', additionalProperties: false,
+            properties: {
+                whenScaledDown: { enum: ['retain', 'delete'] },
+                whenDeleted: { enum: ['retain', 'delete'] },
+                retentionDays: scaleInt(1, 90),
+            },
+        },
+        endpoints: {
+            type: 'object',
+            maxProperties: SCALE_MAX_ENDPOINTS,
+            propertyNames: { pattern: SCALE_NAME_PATTERN, not: { const: 'default' } },
+            additionalProperties: {
+                type: 'object', additionalProperties: false,
+                oneOf: [{ required: ['role'] }, { required: ['ordinals'] }],
+                // A single-writer endpoint never falls back to other replicas: with no writer it has no backend.
+                if: { required: ['max'] },
+                then: { not: { required: ['fallback'] } },
+                properties: {
+                    role: scaleName,
+                    ordinals: { type: 'string', pattern: SCALE_ORDINAL_SELECTOR_PATTERN },
+                    max: { const: 1 },
+                    fallback: scaleName,
+                },
+            },
+        },
+        public: scaleName,
+        backup: {
+            oneOf: [
+                { type: 'object', additionalProperties: false, required: ['from'], properties: { from: { enum: ['all', 'none'] } } },
+                { type: 'object', additionalProperties: false, required: ['ordinals'],
+                    properties: { ordinals: { type: 'array', minItems: 1, maxItems: SCALE_MAX_REPLICAS, items: scaleInt(0, SCALE_MAX_REPLICAS - 1) } } },
+                { type: 'object', additionalProperties: false, required: ['role'], properties: { role: scaleName, fallback: { type: 'boolean' } } },
+            ],
+        },
+        failover: {
+            type: 'object', additionalProperties: false, required: ['enabled'],
+            properties: {
+                enabled: { type: 'boolean' },
+                leaderRole: scaleName,
+                replicaRole: scaleName,
+                leaseTtlSeconds: scaleInt(5, 300),
+                detectAfterSeconds: scaleInt(5, 3600),
+                rank: scaleCommand,
+                maxRankLag: scaleInt(0),
+                promote: scaleCommand,
+                rejoin: scaleCommand,
+                isolation: { enum: ['failsafe', 'fence'] },
+                switchoverOnUpdate: { type: 'boolean' },
+            },
+            if: { properties: { enabled: { const: true } } },
+            then: { required: ['leaderRole', 'rank', 'promote'] },
+        },
+        ordinals: {
+            type: 'object',
+            propertyNames: { pattern: SCALE_ORDINAL_KEY_PATTERN },
+            additionalProperties: {
+                type: 'object', additionalProperties: false,
+                properties: {
+                    resources: {
+                        type: 'object', additionalProperties: false,
+                        properties: {
+                            cpuVCpus: { type: 'number', minimum: 0.05, maximum: 16 },
+                            memoryMb: scaleInt(64, 8192),
+                        },
+                    },
+                    env: {
+                        type: 'object', maxProperties: 64,
+                        propertyNames: { pattern: '^[A-Za-z_][A-Za-z0-9_]*$', maxLength: 256 },
+                        additionalProperties: { type: 'string', maxLength: 32768 },
+                    },
+                    hostLoss: { enum: ['wait', 'rebuild'] },
+                },
+            },
+        },
+    },
+    // Only mode and replicas mean anything for identical (stateless) replicas.
+    if: { not: { required: ['mode'], properties: { mode: { const: 'stateful' } } } },
+    then: { propertyNames: { enum: ['mode', 'replicas'] } },
+};
+/**
+ * services.web.runtime.roles (stateful replicas, role endpoints): what each
+ * replica is, for scale.endpoints. Exactly one form: a probe the runner runs
+ * (an HTTP GET or a command whose answer is the role), or roles by ordinal.
+ * The platform's validator is src/apps/stateful-replicas/role-spec.ts.
+ */
+const ROLE_NAME_JSON_SCHEMA = { type: 'string', pattern: SCALE_NAME_PATTERN, not: { const: 'unknown' } };
+/**
+ * `services.web.runtime.hooks` (docs/roadmap/STATEFUL_REPLICAS.md §3.11): the
+ * init hook of a stateful application's replicas. The platform's validator is
+ * src/apps/stateful-replicas/init-hook.ts (runtimeHooksSchema).
+ */
+const HOOKS_JSON_SCHEMA = {
+    description: 'Commands run in each replica container itself. init: before its command, always or while a declared writable ' +
+        'volume is empty and was never bootstrapped (a replica bootstraps its data from another). Stateful applications only. ' +
+        'Frozen with each release.',
+    type: 'object',
+    additionalProperties: false,
+    properties: {
+        init: {
+            type: 'object',
+            additionalProperties: false,
+            required: ['command'],
+            properties: {
+                command: { type: 'array', minItems: 1, maxItems: 32, items: { type: 'string', minLength: 1, maxLength: 2048 } },
+                when: { enum: ['always', 'emptyVolume'], description: 'always (default), or emptyVolume' },
+                timeoutSeconds: { type: 'integer', minimum: 1, maximum: 3600, description: 'Default 600; the start fails past it' },
+            },
+        },
+    },
+};
+const ROLES_JSON_SCHEMA = {
+    description: 'What each replica of a stateful application is, for its role endpoints (scale.endpoints): a probe the runner runs ' +
+        '(an HTTP path or a command whose answer is the role), or roles by ordinal. Frozen with each release.',
+    type: 'object',
+    additionalProperties: false,
+    properties: {
+        probe: {
+            type: 'object',
+            additionalProperties: false,
+            oneOf: [{ required: ['http'] }, { required: ['command'] }],
+            properties: {
+                http: {
+                    type: 'object',
+                    additionalProperties: false,
+                    required: ['path'],
+                    properties: {
+                        path: { type: 'string', minLength: 1, maxLength: 512, pattern: '^/' },
+                        port: { type: 'string', minLength: 1, maxLength: 32, description: 'A runtime.ports name; the primary port by default' },
+                    },
+                },
+                command: { type: 'array', minItems: 1, maxItems: 32, items: { type: 'string', minLength: 1, maxLength: 2048 } },
+                intervalSeconds: { type: 'integer', minimum: 1, maximum: 60 },
+                timeoutSeconds: { type: 'integer', minimum: 1, maximum: 30 },
+                successThreshold: { type: 'integer', minimum: 1, maximum: 10 },
+            },
+        },
+        byOrdinal: {
+            type: 'object',
+            propertyNames: { pattern: SCALE_ORDINAL_KEY_PATTERN },
+            additionalProperties: ROLE_NAME_JSON_SCHEMA,
+        },
+        default: ROLE_NAME_JSON_SCHEMA,
+    },
+    oneOf: [
+        { required: ['probe'], not: { anyOf: [{ required: ['byOrdinal'] }, { required: ['default'] }] } },
+        { not: { required: ['probe'] }, anyOf: [{ required: ['byOrdinal'] }, { required: ['default'] }] },
+    ],
+};
+/**
+ * The application settings inquir.yaml `services.web` declares with the apps
+ * API's own shapes (docs/roadmap/INQUIR_COMPOSE.md §3.6.2). The platform's
+ * validators are src/apps/app-settings-schema.ts; these bounds are their twin,
+ * kept equal by src/services/inquir-yaml-schema-parity.test.ts.
+ */
+export const APP_SCALING_MAX_REPLICAS = 8;
+export const APP_SCALING_MAX_DELAY_SECONDS = 30 * 24 * 60 * 60;
+export const APP_AUTOSCALING_MAX_STABILIZATION_SECONDS = 3600;
+export const APP_AUTOSCALING_CPU_PERCENT_RANGE = [10, 100];
+export const APP_AUTOSCALING_MAX_CONCURRENCY = 10_000;
+export const APP_ROLLOUT_MAX_FIGURE = 8;
+export const APP_ROLLOUT_PROGRESS_DEADLINE_RANGE = [30, 3600];
+/** A registry image pinned by digest: the only kind a worker runner pulls. */
+export const PINNED_IMAGE_REF_PATTERN = '^[A-Za-z0-9][A-Za-z0-9._:/-]*@sha256:[a-f0-9]{64}$';
+const nullableInt = (minimum, maximum) => ({ type: ['integer', 'null'], minimum, maximum });
+const NETWORK_POLICY_JSON_SCHEMA = {
+    description: 'Network policy, the same object as the apps API: ingress private (default for a new application) or public ' +
+        '(a generated public domain), egress full (default) or none. A missing field keeps the current value. Keys declared ' +
+        'here are managed by this file: a change elsewhere is kept until the next deploy, which restores the file\'s value.',
+    type: 'object',
+    additionalProperties: false,
+    properties: {
+        ingress: { enum: ['private', 'public'] },
+        egress: { enum: ['none', 'full'] },
+        allow: { type: 'array', maxItems: 64, items: { type: 'string', minLength: 1, maxLength: 253 } },
+    },
+};
+const SCALING_JSON_SCHEMA = {
+    description: 'Activation and autoscaling, the same object as the apps API: activation always (default), http (scale to ' +
+        'zero when idle) or manual; replica bounds; autoscaling and rollout. Applied by a deploy that may take production. ' +
+        'Keys declared here are managed by this file.',
+    type: 'object',
+    additionalProperties: false,
+    properties: {
+        activation: { enum: ['always', 'http', 'manual'] },
+        minReplicas: { enum: [0, 1] },
+        maxReplicas: { type: 'integer', minimum: 1, maximum: APP_SCALING_MAX_REPLICAS },
+        idleTimeoutSeconds: { type: 'integer', minimum: 300, maximum: APP_SCALING_MAX_DELAY_SECONDS },
+        activationTimeoutSeconds: { type: 'integer', minimum: 5, maximum: 300 },
+        scaleDownStabilizationSeconds: { type: 'integer', minimum: 0, maximum: APP_SCALING_MAX_DELAY_SECONDS },
+        autoscaling: {
+            type: ['object', 'null'],
+            additionalProperties: false,
+            properties: {
+                minReplicas: { type: 'integer', minimum: 1, maximum: APP_SCALING_MAX_REPLICAS },
+                cpuUtilizationPercent: nullableInt(APP_AUTOSCALING_CPU_PERCENT_RANGE[0], APP_AUTOSCALING_CPU_PERCENT_RANGE[1]),
+                concurrencyPerReplica: nullableInt(1, APP_AUTOSCALING_MAX_CONCURRENCY),
+                scaleUpStabilizationSeconds: { type: 'integer', minimum: 0, maximum: APP_AUTOSCALING_MAX_STABILIZATION_SECONDS },
+                scaleDownStabilizationSeconds: { type: 'integer', minimum: 0, maximum: APP_AUTOSCALING_MAX_STABILIZATION_SECONDS },
+            },
+        },
+        rollout: {
+            type: ['object', 'null'],
+            additionalProperties: false,
+            properties: {
+                maxSurge: nullableInt(1, APP_ROLLOUT_MAX_FIGURE),
+                maxUnavailable: nullableInt(0, APP_ROLLOUT_MAX_FIGURE),
+                progressDeadlineSeconds: nullableInt(APP_ROLLOUT_PROGRESS_DEADLINE_RANGE[0], APP_ROLLOUT_PROGRESS_DEADLINE_RANGE[1]),
+            },
+        },
+    },
+};
+/**
+ * JSON Schema (draft-07) of inquir.yaml, for editor completion and
+ * validation (`# yaml-language-server: $schema=…`). The repository keeps it
+ * as schemas/inquir.yaml.json (a test keeps the two equal, and another runs
+ * one fixture set through this schema and the platform validator); apps'
+ * `services` is described loosely here, its validator is the platform's.
+ * Unknown keys are refused everywhere a typo would silently drop packages.
+ */
+export const INQUIR_YAML_JSON_SCHEMA = {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    $id: 'https://inquir.org/schemas/inquir.yaml.json',
+    title: 'inquir.yaml',
+    description: 'Inquir Compute configuration: function build settings (system packages) and the application manifest.',
+    type: ['object', 'null'],
+    additionalProperties: false,
+    properties: {
+        version: { const: 1, description: 'Application manifest version (apps)' },
+        services: {
+            type: 'object',
+            description: 'Application services (apps): services.web.build or imageRef, runtime, env, scale, networkPolicy, scaling, location',
+            properties: {
+                web: { $ref: '#/definitions/service' },
+            },
+        },
+        build: { $ref: '#/definitions/build', description: 'Build settings for every function deployed from this project or directory' },
+        functions: {
+            type: ['object', 'null'],
+            description: 'Per-function settings; a function entry replaces the project default (no merge)',
+            additionalProperties: {
+                type: ['object', 'null'],
+                additionalProperties: false,
+                properties: { build: { $ref: '#/definitions/build' } },
+            },
+        },
+    },
+    definitions: {
+        service: {
+            description: 'One service: services.web of inquir.yaml, and an inline service of inquir-compose.yaml (the same block).',
+            type: 'object',
+            properties: {
+                build: {
+                    type: 'object',
+                    description: 'The Dockerfile build: context (a folder inside the source), dockerfile (relative to the context), target, args',
+                    properties: {
+                        context: { type: 'string', minLength: 1, maxLength: 1024 },
+                        dockerfile: { type: 'string', minLength: 1, maxLength: 1024 },
+                        target: { type: 'string', minLength: 1, maxLength: 128 },
+                        args: { type: 'object', maxProperties: 32, additionalProperties: { type: 'string', maxLength: 4096 } },
+                    },
+                },
+                env: {
+                    type: 'object',
+                    description: 'Non-secret defaults, frozen with the build; application variables win. Never secrets: inquir.yaml is committed.',
+                    additionalProperties: { type: 'string', maxLength: 32768 },
+                },
+                runtime: {
+                    type: 'object',
+                    description: 'The pod template, frozen with each release (port, ports, volumes, healthcheck, hooks, roles, ...)',
+                    properties: { roles: { $ref: '#/definitions/roles' }, hooks: { $ref: '#/definitions/hooks' } },
+                },
+                scale: { $ref: '#/definitions/scale' },
+                imageRef: {
+                    type: 'string',
+                    maxLength: 512,
+                    pattern: PINNED_IMAGE_REF_PATTERN,
+                    description: 'Deploy this registry image instead of building one, pinned by digest (registry/repository[:tag]@sha256:<digest>; ' +
+                        'docker buildx imagetools inspect <image> prints it). runtime, env and scale apply to it as to a built image. ' +
+                        'Exclusive with build.',
+                },
+                networkPolicy: { $ref: '#/definitions/networkPolicy' },
+                scaling: { $ref: '#/definitions/scaling' },
+                location: {
+                    type: 'string',
+                    minLength: 1,
+                    maxLength: 32,
+                    description: 'Where the service runs: auto (any location) or a location id this platform offers, for example nl or ru ' +
+                        '(checked at deploy time). Managed by this file when declared.',
+                },
+            },
+            not: { required: ['imageRef', 'build'] },
+        },
+        scale: SCALE_JSON_SCHEMA,
+        networkPolicy: NETWORK_POLICY_JSON_SCHEMA,
+        scaling: SCALING_JSON_SCHEMA,
+        roles: ROLES_JSON_SCHEMA,
+        hooks: HOOKS_JSON_SCHEMA,
+        build: {
+            type: ['object', 'null'],
+            additionalProperties: false,
+            properties: {
+                system: { $ref: '#/definitions/system' },
+                dependencies: {
+                    type: ['array', 'null'],
+                    maxItems: 200,
+                    items: { type: 'string', minLength: 1, maxLength: 512 },
+                    description: 'Language packages, the same list for every runtime: node name@version (npm), python a pip requirement such as name==version, go module@version. Merged into package.json / requirements.txt / go.mod for the build; the same package declared there with another version is an error. Where the platform does not enable it yet, a deploy ignores it with a warning.',
+                },
+            },
+        },
+        system: {
+            description: 'OS packages installed into the function image (Debian bookworm; Node.js and Python today, Go coming soon). Removing the block removes them on the next deploy.',
+            type: ['object', 'null'],
+            additionalProperties: false,
+            properties: {
+                presets: { type: ['array', 'null'], maxItems: SYSTEM_MAX_PRESETS, uniqueItems: true, items: presetItemSchema },
+                packages: {
+                    type: ['array', 'null'],
+                    maxItems: SYSTEM_MAX_PACKAGES,
+                    uniqueItems: true,
+                    items: {
+                        type: 'string',
+                        pattern: SYSTEM_PACKAGE_NAME_PATTERN,
+                        not: { pattern: SYSTEM_PACKAGE_DENYLIST_PATTERN },
+                        description: 'Debian package, optionally name=version (daemons, privilege tools, kernels and package tooling are refused)',
+                    },
+                },
+            },
+        },
+    },
+};
+/** The keys of one service block (inquir.yaml services.web; the platform's INQUIR_SERVICE_KEYS). */
+export const INQUIR_SERVICE_KEYS = ['build', 'imageRef', 'runtime', 'env', 'scale', 'networkPolicy', 'scaling', 'location'];
+/** The stack keys an inquir-compose service entry adds (the platform's STACK_KEYS). */
+export const COMPOSE_STACK_KEYS = ['path', 'title', 'dependsOn', 'variables', 'buildArgs'];
+const composeText = {
+    anyOf: [
+        { type: 'string', minLength: 1, maxLength: 8192 },
+        { type: 'object', additionalProperties: false, required: ['en', 'ru'],
+            properties: { en: { type: 'string', minLength: 1, maxLength: 8192 }, ru: { type: 'string', minLength: 1, maxLength: 8192 } } },
+    ],
+};
+const composeServiceKey = '^[a-z][a-z0-9-]{0,30}$';
+/**
+ * JSON Schema (draft-07) of inquir-compose.yaml, for editors
+ * (docs/roadmap/INQUIR_COMPOSE.md §3). An inline service is inquir.yaml's
+ * definitions.service plus the stack keys; references ({{...}}) and the
+ * cross-field rules are the platform validator's (POST /v1/compose/validate).
+ */
+export const INQUIR_COMPOSE_YAML_JSON_SCHEMA = {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    $id: 'https://inquir.org/schemas/inquir-compose.yaml.json',
+    title: 'inquir-compose.yaml',
+    description: 'A stack of Inquir services: each a folder with its own inquir.yaml (path) or an inline inquir.yaml services.web block.',
+    type: 'object',
+    required: ['version', 'services'],
+    additionalProperties: false,
+    patternProperties: { '^x-': { description: 'Ignored by the platform: a place for YAML anchors' } },
+    properties: {
+        version: { const: 1 },
+        metadata: {
+            type: 'object', additionalProperties: false, required: ['title'],
+            properties: {
+                title: composeText,
+                description: composeText,
+                icon: { type: 'string', pattern: '^[a-z][a-z0-9-]{0,31}$' },
+                category: { enum: ['database', 'cache', 'web', 'agent', 'bot', 'other'] },
+                docsUrl: { type: 'string', pattern: '^https://', maxLength: 2048 },
+                notes: { type: 'array', maxItems: 30, items: composeText },
+                minPlan: { enum: ['free', 'simple', 'pro', 'enterprise'], description: 'A display hint; the deploy judges the real plan' },
+            },
+        },
+        inputs: {
+            type: 'object', maxProperties: 64, description: 'Values asked at deploy time',
+            propertyNames: { pattern: '^[A-Za-z_][A-Za-z0-9_]*$' },
+            additionalProperties: {
+                type: 'object', additionalProperties: false, required: ['label'],
+                properties: {
+                    label: composeText, hint: composeText,
+                    secret: { type: 'boolean', description: 'Typed at deploy time, stored encrypted, never echoed; no default' },
+                    required: { type: 'boolean' },
+                    default: { type: 'string', maxLength: 4096 },
+                    minLength: { type: 'integer', minimum: 0, maximum: 4096 },
+                    maxLength: { type: 'integer', minimum: 1, maximum: 4096 },
+                    options: { type: 'array', minItems: 1, maxItems: 32, items: { type: 'string', minLength: 1, maxLength: 256 } },
+                    pattern: { enum: ['username', 'hostname', 'email', 'https-url', 'integer', 'csv-integers'] },
+                },
+                if: { required: ['secret'], properties: { secret: { const: true } } },
+                then: { not: { required: ['default'] } },
+            },
+        },
+        generate: {
+            type: 'object', maxProperties: 32, description: 'Credentials the platform generates once per stack: {{generated.<key>}}',
+            propertyNames: { pattern: '^[a-z][a-z0-9-]{0,63}$' },
+            additionalProperties: {
+                type: 'object', additionalProperties: false, required: ['bytes', 'encoding'],
+                properties: { bytes: { type: 'integer', minimum: 16, maximum: 64 }, encoding: { enum: ['hex', 'base64', 'base64url'] } },
+            },
+        },
+        project: {
+            type: 'object', additionalProperties: false,
+            properties: { placement: { enum: ['new', 'existing'] }, name: { type: 'string', minLength: 1, maxLength: 64 } },
+        },
+        defaults: {
+            type: 'object', additionalProperties: false,
+            description: 'Merged under every inline service: location, networkPolicy, scaling and runtime.resources only',
+            properties: {
+                location: { type: 'string', minLength: 1, maxLength: 32 },
+                networkPolicy: { $ref: '#/definitions/networkPolicy' },
+                scaling: { $ref: '#/definitions/scaling' },
+                runtime: { type: 'object', additionalProperties: false, properties: { resources: { type: 'object' } } },
+            },
+        },
+        services: {
+            type: 'object', minProperties: 1, maxProperties: 32,
+            propertyNames: { pattern: composeServiceKey },
+            additionalProperties: {
+                allOf: [{ $ref: '#/definitions/service' }],
+                type: 'object',
+                propertyNames: { enum: [...INQUIR_SERVICE_KEYS, ...COMPOSE_STACK_KEYS] },
+                properties: {
+                    path: { type: 'string', minLength: 1, maxLength: 1024, description: 'A folder with its own inquir.yaml (then only stack keys sit next to it)' },
+                    title: { type: 'string', minLength: 1, maxLength: 80 },
+                    dependsOn: { type: 'array', maxItems: 32, items: { type: 'string', pattern: composeServiceKey } },
+                    variables: {
+                        type: 'object', maxProperties: 128,
+                        description: 'The application variables; references {{inputs.X}}, {{generated.x}}, {{services.s.privateHost}}, ... resolve here',
+                        propertyNames: { pattern: '^[A-Za-z_][A-Za-z0-9_]*$' },
+                        additionalProperties: { type: 'string', maxLength: 32768 },
+                    },
+                    buildArgs: {
+                        type: 'object', maxProperties: 32, description: 'Build arguments for this deploy: no secrets',
+                        additionalProperties: { type: 'string', maxLength: 4096 },
+                    },
+                },
+            },
+        },
+        entrypoint: { type: 'string', pattern: composeServiceKey, description: 'The public service opened after deploy' },
+        files: { type: 'object', description: 'Bundle form: the embedded build tree, path -> content', additionalProperties: { type: 'string' } },
+    },
+    // inquir.yaml's definitions, copied so the file stands alone (editors resolve no remote $ref).
+    definitions: INQUIR_YAML_JSON_SCHEMA.definitions,
+};
+//# sourceMappingURL=system-packages.js.map