@intentius/chant-lexicon-docker 0.124.46 → 0.124.48

package/dist/export-resources.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Live export for the docker lexicon (#4388): implements
+ * `LexiconPlugin.exportResources()` so `chant import --from <env>` regenerates
+ * a compose project's services, and the configs they read, as chant
+ * TypeScript.
+ *
+ * Which project: `COMPOSE_PROJECT_NAME` when set, else the environment name.
+ * The containers are found by compose's `com.docker.compose.project` label.
+ * All Engine I/O lives here; mapping is pure in `./import/live-export`.
+ */
+import type { ExportedTemplate, ResourceSelector } from "@intentius/chant/lexicon";
+import { type DockerEngine } from "./import/engine.js";
+/** The compose project an environment exports. */
+export declare function projectFor(environment: string): string;
+export declare function exportResources(options: {
+    environment: string;
+    selector?: ResourceSelector;
+    owned?: boolean;
+    verbatim?: boolean;
+}, engine?: DockerEngine, signal?: AbortSignal): Promise<ExportedTemplate>;
+//# sourceMappingURL=export-resources.d.ts.map

package/dist/export-resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export-resources.d.ts","sourceRoot":"","sources":["../src/export-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAAuC,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAoBzF,kDAAkD;AAClD,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAsB,eAAe,CACnC,OAAO,EAAE;IACP,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,EACD,MAAM,GAAE,YAAoC,EAC5C,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,gBAAgB,CAAC,CA2C3B"}

package/dist/export-resources.js

@@ -0,0 +1,63 @@
+/**
+ * Live export for the docker lexicon (#4388): implements
+ * `LexiconPlugin.exportResources()` so `chant import --from <env>` regenerates
+ * a compose project's services, and the configs they read, as chant
+ * TypeScript.
+ *
+ * Which project: `COMPOSE_PROJECT_NAME` when set, else the environment name.
+ * The containers are found by compose's `com.docker.compose.project` label.
+ * All Engine I/O lives here; mapping is pure in `./import/live-export`.
+ */
+import { defaultDockerEngine, singleFileText } from "./import/engine.js";
+import { buildExportFromProject, configCandidates, isChantOwned, PROJECT_LABEL, serviceContainers, } from "./import/live-export.js";
+function json(body) {
+    try {
+        return JSON.parse(body.toString("utf8"));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The compose project an environment exports. */
+export function projectFor(environment) {
+    return process.env.COMPOSE_PROJECT_NAME || environment;
+}
+export async function exportResources(options, engine = defaultDockerEngine(), signal) {
+    const project = projectFor(options.environment);
+    const filters = encodeURIComponent(JSON.stringify({ label: [`${PROJECT_LABEL}=${project}`] }));
+    const list = await engine(`/containers/json?all=1&filters=${filters}`, signal);
+    if (list.status !== 200) {
+        throw new Error(`docker live export: listing the containers of compose project ${project} failed (${list.status}): ${list.body.toString("utf8").trim()}`);
+    }
+    const containers = serviceContainers(project, json(list.body) ?? []);
+    const services = [];
+    const images = new Map();
+    for (const [name, id] of containers) {
+        const res = await engine(`/containers/${encodeURIComponent(id)}/json`, signal);
+        const container = res.status === 200 ? json(res.body) : undefined;
+        if (!container)
+            continue;
+        const ref = container.Config?.Image;
+        if (ref && !images.has(ref)) {
+            const img = await engine(`/images/${encodeURIComponent(ref)}/json`, signal);
+            images.set(ref, img.status === 200 ? json(img.body) : undefined);
+        }
+        // Config files are read only for the services that are exported.
+        const files = {};
+        if (!options.owned || isChantOwned(container)) {
+            for (const path of configCandidates(container)) {
+                const res = await engine(`/containers/${encodeURIComponent(id)}/archive?path=${encodeURIComponent(path)}`, signal);
+                if (res.status !== 200)
+                    continue;
+                const text = singleFileText(res.body);
+                if (text !== undefined)
+                    files[path] = text;
+            }
+        }
+        services.push({ name, container, image: ref ? images.get(ref) : undefined, files });
+    }
+    if (options.owned) {
+        console.warn("[docker] the docker serializer stamps no ownership marker; under --owned only services labelled app.kubernetes.io/managed-by=chant (defaultLabels) are exported");
+    }
+    return buildExportFromProject(project, services, options);
+}

package/dist/import/adapter.d.ts

@@ -10,15 +10,19 @@
  * keyed by its `kind` (service/volume/network/config/secret/dockerfile) and
  * reverse the mapping in the generator so DockerGenerator can do the real work.
  */
-import type { TemplateIR, TemplateParser } from "@intentius/chant/import/parser";
+import type { TemplateIR, TemplateParser, ParseContext } from "@intentius/chant/import/parser";
 import type { GeneratedFile, TypeScriptGenerator } from "@intentius/chant/import/generator";
+import type { ParseResult } from "./parser.js";
 /**
  * TemplateParser adapter — wraps DockerParser.parse and maps its DockerIR
  * entities to a TemplateIR.
  */
 export declare class DockerTemplateParser implements TemplateParser {
-    parse(content: string): TemplateIR;
+    /** With `context.embedded`, a config's `content` another lexicon owns is handed to it (#3373). */
+    parse(content: string, context?: ParseContext): TemplateIR;
 }
+/** A compose parse result as the core TemplateIR. */
+export declare function dockerResultToTemplate({ entities, warnings }: ParseResult): TemplateIR;
 /**
  * TypeScriptGenerator adapter — converts a TemplateIR back into DockerIR[]
  * and delegates to DockerGenerator, returning a single generated file.

package/dist/import/adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../src/import/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAc,MAAM,gCAAgC,CAAC;AAC7F,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAiD5F;;;GAGG;AACH,qBAAa,oBAAqB,YAAW,cAAc;IACzD,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,CAYjC;CACF;AAED;;;GAGG;AACH,qBAAa,uBAAwB,YAAW,mBAAmB;IACjE,QAAQ,CAAC,EAAE,EAAE,UAAU,GAAG,aAAa,EAAE,CAIxC;CACF"}
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../src/import/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAc,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC3G,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAE5F,OAAO,KAAK,EAA6B,WAAW,EAAE,MAAM,UAAU,CAAC;AA+CvE;;;GAGG;AACH,qBAAa,oBAAqB,YAAW,cAAc;IACzD,kGAAkG;IAClG,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,UAAU,CAOzD;CACF;AAED,qDAAqD;AACrD,wBAAgB,sBAAsB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,WAAW,GAAG,UAAU,CAMtF;AAED;;;GAGG;AACH,qBAAa,uBAAwB,YAAW,mBAAmB;IACjE,QAAQ,CAAC,EAAE,EAAE,UAAU,GAAG,aAAa,EAAE,CAIxC;CACF"}

package/dist/import/adapter.js

@@ -59,20 +59,24 @@ function resourceToDockerIr(resource) {
  * entities to a TemplateIR.
  */
 export class DockerTemplateParser {
-    parse(content) {
+    /** With `context.embedded`, a config's `content` another lexicon owns is handed to it (#3373). */
+    parse(content, context) {
         // A Dockerfile has no name of its own; it imports as `app`
         // (Dockerfile.app). Rename the export to choose the file name.
         if (looksLikeDockerfile(content)) {
             return { resources: [dockerIrToResource(new DockerfileParser().parse("app", content))], parameters: [] };
         }
-        const { entities, warnings } = new DockerParser().parse(content);
-        return {
-            resources: entities.map(dockerIrToResource),
-            parameters: [],
-            ...(warnings.length > 0 ? { warnings } : {}),
-        };
+        return dockerResultToTemplate(new DockerParser().parse(content, context));
     }
 }
+/** A compose parse result as the core TemplateIR. */
+export function dockerResultToTemplate({ entities, warnings }) {
+    return {
+        resources: entities.map(dockerIrToResource),
+        parameters: [],
+        ...(warnings.length > 0 ? { warnings } : {}),
+    };
+}
 /**
  * TypeScriptGenerator adapter — converts a TemplateIR back into DockerIR[]
  * and delegates to DockerGenerator, returning a single generated file.

package/dist/import/embedded.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Where a Compose file embeds another lexicon's content, for `chant import`
+ * (#3373, #4388).
+ *
+ * A top-level config with `content` is a file Compose writes into each
+ * container that mounts it. The parser offers that text to core's
+ * embedded-content resolver, as k8s offers a ConfigMap value (#2962) and fly
+ * a machine file. `DockerOtelCollector` carries its collector config this way,
+ * at the otel lexicon's `COLLECTOR_CONFIG_PATH`, so a file or live import of
+ * the project gives the same otel source `chant import config.yaml` gives.
+ *
+ * Which lexicon imports the content is decided by core at run time; the hint
+ * below only names the owner a warning suggests when none is installed.
+ */
+import type { EmbeddedContentResolver } from "@intentius/chant/import/embedded";
+/**
+ * Offer each top-level config's `content` to `embedded`, replacing the value
+ * an owner imports with its reference. `configs` maps config name to its IR
+ * properties and is changed in place with fresh copies; `services` is the
+ * compose document's services section, read for where each config is mounted.
+ *
+ * The owner's modules go in a directory named after the one service that
+ * mounts the config, else after the config, so a file import and a live
+ * import (which cannot recover the config's key) write them to the same place.
+ */
+export declare function delegateEmbedded(configs: Map<string, Record<string, unknown>>, services: Record<string, unknown> | undefined, embedded: EmbeddedContentResolver): void;
+//# sourceMappingURL=embedded.d.ts.map

package/dist/import/embedded.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"embedded.d.ts","sourceRoot":"","sources":["../../src/import/embedded.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAmB,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAiCjG;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC7C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC7C,QAAQ,EAAE,uBAAuB,GAChC,IAAI,CAoBN"}

package/dist/import/embedded.js

@@ -0,0 +1,79 @@
+/**
+ * Where a Compose file embeds another lexicon's content, for `chant import`
+ * (#3373, #4388).
+ *
+ * A top-level config with `content` is a file Compose writes into each
+ * container that mounts it. The parser offers that text to core's
+ * embedded-content resolver, as k8s offers a ConfigMap value (#2962) and fly
+ * a machine file. `DockerOtelCollector` carries its collector config this way,
+ * at the otel lexicon's `COLLECTOR_CONFIG_PATH`, so a file or live import of
+ * the project gives the same otel source `chant import config.yaml` gives.
+ *
+ * Which lexicon imports the content is decided by core at run time; the hint
+ * below only names the owner a warning suggests when none is installed.
+ */
+import { embeddedDocument } from "@intentius/chant/import/embedded";
+import { COLLECTOR_CONFIG_PATH } from "@intentius/chant-lexicon-otel";
+function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+const COLLECTOR = { lexicon: "otel", what: "an OpenTelemetry Collector config" };
+function hintFor(targets, doc) {
+    if (targets.includes(COLLECTOR_CONFIG_PATH))
+        return COLLECTOR;
+    if (isRecord(doc) && isRecord(doc.service) && isRecord(doc.service.pipelines))
+        return COLLECTOR;
+    return undefined;
+}
+/** Each service's mounts of top-level configs: config name, then the services and targets that mount it. */
+function mountsByConfig(services) {
+    const out = new Map();
+    for (const [service, raw] of Object.entries(services ?? {})) {
+        if (!isRecord(raw) || !Array.isArray(raw.configs))
+            continue;
+        for (const c of raw.configs) {
+            const source = typeof c === "string" ? c : isRecord(c) && typeof c.source === "string" ? c.source : undefined;
+            if (!source)
+                continue;
+            const target = isRecord(c) && typeof c.target === "string" ? c.target : `/${source}`;
+            const list = out.get(source) ?? [];
+            list.push({ service, target });
+            out.set(source, list);
+        }
+    }
+    return out;
+}
+/**
+ * Offer each top-level config's `content` to `embedded`, replacing the value
+ * an owner imports with its reference. `configs` maps config name to its IR
+ * properties and is changed in place with fresh copies; `services` is the
+ * compose document's services section, read for where each config is mounted.
+ *
+ * The owner's modules go in a directory named after the one service that
+ * mounts the config, else after the config, so a file import and a live
+ * import (which cannot recover the config's key) write them to the same place.
+ */
+export function delegateEmbedded(configs, services, embedded) {
+    const mounts = mountsByConfig(services);
+    for (const [name, props] of configs) {
+        const text = props.content;
+        if (typeof text !== "string")
+            continue;
+        const doc = embeddedDocument(text);
+        if (!isRecord(doc))
+            continue;
+        const users = mounts.get(name) ?? [];
+        const owners = new Set(users.map((u) => u.service));
+        const ref = embedded.resolve({
+            host: "docker",
+            hostType: "config",
+            location: `config ${name} content`,
+            directory: owners.size === 1 ? [...owners][0] : name,
+            text,
+            document: doc,
+            expectedOwner: hintFor(users.map((u) => u.target), doc),
+        });
+        if (ref)
+            configs.set(name, { ...props, content: ref });
+    }
+}

package/dist/import/engine.d.ts

@@ -0,0 +1,39 @@
+/**
+ * A read-only Docker Engine API client for live export (#4388), and the tar
+ * reader for `GET /containers/{id}/archive`.
+ *
+ * The client is a single function, `(path) => { status, body }`, so tests hand
+ * export a fake Engine and never need a daemon. The default one speaks HTTP
+ * over the socket `DOCKER_HOST` names (`unix://…`, or plain `tcp://host:port`),
+ * else `/var/run/docker.sock`, with the unversioned API paths the daemon
+ * serves at its own version.
+ */
+/** One GET against the Engine API. `path` starts with `/`. */
+export type DockerEngine = (path: string, signal?: AbortSignal) => Promise<{
+    status: number;
+    body: Buffer;
+}>;
+/** Where `DOCKER_HOST` points: a unix socket path, or a host and port. */
+export declare function engineAddress(dockerHost?: string | undefined): {
+    socketPath: string;
+} | {
+    host: string;
+    port: number;
+};
+/** The Engine at `DOCKER_HOST` (or the default socket). */
+export declare function defaultDockerEngine(dockerHost?: string): DockerEngine;
+/** One entry of a tar stream. `type` is the ustar typeflag (`0` file, `5` directory, …). */
+export interface TarEntry {
+    name: string;
+    type: string;
+    data: Buffer;
+}
+/** The entries of an uncompressed tar stream. PAX and GNU long-name records are applied to the entry after them. */
+export declare function readTar(tar: Buffer): TarEntry[];
+/**
+ * The text of the one regular file an archive holds, or undefined when it
+ * holds anything else (a directory, a link, several entries) or the bytes
+ * are not UTF-8 text.
+ */
+export declare function singleFileText(tar: Buffer): string | undefined;
+//# sourceMappingURL=engine.d.ts.map

package/dist/import/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/import/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,8DAA8D;AAC9D,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAI7G,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,UAAU,qBAA0B,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAW3H;AAED,2DAA2D;AAC3D,wBAAgB,mBAAmB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,YAAY,CAarE;AAED,4FAA4F;AAC5F,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAQD,oHAAoH;AACpH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,EAAE,CA+B/C;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAM9D"}

package/dist/import/engine.js

@@ -0,0 +1,94 @@
+/**
+ * A read-only Docker Engine API client for live export (#4388), and the tar
+ * reader for `GET /containers/{id}/archive`.
+ *
+ * The client is a single function, `(path) => { status, body }`, so tests hand
+ * export a fake Engine and never need a daemon. The default one speaks HTTP
+ * over the socket `DOCKER_HOST` names (`unix://…`, or plain `tcp://host:port`),
+ * else `/var/run/docker.sock`, with the unversioned API paths the daemon
+ * serves at its own version.
+ */
+import { request } from "node:http";
+const DEFAULT_SOCKET = "/var/run/docker.sock";
+/** Where `DOCKER_HOST` points: a unix socket path, or a host and port. */
+export function engineAddress(dockerHost = process.env.DOCKER_HOST) {
+    if (!dockerHost)
+        return { socketPath: DEFAULT_SOCKET };
+    if (dockerHost.startsWith("unix://"))
+        return { socketPath: dockerHost.slice("unix://".length) };
+    if (dockerHost.startsWith("tcp://")) {
+        if (process.env.DOCKER_TLS_VERIFY) {
+            throw new Error("docker live export: DOCKER_TLS_VERIFY is set, and a TLS Engine endpoint is not supported; use a unix socket or a plain tcp:// endpoint");
+        }
+        const url = new URL(`http://${dockerHost.slice("tcp://".length)}`);
+        return { host: url.hostname, port: Number(url.port || 2375) };
+    }
+    throw new Error(`docker live export: DOCKER_HOST ${dockerHost} is not a unix:// or tcp:// endpoint`);
+}
+/** The Engine at `DOCKER_HOST` (or the default socket). */
+export function defaultDockerEngine(dockerHost) {
+    const address = engineAddress(dockerHost);
+    return (path, signal) => new Promise((resolve, reject) => {
+        const req = request({ ...address, path, method: "GET", headers: { Host: "docker" }, signal }, (res) => {
+            const chunks = [];
+            res.on("data", (c) => chunks.push(c));
+            res.on("end", () => resolve({ status: res.statusCode ?? 0, body: Buffer.concat(chunks) }));
+            res.on("error", reject);
+        });
+        req.on("error", reject);
+        req.end();
+    });
+}
+function field(block, start, length) {
+    const raw = block.subarray(start, start + length);
+    const end = raw.indexOf(0);
+    return raw.subarray(0, end === -1 ? raw.length : end).toString("utf8");
+}
+/** The entries of an uncompressed tar stream. PAX and GNU long-name records are applied to the entry after them. */
+export function readTar(tar) {
+    const out = [];
+    let offset = 0;
+    let longName;
+    while (offset + 512 <= tar.length) {
+        const header = tar.subarray(offset, offset + 512);
+        if (header.every((b) => b === 0))
+            break;
+        const size = parseInt(field(header, 124, 12).trim() || "0", 8);
+        const type = field(header, 156, 1) || "0";
+        const prefix = field(header, 345, 155);
+        let name = prefix ? `${prefix}/${field(header, 0, 100)}` : field(header, 0, 100);
+        const data = tar.subarray(offset + 512, offset + 512 + size);
+        offset += 512 + Math.ceil(size / 512) * 512;
+        if (type === "x") {
+            const path = /(?:^|\n)\d+ path=([^\n]*)\n/.exec(data.toString("utf8"));
+            if (path)
+                longName = path[1];
+            continue;
+        }
+        if (type === "L") {
+            longName = data.toString("utf8").replace(/\0+$/, "");
+            continue;
+        }
+        if (type === "g")
+            continue;
+        if (longName !== undefined) {
+            name = longName;
+            longName = undefined;
+        }
+        out.push({ name, type: type === "\0" ? "0" : type, data: Buffer.from(data) });
+    }
+    return out;
+}
+/**
+ * The text of the one regular file an archive holds, or undefined when it
+ * holds anything else (a directory, a link, several entries) or the bytes
+ * are not UTF-8 text.
+ */
+export function singleFileText(tar) {
+    const entries = readTar(tar);
+    if (entries.length !== 1 || entries[0].type !== "0")
+        return undefined;
+    const bytes = entries[0].data;
+    const text = bytes.toString("utf8");
+    return Buffer.from(text, "utf8").equals(bytes) ? text : undefined;
+}

package/dist/import/generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../../src/import/generator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAoE,MAAM,UAAU,CAAC;AAE3G,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;GAEG;AACH,qBAAa,eAAe;IAC1B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,cAAc,CA+B7C;CACF"}
+{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../../src/import/generator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAoE,MAAM,UAAU,CAAC;AAE3G,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;GAEG;AACH,qBAAa,eAAe;IAC1B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,cAAc,CAoC7C;CACF"}

package/dist/import/generator.js

@@ -3,6 +3,7 @@
  *
  * Converts parsed IR to valid chant TypeScript source code.
  */
+import { EmbeddedImportScope, isEmbeddedReference, renderEmbeddedReference } from "@intentius/chant/import/embedded";
 /**
  * Generator for Docker entities — IR → TypeScript chant source.
  */
@@ -12,16 +13,20 @@ export class DockerGenerator {
         const imports = new Set();
         const lines = [];
         const names = new ExportNames();
-        for (const entity of entities) {
+        // Export names first, so the imports an embedded reference needs (#3373)
+        // never take one.
+        const exportNames = entities.map((e) => (e.kind === "dockerfile" ? sanitizeName(e.name) : names.take(e.name, e.kind)));
+        const scope = new EmbeddedImportScope("", [...RESERVED, ...exportNames]);
+        entities.forEach((entity, i) => {
             if (entity.kind === "dockerfile") {
                 imports.add("Dockerfile");
                 lines.push(generateDockerfile(entity, warnings));
-                continue;
+                return;
             }
             const ctor = CONSTRUCTORS[entity.kind];
             imports.add(ctor);
-            const exportName = names.take(entity.name, entity.kind);
-            const expr = `new ${ctor}(${propsLiteral(entity)})`;
+            const exportName = exportNames[i];
+            const expr = `new ${ctor}(${propsLiteral(entity, scope)})`;
             // An export name that differs from the compose key would rename the
             // key on build, and every reference to it by name would dangle, so
             // the key is set explicitly (#3937).
@@ -32,9 +37,9 @@ export class DockerGenerator {
                 imports.add("composeKey");
                 lines.push(`export const ${exportName} = composeKey(${JSON.stringify(entity.name)}, ${expr});`);
             }
-        }
+        });
         const importLine = `import { ${[...imports].sort().join(", ")} } from "@intentius/chant-lexicon-docker";`;
-        const source = [importLine, "", ...lines].join("\n");
+        const source = [importLine, ...scope.lines(), "", ...lines].join("\n");
         return { source, warnings };
     }
 }
@@ -45,11 +50,37 @@ const CONSTRUCTORS = {
     config: "DockerConfig",
     secret: "DockerSecret",
 };
-function propsLiteral(entity) {
-    if (entity.kind === "service") {
-        return JSON.stringify(entity.props, null, 2).replace(/"([a-z_][a-z0-9_]*)":/g, "$1:");
+function propsLiteral(entity, scope) {
+    // Embedded references (a config's `content` another lexicon imported) are
+    // rendered as expressions in place of a placeholder string.
+    const refs = [];
+    const props = withPlaceholders(entity.props, refs);
+    let out;
+    if (entity.kind === "service" || refs.length > 0) {
+        out = JSON.stringify(props, null, 2).replace(/"([a-z_][a-z0-9_]*)":/g, "$1:");
+    }
+    else {
+        out = Object.keys(props).length > 0 ? JSON.stringify(props) : "{}";
+    }
+    refs.forEach((ref, i) => {
+        out = out.replace(JSON.stringify(placeholder(i)), () => renderEmbeddedReference(ref, scope, 2));
+    });
+    return out;
+}
+function placeholder(i) {
+    return `\u0000chant-embedded-${i}\u0000`;
+}
+function withPlaceholders(value, refs) {
+    if (isEmbeddedReference(value)) {
+        refs.push(value);
+        return placeholder(refs.length - 1);
+    }
+    if (Array.isArray(value))
+        return value.map((v) => withPlaceholders(v, refs));
+    if (value && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, withPlaceholders(v, refs)]));
     }
-    return Object.keys(entity.props).length > 0 ? JSON.stringify(entity.props) : "{}";
+    return value;
 }
 /** Words an export cannot be named, and the names the generated file imports. */
 const RESERVED = new Set([

package/dist/import/live-export.d.ts

@@ -0,0 +1,142 @@
+/**
+ * Pure export helpers for the docker lexicon (#4388): turn what the Engine API
+ * returns for a compose project's containers back into the compose document a
+ * user would have written, and map it to import IR through `DockerParser`. All
+ * Engine I/O stays in the caller (`../export-resources`).
+ *
+ * A compose project is the set of containers labelled
+ * `com.docker.compose.project=<name>`; each service is the container labelled
+ * `com.docker.compose.service`, the lowest `container-number` when scaled.
+ * One-off containers (`compose run`) are skipped.
+ *
+ * Configs. Outside swarm, a top-level config is not an Engine object. A
+ * `content` config is copied into the container when it is created, and a
+ * `file` config is bind-mounted; neither is named anywhere the Engine keeps.
+ * What the container does keep is its command, so the files a service is
+ * told to read (`--config=/etc/otelcol-contrib/config.yaml`) are the
+ * candidates, and the caller reads each through
+ * `GET /containers/{id}/archive?path=…`, which works for both forms and for a
+ * remote Engine whose host paths are out of reach. A candidate that reads back
+ * as one text file becomes a `content` config mounted at that path, named
+ * `<service>-<file name>` (the original key is not recoverable). A candidate
+ * inside a volume or a directory bind mount belongs to that mount and is not
+ * read.
+ *
+ * The strip. By default fields the image supplies (its command, entrypoint,
+ * environment, labels, working dir and user) are dropped, so a service reaches
+ * the shape it was declared in; `verbatim` keeps them. Compose's own
+ * `com.docker.compose.*` labels are always dropped: compose writes them, and a
+ * declaration that set them would fight it.
+ *
+ * Ownership. The docker serializer stamps no marker, so under `owned` only
+ * services carrying the label marker (`app.kubernetes.io/managed-by: chant`,
+ * set with `defaultLabels`) are exported, and the caller logs that once.
+ */
+import type { ExportedTemplate, ResourceSelector } from "@intentius/chant/lexicon";
+export declare const PROJECT_LABEL = "com.docker.compose.project";
+export declare const SERVICE_LABEL = "com.docker.compose.service";
+type Json = Record<string, unknown>;
+/** A container's or an image's healthcheck, durations in nanoseconds. */
+export interface HealthcheckInspect {
+    Test?: string[];
+    Interval?: number;
+    Timeout?: number;
+    Retries?: number;
+    StartPeriod?: number;
+}
+/** What `GET /containers/{id}/json` returns, as far as export reads it. */
+export interface ContainerInspect {
+    Id?: string;
+    Name?: string;
+    Config?: {
+        Image?: string;
+        Cmd?: string[] | null;
+        Entrypoint?: string[] | null;
+        Env?: string[] | null;
+        Labels?: Record<string, string> | null;
+        WorkingDir?: string;
+        User?: string;
+        Healthcheck?: HealthcheckInspect | null;
+    };
+    HostConfig?: {
+        PortBindings?: Record<string, Array<{
+            HostIp?: string;
+            HostPort?: string;
+        }> | null> | null;
+        RestartPolicy?: {
+            Name?: string;
+            MaximumRetryCount?: number;
+        } | null;
+    };
+    Mounts?: Array<{
+        Type?: string;
+        Name?: string;
+        Source?: string;
+        Destination?: string;
+        RW?: boolean;
+    }>;
+    NetworkSettings?: {
+        Networks?: Record<string, unknown> | null;
+    };
+}
+/** What `GET /images/{name}/json` returns, as far as export reads it. */
+export interface ImageInspect {
+    Config?: {
+        Cmd?: string[] | null;
+        Entrypoint?: string[] | null;
+        Env?: string[] | null;
+        Labels?: Record<string, string> | null;
+        WorkingDir?: string;
+        User?: string;
+        Healthcheck?: HealthcheckInspect | null;
+    };
+}
+/** One service as read from the Engine: its container, its image, and the config files read out of it. */
+export interface LiveService {
+    name: string;
+    container: ContainerInspect;
+    image?: ImageInspect;
+    /** Config target path → the text read from the container. */
+    files: Record<string, string>;
+}
+/**
+ * The containers to export, one per service: compose-labelled for `project`,
+ * not one-off, and the lowest container number when a service is scaled.
+ * `summaries` is what `GET /containers/json` returns.
+ */
+export declare function serviceContainers(project: string, summaries: Array<{
+    Id?: string;
+    Labels?: Record<string, string> | null;
+}>): Map<string, string>;
+/**
+ * The paths a container's command names that may be config files: an
+ * absolute path with a file extension, alone or as a `--flag=` value (an
+ * otel `file:` URI included). A path inside a volume, or inside a directory
+ * bind mount, belongs to that mount and is left out.
+ */
+export declare function configCandidates(container: ContainerInspect): string[];
+/**
+ * The compose document a project's services were created from. External
+ * volumes and networks (not prefixed with the project name) are declared
+ * `external`.
+ */
+export declare function composeFromLive(project: string, services: LiveService[], opts?: {
+    verbatim?: boolean;
+}): Json;
+/** Whether a container carries chant's label marker. */
+export declare function isChantOwned(container: ContainerInspect): boolean;
+/**
+ * Build export IR from one compose project's services, through
+ * {@link DockerParser} as the single compose → IR mapping. `owned` keeps only
+ * services carrying chant's marker; `selector` narrows by IR type (`service`,
+ * `config`, …) and compose key. `reparse(context)` parses the same document
+ * again with a `ParseContext`, so `chant import --from` hands a collector
+ * config to the otel importer, as a file import does (#3373).
+ */
+export declare function buildExportFromProject(project: string, services: LiveService[], opts?: {
+    verbatim?: boolean;
+    selector?: ResourceSelector;
+    owned?: boolean;
+}): ExportedTemplate;
+export {};
+//# sourceMappingURL=live-export.d.ts.map

package/dist/import/live-export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-export.d.ts","sourceRoot":"","sources":["../../src/import/live-export.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAMnF,eAAO,MAAM,aAAa,+BAA+B,CAAC;AAC1D,eAAO,MAAM,aAAa,+BAA+B,CAAC;AAK1D,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpC,yEAAyE;AACzE,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE;QACP,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACtB,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAC7B,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;QACvC,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;KACzC,CAAC;IACF,UAAU,CAAC,EAAE;QACX,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;QAC3F,aAAa,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC;KACtE,CAAC;IACF,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACtG,eAAe,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;KAAE,CAAC;CACjE;AAED,yEAAyE;AACzE,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE;QACP,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACtB,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAC7B,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;QACvC,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;KACzC,CAAC;CACH;AAED,0GAA0G;AAC1G,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,gBAAgB,CAAC;IAC5B,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAMD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC;IAAE,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;CAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAajJ;AAOD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,gBAAgB,GAAG,MAAM,EAAE,CActE;AAkJD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,IAAI,CAoBjH;AAED,wDAAwD;AACxD,wBAAgB,YAAY,CAAC,SAAS,EAAE,gBAAgB,GAAG,OAAO,CAEjE;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,WAAW,EAAE,EACvB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9E,gBAAgB,CAOlB"}