@intentius/chant-lexicon-docker 0.124.46 → 0.124.49

package/dist/import/live-export.js

@@ -0,0 +1,297 @@
+/**
+ * Pure export helpers for the docker lexicon (#4388): turn what the Engine API
+ * returns for a compose project's containers back into the compose document a
+ * user would have written, and map it to import IR through `DockerParser`. All
+ * Engine I/O stays in the caller (`../export-resources`).
+ *
+ * A compose project is the set of containers labelled
+ * `com.docker.compose.project=<name>`; each service is the container labelled
+ * `com.docker.compose.service`, the lowest `container-number` when scaled.
+ * One-off containers (`compose run`) are skipped.
+ *
+ * Configs. Outside swarm, a top-level config is not an Engine object. A
+ * `content` config is copied into the container when it is created, and a
+ * `file` config is bind-mounted; neither is named anywhere the Engine keeps.
+ * What the container does keep is its command, so the files a service is
+ * told to read (`--config=/etc/otelcol-contrib/config.yaml`) are the
+ * candidates, and the caller reads each through
+ * `GET /containers/{id}/archive?path=…`, which works for both forms and for a
+ * remote Engine whose host paths are out of reach. A candidate that reads back
+ * as one text file becomes a `content` config mounted at that path, named
+ * `<service>-<file name>` (the original key is not recoverable). A candidate
+ * inside a volume or a directory bind mount belongs to that mount and is not
+ * read.
+ *
+ * The strip. By default fields the image supplies (its command, entrypoint,
+ * environment, labels, working dir and user) are dropped, so a service reaches
+ * the shape it was declared in; `verbatim` keeps them. Compose's own
+ * `com.docker.compose.*` labels are always dropped: compose writes them, and a
+ * declaration that set them would fight it.
+ *
+ * Ownership. The docker serializer stamps no marker, so under `owned` only
+ * services carrying the label marker (`app.kubernetes.io/managed-by: chant`,
+ * set with `defaultLabels`) are exported, and the caller logs that once.
+ */
+import { hasOwnershipMarker, LABEL_OWNERSHIP_KEYS } from "@intentius/chant/ownership";
+import { DockerParser } from "./parser.js";
+import { dockerResultToTemplate } from "./adapter.js";
+export const PROJECT_LABEL = "com.docker.compose.project";
+export const SERVICE_LABEL = "com.docker.compose.service";
+const NUMBER_LABEL = "com.docker.compose.container-number";
+const ONEOFF_LABEL = "com.docker.compose.oneoff";
+const DEPENDS_LABEL = "com.docker.compose.depends_on";
+function same(a, b) {
+    return JSON.stringify(a ?? null) === JSON.stringify(b ?? null);
+}
+/**
+ * The containers to export, one per service: compose-labelled for `project`,
+ * not one-off, and the lowest container number when a service is scaled.
+ * `summaries` is what `GET /containers/json` returns.
+ */
+export function serviceContainers(project, summaries) {
+    const best = new Map();
+    for (const s of summaries) {
+        const labels = s.Labels ?? {};
+        if (labels[PROJECT_LABEL] !== project || !s.Id)
+            continue;
+        if ((labels[ONEOFF_LABEL] ?? "").toLowerCase() === "true")
+            continue;
+        const service = labels[SERVICE_LABEL];
+        if (!service)
+            continue;
+        const n = Number(labels[NUMBER_LABEL] ?? "1") || 1;
+        const prev = best.get(service);
+        if (!prev || n < prev.n)
+            best.set(service, { id: s.Id, n });
+    }
+    return new Map([...best].sort(([a], [b]) => a.localeCompare(b)).map(([service, { id }]) => [service, id]));
+}
+function under(path, dir) {
+    const d = dir.endsWith("/") ? dir : `${dir}/`;
+    return path.startsWith(d);
+}
+/**
+ * The paths a container's command names that may be config files: an
+ * absolute path with a file extension, alone or as a `--flag=` value (an
+ * otel `file:` URI included). A path inside a volume, or inside a directory
+ * bind mount, belongs to that mount and is left out.
+ */
+export function configCandidates(container) {
+    const args = [...(container.Config?.Entrypoint ?? []), ...(container.Config?.Cmd ?? [])];
+    const mounts = container.Mounts ?? [];
+    const out = [];
+    for (const arg of args) {
+        let value = arg.startsWith("-") && arg.includes("=") ? arg.slice(arg.indexOf("=") + 1) : arg;
+        if (value.startsWith("file:"))
+            value = value.slice("file:".length);
+        if (!/^\/[^\s,;:]+$/.test(value))
+            continue;
+        const base = value.split("/").pop();
+        if (!/\.[A-Za-z0-9]+$/.test(base))
+            continue;
+        if (mounts.some((m) => m.Destination && under(value, m.Destination)))
+            continue;
+        if (!out.includes(value))
+            out.push(value);
+    }
+    return out;
+}
+function stripProjectPrefix(project, name) {
+    return name.startsWith(`${project}_`) ? name.slice(project.length + 1) : undefined;
+}
+function envMap(env) {
+    const out = {};
+    for (const e of env) {
+        const i = e.indexOf("=");
+        if (i === -1)
+            out[e] = null;
+        else
+            out[e.slice(0, i)] = e.slice(i + 1);
+    }
+    return out;
+}
+function duration(ns) {
+    if (!ns)
+        return undefined;
+    const ms = ns / 1e6;
+    return ms % 1000 === 0 ? `${ms / 1000}s` : `${ms}ms`;
+}
+function portList(bindings) {
+    const out = [];
+    for (const [key, binds] of Object.entries(bindings ?? {})) {
+        const [port, proto] = key.split("/");
+        const suffix = proto && proto !== "tcp" ? `/${proto}` : "";
+        if (!binds || binds.length === 0) {
+            out.push(`${port}${suffix}`);
+            continue;
+        }
+        for (const b of binds) {
+            const ip = b.HostIp && b.HostIp !== "0.0.0.0" && b.HostIp !== "::" ? `${b.HostIp}:` : "";
+            out.push(b.HostPort ? `${ip}${b.HostPort}:${port}${suffix}` : `${port}${suffix}`);
+        }
+    }
+    // The Engine may list `::` and `0.0.0.0` bindings of one port separately.
+    return [...new Set(out)];
+}
+function dependsOn(label) {
+    if (!label)
+        return undefined;
+    const entries = label
+        .split(",")
+        .map((e) => e.split(":"))
+        .filter(([name]) => !!name);
+    if (entries.length === 0)
+        return undefined;
+    if (entries.every(([, condition, restart]) => (condition ?? "service_started") === "service_started" && restart !== "true")) {
+        return entries.map(([name]) => name);
+    }
+    return Object.fromEntries(entries.map(([name, condition, restart]) => [name, { condition: condition || "service_started", ...(restart === "true" ? { restart: true } : {}) }]));
+}
+/** The compose service a container was created from, and the config files it mounts. */
+function serviceFromContainer(project, live, verbatim) {
+    const c = live.container.Config ?? {};
+    const img = live.image?.Config ?? {};
+    const keep = (live, image) => verbatim || !same(live, image);
+    const service = {};
+    if (c.Image)
+        service.image = c.Image;
+    if (c.Entrypoint && c.Entrypoint.length > 0 && keep(c.Entrypoint, img.Entrypoint))
+        service.entrypoint = c.Entrypoint;
+    if (c.Cmd && c.Cmd.length > 0 && keep(c.Cmd, img.Cmd))
+        service.command = c.Cmd;
+    const imageEnv = new Set(img.Env ?? []);
+    const env = (c.Env ?? []).filter((e) => verbatim || !imageEnv.has(e));
+    if (env.length > 0)
+        service.environment = envMap(env);
+    const labels = {};
+    for (const [k, v] of Object.entries(c.Labels ?? {})) {
+        if (k.startsWith("com.docker.compose."))
+            continue;
+        if (!verbatim && img.Labels?.[k] === v)
+            continue;
+        labels[k] = v;
+    }
+    if (Object.keys(labels).length > 0)
+        service.labels = labels;
+    if (c.WorkingDir && keep(c.WorkingDir, img.WorkingDir ?? ""))
+        service.working_dir = c.WorkingDir;
+    if (c.User && keep(c.User, img.User ?? ""))
+        service.user = c.User;
+    if (c.Healthcheck?.Test && c.Healthcheck.Test.length > 0 && keep(c.Healthcheck, img.Healthcheck)) {
+        const h = c.Healthcheck;
+        service.healthcheck = {
+            test: h.Test,
+            ...(duration(h.Interval) ? { interval: duration(h.Interval) } : {}),
+            ...(duration(h.Timeout) ? { timeout: duration(h.Timeout) } : {}),
+            ...(h.Retries ? { retries: h.Retries } : {}),
+            ...(duration(h.StartPeriod) ? { start_period: duration(h.StartPeriod) } : {}),
+        };
+    }
+    const ports = portList(live.container.HostConfig?.PortBindings);
+    if (ports.length > 0)
+        service.ports = ports;
+    const restart = live.container.HostConfig?.RestartPolicy;
+    if (restart?.Name && restart.Name !== "no") {
+        service.restart = restart.Name === "on-failure" && restart.MaximumRetryCount ? `on-failure:${restart.MaximumRetryCount}` : restart.Name;
+    }
+    const deps = dependsOn(c.Labels?.[DEPENDS_LABEL]);
+    if (deps !== undefined)
+        service.depends_on = deps;
+    // Mounts: a config read at a mount's destination is that config, not a volume.
+    const volumes = [];
+    const mountList = [];
+    for (const m of live.container.Mounts ?? []) {
+        if (!m.Destination || live.files[m.Destination] !== undefined)
+            continue;
+        const ro = m.RW === false ? ":ro" : "";
+        if (m.Type === "volume" && m.Name) {
+            const key = stripProjectPrefix(project, m.Name);
+            if (key) {
+                volumes.push(key);
+                mountList.push(`${key}:${m.Destination}${ro}`);
+            }
+            else if (/^[0-9a-f]{64}$/.test(m.Name)) {
+                mountList.push(m.Destination);
+            }
+            else {
+                volumes.push(m.Name);
+                mountList.push(`${m.Name}:${m.Destination}${ro}`);
+            }
+        }
+        else if (m.Type === "bind" && m.Source) {
+            mountList.push(`${m.Source}:${m.Destination}${ro}`);
+        }
+    }
+    if (mountList.length > 0)
+        service.volumes = mountList;
+    const networks = [];
+    for (const net of Object.keys(live.container.NetworkSettings?.Networks ?? {})) {
+        networks.push(stripProjectPrefix(project, net) ?? net);
+    }
+    const declaredNets = networks.filter((n) => n !== "default");
+    if (declaredNets.length > 0)
+        service.networks = networks;
+    const configs = Object.entries(live.files).map(([target, content]) => {
+        const base = target.split("/").pop().replace(/\.[^.]*$/, "");
+        return { name: `${live.name}-${base}`, target, content };
+    });
+    if (configs.length > 0)
+        service.configs = configs.map(({ name, target }) => ({ source: name, target }));
+    return { service, configs, volumes, networks: declaredNets };
+}
+/**
+ * The compose document a project's services were created from. External
+ * volumes and networks (not prefixed with the project name) are declared
+ * `external`.
+ */
+export function composeFromLive(project, services, opts = {}) {
+    const doc = { services: {}, configs: {}, volumes: {}, networks: {} };
+    for (const live of services) {
+        const { service, configs, volumes, networks } = serviceFromContainer(project, live, opts.verbatim ?? false);
+        doc.services[live.name] = service;
+        for (const cfg of configs)
+            doc.configs[cfg.name] = { content: cfg.content };
+        for (const v of volumes) {
+            const owned = (live.container.Mounts ?? []).some((m) => m.Name === `${project}_${v}`);
+            doc.volumes[v] = owned ? {} : { external: true };
+        }
+        for (const n of networks) {
+            const owned = Object.keys(live.container.NetworkSettings?.Networks ?? {}).includes(`${project}_${n}`);
+            doc.networks[n] = owned ? {} : { external: true };
+        }
+    }
+    const out = { services: doc.services };
+    for (const section of ["volumes", "networks", "configs"]) {
+        if (Object.keys(doc[section]).length > 0)
+            out[section] = doc[section];
+    }
+    return out;
+}
+/** Whether a container carries chant's label marker. */
+export function isChantOwned(container) {
+    return hasOwnershipMarker(container.Config?.Labels ?? undefined, LABEL_OWNERSHIP_KEYS);
+}
+/**
+ * Build export IR from one compose project's services, through
+ * {@link DockerParser} as the single compose → IR mapping. `owned` keeps only
+ * services carrying chant's marker; `selector` narrows by IR type (`service`,
+ * `config`, …) and compose key. `reparse(context)` parses the same document
+ * again with a `ParseContext`, so `chant import --from` hands a collector
+ * config to the otel importer, as a file import does (#3373).
+ */
+export function buildExportFromProject(project, services, opts = {}) {
+    const kept = opts.owned ? services.filter((s) => isChantOwned(s.container)) : services;
+    if (kept.length === 0)
+        return { resources: [], parameters: [] };
+    const doc = composeFromLive(project, kept, { verbatim: opts.verbatim });
+    const parse = (context) => select(dockerResultToTemplate(new DockerParser().parseDocument(doc, context)), opts.selector);
+    return { ...parse(), reparse: (context) => parse(context) };
+}
+function select(ir, selector) {
+    if (!selector || (selector.type === undefined && selector.name === undefined))
+        return ir;
+    return {
+        ...ir,
+        resources: ir.resources.filter((r) => (selector.type === undefined || r.type === selector.type) && (selector.name === undefined || r.logicalId === selector.name)),
+    };
+}

package/dist/import/parser.d.ts

@@ -2,6 +2,7 @@
  * Docker Compose + Dockerfile parser — converts existing YAML/Dockerfiles
  * to an intermediate representation (IR) for TypeScript code generation.
  */
+import type { ParseContext } from "@intentius/chant/import/parser";
 export interface ServiceIR {
     kind: "service";
     name: string;
@@ -87,7 +88,14 @@ export declare function composeFields(): Map<ComposeKind, Set<string>>;
  * Converts YAML to an IR consumable by the TypeScript generator.
  */
 export declare class DockerParser {
-    parse(content: string): ParseResult;
+    /**
+     * With `context.embedded` (`chant import`), a config's `content` another
+     * lexicon owns (a collector config) is handed to it (see ./embedded.ts).
+     * Without it, every config is kept as written.
+     */
+    parse(content: string, context?: ParseContext): ParseResult;
+    /** The same as {@link parse}, over a compose document already read (live export builds one). */
+    parseDocument(doc: Record<string, unknown> | undefined, context?: ParseContext): ParseResult;
 }
 /** One logical Dockerfile instruction: its upper-case keyword and the rest as written. */
 export interface DockerfileInstruction {

package/dist/import/parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/import/parser.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,YAAY,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B;AAED,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,YAAY,CAAC;AAE7F,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,gGAAgG;AAChG,QAAA,MAAM,QAAQ;aACV,OAAO,EAAE,UAAU;aAAE,IAAI,EAAE,SAAS;aAAE,KAAK,EAAE,SAAS;;aACtD,OAAO,EAAE,SAAS;aAAE,IAAI,EAAE,QAAQ;aAAE,KAAK,EAAE,QAAQ;;aACnD,OAAO,EAAE,UAAU;aAAE,IAAI,EAAE,SAAS;aAAE,KAAK,EAAE,SAAS;;aACtD,OAAO,EAAE,SAAS;aAAE,IAAI,EAAE,QAAQ;aAAE,KAAK,EAAE,cAAc;;aACzD,OAAO,EAAE,SAAS;aAAE,IAAI,EAAE,QAAQ;aAAE,KAAK,EAAE,cAAc;EACnD,CAAC;AAEX,KAAK,WAAW,GAAG,CAAC,OAAO,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;AAIrD;;;;;GAKG;AACH,wBAAgB,aAAa,IAAI,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAe7D;AAsBD;;;GAGG;AACH,qBAAa,YAAY;IACvB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,CA0BlC;CACF;AAED,0FAA0F;AAC1F,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,qBAAqB,EAAE,CAuCpF;AAED;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,YAAY,CAuBjD;CACF;AAED,yHAAyH;AACzH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAS5D"}
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/import/parser.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAGnE,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,YAAY,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B;AAED,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,YAAY,CAAC;AAE7F,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,gGAAgG;AAChG,QAAA,MAAM,QAAQ;aACV,OAAO,EAAE,UAAU;aAAE,IAAI,EAAE,SAAS;aAAE,KAAK,EAAE,SAAS;;aACtD,OAAO,EAAE,SAAS;aAAE,IAAI,EAAE,QAAQ;aAAE,KAAK,EAAE,QAAQ;;aACnD,OAAO,EAAE,UAAU;aAAE,IAAI,EAAE,SAAS;aAAE,KAAK,EAAE,SAAS;;aACtD,OAAO,EAAE,SAAS;aAAE,IAAI,EAAE,QAAQ;aAAE,KAAK,EAAE,cAAc;;aACzD,OAAO,EAAE,SAAS;aAAE,IAAI,EAAE,QAAQ;aAAE,KAAK,EAAE,cAAc;EACnD,CAAC;AAEX,KAAK,WAAW,GAAG,CAAC,OAAO,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;AAIrD;;;;;GAKG;AACH,wBAAgB,aAAa,IAAI,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAe7D;AAsBD;;;GAGG;AACH,qBAAa,YAAY;IACvB;;;;OAIG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,WAAW,CAG1D;IAED,gGAAgG;IAChG,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,WAAW,CA8B3F;CACF;AAED,0FAA0F;AAC1F,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,qBAAqB,EAAE,CAuCpF;AAED;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,YAAY,CAuBjD;CACF;AAED,yHAAyH;AACzH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAS5D"}

package/dist/import/parser.js

@@ -6,6 +6,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { parseYAML } from "@intentius/chant/yaml";
+import { delegateEmbedded } from "./embedded.js";
 /** The compose sections import reads, with the kind each holds and its entry in the lexicon. */
 const SECTIONS = [
     { section: "services", kind: "service", entry: "Service" },
@@ -59,12 +60,20 @@ function extractProps(raw, allowed, where, kind, warnings) {
  * Converts YAML to an IR consumable by the TypeScript generator.
  */
 export class DockerParser {
-    parse(content) {
+    /**
+     * With `context.embedded` (`chant import`), a config's `content` another
+     * lexicon owns (a collector config) is handed to it (see ./embedded.ts).
+     * Without it, every config is kept as written.
+     */
+    parse(content, context) {
         if (!content.trim())
             return { entities: [], warnings: [] };
+        return this.parseDocument(parseYAML(content), context);
+    }
+    /** The same as {@link parse}, over a compose document already read (live export builds one). */
+    parseDocument(doc, context) {
         const entities = [];
         const warnings = [];
-        const doc = parseYAML(content);
         const fields = composeFields();
         const known = new Set(SECTIONS.map((s) => s.section));
         for (const key of Object.keys(doc ?? {})) {
@@ -83,6 +92,14 @@ export class DockerParser {
                 });
             }
         }
+        if (context?.embedded) {
+            const configs = new Map(entities.filter((e) => e.kind === "config").map((e) => [e.name, e.props]));
+            const services = doc?.services;
+            delegateEmbedded(configs, services && typeof services === "object" && !Array.isArray(services) ? services : undefined, context.embedded);
+            for (const e of entities)
+                if (e.kind === "config")
+                    e.props = configs.get(e.name);
+        }
         return { entities, warnings };
     }
 }

package/dist/import/testdata/tar.d.ts

@@ -0,0 +1,3 @@
+/** A ustar archive of regular files and directories, as `GET /containers/{id}/archive` returns one (test fixture). */
+export declare function tarOf(...entries: Array<[name: string, content: string | null]>): Buffer;
+//# sourceMappingURL=tar.d.ts.map

package/dist/import/testdata/tar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tar.d.ts","sourceRoot":"","sources":["../../../src/import/testdata/tar.ts"],"names":[],"mappings":"AAAA,sHAAsH;AACtH,wBAAgB,KAAK,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,GAAG,MAAM,CAsBvF"}

package/dist/import/testdata/tar.js

@@ -0,0 +1,25 @@
+/** A ustar archive of regular files and directories, as `GET /containers/{id}/archive` returns one (test fixture). */
+export function tarOf(...entries) {
+    const blocks = [];
+    for (const [name, content] of entries) {
+        const data = content === null ? Buffer.alloc(0) : Buffer.from(content, "utf8");
+        const header = Buffer.alloc(512);
+        header.write(name, 0, 100, "utf8");
+        header.write("0000644\0", 100, 8, "ascii");
+        header.write("0000000\0", 108, 8, "ascii");
+        header.write("0000000\0", 116, 8, "ascii");
+        header.write(`${data.length.toString(8).padStart(11, "0")}\0`, 124, 12, "ascii");
+        header.write("00000000000\0", 136, 12, "ascii");
+        header.write(content === null ? "5" : "0", 156, 1, "ascii");
+        header.write("ustar\0", 257, 6, "ascii");
+        header.write("00", 263, 2, "ascii");
+        header.fill(" ", 148, 156);
+        let sum = 0;
+        for (const b of header)
+            sum += b;
+        header.write(`${sum.toString(8).padStart(6, "0")}\0 `, 148, 8, "ascii");
+        blocks.push(header, data, Buffer.alloc((512 - (data.length % 512)) % 512));
+    }
+    blocks.push(Buffer.alloc(1024));
+    return Buffer.concat(blocks);
+}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "5a484236f7c739cb2a78374e2585ec115b9c6544a030bfa20520cf23bffe1ad4",
+    "manifest.json": "ae7e2a89319b195c4a7015127f4d5c58be08e79c505c0aa691217bc55b51f7ff",
     "meta.json": "b566d5cb84a87836a861dc5840c229577e860c5427123192810b7839f764a9ee",
     "types/index.d.ts": "256644d2bffa2845900cf86984cc7dde3d9e79da5994ab13a22b0b83edf7f62a",
     "rules/no-latest-tag.ts": "2281be0457c02e782fbafe015f65ff5fd2b008ef0f879226e9b548a3ea65399b",
@@ -24,5 +24,5 @@
     "skills/chant-docker.md": "d499e18525f2cfd7ecc5b5be4a4c52c6931ebdef8d70f872d53279e53bed6f7e",
     "skills/chant-docker-patterns.md": "655f437c833796e0d520bbe08740a4226d48fcec4912b0438672ed5a299897e7"
   },
-  "composite": "3b3069dbc3c7dc9eb8446348ba84227fcd63d48a0686325f87a7623f5ba08097"
+  "composite": "f77f0cd91cd6971d35930ca2372af4fe50b1ae33b3553099441433da33e347f9"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "docker",
-  "version": "0.124.46",
+  "version": "0.124.49",
   "chantVersion": ">=0.1.0",
   "namespace": "Docker",
   "intrinsics": [

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAe7F,eAAO,MAAM,YAAY,EAAE,aA8O1B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAe7F,eAAO,MAAM,YAAY,EAAE,aAoP1B,CAAC"}

package/dist/plugin.js

@@ -222,6 +222,11 @@ export const api = new Service({
             ],
         },
     ]),
+    // Live export (#4388): a compose project's services, read from the Engine API.
+    async exportResources(options) {
+        const { exportResources } = await import("./export-resources.js");
+        return exportResources(options);
+    },
     async listArtifacts(options) {
         const { listArtifacts } = await import("./list-artifacts.js");
         return listArtifacts(options);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-docker",
-  "version": "0.124.46",
+  "version": "0.124.49",
   "description": "Docker lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -63,13 +63,13 @@
     "build": "../../scripts/tsc7.sh -p tsconfig.build.json --sourceMap false && tsc-alias -p tsconfig.build.json"
   },
   "dependencies": {
-    "@intentius/chant-lexicon-otel": "^0.124.46"
+    "@intentius/chant-lexicon-otel": "^0.124.49"
   },
   "devDependencies": {
     "@intentius/chant": "*",
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.46"
+    "@intentius/chant": "^0.124.49"
   }
 }

package/src/export-resources.ts

@@ -0,0 +1,90 @@
+/**
+ * Live export for the docker lexicon (#4388): implements
+ * `LexiconPlugin.exportResources()` so `chant import --from <env>` regenerates
+ * a compose project's services, and the configs they read, as chant
+ * TypeScript.
+ *
+ * Which project: `COMPOSE_PROJECT_NAME` when set, else the environment name.
+ * The containers are found by compose's `com.docker.compose.project` label.
+ * All Engine I/O lives here; mapping is pure in `./import/live-export`.
+ */
+
+import type { ExportedTemplate, ResourceSelector } from "@intentius/chant/lexicon";
+import { defaultDockerEngine, singleFileText, type DockerEngine } from "./import/engine";
+import {
+  buildExportFromProject,
+  configCandidates,
+  isChantOwned,
+  PROJECT_LABEL,
+  serviceContainers,
+  type ContainerInspect,
+  type ImageInspect,
+  type LiveService,
+} from "./import/live-export";
+
+function json<T>(body: Buffer): T | undefined {
+  try {
+    return JSON.parse(body.toString("utf8")) as T;
+  } catch {
+    return undefined;
+  }
+}
+
+/** The compose project an environment exports. */
+export function projectFor(environment: string): string {
+  return process.env.COMPOSE_PROJECT_NAME || environment;
+}
+
+export async function exportResources(
+  options: {
+    environment: string;
+    selector?: ResourceSelector;
+    owned?: boolean;
+    verbatim?: boolean;
+  },
+  engine: DockerEngine = defaultDockerEngine(),
+  signal?: AbortSignal,
+): Promise<ExportedTemplate> {
+  const project = projectFor(options.environment);
+  const filters = encodeURIComponent(JSON.stringify({ label: [`${PROJECT_LABEL}=${project}`] }));
+  const list = await engine(`/containers/json?all=1&filters=${filters}`, signal);
+  if (list.status !== 200) {
+    throw new Error(`docker live export: listing the containers of compose project ${project} failed (${list.status}): ${list.body.toString("utf8").trim()}`);
+  }
+  const containers = serviceContainers(project, json<Array<{ Id?: string; Labels?: Record<string, string> }>>(list.body) ?? []);
+
+  const services: LiveService[] = [];
+  const images = new Map<string, ImageInspect | undefined>();
+  for (const [name, id] of containers) {
+    const res = await engine(`/containers/${encodeURIComponent(id)}/json`, signal);
+    const container = res.status === 200 ? json<ContainerInspect>(res.body) : undefined;
+    if (!container) continue;
+
+    const ref = container.Config?.Image;
+    if (ref && !images.has(ref)) {
+      const img = await engine(`/images/${encodeURIComponent(ref)}/json`, signal);
+      images.set(ref, img.status === 200 ? json<ImageInspect>(img.body) : undefined);
+    }
+
+    // Config files are read only for the services that are exported.
+    const files: Record<string, string> = {};
+    if (!options.owned || isChantOwned(container)) {
+      for (const path of configCandidates(container)) {
+        const res = await engine(`/containers/${encodeURIComponent(id)}/archive?path=${encodeURIComponent(path)}`, signal);
+        if (res.status !== 200) continue;
+        const text = singleFileText(res.body);
+        if (text !== undefined) files[path] = text;
+      }
+    }
+
+    services.push({ name, container, image: ref ? images.get(ref) : undefined, files });
+  }
+
+  if (options.owned) {
+    console.warn(
+      "[docker] the docker serializer stamps no ownership marker; under --owned only services labelled app.kubernetes.io/managed-by=chant (defaultLabels) are exported",
+    );
+  }
+
+  return buildExportFromProject(project, services, options);
+}

package/src/import/adapter.ts

@@ -11,10 +11,10 @@
  * reverse the mapping in the generator so DockerGenerator can do the real work.
  */
 
-import type { TemplateIR, TemplateParser, ResourceIR } from "@intentius/chant/import/parser";
+import type { TemplateIR, TemplateParser, ResourceIR, ParseContext } from "@intentius/chant/import/parser";
 import type { GeneratedFile, TypeScriptGenerator } from "@intentius/chant/import/generator";
 import { DockerParser, DockerfileParser, looksLikeDockerfile } from "./parser";
-import type { DockerIR, DockerfileStage } from "./parser";
+import type { DockerIR, DockerfileStage, ParseResult } from "./parser";
 import { DockerGenerator } from "./generator";
 
 /** Convert a DockerIR into the core ResourceIR shape. */
@@ -66,21 +66,26 @@ function resourceToDockerIr(resource: ResourceIR): DockerIR {
  * entities to a TemplateIR.
  */
 export class DockerTemplateParser implements TemplateParser {
-  parse(content: string): TemplateIR {
+  /** With `context.embedded`, a config's `content` another lexicon owns is handed to it (#3373). */
+  parse(content: string, context?: ParseContext): TemplateIR {
     // A Dockerfile has no name of its own; it imports as `app`
     // (Dockerfile.app). Rename the export to choose the file name.
     if (looksLikeDockerfile(content)) {
       return { resources: [dockerIrToResource(new DockerfileParser().parse("app", content))], parameters: [] };
     }
-    const { entities, warnings } = new DockerParser().parse(content);
-    return {
-      resources: entities.map(dockerIrToResource),
-      parameters: [],
-      ...(warnings.length > 0 ? { warnings } : {}),
-    };
+    return dockerResultToTemplate(new DockerParser().parse(content, context));
   }
 }
 
+/** A compose parse result as the core TemplateIR. */
+export function dockerResultToTemplate({ entities, warnings }: ParseResult): TemplateIR {
+  return {
+    resources: entities.map(dockerIrToResource),
+    parameters: [],
+    ...(warnings.length > 0 ? { warnings } : {}),
+  };
+}
+
 /**
  * TypeScriptGenerator adapter — converts a TemplateIR back into DockerIR[]
  * and delegates to DockerGenerator, returning a single generated file.