@johnhenry/sitefile 0.0.0-stage → 0.0.0

package/lib/src/cbor.d.ts

@@ -0,0 +1,39 @@
+export declare function cborHead(major: number, n: number | bigint): Uint8Array;
+export declare const cborUint: (n: number | bigint) => Uint8Array;
+export declare const cborBytes: (b: Uint8Array) => Uint8Array;
+export declare const cborText: (s: string) => Uint8Array;
+/** Array of already-encoded items. */
+export declare const cborArray: (items: readonly Uint8Array[]) => Uint8Array;
+/** Map of already-encoded [key, value] pairs, in deterministic key order. */
+export declare function cborMap(entries: ReadonlyArray<readonly [Uint8Array, Uint8Array]>): Uint8Array;
+/**
+ * Decoded CBOR. Unsigned integers above 2^53-1 and negative integers below
+ * -(2^53-1) come back as bigint. Byte strings are views into the input (not
+ * copies). Maps are `Map`s (never plain objects, so keys like `__proto__` are
+ * inert); a key that appears twice is an error.
+ */
+export type CborValue = number | bigint | string | boolean | null | Uint8Array | CborValue[] | Map<CborValue, CborValue>;
+export interface CborLimits {
+    /** Maximum nesting of arrays/maps (default 32). */
+    maxDepth?: number;
+    /** Maximum number of data items decoded in total (default 1 000 000). */
+    maxItems?: number;
+}
+export declare class CborError extends Error {
+    readonly offset: number;
+    constructor(message: string, offset: number);
+}
+/**
+ * Read one item head (major type + argument) at `pos`. Definite lengths only:
+ * additional info 28-31 (reserved and indefinite) is an error.
+ */
+export declare function readCborHead(bytes: Uint8Array, pos: number): {
+    major: number;
+    arg: number | bigint;
+    next: number;
+};
+/** Decode the single CBOR item at the start of `bytes`; `end` is the offset just past it. */
+export declare function decodeCbor(bytes: Uint8Array, limits?: CborLimits): {
+    value: CborValue;
+    end: number;
+};

package/lib/src/cbor.js

@@ -0,0 +1,174 @@
+/**
+ * A minimal deterministic CBOR (RFC 8949) encoder: just unsigned integers,
+ * byte strings, text strings, arrays and maps. Every value is encoded to bytes
+ * eagerly; maps are emitted in the RFC 8949 section 4.2.1 core deterministic
+ * order (keys sorted bytewise by their encoded form, which puts shorter first).
+ */
+const enc = new TextEncoder();
+export function cborHead(major, n) {
+    const m = major << 5;
+    if (n < 24)
+        return Uint8Array.of(m | Number(n));
+    if (n < 0x100)
+        return Uint8Array.of(m | 24, Number(n));
+    if (n < 0x10000)
+        return Uint8Array.of(m | 25, Number(n) >> 8, Number(n) & 0xff);
+    if (n < 0x100000000) {
+        const b = Buffer.alloc(5);
+        b[0] = m | 26;
+        b.writeUInt32BE(Number(n), 1);
+        return b;
+    }
+    const b = Buffer.alloc(9);
+    b[0] = m | 27;
+    b.writeBigUInt64BE(BigInt(n), 1);
+    return b;
+}
+const concat = (parts) => Buffer.concat(parts);
+export const cborUint = (n) => cborHead(0, n);
+export const cborBytes = (b) => concat([cborHead(2, b.length), b]);
+export const cborText = (s) => {
+    const b = enc.encode(s);
+    return concat([cborHead(3, b.length), b]);
+};
+/** Array of already-encoded items. */
+export const cborArray = (items) => concat([cborHead(4, items.length), ...items]);
+/** Map of already-encoded [key, value] pairs, in deterministic key order. */
+export function cborMap(entries) {
+    const sorted = [...entries].sort(([a], [b]) => Buffer.compare(a, b));
+    for (let i = 1; i < sorted.length; i++) {
+        if (Buffer.compare(sorted[i - 1][0], sorted[i][0]) === 0)
+            throw new Error('duplicate CBOR map key');
+    }
+    return concat([cborHead(5, sorted.length), ...sorted.flatMap(([k, v]) => [k, v])]);
+}
+export class CborError extends Error {
+    offset;
+    constructor(message, offset) {
+        super(`${message} (at byte ${offset})`);
+        this.offset = offset;
+        this.name = 'CborError';
+    }
+}
+/**
+ * Read one item head (major type + argument) at `pos`. Definite lengths only:
+ * additional info 28-31 (reserved and indefinite) is an error.
+ */
+export function readCborHead(bytes, pos) {
+    if (pos >= bytes.length)
+        throw new CborError('unexpected end of input', pos);
+    const ib = bytes[pos];
+    const major = ib >> 5;
+    const ai = ib & 31;
+    const need = (n) => {
+        if (pos + 1 + n > bytes.length)
+            throw new CborError('unexpected end of input', pos);
+    };
+    if (ai < 24)
+        return { major, arg: ai, next: pos + 1 };
+    const v = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    switch (ai) {
+        case 24:
+            need(1);
+            return { major, arg: bytes[pos + 1], next: pos + 2 };
+        case 25:
+            need(2);
+            return { major, arg: v.getUint16(pos + 1), next: pos + 3 };
+        case 26:
+            need(4);
+            return { major, arg: v.getUint32(pos + 1), next: pos + 5 };
+        case 27: {
+            need(8);
+            const n = v.getBigUint64(pos + 1);
+            return { major, arg: n <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(n) : n, next: pos + 9 };
+        }
+        default:
+            throw new CborError(ai === 31 ? 'indefinite-length items are not supported' : 'reserved additional information', pos);
+    }
+}
+const utf8 = new TextDecoder('utf-8', { fatal: true });
+/** Decode the single CBOR item at the start of `bytes`; `end` is the offset just past it. */
+export function decodeCbor(bytes, limits = {}) {
+    const maxDepth = limits.maxDepth ?? 32;
+    const maxItems = limits.maxItems ?? 1_000_000;
+    let items = 0;
+    const item = (pos, depth) => {
+        if (++items > maxItems)
+            throw new CborError(`more than ${maxItems} items`, pos);
+        const { major, arg, next } = readCborHead(bytes, pos);
+        const remaining = bytes.length - next;
+        // A declared length can never exceed what is left of the input (every
+        // element or byte takes at least one byte), so nothing is sized from it.
+        const length = (min) => {
+            if (typeof arg === 'bigint' || arg * min > remaining)
+                throw new CborError('declared length exceeds remaining input', pos);
+            return arg;
+        };
+        switch (major) {
+            case 0:
+                return { value: arg, end: next };
+            case 1:
+                return { value: typeof arg === 'bigint' ? -1n - arg : -1 - arg, end: next };
+            case 2: {
+                const n = length(1);
+                return { value: bytes.subarray(next, next + n), end: next + n };
+            }
+            case 3: {
+                const n = length(1);
+                try {
+                    return { value: utf8.decode(bytes.subarray(next, next + n)), end: next + n };
+                }
+                catch {
+                    throw new CborError('invalid UTF-8 in text string', next);
+                }
+            }
+            case 4: {
+                const n = length(1);
+                if (depth >= maxDepth)
+                    throw new CborError(`nesting deeper than ${maxDepth}`, pos);
+                const out = [];
+                let p = next;
+                for (let i = 0; i < n; i++) {
+                    const r = item(p, depth + 1);
+                    out.push(r.value);
+                    p = r.end;
+                }
+                return { value: out, end: p };
+            }
+            case 5: {
+                const n = length(2);
+                if (depth >= maxDepth)
+                    throw new CborError(`nesting deeper than ${maxDepth}`, pos);
+                const out = new Map();
+                const seen = new Set();
+                let p = next;
+                for (let i = 0; i < n; i++) {
+                    const k = item(p, depth + 1);
+                    const id = Buffer.from(bytes.subarray(p, k.end)).toString('latin1');
+                    if (seen.has(id))
+                        throw new CborError('duplicate map key', p);
+                    seen.add(id);
+                    const v = item(k.end, depth + 1);
+                    out.set(k.value, v.value);
+                    p = v.end;
+                }
+                return { value: out, end: p };
+            }
+            case 6:
+                throw new CborError('tags are not supported', pos);
+            default: {
+                // major 7: only the simple values false, true and null.
+                const ib = bytes[pos];
+                if (ib === 0xf4)
+                    return { value: false, end: next };
+                if (ib === 0xf5)
+                    return { value: true, end: next };
+                if (ib === 0xf6)
+                    return { value: null, end: next };
+                throw new CborError('unsupported simple value or float', pos);
+            }
+        }
+    };
+    return item(0, 0);
+}
+//# sourceMappingURL=cbor.js.map

package/lib/src/checklinks.d.ts

@@ -0,0 +1,42 @@
+import { type SourceSpan } from './errors.js';
+import type { FetchPolicy } from './resources/types.js';
+import type { Tree } from './tree.js';
+export interface CheckLinksOp {
+    /** Report broken links as warnings instead of failing. */
+    readonly warn: boolean;
+    /** Also request http(s) URLs (under the network policy). */
+    readonly external: boolean;
+    /** The EXPORT path: absolute references resolve below it. */
+    readonly root: string;
+    /** REDIRECT sources (`/old`, `/blog/*`): a link to one of them is not broken. */
+    readonly redirects: readonly string[];
+    readonly span: SourceSpan;
+}
+export interface BrokenLink {
+    /** The referring file (a tree path) and the line of the reference. */
+    readonly file: string;
+    readonly line: number;
+    /** The URL as the file has it (character references and escapes decoded). */
+    readonly url: string;
+    readonly reason: string;
+}
+/** The most broken links an error lists (CHECKLINKS --warn prints every one). */
+export declare const MAX_LISTED = 20;
+/**
+ * Whether a tree path is served the way `sitefile serve` and static hosts serve it: the file itself, `<path>.html`
+ * (clean URLs) or `<path>/index.html`; for a directory URL (`…/`), its `index.html`.
+ */
+export declare function isServed(tree: Tree, path: string, dir: boolean): boolean;
+/** Whether a REDIRECT source covers a URL path: equal, or a `/*` prefix of it. */
+export declare function redirected(sources: readonly string[], url: string): boolean;
+/**
+ * Every broken link in the HTML and CSS files of `tree`, by file (in path order) and then in the order of the
+ * file. An internal link is broken when its target is not served (see {@link isServed}) and no REDIRECT covers
+ * it; with `external`, an http(s) link is broken when requesting it fails or answers 400 or more (each URL is
+ * requested once, in order of first use).
+ */
+export declare function brokenLinks(tree: Tree, op: CheckLinksOp, policy: FetchPolicy): Promise<BrokenLink[]>;
+/** One broken link as messages show it: `/index.html:3: css/a.css (not found: /css/a.css)`. */
+export declare function brokenLinkText(b: BrokenLink): string;
+/** Report the broken links: a warning each with `--warn`, otherwise one E_BROKEN_LINK error listing them. */
+export declare function reportBrokenLinks(broken: readonly BrokenLink[], op: CheckLinksOp, origin: string, warn: (m: string) => void): void;

package/lib/src/checklinks.js

@@ -0,0 +1,118 @@
+// CHECKLINKS (docs/LANGUAGE.md, "Link checking"): find the references in a stage's HTML and CSS files that
+// point at nothing. Ported as rust/src/checklinks.rs: both report the same links, in the same order, with the
+// same messages.
+import { isSitefileError, SitefileError } from './errors.js';
+import { resolveReference, scanFile } from './links.js';
+import { fetchRemote } from './resources/https.js';
+/** The most broken links an error lists (CHECKLINKS --warn prints every one). */
+export const MAX_LISTED = 20;
+/**
+ * Whether a tree path is served the way `sitefile serve` and static hosts serve it: the file itself, `<path>.html`
+ * (clean URLs) or `<path>/index.html`; for a directory URL (`…/`), its `index.html`.
+ */
+export function isServed(tree, path, dir) {
+    const index = path === '/' ? '/index.html' : `${path}/index.html`;
+    if (dir)
+        return tree.isFile(index);
+    return tree.isFile(path) || (path !== '/' && tree.isFile(`${path}.html`)) || (tree.isDirectory(path) && tree.isFile(index));
+}
+/** The URL path of a tree path below the root, or undefined outside it. */
+function urlPath(root, path) {
+    if (root === '/')
+        return path;
+    if (path === root)
+        return '/';
+    return path.startsWith(root + '/') ? path.slice(root.length) : undefined;
+}
+/** Whether a REDIRECT source covers a URL path: equal, or a `/*` prefix of it. */
+export function redirected(sources, url) {
+    return sources.some((from) => from === url || (from.endsWith('/*') && url.startsWith(from.slice(0, -1))));
+}
+/** Why an external URL is broken (undefined when it answered), from the error fetching it. */
+function externalReason(e, url, policy) {
+    switch (e.code) {
+        case 'E_TOO_LARGE':
+            // The limit is 0 bytes: it answered 200 with a body.
+            return undefined;
+        case 'E_FETCH_STATUS': {
+            const status = Number(/HTTP (\d+)$/.exec(e.detail)?.[1] ?? '0');
+            return status >= 400 || status === 0 ? `HTTP ${status}` : undefined;
+        }
+        case 'E_FETCH_TIMEOUT':
+            return `no answer within ${policy.timeoutMs} ms`;
+        case 'E_PROTOCOL':
+            return /^http:/i.test(url) && !policy.allowHttp ? 'plain http is checked only with --allow-http' : 'not allowed by the network policy';
+        case 'E_SSRF_BLOCKED':
+            return 'a non-public address (checked only with --allow-private-network)';
+        case 'E_REDIRECT':
+            return 'too many or invalid redirects';
+        default:
+            return 'could not connect';
+    }
+}
+/**
+ * Every broken link in the HTML and CSS files of `tree`, by file (in path order) and then in the order of the
+ * file. An internal link is broken when its target is not served (see {@link isServed}) and no REDIRECT covers
+ * it; with `external`, an http(s) link is broken when requesting it fails or answers 400 or more (each URL is
+ * requested once, in order of first use).
+ */
+export async function brokenLinks(tree, op, policy) {
+    const out = [];
+    const external = new Map();
+    const entries = tree.entries().sort(([a], [b]) => Buffer.compare(Buffer.from(a, 'utf8'), Buffer.from(b, 'utf8')));
+    for (const [file, node] of entries) {
+        const scan = scanFile(file, node.bytes);
+        if (!scan)
+            continue;
+        for (const r of scan.refs) {
+            const t = resolveReference(r.url, file, op.root);
+            if (t.kind === 'none')
+                continue;
+            let reason;
+            if (t.kind === 'external') {
+                if (!op.external)
+                    continue;
+                const url = t.url.startsWith('//') ? 'https:' + t.url : t.url;
+                if (!external.has(url)) {
+                    try {
+                        await fetchRemote(url, { ...policy, maxBytes: 0 }, op.span);
+                        external.set(url, undefined);
+                    }
+                    catch (e) {
+                        if (!isSitefileError(e))
+                            throw e;
+                        external.set(url, externalReason(e, url, policy));
+                    }
+                }
+                reason = external.get(url);
+            }
+            else if (!isServed(tree, t.path, t.dir)) {
+                const url = urlPath(op.root, t.path);
+                const display = t.dir && t.path !== '/' ? t.path + '/' : t.path;
+                if (url === undefined || !redirected(op.redirects, t.dir && url !== '/' ? url + '/' : url))
+                    reason = `not found: ${display}`;
+            }
+            if (reason !== undefined)
+                out.push({ file, line: r.line, url: r.url, reason });
+        }
+    }
+    return out;
+}
+/** One broken link as messages show it: `/index.html:3: css/a.css (not found: /css/a.css)`. */
+export function brokenLinkText(b) {
+    return `${b.file}:${b.line}: ${b.url} (${b.reason})`;
+}
+/** Report the broken links: a warning each with `--warn`, otherwise one E_BROKEN_LINK error listing them. */
+export function reportBrokenLinks(broken, op, origin, warn) {
+    if (broken.length === 0)
+        return;
+    if (op.warn) {
+        for (const b of broken)
+            warn(`${origin}: broken link ${brokenLinkText(b)}`);
+        return;
+    }
+    const listed = broken.slice(0, MAX_LISTED).map((b) => `\n  ${brokenLinkText(b)}`);
+    const more = broken.length > MAX_LISTED ? `\n  … and ${broken.length - MAX_LISTED} more (CHECKLINKS --warn lists them all)` : '';
+    throw new SitefileError('E_BROKEN_LINK', `CHECKLINKS: ${broken.length} broken link${broken.length === 1 ? '' : 's'}:${listed.join('')}${more}`, op.span);
+}
+//# sourceMappingURL=checklinks.js.map

package/lib/src/cli/bake.d.ts

@@ -0,0 +1,2 @@
+import { type Command } from './common.js';
+export declare const bakeCommands: ReadonlyMap<string, Command>;

package/lib/src/cli/bake.js

@@ -0,0 +1,179 @@
+import { spawn } from 'node:child_process';
+import { mkdir } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { bakePlan, bakePlanJson, bakePlanText, buildArgv, findBakeFile } from '../bake.js';
+import { CACHE_MAX_ENV } from '../cache-limit.js';
+import { evictAfterBuild } from './cache.js';
+import { str, strs, usage } from './common.js';
+/** The CLI entry the targets run (lib/src/cli.js). */
+const CLI = fileURLToPath(new URL('../cli.js', import.meta.url));
+const DEFAULT_JOBS = 4;
+/** Flags passed unchanged to every target's build. */
+const PASS_BOOLEANS = ['allow-plugins', 'no-cache', 'strict-pins', 'frozen-lockfile', 'update-lock', 'no-lockfile', 'allow-http', 'allow-private-network', 'allow-hardlinks', 'force'];
+const PASS_STRINGS = ['vendor-dir', 'max-download-bytes', 'timeout', 'plugin-timeout'];
+const PASS_LISTS = ['allow-exec', 'allow-plugin', 'cache-from', 'insecure-registry', 'build-arg-file', 'build-arg'];
+function positive(raw, flag) {
+    if (raw === undefined)
+        return undefined;
+    const n = Number(raw);
+    if (!Number.isSafeInteger(n) || n <= 0)
+        usage(`${flag} expects a positive integer`);
+    return n;
+}
+/** The flags every target's build gets, in a fixed order. */
+function passThrough(v) {
+    const out = [];
+    for (const f of PASS_BOOLEANS)
+        if (v[f])
+            out.push(`--${f}`);
+    for (const f of PASS_STRINGS) {
+        const s = str(v[f]);
+        if (s !== undefined)
+            out.push(`--${f}`, s);
+    }
+    for (const f of PASS_LISTS)
+        for (const s of strs(v[f]))
+            out.push(`--${f}`, s);
+    return out;
+}
+function runBuild(argv) {
+    return new Promise((resolve) => {
+        // Each target evicts nothing; bake applies the cache size limit once, at the end.
+        const child = spawn(process.execPath, [CLI, ...argv], { stdio: ['ignore', 'pipe', 'pipe'], env: { ...process.env, [CACHE_MAX_ENV]: '0' } });
+        const out = [];
+        const err = [];
+        child.stdout.on('data', (b) => out.push(b));
+        child.stderr.on('data', (b) => err.push(b));
+        child.on('error', (e) => resolve({ code: 1, stdout: '', stderr: `error: cannot run the build: ${e.message}\n` }));
+        child.on('close', (code) => resolve({ code: code ?? 1, stdout: Buffer.concat(out).toString('utf8'), stderr: Buffer.concat(err).toString('utf8') }));
+    });
+}
+/** Each line of `text` with `[name] ` in front. */
+function prefixed(name, text) {
+    if (text === '')
+        return '';
+    const lines = text.split('\n');
+    if (lines[lines.length - 1] === '')
+        lines.pop();
+    return lines.map((l) => `[${name}] ${l}\n`).join('');
+}
+/** The Sitefile.lock a target's build may write (targets that share one never run at the same time). */
+function lockKey(t, v) {
+    if (v['no-lockfile'] || v['frozen-lockfile'])
+        return undefined;
+    return path.resolve(path.dirname(t.file), 'Sitefile.lock');
+}
+const bakeCommand = {
+    name: 'bake',
+    summary: 'build several variants (targets, matrix, groups) from a bake file',
+    usage: 'bake [targets...] [-f sitefile.bake.yaml] [options]',
+    description: "Build the targets of a bake file (default: sitefile.bake.yaml, .yml or .json in the current directory), like\n'docker buildx bake'. Each target is a 'sitefile build' with its own context, Sitefile, build args, --target\nstage, output and tags; a matrix expands one target into one per combination of values. Name targets or\ngroups to build only those (default: the 'default' group, else every target). Paths in the bake file are\nrelative to it. Up to --jobs builds run at once; each target's output is printed, prefixed with its\nname, in plan order. Every target runs even when one fails; then the exit code is 1.",
+    flags: [
+        '-f, --file <path>             bake file (default: sitefile.bake.yaml, .yml or .json)',
+        '--print                       print the resolved targets instead of building (text, or --json)',
+        '--json                        with --print: machine-readable plan',
+        `-j, --jobs <n>                builds to run at once (default ${DEFAULT_JOBS})`,
+        '--profile <dir>               write each target\'s timing trace to <dir>/<target>.json',
+        '--build-arg <NAME=value>      set an ARG in every target (wins over the bake file; repeatable)',
+        '--build-arg-file <path>       read ARGs for every target from a file (after the targets\' own; repeatable)',
+        'Passed to every build: --allow-exec, --allow-plugin, --allow-plugins, --no-cache, --cache-from, --strict-pins,',
+        '  --frozen-lockfile, --update-lock, --no-lockfile, --vendor-dir, --allow-http, --allow-private-network,',
+        '  --allow-hardlinks, --max-download-bytes, --timeout, --plugin-timeout, --insecure-registry, --force',
+    ],
+    options: {
+        file: { type: 'string', short: 'f' },
+        print: { type: 'boolean' },
+        json: { type: 'boolean' },
+        jobs: { type: 'string', short: 'j' },
+        profile: { type: 'string' },
+        'cache-to': { type: 'string', multiple: true },
+        ...Object.fromEntries(PASS_BOOLEANS.map((f) => [f, { type: 'boolean' }])),
+        ...Object.fromEntries(PASS_STRINGS.map((f) => [f, { type: 'string' }])),
+        ...Object.fromEntries(PASS_LISTS.map((f) => [f, { type: 'string', multiple: true }])),
+    },
+    async run(v, pos) {
+        if (v.json && !v.print)
+            usage('bake: --json is only for --print');
+        if (strs(v['cache-to']).length)
+            usage("bake: --cache-to is not supported (each target would replace the others' results); push from one 'sitefile build --cache-to'");
+        if (v['frozen-lockfile'] && v['update-lock'])
+            usage('--frozen-lockfile and --update-lock conflict');
+        if (v['strict-pins'] && v['update-lock'])
+            usage('--strict-pins and --update-lock conflict');
+        if (v['no-cache'] && strs(v['cache-from']).length)
+            usage('--no-cache cannot be combined with --cache-from or --cache-to');
+        const jobs = positive(str(v.jobs), '--jobs') ?? DEFAULT_JOBS;
+        const profile = str(v.profile);
+        if (profile === '')
+            usage('--profile expects a directory path');
+        const plan = await bakePlan(await findBakeFile(str(v.file)), pos);
+        if (v.print) {
+            process.stdout.write(v.json ? JSON.stringify(bakePlanJson(plan), null, 2) + '\n' : bakePlanText(plan));
+            return 0;
+        }
+        if (profile !== undefined)
+            await mkdir(profile, { recursive: true });
+        const extra = passThrough(v);
+        const targets = plan.targets;
+        const results = targets.map(() => undefined);
+        const busy = new Set();
+        const pending = targets.map((_, i) => i);
+        let printed = 0;
+        const flush = () => {
+            while (printed < targets.length && results[printed] !== undefined) {
+                const r = results[printed];
+                const name = targets[printed].name;
+                process.stderr.write(prefixed(name, r.stderr));
+                process.stdout.write(prefixed(name, r.stdout));
+                printed++;
+            }
+        };
+        await new Promise((done) => {
+            if (targets.length === 0)
+                return done();
+            let running = 0;
+            const pump = () => {
+                while (running < jobs) {
+                    // The first pending target whose Sitefile.lock no running build may write.
+                    const k = pending.findIndex((i) => {
+                        const key = lockKey(targets[i], v);
+                        return key === undefined || !busy.has(key);
+                    });
+                    if (k === -1)
+                        break;
+                    const i = pending.splice(k, 1)[0];
+                    const t = targets[i];
+                    const key = lockKey(t, v);
+                    if (key !== undefined)
+                        busy.add(key);
+                    running++;
+                    const argv = [...buildArgv(t), ...extra, ...(profile !== undefined ? ['--profile', path.join(profile, `${t.name}.json`)] : [])];
+                    void runBuild(argv).then((r) => {
+                        results[i] = r;
+                        if (key !== undefined)
+                            busy.delete(key);
+                        running--;
+                        flush();
+                        if (running === 0 && pending.length === 0)
+                            done();
+                        else
+                            pump();
+                    });
+                }
+            };
+            pump();
+        });
+        await evictAfterBuild();
+        const failed = targets.filter((_, i) => results[i].code !== 0).map((t) => t.name);
+        const n = `${targets.length} target${targets.length === 1 ? '' : 's'}`;
+        if (failed.length) {
+            process.stderr.write(`error[E_BAKE]: ${failed.length} of ${n} failed: ${failed.join(', ')}\n`);
+            return 1;
+        }
+        process.stdout.write(`Baked ${n}\n`);
+        return 0;
+    },
+};
+export const bakeCommands = new Map([['bake', bakeCommand]]);
+//# sourceMappingURL=bake.js.map

package/lib/src/cli/build-image.d.ts

@@ -0,0 +1,21 @@
+import type { AttestRequest } from '../attest.js';
+import { type BuildOptions, type BuildResult } from '../executor.js';
+import type { OciCompression } from '../language/ast.js';
+/** Validate `-t` values before building: local name[:tag] only. Throws E_USAGE / E_UNSUPPORTED. */
+export declare function validateImageTags(tags: readonly string[]): void;
+/**
+ * Store a build's exported tree as an OCI image in the local store and point each tag at it.
+ * Build-arg values are never recorded (nothing but the files and OCI labels reach the image).
+ */
+export declare function storeBuildAsImage(result: BuildResult, tags: readonly string[], info: {
+    readonly contextDir: string;
+    readonly ociRoot?: string | undefined;
+    readonly ociCompression?: OciCompression | undefined;
+    readonly platform?: string | undefined;
+    readonly labels?: Readonly<Record<string, string>> | undefined;
+    readonly gitLabels?: boolean | undefined;
+    /** `--provenance` / `--sbom`: attach these attestations to the stored image (they are pushed with it). */
+    readonly attest?: AttestRequest | undefined;
+    /** What the attestations record (the Sitefile, build args). */
+    readonly build?: Pick<BuildOptions, 'contextDir' | 'sitefile' | 'buildArgs'> | undefined;
+}): Promise<string>;

package/lib/src/cli/build-image.js

@@ -0,0 +1,42 @@
+import { sourceDateEpoch } from '../archive-writers.js';
+import { SitefileError } from '../errors.js';
+import { imageAttestations } from '../executor.js';
+import { imageMeta } from '../oci.js';
+import { parseLocalRef } from '../ref.js';
+import { shortId, Store } from '../store.js';
+/** Validate `-t` values before building: local name[:tag] only. Throws E_USAGE / E_UNSUPPORTED. */
+export function validateImageTags(tags) {
+    for (const t of tags) {
+        const ref = parseLocalRef(t);
+        if (ref.digest !== undefined)
+            throw new SitefileError('E_USAGE', `-t '${t}': a tag cannot include a digest`);
+    }
+}
+/**
+ * Store a build's exported tree as an OCI image in the local store and point each tag at it.
+ * Build-arg values are never recorded (nothing but the files and OCI labels reach the image).
+ */
+export async function storeBuildAsImage(result, tags, info) {
+    const store = await Store.open();
+    const { id } = await store.addImage(result.output, {
+        root: info.ociRoot ?? result.plan.exportRoot,
+        compression: info.ociCompression ?? result.plan.exportCompression,
+        platform: info.platform,
+        epoch: sourceDateEpoch(),
+        base: result.base,
+        ...(await imageMeta(info.contextDir, { git: !!info.gitLabels, ...(info.labels ? { labels: info.labels } : {}) })),
+    });
+    if (info.attest && (info.attest.provenance || info.attest.sbom)) {
+        const manifestBytes = await store.readBlob(id);
+        const d = await store.details(id);
+        const img = { manifestDigest: id, manifestBytes, configBytes: await store.readBlob(d.manifest.config.digest), root: d.root };
+        const opts = { contextDir: info.contextDir, ...info.build, ...(info.platform !== undefined ? { platform: info.platform } : {}) };
+        await store.putReferrers(id, await imageAttestations(result, img, opts, info.attest));
+    }
+    for (const t of tags) {
+        const key = await store.tag(id, parseLocalRef(t));
+        process.stdout.write(`Tagged ${key} ${shortId(id)} (${result.output.size} file${result.output.size === 1 ? '' : 's'})\n`);
+    }
+    return id;
+}
+//# sourceMappingURL=build-image.js.map

package/lib/src/cli/cache.d.ts

@@ -0,0 +1,8 @@
+import { type Command } from './common.js';
+/** Where TRANSFORM results are cached: beside the image store, in `$SITEFILE_HOME/cache/transform`. */
+export declare function transformCacheDir(env?: NodeJS.ProcessEnv): string;
+/**
+ * End of `build`/`inspect`: apply $SITEFILE_CACHE_MAX. Never fails: problems are warnings.
+ */
+export declare function evictAfterBuild(env?: NodeJS.ProcessEnv): Promise<void>;
+export declare const cacheSubcommands: ReadonlyMap<string, Command>;