@le-space/node 0.1.2 → 0.1.3

package/index.d.ts

@@ -1,5 +1,5 @@
 import * as _shared_aleph_shared_types from '@shared-aleph/shared-types';
-import { MessageSigner, InstanceAllocation, PortMapping, RuntimeDiagnostics, CrnRecord, RootfsRequiredPortForward, MessageHasher, RootfsManifest } from '@shared-aleph/shared-types';
+import { MessageSigner, InstanceAllocation, PortMapping, RuntimeDiagnostics, CrnRecord, RootfsRequiredPortForward, MessageHasher, RootfsManifest as RootfsManifest$1 } from '@shared-aleph/shared-types';
 
 declare function requiredEnv(name: string, env?: NodeJS.ProcessEnv): string;
 declare function optionalEnv(name: string, fallback?: string, env?: NodeJS.ProcessEnv): string;
@@ -132,7 +132,7 @@ interface DeployExecutorDependencies {
     signer?: MessageSigner;
     sender?: string;
     hasher?: MessageHasher;
-    manifest?: RootfsManifest | null;
+    manifest?: RootfsManifest$1 | null;
     log?: (message: string) => void;
 }
 declare function executeDeployPlan(plan: DeployPlan, dependencies?: DeployExecutorDependencies): Promise<DeployOutputResult>;
@@ -216,4 +216,195 @@ declare function runActionMode(env?: NodeJS.ProcessEnv, hooks?: {
 }): Promise<void>;
 declare function main(): Promise<void>;
 
-export { type DeployConfigurationResult, type DeployExecutorDependencies, type DeployMetadataResult, type DeployOutputResult, type DeployPlan, type PrivateKeyIdentity, actionLog, appendGithubOutput, appendGithubSummary, booleanEnv, buildScaffoldDeployResult, createPrivateKeyIdentity, createPrivateKeySigner, emitDeployOutputs, emitGeocodedCrnOutputs, executeDeployPlan, integerEnv, jsonEnv, main, optionalEnv, parseDeployPlan, requiredEnv, runActionMode };
+interface RootfsContractPort {
+    port: number;
+    tcp?: boolean;
+    udp?: boolean;
+    purpose?: string;
+}
+interface RootfsContractRootfs {
+    profile: string;
+    installMode: string;
+    installDir: string;
+    binaryPath: string;
+    dataDir: string;
+    envFile: string;
+}
+interface RootfsContractServices {
+    bootstrap: string;
+    main: string;
+    autotlsRefresh: string;
+}
+interface RootfsContractManifest {
+    copyTarget: string;
+    notes?: string;
+}
+interface RootfsContractSource {
+    repository?: string;
+    subdirectory?: string;
+}
+interface RootfsContract {
+    schemaVersion: number;
+    id: string;
+    displayName?: string;
+    source?: RootfsContractSource;
+    rootfs: RootfsContractRootfs;
+    services: RootfsContractServices;
+    ports: RootfsContractPort[];
+    manifest: RootfsContractManifest;
+}
+
+type RootfsBuildDriver = 'auto' | 'host' | 'docker';
+interface RootfsBuildPlan {
+    contract: RootfsContract;
+    contractPath: string;
+    projectDir: string;
+    alephDir: string;
+    outDir: string;
+    driver: RootfsBuildDriver;
+    rootfsSizeMiB: number;
+    rootfsImageSize: string;
+    rootfsVersion: string;
+    channel: string;
+    skipUpload: boolean;
+    skipBuild: boolean;
+    ipfsAddUrl: string;
+    ipfsGatewayUrl: string;
+    alephApiHost: string;
+    alephMessageWaitAttempts: number;
+    alephMessageWaitDelaySeconds: number;
+    alephPinAttempts: number;
+    alephPinDelaySeconds: number;
+    ipfsGatewayWaitAttempts: number;
+    ipfsGatewayWaitDelaySeconds: number;
+    manifestPath: string;
+    latestManifestPath: string | null;
+    versionedManifestPath: string | null;
+    imagePath: string;
+    baseImagePath: string;
+    binaryPath: string;
+}
+
+interface RootfsManifest {
+    profile: string;
+    version: string;
+    rootfsInstallStrategy: string;
+    requiresBootstrapNetwork: boolean;
+    bootstrapSummary: string;
+    rootfsSourceSizeBytes?: number;
+    requiredPortForwards: RootfsContract["ports"];
+    rootfsCid?: string;
+    rootfsItemHash?: string;
+    rootfsSizeMiB: number;
+    createdAt: string;
+    notes: string;
+}
+interface RootfsManifestOutputPaths {
+    primaryPath: string;
+    copyTargetPath?: string;
+    versionedTargetPath?: string;
+}
+
+interface RootfsToolchainAvailability {
+    hasDocker: boolean;
+    dockerDaemonRunning?: boolean;
+    hasVirtCustomize: boolean;
+    githubActions?: boolean;
+}
+interface RootfsCommandPlan {
+    command: string;
+    args: string[];
+    env?: Record<string, string>;
+    workdir?: string;
+}
+interface RootfsExecutionPlan {
+    mode: "host" | "docker";
+    reason: string;
+    referenceRootfsDir: string;
+    prepareCommand?: RootfsCommandPlan;
+    runCommand: RootfsCommandPlan;
+}
+interface RootfsExecutionPlanOptions {
+    referenceRootfsDir?: string;
+    projectMountPath?: string;
+    rootfsMountPath?: string;
+    dockerImageTag?: string;
+}
+
+interface RootfsPublicationArtifacts {
+    ipfsAddResponsePath: string;
+    storeMessagePath: string;
+    storeMessageStderrPath: string;
+}
+interface RootfsPublicationResult {
+    cid: string;
+    itemHash: string;
+    sourceSizeBytes?: number;
+}
+
+interface RootfsBuildPipeline {
+    buildPlan: RootfsBuildPlan;
+    executionPlan: RootfsExecutionPlan;
+    publicationArtifacts: RootfsPublicationArtifacts;
+    manifestPaths: RootfsManifestOutputPaths;
+}
+interface RootfsFinalizeResult {
+    manifest: RootfsManifest;
+    manifestJson: string;
+    manifestPaths: RootfsManifestOutputPaths;
+    publication?: RootfsPublicationResult;
+}
+
+interface RootfsExecutedCommand {
+    command: string;
+    args: string[];
+    workdir?: string;
+    env?: Record<string, string>;
+}
+interface RootfsCommandRunner {
+    run(command: RootfsExecutedCommand): Promise<void>;
+}
+interface RootfsFileReader {
+    readText(path: string): Promise<string>;
+}
+interface RootfsExecutorDependencies extends RootfsCommandRunner, RootfsFileReader {
+}
+interface RootfsExecutionResult {
+    pipeline: RootfsBuildPipeline;
+    executedCommands: RootfsExecutedCommand[];
+}
+interface RootfsPublishExecutionResult extends RootfsExecutionResult {
+    finalized: RootfsFinalizeResult;
+}
+interface RootfsPublishOptions extends RootfsExecutionPlanOptions {
+    createdAt?: string;
+    referenceRootfsDir?: string;
+}
+declare function buildRootfs(buildPlan: RootfsBuildPlan, deps: RootfsCommandRunner, availability: RootfsToolchainAvailability, options?: RootfsExecutionPlanOptions): Promise<RootfsExecutionResult>;
+declare function publishRootfs(buildPlan: RootfsBuildPlan, deps: RootfsExecutorDependencies, options?: RootfsPublishOptions): Promise<RootfsPublishExecutionResult>;
+
+interface ParsedRootfsRunnerInputs {
+    buildPlan: RootfsBuildPlan;
+    availability: RootfsToolchainAvailability;
+    referenceRootfsDir?: string;
+    createdAt?: string;
+}
+declare function parseRootfsRunnerInputs(env?: NodeJS.ProcessEnv): Promise<ParsedRootfsRunnerInputs>;
+declare function runLocalCommand(command: {
+    command: string;
+    args: string[];
+    workdir?: string;
+    env?: Record<string, string>;
+}): Promise<void>;
+declare function emitRootfsOutputs(result: RootfsPublishExecutionResult, env?: NodeJS.ProcessEnv): Promise<void>;
+declare function runRootfsMode(env?: NodeJS.ProcessEnv, hooks?: {
+    stdout?: (text: string) => void;
+    parseInputs?: typeof parseRootfsRunnerInputs;
+    buildRootfs?: typeof buildRootfs;
+    publishRootfs?: typeof publishRootfs;
+    runCommand?: typeof runLocalCommand;
+    readText?: (targetPath: string) => Promise<string>;
+}): Promise<void>;
+declare function rootfsMain(): Promise<void>;
+
+export { type DeployConfigurationResult, type DeployExecutorDependencies, type DeployMetadataResult, type DeployOutputResult, type DeployPlan, type ParsedRootfsRunnerInputs, type PrivateKeyIdentity, actionLog, appendGithubOutput, appendGithubSummary, booleanEnv, buildScaffoldDeployResult, createPrivateKeyIdentity, createPrivateKeySigner, emitDeployOutputs, emitGeocodedCrnOutputs, emitRootfsOutputs, executeDeployPlan, integerEnv, jsonEnv, main, optionalEnv, parseDeployPlan, parseRootfsRunnerInputs, requiredEnv, rootfsMain, runActionMode, runLocalCommand, runRootfsMode };

package/index.js

@@ -2102,6 +2102,669 @@ if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
     process.exitCode = 1;
   });
 }
+
+// src/rootfs-runner.ts
+import { pathToFileURL as pathToFileURL2 } from "url";
+import { readFile as readFile2 } from "fs/promises";
+import { spawn } from "child_process";
+
+// ../rootfs/src/contract.ts
+import { readFile } from "fs/promises";
+import { fileURLToPath } from "url";
+function asObject(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function asString5(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+function asNumber3(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function parsePorts(value, errors) {
+  if (!Array.isArray(value)) {
+    errors.push("ports must be an array");
+    return [];
+  }
+  return value.flatMap((entry, index) => {
+    const port = asObject(entry);
+    if (!port) {
+      errors.push(`ports[${index}] must be an object`);
+      return [];
+    }
+    const portNumber = asNumber3(port.port);
+    if (portNumber == null || portNumber < 1 || portNumber > 65535) {
+      errors.push(`ports[${index}].port must be an integer between 1 and 65535`);
+      return [];
+    }
+    return [{
+      port: portNumber,
+      tcp: port.tcp === true,
+      udp: port.udp === true,
+      purpose: asString5(port.purpose) ?? void 0
+    }];
+  });
+}
+function validateRootfsContract(input) {
+  const errors = [];
+  const payload = asObject(input);
+  if (!payload) {
+    return { contract: null, valid: false, errors: ["rootfs contract must be an object"] };
+  }
+  const rootfs = asObject(payload.rootfs);
+  const services = asObject(payload.services);
+  const manifest = asObject(payload.manifest);
+  const source = asObject(payload.source) ?? void 0;
+  const schemaVersion = asNumber3(payload.schemaVersion);
+  if (schemaVersion == null || !Number.isInteger(schemaVersion)) {
+    errors.push("schemaVersion must be an integer");
+  }
+  const id = asString5(payload.id);
+  if (!id) {
+    errors.push("id must be a non-empty string");
+  }
+  if (!rootfs) {
+    errors.push("rootfs must be an object");
+  }
+  if (!services) {
+    errors.push("services must be an object");
+  }
+  if (!manifest) {
+    errors.push("manifest must be an object");
+  }
+  const profile = asString5(rootfs?.profile);
+  if (!profile) errors.push("rootfs.profile must be a non-empty string");
+  const installMode = asString5(rootfs?.installMode);
+  if (!installMode) errors.push("rootfs.installMode must be a non-empty string");
+  const installDir = asString5(rootfs?.installDir);
+  if (!installDir) errors.push("rootfs.installDir must be a non-empty string");
+  const binaryPath = asString5(rootfs?.binaryPath) ?? "/usr/local/bin/universal-chat-go";
+  const dataDir = asString5(rootfs?.dataDir);
+  if (!dataDir) errors.push("rootfs.dataDir must be a non-empty string");
+  const envFile = asString5(rootfs?.envFile);
+  if (!envFile) errors.push("rootfs.envFile must be a non-empty string");
+  const bootstrap = asString5(services?.bootstrap);
+  if (!bootstrap) errors.push("services.bootstrap must be a non-empty string");
+  const main2 = asString5(services?.main);
+  if (!main2) errors.push("services.main must be a non-empty string");
+  const autotlsRefresh = asString5(services?.autotlsRefresh);
+  if (!autotlsRefresh) errors.push("services.autotlsRefresh must be a non-empty string");
+  const copyTarget = asString5(manifest?.copyTarget);
+  if (!copyTarget) errors.push("manifest.copyTarget must be a non-empty string");
+  const ports = parsePorts(payload.ports, errors);
+  if (errors.length > 0 || !schemaVersion || !id || !profile || !installMode || !installDir || !dataDir || !envFile || !bootstrap || !main2 || !autotlsRefresh || !copyTarget) {
+    return { contract: null, valid: false, errors };
+  }
+  return {
+    contract: {
+      schemaVersion,
+      id,
+      displayName: asString5(payload.displayName) ?? void 0,
+      source: source ? {
+        repository: asString5(source.repository) ?? void 0,
+        subdirectory: asString5(source.subdirectory) ?? void 0
+      } : void 0,
+      rootfs: { profile, installMode, installDir, binaryPath, dataDir, envFile },
+      services: { bootstrap, main: main2, autotlsRefresh },
+      ports,
+      manifest: { copyTarget, notes: asString5(manifest?.notes) ?? void 0 }
+    },
+    valid: true,
+    errors: []
+  };
+}
+function parseRootfsContract(input) {
+  const payload = typeof input === "string" ? JSON.parse(input) : input;
+  const result = validateRootfsContract(payload);
+  if (!result.valid || !result.contract) {
+    throw new Error(`Invalid rootfs contract: ${result.errors.join("; ")}`);
+  }
+  return result.contract;
+}
+async function readRootfsContractFile(path4) {
+  return parseRootfsContract(await readFile(path4, "utf8"));
+}
+function referenceProfileRootfsDir(profile) {
+  return fileURLToPath(new URL(`../reference/${profile}/rootfs/`, import.meta.url));
+}
+
+// ../rootfs/src/build-plan.ts
+import path from "path";
+function positiveInteger(value, fallback) {
+  return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : fallback;
+}
+function deriveRootfsVersion(options = {}) {
+  if (options.rootfsVersion && options.rootfsVersion.trim()) {
+    return options.rootfsVersion.trim();
+  }
+  if (options.gitShortSha && options.gitShortSha.trim()) {
+    const now = options.now ?? /* @__PURE__ */ new Date();
+    const yyyy = String(now.getUTCFullYear());
+    const mm = String(now.getUTCMonth() + 1).padStart(2, "0");
+    const dd = String(now.getUTCDate()).padStart(2, "0");
+    return `uc-go-peer-git-${yyyy}${mm}${dd}-${options.gitShortSha.trim()}`;
+  }
+  return "uc-go-peer-v0.1.0";
+}
+function createRootfsBuildPlan(contract, options) {
+  const projectDir = path.resolve(options.projectDir);
+  const alephDir = path.resolve(options.alephDir ?? path.join(projectDir, "go-peer/aleph"));
+  const outDir = path.resolve(options.outDir ?? path.join(alephDir, "dist-rootfs"));
+  const contractPath = path.resolve(options.contractPath ?? path.join(alephDir, "root-profiles", `${contract.id}.json`));
+  const rootfsVersion = deriveRootfsVersion(options);
+  const copyTarget = contract.manifest.copyTarget?.trim() ?? "";
+  const latestManifestPath = copyTarget ? path.resolve(copyTarget.startsWith("/") ? copyTarget : path.join(projectDir, copyTarget)) : null;
+  const versionedManifestPath = latestManifestPath ? path.join(path.dirname(latestManifestPath), `${rootfsVersion}.json`) : null;
+  return {
+    contract,
+    contractPath,
+    projectDir,
+    alephDir,
+    outDir,
+    driver: options.driver ?? "auto",
+    rootfsSizeMiB: positiveInteger(options.rootfsSizeMiB, 20480),
+    rootfsImageSize: options.rootfsImageSize?.trim() || "20G",
+    rootfsVersion,
+    channel: options.channel?.trim() || "ALEPH-CLOUDSOLUTIONS",
+    skipUpload: options.skipUpload === true,
+    skipBuild: options.skipBuild === true,
+    ipfsAddUrl: options.ipfsAddUrl?.trim() || "https://ipfs.aleph.cloud/api/v0/add",
+    ipfsGatewayUrl: options.ipfsGatewayUrl?.trim() || "https://ipfs.aleph.cloud/ipfs",
+    alephApiHost: options.alephApiHost?.trim() || "https://api2.aleph.im",
+    alephMessageWaitAttempts: positiveInteger(options.alephMessageWaitAttempts, 60),
+    alephMessageWaitDelaySeconds: positiveInteger(options.alephMessageWaitDelaySeconds, 5),
+    alephPinAttempts: positiveInteger(options.alephPinAttempts, 4),
+    alephPinDelaySeconds: positiveInteger(options.alephPinDelaySeconds, 10),
+    ipfsGatewayWaitAttempts: positiveInteger(options.ipfsGatewayWaitAttempts, 30),
+    ipfsGatewayWaitDelaySeconds: positiveInteger(options.ipfsGatewayWaitDelaySeconds, 10),
+    manifestPath: path.join(outDir, "rootfs-manifest.json"),
+    latestManifestPath,
+    versionedManifestPath,
+    imagePath: path.join(outDir, "aleph-uc-go-peer.qcow2"),
+    baseImagePath: path.join(outDir, "debian-12-genericcloud-amd64.qcow2"),
+    binaryPath: path.join(outDir, "universal-chat-go")
+  };
+}
+function rootfsBuildShellEnv(plan) {
+  return {
+    OUT_DIR: plan.outDir,
+    ROOTFS_CONTRACT_FILE: plan.contractPath,
+    ROOTFS_BUILD_DRIVER: plan.driver,
+    ROOTFS_SIZE_MIB: String(plan.rootfsSizeMiB),
+    ROOTFS_IMAGE_SIZE: plan.rootfsImageSize,
+    ROOTFS_VERSION: plan.rootfsVersion,
+    CHANNEL: plan.channel,
+    SKIP_UPLOAD: plan.skipUpload ? "1" : "0",
+    SKIP_BUILD: plan.skipBuild ? "1" : "0",
+    IPFS_ADD_URL: plan.ipfsAddUrl,
+    IPFS_GATEWAY_URL: plan.ipfsGatewayUrl,
+    ALEPH_API_HOST: plan.alephApiHost,
+    ALEPH_MESSAGE_WAIT_ATTEMPTS: String(plan.alephMessageWaitAttempts),
+    ALEPH_MESSAGE_WAIT_DELAY_SECONDS: String(plan.alephMessageWaitDelaySeconds),
+    ALEPH_PIN_ATTEMPTS: String(plan.alephPinAttempts),
+    ALEPH_PIN_DELAY_SECONDS: String(plan.alephPinDelaySeconds),
+    IPFS_GATEWAY_WAIT_ATTEMPTS: String(plan.ipfsGatewayWaitAttempts),
+    IPFS_GATEWAY_WAIT_DELAY_SECONDS: String(plan.ipfsGatewayWaitDelaySeconds)
+  };
+}
+
+// ../rootfs/src/manifest.ts
+import { dirname, extname, isAbsolute, join } from "path";
+function createRootfsManifest(plan, contract, options = {}) {
+  const manifest = {
+    profile: contract.rootfs.profile,
+    version: plan.rootfsVersion,
+    rootfsInstallStrategy: contract.rootfs.installMode,
+    requiresBootstrapNetwork: false,
+    bootstrapSummary: "Dependencies are preinstalled in the image.",
+    requiredPortForwards: contract.ports,
+    rootfsSizeMiB: plan.rootfsSizeMiB,
+    createdAt: options.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    notes: contract.manifest.notes ?? ""
+  };
+  if (typeof options.rootfsSourceSizeBytes === "number" && Number.isFinite(options.rootfsSourceSizeBytes) && options.rootfsSourceSizeBytes > 0) {
+    manifest.rootfsSourceSizeBytes = options.rootfsSourceSizeBytes;
+  }
+  if (options.rootfsCid) {
+    manifest.rootfsCid = options.rootfsCid;
+  }
+  if (options.rootfsItemHash) {
+    manifest.rootfsItemHash = options.rootfsItemHash;
+  }
+  return manifest;
+}
+function resolveRootfsManifestOutputPaths(plan) {
+  const paths = {
+    primaryPath: plan.manifestPath
+  };
+  const copyTarget = plan.latestManifestPath;
+  if (!copyTarget) {
+    return paths;
+  }
+  const resolvedCopyTarget = isAbsolute(copyTarget) ? copyTarget : join(plan.projectDir, copyTarget);
+  paths.copyTargetPath = resolvedCopyTarget;
+  const copyTargetExt = extname(resolvedCopyTarget) || ".json";
+  paths.versionedTargetPath = join(dirname(resolvedCopyTarget), `${plan.rootfsVersion}${copyTargetExt}`);
+  return paths;
+}
+function serializeRootfsManifest(manifest) {
+  return `${JSON.stringify(manifest, null, 2)}
+`;
+}
+
+// ../rootfs/src/execution-plan.ts
+import path2 from "path";
+function ensurePathWithin(parent, child, label) {
+  const relative = path2.relative(parent, child);
+  if (relative.startsWith("..") || path2.isAbsolute(relative)) {
+    throw new Error(`${label} must be inside ${parent}`);
+  }
+  return relative || ".";
+}
+function containerPathForProjectFile(hostPath, projectDir, mountPath, label) {
+  const relative = ensurePathWithin(projectDir, hostPath, label);
+  return path2.posix.join(mountPath, relative.split(path2.sep).join("/"));
+}
+function resolveReferenceRootfsDir(contract, override) {
+  if (override) {
+    return path2.resolve(override);
+  }
+  return referenceProfileRootfsDir(contract.id);
+}
+function createHostRootfsExecutionPlan(plan, options = {}) {
+  const referenceRootfsDir = resolveReferenceRootfsDir(plan.contract, options.referenceRootfsDir);
+  return {
+    mode: "host",
+    reason: "Using host virt-customize/qemu-img toolchain.",
+    referenceRootfsDir,
+    runCommand: {
+      command: "bash",
+      args: [path2.join(referenceRootfsDir, "build-rootfs-image.sh")],
+      workdir: referenceRootfsDir,
+      env: {
+        PROJECT_DIR: plan.projectDir,
+        OUT_DIR: plan.outDir,
+        ROOTFS_CONTRACT_FILE: plan.contractPath,
+        ROOTFS_IMAGE_SIZE: plan.rootfsImageSize
+      }
+    }
+  };
+}
+function createDockerRootfsExecutionPlan(plan, options = {}) {
+  const referenceRootfsDir = resolveReferenceRootfsDir(plan.contract, options.referenceRootfsDir);
+  const projectMountPath = options.projectMountPath ?? "/workspace/project";
+  const rootfsMountPath = options.rootfsMountPath ?? "/workspace/shared-rootfs";
+  const dockerImageTag = options.dockerImageTag ?? `${plan.contract.id}-rootfs-builder:local`;
+  const containerProjectDir = projectMountPath;
+  const containerContractPath = containerPathForProjectFile(plan.contractPath, plan.projectDir, projectMountPath, "contractPath");
+  const containerOutDir = containerPathForProjectFile(plan.outDir, plan.projectDir, projectMountPath, "outDir");
+  return {
+    mode: "docker",
+    reason: "Using Dockerized Debian/libguestfs builder.",
+    referenceRootfsDir,
+    prepareCommand: {
+      command: "docker",
+      args: [
+        "build",
+        "--platform",
+        "linux/amd64",
+        "-t",
+        dockerImageTag,
+        "-f",
+        path2.join(referenceRootfsDir, "Dockerfile.rootfs"),
+        referenceRootfsDir
+      ]
+    },
+    runCommand: {
+      command: "docker",
+      args: [
+        "run",
+        "--rm",
+        "--privileged",
+        "--platform",
+        "linux/amd64",
+        "-e",
+        "LIBGUESTFS_BACKEND=direct",
+        "-e",
+        `ROOTFS_CONTRACT_FILE=${containerContractPath}`,
+        "-e",
+        `OUT_DIR=${containerOutDir}`,
+        "-e",
+        `ROOTFS_IMAGE_SIZE=${plan.rootfsImageSize}`,
+        "-e",
+        `PROJECT_DIR=${containerProjectDir}`,
+        "-v",
+        `${plan.projectDir}:${projectMountPath}`,
+        "-v",
+        `${referenceRootfsDir}:${rootfsMountPath}`,
+        "-w",
+        rootfsMountPath,
+        dockerImageTag,
+        "bash",
+        path2.posix.join(rootfsMountPath, "build-rootfs-image.sh")
+      ]
+    }
+  };
+}
+function selectRootfsExecutionPlan(plan, availability, options = {}) {
+  if (plan.driver === "host") {
+    if (!availability.hasVirtCustomize) {
+      throw new Error("ROOTFS_BUILD_DRIVER=host requested, but virt-customize is not available.");
+    }
+    return createHostRootfsExecutionPlan(plan, options);
+  }
+  if (plan.driver === "docker") {
+    if (!availability.hasDocker) {
+      throw new Error("ROOTFS_BUILD_DRIVER=docker requested, but docker is not available.");
+    }
+    if (availability.dockerDaemonRunning === false) {
+      throw new Error("ROOTFS_BUILD_DRIVER=docker requested, but the Docker daemon is not running.");
+    }
+    return createDockerRootfsExecutionPlan(plan, options);
+  }
+  if (availability.githubActions && availability.hasDocker && availability.dockerDaemonRunning !== false) {
+    return createDockerRootfsExecutionPlan(plan, options);
+  }
+  if (availability.hasVirtCustomize) {
+    return createHostRootfsExecutionPlan(plan, options);
+  }
+  if (availability.hasDocker && availability.dockerDaemonRunning !== false) {
+    return createDockerRootfsExecutionPlan(plan, options);
+  }
+  throw new Error("No supported rootfs build toolchain is available.");
+}
+
+// ../rootfs/src/publication.ts
+import { join as join2 } from "path";
+function publicationArtifacts(plan) {
+  return {
+    ipfsAddResponsePath: join2(plan.outDir, "ipfs-add-response.jsonl"),
+    storeMessagePath: join2(plan.outDir, "store-message.json"),
+    storeMessageStderrPath: join2(plan.outDir, "store-message.stderr.log")
+  };
+}
+function parseIpfsAddResponse(content) {
+  return content.split(/\r?\n/u).map((line) => line.trim()).filter(Boolean).map((line) => JSON.parse(line));
+}
+function extractRootfsCid(entries) {
+  if (entries.length === 0) {
+    throw new Error("No response received from the IPFS add endpoint");
+  }
+  const cid = entries.at(-1)?.Hash?.trim();
+  if (!cid) {
+    throw new Error(`IPFS add response did not include a Hash: ${JSON.stringify(entries.at(-1) ?? {})}`);
+  }
+  return cid;
+}
+function extractRootfsSourceSizeBytes(entries) {
+  const size = entries.at(-1)?.Size;
+  if (typeof size === "number" && Number.isFinite(size) && size > 0) {
+    return size;
+  }
+  if (typeof size === "string" && /^\d+$/u.test(size)) {
+    return Number(size);
+  }
+  return void 0;
+}
+function parseStoreMessageResponse(content) {
+  const payload = JSON.parse(content);
+  const itemHash = payload.item_hash?.trim();
+  if (!itemHash) {
+    throw new Error("Failed to extract Aleph item hash from store message response");
+  }
+  return { item_hash: itemHash };
+}
+function createRootfsPublicationResult(ipfsAddContent, storeMessageContent) {
+  const entries = parseIpfsAddResponse(ipfsAddContent);
+  const storeMessage = parseStoreMessageResponse(storeMessageContent);
+  return {
+    cid: extractRootfsCid(entries),
+    itemHash: storeMessage.item_hash,
+    sourceSizeBytes: extractRootfsSourceSizeBytes(entries)
+  };
+}
+
+// ../rootfs/src/orchestration.ts
+function createRootfsBuildPipeline(buildPlan, availability, options = {}) {
+  return {
+    buildPlan,
+    executionPlan: selectRootfsExecutionPlan(buildPlan, availability, options),
+    publicationArtifacts: publicationArtifacts(buildPlan),
+    manifestPaths: resolveRootfsManifestOutputPaths(buildPlan)
+  };
+}
+function finalizeRootfsBuildPipeline(buildPlan, options = {}) {
+  let publication;
+  if (options.ipfsAddResponseContent && options.storeMessageContent) {
+    publication = createRootfsPublicationResult(options.ipfsAddResponseContent, options.storeMessageContent);
+  }
+  const manifest = createRootfsManifest(buildPlan, buildPlan.contract, {
+    createdAt: options.createdAt,
+    rootfsCid: publication?.cid ?? options.rootfsCid,
+    rootfsItemHash: publication?.itemHash ?? options.rootfsItemHash,
+    rootfsSourceSizeBytes: publication?.sourceSizeBytes ?? options.rootfsSourceSizeBytes
+  });
+  return {
+    manifest,
+    manifestJson: serializeRootfsManifest(manifest),
+    manifestPaths: resolveRootfsManifestOutputPaths(buildPlan),
+    publication
+  };
+}
+
+// ../rootfs/src/executor.ts
+import path3 from "path";
+function rootfsScriptDir(buildPlan, override) {
+  return override ? path3.resolve(override) : referenceProfileRootfsDir(buildPlan.contract.id);
+}
+function createRootfsScriptCommand(buildPlan, referenceRootfsDir) {
+  const scriptDir = rootfsScriptDir(buildPlan, referenceRootfsDir);
+  return {
+    command: "bash",
+    args: [path3.join(scriptDir, "build-rootfs.sh")],
+    workdir: scriptDir,
+    env: rootfsBuildShellEnv(buildPlan)
+  };
+}
+async function buildRootfs(buildPlan, deps, availability, options = {}) {
+  const pipeline = createRootfsBuildPipeline(buildPlan, availability, options);
+  const executedCommands = [];
+  if (pipeline.executionPlan.prepareCommand) {
+    const prepareCommand = {
+      command: pipeline.executionPlan.prepareCommand.command,
+      args: pipeline.executionPlan.prepareCommand.args,
+      workdir: pipeline.executionPlan.prepareCommand.workdir,
+      env: pipeline.executionPlan.prepareCommand.env
+    };
+    await deps.run(prepareCommand);
+    executedCommands.push(prepareCommand);
+  }
+  const runCommand = {
+    command: pipeline.executionPlan.runCommand.command,
+    args: pipeline.executionPlan.runCommand.args,
+    workdir: pipeline.executionPlan.runCommand.workdir,
+    env: pipeline.executionPlan.runCommand.env
+  };
+  await deps.run(runCommand);
+  executedCommands.push(runCommand);
+  return {
+    pipeline,
+    executedCommands
+  };
+}
+async function publishRootfs(buildPlan, deps, options = {}) {
+  const command = createRootfsScriptCommand(buildPlan, options.referenceRootfsDir);
+  await deps.run(command);
+  let ipfsAddResponseContent;
+  let storeMessageContent;
+  const publicationArtifacts2 = {
+    ipfsAddResponsePath: path3.join(buildPlan.outDir, "ipfs-add-response.jsonl"),
+    storeMessagePath: path3.join(buildPlan.outDir, "store-message.json"),
+    storeMessageStderrPath: path3.join(buildPlan.outDir, "store-message.stderr.log")
+  };
+  if (!buildPlan.skipUpload) {
+    ipfsAddResponseContent = await deps.readText(publicationArtifacts2.ipfsAddResponsePath);
+    storeMessageContent = await deps.readText(publicationArtifacts2.storeMessagePath);
+  }
+  const finalized = finalizeRootfsBuildPipeline(buildPlan, {
+    createdAt: options.createdAt,
+    ipfsAddResponseContent,
+    storeMessageContent
+  });
+  return {
+    pipeline: {
+      buildPlan,
+      executionPlan: {
+        mode: "docker",
+        reason: "Running shared rootfs build orchestrator script.",
+        referenceRootfsDir: command.workdir ?? rootfsScriptDir(buildPlan, options.referenceRootfsDir),
+        runCommand: {
+          command: command.command,
+          args: command.args,
+          workdir: command.workdir,
+          env: command.env
+        }
+      },
+      publicationArtifacts: publicationArtifacts2,
+      manifestPaths: finalized.manifestPaths
+    },
+    executedCommands: [command],
+    finalized
+  };
+}
+
+// src/rootfs-runner.ts
+async function parseRootfsRunnerInputs(env = process.env) {
+  const contractPath = requiredEnv("ALEPH_ROOTFS_CONTRACT_PATH", env);
+  const contract = await readRootfsContractFile(contractPath);
+  const buildPlan = createRootfsBuildPlan(contract, {
+    projectDir: requiredEnv("ALEPH_ROOTFS_PROJECT_DIR", env),
+    contractPath,
+    alephDir: optionalEnv("ALEPH_ROOTFS_ALEPH_DIR", void 0, env) || void 0,
+    outDir: optionalEnv("ALEPH_ROOTFS_OUT_DIR", void 0, env) || void 0,
+    driver: optionalEnv("ALEPH_ROOTFS_DRIVER", "auto", env),
+    rootfsVersion: optionalEnv("ALEPH_ROOTFS_VERSION", void 0, env) || void 0,
+    rootfsSizeMiB: Number(optionalEnv("ALEPH_ROOTFS_SIZE_MIB", "", env)) || void 0,
+    rootfsImageSize: optionalEnv("ALEPH_ROOTFS_IMAGE_SIZE", void 0, env) || void 0,
+    channel: optionalEnv("ALEPH_ROOTFS_CHANNEL", void 0, env) || void 0,
+    skipUpload: booleanEnv("ALEPH_ROOTFS_SKIP_UPLOAD", false, env),
+    skipBuild: booleanEnv("ALEPH_ROOTFS_SKIP_BUILD", false, env),
+    ipfsAddUrl: optionalEnv("ALEPH_ROOTFS_IPFS_ADD_URL", void 0, env) || void 0,
+    ipfsGatewayUrl: optionalEnv("ALEPH_ROOTFS_IPFS_GATEWAY_URL", void 0, env) || void 0,
+    alephApiHost: optionalEnv("ALEPH_ROOTFS_ALEPH_API_HOST", void 0, env) || void 0,
+    alephMessageWaitAttempts: Number(optionalEnv("ALEPH_ROOTFS_ALEPH_MESSAGE_WAIT_ATTEMPTS", "", env)) || void 0,
+    alephMessageWaitDelaySeconds: Number(optionalEnv("ALEPH_ROOTFS_ALEPH_MESSAGE_WAIT_DELAY_SECONDS", "", env)) || void 0,
+    alephPinAttempts: Number(optionalEnv("ALEPH_ROOTFS_ALEPH_PIN_ATTEMPTS", "", env)) || void 0,
+    alephPinDelaySeconds: Number(optionalEnv("ALEPH_ROOTFS_ALEPH_PIN_DELAY_SECONDS", "", env)) || void 0,
+    ipfsGatewayWaitAttempts: Number(optionalEnv("ALEPH_ROOTFS_IPFS_GATEWAY_WAIT_ATTEMPTS", "", env)) || void 0,
+    ipfsGatewayWaitDelaySeconds: Number(optionalEnv("ALEPH_ROOTFS_IPFS_GATEWAY_WAIT_DELAY_SECONDS", "", env)) || void 0
+  });
+  return {
+    buildPlan,
+    availability: {
+      githubActions: env.GITHUB_ACTIONS === "true",
+      hasDocker: booleanEnv("ALEPH_ROOTFS_HAS_DOCKER", false, env),
+      dockerDaemonRunning: env.ALEPH_ROOTFS_DOCKER_DAEMON_RUNNING == null ? void 0 : booleanEnv("ALEPH_ROOTFS_DOCKER_DAEMON_RUNNING", false, env),
+      hasVirtCustomize: booleanEnv("ALEPH_ROOTFS_HAS_VIRT_CUSTOMIZE", false, env)
+    },
+    referenceRootfsDir: optionalEnv("ALEPH_ROOTFS_REFERENCE_ROOTFS_DIR", void 0, env) || void 0,
+    createdAt: optionalEnv("ALEPH_ROOTFS_CREATED_AT", void 0, env) || void 0
+  };
+}
+async function runLocalCommand(command) {
+  await new Promise((resolve, reject) => {
+    const child = spawn(command.command, command.args, {
+      cwd: command.workdir,
+      env: { ...process.env, ...command.env },
+      stdio: "inherit"
+    });
+    child.on("error", reject);
+    child.on("exit", (code) => {
+      if (code === 0) {
+        resolve();
+      } else {
+        reject(new Error(`${command.command} ${command.args.join(" ")} failed with exit code ${code ?? "unknown"}`));
+      }
+    });
+  });
+}
+async function emitRootfsOutputs(result, env = process.env) {
+  await appendGithubOutput("rootfs_version", result.finalized.manifest.version, env);
+  await appendGithubOutput("rootfs_manifest_path", result.finalized.manifestPaths.primaryPath, env);
+  await appendGithubOutput("rootfs_manifest_json", result.finalized.manifestJson, env);
+  await appendGithubOutput("rootfs_image_path", result.pipeline.buildPlan.imagePath, env);
+  await appendGithubOutput("rootfs_execution_mode", result.pipeline.executionPlan.mode, env);
+  if (result.finalized.manifestPaths.copyTargetPath) {
+    await appendGithubOutput("rootfs_manifest_copy_target_path", result.finalized.manifestPaths.copyTargetPath, env);
+  }
+  if (result.finalized.manifestPaths.versionedTargetPath) {
+    await appendGithubOutput("rootfs_manifest_versioned_path", result.finalized.manifestPaths.versionedTargetPath, env);
+  }
+  if (result.finalized.publication?.cid) {
+    await appendGithubOutput("rootfs_cid", result.finalized.publication.cid, env);
+  }
+  if (result.finalized.publication?.itemHash) {
+    await appendGithubOutput("rootfs_item_hash", result.finalized.publication.itemHash, env);
+  }
+  if (typeof result.finalized.publication?.sourceSizeBytes === "number") {
+    await appendGithubOutput("rootfs_source_size_bytes", result.finalized.publication.sourceSizeBytes, env);
+  }
+  await appendGithubSummary([
+    "## Shared Rootfs Runner",
+    "",
+    `- Version: \`${result.finalized.manifest.version}\``,
+    `- Execution mode: \`${result.pipeline.executionPlan.mode}\``,
+    `- Image path: \`${result.pipeline.buildPlan.imagePath}\``,
+    `- Manifest path: \`${result.finalized.manifestPaths.primaryPath}\``,
+    `- Published CID: \`${result.finalized.publication?.cid ?? ""}\``,
+    `- Aleph item hash: \`${result.finalized.publication?.itemHash ?? ""}\``
+  ], env);
+}
+async function runRootfsMode(env = process.env, hooks = {}) {
+  const mode = optionalEnv("ALEPH_VM_MODE", "rootfs-publish", env);
+  const stdout = hooks.stdout ?? ((text) => process.stdout.write(text));
+  const parsed = await (hooks.parseInputs ?? parseRootfsRunnerInputs)(env);
+  if (mode === "rootfs-build-plan") {
+    stdout(`${JSON.stringify(parsed.buildPlan)}
+`);
+    return;
+  }
+  if (mode === "rootfs-build") {
+    const result = await (hooks.buildRootfs ?? buildRootfs)(
+      parsed.buildPlan,
+      { run: hooks.runCommand ?? runLocalCommand },
+      parsed.availability,
+      { referenceRootfsDir: parsed.referenceRootfsDir }
+    );
+    stdout(`${JSON.stringify(result.pipeline)}
+`);
+    return;
+  }
+  if (mode === "rootfs-publish") {
+    const result = await (hooks.publishRootfs ?? publishRootfs)(
+      parsed.buildPlan,
+      {
+        run: hooks.runCommand ?? runLocalCommand,
+        readText: hooks.readText ?? ((targetPath) => readFile2(targetPath, "utf8"))
+      },
+      { createdAt: parsed.createdAt, referenceRootfsDir: parsed.referenceRootfsDir }
+    );
+    await emitRootfsOutputs(result, env);
+    stdout(`${JSON.stringify(result.finalized)}
+`);
+    return;
+  }
+  throw new Error(`Unsupported ALEPH_VM_MODE "${mode}" in shared rootfs runner.`);
+}
+async function rootfsMain() {
+  await runRootfsMode(process.env);
+}
+if (import.meta.url === pathToFileURL2(process.argv[1] ?? "").href) {
+  rootfsMain().catch((error) => {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(message);
+    process.exitCode = 1;
+  });
+}
 export {
   actionLog,
   appendGithubOutput,
@@ -2112,12 +2775,17 @@ export {
   createPrivateKeySigner,
   emitDeployOutputs,
   emitGeocodedCrnOutputs,
+  emitRootfsOutputs,
   executeDeployPlan,
   integerEnv,
   jsonEnv,
   main,
   optionalEnv,
   parseDeployPlan,
+  parseRootfsRunnerInputs,
   requiredEnv,
-  runActionMode
+  rootfsMain,
+  runActionMode,
+  runLocalCommand,
+  runRootfsMode
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@le-space/node",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Node and GitHub Actions adapters for shared Aleph tooling.",
   "license": "MIT",
   "type": "module",
@@ -16,8 +16,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@le-space/core": "0.1.2",
-    "@le-space/shared-types": "0.1.2",
+    "@le-space/core": "0.1.3",
+    "@le-space/shared-types": "0.1.3",
+    "@le-space/rootfs": "0.1.3",
     "ethers": "^6.15.0"
   }
 }