@pasko70/pibo 2.3.0 → 2.4.0

package/dist/compute/cli.js

@@ -199,13 +199,26 @@ export async function runComputeCli(argv) {
 Examples:
   $ pibo compute spawn
   $ pibo compute dev spawn --worktree my-fix
+  $ pibo compute pool status
   $ pibo compute list
   $ pibo compute release pibo-worker-abc123
 
 Next:
   $ pibo compute spawn --help
   $ pibo compute dev --help
+  $ pibo compute pool --help
 `);
+    program
+        .command("pool")
+        .description("Lease isolated Pibo deployment slots")
+        .helpOption(false)
+        .allowUnknownOption(true)
+        .allowExcessArguments(true)
+        .argument("[args...]")
+        .action(async (args) => {
+        const { runComputePoolCli } = await import("./pool/cli.js");
+        await runComputePoolCli([argv[0] ?? "node", "pibo compute pool", ...args]);
+    });
     program
         .command("spawn")
         .description("Create a one-time worker from the current Docker image")

package/dist/compute/pool/artifacts.js

@@ -0,0 +1,116 @@
+import { createHash } from "node:crypto";
+import { createReadStream, existsSync } from "node:fs";
+import { lstat, mkdir, readFile, readdir, readlink, rename, rm, utimes, writeFile } from "node:fs/promises";
+import { basename, resolve } from "node:path";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+const PACKAGE_RELATIVE_PATH = "node_modules/@pasko70/pibo/package.json";
+const BINARY_RELATIVE_PATH = "node_modules/@pasko70/pibo/dist/bin/pibo.js";
+export async function ensureDeploymentArtifact(input) {
+    if (Boolean(input.archivePath) === Boolean(input.runtimePath)) {
+        throw new Error("Provide exactly one of archivePath or runtimePath");
+    }
+    if (input.runtimePath)
+        return inspectRuntimeArtifact(resolve(input.runtimePath));
+    const archivePath = resolve(input.archivePath);
+    if (!existsSync(archivePath))
+        throw new Error(`Deployment artifact archive does not exist: ${archivePath}`);
+    const sha256 = await sha256File(archivePath);
+    const artifactRoot = resolve(input.config.artifactRoot, sha256);
+    const runtimePath = resolve(artifactRoot, "runtime");
+    if (existsSync(resolve(runtimePath, BINARY_RELATIVE_PATH))) {
+        const now = new Date();
+        await utimes(artifactRoot, now, now);
+        return { ...(await inspectRuntimeArtifact(runtimePath)), sha256, reused: true };
+    }
+    await mkdir(input.config.artifactRoot, { recursive: true, mode: 0o700 });
+    const staging = resolve(input.config.artifactRoot, `.staging-${sha256}-${process.pid}`);
+    await rm(staging, { recursive: true, force: true });
+    await mkdir(resolve(staging, "runtime"), { recursive: true, mode: 0o700 });
+    await writeFile(resolve(staging, "runtime", "package.json"), '{"name":"pibo-deployment-pool-runtime","private":true}\n', { mode: 0o600 });
+    try {
+        await execFileAsync("npm", ["install", "--omit=dev", "--ignore-scripts", "--no-audit", "--no-fund", archivePath], {
+            cwd: resolve(staging, "runtime"),
+            maxBuffer: 20 * 1024 * 1024,
+        });
+        if (!existsSync(resolve(staging, "runtime", BINARY_RELATIVE_PATH)))
+            throw new Error("Installed package does not contain the Pibo binary");
+        await writeFile(resolve(staging, "manifest.json"), `${JSON.stringify({ sha256, source: basename(archivePath), installedAt: new Date().toISOString() }, null, 2)}\n`, { mode: 0o600 });
+        if (existsSync(artifactRoot))
+            await rm(staging, { recursive: true, force: true });
+        else
+            await rename(staging, artifactRoot);
+    }
+    catch (error) {
+        await rm(staging, { recursive: true, force: true });
+        throw error;
+    }
+    return { ...(await inspectRuntimeArtifact(runtimePath)), sha256, reused: false };
+}
+export async function inspectRuntimeArtifact(runtimePath) {
+    const resolved = resolve(runtimePath);
+    const binaryPath = resolve(resolved, BINARY_RELATIVE_PATH);
+    if (!existsSync(binaryPath))
+        throw new Error(`Pibo runtime binary was not found: ${binaryPath}`);
+    let packageVersion;
+    let packageText = "";
+    try {
+        packageText = await readFile(resolve(resolved, PACKAGE_RELATIVE_PATH), "utf8");
+        const parsed = JSON.parse(packageText);
+        if (parsed.name !== "@pasko70/pibo")
+            throw new Error(`Unexpected package name in ${resolved}`);
+        if (typeof parsed.version === "string")
+            packageVersion = parsed.version;
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.startsWith("Unexpected package"))
+            throw error;
+    }
+    const packageRoot = resolve(resolved, "node_modules/@pasko70/pibo");
+    return { sha256: await sha256Directory(packageRoot), runtimePath: resolved, binaryPath, packageVersion, reused: true };
+}
+async function sha256Directory(root) {
+    const hash = createHash("sha256");
+    await hashDirectoryEntries(hash, root, "");
+    return hash.digest("hex");
+}
+async function hashDirectoryEntries(hash, root, relativeDirectory) {
+    const directory = relativeDirectory ? resolve(root, relativeDirectory) : root;
+    const entries = await readdir(directory, { withFileTypes: true });
+    entries.sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
+    for (const entry of entries) {
+        const relativePath = relativeDirectory ? `${relativeDirectory}/${entry.name}` : entry.name;
+        const absolutePath = resolve(root, relativePath);
+        const stats = await lstat(absolutePath);
+        if (entry.isDirectory()) {
+            hash.update(`directory\0${relativePath}\0${stats.mode & 0o777}\0`);
+            await hashDirectoryEntries(hash, root, relativePath);
+            continue;
+        }
+        if (entry.isFile()) {
+            hash.update(`file\0${relativePath}\0${stats.mode & 0o777}\0${stats.size}\0`);
+            await hashFileContents(hash, absolutePath);
+            hash.update("\0");
+            continue;
+        }
+        if (entry.isSymbolicLink()) {
+            hash.update(`symlink\0${relativePath}\0${await readlink(absolutePath)}\0`);
+            continue;
+        }
+        throw new Error(`Unsupported runtime artifact entry: ${absolutePath}`);
+    }
+}
+async function hashFileContents(hash, path) {
+    await new Promise((resolvePromise, reject) => {
+        const stream = createReadStream(path);
+        stream.on("data", (chunk) => hash.update(chunk));
+        stream.once("end", resolvePromise);
+        stream.once("error", reject);
+    });
+}
+async function sha256File(path) {
+    const hash = createHash("sha256");
+    await hashFileContents(hash, path);
+    return hash.digest("hex");
+}

package/dist/compute/pool/cli.js

@@ -0,0 +1,156 @@
+import { Command } from "commander";
+import { ensureDeploymentArtifact } from "./artifacts.js";
+import { resolveDeploymentPoolConfig } from "./config.js";
+import { acquireDeployment, applyDeploymentPoolReapPlan, getDeploymentPoolDoctor, getDeploymentPoolStatus, listDeploymentArtifacts, planDeploymentPoolReap, releaseDeploymentLease, renewDeploymentLease, } from "./service.js";
+function printJson(value) {
+    console.log(JSON.stringify(value, null, 2));
+}
+function parsePositiveInteger(value) {
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed < 1)
+        throw new Error("Value must be a positive integer");
+    return parsed;
+}
+function parseSeedMode(value) {
+    if (value === "full" || value === "medium" || value === "fresh")
+        return value;
+    throw new Error("Seed mode must be full, medium, or fresh");
+}
+function printDiscovery() {
+    console.log(`pibo compute pool - lease isolated Pibo deployment slots
+
+Commands:
+  status                 Show slots and active leases
+  acquire                Install an exact runtime into a free slot
+  renew <lease-id>       Extend an active lease
+  release <lease-id>     Stop and free a lease
+  reap                    Preview or apply expired-lease cleanup
+  doctor                  Check pool, Docker, seed, and container state
+  artifacts               List installed checksum-addressed runtimes
+  seed                    Explain available seed modes
+
+Next:
+  pibo compute pool acquire --help
+`);
+}
+export async function runComputePoolCli(argv) {
+    if (argv.length <= 2 || argv[2] === "--help" || argv[2] === "-h") {
+        printDiscovery();
+        return;
+    }
+    const program = new Command();
+    program.name("pibo compute pool").description("Lease isolated Pibo deployment slots").showHelpAfterError();
+    program.command("status")
+        .option("--json", "Print machine-readable status")
+        .action((options) => {
+        const status = getDeploymentPoolStatus();
+        if (options.json)
+            printJson(status);
+        else {
+            console.log(`Deployment pool: ${status.active}/${status.maxActive} active, ${status.free} free`);
+            for (const slot of status.slots)
+                console.log(`${slot.id}\t${slot.state}\t${slot.publicUrl ?? "-"}\t${slot.lease?.holder ?? "-"}\t${slot.lease?.expiresAt ?? "-"}`);
+        }
+    });
+    program.command("acquire")
+        .requiredOption("--holder <holder>", "Pibo Session ID or other stable holder")
+        .option("--artifact <path>", "Server-local npm package archive")
+        .option("--runtime <path>", "Server-local installed Pibo runtime directory")
+        .option("--seed <mode>", "Seed mode: full, medium, or fresh", parseSeedMode, "medium")
+        .option("--ttl-minutes <minutes>", "Lease lifetime", parsePositiveInteger)
+        .option("--commit <sha>", "Source commit metadata")
+        .option("--json", "Print machine-readable lease")
+        .addHelpText("after", `
+Provide exactly one source:
+  pibo compute pool acquire --holder ps_... --artifact /path/pibo.tgz --seed medium
+  pibo compute pool acquire --holder ps_... --runtime /opt/pibo-candidates/name/commit/runtime --seed fresh
+`)
+        .action(async (options) => {
+        const config = resolveDeploymentPoolConfig();
+        const artifact = await ensureDeploymentArtifact({ config, archivePath: options.artifact, runtimePath: options.runtime });
+        const lease = await acquireDeployment({ holder: options.holder, seedMode: options.seed, artifact, ttlMinutes: options.ttlMinutes, commit: options.commit, config });
+        if (options.json)
+            printJson(lease);
+        else {
+            console.log(`${lease.id}\t${lease.status}\t${lease.slotId}\t${lease.publicUrl ?? "-"}`);
+            console.log(`expires\t${lease.expiresAt}`);
+            console.log(`renew\tpibo compute pool renew ${lease.id} --holder ${lease.holder}`);
+            console.log(`release\tpibo compute pool release ${lease.id} --holder ${lease.holder}`);
+        }
+    });
+    program.command("renew")
+        .argument("<lease-id>")
+        .requiredOption("--holder <holder>")
+        .option("--ttl-minutes <minutes>", "New lifetime from now", parsePositiveInteger)
+        .option("--json")
+        .action((leaseId, options) => {
+        const lease = renewDeploymentLease({ leaseId, holder: options.holder, ttlMinutes: options.ttlMinutes });
+        if (options.json)
+            printJson(lease);
+        else
+            console.log(`${lease.id}\tready\texpires=${lease.expiresAt}`);
+    });
+    program.command("release")
+        .argument("<lease-id>")
+        .option("--holder <holder>")
+        .option("--force", "Operator release without holder match")
+        .option("--json")
+        .action(async (leaseId, options) => {
+        if (!options.force && !options.holder)
+            throw new Error("--holder is required unless --force is used");
+        const lease = await releaseDeploymentLease({ leaseId, holder: options.holder, force: options.force });
+        if (options.json)
+            printJson(lease);
+        else
+            console.log(`${lease.id}\t${lease.status}`);
+    });
+    program.command("reap")
+        .option("--dry-run", "Preview cleanup", true)
+        .option("--apply", "Apply cleanup")
+        .option("--json")
+        .action(async (options) => {
+        const plan = await planDeploymentPoolReap();
+        const result = options.apply ? await applyDeploymentPoolReapPlan(plan) : { applied: false, plan };
+        if (options.json)
+            printJson(result);
+        else {
+            console.log(`Deployment pool reap ${options.apply ? "apply" : "dry-run"}: ${plan.summary.selectedLeases} lease(s), ${plan.summary.selectedOrphanContainers} orphan container(s), ${plan.summary.selectedDirtySlots} dirty slot(s), ${plan.summary.selectedFailureSnapshots} failure snapshot(s), ${plan.summary.selectedArtifacts} artifact(s)`);
+            for (const item of plan.items)
+                console.log(`${item.action}\t${item.lease.id}\t${item.reasons.join("+") || "active"}`);
+            if (!options.apply)
+                console.log("Dry-run only. Apply with: pibo compute pool reap --apply");
+        }
+    });
+    program.command("doctor")
+        .option("--json")
+        .action(async (options) => {
+        const result = await getDeploymentPoolDoctor();
+        if (options.json)
+            printJson(result);
+        else {
+            console.log(`configured\t${result.configured}`);
+            console.log(`runtime-image\t${result.runtimeImageAvailable ? "ok" : "missing"}\t${result.runtimeImage}`);
+            console.log(`seed-source\t${result.seedSourceHomeAvailable ? "ok" : "missing"}\t${result.seedSourceHome}`);
+            console.log("Next: pibo compute pool status --json");
+        }
+    });
+    program.command("artifacts")
+        .option("--json")
+        .action(async (options) => {
+        const rows = await listDeploymentArtifacts();
+        if (options.json)
+            printJson({ artifacts: rows });
+        else if (!rows.length)
+            console.log("No deployment pool artifacts.");
+        else
+            for (const row of rows)
+                console.log(`${row.sha256}\t${row.bytes}\t${row.modifiedAt}\t${row.path}`);
+    });
+    program.command("seed")
+        .action(() => console.log(`Deployment seed modes:
+  full    Nearly complete Pibo home plus configured workspace; excludes active runtime, lock, browser, debug, and pool state.
+  medium  Operational config, selected product databases, projects, contexts, agents, and user skills; excludes heavy payload/tool/browser/debug state.
+  fresh   Operational config, Google/Machine auth configuration, model defaults, contexts, and user skills; no existing product databases.
+`));
+    await program.parseAsync(argv);
+}

package/dist/compute/pool/config.js

@@ -0,0 +1,101 @@
+import { resolve } from "node:path";
+import { getPiboHome, piboHomePath } from "../../core/pibo-home.js";
+export function resolveDeploymentPoolConfig(options = {}) {
+    const env = options.env ?? process.env;
+    const root = resolve(options.root ?? env.PIBO_COMPUTE_POOL_ROOT ?? piboHomePath("compute-pool"));
+    const baseURL = parseBaseURL(options.baseURL ?? env.PIBO_COMPUTE_POOL_BASE_URL);
+    const slotCount = positiveInteger(env.PIBO_COMPUTE_POOL_SLOT_COUNT, 10);
+    const maxActive = Math.min(slotCount, positiveInteger(env.PIBO_COMPUTE_POOL_MAX_ACTIVE, 3));
+    const portBase = validPort(env.PIBO_COMPUTE_POOL_PORT_BASE, 5000);
+    const portStride = positiveInteger(env.PIBO_COMPUTE_POOL_PORT_STRIDE, 10);
+    if (portBase + (slotCount - 1) * portStride + 1 > 65535) {
+        throw new Error("Deployment pool slot ports exceed 65535");
+    }
+    return {
+        root,
+        databasePath: resolve(root, "pool.sqlite"),
+        artifactRoot: resolve(root, "artifacts"),
+        slotsRoot: resolve(root, "slots"),
+        failuresRoot: resolve(root, "failures"),
+        baseURL,
+        slotCount,
+        maxActive,
+        portBase,
+        portStride,
+        defaultTtlMinutes: positiveInteger(env.PIBO_COMPUTE_POOL_TTL_MINUTES, 60),
+        failedRetentionMinutes: positiveInteger(env.PIBO_COMPUTE_POOL_FAILED_RETENTION_MINUTES, 120),
+        maxFailedSnapshots: positiveInteger(env.PIBO_COMPUTE_POOL_MAX_FAILED_SNAPSHOTS, 3),
+        artifactRetentionHours: positiveInteger(env.PIBO_COMPUTE_POOL_ARTIFACT_RETENTION_HOURS, 24),
+        maxArtifacts: positiveInteger(env.PIBO_COMPUTE_POOL_MAX_ARTIFACTS, 10),
+        minMemoryAvailableMb: positiveInteger(env.PIBO_COMPUTE_POOL_MIN_MEMORY_AVAILABLE_MB, 1536),
+        minDiskAvailableGb: positiveInteger(env.PIBO_COMPUTE_POOL_MIN_DISK_AVAILABLE_GB, 10),
+        runtimeImage: nonEmpty(env.PIBO_COMPUTE_POOL_RUNTIME_IMAGE, "pibo:latest"),
+        envFile: optionalResolved(env.PIBO_COMPUTE_POOL_ENV_FILE),
+        seedSourceHome: resolve(env.PIBO_COMPUTE_POOL_SEED_SOURCE_HOME ?? getPiboHome()),
+        seedSourcePiHome: optionalResolved(env.PIBO_COMPUTE_POOL_SEED_SOURCE_PI_HOME),
+        seedSourceWorkspace: optionalResolved(env.PIBO_COMPUTE_POOL_SEED_SOURCE_WORKSPACE),
+    };
+}
+export function requireDeploymentPoolBaseURL(config) {
+    if (!config.baseURL) {
+        throw new Error("PIBO_COMPUTE_POOL_BASE_URL is required for deployment acquire");
+    }
+    return config.baseURL;
+}
+export function deploymentSlotDefinitions(config) {
+    return Array.from({ length: config.slotCount }, (_, index) => {
+        const ordinal = index + 1;
+        const id = `slot-${String(ordinal).padStart(2, "0")}`;
+        const webPort = config.portBase + index * config.portStride;
+        const gatewayPort = webPort + 1;
+        return {
+            id,
+            ordinal,
+            webPort,
+            gatewayPort,
+            publicUrl: config.baseURL ? deploymentSlotURL(id, config.baseURL).toString() : undefined,
+        };
+    });
+}
+export function deploymentSlotURL(slotId, baseURL) {
+    if (!/^slot-\d{2}$/.test(slotId))
+        throw new Error(`Invalid deployment slot id "${slotId}"`);
+    const url = new URL(baseURL.toString());
+    url.hostname = `${slotId}.${baseURL.hostname}`;
+    return url;
+}
+function parseBaseURL(value) {
+    if (!value?.trim())
+        return undefined;
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error("PIBO_COMPUTE_POOL_BASE_URL must be an absolute HTTP or HTTPS URL");
+    }
+    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
+        throw new Error("PIBO_COMPUTE_POOL_BASE_URL must contain only scheme, hostname, and optional port");
+    }
+    return url;
+}
+function positiveInteger(value, fallback) {
+    if (!value?.trim())
+        return fallback;
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed < 1)
+        throw new Error(`Expected positive integer, received "${value}"`);
+    return parsed;
+}
+function validPort(value, fallback) {
+    const port = positiveInteger(value, fallback);
+    if (port > 65535)
+        throw new Error(`Invalid port ${port}`);
+    return port;
+}
+function nonEmpty(value, fallback) {
+    return value?.trim() || fallback;
+}
+function optionalResolved(value) {
+    return value?.trim() ? resolve(value) : undefined;
+}

package/dist/compute/pool/docker.js

@@ -0,0 +1,157 @@
+import { execFile } from "node:child_process";
+import { existsSync } from "node:fs";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+export const DEPLOYMENT_POOL_LABEL = "pibo.deploymentPool";
+export const DEPLOYMENT_LEASE_LABEL = "pibo.deployment.leaseId";
+export const DEPLOYMENT_SLOT_LABEL = "pibo.deployment.slotId";
+export const DEPLOYMENT_HOLDER_LABEL = "pibo.deployment.holder";
+export const DEPLOYMENT_EXPIRES_LABEL = "pibo.deployment.expiresAt";
+export const DEPLOYMENT_ARTIFACT_LABEL = "pibo.deployment.artifactSha256";
+export const DEPLOYMENT_SEED_LABEL = "pibo.deployment.seedMode";
+export function buildDeploymentContainerArgs(input) {
+    const command = [
+        "set -eu",
+        "export DISPLAY=:99",
+        "if command -v Xvfb >/dev/null 2>&1 && ! pgrep -x Xvfb >/dev/null 2>&1; then Xvfb :99 -screen 0 1920x1080x24 -ac -nolisten tcp >/tmp/xvfb.log 2>&1 & fi",
+        "exec node /opt/pibo-runtime/node_modules/@pasko70/pibo/dist/bin/pibo.js gateway:web --web-host 0.0.0.0 --web-port 4788 --gateway-port 4789",
+    ].join("; ");
+    return [
+        "run",
+        "-d",
+        "--name",
+        input.lease.containerName,
+        "--hostname",
+        input.slot.id,
+        "--memory",
+        "1536m",
+        "--memory-swap",
+        "1536m",
+        "--cpus",
+        "1.0",
+        "--pids-limit",
+        "512",
+        "--shm-size",
+        "512m",
+        "--init",
+        "--restart",
+        "no",
+        "--log-driver",
+        "json-file",
+        "--log-opt",
+        "max-size=10m",
+        "--log-opt",
+        "max-file=3",
+        "-e",
+        "NODE_ENV=production",
+        "-e",
+        "PIBO_HOME=/root/.pibo",
+        "-e",
+        "HOME=/root",
+        "-e",
+        "PIBO_COMPUTE_POOL=1",
+        "-e",
+        `PIBO_COMPUTE_POOL_LEASE_ID=${input.lease.id}`,
+        ...(input.config.envFile && existsSync(input.config.envFile) ? ["--env-file", input.config.envFile] : []),
+        "-p",
+        `127.0.0.1:${input.slot.webPort}:4788`,
+        "-p",
+        `127.0.0.1:${input.slot.gatewayPort}:4789`,
+        "-v",
+        `${input.lease.artifactRuntimePath}:/opt/pibo-runtime:ro`,
+        "-v",
+        `${input.homePath}:/root/.pibo`,
+        "-v",
+        `${input.piHomePath}:/root/.pi`,
+        "-v",
+        `${input.workspacePath}:/workspace`,
+        "-w",
+        "/workspace",
+        "--label",
+        `${DEPLOYMENT_POOL_LABEL}=true`,
+        "--label",
+        `${DEPLOYMENT_LEASE_LABEL}=${input.lease.id}`,
+        "--label",
+        `${DEPLOYMENT_SLOT_LABEL}=${input.slot.id}`,
+        "--label",
+        `${DEPLOYMENT_HOLDER_LABEL}=${safeLabelValue(input.lease.holder)}`,
+        "--label",
+        `${DEPLOYMENT_EXPIRES_LABEL}=${input.lease.expiresAt}`,
+        "--label",
+        `${DEPLOYMENT_ARTIFACT_LABEL}=${input.lease.artifactSha256}`,
+        "--label",
+        `${DEPLOYMENT_SEED_LABEL}=${input.lease.seedMode}`,
+        "--entrypoint",
+        "/bin/sh",
+        input.config.runtimeImage,
+        "-lc",
+        command,
+    ];
+}
+export async function startDeploymentContainer(input) {
+    await execFileAsync("docker", buildDeploymentContainerArgs(input), { maxBuffer: 10 * 1024 * 1024 });
+}
+export async function removeDeploymentContainer(containerName) {
+    try {
+        await execFileAsync("docker", ["stop", "-t", "10", containerName]);
+    }
+    catch {
+        // Container may already be stopped or missing.
+    }
+    try {
+        await execFileAsync("docker", ["rm", "-f", containerName]);
+    }
+    catch (error) {
+        if (!String(error?.stderr ?? error?.message ?? error).includes("No such container"))
+            throw error;
+    }
+}
+export async function deploymentContainerExists(containerName) {
+    try {
+        await execFileAsync("docker", ["inspect", "--type=container", containerName]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function listDeploymentContainers() {
+    const { stdout } = await execFileAsync("docker", [
+        "ps", "--all", "--filter", `label=${DEPLOYMENT_POOL_LABEL}=true`,
+        "--format", "{{.ID}}\t{{.Names}}\t{{.State}}\t{{.Label \"pibo.deployment.leaseId\"}}\t{{.Label \"pibo.deployment.slotId\"}}",
+    ]);
+    return stdout.trim().split("\n").filter(Boolean).map((line) => {
+        const [id, name, state, leaseId, slotId] = line.split("\t");
+        return { id: id, name: name, state: state ?? "unknown", leaseId: leaseId || undefined, slotId: slotId || undefined };
+    });
+}
+export async function waitForDeploymentHealth(webPort, options = {}) {
+    const deadline = Date.now() + (options.timeoutMs ?? 90_000);
+    let lastError = "not ready";
+    while (Date.now() < deadline) {
+        try {
+            const response = await fetch(`http://127.0.0.1:${webPort}/health`, { signal: AbortSignal.timeout(2_000) });
+            if (response.ok)
+                return;
+            lastError = `HTTP ${response.status}`;
+        }
+        catch (error) {
+            lastError = error instanceof Error ? error.message : String(error);
+        }
+        await new Promise((resolve) => setTimeout(resolve, options.intervalMs ?? 500));
+    }
+    throw new Error(`Deployment slot health check timed out on port ${webPort}: ${lastError}`);
+}
+export async function dockerImageExists(image) {
+    try {
+        await execFileAsync("docker", ["inspect", "--type=image", image]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function safeLabelValue(value) {
+    const safe = value.replace(/[^A-Za-z0-9._:@-]/g, "-").slice(0, 128);
+    return safe || "unknown";
+}