@promigence/sdk 0.1.0-beta.4 → 0.1.0-beta.6

package/dist/client.js

@@ -1,7 +1,7 @@
-import { lstatSync, readFileSync, readdirSync, readlinkSync, statSync } from "node:fs";
+import { readFileSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { inspect } from "node:util";
-import { dirname, join, relative, sep } from "node:path";
+import { dirname, join } from "node:path";
 import { ApiError, AuthError, EnvFailedError, PromigenceError, InvalidArgumentError, NotFoundError, NotReleasedError, NotVerifiedError, RateLimitError, SpendCapError, TimeoutError, UnreachableError, DEFAULT_API_URL, ERRORS_DOCS_URL, FILE_PUT_CHUNK_BYTES, MAX_OUTPUT_BYTES_DEFAULT, VERSION, WAIT_TIMEOUT_MS, PreviewsUnavailableError, exitForCode, previewsOff, withPreviewsFix, } from "./core.js";
 import { BUNDLE_SCHEMA, buildBundle } from "./bundle.js";
 import { keychainReadCached, keychainStore, storeLabel } from "./credstore.js";
@@ -9,6 +9,7 @@ import { CALLER_HEADER, resolveCaller, userAgentWithCaller } from "./caller.js";
 import { connectPty } from "./pty.js";
 import { connectSshTunnel } from "./ssh.js";
 import { H2Response, Http2Transport, http2Allowed } from "./http2.js";
+import { CONTEXT_TAR_PREFIX } from "./context.js";
 import { proxyFetch, proxyFor } from "./proxy.js";
 import { mark, traceBegin, traceEvent } from "./trace.js";
 import { KEYED_CREATES } from "./keyed.gen.js";
@@ -407,81 +408,6 @@ export function checkImageVersioned(image) {
     throw new InvalidArgumentError(`image ${JSON.stringify(ref)} names no tag or digest, so it would be pinned to whatever ${ref}:latest is today`, `Name the version: a tag (${ref}:<version>), ${ref}:latest if you mean the moving tag, or a digest (${ref}@sha256:<64 hex>).`);
 }
 export const CONTEXT_GIT_RE = /^(?:https?:\/\/|ssh:\/\/|git:\/\/|git@)\S+@[0-9a-f]{40}$/i;
-export const CONTEXT_TAR_PREFIX = "tar;base64,";
-export const CONTEXT_SKIP = new Set([".git", "node_modules", "__pycache__", ".venv", ".DS_Store"]);
-export function dockerignoreMatcher(text) {
-    const rules = [];
-    for (const raw of text.split(/\r?\n/)) {
-        let line = raw.trim();
-        if (!line || line.startsWith("#"))
-            continue;
-        const exclusion = line.startsWith("!");
-        if (exclusion)
-            line = line.slice(1).trim();
-        const parts = [];
-        for (const seg of line.split("/")) {
-            if (seg === "" || seg === ".")
-                continue;
-            if (seg === "..")
-                parts.pop();
-            else
-                parts.push(seg);
-        }
-        const pattern = parts.join("/");
-        if (!pattern)
-            continue;
-        let re = "^";
-        for (let i = 0; i < pattern.length; i++) {
-            const ch = pattern[i];
-            if (ch === "*") {
-                if (pattern[i + 1] === "*") {
-                    i++;
-                    if (pattern[i + 1] === "/")
-                        i++;
-                    re += i + 1 >= pattern.length ? ".*" : "(.*/)?";
-                }
-                else {
-                    re += "[^/]*";
-                }
-            }
-            else if (ch === "?") {
-                re += "[^/]";
-            }
-            else if (ch === "\\") {
-                re += i + 1 < pattern.length ? `\\${pattern[++i]}` : "\\\\";
-            }
-            else if (ch === "[" || ch === "]") {
-                re += ch;
-            }
-            else {
-                re += /[.+()|{}$]/.test(ch) ? `\\${ch}` : ch;
-            }
-        }
-        try {
-            rules.push({ re: new RegExp(`${re}$`), exclusion });
-        }
-        catch {
-        }
-    }
-    if (rules.length === 0)
-        return undefined;
-    const ignored = (rel) => {
-        const dirs = rel.split("/");
-        let matched = false;
-        for (const r of rules) {
-            if (r.exclusion !== matched)
-                continue;
-            let hit = r.re.test(rel);
-            for (let i = 1; !hit && i < dirs.length; i++)
-                hit = r.re.test(dirs.slice(0, i).join("/"));
-            if (hit)
-                matched = !r.exclusion;
-        }
-        return matched;
-    };
-    return { ignored, exceptions: rules.some((r) => r.exclusion) };
-}
-export const CONTEXT_MAX_BYTES = 8 * 1024 * 1024;
 export function repoUrlCredential(url) {
     const u = url.trim();
     const sep = u.indexOf("://");
@@ -531,112 +457,6 @@ export function checkDockerfileContext(context) {
     throw new InvalidArgumentError(`dockerfile.context must be a git URL pinned to a full 40-character sha, got ${JSON.stringify(context)}`, "A branch or a tag is not a pin: pass URL@<40-char sha> (git rev-parse HEAD), or pack a local " +
         "directory with packContext('./app').");
 }
-export function packContext(dir, opts = {}) {
-    const max = opts.maxBytes ?? CONTEXT_MAX_BYTES;
-    const keep = new Set([".dockerignore", ...(opts.keep ?? [])]);
-    const collect = (ignore) => {
-        const entries = [];
-        let total = 0;
-        const walk = (abs, rel) => {
-            for (const name of readdirSync(abs).sort()) {
-                if (CONTEXT_SKIP.has(name))
-                    continue;
-                const childAbs = join(abs, name);
-                const childRel = rel ? `${rel}/${name}` : name;
-                const st = lstatSync(childAbs);
-                const dropped = ignore !== undefined && !keep.has(childRel) && ignore.ignored(childRel);
-                if (st.isDirectory()) {
-                    if (dropped && !ignore.exceptions)
-                        continue;
-                    if (!walk(childAbs, childRel))
-                        return false;
-                    continue;
-                }
-                if (dropped)
-                    continue;
-                if (st.isSymbolicLink()) {
-                    entries.push({ path: childRel, mode: 0o777, body: Buffer.alloc(0), link: readlinkSync(childAbs) });
-                    continue;
-                }
-                if (!st.isFile())
-                    continue;
-                total += st.size;
-                if (total > max)
-                    return false;
-                entries.push({ path: childRel, mode: st.mode & 0o111 ? 0o755 : 0o644, body: readFileSync(childAbs) });
-            }
-            return true;
-        };
-        return walk(dir, "") ? entries : undefined;
-    };
-    let entries = collect();
-    if (entries === undefined) {
-        let ignore;
-        try {
-            ignore = dockerignoreMatcher(readFileSync(join(dir, ".dockerignore"), "utf8"));
-        }
-        catch {
-            ignore = undefined;
-        }
-        if (ignore !== undefined)
-            entries = collect(ignore);
-        if (entries === undefined) {
-            throw new InvalidArgumentError(`the build context is over ${max} bytes${ignore ? " even without what its .dockerignore excludes" : ""}`, `${ignore ? "Exclude more in .dockerignore" : "Add a .dockerignore"}, point --context at a smaller directory, or pass a git URL pinned to a full 40-character sha.`);
-        }
-    }
-    if (entries.length === 0) {
-        throw new InvalidArgumentError(`the build context ${JSON.stringify(dir)} is empty`, "Point --context at the directory holding your Dockerfile.");
-    }
-    return CONTEXT_TAR_PREFIX + tarOf(entries).toString("base64");
-}
-export function contextRelative(contextDir, dockerfilePath) {
-    const rel = relative(contextDir, dockerfilePath).split(sep).join("/");
-    if (!rel || rel.startsWith("..")) {
-        throw new InvalidArgumentError(`${JSON.stringify(dockerfilePath)} is not inside the context ${JSON.stringify(contextDir)}`, "Pass --context DIR with the Dockerfile underneath it.");
-    }
-    return rel;
-}
-function tarOf(entries) {
-    const out = [];
-    for (const e of [...entries].sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0))) {
-        const head = Buffer.alloc(512);
-        let name = e.path;
-        let prefix = "";
-        if (Buffer.byteLength(name) > 100) {
-            const cut = name.lastIndexOf("/", name.length - 100);
-            if (cut <= 0 || Buffer.byteLength(name.slice(cut + 1)) > 100 || Buffer.byteLength(name.slice(0, cut)) > 155) {
-                throw new InvalidArgumentError(`the path ${JSON.stringify(e.path)} is too long for a build context`, "Shorten the path or pass a git URL pinned to a full 40-character sha.");
-            }
-            prefix = name.slice(0, cut);
-            name = name.slice(cut + 1);
-        }
-        const put = (s, at, len) => { head.write(s.slice(0, len), at, len, "utf8"); };
-        const oct = (n, at, len) => { put(n.toString(8).padStart(len - 1, "0") + "\0", at, len); };
-        put(name, 0, 100);
-        oct(e.mode, 100, 8);
-        oct(0, 108, 8);
-        oct(0, 116, 8);
-        oct(e.link === undefined ? e.body.length : 0, 124, 12);
-        oct(0, 136, 12);
-        head.write("        ", 148, 8, "utf8");
-        head.write(e.link === undefined ? "0" : "2", 156, 1, "utf8");
-        if (e.link !== undefined)
-            put(e.link, 157, 100);
-        head.write("ustar\0", 257, 6, "binary");
-        head.write("00", 263, 2, "utf8");
-        put(prefix, 345, 155);
-        let sum = 0;
-        for (const b of head)
-            sum += b;
-        put(sum.toString(8).padStart(6, "0") + "\0 ", 148, 8);
-        out.push(head);
-        if (e.link === undefined && e.body.length > 0) {
-            out.push(e.body, Buffer.alloc((512 - (e.body.length % 512)) % 512));
-        }
-    }
-    out.push(Buffer.alloc(1024));
-    return Buffer.concat(out);
-}
 function sourcesBody(sources) {
     if (sources.length > MAX_SOURCES) {
         throw new InvalidArgumentError(`snapshots.create takes at most ${MAX_SOURCES} extra sources, got ${sources.length}`, "An environment assembled from more repositories than that is cheaper to build once as " +
@@ -684,6 +504,9 @@ export function snapshotCreateBody(opts) {
     let body;
     const github = typeof o.repo === "string"
         && (o.repo.trim().startsWith(GITHUB_REPO_PREFIX) || o.repo.trim().startsWith(GITLAB_REPO_PREFIX));
+    if (o.env !== undefined && Object.keys(o.env).length && forms[0] === "repo") {
+        throw new InvalidArgumentError("snapshots.create env is for an image or a Dockerfile", "A repository snapshot sets its environment in its setup steps, or pass env on each command.");
+    }
     if (!github && (o.ref !== undefined || o.from !== undefined || o.track)) {
         throw new InvalidArgumentError("snapshots.create ref, from and track are for a connected repository (repo: 'github:owner/name' or 'gitlab:group/project')", "Pass { repo: 'github:your-org/app', ref: 'main' }, or drop them for this form.");
     }
@@ -739,6 +562,8 @@ export function snapshotCreateBody(opts) {
             body["tier"] = o.tier;
         if (o.registrySecret)
             body["registry_secret"] = o.registrySecret;
+        if (o.env !== undefined && Object.keys(o.env).length)
+            body["env"] = { ...o.env };
     }
     if (o.alias)
         body["alias"] = o.alias;
@@ -1485,6 +1310,11 @@ export class PromigenceClient {
     github = {
         status: () => this.request({ method: "GET", path: "/integrations/github" }),
         connect: () => this.request({ method: "POST", path: "/integrations/github/connect", body: {} }),
+        ticket: () => this.request({ method: "POST", path: "/integrations/github/requests", body: {} }),
+        request: (requestId) => this.request({
+            method: "GET",
+            path: `/integrations/github/requests/${encodeURIComponent(requestId)}`,
+        }),
         disconnect: (installationId) => this.request({
             method: "DELETE",
             path: `/integrations/github/installations/${encodeURIComponent(String(installationId))}`,
@@ -1503,6 +1333,11 @@ export class PromigenceClient {
     gitlab = {
         status: () => this.request({ method: "GET", path: "/integrations/gitlab" }),
         connect: () => this.request({ method: "POST", path: "/integrations/gitlab/connect", body: {} }),
+        ticket: () => this.request({ method: "POST", path: "/integrations/gitlab/requests", body: {} }),
+        request: (requestId) => this.request({
+            method: "GET",
+            path: `/integrations/gitlab/requests/${encodeURIComponent(requestId)}`,
+        }),
         disconnect: (connectionId) => this.request({
             method: "DELETE",
             path: `/integrations/gitlab/connections/${encodeURIComponent(connectionId)}`,

package/dist/context.d.ts

@@ -0,0 +1,119 @@
+/**
+ * A local directory as a Dockerfile build context: what `packContext` sends, decided before
+ * anything leaves this machine.
+ *
+ * - **`.dockerignore` is applied here, always**, with the rules `docker build` uses: Go glob syntax
+ *   plus `**`, `!` to bring a path back, the last matching line wins, a matched directory takes
+ *   everything under it, and paths are read from the context root. A file the `.dockerignore`
+ *   excludes is never uploaded. `<Dockerfile>.dockerignore` beside the Dockerfile is read instead
+ *   of the root `.dockerignore` when it exists, as `docker build` does. The Dockerfile and the
+ *   ignore files themselves are always sent, whatever a pattern says.
+ * - **`.git` is never sent** unless the `.dockerignore` has the line `!.git`: git history can hold
+ *   credentials long deleted from the tree.
+ * - **Without a `.dockerignore`**, `node_modules`, `__pycache__`, `.venv` and `.DS_Store` are left
+ *   out too, and a note says so; with one, only what it lists is left out.
+ * - Empty directories and permission bits travel as they are on disk; a set-user-ID or
+ *   set-group-ID bit is cleared, with a note.
+ * - Files that look like credentials (`.env`, private keys, cloud credentials, ...) are refused,
+ *   by name, unless `allowSecrets` says otherwise. The check goes by file name: it is
+ *   best-effort and cannot see what a file holds, so look over the list (`listContext`) before
+ *   you send a directory.
+ * - Symbolic links travel as links, never as the file they point at.
+ */
+/** The prefix a packed directory travels under in `dockerfile.context`. */
+export declare const CONTEXT_TAR_PREFIX = "tar;base64,";
+/** The largest context accepted, counted in file bytes after `.dockerignore`. */
+export declare const CONTEXT_MAX_BYTES: number;
+/**
+ * Names left out when the context has no `.dockerignore`. With one, the `.dockerignore` alone
+ * decides, except for `.git` (sent only when it says `!.git`).
+ */
+export declare const CONTEXT_SKIP: Set<string>;
+/** The patterns of one ignore file, compiled. */
+export interface DockerIgnore {
+    /** The ignore file these came from (`.dockerignore` or `<Dockerfile>.dockerignore`). */
+    readonly file: string;
+    /** The patterns as the build holds them, in file order: cleaned, an exception keeping its `!`. */
+    readonly patterns: readonly string[];
+    /** Whether any line is a `!` exception. */
+    readonly exceptions: boolean;
+    /** Whether a line says `!.git`, which is what sends `.git`. */
+    readonly sendsGit: boolean;
+    /**
+     * Is `path` (relative to the context root, `/`-separated) left out? The last pattern that
+     * matches it, or one of the directories above it, decides.
+     */
+    ignored(path: string): boolean;
+}
+/**
+ * Read an ignore file the way `docker build` reads it: a UTF-8 BOM is dropped; a line starting
+ * with `#` is a comment; each line is trimmed; `!` starts an exception; each pattern is cleaned
+ * (`a//b/../c` is `a/c`) and a leading `/` is dropped. A line the build cannot read (a lone `!`,
+ * an unclosed `[`, a trailing `\`) makes the build refuse the whole file, so it is refused here,
+ * naming the line, before anything is sent.
+ */
+export declare function parseDockerignore(text: string, file?: string): DockerIgnore;
+/**
+ * A `.dockerignore`'s patterns as a predicate, or `undefined` for a file with no patterns. Refuses
+ * a file the build could not read. Kept for code written against 0.1; `parseDockerignore` is the
+ * full reader.
+ */
+export declare function dockerignoreMatcher(text: string): {
+    ignored: (rel: string) => boolean;
+    exceptions: boolean;
+} | undefined;
+/**
+ * Does this path look like a credential (`.env`, a private key, cloud or registry credentials, a
+ * token file, ...)? By name only: best-effort, it cannot see what a file holds. Templates such as
+ * `.env.example` are not.
+ */
+export declare function secretLike(path: string): boolean;
+/** What a build context is packed from and sent with. */
+export interface ContextOptions {
+    /**
+     * The Dockerfile's path inside the context, `/`-separated (default `Dockerfile`). It is always
+     * sent, and `<it>.dockerignore`, when present, is read instead of the root `.dockerignore`.
+     */
+    dockerfile?: string;
+    /** More paths inside the context to send whatever `.dockerignore` says. */
+    keep?: readonly string[];
+    /** Refuse a context whose files add up to more than this many bytes (default `CONTEXT_MAX_BYTES`). */
+    maxBytes?: number;
+    /**
+     * Send files that look like credentials. Default `false`: they are refused, by name, and
+     * nothing is sent.
+     */
+    allowSecrets?: boolean;
+    /** Called with each note: what was left out by default, or changed on the way. */
+    onNote?: (note: string) => void;
+}
+/** What a build context would hold, before anything is sent. */
+export interface ContextListing {
+    /** Every path that would be sent, sorted; a directory's ends in `/`. */
+    paths: string[];
+    /** How many of them are files or links. */
+    files: number;
+    /** The files' bytes. */
+    bytes: number;
+    /** What was left out by default or changed on the way, one sentence each. */
+    notes: string[];
+    /** The paths that would be sent and look like credentials. */
+    secrets: string[];
+    /** The ignore file applied, or `null` when there is none. */
+    ignoreFile: string | null;
+}
+/**
+ * What `packContext(dir, opts)` would send, without sending or packing anything: every path, the
+ * notes, and the files that look like credentials. Refuses only what `packContext` cannot read
+ * (an ignore file the build would refuse).
+ */
+export declare function listContext(dir: string, opts?: ContextOptions): ContextListing;
+/**
+ * Pack a directory into the string `dockerfile.context` takes. What is sent is decided here (see
+ * the module notes): files the `.dockerignore` excludes, and `.git`, are never uploaded; files
+ * that look like credentials are refused unless `allowSecrets`; a context over `maxBytes` after
+ * `.dockerignore` is refused. The same tree packs to the same snapshot whichever SDK packs it.
+ */
+export declare function packContext(dir: string, opts?: ContextOptions): string;
+/** The Dockerfile's path as the context sees it, for `dockerfile.path`. */
+export declare function contextRelative(contextDir: string, dockerfilePath: string): string;