@qpqjs/cli 0.0.0-stage → 0.2.0

package/lib/commonjs/platforms/aws/teardown.js

@@ -0,0 +1,59 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.awsTeardown = void 0;
+// AWS sequential teardown (`qpq teardown`) — the stack phases of `qpq go` in
+// reverse. Per phase it destroys every selected service's web, then api, then
+// inf CDK stacks. Phases don't cross-reference each other's CFN outputs
+// (values flow through SSM), so this order is prudence, not a hard dependency.
+// Bootstrap, domain and account stacks are deliberately out of scope — they
+// outlive any one service and are torn down by hand if ever.
+const deploy_aws_1 = require("@qpqjs/deploy-aws");
+const synth_1 = require("../../commands/synth");
+const qpqConfigs_1 = require("../../lib/qpqConfigs");
+const timing_1 = require("../../lib/timing");
+const awsCredentials_1 = require("./awsCredentials");
+const stacks_1 = require("./stacks");
+const teardownPhases = [
+    { label: 'Web', getStackName: deploy_aws_1.qpqDeployAwsUtils.getWebStackName },
+    { label: 'Api', getStackName: deploy_aws_1.qpqDeployAwsUtils.getApiStackName },
+    { label: 'Inf', getStackName: deploy_aws_1.qpqDeployAwsUtils.getInfStackName },
+];
+const awsTeardown = (appName, plan) => __awaiter(void 0, void 0, void 0, function* () {
+    if (plan.kind === 'cancelled') {
+        return;
+    }
+    const { services } = plan;
+    console.log('\n\nRunning automated teardown\n\n');
+    console.log('Executing for services');
+    console.log(services.join(', '));
+    if ((yield (0, awsCredentials_1.isAwsCredentialsValid)()) === false) {
+        console.log('Credentials are expired or invalid.');
+        return;
+    }
+    (0, timing_1.logTimeStart)('totalTime');
+    // The stack-name utils and the cdk app both read the synthed QPQ configs.
+    yield services.reduce((cur, service) => __awaiter(void 0, void 0, void 0, function* () {
+        yield cur;
+        yield (0, synth_1.synthCommand)([service, '--app', appName]);
+    }), Promise.resolve());
+    for (const { label, getStackName } of teardownPhases) {
+        yield services.reduce((cur, service) => __awaiter(void 0, void 0, void 0, function* () {
+            yield cur;
+            const qpqConfigForService = (0, qpqConfigs_1.loadServiceQpqConfig)(appName, service);
+            console.log(`Destroy ${label}: `, service);
+            yield (0, stacks_1.destroyServiceStack)(service, getStackName(qpqConfigForService), appName);
+        }), Promise.resolve());
+    }
+    (0, timing_1.logTimeEnd)('totalTime');
+});
+exports.awsTeardown = awsTeardown;
+//# sourceMappingURL=teardown.js.map

package/lib/commonjs/platforms/aws/teardown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"teardown.js","sourceRoot":"","sources":["../../../../src/platforms/aws/teardown.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6EAA6E;AAC7E,8EAA8E;AAC9E,wEAAwE;AACxE,+EAA+E;AAC/E,4EAA4E;AAC5E,6DAA6D;AAC7D,kDAAsD;AAEtD,gDAAoD;AAEpD,qDAA4D;AAC5D,6CAA4D;AAC5D,qDAAyD;AACzD,qCAA+C;AAE/C,MAAM,cAAc,GAAG;IACrB,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,8BAAiB,CAAC,eAAe,EAAE;IACjE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,8BAAiB,CAAC,eAAe,EAAE;IACjE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,8BAAiB,CAAC,eAAe,EAAE;CAClE,CAAC;AAEK,MAAM,WAAW,GAAG,CAAO,OAAe,EAAE,IAAkB,EAAiB,EAAE;IACtF,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC9B,OAAO;IACT,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAE1B,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEjC,IAAI,CAAC,MAAM,IAAA,sCAAqB,GAAE,CAAC,KAAK,KAAK,EAAE,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACnD,OAAO;IACT,CAAC;IAED,IAAA,qBAAY,EAAC,WAAW,CAAC,CAAC;IAE1B,0EAA0E;IAC1E,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAO,GAAG,EAAE,OAAO,EAAE,EAAE;QAC3C,MAAM,GAAG,CAAC;QACV,MAAM,IAAA,oBAAY,EAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC,CAAA,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAEtB,KAAK,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,cAAc,EAAE,CAAC;QACrD,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAO,GAAG,EAAE,OAAO,EAAE,EAAE;YAC3C,MAAM,GAAG,CAAC;YACV,MAAM,mBAAmB,GAAG,IAAA,iCAAoB,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACnE,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3C,MAAM,IAAA,4BAAmB,EAAC,OAAO,EAAE,YAAY,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,CAAC;QACjF,CAAC,CAAA,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACxB,CAAC;IAED,IAAA,mBAAU,EAAC,WAAW,CAAC,CAAC;AAC1B,CAAC,CAAA,CAAC;AAlCW,QAAA,WAAW,eAkCtB","sourcesContent":["// AWS sequential teardown (`qpq teardown`) — the stack phases of `qpq go` in\n// reverse. Per phase it destroys every selected service's web, then api, then\n// inf CDK stacks. Phases don't cross-reference each other's CFN outputs\n// (values flow through SSM), so this order is prudence, not a hard dependency.\n// Bootstrap, domain and account stacks are deliberately out of scope — they\n// outlive any one service and are torn down by hand if ever.\nimport { qpqDeployAwsUtils } from '@qpqjs/deploy-aws';\n\nimport { synthCommand } from '../../commands/synth';\nimport { TeardownPlan } from '../../lib/deployPrompts';\nimport { loadServiceQpqConfig } from '../../lib/qpqConfigs';\nimport { logTimeEnd, logTimeStart } from '../../lib/timing';\nimport { isAwsCredentialsValid } from './awsCredentials';\nimport { destroyServiceStack } from './stacks';\n\nconst teardownPhases = [\n  { label: 'Web', getStackName: qpqDeployAwsUtils.getWebStackName },\n  { label: 'Api', getStackName: qpqDeployAwsUtils.getApiStackName },\n  { label: 'Inf', getStackName: qpqDeployAwsUtils.getInfStackName },\n];\n\nexport const awsTeardown = async (appName: string, plan: TeardownPlan): Promise<void> => {\n  if (plan.kind === 'cancelled') {\n    return;\n  }\n\n  const { services } = plan;\n\n  console.log('\\n\\nRunning automated teardown\\n\\n');\n  console.log('Executing for services');\n  console.log(services.join(', '));\n\n  if ((await isAwsCredentialsValid()) === false) {\n    console.log('Credentials are expired or invalid.');\n    return;\n  }\n\n  logTimeStart('totalTime');\n\n  // The stack-name utils and the cdk app both read the synthed QPQ configs.\n  await services.reduce(async (cur, service) => {\n    await cur;\n    await synthCommand([service, '--app', appName]);\n  }, Promise.resolve());\n\n  for (const { label, getStackName } of teardownPhases) {\n    await services.reduce(async (cur, service) => {\n      await cur;\n      const qpqConfigForService = loadServiceQpqConfig(appName, service);\n      console.log(`Destroy ${label}: `, service);\n      await destroyServiceStack(service, getStackName(qpqConfigForService), appName);\n    }, Promise.resolve());\n  }\n\n  logTimeEnd('totalTime');\n};\n"]}

package/lib/commonjs/platforms/aws/viewsSync.d.ts

@@ -0,0 +1,3 @@
+export declare const NO_CACHE_FILES: string[];
+export declare const getViewsS3Destinations: (appName: string, serviceName: string) => string[];
+export declare const syncViewsToS3: (appName: string, serviceName: string) => Promise<void>;

package/lib/commonjs/platforms/aws/viewsSync.js

@@ -0,0 +1,77 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.syncViewsToS3 = exports.getViewsS3Destinations = exports.NO_CACHE_FILES = void 0;
+// Views upload to S3. Every service's views go to its prefix in the shared
+// 'views' bucket (owned by shell). A service can also be a standalone host on
+// its own domain: each of its web entries marked `storageDrive.syncServiceViews`
+// gets the bundle at its drive's root. shell is the root website, which predates
+// that flag, so it keeps its 'website' bucket root when it declares none.
+const actionprocessor_aws_1 = require("@qpqjs/actionprocessor-aws");
+const webserver_1 = require("@qpqjs/webserver");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const qpqConfigs_1 = require("../../lib/qpqConfigs");
+const runCommand_1 = require("../../lib/runCommand");
+const views_1 = require("../../lib/views");
+// The mutable entry points: fixed names whose CONTENT changes every deploy. They
+// must never be cached without revalidation — a browser holding a stale
+// mf-manifest.json or remoteEntry.js keeps running the previous deploy's bundle
+// (the module-reload hot-swap and plain page refreshes both depend on these being
+// fresh). Everything else in a views dist is content-hashed and safely immutable.
+exports.NO_CACHE_FILES = ['mf-manifest.json', 'remoteEntry.js', 'index.html', 'favicon.ico'];
+const getViewsS3Destinations = (appName, serviceName) => {
+    const shellConfig = (0, qpqConfigs_1.loadServiceQpqConfig)(appName, 'shell');
+    const viewsBucketName = actionprocessor_aws_1.awsNamingUtils.getConfigRuntimeResourceNameFromConfig('views', shellConfig);
+    const destinations = [`s3://${viewsBucketName}/${serviceName}`];
+    const serviceConfig = serviceName === 'shell' ? shellConfig : (0, qpqConfigs_1.loadServiceQpqConfig)(appName, serviceName);
+    const hostDrives = webserver_1.qpqWebServerUtils
+        .getWebEntryConfigs(serviceConfig)
+        .filter((webEntry) => webEntry.storageDrive.syncServiceViews && webEntry.storageDrive.sourceStorageDrive)
+        .map((webEntry) => webEntry.storageDrive.sourceStorageDrive);
+    if (serviceName === 'shell' && hostDrives.length === 0) {
+        hostDrives.push('website');
+    }
+    for (const drive of hostDrives) {
+        destinations.push(`s3://${actionprocessor_aws_1.awsNamingUtils.getConfigRuntimeResourceNameFromConfig(drive, serviceConfig)}`);
+    }
+    return destinations;
+};
+exports.getViewsS3Destinations = getViewsS3Destinations;
+const syncViewsToS3 = (appName, serviceName) => __awaiter(void 0, void 0, void 0, function* () {
+    const distDir = (0, views_1.getViewsDistDir)(appName, serviceName);
+    for (const destination of (0, exports.getViewsS3Destinations)(appName, serviceName)) {
+        console.log(`Copying [${serviceName}] views to [${destination}]`);
+        // Content-hashed assets: cache forever.
+        yield (0, runCommand_1.runCommand)('aws', [
+            's3',
+            'sync',
+            distDir,
+            destination,
+            '--cache-control',
+            'public,max-age=31536000,immutable',
+            ...exports.NO_CACHE_FILES.flatMap((file) => ['--exclude', file]),
+        ]);
+        // Entry points: cp (not sync) so the no-cache header is (re)applied on every
+        // deploy even when a body happens to be byte-identical.
+        for (const file of exports.NO_CACHE_FILES) {
+            if (!fs_1.default.existsSync(path_1.default.join(distDir, file))) {
+                continue;
+            }
+            yield (0, runCommand_1.runCommand)('aws', ['s3', 'cp', path_1.default.join(distDir, file), `${destination}/${file}`, '--cache-control', 'no-cache']);
+        }
+    }
+});
+exports.syncViewsToS3 = syncViewsToS3;
+//# sourceMappingURL=viewsSync.js.map

package/lib/commonjs/platforms/aws/viewsSync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"viewsSync.js","sourceRoot":"","sources":["../../../../src/platforms/aws/viewsSync.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2EAA2E;AAC3E,8EAA8E;AAC9E,iFAAiF;AACjF,iFAAiF;AACjF,0EAA0E;AAC1E,oEAA4D;AAC5D,gDAAqD;AAErD,4CAAoB;AACpB,gDAAwB;AAExB,qDAA4D;AAC5D,qDAAkD;AAClD,2CAAkD;AAElD,iFAAiF;AACjF,wEAAwE;AACxE,gFAAgF;AAChF,kFAAkF;AAClF,kFAAkF;AACrE,QAAA,cAAc,GAAG,CAAC,kBAAkB,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;AAE3F,MAAM,sBAAsB,GAAG,CAAC,OAAe,EAAE,WAAmB,EAAY,EAAE;IACvF,MAAM,WAAW,GAAG,IAAA,iCAAoB,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,eAAe,GAAG,oCAAc,CAAC,sCAAsC,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAEpG,MAAM,YAAY,GAAG,CAAC,QAAQ,eAAe,IAAI,WAAW,EAAE,CAAC,CAAC;IAEhE,MAAM,aAAa,GAAG,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAA,iCAAoB,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACzG,MAAM,UAAU,GAAG,6BAAiB;SACjC,kBAAkB,CAAC,aAAa,CAAC;SACjC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,gBAAgB,IAAI,QAAQ,CAAC,YAAY,CAAC,kBAAkB,CAAC;SACxG,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,kBAAmB,CAAC,CAAC;IAEhE,IAAI,WAAW,KAAK,OAAO,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,YAAY,CAAC,IAAI,CAAC,QAAQ,oCAAc,CAAC,sCAAsC,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC;IAC3G,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC,CAAC;AArBW,QAAA,sBAAsB,0BAqBjC;AAEK,MAAM,aAAa,GAAG,CAAO,OAAe,EAAE,WAAmB,EAAiB,EAAE;IACzF,MAAM,OAAO,GAAG,IAAA,uBAAe,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAEtD,KAAK,MAAM,WAAW,IAAI,IAAA,8BAAsB,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;QACvE,OAAO,CAAC,GAAG,CAAC,YAAY,WAAW,eAAe,WAAW,GAAG,CAAC,CAAC;QAElE,wCAAwC;QACxC,MAAM,IAAA,uBAAU,EAAC,KAAK,EAAE;YACtB,IAAI;YACJ,MAAM;YACN,OAAO;YACP,WAAW;YACX,iBAAiB;YACjB,mCAAmC;YACnC,GAAG,sBAAc,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;SACzD,CAAC,CAAC;QAEH,6EAA6E;QAC7E,wDAAwD;QACxD,KAAK,MAAM,IAAI,IAAI,sBAAc,EAAE,CAAC;YAClC,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,cAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC7C,SAAS;YACX,CAAC;YAED,MAAM,IAAA,uBAAU,EAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,cAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,GAAG,WAAW,IAAI,IAAI,EAAE,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC;QAC3H,CAAC;IACH,CAAC;AACH,CAAC,CAAA,CAAC;AA3BW,QAAA,aAAa,iBA2BxB","sourcesContent":["// Views upload to S3. Every service's views go to its prefix in the shared\n// 'views' bucket (owned by shell). A service can also be a standalone host on\n// its own domain: each of its web entries marked `storageDrive.syncServiceViews`\n// gets the bundle at its drive's root. shell is the root website, which predates\n// that flag, so it keeps its 'website' bucket root when it declares none.\nimport { awsNamingUtils } from '@qpqjs/actionprocessor-aws';\nimport { qpqWebServerUtils } from '@qpqjs/webserver';\n\nimport fs from 'fs';\nimport path from 'path';\n\nimport { loadServiceQpqConfig } from '../../lib/qpqConfigs';\nimport { runCommand } from '../../lib/runCommand';\nimport { getViewsDistDir } from '../../lib/views';\n\n// The mutable entry points: fixed names whose CONTENT changes every deploy. They\n// must never be cached without revalidation — a browser holding a stale\n// mf-manifest.json or remoteEntry.js keeps running the previous deploy's bundle\n// (the module-reload hot-swap and plain page refreshes both depend on these being\n// fresh). Everything else in a views dist is content-hashed and safely immutable.\nexport const NO_CACHE_FILES = ['mf-manifest.json', 'remoteEntry.js', 'index.html', 'favicon.ico'];\n\nexport const getViewsS3Destinations = (appName: string, serviceName: string): string[] => {\n  const shellConfig = loadServiceQpqConfig(appName, 'shell');\n  const viewsBucketName = awsNamingUtils.getConfigRuntimeResourceNameFromConfig('views', shellConfig);\n\n  const destinations = [`s3://${viewsBucketName}/${serviceName}`];\n\n  const serviceConfig = serviceName === 'shell' ? shellConfig : loadServiceQpqConfig(appName, serviceName);\n  const hostDrives = qpqWebServerUtils\n    .getWebEntryConfigs(serviceConfig)\n    .filter((webEntry) => webEntry.storageDrive.syncServiceViews && webEntry.storageDrive.sourceStorageDrive)\n    .map((webEntry) => webEntry.storageDrive.sourceStorageDrive!);\n\n  if (serviceName === 'shell' && hostDrives.length === 0) {\n    hostDrives.push('website');\n  }\n\n  for (const drive of hostDrives) {\n    destinations.push(`s3://${awsNamingUtils.getConfigRuntimeResourceNameFromConfig(drive, serviceConfig)}`);\n  }\n\n  return destinations;\n};\n\nexport const syncViewsToS3 = async (appName: string, serviceName: string): Promise<void> => {\n  const distDir = getViewsDistDir(appName, serviceName);\n\n  for (const destination of getViewsS3Destinations(appName, serviceName)) {\n    console.log(`Copying [${serviceName}] views to [${destination}]`);\n\n    // Content-hashed assets: cache forever.\n    await runCommand('aws', [\n      's3',\n      'sync',\n      distDir,\n      destination,\n      '--cache-control',\n      'public,max-age=31536000,immutable',\n      ...NO_CACHE_FILES.flatMap((file) => ['--exclude', file]),\n    ]);\n\n    // Entry points: cp (not sync) so the no-cache header is (re)applied on every\n    // deploy even when a body happens to be byte-identical.\n    for (const file of NO_CACHE_FILES) {\n      if (!fs.existsSync(path.join(distDir, file))) {\n        continue;\n      }\n\n      await runCommand('aws', ['s3', 'cp', path.join(distDir, file), `${destination}/${file}`, '--cache-control', 'no-cache']);\n    }\n  }\n};\n"]}

package/lib/commonjs/platforms/docker/QpqDockerPlatformSettings.d.ts

@@ -0,0 +1,10 @@
+/** The docker entry's `platformSettings`: how the image is named, built and mapped onto a host. */
+export type QpqDockerPlatformSettings = {
+    portMappings?: string;
+    registry?: string;
+    arch?: string;
+    tag?: string;
+    publicHost?: string;
+    dataPath?: string;
+    mounts?: string;
+};

package/lib/commonjs/platforms/docker/QpqDockerPlatformSettings.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=QpqDockerPlatformSettings.js.map

package/lib/commonjs/platforms/docker/QpqDockerPlatformSettings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"QpqDockerPlatformSettings.js","sourceRoot":"","sources":["../../../../src/platforms/docker/QpqDockerPlatformSettings.ts"],"names":[],"mappings":"","sourcesContent":["/** The docker entry's `platformSettings`: how the image is named, built and mapped onto a host. */\nexport type QpqDockerPlatformSettings = {\n  // Comma-separated docker `host:container` pairs, e.g. \"80:8080, 8888:8888, 3090:3090\". Container\n  // ports are 8080 (api + site), 8888 (websockets), 3001 (file storage), plus the port of every\n  // web entry listed in a service's defineDevServerOptions. Default: 80 to the site and every\n  // container port to itself. The host side is baked into the frontend, so a host must map the\n  // same ports.\n  portMappings?: string;\n\n  // Registry to push the image to, e.g. \"192.168.8.88:5000\" or \"ghcr.io/me\". Without it the image\n  // only lands in the local docker store.\n  registry?: string;\n\n  // Target platform for the image, e.g. \"linux/amd64\" for an x86 host built from an arm Mac.\n  // Default: the building machine's own.\n  arch?: string;\n\n  // Image tag. Default: the deployment's environment.\n  tag?: string;\n\n  // The address browsers reach the host on, e.g. \"192.168.8.88\" or \"unraid.local\". Secure file\n  // upload/download urls are absolute and point here. Default: localhost.\n  publicHost?: string;\n\n  // Host directory for the app's state (key-value stores, file storage), e.g.\n  // \"/mnt/user/appdata/qpq-myapp\". Default: a docker named volume.\n  dataPath?: string;\n\n  // Comma-separated host folders to mount into the container, as docker `host:container` pairs\n  // with both absolute, optionally ending \":ro\" for read-only, e.g.\n  // \"/mnt/user/media/downloads:/mnt/user/media/downloads, /mnt/user/tv:/tv:ro\". For apps that\n  // read or write files on the host outside their own state. Default: none.\n  mounts?: string;\n};\n"]}

package/lib/commonjs/platforms/docker/getContainerPorts.d.ts

@@ -0,0 +1,4 @@
+import { WebEntryHost } from '@qpqjs/dev-server';
+import { ResolvedDevServerPorts } from '../../lib/devServerPorts';
+/** Every port the image listens on: the app's dev-server ports plus one per hosted web entry. */
+export declare const getContainerPorts: (devServerPorts: ResolvedDevServerPorts, hosts: WebEntryHost[]) => number[];

package/lib/commonjs/platforms/docker/getContainerPorts.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getContainerPorts = void 0;
+/** Every port the image listens on: the app's dev-server ports plus one per hosted web entry. */
+const getContainerPorts = (devServerPorts, hosts) => [
+    devServerPorts.api,
+    devServerPorts.webSocket,
+    devServerPorts.fileStorage,
+    ...hosts.map((host) => host.port),
+];
+exports.getContainerPorts = getContainerPorts;
+//# sourceMappingURL=getContainerPorts.js.map

package/lib/commonjs/platforms/docker/getContainerPorts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getContainerPorts.js","sourceRoot":"","sources":["../../../../src/platforms/docker/getContainerPorts.ts"],"names":[],"mappings":";;;AAIA,iGAAiG;AAC1F,MAAM,iBAAiB,GAAG,CAAC,cAAsC,EAAE,KAAqB,EAAY,EAAE,CAAC;IAC5G,cAAc,CAAC,GAAG;IAClB,cAAc,CAAC,SAAS;IACxB,cAAc,CAAC,WAAW;IAC1B,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;CAClC,CAAC;AALW,QAAA,iBAAiB,qBAK5B","sourcesContent":["import { WebEntryHost } from '@qpqjs/dev-server';\n\nimport { ResolvedDevServerPorts } from '../../lib/devServerPorts';\n\n/** Every port the image listens on: the app's dev-server ports plus one per hosted web entry. */\nexport const getContainerPorts = (devServerPorts: ResolvedDevServerPorts, hosts: WebEntryHost[]): number[] => [\n  devServerPorts.api,\n  devServerPorts.webSocket,\n  devServerPorts.fileStorage,\n  ...hosts.map((host) => host.port),\n];\n"]}

package/lib/commonjs/platforms/docker/getDefaultPortMappings.d.ts

@@ -0,0 +1,3 @@
+import { PortMapping } from './parsePortMappings';
+/** Each container port on the same host port, plus 80 for the site, when the deployment sets no `portMappings`. */
+export declare const getDefaultPortMappings: (apiPort: number, containerPorts: number[]) => PortMapping[];

package/lib/commonjs/platforms/docker/getDefaultPortMappings.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getDefaultPortMappings = void 0;
+/** Each container port on the same host port, plus 80 for the site, when the deployment sets no `portMappings`. */
+const getDefaultPortMappings = (apiPort, containerPorts) => [
+    { host: 80, container: apiPort },
+    ...containerPorts.map((port) => ({ host: port, container: port })),
+];
+exports.getDefaultPortMappings = getDefaultPortMappings;
+//# sourceMappingURL=getDefaultPortMappings.js.map

package/lib/commonjs/platforms/docker/getDefaultPortMappings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getDefaultPortMappings.js","sourceRoot":"","sources":["../../../../src/platforms/docker/getDefaultPortMappings.ts"],"names":[],"mappings":";;;AAEA,mHAAmH;AAC5G,MAAM,sBAAsB,GAAG,CAAC,OAAe,EAAE,cAAwB,EAAiB,EAAE,CAAC;IAClG,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE;IAChC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;CACnE,CAAC;AAHW,QAAA,sBAAsB,0BAGjC","sourcesContent":["import { PortMapping } from './parsePortMappings';\n\n/** Each container port on the same host port, plus 80 for the site, when the deployment sets no `portMappings`. */\nexport const getDefaultPortMappings = (apiPort: number, containerPorts: number[]): PortMapping[] => [\n  { host: 80, container: apiPort },\n  ...containerPorts.map((port) => ({ host: port, container: port })),\n];\n"]}

package/lib/commonjs/platforms/docker/getDockerPlatformSettings.d.ts

@@ -0,0 +1,14 @@
+import { QpqAppDeployment } from '@qpqjs/core';
+import { Mount } from './parseMounts';
+import { PortMapping } from './parsePortMappings';
+export type ParsedDockerPlatformSettings = {
+    portMappings?: PortMapping[];
+    registry?: string;
+    arch?: string;
+    tag: string;
+    publicHost?: string;
+    dataPath?: string;
+    mounts?: Mount[];
+};
+/** The docker entry's platform settings, parsed; throws for a malformed value, naming the deployment. */
+export declare const getDockerPlatformSettings: (deploymentName: string, deployment: QpqAppDeployment) => ParsedDockerPlatformSettings;

package/lib/commonjs/platforms/docker/getDockerPlatformSettings.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getDockerPlatformSettings = void 0;
+const parseMounts_1 = require("./parseMounts");
+const parsePortMappings_1 = require("./parsePortMappings");
+const asOptionalString = (deploymentName, name, value) => {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (typeof value !== 'string' || value.trim() === '') {
+        throw new Error(`Invalid docker deployment '${deploymentName}': platformSettings.${name} must be a non-empty string`);
+    }
+    return value.trim().replace(/\/+$/, '');
+};
+/** The docker entry's platform settings, parsed; throws for a malformed value, naming the deployment. */
+const getDockerPlatformSettings = (deploymentName, deployment) => {
+    var _a, _b;
+    const settings = (_a = deployment.platformSettings) !== null && _a !== void 0 ? _a : {};
+    let portMappings;
+    let mounts;
+    try {
+        portMappings = settings.portMappings === undefined ? undefined : (0, parsePortMappings_1.parsePortMappings)(settings.portMappings);
+        mounts = settings.mounts === undefined ? undefined : (0, parseMounts_1.parseMounts)(settings.mounts);
+    }
+    catch (error) {
+        throw new Error(`Invalid docker deployment '${deploymentName}': ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return {
+        portMappings,
+        registry: asOptionalString(deploymentName, 'registry', settings.registry),
+        arch: asOptionalString(deploymentName, 'arch', settings.arch),
+        tag: (_b = asOptionalString(deploymentName, 'tag', settings.tag)) !== null && _b !== void 0 ? _b : deployment.environment,
+        publicHost: asOptionalString(deploymentName, 'publicHost', settings.publicHost),
+        dataPath: asOptionalString(deploymentName, 'dataPath', settings.dataPath),
+        mounts,
+    };
+};
+exports.getDockerPlatformSettings = getDockerPlatformSettings;
+//# sourceMappingURL=getDockerPlatformSettings.js.map

package/lib/commonjs/platforms/docker/getDockerPlatformSettings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getDockerPlatformSettings.js","sourceRoot":"","sources":["../../../../src/platforms/docker/getDockerPlatformSettings.ts"],"names":[],"mappings":";;;AAEA,+CAAmD;AACnD,2DAAqE;AAcrE,MAAM,gBAAgB,GAAG,CAAC,cAAsB,EAAE,IAAY,EAAE,KAAc,EAAsB,EAAE;IACpG,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,8BAA8B,cAAc,uBAAuB,IAAI,6BAA6B,CAAC,CAAC;IACxH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC,CAAC;AAEF,yGAAyG;AAClG,MAAM,yBAAyB,GAAG,CAAC,cAAsB,EAAE,UAA4B,EAAgC,EAAE;;IAC9H,MAAM,QAAQ,GAAG,MAAA,UAAU,CAAC,gBAAgB,mCAAI,EAAE,CAAC;IAEnD,IAAI,YAAuC,CAAC;IAC5C,IAAI,MAA2B,CAAC;IAChC,IAAI,CAAC;QACH,YAAY,GAAG,QAAQ,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAA,qCAAiB,EAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC1G,MAAM,GAAG,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAA,yBAAW,EAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,8BAA8B,cAAc,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9H,CAAC;IAED,OAAO;QACL,YAAY;QACZ,QAAQ,EAAE,gBAAgB,CAAC,cAAc,EAAE,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC;QACzE,IAAI,EAAE,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC;QAC7D,GAAG,EAAE,MAAA,gBAAgB,CAAC,cAAc,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,mCAAI,UAAU,CAAC,WAAW;QACpF,UAAU,EAAE,gBAAgB,CAAC,cAAc,EAAE,YAAY,EAAE,QAAQ,CAAC,UAAU,CAAC;QAC/E,QAAQ,EAAE,gBAAgB,CAAC,cAAc,EAAE,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC;QACzE,MAAM;KACP,CAAC;AACJ,CAAC,CAAC;AArBW,QAAA,yBAAyB,6BAqBpC","sourcesContent":["import { QpqAppDeployment } from '@qpqjs/core';\n\nimport { Mount, parseMounts } from './parseMounts';\nimport { parsePortMappings, PortMapping } from './parsePortMappings';\n\nexport type ParsedDockerPlatformSettings = {\n  // Absent when the deployment sets no `portMappings`; the defaults depend on the app's config.\n  portMappings?: PortMapping[];\n  registry?: string;\n  arch?: string;\n  tag: string;\n  publicHost?: string;\n  dataPath?: string;\n  // Absent when the deployment mounts nothing beyond its state directory.\n  mounts?: Mount[];\n};\n\nconst asOptionalString = (deploymentName: string, name: string, value: unknown): string | undefined => {\n  if (value === undefined) {\n    return undefined;\n  }\n  if (typeof value !== 'string' || value.trim() === '') {\n    throw new Error(`Invalid docker deployment '${deploymentName}': platformSettings.${name} must be a non-empty string`);\n  }\n  return value.trim().replace(/\\/+$/, '');\n};\n\n/** The docker entry's platform settings, parsed; throws for a malformed value, naming the deployment. */\nexport const getDockerPlatformSettings = (deploymentName: string, deployment: QpqAppDeployment): ParsedDockerPlatformSettings => {\n  const settings = deployment.platformSettings ?? {};\n\n  let portMappings: PortMapping[] | undefined;\n  let mounts: Mount[] | undefined;\n  try {\n    portMappings = settings.portMappings === undefined ? undefined : parsePortMappings(settings.portMappings);\n    mounts = settings.mounts === undefined ? undefined : parseMounts(settings.mounts);\n  } catch (error) {\n    throw new Error(`Invalid docker deployment '${deploymentName}': ${error instanceof Error ? error.message : String(error)}`);\n  }\n\n  return {\n    portMappings,\n    registry: asOptionalString(deploymentName, 'registry', settings.registry),\n    arch: asOptionalString(deploymentName, 'arch', settings.arch),\n    tag: asOptionalString(deploymentName, 'tag', settings.tag) ?? deployment.environment,\n    publicHost: asOptionalString(deploymentName, 'publicHost', settings.publicHost),\n    dataPath: asOptionalString(deploymentName, 'dataPath', settings.dataPath),\n    mounts,\n  };\n};\n"]}

package/lib/commonjs/platforms/docker/getImageName.d.ts

@@ -0,0 +1,6 @@
+import { ParsedDockerPlatformSettings } from './getDockerPlatformSettings';
+/**
+ * `[<registry>/]qpq-<application>:<tag>`. Named by the deployment's application, not the app
+ * folder, so two products built from one codebase get separate images and data volumes.
+ */
+export declare const getImageName: (applicationName: string, settings: ParsedDockerPlatformSettings) => string;

package/lib/commonjs/platforms/docker/getImageName.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getImageName = void 0;
+/**
+ * `[<registry>/]qpq-<application>:<tag>`. Named by the deployment's application, not the app
+ * folder, so two products built from one codebase get separate images and data volumes.
+ */
+const getImageName = (applicationName, settings) => `${settings.registry ? `${settings.registry}/` : ''}qpq-${applicationName}:${settings.tag}`;
+exports.getImageName = getImageName;
+//# sourceMappingURL=getImageName.js.map

package/lib/commonjs/platforms/docker/getImageName.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getImageName.js","sourceRoot":"","sources":["../../../../src/platforms/docker/getImageName.ts"],"names":[],"mappings":";;;AAEA;;;GAGG;AACI,MAAM,YAAY,GAAG,CAAC,eAAuB,EAAE,QAAsC,EAAU,EAAE,CACtG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,eAAe,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;AADjF,QAAA,YAAY,gBACqE","sourcesContent":["import { ParsedDockerPlatformSettings } from './getDockerPlatformSettings';\n\n/**\n * `[<registry>/]qpq-<application>:<tag>`. Named by the deployment's application, not the app\n * folder, so two products built from one codebase get separate images and data volumes.\n */\nexport const getImageName = (applicationName: string, settings: ParsedDockerPlatformSettings): string =>\n  `${settings.registry ? `${settings.registry}/` : ''}qpq-${applicationName}:${settings.tag}`;\n"]}

package/lib/commonjs/platforms/docker/go.d.ts

@@ -0,0 +1,2 @@
+import { DeployPlan } from '../../lib/deployPrompts';
+export declare const dockerGo: (appName: string, plan: DeployPlan) => Promise<void>;

package/lib/commonjs/platforms/docker/go.js

@@ -0,0 +1,261 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dockerGo = void 0;
+// Docker platform deploy (`qpq go` with platform 'docker') — proof-of-concept
+// self-hosting: bakes the QPQ dev server (a full local platform emulation)
+// plus every service of the app and its pre-built views into one docker image.
+//
+//   1. Build workspace packages, then the dev-server bundle (all services).
+//   2. Build every views microfrontend with a same-origin module-federation
+//      remote base (/<views subdomain>/<svc>), mirroring the AWS layout.
+//   3. Assemble an image context under dist/qpq/docker-image/<app>/ — server
+//      bundle, web root (every web entry, placed by its port or its domain),
+//      a workspaces-stripped package.json for runtime deps, and the
+//      locally-built quidproquo packages as a vendor overlay.
+//   4. docker build (buildx with a push when the deployment names a registry or
+//      a target platform), write a docker-compose.yml, print how to run it.
+//
+// Not production-grade (single process, sqlite KVS, in-memory queues) —
+// it's the whole product on one box with one command.
+const config_aws_1 = require("@qpqjs/config-aws");
+const core_1 = require("@qpqjs/core");
+const deploy_rspack_1 = require("@qpqjs/deploy-rspack");
+const dev_server_1 = require("@qpqjs/dev-server");
+const webserver_1 = require("@qpqjs/webserver");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const devServerEntry_1 = require("../../lib/devServerEntry");
+const devServerPorts_1 = require("../../lib/devServerPorts");
+const discovery_1 = require("../../lib/discovery");
+const getDefaultHookJobs_1 = require("../../lib/getDefaultHookJobs");
+const hooks_1 = require("../../lib/hooks");
+const packageRoot_1 = require("../../lib/packageRoot");
+const runCommand_1 = require("../../lib/runCommand");
+const runTasks_1 = require("../../lib/runTasks");
+const timing_1 = require("../../lib/timing");
+const views_1 = require("../../lib/views");
+const webAddressingEnv_1 = require("../../lib/webAddressingEnv");
+const getContainerPorts_1 = require("./getContainerPorts");
+const getDockerPlatformSettings_1 = require("./getDockerPlatformSettings");
+const getImageName_1 = require("./getImageName");
+const resolvePortMappings_1 = require("./resolvePortMappings");
+const writeComposeFile_1 = require("./writeComposeFile");
+const getImageContextDir = (root, appName) => path_1.default.join(root, 'dist', 'qpq', 'docker-image', appName);
+// Every web entry's files go where the runtime looks for them. The federated views entry
+// is assembled from every service's views build (one folder per service, as on AWS);
+// anything else is its own buildPath. A missing build fails here rather than serving an
+// empty site later.
+const copyWebEntryContent = (appName, contextDir, entry, viewServices) => {
+    const label = `${entry.service}/${entry.entryName}`;
+    const targetDir = (0, dev_server_1.getWebEntryDir)(path_1.default.join(contextDir, 'web'), entry);
+    if (entry.webEntry.domain.subDomainName === webserver_1.FEDERATED_VIEWS_SUBDOMAIN) {
+        for (const serviceName of viewServices) {
+            fs_1.default.cpSync((0, views_1.getViewsDistDir)(appName, serviceName), path_1.default.join(targetDir, serviceName), { recursive: true });
+        }
+        return;
+    }
+    // A standalone host entry serves its own service's views build, as on AWS.
+    if (entry.webEntry.storageDrive.syncServiceViews) {
+        fs_1.default.cpSync((0, views_1.getViewsDistDir)(appName, entry.service), targetDir, { recursive: true });
+        return;
+    }
+    if (!entry.webEntry.buildPath) {
+        throw new Error(`Web entry ${label} has no buildPath, so there is nothing to serve`);
+    }
+    const buildDir = path_1.default.resolve(entry.configRoot, entry.webEntry.buildPath);
+    if (!fs_1.default.existsSync(path_1.default.join(buildDir, entry.webEntry.indexRoot))) {
+        throw new Error(`Web entry ${label} has no ${entry.webEntry.indexRoot} under ${buildDir}; build it before qpq go`);
+    }
+    fs_1.default.cpSync(buildDir, targetDir, { recursive: true });
+};
+// Plain `docker build` into the local store unless the deployment asks for a registry or a
+// target platform, which need buildx: `--push` sends a cross-platform image straight to the
+// registry, `--load` keeps a same-machine one local.
+const buildImage = (imageName, contextDir, settings) => __awaiter(void 0, void 0, void 0, function* () {
+    if (!settings.registry && !settings.arch) {
+        yield (0, runCommand_1.runCommand)('docker', ['build', '-t', imageName, contextDir]);
+        return;
+    }
+    const platformArgs = settings.arch ? ['--platform', settings.arch] : [];
+    yield (0, runCommand_1.runCommand)('docker', ['buildx', 'build', ...platformArgs, '-t', imageName, settings.registry ? '--push' : '--load', contextDir]);
+});
+// The Dockerfile is shared; only its EXPOSE line depends on the app.
+const writeDockerfile = (contextDir, containerPorts) => {
+    const template = fs_1.default.readFileSync(path_1.default.join((0, packageRoot_1.getOwnPackageRoot)(), 'docker', 'dev-server', 'Dockerfile'), 'utf8');
+    const dockerfile = template.replace(/^EXPOSE .*$/m, `EXPOSE ${containerPorts.join(' ')}`);
+    fs_1.default.writeFileSync(path_1.default.join(contextDir, 'Dockerfile'), dockerfile);
+};
+// The consumer root package.json, stripped to what the image's npm install
+// needs: runtime dependencies (+ overrides). Workspaces/scripts/devDeps are
+// host-only concerns — the workspace packages themselves are bundled into the
+// server bundle from source.
+//
+// quidproquo deps declared as file: refs (a consumer living beside the qpq
+// monorepo) point outside the image context, where npm install would leave
+// dangling symlinks — rewrite them to the vendored copies inside the context.
+const writeImagePackageJson = (root, contextDir) => {
+    var _a, _b;
+    const rootPackageJson = JSON.parse(fs_1.default.readFileSync(path_1.default.join(root, 'package.json'), 'utf8'));
+    const dependencies = Object.assign({}, ((_a = rootPackageJson.dependencies) !== null && _a !== void 0 ? _a : {}));
+    for (const [name, version] of Object.entries(dependencies)) {
+        if ((0, core_1.isQpqPackageName)(name) && version.startsWith('file:')) {
+            dependencies[name] = `file:./vendor/${name}`;
+        }
+    }
+    const imagePackageJson = {
+        name: `${rootPackageJson.name}-qpq-docker`,
+        version: (_b = rootPackageJson.version) !== null && _b !== void 0 ? _b : '0.0.0',
+        private: true,
+        dependencies,
+        overrides: rootPackageJson.overrides,
+    };
+    fs_1.default.writeFileSync(path_1.default.join(contextDir, 'package.json'), JSON.stringify(imagePackageJson, null, 2) + '\n');
+};
+// Copy the locally-built quidproquo packages (which may be npm-linked
+// checkouts newer than the registry) into vendor/ so the image runs the same
+// qpq code the bundle was built against. Follows the node_modules symlinks;
+// lib/config only — no node_modules, no src.
+const vendorQuidproquoPackages = (root, contextDir) => {
+    const nodeModules = path_1.default.join(root, 'node_modules');
+    const vendorDir = path_1.default.join(contextDir, 'vendor');
+    let vendored = 0;
+    for (const name of (0, deploy_rspack_1.listInstalledQpqPackageNames)(nodeModules)) {
+        const packageDir = fs_1.default.realpathSync(path_1.default.join(nodeModules, name));
+        const targetDir = path_1.default.join(vendorDir, name);
+        fs_1.default.mkdirSync(targetDir, { recursive: true });
+        fs_1.default.copyFileSync(path_1.default.join(packageDir, 'package.json'), path_1.default.join(targetDir, 'package.json'));
+        for (const sub of ['lib', 'config']) {
+            const subDir = path_1.default.join(packageDir, sub);
+            if (fs_1.default.existsSync(subDir)) {
+                fs_1.default.cpSync(subDir, path_1.default.join(targetDir, sub), { recursive: true, dereference: true });
+            }
+        }
+        vendored += 1;
+    }
+    return vendored;
+};
+const dockerGo = (appName, plan) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a, _b, _c, _d, _e;
+    if (plan.kind === 'cancelled') {
+        return;
+    }
+    if (plan.kind === 'account' || plan.kind === 'bootstrap') {
+        console.log(`Nothing to do — the docker platform has no ${plan.kind} stacks.`);
+        return;
+    }
+    const root = (0, discovery_1.getRoot)();
+    const deploymentName = process.env[core_1.QpqDeployEnvVar.deployName];
+    const dockerSettings = (0, getDockerPlatformSettings_1.getDockerPlatformSettings)(deploymentName, (0, config_aws_1.getQpqAppDeployment)(root, appName, deploymentName));
+    const applicationName = process.env[core_1.QpqDeployEnvVar.applicationName];
+    const imageName = (0, getImageName_1.getImageName)(applicationName, dockerSettings);
+    const containerName = `qpq-${applicationName}`;
+    const volumeName = `${containerName}-data`;
+    // The dev server hosts every service of the app, so per-service/stack
+    // selections don't apply — the image is always the whole app.
+    console.log(`\n\nBuilding docker image [${imageName}] — the whole app deploys as one image\n\n`);
+    (0, timing_1.logTimeStart)('totalTime');
+    yield (0, hooks_1.runAppHook)(appName, 'predeploy');
+    // Workspace packages resolve through their built dist/ (package.json main),
+    // so bundles would ship stale code unless every lib is tsc'd first.
+    console.log('Building workspace packages');
+    (0, runTasks_1.assertNoFailures)('Workspace build', yield (0, hooks_1.runHookForAppPackages)('build', appName, (0, getDefaultHookJobs_1.getDefaultHookJobs)()));
+    // ---- Server bundle: the dev server + every service, one main.js ----
+    console.log('Bundling server (dev server + all services)');
+    const qpqConfigs = (0, deploy_rspack_1.getAppServiceQpqConfigs)(root, appName);
+    // Resolved before anything slow runs, so a bad port or domain fails the build up front.
+    const devServerPorts = (0, devServerPorts_1.readDevServerPorts)(appName);
+    const { hosts: webEntryHosts, routes: webEntryRoutes } = (0, dev_server_1.getWebEntryPlacements)(qpqConfigs, Object.values(devServerPorts));
+    const containerPorts = (0, getContainerPorts_1.getContainerPorts)(devServerPorts, webEntryHosts);
+    const portMappings = (0, resolvePortMappings_1.resolvePortMappings)(deploymentName, dockerSettings, devServerPorts.api, containerPorts);
+    const mapHostPort = (containerPort) => { var _a, _b; return (_b = (_a = portMappings.find((mapping) => mapping.container === containerPort)) === null || _a === void 0 ? void 0 : _a.host) !== null && _b !== void 0 ? _b : containerPort; };
+    // Nothing deploys into the container, so the image runs its own pending migrations on start.
+    const entry = (0, devServerEntry_1.writeDevServerEntry)(root, appName, 'migrate-then-serve');
+    const userScriptChildEntry = (0, devServerEntry_1.writeUserScriptChildEntry)(root);
+    // The image installs its own node_modules next to the bundle, so externals
+    // must stay bare; host-resolved absolute paths do not exist in the container.
+    yield (0, deploy_rspack_1.runRspack)((0, deploy_rspack_1.getDevServerRspackConfig)({ root, entry, userScriptChildEntry, qpqConfigs, portableExternals: true }));
+    // ---- Views: production builds with same-origin federation remotes ----
+    // The browser reaches everything on the page's own host, on the HOST side of the port
+    // mappings; an unmapped port stays as is (nothing outside the container can reach it anyway).
+    (0, webAddressingEnv_1.setWebAddressingEnv)(qpqConfigs, { api: devServerPorts.api, webSocket: devServerPorts.webSocket, mapHostPort });
+    process.env.QPQ_VIEWS_REMOTE_BASE = `/${webserver_1.FEDERATED_VIEWS_SUBDOMAIN}`;
+    const viewServices = (0, discovery_1.getServiceNamesWithViews)(appName);
+    for (const serviceName of viewServices) {
+        console.log(`Bundling views: [${serviceName}]`);
+        yield (0, views_1.bundleViews)(appName, serviceName);
+    }
+    delete process.env.QPQ_VIEWS_REMOTE_BASE;
+    (0, webAddressingEnv_1.clearWebAddressingEnv)();
+    // ---- Assemble the image context ----
+    console.log('Assembling image context');
+    const contextDir = getImageContextDir(root, appName);
+    fs_1.default.rmSync(contextDir, { recursive: true, force: true });
+    fs_1.default.mkdirSync(contextDir, { recursive: true });
+    writeDockerfile(contextDir, containerPorts);
+    writeImagePackageJson(root, contextDir);
+    const vendored = vendorQuidproquoPackages(root, contextDir);
+    console.log(`Vendored ${vendored} quidproquo packages`);
+    fs_1.default.cpSync(path_1.default.join(root, 'dist', 'qpq', 'dev-server'), path_1.default.join(contextDir, 'server'), { recursive: true });
+    for (const entry of [...webEntryRoutes, ...webEntryHosts]) {
+        copyWebEntryContent(appName, contextDir, entry, viewServices);
+    }
+    const composePath = (0, writeComposeFile_1.writeComposeFile)({
+        contextDir,
+        imageName,
+        serviceName: containerName,
+        volumeName,
+        portMappings,
+        dataPath: (_a = dockerSettings.dataPath) !== null && _a !== void 0 ? _a : null,
+        mounts: (_b = dockerSettings.mounts) !== null && _b !== void 0 ? _b : [],
+        publicHost: (_c = dockerSettings.publicHost) !== null && _c !== void 0 ? _c : null,
+        publicFileStoragePort: mapHostPort(devServerPorts.fileStorage),
+    });
+    // ---- Build the image ----
+    console.log(`Building docker image${dockerSettings.arch ? ` for ${dockerSettings.arch}` : ''}${dockerSettings.registry ? `, pushing to ${dockerSettings.registry}` : ''}`);
+    yield buildImage(imageName, contextDir, dockerSettings);
+    (0, timing_1.logTimeEnd)('totalTime');
+    const hostUrl = (containerPort) => {
+        var _a;
+        const hostPort = (_a = portMappings.find((mapping) => mapping.container === containerPort)) === null || _a === void 0 ? void 0 : _a.host;
+        return hostPort === undefined ? `(container port ${containerPort} is not mapped)` : `http://localhost${hostPort === 80 ? '' : `:${hostPort}`}`;
+    };
+    const siteUrl = hostUrl(devServerPorts.api);
+    const entryLines = [
+        ...webEntryRoutes.map((route) => `  ${route.service}/${route.entryName}: ${siteUrl}${route.path === '/' ? '' : route.path}`),
+        ...webEntryHosts.map((host) => `  ${host.service}/${host.entryName}: ${hostUrl(host.port)}`),
+    ].join('\n');
+    const where = dockerSettings.registry ? `pushed to [${imageName}]` : `[${imageName}] in the local docker store`;
+    const onHost = dockerSettings.registry
+        ? `On the host (Unraid: Compose Manager, or any docker host), copy the compose file there and run:`
+        : `Run it here:`;
+    console.log(`
+Done. The image is ${where}.
+
+${onHost}
+
+  docker compose -f ${composePath} up -d
+
+Then open ${siteUrl} (replace localhost with the host's address)
+${entryLines ? `\nWeb entries:\n${entryLines}\n` : ''}
+Ports come from the deployment's platformSettings.portMappings (${portMappings.map((m) => `${m.host}:${m.container}`).join(', ')})
+and are baked into the frontend, so a host must map the same ones. App state lives in ${(_d = dockerSettings.dataPath) !== null && _d !== void 0 ? _d : `the ${volumeName} volume`}.${((_e = dockerSettings.mounts) === null || _e === void 0 ? void 0 : _e.length)
+        ? `\nAlso mounted: ${dockerSettings.mounts.map((mount) => `${mount.host} at ${mount.container}${mount.readOnly ? ' (read-only)' : ''}`).join(', ')}.`
+        : ''}${dockerSettings.publicHost
+        ? ''
+        : `\nSecure file urls point at localhost; set platformSettings.publicHost to the address browsers use for this host.`}
+`);
+});
+exports.dockerGo = dockerGo;
+//# sourceMappingURL=go.js.map