@replayio/app-building 1.25.0 → 1.26.0

package/dist/index.js

@@ -1,7 +1,799 @@
-export * from "./container";
-export * from "./container-registry";
-export * from "./container-utils";
-export * from "./http-client";
-export * from "./image-ref";
-export * from "./secrets";
-export * from "./tasks";
+// container.ts
+import { execFileSync, spawn } from "child_process";
+import { readFileSync, existsSync } from "fs";
+import { resolve } from "path";
+
+// fly.ts
+var API_BASE = "https://api.machines.dev/v1";
+async function flyFetch(path, token, opts = {}) {
+  const res = await fetch(`${API_BASE}${path}`, {
+    ...opts,
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json",
+      ...opts.headers ?? {}
+    }
+  });
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    throw new Error(`Fly API ${opts.method ?? "GET"} ${path} \u2192 ${res.status}: ${body}`);
+  }
+  return res;
+}
+async function createVolume(app, token, name, region, sizeGb = 50) {
+  const res = await flyFetch(`/apps/${app}/volumes`, token, {
+    method: "POST",
+    body: JSON.stringify({
+      name,
+      region,
+      size_gb: sizeGb,
+      encrypted: true,
+      require_unique_zone: false
+    })
+  });
+  const data = await res.json();
+  return data.id;
+}
+async function deleteVolume(app, token, volumeId) {
+  await flyFetch(`/apps/${app}/volumes/${volumeId}`, token, {
+    method: "DELETE"
+  });
+}
+async function createMachine(app, token, image, env, name) {
+  const volumeName = `repo_${name.replace(/-/g, "_")}`.slice(0, 30);
+  const regions = ["dfw", "iad", "ord", "sjc"];
+  let cleanupDone;
+  for (const region of regions) {
+    console.log(`Creating machine in region ${region}...`);
+    const volumeId = await createVolume(app, token, volumeName, region, 50);
+    if (!cleanupDone) {
+      cleanupDone = listVolumes(app, token).then((vols) => Promise.all(
+        vols.map(async ({ id, attached_machine_id }) => {
+          if (attached_machine_id || id === volumeId)
+            return;
+          await deleteVolume(app, token, id).catch(() => {
+          });
+        })
+      ));
+    }
+    try {
+      const res = await flyFetch(`/apps/${app}/machines`, token, {
+        method: "POST",
+        body: JSON.stringify({
+          name,
+          region,
+          config: {
+            image,
+            env,
+            auto_destroy: true,
+            restart: { policy: "on-failure", max_retries: 3 },
+            guest: {
+              cpu_kind: "performance",
+              cpus: 16,
+              memory_mb: 32768
+            },
+            mounts: [{ volume: volumeId, path: "/repo" }],
+            services: [
+              {
+                ports: [{ port: 443, handlers: ["tls", "http"] }],
+                protocol: "tcp",
+                internal_port: 3e3,
+                autostart: false,
+                autostop: "off"
+              }
+            ]
+          }
+        })
+      });
+      const data = await res.json();
+      await cleanupDone;
+      return { machineId: data.id, volumeId };
+    } catch (err) {
+      await deleteVolume(app, token, volumeId).catch(() => {
+      });
+      const msg = err instanceof Error ? err.message : String(err);
+      if (msg.includes("412") || msg.includes("insufficient")) {
+        console.log(`Insufficient resources in ${region}, trying next region...`);
+        continue;
+      }
+      throw new Error(`Failed to create machine in region ${region}: ${msg}`);
+    }
+  }
+  throw new Error(`Failed to create machine in any region (tried ${regions.join(", ")}): insufficient resources`);
+}
+async function waitForMachine(app, token, machineId, timeoutMs = 18e4) {
+  const start = Date.now();
+  let lastLogTime = 0;
+  while (Date.now() - start < timeoutMs) {
+    try {
+      await flyFetch(
+        `/apps/${app}/machines/${machineId}/wait?state=started&timeout=60`,
+        token
+      );
+      return;
+    } catch (e) {
+      const now = Date.now();
+      const elapsed = Math.round((now - start) / 1e3);
+      if (now - lastLogTime >= 1e4) {
+        console.log(`Still waiting for machine to start (${elapsed}s elapsed): ${e instanceof Error ? e.message : e}`);
+        lastLogTime = now;
+      }
+      await new Promise((r) => setTimeout(r, 5e3));
+    }
+  }
+  throw new Error(`Machine ${machineId} did not reach started state within ${timeoutMs / 1e3}s`);
+}
+async function destroyMachine(app, token, machineId, volumeId) {
+  await flyFetch(`/apps/${app}/machines/${machineId}?force=true`, token, {
+    method: "DELETE"
+  });
+  if (volumeId) {
+    await deleteVolume(app, token, volumeId).catch((err) => {
+      console.log(`Warning: failed to delete volume ${volumeId}: ${err instanceof Error ? err.message : err}`);
+    });
+  }
+}
+async function listMachines(app, token) {
+  const res = await flyFetch(`/apps/${app}/machines`, token);
+  return await res.json();
+}
+async function listVolumes(app, token) {
+  const res = await flyFetch(`/apps/${app}/volumes`, token);
+  return await res.json();
+}
+
+// image-ref.ts
+var DEFAULT_IMAGE_REF = "ghcr.io/replayio/app-building:latest";
+function getImageRef() {
+  return process.env.CONTAINER_IMAGE_REF ?? DEFAULT_IMAGE_REF;
+}
+
+// container.ts
+var IMAGE_NAME = "app-building";
+function debugLog(...args) {
+  if (process.env.DEBUG) console.log("[container]", ...args);
+}
+function loadDotEnv(projectRoot) {
+  const envPath = resolve(projectRoot, ".env");
+  if (!existsSync(envPath)) {
+    return {};
+  }
+  const content = readFileSync(envPath, "utf-8");
+  const vars = {};
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eqIndex = trimmed.indexOf("=");
+    if (eqIndex === -1) continue;
+    const key = trimmed.slice(0, eqIndex).trim();
+    let value = trimmed.slice(eqIndex + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    vars[key] = value;
+  }
+  return vars;
+}
+function buildImage(config) {
+  if (!config.projectRoot) throw new Error("projectRoot is required for local Docker operations");
+  console.log("Building Docker image...");
+  execFileSync("docker", ["build", "--platform", "linux/amd64", "--network", "host", "-t", IMAGE_NAME, config.projectRoot], {
+    stdio: "inherit",
+    timeout: 6e5
+  });
+  console.log("Docker image built successfully.");
+}
+function ensureImageExists(projectRoot) {
+  try {
+    execFileSync("docker", ["image", "inspect", IMAGE_NAME], {
+      stdio: "ignore"
+    });
+  } catch {
+    console.log("Building Docker image...");
+    execFileSync("docker", ["build", "--platform", "linux/amd64", "--network", "host", "-t", IMAGE_NAME, projectRoot], {
+      stdio: "inherit",
+      timeout: 6e5
+    });
+    console.log("Docker image built successfully.");
+  }
+}
+function findFreePort() {
+  let port = 3100;
+  try {
+    const out = execFileSync("ss", ["-tlnH"], {
+      encoding: "utf-8",
+      timeout: 5e3
+    });
+    const usedPorts = /* @__PURE__ */ new Set();
+    for (const match of out.matchAll(/:(\d+)\s/g)) {
+      usedPorts.add(parseInt(match[1], 10));
+    }
+    while (usedPorts.has(port)) port++;
+  } catch {
+  }
+  return port;
+}
+function buildContainerEnv(repo, infisical, extra = {}) {
+  const env = {
+    REPO_URL: repo.repoUrl,
+    CLONE_BRANCH: repo.cloneBranch,
+    PUSH_BRANCH: repo.pushBranch,
+    GIT_AUTHOR_NAME: "App Builder",
+    GIT_AUTHOR_EMAIL: "app-builder@localhost",
+    GIT_COMMITTER_NAME: "App Builder",
+    GIT_COMMITTER_EMAIL: "app-builder@localhost",
+    PLAYWRIGHT_BROWSERS_PATH: "/opt/playwright",
+    INFISICAL_TOKEN: infisical.token,
+    INFISICAL_PROJECT_ID: infisical.projectId,
+    INFISICAL_ENVIRONMENT: infisical.environment,
+    ...extra
+  };
+  if (process.env.DEBUG) {
+    env.DEBUG = process.env.DEBUG;
+  }
+  return env;
+}
+function buildExtraEnv(config, containerName) {
+  const extra = {
+    PORT: "3000",
+    CONTAINER_NAME: containerName
+  };
+  if (config.webhookUrl) extra.WEBHOOK_URL = config.webhookUrl;
+  if (config.taskWebhookUrl) extra.TASK_WEBHOOK_URL = config.taskWebhookUrl;
+  if (config.addTaskWebhookUrl) extra.ADD_TASK_WEBHOOK_URL = config.addTaskWebhookUrl;
+  if (config.webhookSecret) extra.WEBHOOK_SECRET = config.webhookSecret;
+  if (config.detached) extra.DETACHED = "1";
+  if (config.initialPrompt) extra.INITIAL_PROMPT = config.initialPrompt;
+  if (config.absorbTasks) extra.ABSORB_TASKS = "1";
+  if (config.agentCommand) extra.AGENT_COMMAND = config.agentCommand;
+  return extra;
+}
+function isRemote(config) {
+  return !!(config.flyToken && config.flyApp);
+}
+async function startLocalContainer(config, repo) {
+  buildImage(config);
+  const uniqueId = Math.random().toString(36).slice(2, 8);
+  const prefix = config.namePrefix ?? "app-building";
+  const containerName = `${prefix}-${uniqueId}`;
+  const containerPort = 3e3;
+  const hostPort = config.localPort ?? findFreePort();
+  const extra = buildExtraEnv(config, containerName);
+  extra.PORT = String(containerPort);
+  const containerEnv = buildContainerEnv(repo, config.infisical, extra);
+  const args = ["run", "--platform", "linux/amd64", "-d", "--rm", "--name", containerName];
+  args.push("-p", `${hostPort}:${containerPort}`);
+  for (const [k, v] of Object.entries(containerEnv)) {
+    args.push("--env", `${k}=${v}`);
+  }
+  args.push(IMAGE_NAME);
+  const containerId = execFileSync("docker", args, {
+    encoding: "utf-8",
+    timeout: 3e4
+  }).trim();
+  console.log(`Container started: ${containerId.slice(0, 12)} (${containerName})`);
+  const baseUrl = `http://127.0.0.1:${hostPort}`;
+  const maxWait = 12e4;
+  const interval = 1e3;
+  const start = Date.now();
+  let ready = false;
+  while (Date.now() - start < maxWait) {
+    try {
+      execFileSync(
+        "docker",
+        ["inspect", "--format", "{{.State.Running}}", containerName],
+        { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"], timeout: 5e3 }
+      );
+    } catch {
+      let logs = "";
+      try {
+        logs = execFileSync("docker", ["logs", "--tail", "30", containerName], {
+          encoding: "utf-8",
+          timeout: 5e3
+        });
+      } catch {
+      }
+      throw new Error(
+        `Container exited during startup.${logs ? `
+
+--- container logs ---
+${logs}` : " (no logs available, container was removed)"}`
+      );
+    }
+    try {
+      const res = await fetch(`${baseUrl}/status`);
+      if (res.ok) {
+        ready = true;
+        break;
+      }
+    } catch {
+    }
+    await new Promise((r) => setTimeout(r, interval));
+  }
+  if (!ready) {
+    throw new Error("Container did not become ready within timeout");
+  }
+  return { type: "local", containerName, port: hostPort, baseUrl };
+}
+function stopLocalContainer(containerName) {
+  try {
+    execFileSync("docker", ["stop", containerName], { stdio: "ignore", timeout: 3e4 });
+  } catch {
+  }
+}
+async function startRemoteContainerImpl(config, repo) {
+  if (!config.flyToken) throw new Error("flyToken is required for remote containers");
+  if (!config.flyApp) throw new Error("flyApp is required for remote containers");
+  const imageRef = config.imageRef ?? getImageRef();
+  const uniqueId = Math.random().toString(36).slice(2, 8);
+  const prefix = config.namePrefix ?? "app-building";
+  const machineName = `${prefix}-${uniqueId}`;
+  const extra = buildExtraEnv(config, machineName);
+  const containerEnv = buildContainerEnv(repo, config.infisical, extra);
+  const existing = await listMachines(config.flyApp, config.flyToken);
+  if (existing.length > 0) {
+    console.log(`${existing.length} existing machine(s) in ${config.flyApp}:`);
+    for (const m of existing) {
+      console.log(`  ${m.id} (${m.name}) \u2014 ${m.state}`);
+    }
+  }
+  console.log("Creating Fly machine (with volume)...");
+  let machineId = "";
+  let volumeId = "";
+  for (let attempt = 0; attempt < 5; attempt++) {
+    try {
+      const result = await createMachine(config.flyApp, config.flyToken, imageRef, containerEnv, machineName);
+      machineId = result.machineId;
+      volumeId = result.volumeId;
+      break;
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (msg.includes("MANIFEST_UNKNOWN") && attempt < 4) {
+        console.log("Image not yet available in registry, retrying in 5s...");
+        await new Promise((r) => setTimeout(r, 5e3));
+        continue;
+      }
+      throw err;
+    }
+  }
+  console.log(`Machine created: ${machineId} (volume: ${volumeId})`);
+  const baseUrl = `https://${config.flyApp}.fly.dev`;
+  const agentState = {
+    type: "remote",
+    containerName: machineName,
+    port: 443,
+    baseUrl,
+    flyApp: config.flyApp,
+    flyMachineId: machineId,
+    flyVolumeId: volumeId
+  };
+  console.log("Waiting for machine to start...");
+  await waitForMachine(config.flyApp, config.flyToken, machineId);
+  console.log("Machine started.");
+  const maxWait = 18e4;
+  const interval = 2e3;
+  const start = Date.now();
+  let ready = false;
+  while (Date.now() - start < maxWait) {
+    try {
+      const res = await fetch(`${baseUrl}/status`, {
+        headers: { "fly-force-instance-id": machineId }
+      });
+      if (res.ok) {
+        ready = true;
+        break;
+      }
+    } catch {
+    }
+    await new Promise((r) => setTimeout(r, interval));
+  }
+  if (!ready) {
+    console.log("Timed out waiting for machine, destroying...");
+    await destroyMachine(config.flyApp, config.flyToken, machineId, volumeId).catch(() => {
+    });
+    throw new Error("Remote container did not become ready within timeout");
+  }
+  return agentState;
+}
+async function stopRemoteContainerImpl(config, state) {
+  if (!state.flyApp || !state.flyMachineId) {
+    throw new Error("Missing flyApp or flyMachineId in agent state");
+  }
+  if (!config.flyToken) throw new Error("flyToken is required to stop remote container");
+  console.log(`Destroying Fly machine ${state.flyMachineId}...`);
+  await destroyMachine(state.flyApp, config.flyToken, state.flyMachineId, state.flyVolumeId);
+  console.log("Machine destroyed.");
+}
+async function startContainer(config, repo) {
+  const { token, projectId, environment } = config.infisical;
+  if (!token || !projectId || !environment) {
+    const missing = [
+      !token && "token",
+      !projectId && "projectId",
+      !environment && "environment"
+    ].filter(Boolean);
+    throw new Error(`Missing Infisical credentials: ${missing.join(", ")}. Containers cannot start without Infisical.`);
+  }
+  debugLog("startContainer config:", {
+    projectRoot: config.projectRoot,
+    flyApp: config.flyApp,
+    imageRef: config.imageRef,
+    webhookUrl: config.webhookUrl,
+    detached: config.detached,
+    remote: isRemote(config),
+    initialPrompt: config.initialPrompt ? `${config.initialPrompt.slice(0, 100)}...` : void 0
+  });
+  debugLog("startContainer repo:", repo);
+  const state = isRemote(config) ? await startRemoteContainerImpl(config, repo) : await startLocalContainer(config, repo);
+  config.registry.log(state);
+  return state;
+}
+async function stopContainer(config, state) {
+  if (state.type === "remote") {
+    await stopRemoteContainerImpl(config, state);
+  } else {
+    stopLocalContainer(state.containerName);
+  }
+  config.registry.markStopped(state.containerName);
+}
+function spawnTestContainer(config) {
+  if (!config.projectRoot) throw new Error("projectRoot is required for local Docker operations");
+  ensureImageExists(config.projectRoot);
+  const uniqueId = Math.random().toString(36).slice(2, 8);
+  const containerName = `app-building-test-${uniqueId}`;
+  const args = ["run", "--platform", "linux/amd64", "-it", "--rm", "--name", containerName];
+  args.push("-v", `${config.projectRoot}:/repo`);
+  args.push("-w", "/repo");
+  args.push("--network", "host");
+  args.push("--user", `${process.getuid()}:${process.getgid()}`);
+  args.push("--env", "HOME=/repo/.agent-home");
+  args.push("--env", "PLAYWRIGHT_BROWSERS_PATH=/opt/playwright");
+  args.push("--env", `INFISICAL_TOKEN=${config.infisical.token}`);
+  args.push("--env", `INFISICAL_PROJECT_ID=${config.infisical.projectId}`);
+  args.push("--env", `INFISICAL_ENVIRONMENT=${config.infisical.environment}`);
+  args.push(IMAGE_NAME, "bash");
+  return new Promise((resolvePromise, reject) => {
+    const child = spawn("docker", args, { stdio: "inherit" });
+    child.on("close", (code) => {
+      if (code === 0) resolvePromise();
+      else reject(new Error(`Container exited with code ${code}`));
+    });
+    child.on("error", reject);
+  });
+}
+
+// container-registry.ts
+import { readFileSync as readFileSync2, writeFileSync, appendFileSync, existsSync as existsSync2 } from "fs";
+
+// container-utils.ts
+function httpOptsFor(state) {
+  if (state.type === "remote" && state.flyMachineId) {
+    return { headers: { "fly-force-instance-id": state.flyMachineId } };
+  }
+  return {};
+}
+async function probeAlive(entry) {
+  try {
+    const headers = {};
+    if (entry.type === "remote" && entry.flyMachineId) {
+      headers["fly-force-instance-id"] = entry.flyMachineId;
+    }
+    const res = await fetch(`${entry.baseUrl}/status`, {
+      headers,
+      signal: AbortSignal.timeout(5e3)
+    });
+    if (!res.ok) return false;
+    const body = await res.json();
+    if (body.containerName && body.containerName !== entry.containerName) {
+      return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// container-registry.ts
+var FileContainerRegistry = class {
+  constructor(filePath) {
+    this.filePath = filePath;
+  }
+  readRegistry() {
+    if (!existsSync2(this.filePath)) return { lines: [], entries: [] };
+    const lines = readFileSync2(this.filePath, "utf-8").split("\n").filter((l) => l.trim());
+    const entries = lines.map((line) => {
+      try {
+        return JSON.parse(line);
+      } catch {
+        return null;
+      }
+    });
+    return { lines, entries };
+  }
+  updateEntry(match, update) {
+    const { lines, entries } = this.readRegistry();
+    for (let i = entries.length - 1; i >= 0; i--) {
+      const entry = entries[i];
+      if (entry && match(entry)) {
+        update(entry);
+        lines[i] = JSON.stringify(entry);
+        writeFileSync(this.filePath, lines.join("\n") + "\n");
+        return;
+      }
+    }
+  }
+  log(state) {
+    const entry = {
+      ...state,
+      startedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    appendFileSync(this.filePath, JSON.stringify(entry) + "\n");
+  }
+  markStopped(containerName) {
+    this.updateEntry(
+      (e) => !e.stoppedAt && (!containerName || e.containerName === containerName),
+      (e) => {
+        e.stoppedAt = (/* @__PURE__ */ new Date()).toISOString();
+      }
+    );
+  }
+  clearStopped(containerName) {
+    this.updateEntry(
+      (e) => e.containerName === containerName && !!e.stoppedAt,
+      (e) => {
+        delete e.stoppedAt;
+      }
+    );
+  }
+  getRecent(limit = 20) {
+    const { entries } = this.readRegistry();
+    return entries.filter((e) => e !== null).slice(-limit);
+  }
+  find(containerName) {
+    const entries = this.getRecent(100);
+    for (let i = entries.length - 1; i >= 0; i--) {
+      if (entries[i].containerName === containerName) {
+        return entries[i];
+      }
+    }
+    return null;
+  }
+  async findAlive() {
+    const entries = this.getRecent();
+    const oneDayAgo = Date.now() - 24 * 60 * 60 * 1e3;
+    const candidates = entries.filter((e) => new Date(e.startedAt).getTime() > oneDayAgo);
+    const aliveResults = await Promise.all(
+      candidates.map(async (entry) => ({
+        entry,
+        alive: await probeAlive(entry)
+      }))
+    );
+    for (const r of aliveResults) {
+      if (r.alive && r.entry.stoppedAt) {
+        this.clearStopped(r.entry.containerName);
+      } else if (!r.alive && !r.entry.stoppedAt) {
+        this.markStopped(r.entry.containerName);
+      }
+    }
+    return aliveResults.filter((r) => r.alive).map((r) => r.entry);
+  }
+};
+
+// http-client.ts
+var DEFAULT_TIMEOUT = 3e4;
+var MAX_RETRIES = 4;
+var RETRY_DELAY_MS = 2e3;
+async function fetchWithRetry(url, init, timeout) {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      const res = await fetch(url, { ...init, signal: AbortSignal.timeout(timeout) });
+      if (!res.ok) throw new Error(`${init.method ?? "GET"} ${url}: ${res.status} ${res.statusText}`);
+      return res;
+    } catch (err) {
+      if (attempt >= MAX_RETRIES) throw err;
+      await new Promise((r) => setTimeout(r, RETRY_DELAY_MS));
+    }
+  }
+}
+async function httpGet(url, opts = {}) {
+  const res = await fetchWithRetry(url, { headers: opts.headers }, opts.timeout ?? DEFAULT_TIMEOUT);
+  return res.json();
+}
+async function httpPost(url, body, opts = {}) {
+  const res = await fetchWithRetry(
+    url,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json", ...opts.headers },
+      body: body !== void 0 ? JSON.stringify(body) : void 0
+    },
+    opts.timeout ?? DEFAULT_TIMEOUT
+  );
+  return res.json();
+}
+
+// secrets.ts
+var INFISICAL_API_BASE = "https://app.infisical.com";
+async function infisicalLogin(clientId, clientSecret) {
+  const res = await fetch(`${INFISICAL_API_BASE}/api/v1/auth/universal-auth/login`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ clientId, clientSecret })
+  });
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    throw new Error(`Infisical login failed \u2192 ${res.status}: ${body}`);
+  }
+  const data = await res.json();
+  return data.accessToken;
+}
+function authHeaders(config) {
+  return {
+    Authorization: `Bearer ${config.token}`,
+    "Content-Type": "application/json"
+  };
+}
+async function fetchInfisicalSecrets(config, secretPath) {
+  const params = new URLSearchParams({
+    projectId: config.projectId,
+    environment: config.environment,
+    secretPath
+  });
+  const res = await fetch(`${INFISICAL_API_BASE}/api/v4/secrets?${params}`, {
+    headers: authHeaders(config)
+  });
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    throw new Error(`Infisical GET secrets ${secretPath} \u2192 ${res.status}: ${body}`);
+  }
+  const data = await res.json();
+  const secrets = {};
+  for (const s of data.secrets) {
+    secrets[s.secretKey] = s.secretValue;
+  }
+  return secrets;
+}
+async function fetchGlobalSecrets(config) {
+  return fetchInfisicalSecrets(config, "/global/");
+}
+async function fetchBranchSecrets(config, branch) {
+  return fetchInfisicalSecrets(config, `/branches/${branch}/`);
+}
+async function ensureFolder(config, folderPath) {
+  const segments = folderPath.split("/").filter(Boolean);
+  let parentPath = "/";
+  for (const segment of segments) {
+    const res = await fetch(`${INFISICAL_API_BASE}/api/v2/folders`, {
+      method: "POST",
+      headers: authHeaders(config),
+      body: JSON.stringify({
+        projectId: config.projectId,
+        environment: config.environment,
+        name: segment,
+        path: parentPath
+      })
+    });
+    if (res.ok || res.status === 400) {
+      parentPath += segment + "/";
+      continue;
+    }
+    const text = await res.text().catch(() => "");
+    throw new Error(`Infisical create folder ${parentPath}${segment} \u2192 ${res.status}: ${text}`);
+  }
+}
+async function createBranchSecret(config, branch, name, value) {
+  const secretPath = `/branches/${branch}/`;
+  const url = `${INFISICAL_API_BASE}/api/v4/secrets/${encodeURIComponent(name)}`;
+  const body = {
+    projectId: config.projectId,
+    environment: config.environment,
+    secretPath,
+    secretValue: value,
+    type: "shared"
+  };
+  const headers = authHeaders(config);
+  const res = await fetch(url, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(body)
+  });
+  if (res.ok) return;
+  if (res.status === 400) {
+    const patchRes = await fetch(url, {
+      method: "PATCH",
+      headers,
+      body: JSON.stringify(body)
+    });
+    if (patchRes.ok) return;
+    const text2 = await patchRes.text().catch(() => "");
+    throw new Error(`Infisical PATCH ${name} \u2192 ${patchRes.status}: ${text2}`);
+  }
+  if (res.status === 404) {
+    await ensureFolder(config, secretPath);
+    const retryRes = await fetch(url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(body)
+    });
+    if (retryRes.ok) return;
+    if (retryRes.status === 400) {
+      const patchRes = await fetch(url, {
+        method: "PATCH",
+        headers,
+        body: JSON.stringify(body)
+      });
+      if (patchRes.ok) return;
+      const text3 = await patchRes.text().catch(() => "");
+      throw new Error(`Infisical PATCH ${name} (after folder creation) \u2192 ${patchRes.status}: ${text3}`);
+    }
+    const text2 = await retryRes.text().catch(() => "");
+    throw new Error(`Infisical POST ${name} (after folder creation) \u2192 ${retryRes.status}: ${text2}`);
+  }
+  const text = await res.text().catch(() => "");
+  throw new Error(`Infisical POST ${name} \u2192 ${res.status}: ${text}`);
+}
+async function getInfisicalConfig(envVars) {
+  const clientId = envVars.INFISICAL_CLIENT_ID;
+  const clientSecret = envVars.INFISICAL_CLIENT_SECRET;
+  const projectId = envVars.INFISICAL_PROJECT_ID;
+  const environment = envVars.INFISICAL_ENVIRONMENT;
+  const missing = [
+    !clientId && "INFISICAL_CLIENT_ID",
+    !clientSecret && "INFISICAL_CLIENT_SECRET",
+    !projectId && "INFISICAL_PROJECT_ID",
+    !environment && "INFISICAL_ENVIRONMENT"
+  ].filter(Boolean);
+  if (missing.length > 0) {
+    throw new Error(`Missing Infisical config in .env: ${missing.join(", ")}`);
+  }
+  const token = await infisicalLogin(clientId, clientSecret);
+  return { token, projectId, environment };
+}
+
+// tasks.ts
+function findReadyTask(pendingTasks, completedTasks) {
+  const completedIds = new Set(completedTasks.map((t) => t.id).filter(Boolean));
+  const pendingChildParents = /* @__PURE__ */ new Set();
+  for (const t of pendingTasks) {
+    if (t.parentTaskId) pendingChildParents.add(t.parentTaskId);
+  }
+  const cache = /* @__PURE__ */ new Map();
+  function isFullyComplete(taskId) {
+    if (cache.has(taskId)) return cache.get(taskId);
+    cache.set(taskId, false);
+    if (!completedIds.has(taskId)) return false;
+    if (pendingChildParents.has(taskId)) return false;
+    for (const child of completedTasks) {
+      if (child.parentTaskId === taskId && child.id && !isFullyComplete(child.id)) {
+        return false;
+      }
+    }
+    cache.set(taskId, true);
+    return true;
+  }
+  const idx = pendingTasks.findIndex((task) => {
+    if (!task.requiredTaskIds || task.requiredTaskIds.length === 0) return true;
+    return task.requiredTaskIds.every((id) => isFullyComplete(id));
+  });
+  return idx === -1 ? null : pendingTasks[idx];
+}
+export {
+  FileContainerRegistry,
+  buildImage,
+  createBranchSecret,
+  fetchBranchSecrets,
+  fetchGlobalSecrets,
+  fetchInfisicalSecrets,
+  findReadyTask,
+  getImageRef,
+  getInfisicalConfig,
+  httpGet,
+  httpOptsFor,
+  httpPost,
+  infisicalLogin,
+  loadDotEnv,
+  probeAlive,
+  spawnTestContainer,
+  startContainer,
+  stopContainer
+};