@toa.io/operations 1.0.0-alpha.296 → 1.0.0-alpha.297

package/CHANGELOG.md

@@ -3,6 +3,14 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [1.0.0-alpha.297](https://github.com/toa-io/toa/compare/v1.0.0-alpha.296...v1.0.0-alpha.297) (2026-09-08)
+
+**Note:** Version bump only for package @toa.io/operations
+
+
+
+
+
 # [1.0.0-alpha.296](https://github.com/toa-io/toa/compare/v1.0.0-alpha.295...v1.0.0-alpha.296) (2026-09-08)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@toa.io/operations",
-  "version": "1.0.0-alpha.296",
+  "version": "1.0.0-alpha.297",
   "type": "module",
   "description": "Toa Deployment",
   "homepage": "https://toa.io",
@@ -30,8 +30,8 @@
   "dependencies": {
     "@toa.io/generic": "1.0.0-alpha.292",
     "@toa.io/kubernetes": "1.0.0-alpha.293",
-    "@toa.io/norm": "1.0.0-alpha.296",
+    "@toa.io/norm": "1.0.0-alpha.297",
     "paseto": "4.0.0"
   },
-  "gitHead": "d0fd4f9d13483f763acd9dd2b3c3eb8cb8856524"
+  "gitHead": "52959bba83817238725f50553d45afde1f231af1"
 }

package/src/deployment/images/format.test.js

@@ -111,3 +111,39 @@ describe('normalized', () => {
     assert.strictEqual(read.locator.id, 'todos.tasks')
   })
 })
+
+describe('a service image', () => {
+  it('installs what its components declare beside Toa as well', async () => {
+    const { Service } = await import('./service.js')
+
+    const path = join(root, 'extension')
+    const component = join(path, 'components', 'octets')
+
+    await mkdir(component, { recursive: true })
+    await writeFile(join(path, 'package.json'), JSON.stringify({ name: 'ext', version: '1' }))
+    await writeFile(
+      join(component, 'package.json'),
+      JSON.stringify({ dependencies: { cloudinary: '2.11.0', jose: '6.2.10' } })
+    )
+
+    const service = new Service('', { version: '1' }, {}, path, {
+      group: 'g',
+      name: 'n',
+      version: '1'
+    })
+
+    service.reference = 'probe'
+
+    const context = await service.prepare(join(root, 'service'))
+
+    // what an extension imports on a component's behalf is imported from where Toa is
+    assert.strictEqual(
+      await readFile(join(context, '.packages'), 'utf8'),
+      'cloudinary@2.11.0\njose@6.2.10'
+    )
+
+    const dockerfile = await readFile(join(context, 'Dockerfile'), 'utf8')
+
+    assert.ok(dockerfile.includes('npm i --prefix /toa --omit=dev --legacy-peer-deps $(cat .packages)'))
+  })
+})

package/src/deployment/images/service.Dockerfile

@@ -14,7 +14,12 @@ RUN --mount=type=cache,target=/root/.npm,sharing=locked \
 # component rather than beside the extension: an application that runs none of them, and the
 # runtime image every application is built on, carry nothing for them
 RUN --mount=type=cache,target=/root/.npm,sharing=locked \
-  for entry in components/*; do if grep -qs '"dependencies"' "$entry/package.json"; then (cd $entry && npm i --omit=dev); fi; done
+  for entry in components/*; do if grep -qs '"dependencies"' "$entry/package.json"; then (cd $entry && npm i --omit=dev --legacy-peer-deps); fi; done
+
+# and beside Toa as well, because what an extension imports on a component's behalf — a storage
+# provider's SDK — is imported from where the extension is, which is `/toa` and not here
+RUN --mount=type=cache,target=/root/.npm,sharing=locked \
+  if [ -s .packages ]; then npm i --prefix /toa --omit=dev --legacy-peer-deps $(cat .packages); fi
 
 # no USER: the runtime drops to `node` itself, and only a process that started as root can
 # close its environment under /proc — see runtime/runtime/bin/toa

package/src/deployment/images/service.js

@@ -1,8 +1,9 @@
 import { createRequire } from 'node:module'
 import { join, dirname } from 'node:path'
+import { existsSync, readdirSync, readFileSync } from 'node:fs'
 
 import { Image } from './image.js'
-import { cp } from 'node:fs/promises'
+import { cp, writeFile } from 'node:fs/promises'
 
 // a service is named the way a package is, and its directory is where it lives
 const require = createRequire(import.meta.url)
@@ -60,11 +61,46 @@ export class Service extends Image {
     const context = await super.prepare(root)
 
     await cp(this.#path, context, { recursive: true })
+    await writeFile(join(context, PACKAGES), this.#packages().join('\n'))
 
     return context
   }
+
+  /**
+   * What the components this service runs declare, as `name@version`.
+   *
+   * Each is installed beside its component, where the component's own modules import it, and
+   * beside Toa, where an extension that imports on a component's behalf is — a storage
+   * provider's SDK is imported by `@toa.io/extensions.storages`, not by the component that
+   * declares the storage.
+   *
+   * @returns {string[]}
+   */
+  #packages() {
+    const directory = join(this.#path, 'components')
+
+    if (!existsSync(directory)) return []
+
+    /** @type {Record<string, string>} */
+    const packages = {}
+
+    for (const label of readdirSync(directory)) {
+      const manifest = join(directory, label, 'package.json')
+
+      if (!existsSync(manifest)) continue
+
+      Object.assign(packages, JSON.parse(readFileSync(manifest, 'utf8')).dependencies)
+    }
+
+    return Object.entries(packages)
+      .map(([name, version]) => `${name}@${version}`)
+      .sort()
+  }
 }
 
+/** Where the install reads what the components need, one `name@version` per line. */
+const PACKAGES = '.packages'
+
 /**
  * Where the extension is installed, which is what its image is built from. A deploy install
  * carries what an extension declares and not the extension, so a service is built only where