@vtechcom/hexcore 2.0.0-beta.1

package/dist/docker/container-stats.js

@@ -0,0 +1,134 @@
+"use strict";
+/**
+ * Reading Docker's stats payload, without Docker.
+ *
+ * Kept a pure function for the same reason `hydra/argv.ts` is: the interesting
+ * part is arithmetic that is wrong in obvious ways and right in non-obvious
+ * ones, and it can be tested against captured samples instead of against a
+ * daemon. Two pieces of that arithmetic are worth knowing before changing it.
+ *
+ * **CPU is a delta between two samples, not a reading.** The cgroup counter is
+ * cumulative nanoseconds, so a percentage only exists relative to a previous
+ * sample. Docker takes that second sample for us when the stats request asks
+ * for `stream=false` without `one-shot`; ask for `one-shot=true` and `precpu`
+ * comes back zeroed, every delta becomes the whole lifetime of the container,
+ * and the number reads as a plausible few percent while meaning nothing.
+ *
+ * **Memory has to have the page cache subtracted.** The raw cgroup `usage`
+ * includes file cache, and a hydra-node reads a ~426 KB trusted setup and maps
+ * its persistence — that cache is memory the kernel gives back the moment
+ * anything else wants it. `docker stats` subtracts it and so do we, otherwise
+ * the number that the ~500 MB-per-node budget is checked against is inflated by
+ * whatever the node last touched.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.emptyUsage = emptyUsage;
+exports.readContainerStats = readContainerStats;
+const EMPTY = {
+    cpuPercent: null,
+    cpuCores: null,
+    memoryBytes: null,
+    memoryLimitBytes: null,
+    memoryPercent: null,
+    netRxBytes: null,
+    netTxBytes: null,
+    blockReadBytes: null,
+    blockWriteBytes: null,
+    pids: null,
+};
+function emptyUsage() {
+    return { ...EMPTY };
+}
+function readContainerStats(raw) {
+    if (!raw || typeof raw !== 'object')
+        return emptyUsage();
+    const stats = raw;
+    return {
+        ...cpuUsage(stats),
+        ...memoryUsage(stats),
+        ...networkUsage(stats),
+        ...blockIoUsage(stats),
+        pids: numberOrNull(stats.pids_stats?.current),
+    };
+}
+function cpuUsage(stats) {
+    const cores = stats.cpu_stats?.online_cpus ?? stats.cpu_stats?.cpu_usage?.percpu_usage?.length ?? null;
+    /**
+     * There must BE a previous sample before a delta can be taken from it.
+     *
+     * `system_cpu_usage` is the host's cumulative CPU time — on any real second
+     * reading it is an enormous positive number, and it is zero in exactly one
+     * situation: `precpu_stats` was never filled in, which is what a `one-shot`
+     * request returns. Checking the deltas is not enough to catch that, because
+     * subtracting zero leaves both of them positive and the ratio comes out as
+     * a believable few percent that is actually "container lifetime over host
+     * uptime". This is the check that rejects it.
+     */
+    const priorSystem = stats.precpu_stats?.system_cpu_usage ?? 0;
+    if (priorSystem <= 0 || !cores)
+        return { cpuPercent: null, cpuCores: cores };
+    const cpuDelta = (stats.cpu_stats?.cpu_usage?.total_usage ?? 0) - (stats.precpu_stats?.cpu_usage?.total_usage ?? 0);
+    const systemDelta = (stats.cpu_stats?.system_cpu_usage ?? 0) - priorSystem;
+    /**
+     * Both deltas must be positive for the ratio to mean anything. A zero
+     * system delta means two reads landed inside the same clock tick; a
+     * negative one means the container restarted between them and the counters
+     * reset. Null in both cases — "we cannot say" is a fact the UI can render,
+     * 0% is a lie.
+     */
+    if (cpuDelta <= 0 || systemDelta <= 0)
+        return { cpuPercent: null, cpuCores: cores };
+    return { cpuPercent: round2((cpuDelta / systemDelta) * cores * 100), cpuCores: cores };
+}
+function memoryUsage(stats) {
+    const usage = numberOrNull(stats.memory_stats?.usage);
+    const limit = numberOrNull(stats.memory_stats?.limit);
+    if (usage === null)
+        return { memoryBytes: null, memoryLimitBytes: limit, memoryPercent: null };
+    /**
+     * cgroup v2 names it `inactive_file`, v1 `total_inactive_file`, and older
+     * daemons only report `cache`. Docker Desktop is v2 today and the Linux
+     * hosts this also runs on may be either, so take whichever is present
+     * rather than picking one and being silently wrong on the other.
+     */
+    const cache = stats.memory_stats?.stats ?? {};
+    const cached = cache.inactive_file ?? cache.total_inactive_file ?? cache.cache ?? 0;
+    const used = Math.max(0, usage - cached);
+    return {
+        memoryBytes: used,
+        memoryLimitBytes: limit,
+        memoryPercent: limit && limit > 0 ? round2((used / limit) * 100) : null,
+    };
+}
+function networkUsage(stats) {
+    const interfaces = Object.values(stats.networks ?? {});
+    if (interfaces.length === 0)
+        return { netRxBytes: null, netTxBytes: null };
+    return {
+        netRxBytes: interfaces.reduce((sum, i) => sum + (i.rx_bytes ?? 0), 0),
+        netTxBytes: interfaces.reduce((sum, i) => sum + (i.tx_bytes ?? 0), 0),
+    };
+}
+function blockIoUsage(stats) {
+    const entries = stats.blkio_stats?.io_service_bytes_recursive;
+    // Docker Desktop's VM reports this as null rather than an empty array.
+    if (!Array.isArray(entries) || entries.length === 0)
+        return { blockReadBytes: null, blockWriteBytes: null };
+    let read = 0;
+    let write = 0;
+    for (const entry of entries) {
+        const op = (entry.op ?? '').toLowerCase();
+        if (op === 'read')
+            read += entry.value ?? 0;
+        if (op === 'write')
+            write += entry.value ?? 0;
+    }
+    return { blockReadBytes: read, blockWriteBytes: write };
+}
+function numberOrNull(value) {
+    return typeof value === 'number' && Number.isFinite(value) ? value : null;
+}
+function round2(value) {
+    return Math.round(value * 100) / 100;
+}
+//# sourceMappingURL=container-stats.js.map

package/dist/docker/container-stats.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-stats.js","sourceRoot":"","sources":["../../src/docker/container-stats.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;AAkDH,gCAEC;AAED,gDAWC;AA5BD,MAAM,KAAK,GAAmB;IAC1B,UAAU,EAAE,IAAI;IAChB,QAAQ,EAAE,IAAI;IACd,WAAW,EAAE,IAAI;IACjB,gBAAgB,EAAE,IAAI;IACtB,aAAa,EAAE,IAAI;IACnB,UAAU,EAAE,IAAI;IAChB,UAAU,EAAE,IAAI;IAChB,cAAc,EAAE,IAAI;IACpB,eAAe,EAAE,IAAI;IACrB,IAAI,EAAE,IAAI;CACb,CAAC;AAEF,SAAgB,UAAU;IACtB,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;AACxB,CAAC;AAED,SAAgB,kBAAkB,CAAC,GAAY;IAC3C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,UAAU,EAAE,CAAC;IACzD,MAAM,KAAK,GAAG,GAAyB,CAAC;IAExC,OAAO;QACH,GAAG,QAAQ,CAAC,KAAK,CAAC;QAClB,GAAG,WAAW,CAAC,KAAK,CAAC;QACrB,GAAG,YAAY,CAAC,KAAK,CAAC;QACtB,GAAG,YAAY,CAAC,KAAK,CAAC;QACtB,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC;KAChD,CAAC;AACN,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,WAAW,IAAI,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,IAAI,IAAI,CAAC;IAEvG;;;;;;;;;;OAUG;IACH,MAAM,WAAW,GAAG,KAAK,CAAC,YAAY,EAAE,gBAAgB,IAAI,CAAC,CAAC;IAC9D,IAAI,WAAW,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAE7E,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,SAAS,EAAE,WAAW,IAAI,CAAC,CAAC,CAAC;IACpH,MAAM,WAAW,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,gBAAgB,IAAI,CAAC,CAAC,GAAG,WAAW,CAAC;IAE3E;;;;;;OAMG;IACH,IAAI,QAAQ,IAAI,CAAC,IAAI,WAAW,IAAI,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAEpF,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,QAAQ,GAAG,WAAW,CAAC,GAAG,KAAK,GAAG,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC3F,CAAC;AAED,SAAS,WAAW,CAChB,KAAyB;IAEzB,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IAE/F;;;;;OAKG;IACH,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,mBAAmB,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,CAAC;IAEzC,OAAO;QACH,WAAW,EAAE,IAAI;QACjB,gBAAgB,EAAE,KAAK;QACvB,aAAa,EAAE,KAAK,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;KAC1E,CAAC;AACN,CAAC;AAED,SAAS,YAAY,CAAC,KAAyB;IAC3C,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IACvD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC3E,OAAO;QACH,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;QACrE,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;KACxE,CAAC;AACN,CAAC;AAED,SAAS,YAAY,CAAC,KAAyB;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,EAAE,0BAA0B,CAAC;IAC9D,uEAAuE;IACvE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IAE5G,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,EAAE,KAAK,MAAM;YAAE,IAAI,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QAC5C,IAAI,EAAE,KAAK,OAAO;YAAE,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9E,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IACzB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;AACzC,CAAC"}

package/dist/docker/docker.service.js

@@ -0,0 +1,335 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+var DockerService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DockerService = exports.ImagePullError = exports.DockerUnavailableError = void 0;
+exports.demuxDockerLog = demuxDockerLog;
+/**
+ * Docker orchestration.
+ *
+ * Wraps dockerode with the few operations the head lifecycle needs, plus
+ * preflight checks. v1 assumed the daemon was reachable and the image present;
+ * when either was false you got a raw ENOENT or a 404 from deep inside a
+ * container create. Here every failure is translated into an actionable message.
+ */
+const common_1 = require("@nestjs/common");
+const dockerode_1 = __importDefault(require("dockerode"));
+const node_stream_1 = require("node:stream");
+const shared_1 = require("@hexcore/shared");
+const config_module_1 = require("../config.module");
+const settings_1 = require("../settings");
+class DockerUnavailableError extends Error {
+    constructor(cause) {
+        /**
+         * The daemon's own words, and nothing else.
+         *
+         * This message is rendered in the UI, and it used to wrap the cause in a
+         * second pair of parentheses and then append both the macOS and the
+         * Linux remedy — around 250 characters of which most were wrong for
+         * whoever was reading them. Docker says why itself ("Docker Desktop is
+         * manually paused", "connect ENOENT ..."), so the remedy belongs where
+         * there is room for it: preflight adds a platform-specific hint, the UI
+         * banner says what is blocked.
+         */
+        super(`Cannot reach the Docker daemon: ${cause.replace(/\s+/g, ' ').trim()}`);
+        this.name = 'DockerUnavailableError';
+    }
+}
+exports.DockerUnavailableError = DockerUnavailableError;
+/**
+ * A pull that could not produce the image.
+ *
+ * Docker's own words name the *repository* and never the tag, so a reference
+ * with one character wrong ("aniadev" for "aniadev9") reports a repository the
+ * operator has never heard of and does not obviously match what they typed.
+ * Since the image is chosen once and only checked at the first start, that is
+ * exactly the moment they need to see their own string back.
+ */
+class ImagePullError extends Error {
+    constructor(image, cause) {
+        const said = cause.replace(/\s+/g, ' ').trim();
+        const missing = /pull access denied|repository does not exist|manifest unknown|not found/i.test(said);
+        super(missing
+            ? `Cannot pull "${image}". No such image in the registry, or it is private — check the ` +
+                `account and repository spelling and the tag, and that the image is public or the ` +
+                `Docker daemon is logged in. Docker said: ${said}`
+            : `Cannot pull "${image}". Docker said: ${said}`);
+        this.name = 'ImagePullError';
+    }
+}
+exports.ImagePullError = ImagePullError;
+let DockerService = DockerService_1 = class DockerService {
+    config;
+    logger = new common_1.Logger(DockerService_1.name);
+    docker;
+    constructor(config) {
+        this.config = config;
+        this.docker = new dockerode_1.default({ socketPath: config.dockerSocket });
+    }
+    async ping() {
+        try {
+            await this.docker.ping();
+        }
+        catch (err) {
+            throw new DockerUnavailableError(err.message);
+        }
+    }
+    async version() {
+        const v = (await this.docker.version());
+        return v.Version ?? 'unknown';
+    }
+    async hasImage(image) {
+        try {
+            await this.docker.getImage(image).inspect();
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Pull an image, streaming progress lines to onProgress. */
+    async pullImage(image, onProgress) {
+        const stream = (await this.docker.pull(image));
+        await new Promise((resolvePull, rejectPull) => {
+            this.docker.modem.followProgress(stream, (err) => (err ? rejectPull(err) : resolvePull()), (event) => {
+                if (onProgress && event.status) {
+                    onProgress(`${event.status}${event.progress ? ' ' + event.progress : ''}`);
+                }
+            });
+        });
+    }
+    async ensureImage(image, onProgress) {
+        if (await this.hasImage(image))
+            return;
+        this.logger.log(`pulling hydra-node image ${image} (first run only)`);
+        try {
+            await this.pullImage(image, onProgress);
+        }
+        catch (err) {
+            // A pull failure is about the reference, not about Docker being
+            // unreachable — say which image, since Docker will not.
+            throw new ImagePullError(image, err.message);
+        }
+    }
+    /** Create the shared user-defined bridge so nodes resolve each other by name. */
+    async ensureNetwork() {
+        const networks = await this.docker.listNetworks();
+        if (networks.some(n => n.Name === shared_1.DOCKER_NETWORK))
+            return;
+        await this.docker.createNetwork({ Name: shared_1.DOCKER_NETWORK, Driver: 'bridge' });
+        this.logger.log(`created docker network ${shared_1.DOCKER_NETWORK}`);
+    }
+    async removeContainer(name) {
+        try {
+            const container = this.docker.getContainer(name);
+            const info = await container.inspect();
+            if (info.State.Running)
+                await container.stop({ t: 10 }).catch(() => undefined);
+            await container.remove({ force: true });
+            this.logger.debug(`container ${name} removed`);
+        }
+        catch (err) {
+            const code = err.statusCode;
+            if (code !== 404)
+                this.logger.warn(`failed removing container ${name}: ${err.message}`);
+        }
+    }
+    async createAndStart(spec) {
+        // Always clear a stale container with the same name first: names are
+        // deterministic in v2, so a leftover from a crashed boot would
+        // otherwise make every subsequent start fail with 409 Conflict.
+        await this.removeContainer(spec.name);
+        const exposed = {};
+        const bindings = {};
+        for (const p of spec.ports) {
+            exposed[`${p}/tcp`] = {};
+            bindings[`${p}/tcp`] = [{ HostPort: String(p) }];
+        }
+        const container = await this.docker.createContainer({
+            name: spec.name,
+            Image: spec.image,
+            Cmd: spec.cmd,
+            Labels: { [shared_1.LABEL_MANAGED]: 'true', ...spec.labels },
+            Env: spec.env,
+            User: spec.user,
+            ExposedPorts: exposed,
+            HostConfig: {
+                NetworkMode: shared_1.DOCKER_NETWORK,
+                Binds: spec.binds,
+                PortBindings: bindings,
+                RestartPolicy: { Name: 'unless-stopped' },
+                ...(spec.logRotation
+                    ? {
+                        LogConfig: {
+                            Type: 'json-file',
+                            Config: {
+                                'max-size': `${spec.logRotation.maxSizeMb}m`,
+                                'max-file': String(spec.logRotation.maxFiles),
+                            },
+                        },
+                    }
+                    : {}),
+            },
+        });
+        await container.start();
+        this.logger.log(`container ${spec.name} started (${container.id.slice(0, 12)})`);
+        return container;
+    }
+    /** All containers this control-plane manages, optionally filtered by head. */
+    async listManaged(headId) {
+        const label = [`${shared_1.LABEL_MANAGED}=true`];
+        if (headId !== undefined)
+            label.push(`${shared_1.LABEL_HEAD_ID}=${headId}`);
+        return this.docker.listContainers({ all: true, filters: { label } });
+    }
+    async isRunning(name) {
+        try {
+            const info = await this.docker.getContainer(name).inspect();
+            return info.State.Running;
+        }
+        catch {
+            return false;
+        }
+    }
+    async restart(name) {
+        await this.docker.getContainer(name).restart();
+    }
+    /**
+     * Run a throwaway container and return its combined output.
+     *
+     * Used to ask an image what it supports (`--help`, `--version`) instead of
+     * maintaining a version→flags table that goes stale and cannot describe a
+     * fork or a `master` tag. The container is removed on exit; a non-zero exit
+     * is still a useful answer, since `--help` exits 1 on some builds, so the
+     * output is returned rather than treated as failure.
+     */
+    async runOnce(image, cmd, timeoutMs = 60_000) {
+        await this.ensureImage(image);
+        const chunks = [];
+        const sink = new node_stream_1.Writable({
+            write(chunk, _enc, done) {
+                chunks.push(chunk);
+                done();
+            },
+        });
+        const run = this.docker.run(image, cmd, sink, {
+            HostConfig: { AutoRemove: true, NetworkMode: 'none' },
+            Tty: false,
+        });
+        // dockerode's run() resolves only when the container exits; a hung
+        // image would otherwise stall boot indefinitely.
+        const timeout = new Promise((_, reject) => setTimeout(() => reject(new Error(`timed out after ${timeoutMs}ms`)), timeoutMs).unref?.());
+        try {
+            await Promise.race([run, timeout]);
+        }
+        catch (err) {
+            // Output collected before the failure is still worth returning:
+            // `--help` on some builds writes to stderr and exits non-zero.
+            if (chunks.length === 0)
+                throw err;
+        }
+        return demuxDockerLog(Buffer.concat(chunks));
+    }
+    /** Tail container logs — used by the UI log viewer. */
+    async logs(name, tail = 200) {
+        try {
+            const buf = (await this.docker.getContainer(name).logs({
+                stdout: true,
+                stderr: true,
+                tail,
+                timestamps: false,
+            }));
+            return demuxDockerLog(buf);
+        }
+        catch (err) {
+            const code = err.statusCode;
+            if (code === 404)
+                return '';
+            throw err;
+        }
+    }
+    /**
+     * One resource sample for a container, or null when it is not there.
+     *
+     * `stream: false` and NOT `one-shot`: Docker then takes two readings itself
+     * and returns the second with `precpu_stats` filled in, which is the only
+     * way a CPU percentage exists at all — see docker/container-stats.ts. The
+     * cost is that this call blocks for about a second inside the daemon, so it
+     * belongs on a request the operator asked for, never on a polling path that
+     * runs for every head.
+     */
+    async stats(name) {
+        try {
+            return await this.docker.getContainer(name).stats({ stream: false });
+        }
+        catch (err) {
+            const code = err.statusCode;
+            if (code === 404)
+                return null;
+            throw err;
+        }
+    }
+    /** Follow logs as a stream (websocket log tailing). */
+    async logStream(name, tail = 50) {
+        return (await this.docker.getContainer(name).logs({
+            stdout: true,
+            stderr: true,
+            tail,
+            follow: true,
+        }));
+    }
+    labelsFor(headId, nodeId, nodeIndex) {
+        return {
+            [shared_1.LABEL_HEAD_ID]: String(headId),
+            [shared_1.LABEL_NODE_ID]: String(nodeId),
+            [shared_1.LABEL_NODE_INDEX]: String(nodeIndex),
+            // Which installation owns this. See LABEL_INSTALL — without it a
+            // bulk operation cannot tell two Hexcores on one daemon apart.
+            [shared_1.LABEL_INSTALL]: this.installId,
+        };
+    }
+    /** This installation's id, derived from its state dir. */
+    get installId() {
+        return (0, settings_1.installId)(this.config.stateDir);
+    }
+};
+exports.DockerService = DockerService;
+exports.DockerService = DockerService = DockerService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(config_module_1.APP_CONFIG)),
+    __metadata("design:paramtypes", [Object])
+], DockerService);
+/**
+ * Docker multiplexes stdout/stderr into 8-byte-framed chunks when the container
+ * has no TTY. Strip the frames so the UI shows clean lines.
+ */
+function demuxDockerLog(buf) {
+    const out = [];
+    let offset = 0;
+    while (offset + 8 <= buf.length) {
+        const type = buf[offset];
+        // A valid frame header starts with stream type 0/1/2 and 3 zero bytes.
+        if (type > 2 || buf[offset + 1] !== 0 || buf[offset + 2] !== 0 || buf[offset + 3] !== 0) {
+            return buf.toString('utf8');
+        }
+        const len = buf.readUInt32BE(offset + 4);
+        out.push(buf.toString('utf8', offset + 8, offset + 8 + len));
+        offset += 8 + len;
+    }
+    return out.join('');
+}
+//# sourceMappingURL=docker.service.js.map

package/dist/docker/docker.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker.service.js","sourceRoot":"","sources":["../../src/docker/docker.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAoVA,wCAcC;AAlWD;;;;;;;GAOG;AACH,2CAA4D;AAC5D,0DAA+B;AAC/B,6CAAsD;AACtD,4CAOyB;AACzB,oDAA8C;AAE9C,0CAAwC;AAExC,MAAa,sBAAuB,SAAQ,KAAK;IAC7C,YAAY,KAAa;QACrB;;;;;;;;;;WAUG;QACH,KAAK,CAAC,mCAAmC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACzC,CAAC;CACJ;AAhBD,wDAgBC;AAED;;;;;;;;GAQG;AACH,MAAa,cAAe,SAAQ,KAAK;IACrC,YAAY,KAAa,EAAE,KAAa;QACpC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,0EAA0E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtG,KAAK,CACD,OAAO;YACH,CAAC,CAAC,gBAAgB,KAAK,iEAAiE;gBAClF,mFAAmF;gBACnF,4CAA4C,IAAI,EAAE;YACxD,CAAC,CAAC,gBAAgB,KAAK,mBAAmB,IAAI,EAAE,CACvD,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IACjC,CAAC;CACJ;AAbD,wCAaC;AAuBM,IAAM,aAAa,qBAAnB,MAAM,aAAa;IAI2B;IAHhC,MAAM,GAAG,IAAI,eAAM,CAAC,eAAa,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,CAAS;IAEhC,YAAiD,MAAiB;QAAjB,WAAM,GAAN,MAAM,CAAW;QAC9D,IAAI,CAAC,MAAM,GAAG,IAAI,mBAAM,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,IAAI;QACN,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,IAAI,sBAAsB,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;QAC7D,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO;QACT,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAyB,CAAC;QAChE,OAAO,CAAC,CAAC,OAAO,IAAI,SAAS,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAa;QACxB,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAED,6DAA6D;IAC7D,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,UAAmC;QAC9D,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAa,CAAC;QAC3D,MAAM,IAAI,OAAO,CAAO,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE;YAChD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAC5B,MAAM,EACN,CAAC,GAAiB,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,EAC9D,CAAC,KAA6C,EAAE,EAAE;gBAC9C,IAAI,UAAU,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBAC7B,UAAU,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC/E,CAAC;YACL,CAAC,CACJ,CAAC;QACN,CAAC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,UAAmC;QAChE,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO;QACvC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,KAAK,mBAAmB,CAAC,CAAC;QACtE,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,gEAAgE;YAChE,wDAAwD;YACxD,MAAM,IAAI,cAAc,CAAC,KAAK,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QAC5D,CAAC;IACL,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,aAAa;QACf,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAClD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,uBAAc,CAAC;YAAE,OAAO;QAC1D,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,uBAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B,uBAAc,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,IAAY;QAC9B,IAAI,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO;gBAAE,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC/E,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,UAAU,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,IAAI,GAAI,GAA+B,CAAC,UAAU,CAAC;YACzD,IAAI,IAAI,KAAK,GAAG;gBAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACvG,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,IAAmB;QACpC,qEAAqE;QACrE,+DAA+D;QAC/D,gEAAgE;QAChE,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEtC,MAAM,OAAO,GAA0C,EAAE,CAAC;QAC1D,MAAM,QAAQ,GAAgD,EAAE,CAAC;QACjE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YACzB,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;YAChD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,MAAM,EAAE,EAAE,CAAC,sBAAa,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE;YACnD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY,EAAE,OAAO;YACrB,UAAU,EAAE;gBACR,WAAW,EAAE,uBAAc;gBAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,YAAY,EAAE,QAAQ;gBACtB,aAAa,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;gBACzC,GAAG,CAAC,IAAI,CAAC,WAAW;oBAChB,CAAC,CAAC;wBACI,SAAS,EAAE;4BACP,IAAI,EAAE,WAAW;4BACjB,MAAM,EAAE;gCACJ,UAAU,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,GAAG;gCAC5C,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;6BAChD;yBACJ;qBACJ;oBACH,CAAC,CAAC,EAAE,CAAC;aACZ;SACJ,CAAC,CAAC;QAEH,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,IAAI,aAAa,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QACjF,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,WAAW,CAAC,MAAe;QAC7B,MAAM,KAAK,GAAG,CAAC,GAAG,sBAAa,OAAO,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,sBAAa,IAAI,MAAM,EAAE,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAY;QACxB,IAAI,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC5D,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY;QACtB,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;IACnD,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,GAAa,EAAE,SAAS,GAAG,MAAM;QAC1D,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAE9B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,sBAAQ,CAAC;YACtB,KAAK,CAAC,KAAa,EAAE,IAAI,EAAE,IAAI;gBAC3B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,IAAI,EAAE,CAAC;YACX,CAAC;SACJ,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE;YAC1C,UAAU,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE;YACrD,GAAG,EAAE,KAAK;SACb,CAAC,CAAC;QAEH,mEAAmE;QACnE,iDAAiD;QACjD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC7C,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,SAAS,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAC7F,CAAC;QAEF,IAAI,CAAC;YACD,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,gEAAgE;YAChE,+DAA+D;YAC/D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,GAAG,CAAC;QACvC,CAAC;QAED,OAAO,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,uDAAuD;IACvD,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,IAAI,GAAG,GAAG;QAC/B,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;gBACnD,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,IAAI;gBACZ,IAAI;gBACJ,UAAU,EAAE,KAAK;aACpB,CAAC,CAAsB,CAAC;YACzB,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,IAAI,GAAI,GAA+B,CAAC,UAAU,CAAC;YACzD,IAAI,IAAI,KAAK,GAAG;gBAAE,OAAO,EAAE,CAAC;YAC5B,MAAM,GAAG,CAAC;QACd,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,KAAK,CAAC,IAAY;QACpB,IAAI,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,IAAI,GAAI,GAA+B,CAAC,UAAU,CAAC;YACzD,IAAI,IAAI,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC9B,MAAM,GAAG,CAAC;QACd,CAAC;IACL,CAAC;IAED,uDAAuD;IACvD,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,IAAI,GAAG,EAAE;QACnC,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;YAC9C,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,IAAI;YACZ,IAAI;YACJ,MAAM,EAAE,IAAI;SACf,CAAC,CAAwB,CAAC;IAC/B,CAAC;IAED,SAAS,CAAC,MAAc,EAAE,MAAc,EAAE,SAAiB;QACvD,OAAO;YACH,CAAC,sBAAa,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;YAC/B,CAAC,sBAAa,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;YAC/B,CAAC,yBAAgB,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC;YACrC,iEAAiE;YACjE,+DAA+D;YAC/D,CAAC,sBAAa,CAAC,EAAE,IAAI,CAAC,SAAS;SAClC,CAAC;IACN,CAAC;IAED,0DAA0D;IAC1D,IAAI,SAAS;QACT,OAAO,IAAA,oBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;CACJ,CAAA;AAxPY,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAU,GAAE;IAKI,WAAA,IAAA,eAAM,EAAC,0BAAU,CAAC,CAAA;;GAJtB,aAAa,CAwPzB;AAED;;;GAGG;AACH,SAAgB,cAAc,CAAC,GAAW;IACtC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QACzB,uEAAuE;QACvE,IAAI,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACtF,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,GAAG,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxB,CAAC"}

package/dist/hydra/argv.js

@@ -0,0 +1,172 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isOffline = isOffline;
+exports.backendArgs = backendArgs;
+exports.scriptArgs = scriptArgs;
+exports.buildNodeArgv = buildNodeArgv;
+/**
+ * hydra-node argv construction.
+ *
+ * Pure functions so the exact flags a head boots with can be asserted in tests
+ * without Docker, a Blockfrost key, or a running Nest app. Getting these wrong
+ * is expensive: an unknown or conflicting flag aborts hydra-node during option
+ * parsing, the container dies instantly, and the head reports a generic
+ * "node never became ready" that points nowhere near the real cause.
+ */
+const shared_1 = require("@hexcore/shared");
+const keys_1 = require("./keys");
+/** True for heads whose layer-1 interface is disabled entirely. See offline.ts. */
+function isOffline(head) {
+    return head.chain_backend === 'offline';
+}
+/**
+ * Chain backend flags.
+ *
+ * The backends are mutually exclusive in hydra-node's option parser:
+ * --blockfrost cannot be combined with --testnet-magic / --node-socket.
+ */
+function backendArgs(head, nodeIndex, opts) {
+    const cp = (0, shared_1.containerHeadPaths)(head.id);
+    /**
+     * Offline mode is a different branch of the option parser, not a variant of
+     * the online backends: no network magic, no socket, no Blockfrost, no
+     * scripts. `--initial-utxo` is the L2 ledger's whole starting state.
+     *
+     * `--ledger-genesis` is emitted only when a genesis file was actually
+     * written. hydra-node's own default is to have none, and pointing the flag
+     * at a missing file is a hard startup failure.
+     */
+    if (isOffline(head)) {
+        const args = ['--offline-head-seed', head.offline_head_seed || (0, shared_1.defaultOfflineHeadSeed)(head.id)];
+        args.push('--initial-utxo', cp.initialUtxo);
+        if (head.offline_ledger_genesis)
+            args.push('--ledger-genesis', cp.ledgerGenesis);
+        return args;
+    }
+    if (head.chain_backend === 'cardano-node') {
+        return [...(0, keys_1.networkArgs)(head.network), '--node-socket', '/cardano-node/node.socket'];
+    }
+    /**
+     * Each node reads its own token file. hydra-node takes a path, not a key,
+     * so per-node keys can only be expressed as per-node files — and pointing
+     * every node at one shared file would silently put N nodes on a single
+     * Blockfrost rate-limit budget.
+     */
+    const args = ['--blockfrost', cp.nodeBlockfrostToken(nodeIndex)];
+    /**
+     * Blockfrost polls over HTTP rather than following the chain, so a node's
+     * tip lags — upstream measured 50-80s on preprod against ~0s for a local
+     * socket. hydra-node defaults --unsynced-period to HALF the contestation
+     * period, so a common 120s contestation yields 60s, squarely inside that
+     * drift band.
+     *
+     * The consequence is not cosmetic: past the unsynced period hydra-node
+     * stops signing snapshots AND rejects client input, so a deposit can
+     * silently expire unsigned while the head looks healthy.
+     *
+     * Raise it only when the node's own default would be tighter, and never
+     * lower a value the operator deliberately set higher.
+     */
+    if (opts.caps.unsyncedPeriod) {
+        const nodeDefault = Math.floor(head.contestation_period / 2);
+        args.push('--unsynced-period', `${Math.max(opts.unsyncedPeriod, nodeDefault)}s`);
+    }
+    if (opts.caps.blockfrostTimeouts) {
+        args.push('--blockfrost-query-timeout', String(opts.blockfrostQueryTimeout), '--blockfrost-retry-timeout', String(opts.blockfrostRetryTimeout));
+    }
+    return args;
+}
+/**
+ * Script selection.
+ *
+ * An explicit tx id wins; otherwise --network picks the last pre-published
+ * scripts for that network, which is what lets a head boot with no setup. The
+ * two are mutually exclusive, and older images may support neither.
+ */
+function scriptArgs(head, opts) {
+    // Offline heads never touch a chain, so there are no on-chain scripts to
+    // select. Both flags belong to the online branch and would abort parsing.
+    if (isOffline(head))
+        return [];
+    if (opts.hydraScriptsTxId)
+        return ['--hydra-scripts-tx-id', opts.hydraScriptsTxId];
+    return opts.caps.network ? ['--network', head.network] : [];
+}
+/**
+ * Full argv for one node. Peers are addressed by container name on the shared
+ * bridge network, so a head behaves identically on a laptop and on a server
+ * without host-network workarounds.
+ */
+function buildNodeArgv(head, node, peers, opts) {
+    const cp = (0, shared_1.containerHeadPaths)(head.id);
+    const self = cp.nodeKeys(node.node_index);
+    const offline = isOffline(head);
+    /**
+     * Peer wiring works in both modes, but not identically.
+     *
+     * `--peer` and `--hydra-verification-key` sit OUTSIDE hydra-node's
+     * chain-config group, so an offline head forms a multi-party Head over the
+     * same network layer as an online one. `--cardano-verification-key` does
+     * not: it is inside the online branch, and passing it alongside
+     * `--offline-head-seed` aborts option parsing. It is dropped rather than
+     * substituted, because offline peers authorise nothing on chain.
+     */
+    const peerArgs = peers.flatMap(peer => {
+        const pk = cp.nodeKeys(peer.node_index);
+        return [
+            '--peer',
+            `${peer.name}:${peer.p2p_port}`,
+            '--hydra-verification-key',
+            pk.hydraVk,
+            ...(offline ? [] : ['--cardano-verification-key', pk.cardanoVk]),
+        ];
+    });
+    return [
+        // --quiet is a top-level flag; keeping it first also keeps it clear of
+        // the mutually exclusive backend groups below.
+        ...(head.log_quiet ? ['--quiet'] : []),
+        '--node-id',
+        node.name,
+        '--listen',
+        `0.0.0.0:${node.p2p_port}`,
+        '--advertise',
+        `${node.name}:${node.p2p_port}`,
+        '--api-host',
+        '0.0.0.0',
+        '--api-port',
+        String(node.api_port),
+        '--monitoring-port',
+        String(node.monitoring_port),
+        '--hydra-signing-key',
+        self.hydraSk,
+        /**
+         * Everything below the Hydra key belongs to the online branch of the
+         * option parser.
+         *
+         * The Cardano key authorises on-chain Hydra transactions and pays their
+         * fuel; the two periods bound on-chain close and deposit deadlines.
+         * Offline mode has no chain for any of it, and hydra-node rejects the
+         * flags outright rather than ignoring them — which is why they are
+         * dropped here instead of being passed with harmless values.
+         */
+        ...(offline ? [] : ['--cardano-signing-key', self.cardanoSk]),
+        '--persistence-dir',
+        cp.nodePersistence(node.node_index),
+        '--persistence-rotate-after',
+        String(head.persistence_rotate_after),
+        ...(offline
+            ? []
+            : ['--contestation-period', `${head.contestation_period}s`, '--deposit-period', `${head.deposit_period}s`]),
+        '--ledger-protocol-parameters',
+        cp.protocolParameters,
+        ...peerArgs,
+        ...scriptArgs(head, opts),
+        ...backendArgs(head, node.node_index, opts),
+        // Appended, never merged: these must be flags nothing above emits.
+        // hydra-node's parser rejects a repeated option rather than letting the
+        // last one win, so a duplicate here kills the container at startup —
+        // hence the test asserting no profile collides with the base argv.
+        ...(opts.extraArgs ?? []),
+    ];
+}
+//# sourceMappingURL=argv.js.map