@wpelevator/tug 0.2.0 → 0.3.0

package/dist/mesh.js

@@ -17,7 +17,11 @@ export const isWgKey = (value) => typeof value === 'string' && WG_KEY_RE.test(va
 const PKCS8_X25519_PREFIX = Buffer.from('302e020100300506032b656e04220420', 'hex');
 /** Public key for a base64 private key (X25519, as `wg pubkey` computes it). */
 export function publicKeyFromPrivate(privateKey) {
-    const key = crypto.createPrivateKey({ key: Buffer.concat([PKCS8_X25519_PREFIX, Buffer.from(privateKey, 'base64')]), format: 'der', type: 'pkcs8' });
+    const key = crypto.createPrivateKey({
+        key: Buffer.concat([PKCS8_X25519_PREFIX, Buffer.from(privateKey, 'base64')]),
+        format: 'der',
+        type: 'pkcs8',
+    });
     const jwk = crypto.createPublicKey(key).export({ format: 'jwk' });
     return Buffer.from(jwk.x, 'base64url').toString('base64');
 }
@@ -35,13 +39,17 @@ export async function ensureWgKeys(stateDir) {
         if (isWgKey(privateKey))
             return { privateKey, publicKey: publicKeyFromPrivate(privateKey) };
     }
-    catch { /* first boot */ }
+    catch {
+        /* first boot */
+    }
     return rotateWgKeys(stateDir);
 }
 export async function rotateWgKeys(stateDir) {
     const pair = generateWgKeyPair();
     await ensureDir(wgDir(stateDir));
-    await fs.writeFile(path.join(wgDir(stateDir), 'private.key'), `${pair.privateKey}\n`, { mode: 0o600 });
+    await fs.writeFile(path.join(wgDir(stateDir), 'private.key'), `${pair.privateKey}\n`, {
+        mode: 0o600,
+    });
     return pair;
 }
 /** The public key control last accepted, so the agent only re-reports when it changed. */
@@ -60,7 +68,7 @@ export async function writeReportedKey(stateDir, publicKey) {
 // ---- Overlay addressing (control) --------------------------------------------------------------
 export function ipToInt(ip) {
     const parts = ip.split('.').map(Number);
-    if (parts.length !== 4 || parts.some(p => !Number.isInteger(p) || p < 0 || p > 255))
+    if (parts.length !== 4 || parts.some((p) => !Number.isInteger(p) || p < 0 || p > 255))
         throw new Error(`invalid IPv4 address ${ip}`);
     return ((parts[0] << 24) | (parts[1] << 16) | (parts[2] << 8) | parts[3]) >>> 0;
 }
@@ -68,7 +76,11 @@ export const intToIp = (n) => [n >>> 24, (n >>> 16) & 255, (n >>> 8) & 255, n &
 export function parseCidr(cidr) {
     const [ip, bits, extra] = cidr.split('/');
     const prefix = Number(bits);
-    if (extra !== undefined || bits === undefined || !Number.isInteger(prefix) || prefix < 8 || prefix > 29)
+    if (extra !== undefined ||
+        bits === undefined ||
+        !Number.isInteger(prefix) ||
+        prefix < 8 ||
+        prefix > 29)
         throw new Error(`invalid mesh CIDR ${cidr} (IPv4, prefix /8 to /29)`);
     const size = 2 ** (32 - prefix);
     const base = (ipToInt(ip) & ~(size - 1)) >>> 0;
@@ -114,28 +126,30 @@ export function parseWgDump(dump) {
     return {
         publicKey: h[1] || '',
         listenPort: Number(h[2]) || 0,
-        peers: rest.map(line => {
+        peers: rest.map((line) => {
             const f = line.split('\t');
             return {
                 publicKey: f[0],
                 endpoint: f[2] && f[2] !== '(none)' ? f[2] : undefined,
                 allowedIps: f[3] && f[3] !== '(none)' ? f[3].split(',') : [],
-                keepalive: f[7] && f[7] !== 'off' ? Number(f[7]) : 0
+                keepalive: f[7] && f[7] !== 'off' ? Number(f[7]) : 0,
             };
-        })
+        }),
     };
 }
 /** Compares desired peers with what `wg` reports. A desired endpoint is authoritative; a peer without one keeps whatever it roamed to. */
 export function diffPeers(desired, applied) {
-    const have = new Map(applied.map(p => [p.publicKey, p]));
-    const want = new Map(desired.map(p => [p.publicKey, p]));
+    const have = new Map(applied.map((p) => [p.publicKey, p]));
+    const want = new Map(desired.map((p) => [p.publicKey, p]));
     const sameSet = (a, b) => a.length === b.length && [...a].sort().every((v, i) => v === [...b].sort()[i]);
     const diff = { add: [], remove: [], update: [] };
     for (const [key, peer] of want) {
         const cur = have.get(key);
         if (!cur)
             diff.add.push(key);
-        else if (!sameSet(peer.allowedIps, cur.allowedIps) || peer.persistentKeepalive !== cur.keepalive || (peer.endpoint && peer.endpoint !== cur.endpoint))
+        else if (!sameSet(peer.allowedIps, cur.allowedIps) ||
+            peer.persistentKeepalive !== cur.keepalive ||
+            (peer.endpoint && peer.endpoint !== cur.endpoint))
             diff.update.push(key);
     }
     for (const key of have.keys())
@@ -172,11 +186,16 @@ export async function reconcileMesh(host, stateDir, network) {
         }
     }
     const diff = diffPeers(network.peers, applied.peers);
-    const synced = created || applied.publicKey !== publicKey || applied.listenPort !== network.listenPort || diff.add.length + diff.remove.length + diff.update.length > 0;
+    const synced = created ||
+        applied.publicKey !== publicKey ||
+        applied.listenPort !== network.listenPort ||
+        diff.add.length + diff.remove.length + diff.update.length > 0;
     if (synced) {
         const file = path.join(wgDir(stateDir), `${iface}.conf`);
         await ensureDir(wgDir(stateDir));
-        await fs.writeFile(file, renderWgConfig(privateKey, network.listenPort, network.peers), { mode: 0o600 });
+        await fs.writeFile(file, renderWgConfig(privateKey, network.listenPort, network.peers), {
+            mode: 0o600,
+        });
         await host('wg', ['syncconf', iface, file]);
     }
     return { created, synced, diff };

package/dist/protocol.d.ts

@@ -1,5 +1,7 @@
 export interface Placement {
     nodes?: string[];
+    labels?: string[];
+    global?: boolean;
 }
 export interface HealthCheck {
     type: 'docker' | 'tcp' | 'http';
@@ -33,6 +35,7 @@ export interface RolloutSpec {
 export interface ServiceExtension {
     placement?: Placement;
     replicas?: number;
+    global?: boolean;
     health?: HealthCheck;
     ingress?: IngressSpec;
     rollout?: RolloutSpec;
@@ -48,6 +51,10 @@ export interface VolumeExtension {
     driver?: string;
     persistent?: boolean;
     placement?: Placement;
+    /** NFS exporter address; control fills in the exporter's overlay IP (or node address) at deploy time. */
+    address?: string;
+    /** Directory exported by the NFS server on the exporter node (default `/srv/tug/<volume>`). */
+    export?: string;
 }
 export type BuildConfig = string | {
     context?: string;
@@ -141,12 +148,14 @@ export interface Command {
     created_at?: string;
     updated_at?: string;
 }
+/** One diagnostic result; `warning` flags something to look at that does not fail the check. */
 export interface DiagnosticCheck {
     name: string;
     ok: boolean;
     stdout?: string;
     stderr?: string;
     error?: string;
+    warning?: string;
 }
 export type CommandResultPayload = {
     checks: DiagnosticCheck[];
@@ -172,6 +181,138 @@ export interface CommandResult {
     state: 'succeeded' | 'failed';
     result: CommandResultPayload;
 }
+/**
+ * Messages sent by control over the agent-initiated WebSocket. The stream is authenticated during the HTTP
+ * upgrade, so credentials never appear in the URL or a message. A wake is only a hint: the agent fetches the
+ * authoritative state from `/agent/v1/work` and continues periodic polling if notifications are lost.
+ */
+export type StreamMessage = {
+    type: 'ready';
+    nodeId: string;
+    cursor: number;
+} | {
+    type: 'work-available';
+    cursor: number;
+    project?: string;
+};
+/** Live operations always resolve their project/service placement on control before reaching an agent. */
+export type LiveRequest = {
+    operation: 'exec';
+    project: string;
+    service: string;
+    node?: string;
+    command: string[];
+    interactive: boolean;
+    tty: boolean;
+    columns?: number;
+    rows?: number;
+} | {
+    operation: 'logs';
+    project: string;
+    service: string;
+    node?: string;
+    follow: true;
+    tail: number;
+} | {
+    operation: 'ps';
+    project: string;
+    node?: string;
+} | {
+    operation: 'inspect';
+    project: string;
+    service: string;
+    node?: string;
+};
+export declare const LIVE_MAX_FRAME_BYTES: number;
+export declare const LIVE_MAX_BUFFERED_BYTES: number;
+export declare const LIVE_MAX_SESSIONS = 64;
+export declare const LIVE_START_TIMEOUT_MS = 10000;
+export type LiveInput = {
+    v: 1;
+    type: 'live.stdin';
+    data: string;
+} | {
+    v: 1;
+    type: 'live.stdin-end';
+} | {
+    v: 1;
+    type: 'live.resize';
+    columns: number;
+    rows: number;
+} | {
+    v: 1;
+    type: 'live.cancel';
+};
+export type OperatorLiveFrame = {
+    v: 1;
+    type: 'live.open';
+    request: LiveRequest;
+} | LiveInput;
+export type AgentLiveCommand = {
+    v: 1;
+    type: 'live.open';
+    sessionId: string;
+    request: LiveRequest;
+} | (LiveInput & {
+    sessionId: string;
+});
+export type AgentLiveFrame = {
+    v: 1;
+    type: 'live.started';
+    sessionId: string;
+} | {
+    v: 1;
+    type: 'live.output';
+    sessionId: string;
+    stream: 'stdout' | 'stderr';
+    data: string;
+} | {
+    v: 1;
+    type: 'live.result';
+    sessionId: string;
+    result: unknown;
+} | {
+    v: 1;
+    type: 'live.exit';
+    sessionId: string;
+    code: number | null;
+    signal: string | null;
+    cancelled: boolean;
+    error?: string;
+};
+export type OperatorLiveMessage = {
+    v: 1;
+    type: 'live.started';
+    sessionId: string;
+    node: string;
+} | {
+    v: 1;
+    type: 'live.output';
+    sessionId: string;
+    stream: 'stdout' | 'stderr';
+    data: string;
+} | {
+    v: 1;
+    type: 'live.result';
+    sessionId: string;
+    value: unknown;
+} | {
+    v: 1;
+    type: 'live.exit';
+    sessionId: string;
+    code: number;
+} | {
+    v: 1;
+    type: 'live.error';
+    sessionId?: string;
+    message: string;
+};
+/** Response from the long-poll fallback used when a WebSocket cannot be established. */
+export type WakeResponse = {
+    type: 'work-available' | 'timeout';
+    cursor: number;
+    project?: string;
+};
 export interface WorkResponse {
     serverTime: string;
     nodeId: string;
@@ -184,6 +325,18 @@ export interface WorkResponse {
     serviceEndpoints?: ServiceEndpoints;
     /** Edge proxy config; present only for nodes marked as ingress nodes. */
     ingress?: IngressWork;
+    /** Host addresses for published ports that name no host IP. */
+    ports?: PortBinding;
+}
+/**
+ * Where a node's published ports listen when a `ports` entry names no host IP. Entries with an
+ * explicit host IP (including `0.0.0.0`) are never changed.
+ */
+export interface PortBinding {
+    /** The node's overlay IP with the mesh, otherwise its `address` (an IP or a hostname the agent resolves); null binds to `127.0.0.1`. */
+    address: string | null;
+    /** Per project, services whose ingress port only the managed Caddy on this node dials; that port binds to `127.0.0.1`. */
+    loopback: Record<string, string[]>;
 }
 export interface WgPeer {
     node: string;
@@ -285,6 +438,7 @@ export interface NodeInfo {
     address: string | null;
     public_address: string | null;
     overlay_ip?: string | null;
+    labels?: string[];
     status: string;
     created_at: string;
     updated_at: string;
@@ -303,6 +457,8 @@ export interface EnrollRequest {
     publicAddress?: string;
     /** Base64 WireGuard public key; the private key never leaves the node. */
     wgPublicKey?: string;
+    /** Node labels (tags) used for label-based placement. */
+    labels?: string[];
 }
 /** Response of `POST /agent/v1/enroll`. */
 export interface EnrollResponse extends RegisterResponse {
@@ -323,4 +479,6 @@ export interface JoinKey {
     enrollToken: string;
     /** PEM CA certificate to trust for a private/self-signed control plane. */
     ca?: string;
+    /** Node labels to register at enrollment. */
+    labels?: string[];
 }

package/dist/protocol.js

@@ -3,6 +3,20 @@
 // control.ts, agent.ts, compose.ts and cli.ts all import from here.
 // ---- Deployments -------------------------------------------------------------------------------
 /** Deployment states during which a project is considered busy. */
-export const ACTIVE_DEPLOYMENT_STATES = ['uploading', 'building', 'pending_dependencies', 'rolling_out'];
+export const ACTIVE_DEPLOYMENT_STATES = [
+    'uploading',
+    'building',
+    'pending_dependencies',
+    'rolling_out',
+];
 /** Deployment states a CLI wait loop stops on. */
-export const TERMINAL_DEPLOYMENT_STATES = ['succeeded', 'failed', 'build_failed', 'cancelled'];
+export const TERMINAL_DEPLOYMENT_STATES = [
+    'succeeded',
+    'failed',
+    'build_failed',
+    'cancelled',
+];
+export const LIVE_MAX_FRAME_BYTES = 256 * 1024;
+export const LIVE_MAX_BUFFERED_BYTES = 1024 * 1024;
+export const LIVE_MAX_SESSIONS = 64;
+export const LIVE_START_TIMEOUT_MS = 10_000;

package/dist/rollout.js

@@ -27,7 +27,7 @@ export function revisionProject(project, service, hash) {
 }
 /** Returns `ports` with the host side of its (single) published entry replaced by `port`. */
 export function remapPublishedPort(ports, port) {
-    return ports.map(entry => {
+    return ports.map((entry) => {
         if (typeof entry === 'number')
             return entry;
         if (typeof entry === 'object')
@@ -44,7 +44,11 @@ export function remapPublishedPort(ports, port) {
 export function serviceRevisionHash(desired, rendered, service, secretVersions = {}) {
     const artifact = desired.services[service]?.artifact;
     const definition = { ...rendered, image: artifact?.imageId ?? rendered.image };
-    return crypto.createHash('sha256').update(JSON.stringify({ definition, secretVersions })).digest('hex').slice(0, 16);
+    return crypto
+        .createHash('sha256')
+        .update(JSON.stringify({ definition, secretVersions }))
+        .digest('hex')
+        .slice(0, 16);
 }
 /** The Compose file of one rolling revision: the service alone, on the main project's network and volumes. */
 export function rollingCompose(full, project, service, port) {
@@ -52,7 +56,10 @@ export function rollingCompose(full, project, service, port) {
     delete svc.depends_on;
     if (port !== null && svc.ports)
         svc.ports = remapPublishedPort(svc.ports, port);
-    const out = { services: { [service]: svc }, networks: { default: { name: `${project}_default`, external: true } } };
+    const out = {
+        services: { [service]: svc },
+        networks: { default: { name: `${project}_default`, external: true } },
+    };
     const volumes = {};
     for (const mount of svc.volumes || []) {
         const source = typeof mount === 'string' ? mount.split(':')[0] : mount.source;
@@ -60,7 +67,8 @@ export function rollingCompose(full, project, service, port) {
         if (!source || !def)
             continue;
         // Named volumes keep the data the main project would use; explicit `name` / `external` volumes already do.
-        volumes[source] = def.external || def.name ? def : { ...def, external: true, name: `${project}_${source}` };
+        volumes[source] =
+            def.external || def.name ? def : { ...def, external: true, name: `${project}_${source}` };
     }
     if (Object.keys(volumes).length)
         out.volumes = volumes;
@@ -89,7 +97,11 @@ export function composeBase(project, dir, file) {
     return ['compose', '-p', project, '--project-directory', dir, '-f', file];
 }
 async function containerIds(ctx, project, service) {
-    const filters = ['--filter', `label=${LABEL_PROJECT}=${project}`, ...(service ? ['--filter', `label=${LABEL_SERVICE}=${service}`] : [])];
+    const filters = [
+        '--filter',
+        `label=${LABEL_PROJECT}=${project}`,
+        ...(service ? ['--filter', `label=${LABEL_SERVICE}=${service}`] : []),
+    ];
     return (await ctx.docker(['ps', '-aq', ...filters])).out.split(/\s+/).filter(Boolean);
 }
 /** Stops and removes every container of a revision project (or of one service of the main project). */
@@ -104,7 +116,17 @@ async function removeRevision(ctx, dir, project, service) {
 }
 async function ensureSharedResources(ctx, project, services, full) {
     const network = `${project}_default`;
-    await ctx.docker(['network', 'inspect', network]).catch(() => ctx.docker(['network', 'create', '--label', `${LABEL_PROJECT}=${project}`, '--label', 'com.docker.compose.network=default', network]));
+    await ctx
+        .docker(['network', 'inspect', network])
+        .catch(() => ctx.docker([
+        'network',
+        'create',
+        '--label',
+        `${LABEL_PROJECT}=${project}`,
+        '--label',
+        'com.docker.compose.network=default',
+        network,
+    ]));
     const created = new Set();
     for (const service of services) {
         for (const mount of full.services[service].volumes || []) {
@@ -114,14 +136,24 @@ async function ensureSharedResources(ctx, project, services, full) {
                 continue;
             created.add(source);
             const opts = Object.entries(def.driver_opts || {}).flatMap(([k, v]) => ['--opt', `${k}=${v}`]);
-            await ctx.docker(['volume', 'create', ...(def.driver ? ['--driver', String(def.driver)] : []), ...opts, '--label', `${LABEL_PROJECT}=${project}`, '--label', `com.docker.compose.volume=${source}`, `${project}_${source}`]);
+            await ctx.docker([
+                'volume',
+                'create',
+                ...(def.driver ? ['--driver', String(def.driver)] : []),
+                ...opts,
+                '--label',
+                `${LABEL_PROJECT}=${project}`,
+                '--label',
+                `com.docker.compose.volume=${source}`,
+                `${project}_${source}`,
+            ]);
         }
     }
 }
 /** Host ports already published by running containers (`0.0.0.0:20001->80/tcp, [::]:20001->80/tcp`). */
 async function publishedHostPorts(ctx) {
     const out = (await ctx.docker(['ps', '--format', '{{.Ports}}'])).out;
-    return new Set([...out.matchAll(/:(\d+)(?:-(\d+))?->/g)].flatMap(m => {
+    return new Set([...out.matchAll(/:(\d+)(?:-(\d+))?->/g)].flatMap((m) => {
         const lo = Number(m[1]);
         const hi = Number(m[2] || m[1]);
         return Array.from({ length: Math.min(hi - lo + 1, 1000) }, (_, i) => lo + i);
@@ -133,7 +165,7 @@ async function allocatePort(ctx, known, exclude) {
     for (const port of [...known, ...exclude])
         busy.add(port);
     // Start after the newest port in use so a just-released port is not reused straight away.
-    const last = Math.max(lo - 1, ...known.filter(p => p >= lo && p <= hi));
+    const last = Math.max(lo - 1, ...known.filter((p) => p >= lo && p <= hi));
     const size = hi - lo + 1;
     for (let i = 0; i < size; i++) {
         const port = lo + ((last + 1 - lo + i) % size);
@@ -144,7 +176,14 @@ async function allocatePort(ctx, known, exclude) {
 }
 const PORT_CONFLICT = /port is already allocated|address already in use|bind for .* failed/i;
 function servingState(rev, extra = {}) {
-    return { rolloutState: 'serving', image: rev.image, healthyAt: now(), ...(rev.legacy ? {} : { port: rev.port }), rolloutRevision: rev.hash, ...extra };
+    return {
+        rolloutState: 'serving',
+        image: rev.image,
+        healthyAt: now(),
+        ...(rev.legacy ? {} : { port: rev.port }),
+        rolloutRevision: rev.hash,
+        ...extra,
+    };
 }
 /** True when containers of `services` still run in the main project from before they became rolling. */
 export async function hasLegacyContainers(ctx, project, services) {
@@ -153,7 +192,9 @@ export async function hasLegacyContainers(ctx, project, services) {
             return true;
     return false;
 }
-export function isRollingService(desired, service) { return isRolling(desired.compose.services[service]); }
+export function isRollingService(desired, service) {
+    return isRolling(desired.compose.services[service]);
+}
 export async function reconcileRolling(ctx, input) {
     const { desired, dir, services, full, deps } = input;
     const project = desired.project;
@@ -164,7 +205,7 @@ export async function reconcileRolling(ctx, input) {
     await retireRevisions(ctx, dir, state, desired, new Set(services), deps);
     await ensureSharedResources(ctx, project, services, full);
     for (const service of services) {
-        const rollout = state.services[service] ||= { draining: [] };
+        const rollout = (state.services[service] ||= { draining: [] });
         const spec = desired.compose.services[service];
         const declaredPort = publishedPort(spec, spec['x-tug'].ingress.port);
         const drainMs = parseDuration(spec['x-tug']?.rollout?.drain ?? DEFAULT_DRAIN, 30000);
@@ -194,21 +235,32 @@ export async function reconcileRolling(ctx, input) {
             }
             catch (e) {
                 result.errors[service] = errMessage(e);
-                result.serviceStates[service] = { rolloutState: 'health_checking', image, rolloutRevision: hash };
+                result.serviceStates[service] = {
+                    rolloutState: 'health_checking',
+                    image,
+                    rolloutRevision: hash,
+                };
             }
             continue;
         }
         const key = `${desired.revision || desired.version}:${hash}`;
         const reject = (error) => {
             result.errors[service] = error;
-            result.serviceStates[service] = rollout.active ? servingState(rollout.active, { rolloutError: error }) : { rolloutState: 'health_checking', image, rolloutRevision: hash };
+            result.serviceStates[service] = rollout.active
+                ? servingState(rollout.active, { rolloutError: error })
+                : { rolloutState: 'health_checking', image, rolloutRevision: hash };
         };
         if (rollout.failed?.key === key) {
             reject(rollout.failed.error);
             continue;
         }
         try {
-            const candidate = rollout.candidate ?? { hash, project: revProject, port: await allocatePort(ctx, knownPorts(rollout), new Set()), image };
+            const candidate = rollout.candidate ?? {
+                hash,
+                project: revProject,
+                port: await allocatePort(ctx, knownPorts(rollout), new Set()),
+                image,
+            };
             rollout.candidate = candidate;
             await saveRolloutState(dir, state);
             await deps.emit(service, 'pulling');
@@ -235,7 +287,12 @@ export async function reconcileRolling(ctx, input) {
             await deps.waitForHealth(revProject, service, file);
             // Takeover: the next status report carries the new port and control re-renders the ingress.
             if (rollout.active)
-                rollout.draining.push({ service, project: rollout.active.project, legacy: rollout.active.legacy, drainUntil: Date.now() + drainMs });
+                rollout.draining.push({
+                    service,
+                    project: rollout.active.project,
+                    legacy: rollout.active.legacy,
+                    drainUntil: Date.now() + drainMs,
+                });
             rollout.active = { ...candidate };
             delete rollout.candidate;
             delete rollout.failed;
@@ -258,20 +315,29 @@ export async function reconcileRolling(ctx, input) {
     return result;
 }
 function knownPorts(rollout) {
-    return [rollout.active, rollout.candidate].filter((r) => Boolean(r && !r.legacy)).map(r => r.port);
+    return [rollout.active, rollout.candidate]
+        .filter((r) => Boolean(r && !r.legacy))
+        .map((r) => r.port);
 }
 /** Removes drained revisions, and revisions of services that are no longer rolling on this node. */
 async function retireRevisions(ctx, dir, state, desired, rolling, deps) {
     for (const [service, rollout] of Object.entries(state.services)) {
         if (!rolling.has(service)) {
             // No longer rolling here. A service that is now recreated keeps the old revision for one drain so the switch is not abrupt.
-            const stillRuns = desired.compose.services[service] && (desired.services[service]?.placement?.nodes?.includes(ctx.nodeName) || !desired.services[service]?.placement?.nodes?.length);
+            const stillRuns = desired.compose.services[service] &&
+                (desired.services[service]?.placement?.nodes?.includes(ctx.nodeName) ||
+                    !desired.services[service]?.placement?.nodes?.length);
             if (rollout.candidate) {
                 await removeRevision(ctx, dir, rollout.candidate.project).catch(() => { });
                 delete rollout.candidate;
             }
             if (rollout.active && stillRuns) {
-                rollout.draining.push({ service, project: rollout.active.project, legacy: rollout.active.legacy, drainUntil: Date.now() + parseDuration(DEFAULT_DRAIN) });
+                rollout.draining.push({
+                    service,
+                    project: rollout.active.project,
+                    legacy: rollout.active.legacy,
+                    drainUntil: Date.now() + parseDuration(DEFAULT_DRAIN),
+                });
                 delete rollout.active;
             }
             else if (rollout.active) {

package/dist/secrets.js

@@ -10,7 +10,9 @@ export async function loadOrCreateMasterKey(file) {
     await fs.writeFile(file, key, { mode: 0o600 });
     return key;
 }
-function keyBytes(key) { return crypto.createHash('sha256').update(key).digest(); }
+function keyBytes(key) {
+    return crypto.createHash('sha256').update(key).digest();
+}
 export function encrypt(value, masterKey) {
     const iv = crypto.randomBytes(12);
     const cipher = crypto.createCipheriv('aes-256-gcm', keyBytes(masterKey), iv);

package/dist/templates/control-compose.yml

@@ -7,6 +7,7 @@ services:
       PORT: 8080
       TUG_DATA_DIR: /data
       TUG_OPERATOR_TOKEN: {{OPERATOR_TOKEN}}
+      TUG_MESH: {{MESH}}
       TUG_REGISTRY: {{REGISTRY_HOST}}
       TUG_REGISTRY_AUTH_PATH: {{REGISTRY_AUTH_PATH}}
       TUG_REGISTRY_CONTAINER: {{REGISTRY_CONTAINER}}

package/dist/tokens.d.ts

@@ -2,7 +2,7 @@ import type { Request, RequestHandler } from 'express';
 import type { Db } from './db.ts';
 /** Roles are cumulative: `deploy` includes `read`, and `admin` includes both. */
 export declare const ROLES: readonly ["read", "deploy", "admin"];
-export type Role = typeof ROLES[number];
+export type Role = (typeof ROLES)[number];
 export type RouteRole = Role | 'public';
 /** Name recorded in the audit trail for the root operator token. */
 export declare const OPERATOR_ACTOR = "operator";