@xemahq/kernel-contracts 0.29.0 → 0.31.0

package/src/workspace-image/lib/types.ts

@@ -0,0 +1,79 @@
+// ═══════════════════════════════════════════════════════════════════════════
+// ── Workspace image — manifest & variant types ──
+//
+// Strict types for per-org workspace image variants. The kernel never sees
+// a Dockerfile — variants are declared as a closed list of layer recipes
+// that the bake service translates into Buildah/BuildKit operations.
+// ═══════════════════════════════════════════════════════════════════════════
+
+import type { WorkerRuntimeKind } from '../../worker-runtime';
+
+import type { ImageLayerKind, VariantStatus } from './enums';
+
+/**
+ * A single layer in a `WorkspaceImageManifest`. Closed discriminated
+ * union keyed by `kind`. Each kind has a strict payload — the bake
+ * service exhaustively `switch`es on `kind`.
+ *
+ * No `entrypoint` / `cmd` kind by design: the worker-runtime owns process
+ * lifecycle, not the org-authored image.
+ */
+export type ImageLayer =
+  | { readonly kind: ImageLayerKind.Apt; readonly packages: readonly string[] }
+  | { readonly kind: ImageLayerKind.Dnf; readonly packages: readonly string[] }
+  | { readonly kind: ImageLayerKind.Apk; readonly packages: readonly string[] }
+  | {
+      readonly kind: ImageLayerKind.Pip;
+      readonly packages: readonly string[];
+      readonly pythonVersion?: string;
+    }
+  | { readonly kind: ImageLayerKind.NpmGlobal; readonly packages: readonly string[] }
+  | { readonly kind: ImageLayerKind.Env; readonly vars: Readonly<Record<string, string>> }
+  | {
+      readonly kind: ImageLayerKind.File;
+      readonly path: string;
+      readonly contentBase64: string;
+      readonly mode?: number;
+    };
+
+/**
+ * A bake recipe. The manifest is the AUTHORATIVE input to the bake
+ * service; everything else on `WorkspaceImageVariant` is derived metadata.
+ *
+ * `workdir` is the working directory inside the resulting image; it
+ * defaults to the runtime's choice when omitted. No `entrypoint` field —
+ * the runtime owns process lifecycle.
+ */
+export interface WorkspaceImageManifest {
+  readonly layers: readonly ImageLayer[];
+  readonly workdir?: string;
+}
+
+/**
+ * Cross-service DTO for a baked variant. Mirrors the Prisma row in the
+ * workspace-image / bake service.
+ */
+export interface WorkspaceImageVariant {
+  readonly id: string;
+  readonly orgId: string;
+  readonly slug: string;
+  readonly description: string;
+  readonly runtimeKind: WorkerRuntimeKind;
+  /** Base image (registry/name:tag or digest) the manifest extends. */
+  readonly baseImage: string;
+  readonly manifest: WorkspaceImageManifest;
+  /** sha256 of `(manifest, baseImageDigest)` — see `computeContentHash`. */
+  readonly contentHash: string;
+  /** Pushed registry reference once `status = Ready`. */
+  readonly registryRef?: string;
+  readonly status: VariantStatus;
+  readonly isOrgDefault: boolean;
+  readonly autoRebake: boolean;
+  /** Regions in which this variant has been replicated. */
+  readonly regions: readonly string[];
+  /** Tail of the bake log; absent for `draft`. */
+  readonly buildLog?: string;
+  /** ISO-8601 timestamp; absent until first successful bake. */
+  readonly builtAt?: string;
+  readonly createdAt: string;
+}