@xemahq/xema 0.13.0 → 0.15.0

package/dist/runtime/runner/container-preflight.d.ts

@@ -0,0 +1,77 @@
+import { DockerCli } from './docker-cli';
+import { type ResolvedPlatform } from './host-platform';
+import { type LicenseRegistryCredentials, type RegistryAuthResult } from '../license/registry-credential';
+import type { RosterEntry } from '../roster';
+import type { RuntimeImagePlatform } from '@xemahq/kernel-contracts/distribution';
+export declare enum ContainerPreflightFailureKind {
+    RuntimeUnreachable = "runtime-unreachable",
+    MalformedImagePlatforms = "malformed-image-platforms",
+    PlatformMismatch = "platform-mismatch",
+    RegistryAuthFailed = "registry-auth-failed",
+    RegistryProbeFailed = "registry-probe-failed"
+}
+export declare enum RegistryProbeOutcome {
+    Reachable = "reachable",
+    LocalImagesPresent = "local-images-present",
+    Unauthorized = "unauthorized",
+    ManifestUnknown = "manifest-unknown",
+    Unreachable = "unreachable",
+    Unverified = "unverified",
+    Unclassified = "unclassified"
+}
+export interface EffectiveRunPlatform {
+    readonly service: string;
+    readonly platform: ResolvedPlatform;
+    readonly emulated: boolean;
+}
+export interface PlatformMismatchGroup {
+    readonly services: readonly string[];
+    readonly declared: readonly RuntimeImagePlatform[];
+}
+export interface RegistryProbeTarget {
+    readonly host: string;
+    readonly service: string;
+    readonly image: string;
+}
+export interface RegistryProbeResult {
+    readonly target: RegistryProbeTarget;
+    readonly outcome: RegistryProbeOutcome;
+    readonly detail: string;
+    readonly remediation: string;
+}
+export interface ContainerPreflightFailure {
+    readonly kind: ContainerPreflightFailureKind;
+    readonly message: string;
+}
+export interface ContainerPreflightReport {
+    readonly runtimeBinary: string;
+    readonly runtimeReachable: boolean;
+    readonly runtimePlatform: ResolvedPlatform | null;
+    readonly nodePlatform: ResolvedPlatform;
+    readonly effectivePlatforms: readonly EffectiveRunPlatform[];
+    readonly emulationNotices: readonly PlatformMismatchGroup[];
+    readonly registryAuth: readonly RegistryAuthResult[];
+    readonly registryProbes: readonly RegistryProbeResult[];
+    readonly failures: readonly ContainerPreflightFailure[];
+    readonly passed: boolean;
+}
+export interface ContainerPreflightOptions {
+    readonly roster: readonly RosterEntry[];
+    readonly allowEmulatedPlatform: boolean;
+    readonly registryCredentials: LicenseRegistryCredentials;
+    readonly docker?: DockerCli;
+}
+export declare const DEFAULT_REGISTRY_HOST = "docker.io";
+export declare function registryHostForImageRef(imageRef: string): string;
+export declare function distinctRegistryTargets(candidates: readonly Omit<RegistryProbeTarget, 'host'>[], localImages?: ReadonlySet<string>): {
+    readonly targets: RegistryProbeTarget[];
+    readonly satisfiedLocally: RegistryProbeTarget[];
+};
+export declare function rosterRegistryTargets(roster: readonly RosterEntry[], localImages?: ReadonlySet<string>): ReturnType<typeof distinctRegistryTargets>;
+export declare function classifyRegistryProbeFailure(errorText: string): RegistryProbeOutcome;
+export declare function isBlockingRegistryOutcome(outcome: RegistryProbeOutcome): boolean;
+export declare function probeRegistries(targets: readonly RegistryProbeTarget[], docker: DockerCli, satisfiedLocally?: readonly RegistryProbeTarget[]): Promise<RegistryProbeResult[]>;
+export declare function runContainerPreflight(opts: ContainerPreflightOptions): Promise<ContainerPreflightReport>;
+export declare function assertContainerPreflightPassed(report: ContainerPreflightReport): void;
+export declare function formatContainerPreflight(report: ContainerPreflightReport): string;
+//# sourceMappingURL=container-preflight.d.ts.map

package/dist/runtime/runner/container-preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-preflight.d.ts","sourceRoot":"","sources":["../../../src/runtime/runner/container-preflight.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAOL,KAAK,gBAAgB,EACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACxB,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAmClF,oBAAY,6BAA6B;IACvC,kBAAkB,wBAAwB;IAC1C,uBAAuB,8BAA8B;IACrD,gBAAgB,sBAAsB;IAEtC,kBAAkB,yBAAyB;IAC3C,mBAAmB,0BAA0B;CAC9C;AAaD,oBAAY,oBAAoB;IAC9B,SAAS,cAAc;IAOvB,kBAAkB,yBAAyB;IAC3C,YAAY,iBAAiB;IAC7B,eAAe,qBAAqB;IACpC,WAAW,gBAAgB;IAC3B,UAAU,eAAe;IACzB,YAAY,iBAAiB;CAC9B;AAGD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IAEpC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAGD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACpD;AAGD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IAEvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAE7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IAEvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IAEnC,QAAQ,CAAC,eAAe,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAElD,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACxC,QAAQ,CAAC,kBAAkB,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAE7D,QAAQ,CAAC,gBAAgB,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAE5D,QAAQ,CAAC,YAAY,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACrD,QAAQ,CAAC,cAAc,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACxD,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;IACxD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IAKxC,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IAOxC,QAAQ,CAAC,mBAAmB,EAAE,0BAA0B,CAAC;IAEzD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;CAC7B;AAGD,eAAO,MAAM,qBAAqB,cAAc,CAAC;AAQjD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAUhE;AAaD,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,SAAS,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,EAAE,EACxD,WAAW,GAAE,WAAW,CAAC,MAAM,CAAa,GAC3C;IAAE,QAAQ,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAAC,QAAQ,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,CAAA;CAAE,CAsB/F;AAGD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,SAAS,WAAW,EAAE,EAC9B,WAAW,GAAE,WAAW,CAAC,MAAM,CAAa,GAC3C,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAO5C;AAsCD,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,MAAM,GAAG,oBAAoB,CAQpF;AAsDD,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAEhF;AAGD,wBAAsB,eAAe,CACnC,OAAO,EAAE,SAAS,mBAAmB,EAAE,EACvC,MAAM,EAAE,SAAS,EACjB,gBAAgB,GAAE,SAAS,mBAAmB,EAAO,GACpD,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAkBhC;AA0ED,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,wBAAwB,CAAC,CAkInC;AAGD,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAUrF;AAGD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CAyCjF"}

package/dist/runtime/runner/container-preflight.js

@@ -0,0 +1,360 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_REGISTRY_HOST = exports.RegistryProbeOutcome = exports.ContainerPreflightFailureKind = void 0;
+exports.registryHostForImageRef = registryHostForImageRef;
+exports.distinctRegistryTargets = distinctRegistryTargets;
+exports.rosterRegistryTargets = rosterRegistryTargets;
+exports.classifyRegistryProbeFailure = classifyRegistryProbeFailure;
+exports.isBlockingRegistryOutcome = isBlockingRegistryOutcome;
+exports.probeRegistries = probeRegistries;
+exports.runContainerPreflight = runContainerPreflight;
+exports.assertContainerPreflightPassed = assertContainerPreflightPassed;
+exports.formatContainerPreflight = formatContainerPreflight;
+const container_runner_1 = require("./container-runner");
+const docker_cli_1 = require("./docker-cli");
+const host_platform_1 = require("./host-platform");
+const registry_credential_1 = require("../license/registry-credential");
+var ContainerPreflightFailureKind;
+(function (ContainerPreflightFailureKind) {
+    ContainerPreflightFailureKind["RuntimeUnreachable"] = "runtime-unreachable";
+    ContainerPreflightFailureKind["MalformedImagePlatforms"] = "malformed-image-platforms";
+    ContainerPreflightFailureKind["PlatformMismatch"] = "platform-mismatch";
+    ContainerPreflightFailureKind["RegistryAuthFailed"] = "registry-auth-failed";
+    ContainerPreflightFailureKind["RegistryProbeFailed"] = "registry-probe-failed";
+})(ContainerPreflightFailureKind || (exports.ContainerPreflightFailureKind = ContainerPreflightFailureKind = {}));
+var RegistryProbeOutcome;
+(function (RegistryProbeOutcome) {
+    RegistryProbeOutcome["Reachable"] = "reachable";
+    RegistryProbeOutcome["LocalImagesPresent"] = "local-images-present";
+    RegistryProbeOutcome["Unauthorized"] = "unauthorized";
+    RegistryProbeOutcome["ManifestUnknown"] = "manifest-unknown";
+    RegistryProbeOutcome["Unreachable"] = "unreachable";
+    RegistryProbeOutcome["Unverified"] = "unverified";
+    RegistryProbeOutcome["Unclassified"] = "unclassified";
+})(RegistryProbeOutcome || (exports.RegistryProbeOutcome = RegistryProbeOutcome = {}));
+exports.DEFAULT_REGISTRY_HOST = 'docker.io';
+function registryHostForImageRef(imageRef) {
+    const firstSlash = imageRef.indexOf('/');
+    if (firstSlash === -1) {
+        return exports.DEFAULT_REGISTRY_HOST;
+    }
+    const candidate = imageRef.slice(0, firstSlash);
+    if (candidate === 'localhost' || candidate.includes('.') || candidate.includes(':')) {
+        return candidate;
+    }
+    return exports.DEFAULT_REGISTRY_HOST;
+}
+function distinctRegistryTargets(candidates, localImages = new Set()) {
+    const byHost = new Map();
+    const localOnly = new Map();
+    for (const candidate of candidates) {
+        const host = registryHostForImageRef(candidate.image);
+        const target = { host, service: candidate.service, image: candidate.image };
+        if (localImages.has(candidate.image)) {
+            if (!localOnly.has(host)) {
+                localOnly.set(host, target);
+            }
+            continue;
+        }
+        if (!byHost.has(host)) {
+            byHost.set(host, target);
+        }
+    }
+    return {
+        targets: [...byHost.values()],
+        satisfiedLocally: [...localOnly.entries()]
+            .filter(([host]) => !byHost.has(host))
+            .map(([, target]) => target),
+    };
+}
+function rosterRegistryTargets(roster, localImages = new Set()) {
+    return distinctRegistryTargets(roster
+        .filter((entry) => entry.imageRef !== undefined && entry.imageRef !== '')
+        .map((entry) => ({ service: entry.name, image: (0, container_runner_1.containerImageForRosterEntry)(entry) })), localImages);
+}
+const REGISTRY_FAILURE_RULES = [
+    {
+        outcome: RegistryProbeOutcome.Unverified,
+        pattern: /is not a docker command|unknown command|unknown shorthand|unknown flag|unrecognized command|command not found|requires experimental|not supported by this runtime/,
+    },
+    {
+        outcome: RegistryProbeOutcome.Unauthorized,
+        pattern: /unauthorized|authentication required|no basic auth credentials|access to the resource is denied|denied:|forbidden|http status: 401|status code 401|status: 403/,
+    },
+    {
+        outcome: RegistryProbeOutcome.ManifestUnknown,
+        pattern: /manifest unknown|manifest_unknown|no such manifest|manifest for .* not found|not found: manifest|repository name not known|name unknown|404/,
+    },
+    {
+        outcome: RegistryProbeOutcome.Unreachable,
+        pattern: /dial tcp|no such host|connection refused|connection reset|network is unreachable|i\/o timeout|timeout exceeded|timed out|tls|x509|certificate|temporary failure in name resolution|eof$/,
+    },
+];
+function classifyRegistryProbeFailure(errorText) {
+    const text = errorText.toLowerCase();
+    for (const rule of REGISTRY_FAILURE_RULES) {
+        if (rule.pattern.test(text)) {
+            return rule.outcome;
+        }
+    }
+    return RegistryProbeOutcome.Unclassified;
+}
+function remediationFor(outcome, target) {
+    switch (outcome) {
+        case RegistryProbeOutcome.Reachable:
+        case RegistryProbeOutcome.LocalImagesPresent:
+            return '';
+        case RegistryProbeOutcome.Unauthorized:
+            return (`Authenticate to the registry: \`docker login ${target.host}\` with an account ` +
+                'entitled to this distribution, then re-run.');
+        case RegistryProbeOutcome.ManifestUnknown:
+            return (`The image coordinate "${target.image}" is not published at that tag. The lock is ` +
+                'content-addressed, so the tag IS the content hash: either the producing pipeline ' +
+                'has not pushed this build yet, or this edition was resolved against a registry ' +
+                'that does not mirror it. Re-resolve the edition, or point the installation at a ' +
+                'registry that carries it.');
+        case RegistryProbeOutcome.Unreachable:
+            return (`The registry host "${target.host}" is not reachable from this machine. Check ` +
+                'network/DNS/proxy and TLS trust for that host (an air-gapped install must be ' +
+                'pointed at its local mirror instead).');
+        case RegistryProbeOutcome.Unverified:
+            return ('The container runtime does not support the metadata-only `manifest inspect` probe, ' +
+                'so registry reachability could not be verified here. This is NOT a failure — but a ' +
+                'registry problem, if any, will surface at pull time instead.');
+        case RegistryProbeOutcome.Unclassified:
+            return (`The registry probe for "${target.image}" failed with an error this CLI does not ` +
+                'recognize (verbatim above). Resolve it against the runtime/registry directly ' +
+                'before launching.');
+    }
+}
+const BLOCKING_REGISTRY_OUTCOMES = new Set([
+    RegistryProbeOutcome.Unauthorized,
+    RegistryProbeOutcome.ManifestUnknown,
+    RegistryProbeOutcome.Unreachable,
+    RegistryProbeOutcome.Unclassified,
+]);
+function isBlockingRegistryOutcome(outcome) {
+    return BLOCKING_REGISTRY_OUTCOMES.has(outcome);
+}
+async function probeRegistries(targets, docker, satisfiedLocally = []) {
+    const results = satisfiedLocally.map((target) => ({
+        target,
+        outcome: RegistryProbeOutcome.LocalImagesPresent,
+        detail: '',
+        remediation: '',
+    }));
+    for (const target of targets) {
+        try {
+            await docker.manifestInspect(target.image);
+            results.push({ target, outcome: RegistryProbeOutcome.Reachable, detail: '', remediation: '' });
+        }
+        catch (err) {
+            const detail = (err instanceof Error ? err.message : String(err)).trim();
+            const outcome = classifyRegistryProbeFailure(detail);
+            results.push({ target, outcome, detail, remediation: remediationFor(outcome, target) });
+        }
+    }
+    return results;
+}
+function declaredPlatformKey(declared) {
+    return declared.map(host_platform_1.formatDeclaredPlatform).join(',');
+}
+function runtimeUnreachableFailure(binary) {
+    return {
+        kind: ContainerPreflightFailureKind.RuntimeUnreachable,
+        message: [
+            `Container runtime \`${binary}\` is not reachable.`,
+            '',
+            `\`${binary} version\` reported no server, so no service container can be started.`,
+            'Resolve it by one of:',
+            `  - install a container runtime that provides the \`${binary}\` command ` +
+                '(Docker Engine / Docker Desktop, or Podman, which ships a docker-compatible CLI);',
+            '  - start the runtime daemon if it is installed but not running;',
+            '  - run this installation on a host where the runtime is available.',
+        ].join('\n'),
+    };
+}
+function malformedPlatformsFailure(services) {
+    return {
+        kind: ContainerPreflightFailureKind.MalformedImagePlatforms,
+        message: [
+            `images.lock.json declares an image but no requiredPlatforms for ${String(services.length)} service(s).`,
+            '',
+            `  services : ${services.join(', ')}`,
+            '',
+            'The container substrate pins --platform from that declaration; without it the runtime ' +
+                'would pick a platform on its own, which is exactly how an image plane reaches a host ' +
+                'it was never built for. Re-resolve this edition with a generator that emits ' +
+                'requiredPlatforms.',
+        ].join('\n'),
+    };
+}
+function platformMismatchMessage(group, runtimePlatform, nodePlatform, runtimeBinary) {
+    const declared = group.declared.map(host_platform_1.formatDeclaredPlatform).join(', ');
+    return [
+        `The image plane does not build for this host's architecture ` +
+            `(${String(group.services.length)} service(s) affected).`,
+        '',
+        `  services : ${group.services.join(', ')}`,
+        `  host     : ${(0, host_platform_1.formatPlatform)(runtimePlatform)} ` +
+            `(container runtime \`${runtimeBinary}\`; this CLI process runs ${(0, host_platform_1.formatPlatform)(nodePlatform)})`,
+        `  images   : ${declared}`,
+        '',
+        'These images ship no manifest for the host platform. Starting them anyway produces an ' +
+            'opaque `exec format error` at container start, or a "no matching manifest" pull failure.',
+        'Resolve it by one of:',
+        `  - install a distribution/edition whose images are built for ${(0, host_platform_1.formatPlatform)(runtimePlatform)};`,
+        `  - run this installation on a ${declared} host;`,
+        '  - explicitly authorize emulated execution (--allow-emulated-platform). The runtime then ' +
+            'runs the declared platform under its emulation layer — markedly slower, and only ' +
+            'available where the runtime provides one.',
+    ].join('\n');
+}
+async function runContainerPreflight(opts) {
+    const docker = opts.docker ?? new docker_cli_1.DockerCli();
+    const nodePlatform = (0, host_platform_1.nodeHostPlatform)();
+    if (!(await docker.available())) {
+        return {
+            runtimeBinary: docker.binary,
+            runtimeReachable: false,
+            runtimePlatform: null,
+            nodePlatform,
+            effectivePlatforms: [],
+            emulationNotices: [],
+            registryAuth: [],
+            registryProbes: [],
+            failures: [runtimeUnreachableFailure(docker.binary)],
+            passed: false,
+        };
+    }
+    const runtimePlatform = await docker.serverPlatform();
+    const effectivePlatforms = [];
+    const malformed = [];
+    const mismatchGroups = new Map();
+    for (const entry of opts.roster) {
+        if (entry.imageRef === undefined || entry.imageRef === '') {
+            continue;
+        }
+        const declared = entry.imagePlatforms;
+        if (declared === undefined || declared.length === 0) {
+            malformed.push(entry.name);
+            continue;
+        }
+        const platform = (0, host_platform_1.selectRunPlatform)(declared, runtimePlatform);
+        const supported = declared.some((candidate) => (0, host_platform_1.platformMatches)((0, host_platform_1.normalizePlatform)(candidate), runtimePlatform));
+        effectivePlatforms.push({ service: entry.name, platform, emulated: !supported });
+        if (!supported) {
+            const key = declaredPlatformKey(declared);
+            const group = mismatchGroups.get(key);
+            if (group === undefined) {
+                mismatchGroups.set(key, { services: [entry.name], declared });
+            }
+            else {
+                group.services.push(entry.name);
+            }
+        }
+    }
+    const failures = [];
+    if (malformed.length > 0) {
+        failures.push(malformedPlatformsFailure(malformed));
+    }
+    const groups = [...mismatchGroups.values()].map((group) => ({
+        services: group.services,
+        declared: group.declared,
+    }));
+    const emulationNotices = opts.allowEmulatedPlatform ? groups : [];
+    if (!opts.allowEmulatedPlatform) {
+        for (const group of groups) {
+            failures.push({
+                kind: ContainerPreflightFailureKind.PlatformMismatch,
+                message: platformMismatchMessage(group, runtimePlatform, nodePlatform, docker.binary),
+            });
+        }
+    }
+    const localImages = await docker.localImageRefs();
+    const registry = rosterRegistryTargets(opts.roster, localImages);
+    const registryAuth = await (0, registry_credential_1.authenticateLicenseRegistries)(registry.targets.map((target) => target.host), opts.registryCredentials, docker);
+    for (const auth of registryAuth) {
+        if ((0, registry_credential_1.isBlockingAuthOutcome)(auth.outcome)) {
+            failures.push({
+                kind: ContainerPreflightFailureKind.RegistryAuthFailed,
+                message: [
+                    `Registry ${auth.host} did not accept this installation's Xema license (${auth.outcome}).`,
+                    '',
+                    ...(auth.detail.length > 0 ? [`  runtime  : ${auth.detail}`, ''] : []),
+                    auth.remediation,
+                ].join('\n'),
+            });
+        }
+    }
+    const registryProbes = await probeRegistries(registry.targets, docker, registry.satisfiedLocally);
+    for (const probe of registryProbes) {
+        if (BLOCKING_REGISTRY_OUTCOMES.has(probe.outcome)) {
+            failures.push({
+                kind: ContainerPreflightFailureKind.RegistryProbeFailed,
+                message: [
+                    `Registry ${probe.target.host} is not usable for this installation (${probe.outcome}).`,
+                    '',
+                    `  probed   : ${probe.target.image} (representative image for ${probe.target.service})`,
+                    `  runtime  : ${probe.detail}`,
+                    '',
+                    probe.remediation,
+                ].join('\n'),
+            });
+        }
+    }
+    return {
+        runtimeBinary: docker.binary,
+        runtimeReachable: true,
+        runtimePlatform,
+        nodePlatform,
+        effectivePlatforms,
+        emulationNotices,
+        registryAuth,
+        registryProbes,
+        failures,
+        passed: failures.length === 0,
+    };
+}
+function assertContainerPreflightPassed(report) {
+    if (report.passed) {
+        return;
+    }
+    throw new Error([
+        `Container preflight failed (${String(report.failures.length)} problem(s)) — no service was started.`,
+        ...report.failures.map((failure) => failure.message),
+    ].join('\n\n'));
+}
+function formatContainerPreflight(report) {
+    const lines = [];
+    lines.push('container preflight');
+    lines.push('-'.repeat(60));
+    lines.push(`runtime  : \`${report.runtimeBinary}\` ${report.runtimeReachable ? 'reachable' : 'UNREACHABLE'}`);
+    lines.push(`platform : ${report.runtimePlatform === null ? 'unknown' : (0, host_platform_1.formatPlatform)(report.runtimePlatform)} (runtime) · ${(0, host_platform_1.formatPlatform)(report.nodePlatform)} (this CLI process)`);
+    const emulatedCount = report.effectivePlatforms.filter((p) => p.emulated).length;
+    lines.push(`images   : ${String(report.effectivePlatforms.length)} pinned` +
+        (emulatedCount > 0 ? `, ${String(emulatedCount)} EMULATED` : ''));
+    for (const auth of report.registryAuth) {
+        lines.push(`license  : ${auth.host} — ${auth.outcome}`);
+    }
+    for (const probe of report.registryProbes) {
+        lines.push(`registry : ${probe.target.host} — ${probe.outcome}`);
+    }
+    for (const notice of report.emulationNotices) {
+        lines.push('');
+        lines.push(`!! EMULATED EXECUTION AUTHORIZED — ${String(notice.services.length)} service(s) run under ` +
+            `emulation: their images ship only ${notice.declared.map(host_platform_1.formatDeclaredPlatform).join(', ')}.`);
+        lines.push(`   services: ${notice.services.join(', ')}`);
+        lines.push('   Expect materially slower startup and runtime. This is not a supported');
+        lines.push('   production configuration — use a distribution built for this architecture.');
+    }
+    for (const probe of report.registryProbes) {
+        if (probe.outcome === RegistryProbeOutcome.Unverified) {
+            lines.push('');
+            lines.push(`!! registry ${probe.target.host} UNVERIFIED: ${probe.detail}`);
+            lines.push(`   ${probe.remediation}`);
+        }
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=container-preflight.js.map

package/dist/runtime/runner/container-preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-preflight.js","sourceRoot":"","sources":["../../../src/runtime/runner/container-preflight.ts"],"names":[],"mappings":";;;AA6KA,0DAUC;AAaD,0DAyBC;AAGD,sDAUC;AAsCD,oEAQC;AAsDD,8DAEC;AAGD,0CAsBC;AA0ED,sDAoIC;AAGD,wEAUC;AAGD,4DAyCC;AAhnBD,yDAAkE;AAClE,6CAAyC;AACzC,mDAQyB;AACzB,wEAKwC;AAsCxC,IAAY,6BAOX;AAPD,WAAY,6BAA6B;IACvC,2EAA0C,CAAA;IAC1C,sFAAqD,CAAA;IACrD,uEAAsC,CAAA;IAEtC,4EAA2C,CAAA;IAC3C,8EAA6C,CAAA;AAC/C,CAAC,EAPW,6BAA6B,6CAA7B,6BAA6B,QAOxC;AAaD,IAAY,oBAcX;AAdD,WAAY,oBAAoB;IAC9B,+CAAuB,CAAA;IAOvB,mEAA2C,CAAA;IAC3C,qDAA6B,CAAA;IAC7B,4DAAoC,CAAA;IACpC,mDAA2B,CAAA;IAC3B,iDAAyB,CAAA;IACzB,qDAA6B,CAAA;AAC/B,CAAC,EAdW,oBAAoB,oCAApB,oBAAoB,QAc/B;AA6EY,QAAA,qBAAqB,GAAG,WAAW,CAAC;AAQjD,SAAgB,uBAAuB,CAAC,QAAgB;IACtD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,6BAAqB,CAAC;IAC/B,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAChD,IAAI,SAAS,KAAK,WAAW,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACpF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,6BAAqB,CAAC;AAC/B,CAAC;AAaD,SAAgB,uBAAuB,CACrC,UAAwD,EACxD,cAAmC,IAAI,GAAG,EAAE;IAE5C,MAAM,MAAM,GAAG,IAAI,GAAG,EAA+B,CAAC;IACtD,MAAM,SAAS,GAAG,IAAI,GAAG,EAA+B,CAAC;IACzD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,uBAAuB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;QAC5E,IAAI,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC9B,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC7B,gBAAgB,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;aACvC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;aACrC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC;KAC/B,CAAC;AACJ,CAAC;AAGD,SAAgB,qBAAqB,CACnC,MAA8B,EAC9B,cAAmC,IAAI,GAAG,EAAE;IAE5C,OAAO,uBAAuB,CAC5B,MAAM;SACH,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,EAAE,CAAC;SACxE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAA,+CAA4B,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EACxF,WAAW,CACZ,CAAC;AACJ,CAAC;AAOD,MAAM,sBAAsB,GAGtB;IACJ;QACE,OAAO,EAAE,oBAAoB,CAAC,UAAU;QACxC,OAAO,EACL,mKAAmK;KACtK;IACD;QACE,OAAO,EAAE,oBAAoB,CAAC,YAAY;QAC1C,OAAO,EACL,gKAAgK;KACnK;IACD;QACE,OAAO,EAAE,oBAAoB,CAAC,eAAe;QAC7C,OAAO,EACL,6IAA6I;KAChJ;IACD;QACE,OAAO,EAAE,oBAAoB,CAAC,WAAW;QACzC,OAAO,EACL,yLAAyL;KAC5L;CACF,CAAC;AAOF,SAAgB,4BAA4B,CAAC,SAAiB;IAC5D,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,sBAAsB,EAAE,CAAC;QAC1C,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,oBAAoB,CAAC,YAAY,CAAC;AAC3C,CAAC;AAED,SAAS,cAAc,CAAC,OAA6B,EAAE,MAA2B;IAChF,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,oBAAoB,CAAC,SAAS,CAAC;QACpC,KAAK,oBAAoB,CAAC,kBAAkB;YAC1C,OAAO,EAAE,CAAC;QACZ,KAAK,oBAAoB,CAAC,YAAY;YACpC,OAAO,CACL,gDAAgD,MAAM,CAAC,IAAI,qBAAqB;gBAChF,6CAA6C,CAC9C,CAAC;QACJ,KAAK,oBAAoB,CAAC,eAAe;YACvC,OAAO,CACL,yBAAyB,MAAM,CAAC,KAAK,8CAA8C;gBACnF,mFAAmF;gBACnF,iFAAiF;gBACjF,kFAAkF;gBAClF,2BAA2B,CAC5B,CAAC;QACJ,KAAK,oBAAoB,CAAC,WAAW;YACnC,OAAO,CACL,sBAAsB,MAAM,CAAC,IAAI,8CAA8C;gBAC/E,+EAA+E;gBAC/E,uCAAuC,CACxC,CAAC;QACJ,KAAK,oBAAoB,CAAC,UAAU;YAClC,OAAO,CACL,qFAAqF;gBACrF,qFAAqF;gBACrF,8DAA8D,CAC/D,CAAC;QACJ,KAAK,oBAAoB,CAAC,YAAY;YACpC,OAAO,CACL,2BAA2B,MAAM,CAAC,KAAK,2CAA2C;gBAClF,+EAA+E;gBAC/E,mBAAmB,CACpB,CAAC;IACN,CAAC;AACH,CAAC;AAGD,MAAM,0BAA0B,GAAsC,IAAI,GAAG,CAAC;IAC5E,oBAAoB,CAAC,YAAY;IACjC,oBAAoB,CAAC,eAAe;IACpC,oBAAoB,CAAC,WAAW;IAChC,oBAAoB,CAAC,YAAY;CAClC,CAAC,CAAC;AAOH,SAAgB,yBAAyB,CAAC,OAA6B;IACrE,OAAO,0BAA0B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAGM,KAAK,UAAU,eAAe,CACnC,OAAuC,EACvC,MAAiB,EACjB,mBAAmD,EAAE;IAErD,MAAM,OAAO,GAA0B,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvE,MAAM;QACN,OAAO,EAAE,oBAAoB,CAAC,kBAAkB;QAChD,MAAM,EAAE,EAAE;QACV,WAAW,EAAE,EAAE;KAChB,CAAC,CAAC,CAAC;IACJ,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;QACjG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACzE,MAAM,OAAO,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAGD,SAAS,mBAAmB,CAAC,QAAyC;IACpE,OAAO,QAAQ,CAAC,GAAG,CAAC,sCAAsB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAc;IAC/C,OAAO;QACL,IAAI,EAAE,6BAA6B,CAAC,kBAAkB;QACtD,OAAO,EAAE;YACP,uBAAuB,MAAM,sBAAsB;YACnD,EAAE;YACF,KAAK,MAAM,wEAAwE;YACnF,uBAAuB;YACvB,uDAAuD,MAAM,aAAa;gBACxE,mFAAmF;YACrF,kEAAkE;YAClE,qEAAqE;SACtE,CAAC,IAAI,CAAC,IAAI,CAAC;KACb,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,QAA2B;IAC5D,OAAO;QACL,IAAI,EAAE,6BAA6B,CAAC,uBAAuB;QAC3D,OAAO,EAAE;YACP,mEAAmE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc;YACxG,EAAE;YACF,gBAAgB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACrC,EAAE;YACF,wFAAwF;gBACtF,uFAAuF;gBACvF,8EAA8E;gBAC9E,oBAAoB;SACvB,CAAC,IAAI,CAAC,IAAI,CAAC;KACb,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAA4B,EAC5B,eAAiC,EACjC,YAA8B,EAC9B,aAAqB;IAErB,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,sCAAsB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvE,OAAO;QACL,8DAA8D;YAC5D,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,wBAAwB;QAC3D,EAAE;QACF,gBAAgB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC3C,gBAAgB,IAAA,8BAAc,EAAC,eAAe,CAAC,GAAG;YAChD,wBAAwB,aAAa,6BAA6B,IAAA,8BAAc,EAAC,YAAY,CAAC,GAAG;QACnG,gBAAgB,QAAQ,EAAE;QAC1B,EAAE;QACF,wFAAwF;YACtF,0FAA0F;QAC5F,uBAAuB;QACvB,iEAAiE,IAAA,8BAAc,EAAC,eAAe,CAAC,GAAG;QACnG,kCAAkC,QAAQ,QAAQ;QAClD,4FAA4F;YAC1F,mFAAmF;YACnF,2CAA2C;KAC9C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAUM,KAAK,UAAU,qBAAqB,CACzC,IAA+B;IAE/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,sBAAS,EAAE,CAAC;IAC9C,MAAM,YAAY,GAAG,IAAA,gCAAgB,GAAE,CAAC;IAExC,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,gBAAgB,EAAE,KAAK;YACvB,eAAe,EAAE,IAAI;YACrB,YAAY;YACZ,kBAAkB,EAAE,EAAE;YACtB,gBAAgB,EAAE,EAAE;YACpB,YAAY,EAAE,EAAE;YAChB,cAAc,EAAE,EAAE;YAClB,QAAQ,EAAE,CAAC,yBAAyB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpD,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,cAAc,EAAE,CAAC;IAEtD,MAAM,kBAAkB,GAA2B,EAAE,CAAC;IACtD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,cAAc,GAAG,IAAI,GAAG,EAA6E,CAAC;IAE5G,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC1D,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,IAAA,iCAAiB,EAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAC5C,IAAA,+BAAe,EAAC,IAAA,iCAAiB,EAAC,SAAS,CAAC,EAAE,eAAe,CAAC,CAC/D,CAAC;QACF,kBAAkB,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;YAChE,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAgC,EAAE,CAAC;IACjD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,MAAM,GAA4B,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnF,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC,CAAC;IACJ,MAAM,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAChC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,6BAA6B,CAAC,gBAAgB;gBACpD,OAAO,EAAE,uBAAuB,CAAC,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC;aACtF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAKD,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,cAAc,EAAE,CAAC;IAClD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAKjE,MAAM,YAAY,GAAG,MAAM,IAAA,mDAA6B,EACtD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAC7C,IAAI,CAAC,mBAAmB,EACxB,MAAM,CACP,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,IAAI,IAAA,2CAAqB,EAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,6BAA6B,CAAC,kBAAkB;gBACtD,OAAO,EAAE;oBACP,YAAY,IAAI,CAAC,IAAI,qDAAqD,IAAI,CAAC,OAAO,IAAI;oBAC1F,EAAE;oBACF,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtE,IAAI,CAAC,WAAW;iBACjB,CAAC,IAAI,CAAC,IAAI,CAAC;aACb,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,eAAe,CAC1C,QAAQ,CAAC,OAAO,EAChB,MAAM,EACN,QAAQ,CAAC,gBAAgB,CAC1B,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,IAAI,0BAA0B,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,6BAA6B,CAAC,mBAAmB;gBACvD,OAAO,EAAE;oBACP,YAAY,KAAK,CAAC,MAAM,CAAC,IAAI,yCAAyC,KAAK,CAAC,OAAO,IAAI;oBACvF,EAAE;oBACF,gBAAgB,KAAK,CAAC,MAAM,CAAC,KAAK,8BAA8B,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG;oBACvF,gBAAgB,KAAK,CAAC,MAAM,EAAE;oBAC9B,EAAE;oBACF,KAAK,CAAC,WAAW;iBAClB,CAAC,IAAI,CAAC,IAAI,CAAC;aACb,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,aAAa,EAAE,MAAM,CAAC,MAAM;QAC5B,gBAAgB,EAAE,IAAI;QACtB,eAAe;QACf,YAAY;QACZ,kBAAkB;QAClB,gBAAgB;QAChB,YAAY;QACZ,cAAc;QACd,QAAQ;QACR,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;KAC9B,CAAC;AACJ,CAAC;AAGD,SAAgB,8BAA8B,CAAC,MAAgC;IAC7E,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CACb;QACE,+BAA+B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,wCAAwC;QACrG,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;KACrD,CAAC,IAAI,CAAC,MAAM,CAAC,CACf,CAAC;AACJ,CAAC;AAGD,SAAgB,wBAAwB,CAAC,MAAgC;IACvE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAClC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,KAAK,CAAC,IAAI,CACR,gBAAgB,MAAM,CAAC,aAAa,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,CAClG,CAAC;IACF,KAAK,CAAC,IAAI,CACR,cACE,MAAM,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAA,8BAAc,EAAC,MAAM,CAAC,eAAe,CACrF,gBAAgB,IAAA,8BAAc,EAAC,MAAM,CAAC,YAAY,CAAC,qBAAqB,CACzE,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;IACjF,KAAK,CAAC,IAAI,CACR,cAAc,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,SAAS;QAC7D,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CACnE,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1C,KAAK,CAAC,IAAI,CAAC,cAAc,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CACR,sCAAsC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,wBAAwB;YAC1F,qCAAqC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,sCAAsB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACjG,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;QACvF,KAAK,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IAC9F,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1C,IAAI,KAAK,CAAC,OAAO,KAAK,oBAAoB,CAAC,UAAU,EAAE,CAAC;YACtD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,eAAe,KAAK,CAAC,MAAM,CAAC,IAAI,gBAAgB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAC3E,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/runtime/runner/container-runner.d.ts

@@ -1,14 +1,28 @@
+import { DockerCli } from './docker-cli';
 import { ServiceRunnerKind, type RunningService, type ServiceRunner, type StartServiceInput } from './service-runner';
+import type { RosterEntry } from '../roster';
+export declare const DEFAULT_CONTAINER_SERVICE_PORT = 3000;
 export interface ContainerRunnerOptions {
     readonly bin?: string;
     readonly network: string;
     readonly containerPort: number;
+    readonly distributionLockPath: string;
 }
+export interface DockerEnvironmentMaterialization {
+    readonly args: readonly string[];
+    readonly processEnv: NodeJS.ProcessEnv;
+}
+export declare function materializeDockerEnvironment(env: Readonly<Record<string, string>>, parentEnv?: NodeJS.ProcessEnv): DockerEnvironmentMaterialization;
+export declare function containerImageForRosterEntry(entry: Pick<RosterEntry, 'name' | 'imageRef' | 'imageTag'>): string;
+export declare function containerNameForWorkload(installationId: string, workloadName: string): string;
+export declare function reconcileInstallationServiceContainers(installationId: string, docker?: Pick<DockerCli, 'launcherServiceContainersStrict' | 'run'>): Promise<void>;
 export declare class ContainerRunner implements ServiceRunner {
     private readonly opts;
     readonly kind = ServiceRunnerKind.Container;
     private readonly docker;
+    private runtimePlatform;
     constructor(opts: ContainerRunnerOptions);
+    private hostPlatform;
     start(input: StartServiceInput): Promise<RunningService>;
 }
 //# sourceMappingURL=container-runner.d.ts.map

package/dist/runtime/runner/container-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"container-runner.d.ts","sourceRoot":"","sources":["../../../src/runtime/runner/container-runner.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACvB,MAAM,kBAAkB,CAAC;AAY1B,MAAM,WAAW,sBAAsB;IAErC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,qBAAa,eAAgB,YAAW,aAAa;IAIvC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,QAAQ,CAAC,IAAI,+BAA+B;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;gBAEN,IAAI,EAAE,sBAAsB;IAInD,KAAK,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;CAiD/D"}
+{"version":3,"file":"container-runner.d.ts","sourceRoot":"","sources":["../../../src/runtime/runner/container-runner.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,SAAS,EAMV,MAAM,cAAc,CAAC;AAOtB,OAAO,EACL,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACvB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,eAAO,MAAM,8BAA8B,OAAQ,CAAC;AAYpD,MAAM,WAAW,sBAAsB;IAErC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAS/B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;CACxC;AAED,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACrC,SAAS,GAAE,MAAM,CAAC,UAAwB,GACzC,gCAAgC,CAWlC;AAED,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,UAAU,GAAG,UAAU,CAAC,GACzD,MAAM,CAUR;AAED,wBAAgB,wBAAwB,CACtC,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,GACnB,MAAM,CAmBR;AAED,wBAAsB,sCAAsC,CAC1D,cAAc,EAAE,MAAM,EACtB,MAAM,GAAE,IAAI,CAAC,SAAS,EAAE,iCAAiC,GAAG,KAAK,CAChD,GAChB,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,qBAAa,eAAgB,YAAW,aAAa;IAWvC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAVjC,QAAQ,CAAC,IAAI,+BAA+B;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IAOnC,OAAO,CAAC,eAAe,CAAwC;gBAElC,IAAI,EAAE,sBAAsB;IAIzD,OAAO,CAAC,YAAY;IAKd,KAAK,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;CA4G/D"}