agent-hitch 0.2.5 → 0.2.7

package/dist/src/images/gc.js

@@ -0,0 +1,261 @@
+import { readdir, rm } from "node:fs/promises";
+import path from "node:path";
+import { HitchError, atomicWriteJSON, hitchRootId, readEvalEnvironmentImageReferences, readJSON, runCommand, sha256JSON, statePaths, withEnvironmentImageReferenceLock, withFileLock } from "../foundation/index.js";
+import { parseEnvironmentBuildRecord, parseEnvironmentImageManifest } from "./manifest.js";
+import { ENVIRONMENT_IMAGE_LABELS } from "./ownership.js";
+import { environmentBuildRecordPath, environmentImageManifestPath, loadEnvironmentImageManifest } from "./service.js";
+const TERMINAL_EVAL_STATES = new Set(["succeeded", "failed", "cancelled"]);
+export async function pinEnvironmentImage(root, imageId, reason) {
+    validateRootAndImage(root, imageId);
+    if (reason !== undefined && (!reason.trim() || reason.length > 1_024 || /[\0\r\n]/.test(reason)))
+        throw new TypeError("environment image pin reason is invalid");
+    await withEnvironmentImageReferenceLock(root, async () => {
+        await loadEnvironmentImageManifest(root, imageId);
+        const file = environmentImagePinPath(root, imageId);
+        const existing = await readJSON(file, null);
+        if (existing !== null) {
+            parsePin(existing, imageId);
+            return;
+        }
+        await atomicWriteJSON(file, {
+            schema_version: "1",
+            image_id: imageId,
+            pinned_at: new Date().toISOString(),
+            ...(reason === undefined ? {} : { reason }),
+        });
+    });
+}
+export async function unpinEnvironmentImage(root, imageId) {
+    validateRootAndImage(root, imageId);
+    await withEnvironmentImageReferenceLock(root, () => rm(environmentImagePinPath(root, imageId), { force: true }));
+}
+export async function gcEnvironmentImages(input) {
+    if (!input.root || typeof input.dryRun !== "boolean")
+        throw new TypeError("environment image GC input is invalid");
+    const minimumAgeMs = input.minimumAgeMs ?? 24 * 60 * 60 * 1_000;
+    if (!Number.isSafeInteger(minimumAgeMs) || minimumAgeMs < 0)
+        throw new TypeError("environment image GC minimum age is invalid");
+    const env = input.env ?? process.env;
+    const command = input.run ?? ((args) => runCommand(env.HITCH_DOCKER_PATH || "docker", args, {
+        env,
+        ...(input.signal ? { signal: input.signal } : {}),
+        timeoutMs: 30_000,
+        failureCode: "environment_image_gc_docker_failed",
+        failureExitCode: 12,
+    }));
+    return withEnvironmentImageReferenceLock(input.root, async () => {
+        const references = await referencedEnvironmentImages(input.root);
+        const manifests = await storedManifests(input.root);
+        const retained = [];
+        const eligible = [];
+        const removed = [];
+        const skipped = [];
+        for (const manifest of manifests) {
+            const reasons = [...(references.get(manifest.image_id) ?? [])].sort(compare);
+            if (reasons.length > 0) {
+                retained.push({ image_id: manifest.image_id, reasons });
+                continue;
+            }
+            if (manifest.source.kind === "registry") {
+                retained.push({ image_id: manifest.image_id, reasons: ["external-registry-image"] });
+                continue;
+            }
+            if (Date.now() - Date.parse(manifest.created_at) < minimumAgeMs) {
+                retained.push({ image_id: manifest.image_id, reasons: ["minimum-age"] });
+                continue;
+            }
+            const candidate = await withFileLock(statePaths(input.root).buildLocks, manifest.build.cache_key, async () => {
+                const current = await loadEnvironmentImageManifest(input.root, manifest.image_id);
+                if (JSON.stringify(current) !== JSON.stringify(manifest))
+                    throw gcError("environment image changed during GC");
+                return inspectGcCandidate(input.root, manifest, command);
+            }, { timeoutCode: "environment_image_gc_build_locked", timeoutExitCode: 12, ...(input.signal ? { signal: input.signal } : {}) });
+            if ("code" in candidate) {
+                skipped.push({ image_id: manifest.image_id, code: candidate.code });
+                continue;
+            }
+            eligible.push(candidate);
+            if (input.dryRun)
+                continue;
+            const deleted = await withFileLock(statePaths(input.root).buildLocks, manifest.build.cache_key, async () => {
+                const current = await loadEnvironmentImageManifest(input.root, manifest.image_id);
+                if (JSON.stringify(current) !== JSON.stringify(manifest))
+                    throw gcError("environment image changed during GC");
+                const rechecked = await inspectGcCandidate(input.root, manifest, command);
+                if ("code" in rechecked)
+                    return rechecked;
+                await command(["image", "rm", manifest.output.reference]);
+                await removeEnvironmentImageRecords(input.root, manifest);
+                return rechecked;
+            }, { timeoutCode: "environment_image_gc_build_locked", timeoutExitCode: 12, ...(input.signal ? { signal: input.signal } : {}) });
+            if ("code" in deleted)
+                skipped.push({ image_id: manifest.image_id, code: deleted.code });
+            else
+                removed.push(deleted);
+        }
+        return {
+            schema_version: "1",
+            dry_run: input.dryRun,
+            scanned: manifests.length,
+            retained: retained.sort(byImageId),
+            eligible: eligible.sort(byImageId),
+            removed: removed.sort(byImageId),
+            skipped: skipped.sort(byImageId),
+        };
+    });
+}
+async function inspectGcCandidate(root, manifest, command) {
+    if (!/^hitch-environment:[a-f0-9]{32}$/.test(manifest.output.reference) || !manifest.output.config_digest)
+        return { code: "not-owned-build-output" };
+    const record = parseEnvironmentBuildRecord(await readJSON(environmentBuildRecordPath(root, manifest.build.cache_key)));
+    if (record.state !== "succeeded" || record.image_id !== manifest.image_id || record.cache_key !== manifest.build.cache_key)
+        throw gcError("environment image build record does not match manifest");
+    let inspected;
+    try {
+        inspected = JSON.parse((await command(["image", "inspect", "--format", "{{json .}}", manifest.output.reference])).stdout);
+    }
+    catch {
+        return { code: "docker-image-unavailable" };
+    }
+    if (!inspected || typeof inspected !== "object" || Array.isArray(inspected))
+        return { code: "docker-inspect-invalid" };
+    const image = inspected;
+    const config = image.Config && typeof image.Config === "object" && !Array.isArray(image.Config) ? image.Config : {};
+    const labels = config.Labels && typeof config.Labels === "object" && !Array.isArray(config.Labels) ? config.Labels : {};
+    if (image.Id !== manifest.output.config_digest)
+        return { code: "config-digest-mismatch" };
+    if (labels[ENVIRONMENT_IMAGE_LABELS.rootId] !== hitchRootId(root)
+        || labels[ENVIRONMENT_IMAGE_LABELS.cacheKey] !== manifest.build.cache_key)
+        return { code: "ownership-label-mismatch" };
+    return { image_id: manifest.image_id, reference: manifest.output.reference, config_digest: manifest.output.config_digest };
+}
+async function referencedEnvironmentImages(root) {
+    const result = new Map();
+    const paths = statePaths(root);
+    for (const entry of await directories(paths.evals)) {
+        if (!/^eval_[a-f0-9]{32}$/.test(entry))
+            continue;
+        const directory = path.join(paths.evals, entry);
+        const control = await readJSON(path.join(directory, "control.json"), null);
+        const terminalResult = await readJSON(path.join(directory, "result.json"), null);
+        const terminal = TERMINAL_EVAL_STATES.has(String(control?.state)) || TERMINAL_EVAL_STATES.has(String(terminalResult?.status));
+        if (terminal)
+            continue;
+        const request = await readJSON(path.join(directory, "request.json"), null);
+        if (request === null && control === null)
+            continue;
+        const references = await readEvalEnvironmentImageReferences(directory, entry);
+        if (!references)
+            throw gcError(`active eval has no environment image reference fence: ${entry}`);
+        if (references.state !== "planned")
+            throw gcError(`active eval image planning is incomplete: ${entry}`);
+        for (const imageId of references.image_ids)
+            addReference(result, imageId, "active-eval");
+    }
+    for (const entry of await directories(paths.runs)) {
+        const index = await readJSON(path.join(paths.runs, entry, "bundle.index.json"), null);
+        if (index === null)
+            continue;
+        const manifest = await readJSON(path.join(paths.runs, entry, "manifest.json"), null);
+        const { bundle_digest: bundleDigest, created_at: _createdAt, ...bundleIdentity } = index;
+        if (index.schema_version !== "1" || index.sealed !== true || typeof index.run_id !== "string"
+            || typeof bundleDigest !== "string" || !/^sha256:[a-f0-9]{64}$/.test(bundleDigest)
+            || sha256JSON(bundleIdentity) !== bundleDigest
+            || manifest?.sealed !== true || manifest.run_id !== index.run_id)
+            throw gcError(`sealed bundle index is invalid: ${entry}`);
+        if (index.environment === undefined)
+            continue;
+        const environment = record(index.environment);
+        if (!environment || !Array.isArray(environment.images))
+            throw gcError(`sealed bundle environment is invalid: ${entry}`);
+        for (const image of environment.images) {
+            const value = record(image);
+            if (!value || typeof value.image_id !== "string" || !/^sha256:[a-f0-9]{64}$/.test(value.image_id))
+                throw gcError(`sealed bundle image reference is invalid: ${entry}`);
+            addReference(result, value.image_id, "sealed-bundle");
+        }
+    }
+    for (const entry of await files(paths.environmentImagePins)) {
+        if (!/^[a-f0-9]{64}\.json$/.test(entry))
+            throw gcError("environment image pin filename is invalid");
+        const imageId = `sha256:${entry.slice(0, 64)}`;
+        parsePin(await readJSON(path.join(paths.environmentImagePins, entry)), imageId);
+        addReference(result, imageId, "operator-pin");
+    }
+    return result;
+}
+async function storedManifests(root) {
+    const result = [];
+    for (const entry of await directories(statePaths(root).environmentImages)) {
+        if (!/^[a-f0-9]{64}$/.test(entry))
+            throw gcError("environment image store entry is invalid");
+        const manifest = parseEnvironmentImageManifest(await readJSON(path.join(statePaths(root).environmentImages, entry, "manifest.json")));
+        if (manifest.image_id !== `sha256:${entry}`)
+            throw gcError("environment image store path does not match manifest");
+        result.push(manifest);
+    }
+    return result.sort((left, right) => compare(left.image_id, right.image_id));
+}
+async function removeEnvironmentImageRecords(root, manifest) {
+    const paths = statePaths(root);
+    const manifestDirectory = path.dirname(environmentImageManifestPath(root, manifest.image_id));
+    const recordDirectory = path.dirname(environmentBuildRecordPath(root, manifest.build.cache_key));
+    const buildId = `build_${manifest.build.cache_key.slice("sha256:".length, "sha256:".length + 32)}`;
+    await rm(path.join(paths.buildIndexes, `${buildId}.json`), { force: true });
+    await rm(recordDirectory, { recursive: true, force: true });
+    await rm(manifestDirectory, { recursive: true, force: true });
+}
+function environmentImagePinPath(root, imageId) {
+    return path.join(statePaths(root).environmentImagePins, `${imageId.slice("sha256:".length)}.json`);
+}
+function parsePin(value, expectedImageId) {
+    const pin = record(value);
+    if (!pin || Object.keys(pin).some((key) => !["schema_version", "image_id", "pinned_at", "reason"].includes(key))
+        || pin.schema_version !== "1" || pin.image_id !== expectedImageId
+        || typeof pin.pinned_at !== "string" || !Number.isFinite(Date.parse(pin.pinned_at))
+        || pin.reason !== undefined && (typeof pin.reason !== "string" || !pin.reason || pin.reason.length > 1_024 || /[\0\r\n]/.test(pin.reason))) {
+        throw gcError("environment image pin is invalid");
+    }
+}
+async function directories(root) {
+    try {
+        return (await readdir(root, { withFileTypes: true })).filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort(compare);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+}
+async function files(root) {
+    try {
+        return (await readdir(root, { withFileTypes: true })).filter((entry) => entry.isFile()).map((entry) => entry.name).sort(compare);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+}
+function addReference(target, imageId, reason) {
+    const reasons = target.get(imageId) ?? new Set();
+    reasons.add(reason);
+    target.set(imageId, reasons);
+}
+function record(value) {
+    return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function validateRootAndImage(root, imageId) {
+    if (!root || !/^sha256:[a-f0-9]{64}$/.test(imageId))
+        throw new TypeError("environment image pin identity is invalid");
+}
+function gcError(message) {
+    return new HitchError(message, { code: "environment_image_gc_reference_scan_failed", exitCode: 12 });
+}
+function byImageId(left, right) {
+    return compare(left.image_id, right.image_id);
+}
+function compare(left, right) {
+    return Buffer.compare(Buffer.from(left), Buffer.from(right));
+}
+//# sourceMappingURL=gc.js.map

package/dist/src/images/gc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gc.js","sourceRoot":"","sources":["../../../src/images/gc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,kCAAkC,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,iCAAiC,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACrN,OAAO,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AAEtH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAY3E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,OAAe,EAAE,MAAe;IACtF,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,GAAG,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;IACjK,MAAM,iCAAiC,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,4BAA4B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAiB,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,MAAM,eAAe,CAAC,IAAI,EAAE;YAC1B,cAAc,EAAE,GAAG;YACnB,QAAQ,EAAE,OAAO;YACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;SAC5C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAY,EAAE,OAAe;IACvE,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,iCAAiC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACnH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAOzC;IACC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;IACnH,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IAChE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;IAChI,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,IAAc,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,iBAAiB,IAAI,QAAQ,EAAE,IAAI,EAAE;QACpG,GAAG;QACH,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,SAAS,EAAE,MAAM;QACjB,WAAW,EAAE,oCAAoC;QACjD,eAAe,EAAE,EAAE;KACpB,CAAC,CAAC,CAAC;IACJ,OAAO,iCAAiC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,UAAU,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,QAAQ,GAA2C,EAAE,CAAC;QAC5D,MAAM,QAAQ,GAA2C,EAAE,CAAC;QAC5D,MAAM,OAAO,GAA0C,EAAE,CAAC;QAC1D,MAAM,OAAO,GAA0C,EAAE,CAAC;QAC1D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;gBACxD,SAAS;YACX,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC;gBACrF,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,YAAY,EAAE,CAAC;gBAChE,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;gBACzE,SAAS;YACX,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;gBAC3G,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAClF,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;oBAAE,MAAM,OAAO,CAAC,qCAAqC,CAAC,CAAC;gBAC/G,OAAO,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC3D,CAAC,EAAE,EAAE,WAAW,EAAE,mCAAmC,EAAE,eAAe,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACjI,IAAI,MAAM,IAAI,SAAS,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;gBACpE,SAAS;YACX,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzB,IAAI,KAAK,CAAC,MAAM;gBAAE,SAAS;YAC3B,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;gBACzG,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAClF,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;oBAAE,MAAM,OAAO,CAAC,qCAAqC,CAAC,CAAC;gBAC/G,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAC1E,IAAI,MAAM,IAAI,SAAS;oBAAE,OAAO,SAAS,CAAC;gBAC1C,MAAM,OAAO,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC1D,MAAM,6BAA6B,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBAC1D,OAAO,SAAS,CAAC;YACnB,CAAC,EAAE,EAAE,WAAW,EAAE,mCAAmC,EAAE,eAAe,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACjI,IAAI,MAAM,IAAI,OAAO;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;;gBACpF,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO;YACL,cAAc,EAAE,GAAG;YACnB,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,OAAO,EAAE,SAAS,CAAC,MAAM;YACzB,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;YAClC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;YAClC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;YAChC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;SACjC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAAY,EACZ,QAAoC,EACpC,OAAyE;IAEzE,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa;QAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;IACrJ,MAAM,MAAM,GAAG,2BAA2B,CAAC,MAAM,QAAQ,CAAC,0BAA0B,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACvH,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,KAAK,CAAC,SAAS;QAAE,MAAM,OAAO,CAAC,wDAAwD,CAAC,CAAC;IACpM,IAAI,SAAkB,CAAC;IACvB,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5H,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;IACvH,MAAM,KAAK,GAAG,SAAoC,CAAC;IACnD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/I,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnJ,IAAI,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,MAAM,CAAC,aAAa;QAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;IAC1F,IAAI,MAAM,CAAC,wBAAwB,CAAC,MAAM,CAAC,KAAK,WAAW,CAAC,IAAI,CAAC;WAC5D,MAAM,CAAC,wBAAwB,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;IACzH,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;AAC7H,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,IAAY;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAiC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3G,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAiC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;QACjH,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9H,IAAI,QAAQ;YAAE,SAAS;QACvB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAiB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3F,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QACnD,MAAM,UAAU,GAAG,MAAM,kCAAkC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU;YAAE,MAAM,OAAO,CAAC,yDAAyD,KAAK,EAAE,CAAC,CAAC;QACjG,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS;YAAE,MAAM,OAAO,CAAC,6CAA6C,KAAK,EAAE,CAAC,CAAC;QACxG,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,SAAS;YAAE,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IAC3F,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAiC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAAC,EAAE,IAAI,CAAC,CAAC;QACtH,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC7B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAiC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,CAAC;QACrH,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,cAAc,EAAE,GAAG,KAAK,CAAC;QACzF,IAAI,KAAK,CAAC,cAAc,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;eACxF,OAAO,YAAY,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,YAAY,CAAC;eAC/E,UAAU,CAAC,cAAc,CAAC,KAAK,YAAY;eAC3C,QAAQ,EAAE,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YAAE,MAAM,OAAO,CAAC,mCAAmC,KAAK,EAAE,CAAC,CAAC;QAC9H,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;YAAE,SAAS;QAC9C,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC;YAAE,MAAM,OAAO,CAAC,yCAAyC,KAAK,EAAE,CAAC,CAAC;QACxH,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAAE,MAAM,OAAO,CAAC,6CAA6C,KAAK,EAAE,CAAC,CAAC;YACvK,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,QAAkB,EAAE,eAAe,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,OAAO,CAAC,2CAA2C,CAAC,CAAC;QACpG,MAAM,OAAO,GAAG,UAAU,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAY,CAAC;QACzD,QAAQ,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChF,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,MAAM,MAAM,GAAiC,EAAE,CAAC;IAChD,KAAK,MAAM,KAAK,IAAI,MAAM,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,OAAO,CAAC,0CAA0C,CAAC,CAAC;QAC7F,MAAM,QAAQ,GAAG,6BAA6B,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;QACtI,IAAI,QAAQ,CAAC,QAAQ,KAAK,UAAU,KAAK,EAAE;YAAE,MAAM,OAAO,CAAC,sDAAsD,CAAC,CAAC;QACnH,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,KAAK,UAAU,6BAA6B,CAAC,IAAY,EAAE,QAAoC;IAC7F,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,4BAA4B,CAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9F,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,0BAA0B,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,SAAS,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC;IACnG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,OAAO,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5E,MAAM,EAAE,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,EAAE,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY,EAAE,OAAe;IAC5D,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACrG,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc,EAAE,eAAuB;IACvD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;WAC3G,GAAG,CAAC,cAAc,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,eAAe;WAC9D,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;WAChF,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC7I,MAAM,OAAO,CAAC,kCAAkC,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY;IACrC,IAAI,CAAC;QAAC,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAC9I,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;AACnG,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,IAAY;IAC/B,IAAI,CAAC;QAAC,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IACzI,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;AACnG,CAAC;AAED,SAAS,YAAY,CAAC,MAAgC,EAAE,OAAe,EAAE,MAAc;IACrF,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAgC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/G,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,OAAe;IACzD,IAAI,CAAC,IAAI,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;AACxH,CAAC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,OAAO,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,4CAA4C,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;AACvG,CAAC;AAED,SAAS,SAAS,CAAC,IAA0B,EAAE,KAA2B;IACxE,OAAO,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,KAAa;IAC1C,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/dist/src/images/index.js

@@ -0,0 +1,10 @@
+export { resolveBuildContext } from "./context.js";
+export { inspectPinnedDockerfileBases } from "./dockerfile.js";
+export { environmentImageIdentity, parseEnvironmentBuildRecord, parseEnvironmentImageManifest } from "./manifest.js";
+export { EnvironmentImageService, loadEnvironmentImageManifest } from "./service.js";
+export { DockerBuildKitBuilder } from "./docker-buildkit.js";
+export { ENVIRONMENT_IMAGE_LABELS } from "./ownership.js";
+export { gcEnvironmentImages, pinEnvironmentImage, unpinEnvironmentImage } from "./gc.js";
+export { inspectEnvironmentBuild } from "./records.js";
+export { DockerRegistryResolver, resolveRegistryEnvironmentImage } from "./registry.js";
+//# sourceMappingURL=index.js.map

package/dist/src/images/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/images/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD,OAAO,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAC;AACrH,OAAO,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AAErF,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAE1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,sBAAsB,EAAE,+BAA+B,EAAE,MAAM,eAAe,CAAC"}

package/dist/src/images/manifest.js

@@ -0,0 +1,109 @@
+import { sha256JSON } from "../foundation/index.js";
+const SHA256 = /^sha256:[a-f0-9]{64}$/;
+export function environmentImageIdentity(value) {
+    return sha256JSON({
+        source: value.source,
+        platform: value.platform,
+        build: value.build,
+        output: {
+            manifest_digest: value.output.manifest_digest,
+            ...(value.output.config_digest ? { config_digest: value.output.config_digest } : {}),
+        },
+        base_images: value.base_images,
+    });
+}
+export function parseEnvironmentImageManifest(value) {
+    const manifest = exact(value, ["schema_version", "image_id", "source", "platform", "build", "output", "base_images", "created_at"], "environment image manifest");
+    if (manifest.schema_version !== "1" || !digest(manifest.image_id) || typeof manifest.platform !== "string" || !manifest.platform
+        || typeof manifest.created_at !== "string" || !Number.isFinite(Date.parse(manifest.created_at)))
+        throw new TypeError("environment image manifest identity is invalid");
+    const source = exact(manifest.source, ["kind", "benchmark_id", "benchmark_revision"], "environment image source", ["task_id", "context_digest", "dockerfile_digest"]);
+    if (!new Set(["registry", "build-context", "compose-build"]).has(String(source.kind))
+        || typeof source.benchmark_id !== "string" || !source.benchmark_id
+        || typeof source.benchmark_revision !== "string" || !source.benchmark_revision)
+        throw new TypeError("environment image source is invalid");
+    for (const name of ["task_id"])
+        if (source[name] !== undefined && (typeof source[name] !== "string" || !source[name]))
+            throw new TypeError(`environment image source ${name} is invalid`);
+    for (const name of ["context_digest", "dockerfile_digest"])
+        if (source[name] !== undefined && !digest(source[name]))
+            throw new TypeError(`environment image source ${name} is invalid`);
+    if (source.kind !== "registry" && (!digest(source.context_digest) || !digest(source.dockerfile_digest)))
+        throw new TypeError("built image source digests are missing");
+    const build = exact(manifest.build, ["builder", "secret_names", "cache_key"], "environment image build", ["buildkit_version", "builder_id", "frontend", "target", "build_args_sha256"]);
+    if (build.builder !== "buildkit" || !digest(build.cache_key))
+        throw new TypeError("environment image build identity is invalid");
+    for (const name of ["buildkit_version", "builder_id", "frontend", "target"])
+        if (build[name] !== undefined && (typeof build[name] !== "string" || !build[name]))
+            throw new TypeError(`environment image build ${name} is invalid`);
+    if (build.build_args_sha256 !== undefined && !digest(build.build_args_sha256))
+        throw new TypeError("environment image build args digest is invalid");
+    const secretNames = stringSet(build.secret_names, "environment image secret names", /^[A-Za-z_][A-Za-z0-9_]*$/);
+    const output = exact(manifest.output, ["reference", "manifest_digest"], "environment image output", ["config_digest"]);
+    if (typeof output.reference !== "string" || !output.reference || !digest(output.manifest_digest)
+        || (output.config_digest !== undefined && !digest(output.config_digest)))
+        throw new TypeError("environment image output is invalid");
+    if (!Array.isArray(manifest.base_images))
+        throw new TypeError("environment image base images are invalid");
+    const baseImages = manifest.base_images.map((entry) => {
+        const base = exact(entry, ["reference", "digest"], "environment image base image");
+        if (typeof base.reference !== "string" || !base.reference || !digest(base.digest))
+            throw new TypeError("environment image base image is invalid");
+        return { reference: base.reference, digest: base.digest };
+    });
+    if (!canonical(baseImages.map((entry) => entry.reference)) || new Set(baseImages.map((entry) => entry.reference)).size !== baseImages.length)
+        throw new TypeError("environment image base images are not canonical");
+    const parsed = {
+        schema_version: "1",
+        image_id: manifest.image_id,
+        source: source,
+        platform: manifest.platform,
+        build: { ...build, secret_names: secretNames },
+        output: output,
+        base_images: baseImages,
+        created_at: manifest.created_at,
+    };
+    const { image_id: _imageId, created_at: _createdAt, ...identity } = parsed;
+    if (environmentImageIdentity(identity) !== parsed.image_id)
+        throw new TypeError("environment image id does not match its identity");
+    return parsed;
+}
+export function parseEnvironmentBuildRecord(value) {
+    const record = exact(value, ["schema_version", "build_id", "cache_key", "state", "owner_id", "builder_id", "started_at"], "environment build record", ["completed_at", "image_id", "error"]);
+    if (record.schema_version !== "1" || typeof record.build_id !== "string" || !/^build_[a-f0-9]{32}$/.test(record.build_id)
+        || !digest(record.cache_key) || !new Set(["running", "succeeded", "failed"]).has(String(record.state))
+        || typeof record.owner_id !== "string" || !record.owner_id || typeof record.builder_id !== "string" || !record.builder_id
+        || typeof record.started_at !== "string" || !Number.isFinite(Date.parse(record.started_at)))
+        throw new TypeError("environment build record identity is invalid");
+    const terminal = record.state === "succeeded" || record.state === "failed";
+    if (terminal !== (typeof record.completed_at === "string" && Number.isFinite(Date.parse(record.completed_at))))
+        throw new TypeError("environment build terminal state is inconsistent");
+    if ((record.state === "succeeded") !== digest(record.image_id))
+        throw new TypeError("environment build image identity is inconsistent");
+    const error = record.error;
+    if ((record.state === "failed") !== Boolean(error) || (error && (typeof error !== "object" || Array.isArray(error)
+        || typeof error.code !== "string" || typeof error.message !== "string")))
+        throw new TypeError("environment build failure is inconsistent");
+    return record;
+}
+function exact(value, required, label, optional = []) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new TypeError(`${label} must be an object`);
+    const record = value;
+    if (required.some((key) => !(key in record)) || Object.keys(record).some((key) => !required.includes(key) && !optional.includes(key)))
+        throw new TypeError(`${label} fields are invalid`);
+    return record;
+}
+function digest(value) {
+    return typeof value === "string" && SHA256.test(value);
+}
+function stringSet(value, label, pattern) {
+    if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string" || !pattern.test(entry)) || !canonical(value)
+        || new Set(value).size !== value.length)
+        throw new TypeError(`${label} are invalid`);
+    return value;
+}
+function canonical(values) {
+    return values.every((value, index) => index === 0 || Buffer.compare(Buffer.from(values[index - 1]), Buffer.from(value)) < 0);
+}
+//# sourceMappingURL=manifest.js.map

package/dist/src/images/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../../src/images/manifest.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,MAAM,MAAM,GAAG,uBAAuB,CAAC;AAEvC,MAAM,UAAU,wBAAwB,CAAC,KAAkE;IACzG,OAAO,UAAU,CAAC;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE;YACN,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe;YAC7C,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrF;QACD,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,CAAC,EAAE,4BAA4B,CAAC,CAAC;IAClK,IAAI,QAAQ,CAAC,cAAc,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ;WAC3H,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;IACzK,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,oBAAoB,CAAC,EAAE,0BAA0B,EAAE,CAAC,SAAS,EAAE,gBAAgB,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACtK,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;WAChF,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,YAAY;WAC/D,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,kBAAkB;QAAE,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;IAC7I,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,CAAU;QAAE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,4BAA4B,IAAI,aAAa,CAAC,CAAC;IACnM,KAAK,MAAM,IAAI,IAAI,CAAC,gBAAgB,EAAE,mBAAmB,CAAU;QAAE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,4BAA4B,IAAI,aAAa,CAAC,CAAC;IACjM,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;IACvK,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,WAAW,CAAC,EAAE,yBAAyB,EAAE,CAAC,kBAAkB,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACxL,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;IACjI,KAAK,MAAM,IAAI,IAAI,CAAC,kBAAkB,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAU;QAAE,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,2BAA2B,IAAI,aAAa,CAAC,CAAC;IAC5O,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;IACrJ,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,YAAY,EAAE,gCAAgC,EAAE,0BAA0B,CAAC,CAAC;IAChH,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,0BAA0B,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;IACvH,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;WAC3F,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;IACvI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;IAC3G,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACpD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,8BAA8B,CAAC,CAAC;QACnF,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;QAClJ,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAgB,EAAE,CAAC;IACtE,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;IACrN,MAAM,MAAM,GAAG;QACb,cAAc,EAAE,GAAY;QAC5B,QAAQ,EAAE,QAAQ,CAAC,QAAkB;QACrC,MAAM,EAAE,MAAyD;QACjE,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,WAAW,EAAoD;QAChG,MAAM,EAAE,MAAyD;QACjE,WAAW,EAAE,UAAU;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CAAC;IACF,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC3E,IAAI,wBAAwB,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;IACpI,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACxD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,CAAC,EAAE,0BAA0B,EAAE,CAAC,cAAc,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7L,IAAI,MAAM,CAAC,cAAc,KAAK,GAAG,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;WACpH,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;WACnG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,UAAU;WACtH,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;IACnK,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,KAAK,WAAW,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC;IAC3E,IAAI,QAAQ,KAAK,CAAC,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;IACxL,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,WAAW,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;IACxI,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;WAC7G,OAAQ,KAAiC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAQ,KAAiC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;IACvM,OAAO,MAA6C,CAAC;AACvD,CAAC;AAED,SAAS,KAAK,CAAC,KAAc,EAAE,QAAkB,EAAE,KAAa,EAAE,WAAqB,EAAE;IACvF,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IACnH,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IAC1L,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,KAAa,EAAE,OAAe;IAC/D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;WACrH,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;IACvF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,MAAgB;IACjC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAW,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACzI,CAAC"}

package/dist/src/images/ownership.js

@@ -0,0 +1,5 @@
+export const ENVIRONMENT_IMAGE_LABELS = {
+    rootId: "io.hitch.environment-image-root-id",
+    cacheKey: "io.hitch.environment-image-cache-key",
+};
+//# sourceMappingURL=ownership.js.map

package/dist/src/images/ownership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownership.js","sourceRoot":"","sources":["../../../src/images/ownership.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,MAAM,EAAE,oCAAoC;IAC5C,QAAQ,EAAE,sCAAsC;CACxC,CAAC"}

package/dist/src/images/records.js

@@ -0,0 +1,32 @@
+import path from "node:path";
+import { readJSON, statePaths } from "../foundation/index.js";
+import { parseEnvironmentBuildRecord, parseEnvironmentImageManifest } from "./manifest.js";
+import { environmentBuildRecordPath, environmentImageManifestPath } from "./service.js";
+export async function inspectEnvironmentBuild(root, buildId) {
+    if (!/^build_[a-f0-9]{32}$/.test(buildId))
+        throw new TypeError("environment build id is invalid");
+    const index = await readJSON(path.join(statePaths(root).buildIndexes, `${buildId}.json`), null);
+    if (!index)
+        return null;
+    if (Object.keys(index).some((key) => !new Set(["schema_version", "build_id", "cache_key"]).has(key))
+        || index.schema_version !== "1" || index.build_id !== buildId || typeof index.cache_key !== "string"
+        || !/^sha256:[a-f0-9]{64}$/.test(index.cache_key)
+        || buildId !== `build_${index.cache_key.slice("sha256:".length, "sha256:".length + 32)}`)
+        throw new TypeError("environment build index is invalid");
+    const recordValue = await readJSON(environmentBuildRecordPath(root, index.cache_key), null);
+    if (!recordValue)
+        throw new TypeError("environment build record is missing");
+    const record = parseEnvironmentBuildRecord(recordValue);
+    if (record.build_id !== buildId || record.cache_key !== index.cache_key)
+        throw new TypeError("environment build record does not match its index");
+    if (!record.image_id)
+        return { record, manifest: null };
+    const manifestValue = await readJSON(environmentImageManifestPath(root, record.image_id), null);
+    if (!manifestValue)
+        throw new TypeError("environment image manifest is missing");
+    const manifest = parseEnvironmentImageManifest(manifestValue);
+    if (manifest.image_id !== record.image_id || manifest.build.cache_key !== record.cache_key)
+        throw new TypeError("environment image manifest does not match its build");
+    return { record, manifest };
+}
+//# sourceMappingURL=records.js.map

package/dist/src/images/records.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"records.js","sourceRoot":"","sources":["../../../src/images/records.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AAOxF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAY,EAAE,OAAe;IACzE,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;IAClG,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAiC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,GAAG,OAAO,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;IAChI,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;WAC/F,KAAK,CAAC,cAAc,KAAK,GAAG,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;WACjG,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;WAC9C,OAAO,KAAK,SAAS,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,oCAAoC,CAAC,CAAC;IACtJ,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAiB,0BAA0B,CAAC,IAAI,EAAE,KAAK,CAAC,SAAmB,CAAC,EAAE,IAAI,CAAC,CAAC;IACtH,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,mDAAmD,CAAC,CAAC;IAClJ,IAAI,CAAC,MAAM,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACxD,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAiB,4BAA4B,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IAChH,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,6BAA6B,CAAC,aAAa,CAAC,CAAC;IAC9D,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;IACvK,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC"}

package/dist/src/images/registry.js

@@ -0,0 +1,154 @@
+import { lstat } from "node:fs/promises";
+import path from "node:path";
+import { HitchError, atomicWriteJSON, ensureDir, readJSON, runCommand, sha256JSON } from "../foundation/index.js";
+import { environmentImageIdentity, parseEnvironmentImageManifest } from "./manifest.js";
+import { environmentImageManifestPath } from "./service.js";
+export async function resolveRegistryEnvironmentImage(input) {
+    if (!input.root || !input.benchmarkId || !input.benchmarkRevision || !validReference(input.reference) || !input.platform || !input.resolver.id) {
+        throw new TypeError("registry image request identity is invalid");
+    }
+    const secretNames = canonicalNames(input.secretNames ?? []);
+    const resolved = await input.resolver.resolve(input.reference, input.platform, input.signal);
+    if (resolved.platform !== input.platform || !digest(resolved.manifest_digest) || (resolved.config_digest !== undefined && !digest(resolved.config_digest))
+        || !validReference(resolved.reference) || repositoryOf(resolved.reference) !== repositoryOf(input.reference)
+        || !resolved.reference.endsWith(`@${resolved.manifest_digest}`)) {
+        throw new HitchError("registry image identity does not match the request", { code: "image_output_mismatch", exitCode: 12 });
+    }
+    const requestedDigest = input.reference.match(/@(sha256:[a-f0-9]{64})$/)?.[1];
+    if (requestedDigest && requestedDigest !== resolved.manifest_digest)
+        throw new HitchError("registry digest resolution changed an immutable reference", { code: "image_digest_mismatch", exitCode: 12 });
+    const cacheKey = sha256JSON({ kind: "registry", requested_reference: input.reference, manifest_digest: resolved.manifest_digest, platform: input.platform });
+    const withoutIdentity = {
+        schema_version: "1",
+        source: {
+            kind: "registry",
+            benchmark_id: input.benchmarkId,
+            benchmark_revision: input.benchmarkRevision,
+            ...(input.taskId ? { task_id: input.taskId } : {}),
+        },
+        platform: input.platform,
+        build: {
+            builder: "buildkit",
+            builder_id: input.resolver.id,
+            frontend: "registry-resolution",
+            secret_names: secretNames,
+            cache_key: cacheKey,
+        },
+        output: {
+            reference: resolved.reference,
+            manifest_digest: resolved.manifest_digest,
+            ...(resolved.config_digest ? { config_digest: resolved.config_digest } : {}),
+        },
+        base_images: [],
+    };
+    const manifest = parseEnvironmentImageManifest({
+        ...withoutIdentity,
+        image_id: environmentImageIdentity(withoutIdentity),
+        created_at: new Date().toISOString(),
+    });
+    const file = environmentImageManifestPath(input.root, manifest.image_id);
+    const cacheHit = await regularFile(file);
+    if (cacheHit) {
+        const persisted = parseEnvironmentImageManifest(await readJSON(file));
+        if (persisted.image_id !== manifest.image_id || persisted.output.manifest_digest !== manifest.output.manifest_digest)
+            throw new TypeError("registry image cache identity changed");
+        return { manifest: persisted, cacheHit: true };
+    }
+    await ensureDir(path.dirname(file));
+    await atomicWriteJSON(file, manifest);
+    return { manifest: parseEnvironmentImageManifest(await readJSON(file)), cacheHit: false };
+}
+export class DockerRegistryResolver {
+    id;
+    docker;
+    env;
+    constructor({ dockerExecutable, env = process.env, id = "local-docker-registry" } = {}) {
+        if (!id)
+            throw new TypeError("Docker registry resolver id is invalid");
+        this.id = id;
+        this.docker = dockerExecutable || env.HITCH_DOCKER_PATH || "docker";
+        this.env = env;
+    }
+    async resolve(reference, platform, signal) {
+        if (!validReference(reference) || !platform)
+            throw new TypeError("Docker registry image request is invalid");
+        try {
+            await runCommand(this.docker, ["pull", "--platform", platform, reference], {
+                env: this.env,
+                failureCode: "image_registry_unavailable",
+                failureExitCode: 3,
+                ...(signal ? { signal } : {}),
+            });
+            const result = await runCommand(this.docker, ["image", "inspect", "--format", "{{json .}}", reference], {
+                env: this.env,
+                failureCode: "image_unavailable",
+                failureExitCode: 12,
+                timeoutMs: 30_000,
+                ...(signal ? { signal } : {}),
+            });
+            return parseDockerInspection(reference, platform, result.stdout);
+        }
+        catch (error) {
+            if (error.code === "cancelled")
+                throw error;
+            throw new HitchError("registry image resolution failed", { code: error.code || "image_registry_unavailable", exitCode: 12, cause: error });
+        }
+    }
+}
+function parseDockerInspection(requested, platform, stdout) {
+    let value;
+    try {
+        value = JSON.parse(stdout);
+    }
+    catch {
+        throw new TypeError("Docker registry inspection is invalid");
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new TypeError("Docker registry inspection is invalid");
+    const image = value;
+    if (!digest(image.Id) || typeof image.Os !== "string" || typeof image.Architecture !== "string" || !Array.isArray(image.RepoDigests))
+        throw new TypeError("Docker registry image identity is invalid");
+    const actualPlatform = `${image.Os}/${image.Architecture}${typeof image.Variant === "string" && image.Variant ? `/${image.Variant}` : ""}`;
+    if (actualPlatform !== platform)
+        throw new HitchError("registry image platform does not match", { code: "image_platform_mismatch", exitCode: 12 });
+    const candidates = image.RepoDigests.filter((entry) => typeof entry === "string" && /@sha256:[a-f0-9]{64}$/.test(entry));
+    const requestedDigest = requested.match(/@(sha256:[a-f0-9]{64})$/)?.[1];
+    const repository = repositoryOf(requested);
+    const selected = candidates.find((entry) => entry === `${repository}@${requestedDigest}`)
+        ?? candidates.find((entry) => entry.startsWith(`${repository}@`))
+        ?? (candidates.length === 1 ? candidates[0] : undefined);
+    if (!selected)
+        throw new TypeError("Docker registry manifest digest is unavailable");
+    const manifestDigest = selected.slice(selected.lastIndexOf("@") + 1);
+    if (requestedDigest && manifestDigest !== requestedDigest)
+        throw new HitchError("Docker registry digest does not match", { code: "image_digest_mismatch", exitCode: 12 });
+    return { reference: `${repository}@${manifestDigest}`, manifest_digest: manifestDigest, config_digest: image.Id, platform: actualPlatform };
+}
+function repositoryOf(reference) {
+    const withoutDigest = reference.split("@")[0];
+    const slash = withoutDigest.lastIndexOf("/");
+    const colon = withoutDigest.lastIndexOf(":");
+    return colon > slash ? withoutDigest.slice(0, colon) : withoutDigest;
+}
+function validReference(value) {
+    return typeof value === "string" && value.length > 0 && value.length <= 1_024 && !/[\s\0]/.test(value) && !value.includes("://");
+}
+function digest(value) {
+    return typeof value === "string" && /^sha256:[a-f0-9]{64}$/.test(value);
+}
+function canonicalNames(value) {
+    if (value.some((name) => !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)))
+        throw new TypeError("registry secret names are invalid");
+    return [...new Set(value)].sort((left, right) => Buffer.compare(Buffer.from(left), Buffer.from(right)));
+}
+async function regularFile(file) {
+    try {
+        return (await lstat(file)).isFile();
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return false;
+        throw error;
+    }
+}
+//# sourceMappingURL=registry.js.map