devchain-cli 0.23.3 → 0.24.0

package/dist/server/modules/remotes/docker/docker-handoff.js

@@ -0,0 +1,798 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DockerHandoff = void 0;
+exports.dockerSelection = dockerSelection;
+exports.buildRecord = buildRecord;
+exports.captureSettings = captureSettings;
+const docker_data_groups_1 = require("./docker-data-groups");
+const common_1 = require("@nestjs/common");
+const node_crypto_1 = require("node:crypto");
+const node_stream_1 = require("node:stream");
+const promises_1 = require("node:stream/promises");
+const error_types_1 = require("../../../common/errors/error-types");
+const logger_1 = require("../../../common/logging/logger");
+const docker_archive_journal_1 = require("../../core/controllers/docker-archive-journal");
+const docker_archive_1 = require("../../core/controllers/docker-archive");
+const docker_engine_client_1 = require("../../core/controllers/docker-engine.client");
+const docker_settings_1 = require("../../core/controllers/docker-settings");
+const file_sync_dto_1 = require("../../file-sync/file-sync.dto");
+const file_sync_managed_exclusions_store_1 = require("../../file-sync/file-sync-managed-exclusions.store");
+const docker_import_inventory_store_1 = require("../operations/docker-import-inventory.store");
+const remote_host_client_1 = require("../operations/remote-host.client");
+const remote_operation_errors_1 = require("../operations/remote-operation.errors");
+const remote_operation_types_1 = require("../operations/remote-operation.types");
+const docker_plan_fit_1 = require("./docker-plan-fit");
+const docker_plan_files_1 = require("./docker-plan-files");
+const docker_plan_dto_1 = require("./docker-plan.dto");
+const docker_plan_policy_1 = require("./docker-plan-policy");
+const docker_plan_service_1 = require("./docker-plan.service");
+const docker_plan_source_service_1 = require("./docker-plan-source.service");
+const docker_handoff_store_1 = require("./docker-handoff.store");
+const logger = (0, logger_1.createLogger)('DockerHandoff');
+const RATE_WARMUP_MS = 5_000;
+const DEFAULT_NETWORKS = new Set(['bridge', 'host', 'none', 'default']);
+function dockerSelection(details) {
+    const selection = details.dockerSelection;
+    return selection?.items?.length ? selection : null;
+}
+class DockerHandoffError extends error_types_1.AppError {
+    constructor(message, code = 'DOCKER_HANDOFF_FAILED') {
+        super(message, code, 502);
+    }
+}
+function clean(error) {
+    if (error instanceof error_types_1.AppError)
+        return error;
+    if (error instanceof docker_engine_client_1.DockerEngineError)
+        return new DockerHandoffError(error.message, (0, docker_engine_client_1.dockerErrorCode)(error.code));
+    return new DockerHandoffError('The Docker copy failed.');
+}
+function notFound(error) {
+    return ((error instanceof remote_host_client_1.RemoteHostRequestError &&
+        (error.status === 404 || error.details?.hostCode === 'not-found')) ||
+        (0, docker_engine_client_1.isDockerNotFound)(error));
+}
+let DockerHandoff = class DockerHandoff {
+    plans;
+    source;
+    host;
+    store;
+    journal;
+    exclusions;
+    inventory;
+    active = new Map();
+    rollbackLimits = { vmCleanupMs: 10 * 60_000, homeConnectMs: 30_000, homeStartMs: 60_000 };
+    constructor(plans, source, host, store, journal, exclusions, inventory) {
+        this.plans = plans;
+        this.source = source;
+        this.host = host;
+        this.store = store;
+        this.journal = journal;
+        this.exclusions = exclusions;
+        this.inventory = inventory;
+    }
+    interrupt(operationId) {
+        this.active.get(operationId)?.abort();
+    }
+    preflight(run) {
+        return this.step(run, async (signal) => {
+            const projectId = (0, remote_operation_types_1.requireProjectId)(run.operation);
+            const selection = dockerSelection(run.details);
+            if (!selection)
+                return;
+            const plan = await this.plans.plan(projectId, { remoteId: run.operation.remoteId, items: selection.items }, signal, { estimate: false });
+            if (!plan.availability.available || !plan.apiVersion)
+                throw new remote_operation_errors_1.RemoteOperationStepRefusedError('DOCKER_PLAN_REFUSED', plan.availability.reason?.message ?? 'Docker is unavailable.', { reason: plan.availability.reason?.code ?? null });
+            const selected = plan.items.filter((item) => item.selectedMode);
+            if (!plan.canConnect) {
+                const reasons = [
+                    ...plan.filesystems
+                        .filter((fs) => fs.status === 'refused')
+                        .map((fs) => `Not enough space on the VM for ${fs.paths.join(', ')}.`),
+                    ...selected.flatMap((item) => item.blockers
+                        .filter((b) => (0, docker_plan_policy_1.blocksMode)(item.selectedMode, b.code))
+                        .map((b) => `${item.name}: ${b.message}`)),
+                ];
+                throw new remote_operation_errors_1.RemoteOperationStepRefusedError('DOCKER_PLAN_REFUSED', reasons.join(' ') || 'The Docker import cannot proceed.', { fit: plan.fit });
+            }
+            const record = buildRecord(plan.items, selected, plan.apiVersion, await this.plans.projectRoot(projectId));
+            const previousRecord = await this.store.read(run.operation.id);
+            record.inventoryBefore =
+                previousRecord?.inventoryBefore !== undefined
+                    ? previousRecord.inventoryBefore
+                    : this.inventory.get(projectId, run.operation.remoteId);
+            const managed = [
+                ...new Set([
+                    ...plan.managedExclusions,
+                    ...(this.inventory
+                        .get(projectId, run.operation.remoteId)
+                        ?.items.flatMap((item) => item.bindPaths) ?? []),
+                ]),
+            ];
+            if (managed.length > file_sync_dto_1.IGNORE_PATTERNS_MAX)
+                throw new remote_operation_errors_1.RemoteOperationStepRefusedError('DOCKER_TOO_MANY_DATA_FOLDERS', `The Docker data folders need ${managed.length} file-sync exclusions; at most ${file_sync_dto_1.IGNORE_PATTERNS_MAX} are supported.`, { count: managed.length });
+            await this.store.write(run.operation.id, record);
+            if (!('managedExclusionsBefore' in run.details))
+                await run.progress({ managedExclusionsBefore: this.exclusions.get(projectId) });
+            this.exclusions.set(projectId, managed);
+            await run.progress({
+                docker: {
+                    bytesDone: 0,
+                    bytesTotal: record.bytesTotal,
+                    rateBytesPerSecond: null,
+                    etaSeconds: null,
+                    item: null,
+                    replaced: plan.reconnect?.replacing ?? [],
+                },
+            });
+        });
+    }
+    stopHome(run) {
+        return this.step(run, async (signal) => {
+            const record = await this.requireRecord(run.operation.id);
+            const client = await this.homeClient(record, signal);
+            const settings = await this.store.readSettings(run.operation.id);
+            for (const item of record.items.filter((i) => i.createsContainer)) {
+                if (settings[item.id])
+                    continue;
+                const inspect = await client.json('GET', `/containers/${encodeURIComponent(item.id)}/json`, undefined, { signal });
+                const captured = captureSettings(inspect, item.name, client.socketPath);
+                for (const name of networkNames(captured.config))
+                    if (!record.networks.some((n) => n.name === name))
+                        record.networks.push(await homeNetwork(client, name, signal));
+                settings[item.id] = captured;
+            }
+            await this.store.writeSettings(run.operation.id, settings);
+            await this.store.write(run.operation.id, record);
+            for (const id of record.stopIds) {
+                let state;
+                try {
+                    state = await client.json('GET', `/containers/${encodeURIComponent(id)}/json`, undefined, { signal });
+                }
+                catch (error) {
+                    if (notFound(error))
+                        continue;
+                    throw error;
+                }
+                if (!state.State?.Running)
+                    continue;
+                if (!record.stopped.some((s) => s.id === id)) {
+                    record.stopped.push({
+                        id,
+                        temporary: state.HostConfig?.AutoRemove === true,
+                        ...(state.Name && { name: state.Name.replace(/^\//, '') }),
+                    });
+                    await this.store.write(run.operation.id, record);
+                }
+                await (0, docker_engine_client_1.changeDockerContainerState)(client, id, 'stop', signal);
+            }
+        });
+    }
+    push(run) {
+        return this.step(run, async (signal) => {
+            const projectId = (0, remote_operation_types_1.requireProjectId)(run.operation);
+            const { remoteId } = run.operation;
+            const record = await this.requireRecord(run.operation.id);
+            const client = await this.homeClient(record, signal);
+            const options = { signal, apiVersion: record.apiVersion };
+            const progress = new TransferProgress(run, record);
+            await this.journal.reconcile(client, signal);
+            const pendingImages = record.images.filter((i) => !record.verified.images.includes(i.id));
+            const present = pendingImages.length
+                ? (await this.host.dockerImagesPresent(remoteId, pendingImages.map((i) => i.id), options)).ids
+                : [];
+            for (const image of pendingImages) {
+                progress.item(image.id, 'image', image.sizeBytes);
+                if (!present.includes(image.id)) {
+                    const saved = await saveImage(client, image.id, signal);
+                    await this.host.dockerLoadImage(remoteId, progress.count(saved), options);
+                    const loaded = await this.host.dockerImagesPresent(remoteId, [image.id], options);
+                    if (!loaded.ids.includes(image.id))
+                        throw new DockerHandoffError('The VM did not load an image with the expected ID.');
+                }
+                record.verified.images.push(image.id);
+                await this.store.write(run.operation.id, record);
+                progress.complete();
+            }
+            const presentKeptVolumes = record.ensureVolumes?.length
+                ? new Set((await this.host.dockerScan(remoteId, [], options)).volumes.map((v) => v.name))
+                : new Set();
+            for (const name of record.ensureVolumes ?? []) {
+                if (!presentKeptVolumes.has(name) && !record.created.volumes.includes(name)) {
+                    record.created.volumes.push(name);
+                    await this.store.write(run.operation.id, record);
+                }
+                await this.host.dockerCreateVolume(remoteId, {
+                    projectId,
+                    name,
+                    labels: await homeVolumeLabels(client, name, signal),
+                }, options);
+            }
+            const existing = record.volumes.some((v) => !restoresData(record, v.name))
+                ? new Set((await this.host.dockerScan(remoteId, [], options)).volumes.map((v) => v.name))
+                : new Set();
+            for (const volume of record.volumes) {
+                if (record.verified.volumes.includes(volume.name))
+                    continue;
+                const restore = restoresData(record, volume.name);
+                progress.item(volume.name, 'volume', restore ? volume.sizeBytes : 0);
+                if (!restore &&
+                    existing.has(volume.name) &&
+                    !record.created.volumes.includes(volume.name)) {
+                    record.verified.volumes.push(volume.name);
+                    await this.store.write(run.operation.id, record);
+                    progress.complete();
+                    continue;
+                }
+                await this.replaceVolume(run.operation.id, record, projectId, remoteId, volume, options);
+                const labels = await homeVolumeLabels(client, volume.name, signal);
+                record.created.volumes.push(volume.name);
+                await this.store.write(run.operation.id, record);
+                await this.host.dockerCreateVolume(remoteId, { projectId, name: volume.name, labels }, options);
+                if (restore) {
+                    await this.copy(client, progress, remoteId, { projectId, image: volume.helperImage, mountType: 'volume', source: volume.name }, options);
+                    (record.copiedData ??= { volumes: [], binds: [] }).volumes.push(volume.name);
+                }
+                record.verified.volumes.push(volume.name);
+                await this.store.write(run.operation.id, record);
+                progress.complete();
+            }
+            await progress.finish();
+        });
+    }
+    createHost(run) {
+        return this.step(run, async (signal) => {
+            const projectId = (0, remote_operation_types_1.requireProjectId)(run.operation);
+            const { remoteId } = run.operation;
+            const record = await this.requireRecord(run.operation.id);
+            const client = await this.homeClient(record, signal);
+            const options = { signal, apiVersion: record.apiVersion };
+            const progress = new TransferProgress(run, record);
+            for (let offset = 0; offset < (record.ensureBinds?.length ?? 0); offset += 64)
+                await this.host.dockerPrepareBinds(remoteId, {
+                    projectId,
+                    paths: record
+                        .ensureBinds.slice(offset, offset + 64)
+                        .map((path) => ({ path, replace: false })),
+                }, options);
+            const binds = record.binds.filter((b) => !record.verified.binds.includes(b.path));
+            const created = binds.filter((b) => !b.replace);
+            for (let offset = 0; offset < created.length; offset += 64)
+                await this.host.dockerPrepareBinds(remoteId, {
+                    projectId,
+                    paths: created
+                        .slice(offset, offset + 64)
+                        .map((b) => ({ path: b.path, replace: false })),
+                }, options);
+            for (const bind of binds.filter((b) => b.replace)) {
+                try {
+                    await this.host.dockerPrepareBinds(remoteId, { projectId, paths: [{ path: bind.path, replace: true, image: bind.helperImage }] }, options);
+                }
+                catch (error) {
+                    if (!(error instanceof remote_host_client_1.RemoteHostRequestError) || error.status !== 422)
+                        throw error;
+                    throw new DockerHandoffError(`The VM folder ${bind.path} could not be emptied for the fresh copy. Empty it on the VM (for example, sudo rm -rf ${bind.path}/*) and press Retry, or Cancel.`, 'DOCKER_BIND_CLEAR_FAILED');
+                }
+            }
+            for (const bind of binds) {
+                progress.item(bind.path, 'bind', bind.sizeBytes);
+                await this.copy(client, progress, remoteId, { projectId, image: bind.helperImage, mountType: 'bind', source: bind.path }, options);
+                (record.copiedData ??= { volumes: [], binds: [] }).binds.push(bind.path);
+                record.verified.binds.push(bind.path);
+                await this.store.write(run.operation.id, record);
+                progress.complete();
+            }
+            for (const network of record.networks) {
+                progress.item(network.name, 'network');
+                const { created } = await this.host.dockerCreateNetwork(remoteId, {
+                    projectId,
+                    name: network.name,
+                    labels: network.labels,
+                    internal: network.internal,
+                    attachable: network.attachable,
+                    options: network.options,
+                }, options);
+                if (created && !record.created.networks.includes(network.name)) {
+                    record.created.networks.push(network.name);
+                    await this.store.write(run.operation.id, record);
+                }
+            }
+            const settings = await this.store.readSettings(run.operation.id);
+            for (const item of record.items.filter((i) => i.createsContainer)) {
+                if (record.verified.containers.includes(item.name))
+                    continue;
+                const captured = settings[item.id];
+                if (!captured)
+                    throw new DockerHandoffError(`The captured settings of ${item.name} are missing.`);
+                progress.item(item.name, 'container');
+                if (item.targetAction === 'replace' || record.created.containers.includes(item.name))
+                    await this.deleteIfPresent(remoteId, 'containers', item.name, projectId, options);
+                record.created.containers.push(item.name);
+                await this.store.write(run.operation.id, record);
+                await this.host.dockerCreateContainer(remoteId, { projectId, name: item.name, config: captured.config }, options);
+                record.verified.containers.push(item.name);
+                await this.store.write(run.operation.id, record);
+            }
+            await progress.finish();
+            const imported = record.items
+                .filter((item) => item.targetAction !== 'leave-as-is' &&
+                !record.keptInventory?.some((kept) => kept.name === item.name))
+                .map((item) => ({
+                name: item.name,
+                imageId: item.imageIds[0] ?? item.id,
+                volumes: item.volumes.map((name) => ({
+                    name,
+                    sizeBytes: record.volumes.find((v) => v.name === name)?.sizeBytes ?? null,
+                })),
+                bindPaths: item.binds
+                    .filter((path) => (0, docker_plan_files_1.within)(record.projectRoot, path))
+                    .map((path) => (0, docker_plan_files_1.projectAnchoredPath)(record.projectRoot, path)),
+                sizeBytes: item.sizeBytes,
+            }));
+            imported.push(...(record.keptInventory ?? []));
+            const kept = (this.inventory.get(projectId, remoteId)?.items ?? []).filter((prior) => !imported.some((item) => item.name === prior.name));
+            record.inventoryStampedAt ??= new Date().toISOString();
+            if (record.inventoryBefore === undefined)
+                record.inventoryBefore = this.inventory.get(projectId, remoteId);
+            await this.store.write(run.operation.id, record);
+            const stamped = (record.dataGroups ?? [])
+                .filter((group) => !record.keptGroups?.some((kept) => kept.itemIds.some((id) => group.itemIds.includes(id))) &&
+                record.items
+                    .filter((i) => group.itemIds.includes(i.id))
+                    .every((i) => i.targetAction !== 'leave-as-is' && i.mode !== 'without-data') &&
+                group.volumes.every((v) => record.copiedData?.volumes.includes(v)) &&
+                group.bindPaths.every((p) => record.copiedData?.binds.some((copied) => (0, docker_plan_files_1.within)(copied, p))))
+                .map(({ volumes, bindPaths }) => ({
+                volumes,
+                bindPaths,
+                lastSyncedAt: record.inventoryStampedAt,
+                lastSyncDirection: 'to-vm',
+            }));
+            const preserved = new Map((record.inventoryBefore?.groups ?? []).map((g) => [(0, docker_data_groups_1.dataGroupIdentity)(g), g]));
+            for (const { volumes, bindPaths } of record.discardedHomeGroups ?? []) {
+                const key = (0, docker_data_groups_1.dataGroupIdentity)({ volumes, bindPaths });
+                preserved.set(key, {
+                    ...preserved.get(key),
+                    volumes,
+                    bindPaths,
+                    homeDiscardedAt: record.inventoryStampedAt,
+                });
+            }
+            this.inventory.set(projectId, remoteId, {
+                groups: (0, docker_data_groups_1.supersedeGroupRecords)([...preserved.values()], stamped),
+                importedAt: record.inventoryStampedAt,
+                items: [...imported, ...kept],
+            });
+            const docker = (run.details.docker ?? {});
+            await run.progress({
+                docker: {
+                    ...docker,
+                    item: null,
+                    result: {
+                        withoutData: record.items.filter((i) => i.mode === 'without-data').map((i) => i.name),
+                        dataOnly: record.items.filter((i) => i.mode === 'data-only').map((i) => i.name),
+                    },
+                },
+            });
+        });
+    }
+    stopHost(run) {
+        return this.step(run, async (signal) => {
+            const projectId = (0, remote_operation_types_1.requireProjectId)(run.operation);
+            if (!this.inventory.get(projectId, run.operation.remoteId))
+                return;
+            try {
+                await this.host.dockerStopProject(run.operation.remoteId, projectId, { signal });
+            }
+            catch (error) {
+                if (!(error instanceof remote_host_client_1.RemoteHostRequestError) || error.status !== 503)
+                    throw error;
+                run.details.dockerStopSkipped = 'The VM Docker engine is unavailable.';
+            }
+        });
+    }
+    async rollback(operation) {
+        const record = await this.store.read(operation.id);
+        if (!record) {
+            await this.store.remove(operation.id);
+            return {};
+        }
+        const projectId = (0, remote_operation_types_1.requireProjectId)(operation);
+        if (record.inventoryBefore !== undefined) {
+            if (record.inventoryBefore)
+                this.inventory.set(projectId, operation.remoteId, record.inventoryBefore);
+            else
+                this.inventory.delete(projectId, operation.remoteId);
+        }
+        const cleanupSignal = AbortSignal.timeout(this.rollbackLimits.vmCleanupMs);
+        const options = { apiVersion: record.apiVersion, signal: cleanupSignal };
+        let cleanupError;
+        if ((0, remote_operation_types_1.stepStarted)(operation, 'docker_push') || (0, remote_operation_types_1.stepStarted)(operation, 'docker_create_host')) {
+            try {
+                for (const name of [...record.created.containers].reverse())
+                    await this.deleteIfPresent(operation.remoteId, 'containers', name, projectId, options);
+                for (const name of record.created.networks)
+                    await this.deleteIfPresent(operation.remoteId, 'networks', name, projectId, options).catch(() => undefined);
+                for (const name of record.created.volumes)
+                    await this.deleteIfPresent(operation.remoteId, 'volumes', name, projectId, options);
+            }
+            catch (error) {
+                if (cleanupSignal.aborted)
+                    cleanupError =
+                        'The VM Docker cleanup did not finish in time. Remove the remaining Docker items of this project on the VM.';
+                else
+                    cleanupError =
+                        error instanceof error_types_1.AppError ? error.message : 'The VM Docker cleanup failed.';
+                logger.warn({ operationId: operation.id }, 'Docker VM cleanup after cancel failed');
+            }
+        }
+        const notRestarted = [];
+        const restart = record.stopped.filter((s) => !s.temporary);
+        if (restart.length) {
+            const client = await this.homeClient(record, AbortSignal.timeout(this.rollbackLimits.homeConnectMs)).catch(() => null);
+            for (const stopped of restart) {
+                const started = client !== null &&
+                    (await (0, docker_engine_client_1.changeDockerContainerState)(client, stopped.id, 'start', AbortSignal.timeout(this.rollbackLimits.homeStartMs)).then(() => true, () => false));
+                if (!started)
+                    notRestarted.push(stopped.name ?? stopped.id);
+            }
+            if (notRestarted.length)
+                logger.warn({ operationId: operation.id, count: notRestarted.length }, 'Home Docker containers were not restarted after cancel');
+        }
+        await this.store.remove(operation.id);
+        return {
+            ...(cleanupError && { dockerCleanupError: cleanupError }),
+            ...(notRestarted.length > 0 && { dockerNotRestarted: notRestarted }),
+        };
+    }
+    async finish(operationId) {
+        this.active.delete(operationId);
+        await this.store.remove(operationId);
+    }
+    async step(run, body) {
+        const controller = new AbortController();
+        this.active.set(run.operation.id, controller);
+        try {
+            await body(controller.signal);
+        }
+        catch (error) {
+            throw clean(error);
+        }
+        finally {
+            if (this.active.get(run.operation.id) === controller)
+                this.active.delete(run.operation.id);
+        }
+    }
+    async requireRecord(operationId) {
+        const record = await this.store.read(operationId);
+        if (!record)
+            throw new DockerHandoffError('The Docker import record is missing; cancel and connect again.');
+        return record;
+    }
+    async homeClient(record, signal) {
+        const client = await this.source.connect(signal);
+        client.apiVersion = record.apiVersion;
+        return client;
+    }
+    async replaceVolume(operationId, record, projectId, remoteId, volume, options) {
+        const { holders } = await this.host.dockerVolumeHolders(remoteId, volume.name, options);
+        for (const holder of holders) {
+            try {
+                await this.host.dockerDelete(remoteId, 'containers', holder.id, projectId, options);
+            }
+            catch (error) {
+                if (notFound(error))
+                    continue;
+                if (error instanceof remote_host_client_1.RemoteHostRequestError && error.status === 403)
+                    throw new remote_operation_errors_1.RemoteOperationStepRefusedError('DOCKER_UNRELATED_HOLDER', `A VM container that is not part of this project holds volume ${volume.name}.`);
+                throw error;
+            }
+        }
+        const deleted = await this.deleteIfPresent(remoteId, 'volumes', volume.name, projectId, options);
+        if (deleted &&
+            !record.created.volumes.includes(volume.name) &&
+            !record.replaced.includes(volume.name)) {
+            record.replaced.push(volume.name);
+            await this.store.write(operationId, record);
+        }
+    }
+    async deleteIfPresent(remoteId, kind, name, projectId, options) {
+        try {
+            await this.host.dockerDelete(remoteId, kind, name, projectId, options);
+            return true;
+        }
+        catch (error) {
+            if (!notFound(error))
+                throw error;
+            return false;
+        }
+    }
+    async copy(client, progress, remoteId, request, options) {
+        const helper = await this.journal.create(client, request.image, [{ Type: request.mountType, Source: request.source, Target: '/data', ReadOnly: true }], options.signal);
+        try {
+            const archive = await (0, docker_archive_1.readDockerArchive)(client, helper.id, options.signal);
+            const hash = (0, node_crypto_1.createHash)('sha256');
+            const body = progress.count(archive, (chunk) => hash.update(chunk));
+            const { sha256 } = await this.host.dockerWriteArchive(remoteId, request, body, options);
+            if (sha256 !== hash.digest('hex'))
+                throw new DockerHandoffError('The copied data did not match on the VM; retry the copy.');
+        }
+        finally {
+            await this.journal.cleanup(client, helper);
+        }
+    }
+};
+exports.DockerHandoff = DockerHandoff;
+exports.DockerHandoff = DockerHandoff = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [docker_plan_service_1.DockerPlanService,
+        docker_plan_source_service_1.DockerPlanSourceService,
+        remote_host_client_1.RemoteHostClient,
+        docker_handoff_store_1.DockerHandoffStore,
+        docker_archive_journal_1.DockerArchiveJournal,
+        file_sync_managed_exclusions_store_1.FileSyncManagedExclusionsStore,
+        docker_import_inventory_store_1.DockerImportInventoryStore])
+], DockerHandoff);
+function buildRecord(all, selected, apiVersion, projectRoot) {
+    const moving = selected.filter(docker_plan_fit_1.movesToVm);
+    const helperImage = (item) => {
+        const image = item.images[0]?.id ?? moving.flatMap((i) => i.images)[0]?.id;
+        if (!image)
+            throw new remote_operation_errors_1.RemoteOperationStepRefusedError('DOCKER_PLAN_REFUSED', `${item.name}: no local image is available to copy its data.`);
+        return image;
+    };
+    const copied = new Map(selected.map((item) => [item, (0, docker_plan_fit_1.copiedDataMounts)(item, projectRoot)]));
+    const unique = (0, docker_plan_fit_1.uniqueCopiedMounts)(moving, projectRoot);
+    const owner = (source) => moving.find((i) => copied.get(i).some((m) => m.source === source));
+    const volumes = unique
+        .filter((m) => (0, docker_plan_dto_1.isVolumeMount)(m.kind))
+        .map((m) => ({
+        name: m.source,
+        helperImage: helperImage(owner(m.source)),
+        sizeBytes: m.size.bytes,
+    }));
+    const binds = unique
+        .filter((m) => !(0, docker_plan_dto_1.isVolumeMount)(m.kind))
+        .map((m) => ({
+        path: m.source,
+        replace: m.kind === 'project-bind',
+        helperImage: helperImage(owner(m.source)),
+        sizeBytes: m.size.bytes,
+    }));
+    for (const item of moving)
+        for (const name of emptyVolumes(item))
+            if (!volumes.some((v) => v.name === name))
+                volumes.push({ name, helperImage: helperImage(item), sizeBytes: 0 });
+    const images = [...new Map(moving.flatMap((i) => i.images).map((i) => [i.id, i])).values()].map((image) => ({ id: image.id, sizeBytes: image.size.bytes }));
+    const containerIds = new Set(all.filter((i) => i.kind === 'container').map((i) => i.id));
+    const stopIds = new Set();
+    for (const item of moving) {
+        if (item.kind === 'container')
+            stopIds.add(item.id);
+        for (const id of (0, docker_plan_fit_1.writerStops)(item, containerIds, projectRoot))
+            stopIds.add(id);
+        for (const id of (0, docker_plan_fit_1.keptWriterStops)(item, all))
+            stopIds.add(id);
+    }
+    const items = selected.map((item) => {
+        const mounts = copied.get(item);
+        return {
+            id: item.id,
+            name: item.name,
+            kind: item.kind,
+            mode: item.selectedMode,
+            temporary: item.temporary,
+            targetAction: item.targetAction,
+            createsContainer: item.kind === 'container' &&
+                !item.temporary &&
+                item.selectedMode !== 'data-only' &&
+                item.targetAction !== 'leave-as-is',
+            imageIds: item.images.map((i) => i.id),
+            volumes: [
+                ...new Set([
+                    ...mounts.filter((m) => (0, docker_plan_dto_1.isVolumeMount)(m.kind)).map((m) => m.source),
+                    ...emptyVolumes(item),
+                ]),
+            ],
+            binds: mounts.filter((m) => !(0, docker_plan_dto_1.isVolumeMount)(m.kind)).map((m) => m.source),
+            sizeBytes: mounts.some((m) => m.size.unknown)
+                ? null
+                : mounts.reduce((sum, m) => sum + m.size.bytes, 0),
+        };
+    });
+    const dataGroups = (0, docker_data_groups_1.groupDockerData)(all, projectRoot).filter((g) => g.itemIds.some((id) => selected.some((i) => i.id === id)));
+    const keptGroups = dataGroups.filter((g) => selected.some((i) => g.itemIds.includes(i.id) && i.dataAction === 'keep-vm'));
+    const keptItems = selected.filter((i) => i.dataAction === 'keep-vm');
+    return {
+        dataGroups,
+        keptGroups,
+        discardedHomeGroups: keptGroups.filter((g) => selected.some((i) => g.itemIds.includes(i.id) && i.dataChoice === 'keep-vm')),
+        ensureVolumes: [...new Set(keptItems.flatMap((i) => i.missingData?.volumes ?? []))],
+        ensureBinds: [...new Set(keptItems.flatMap((i) => i.missingData?.bindPaths ?? []))],
+        keptInventory: keptItems.map((i) => {
+            const mounts = (0, docker_plan_fit_1.potentialDataMounts)(i, projectRoot);
+            return {
+                name: i.name,
+                imageId: i.images[0]?.id ?? i.id,
+                volumes: mounts
+                    .filter((m) => (0, docker_plan_dto_1.isVolumeMount)(m.kind))
+                    .map((m) => ({ name: m.source, sizeBytes: m.size.unknown ? null : m.size.bytes })),
+                bindPaths: mounts
+                    .filter((m) => m.kind === 'project-bind')
+                    .map((m) => (0, docker_plan_files_1.projectAnchoredPath)(projectRoot, m.source)),
+                sizeBytes: mounts.some((m) => m.size.unknown)
+                    ? null
+                    : mounts.reduce((sum, m) => sum + m.size.bytes, 0),
+            };
+        }),
+        copiedData: { volumes: [], binds: [] },
+        apiVersion,
+        projectRoot,
+        items,
+        images,
+        volumes,
+        binds,
+        stopIds: [...stopIds],
+        stopped: [],
+        networks: [],
+        verified: { images: [], volumes: [], binds: [], containers: [] },
+        created: { volumes: [], networks: [], containers: [] },
+        replaced: [],
+        bytesTotal: totalBytes(images, volumes, binds),
+    };
+}
+function emptyVolumes(item) {
+    if (item.selectedMode !== 'without-data' || item.dataAction === 'keep-vm')
+        return [];
+    return item.mounts
+        .filter((m) => (0, docker_plan_dto_1.isVolumeMount)(m.kind) && m.driver === 'local')
+        .map((m) => m.source);
+}
+function totalBytes(...lists) {
+    return lists.reduce((sum, list) => sum + list.reduce((s, entry) => s + entry.sizeBytes, 0), 0);
+}
+function restoresData(record, volume) {
+    return record.items.some((i) => i.mode !== 'without-data' && i.volumes.includes(volume));
+}
+function captureSettings(inspect, name, socketPath) {
+    const config = (0, docker_settings_1.projectDockerCreate)(inspect, socketPath);
+    const host = config.HostConfig;
+    const referenced = new Set();
+    if (Array.isArray(host.Binds))
+        host.Binds = host.Binds.map((bind) => {
+            const [source, target, options] = bind.split(':');
+            if (source.startsWith('/') || target === undefined)
+                return bind;
+            referenced.add(source);
+            const flags = options ? options.split(',') : [];
+            return flags.includes('nocopy')
+                ? bind
+                : `${source}:${target}:${[...flags, 'nocopy'].join(',')}`;
+        });
+    const mounts = Array.isArray(host.Mounts) ? host.Mounts : [];
+    for (const mount of mounts) {
+        if (mount.Type !== 'volume')
+            continue;
+        if (!mount.Source)
+            mount.Source = inspect.Mounts?.find((m) => m.Destination === mount.Target)?.Name ?? '';
+        referenced.add(String(mount.Source));
+        mount.VolumeOptions = { ...mount.VolumeOptions, NoCopy: true };
+    }
+    for (const mount of inspect.Mounts ?? []) {
+        if (mount.Type !== 'volume' || !mount.Name || referenced.has(mount.Name))
+            continue;
+        mounts.push({
+            Type: 'volume',
+            Source: mount.Name,
+            Target: mount.Destination,
+            ReadOnly: mount.RW === false,
+            VolumeOptions: { NoCopy: true },
+        });
+    }
+    if (mounts.length)
+        host.Mounts = mounts;
+    return { name, config };
+}
+function networkNames(config) {
+    const endpoints = config.NetworkingConfig
+        ?.EndpointsConfig;
+    return Object.keys(endpoints ?? {}).filter((name) => !DEFAULT_NETWORKS.has(name));
+}
+async function homeNetwork(client, name, signal) {
+    const network = await client.json('GET', `/networks/${encodeURIComponent(name)}`, undefined, { signal });
+    if (network.Driver !== 'bridge')
+        throw new remote_operation_errors_1.RemoteOperationStepRefusedError('DOCKER_PLAN_REFUSED', `Network ${name} uses the ${network.Driver} driver; only bridge networks move.`);
+    return {
+        name,
+        labels: network.Labels ?? {},
+        internal: network.Internal === true,
+        attachable: network.Attachable === true,
+        options: network.Options ?? {},
+    };
+}
+async function homeVolumeLabels(client, name, signal) {
+    const volume = await client.json('GET', `/volumes/${encodeURIComponent(name)}`, undefined, { signal });
+    return volume.Labels ?? {};
+}
+async function saveImage(client, id, signal) {
+    const image = await client.json('GET', `/images/${encodeURIComponent(id)}/json`, undefined, { signal });
+    const names = image.RepoTags?.length ? image.RepoTags : [id];
+    const query = names.map((n) => `names=${encodeURIComponent(n)}`).join('&');
+    return client.stream('GET', `/images/get?${query}`, { signal });
+}
+class TransferProgress {
+    run;
+    startedAt = Date.now();
+    stepBytes = 0;
+    itemStart = 0;
+    itemPlanned = 0;
+    details;
+    constructor(run, record) {
+        this.run = run;
+        const previous = run.details.docker;
+        const done = totalBytes(record.images.filter((i) => record.verified.images.includes(i.id)), record.volumes.filter((v) => record.verified.volumes.includes(v.name)), record.binds.filter((b) => record.verified.binds.includes(b.path)));
+        this.details = {
+            replaced: record.replaced,
+            ...previous,
+            bytesDone: done,
+            bytesTotal: Math.max(record.bytesTotal, done),
+            rateBytesPerSecond: null,
+            etaSeconds: null,
+            item: null,
+        };
+    }
+    item(name, phase, plannedBytes = 0) {
+        this.details.item = { name, phase };
+        this.itemStart = this.details.bytesDone;
+        this.itemPlanned = plannedBytes;
+        this.publish();
+    }
+    complete() {
+        this.details.bytesDone = Math.max(this.details.bytesDone, this.itemStart + this.itemPlanned);
+        this.itemPlanned = 0;
+        this.itemStart = this.details.bytesDone;
+        this.add(0);
+    }
+    count(source, observe) {
+        const counter = new node_stream_1.Transform({
+            transform: (chunk, _encoding, callback) => {
+                observe?.(chunk);
+                this.add(chunk.length);
+                callback(null, chunk);
+            },
+        });
+        (0, promises_1.pipeline)(source, counter).catch(() => undefined);
+        return counter;
+    }
+    async finish() {
+        this.details.item = null;
+        await this.run.progress({ docker: { ...this.details } });
+    }
+    add(bytes) {
+        this.stepBytes += bytes;
+        const next = this.details.bytesDone + bytes;
+        this.details.bytesDone =
+            this.itemPlanned > 0 ? Math.min(next, this.itemStart + this.itemPlanned) : next;
+        this.details.bytesTotal = Math.max(this.details.bytesTotal, this.details.bytesDone);
+        const elapsed = Date.now() - this.startedAt;
+        if (elapsed >= RATE_WARMUP_MS && this.stepBytes > 0) {
+            const rate = this.stepBytes / (elapsed / 1000);
+            this.details.rateBytesPerSecond = Math.round(rate);
+            this.details.etaSeconds = Math.ceil(Math.max(0, this.details.bytesTotal - this.details.bytesDone) / rate);
+        }
+        this.publish();
+    }
+    publish() {
+        void this.run.progress({ docker: { ...this.details } });
+    }
+}
+//# sourceMappingURL=docker-handoff.js.map