devchain-cli 0.23.4 → 0.24.1

package/dist/server/modules/remotes/host/host-docker.dto.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DockerScanRequestSchema = exports.DockerImageLoadResultSchema = exports.DockerArchiveWriteResultSchema = exports.DockerBindPrepareSchema = exports.DockerCapacityRequestSchema = exports.DOCKER_ARCHIVE_SHA256_TRAILER = exports.DOCKER_API_VERSION_HEADER = exports.COMPOSE_PROJECT_LABEL = exports.DOCKER_PROJECT_LABEL = exports.DockerResourceIdSchema = exports.DockerArchiveRequestSchema = exports.DockerContainerCreateSchema = exports.DockerNetworkCreateSchema = exports.DockerVolumeCreateSchema = exports.DockerIdsSchema = exports.DockerOwnerSchema = void 0;
+const zod_1 = require("zod");
+const node_path_1 = require("node:path");
+const identifier = zod_1.z
+    .string()
+    .min(1)
+    .max(256)
+    .regex(/^[a-zA-Z0-9][a-zA-Z0-9_.:-]*$/);
+const projectId = zod_1.z.string().uuid();
+const labels = zod_1.z.record(zod_1.z.string()).default({});
+exports.DockerOwnerSchema = zod_1.z.object({ projectId }).strict();
+exports.DockerIdsSchema = zod_1.z.object({ ids: zod_1.z.array(identifier).max(10000) }).strict();
+exports.DockerVolumeCreateSchema = zod_1.z.object({ projectId, name: identifier, labels }).strict();
+exports.DockerNetworkCreateSchema = zod_1.z
+    .object({
+    projectId,
+    name: identifier,
+    labels,
+    internal: zod_1.z.boolean().default(false),
+    attachable: zod_1.z.boolean().default(false),
+    options: zod_1.z.record(zod_1.z.string()).default({}),
+})
+    .strict();
+exports.DockerContainerCreateSchema = zod_1.z
+    .object({
+    projectId,
+    name: identifier,
+    config: zod_1.z.record(zod_1.z.unknown()),
+})
+    .strict();
+exports.DockerArchiveRequestSchema = zod_1.z
+    .object({
+    projectId,
+    image: identifier,
+    mountType: zod_1.z.enum(['volume', 'bind', 'file']),
+    source: zod_1.z.string().min(1).max(4096),
+})
+    .strict();
+exports.DockerResourceIdSchema = identifier;
+exports.DOCKER_PROJECT_LABEL = 'dev.devchain.project';
+exports.COMPOSE_PROJECT_LABEL = 'com.docker.compose.project';
+exports.DOCKER_API_VERSION_HEADER = 'x-devchain-docker-api-version';
+exports.DOCKER_ARCHIVE_SHA256_TRAILER = 'x-devchain-archive-sha256';
+exports.DockerCapacityRequestSchema = zod_1.z
+    .object({ paths: zod_1.z.array(zod_1.z.string().min(1).max(4096)).max(64) })
+    .strict();
+const scanPath = zod_1.z
+    .string()
+    .min(1)
+    .max(4096)
+    .refine((path) => (0, node_path_1.isAbsolute)(path) && (0, node_path_1.normalize)(path) === path && !path.includes('\0'));
+exports.DockerBindPrepareSchema = zod_1.z
+    .object({
+    projectId,
+    paths: zod_1.z
+        .array(zod_1.z
+        .object({
+        path: scanPath,
+        replace: zod_1.z.boolean(),
+        image: identifier.optional(),
+        file: zod_1.z.literal(true).optional(),
+    })
+        .strict()
+        .refine((bind) => !bind.replace || bind.image !== undefined))
+        .min(1)
+        .max(64),
+})
+    .strict();
+exports.DockerArchiveWriteResultSchema = zod_1.z
+    .object({ sha256: zod_1.z.string().regex(/^[0-9a-f]{64}$/), bytes: zod_1.z.number().int().nonnegative() })
+    .strict();
+exports.DockerImageLoadResultSchema = zod_1.z
+    .object({
+    images: zod_1.z
+        .array(zod_1.z
+        .object({
+        id: zod_1.z.string().min(1).max(256),
+        layers: zod_1.z.array(zod_1.z.string().min(1).max(256)).max(10000),
+    })
+        .strict())
+        .max(10000),
+})
+    .strict();
+exports.DockerScanRequestSchema = zod_1.z
+    .object({
+    paths: zod_1.z.array(scanPath).max(64).default([]),
+    volumes: zod_1.z.array(identifier).max(10000).optional(),
+})
+    .strict();
+//# sourceMappingURL=host-docker.dto.js.map

package/dist/server/modules/remotes/host/host-docker.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-docker.dto.js","sourceRoot":"","sources":["../../../../src/modules/remotes/host/host-docker.dto.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,yCAAkD;AAGlD,MAAM,UAAU,GAAG,OAAC;KACjB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,+BAA+B,CAAC,CAAC;AAC1C,MAAM,SAAS,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;AACpC,MAAM,MAAM,GAAG,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AACnC,QAAA,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACrD,QAAA,eAAe,GAAG,OAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,OAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC7E,QAAA,wBAAwB,GAAG,OAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACtF,QAAA,yBAAyB,GAAG,OAAC;KACvC,MAAM,CAAC;IACN,SAAS;IACT,IAAI,EAAE,UAAU;IAChB,MAAM;IACN,QAAQ,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACpC,UAAU,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACtC,OAAO,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AACC,QAAA,2BAA2B,GAAG,OAAC;KACzC,MAAM,CAAC;IACN,SAAS;IACT,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,OAAO,EAAE,CAAC;CAC9B,CAAC;KACD,MAAM,EAAE,CAAC;AACC,QAAA,0BAA0B,GAAG,OAAC;KACxC,MAAM,CAAC;IACN,SAAS;IACT,KAAK,EAAE,UAAU;IAEjB,SAAS,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;CACpC,CAAC;KACD,MAAM,EAAE,CAAC;AACC,QAAA,sBAAsB,GAAG,UAAU,CAAC;AASpC,QAAA,oBAAoB,GAAG,sBAAsB,CAAC;AAC9C,QAAA,qBAAqB,GAAG,4BAA4B,CAAC;AAMrD,QAAA,yBAAyB,GAAG,+BAA+B,CAAC;AAE5D,QAAA,6BAA6B,GAAG,2BAA2B,CAAC;AAE5D,QAAA,2BAA2B,GAAG,OAAC;KACzC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;KAC/D,MAAM,EAAE,CAAC;AAMZ,MAAM,QAAQ,GAAG,OAAC;KACf,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,IAAI,CAAC;KACT,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,sBAAU,EAAC,IAAI,CAAC,IAAI,IAAA,qBAAS,EAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7E,QAAA,uBAAuB,GAAG,OAAC;KACrC,MAAM,CAAC;IACN,SAAS;IACT,KAAK,EAAE,OAAC;SACL,KAAK,CACJ,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE;QACpB,KAAK,EAAE,UAAU,CAAC,QAAQ,EAAE;QAE5B,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;KACjC,CAAC;SACD,MAAM,EAAE;SAER,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAC/D;SACA,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;CACX,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,8BAA8B,GAAG,OAAC;KAC5C,MAAM,CAAC,EAAE,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;KAC7F,MAAM,EAAE,CAAC;AAQC,QAAA,2BAA2B,GAAG,OAAC;KACzC,MAAM,CAAC;IACN,MAAM,EAAE,OAAC;SACN,KAAK,CACJ,OAAC;SACE,MAAM,CAAC;QACN,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAC9B,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;KACvD,CAAC;SACD,MAAM,EAAE,CACZ;SACA,GAAG,CAAC,KAAK,CAAC;CACd,CAAC;KACD,MAAM,EAAE,CAAC;AAGC,QAAA,uBAAuB,GAAG,OAAC;KACrC,MAAM,CAAC;IACN,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/server/modules/remotes/host/host-docker.service.d.ts

@@ -0,0 +1,47 @@
+import { DockerArchiveJournal } from '../../core/controllers/docker-archive-journal';
+import { Readable } from 'node:stream';
+import { DockerVersion } from '../../core/controllers/docker-engine.client';
+import { DockerArchiveRequest, DockerContainerCreate, DockerNetworkCreate, DockerVolumeCreate, DockerVolumeHolder, DockerCapacityResult, DockerScanResult, DockerArchiveWriteResult, DockerBindPrepare, DockerImageLoadResult } from './host-docker.dto';
+type Labels = Record<string, string>;
+type Volume = {
+    Name: string;
+    Labels?: Labels;
+};
+export declare class HostDockerService {
+    private readonly archives;
+    constructor(archives: DockerArchiveJournal);
+    version(signal?: AbortSignal): Promise<DockerVersion>;
+    private engine;
+    scan(paths: string[], signal?: AbortSignal, apiVersion?: string, holderVolumes?: string[]): Promise<DockerScanResult>;
+    capacity(paths: string[], signal?: AbortSignal): Promise<DockerCapacityResult>;
+    imagesPresent(ids: string[], signal?: AbortSignal, apiVersion?: string): Promise<{
+        ids: string[];
+    }>;
+    loadImage(body: Readable, signal?: AbortSignal, apiVersion?: string): Promise<DockerImageLoadResult>;
+    saveImage(id: string, signal?: AbortSignal, apiVersion?: string): Promise<Readable>;
+    createVolume(input: DockerVolumeCreate, signal?: AbortSignal, apiVersion?: string): Promise<Volume>;
+    createNetwork(input: DockerNetworkCreate, signal?: AbortSignal, apiVersion?: string): Promise<{
+        Id: string;
+        created: boolean;
+    }>;
+    createContainer(input: DockerContainerCreate, signal?: AbortSignal, apiVersion?: string): Promise<{
+        Id: string;
+    }>;
+    holders(name: string, signal?: AbortSignal, apiVersion?: string): Promise<{
+        holders: DockerVolumeHolder[];
+    }>;
+    remove(kind: 'volumes' | 'containers' | 'networks', id: string, projectId: string, signal?: AbortSignal, apiVersion?: string): Promise<void>;
+    writeArchive(input: DockerArchiveRequest, body: Readable, signal?: AbortSignal, apiVersion?: string): Promise<DockerArchiveWriteResult>;
+    prepareBinds(input: DockerBindPrepare, signal?: AbortSignal, apiVersion?: string): Promise<void>;
+    private clearBind;
+    stopProject(projectId: string, signal?: AbortSignal, apiVersion?: string): Promise<{
+        stopped: string[];
+    }>;
+    stopContainer(id: string, projectId: string, signal?: AbortSignal, apiVersion?: string): Promise<void>;
+    readArchive(input: DockerArchiveRequest, signal?: AbortSignal, apiVersion?: string): Promise<Readable>;
+    private requireOwner;
+    private composeOwnsProjectVolume;
+    private composeHolder;
+    private archiveSource;
+}
+export {};

package/dist/server/modules/remotes/host/host-docker.service.js

@@ -0,0 +1,491 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HostDockerService = void 0;
+const docker_archive_journal_1 = require("../../core/controllers/docker-archive-journal");
+const common_1 = require("@nestjs/common");
+const node_crypto_1 = require("node:crypto");
+const promises_1 = require("node:fs/promises");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const node_stream_1 = require("node:stream");
+const promises_2 = require("node:stream/promises");
+const error_types_1 = require("../../../common/errors/error-types");
+const docker_engine_client_1 = require("../../core/controllers/docker-engine.client");
+const docker_archive_1 = require("../../core/controllers/docker-archive");
+const docker_runtime_1 = require("../../core/controllers/docker-runtime");
+const docker_settings_1 = require("../../core/controllers/docker-settings");
+const host_docker_dto_1 = require("./host-docker.dto");
+let HostDockerService = class HostDockerService {
+    archives;
+    constructor(archives) {
+        this.archives = archives;
+    }
+    async version(signal) {
+        return (await docker_engine_client_1.DockerEngineClient.connect(signal)).version(signal);
+    }
+    async engine(signal, apiVersion) {
+        const client = await docker_engine_client_1.DockerEngineClient.connect(signal);
+        if (apiVersion)
+            client.apiVersion = (0, docker_engine_client_1.selectDockerApiVersion)(await client.version(signal), {
+                ApiVersion: apiVersion,
+                MinAPIVersion: apiVersion,
+            });
+        return client;
+    }
+    async scan(paths, signal, apiVersion, holderVolumes) {
+        const client = await this.engine(signal, apiVersion);
+        const info = client.connectedInfo ?? (await client.info(signal));
+        if (!info.Architecture)
+            throw new docker_engine_client_1.DockerEngineError('invalid-response', 'Docker architecture is unavailable');
+        const containers = await client.json('GET', '/containers/json?all=true', undefined, { signal });
+        const volumes = await client.json('GET', '/volumes', undefined, { signal });
+        const existence = [];
+        for (const path of paths) {
+            signal?.throwIfAborted();
+            try {
+                const stats = await (0, promises_1.stat)(path);
+                existence.push(stats.isFile() ? { path, exists: true, file: true } : { path, exists: true });
+            }
+            catch (error) {
+                existence.push(error.code === 'ENOENT'
+                    ? { path, exists: false }
+                    : { path, unknown: true });
+            }
+        }
+        const metadata = new Map();
+        if (holderVolumes) {
+            const holders = containers.filter((container) => container.Mounts?.some((m) => (m.Type === 'volume' && m.Name && holderVolumes.includes(m.Name)) ||
+                (m.Type === 'bind' &&
+                    m.Source &&
+                    paths.some((p) => inside(p, m.Source) || inside(m.Source, p)))));
+            await Promise.all(holders.map(async (container) => {
+                try {
+                    const inspect = await client.json('GET', `/containers/${encodeURIComponent(container.Id)}/json`, undefined, { signal });
+                    metadata.set(container.Id, {
+                        created: inspect.Created,
+                        startedAt: inspect.State?.StartedAt,
+                        running: inspect.State?.Running,
+                    });
+                }
+                catch {
+                    signal?.throwIfAborted();
+                    metadata.set(container.Id, {});
+                }
+            }));
+        }
+        signal?.throwIfAborted();
+        return {
+            architecture: info.Architecture,
+            containers: containers.map((container) => ({
+                id: container.Id,
+                ...(metadata.has(container.Id) && { metadata: metadata.get(container.Id) }),
+                name: container.Names[0]?.replace(/^\//, '') ?? container.Id,
+                labels: container.Labels ?? {},
+                mounts: (container.Mounts ?? []).map((mount) => ({
+                    type: mount.Type,
+                    ...(mount.Name ? { name: mount.Name } : {}),
+                    ...(mount.Source ? { source: mount.Source } : {}),
+                    destination: mount.Destination,
+                })),
+            })),
+            volumes: (volumes.Volumes ?? []).map((volume) => ({
+                name: volume.Name,
+                driver: volume.Driver,
+                labels: volume.Labels ?? {},
+            })),
+            paths: existence,
+        };
+    }
+    async capacity(paths, signal) {
+        const home = (0, node_os_1.homedir)();
+        if (paths.some((path) => !(0, node_path_1.isAbsolute)(path) ||
+            (0, node_path_1.normalize)(path) !== path ||
+            path.includes('\0') ||
+            !inside(path, home)))
+            throw new error_types_1.AppError('Capacity paths must be absolute normalized paths under VM home', 'DOCKER_BIND_OUTSIDE_HOME', 403);
+        const results = [];
+        const canonicalHome = await (0, promises_1.realpath)(home).catch(() => null);
+        for (const path of paths) {
+            signal?.throwIfAborted();
+            try {
+                if (canonicalHome === null)
+                    throw new Error();
+                const resolved = await (0, promises_1.realpath)(await nearestExisting(path, home));
+                if (!inside(resolved, canonicalHome))
+                    throw new Error();
+                const sample = await (0, docker_runtime_1.dockerFilesystem)(resolved);
+                if (!sample || !Number.isFinite(sample.freeBytes) || sample.freeBytes < 0)
+                    throw new Error();
+                results.push({ ...sample, path });
+            }
+            catch {
+                results.push({ path, unknown: true });
+            }
+        }
+        signal?.throwIfAborted();
+        return { paths: results };
+    }
+    async imagesPresent(ids, signal, apiVersion) {
+        const client = await this.engine(signal, apiVersion);
+        const present = [];
+        for (const id of new Set(ids)) {
+            try {
+                await client.json('GET', `/images/${encodeURIComponent(id)}/json`, undefined, { signal });
+                present.push(id);
+            }
+            catch (error) {
+                if (!(0, docker_engine_client_1.isDockerNotFound)(error))
+                    throw error;
+            }
+        }
+        return { ids: present };
+    }
+    async loadImage(body, signal, apiVersion) {
+        const client = await this.engine(signal, apiVersion);
+        const response = await client.stream('POST', '/images/load?quiet=1', {
+            body,
+            headers: { 'Content-Type': 'application/x-tar' },
+            signal,
+        });
+        const references = [];
+        let line = '';
+        const consume = (value) => {
+            if (!value.trim())
+                return;
+            let message;
+            try {
+                message = JSON.parse(value);
+            }
+            catch {
+                throw new docker_engine_client_1.DockerEngineError('invalid-response', 'Invalid Docker image load response');
+            }
+            if (message.error || message.errorDetail)
+                throw new docker_engine_client_1.DockerEngineError('engine-error', 'Docker image load failed');
+            if (typeof message.stream !== 'string')
+                return;
+            for (const prefix of ['Loaded image: ', 'Loaded image ID: ']) {
+                if (!message.stream.startsWith(prefix))
+                    continue;
+                const reference = message.stream.slice(prefix.length).replace(/\n$/, '');
+                if (reference)
+                    references.push(reference);
+            }
+        };
+        try {
+            for await (const chunk of response) {
+                line += chunk.toString('utf8');
+                let newline;
+                while ((newline = line.indexOf('\n')) >= 0) {
+                    consume(line.slice(0, newline));
+                    line = line.slice(newline + 1);
+                }
+                if (line.length > 1024 * 1024)
+                    throw new docker_engine_client_1.DockerEngineError('invalid-response', 'Docker image load response exceeds limit');
+            }
+            consume(line);
+        }
+        finally {
+            response.destroy();
+        }
+        const images = [];
+        const seen = new Set();
+        for (const reference of references) {
+            const inspect = await (0, docker_engine_client_1.optionalDockerJson)(client, `/images/${encodeURIComponent(reference)}/json`, signal);
+            if (!inspect?.Id || seen.has(inspect.Id))
+                continue;
+            seen.add(inspect.Id);
+            images.push({ id: inspect.Id, layers: inspect.RootFS?.Layers ?? [] });
+        }
+        return { images };
+    }
+    async saveImage(id, signal, apiVersion) {
+        const client = await this.engine(signal, apiVersion);
+        return client.stream('GET', `/images/${encodeURIComponent(id)}/get`, { signal });
+    }
+    async createVolume(input, signal, apiVersion) {
+        const client = await this.engine(signal, apiVersion);
+        const old = await (0, docker_engine_client_1.optionalDockerJson)(client, `/volumes/${encodeURIComponent(input.name)}`, signal);
+        if (old) {
+            this.requireOwner(old.Labels, input.projectId, true);
+            return { Name: old.Name, Labels: old.Labels };
+        }
+        const created = await client.json('POST', '/volumes/create', { Name: input.name, Labels: { ...input.labels, [host_docker_dto_1.DOCKER_PROJECT_LABEL]: input.projectId } }, { signal });
+        this.requireOwner(created.Labels, input.projectId, true);
+        return { Name: created.Name, Labels: created.Labels };
+    }
+    async createNetwork(input, signal, apiVersion) {
+        const client = await this.engine(signal, apiVersion);
+        const old = await (0, docker_engine_client_1.optionalDockerJson)(client, `/networks/${encodeURIComponent(input.name)}`, signal);
+        if (old) {
+            this.requireOwner(old.Labels, input.projectId, true);
+            return { Id: old.Id, created: false };
+        }
+        const created = await client.json('POST', '/networks/create', {
+            Name: input.name,
+            Driver: 'bridge',
+            Internal: input.internal,
+            Attachable: input.attachable,
+            Options: input.options,
+            Labels: { ...input.labels, [host_docker_dto_1.DOCKER_PROJECT_LABEL]: input.projectId },
+        }, { signal });
+        return { Id: created.Id, created: true };
+    }
+    async createContainer(input, signal, apiVersion) {
+        const { HostConfig = {}, NetworkingConfig = {}, ...config } = input.config;
+        if (typeof config.Image !== 'string')
+            throw new error_types_1.AppError('Container image is required', 'DOCKER_INVALID_SETTINGS', 400);
+        const network = NetworkingConfig;
+        if (Object.keys(network).some((key) => key !== 'EndpointsConfig'))
+            throw new error_types_1.AppError('Unsupported network settings', 'DOCKER_INVALID_SETTINGS', 400);
+        const projected = (0, docker_settings_1.projectDockerCreate)({
+            Config: config,
+            HostConfig: HostConfig,
+            Image: config.Image,
+            NetworkSettings: { Networks: network.EndpointsConfig },
+        });
+        projected.Labels = {
+            ...config.Labels,
+            [host_docker_dto_1.DOCKER_PROJECT_LABEL]: input.projectId,
+        };
+        const client = await this.engine(signal, apiVersion);
+        return client.json('POST', `/containers/create?name=${encodeURIComponent(input.name)}`, projected, { signal });
+    }
+    async holders(name, signal, apiVersion) {
+        const client = await this.engine(signal, apiVersion);
+        const containers = await client.json('GET', `/containers/json?all=true&filters=${encodeURIComponent(JSON.stringify({ volume: [name] }))}`, undefined, { signal });
+        return {
+            holders: containers
+                .filter((container) => container.Mounts?.some((mount) => mount.Type === 'volume' && mount.Name === name))
+                .map((container) => ({ id: container.Id, labels: container.Labels ?? {} })),
+        };
+    }
+    async remove(kind, id, projectId, signal, apiVersion) {
+        const client = await this.engine(signal, apiVersion);
+        const resource = await client.json('GET', `/${kind}/${encodeURIComponent(id)}${kind === 'containers' ? '/json' : ''}`, undefined, { signal });
+        const labels = kind === 'containers' ? resource.Config.Labels : resource.Labels;
+        if (labels?.[host_docker_dto_1.DOCKER_PROJECT_LABEL] !== projectId) {
+            if (kind !== 'containers' ||
+                labels?.[host_docker_dto_1.DOCKER_PROJECT_LABEL] ||
+                !(await this.composeHolder(client, resource, projectId, signal)))
+                this.requireOwner(labels, projectId);
+        }
+        const exactId = kind === 'volumes' ? id : resource.Id;
+        if (!exactId)
+            throw new docker_engine_client_1.DockerEngineError('invalid-response', 'Docker resource identity is missing');
+        if (kind === 'containers')
+            await (0, docker_engine_client_1.changeDockerContainerState)(client, exactId, 'stop', signal);
+        await client.json('DELETE', `/${kind}/${encodeURIComponent(exactId)}`, undefined, { signal });
+    }
+    async writeArchive(input, body, signal, apiVersion) {
+        const client = await this.engine(signal, apiVersion);
+        const source = await this.archiveSource(client, input, signal);
+        const layout = (0, docker_archive_1.dockerArchiveLayout)(input.mountType, source);
+        const helper = await this.archives.create(client, input.image, [layout.mount], signal);
+        const hash = (0, node_crypto_1.createHash)('sha256');
+        let bytes = 0;
+        const toEngine = new node_stream_1.PassThrough();
+        const received = (async () => {
+            for await (const chunk of body) {
+                hash.update(chunk);
+                bytes += chunk.length;
+                if (toEngine.destroyed || toEngine.writableEnded)
+                    continue;
+                if (!toEngine.write(chunk))
+                    await new Promise((done) => {
+                        const settle = () => {
+                            toEngine.off('drain', settle).off('close', settle);
+                            done();
+                        };
+                        toEngine.on('drain', settle).on('close', settle);
+                    });
+            }
+            if (!toEngine.destroyed)
+                toEngine.end();
+        })();
+        try {
+            await Promise.all([
+                received,
+                (0, docker_archive_1.writeDockerArchive)(client, helper.id, toEngine, signal, layout.writePath).catch((error) => {
+                    body.destroy();
+                    throw error;
+                }),
+            ]);
+        }
+        catch (error) {
+            toEngine.destroy();
+            await received.catch(() => undefined);
+            throw error;
+        }
+        finally {
+            await this.archives.cleanup(client, helper);
+        }
+        return { sha256: hash.digest('hex'), bytes };
+    }
+    async prepareBinds(input, signal, apiVersion) {
+        const home = (0, node_os_1.homedir)();
+        const canonicalHome = await (0, promises_1.realpath)(home);
+        for (const { path, replace, image, file } of input.paths) {
+            signal?.throwIfAborted();
+            if (path === home || !inside(path, home))
+                throw new error_types_1.AppError('Bind paths must be under the VM home', 'DOCKER_BIND_OUTSIDE_HOME', 403);
+            const existing = await nearestExisting(path);
+            const resolved = await (0, promises_1.realpath)(existing);
+            if (!inside(resolved, canonicalHome))
+                throw new error_types_1.AppError('Bind paths must be under the VM home', 'DOCKER_BIND_OUTSIDE_HOME', 403);
+            if (existing === path && (await (0, promises_1.lstat)(path)).isSymbolicLink())
+                throw new error_types_1.AppError('Bind paths must not be links', 'DOCKER_BIND_OUTSIDE_HOME', 403);
+            if (file) {
+                await (0, promises_1.mkdir)((0, node_path_1.dirname)(path), { recursive: true });
+                continue;
+            }
+            if (replace && existing === path) {
+                if (!(await (0, promises_1.lstat)(resolved)).isDirectory())
+                    await (0, promises_1.rm)(path, { force: true });
+                else if (!(await (0, promises_1.readdir)(resolved).then((entries) => entries.length === 0, () => false)))
+                    await this.clearBind(path, resolved, image, signal, apiVersion);
+            }
+            await (0, promises_1.mkdir)(path, { recursive: true });
+        }
+    }
+    async clearBind(path, target, image, signal, apiVersion) {
+        try {
+            await this.archives.clearBind(await this.engine(signal, apiVersion), image, target, signal);
+        }
+        catch (error) {
+            if (signal?.aborted)
+                throw error;
+            throw new error_types_1.AppError(`The VM folder ${path} could not be emptied for the fresh copy. Empty it on the VM (for example, sudo rm -rf ${path}/*) and press Retry, or Cancel.`, 'DOCKER_BIND_CLEAR_FAILED', 422);
+        }
+    }
+    async stopProject(projectId, signal, apiVersion) {
+        const client = await this.engine(signal, apiVersion);
+        const filters = JSON.stringify({
+            label: [`${host_docker_dto_1.DOCKER_PROJECT_LABEL}=${projectId}`],
+            status: ['running', 'restarting', 'paused'],
+        });
+        const running = await client.json('GET', `/containers/json?filters=${encodeURIComponent(filters)}`, undefined, { signal });
+        const stopped = [];
+        for (const container of running) {
+            if (container.Labels?.[host_docker_dto_1.DOCKER_PROJECT_LABEL] !== projectId)
+                continue;
+            await (0, docker_engine_client_1.changeDockerContainerState)(client, container.Id, 'stop', signal);
+            stopped.push(container.Id);
+        }
+        return { stopped };
+    }
+    async stopContainer(id, projectId, signal, apiVersion) {
+        const client = await this.engine(signal, apiVersion);
+        const container = await client.json('GET', `/containers/${encodeURIComponent(id)}/json`, undefined, { signal });
+        const labels = container.Config.Labels ?? {};
+        if (labels[host_docker_dto_1.DOCKER_PROJECT_LABEL] !== projectId) {
+            const compose = labels[host_docker_dto_1.COMPOSE_PROJECT_LABEL];
+            const owned = !labels[host_docker_dto_1.DOCKER_PROJECT_LABEL] &&
+                compose !== undefined &&
+                (await this.composeOwnsProjectVolume(client, compose, projectId, signal));
+            if (!owned)
+                this.requireOwner(labels, projectId);
+        }
+        await (0, docker_engine_client_1.changeDockerContainerState)(client, container.Id, 'stop', signal);
+    }
+    async readArchive(input, signal, apiVersion) {
+        const client = await this.engine(signal, apiVersion);
+        const source = await this.archiveSource(client, input, signal);
+        const layout = (0, docker_archive_1.dockerArchiveLayout)(input.mountType, source);
+        const helper = await this.archives.create(client, input.image, [{ ...layout.mount, ReadOnly: true }], signal);
+        let archive;
+        try {
+            archive = await (0, docker_archive_1.readDockerArchive)(client, helper.id, signal, layout.readPath);
+        }
+        catch (error) {
+            await this.archives.cleanup(client, helper);
+            throw error;
+        }
+        const output = new node_stream_1.PassThrough();
+        void (async () => {
+            try {
+                await (0, promises_2.pipeline)(archive, output, { end: false });
+                await this.archives.cleanup(client, helper);
+                output.end();
+            }
+            catch {
+                await this.archives.cleanup(client, helper).catch(() => undefined);
+                output.destroy(new docker_engine_client_1.DockerEngineError('unavailable', 'Docker archive transfer failed'));
+            }
+        })();
+        return output;
+    }
+    requireOwner(labels, projectId, conflict = false) {
+        if (labels?.[host_docker_dto_1.DOCKER_PROJECT_LABEL] !== projectId)
+            throw new error_types_1.AppError('Docker resource is not owned by this imported project', 'DOCKER_OWNERSHIP_REQUIRED', conflict ? 409 : 403);
+    }
+    async composeOwnsProjectVolume(client, compose, projectId, signal) {
+        const { Volumes } = await client.json('GET', `/volumes?filters=${encodeURIComponent(JSON.stringify({ label: [`${host_docker_dto_1.DOCKER_PROJECT_LABEL}=${projectId}`] }))}`, undefined, { signal });
+        return (Volumes?.some((volume) => volume.Labels?.[host_docker_dto_1.DOCKER_PROJECT_LABEL] === projectId &&
+            volume.Labels?.[host_docker_dto_1.COMPOSE_PROJECT_LABEL] === compose) ?? false);
+    }
+    async composeHolder(client, container, projectId, signal) {
+        const compose = container.Config.Labels?.[host_docker_dto_1.COMPOSE_PROJECT_LABEL];
+        if (!compose)
+            return false;
+        for (const mount of container.Mounts ?? []) {
+            if (mount.Type !== 'volume' || !mount.Name)
+                continue;
+            const volume = await client.json('GET', `/volumes/${encodeURIComponent(mount.Name)}`, undefined, { signal });
+            if (volume.Labels?.[host_docker_dto_1.DOCKER_PROJECT_LABEL] === projectId &&
+                volume.Labels?.[host_docker_dto_1.COMPOSE_PROJECT_LABEL] === compose)
+                return true;
+        }
+        return false;
+    }
+    async archiveSource(client, input, signal) {
+        if (input.mountType === 'volume') {
+            const volume = await client.json('GET', `/volumes/${encodeURIComponent(input.source)}`, undefined, { signal });
+            this.requireOwner(volume.Labels, input.projectId);
+            return volume.Name;
+        }
+        try {
+            const file = input.mountType === 'file';
+            const requested = (0, node_path_1.resolve)(input.source);
+            const [home, resolved] = await Promise.all([
+                (0, promises_1.realpath)((0, node_os_1.homedir)()),
+                (0, promises_1.realpath)(file ? (0, node_path_1.dirname)(requested) : requested),
+            ]);
+            if (!inside(resolved, home))
+                throw new Error();
+            return file ? (0, node_path_1.join)(resolved, (0, node_path_1.basename)(requested)) : resolved;
+        }
+        catch {
+            throw new error_types_1.AppError('Bind archive paths must exist under the VM home', 'DOCKER_BIND_OUTSIDE_HOME', 403);
+        }
+    }
+};
+exports.HostDockerService = HostDockerService;
+exports.HostDockerService = HostDockerService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [docker_archive_journal_1.DockerArchiveJournal])
+], HostDockerService);
+function inside(path, root) {
+    return path === root || path.startsWith(root + node_path_1.sep);
+}
+async function nearestExisting(path, stop) {
+    for (let candidate = path;; candidate = (0, node_path_1.dirname)(candidate)) {
+        try {
+            await (0, promises_1.lstat)(candidate);
+            return candidate;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT' || candidate === stop)
+                throw error;
+        }
+    }
+}
+//# sourceMappingURL=host-docker.service.js.map