everything-dev 2.0.0-rc.1 → 2.0.0-rc.5

package/dist/image-deploy.cjs

@@ -58,21 +58,26 @@ function readFrameworkVersion(configDir) {
 * Tag scheme (ADR 0021): `sha-<short>` always; the exact `v<version>` tag; a
 * floating major tag (`v2`) on stable releases only. `latest` is held during
 * prereleases (npm's `rc` dist-tag analog) so existing deployments pinned to
-* `:latest` keep serving the last stable image.
+* `:latest` keep serving the last stable image — and `:rc` is the floating
+* ref for the prerelease train (npm's `rc` dist-tag mirror): it moves on
+* every prerelease deploy and freezes at the last rc-train build once the
+* workspace releases a stable version.
 */
 function computeImageTags(input) {
 	const tags = [`sha-${input.shortSha}`];
 	const match = input.version?.trim().match(SEMVER_PATTERN);
 	if (!match) return {
 		tags,
-		pushLatest: true
+		pushLatest: true,
+		pushRc: false
 	};
 	const [, major, minor, patch, prerelease] = match;
 	const exact = prerelease ? `v${major}.${minor}.${patch}-${prerelease}` : `v${major}.${minor}.${patch}`;
 	if (prerelease) return {
 		tags: [...tags, exact],
 		pushLatest: false,
-		latestHoldReason: `${exact} is a prerelease — :latest still serves the last stable image`
+		latestHoldReason: `${exact} is a prerelease — :latest still serves the last stable image`,
+		pushRc: true
 	};
 	return {
 		tags: [
@@ -80,14 +85,49 @@ function computeImageTags(input) {
 			exact,
 			`v${major}`
 		],
-		pushLatest: true
+		pushLatest: true,
+		pushRc: false
+	};
+}
+const DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/;
+/** A Railway pin is `FROM image@<digest>` — anything else cannot resolve. */
+function isValidImageDigest(digest) {
+	return DIGEST_PATTERN.test(digest);
+}
+/**
+* Decide the image leg's source: a digest handed over from a pre-pushed image
+* (the CI image job) wins; otherwise the local docker build runs when the
+* toolchain and Dockerfile are present (ADR 0021, as amended).
+*/
+function resolveDeployImagePlan(input) {
+	if (!input.imageRef) return {
+		kind: "skip",
+		reason: "set ci.image in bos.config.json (or BOS_IMAGE) to build and push the runtime image"
+	};
+	if (input.imageDigest) return {
+		kind: "prebuilt",
+		image: input.imageRef.image,
+		digest: input.imageDigest
+	};
+	if (!input.hasDocker) return {
+		kind: "skip",
+		reason: "docker is not available"
+	};
+	if (!input.hasDockerfile) return {
+		kind: "skip",
+		reason: "no Dockerfile at the config root"
+	};
+	return {
+		kind: "build",
+		image: input.imageRef.image
 	};
 }
 /**
 * Image leg (ADR 0021): build the runtime stage, tag `sha-<short>` + version
-* tags, push them, capture the digest, and push `:latest` unless the version
-* is a prerelease. Callers skip the leg with a notice when no image is
-* configured (child repos get build+upload+publish only).
+* tags, push them, capture the digest, then push the floating refs — `:latest`
+* unless the version is a prerelease, and `:rc` when it is. Callers skip the
+* leg with a notice when no image is configured (child repos get
+* build+upload+publish only).
 */
 async function buildAndPushImage(input) {
 	const shaResult = await require_run.run("git", [
@@ -103,13 +143,15 @@ async function buildAndPushImage(input) {
 		const detail = shaResult?.stderr.trim();
 		throw new Error(`Failed to resolve the current git SHA in ${input.configDir} (exit code ${shaResult?.exitCode ?? "unknown"}${detail ? `: ${detail}` : ""})`);
 	}
-	const { tags, pushLatest, latestHoldReason } = computeImageTags({
+	const { tags, pushLatest, latestHoldReason, pushRc } = computeImageTags({
 		shortSha,
 		version: readFrameworkVersion(input.configDir)
 	});
 	const refs = tags.map((tag) => `${input.image}:${tag}`);
 	const latestRef = `${input.image}:latest`;
-	const buildRefs = pushLatest ? [...refs, latestRef] : refs;
+	const rcRef = `${input.image}:rc`;
+	const buildRefs = pushLatest ? [...refs, latestRef] : [...refs];
+	if (pushRc) buildRefs.push(rcRef);
 	console.log(`  Building runtime image ${require_theme.colors.cyan(buildRefs.join(", "))}${pushLatest ? "" : require_theme.colors.yellow(" (latest held)")}`);
 	await require_run.run("docker", [
 		"build",
@@ -129,51 +171,79 @@ async function buildAndPushImage(input) {
 		digest ??= parseDigest(push.stdout);
 		if (input.verbose && push.stdout.trim()) console.log(require_theme.colors.dim(push.stdout.trim()));
 	}
-	let latestPushed = false;
-	if (pushLatest) {
-		const pushLatestRef = await require_run.run("docker", ["push", latestRef], {
+	const pushFloating = async (ref) => {
+		const push = await require_run.run("docker", ["push", ref], {
 			cwd: input.configDir,
 			capture: true
 		});
-		if (!pushLatestRef || pushLatestRef.exitCode !== 0) throw new Error(`docker push ${latestRef} failed with exit code ${pushLatestRef?.exitCode ?? "unknown"}`);
-		digest ??= parseDigest(pushLatestRef.stdout);
-		if (input.verbose && pushLatestRef.stdout.trim()) console.log(require_theme.colors.dim(pushLatestRef.stdout.trim()));
-		latestPushed = true;
-	} else console.log(require_theme.colors.yellow(`  latest held: ${latestHoldReason}`));
+		if (!push || push.exitCode !== 0) throw new Error(`docker push ${ref} failed with exit code ${push?.exitCode ?? "unknown"}`);
+		digest ??= parseDigest(push.stdout);
+		if (input.verbose && push.stdout.trim()) console.log(require_theme.colors.dim(push.stdout.trim()));
+		return true;
+	};
+	let latestPushed = false;
+	if (pushLatest) latestPushed = await pushFloating(latestRef);
+	else console.log(require_theme.colors.yellow(`  latest held: ${latestHoldReason}`));
+	const rcPushed = pushRc ? await pushFloating(rcRef) : false;
 	if (!digest) console.log(require_theme.colors.yellow("  Could not capture the image digest from push output"));
 	return {
 		image: input.image,
 		tag: tags[0],
 		tags,
 		latestPushed,
+		rcPushed,
 		digest
 	};
 }
 /**
-* Railway leg (ADR 0021): pull-only deploy of the pushed image digest — a
-* thin `FROM image@digest` Dockerfile pins the digest so Railway never
-* rebuilds; `RAILWAY_DOCKERFILE_PATH` points at the generated file.
+* Railway leg (ADR 0021, amended): image-backed deploy. The service's source
+* is a Docker image ref (connected once in the dashboard — `:rc` during the
+* prerelease train), and `redeploy --from-source` pulls and deploys whatever
+* that ref points at. The image leg pushes `:rc` (and the `sha-<short>` /
+* version tags) immediately before this step, so the pulled bytes are exactly
+* what this train validated. Railway skips the build entirely for
+* Docker-image sources — nothing is uploaded, nothing is built on Railway,
+* and the digest-pin Dockerfile mechanism this replaces is gone (the CLI v5
+* dropped RAILWAY_DOCKERFILE_PATH, its snapshot respects .gitignore so
+* generated Dockerfiles never shipped, and its Metal builder rejected the
+* repo Dockerfile's cache-mount ids).
 */
 async function deployImageToRailway(input) {
-	const deployDir = (0, node_path.join)(input.configDir, ".bos", "deploy");
-	(0, node_fs.mkdirSync)(deployDir, { recursive: true });
-	const dockerfilePath = (0, node_path.join)(deployDir, "Dockerfile");
-	(0, node_fs.writeFileSync)(dockerfilePath, `FROM ${input.image}@${input.digest}\n`);
-	console.log(`  Deploying to Railway service ${require_theme.colors.cyan(input.service)} (pull-only)...`);
+	console.log(`  Deploying to Railway service ${require_theme.colors.cyan(input.service)} (image-backed)...`);
+	let version;
+	try {
+		version = (await require_run.run("railway", ["--version"], {
+			cwd: input.configDir,
+			capture: true
+		}))?.stdout;
+	} catch {
+		version = void 0;
+	}
+	if (!version?.trim()) throw new Error("Railway CLI not found. Install it: npm i -g @railway/cli");
+	console.log(`  ${require_theme.colors.dim(`railway ${version.trim()}`)}`);
+	const collected = {
+		stdout: "",
+		stderr: ""
+	};
 	const result = await require_run.run("railway", [
-		"up",
+		"redeploy",
 		"--service",
 		input.service,
-		"--ci"
+		"--from-source",
+		"--yes"
 	], {
 		cwd: input.configDir,
 		capture: true,
-		env: { RAILWAY_DOCKERFILE_PATH: ".bos/deploy/Dockerfile" }
+		onChunk: (stream, chunk) => {
+			collected[stream] += chunk.toString("utf-8");
+			for (const line of chunk.toString("utf-8").split("\n")) if (line.trim()) console.log(`  ${require_theme.colors.dim(line.trim())}`);
+		}
 	});
-	if (result?.stdout) {
-		for (const line of result.stdout.split("\n")) if (line.trim()) console.log(`  ${require_theme.colors.dim(line.trim())}`);
+	if (!result || result.exitCode !== 0) {
+		const exitCode = result?.exitCode ?? "unknown";
+		const tail = (stream, text) => text.trim() ? `\nrailway ${stream} (tail):\n${text.trim().split("\n").slice(-20).join("\n")}` : "";
+		throw new Error(`railway redeploy failed with exit code ${exitCode}` + tail("stdout", collected.stdout) + tail("stderr", collected.stderr));
 	}
-	if (!result || result.exitCode !== 0) throw new Error(result?.stderr.trim() ? `railway up failed: ${result.stderr.trim().split("\n").slice(-3).join(" ")}` : `railway up failed with exit code ${result?.exitCode ?? "unknown"}`);
 	console.log(require_theme.colors.green(`  ${require_theme.icons.ok} Railway deploy complete`));
 }
 
@@ -182,5 +252,7 @@ exports.buildAndPushImage = buildAndPushImage;
 exports.computeImageTags = computeImageTags;
 exports.deployImageToRailway = deployImageToRailway;
 exports.hasDocker = hasDocker;
+exports.isValidImageDigest = isValidImageDigest;
+exports.resolveDeployImagePlan = resolveDeployImagePlan;
 exports.resolveImageRef = resolveImageRef;
 //# sourceMappingURL=image-deploy.cjs.map

package/dist/image-deploy.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"image-deploy.cjs","names":["run","readFileSync","join","colors","icons"],"sources":["../src/image-deploy.ts"],"sourcesContent":["import { mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { run } from \"./utils/run\";\nimport { colors, icons } from \"./utils/theme\";\n\nexport interface ResolvedImageRef {\n  image: string;\n  source: \"ci\" | \"env\" | \"repository\";\n}\n\n/**\n * Image reference resolution precedence (ADR 0021): `ci.image` in\n * bos.config.json → `BOS_IMAGE` env → derived from `repository`.\n */\nexport function resolveImageRef(input: {\n  ciImage?: string;\n  repository?: string;\n  env?: Record<string, string | undefined>;\n}): ResolvedImageRef | undefined {\n  const envImage = input.env?.BOS_IMAGE;\n  if (input.ciImage) return { image: input.ciImage, source: \"ci\" };\n  if (envImage) return { image: envImage, source: \"env\" };\n\n  const repo = input.repository\n    ?.replace(/^https?:\\/\\/(www\\.)?github\\.com\\//i, \"\")\n    .replace(/\\.git$/i, \"\")\n    .replace(/\\/+$/, \"\")\n    .toLowerCase();\n  if (!repo?.includes(\"/\") || repo.split(\"/\").length !== 2) return undefined;\n  return { image: `ghcr.io/${repo}`, source: \"repository\" };\n}\n\nexport async function hasDocker(): Promise<boolean> {\n  try {\n    const result = await run(\"docker\", [\"info\", \"--format\", \"{{.ServerVersion}}\"], {\n      capture: true,\n    });\n    return result?.exitCode === 0;\n  } catch {\n    return false;\n  }\n}\n\nfunction parseDigest(pushOutput: string): string | undefined {\n  const match = pushOutput.match(/digest:\\s*(sha256:[a-f0-9]+)/i);\n  return match?.[1];\n}\n\nconst SEMVER_PATTERN = /^(\\d+)\\.(\\d+)\\.(\\d+)(?:-([0-9A-Za-z.-]+))?$/;\n\n/**\n * The runtime framework version baked into the image is the workspace source's\n * `everything-dev` package version — the image builds from `configDir`, so that\n * file is the truth. Missing (child repos without the workspace) → undefined.\n */\nfunction readFrameworkVersion(configDir: string): string | undefined {\n  try {\n    const raw = readFileSync(\n      join(configDir, \"packages\", \"everything-dev\", \"package.json\"),\n      \"utf-8\",\n    );\n    const pkg = JSON.parse(raw) as { version?: unknown };\n    return typeof pkg.version === \"string\" && SEMVER_PATTERN.test(pkg.version)\n      ? pkg.version\n      : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nexport interface ImageTags {\n  /** Exact refs to build and push, in push order (latest excluded). */\n  tags: string[];\n  /** Push `:latest` after the pinned tags. */\n  pushLatest: boolean;\n  /** Human-readable reason when `latest` is held. */\n  latestHoldReason?: string;\n}\n\n/**\n * Tag scheme (ADR 0021): `sha-<short>` always; the exact `v<version>` tag; a\n * floating major tag (`v2`) on stable releases only. `latest` is held during\n * prereleases (npm's `rc` dist-tag analog) so existing deployments pinned to\n * `:latest` keep serving the last stable image.\n */\nexport function computeImageTags(input: { shortSha: string; version?: string }): ImageTags {\n  const tags = [`sha-${input.shortSha}`];\n  const match = input.version?.trim().match(SEMVER_PATTERN);\n  if (!match) {\n    return { tags, pushLatest: true };\n  }\n  const [, major, minor, patch, prerelease] = match;\n  const exact = prerelease\n    ? `v${major}.${minor}.${patch}-${prerelease}`\n    : `v${major}.${minor}.${patch}`;\n  if (prerelease) {\n    return {\n      tags: [...tags, exact],\n      pushLatest: false,\n      latestHoldReason: `${exact} is a prerelease — :latest still serves the last stable image`,\n    };\n  }\n  return { tags: [...tags, exact, `v${major}`], pushLatest: true };\n}\n\nexport interface ImageDeployResult {\n  image: string;\n  /** Primary pinned tag (the sha tag). */\n  tag: string;\n  /** All tags pushed, including the primary. */\n  tags: string[];\n  latestPushed: boolean;\n  digest?: string;\n}\n\n/**\n * Image leg (ADR 0021): build the runtime stage, tag `sha-<short>` + version\n * tags, push them, capture the digest, and push `:latest` unless the version\n * is a prerelease. Callers skip the leg with a notice when no image is\n * configured (child repos get build+upload+publish only).\n */\nexport async function buildAndPushImage(input: {\n  image: string;\n  configDir: string;\n  verbose?: boolean;\n}): Promise<ImageDeployResult> {\n  const shaResult = await run(\"git\", [\"rev-parse\", \"--short=7\", \"HEAD\"], {\n    cwd: input.configDir,\n    capture: true,\n  });\n  const shortSha = shaResult?.stdout.trim();\n  if (!shaResult || shaResult.exitCode !== 0 || !shortSha) {\n    const detail = shaResult?.stderr.trim();\n    throw new Error(\n      `Failed to resolve the current git SHA in ${input.configDir} (exit code ${shaResult?.exitCode ?? \"unknown\"}${detail ? `: ${detail}` : \"\"})`,\n    );\n  }\n\n  const version = readFrameworkVersion(input.configDir);\n  const { tags, pushLatest, latestHoldReason } = computeImageTags({ shortSha, version });\n  const refs = tags.map((tag) => `${input.image}:${tag}`);\n  const latestRef = `${input.image}:latest`;\n  const buildRefs = pushLatest ? [...refs, latestRef] : refs;\n\n  console.log(\n    `  Building runtime image ${colors.cyan(buildRefs.join(\", \"))}${pushLatest ? \"\" : colors.yellow(\" (latest held)\")}`,\n  );\n  await run(\n    \"docker\",\n    [\"build\", \"--target\", \"runtime\", ...buildRefs.flatMap((ref) => [\"-t\", ref]), \".\"],\n    { cwd: input.configDir },\n  );\n\n  console.log(`  Pushing ${colors.cyan(refs.join(\", \"))}...`);\n  let digest: string | undefined;\n  for (const ref of refs) {\n    const push = await run(\"docker\", [\"push\", ref], {\n      cwd: input.configDir,\n      capture: true,\n    });\n    if (!push || push.exitCode !== 0) {\n      throw new Error(`docker push ${ref} failed with exit code ${push?.exitCode ?? \"unknown\"}`);\n    }\n    digest ??= parseDigest(push.stdout);\n    if (input.verbose && push.stdout.trim()) {\n      console.log(colors.dim(push.stdout.trim()));\n    }\n  }\n\n  let latestPushed = false;\n  if (pushLatest) {\n    const pushLatestRef = await run(\"docker\", [\"push\", latestRef], {\n      cwd: input.configDir,\n      capture: true,\n    });\n    if (!pushLatestRef || pushLatestRef.exitCode !== 0) {\n      throw new Error(\n        `docker push ${latestRef} failed with exit code ${pushLatestRef?.exitCode ?? \"unknown\"}`,\n      );\n    }\n    digest ??= parseDigest(pushLatestRef.stdout);\n    if (input.verbose && pushLatestRef.stdout.trim()) {\n      console.log(colors.dim(pushLatestRef.stdout.trim()));\n    }\n    latestPushed = true;\n  } else {\n    console.log(colors.yellow(`  latest held: ${latestHoldReason}`));\n  }\n\n  if (!digest) {\n    console.log(colors.yellow(\"  Could not capture the image digest from push output\"));\n  }\n\n  return { image: input.image, tag: tags[0], tags, latestPushed, digest };\n}\n\n/**\n * Railway leg (ADR 0021): pull-only deploy of the pushed image digest — a\n * thin `FROM image@digest` Dockerfile pins the digest so Railway never\n * rebuilds; `RAILWAY_DOCKERFILE_PATH` points at the generated file.\n */\nexport async function deployImageToRailway(input: {\n  image: string;\n  digest: string;\n  service: string;\n  configDir: string;\n}): Promise<void> {\n  const deployDir = join(input.configDir, \".bos\", \"deploy\");\n  mkdirSync(deployDir, { recursive: true });\n  const dockerfilePath = join(deployDir, \"Dockerfile\");\n  writeFileSync(dockerfilePath, `FROM ${input.image}@${input.digest}\\n`);\n\n  console.log(`  Deploying to Railway service ${colors.cyan(input.service)} (pull-only)...`);\n  const result = await run(\"railway\", [\"up\", \"--service\", input.service, \"--ci\"], {\n    cwd: input.configDir,\n    capture: true,\n    env: { RAILWAY_DOCKERFILE_PATH: \".bos/deploy/Dockerfile\" },\n  });\n  if (result?.stdout) {\n    for (const line of result.stdout.split(\"\\n\")) {\n      if (line.trim()) console.log(`  ${colors.dim(line.trim())}`);\n    }\n  }\n  if (!result || result.exitCode !== 0) {\n    throw new Error(\n      result?.stderr.trim()\n        ? `railway up failed: ${result.stderr.trim().split(\"\\n\").slice(-3).join(\" \")}`\n        : `railway up failed with exit code ${result?.exitCode ?? \"unknown\"}`,\n    );\n  }\n  console.log(colors.green(`  ${icons.ok} Railway deploy complete`));\n}\n"],"mappings":";;;;;;;;;;AAcA,SAAgB,gBAAgB,OAIC;CAC/B,MAAM,WAAW,MAAM,KAAK;CAC5B,IAAI,MAAM,SAAS,OAAO;EAAE,OAAO,MAAM;EAAS,QAAQ;CAAK;CAC/D,IAAI,UAAU,OAAO;EAAE,OAAO;EAAU,QAAQ;CAAM;CAEtD,MAAM,OAAO,MAAM,YACf,QAAQ,sCAAsC,EAAE,CAAC,CAClD,QAAQ,WAAW,EAAE,CAAC,CACtB,QAAQ,QAAQ,EAAE,CAAC,CACnB,YAAY;CACf,IAAI,CAAC,MAAM,SAAS,GAAG,KAAK,KAAK,MAAM,GAAG,CAAC,CAAC,WAAW,GAAG,OAAO;CACjE,OAAO;EAAE,OAAO,WAAW;EAAQ,QAAQ;CAAa;AAC1D;AAEA,eAAsB,YAA8B;CAClD,IAAI;EAIF,QAAO,MAHcA,gBAAI,UAAU;GAAC;GAAQ;GAAY;EAAoB,GAAG,EAC7E,SAAS,KACX,CAAC,EACY,EAAE,aAAa;CAC9B,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,YAAY,YAAwC;CAE3D,OADc,WAAW,MAAM,+BACpB,CAAC,GAAG;AACjB;AAEA,MAAM,iBAAiB;;;;;;AAOvB,SAAS,qBAAqB,WAAuC;CACnE,IAAI;EACF,MAAM,UAAMC,0BACVC,gBAAK,WAAW,YAAY,kBAAkB,cAAc,GAC5D,OACF;EACA,MAAM,MAAM,KAAK,MAAM,GAAG;EAC1B,OAAO,OAAO,IAAI,YAAY,YAAY,eAAe,KAAK,IAAI,OAAO,IACrE,IAAI,UACJ;CACN,QAAQ;EACN;CACF;AACF;;;;;;;AAiBA,SAAgB,iBAAiB,OAA0D;CACzF,MAAM,OAAO,CAAC,OAAO,MAAM,UAAU;CACrC,MAAM,QAAQ,MAAM,SAAS,KAAK,CAAC,CAAC,MAAM,cAAc;CACxD,IAAI,CAAC,OACH,OAAO;EAAE;EAAM,YAAY;CAAK;CAElC,MAAM,GAAG,OAAO,OAAO,OAAO,cAAc;CAC5C,MAAM,QAAQ,aACV,IAAI,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,eAC/B,IAAI,MAAM,GAAG,MAAM,GAAG;CAC1B,IAAI,YACF,OAAO;EACL,MAAM,CAAC,GAAG,MAAM,KAAK;EACrB,YAAY;EACZ,kBAAkB,GAAG,MAAM;CAC7B;CAEF,OAAO;EAAE,MAAM;GAAC,GAAG;GAAM;GAAO,IAAI;EAAO;EAAG,YAAY;CAAK;AACjE;;;;;;;AAkBA,eAAsB,kBAAkB,OAIT;CAC7B,MAAM,YAAY,MAAMF,gBAAI,OAAO;EAAC;EAAa;EAAa;CAAM,GAAG;EACrE,KAAK,MAAM;EACX,SAAS;CACX,CAAC;CACD,MAAM,WAAW,WAAW,OAAO,KAAK;CACxC,IAAI,CAAC,aAAa,UAAU,aAAa,KAAK,CAAC,UAAU;EACvD,MAAM,SAAS,WAAW,OAAO,KAAK;EACtC,MAAM,IAAI,MACR,4CAA4C,MAAM,UAAU,cAAc,WAAW,YAAY,YAAY,SAAS,KAAK,WAAW,GAAG,EAC3I;CACF;CAGA,MAAM,EAAE,MAAM,YAAY,qBAAqB,iBAAiB;EAAE;EAAU,SAD5D,qBAAqB,MAAM,SACuC;CAAE,CAAC;CACrF,MAAM,OAAO,KAAK,KAAK,QAAQ,GAAG,MAAM,MAAM,GAAG,KAAK;CACtD,MAAM,YAAY,GAAG,MAAM,MAAM;CACjC,MAAM,YAAY,aAAa,CAAC,GAAG,MAAM,SAAS,IAAI;CAEtD,QAAQ,IACN,4BAA4BG,qBAAO,KAAK,UAAU,KAAK,IAAI,CAAC,IAAI,aAAa,KAAKA,qBAAO,OAAO,gBAAgB,GAClH;CACA,MAAMH,gBACJ,UACA;EAAC;EAAS;EAAY;EAAW,GAAG,UAAU,SAAS,QAAQ,CAAC,MAAM,GAAG,CAAC;EAAG;CAAG,GAChF,EAAE,KAAK,MAAM,UAAU,CACzB;CAEA,QAAQ,IAAI,aAAaG,qBAAO,KAAK,KAAK,KAAK,IAAI,CAAC,EAAE,IAAI;CAC1D,IAAI;CACJ,KAAK,MAAM,OAAO,MAAM;EACtB,MAAM,OAAO,MAAMH,gBAAI,UAAU,CAAC,QAAQ,GAAG,GAAG;GAC9C,KAAK,MAAM;GACX,SAAS;EACX,CAAC;EACD,IAAI,CAAC,QAAQ,KAAK,aAAa,GAC7B,MAAM,IAAI,MAAM,eAAe,IAAI,yBAAyB,MAAM,YAAY,WAAW;EAE3F,WAAW,YAAY,KAAK,MAAM;EAClC,IAAI,MAAM,WAAW,KAAK,OAAO,KAAK,GACpC,QAAQ,IAAIG,qBAAO,IAAI,KAAK,OAAO,KAAK,CAAC,CAAC;CAE9C;CAEA,IAAI,eAAe;CACnB,IAAI,YAAY;EACd,MAAM,gBAAgB,MAAMH,gBAAI,UAAU,CAAC,QAAQ,SAAS,GAAG;GAC7D,KAAK,MAAM;GACX,SAAS;EACX,CAAC;EACD,IAAI,CAAC,iBAAiB,cAAc,aAAa,GAC/C,MAAM,IAAI,MACR,eAAe,UAAU,yBAAyB,eAAe,YAAY,WAC/E;EAEF,WAAW,YAAY,cAAc,MAAM;EAC3C,IAAI,MAAM,WAAW,cAAc,OAAO,KAAK,GAC7C,QAAQ,IAAIG,qBAAO,IAAI,cAAc,OAAO,KAAK,CAAC,CAAC;EAErD,eAAe;CACjB,OACE,QAAQ,IAAIA,qBAAO,OAAO,kBAAkB,kBAAkB,CAAC;CAGjE,IAAI,CAAC,QACH,QAAQ,IAAIA,qBAAO,OAAO,uDAAuD,CAAC;CAGpF,OAAO;EAAE,OAAO,MAAM;EAAO,KAAK,KAAK;EAAI;EAAM;EAAc;CAAO;AACxE;;;;;;AAOA,eAAsB,qBAAqB,OAKzB;CAChB,MAAM,gBAAYD,gBAAK,MAAM,WAAW,QAAQ,QAAQ;CACxD,uBAAU,WAAW,EAAE,WAAW,KAAK,CAAC;CACxC,MAAM,qBAAiBA,gBAAK,WAAW,YAAY;CACnD,2BAAc,gBAAgB,QAAQ,MAAM,MAAM,GAAG,MAAM,OAAO,GAAG;CAErE,QAAQ,IAAI,kCAAkCC,qBAAO,KAAK,MAAM,OAAO,EAAE,gBAAgB;CACzF,MAAM,SAAS,MAAMH,gBAAI,WAAW;EAAC;EAAM;EAAa,MAAM;EAAS;CAAM,GAAG;EAC9E,KAAK,MAAM;EACX,SAAS;EACT,KAAK,EAAE,yBAAyB,yBAAyB;CAC3D,CAAC;CACD,IAAI,QAAQ,QACV;OAAK,MAAM,QAAQ,OAAO,OAAO,MAAM,IAAI,GACzC,IAAI,KAAK,KAAK,GAAG,QAAQ,IAAI,KAAKG,qBAAO,IAAI,KAAK,KAAK,CAAC,GAAG;CAC7D;CAEF,IAAI,CAAC,UAAU,OAAO,aAAa,GACjC,MAAM,IAAI,MACR,QAAQ,OAAO,KAAK,IAChB,sBAAsB,OAAO,OAAO,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,GAAG,MACzE,oCAAoC,QAAQ,YAAY,WAC9D;CAEF,QAAQ,IAAIA,qBAAO,MAAM,KAAKC,oBAAM,GAAG,yBAAyB,CAAC;AACnE"}
+{"version":3,"file":"image-deploy.cjs","names":["run","readFileSync","join","colors","icons"],"sources":["../src/image-deploy.ts"],"sourcesContent":["import { readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { run } from \"./utils/run\";\nimport { colors, icons } from \"./utils/theme\";\n\nexport interface ResolvedImageRef {\n  image: string;\n  source: \"ci\" | \"env\" | \"repository\";\n}\n\n/**\n * Image reference resolution precedence (ADR 0021): `ci.image` in\n * bos.config.json → `BOS_IMAGE` env → derived from `repository`.\n */\nexport function resolveImageRef(input: {\n  ciImage?: string;\n  repository?: string;\n  env?: Record<string, string | undefined>;\n}): ResolvedImageRef | undefined {\n  const envImage = input.env?.BOS_IMAGE;\n  if (input.ciImage) return { image: input.ciImage, source: \"ci\" };\n  if (envImage) return { image: envImage, source: \"env\" };\n\n  const repo = input.repository\n    ?.replace(/^https?:\\/\\/(www\\.)?github\\.com\\//i, \"\")\n    .replace(/\\.git$/i, \"\")\n    .replace(/\\/+$/, \"\")\n    .toLowerCase();\n  if (!repo?.includes(\"/\") || repo.split(\"/\").length !== 2) return undefined;\n  return { image: `ghcr.io/${repo}`, source: \"repository\" };\n}\n\nexport async function hasDocker(): Promise<boolean> {\n  try {\n    const result = await run(\"docker\", [\"info\", \"--format\", \"{{.ServerVersion}}\"], {\n      capture: true,\n    });\n    return result?.exitCode === 0;\n  } catch {\n    return false;\n  }\n}\n\nfunction parseDigest(pushOutput: string): string | undefined {\n  const match = pushOutput.match(/digest:\\s*(sha256:[a-f0-9]+)/i);\n  return match?.[1];\n}\n\nconst SEMVER_PATTERN = /^(\\d+)\\.(\\d+)\\.(\\d+)(?:-([0-9A-Za-z.-]+))?$/;\n\n/**\n * The runtime framework version baked into the image is the workspace source's\n * `everything-dev` package version — the image builds from `configDir`, so that\n * file is the truth. Missing (child repos without the workspace) → undefined.\n */\nfunction readFrameworkVersion(configDir: string): string | undefined {\n  try {\n    const raw = readFileSync(\n      join(configDir, \"packages\", \"everything-dev\", \"package.json\"),\n      \"utf-8\",\n    );\n    const pkg = JSON.parse(raw) as { version?: unknown };\n    return typeof pkg.version === \"string\" && SEMVER_PATTERN.test(pkg.version)\n      ? pkg.version\n      : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nexport interface ImageTags {\n  /** Exact refs to build and push, in push order (latest excluded). */\n  tags: string[];\n  /** Push `:latest` after the pinned tags. */\n  pushLatest: boolean;\n  /** Human-readable reason when `latest` is held. */\n  latestHoldReason?: string;\n  /** Push `:rc` after the pinned tags — the floating prerelease-train ref. */\n  pushRc: boolean;\n}\n\n/**\n * Tag scheme (ADR 0021): `sha-<short>` always; the exact `v<version>` tag; a\n * floating major tag (`v2`) on stable releases only. `latest` is held during\n * prereleases (npm's `rc` dist-tag analog) so existing deployments pinned to\n * `:latest` keep serving the last stable image — and `:rc` is the floating\n * ref for the prerelease train (npm's `rc` dist-tag mirror): it moves on\n * every prerelease deploy and freezes at the last rc-train build once the\n * workspace releases a stable version.\n */\nexport function computeImageTags(input: { shortSha: string; version?: string }): ImageTags {\n  const tags = [`sha-${input.shortSha}`];\n  const match = input.version?.trim().match(SEMVER_PATTERN);\n  if (!match) {\n    return { tags, pushLatest: true, pushRc: false };\n  }\n  const [, major, minor, patch, prerelease] = match;\n  const exact = prerelease\n    ? `v${major}.${minor}.${patch}-${prerelease}`\n    : `v${major}.${minor}.${patch}`;\n  if (prerelease) {\n    return {\n      tags: [...tags, exact],\n      pushLatest: false,\n      latestHoldReason: `${exact} is a prerelease — :latest still serves the last stable image`,\n      pushRc: true,\n    };\n  }\n  return { tags: [...tags, exact, `v${major}`], pushLatest: true, pushRc: false };\n}\n\nexport interface ImageDeployResult {\n  image: string;\n  /** Primary pinned tag (the sha tag). */\n  tag: string;\n  /** All tags pushed, including the primary. */\n  tags: string[];\n  latestPushed: boolean;\n  /** Whether the floating `:rc` prerelease-train ref was pushed. */\n  rcPushed: boolean;\n  digest?: string;\n}\n\nexport type DeployImagePlan =\n  | { kind: \"prebuilt\"; image: string; digest: string }\n  | { kind: \"build\"; image: string }\n  | { kind: \"skip\"; reason: string };\n\nconst DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/;\n\n/** A Railway pin is `FROM image@<digest>` — anything else cannot resolve. */\nexport function isValidImageDigest(digest: string): boolean {\n  return DIGEST_PATTERN.test(digest);\n}\n\n/**\n * Decide the image leg's source: a digest handed over from a pre-pushed image\n * (the CI image job) wins; otherwise the local docker build runs when the\n * toolchain and Dockerfile are present (ADR 0021, as amended).\n */\nexport function resolveDeployImagePlan(input: {\n  imageRef: ResolvedImageRef | undefined;\n  imageDigest?: string;\n  hasDocker: boolean;\n  hasDockerfile: boolean;\n}): DeployImagePlan {\n  if (!input.imageRef) {\n    return {\n      kind: \"skip\",\n      reason: \"set ci.image in bos.config.json (or BOS_IMAGE) to build and push the runtime image\",\n    };\n  }\n  if (input.imageDigest) {\n    return { kind: \"prebuilt\", image: input.imageRef.image, digest: input.imageDigest };\n  }\n  if (!input.hasDocker) {\n    return { kind: \"skip\", reason: \"docker is not available\" };\n  }\n  if (!input.hasDockerfile) {\n    return { kind: \"skip\", reason: \"no Dockerfile at the config root\" };\n  }\n  return { kind: \"build\", image: input.imageRef.image };\n}\n\n/**\n * Image leg (ADR 0021): build the runtime stage, tag `sha-<short>` + version\n * tags, push them, capture the digest, then push the floating refs — `:latest`\n * unless the version is a prerelease, and `:rc` when it is. Callers skip the\n * leg with a notice when no image is configured (child repos get\n * build+upload+publish only).\n */\nexport async function buildAndPushImage(input: {\n  image: string;\n  configDir: string;\n  verbose?: boolean;\n}): Promise<ImageDeployResult> {\n  const shaResult = await run(\"git\", [\"rev-parse\", \"--short=7\", \"HEAD\"], {\n    cwd: input.configDir,\n    capture: true,\n  });\n  const shortSha = shaResult?.stdout.trim();\n  if (!shaResult || shaResult.exitCode !== 0 || !shortSha) {\n    const detail = shaResult?.stderr.trim();\n    throw new Error(\n      `Failed to resolve the current git SHA in ${input.configDir} (exit code ${shaResult?.exitCode ?? \"unknown\"}${detail ? `: ${detail}` : \"\"})`,\n    );\n  }\n\n  const version = readFrameworkVersion(input.configDir);\n  const { tags, pushLatest, latestHoldReason, pushRc } = computeImageTags({\n    shortSha,\n    version,\n  });\n  const refs = tags.map((tag) => `${input.image}:${tag}`);\n  const latestRef = `${input.image}:latest`;\n  const rcRef = `${input.image}:rc`;\n  const buildRefs = pushLatest ? [...refs, latestRef] : [...refs];\n  if (pushRc) buildRefs.push(rcRef);\n\n  console.log(\n    `  Building runtime image ${colors.cyan(buildRefs.join(\", \"))}${pushLatest ? \"\" : colors.yellow(\" (latest held)\")}`,\n  );\n  await run(\n    \"docker\",\n    [\"build\", \"--target\", \"runtime\", ...buildRefs.flatMap((ref) => [\"-t\", ref]), \".\"],\n    { cwd: input.configDir },\n  );\n\n  console.log(`  Pushing ${colors.cyan(refs.join(\", \"))}...`);\n  let digest: string | undefined;\n  for (const ref of refs) {\n    const push = await run(\"docker\", [\"push\", ref], {\n      cwd: input.configDir,\n      capture: true,\n    });\n    if (!push || push.exitCode !== 0) {\n      throw new Error(`docker push ${ref} failed with exit code ${push?.exitCode ?? \"unknown\"}`);\n    }\n    digest ??= parseDigest(push.stdout);\n    if (input.verbose && push.stdout.trim()) {\n      console.log(colors.dim(push.stdout.trim()));\n    }\n  }\n\n  const pushFloating = async (ref: string): Promise<boolean> => {\n    const push = await run(\"docker\", [\"push\", ref], {\n      cwd: input.configDir,\n      capture: true,\n    });\n    if (!push || push.exitCode !== 0) {\n      throw new Error(`docker push ${ref} failed with exit code ${push?.exitCode ?? \"unknown\"}`);\n    }\n    digest ??= parseDigest(push.stdout);\n    if (input.verbose && push.stdout.trim()) {\n      console.log(colors.dim(push.stdout.trim()));\n    }\n    return true;\n  };\n\n  let latestPushed = false;\n  if (pushLatest) {\n    latestPushed = await pushFloating(latestRef);\n  } else {\n    console.log(colors.yellow(`  latest held: ${latestHoldReason}`));\n  }\n  const rcPushed = pushRc ? await pushFloating(rcRef) : false;\n\n  if (!digest) {\n    console.log(colors.yellow(\"  Could not capture the image digest from push output\"));\n  }\n\n  return { image: input.image, tag: tags[0]!, tags, latestPushed, rcPushed, digest };\n}\n\n/**\n * Railway leg (ADR 0021, amended): image-backed deploy. The service's source\n * is a Docker image ref (connected once in the dashboard — `:rc` during the\n * prerelease train), and `redeploy --from-source` pulls and deploys whatever\n * that ref points at. The image leg pushes `:rc` (and the `sha-<short>` /\n * version tags) immediately before this step, so the pulled bytes are exactly\n * what this train validated. Railway skips the build entirely for\n * Docker-image sources — nothing is uploaded, nothing is built on Railway,\n * and the digest-pin Dockerfile mechanism this replaces is gone (the CLI v5\n * dropped RAILWAY_DOCKERFILE_PATH, its snapshot respects .gitignore so\n * generated Dockerfiles never shipped, and its Metal builder rejected the\n * repo Dockerfile's cache-mount ids).\n */\nexport async function deployImageToRailway(input: {\n  service: string;\n  configDir: string;\n}): Promise<void> {\n  console.log(`  Deploying to Railway service ${colors.cyan(input.service)} (image-backed)...`);\n  // The probe is authoritative: runners don't ship the CLI, and a spawn\n  // failure resolves (reject:false) as exitCode 1 with empty output — the\n  // 2026-10-13 deploy surfaced exactly that as a silent instant failure.\n  let version: string | undefined;\n  try {\n    version = (await run(\"railway\", [\"--version\"], { cwd: input.configDir, capture: true }))\n      ?.stdout;\n  } catch {\n    version = undefined;\n  }\n  if (!version?.trim()) {\n    throw new Error(\"Railway CLI not found. Install it: npm i -g @railway/cli\");\n  }\n  console.log(`  ${colors.dim(`railway ${version.trim()}`)}`);\n\n  // Stream the CLI's output live — a silent exit (empty stdout+stderr, seen\n  // on the 2026-10-13 deploy) must still be diagnosable from the workflow log.\n  const collected = { stdout: \"\", stderr: \"\" };\n  const result = await run(\n    \"railway\",\n    [\"redeploy\", \"--service\", input.service, \"--from-source\", \"--yes\"],\n    {\n      cwd: input.configDir,\n      capture: true,\n      onChunk: (stream, chunk) => {\n        collected[stream] += chunk.toString(\"utf-8\");\n        for (const line of chunk.toString(\"utf-8\").split(\"\\n\")) {\n          if (line.trim()) console.log(`  ${colors.dim(line.trim())}`);\n        }\n      },\n    },\n  );\n  if (!result || result.exitCode !== 0) {\n    const exitCode = result?.exitCode ?? \"unknown\";\n    const tail = (stream: string, text: string) =>\n      text.trim()\n        ? `\\nrailway ${stream} (tail):\\n${text.trim().split(\"\\n\").slice(-20).join(\"\\n\")}`\n        : \"\";\n    throw new Error(\n      `railway redeploy failed with exit code ${exitCode}` +\n        tail(\"stdout\", collected.stdout) +\n        tail(\"stderr\", collected.stderr),\n    );\n  }\n  console.log(colors.green(`  ${icons.ok} Railway deploy complete`));\n}\n"],"mappings":";;;;;;;;;;AAcA,SAAgB,gBAAgB,OAIC;CAC/B,MAAM,WAAW,MAAM,KAAK;CAC5B,IAAI,MAAM,SAAS,OAAO;EAAE,OAAO,MAAM;EAAS,QAAQ;CAAK;CAC/D,IAAI,UAAU,OAAO;EAAE,OAAO;EAAU,QAAQ;CAAM;CAEtD,MAAM,OAAO,MAAM,YACf,QAAQ,sCAAsC,EAAE,CAAC,CAClD,QAAQ,WAAW,EAAE,CAAC,CACtB,QAAQ,QAAQ,EAAE,CAAC,CACnB,YAAY;CACf,IAAI,CAAC,MAAM,SAAS,GAAG,KAAK,KAAK,MAAM,GAAG,CAAC,CAAC,WAAW,GAAG,OAAO;CACjE,OAAO;EAAE,OAAO,WAAW;EAAQ,QAAQ;CAAa;AAC1D;AAEA,eAAsB,YAA8B;CAClD,IAAI;EAIF,QAAO,MAHcA,gBAAI,UAAU;GAAC;GAAQ;GAAY;EAAoB,GAAG,EAC7E,SAAS,KACX,CAAC,EACY,EAAE,aAAa;CAC9B,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,YAAY,YAAwC;CAE3D,OADc,WAAW,MAAM,+BACpB,CAAC,GAAG;AACjB;AAEA,MAAM,iBAAiB;;;;;;AAOvB,SAAS,qBAAqB,WAAuC;CACnE,IAAI;EACF,MAAM,UAAMC,0BACVC,gBAAK,WAAW,YAAY,kBAAkB,cAAc,GAC5D,OACF;EACA,MAAM,MAAM,KAAK,MAAM,GAAG;EAC1B,OAAO,OAAO,IAAI,YAAY,YAAY,eAAe,KAAK,IAAI,OAAO,IACrE,IAAI,UACJ;CACN,QAAQ;EACN;CACF;AACF;;;;;;;;;;AAsBA,SAAgB,iBAAiB,OAA0D;CACzF,MAAM,OAAO,CAAC,OAAO,MAAM,UAAU;CACrC,MAAM,QAAQ,MAAM,SAAS,KAAK,CAAC,CAAC,MAAM,cAAc;CACxD,IAAI,CAAC,OACH,OAAO;EAAE;EAAM,YAAY;EAAM,QAAQ;CAAM;CAEjD,MAAM,GAAG,OAAO,OAAO,OAAO,cAAc;CAC5C,MAAM,QAAQ,aACV,IAAI,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,eAC/B,IAAI,MAAM,GAAG,MAAM,GAAG;CAC1B,IAAI,YACF,OAAO;EACL,MAAM,CAAC,GAAG,MAAM,KAAK;EACrB,YAAY;EACZ,kBAAkB,GAAG,MAAM;EAC3B,QAAQ;CACV;CAEF,OAAO;EAAE,MAAM;GAAC,GAAG;GAAM;GAAO,IAAI;EAAO;EAAG,YAAY;EAAM,QAAQ;CAAM;AAChF;AAmBA,MAAM,iBAAiB;;AAGvB,SAAgB,mBAAmB,QAAyB;CAC1D,OAAO,eAAe,KAAK,MAAM;AACnC;;;;;;AAOA,SAAgB,uBAAuB,OAKnB;CAClB,IAAI,CAAC,MAAM,UACT,OAAO;EACL,MAAM;EACN,QAAQ;CACV;CAEF,IAAI,MAAM,aACR,OAAO;EAAE,MAAM;EAAY,OAAO,MAAM,SAAS;EAAO,QAAQ,MAAM;CAAY;CAEpF,IAAI,CAAC,MAAM,WACT,OAAO;EAAE,MAAM;EAAQ,QAAQ;CAA0B;CAE3D,IAAI,CAAC,MAAM,eACT,OAAO;EAAE,MAAM;EAAQ,QAAQ;CAAmC;CAEpE,OAAO;EAAE,MAAM;EAAS,OAAO,MAAM,SAAS;CAAM;AACtD;;;;;;;;AASA,eAAsB,kBAAkB,OAIT;CAC7B,MAAM,YAAY,MAAMF,gBAAI,OAAO;EAAC;EAAa;EAAa;CAAM,GAAG;EACrE,KAAK,MAAM;EACX,SAAS;CACX,CAAC;CACD,MAAM,WAAW,WAAW,OAAO,KAAK;CACxC,IAAI,CAAC,aAAa,UAAU,aAAa,KAAK,CAAC,UAAU;EACvD,MAAM,SAAS,WAAW,OAAO,KAAK;EACtC,MAAM,IAAI,MACR,4CAA4C,MAAM,UAAU,cAAc,WAAW,YAAY,YAAY,SAAS,KAAK,WAAW,GAAG,EAC3I;CACF;CAGA,MAAM,EAAE,MAAM,YAAY,kBAAkB,WAAW,iBAAiB;EACtE;EACA,SAHc,qBAAqB,MAAM,SAGnC;CACR,CAAC;CACD,MAAM,OAAO,KAAK,KAAK,QAAQ,GAAG,MAAM,MAAM,GAAG,KAAK;CACtD,MAAM,YAAY,GAAG,MAAM,MAAM;CACjC,MAAM,QAAQ,GAAG,MAAM,MAAM;CAC7B,MAAM,YAAY,aAAa,CAAC,GAAG,MAAM,SAAS,IAAI,CAAC,GAAG,IAAI;CAC9D,IAAI,QAAQ,UAAU,KAAK,KAAK;CAEhC,QAAQ,IACN,4BAA4BG,qBAAO,KAAK,UAAU,KAAK,IAAI,CAAC,IAAI,aAAa,KAAKA,qBAAO,OAAO,gBAAgB,GAClH;CACA,MAAMH,gBACJ,UACA;EAAC;EAAS;EAAY;EAAW,GAAG,UAAU,SAAS,QAAQ,CAAC,MAAM,GAAG,CAAC;EAAG;CAAG,GAChF,EAAE,KAAK,MAAM,UAAU,CACzB;CAEA,QAAQ,IAAI,aAAaG,qBAAO,KAAK,KAAK,KAAK,IAAI,CAAC,EAAE,IAAI;CAC1D,IAAI;CACJ,KAAK,MAAM,OAAO,MAAM;EACtB,MAAM,OAAO,MAAMH,gBAAI,UAAU,CAAC,QAAQ,GAAG,GAAG;GAC9C,KAAK,MAAM;GACX,SAAS;EACX,CAAC;EACD,IAAI,CAAC,QAAQ,KAAK,aAAa,GAC7B,MAAM,IAAI,MAAM,eAAe,IAAI,yBAAyB,MAAM,YAAY,WAAW;EAE3F,WAAW,YAAY,KAAK,MAAM;EAClC,IAAI,MAAM,WAAW,KAAK,OAAO,KAAK,GACpC,QAAQ,IAAIG,qBAAO,IAAI,KAAK,OAAO,KAAK,CAAC,CAAC;CAE9C;CAEA,MAAM,eAAe,OAAO,QAAkC;EAC5D,MAAM,OAAO,MAAMH,gBAAI,UAAU,CAAC,QAAQ,GAAG,GAAG;GAC9C,KAAK,MAAM;GACX,SAAS;EACX,CAAC;EACD,IAAI,CAAC,QAAQ,KAAK,aAAa,GAC7B,MAAM,IAAI,MAAM,eAAe,IAAI,yBAAyB,MAAM,YAAY,WAAW;EAE3F,WAAW,YAAY,KAAK,MAAM;EAClC,IAAI,MAAM,WAAW,KAAK,OAAO,KAAK,GACpC,QAAQ,IAAIG,qBAAO,IAAI,KAAK,OAAO,KAAK,CAAC,CAAC;EAE5C,OAAO;CACT;CAEA,IAAI,eAAe;CACnB,IAAI,YACF,eAAe,MAAM,aAAa,SAAS;MAE3C,QAAQ,IAAIA,qBAAO,OAAO,kBAAkB,kBAAkB,CAAC;CAEjE,MAAM,WAAW,SAAS,MAAM,aAAa,KAAK,IAAI;CAEtD,IAAI,CAAC,QACH,QAAQ,IAAIA,qBAAO,OAAO,uDAAuD,CAAC;CAGpF,OAAO;EAAE,OAAO,MAAM;EAAO,KAAK,KAAK;EAAK;EAAM;EAAc;EAAU;CAAO;AACnF;;;;;;;;;;;;;;AAeA,eAAsB,qBAAqB,OAGzB;CAChB,QAAQ,IAAI,kCAAkCA,qBAAO,KAAK,MAAM,OAAO,EAAE,mBAAmB;CAI5F,IAAI;CACJ,IAAI;EACF,WAAW,MAAMH,gBAAI,WAAW,CAAC,WAAW,GAAG;GAAE,KAAK,MAAM;GAAW,SAAS;EAAK,CAAC,EAAC,EACnF;CACN,QAAQ;EACN,UAAU;CACZ;CACA,IAAI,CAAC,SAAS,KAAK,GACjB,MAAM,IAAI,MAAM,0DAA0D;CAE5E,QAAQ,IAAI,KAAKG,qBAAO,IAAI,WAAW,QAAQ,KAAK,GAAG,GAAG;CAI1D,MAAM,YAAY;EAAE,QAAQ;EAAI,QAAQ;CAAG;CAC3C,MAAM,SAAS,MAAMH,gBACnB,WACA;EAAC;EAAY;EAAa,MAAM;EAAS;EAAiB;CAAO,GACjE;EACE,KAAK,MAAM;EACX,SAAS;EACT,UAAU,QAAQ,UAAU;GAC1B,UAAU,WAAW,MAAM,SAAS,OAAO;GAC3C,KAAK,MAAM,QAAQ,MAAM,SAAS,OAAO,CAAC,CAAC,MAAM,IAAI,GACnD,IAAI,KAAK,KAAK,GAAG,QAAQ,IAAI,KAAKG,qBAAO,IAAI,KAAK,KAAK,CAAC,GAAG;EAE/D;CACF,CACF;CACA,IAAI,CAAC,UAAU,OAAO,aAAa,GAAG;EACpC,MAAM,WAAW,QAAQ,YAAY;EACrC,MAAM,QAAQ,QAAgB,SAC5B,KAAK,KAAK,IACN,aAAa,OAAO,YAAY,KAAK,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI,MAC5E;EACN,MAAM,IAAI,MACR,0CAA0C,aACxC,KAAK,UAAU,UAAU,MAAM,IAC/B,KAAK,UAAU,UAAU,MAAM,CACnC;CACF;CACA,QAAQ,IAAIA,qBAAO,MAAM,KAAKC,oBAAM,GAAG,yBAAyB,CAAC;AACnE"}

package/dist/image-deploy.mjs

@@ -1,6 +1,6 @@
 import { run } from "./utils/run.mjs";
 import { colors, icons } from "./utils/theme.mjs";
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { readFileSync } from "node:fs";
 import { join } from "node:path";
 
 //#region src/image-deploy.ts
@@ -58,21 +58,26 @@ function readFrameworkVersion(configDir) {
 * Tag scheme (ADR 0021): `sha-<short>` always; the exact `v<version>` tag; a
 * floating major tag (`v2`) on stable releases only. `latest` is held during
 * prereleases (npm's `rc` dist-tag analog) so existing deployments pinned to
-* `:latest` keep serving the last stable image.
+* `:latest` keep serving the last stable image — and `:rc` is the floating
+* ref for the prerelease train (npm's `rc` dist-tag mirror): it moves on
+* every prerelease deploy and freezes at the last rc-train build once the
+* workspace releases a stable version.
 */
 function computeImageTags(input) {
 	const tags = [`sha-${input.shortSha}`];
 	const match = input.version?.trim().match(SEMVER_PATTERN);
 	if (!match) return {
 		tags,
-		pushLatest: true
+		pushLatest: true,
+		pushRc: false
 	};
 	const [, major, minor, patch, prerelease] = match;
 	const exact = prerelease ? `v${major}.${minor}.${patch}-${prerelease}` : `v${major}.${minor}.${patch}`;
 	if (prerelease) return {
 		tags: [...tags, exact],
 		pushLatest: false,
-		latestHoldReason: `${exact} is a prerelease — :latest still serves the last stable image`
+		latestHoldReason: `${exact} is a prerelease — :latest still serves the last stable image`,
+		pushRc: true
 	};
 	return {
 		tags: [
@@ -80,14 +85,49 @@ function computeImageTags(input) {
 			exact,
 			`v${major}`
 		],
-		pushLatest: true
+		pushLatest: true,
+		pushRc: false
+	};
+}
+const DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/;
+/** A Railway pin is `FROM image@<digest>` — anything else cannot resolve. */
+function isValidImageDigest(digest) {
+	return DIGEST_PATTERN.test(digest);
+}
+/**
+* Decide the image leg's source: a digest handed over from a pre-pushed image
+* (the CI image job) wins; otherwise the local docker build runs when the
+* toolchain and Dockerfile are present (ADR 0021, as amended).
+*/
+function resolveDeployImagePlan(input) {
+	if (!input.imageRef) return {
+		kind: "skip",
+		reason: "set ci.image in bos.config.json (or BOS_IMAGE) to build and push the runtime image"
+	};
+	if (input.imageDigest) return {
+		kind: "prebuilt",
+		image: input.imageRef.image,
+		digest: input.imageDigest
+	};
+	if (!input.hasDocker) return {
+		kind: "skip",
+		reason: "docker is not available"
+	};
+	if (!input.hasDockerfile) return {
+		kind: "skip",
+		reason: "no Dockerfile at the config root"
+	};
+	return {
+		kind: "build",
+		image: input.imageRef.image
 	};
 }
 /**
 * Image leg (ADR 0021): build the runtime stage, tag `sha-<short>` + version
-* tags, push them, capture the digest, and push `:latest` unless the version
-* is a prerelease. Callers skip the leg with a notice when no image is
-* configured (child repos get build+upload+publish only).
+* tags, push them, capture the digest, then push the floating refs — `:latest`
+* unless the version is a prerelease, and `:rc` when it is. Callers skip the
+* leg with a notice when no image is configured (child repos get
+* build+upload+publish only).
 */
 async function buildAndPushImage(input) {
 	const shaResult = await run("git", [
@@ -103,13 +143,15 @@ async function buildAndPushImage(input) {
 		const detail = shaResult?.stderr.trim();
 		throw new Error(`Failed to resolve the current git SHA in ${input.configDir} (exit code ${shaResult?.exitCode ?? "unknown"}${detail ? `: ${detail}` : ""})`);
 	}
-	const { tags, pushLatest, latestHoldReason } = computeImageTags({
+	const { tags, pushLatest, latestHoldReason, pushRc } = computeImageTags({
 		shortSha,
 		version: readFrameworkVersion(input.configDir)
 	});
 	const refs = tags.map((tag) => `${input.image}:${tag}`);
 	const latestRef = `${input.image}:latest`;
-	const buildRefs = pushLatest ? [...refs, latestRef] : refs;
+	const rcRef = `${input.image}:rc`;
+	const buildRefs = pushLatest ? [...refs, latestRef] : [...refs];
+	if (pushRc) buildRefs.push(rcRef);
 	console.log(`  Building runtime image ${colors.cyan(buildRefs.join(", "))}${pushLatest ? "" : colors.yellow(" (latest held)")}`);
 	await run("docker", [
 		"build",
@@ -129,54 +171,82 @@ async function buildAndPushImage(input) {
 		digest ??= parseDigest(push.stdout);
 		if (input.verbose && push.stdout.trim()) console.log(colors.dim(push.stdout.trim()));
 	}
-	let latestPushed = false;
-	if (pushLatest) {
-		const pushLatestRef = await run("docker", ["push", latestRef], {
+	const pushFloating = async (ref) => {
+		const push = await run("docker", ["push", ref], {
 			cwd: input.configDir,
 			capture: true
 		});
-		if (!pushLatestRef || pushLatestRef.exitCode !== 0) throw new Error(`docker push ${latestRef} failed with exit code ${pushLatestRef?.exitCode ?? "unknown"}`);
-		digest ??= parseDigest(pushLatestRef.stdout);
-		if (input.verbose && pushLatestRef.stdout.trim()) console.log(colors.dim(pushLatestRef.stdout.trim()));
-		latestPushed = true;
-	} else console.log(colors.yellow(`  latest held: ${latestHoldReason}`));
+		if (!push || push.exitCode !== 0) throw new Error(`docker push ${ref} failed with exit code ${push?.exitCode ?? "unknown"}`);
+		digest ??= parseDigest(push.stdout);
+		if (input.verbose && push.stdout.trim()) console.log(colors.dim(push.stdout.trim()));
+		return true;
+	};
+	let latestPushed = false;
+	if (pushLatest) latestPushed = await pushFloating(latestRef);
+	else console.log(colors.yellow(`  latest held: ${latestHoldReason}`));
+	const rcPushed = pushRc ? await pushFloating(rcRef) : false;
 	if (!digest) console.log(colors.yellow("  Could not capture the image digest from push output"));
 	return {
 		image: input.image,
 		tag: tags[0],
 		tags,
 		latestPushed,
+		rcPushed,
 		digest
 	};
 }
 /**
-* Railway leg (ADR 0021): pull-only deploy of the pushed image digest — a
-* thin `FROM image@digest` Dockerfile pins the digest so Railway never
-* rebuilds; `RAILWAY_DOCKERFILE_PATH` points at the generated file.
+* Railway leg (ADR 0021, amended): image-backed deploy. The service's source
+* is a Docker image ref (connected once in the dashboard — `:rc` during the
+* prerelease train), and `redeploy --from-source` pulls and deploys whatever
+* that ref points at. The image leg pushes `:rc` (and the `sha-<short>` /
+* version tags) immediately before this step, so the pulled bytes are exactly
+* what this train validated. Railway skips the build entirely for
+* Docker-image sources — nothing is uploaded, nothing is built on Railway,
+* and the digest-pin Dockerfile mechanism this replaces is gone (the CLI v5
+* dropped RAILWAY_DOCKERFILE_PATH, its snapshot respects .gitignore so
+* generated Dockerfiles never shipped, and its Metal builder rejected the
+* repo Dockerfile's cache-mount ids).
 */
 async function deployImageToRailway(input) {
-	const deployDir = join(input.configDir, ".bos", "deploy");
-	mkdirSync(deployDir, { recursive: true });
-	const dockerfilePath = join(deployDir, "Dockerfile");
-	writeFileSync(dockerfilePath, `FROM ${input.image}@${input.digest}\n`);
-	console.log(`  Deploying to Railway service ${colors.cyan(input.service)} (pull-only)...`);
+	console.log(`  Deploying to Railway service ${colors.cyan(input.service)} (image-backed)...`);
+	let version;
+	try {
+		version = (await run("railway", ["--version"], {
+			cwd: input.configDir,
+			capture: true
+		}))?.stdout;
+	} catch {
+		version = void 0;
+	}
+	if (!version?.trim()) throw new Error("Railway CLI not found. Install it: npm i -g @railway/cli");
+	console.log(`  ${colors.dim(`railway ${version.trim()}`)}`);
+	const collected = {
+		stdout: "",
+		stderr: ""
+	};
 	const result = await run("railway", [
-		"up",
+		"redeploy",
 		"--service",
 		input.service,
-		"--ci"
+		"--from-source",
+		"--yes"
 	], {
 		cwd: input.configDir,
 		capture: true,
-		env: { RAILWAY_DOCKERFILE_PATH: ".bos/deploy/Dockerfile" }
+		onChunk: (stream, chunk) => {
+			collected[stream] += chunk.toString("utf-8");
+			for (const line of chunk.toString("utf-8").split("\n")) if (line.trim()) console.log(`  ${colors.dim(line.trim())}`);
+		}
 	});
-	if (result?.stdout) {
-		for (const line of result.stdout.split("\n")) if (line.trim()) console.log(`  ${colors.dim(line.trim())}`);
+	if (!result || result.exitCode !== 0) {
+		const exitCode = result?.exitCode ?? "unknown";
+		const tail = (stream, text) => text.trim() ? `\nrailway ${stream} (tail):\n${text.trim().split("\n").slice(-20).join("\n")}` : "";
+		throw new Error(`railway redeploy failed with exit code ${exitCode}` + tail("stdout", collected.stdout) + tail("stderr", collected.stderr));
 	}
-	if (!result || result.exitCode !== 0) throw new Error(result?.stderr.trim() ? `railway up failed: ${result.stderr.trim().split("\n").slice(-3).join(" ")}` : `railway up failed with exit code ${result?.exitCode ?? "unknown"}`);
 	console.log(colors.green(`  ${icons.ok} Railway deploy complete`));
 }
 
 //#endregion
-export { buildAndPushImage, computeImageTags, deployImageToRailway, hasDocker, resolveImageRef };
+export { buildAndPushImage, computeImageTags, deployImageToRailway, hasDocker, isValidImageDigest, resolveDeployImagePlan, resolveImageRef };
 //# sourceMappingURL=image-deploy.mjs.map

package/dist/image-deploy.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"image-deploy.mjs","names":[],"sources":["../src/image-deploy.ts"],"sourcesContent":["import { mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { run } from \"./utils/run\";\nimport { colors, icons } from \"./utils/theme\";\n\nexport interface ResolvedImageRef {\n  image: string;\n  source: \"ci\" | \"env\" | \"repository\";\n}\n\n/**\n * Image reference resolution precedence (ADR 0021): `ci.image` in\n * bos.config.json → `BOS_IMAGE` env → derived from `repository`.\n */\nexport function resolveImageRef(input: {\n  ciImage?: string;\n  repository?: string;\n  env?: Record<string, string | undefined>;\n}): ResolvedImageRef | undefined {\n  const envImage = input.env?.BOS_IMAGE;\n  if (input.ciImage) return { image: input.ciImage, source: \"ci\" };\n  if (envImage) return { image: envImage, source: \"env\" };\n\n  const repo = input.repository\n    ?.replace(/^https?:\\/\\/(www\\.)?github\\.com\\//i, \"\")\n    .replace(/\\.git$/i, \"\")\n    .replace(/\\/+$/, \"\")\n    .toLowerCase();\n  if (!repo?.includes(\"/\") || repo.split(\"/\").length !== 2) return undefined;\n  return { image: `ghcr.io/${repo}`, source: \"repository\" };\n}\n\nexport async function hasDocker(): Promise<boolean> {\n  try {\n    const result = await run(\"docker\", [\"info\", \"--format\", \"{{.ServerVersion}}\"], {\n      capture: true,\n    });\n    return result?.exitCode === 0;\n  } catch {\n    return false;\n  }\n}\n\nfunction parseDigest(pushOutput: string): string | undefined {\n  const match = pushOutput.match(/digest:\\s*(sha256:[a-f0-9]+)/i);\n  return match?.[1];\n}\n\nconst SEMVER_PATTERN = /^(\\d+)\\.(\\d+)\\.(\\d+)(?:-([0-9A-Za-z.-]+))?$/;\n\n/**\n * The runtime framework version baked into the image is the workspace source's\n * `everything-dev` package version — the image builds from `configDir`, so that\n * file is the truth. Missing (child repos without the workspace) → undefined.\n */\nfunction readFrameworkVersion(configDir: string): string | undefined {\n  try {\n    const raw = readFileSync(\n      join(configDir, \"packages\", \"everything-dev\", \"package.json\"),\n      \"utf-8\",\n    );\n    const pkg = JSON.parse(raw) as { version?: unknown };\n    return typeof pkg.version === \"string\" && SEMVER_PATTERN.test(pkg.version)\n      ? pkg.version\n      : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nexport interface ImageTags {\n  /** Exact refs to build and push, in push order (latest excluded). */\n  tags: string[];\n  /** Push `:latest` after the pinned tags. */\n  pushLatest: boolean;\n  /** Human-readable reason when `latest` is held. */\n  latestHoldReason?: string;\n}\n\n/**\n * Tag scheme (ADR 0021): `sha-<short>` always; the exact `v<version>` tag; a\n * floating major tag (`v2`) on stable releases only. `latest` is held during\n * prereleases (npm's `rc` dist-tag analog) so existing deployments pinned to\n * `:latest` keep serving the last stable image.\n */\nexport function computeImageTags(input: { shortSha: string; version?: string }): ImageTags {\n  const tags = [`sha-${input.shortSha}`];\n  const match = input.version?.trim().match(SEMVER_PATTERN);\n  if (!match) {\n    return { tags, pushLatest: true };\n  }\n  const [, major, minor, patch, prerelease] = match;\n  const exact = prerelease\n    ? `v${major}.${minor}.${patch}-${prerelease}`\n    : `v${major}.${minor}.${patch}`;\n  if (prerelease) {\n    return {\n      tags: [...tags, exact],\n      pushLatest: false,\n      latestHoldReason: `${exact} is a prerelease — :latest still serves the last stable image`,\n    };\n  }\n  return { tags: [...tags, exact, `v${major}`], pushLatest: true };\n}\n\nexport interface ImageDeployResult {\n  image: string;\n  /** Primary pinned tag (the sha tag). */\n  tag: string;\n  /** All tags pushed, including the primary. */\n  tags: string[];\n  latestPushed: boolean;\n  digest?: string;\n}\n\n/**\n * Image leg (ADR 0021): build the runtime stage, tag `sha-<short>` + version\n * tags, push them, capture the digest, and push `:latest` unless the version\n * is a prerelease. Callers skip the leg with a notice when no image is\n * configured (child repos get build+upload+publish only).\n */\nexport async function buildAndPushImage(input: {\n  image: string;\n  configDir: string;\n  verbose?: boolean;\n}): Promise<ImageDeployResult> {\n  const shaResult = await run(\"git\", [\"rev-parse\", \"--short=7\", \"HEAD\"], {\n    cwd: input.configDir,\n    capture: true,\n  });\n  const shortSha = shaResult?.stdout.trim();\n  if (!shaResult || shaResult.exitCode !== 0 || !shortSha) {\n    const detail = shaResult?.stderr.trim();\n    throw new Error(\n      `Failed to resolve the current git SHA in ${input.configDir} (exit code ${shaResult?.exitCode ?? \"unknown\"}${detail ? `: ${detail}` : \"\"})`,\n    );\n  }\n\n  const version = readFrameworkVersion(input.configDir);\n  const { tags, pushLatest, latestHoldReason } = computeImageTags({ shortSha, version });\n  const refs = tags.map((tag) => `${input.image}:${tag}`);\n  const latestRef = `${input.image}:latest`;\n  const buildRefs = pushLatest ? [...refs, latestRef] : refs;\n\n  console.log(\n    `  Building runtime image ${colors.cyan(buildRefs.join(\", \"))}${pushLatest ? \"\" : colors.yellow(\" (latest held)\")}`,\n  );\n  await run(\n    \"docker\",\n    [\"build\", \"--target\", \"runtime\", ...buildRefs.flatMap((ref) => [\"-t\", ref]), \".\"],\n    { cwd: input.configDir },\n  );\n\n  console.log(`  Pushing ${colors.cyan(refs.join(\", \"))}...`);\n  let digest: string | undefined;\n  for (const ref of refs) {\n    const push = await run(\"docker\", [\"push\", ref], {\n      cwd: input.configDir,\n      capture: true,\n    });\n    if (!push || push.exitCode !== 0) {\n      throw new Error(`docker push ${ref} failed with exit code ${push?.exitCode ?? \"unknown\"}`);\n    }\n    digest ??= parseDigest(push.stdout);\n    if (input.verbose && push.stdout.trim()) {\n      console.log(colors.dim(push.stdout.trim()));\n    }\n  }\n\n  let latestPushed = false;\n  if (pushLatest) {\n    const pushLatestRef = await run(\"docker\", [\"push\", latestRef], {\n      cwd: input.configDir,\n      capture: true,\n    });\n    if (!pushLatestRef || pushLatestRef.exitCode !== 0) {\n      throw new Error(\n        `docker push ${latestRef} failed with exit code ${pushLatestRef?.exitCode ?? \"unknown\"}`,\n      );\n    }\n    digest ??= parseDigest(pushLatestRef.stdout);\n    if (input.verbose && pushLatestRef.stdout.trim()) {\n      console.log(colors.dim(pushLatestRef.stdout.trim()));\n    }\n    latestPushed = true;\n  } else {\n    console.log(colors.yellow(`  latest held: ${latestHoldReason}`));\n  }\n\n  if (!digest) {\n    console.log(colors.yellow(\"  Could not capture the image digest from push output\"));\n  }\n\n  return { image: input.image, tag: tags[0], tags, latestPushed, digest };\n}\n\n/**\n * Railway leg (ADR 0021): pull-only deploy of the pushed image digest — a\n * thin `FROM image@digest` Dockerfile pins the digest so Railway never\n * rebuilds; `RAILWAY_DOCKERFILE_PATH` points at the generated file.\n */\nexport async function deployImageToRailway(input: {\n  image: string;\n  digest: string;\n  service: string;\n  configDir: string;\n}): Promise<void> {\n  const deployDir = join(input.configDir, \".bos\", \"deploy\");\n  mkdirSync(deployDir, { recursive: true });\n  const dockerfilePath = join(deployDir, \"Dockerfile\");\n  writeFileSync(dockerfilePath, `FROM ${input.image}@${input.digest}\\n`);\n\n  console.log(`  Deploying to Railway service ${colors.cyan(input.service)} (pull-only)...`);\n  const result = await run(\"railway\", [\"up\", \"--service\", input.service, \"--ci\"], {\n    cwd: input.configDir,\n    capture: true,\n    env: { RAILWAY_DOCKERFILE_PATH: \".bos/deploy/Dockerfile\" },\n  });\n  if (result?.stdout) {\n    for (const line of result.stdout.split(\"\\n\")) {\n      if (line.trim()) console.log(`  ${colors.dim(line.trim())}`);\n    }\n  }\n  if (!result || result.exitCode !== 0) {\n    throw new Error(\n      result?.stderr.trim()\n        ? `railway up failed: ${result.stderr.trim().split(\"\\n\").slice(-3).join(\" \")}`\n        : `railway up failed with exit code ${result?.exitCode ?? \"unknown\"}`,\n    );\n  }\n  console.log(colors.green(`  ${icons.ok} Railway deploy complete`));\n}\n"],"mappings":";;;;;;;;;;AAcA,SAAgB,gBAAgB,OAIC;CAC/B,MAAM,WAAW,MAAM,KAAK;CAC5B,IAAI,MAAM,SAAS,OAAO;EAAE,OAAO,MAAM;EAAS,QAAQ;CAAK;CAC/D,IAAI,UAAU,OAAO;EAAE,OAAO;EAAU,QAAQ;CAAM;CAEtD,MAAM,OAAO,MAAM,YACf,QAAQ,sCAAsC,EAAE,CAAC,CAClD,QAAQ,WAAW,EAAE,CAAC,CACtB,QAAQ,QAAQ,EAAE,CAAC,CACnB,YAAY;CACf,IAAI,CAAC,MAAM,SAAS,GAAG,KAAK,KAAK,MAAM,GAAG,CAAC,CAAC,WAAW,GAAG,OAAO;CACjE,OAAO;EAAE,OAAO,WAAW;EAAQ,QAAQ;CAAa;AAC1D;AAEA,eAAsB,YAA8B;CAClD,IAAI;EAIF,QAAO,MAHc,IAAI,UAAU;GAAC;GAAQ;GAAY;EAAoB,GAAG,EAC7E,SAAS,KACX,CAAC,EACY,EAAE,aAAa;CAC9B,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,YAAY,YAAwC;CAE3D,OADc,WAAW,MAAM,+BACpB,CAAC,GAAG;AACjB;AAEA,MAAM,iBAAiB;;;;;;AAOvB,SAAS,qBAAqB,WAAuC;CACnE,IAAI;EACF,MAAM,MAAM,aACV,KAAK,WAAW,YAAY,kBAAkB,cAAc,GAC5D,OACF;EACA,MAAM,MAAM,KAAK,MAAM,GAAG;EAC1B,OAAO,OAAO,IAAI,YAAY,YAAY,eAAe,KAAK,IAAI,OAAO,IACrE,IAAI,UACJ;CACN,QAAQ;EACN;CACF;AACF;;;;;;;AAiBA,SAAgB,iBAAiB,OAA0D;CACzF,MAAM,OAAO,CAAC,OAAO,MAAM,UAAU;CACrC,MAAM,QAAQ,MAAM,SAAS,KAAK,CAAC,CAAC,MAAM,cAAc;CACxD,IAAI,CAAC,OACH,OAAO;EAAE;EAAM,YAAY;CAAK;CAElC,MAAM,GAAG,OAAO,OAAO,OAAO,cAAc;CAC5C,MAAM,QAAQ,aACV,IAAI,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,eAC/B,IAAI,MAAM,GAAG,MAAM,GAAG;CAC1B,IAAI,YACF,OAAO;EACL,MAAM,CAAC,GAAG,MAAM,KAAK;EACrB,YAAY;EACZ,kBAAkB,GAAG,MAAM;CAC7B;CAEF,OAAO;EAAE,MAAM;GAAC,GAAG;GAAM;GAAO,IAAI;EAAO;EAAG,YAAY;CAAK;AACjE;;;;;;;AAkBA,eAAsB,kBAAkB,OAIT;CAC7B,MAAM,YAAY,MAAM,IAAI,OAAO;EAAC;EAAa;EAAa;CAAM,GAAG;EACrE,KAAK,MAAM;EACX,SAAS;CACX,CAAC;CACD,MAAM,WAAW,WAAW,OAAO,KAAK;CACxC,IAAI,CAAC,aAAa,UAAU,aAAa,KAAK,CAAC,UAAU;EACvD,MAAM,SAAS,WAAW,OAAO,KAAK;EACtC,MAAM,IAAI,MACR,4CAA4C,MAAM,UAAU,cAAc,WAAW,YAAY,YAAY,SAAS,KAAK,WAAW,GAAG,EAC3I;CACF;CAGA,MAAM,EAAE,MAAM,YAAY,qBAAqB,iBAAiB;EAAE;EAAU,SAD5D,qBAAqB,MAAM,SACuC;CAAE,CAAC;CACrF,MAAM,OAAO,KAAK,KAAK,QAAQ,GAAG,MAAM,MAAM,GAAG,KAAK;CACtD,MAAM,YAAY,GAAG,MAAM,MAAM;CACjC,MAAM,YAAY,aAAa,CAAC,GAAG,MAAM,SAAS,IAAI;CAEtD,QAAQ,IACN,4BAA4B,OAAO,KAAK,UAAU,KAAK,IAAI,CAAC,IAAI,aAAa,KAAK,OAAO,OAAO,gBAAgB,GAClH;CACA,MAAM,IACJ,UACA;EAAC;EAAS;EAAY;EAAW,GAAG,UAAU,SAAS,QAAQ,CAAC,MAAM,GAAG,CAAC;EAAG;CAAG,GAChF,EAAE,KAAK,MAAM,UAAU,CACzB;CAEA,QAAQ,IAAI,aAAa,OAAO,KAAK,KAAK,KAAK,IAAI,CAAC,EAAE,IAAI;CAC1D,IAAI;CACJ,KAAK,MAAM,OAAO,MAAM;EACtB,MAAM,OAAO,MAAM,IAAI,UAAU,CAAC,QAAQ,GAAG,GAAG;GAC9C,KAAK,MAAM;GACX,SAAS;EACX,CAAC;EACD,IAAI,CAAC,QAAQ,KAAK,aAAa,GAC7B,MAAM,IAAI,MAAM,eAAe,IAAI,yBAAyB,MAAM,YAAY,WAAW;EAE3F,WAAW,YAAY,KAAK,MAAM;EAClC,IAAI,MAAM,WAAW,KAAK,OAAO,KAAK,GACpC,QAAQ,IAAI,OAAO,IAAI,KAAK,OAAO,KAAK,CAAC,CAAC;CAE9C;CAEA,IAAI,eAAe;CACnB,IAAI,YAAY;EACd,MAAM,gBAAgB,MAAM,IAAI,UAAU,CAAC,QAAQ,SAAS,GAAG;GAC7D,KAAK,MAAM;GACX,SAAS;EACX,CAAC;EACD,IAAI,CAAC,iBAAiB,cAAc,aAAa,GAC/C,MAAM,IAAI,MACR,eAAe,UAAU,yBAAyB,eAAe,YAAY,WAC/E;EAEF,WAAW,YAAY,cAAc,MAAM;EAC3C,IAAI,MAAM,WAAW,cAAc,OAAO,KAAK,GAC7C,QAAQ,IAAI,OAAO,IAAI,cAAc,OAAO,KAAK,CAAC,CAAC;EAErD,eAAe;CACjB,OACE,QAAQ,IAAI,OAAO,OAAO,kBAAkB,kBAAkB,CAAC;CAGjE,IAAI,CAAC,QACH,QAAQ,IAAI,OAAO,OAAO,uDAAuD,CAAC;CAGpF,OAAO;EAAE,OAAO,MAAM;EAAO,KAAK,KAAK;EAAI;EAAM;EAAc;CAAO;AACxE;;;;;;AAOA,eAAsB,qBAAqB,OAKzB;CAChB,MAAM,YAAY,KAAK,MAAM,WAAW,QAAQ,QAAQ;CACxD,UAAU,WAAW,EAAE,WAAW,KAAK,CAAC;CACxC,MAAM,iBAAiB,KAAK,WAAW,YAAY;CACnD,cAAc,gBAAgB,QAAQ,MAAM,MAAM,GAAG,MAAM,OAAO,GAAG;CAErE,QAAQ,IAAI,kCAAkC,OAAO,KAAK,MAAM,OAAO,EAAE,gBAAgB;CACzF,MAAM,SAAS,MAAM,IAAI,WAAW;EAAC;EAAM;EAAa,MAAM;EAAS;CAAM,GAAG;EAC9E,KAAK,MAAM;EACX,SAAS;EACT,KAAK,EAAE,yBAAyB,yBAAyB;CAC3D,CAAC;CACD,IAAI,QAAQ,QACV;OAAK,MAAM,QAAQ,OAAO,OAAO,MAAM,IAAI,GACzC,IAAI,KAAK,KAAK,GAAG,QAAQ,IAAI,KAAK,OAAO,IAAI,KAAK,KAAK,CAAC,GAAG;CAC7D;CAEF,IAAI,CAAC,UAAU,OAAO,aAAa,GACjC,MAAM,IAAI,MACR,QAAQ,OAAO,KAAK,IAChB,sBAAsB,OAAO,OAAO,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,GAAG,MACzE,oCAAoC,QAAQ,YAAY,WAC9D;CAEF,QAAQ,IAAI,OAAO,MAAM,KAAK,MAAM,GAAG,yBAAyB,CAAC;AACnE"}
+{"version":3,"file":"image-deploy.mjs","names":[],"sources":["../src/image-deploy.ts"],"sourcesContent":["import { readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { run } from \"./utils/run\";\nimport { colors, icons } from \"./utils/theme\";\n\nexport interface ResolvedImageRef {\n  image: string;\n  source: \"ci\" | \"env\" | \"repository\";\n}\n\n/**\n * Image reference resolution precedence (ADR 0021): `ci.image` in\n * bos.config.json → `BOS_IMAGE` env → derived from `repository`.\n */\nexport function resolveImageRef(input: {\n  ciImage?: string;\n  repository?: string;\n  env?: Record<string, string | undefined>;\n}): ResolvedImageRef | undefined {\n  const envImage = input.env?.BOS_IMAGE;\n  if (input.ciImage) return { image: input.ciImage, source: \"ci\" };\n  if (envImage) return { image: envImage, source: \"env\" };\n\n  const repo = input.repository\n    ?.replace(/^https?:\\/\\/(www\\.)?github\\.com\\//i, \"\")\n    .replace(/\\.git$/i, \"\")\n    .replace(/\\/+$/, \"\")\n    .toLowerCase();\n  if (!repo?.includes(\"/\") || repo.split(\"/\").length !== 2) return undefined;\n  return { image: `ghcr.io/${repo}`, source: \"repository\" };\n}\n\nexport async function hasDocker(): Promise<boolean> {\n  try {\n    const result = await run(\"docker\", [\"info\", \"--format\", \"{{.ServerVersion}}\"], {\n      capture: true,\n    });\n    return result?.exitCode === 0;\n  } catch {\n    return false;\n  }\n}\n\nfunction parseDigest(pushOutput: string): string | undefined {\n  const match = pushOutput.match(/digest:\\s*(sha256:[a-f0-9]+)/i);\n  return match?.[1];\n}\n\nconst SEMVER_PATTERN = /^(\\d+)\\.(\\d+)\\.(\\d+)(?:-([0-9A-Za-z.-]+))?$/;\n\n/**\n * The runtime framework version baked into the image is the workspace source's\n * `everything-dev` package version — the image builds from `configDir`, so that\n * file is the truth. Missing (child repos without the workspace) → undefined.\n */\nfunction readFrameworkVersion(configDir: string): string | undefined {\n  try {\n    const raw = readFileSync(\n      join(configDir, \"packages\", \"everything-dev\", \"package.json\"),\n      \"utf-8\",\n    );\n    const pkg = JSON.parse(raw) as { version?: unknown };\n    return typeof pkg.version === \"string\" && SEMVER_PATTERN.test(pkg.version)\n      ? pkg.version\n      : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nexport interface ImageTags {\n  /** Exact refs to build and push, in push order (latest excluded). */\n  tags: string[];\n  /** Push `:latest` after the pinned tags. */\n  pushLatest: boolean;\n  /** Human-readable reason when `latest` is held. */\n  latestHoldReason?: string;\n  /** Push `:rc` after the pinned tags — the floating prerelease-train ref. */\n  pushRc: boolean;\n}\n\n/**\n * Tag scheme (ADR 0021): `sha-<short>` always; the exact `v<version>` tag; a\n * floating major tag (`v2`) on stable releases only. `latest` is held during\n * prereleases (npm's `rc` dist-tag analog) so existing deployments pinned to\n * `:latest` keep serving the last stable image — and `:rc` is the floating\n * ref for the prerelease train (npm's `rc` dist-tag mirror): it moves on\n * every prerelease deploy and freezes at the last rc-train build once the\n * workspace releases a stable version.\n */\nexport function computeImageTags(input: { shortSha: string; version?: string }): ImageTags {\n  const tags = [`sha-${input.shortSha}`];\n  const match = input.version?.trim().match(SEMVER_PATTERN);\n  if (!match) {\n    return { tags, pushLatest: true, pushRc: false };\n  }\n  const [, major, minor, patch, prerelease] = match;\n  const exact = prerelease\n    ? `v${major}.${minor}.${patch}-${prerelease}`\n    : `v${major}.${minor}.${patch}`;\n  if (prerelease) {\n    return {\n      tags: [...tags, exact],\n      pushLatest: false,\n      latestHoldReason: `${exact} is a prerelease — :latest still serves the last stable image`,\n      pushRc: true,\n    };\n  }\n  return { tags: [...tags, exact, `v${major}`], pushLatest: true, pushRc: false };\n}\n\nexport interface ImageDeployResult {\n  image: string;\n  /** Primary pinned tag (the sha tag). */\n  tag: string;\n  /** All tags pushed, including the primary. */\n  tags: string[];\n  latestPushed: boolean;\n  /** Whether the floating `:rc` prerelease-train ref was pushed. */\n  rcPushed: boolean;\n  digest?: string;\n}\n\nexport type DeployImagePlan =\n  | { kind: \"prebuilt\"; image: string; digest: string }\n  | { kind: \"build\"; image: string }\n  | { kind: \"skip\"; reason: string };\n\nconst DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/;\n\n/** A Railway pin is `FROM image@<digest>` — anything else cannot resolve. */\nexport function isValidImageDigest(digest: string): boolean {\n  return DIGEST_PATTERN.test(digest);\n}\n\n/**\n * Decide the image leg's source: a digest handed over from a pre-pushed image\n * (the CI image job) wins; otherwise the local docker build runs when the\n * toolchain and Dockerfile are present (ADR 0021, as amended).\n */\nexport function resolveDeployImagePlan(input: {\n  imageRef: ResolvedImageRef | undefined;\n  imageDigest?: string;\n  hasDocker: boolean;\n  hasDockerfile: boolean;\n}): DeployImagePlan {\n  if (!input.imageRef) {\n    return {\n      kind: \"skip\",\n      reason: \"set ci.image in bos.config.json (or BOS_IMAGE) to build and push the runtime image\",\n    };\n  }\n  if (input.imageDigest) {\n    return { kind: \"prebuilt\", image: input.imageRef.image, digest: input.imageDigest };\n  }\n  if (!input.hasDocker) {\n    return { kind: \"skip\", reason: \"docker is not available\" };\n  }\n  if (!input.hasDockerfile) {\n    return { kind: \"skip\", reason: \"no Dockerfile at the config root\" };\n  }\n  return { kind: \"build\", image: input.imageRef.image };\n}\n\n/**\n * Image leg (ADR 0021): build the runtime stage, tag `sha-<short>` + version\n * tags, push them, capture the digest, then push the floating refs — `:latest`\n * unless the version is a prerelease, and `:rc` when it is. Callers skip the\n * leg with a notice when no image is configured (child repos get\n * build+upload+publish only).\n */\nexport async function buildAndPushImage(input: {\n  image: string;\n  configDir: string;\n  verbose?: boolean;\n}): Promise<ImageDeployResult> {\n  const shaResult = await run(\"git\", [\"rev-parse\", \"--short=7\", \"HEAD\"], {\n    cwd: input.configDir,\n    capture: true,\n  });\n  const shortSha = shaResult?.stdout.trim();\n  if (!shaResult || shaResult.exitCode !== 0 || !shortSha) {\n    const detail = shaResult?.stderr.trim();\n    throw new Error(\n      `Failed to resolve the current git SHA in ${input.configDir} (exit code ${shaResult?.exitCode ?? \"unknown\"}${detail ? `: ${detail}` : \"\"})`,\n    );\n  }\n\n  const version = readFrameworkVersion(input.configDir);\n  const { tags, pushLatest, latestHoldReason, pushRc } = computeImageTags({\n    shortSha,\n    version,\n  });\n  const refs = tags.map((tag) => `${input.image}:${tag}`);\n  const latestRef = `${input.image}:latest`;\n  const rcRef = `${input.image}:rc`;\n  const buildRefs = pushLatest ? [...refs, latestRef] : [...refs];\n  if (pushRc) buildRefs.push(rcRef);\n\n  console.log(\n    `  Building runtime image ${colors.cyan(buildRefs.join(\", \"))}${pushLatest ? \"\" : colors.yellow(\" (latest held)\")}`,\n  );\n  await run(\n    \"docker\",\n    [\"build\", \"--target\", \"runtime\", ...buildRefs.flatMap((ref) => [\"-t\", ref]), \".\"],\n    { cwd: input.configDir },\n  );\n\n  console.log(`  Pushing ${colors.cyan(refs.join(\", \"))}...`);\n  let digest: string | undefined;\n  for (const ref of refs) {\n    const push = await run(\"docker\", [\"push\", ref], {\n      cwd: input.configDir,\n      capture: true,\n    });\n    if (!push || push.exitCode !== 0) {\n      throw new Error(`docker push ${ref} failed with exit code ${push?.exitCode ?? \"unknown\"}`);\n    }\n    digest ??= parseDigest(push.stdout);\n    if (input.verbose && push.stdout.trim()) {\n      console.log(colors.dim(push.stdout.trim()));\n    }\n  }\n\n  const pushFloating = async (ref: string): Promise<boolean> => {\n    const push = await run(\"docker\", [\"push\", ref], {\n      cwd: input.configDir,\n      capture: true,\n    });\n    if (!push || push.exitCode !== 0) {\n      throw new Error(`docker push ${ref} failed with exit code ${push?.exitCode ?? \"unknown\"}`);\n    }\n    digest ??= parseDigest(push.stdout);\n    if (input.verbose && push.stdout.trim()) {\n      console.log(colors.dim(push.stdout.trim()));\n    }\n    return true;\n  };\n\n  let latestPushed = false;\n  if (pushLatest) {\n    latestPushed = await pushFloating(latestRef);\n  } else {\n    console.log(colors.yellow(`  latest held: ${latestHoldReason}`));\n  }\n  const rcPushed = pushRc ? await pushFloating(rcRef) : false;\n\n  if (!digest) {\n    console.log(colors.yellow(\"  Could not capture the image digest from push output\"));\n  }\n\n  return { image: input.image, tag: tags[0]!, tags, latestPushed, rcPushed, digest };\n}\n\n/**\n * Railway leg (ADR 0021, amended): image-backed deploy. The service's source\n * is a Docker image ref (connected once in the dashboard — `:rc` during the\n * prerelease train), and `redeploy --from-source` pulls and deploys whatever\n * that ref points at. The image leg pushes `:rc` (and the `sha-<short>` /\n * version tags) immediately before this step, so the pulled bytes are exactly\n * what this train validated. Railway skips the build entirely for\n * Docker-image sources — nothing is uploaded, nothing is built on Railway,\n * and the digest-pin Dockerfile mechanism this replaces is gone (the CLI v5\n * dropped RAILWAY_DOCKERFILE_PATH, its snapshot respects .gitignore so\n * generated Dockerfiles never shipped, and its Metal builder rejected the\n * repo Dockerfile's cache-mount ids).\n */\nexport async function deployImageToRailway(input: {\n  service: string;\n  configDir: string;\n}): Promise<void> {\n  console.log(`  Deploying to Railway service ${colors.cyan(input.service)} (image-backed)...`);\n  // The probe is authoritative: runners don't ship the CLI, and a spawn\n  // failure resolves (reject:false) as exitCode 1 with empty output — the\n  // 2026-10-13 deploy surfaced exactly that as a silent instant failure.\n  let version: string | undefined;\n  try {\n    version = (await run(\"railway\", [\"--version\"], { cwd: input.configDir, capture: true }))\n      ?.stdout;\n  } catch {\n    version = undefined;\n  }\n  if (!version?.trim()) {\n    throw new Error(\"Railway CLI not found. Install it: npm i -g @railway/cli\");\n  }\n  console.log(`  ${colors.dim(`railway ${version.trim()}`)}`);\n\n  // Stream the CLI's output live — a silent exit (empty stdout+stderr, seen\n  // on the 2026-10-13 deploy) must still be diagnosable from the workflow log.\n  const collected = { stdout: \"\", stderr: \"\" };\n  const result = await run(\n    \"railway\",\n    [\"redeploy\", \"--service\", input.service, \"--from-source\", \"--yes\"],\n    {\n      cwd: input.configDir,\n      capture: true,\n      onChunk: (stream, chunk) => {\n        collected[stream] += chunk.toString(\"utf-8\");\n        for (const line of chunk.toString(\"utf-8\").split(\"\\n\")) {\n          if (line.trim()) console.log(`  ${colors.dim(line.trim())}`);\n        }\n      },\n    },\n  );\n  if (!result || result.exitCode !== 0) {\n    const exitCode = result?.exitCode ?? \"unknown\";\n    const tail = (stream: string, text: string) =>\n      text.trim()\n        ? `\\nrailway ${stream} (tail):\\n${text.trim().split(\"\\n\").slice(-20).join(\"\\n\")}`\n        : \"\";\n    throw new Error(\n      `railway redeploy failed with exit code ${exitCode}` +\n        tail(\"stdout\", collected.stdout) +\n        tail(\"stderr\", collected.stderr),\n    );\n  }\n  console.log(colors.green(`  ${icons.ok} Railway deploy complete`));\n}\n"],"mappings":";;;;;;;;;;AAcA,SAAgB,gBAAgB,OAIC;CAC/B,MAAM,WAAW,MAAM,KAAK;CAC5B,IAAI,MAAM,SAAS,OAAO;EAAE,OAAO,MAAM;EAAS,QAAQ;CAAK;CAC/D,IAAI,UAAU,OAAO;EAAE,OAAO;EAAU,QAAQ;CAAM;CAEtD,MAAM,OAAO,MAAM,YACf,QAAQ,sCAAsC,EAAE,CAAC,CAClD,QAAQ,WAAW,EAAE,CAAC,CACtB,QAAQ,QAAQ,EAAE,CAAC,CACnB,YAAY;CACf,IAAI,CAAC,MAAM,SAAS,GAAG,KAAK,KAAK,MAAM,GAAG,CAAC,CAAC,WAAW,GAAG,OAAO;CACjE,OAAO;EAAE,OAAO,WAAW;EAAQ,QAAQ;CAAa;AAC1D;AAEA,eAAsB,YAA8B;CAClD,IAAI;EAIF,QAAO,MAHc,IAAI,UAAU;GAAC;GAAQ;GAAY;EAAoB,GAAG,EAC7E,SAAS,KACX,CAAC,EACY,EAAE,aAAa;CAC9B,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,YAAY,YAAwC;CAE3D,OADc,WAAW,MAAM,+BACpB,CAAC,GAAG;AACjB;AAEA,MAAM,iBAAiB;;;;;;AAOvB,SAAS,qBAAqB,WAAuC;CACnE,IAAI;EACF,MAAM,MAAM,aACV,KAAK,WAAW,YAAY,kBAAkB,cAAc,GAC5D,OACF;EACA,MAAM,MAAM,KAAK,MAAM,GAAG;EAC1B,OAAO,OAAO,IAAI,YAAY,YAAY,eAAe,KAAK,IAAI,OAAO,IACrE,IAAI,UACJ;CACN,QAAQ;EACN;CACF;AACF;;;;;;;;;;AAsBA,SAAgB,iBAAiB,OAA0D;CACzF,MAAM,OAAO,CAAC,OAAO,MAAM,UAAU;CACrC,MAAM,QAAQ,MAAM,SAAS,KAAK,CAAC,CAAC,MAAM,cAAc;CACxD,IAAI,CAAC,OACH,OAAO;EAAE;EAAM,YAAY;EAAM,QAAQ;CAAM;CAEjD,MAAM,GAAG,OAAO,OAAO,OAAO,cAAc;CAC5C,MAAM,QAAQ,aACV,IAAI,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,eAC/B,IAAI,MAAM,GAAG,MAAM,GAAG;CAC1B,IAAI,YACF,OAAO;EACL,MAAM,CAAC,GAAG,MAAM,KAAK;EACrB,YAAY;EACZ,kBAAkB,GAAG,MAAM;EAC3B,QAAQ;CACV;CAEF,OAAO;EAAE,MAAM;GAAC,GAAG;GAAM;GAAO,IAAI;EAAO;EAAG,YAAY;EAAM,QAAQ;CAAM;AAChF;AAmBA,MAAM,iBAAiB;;AAGvB,SAAgB,mBAAmB,QAAyB;CAC1D,OAAO,eAAe,KAAK,MAAM;AACnC;;;;;;AAOA,SAAgB,uBAAuB,OAKnB;CAClB,IAAI,CAAC,MAAM,UACT,OAAO;EACL,MAAM;EACN,QAAQ;CACV;CAEF,IAAI,MAAM,aACR,OAAO;EAAE,MAAM;EAAY,OAAO,MAAM,SAAS;EAAO,QAAQ,MAAM;CAAY;CAEpF,IAAI,CAAC,MAAM,WACT,OAAO;EAAE,MAAM;EAAQ,QAAQ;CAA0B;CAE3D,IAAI,CAAC,MAAM,eACT,OAAO;EAAE,MAAM;EAAQ,QAAQ;CAAmC;CAEpE,OAAO;EAAE,MAAM;EAAS,OAAO,MAAM,SAAS;CAAM;AACtD;;;;;;;;AASA,eAAsB,kBAAkB,OAIT;CAC7B,MAAM,YAAY,MAAM,IAAI,OAAO;EAAC;EAAa;EAAa;CAAM,GAAG;EACrE,KAAK,MAAM;EACX,SAAS;CACX,CAAC;CACD,MAAM,WAAW,WAAW,OAAO,KAAK;CACxC,IAAI,CAAC,aAAa,UAAU,aAAa,KAAK,CAAC,UAAU;EACvD,MAAM,SAAS,WAAW,OAAO,KAAK;EACtC,MAAM,IAAI,MACR,4CAA4C,MAAM,UAAU,cAAc,WAAW,YAAY,YAAY,SAAS,KAAK,WAAW,GAAG,EAC3I;CACF;CAGA,MAAM,EAAE,MAAM,YAAY,kBAAkB,WAAW,iBAAiB;EACtE;EACA,SAHc,qBAAqB,MAAM,SAGnC;CACR,CAAC;CACD,MAAM,OAAO,KAAK,KAAK,QAAQ,GAAG,MAAM,MAAM,GAAG,KAAK;CACtD,MAAM,YAAY,GAAG,MAAM,MAAM;CACjC,MAAM,QAAQ,GAAG,MAAM,MAAM;CAC7B,MAAM,YAAY,aAAa,CAAC,GAAG,MAAM,SAAS,IAAI,CAAC,GAAG,IAAI;CAC9D,IAAI,QAAQ,UAAU,KAAK,KAAK;CAEhC,QAAQ,IACN,4BAA4B,OAAO,KAAK,UAAU,KAAK,IAAI,CAAC,IAAI,aAAa,KAAK,OAAO,OAAO,gBAAgB,GAClH;CACA,MAAM,IACJ,UACA;EAAC;EAAS;EAAY;EAAW,GAAG,UAAU,SAAS,QAAQ,CAAC,MAAM,GAAG,CAAC;EAAG;CAAG,GAChF,EAAE,KAAK,MAAM,UAAU,CACzB;CAEA,QAAQ,IAAI,aAAa,OAAO,KAAK,KAAK,KAAK,IAAI,CAAC,EAAE,IAAI;CAC1D,IAAI;CACJ,KAAK,MAAM,OAAO,MAAM;EACtB,MAAM,OAAO,MAAM,IAAI,UAAU,CAAC,QAAQ,GAAG,GAAG;GAC9C,KAAK,MAAM;GACX,SAAS;EACX,CAAC;EACD,IAAI,CAAC,QAAQ,KAAK,aAAa,GAC7B,MAAM,IAAI,MAAM,eAAe,IAAI,yBAAyB,MAAM,YAAY,WAAW;EAE3F,WAAW,YAAY,KAAK,MAAM;EAClC,IAAI,MAAM,WAAW,KAAK,OAAO,KAAK,GACpC,QAAQ,IAAI,OAAO,IAAI,KAAK,OAAO,KAAK,CAAC,CAAC;CAE9C;CAEA,MAAM,eAAe,OAAO,QAAkC;EAC5D,MAAM,OAAO,MAAM,IAAI,UAAU,CAAC,QAAQ,GAAG,GAAG;GAC9C,KAAK,MAAM;GACX,SAAS;EACX,CAAC;EACD,IAAI,CAAC,QAAQ,KAAK,aAAa,GAC7B,MAAM,IAAI,MAAM,eAAe,IAAI,yBAAyB,MAAM,YAAY,WAAW;EAE3F,WAAW,YAAY,KAAK,MAAM;EAClC,IAAI,MAAM,WAAW,KAAK,OAAO,KAAK,GACpC,QAAQ,IAAI,OAAO,IAAI,KAAK,OAAO,KAAK,CAAC,CAAC;EAE5C,OAAO;CACT;CAEA,IAAI,eAAe;CACnB,IAAI,YACF,eAAe,MAAM,aAAa,SAAS;MAE3C,QAAQ,IAAI,OAAO,OAAO,kBAAkB,kBAAkB,CAAC;CAEjE,MAAM,WAAW,SAAS,MAAM,aAAa,KAAK,IAAI;CAEtD,IAAI,CAAC,QACH,QAAQ,IAAI,OAAO,OAAO,uDAAuD,CAAC;CAGpF,OAAO;EAAE,OAAO,MAAM;EAAO,KAAK,KAAK;EAAK;EAAM;EAAc;EAAU;CAAO;AACnF;;;;;;;;;;;;;;AAeA,eAAsB,qBAAqB,OAGzB;CAChB,QAAQ,IAAI,kCAAkC,OAAO,KAAK,MAAM,OAAO,EAAE,mBAAmB;CAI5F,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,IAAI,WAAW,CAAC,WAAW,GAAG;GAAE,KAAK,MAAM;GAAW,SAAS;EAAK,CAAC,EAAC,EACnF;CACN,QAAQ;EACN,UAAU;CACZ;CACA,IAAI,CAAC,SAAS,KAAK,GACjB,MAAM,IAAI,MAAM,0DAA0D;CAE5E,QAAQ,IAAI,KAAK,OAAO,IAAI,WAAW,QAAQ,KAAK,GAAG,GAAG;CAI1D,MAAM,YAAY;EAAE,QAAQ;EAAI,QAAQ;CAAG;CAC3C,MAAM,SAAS,MAAM,IACnB,WACA;EAAC;EAAY;EAAa,MAAM;EAAS;EAAiB;CAAO,GACjE;EACE,KAAK,MAAM;EACX,SAAS;EACT,UAAU,QAAQ,UAAU;GAC1B,UAAU,WAAW,MAAM,SAAS,OAAO;GAC3C,KAAK,MAAM,QAAQ,MAAM,SAAS,OAAO,CAAC,CAAC,MAAM,IAAI,GACnD,IAAI,KAAK,KAAK,GAAG,QAAQ,IAAI,KAAK,OAAO,IAAI,KAAK,KAAK,CAAC,GAAG;EAE/D;CACF,CACF;CACA,IAAI,CAAC,UAAU,OAAO,aAAa,GAAG;EACpC,MAAM,WAAW,QAAQ,YAAY;EACrC,MAAM,QAAQ,QAAgB,SAC5B,KAAK,KAAK,IACN,aAAa,OAAO,YAAY,KAAK,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI,MAC5E;EACN,MAAM,IAAI,MACR,0CAA0C,aACxC,KAAK,UAAU,UAAU,MAAM,IAC/B,KAAK,UAAU,UAAU,MAAM,CACnC;CACF;CACA,QAAQ,IAAI,OAAO,MAAM,KAAK,MAAM,GAAG,yBAAyB,CAAC;AACnE"}