hammerkit 1.22.0 → 1.24.0

package/build.schema.json

@@ -204,7 +204,10 @@
                       "properties": {
                         "from": {
                           "type": "string",
-                          "pattern": "^(env|file):.+$"
+                          "pattern": "^[A-Za-z][A-Za-z0-9_-]*:.+$"
+                        },
+                        "account": {
+                          "type": "string"
                         },
                         "env": {
                           "type": "string",
@@ -221,9 +224,12 @@
                         "from"
                       ],
                       "additionalProperties": false,
-                      "description": "secret from env:NAME or file:path, injected as env or a read-only file"
+                      "description": "secret from env:NAME, file:path or <provider>:<ref>, injected as env or a read-only file"
                     }
                   },
+                  "account": {
+                    "type": "string"
+                  },
                   "resources": {
                     "type": "object",
                     "properties": {
@@ -255,6 +261,10 @@
                     "additionalProperties": false,
                     "description": "cpu and memory requests and limits"
                   },
+                  "runner": {
+                    "type": "string",
+                    "minLength": 1
+                  },
                   "image": {
                     "type": "string"
                   },
@@ -319,9 +329,15 @@
                   "secrets": {
                     "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/secrets"
                   },
+                  "account": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/account"
+                  },
                   "resources": {
                     "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/resources"
                   },
+                  "runner": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/runner"
+                  },
                   "platform": {
                     "type": "object",
                     "properties": {
@@ -446,6 +462,9 @@
                       "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/secrets/items"
                     }
                   },
+                  "account": {
+                    "type": "string"
+                  },
                   "resources": {
                     "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/resources",
                     "description": "cpu and memory requests and limits"
@@ -748,8 +767,79 @@
             "additionalProperties": false
           }
         },
+        "secretProviders": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "object",
+            "properties": {
+              "command": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                },
+                "minItems": 1,
+                "description": "command and arguments, no shell; {{ref}} is replaced by the secret reference"
+              },
+              "env": {
+                "type": "object",
+                "additionalProperties": {
+                  "type": "string"
+                },
+                "description": "static environment of the command, next to PATH and the account env"
+              },
+              "timeout": {
+                "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/timeout",
+                "description": "how long the command may run, 30s when omitted"
+              }
+            },
+            "required": [
+              "command"
+            ],
+            "additionalProperties": false,
+            "description": "secret provider, a command that prints the secret to stdout"
+          }
+        },
+        "secretAccounts": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "object",
+            "properties": {
+              "default": {
+                "type": "boolean",
+                "description": "the account for secrets and tasks that name none"
+              },
+              "providers": {
+                "type": "object",
+                "additionalProperties": {
+                  "type": "object",
+                  "properties": {
+                    "env": {
+                      "type": "object",
+                      "additionalProperties": {
+                        "type": "string"
+                      }
+                    }
+                  },
+                  "required": [
+                    "env"
+                  ],
+                  "additionalProperties": false
+                },
+                "description": "per provider, the environment that makes its command act as this account"
+              }
+            },
+            "required": [
+              "providers"
+            ],
+            "additionalProperties": false,
+            "description": "service account the secret providers are read as"
+          }
+        },
         "labels": {
           "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/labels"
+        },
+        "runner": {
+          "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/runner"
         }
       },
       "additionalProperties": false,

package/dist/cli.js

@@ -13,6 +13,7 @@ const check_for_loop_1 = require("./executer/scheduler/check-for-loop");
 const state_1 = require("./executer/state");
 const get_scheduler_execute_result_1 = require("./executer/get-scheduler-execute-result");
 const reset_work_tree_1 = require("./executer/reset-work-tree");
+const location_1 = require("./remote/location");
 const execute_work_tree_1 = require("./executer/execute-work-tree");
 const package_1 = require("./docker/package");
 const explain_1 = require("./cache/explain");
@@ -21,6 +22,7 @@ const work_graph_serializer_1 = require("./planner/work-graph-serializer");
 const dry_run_1 = require("./executer/dry-run");
 const cache_sync_1 = require("./cache/cache-sync");
 const cache_inventory_1 = require("./cache/cache-inventory");
+const prefetch_secrets_1 = require("./secrets/prefetch-secrets");
 const isCliTask = (val) => val.type === 'task';
 exports.isCliTask = isCliTask;
 const isCliService = (val) => val.type === 'service';
@@ -30,6 +32,11 @@ class Cli {
         this.workTree = workTree;
         this.environment = environment;
     }
+    // Starts the run's secrets: the values that make up a task id are fetched
+    // before anything asks for an id, see prefetchSecrets.
+    async prepareSecrets(newRun = false) {
+        await (0, prefetch_secrets_1.prefetchSecrets)(this.workTree, this.environment, newRun);
+    }
     setup(type, options) {
         const logMode = options?.logMode ?? (ci_1.isCI ? 'live' : 'interactive');
         const workTree = (0, reset_work_tree_1.resetWorkTree)(this.workTree, type);
@@ -43,7 +50,15 @@ class Cli {
         return {
             state: processWorkTree,
             start: async () => {
+                if (type !== 'down') {
+                    await this.prepareSecrets(true);
+                }
                 (0, check_for_loop_1.checkForLoop)(workTree);
+                const location = await (0, location_1.resolveRunLocation)(workTree, this.environment);
+                if (location.type === 'server') {
+                    throw new Error(`this run is meant for server ${location.name}, but running on a server is not available yet. ` +
+                        'Remove the runner, or run locally with: hammerkit remote use local');
+                }
                 const capacity = (0, plan_work_tasks_1.hasError)(workTree) ? null : await (0, resource_budget_1.getResourceCapacity)(workTree, this.environment);
                 if (capacity && type !== 'down' && (options?.resourceCheck ?? true)) {
                     rejectOversizedWork(workTree, capacity, type === 'up');
@@ -100,15 +115,19 @@ class Cli {
         return await run.start();
     }
     async clean(options) {
+        await this.prepareSecrets();
         await (0, event_cache_1.cleanCache)(this.workTree, this.environment, options);
     }
     async restore(path) {
+        await this.prepareSecrets();
         await (0, event_cache_1.restoreCache)(this.environment, path, this.workTree);
     }
     async package(options) {
+        await this.prepareSecrets();
         await (0, package_1.packageWorkTree)(this.workTree, this.environment, options);
     }
     async store(path) {
+        await this.prepareSecrets();
         await (0, event_cache_1.storeCache)(this.environment, path, this.workTree);
     }
     services() {
@@ -132,6 +151,7 @@ class Cli {
         return [...(0, plan_work_tasks_1.iterateWorkTasks)(this.workTree)].map((task) => (0, describe_task_1.describeTask)(task, this.environment.cwd));
     }
     async explain(options) {
+        await this.prepareSecrets();
         return (0, explain_1.explainWorkTree)(this.workTree, options?.cacheDefault ?? 'checksum', this.environment);
     }
     // Serialize the in-scope work graph for rendering (mermaid/dot). Pure read of
@@ -142,25 +162,30 @@ class Cli {
     // Ordered execution plan with predicted cache decisions, reusing the explain
     // engine — executes nothing, starts nothing, performs no cache push/pull.
     async dryRun(options) {
+        await this.prepareSecrets();
         return (0, dry_run_1.planDryRun)(this.workTree, options?.cacheDefault ?? 'checksum', this.environment);
     }
     // Move cache entries between the tasks' own caches and a named remote without
     // executing anything (`cache pull` / `cache push`).
     async syncCache(options) {
+        await this.prepareSecrets();
         return (0, cache_sync_1.syncCache)(this.workTree, options, this.environment);
     }
     // Entries of a named cache (default: the local `default` cache).
     async listCache(cacheName) {
+        await this.prepareSecrets();
         return (0, cache_inventory_1.listCache)(this.workTree, cacheName, this.environment);
     }
     retentionPolicy(cacheName, overrides) {
         return (0, cache_inventory_1.retentionPolicyOf)(this.workTree, cacheName, overrides);
     }
     async pruneCache(cacheName, policy, dryRun = false) {
+        await this.prepareSecrets();
         return (0, cache_inventory_1.pruneCache)(this.workTree, cacheName, policy, { dryRun }, this.environment);
     }
     // Apply declared retention to the local caches this build file uses.
     async autoPrune() {
+        await this.prepareSecrets();
         return (0, cache_inventory_1.autoPrune)(this.workTree, this.environment);
     }
     task(name) {

package/dist/executer/environment-mock.js

@@ -5,14 +5,17 @@ const work_item_status_1 = require("../planner/work-item-status");
 const get_file_context_1 = require("../file/get-file-context");
 const log_1 = require("../log");
 const empty_writable_1 = require("../utils/empty-writable");
+const redact_1 = require("../utils/redact");
 function environmentMock(cwd) {
+    const secrets = (0, redact_1.createSecretRegistry)();
     return {
         cwd,
         file: (0, get_file_context_1.getFileContext)(cwd),
         console: (0, log_1.consoleContext)((0, empty_writable_1.emptyWritable)()),
         abortCtrl: new AbortController(),
         processEnvs: {},
-        status: (0, work_item_status_1.statusConsole)((0, empty_writable_1.emptyWritable)()),
+        status: (0, work_item_status_1.statusConsole)((0, empty_writable_1.emptyWritable)(), secrets),
+        secrets,
         stdout: (0, empty_writable_1.emptyWritable)(),
         stderr: (0, empty_writable_1.emptyWritable)(),
         stdoutColumns: 80,

package/dist/executer/execute-command.js

@@ -12,11 +12,17 @@ const environment_config_1 = require("../utils/environment-config");
 function getStopTimeout() {
     return (0, environment_config_1.getEnvironmentConfig)('HAMMERKIT_STOP_TIMEOUT_MS', 10000);
 }
+// powershell takes about half a minute to start when it has to work out its module
+// path itself, so the one of the process is passed on
+function shellEnvs(windows, environment) {
+    const value = environment.processEnvs['PSModulePath'];
+    return windows && value !== undefined ? { PSModulePath: value } : {};
+}
 async function executeCommand(status, abortSignal, cwd, command, envs, environment) {
     const windows = (0, os_1.platform)() === 'win32';
     return new Promise((resolve, reject) => {
         const ps = (0, child_process_1.spawn)(command, {
-            env: { ...envs, PATH: environment.processEnvs['PATH'] },
+            env: { ...envs, ...shellEnvs(windows, environment), PATH: environment.processEnvs['PATH'] },
             cwd,
             shell: windows ? 'powershell.exe' : true,
             // its own process group, so an abort reaches every process the command

package/dist/index.js

@@ -4,6 +4,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const log_1 = require("./log");
 const get_file_context_1 = require("./file/get-file-context");
 const work_item_status_1 = require("./planner/work-item-status");
+const redact_1 = require("./utils/redact");
 const empty_writable_1 = require("./utils/empty-writable");
 const run_program_1 = require("./run-program");
 const abort_on_signals_1 = require("./utils/abort-on-signals");
@@ -19,13 +20,15 @@ process.on('beforeExit', () => {
         process.exitCode = 1;
     }
 });
+const secrets = (0, redact_1.createSecretRegistry)();
 (0, run_program_1.runProgram)({
     cwd: process.cwd(),
     abortCtrl,
     processEnvs: process.env,
     file: (0, get_file_context_1.getFileContext)(process.cwd()),
     console: (0, log_1.consoleContext)(process.stdout),
-    status: (0, work_item_status_1.statusConsole)((0, empty_writable_1.emptyWritable)()),
+    status: (0, work_item_status_1.statusConsole)((0, empty_writable_1.emptyWritable)(), secrets),
+    secrets,
     stdout: process.stdout,
     stderr: process.stderr,
     stdoutColumns: process.stdout.columns,

package/dist/planner/service-definition.js

@@ -26,7 +26,9 @@ function getServiceDefinitionHash(item) {
         src: service.src.map((s) => s.absolutePath),
         healthcheck: service.healthcheck?.cmd.cmd ?? null,
         // where secrets go, never their values: a rotated value needs a `down`
-        secrets: service.secrets.map((s) => `${s.source.type}:${(0, work_secret_1.getSecretName)(s)}`),
+        secrets: service.secrets.map((s) => s.source.type === 'provider'
+            ? `provider:${(0, work_secret_1.getSecretName)(s)}:${(0, work_secret_1.describeSecretSource)(s)}`
+            : `${s.source.type}:${(0, work_secret_1.getSecretName)(s)}`),
         // the init task's id covers its image, commands, envs and mounts: a changed
         // init recreates the service, so it runs again
         init: service.init ? service.init.task.id() : null,

package/dist/planner/utils/append-work-service.js

@@ -114,7 +114,7 @@ function parseService(workTree, service, environment, context) {
             caching,
             // set once the service is planned, see appendServiceInit
             init: null,
-            secrets: (0, work_secret_1.parseWorkSecrets)(service.cwd, context.projectRoot, service.schema.secrets, envs, environment),
+            secrets: (0, work_secret_1.parseWorkSecrets)(service.cwd, context.projectRoot, service.schema.secrets, envs, environment, context.secrets, service.schema.account),
             resources: (0, work_resources_1.parseWorkResources)(service.schema.resources),
         };
     }

package/dist/planner/utils/append-work-task.js

@@ -70,8 +70,9 @@ function parseTask(cwd, task, environment, context) {
         shell: task.schema.shell ? (0, template_value_1.templateValue)(task.schema.shell, envs) : '/bin/sh',
         continuous: task.schema.continuous ?? false,
         timeout: task.schema.timeout ? (0, units_1.parseDuration)(task.schema.timeout) : null,
-        secrets: (0, work_secret_1.parseWorkSecrets)(cwd, context.projectRoot, task.schema.secrets, envs, environment),
+        secrets: (0, work_secret_1.parseWorkSecrets)(cwd, context.projectRoot, task.schema.secrets, envs, environment, context.secrets, task.schema.account),
         resources: (0, work_resources_1.parseWorkResources)(task.schema.resources),
+        runner: task.schema.runner ?? task.scope.schema.runner ?? null,
     };
     if ((0, build_file_task_schema_1.isBuildFileContainerTaskSchema)(task.schema)) {
         return {

package/dist/planner/work-item-status.js

@@ -15,12 +15,13 @@ function logContext(type, item) {
     };
 }
 exports.logContext = logContext;
-function statusConsole(writable) {
+// `secrets` is the registry of the run (its Environment) whose output this console shows.
+function statusConsole(writable, secrets = (0, redact_1.createSecretRegistry)()) {
     const statusBuffer = new buffer_context_1.BufferContext(StatusBufferMax);
     const consoleBuffer = new buffer_context_1.BufferContext(ConsoleBufferMax);
     const emit = (0, emitter_1.emitter)();
     function addMessage(context, unredacted) {
-        const message = { ...unredacted, message: (0, redact_1.redact)(unredacted.message) };
+        const message = { ...unredacted, message: secrets.redact(unredacted.message) };
         emit.emit(message);
         writable.write(JSON.stringify({ context, message }) + '\n');
         if (message.type === 'console') {

package/dist/planner/work-secret.js

@@ -1,13 +1,24 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getSecretDigest = exports.resolveSecretValue = exports.parseWorkSecrets = exports.getPortableSecretName = exports.getSecretName = void 0;
+exports.getSecretDigest = exports.resolveSecretValue = exports.parseWorkSecrets = exports.getPortableSecretName = exports.getSecretName = exports.describeSecretSource = void 0;
 const crypto_1 = require("crypto");
 const os_1 = require("os");
 const fs_1 = require("fs");
 const normalize_path_1 = require("./utils/normalize-path");
 const template_value_1 = require("./utils/template-value");
 const portable_path_1 = require("./utils/portable-path");
-const redact_1 = require("../utils/redact");
+const abort_1 = require("../executer/abort");
+const provider_values_1 = require("../secrets/provider-values");
+// Where the value comes from, for messages and for what makes a service
+// different: never the value.
+function describeSecretSource(secret) {
+    const source = secret.source;
+    if (source.type === 'provider') {
+        return `${source.provider}:${source.ref} as ${source.account}`;
+    }
+    return source.type === 'env' ? `env:${source.name}` : `file:${source.path}`;
+}
+exports.describeSecretSource = describeSecretSource;
 function getSecretName(secret) {
     return secret.target.type === 'env' ? secret.target.name : secret.target.path;
 }
@@ -18,15 +29,16 @@ function getPortableSecretName(projectRoot, secret) {
     return secret.target.type === 'env' ? secret.target.name : (0, portable_path_1.portablePath)(projectRoot, secret.target.path);
 }
 exports.getPortableSecretName = getPortableSecretName;
-function parseWorkSecrets(cwd, projectRoot, secrets, envs, environment) {
+function parseWorkSecrets(cwd, projectRoot, secrets, envs, environment, catalog, 
+// the service account of the task or service the secrets belong to
+account) {
     return (secrets ?? []).map((secret) => {
         const ref = secret.from.substring(secret.from.indexOf(':') + 1);
-        const source = secret.from.startsWith('env:')
-            ? { type: 'env', name: ref }
-            : { type: 'file', path: (0, normalize_path_1.normalizePath)(cwd, (0, os_1.homedir)(), (0, template_value_1.templateValue)(ref, envs)) };
         const target = secret.env
             ? { type: 'env', name: secret.env }
             : { type: 'file', path: (0, normalize_path_1.normalizePath)(cwd, cwd, (0, template_value_1.templateValue)(secret.path ?? '', envs)) };
+        const name = target.type === 'env' ? target.name : secret.path;
+        const source = parseSecretSource(secret, ref, cwd, envs, catalog, account, `secret ${name}`);
         const workSecret = {
             source,
             target,
@@ -37,20 +49,65 @@ function parseWorkSecrets(cwd, projectRoot, secrets, envs, environment) {
     });
 }
 exports.parseWorkSecrets = parseWorkSecrets;
+function parseSecretSource(secret, ref, cwd, envs, catalog, taskAccount, label) {
+    const kind = secret.from.substring(0, secret.from.indexOf(':'));
+    if (kind === 'env') {
+        return { type: 'env', name: ref };
+    }
+    if (kind === 'file') {
+        return { type: 'file', path: (0, normalize_path_1.normalizePath)(cwd, (0, os_1.homedir)(), (0, template_value_1.templateValue)(ref, envs)) };
+    }
+    const provider = catalog.providers[kind];
+    if (!provider) {
+        const declared = Object.keys(catalog.providers);
+        throw new Error(`${label}: unknown secret provider ${kind}, ${declared.length > 0 ? `declared: ${declared.join(', ')}` : 'none is declared'}`);
+    }
+    const providerRef = (0, template_value_1.templateValue)(ref, envs);
+    if (providerRef.length === 0 || providerRef.startsWith('-')) {
+        throw new Error(`${label}: a reference for ${kind} must not be empty or start with -`);
+    }
+    const accountName = secret.account ?? taskAccount ?? Object.values(catalog.accounts).find((a) => a.default)?.name;
+    if (!accountName) {
+        throw new Error(`${label}: ${kind}:${providerRef} needs an account, and none is named or marked default: true`);
+    }
+    const account = catalog.accounts[accountName];
+    if (!account) {
+        throw new Error(`${label}: unknown secret account ${accountName}, declared: ${Object.keys(catalog.accounts).join(', ') || 'none'}`);
+    }
+    const credentials = account.providers[kind];
+    if (!credentials) {
+        throw new Error(`${label}: account ${accountName} has no credentials for provider ${kind}`);
+    }
+    return {
+        type: 'provider',
+        provider: kind,
+        ref: providerRef,
+        account: accountName,
+        binding: { definition: provider, account: { name: accountName, env: credentials.env } },
+    };
+}
 function readSecretValueSync(secret, environment) {
     if (secret.source.type === 'env') {
         const value = environment.processEnvs[secret.source.name];
         if (value === undefined || value === null) {
             throw new Error(`secret ${getSecretName(secret)}: environment variable ${secret.source.name} is not set`);
         }
-        (0, redact_1.registerSecretValue)(value);
+        environment.secrets.register(value);
+        return value;
+    }
+    if (secret.source.type === 'provider') {
+        const value = (0, provider_values_1.peekProviderValue)(secret.source.binding, secret.source.ref, environment);
+        if (value === undefined) {
+            throw new Error(`secret ${getSecretName(secret)}: ${describeSecretSource(secret)} was not fetched before its task id was computed`);
+        }
+        environment.secrets.register(value);
         return value;
     }
     if (!(0, fs_1.existsSync)(secret.source.path)) {
         throw new Error(`secret ${getSecretName(secret)}: file ${secret.source.path} does not exist`);
     }
     const value = (0, fs_1.readFileSync)(secret.source.path, 'utf8');
-    (0, redact_1.registerSecretValue)(value);
+    environment.secrets.register(value);
     return value;
 }
 // The value, read when the task or service starts (or when a cache-affecting
@@ -61,14 +118,17 @@ async function resolveSecretValue(secret, environment) {
         if (value === undefined || value === null) {
             throw new Error(`secret ${getSecretName(secret)}: environment variable ${secret.source.name} is not set`);
         }
-        (0, redact_1.registerSecretValue)(value);
+        environment.secrets.register(value);
         return value;
     }
+    if (secret.source.type === 'provider') {
+        return resolveProviderSecret(secret, secret.source, environment);
+    }
     if (!(await environment.file.exists(secret.source.path))) {
         throw new Error(`secret ${getSecretName(secret)}: file ${secret.source.path} does not exist`);
     }
     const value = await environment.file.read(secret.source.path);
-    (0, redact_1.registerSecretValue)(value);
+    environment.secrets.register(value);
     return value;
 }
 exports.resolveSecretValue = resolveSecretValue;
@@ -80,4 +140,21 @@ function getSecretDigest(projectRoot, cwd, secret, value) {
     return `sha256:${(0, crypto_1.createHash)('sha256').update(`${salt}\0${value}`).digest('hex')}`;
 }
 exports.getSecretDigest = getSecretDigest;
+async function resolveProviderSecret(secret, source, environment) {
+    let value;
+    try {
+        value = await (0, provider_values_1.fetchProviderValue)(source.binding, source.ref, environment);
+    }
+    catch (error) {
+        if (error instanceof abort_1.AbortError) {
+            throw error;
+        }
+        throw new Error(`secret ${getSecretName(secret)} (${describeSecretSource(secret)}): ${error instanceof Error ? error.message : error}`);
+    }
+    if (value.length === 0) {
+        throw new Error(`secret ${getSecretName(secret)} (${describeSecretSource(secret)}): the provider returned no value`);
+    }
+    environment.secrets.register(value);
+    return value;
+}
 //# sourceMappingURL=work-secret.js.map

package/dist/program.js

@@ -25,6 +25,8 @@ const version_1 = require("./version");
 const read_only_1 = require("./cache/read-only");
 const units_1 = require("./utils/units");
 const cache_inventory_1 = require("./cache/cache-inventory");
+const remote_commands_1 = require("./remote/remote-commands");
+const server_command_1 = require("./server/server-command");
 async function createCli(fileName, environment, workScope) {
     const { ctx, scope } = await (0, schema_parser_1.createParseContext)(fileName, environment);
     const referencedScope = await (0, reference_parser_1.parseReferences)(ctx, scope, environment);
@@ -102,6 +104,7 @@ function parseWorkLabelScope(options) {
 }
 async function getProgram(environment, argv) {
     const program = new commander_1.Command();
+    (0, server_command_1.registerServerCommand)(program, environment);
     const parsed = (0, parse_set_arguments_1.parseSetArguments)(argv);
     const args = parsed.args;
     environment.processEnvs = { ...environment.processEnvs, ...parsed.values };
@@ -110,6 +113,7 @@ async function getProgram(environment, argv) {
     if (fileIndex >= 0) {
         args.splice(fileIndex, 2);
     }
+    (0, remote_commands_1.registerRemoteCommands)(program, environment, fileName);
     if (await environment.file.exists(fileName)) {
         program
             .command('ls')

package/dist/remote/bundle.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HASH_PATTERN = exports.hashBundle = exports.bundleSchema = exports.isBundlePath = exports.MAX_BUNDLE_BYTES = exports.MAX_BUNDLE_FILES = exports.DEFAULT_ENTRY = void 0;
+const crypto_1 = require("crypto");
+const zod_1 = require("zod");
+exports.DEFAULT_ENTRY = '.hammerkit.yaml';
+exports.MAX_BUNDLE_FILES = 200;
+exports.MAX_BUNDLE_BYTES = 1024 * 1024;
+// A path inside the bundle: relative, forward slashes, nothing that climbs out.
+function isBundlePath(path) {
+    return (path.length > 0 &&
+        path.length <= 200 &&
+        !path.startsWith('/') &&
+        !path.includes('\\') &&
+        !path.includes('\0') &&
+        !path.split('/').some((part) => part === '' || part === '.' || part === '..'));
+}
+exports.isBundlePath = isBundlePath;
+exports.bundleSchema = zod_1.z
+    .object({
+    entry: zod_1.z.string().default(exports.DEFAULT_ENTRY),
+    files: zod_1.z.record(zod_1.z.string()),
+})
+    .strict()
+    .superRefine((bundle, ctx) => {
+    const paths = Object.keys(bundle.files);
+    const bad = paths.find((path) => !isBundlePath(path));
+    if (bad !== undefined) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['files'],
+            message: `"${bad}" is not a path inside the bundle`,
+        });
+    }
+    if (paths.length > exports.MAX_BUNDLE_FILES) {
+        ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, path: ['files'], message: `more than ${exports.MAX_BUNDLE_FILES} files` });
+    }
+    const bytes = paths.reduce((sum, path) => sum + Buffer.byteLength(bundle.files[path]), 0);
+    if (bytes > exports.MAX_BUNDLE_BYTES) {
+        ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, path: ['files'], message: `larger than ${exports.MAX_BUNDLE_BYTES} bytes` });
+    }
+    if (!isBundlePath(bundle.entry) || !Object.prototype.hasOwnProperty.call(bundle.files, bundle.entry)) {
+        ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, path: ['entry'], message: `${bundle.entry} is not one of the files` });
+    }
+});
+// The version of a bundle: the hash of its entry and of every file, in path order,
+// so the same files always have the same version, wherever it is computed. It is
+// the sha-256 of the JSON `[entry, [[path, sha-256 of the content], ...]]`.
+function hashBundle(bundle) {
+    const files = Object.keys(bundle.files)
+        .sort()
+        .map((path) => [path, (0, crypto_1.createHash)('sha256').update(bundle.files[path]).digest('hex')]);
+    return `sha256:${(0, crypto_1.createHash)('sha256')
+        .update(JSON.stringify([bundle.entry, files]))
+        .digest('hex')}`;
+}
+exports.hashBundle = hashBundle;
+exports.HASH_PATTERN = /^sha256:[0-9a-f]{64}$/;
+//# sourceMappingURL=bundle.js.map

package/dist/remote/collect-bundle.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.collectBundle = void 0;
+const path_1 = require("path");
+const resolve_git_source_1 = require("../includes/resolve-git-source");
+const schema_parser_1 = require("../schema/schema-parser");
+const bundle_1 = require("./bundle");
+// The bundle of a build file on this machine: the file itself and every local
+// file it includes or references, as the server reads them when it is published.
+// The build file is read with the parser of a run, so what it pulls in is what a
+// run would read. Git includes are not part of it (the server fetches them, at
+// the commit they are pinned to), and neither is anything outside of the
+// directory of the build file, which a server could not reproduce.
+async function collectBundle(fileName, environment) {
+    if (!(await environment.file.exists(fileName))) {
+        throw new Error(`there is no build file at ${fileName}`);
+    }
+    const entryPath = (0, path_1.resolve)(fileName);
+    const root = (0, path_1.dirname)(entryPath);
+    const { ctx } = await (0, schema_parser_1.createParseContext)(entryPath, environment);
+    const paths = new Set([entryPath]);
+    for (const scope of Object.values(ctx.files)) {
+        if (!scope.remote) {
+            paths.add((0, path_1.resolve)(scope.fileName));
+        }
+    }
+    const files = {};
+    for (const path of [...paths].sort()) {
+        if (!(0, resolve_git_source_1.isWithin)(root, path)) {
+            throw new Error(`${path} is outside of ${root}: a published build file can only include files below its own directory`);
+        }
+        files[(0, path_1.relative)(root, path).split(path_1.sep).join('/')] = await environment.file.read(path);
+    }
+    const result = bundle_1.bundleSchema.safeParse({ entry: (0, path_1.relative)(root, entryPath).split(path_1.sep).join('/'), files });
+    if (!result.success) {
+        throw new Error(`the build file can't be published: ${result.error.issues[0].message}`);
+    }
+    return result.data;
+}
+exports.collectBundle = collectBundle;
+//# sourceMappingURL=collect-bundle.js.map