hammerkit 1.23.0 → 1.24.0

package/dist/remote/location.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveRunLocation = void 0;
+const host_config_1 = require("./host-config");
+// Where a run happens, highest precedence first: --on / --local, HAMMERKIT_ON,
+// the runner of the tasks, `run.on` of the host config, local. `auto` (as
+// --on, HAMMERKIT_ON or run.on) means the runner of the tasks, else local.
+// A name that is not registered is an error: a run never falls back to the
+// local machine silently.
+async function resolveRunLocation(workTree, environment, options = {}) {
+    if (options.on && options.local) {
+        throw new Error('--on and --local contradict each other');
+    }
+    const config = await (0, host_config_1.readHostConfig)(environment);
+    const explicit = options.local ? 'local' : options.on ?? (environment.processEnvs.HAMMERKIT_ON || undefined);
+    if (explicit && explicit !== 'auto') {
+        return explicit === 'local' ? { type: 'local' } : lookup(config.servers, explicit);
+    }
+    const runners = getTaskRunners(workTree);
+    if (runners.length > 1) {
+        throw new Error(`a run goes to one server, but its tasks name ${runners.join(', ')}`);
+    }
+    const requested = runners[0] ?? (explicit ? undefined : config.run.on);
+    if (!requested || requested === 'local' || requested === 'auto') {
+        return { type: 'local' };
+    }
+    return lookup(config.servers, requested);
+}
+exports.resolveRunLocation = resolveRunLocation;
+function lookup(servers, name) {
+    const server = (0, host_config_1.hasServer)(servers, name) ? servers[name] : undefined;
+    if (!server) {
+        throw new Error(`server ${name} is not registered, add it with: hammerkit remote add ${name} <url> --issuer <url>`);
+    }
+    return { type: 'server', name, server };
+}
+function getTaskRunners(workTree) {
+    const runners = new Set();
+    for (const task of Object.values(workTree.tasks)) {
+        if (task.data.runner) {
+            runners.add(task.data.runner);
+        }
+    }
+    return [...runners].sort();
+}
+//# sourceMappingURL=location.js.map

package/dist/remote/remote-commands.js

@@ -0,0 +1,154 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerRemoteCommands = void 0;
+const commander_1 = require("commander");
+const colors_1 = __importDefault(require("colors"));
+const log_1 = require("../log");
+const host_config_1 = require("./host-config");
+const device_login_1 = require("./device-login");
+const credentials_1 = require("./credentials");
+const server_client_1 = require("./server-client");
+const remote_work_commands_1 = require("./remote-work-commands");
+// Host-level commands: they only touch the machine's config file, so they work
+// with or without a build file in the working directory.
+function registerRemoteCommands(program, environment, buildFile) {
+    const remote = program.command('remote').description('register the servers runs can be sent to');
+    const guarded = (failure, fn) => {
+        return async (...args) => {
+            try {
+                await fn(...args);
+            }
+            catch (e) {
+                if (e instanceof commander_1.CommanderError) {
+                    throw e;
+                }
+                program.error(`${failure}: ${(0, log_1.getErrorMessage)(e)}`, { exitCode: 1 });
+            }
+        };
+    };
+    remote
+        .command('add <name> <url>')
+        .description('register a server under a name that build files and --on can refer to')
+        .addOption(new commander_1.Option('--issuer <url>', 'OAuth issuer the server accepts tokens from').makeOptionMandatory())
+        .addOption(new commander_1.Option('--client-id <id>', 'OAuth client to sign in with (pinned; default: what the server offers)'))
+        .addOption(new commander_1.Option('--audience <audience>', 'audience of the token (pinned; default: what the server offers)'))
+        .addOption(new commander_1.Option('--scope <scope>', 'scopes to request (pinned; default: what the server offers)'))
+        .addOption(new commander_1.Option('--force', 'point an already registered name at a different server').default(false))
+        .action(guarded('Remote add was not successful', async (name, url, options) => {
+        const server = await (0, host_config_1.addServer)(environment, name, url, {
+            issuer: options.issuer,
+            clientId: options.clientId,
+            audience: options.audience,
+            scope: options.scope,
+            force: options.force,
+        });
+        environment.stdout.write(`added ${name}: ${server.url} (issuer ${server.issuer})\n`);
+    }));
+    remote
+        .command('list')
+        .description('list the registered servers')
+        .action(guarded('Remote list was not successful', async () => {
+        const config = await (0, host_config_1.readHostConfig)(environment);
+        const names = Object.keys(config.servers).sort();
+        if (names.length === 0) {
+            environment.stdout.write(`no servers registered (config: ${(0, host_config_1.getHostConfigPath)(environment)})\n`);
+            return;
+        }
+        for (const name of names) {
+            const server = config.servers[name];
+            const marker = config.run.on === name ? colors_1.default.green(' (default)') : '';
+            environment.stdout.write(`${colors_1.default.bold(name)}${marker}  ${server.url}  issuer ${server.issuer}\n`);
+        }
+        if (config.run.on === 'auto' || config.run.on === 'local') {
+            environment.stdout.write(`default location: ${config.run.on}\n`);
+        }
+    }));
+    remote
+        .command('remove <name>')
+        .description('forget a registered server')
+        .action(guarded('Remote remove was not successful', async (name) => {
+        const { resetDefault } = await (0, host_config_1.removeServer)(environment, name);
+        environment.stdout.write(`removed ${name}\n`);
+        if (resetDefault) {
+            environment.stdout.write('it was the default location, runs are local again\n');
+        }
+    }));
+    remote
+        .command('use <location>')
+        .description('set where runs happen by default: local, auto or a registered server')
+        .action(guarded('Remote use was not successful', async (location) => {
+        await (0, host_config_1.setDefaultLocation)(environment, location);
+        environment.stdout.write(`default location: ${location}\n`);
+    }));
+    const getServer = async (name) => {
+        const config = await (0, host_config_1.readHostConfig)(environment);
+        const chosen = name ?? config.run.on;
+        if (!chosen || !(0, host_config_1.hasServer)(config.servers, chosen)) {
+            throw new Error(name
+                ? `server ${name} is not registered, add it with: hammerkit remote add ${name} <url> --issuer <url>`
+                : 'name a server, or set one as the default with: hammerkit remote use <name>');
+        }
+        return { name: chosen, server: config.servers[chosen] };
+    };
+    remote
+        .command('login <name>')
+        .description('sign in to a registered server with your identity provider (device code, works headless)')
+        .action(guarded('Remote login was not successful', async (name) => {
+        const { server } = await getServer(name);
+        const { pinned, ...result } = await (0, device_login_1.deviceLogin)(server, {
+            prompt: (message) => environment.stdout.write(`${message}\n`),
+            signal: environment.abortCtrl.signal,
+        });
+        await (0, host_config_1.pinLogin)(environment, name, pinned);
+        await (0, credentials_1.saveToken)(environment, name, { url: server.url, issuer: server.issuer, ...result });
+        try {
+            const me = await (0, server_client_1.getMe)(server, result.accessToken);
+            environment.stdout.write(`signed in to ${name} as ${me.sub}\n`);
+            environment.stdout.write(me.accounts.length > 0
+                ? `service accounts: ${me.accounts.join(', ')}\n`
+                : 'you have no service accounts on this server\n');
+        }
+        catch (e) {
+            // a token the server does not accept is of no use
+            await (0, credentials_1.removeToken)(environment, name);
+            throw e;
+        }
+    }));
+    remote
+        .command('logout <name>')
+        .description('forget the sign-in to a server')
+        .action(guarded('Remote logout was not successful', async (name) => {
+        const removed = await (0, credentials_1.removeToken)(environment, name);
+        environment.stdout.write(removed ? `signed out of ${name}\n` : `not signed in to ${name}\n`);
+    }));
+    remote
+        .command('accounts [name]')
+        .description('show who you are on a server and which service accounts you may use')
+        .action(guarded('Remote accounts was not successful', async (name) => {
+        const chosen = await getServer(name);
+        const token = await (0, credentials_1.getAccessToken)(environment, chosen.name, chosen.server);
+        const me = await (0, server_client_1.getMe)(chosen.server, token);
+        environment.stdout.write(`${chosen.name}: ${me.sub} (${me.iss})\n`);
+        if (me.accounts.length === 0 && !(me.request && me.request.length > 0)) {
+            environment.stdout.write('no service accounts\n');
+        }
+        for (const account of me.accounts) {
+            environment.stdout.write(`${account}${account === me.default ? colors_1.default.green(' (default)') : ''}\n`);
+        }
+        if (me.publish && me.publish.length > 0) {
+            environment.stdout.write(`may publish build files: ${me.publish.join(', ')}\n`);
+        }
+        if (me.propose && me.propose.length > 0) {
+            environment.stdout.write(`may propose build files, which need an approval: ${me.propose.join(', ')}\n`);
+        }
+        if (me.request && me.request.length > 0) {
+            environment.stdout.write(`may request runs, which an admin approves: ${me.request.join(', ')}\n`);
+        }
+    }));
+    (0, remote_work_commands_1.registerWorkCommands)(remote, { environment, buildFile, getServer, guarded });
+}
+exports.registerRemoteCommands = registerRemoteCommands;
+//# sourceMappingURL=remote-commands.js.map

package/dist/remote/remote-work-commands.js

@@ -0,0 +1,152 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerWorkCommands = void 0;
+const commander_1 = require("commander");
+const colors_1 = __importDefault(require("colors"));
+const credentials_1 = require("./credentials");
+const collect_bundle_1 = require("./collect-bundle");
+const bundle_1 = require("./bundle");
+const server_client_1 = require("./server-client");
+const text_diff_1 = require("./text-diff");
+const PROPOSAL_NAME = /^([a-z0-9][a-z0-9._-]{0,63})@(sha256:[0-9a-f]{64})$/i;
+// A proposed version is named like `payments@sha256:...`
+function parseProposal(value) {
+    const match = PROPOSAL_NAME.exec(value);
+    return match && bundle_1.HASH_PATTERN.test(match[2]) ? { name: match[1], hash: match[2] } : undefined;
+}
+const RUN_ID = /^run_[A-Za-z0-9_-]{16}$/;
+// What a person who approves is shown of a run: everything the decision rests on.
+function describe(run) {
+    const source = run.source.type === 'ref' ? `ref ${run.source.ref}` : `snapshot ${run.source.snapshot}`;
+    const options = Object.entries(run.options)
+        .map(([key, value]) => `${key}=${Array.isArray(value) ? value.join(',') : value}`)
+        .join(' ');
+    return [
+        `${colors_1.default.bold((0, server_client_1.printable)(run.id))}  requested by ${(0, server_client_1.printable)(run.requestedBy.sub)} (${(0, server_client_1.printable)(run.requestedBy.iss)})`,
+        `  ${(0, server_client_1.printable)(run.definition.name)} ${(0, server_client_1.printable)(run.definition.hash)}`,
+        `  tasks: ${run.tasks.length > 0 ? run.tasks.map(server_client_1.printable).join(', ') : 'selected by labels'}`,
+        `  account ${run.account === null ? 'none' : (0, server_client_1.printable)(run.account)}, source ${(0, server_client_1.printable)(source)}${options ? `, ${(0, server_client_1.printable)(options)}` : ''}`,
+        `  needs the approval of an admin of ${run.account === null ? 'none' : (0, server_client_1.printable)(run.account)}`,
+        `  decide before ${(0, server_client_1.printable)(run.approval?.expiresAt ?? '-')}`,
+    ];
+}
+function registerWorkCommands(remote, context) {
+    const { environment, buildFile, getServer, guarded } = context;
+    const connect = async (name) => {
+        const chosen = await getServer(name);
+        const token = await (0, credentials_1.getAccessToken)(environment, chosen.name, chosen.server);
+        return { ...chosen, token };
+    };
+    remote
+        .command('publish <definition> [server]')
+        .description('publish the build file and the files it includes to a server, under a name runs can refer to')
+        .action(guarded('Remote publish was not successful', async (definition, name) => {
+        const bundle = await (0, collect_bundle_1.collectBundle)(buildFile, environment);
+        const { name: serverName, server, token } = await connect(name);
+        const answer = await (0, server_client_1.callServer)(server, token, 'PUT', `/v1/definitions/${encodeURIComponent(definition)}`, bundle);
+        const version = answer.body;
+        const files = Object.keys(bundle.files).length;
+        const proposed = answer.status === 202;
+        const verb = proposed ? 'proposed' : answer.status === 201 ? 'published' : 'already published';
+        environment.stdout.write(`${verb} ${definition} to ${serverName}: ${(0, server_client_1.printable)(version.hash)} (${files} ${files === 1 ? 'file' : 'files'})\n`);
+        const names = [...(version.tasks ?? []), ...(version.services ?? [])];
+        environment.stdout.write(`tasks and services: ${names.map(server_client_1.printable).join(', ') || 'none'}\n`);
+        if (proposed) {
+            environment.stdout.write(`it can not run before somebody who may publish ${(0, server_client_1.printable)(definition)} approves it, until ${(0, server_client_1.printable)(version.expiresAt)}\n`);
+        }
+    }));
+    remote
+        .command('approvals [server]')
+        .description('list the runs on a server that wait for your approval')
+        .action(guarded('Remote approvals was not successful', async (name) => {
+        const { name: serverName, server, token } = await connect(name);
+        const { body } = await (0, server_client_1.callServer)(server, token, 'GET', '/v1/approvals');
+        if (body.approvals.length === 0) {
+            environment.stdout.write(`${serverName}: no runs wait for your approval\n`);
+            return;
+        }
+        environment.stdout.write(`${serverName}: ${body.approvals.length} waiting for your approval\n`);
+        for (const run of body.approvals) {
+            for (const line of describe(run)) {
+                environment.stdout.write(`${line}\n`);
+            }
+        }
+    }));
+    remote
+        .command('proposals [server]')
+        .description('list the proposed versions of build files you made or may approve')
+        .action(guarded('Remote proposals was not successful', async (name) => {
+        const { name: serverName, server, token } = await connect(name);
+        const { body } = await (0, server_client_1.callServer)(server, token, 'GET', '/v1/proposals');
+        if (body.proposals.length === 0) {
+            environment.stdout.write(`${serverName}: no proposed versions\n`);
+            return;
+        }
+        environment.stdout.write(`${serverName}: ${body.proposals.length} proposed\n`);
+        for (const proposal of body.proposals) {
+            const who = proposal.mine ? 'you' : (0, server_client_1.printable)(proposal.proposedBy.sub);
+            const state = proposal.canDecide ? colors_1.default.bold('waits for your approval') : (0, server_client_1.printable)(proposal.state);
+            environment.stdout.write(`${colors_1.default.bold(`${(0, server_client_1.printable)(proposal.name)}@${(0, server_client_1.printable)(proposal.hash)}`)}  proposed by ${who}, ${state}\n`);
+            const names = [...proposal.tasks, ...proposal.services];
+            environment.stdout.write(`  tasks and services: ${names.map(server_client_1.printable).join(', ') || 'none'}\n`);
+            if (proposal.state === 'waiting') {
+                environment.stdout.write(`  decide before ${(0, server_client_1.printable)(proposal.expiresAt)}\n`);
+            }
+            else if (proposal.reason) {
+                environment.stdout.write(`  ${(0, server_client_1.printable)(proposal.state)}: ${(0, server_client_1.printable)(proposal.reason)}\n`);
+            }
+        }
+    }));
+    remote
+        .command('diff <proposal> [server]')
+        .description('show what a proposed version (name@hash) changes against the version it follows')
+        .action(guarded('Remote diff was not successful', async (target, name) => {
+        const proposal = parseProposal(target);
+        if (!proposal) {
+            throw new Error(`${(0, server_client_1.printable)(target)} is not a proposal, list them with: hammerkit remote proposals`);
+        }
+        const { name: serverName, server, token } = await connect(name);
+        const path = `/v1/proposals/${encodeURIComponent(proposal.name)}/${proposal.hash}`;
+        const view = (await (0, server_client_1.callServer)(server, token, 'GET', path)).body;
+        const proposed = (await (0, server_client_1.callServer)(server, token, 'GET', `${path}/files`)).body;
+        const base = view.base
+            ? (await (0, server_client_1.callServer)(server, token, 'GET', `/v1/definitions/${encodeURIComponent(proposal.name)}/${view.base}/files`)).body
+            : undefined;
+        environment.stdout.write(`${(0, server_client_1.printable)(proposal.name)}@${(0, server_client_1.printable)(proposal.hash)} on ${serverName}, proposed by ${(0, server_client_1.printable)(view.proposedBy.sub)} (${(0, server_client_1.printable)(view.proposedBy.iss)})\n`);
+        environment.stdout.write(base ? `compared with ${(0, server_client_1.printable)(view.base)}\n` : 'no version is published yet, everything is new\n');
+        const lines = (0, text_diff_1.diffBundles)(base, proposed);
+        environment.stdout.write(lines.length > 0 ? `${lines.join('\n')}\n` : 'the files are the same\n');
+    }));
+    for (const action of ['approve', 'reject']) {
+        remote
+            .command(`${action} <target> [server]`)
+            .description(action === 'approve'
+            ? 'let a run (run_...) or a proposed version (name@hash) that waits for your approval go ahead'
+            : 'end a run (run_...) or drop a proposed version (name@hash) that waits for your approval')
+            .addOption(new commander_1.Option('--reason <text>', 'why, shown to who asked').argParser((value) => value))
+            .action(guarded(`Remote ${action} was not successful`, async (target, name, options) => {
+            const proposal = parseProposal(target);
+            if (!proposal && !RUN_ID.test(target)) {
+                throw new Error(`${(0, server_client_1.printable)(target)} is not a run id or a proposed version, list them with: hammerkit remote approvals or remote proposals`);
+            }
+            const { name: serverName, server, token } = await connect(name);
+            const path = proposal
+                ? `/v1/proposals/${encodeURIComponent(proposal.name)}/${proposal.hash}/${action}`
+                : `/v1/approvals/${target}/${action}`;
+            const { body } = await (0, server_client_1.callServer)(server, token, 'POST', path, options.reason ? { reason: options.reason } : undefined);
+            const rejected = body.state === 'rejected';
+            environment.stdout.write(proposal
+                ? rejected
+                    ? `rejected ${target} on ${serverName}\n`
+                    : `approved ${target} on ${serverName}, it is published\n`
+                : rejected
+                    ? `rejected ${target} on ${serverName}\n`
+                    : `approved ${target} on ${serverName}, it is queued\n`);
+        }));
+    }
+}
+exports.registerWorkCommands = registerWorkCommands;
+//# sourceMappingURL=remote-work-commands.js.map

package/dist/remote/server-client.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.callServer = exports.getMe = exports.getDiscovery = exports.printable = exports.ServerError = void 0;
+const discovery_1 = require("../server/discovery");
+const TIMEOUT_MS = 10000;
+const WRITE_TIMEOUT_MS = 30000;
+class ServerError extends Error {
+}
+exports.ServerError = ServerError;
+// Text from the server or the identity provider is shown to the user: no
+// control characters, so it can't rewrite the terminal.
+function printable(value) {
+    return String(value)
+        .replace(/\p{Cc}/gu, '?')
+        .slice(0, 300);
+}
+exports.printable = printable;
+async function getJson(url, token) {
+    let response;
+    try {
+        response = await fetch(url, {
+            headers: token ? { authorization: `Bearer ${token}` } : {},
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+    }
+    catch (e) {
+        throw new ServerError(`unable to reach ${url}: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    if (response.status === 401) {
+        throw new ServerError(`${url} did not accept the token`);
+    }
+    if (!response.ok) {
+        throw new ServerError(`${url} answered ${response.status}`);
+    }
+    return response.json();
+}
+// What the server says it is. The issuer registered with `remote add` has to be
+// one it accepts, otherwise a login would send the user to an identity provider
+// the server does not trust.
+async function getDiscovery(server) {
+    const document = (await getJson(`${server.url}${discovery_1.DISCOVERY_PATH}`));
+    if (document?.name !== 'hammerkit' || !Array.isArray(document.issuers)) {
+        throw new ServerError(`${server.url} is not a hammerkit server`);
+    }
+    return document;
+}
+exports.getDiscovery = getDiscovery;
+async function getMe(server, token) {
+    return (await getJson(`${server.url}/v1/me`, token));
+}
+exports.getMe = getMe;
+// A call that changes something, or whose answer the caller tells apart by status.
+// Anything but 2xx is an error carrying what the server said about it.
+async function callServer(server, token, method, path, body) {
+    const url = `${server.url}${path}`;
+    let response;
+    try {
+        response = await fetch(url, {
+            method,
+            headers: {
+                authorization: `Bearer ${token}`,
+                ...(body !== undefined ? { 'content-type': 'application/json' } : {}),
+            },
+            body: body === undefined ? undefined : JSON.stringify(body),
+            signal: AbortSignal.timeout(method === 'GET' ? TIMEOUT_MS : WRITE_TIMEOUT_MS),
+        });
+    }
+    catch (e) {
+        throw new ServerError(`unable to reach ${url}: ${printable(e instanceof Error ? e.message : e)}`);
+    }
+    let answer;
+    try {
+        answer = await response.json();
+    }
+    catch {
+        answer = undefined;
+    }
+    if (response.status === 401) {
+        throw new ServerError(`${server.url} did not accept the token`);
+    }
+    if (!response.ok) {
+        const said = answer && typeof answer.error === 'string' ? `: ${printable(answer.error)}` : '';
+        throw new ServerError(`${server.url} answered ${response.status}${said}`);
+    }
+    return { status: response.status, body: answer };
+}
+exports.callServer = callServer;
+//# sourceMappingURL=server-client.js.map

package/dist/remote/source-manifest.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deniedSourcePath = exports.hashSource = exports.sourceManifestSchema = exports.DIGEST_PATTERN = exports.MAX_MANIFEST_BODY_BYTES = exports.MAX_SOURCE_BYTES = exports.MAX_SOURCE_FILE_BYTES = exports.MAX_SOURCE_FILES = void 0;
+const crypto_1 = require("crypto");
+const zod_1 = require("zod");
+const bundle_1 = require("./bundle");
+exports.MAX_SOURCE_FILES = 20000;
+exports.MAX_SOURCE_FILE_BYTES = 32 * 1024 * 1024;
+exports.MAX_SOURCE_BYTES = 1024 * 1024 * 1024;
+// a manifest is about 200 bytes per file
+exports.MAX_MANIFEST_BODY_BYTES = 8 * 1024 * 1024;
+exports.DIGEST_PATTERN = /^[0-9a-f]{64}$/;
+const sourceFileSchema = zod_1.z
+    .object({
+    path: zod_1.z.string(),
+    sha256: zod_1.z.string().regex(exports.DIGEST_PATTERN, 'expected 64 lowercase hex digits'),
+    size: zod_1.z.number().int().min(0).max(exports.MAX_SOURCE_FILE_BYTES),
+    mode: zod_1.z.enum(['file', 'exec']).default('file'),
+})
+    .strict();
+exports.sourceManifestSchema = zod_1.z
+    .object({ files: zod_1.z.array(sourceFileSchema).min(1).max(exports.MAX_SOURCE_FILES) })
+    .strict()
+    .superRefine((manifest, ctx) => {
+    const seen = new Set();
+    let bytes = 0;
+    manifest.files.forEach((file, index) => {
+        if (!(0, bundle_1.isBundlePath)(file.path)) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['files', index, 'path'],
+                message: `"${file.path}" is not a path inside the project`,
+            });
+        }
+        if (seen.has(file.path)) {
+            ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, path: ['files', index, 'path'], message: `${file.path} twice` });
+        }
+        seen.add(file.path);
+        bytes += file.size;
+    });
+    if (bytes > exports.MAX_SOURCE_BYTES) {
+        ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, path: ['files'], message: `more than ${exports.MAX_SOURCE_BYTES} bytes` });
+    }
+});
+// The name of a tree: the sha-256 of the JSON `[[path, sha-256, mode], ...]` in
+// path order. The same files have the same name wherever it is computed, and the
+// size is not part of it because the content digest already decides it.
+function hashSource(manifest) {
+    const files = [...manifest.files]
+        .sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0))
+        .map((file) => [file.path, file.sha256, file.mode]);
+    return `sha256:${(0, crypto_1.createHash)('sha256').update(JSON.stringify(files)).digest('hex')}`;
+}
+exports.hashSource = hashSource;
+const DENIED_DIRECTORIES = ['.git', '.ssh', '.aws', '.gnupg', '.kube'];
+const DENIED_NAMES = [
+    /^\.env$/i,
+    /^\.env\.(?!example$|sample$|template$|dist$)/i,
+    /^\.(npmrc|netrc|pypirc|dockercfg|git-credentials)$/i,
+    /^id_(rsa|dsa|ecdsa|ed25519)$/i,
+    /\.(pem|p12|pfx)$/i,
+];
+// Files that hold credentials are not sent to a server even when a `src` pattern
+// reaches them: a secret belongs in a secret provider, and a glob such as `**`
+// must not be what decides that a key leaves the machine.
+function deniedSourcePath(path) {
+    const parts = path.split('/');
+    const directory = parts.slice(0, -1).find((part) => DENIED_DIRECTORIES.includes(part));
+    if (directory !== undefined) {
+        return `${directory}/ holds credentials or history`;
+    }
+    const name = parts[parts.length - 1];
+    if (DENIED_NAMES.some((pattern) => pattern.test(name))) {
+        return `${name} looks like a credential file`;
+    }
+    return null;
+}
+exports.deniedSourcePath = deniedSourcePath;
+//# sourceMappingURL=source-manifest.js.map

package/dist/remote/text-diff.js

@@ -0,0 +1,89 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.diffBundles = exports.diffLines = exports.visible = void 0;
+// Text from a proposal is shown to somebody who decides on it, so nothing in it may
+// rewrite the terminal or hide what it says: control and format characters (which
+// include the ones that reorder text) are shown as `?`. Long lines are not cut,
+// what is hidden behind a cut is what a reviewer needs to see.
+function visible(line) {
+    return line.replace(/\t/g, '  ').replace(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu, '?');
+}
+exports.visible = visible;
+// Beyond this many comparisons a file is shown whole instead of compared.
+const MAX_CELLS = 4000000;
+// The lines that differ, with `context` lines around each change.
+function diffLines(before, after, context = 2) {
+    if ((before.length + 1) * (after.length + 1) > MAX_CELLS) {
+        return undefined;
+    }
+    const n = before.length;
+    const m = after.length;
+    // lengths of the longest common suffixes
+    const table = Array.from({ length: n + 1 }, () => new Uint32Array(m + 1));
+    for (let i = n - 1; i >= 0; i--) {
+        for (let j = m - 1; j >= 0; j--) {
+            table[i][j] = before[i] === after[j] ? table[i + 1][j + 1] + 1 : Math.max(table[i + 1][j], table[i][j + 1]);
+        }
+    }
+    const all = [];
+    let i = 0;
+    let j = 0;
+    while (i < n && j < m) {
+        if (before[i] === after[j]) {
+            all.push({ type: ' ', text: before[i] });
+            i++;
+            j++;
+        }
+        else if (table[i + 1][j] >= table[i][j + 1]) {
+            all.push({ type: '-', text: before[i++] });
+        }
+        else {
+            all.push({ type: '+', text: after[j++] });
+        }
+    }
+    while (i < n)
+        all.push({ type: '-', text: before[i++] });
+    while (j < m)
+        all.push({ type: '+', text: after[j++] });
+    const keep = new Array(all.length).fill(false);
+    all.forEach((line, index) => {
+        if (line.type !== ' ') {
+            for (let k = Math.max(0, index - context); k <= Math.min(all.length - 1, index + context); k++) {
+                keep[k] = true;
+            }
+        }
+    });
+    return all.filter((_, index) => keep[index]);
+}
+exports.diffLines = diffLines;
+const lines = (text) => (text === '' ? [] : text.replace(/\n$/, '').split('\n'));
+// What a proposal changes against the version it follows, file by file.
+function diffBundles(base, proposed) {
+    const out = [];
+    const before = base?.files ?? {};
+    const paths = [...new Set([...Object.keys(before), ...Object.keys(proposed.files)])].sort();
+    for (const path of paths) {
+        const old = before[path];
+        const next = proposed.files[path];
+        if (old === next) {
+            continue;
+        }
+        const status = old === undefined ? 'added' : next === undefined ? 'removed' : 'changed';
+        out.push(`--- ${visible(path)} (${status})`);
+        const compared = old !== undefined && next !== undefined ? diffLines(lines(old), lines(next)) : undefined;
+        if (compared) {
+            compared.forEach((line) => out.push(`${line.type} ${visible(line.text)}`));
+        }
+        else {
+            // added, removed or too large to compare: all of the old, then all of the new
+            lines(old ?? '').forEach((line) => out.push(`- ${visible(line)}`));
+            lines(next ?? '').forEach((line) => out.push(`+ ${visible(line)}`));
+        }
+    }
+    if (base && base.entry !== proposed.entry) {
+        out.unshift(`entry file: ${visible(base.entry)} -> ${visible(proposed.entry)}`);
+    }
+    return out;
+}
+exports.diffBundles = diffBundles;
+//# sourceMappingURL=text-diff.js.map

package/dist/schema/build-file-base-task-schema.js

@@ -11,6 +11,7 @@ const build_file_volume_schema_1 = require("./build-file-volume-schema");
 const duration_schema_1 = require("./duration-schema");
 const build_file_secret_schema_1 = require("./build-file-secret-schema");
 const resources_schema_1 = require("./resources-schema");
+const runner_schema_1 = require("./runner-schema");
 // what `extend` adds to (the rest, e.g. `image` or `shell`, the task just overrides)
 exports.RESET_PROPERTIES = ['deps', 'needs', 'src', 'generates', 'cmds', 'mounts', 'envs', 'labels'];
 exports.buildFileBaseTaskSchema = (0, zod_1.object)({
@@ -38,5 +39,8 @@ exports.buildFileBaseTaskSchema = (0, zod_1.object)({
     account: (0, zod_1.string)().optional(),
     // CPU and memory limits of the container; a local task is not limited
     resources: resources_schema_1.resourcesSchema.optional(),
+    // Name of the server (see `hammerkit remote`) the task has to run on; defaults
+    // to the build file's `runner`. Never a local fallback when it is unknown.
+    runner: runner_schema_1.runnerSchema.optional(),
 });
 //# sourceMappingURL=build-file-base-task-schema.js.map

package/dist/schema/build-file-schema.js

@@ -10,6 +10,7 @@ const labels_schema_1 = require("./labels-schema");
 const cache_schema_1 = require("./cache-schema");
 const build_file_include_schema_1 = require("./build-file-include-schema");
 const build_file_secret_provider_schema_1 = require("./build-file-secret-provider-schema");
+const runner_schema_1 = require("./runner-schema");
 exports.buildFileSchema = (0, zod_1.object)({
     envs: envs_schema_1.envsSchema.optional(),
     tasks: (0, zod_1.record)(build_file_task_schema_1.buildFileTaskSchema).optional(),
@@ -21,6 +22,8 @@ exports.buildFileSchema = (0, zod_1.object)({
     secretProviders: build_file_secret_provider_schema_1.buildFileSecretProvidersSchema.optional(),
     secretAccounts: build_file_secret_provider_schema_1.buildFileSecretAccountsSchema.optional(),
     labels: labels_schema_1.labelsSchema.optional(),
+    // default `runner` of the tasks of this file
+    runner: runner_schema_1.runnerSchema.optional(),
 })
     .strict()
     .describe('Build file with support for containerization\nhttps://hammerkit.dev/docs/build-file');

package/dist/schema/reference-parser.js

@@ -121,6 +121,7 @@ function applySchemaExtension(reference, task) {
     task.schema.shell = task.schema.shell ?? extend.schema.shell;
     task.schema.cache = task.schema.cache ?? extend.schema.cache;
     task.schema.timeout = task.schema.timeout ?? extend.schema.timeout;
+    task.schema.runner = task.schema.runner ?? extend.schema.runner;
     if (!reset.has('cmds'))
         task.schema.cmds = extendArray(task.schema.cmds, extend.schema.cmds);
     if (!reset.has('src'))