hammerkit 1.27.0-next.20 → 1.27.0-next.22

package/build.schema.json

@@ -296,6 +296,9 @@
                     "type": "string",
                     "minLength": 1
                   },
+                  "publish": {
+                    "type": "boolean"
+                  },
                   "image": {
                     "type": "string"
                   },
@@ -379,6 +382,9 @@
                   "runner": {
                     "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/runner"
                   },
+                  "publish": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/publish"
+                  },
                   "platform": {
                     "type": "object",
                     "properties": {
@@ -520,6 +526,9 @@
                   },
                   "args": {
                     "type": "boolean"
+                  },
+                  "publish": {
+                    "type": "boolean"
                   }
                 },
                 "required": [
@@ -576,6 +585,9 @@
                         "number"
                       ]
                     }
+                  },
+                  "publish": {
+                    "type": "boolean"
                   }
                 },
                 "required": [
@@ -595,6 +607,28 @@
               {
                 "type": "string"
               },
+              {
+                "type": "object",
+                "properties": {
+                  "path": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "Build file or directory, relative to the including file"
+                  },
+                  "with": {
+                    "$ref": "#/definitions/hammerkit/properties/envs",
+                    "description": "Environment values for the current build task\nhttps://hammerkit.dev/docs/build-file/environment-variables"
+                  },
+                  "publish": {
+                    "type": "boolean",
+                    "description": "false: a server leaves out what this file declares"
+                  }
+                },
+                "required": [
+                  "path"
+                ],
+                "additionalProperties": false
+              },
               {
                 "type": "object",
                 "properties": {
@@ -615,6 +649,10 @@
                   "with": {
                     "$ref": "#/definitions/hammerkit/properties/envs",
                     "description": "Environment values for the current build task\nhttps://hammerkit.dev/docs/build-file/environment-variables"
+                  },
+                  "publish": {
+                    "type": "boolean",
+                    "description": "false: a server leaves out what this file declares"
                   }
                 },
                 "required": [

package/dist/executer/execution-steps.js

@@ -9,6 +9,7 @@ const work_task_1 = require("../planner/work-task");
 const work_service_1 = require("../planner/work-service");
 const get_container_binds_1 = require("./get-container-binds");
 const assert_item_paths_1 = require("../planner/utils/assert-item-paths");
+const log_1 = require("../log");
 // The files a server run works on: its checkout, or a sandbox. Somebody else wrote them.
 function hostedRoot(environment) {
     return environment.hosted ? environment.cwd : undefined;
@@ -66,10 +67,27 @@ async function prepareMounts(item, environment) {
             continue;
         }
         if ((0, path_1.extname)(mount.localPath)) {
-            await environment.file.writeFile(mount.localPath, '');
+            try {
+                await environment.file.writeFile(mount.localPath, '');
+            }
+            catch (e) {
+                // Docker would make a directory there
+                throw new Error(`mount ${mount.localPath} does not exist and can't be created (${(0, log_1.getErrorMessage)(e)})`);
+            }
         }
         else {
-            await environment.file.createDirectory(mount.localPath);
+            try {
+                await environment.file.createDirectory(mount.localPath);
+            }
+            catch (e) {
+                // on a server a root-owned directory in the run's files could break its cleanup
+                if (environment.hosted) {
+                    throw e;
+                }
+                // hammerkit may run in a container whose file system is not the one of the Docker
+                // host: Docker creates the missing directory of a bind on its own
+                item.status.write('warn', `can't create ${mount.localPath} (${(0, log_1.getErrorMessage)(e)}), Docker creates it on its host as root`);
+            }
         }
     }
     if ((0, work_task_1.isContainerWorkTask)(item.data)) {

package/dist/executer/reset-work-tree.js

@@ -5,6 +5,10 @@ const state_1 = require("./state");
 function resetWorkTree(workTree, type) {
     return {
         tasks: Object.entries(workTree.tasks).reduce((tasks, [key, task]) => {
+            // down only stops services: a task it selects names the services it needs
+            if (type === 'down') {
+                return tasks;
+            }
             task.state = new state_1.State({
                 type: 'pending',
                 stateKey: null,

package/dist/program.js

@@ -111,6 +111,18 @@ function getListJson(tasks, services) {
         })),
     };
 }
+// `up` and `down` select by name or by label, not both: a name outside the labels would
+// silently select nothing
+function parseWorkNameScope(names, options) {
+    const scope = parseWorkLabelScope(options);
+    if (names.length === 0) {
+        return scope;
+    }
+    if (scope.filterLabels || scope.excludeLabels) {
+        throw new Error('name tasks and services or select them with --filter/--exclude, not both');
+    }
+    return { ...scope, names };
+}
 function parseWorkLabelScope(options) {
     const scope = {
         environmentName: null,
@@ -587,9 +599,9 @@ async function getProgram(environment, argv) {
             }
         });
         program
-            .command('up')
-            .description("start services(s), with the arguments after -- appended to the selected service's cmd")
-            .usage('[options] [-- args...]')
+            .command('up [names...]')
+            .description("start services(s), all or the named tasks and services, with the arguments after -- appended to the selected service's cmd")
+            .usage('[options] [names...] [-- args...]')
             .addOption(new commander_1.Option('-f, --filter <labels...>', 'filter task and services with labels'))
             .addOption(new commander_1.Option('-e, --exclude <labels...>', 'exclude task and services with labels'))
             .addOption(new commander_1.Option('-c, --concurrency <number>', 'parallel worker count (default 4, unbounded when every task and service requests cpus and memory)').argParser(parseInt))
@@ -610,10 +622,10 @@ async function getProgram(environment, argv) {
             .addOption(new commander_1.Option('--timeout <duration>', 'fail tasks without their own timeout after this long (e.g. 10m)').argParser(units_1.parseDuration))
             .addOption(new commander_1.Option('--max-timeout <duration>', 'fail any task after this long, also one with a longer timeout of its own (e.g. 2m)').argParser(units_1.parseDuration))
             .addOption(new commander_1.Option('--network <level>', 'the most any task or service reaches besides its needs: none, open or allow:<host>,<host>').argParser(parseNetworkArgument))
-            .action(async (options, command) => {
+            .action(async (names, options, command) => {
             try {
                 const scope = {
-                    ...parseWorkLabelScope(options),
+                    ...parseWorkNameScope(names, options),
                     args: { values: passthrough, services: true, cache: keepsCache(command) },
                 };
                 const cli = await createCli(fileName, environment, scope);
@@ -646,14 +658,14 @@ async function getProgram(environment, argv) {
             }
         });
         program
-            .command('down')
-            .description('stop services(s)')
+            .command('down [names...]')
+            .description('stop services(s), all or the named services and the services the named tasks need')
             .addOption(new commander_1.Option('-f, --filter <labels...>', 'filter task and services with labels'))
             .addOption(new commander_1.Option('-e, --exclude <labels...>', 'exclude task and services with labels'))
             .addOption(new commander_1.Option('--env <name>', 'environment'))
-            .action(async (options) => {
+            .action(async (names, options) => {
             try {
-                const scope = parseWorkLabelScope(options);
+                const scope = { ...parseWorkNameScope(names, options), stop: true };
                 const cli = await createCli(fileName, environment, scope);
                 const result = await cli.runDown();
                 if (!result.success) {

package/dist/remote/host-config.js

@@ -5,6 +5,7 @@ const path_1 = require("path");
 const zod_1 = require("zod");
 const yaml_1 = require("yaml");
 const get_cache_directory_1 = require("../optimizer/get-cache-directory");
+const build_file_secret_provider_schema_1 = require("../schema/build-file-secret-provider-schema");
 // Names with a meaning of their own in `run.on` / `--on`
 exports.RESERVED_SERVER_NAMES = ['local', 'auto'];
 const serverNamePattern = /^[a-z0-9][a-z0-9._-]*$/i;
@@ -43,6 +44,10 @@ exports.hostConfigSchema = zod_1.z
     servers: zod_1.z.record(exports.hostServerSchema).default({}),
     tokenCommands: zod_1.z.record(tokenCommandSchema).optional(),
     run: zod_1.z.object({ on: zod_1.z.string().optional() }).passthrough().default({}),
+    // how this machine reads secrets, beside what the build files declare (see
+    // collectSecretCatalog); a server reads only its own config
+    secretProviders: build_file_secret_provider_schema_1.buildFileSecretProvidersSchema.optional(),
+    secretAccounts: build_file_secret_provider_schema_1.buildFileSecretAccountsSchema.optional(),
 })
     .passthrough();
 // Names like "constructor" must not find inherited members.

package/dist/remote/remote-work-commands.js

@@ -17,6 +17,22 @@ const units_1 = require("../utils/units");
 const service_tools_1 = require("../harness/service-tools");
 const path_1 = require("path");
 const check_keys_1 = require("../optimizer/check-keys");
+function describeOutcome(planned) {
+    switch (planned.outcome) {
+        case 'published':
+            return 'publishing it would publish it';
+        case 'already published':
+            return planned.yanked ? 'it is published already, and yanked' : 'it is published already';
+        case 'proposed':
+            return planned.missing?.length
+                ? `publishing it would propose it, it names accounts you do not use: ${planned.missing
+                    .map(server_client_1.printable)
+                    .join(', ')}`
+                : 'publishing it would propose it, somebody who may publish approves it';
+        default:
+            return 'the server accepts it, publishing it needs builds: propose or publish';
+    }
+}
 const RUN_ID = /^run_[A-Za-z0-9_-]{16}$/;
 // how a check passed, one line
 function describePassed(passed) {
@@ -136,8 +152,24 @@ function registerWorkCommands(remote, context) {
         .command('publish [server]')
         .description('publish the build file and the files it includes to a server, runs refer to it by its hash')
         .addOption(new commander_1.Option('--annotation <key=value>', 'say more about where it comes from, or leave one out with key=; path, repo, commit, machine and user are filled in').argParser(collectOption))
+        .addOption(new commander_1.Option('--dry-run', "check it against the server's policy and say what publishing would do, without publishing; builds: run is enough"))
         .action(guarded('Remote publish was not successful', async (name, options) => {
         const bundle = await (0, collect_bundle_1.collectBundle)(buildFile, environment);
+        if (options.dryRun) {
+            const { name: serverName, server, token } = await connect(name);
+            const answer = await (0, server_client_1.callServer)(server, token, 'POST', '/v1/definitions/plan', bundle).catch((e) => {
+                throw e instanceof server_client_1.ServerError && e.status === 404
+                    ? new Error(`${serverName} can't check a build file without publishing it, it needs hammerkit 1.27`)
+                    : e;
+            });
+            const planned = answer.body;
+            const files = Object.keys(bundle.files).length;
+            environment.stdout.write(`checked with the policy of ${serverName}: ${(0, server_client_1.printable)(planned.hash)} (${files} ${files === 1 ? 'file' : 'files'}), nothing was published\n`);
+            const names = [...(planned.tasks ?? []), ...(planned.services ?? [])];
+            environment.stdout.write(`tasks and services: ${names.map(server_client_1.printable).join(', ') || 'none'}\n`);
+            environment.stdout.write(`${describeOutcome(planned)}\n`);
+            return;
+        }
         const annotations = (0, annotations_1.applyAnnotations)(await (0, annotations_1.collectAnnotations)(buildFile, Object.keys(bundle.files)), options.annotation ?? []);
         const { name: serverName, server, token } = await connect(name);
         const answer = await (0, server_client_1.callServer)(server, token, 'POST', '/v1/definitions', {

package/dist/schema/build-file-base-task-schema.js

@@ -49,5 +49,8 @@ exports.buildFileBaseTaskSchema = (0, zod_1.object)({
     // Name of the server (see `hammerkit remote`) the task has to run on; defaults
     // to the build file's `runner`. Never a local fallback when it is unknown.
     runner: runner_schema_1.runnerSchema.optional(),
+    // false: a server leaves it out of a published version, for a task only this machine
+    // runs (a dev watcher, a task that mounts the docker socket)
+    publish: (0, zod_1.boolean)().optional(),
 });
 //# sourceMappingURL=build-file-base-task-schema.js.map

package/dist/schema/build-file-container-service-schema.js

@@ -47,6 +47,8 @@ exports.buildFileContainerServiceSchema = (0, zod_1.object)({
     network: network_schema_1.networkSchema.optional(),
     // whether its `cmd` takes the arguments after `--` of `up`: false refuses them
     args: (0, zod_1.boolean)().optional(),
+    // false: a server leaves it out of a published version
+    publish: (0, zod_1.boolean)().optional(),
 })
     .strict()
     .describe('container service');

package/dist/schema/build-file-include-schema.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isGitSource = exports.buildFileIncludeSchema = exports.buildFileGitSourceSchema = void 0;
+exports.isPublished = exports.isGitSource = exports.buildFileIncludeSchema = exports.buildFileLocalSourceSchema = exports.buildFileGitSourceSchema = void 0;
 const zod_1 = require("zod");
 const envs_schema_1 = require("./envs-schema");
 // A repo URL or ref starting with `-` would be read by git as an option
@@ -21,11 +21,25 @@ exports.buildFileGitSourceSchema = (0, zod_1.object)({
     path: (0, zod_1.string)().optional().describe('Build file or directory within the repository'),
     // overrides for the top-level `envs` the included file declares as its inputs
     with: envs_schema_1.envsSchema.optional(),
+    publish: (0, zod_1.boolean)().optional().describe('false: a server leaves out what this file declares'),
 }).strict();
-// A string is a local path; an object is a git source (ADR-0004).
-exports.buildFileIncludeSchema = (0, zod_1.union)([(0, zod_1.string)(), exports.buildFileGitSourceSchema]);
+// A local path, with values for the inputs of the file it names like `with` of a git
+// source (a value may pass on an `envs` value of the including file as `${NAME}`), and
+// whether a server publishes what it declares.
+exports.buildFileLocalSourceSchema = (0, zod_1.object)({
+    path: (0, zod_1.string)().min(1).describe('Build file or directory, relative to the including file'),
+    with: envs_schema_1.envsSchema.optional(),
+    publish: (0, zod_1.boolean)().optional().describe('false: a server leaves out what this file declares'),
+}).strict();
+// A string is a local path; an object is a local path with options, or a git source (ADR-0004).
+exports.buildFileIncludeSchema = (0, zod_1.union)([(0, zod_1.string)(), exports.buildFileLocalSourceSchema, exports.buildFileGitSourceSchema]);
 function isGitSource(include) {
-    return typeof include !== 'string';
+    return typeof include !== 'string' && 'git' in include;
 }
 exports.isGitSource = isGitSource;
+// `publish: false`: what the file declares is left out of a version a server publishes
+function isPublished(include) {
+    return typeof include === 'string' || include.publish !== false;
+}
+exports.isPublished = isPublished;
 //# sourceMappingURL=build-file-include-schema.js.map

package/dist/schema/build-file-kubernetes-service-schema.js

@@ -13,5 +13,7 @@ exports.buildFileKubernetesServiceSchema = (0, zod_1.object)({
     selector: build_file_kubernetes_service_selector_schema_1.buildFileKubernetesServiceSelectorSchema,
     labels: labels_schema_1.labelsSchema.optional(),
     ports: (0, zod_1.array)((0, zod_1.union)([(0, zod_1.string)(), (0, zod_1.number)()])),
+    // false: a server leaves it out of a published version
+    publish: (0, zod_1.boolean)().optional(),
 }).strict();
 //# sourceMappingURL=build-file-kubernetes-service-schema.js.map

package/dist/schema/reference-parser.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.findService = exports.findTask = exports.parseReferences = void 0;
+exports.findService = exports.findTask = exports.parseReferences = exports.getPublishedFiles = void 0;
 const build_file_task_schema_1 = require("./build-file-task-schema");
 const build_file_service_schema_1 = require("./build-file-service-schema");
 const split_name_1 = require("../planner/utils/split-name");
@@ -10,11 +10,59 @@ const merge_environment_variables_1 = require("../environment/merge-environment-
 const resolve_cache_1 = require("../cache/resolve-cache");
 const project_root_1 = require("../planner/project-root");
 const secret_catalog_1 = require("../secrets/secret-catalog");
+const host_config_1 = require("../remote/host-config");
+// The providers and accounts of the host config, see HostSecretDeclarations
+async function readHostSecrets(environment) {
+    const config = await (0, host_config_1.readHostConfig)(environment);
+    return {
+        fileName: (0, host_config_1.getHostConfigPath)(environment),
+        secretProviders: config.secretProviders,
+        secretAccounts: config.secretAccounts,
+    };
+}
+// What a task or service names that a server left out (`publish: false`)
+class UnpublishedError extends Error {
+    constructor(name, reason) {
+        super(`${name} is not published (${reason})`);
+        this.name = name;
+        this.reason = reason;
+    }
+}
+// The task or service `user` names another one by, which a server left out: the error says
+// which published one still needs it, as an error elsewhere is left as it is
+function findPublished(user, verb, find) {
+    try {
+        return find();
+    }
+    catch (e) {
+        if (e instanceof UnpublishedError) {
+            throw new Error(`${user} ${verb} ${e.name}, which is not published (${e.reason})`);
+        }
+        throw e;
+    }
+}
+// The build files a server publishes: the entry file and what it includes or references,
+// except through an include with `publish: false`. The key of each is in ctx.files.
+function getPublishedFiles(mainScope) {
+    const published = new Set([mainScope]);
+    const queue = [mainScope];
+    for (let scope = queue.shift(); scope; scope = queue.shift()) {
+        for (const reference of Object.values(scope.references)) {
+            if (reference.publish && !published.has(reference.scope)) {
+                published.add(reference.scope);
+                queue.push(reference.scope);
+            }
+        }
+    }
+    return published;
+}
+exports.getPublishedFiles = getPublishedFiles;
 function combinePath(namePrefix, name) {
     return namePrefix.length > 0 ? `${namePrefix}:${name}` : name;
 }
 async function parseReferences(ctx, mainScope, environment) {
     const declaredCaches = {};
+    const unpublished = {};
     const reference = {
         files: {},
         tasks: {},
@@ -24,9 +72,28 @@ async function parseReferences(ctx, mainScope, environment) {
         caches: {},
         secrets: (0, secret_catalog_1.emptySecretCatalog)(),
         projectRoot: await (0, project_root_1.findProjectRoot)(mainScope.cwd, environment),
+        unpublished,
+    };
+    // a server leaves out what is not published: it doesn't run, and isn't checked against
+    // its policy. Locally everything is there.
+    const publishedFiles = environment.hosted ? getPublishedFiles(mainScope) : null;
+    const isLeftOut = (file, name, schema) => {
+        if (!publishedFiles) {
+            return false;
+        }
+        if (!publishedFiles.has(file)) {
+            unpublished[name] = 'its build file is included with publish: false';
+        }
+        else if (schema.publish === false) {
+            unpublished[name] = 'publish: false';
+        }
+        return name in unpublished;
     };
     for (const file of Object.values(ctx.files)) {
-        if (environment.hosted && (file.schema.secretProviders || file.schema.secretAccounts)) {
+        // what a server leaves out of a file it doesn't publish: its tasks and services (see
+        // isLeftOut), and where it would run or store things, which only a local run reads
+        const published = !publishedFiles || publishedFiles.has(file);
+        if (published && environment.hosted && (file.schema.secretProviders || file.schema.secretAccounts)) {
             throw new Error(`${file.fileName} declares secret providers or accounts, which a server defines in its own config`);
         }
         if (!reference.envFiles[file.cwd]) {
@@ -38,6 +105,9 @@ async function parseReferences(ctx, mainScope, environment) {
             for (const [taskName, task] of Object.entries(file.schema.tasks)) {
                 const taskEnvs = (0, merge_environment_variables_1.mergeEnvironmentVariables)(task.envs, buildFileEnvs);
                 const relativeName = combinePath(file.namePrefix, taskName);
+                if (isLeftOut(file, relativeName, task)) {
+                    continue;
+                }
                 reference.tasks[relativeName] = {
                     type: 'task',
                     schema: task,
@@ -51,7 +121,7 @@ async function parseReferences(ctx, mainScope, environment) {
                 };
             }
         }
-        if (file.schema.environments) {
+        if (file.schema.environments && published) {
             for (const [envName, env] of Object.entries(file.schema.environments)) {
                 reference.environments[envName] = {
                     type: 'environment',
@@ -61,7 +131,7 @@ async function parseReferences(ctx, mainScope, environment) {
                 };
             }
         }
-        if (file.schema.caches) {
+        if (file.schema.caches && published) {
             for (const [cacheName, cache] of Object.entries(file.schema.caches)) {
                 declaredCaches[cacheName] = cache;
             }
@@ -69,6 +139,9 @@ async function parseReferences(ctx, mainScope, environment) {
         if (file.schema.services) {
             for (const [serviceName, service] of Object.entries(file.schema.services)) {
                 const relativeName = combinePath(file.namePrefix, serviceName);
+                if (isLeftOut(file, relativeName, service)) {
+                    continue;
+                }
                 const serviceEnvs = (0, merge_environment_variables_1.mergeEnvironmentVariables)((0, build_file_service_schema_1.isBuildFileKubernetesServiceSchema)(service) ? {} : service.envs, buildFileEnvs);
                 reference.services[relativeName] = {
                     type: 'service',
@@ -98,7 +171,7 @@ async function parseReferences(ctx, mainScope, environment) {
     reference.caches = (0, resolve_cache_1.withBuiltinCaches)(declaredCaches);
     reference.secrets = environment.hosted
         ? { ...environment.hosted.catalog, explicitAccounts: true }
-        : (0, secret_catalog_1.collectSecretCatalog)(Object.values(ctx.files), environment, reference);
+        : (0, secret_catalog_1.collectSecretCatalog)(Object.values(ctx.files), environment, reference, await readHostSecrets(environment));
     return reference;
 }
 exports.parseReferences = parseReferences;
@@ -122,7 +195,8 @@ function applySchemaExtension(reference, task) {
         task.extension = 'applied';
         return;
     }
-    const extend = findTask(reference, task.scope, task.schema.extend, null).task;
+    const name = task.schema.extend;
+    const extend = findPublished(task.relativeName, 'extends', () => findTask(reference, task.scope, name, null)).task;
     applySchemaExtension(reference, extend);
     task.schema.shell = task.schema.shell ?? extend.schema.shell;
     task.schema.cache = task.schema.cache ?? extend.schema.cache;
@@ -182,7 +256,7 @@ function extendObject(base, extend) {
 }
 function resolveDeps(reference, taskOrService, scope, schema) {
     for (const depName of schema.deps || []) {
-        const depTask = findTask(reference, scope, depName, null);
+        const depTask = findPublished(taskOrService.relativeName, 'depends on', () => findTask(reference, scope, depName, null));
         taskOrService.deps.push({
             task: depTask.task,
             type: depTask.type,
@@ -195,7 +269,8 @@ function resolveInit(reference, service) {
     if ((0, build_file_service_schema_1.isBuildFileKubernetesServiceSchema)(service.schema) || !service.schema.init) {
         return;
     }
-    const initTask = findTask(reference, service.scope, service.schema.init, null);
+    const init = service.schema.init;
+    const initTask = findPublished(service.relativeName, 'runs as init', () => findTask(reference, service.scope, init, null));
     service.init = {
         task: initTask.task,
         type: initTask.type,
@@ -213,13 +288,13 @@ function resolveNeeds(reference, taskOrService, scope, schema) {
                 // the host name it is reached by: a service of an include, `services:postgres`, as
                 // `services-postgres`, since Docker and DNS take no colon
                 relativeName: needName.replace(/:/g, '-'),
-                service: findService(reference, scope, needName),
+                service: findPublished(taskOrService.relativeName, 'needs', () => findService(reference, scope, needName)),
             });
         }
         else {
             taskOrService.needs.push({
                 relativeName: needName.name,
-                service: findService(reference, scope, needName.service),
+                service: findPublished(taskOrService.relativeName, 'needs', () => findService(reference, scope, needName.service)),
             });
         }
     }
@@ -230,6 +305,7 @@ function resolveNeeds(reference, taskOrService, scope, schema) {
     }
 }
 function findTask(ctx, scope, name, type) {
+    refuseNotFetched(scope, name);
     const ref = (0, split_name_1.splitName)(name);
     if (ref.prefix) {
         if (scope.references[ref.prefix]) {
@@ -245,15 +321,25 @@ function findTask(ctx, scope, name, type) {
     throw new Error('unable to find ' + name); // TODO improve
 }
 exports.findTask = findTask;
+// A name in a git source a server did not fetch, since it is left out
+function refuseNotFetched(scope, name) {
+    if (scope.notFetched) {
+        throw new UnpublishedError(combinePath(scope.namePrefix, name), 'its build file is included with publish: false');
+    }
+}
 function resolveTask(ctx, scope, name, type) {
     const fullName = combinePath(scope.namePrefix, name);
     const buildFileTask = ctx.tasks[fullName];
+    if (!buildFileTask && ctx.unpublished?.[fullName]) {
+        throw new UnpublishedError(fullName, ctx.unpublished[fullName]);
+    }
     if (!buildFileTask) {
         throw new Error('unable to find ' + fullName);
     }
     return { task: buildFileTask, type };
 }
 function findService(ctx, scope, name) {
+    refuseNotFetched(scope, name);
     const ref = (0, split_name_1.splitName)(name);
     if (ref.prefix) {
         if (scope.references[ref.prefix]) {
@@ -272,6 +358,9 @@ exports.findService = findService;
 function resolveService(ctx, scope, name) {
     const fullName = combinePath(scope.namePrefix, name);
     const service = ctx.services[fullName];
+    if (!service && ctx.unpublished?.[fullName]) {
+        throw new UnpublishedError(fullName, ctx.unpublished[fullName]);
+    }
     if (!service) {
         throw new Error('unable to find ' + fullName);
     }

package/dist/schema/schema-parser.js

@@ -13,60 +13,79 @@ async function createParseContext(fileName, environment, options) {
         files: {},
         refreshed: options?.refresh ? new Map() : undefined,
         directory: options?.directory,
+        checkGitSource: options?.checkGitSource,
     };
     const scope = await appendBuildFile(workDirectory(ctx, (0, path_1.dirname)(fileName)), ctx, environment, fileName, []);
     return { ctx, scope };
 }
 exports.createParseContext = createParseContext;
-async function appendBuildFile(cwd, ctx, environment, fileName, namePrefix, remote, inputs) {
+async function appendBuildFile(cwd, ctx, environment, fileName, namePrefix, remote, inputs, 
+// on a server: the file is included with `publish: false`, or below such an include
+leftOut = false) {
     const relativeName = namePrefix.join(':');
-    // the same file included with other inputs is another set of tasks
-    const key = inputs ? `${cwd}:${fileName}:${JSON.stringify(inputs)}` : `${cwd}:${fileName}`;
+    // the same file included with other inputs is another set of tasks, and on a server a
+    // file left out is another one than the same file published (its git sources differ)
+    const key = `${cwd}:${fileName}${inputs ? `:${JSON.stringify(inputs)}` : ''}${leftOut ? ':left-out' : ''}`;
     if (ctx.files[key]) {
         return ctx.files[key];
     }
     const input = await (0, read_build_file_1.read)(fileName, environment);
     const result = await build_file_schema_1.buildFileSchema.safeParseAsync(input);
-    if (result.success) {
-        const scope = {
-            fileName,
-            cwd,
-            schema: inputs ? applyInputs(result.data, inputs, namePrefix, fileName) : result.data,
-            namePrefix: relativeName,
-            remote,
-            inputs,
-            references: {},
-        };
-        ctx.files[key] = scope;
-        if (scope.schema.references) {
-            for (const referenceName of Object.keys(scope.schema.references)) {
-                const target = await locateInclude(ctx, scope, scope.schema.references[referenceName], 
-                // a remote file's paths resolve within its repository
-                remote ? (0, path_1.dirname)(scope.fileName) : readDirectory(ctx, scope.cwd), environment);
-                const referenceScope = await appendBuildFile(workDirectory(ctx, (0, path_1.dirname)(target.fileName)), ctx, environment, target.fileName, [...namePrefix, referenceName], target.remote, target.inputs);
-                if (scope.references[referenceName]) {
-                    throw new Error(referenceName + ' already exists');
-                }
-                scope.references[referenceName] = { type: 'reference', scope: referenceScope };
+    if (!result.success) {
+        throw new parse_error_1.ParseError(result.error, fileName);
+    }
+    const scope = {
+        fileName,
+        cwd,
+        schema: inputs ? applyInputs(result.data, inputs, namePrefix, fileName) : result.data,
+        namePrefix: relativeName,
+        remote,
+        inputs,
+        references: {},
+    };
+    ctx.files[key] = scope;
+    for (const block of ['references', 'includes']) {
+        for (const [name, include] of Object.entries(scope.schema[block] ?? {})) {
+            if (scope.references[name]) {
+                throw new Error(name + ' already exists');
             }
-        }
-        if (scope.schema.includes) {
-            for (const includeName of Object.keys(scope.schema.includes)) {
-                const target = await locateInclude(ctx, scope, scope.schema.includes[includeName], (0, path_1.dirname)(scope.fileName), environment);
-                const includeScope = await appendBuildFile(cwd, ctx, environment, target.fileName, [...namePrefix, includeName], target.remote, target.inputs);
-                if (scope.references[includeName]) {
-                    throw new Error(includeName + ' already exists');
-                }
-                scope.references[includeName] = { type: 'include', scope: includeScope };
+            const publish = (0, build_file_include_schema_1.isPublished)(include);
+            const type = block === 'references' ? 'reference' : 'include';
+            // a server does not fetch what it leaves out: it doesn't run, and isn't checked
+            const leaveOut = !!environment.hosted && (leftOut || !publish);
+            if ((0, build_file_include_schema_1.isGitSource)(include) && leaveOut) {
+                scope.references[name] = { type, publish, scope: notFetched(cwd, [...namePrefix, name], include) };
+                continue;
             }
+            if ((0, build_file_include_schema_1.isGitSource)(include)) {
+                ctx.checkGitSource?.(include, scope, block, name);
+            }
+            const target = await locateInclude(ctx, scope, include, block === 'references'
+                ? // a remote file's paths resolve within its repository
+                    remote
+                        ? (0, path_1.dirname)(scope.fileName)
+                        : readDirectory(ctx, scope.cwd)
+                : (0, path_1.dirname)(scope.fileName), environment);
+            const targetScope = await appendBuildFile(
+            // a reference works in its own directory, an include in the one of the including file
+            block === 'references' ? workDirectory(ctx, (0, path_1.dirname)(target.fileName)) : cwd, ctx, environment, target.fileName, [...namePrefix, name], target.remote, target.inputs, leaveOut);
+            scope.references[name] = { type, scope: targetScope, publish };
         }
-        return scope;
-    }
-    else {
-        throw new parse_error_1.ParseError(result.error, fileName);
     }
+    return scope;
 }
 exports.appendBuildFile = appendBuildFile;
+// The scope of a git source a server does not fetch, see ParseScope.notFetched
+function notFetched(cwd, namePrefix, include) {
+    return {
+        fileName: `${include.git}${include.path ? ` ${include.path}` : ''}`,
+        cwd,
+        schema: {},
+        namePrefix: namePrefix.join(':'),
+        references: {},
+        notFetched: true,
+    };
+}
 // The directory a build file works in, for the directory it was read from: the same
 // one, unless the files were read from elsewhere (see BuildFileDirectory).
 function workDirectory(ctx, directory) {
@@ -89,13 +108,45 @@ async function locateInclude(ctx, scope, include, base, environment) {
         if (!(0, resolve_git_source_1.isWithin)(remote.root, path)) {
             throw new Error(`${include.path} in ${include.git} points outside the repository`);
         }
-        return { fileName: await (0, default_build_file_1.getBuildFilename)(path, environment), remote, inputs: include.with };
+        return { fileName: await (0, default_build_file_1.getBuildFilename)(path, environment), remote, inputs: passEnvs(include.with, scope) };
     }
-    const path = (0, path_1.join)(base, include);
+    const localPath = typeof include === 'string' ? include : include.path;
+    const path = (0, path_1.join)(base, localPath);
     if (scope.remote && !(0, resolve_git_source_1.isWithin)(scope.remote.root, path)) {
-        throw new Error(`${include} in ${scope.fileName} points outside ${scope.remote.git}`);
+        throw new Error(`${localPath} in ${scope.fileName} points outside ${scope.remote.git}`);
+    }
+    const inputs = typeof include === 'string' ? undefined : passEnvs(include.with, scope);
+    return { fileName: await (0, default_build_file_1.getBuildFilename)(path, environment), remote: scope.remote, inputs };
+}
+// `${NAME}` (or `${NAME:-default}`) in a `with` value reads as it does in the including
+// file: the environment or a `.env` file first, then that file's own `envs` value. So one
+// file holds a value such as NODE_VERSION for all it includes, and CI can still set it. A
+// name the file does not declare is left to the included file, which reads it the same way.
+function passEnvs(inputs, scope) {
+    if (!inputs) {
+        return undefined;
+    }
+    const envs = scope.schema.envs ?? {};
+    const result = {};
+    for (const [key, value] of Object.entries(inputs)) {
+        result[key] =
+            typeof value === 'string'
+                ? value.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-([^}]*))?\}/g, (match, name, fallback) => name in envs ? passEnv(name, `${envs[name]}`, fallback) : match)
+                : value;
+    }
+    return result;
+}
+// The including file's value as an interpolation the included file resolves in the same
+// order. A value built from other variables is passed on as it is written.
+function passEnv(name, value, fallback) {
+    const reference = /^\$([A-Za-z_][A-Za-z0-9_]*)$/.exec(value);
+    if (reference) {
+        return fallback === undefined ? `\${${reference[1]}}` : `\${${reference[1]}:-${fallback}}`;
+    }
+    if (value.includes('$') || value.includes('}')) {
+        return value;
     }
-    return { fileName: await (0, default_build_file_1.getBuildFilename)(path, environment), remote: scope.remote };
+    return `\${${name}:-${value}}`;
 }
 // `includes pull` fetches each source once, however often the build files name it.
 async function resolveRemote(ctx, source, environment) {

package/dist/schema/work-scope-parser.js

@@ -47,19 +47,27 @@ function getWorkContext(context, scope, environment) {
     // its init task's need on it, which narrowing follows
     const tasks = Object.values(context.tasks).map((task) => (0, append_work_task_1.appendWorkTask)(workTree, task.cwd, task, environment, context));
     const services = Object.values(context.services).map((service) => (0, append_work_service_1.appendWorkService)(workTree, service, environment, context));
+    const apply = { servicesAlone: !(0, work_scope_1.isContextTaskFilter)(scope) && !!scope.names && !!scope.stop };
     const selectedTasks = [];
     const selectedServices = [];
     for (const item of tasks) {
         if (matchesTaskWorkScope(item, scope)) {
             requested.push(item.name);
             selectedTasks.push(item.data);
-            applyTask(filteredWorkTree, item);
+            applyTask(filteredWorkTree, item, apply);
         }
     }
     for (const item of services) {
         if (matchesServiceWorkScope(item.data, scope)) {
             selectedServices.push(item.data);
-            applyService(filteredWorkTree, item);
+            applyService(filteredWorkTree, item, apply);
+        }
+    }
+    if (!(0, work_scope_1.isContextTaskFilter)(scope) && scope.names) {
+        const known = new Set([...tasks.map((task) => task.name), ...services.map((service) => service.data.name)]);
+        const unknown = scope.names.filter((name) => !known.has(name));
+        if (unknown.length > 0) {
+            throw new Error(`no task or service named ${unknown.join(', ')}, see hammerkit ls`);
         }
     }
     if (scope.args) {
@@ -86,31 +94,34 @@ function keepRequirersInScope(workTree) {
         }
     }
 }
-function applyTask(workTree, item) {
+function applyTask(workTree, item, options) {
     if (workTree.tasks[item.name]) {
         return;
     }
     workTree.tasks[item.name] = item;
-    applyNeedsAndDeps(workTree, item);
+    applyNeedsAndDeps(workTree, item, options);
 }
-function applyService(workTree, need) {
+function applyService(workTree, need, options) {
     const item = (0, append_work_service_1.getPlannedService)(need);
     if (workTree.services[item.name]) {
         return;
     }
     workTree.services[item.name] = item;
-    applyNeedsAndDeps(workTree, item);
+    if (options.servicesAlone) {
+        return;
+    }
+    applyNeedsAndDeps(workTree, item, options);
     // a service in the run brings its init task, which runs once it is healthy
     if (item.data.type === 'container-service' && item.data.init) {
-        applyTask(workTree, item.data.init.task);
+        applyTask(workTree, item.data.init.task, options);
     }
 }
-function applyNeedsAndDeps(workTree, item) {
+function applyNeedsAndDeps(workTree, item, options) {
     for (const dep of item.deps) {
-        applyTask(workTree, dep);
+        applyTask(workTree, dep, options);
     }
     for (const need of item.needs) {
-        applyService(workTree, need.service);
+        applyService(workTree, need.service, options);
     }
 }
 function matchesTaskWorkScope(task, scope) {
@@ -120,6 +131,9 @@ function matchesTaskWorkScope(task, scope) {
     if (scope.serviceNames) {
         return false;
     }
+    if (scope.names) {
+        return scope.names.includes(task.name);
+    }
     return (0, label_values_1.appliesToLabels)(task.data.labels, scope);
 }
 function matchesServiceWorkScope(service, scope) {
@@ -129,6 +143,9 @@ function matchesServiceWorkScope(service, scope) {
     if (scope.serviceNames) {
         return scope.serviceNames.includes(service.name);
     }
+    if (scope.names) {
+        return scope.names.includes(service.name);
+    }
     return (0, label_values_1.appliesToLabels)(service.labels, scope);
 }
 //# sourceMappingURL=work-scope-parser.js.map

package/dist/secrets/command-secret-provider.js

@@ -150,9 +150,11 @@ function candidates(command, path) {
             .map((dir) => (0, path_1.resolve)(dir, command));
     return bases.flatMap((base) => extensions.map((extension) => base + extension));
 }
+// bigint: a Windows file id has more digits than a number keeps, and two files whose ids
+// round to the same number would be the same file
 function statOf(path) {
     try {
-        const stat = (0, fs_1.statSync)(path);
+        const stat = (0, fs_1.statSync)(path, { bigint: true });
         return stat.isFile() ? stat : null;
     }
     catch {

package/dist/secrets/secret-catalog.js

@@ -11,10 +11,12 @@ function emptySecretCatalog() {
 exports.emptySecretCatalog = emptySecretCatalog;
 const FULL_COMMIT = /^[0-9a-f]{40}$/i;
 // Providers and accounts are global names, like caches, collected from every
-// loaded build file. A name declared twice is an error rather than a silent
-// override: which definition runs with a service account's credential must not
-// depend on include order.
-function collectSecretCatalog(files, environment, context) {
+// loaded build file. A name declared twice is an error rather than a silent override:
+// which definition runs with a service account's credential must not depend on include
+// order. The host config then replaces what the build files declare, name by name (and
+// its default account replaces theirs): the machine that runs a task says how it reads
+// secrets, and a build file that still declares them loads as it is.
+function collectSecretCatalog(files, environment, context, host) {
     const catalog = emptySecretCatalog();
     for (const file of files) {
         const providers = Object.entries(file.schema.secretProviders ?? {});
@@ -28,25 +30,13 @@ function collectSecretCatalog(files, environment, context) {
             if (catalog.providers[name]) {
                 throw new Error(`secret provider ${name} is declared in ${catalog.providers[name].declaredIn} and in ${file.fileName}`);
             }
-            catalog.providers[name] = {
-                name,
-                type: 'command',
-                command: provider.command.map((part) => applyEnvs(part, envs)),
-                env: provider.env ?? {},
-                timeoutMs: (0, units_1.parseDuration)(provider.timeout ?? DEFAULT_TIMEOUT),
-                declaredIn: file.fileName,
-            };
+            catalog.providers[name] = toProvider(name, provider, envs, file.fileName);
         }
         for (const [name, account] of accounts) {
             if (catalog.accounts[name]) {
                 throw new Error(`secret account ${name} is declared in ${catalog.accounts[name].declaredIn} and in ${file.fileName}`);
             }
-            catalog.accounts[name] = {
-                name,
-                default: account.default ?? false,
-                providers: account.providers,
-                declaredIn: file.fileName,
-            };
+            catalog.accounts[name] = toAccount(name, account, file.fileName);
         }
     }
     const defaults = Object.values(catalog.accounts).filter((account) => account.default);
@@ -55,14 +45,48 @@ function collectSecretCatalog(files, environment, context) {
     }
     for (const account of Object.values(catalog.accounts)) {
         for (const provider of Object.keys(account.providers)) {
-            if (!catalog.providers[provider]) {
+            if (!catalog.providers[provider] && !host?.secretProviders?.[provider]) {
                 throw new Error(`secret account ${account.name} (${account.declaredIn}) names provider ${provider}, which is not declared`);
             }
         }
     }
+    if (host) {
+        // the host config has no envs of its own: `${NAME}` is read from the process
+        for (const [name, provider] of Object.entries(host.secretProviders ?? {})) {
+            catalog.providers[name] = toProvider(name, provider, {}, host.fileName);
+        }
+        const accounts = Object.entries(host.secretAccounts ?? {});
+        const hostDefaults = accounts.filter(([, account]) => account.default);
+        if (hostDefaults.length > 1) {
+            throw new Error(`more than one default secret account: ${hostDefaults.map(([name]) => name).join(', ')} (${host.fileName})`);
+        }
+        if (hostDefaults.length > 0) {
+            for (const account of Object.values(catalog.accounts)) {
+                account.default = false;
+            }
+        }
+        // a provider an account of the host names is only checked when a secret uses it:
+        // a project that doesn't declare it, and reads no secret, loads anyway
+        for (const [name, account] of accounts) {
+            catalog.accounts[name] = toAccount(name, account, host.fileName);
+        }
+    }
     return catalog;
 }
 exports.collectSecretCatalog = collectSecretCatalog;
+function toProvider(name, provider, envs, declaredIn) {
+    return {
+        name,
+        type: 'command',
+        command: provider.command.map((part) => applyEnvs(part, envs)),
+        env: provider.env ?? {},
+        timeoutMs: (0, units_1.parseDuration)(provider.timeout ?? DEFAULT_TIMEOUT),
+        declaredIn,
+    };
+}
+function toAccount(name, account, declaredIn) {
+    return { name, default: account.default ?? false, providers: account.providers, declaredIn };
+}
 // A tag or branch can be moved, and a moved file runs with the credentials of a
 // service account: providers and accounts from a git include are pinned.
 function requirePinnedSource(file) {

package/dist/server/definitions-api.js

@@ -23,10 +23,22 @@ const MAX_PUBLISH_BYTES = bundle_1.MAX_BUNDLE_BYTES * 2;
  *   GET  /v1/definitions/<hash>          one version, with `arguments`: per task null when
  *                                        a run of it may pass arguments, else why not
  *   GET  /v1/definitions/<hash>/files    its files
+ *   POST /v1/definitions/plan            what publishing a bundle would do: plans it with this
+ *                                        server's policy and stores nothing. For anybody with
+ *                                        a `builds` level, `run` too
  *   POST /v1/definitions/<hash>/yank     pull it back (body: optional {reason})
  *   POST /v1/definitions/<hash>/unyank   let it go on
  */
 async function handleDefinitions(config, store, proposals, log, principal, req, res, url) {
+    if (url.pathname === '/v1/definitions/plan') {
+        if (req.method !== 'POST') {
+            (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: 'POST' });
+        }
+        else {
+            await plan(config, store, log, principal, req, res);
+        }
+        return true;
+    }
     const match = /^\/v1\/definitions(?:\/([^/]+)(\/files|\/yank|\/unyank)?)?$/.exec(url.pathname);
     if (!match) {
         return false;
@@ -124,6 +136,55 @@ async function yank(config, store, log, principal, hash, undo, req, res) {
     log(`${undo ? 'unyank' : 'yank'} ${hash} iss=${principal.iss} sub=${principal.sub}${body.data.reason ? ` reason=${(0, oauth_1.quote)(body.data.reason)}` : ''}`);
     (0, http_1.send)(res, 200, changed);
 }
+// Answers what POST /v1/definitions would: the version with its plan, and whether the
+// caller would publish or propose it. A developer checks a build file against the policy
+// before the account that publishes does. Nothing is stored, nothing is logged but the call.
+async function plan(config, store, log, principal, req, res) {
+    const grant = (0, policy_1.getGrant)(config.entitlements, principal);
+    if (grant.builds === null) {
+        (0, http_1.send)(res, 403, { error: 'you may not check build files, it needs builds: run, propose or publish' });
+        return;
+    }
+    const parsed = bundle_1.bundleSchema.safeParse(await (0, http_1.readJson)(req, MAX_PUBLISH_BYTES));
+    if (!parsed.success) {
+        const issue = parsed.error.issues[0];
+        (0, http_1.send)(res, 400, { error: `${issue.path.join('.') || 'request'}: ${issue.message}` });
+        return;
+    }
+    try {
+        // like a proposal: a caller who may not publish does not make the server fetch
+        const { version, existing } = await store.prepare(parsed.data, principal, {
+            noRemote: (0, policy_1.mayPublish)(grant) ? undefined : 'check',
+        });
+        const missing = (version.accounts ?? []).filter((account) => !(0, policy_1.canUse)(grant, account));
+        const outcome = existing
+            ? 'already published'
+            : (0, policy_1.mayPublish)(grant) && missing.length === 0
+                ? 'published'
+                : (0, policy_1.mayPublish)(grant) || (0, policy_1.mayPropose)(grant)
+                    ? 'proposed'
+                    : null;
+        log(`plan ${version.hash} iss=${principal.iss} sub=${principal.sub} tasks=${version.tasks.length}`);
+        (0, http_1.send)(res, 200, {
+            hash: version.hash,
+            tasks: version.tasks,
+            services: version.services,
+            plan: version.plan,
+            accounts: version.accounts,
+            outcome,
+            // a yanked version is not checked again: it is the one that was published
+            ...(existing?.yanked ? { yanked: true } : {}),
+            ...(missing.length > 0 ? { missing } : {}),
+        });
+    }
+    catch (e) {
+        if (e instanceof definitions_1.DefinitionError) {
+            (0, http_1.send)(res, 400, { error: `the build file does not load: ${e.message}` });
+            return;
+        }
+        throw e;
+    }
+}
 async function publish(config, store, proposals, log, principal, req, res) {
     const grant = (0, policy_1.getGrant)(config.entitlements, principal);
     if (!(0, policy_1.mayPublish)(grant) && !(0, policy_1.mayPropose)(grant)) {
@@ -151,7 +212,7 @@ async function publish(config, store, proposals, log, principal, req, res) {
         // a version can't run before it is approved, but it has to load, as it would
         // have when published, so the approver is not asked about a broken one
         const { version, existing } = await store.prepare(parsed.data, principal, {
-            noRemote: !(0, policy_1.mayPublish)(grant),
+            noRemote: (0, policy_1.mayPublish)(grant) ? undefined : 'proposal',
             annotations,
         });
         if (existing) {

package/dist/server/plan.js

@@ -40,50 +40,33 @@ const COMMIT_PATTERN = /^[0-9a-f]{40}([0-9a-f]{24})?$/i;
 // A hash alone can only name what is inside the bundle, so everything a build
 // file pulls in from elsewhere has to be pinned: a git include needs a commit
 // and a remote that is not a path on the server.
-function findLooseIncludes(bundle, noRemote = false) {
+function checkGitSource(path, where, source, noRemote) {
+    if (noRemote === 'proposal') {
+        throw new DefinitionError(`${path}: ${where}: a proposal may not include from git, the server would fetch it before anybody approved it`);
+    }
+    if (noRemote === 'check') {
+        throw new DefinitionError(`${path}: ${where}: checking a build file that includes from git needs builds: publish, the server would fetch it`);
+    }
     const problems = [];
-    for (const [path, content] of Object.entries(bundle.files)) {
-        if (!/\.ya?ml$/i.test(path)) {
-            continue;
-        }
-        let document;
-        try {
-            document = (0, yaml_1.parse)(content);
-        }
-        catch {
-            continue; // a file that isn't valid yaml is reported when the bundle is parsed
-        }
-        for (const block of ['includes', 'references']) {
-            for (const [name, include] of Object.entries(document?.[block] ?? {})) {
-                const source = include;
-                if (!source || typeof source !== 'object' || source.git === undefined) {
-                    continue;
-                }
-                if (noRemote) {
-                    problems.push(`${path}: ${block}.${name}: a proposal may not include from git, the server would fetch it before anybody approved it`);
-                    continue;
-                }
-                if (typeof source.git !== 'string' || !/^(https:\/\/|ssh:\/\/|git@[\w.-]+:)/.test(source.git)) {
-                    problems.push(`${path}: ${block}.${name}: git has to be an https:// or ssh:// address`);
-                }
-                if (typeof source.ref !== 'string' || !COMMIT_PATTERN.test(source.ref)) {
-                    problems.push(`${path}: ${block}.${name}: pin ref to a commit, a branch or tag can move`);
-                }
-            }
-        }
+    if (!/^(https:\/\/|ssh:\/\/|git@[\w.-]+:)/.test(source.git)) {
+        problems.push(`${path}: ${where}: git has to be an https:// or ssh:// address`);
+    }
+    if (typeof source.ref !== 'string' || !COMMIT_PATTERN.test(source.ref)) {
+        problems.push(`${path}: ${where}: pin ref to a commit, a branch or tag can move`);
+    }
+    if (problems.length > 0) {
+        throw new DefinitionError(problems.join('\n'));
     }
-    return problems;
 }
 // What a build file may not name on a server: the places it would run or store things
 // are the operator's. The docker host, a Kubernetes cluster and a remote cache are
 // credentials of the machine, not of the build file, and a project file that could carry
 // them could send runs, or the cache, anywhere.
-function findHostProblems(bundle) {
+// A file a server leaves out (`publish: false`) is not checked, and neither is a service
+// with `publish: false`: what is left out is never run there.
+function findHostProblems(files) {
     const problems = [];
-    for (const [path, content] of Object.entries(bundle.files)) {
-        if (!/\.ya?ml$/i.test(path)) {
-            continue;
-        }
+    for (const [path, content] of Object.entries(files)) {
         let document;
         try {
             document = (0, yaml_1.parse)(content);
@@ -105,6 +88,7 @@ function findHostProblems(bundle) {
         for (const [name, service] of Object.entries(document.services ?? {})) {
             if (service &&
                 typeof service === 'object' &&
+                service.publish !== false &&
                 ('selector' in service || 'kubeconfig' in service || 'context' in service)) {
                 problems.push(`${path}: services.${name}: Kubernetes services are not supported on a server`);
             }
@@ -112,6 +96,17 @@ function findHostProblems(bundle) {
     }
     return problems;
 }
+// The files of the bundle a server publishes, see getPublishedFiles
+function publishedBundleFiles(bundle, directory, entry) {
+    const files = {};
+    for (const scope of (0, reference_parser_1.getPublishedFiles)(entry)) {
+        const path = (0, path_1.relative)(directory, scope.fileName).split(path_1.sep).join('/');
+        if (!scope.remote && path in bundle.files) {
+            files[path] = bundle.files[path];
+        }
+    }
+    return files;
+}
 // What a build file may read while it is inspected: its own files. The rest of
 // the server is not its business (a missing file is "not there", not an error).
 function confined(files, root) {
@@ -342,10 +337,6 @@ function describeFailure(e) {
 // when somebody wants to run it. The same function answers what a run will do,
 // with the scope of the run: which tasks, services and accounts it involves.
 async function planBundle(bundle, environment, options = {}) {
-    const problems = [...findLooseIncludes(bundle, options.noRemote), ...(options.policy ? findHostProblems(bundle) : [])];
-    if (problems.length > 0) {
-        throw new DefinitionError(problems.join('\n'));
-    }
     const directory = await (0, promises_1.mkdtemp)((0, path_1.join)((0, os_1.tmpdir)(), 'hammerkit-definition-'));
     try {
         for (const [path, content] of Object.entries(bundle.files)) {
@@ -358,7 +349,20 @@ async function planBundle(bundle, environment, options = {}) {
             file: confined((0, get_file_context_1.getFileContext)(directory), directory),
         };
         try {
-            const { ctx, scope } = await (0, schema_parser_1.createParseContext)((0, path_1.join)(directory, bundle.entry), inspected);
+            const { ctx, scope } = await (0, schema_parser_1.createParseContext)((0, path_1.join)(directory, bundle.entry), inspected, {
+                // a hash alone can only name what is inside the bundle, see checkGitSource
+                checkGitSource: (source, from, block, name) => checkGitSource(
+                // a file of a git include is named by its repository
+                from.remote
+                    ? `${from.remote.git} ${(0, path_1.relative)(from.remote.root, from.fileName).split(path_1.sep).join('/')}`
+                    : (0, path_1.relative)(directory, from.fileName), `${block}.${name}`, source, options.noRemote),
+            });
+            if (options.policy) {
+                const problems = findHostProblems(publishedBundleFiles(bundle, directory, scope));
+                if (problems.length > 0) {
+                    throw new DefinitionError(problems.join('\n'));
+                }
+            }
             const context = await (0, reference_parser_1.parseReferences)(ctx, scope, inspected);
             const workTree = (0, work_scope_parser_1.getWorkContext)(context, options.scope ?? { environmentName: null }, inspected);
             const items = itemsOf(workTree);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hammerkit",
   "description": "Containerized build tool with incremental caching that runs the same build file locally, in Docker and on Kubernetes.",
-  "version": "1.27.0-next.20",
+  "version": "1.27.0-next.22",
   "keywords": [
     "build",
     "build-tool",