hammerkit 1.27.0-next.8 → 2.0.0-next.1

package/dist/planner/utils/append-work-service.js

@@ -118,6 +118,7 @@ function parseService(workTree, service, environment, context) {
             secrets: (0, work_secret_1.parseWorkSecrets)(service.cwd, context.projectRoot, service.schema.secrets, envs, environment, context.secrets, service.schema.account),
             resources: (0, work_resources_1.parseWorkResources)(service.schema.resources),
             volumeSize: service.schema.volumeSize ?? null,
+            restarts: service.schema.restarts ?? null,
             network: (0, work_network_1.parseWorkNetwork)(service.schema.network),
             networkCeiling: null,
             args: service.schema.args ?? null,
@@ -143,7 +144,11 @@ function appendServiceInit(workTree, service, item, environment, context) {
         task.needs[selfNeed] = { name: task.needs[selfNeed].name, service: view };
     }
     else {
-        task.needs.push({ name: item.name, service: view });
+        const name = getInitNeedName(service);
+        if (task.needs.some((need) => need.name === name)) {
+            throw new Error(`${task.name} needs two services as ${name}, give one another name with name:`);
+        }
+        task.needs.push({ name, service: view });
     }
     removeRequirer(item, task.name);
     // explicit, so neither the default method nor `--cache` turns it back on
@@ -153,6 +158,18 @@ function appendServiceInit(workTree, service, item, environment, context) {
     }
     item.data.init = { task, state };
 }
+// The host name the init reaches its service by: the name its task declares the
+// need by, else the service's name in its own build file. Planning the task
+// skips that need (it is the init's), and the full name of a service of an
+// include, `services:db`, is no host name: Docker and DNS take no colon.
+function getInitNeedName(service) {
+    const declared = service.init?.task.needs.find((need) => need.service.relativeName === service.relativeName);
+    if (declared) {
+        return declared.relativeName;
+    }
+    const prefix = service.scope.namePrefix;
+    return prefix.length > 0 ? service.relativeName.slice(prefix.length + 1) : service.relativeName;
+}
 const initViews = new WeakMap();
 // The service itself for the view its init task needs, else the item.
 function getPlannedService(item) {

package/dist/planner/utils/append-work-task.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.appendWorkTask = void 0;
 const work_secret_1 = require("../work-secret");
+const work_task_1 = require("../work-task");
 const parse_work_generate_1 = require("./parse-work-generate");
 const template_value_1 = require("./template-value");
 const parse_work_mounts_1 = require("./parse-work-mounts");
@@ -25,7 +26,8 @@ function appendWorkTask(workTree, cwd, referenceTask, environment, context) {
     const parsed = parseTask(cwd, referenceTask, environment, context);
     // on a server's cluster a local task runs in a tool image like a container task
     const server = workTree.environment.type === 'kubernetes' ? workTree.environment.server : undefined;
-    const task = !server
+    // an aggregate runs nothing, so it needs no pod either
+    const task = !server || (0, work_task_1.isAggregateTask)(parsed)
         ? parsed
         : parsed.type === 'local-task'
             ? (0, job_placement_1.runInToolImage)(parsed, server, referenceTask.schema.platform)
@@ -77,7 +79,6 @@ function parseTask(cwd, task, environment, context) {
         labels: task.labels,
         caching: (0, resolve_cache_1.resolveCache)(task.schema.cache ?? null, context.caches, task.relativeName),
         shell: task.schema.shell ? (0, template_value_1.templateValue)(task.schema.shell, envs) : '/bin/sh',
-        continuous: task.schema.continuous ?? false,
         timeout: task.schema.timeout ? (0, units_1.parseDuration)(task.schema.timeout) : null,
         secrets: (0, work_secret_1.parseWorkSecrets)(cwd, context.projectRoot, task.schema.secrets, envs, environment, context.secrets, task.schema.account),
         resources: (0, work_resources_1.parseWorkResources)(task.schema.resources),
@@ -90,10 +91,12 @@ function parseTask(cwd, task, environment, context) {
         return {
             ...baseWorkNode,
             type: 'container-task',
-            user: (0, get_container_user_1.getContainerUser)(),
+            // a capability holds for root only: a task that adds some runs as its image's user
+            user: task.schema.capAdd?.length ? null : (0, get_container_user_1.getContainerUser)(),
             image: (0, template_value_1.templateValue)(task.schema.image, envs),
             mounts: (0, parse_work_mounts_1.parseWorkMounts)(cwd, task.schema, envs),
             volumeSize: task.schema.volumeSize ?? null,
+            capAdd: task.schema.capAdd ?? [],
         };
     }
     else {
@@ -107,9 +110,16 @@ function parseTask(cwd, task, environment, context) {
             throw new Error(`task ${task.relativeName}: network ${(0, work_network_1.formatNetwork)(baseWorkNode.network)} needs a container, ` +
                 `hammerkit can't limit the network of a local task`);
         }
+        const aggregate = task.deps.length > 0 &&
+            task.needs.length === 0 &&
+            baseWorkNode.src.length === 0 &&
+            baseWorkNode.cmds.length === 0 &&
+            baseWorkNode.generates.length === 0 &&
+            baseWorkNode.secrets.length === 0;
         return {
             ...baseWorkNode,
             type: 'local-task',
+            ...(aggregate ? { aggregate } : {}),
         };
     }
 }

package/dist/planner/utils/get-work-runtime.js

@@ -4,6 +4,8 @@ exports.getWorkTaskRuntime = exports.getWorkServiceRuntime = void 0;
 const work_runtime_docker_1 = require("../work-runtime-docker");
 const work_runtime_kubernetes_1 = require("../work-runtime-kubernetes");
 const work_runtime_local_1 = require("../work-runtime-local");
+const work_runtime_aggregate_1 = require("../work-runtime-aggregate");
+const work_task_1 = require("../work-task");
 const work_item_1 = require("../work-item");
 function getWorkServiceRuntime(workTree, service) {
     if ((0, work_item_1.isContainerWorkServiceItem)(service)) {
@@ -24,7 +26,10 @@ function getWorkServiceRuntime(workTree, service) {
 }
 exports.getWorkServiceRuntime = getWorkServiceRuntime;
 function getWorkTaskRuntime(workTree, task) {
-    if ((0, work_item_1.isLocalWorkTaskItem)(task)) {
+    if ((0, work_task_1.isAggregateTask)(task.data)) {
+        return (0, work_runtime_aggregate_1.aggregateWorkRuntime)();
+    }
+    else if ((0, work_item_1.isLocalWorkTaskItem)(task)) {
         return (0, work_runtime_local_1.getLocalWorkRuntime)(task);
     }
     else if ((0, work_item_1.isContainerWorkTaskItem)(task)) {

package/dist/planner/utils/normalize-path.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.normalizePath = void 0;
+exports.normalizeHostPath = exports.getHomeReference = exports.normalizePath = void 0;
 const path_1 = require("path");
 function normalizePath(cwd, pwd, path) {
     if (path.startsWith('/')) {
@@ -14,4 +14,22 @@ function normalizePath(cwd, pwd, path) {
     }
 }
 exports.normalizePath = normalizePath;
+// What a path of the host starts with to name the home directory: `~` and `$HOME`, and
+// `$PWD`, which in a mount has always meant the home directory, not the project it reads like
+function getHomeReference(path) {
+    for (const reference of ['~', '$HOME']) {
+        if (path === reference || path.startsWith(`${reference}/`) || path.startsWith(`${reference}\\`)) {
+            return reference;
+        }
+    }
+    return path.startsWith('$PWD') ? '$PWD' : null;
+}
+exports.getHomeReference = getHomeReference;
+// A path of the host in a mount: in the home directory when it starts with one of the
+// references above, else in the directory of the build file unless it is absolute
+function normalizeHostPath(cwd, home, path) {
+    const reference = getHomeReference(path);
+    return reference ? (0, path_1.join)(home, path.substring(reference.length)) : normalizePath(cwd, home, path);
+}
+exports.normalizeHostPath = normalizeHostPath;
 //# sourceMappingURL=normalize-path.js.map

package/dist/planner/utils/parse-work-mount.js

@@ -7,6 +7,12 @@ const path_1 = require("path");
 function parseWorkMount(cwd, dir) {
     const parts = dir.split(':');
     if (parts.length === 1) {
+        const home = (0, normalize_path_1.getHomeReference)(dir);
+        if (home === '~' || home === '$HOME') {
+            // the container has no such directory: the same path on both sides would be one of the
+            // project there (`$PWD` has always been, so it stays)
+            throw new Error(`mount ${dir} is in the home directory, name where it goes in the container (${dir}:/path)`);
+        }
         return parseLocalMount(cwd, dir, dir, dir, false);
     }
     else if (parts.length === 2) {
@@ -22,7 +28,7 @@ function parseWorkMount(cwd, dir) {
 exports.parseWorkMount = parseWorkMount;
 function parseLocalMount(cwd, localPath, containerPath, mount, readOnly) {
     return {
-        localPath: (0, normalize_path_1.normalizePath)(cwd, (0, os_1.homedir)(), localPath),
+        localPath: (0, normalize_path_1.normalizeHostPath)(cwd, (0, os_1.homedir)(), localPath),
         containerPath: (0, normalize_path_1.normalizePath)(cwd, cwd, containerPath),
         isFile: (0, path_1.extname)(localPath).length > 1,
         mount,

package/dist/planner/utils/parse-work-port.js

@@ -8,7 +8,10 @@ function parseWorkPort(port) {
         return { containerPort: port, hostPort: port };
     }
     else if (parts.length === 2) {
-        return { containerPort: parsePort(parts[1], false), hostPort: parsePort(parts[0], true) };
+        // `0:80` is not published, as an empty host port: 0 (a free port) is for the endpoints
+        // of a server only
+        const hostPort = parsePort(parts[0], true);
+        return { containerPort: parsePort(parts[1], false), hostPort: hostPort === 0 ? null : hostPort };
     }
     else {
         throw new Error(`invalid port ${port}`);

package/dist/planner/validate.js

@@ -4,6 +4,7 @@ exports.checkIfContextExists = exports.hasDependencyCycle = exports.hasNeedCycle
 const read_build_file_1 = require("../parser/read-build-file");
 const plan_work_tasks_1 = require("./utils/plan-work-tasks");
 const unreferenced_build_file_envs_1 = require("./unreferenced-build-file-envs");
+const normalize_path_1 = require("./utils/normalize-path");
 async function* validate(workTree, context) {
     const cycleItems = [];
     for (const item of (0, plan_work_tasks_1.iterateWorkServices)(workTree)) {
@@ -16,6 +17,10 @@ async function* validate(workTree, context) {
                 yield { type: 'warn', message: 'missing healthcheck', item: service };
             }
             for (const mount of service.mounts) {
+                const pwd = getPwdMountWarning(mount);
+                if (pwd) {
+                    yield { type: 'warn', message: pwd, item: service };
+                }
                 if (!(await context.file.exists(mount.localPath))) {
                     yield {
                         type: 'warn',
@@ -62,6 +67,12 @@ async function* validate(workTree, context) {
                 item: task,
             };
         }
+        for (const mount of task.type === 'container-task' ? task.mounts : []) {
+            const pwd = getPwdMountWarning(mount);
+            if (pwd) {
+                yield { type: 'warn', message: pwd, item: task };
+            }
+        }
         for (const src of task.src) {
             if (!(await context.file.exists(src.absolutePath))) {
                 yield {
@@ -146,4 +157,15 @@ async function checkIfContextExists(service, context) {
     return false;
 }
 exports.checkIfContextExists = checkIfContextExists;
+// `$PWD` in a mount is the home directory, which reads like a path of the project
+function getPwdMountWarning(mount) {
+    const source = mount.mount.split(':')[0];
+    if ((0, normalize_path_1.getHomeReference)(source) !== '$PWD') {
+        return null;
+    }
+    const rest = source.substring('$PWD'.length);
+    const home = rest === '' || rest.startsWith('/') || rest.startsWith('\\') ? `~${rest}` : '~/…';
+    return (`mount ${source} is ${mount.localPath}: $PWD in a mount is the home directory, not the project. ` +
+        `Write ${home} for the home directory, or a relative path for the project`);
+}
 //# sourceMappingURL=validate.js.map

package/dist/planner/work-network.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.applyNetworkCeiling = exports.formatNetwork = exports.getTcpForwards = exports.matchesHost = exports.isLimitedNetwork = exports.toNetworkSchema = exports.exceedsNetwork = exports.getEffectiveNetwork = exports.limitNetwork = exports.parseNetworkOption = exports.parseWorkNetwork = exports.OPEN_NETWORK = void 0;
 const network_schema_1 = require("../schema/network-schema");
+const work_task_1 = require("./work-task");
 exports.OPEN_NETWORK = { type: 'open' };
 function parseWorkNetwork(schema) {
     if (!schema || schema === 'open') {
@@ -153,7 +154,8 @@ exports.formatNetwork = formatNetwork;
 function applyNetworkCeiling(workTree, ceiling) {
     const limit = ceiling && isLimitedNetwork(ceiling) ? ceiling : null;
     if (limit) {
-        const local = Object.values(workTree.tasks).find((task) => task.data.type === 'local-task');
+        // an aggregate runs nothing, so there is nothing of it to limit
+        const local = Object.values(workTree.tasks).find((task) => task.data.type === 'local-task' && !(0, work_task_1.isAggregateTask)(task.data));
         if (local) {
             throw new Error(`--network ${formatNetwork(limit)} needs every task in a container, ` +
                 `hammerkit can't limit the network of the local task ${local.name}`);

package/dist/planner/work-runtime-aggregate.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.aggregateWorkRuntime = void 0;
+// An aggregate runs nothing, so it touches nothing: no pid or state file in its
+// directory (on a server that is a checkout it doesn't trust), no outputs.
+function aggregateWorkRuntime() {
+    return {
+        async initialize() {
+            // nothing to prepare
+        },
+        async remove() {
+            // it has no outputs of its own
+        },
+        async execute() {
+            // its state stays running, and executeWorkTask completes it
+        },
+        async stop() {
+            // nothing is running
+        },
+        async archive() {
+            // never pushed, see pushToBackend
+        },
+        async restore() {
+            // never a hit, see checkCacheState
+        },
+        async currentStateKey() {
+            return null;
+        },
+    };
+}
+exports.aggregateWorkRuntime = aggregateWorkRuntime;
+//# sourceMappingURL=work-runtime-aggregate.js.map

package/dist/planner/work-runtime-kubernetes.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.kubernetesForwardRuntime = exports.kubernetesServiceRuntime = exports.kubernetesTaskRuntime = exports.getTaskJobContainers = exports.describeFailedJob = void 0;
+exports.kubernetesForwardRuntime = exports.isRolledOut = exports.kubernetesServiceRuntime = exports.kubernetesTaskRuntime = exports.getTaskJobContainers = exports.describeFailedJob = void 0;
 const abort_1 = require("../executer/abort");
 const kubernetes_service_1 = require("../executer/kubernetes-service");
 const kubernetes_instance_1 = require("../kubernetes/kubernetes-instance");
@@ -11,12 +11,14 @@ const replace_env_variables_1 = require("../environment/replace-env-variables");
 const apply_1 = require("../kubernetes/apply");
 const ensure_kubernetes_service_exists_1 = require("../kubernetes/ensure-kubernetes-service-exists");
 const ensure_kubernetes_deployment_exists_1 = require("../kubernetes/ensure-kubernetes-deployment-exists");
+const follow_pod_logs_1 = require("../kubernetes/follow-pod-logs");
 const service_definition_1 = require("./service-definition");
 const ensure_namespace_1 = require("../kubernetes/ensure-namespace");
 const ensure_persistent_data_1 = require("../kubernetes/ensure-persistent-data");
 const network_gate_1 = require("../kubernetes/network-gate");
 const await_running_state_1 = require("../kubernetes/await-running-state");
 const volumes_1 = require("../kubernetes/volumes");
+const service_rollouts_1 = require("../kubernetes/service-rollouts");
 const resources_1 = require("../kubernetes/resources");
 const ensure_http_route_1 = require("../kubernetes/ensure-http-route");
 const find_process_1 = __importDefault(require("find-process"));
@@ -34,11 +36,12 @@ const job_placement_1 = require("../kubernetes/job-placement");
 const network_policy_1 = require("../kubernetes/network-policy");
 const run_id_1 = require("../utils/run-id");
 const work_network_1 = require("./work-network");
+const sandbox_runner_1 = require("../kubernetes/sandbox-runner");
 const work_secret_1 = require("./work-secret");
 async function listJobNames(instance, kubernetes, task) {
     const jobs = await instance.batchApi.listNamespacedJob({
         namespace: kubernetes.namespace,
-        labelSelector: `hammerkit.dev/id=${task.id()}`,
+        labelSelector: (0, resources_1.getItemSelector)(task, kubernetes),
     });
     return jobs.items.flatMap((job) => (job.metadata?.name ? [job.metadata.name] : []));
 }
@@ -129,7 +132,8 @@ exports.describeFailedJob = describeFailedJob;
  * The containers of the Job of a command: the network gate first, nothing runs before the
  * item's policy holds, then the init containers that read its secrets, then the command. The
  * proxy's token (`network.secretEnv`) reaches the init containers through `secretSpec` only:
- * the command's container gets the proxy variables of a limited network without it.
+ * the command's container gets the proxy variables of a limited network without it. A task that
+ * adds capabilities gets them in the sandbox's RuntimeClass only.
  */
 function getTaskJobContainers(options) {
     const { task, cmd, envs, secrets, network, secretSpec, kubernetes } = options;
@@ -154,9 +158,10 @@ function getTaskJobContainers(options) {
                 name: options.container,
                 volumeMounts: [...options.mounts, ...secrets.mounts, ...secretSpec.mounts],
                 ...(0, container_resources_1.getKubernetesResources)(task.data.resources),
-                ...(0, job_placement_1.getContainerSecurity)(kubernetes),
+                ...(0, job_placement_1.getContainerSecurity)(kubernetes, task.data.capAdd),
             },
         ],
+        ...(0, job_placement_1.getPodRuntimeClass)({ name: task.name, capAdd: task.data.capAdd }, kubernetes),
     };
 }
 exports.getTaskJobContainers = getTaskJobContainers;
@@ -171,29 +176,67 @@ function kubernetesTaskRuntime(task, kubernetes) {
             return Promise.resolve();
         },
         async restore(environment, path, stateKey) {
+            // a cache hit of a service run at the state that services of the run mount (a move whose
+            // dep did not change): its outputs are there, and stay as they are while pods read them
+            if (kubernetes.server?.serviceRun &&
+                stateKey &&
+                (await (0, ensure_persistent_data_1.getStateDirsInUse)(instance, kubernetes.namespace, claim)).has((0, volumes_1.getStateFilesDir)(stateKey))) {
+                task.status.write('info', `${task.name}: services of the run use its outputs of this state, they stay`);
+                return;
+            }
             if (!kept) {
-                await (0, restore_kubernetes_data_1.restoreKubernetesData)(task, kubernetes, instance, environment, path);
+                await (0, restore_kubernetes_data_1.restoreKubernetesData)(task, kubernetes, instance, environment, path, { stateKey });
                 return;
             }
             const reset = await (0, kept_claims_1.forgetClaimState)(instance, kubernetes, claim);
-            await (0, restore_kubernetes_data_1.restoreKubernetesData)(task, kubernetes, instance, environment, path, { reset });
+            await (0, restore_kubernetes_data_1.restoreKubernetesData)(task, kubernetes, instance, environment, path, { reset, stateKey });
             if (stateKey) {
                 await (0, kept_claims_1.recordClaimState)(instance, kubernetes, claim, stateKey);
             }
         },
-        async archive(environment, path) {
-            await (0, store_kubernetes_data_1.storeKubernetesData)(task, kubernetes, instance, environment, path);
+        async archive(environment, path, stateKey) {
+            await (0, store_kubernetes_data_1.storeKubernetesData)(task, kubernetes, instance, environment, path, stateKey);
         },
         async execute(environment, options) {
             const envs = (0, replace_env_variables_1.getEnvironmentVariables)(task.data.envs);
-            const persistence = await (0, volumes_1.getKubernetesPersistence)(task, kubernetes);
+            const persistence = await (0, volumes_1.getKubernetesPersistence)(task, kubernetes, options.stateKey);
             const workspace = (0, volumes_1.getWorkspacePodSpec)(kubernetes, persistence, { name: task.name, pool: task.data.pool });
+            // a shell of a sandbox: its commands go into the sandbox's runner, when it has one now
+            if ((0, sandbox_runner_1.canUseRunner)(task, kubernetes, persistence)) {
+                try {
+                    const result = await (0, sandbox_runner_1.executeInRunner)(instance, task, kubernetes, persistence, options.abort);
+                    if (result.type === 'crash') {
+                        options.state.set({ stateKey: options.stateKey, type: 'crash', exitCode: result.exitCode });
+                        return;
+                    }
+                    // stopped while the runner started: no Job for it either
+                    if (result.type === 'canceled' || options.abort.aborted) {
+                        options.state.set({ stateKey: options.stateKey, type: 'canceled' });
+                        return;
+                    }
+                    if (result.type === 'done') {
+                        return;
+                    }
+                }
+                catch (e) {
+                    options.state.set({ stateKey: options.stateKey, type: 'error', errorMessage: (0, log_1.getErrorMessage)(e) });
+                    return;
+                }
+            }
             await (0, ensure_namespace_1.ensureNamespace)(instance, kubernetes.namespace);
+            // a service run writes the outputs of each state into a folder of their own (see
+            // getStateFilesDir), which pods of its services may mount: of the commit before during
+            // a move, or of this state after a move that went back
+            const files = kubernetes.server?.serviceRun ? { dir: (0, volumes_1.getStateFilesDir)(options.stateKey) } : undefined;
             try {
+                if (files && (await (0, ensure_persistent_data_1.getStateDirsInUse)(instance, kubernetes.namespace, claim)).has(files.dir)) {
+                    task.status.write('info', `${task.name}: services of the run use its outputs of this state, they stay`);
+                    return;
+                }
                 // the task writes to it now: what it holds stops being the outputs of a state, and
                 // goes, as a new claim would hold nothing
                 const reset = kept && (await (0, kept_claims_1.forgetClaimState)(instance, kubernetes, claim));
-                await (0, ensure_persistent_data_1.ensurePersistentData)(instance, kubernetes, environment, task, persistence, { reset });
+                await (0, ensure_persistent_data_1.ensurePersistentData)(instance, kubernetes, environment, task, persistence, { reset, files });
             }
             catch (e) {
                 options.state.set({ stateKey: options.stateKey, type: 'error', errorMessage: (0, log_1.getErrorMessage)(e) });
@@ -201,7 +244,7 @@ function kubernetesTaskRuntime(task, kubernetes) {
             }
             const server = kubernetes.server;
             const { delivered, inJob } = (0, job_secrets_1.splitJobSecrets)(task.data.secrets, server);
-            const secrets = (0, secrets_1.getKubernetesSecretRefs)(task, delivered);
+            const secrets = (0, secrets_1.getKubernetesSecretRefs)(task, kubernetes, delivered);
             const admitted = environment.hosted?.accounts;
             let secretHosts;
             try {
@@ -230,7 +273,7 @@ function kubernetesTaskRuntime(task, kubernetes) {
                     : {}),
             };
             const labels = {
-                'hammerkit.dev/id': task.id(),
+                ...(0, resources_1.getItemLabels)(task, kubernetes),
                 'hammerkit.dev/state': options.stateKey,
                 ...workspace.labels,
                 [network_policy_1.RUN_LABEL]: scope.run,
@@ -258,7 +301,7 @@ function kubernetesTaskRuntime(task, kubernetes) {
                 return;
             }
             try {
-                const podName = (0, resources_1.getResourceName)(task, '-job');
+                const podName = (0, resources_1.getResourceName)(task, kubernetes, '-job');
                 let i = 0;
                 for (const cmd of task.data.cmds) {
                     const container = `cmd-${++i}`;
@@ -387,7 +430,7 @@ function kubernetesTaskRuntime(task, kubernetes) {
         async stop() {
             const jobs = await instance.batchApi.listNamespacedJob({
                 namespace: kubernetes.namespace,
-                labelSelector: `hammerkit.dev/id=${task.id()}`,
+                labelSelector: (0, resources_1.getItemSelector)(task, kubernetes),
             });
             for (const job of jobs.items) {
                 if (job.metadata?.name) {
@@ -396,7 +439,7 @@ function kubernetesTaskRuntime(task, kubernetes) {
             }
             const deployments = await instance.appsApi.listNamespacedDeployment({
                 namespace: kubernetes.namespace,
-                labelSelector: `hammerkit.dev/id=${task.id()}`,
+                labelSelector: (0, resources_1.getItemSelector)(task, kubernetes),
             });
             for (const deploy of deployments.items) {
                 if (deploy.metadata?.name) {
@@ -408,7 +451,7 @@ function kubernetesTaskRuntime(task, kubernetes) {
             }
             const pods = await instance.coreApi.listNamespacedPod({
                 namespace: kubernetes.namespace,
-                labelSelector: `hammerkit.dev/id=${task.id()}`,
+                labelSelector: (0, resources_1.getItemSelector)(task, kubernetes),
             });
             for (const pod of pods.items) {
                 if (pod.metadata?.name) {
@@ -430,7 +473,7 @@ function kubernetesTaskRuntime(task, kubernetes) {
             }
             const jobs = await instance.batchApi.listNamespacedJob({
                 namespace: kubernetes.namespace,
-                labelSelector: `hammerkit.dev/id=${task.id()}`,
+                labelSelector: (0, resources_1.getItemSelector)(task, kubernetes),
             });
             const completedStates = jobs.items
                 .filter((j) => j.status?.succeeded && j.metadata?.labels?.['hammerkit.dev/state'])
@@ -465,9 +508,13 @@ function kubernetesServiceRuntime(service, kubernetes) {
         // stops it and a run reuses it, as with a container on Docker. One whose
         // definition changed goes, with its limits, and is created anew.
         async initialize(state) {
+            if (kubernetes.server?.serviceRun) {
+                // a service run starts every service: one that did not change stays as it is (execute)
+                return;
+            }
             const deployments = await instance.appsApi.listNamespacedDeployment({
                 namespace: kubernetes.namespace,
-                labelSelector: `hammerkit.dev/id=${service.id()}`,
+                labelSelector: (0, resources_1.getItemSelector)(service, kubernetes),
             });
             const deployment = deployments.items[0];
             if (!deployment?.metadata?.name) {
@@ -494,7 +541,7 @@ function kubernetesServiceRuntime(service, kubernetes) {
         async stop() {
             const deployments = await instance.appsApi.listNamespacedDeployment({
                 namespace: kubernetes.namespace,
-                labelSelector: `hammerkit.dev/id=${service.id()}`,
+                labelSelector: (0, resources_1.getItemSelector)(service, kubernetes),
             });
             for (const deployment of deployments.items) {
                 if (deployment.metadata?.name) {
@@ -509,14 +556,70 @@ function kubernetesServiceRuntime(service, kubernetes) {
             await (0, network_policy_1.removeAllKubernetesItemNetworks)(instance, kubernetes, service);
         },
         async execute(environment, options) {
-            const persistence = await (0, volumes_1.getKubernetesPersistence)(service, kubernetes);
+            const name = (0, resources_1.getResourceName)(service, kubernetes);
+            // a service run that moves to another commit: a service of the same definition and
+            // state is left running, another one is rolled from the Deployment it has now
+            let previous;
+            if (kubernetes.server?.serviceRun) {
+                previous = await readDeployment(instance, kubernetes.namespace, name);
+                if (previous && isRolledOut(previous, (0, service_definition_1.getServiceDefinitionHash)(service), options.stateKey)) {
+                    service.status.write('info', `${service.name} did not change, it stays up`);
+                    options.state.set({ type: 'running', dns: { containerId: name }, stateKey: options.stateKey, remote: null });
+                    return;
+                }
+            }
+            const persistence = await (0, volumes_1.getKubernetesPersistence)(service, kubernetes, options.stateKey);
+            // the files of a service run's service go into a folder of their state, so the pod that
+            // runs keeps its own until the new one is up. One that watches its files (`continuous`)
+            // gets them synced into the folder its pod mounts: the pod that runs sees the changes.
+            const live = (0, volumes_1.isLiveService)(service, kubernetes);
+            // the files of the state it runs at now, to put back when the move does not get up
+            const before = live ? previous?.metadata?.labels?.['hammerkit.dev/state'] : undefined;
+            const files = kubernetes.server?.serviceRun
+                ? {
+                    dir: (0, volumes_1.getStateFilesDir)(options.stateKey),
+                    live,
+                    keep: before ? [(0, volumes_1.getStateFilesDir)(before)] : [],
+                }
+                : undefined;
+            if (live && previous && before) {
+                const from = (0, volumes_1.getStateFilesDir)(before);
+                service_rollouts_1.serviceRollouts.add(kubernetes.namespace, name, previous, () => (0, ensure_persistent_data_1.restoreLiveFiles)(instance, kubernetes, service, persistence, from));
+            }
             await (0, ensure_namespace_1.ensureNamespace)(instance, kubernetes.namespace);
             await (0, ensure_kubernetes_service_exists_1.ensureKubernetesServiceExists)(instance, kubernetes, service);
-            await (0, ensure_persistent_data_1.ensurePersistentData)(instance, kubernetes, environment, service, persistence);
+            await (0, ensure_persistent_data_1.ensurePersistentData)(instance, kubernetes, environment, service, persistence, { files });
             await (0, secrets_1.ensureKubernetesSecret)(instance, kubernetes, service, service.data.secrets, environment);
-            const network = await (0, network_policy_1.ensureKubernetesItemNetwork)(instance, kubernetes, service, { followLog: false, run: null });
-            await (0, ensure_kubernetes_deployment_exists_1.ensureKubernetesDeploymentExists)(instance, kubernetes, service, persistence, (0, secrets_1.getKubernetesSecretRefs)(service, service.data.secrets), options.stateKey, network);
-            const name = (0, resources_1.getResourceName)(service);
+            // on a server, the run's: its runs share the namespace, and the service goes with the run
+            const network = await (0, network_policy_1.ensureKubernetesItemNetwork)(instance, kubernetes, service, {
+                followLog: false,
+                run: kubernetes.server ? (0, job_placement_1.getRunLabelValue)(kubernetes.server.run) : null,
+            });
+            // its output, as on Docker: while it starts, and while it runs unless it runs on
+            // without hammerkit (`up --daemon`)
+            const logs = (0, follow_pod_logs_1.followPodLogs)(instance, kubernetes.namespace, (0, resources_1.getItemSelector)(service, kubernetes), (0, ensure_kubernetes_deployment_exists_1.getServiceContainerName)(service), (line) => service.status.console('stdout', line), { onError: (text) => service.status.write('debug', text) });
+            try {
+                await (0, ensure_kubernetes_deployment_exists_1.ensureKubernetesDeploymentExists)(instance, kubernetes, service, persistence, (0, secrets_1.getKubernetesSecretRefs)(service, kubernetes, service.data.secrets), options.stateKey, network, { previous, signal: options.abort });
+            }
+            catch (e) {
+                // the last words of a container that crashed, before why it failed
+                await logs.settle().catch(() => undefined);
+                logs.stop();
+                throw e;
+            }
+            if (options.daemon || options.abort.aborted || environment.abortCtrl.signal.aborted) {
+                logs.stop();
+            }
+            else {
+                // either ends it, and takes the other listener with it
+                const listening = new AbortController();
+                const stop = () => {
+                    logs.stop();
+                    listening.abort();
+                };
+                options.abort.addEventListener('abort', stop, { once: true, signal: listening.signal });
+                environment.abortCtrl.signal.addEventListener('abort', stop, { once: true, signal: listening.signal });
+            }
             options.state.set({
                 type: 'running',
                 dns: { containerId: name },
@@ -548,7 +651,7 @@ function kubernetesServiceRuntime(service, kubernetes) {
             }
             const services = await instance.coreApi.listNamespacedService({
                 namespace: kubernetes.namespace,
-                labelSelector: `hammerkit.dev/id=${service.id()}`,
+                labelSelector: (0, resources_1.getItemSelector)(service, kubernetes),
             });
             for (const service of services.items) {
                 if (service.metadata?.name) {
@@ -564,7 +667,7 @@ function kubernetesServiceRuntime(service, kubernetes) {
         async currentStateKey() {
             const deployments = await instance.appsApi.listNamespacedDeployment({
                 namespace: kubernetes.namespace,
-                labelSelector: `hammerkit.dev/id=${service.id()}`,
+                labelSelector: (0, resources_1.getItemSelector)(service, kubernetes),
             });
             const deployment = deployments.items[0];
             return deployment?.metadata?.labels?.['hammerkit.dev/state'] ?? null;
@@ -572,6 +675,30 @@ function kubernetesServiceRuntime(service, kubernetes) {
     };
 }
 exports.kubernetesServiceRuntime = kubernetesServiceRuntime;
+async function readDeployment(instance, namespace, name) {
+    try {
+        return await instance.appsApi.readNamespacedDeployment({ name, namespace });
+    }
+    catch (e) {
+        if ((0, apply_1.statusCodeOf)(e) === 404) {
+            return undefined;
+        }
+        throw e;
+    }
+}
+// A Deployment of this definition and state whose pods are all of it and ready
+function isRolledOut(deployment, definition, stateKey) {
+    const labels = deployment.metadata?.labels ?? {};
+    const status = deployment.status;
+    return (!deployment.metadata?.deletionTimestamp &&
+        labels[ensure_kubernetes_deployment_exists_1.DEFINITION_LABEL] === definition &&
+        labels['hammerkit.dev/state'] === stateKey &&
+        (status?.observedGeneration ?? 0) >= (deployment.metadata?.generation ?? 0) &&
+        (status?.updatedReplicas ?? 0) >= 1 &&
+        (status?.availableReplicas ?? 0) >= 1 &&
+        (status?.replicas ?? 0) === (status?.updatedReplicas ?? 0));
+}
+exports.isRolledOut = isRolledOut;
 function kubernetesForwardRuntime(service) {
     return {
         async initialize(item) {

package/dist/planner/work-task.js

@@ -1,8 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isWorkTask = exports.isContainerWorkTask = void 0;
+exports.isAggregateTask = exports.isWorkTask = exports.isContainerWorkTask = void 0;
 const isContainerWorkTask = (val) => val.type === 'container-task';
 exports.isContainerWorkTask = isContainerWorkTask;
 const isWorkTask = (val) => val.type === 'container-task' || val.type === 'local-task';
 exports.isWorkTask = isWorkTask;
+// A task that only groups its dependencies: `deps`, and no `image`, `cmds`, `src`,
+// `generates`, `secrets` or `needs`. It needs no runtime, hands on what its dependencies generate to what
+// depends on it, and is up to date (or verified) when all its dependencies are.
+const isAggregateTask = (val) => val.type === 'local-task' && val.aggregate === true;
+exports.isAggregateTask = isAggregateTask;
 //# sourceMappingURL=work-task.js.map