hammerkit 1.27.0-next.9 → 2.0.0-next.1

package/dist/remote/server-client.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.callServer = exports.getMe = exports.getDiscovery = exports.printableWhole = exports.printable = exports.ServerError = void 0;
+exports.callServer = exports.getMe = exports.getDiscovery = exports.printableWhole = exports.printableLines = exports.printable = exports.ServerError = void 0;
 const discovery_1 = require("../server/discovery");
 const TIMEOUT_MS = 10000;
 const WRITE_TIMEOUT_MS = 30000;
@@ -21,6 +21,17 @@ function printable(value) {
     return text.length > 300 ? `${text.slice(0, 300)}… (+${text.length - 300} chars)` : text;
 }
 exports.printable = printable;
+// Text of several lines, such as every problem of a refused publish: each line made
+// printable and cut like `printable`, one per line, and at most `MAX_LINES` of them.
+const MAX_LINES = 100;
+function printableLines(value) {
+    const lines = String(value)
+        .split(/\r?\n/)
+        .filter((line) => line.trim().length > 0);
+    const shown = lines.slice(0, MAX_LINES).map(printable);
+    return lines.length > MAX_LINES ? [...shown, `… (+${lines.length - MAX_LINES} lines)`] : shown;
+}
+exports.printableLines = printableLines;
 // The same, never cut: for what somebody decides on, such as a command.
 function printableWhole(value) {
     return String(value)
@@ -92,7 +103,9 @@ async function callServer(server, token, method, path, body) {
         throw new ServerError(`${server.url} did not accept the token`);
     }
     if (!response.ok) {
-        const said = answer && typeof answer.error === 'string' ? `: ${printable(answer.error)}` : '';
+        const lines = answer && typeof answer.error === 'string' ? printableLines(answer.error) : [];
+        // a refused publish says every problem, each on a line of its own
+        const said = lines.length > 1 ? `:\n${lines.map((line) => `  ${line}`).join('\n')}` : lines.length === 1 ? `: ${lines[0]}` : '';
         throw new ServerError(`${server.url} answered ${response.status}${said}`, response.status);
     }
     return { status: response.status, body: answer };

package/dist/remote/token-source.js

@@ -9,6 +9,54 @@ function isToken(value) {
     return /^[\x21-\x7e]+$/.test(value);
 }
 exports.isToken = isToken;
+// What a failed token command said on stderr, for the user's own terminal: never its stdout,
+// and never in an error message, which a harness hands on to an agent.
+const MAX_STDERR_LINES = 20;
+const MAX_STDERR_LINE = 300;
+function writeStderr(environment, what, stderr) {
+    const lines = stderr
+        .split(/\r?\n/)
+        .map((line) => line.replace(/[^\x20-\x7e\t]/g, '?').slice(0, MAX_STDERR_LINE))
+        .filter((line) => line.trim())
+        .slice(-MAX_STDERR_LINES);
+    for (const line of lines) {
+        environment.stderr.write(`${what}: ${line}\n`);
+    }
+}
+function commandSource(environment, command, what) {
+    let current;
+    const run = () => new Promise((resolve, reject) => {
+        (0, child_process_1.exec)(command, { env: environment.processEnvs, timeout: 60000 }, (error, stdout, stderr) => {
+            const token = String(stdout).trim();
+            if (error || !token) {
+                writeStderr(environment, what, String(stderr));
+                const status = error?.killed
+                    ? ', it did not end within a minute'
+                    : typeof error?.code === 'number'
+                        ? `, it exited with ${error.code}`
+                        : '';
+                reject(new Error(`${what} printed no token${status}`));
+            }
+            else if (!isToken(token)) {
+                // never the output itself: it can hold more secrets than the token
+                reject(new Error(`${what} printed more than a token, it has to print the token alone`));
+            }
+            else {
+                resolve(token);
+            }
+        });
+    });
+    return {
+        token: () => {
+            current = current ?? run();
+            current.catch(() => (current = undefined));
+            return current;
+        },
+        renew: async () => {
+            current = undefined;
+        },
+    };
+}
 /**
  * The token a client of a server sends: a harness, and the `remote` commands. In this order:
  *
@@ -16,42 +64,29 @@ exports.isToken = isToken;
  *   identity, such as a workload identity or a service account of the identity provider. It
  *   runs again when the server no longer accepts the token.
  * - `HAMMERKIT_TOKEN`: such a token, as the agent's platform hands it over.
+ * - the token command of the server in the host config (`remote add --token-command`): the
+ *   same as `HAMMERKIT_TOKEN_COMMAND`, for one server, so each server can have the service
+ *   account and audience it accepts. It only ever comes from the host config, never from a
+ *   build file: whoever writes it decides what runs on this machine.
  * - the sign-in of `hammerkit remote login <server>`.
  *
  * The token only goes to the URL the server is registered with in the host config.
  */
 function getTokenSource(environment, name, server) {
+    // a variable holds for every server: say so when it takes the place of the one registered
+    const overrides = (variable) => {
+        if (server.tokenCommand) {
+            environment.stderr.write(`${variable} is set, so the token command of ${name} is not used\n`);
+        }
+    };
     const command = environment.processEnvs.HAMMERKIT_TOKEN_COMMAND;
     if (command) {
-        let current;
-        const run = () => new Promise((resolve, reject) => {
-            (0, child_process_1.exec)(command, { env: environment.processEnvs, timeout: 60000 }, (error, stdout) => {
-                const token = String(stdout).trim();
-                if (error || !token) {
-                    reject(new Error('HAMMERKIT_TOKEN_COMMAND printed no token'));
-                }
-                else if (!isToken(token)) {
-                    // never the output itself: it can hold more secrets than the token
-                    reject(new Error('HAMMERKIT_TOKEN_COMMAND printed more than a token, it has to print the token alone'));
-                }
-                else {
-                    resolve(token);
-                }
-            });
-        });
-        return {
-            token: () => {
-                current = current ?? run();
-                current.catch(() => (current = undefined));
-                return current;
-            },
-            renew: async () => {
-                current = undefined;
-            },
-        };
+        overrides('HAMMERKIT_TOKEN_COMMAND');
+        return commandSource(environment, command, 'HAMMERKIT_TOKEN_COMMAND');
     }
     const fixed = environment.processEnvs.HAMMERKIT_TOKEN?.trim();
     if (fixed) {
+        overrides('HAMMERKIT_TOKEN');
         return {
             token: async () => {
                 if (!isToken(fixed)) {
@@ -61,6 +96,9 @@ function getTokenSource(environment, name, server) {
             },
         };
     }
+    if (server.tokenCommand) {
+        return commandSource(environment, server.tokenCommand, `the token command of ${name}`);
+    }
     return { token: () => (0, credentials_1.getAccessToken)(environment, name, server) };
 }
 exports.getTokenSource = getTokenSource;

package/dist/run-program.js

@@ -7,6 +7,8 @@ exports.runProgram = void 0;
 const program_1 = require("./program");
 const parse_error_1 = require("./schema/parse-error");
 const colors_1 = __importDefault(require("colors"));
+const commander_1 = require("commander");
+const log_1 = require("./log");
 function runProgram(env, argv, exitOverride) {
     return (0, program_1.getProgram)(env, argv)
         .then(({ program, args }) => {
@@ -18,8 +20,15 @@ function runProgram(env, argv, exitOverride) {
             for (const error of err.zod.errors) {
                 env.stderr.write(` ${colors_1.default.underline(colors_1.default.blue(`error`))} at ${colors_1.default.gray(error.path.join('.'))} ${error.message}  ${colors_1.default.gray(error.code)}\n`);
             }
+            // printed, but still a failure: CI must not pass on a build file that doesn't parse
+            throw err;
         }
         else {
+            // what commander reports (program.error, a wrong option) is printed already; anything
+            // else, such as a build file that is no YAML, would otherwise end the process silently
+            if (!(err instanceof commander_1.CommanderError)) {
+                env.stderr.write(`${colors_1.default.red('error')}: ${(0, log_1.getErrorMessage)(err)}\n`);
+            }
             throw err;
         }
     });

package/dist/schema/build-file-base-task-schema.js

@@ -29,9 +29,6 @@ exports.buildFileBaseTaskSchema = (0, zod_1.object)({
     src: (0, zod_1.array)((0, zod_1.string)()).optional(),
     generates: (0, zod_1.array)(build_file_volume_schema_1.buildFileVolumeSchema).optional(),
     shell: (0, zod_1.string)().optional(),
-    // A task that watches its own sources and restarts itself (e.g. `ng serve`,
-    // `tsc -w`). In watch mode hammerkit then does not watch/restart it itself.
-    continuous: (0, zod_1.boolean)().optional(),
     // Maximum execution time, e.g. `30s`, `10m`, `1h30m`. The task fails when it
     // runs longer. Does not affect the cache key (ADR-0002).
     timeout: duration_schema_1.durationSchema.optional(),
@@ -49,5 +46,8 @@ exports.buildFileBaseTaskSchema = (0, zod_1.object)({
     // Name of the server (see `hammerkit remote`) the task has to run on; defaults
     // to the build file's `runner`. Never a local fallback when it is unknown.
     runner: runner_schema_1.runnerSchema.optional(),
+    // false: a server leaves it out of a published version, for a task only this machine
+    // runs (a dev watcher, a task that mounts the docker socket)
+    publish: (0, zod_1.boolean)().optional(),
 });
 //# sourceMappingURL=build-file-base-task-schema.js.map

package/dist/schema/build-file-container-service-schema.js

@@ -41,12 +41,22 @@ exports.buildFileContainerServiceSchema = (0, zod_1.object)({
     // the service account its provider secrets are read as, unless a secret names one
     account: (0, zod_1.string)().optional(),
     resources: resources_schema_1.resourcesSchema.optional(),
+    // on Kubernetes, how often its container may crash and be restarted before the
+    // service fails (2 by default): it fails when it crashes once more
+    restarts: (0, zod_1.number)()
+        .int()
+        .min(0)
+        .max(10)
+        .describe('crashes restarted before it fails on Kubernetes, 0 to 10, 2 by default')
+        .optional(),
     // on Kubernetes, the size of the claim that holds its sources, mounts and volumes
     volumeSize: size_schema_1.sizeSchema.describe('size of its claim on Kubernetes, e.g. 10Gi').optional(),
     // what the service reaches besides its needs; tasks needing it always reach it
     network: network_schema_1.networkSchema.optional(),
     // whether its `cmd` takes the arguments after `--` of `up`: false refuses them
     args: (0, zod_1.boolean)().optional(),
+    // false: a server leaves it out of a published version
+    publish: (0, zod_1.boolean)().optional(),
 })
     .strict()
     .describe('container service');

package/dist/schema/build-file-container-task-schema.js

@@ -1,16 +1,31 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildFileContainerTaskSchema = void 0;
+exports.CONTAINER_TASK_PROPERTIES = exports.buildFileExtendingContainerTaskSchema = exports.buildFileContainerTaskSchema = void 0;
 const build_file_base_task_schema_1 = require("./build-file-base-task-schema");
 const zod_1 = require("zod");
 const size_schema_1 = require("./size-schema");
+const capabilities_schema_1 = require("./capabilities-schema");
 exports.buildFileContainerTaskSchema = build_file_base_task_schema_1.buildFileBaseTaskSchema
     .extend({
     image: (0, zod_1.string)(),
     mounts: (0, zod_1.array)((0, zod_1.string)()).optional(),
     // on Kubernetes, the size of the claim that holds its sources, mounts and outputs
     volumeSize: size_schema_1.sizeSchema.describe('size of its claim on Kubernetes, e.g. 10Gi').optional(),
+    // Linux capabilities added to the container, such as SYS_ADMIN for a daemonless image
+    // build. A server allows them only in a sandboxed runtime (`backend.capabilities`).
+    capAdd: capabilities_schema_1.capabilitiesSchema.describe('Linux capabilities added to the container, e.g. [SYS_ADMIN]').optional(),
 })
     .strict()
     .describe('container task');
+// A task that extends another takes the image of its base, so it may set the
+// container properties without an image of its own; once extended, a task whose
+// base has no image either is refused them (applySchemaExtension).
+exports.buildFileExtendingContainerTaskSchema = exports.buildFileContainerTaskSchema
+    .extend({
+    image: (0, zod_1.string)().optional(),
+    extend: (0, zod_1.string)(),
+})
+    .strict()
+    .describe('container task taking its image from the task it extends');
+exports.CONTAINER_TASK_PROPERTIES = ['mounts', 'volumeSize', 'capAdd'];
 //# sourceMappingURL=build-file-container-task-schema.js.map

package/dist/schema/build-file-include-schema.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isGitSource = exports.buildFileIncludeSchema = exports.buildFileGitSourceSchema = void 0;
+exports.isPublished = exports.isGitSource = exports.buildFileIncludeSchema = exports.buildFileLocalSourceSchema = exports.buildFileGitSourceSchema = void 0;
 const zod_1 = require("zod");
 const envs_schema_1 = require("./envs-schema");
 // A repo URL or ref starting with `-` would be read by git as an option
@@ -21,11 +21,25 @@ exports.buildFileGitSourceSchema = (0, zod_1.object)({
     path: (0, zod_1.string)().optional().describe('Build file or directory within the repository'),
     // overrides for the top-level `envs` the included file declares as its inputs
     with: envs_schema_1.envsSchema.optional(),
+    publish: (0, zod_1.boolean)().optional().describe('false: a server leaves out what this file declares'),
 }).strict();
-// A string is a local path; an object is a git source (ADR-0004).
-exports.buildFileIncludeSchema = (0, zod_1.union)([(0, zod_1.string)(), exports.buildFileGitSourceSchema]);
+// A local path, with values for the inputs of the file it names like `with` of a git
+// source (a value may pass on an `envs` value of the including file as `${NAME}`), and
+// whether a server publishes what it declares.
+exports.buildFileLocalSourceSchema = (0, zod_1.object)({
+    path: (0, zod_1.string)().min(1).describe('Build file or directory, relative to the including file'),
+    with: envs_schema_1.envsSchema.optional(),
+    publish: (0, zod_1.boolean)().optional().describe('false: a server leaves out what this file declares'),
+}).strict();
+// A string is a local path; an object is a local path with options, or a git source (ADR-0004).
+exports.buildFileIncludeSchema = (0, zod_1.union)([(0, zod_1.string)(), exports.buildFileLocalSourceSchema, exports.buildFileGitSourceSchema]);
 function isGitSource(include) {
-    return typeof include !== 'string';
+    return typeof include !== 'string' && 'git' in include;
 }
 exports.isGitSource = isGitSource;
+// `publish: false`: what the file declares is left out of a version a server publishes
+function isPublished(include) {
+    return typeof include === 'string' || include.publish !== false;
+}
+exports.isPublished = isPublished;
 //# sourceMappingURL=build-file-include-schema.js.map

package/dist/schema/build-file-kubernetes-service-schema.js

@@ -13,5 +13,7 @@ exports.buildFileKubernetesServiceSchema = (0, zod_1.object)({
     selector: build_file_kubernetes_service_selector_schema_1.buildFileKubernetesServiceSelectorSchema,
     labels: labels_schema_1.labelsSchema.optional(),
     ports: (0, zod_1.array)((0, zod_1.union)([(0, zod_1.string)(), (0, zod_1.number)()])),
+    // false: a server leaves it out of a published version
+    publish: (0, zod_1.boolean)().optional(),
 }).strict();
 //# sourceMappingURL=build-file-kubernetes-service-schema.js.map

package/dist/schema/build-file-task-schema.js

@@ -4,7 +4,11 @@ exports.isBuildFileLocalTaskSchema = exports.isBuildFileContainerTaskSchema = ex
 const zod_1 = require("zod");
 const build_file_container_task_schema_1 = require("./build-file-container-task-schema");
 const build_file_local_task_schema_1 = require("./build-file-local-task-schema");
-exports.buildFileTaskSchema = (0, zod_1.union)([build_file_container_task_schema_1.buildFileContainerTaskSchema, build_file_local_task_schema_1.buildFileLocalTaskSchema]);
+exports.buildFileTaskSchema = (0, zod_1.union)([
+    build_file_container_task_schema_1.buildFileContainerTaskSchema,
+    build_file_local_task_schema_1.buildFileLocalTaskSchema,
+    build_file_container_task_schema_1.buildFileExtendingContainerTaskSchema,
+]);
 const isBuildFileContainerTaskSchema = (val) => 'image' in val;
 exports.isBuildFileContainerTaskSchema = isBuildFileContainerTaskSchema;
 const isBuildFileLocalTaskSchema = (val) => !('image' in val);

package/dist/schema/capabilities-schema.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.capabilitiesSchema = exports.LINUX_CAPABILITIES = void 0;
+const zod_1 = require("zod");
+// The Linux capabilities, without the CAP_ prefix (capabilities(7))
+exports.LINUX_CAPABILITIES = [
+    'AUDIT_CONTROL',
+    'AUDIT_READ',
+    'AUDIT_WRITE',
+    'BLOCK_SUSPEND',
+    'BPF',
+    'CHECKPOINT_RESTORE',
+    'CHOWN',
+    'DAC_OVERRIDE',
+    'DAC_READ_SEARCH',
+    'FOWNER',
+    'FSETID',
+    'IPC_LOCK',
+    'IPC_OWNER',
+    'KILL',
+    'LEASE',
+    'LINUX_IMMUTABLE',
+    'MAC_ADMIN',
+    'MAC_OVERRIDE',
+    'MKNOD',
+    'NET_ADMIN',
+    'NET_BIND_SERVICE',
+    'NET_BROADCAST',
+    'NET_RAW',
+    'PERFMON',
+    'SETFCAP',
+    'SETGID',
+    'SETPCAP',
+    'SETUID',
+    'SYS_ADMIN',
+    'SYS_BOOT',
+    'SYS_CHROOT',
+    'SYS_MODULE',
+    'SYS_NICE',
+    'SYS_PACCT',
+    'SYS_PTRACE',
+    'SYS_RAWIO',
+    'SYS_RESOURCE',
+    'SYS_TIME',
+    'SYS_TTY_CONFIG',
+    'SYSLOG',
+    'WAKE_ALARM',
+];
+// Capabilities a container gets on top of its runtime's default set, by name such as
+// SYS_ADMIN. `ALL` is not one: a task names what it needs.
+exports.capabilitiesSchema = (0, zod_1.array)((0, zod_1.enum)(exports.LINUX_CAPABILITIES, {
+    errorMap: (issue, ctx) => issue.code === 'invalid_enum_value'
+        ? { message: `unknown capability ${JSON.stringify(issue.received)}, expected a name such as SYS_ADMIN` }
+        : { message: ctx.defaultError },
+})).refine((names) => new Set(names).size === names.length, 'a capability is listed twice');
+//# sourceMappingURL=capabilities-schema.js.map

package/dist/schema/reference-parser.js

@@ -1,20 +1,69 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.findService = exports.findTask = exports.parseReferences = void 0;
+exports.findService = exports.findTask = exports.parseReferences = exports.getPublishedFiles = void 0;
 const build_file_task_schema_1 = require("./build-file-task-schema");
 const build_file_service_schema_1 = require("./build-file-service-schema");
 const split_name_1 = require("../planner/utils/split-name");
 const read_env_file_1 = require("../parser/read-env-file");
 const label_values_1 = require("../executer/label-values");
 const merge_environment_variables_1 = require("../environment/merge-environment-variables");
+const build_file_container_task_schema_1 = require("./build-file-container-task-schema");
 const resolve_cache_1 = require("../cache/resolve-cache");
 const project_root_1 = require("../planner/project-root");
 const secret_catalog_1 = require("../secrets/secret-catalog");
+const host_config_1 = require("../remote/host-config");
+// The providers and accounts of the host config, see HostSecretDeclarations
+async function readHostSecrets(environment) {
+    const config = await (0, host_config_1.readHostConfig)(environment);
+    return {
+        fileName: (0, host_config_1.getHostConfigPath)(environment),
+        secretProviders: config.secretProviders,
+        secretAccounts: config.secretAccounts,
+    };
+}
+// What a task or service names that a server left out (`publish: false`)
+class UnpublishedError extends Error {
+    constructor(name, reason) {
+        super(`${name} is not published (${reason})`);
+        this.name = name;
+        this.reason = reason;
+    }
+}
+// The task or service `user` names another one by, which a server left out: the error says
+// which published one still needs it, as an error elsewhere is left as it is
+function findPublished(user, verb, find) {
+    try {
+        return find();
+    }
+    catch (e) {
+        if (e instanceof UnpublishedError) {
+            throw new Error(`${user} ${verb} ${e.name}, which is not published (${e.reason})`);
+        }
+        throw e;
+    }
+}
+// The build files a server publishes: the entry file and what it includes or references,
+// except through an include with `publish: false`. The key of each is in ctx.files.
+function getPublishedFiles(mainScope) {
+    const published = new Set([mainScope]);
+    const queue = [mainScope];
+    for (let scope = queue.shift(); scope; scope = queue.shift()) {
+        for (const reference of Object.values(scope.references)) {
+            if (reference.publish && !published.has(reference.scope)) {
+                published.add(reference.scope);
+                queue.push(reference.scope);
+            }
+        }
+    }
+    return published;
+}
+exports.getPublishedFiles = getPublishedFiles;
 function combinePath(namePrefix, name) {
     return namePrefix.length > 0 ? `${namePrefix}:${name}` : name;
 }
 async function parseReferences(ctx, mainScope, environment) {
     const declaredCaches = {};
+    const unpublished = {};
     const reference = {
         files: {},
         tasks: {},
@@ -24,9 +73,28 @@ async function parseReferences(ctx, mainScope, environment) {
         caches: {},
         secrets: (0, secret_catalog_1.emptySecretCatalog)(),
         projectRoot: await (0, project_root_1.findProjectRoot)(mainScope.cwd, environment),
+        unpublished,
+    };
+    // a server leaves out what is not published: it doesn't run, and isn't checked against
+    // its policy. Locally everything is there.
+    const publishedFiles = environment.hosted ? getPublishedFiles(mainScope) : null;
+    const isLeftOut = (file, name, schema) => {
+        if (!publishedFiles) {
+            return false;
+        }
+        if (!publishedFiles.has(file)) {
+            unpublished[name] = 'its build file is included with publish: false';
+        }
+        else if (schema.publish === false) {
+            unpublished[name] = 'publish: false';
+        }
+        return name in unpublished;
     };
     for (const file of Object.values(ctx.files)) {
-        if (environment.hosted && (file.schema.secretProviders || file.schema.secretAccounts)) {
+        // what a server leaves out of a file it doesn't publish: its tasks and services (see
+        // isLeftOut), and where it would run or store things, which only a local run reads
+        const published = !publishedFiles || publishedFiles.has(file);
+        if (published && environment.hosted && (file.schema.secretProviders || file.schema.secretAccounts)) {
             throw new Error(`${file.fileName} declares secret providers or accounts, which a server defines in its own config`);
         }
         if (!reference.envFiles[file.cwd]) {
@@ -38,6 +106,9 @@ async function parseReferences(ctx, mainScope, environment) {
             for (const [taskName, task] of Object.entries(file.schema.tasks)) {
                 const taskEnvs = (0, merge_environment_variables_1.mergeEnvironmentVariables)(task.envs, buildFileEnvs);
                 const relativeName = combinePath(file.namePrefix, taskName);
+                if (isLeftOut(file, relativeName, task)) {
+                    continue;
+                }
                 reference.tasks[relativeName] = {
                     type: 'task',
                     schema: task,
@@ -51,7 +122,7 @@ async function parseReferences(ctx, mainScope, environment) {
                 };
             }
         }
-        if (file.schema.environments) {
+        if (file.schema.environments && published) {
             for (const [envName, env] of Object.entries(file.schema.environments)) {
                 reference.environments[envName] = {
                     type: 'environment',
@@ -61,7 +132,7 @@ async function parseReferences(ctx, mainScope, environment) {
                 };
             }
         }
-        if (file.schema.caches) {
+        if (file.schema.caches && published) {
             for (const [cacheName, cache] of Object.entries(file.schema.caches)) {
                 declaredCaches[cacheName] = cache;
             }
@@ -69,6 +140,9 @@ async function parseReferences(ctx, mainScope, environment) {
         if (file.schema.services) {
             for (const [serviceName, service] of Object.entries(file.schema.services)) {
                 const relativeName = combinePath(file.namePrefix, serviceName);
+                if (isLeftOut(file, relativeName, service)) {
+                    continue;
+                }
                 const serviceEnvs = (0, merge_environment_variables_1.mergeEnvironmentVariables)((0, build_file_service_schema_1.isBuildFileKubernetesServiceSchema)(service) ? {} : service.envs, buildFileEnvs);
                 reference.services[relativeName] = {
                     type: 'service',
@@ -98,7 +172,7 @@ async function parseReferences(ctx, mainScope, environment) {
     reference.caches = (0, resolve_cache_1.withBuiltinCaches)(declaredCaches);
     reference.secrets = environment.hosted
         ? { ...environment.hosted.catalog, explicitAccounts: true }
-        : (0, secret_catalog_1.collectSecretCatalog)(Object.values(ctx.files), environment, reference);
+        : (0, secret_catalog_1.collectSecretCatalog)(Object.values(ctx.files), environment, reference, await readHostSecrets(environment));
     return reference;
 }
 exports.parseReferences = parseReferences;
@@ -122,7 +196,8 @@ function applySchemaExtension(reference, task) {
         task.extension = 'applied';
         return;
     }
-    const extend = findTask(reference, task.scope, task.schema.extend, null).task;
+    const name = task.schema.extend;
+    const extend = findPublished(task.relativeName, 'extends', () => findTask(reference, task.scope, name, null)).task;
     applySchemaExtension(reference, extend);
     task.schema.shell = task.schema.shell ?? extend.schema.shell;
     task.schema.cache = task.schema.cache ?? extend.schema.cache;
@@ -148,6 +223,7 @@ function applySchemaExtension(reference, task) {
         if (!reset.has('mounts'))
             taskSchema.mounts = extendArray(taskSchema.mounts, extend.schema.mounts);
     }
+    rejectContainerPropertiesWithoutImage(task);
     // deps and needs resolve in the file that declares them, so every base up the
     // chain contributes its own, not only the nearest; what a task resets is not
     // passed on to the tasks extending it either
@@ -162,6 +238,16 @@ function applySchemaExtension(reference, task) {
     }
     task.extension = 'applied';
 }
+function rejectContainerPropertiesWithoutImage(task) {
+    if ((0, build_file_task_schema_1.isBuildFileContainerTaskSchema)(task.schema)) {
+        return;
+    }
+    const schema = task.schema;
+    const property = build_file_container_task_schema_1.CONTAINER_TASK_PROPERTIES.find((key) => schema[key] !== undefined);
+    if (property) {
+        throw new Error(`task ${task.relativeName} sets ${property}, but neither it nor its base has an image`);
+    }
+}
 function extendArray(base, extend) {
     if (!extend) {
         return base;
@@ -182,7 +268,7 @@ function extendObject(base, extend) {
 }
 function resolveDeps(reference, taskOrService, scope, schema) {
     for (const depName of schema.deps || []) {
-        const depTask = findTask(reference, scope, depName, null);
+        const depTask = findPublished(taskOrService.relativeName, 'depends on', () => findTask(reference, scope, depName, null));
         taskOrService.deps.push({
             task: depTask.task,
             type: depTask.type,
@@ -195,7 +281,8 @@ function resolveInit(reference, service) {
     if ((0, build_file_service_schema_1.isBuildFileKubernetesServiceSchema)(service.schema) || !service.schema.init) {
         return;
     }
-    const initTask = findTask(reference, service.scope, service.schema.init, null);
+    const init = service.schema.init;
+    const initTask = findPublished(service.relativeName, 'runs as init', () => findTask(reference, service.scope, init, null));
     service.init = {
         task: initTask.task,
         type: initTask.type,
@@ -210,19 +297,27 @@ function resolveNeeds(reference, taskOrService, scope, schema) {
     for (const needName of schema.needs || []) {
         if (typeof needName === 'string') {
             taskOrService.needs.push({
-                relativeName: needName,
-                service: findService(reference, scope, needName),
+                // the host name it is reached by: a service of an include, `services:postgres`, as
+                // `services-postgres`, since Docker and DNS take no colon
+                relativeName: needName.replace(/:/g, '-'),
+                service: findPublished(taskOrService.relativeName, 'needs', () => findService(reference, scope, needName)),
             });
         }
         else {
             taskOrService.needs.push({
                 relativeName: needName.name,
-                service: findService(reference, scope, needName.service),
+                service: findPublished(taskOrService.relativeName, 'needs', () => findService(reference, scope, needName.service)),
             });
         }
     }
+    const names = taskOrService.needs.map((need) => need.relativeName);
+    const twice = names.find((name, index) => names.indexOf(name) !== index);
+    if (twice) {
+        throw new Error(`${taskOrService.relativeName} needs two services as ${twice}, give one another name with name:`);
+    }
 }
 function findTask(ctx, scope, name, type) {
+    refuseNotFetched(scope, name);
     const ref = (0, split_name_1.splitName)(name);
     if (ref.prefix) {
         if (scope.references[ref.prefix]) {
@@ -238,15 +333,25 @@ function findTask(ctx, scope, name, type) {
     throw new Error('unable to find ' + name); // TODO improve
 }
 exports.findTask = findTask;
+// A name in a git source a server did not fetch, since it is left out
+function refuseNotFetched(scope, name) {
+    if (scope.notFetched) {
+        throw new UnpublishedError(combinePath(scope.namePrefix, name), 'its build file is included with publish: false');
+    }
+}
 function resolveTask(ctx, scope, name, type) {
     const fullName = combinePath(scope.namePrefix, name);
     const buildFileTask = ctx.tasks[fullName];
+    if (!buildFileTask && ctx.unpublished?.[fullName]) {
+        throw new UnpublishedError(fullName, ctx.unpublished[fullName]);
+    }
     if (!buildFileTask) {
         throw new Error('unable to find ' + fullName);
     }
     return { task: buildFileTask, type };
 }
 function findService(ctx, scope, name) {
+    refuseNotFetched(scope, name);
     const ref = (0, split_name_1.splitName)(name);
     if (ref.prefix) {
         if (scope.references[ref.prefix]) {
@@ -265,6 +370,9 @@ exports.findService = findService;
 function resolveService(ctx, scope, name) {
     const fullName = combinePath(scope.namePrefix, name);
     const service = ctx.services[fullName];
+    if (!service && ctx.unpublished?.[fullName]) {
+        throw new UnpublishedError(fullName, ctx.unpublished[fullName]);
+    }
     if (!service) {
         throw new Error('unable to find ' + fullName);
     }

package/dist/schema/removed-properties.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertNoRemovedProperties = void 0;
+// Properties a build file may no longer have, with what takes their place: a file that
+// still has one fails to parse with that, rather than with an unknown key.
+function assertNoRemovedProperties(input, fileName) {
+    const tasks = isObject(input) && isObject(input.tasks) ? input.tasks : {};
+    for (const [name, task] of Object.entries(tasks)) {
+        if (isObject(task) && 'continuous' in task) {
+            throw new Error(`task ${name} in ${fileName}: continuous is for services only since hammerkit 2. A dev server that ` +
+                `watches its own files (ng serve, vite, nodemon) is a service with continuous: true, see ` +
+                `https://hammerkit.dev/docs/service/container#continuous`);
+        }
+    }
+}
+exports.assertNoRemovedProperties = assertNoRemovedProperties;
+function isObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=removed-properties.js.map