hammerkit 1.27.0-next.9 → 2.0.0-next.2

package/dist/server/service-runs.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mayOpenEndpoints = exports.getRunRepo = exports.toRunEndpoints = exports.refuseEndpoints = exports.getEndpointHosts = exports.getServiceRunName = void 0;
+const crypto_1 = require("crypto");
+const plan_1 = require("./plan");
+const policy_1 = require("./policy");
+const run_request_1 = require("./run-request");
+// The name of a service run when the request names none: the branch it runs from, as a DNS
+// label, so the runs of several branches stand side by side and each keeps its hosts.
+function getServiceRunName(branch) {
+    const name = (branch ?? '')
+        .toLowerCase()
+        .replace(/[^a-z0-9-]+/g, '-')
+        .replace(/-+/g, '-')
+        .slice(0, 40)
+        .replace(/^-+|-+$/g, '');
+    return run_request_1.SERVICE_RUN_NAME_PATTERN.test(name) ? name : 'run';
+}
+exports.getServiceRunName = getServiceRunName;
+/**
+ * The host labels of a run's endpoints: its name, the port and twelve hex digits of its
+ * owner (at most 40 + 5 + 2 + 12 and three dashes: a DNS label), so two callers with a branch of the same name get hosts of their own, and a run
+ * that replaces another of the same name takes over its hosts. Two endpoints on the same
+ * port (of two services) are told apart by their place.
+ */
+function getEndpointHosts(name, owner, endpoints) {
+    const of = (0, crypto_1.createHash)('sha256').update(`${owner.iss}\0${owner.sub}`).digest('hex').slice(0, 12);
+    return endpoints.map((endpoint, index) => endpoints.findIndex((other) => other.port === endpoint.port) === index
+        ? `${name}-${endpoint.port}-${of}`
+        : `${name}-${endpoint.port}-${index}-${of}`);
+}
+exports.getEndpointHosts = getEndpointHosts;
+// The container port of each `host:container` port of a planned service.
+function containerPorts(plan) {
+    return plan.ports.map((port) => Number(port.split(':').pop()));
+}
+/**
+ * Why the endpoints of a service run can't be published, or null. Each is a port its
+ * service declares, of a service the run starts. Under a `runs.secretNetwork` below `open`
+ * a service behind an endpoint may not read a secret or a credential of the server: a page
+ * is a way out that no mask of the log covers.
+ */
+function refuseEndpoints(request, plan, secretNetworkOpen) {
+    for (const endpoint of request.endpoints) {
+        const item = plan[endpoint.service];
+        if (!item || item.kind !== 'service') {
+            return `the endpoint ${endpoint.service}:${endpoint.port} names no service the run starts`;
+        }
+        if (!containerPorts(item).includes(endpoint.port)) {
+            const ports = containerPorts(item);
+            return `${endpoint.service} has no port ${endpoint.port}${ports.length > 0 ? `, its ports are ${ports.join(', ')}` : ', it declares none'}`;
+        }
+        const reads = (0, plan_1.getCredentialReads)(item);
+        if (!secretNetworkOpen && reads.length > 0) {
+            return `${endpoint.service} reads ${reads.join(', ')}, it can not be behind an endpoint on this server (runs.secretNetwork): a page could show it`;
+        }
+    }
+    return null;
+}
+exports.refuseEndpoints = refuseEndpoints;
+function toRunEndpoints(endpoints, hosts, url) {
+    return endpoints.map((endpoint, index) => ({
+        service: endpoint.service,
+        port: endpoint.port,
+        host: hosts[index],
+        url: url(hosts[index]),
+    }));
+}
+exports.toRunEndpoints = toRunEndpoints;
+// The repository of a run's source, which the endpoints grants are written for.
+function getRunRepo(run) {
+    return run.source.type === 'upload' ? null : run.source.repo;
+}
+exports.getRunRepo = getRunRepo;
+// Who may open the endpoints of a service run, and extend it, besides its owner: those
+// with an `open` or `publish` level for its repository.
+function mayOpenEndpoints(grant, run) {
+    const repo = getRunRepo(run);
+    return repo !== null && (0, policy_1.endpointLevel)(grant, repo) !== null;
+}
+exports.mayOpenEndpoints = mayOpenEndpoints;
+//# sourceMappingURL=service-runs.js.map

package/dist/server/timings.js

@@ -0,0 +1,132 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getTaskStats = exports.roughly = exports.ranMs = exports.waitedMs = void 0;
+const at = (iso) => (iso ? Date.parse(iso) : NaN);
+// How long a run waited in the queue for a place: from when it was queued (after its
+// approval, or when it woke) until it started, or until now while it waits.
+function waitedMs(run, now) {
+    const queued = at(run.queuedAt);
+    if (!Number.isFinite(queued)) {
+        return undefined;
+    }
+    const started = at(run.startedAt);
+    if (Number.isFinite(started) && started >= queued) {
+        return started - queued;
+    }
+    if (run.state === 'queued') {
+        return Math.max(0, now - queued);
+    }
+    // it ended before it started: cancelled in the queue
+    const finished = at(run.finishedAt);
+    return Number.isFinite(finished) && finished >= queued ? finished - queued : undefined;
+}
+exports.waitedMs = waitedMs;
+// How long a run ran: from its start to its end, or until now while it runs. A service run
+// counts until its services were up.
+function ranMs(run, now) {
+    const started = at(run.startedAt);
+    if (!Number.isFinite(started)) {
+        return undefined;
+    }
+    const up = at(run.upAt);
+    const finished = at(run.finishedAt);
+    const end = Number.isFinite(up) && up >= started ? up : Number.isFinite(finished) ? finished : now;
+    return Math.max(0, end - started);
+}
+exports.ranMs = ranMs;
+// a span of time as a person reads it at a glance: 2d 3h, 7h 59m, 29m 5s, 12s, 340ms
+function roughly(ms) {
+    if (ms < 1000) {
+        return `${Math.max(0, Math.round(ms))}ms`;
+    }
+    const seconds = Math.round(ms / 1000);
+    const [d, h, m, s] = [
+        Math.floor(seconds / 86400),
+        Math.floor(seconds / 3600) % 24,
+        Math.floor(seconds / 60) % 60,
+        seconds % 60,
+    ];
+    if (d > 0) {
+        return `${d}d ${h}h`;
+    }
+    if (h > 0) {
+        return `${h}h ${m}m`;
+    }
+    if (m > 0) {
+        return s > 0 && m < 10 ? `${m}m ${s}s` : `${m}m`;
+    }
+    return `${s}s`;
+}
+exports.roughly = roughly;
+function quantile(sorted, q) {
+    if (sorted.length === 0) {
+        return undefined;
+    }
+    return sorted[Math.min(sorted.length - 1, Math.max(0, Math.ceil(q * sorted.length) - 1))];
+}
+/**
+ * Per task and repository, newest first: how often it ran and how, what it took the last
+ * time, and the median and 90th percentile of the times it executed. `runs` is newest first.
+ */
+function getTaskStats(runs, now) {
+    const groups = new Map();
+    for (const run of runs) {
+        const repo = run.source.repo ?? 'an upload';
+        const waited = waitedMs(run, now);
+        for (const [task, timing] of Object.entries(run.timings ?? {})) {
+            if (timing.status === 'running' || timing.status === 'skipped' || timing.status === 'cancelled') {
+                continue;
+            }
+            const key = `${repo}\0${task}`;
+            let group = groups.get(key);
+            if (!group) {
+                group = {
+                    stats: {
+                        repo,
+                        task,
+                        runs: 0,
+                        succeeded: 0,
+                        failed: 0,
+                        cached: 0,
+                        last: {
+                            status: timing.status,
+                            at: timing.finishedAt ?? run.finishedAt ?? run.createdAt,
+                            ...(timing.durationMs !== undefined ? { durationMs: timing.durationMs } : {}),
+                        },
+                    },
+                    durations: [],
+                    waits: [],
+                };
+                groups.set(key, group);
+            }
+            const { stats } = group;
+            stats.runs++;
+            if (timing.status === 'cached') {
+                stats.cached++;
+                continue;
+            }
+            timing.status === 'succeeded' ? stats.succeeded++ : stats.failed++;
+            if (timing.durationMs !== undefined) {
+                group.durations.push(timing.durationMs);
+            }
+            if (waited !== undefined) {
+                group.waits.push(waited);
+            }
+        }
+    }
+    return [...groups.values()].map(({ stats, durations, waits }) => {
+        durations.sort((a, b) => a - b);
+        waits.sort((a, b) => a - b);
+        const median = quantile(durations, 0.5);
+        const p90 = quantile(durations, 0.9);
+        const wait = quantile(waits, 0.5);
+        return {
+            ...stats,
+            ...(median !== undefined ? { medianMs: median } : {}),
+            ...(p90 !== undefined ? { p90Ms: p90 } : {}),
+            ...(wait !== undefined ? { medianWaitMs: wait } : {}),
+        };
+    });
+}
+exports.getTaskStats = getTaskStats;
+//# sourceMappingURL=timings.js.map

package/dist/server/wait-reason.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describeWait = void 0;
+// What keeps a queued run from starting, in words: `mine` says whose limit it is, `keys`
+// names the setting of the server that sets it.
+function describeWait(reason, mine, keys = true) {
+    switch (reason.type) {
+        case 'own-limit':
+            return `${mine ? 'your' : 'its owner’s'} limit of running runs, ${reason.running} of ${reason.limit}${keys ? ' (runs.limits.running)' : ''}`;
+        case 'sandbox':
+            return reason.run ? `its sandbox runs ${reason.run}` : 'another run works on its sandbox';
+        case 'held':
+            return reason.run ? `${reason.run} holds what it needs` : 'another run holds what it needs';
+        case 'place':
+            return `no free place, ${reason.used} of ${reason.max} taken${keys ? ' (runs.maxConcurrent)' : ''}`;
+        case 'starting':
+            return 'starts now';
+    }
+}
+exports.describeWait = describeWait;
+//# sourceMappingURL=wait-reason.js.map

package/dist/utils/tar.js

@@ -3,7 +3,34 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.packArchive = void 0;
 const tar_1 = require("tar");
 function packArchive(options, files) {
-    return (0, tar_1.create)({ ...options, jobs: 1 }, files);
+    return (0, tar_1.create)({ ...options, jobs: 1, linkCache: new ExactLinkCache() }, files);
 }
 exports.packArchive = packArchive;
+// node-tar packs a file with more than one link as a link to the first file it packed with
+// the same `dev:ino`. On Windows a file id has 64 bits, and Node gives it as a number, so
+// ids above 2^53 are rounded and files of two link groups can get the same one. Packed as
+// a link, a file would be restored with the other file's content. This cache leaves out the
+// ids that may be rounded, so those files are packed in full.
+//
+// node-tar asks the cache in two places. A WriteEntry links to the path it gets only when
+// that path is in the packed directory, and packs the file in full otherwise. The Pack treats
+// a file it gets no path for as the first of its links, and takes a path for it that ends
+// the archive a second time when the file is empty and the last one packed: an empty file
+// whose other link is outside the packed directory, as in a pnpm node_modules, or any empty
+// file with a rounded id. That throws "write after end" (a zlib stream error with gzip)
+// where nothing can catch it. With one file read at a time that path is not needed, so the
+// cache never answers with nothing: for a file it has no path for, it answers NOT_PACKED,
+// which is in no directory.
+class ExactLinkCache extends Map {
+    get(key) {
+        return super.get(key) || NOT_PACKED;
+    }
+    set(key, path) {
+        return isExact(key) ? super.set(key, path) : this;
+    }
+}
+const NOT_PACKED = '\0';
+function isExact(key) {
+    return key.split(':').every((part) => Number.isSafeInteger(Number(part)));
+}
 //# sourceMappingURL=tar.js.map

package/dist/utils/terminal-prompt.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isYes = exports.getTerminalPrompt = exports.terminalPrompt = void 0;
+const readline_1 = require("readline");
+/**
+ * Asks the person at the terminal one question and answers the line they typed, or
+ * undefined when the input ended or the signal stopped the command first (Ctrl-C).
+ * The terminal stays in its own line mode, so Ctrl-C is a signal as anywhere else.
+ */
+function terminalPrompt(input, output, signal) {
+    return (question) => new Promise((resolve) => {
+        if (signal.aborted) {
+            resolve(undefined);
+            return;
+        }
+        const lines = (0, readline_1.createInterface)({ input, output, terminal: false });
+        let answer;
+        const stop = () => lines.close();
+        signal.addEventListener('abort', stop, { once: true });
+        lines.once('close', () => {
+            signal.removeEventListener('abort', stop);
+            if (answer === undefined) {
+                // what was asked ends on a line of its own
+                output.write('\n');
+            }
+            resolve(answer);
+        });
+        lines.question(question, (line) => {
+            answer = line;
+            lines.close();
+        });
+    });
+}
+exports.terminalPrompt = terminalPrompt;
+/**
+ * The prompt of the CLI: only when somebody sits at a terminal to answer it, never in
+ * CI, where a question would wait until the job times out.
+ */
+function getTerminalPrompt(processEnvs, signal, stdio = process) {
+    if (!stdio.stdin.isTTY || !stdio.stdout.isTTY || isSet(processEnvs.CI)) {
+        return undefined;
+    }
+    return terminalPrompt(stdio.stdin, stdio.stdout, signal);
+}
+exports.getTerminalPrompt = getTerminalPrompt;
+function isSet(value) {
+    return value !== undefined && value !== '' && value !== '0' && value.toLowerCase() !== 'false';
+}
+function isYes(answer) {
+    return /^\s*y(es)?\s*$/i.test(answer ?? '');
+}
+exports.isYes = isYes;
+//# sourceMappingURL=terminal-prompt.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hammerkit",
   "description": "Containerized build tool with incremental caching that runs the same build file locally, in Docker and on Kubernetes.",
-  "version": "1.27.0-next.9",
+  "version": "2.0.0-next.2",
   "keywords": [
     "build",
     "build-tool",
@@ -22,6 +22,11 @@
     "build.schema.json",
     "harness"
   ],
+  "pkg": {
+    "assets": [
+      "dist/dashboard/**/*"
+    ]
+  },
   "pi": {
     "extensions": [
       "./harness/pi.ts"
@@ -43,8 +48,9 @@
     "type": "git"
   },
   "scripts": {
-    "prepack": "tsc -b tsconfig.json",
+    "prepack": "tsc -b tsconfig.json && npm run build:dashboard",
     "build": "tsc -b tsconfig.json",
+    "build:dashboard": "npm ci --prefix dashboard --no-audit --no-fund && npm run build --prefix dashboard",
     "test": "vitest run",
     "test:integration": "vitest run --mode integration",
     "test:mutation": "stryker run",