niceeval 0.13.3 → 0.13.4-canary.39

package/dist/sandbox/docker-task-build-cache.d.cts

@@ -0,0 +1,68 @@
+import type { DockerCapacityObservation as ProviderCapacityObservation, DockerCacheDomainDescriptor as CacheDomainDescriptor } from "../docker/cache-administration.cjs";
+export interface TaskBuildInventoryEntry {
+    readonly buildKey: string;
+    readonly tag: string;
+    readonly imageId: string;
+    readonly createdAt: string;
+    readonly lastSuccessfulUseAt: string | null;
+    readonly protectedUntil: string;
+    readonly state: "active-leased" | "cold-reusable" | "unverified";
+}
+export interface TaskBuildDomainInventory {
+    readonly domainId: string;
+    readonly providerFamily: "docker";
+    readonly backendKind: "docker-images";
+    readonly state: "verified-managed";
+    readonly entries: readonly TaskBuildInventoryEntry[];
+}
+export interface TaskBuildCacheService {
+    lookup(buildKey: string, tag: string, manifestDigest: string, dockerSocketPath?: string): Promise<boolean>;
+    publish(buildKey: string, tag: string, manifestDigest: string, operationId: string, dockerSocketPath?: string): Promise<void>;
+    acquireUse(buildKey: string, tag: string, manifestDigest: string, dockerSocketPath?: string): Promise<{
+        release(): void;
+    }>;
+}
+export interface TaskBuildCacheAdminService {
+    inventory(): Promise<TaskBuildDomainInventory>;
+    planGc(domainId: string): Promise<TaskBuildGcPlan>;
+    applyGc(domainId: string, planId: string): Promise<TaskBuildGcOutcome>;
+}
+export interface TaskBuildGcPlan {
+    readonly schemaVersion: 1;
+    readonly planId: string;
+    readonly domainId: string;
+    readonly ownerId: string;
+    readonly backendIdentity: string;
+    readonly authorityEpoch: string;
+    readonly policyVersion: 1;
+    readonly registrySafetyRevision: number;
+    readonly observedAt: string;
+    readonly expiresAt: string;
+    readonly planDigest: string;
+    readonly candidates: ReadonlyArray<{
+        readonly buildKey: string;
+        readonly tag: string;
+        readonly imageId: string;
+        readonly manifestDigest: string;
+        readonly generation: number;
+        readonly evidenceDigest: string;
+        readonly ruleId: "max-age/task-build";
+    }>;
+}
+export declare function observeDockerBuildKitCapacity(): Promise<ProviderCapacityObservation>;
+export declare function listDockerCacheDomains(): Promise<readonly CacheDomainDescriptor[]>;
+export declare function dockerTaskBuildAuthorityFingerprint(): Promise<string>;
+export declare function makeTaskBuildCacheService(): TaskBuildCacheService;
+export declare function inventoryTaskBuildDomain(dockerSocketPath?: string): Promise<TaskBuildDomainInventory>;
+export declare function planTaskBuildGc(domainId: string): Promise<TaskBuildGcPlan>;
+export interface TaskBuildGcOutcome {
+    readonly planId: string;
+    readonly domainId: string;
+    readonly outcomes: ReadonlyArray<{
+        readonly buildKey: string;
+        readonly status: "deleted" | "already-absent" | "skipped" | "failed";
+        readonly reason: string;
+    }>;
+}
+export declare function applyTaskBuildGc(domainId: string, planId: string): Promise<TaskBuildGcOutcome>;
+export declare const liveTaskBuildCacheAdminService: TaskBuildCacheAdminService;

package/dist/sandbox/docker-task-build-cache.d.mts

@@ -0,0 +1,68 @@
+import type { DockerCapacityObservation as ProviderCapacityObservation, DockerCacheDomainDescriptor as CacheDomainDescriptor } from "../docker/cache-administration.mjs";
+export interface TaskBuildInventoryEntry {
+    readonly buildKey: string;
+    readonly tag: string;
+    readonly imageId: string;
+    readonly createdAt: string;
+    readonly lastSuccessfulUseAt: string | null;
+    readonly protectedUntil: string;
+    readonly state: "active-leased" | "cold-reusable" | "unverified";
+}
+export interface TaskBuildDomainInventory {
+    readonly domainId: string;
+    readonly providerFamily: "docker";
+    readonly backendKind: "docker-images";
+    readonly state: "verified-managed";
+    readonly entries: readonly TaskBuildInventoryEntry[];
+}
+export interface TaskBuildCacheService {
+    lookup(buildKey: string, tag: string, manifestDigest: string, dockerSocketPath?: string): Promise<boolean>;
+    publish(buildKey: string, tag: string, manifestDigest: string, operationId: string, dockerSocketPath?: string): Promise<void>;
+    acquireUse(buildKey: string, tag: string, manifestDigest: string, dockerSocketPath?: string): Promise<{
+        release(): void;
+    }>;
+}
+export interface TaskBuildCacheAdminService {
+    inventory(): Promise<TaskBuildDomainInventory>;
+    planGc(domainId: string): Promise<TaskBuildGcPlan>;
+    applyGc(domainId: string, planId: string): Promise<TaskBuildGcOutcome>;
+}
+export interface TaskBuildGcPlan {
+    readonly schemaVersion: 1;
+    readonly planId: string;
+    readonly domainId: string;
+    readonly ownerId: string;
+    readonly backendIdentity: string;
+    readonly authorityEpoch: string;
+    readonly policyVersion: 1;
+    readonly registrySafetyRevision: number;
+    readonly observedAt: string;
+    readonly expiresAt: string;
+    readonly planDigest: string;
+    readonly candidates: ReadonlyArray<{
+        readonly buildKey: string;
+        readonly tag: string;
+        readonly imageId: string;
+        readonly manifestDigest: string;
+        readonly generation: number;
+        readonly evidenceDigest: string;
+        readonly ruleId: "max-age/task-build";
+    }>;
+}
+export declare function observeDockerBuildKitCapacity(): Promise<ProviderCapacityObservation>;
+export declare function listDockerCacheDomains(): Promise<readonly CacheDomainDescriptor[]>;
+export declare function dockerTaskBuildAuthorityFingerprint(): Promise<string>;
+export declare function makeTaskBuildCacheService(): TaskBuildCacheService;
+export declare function inventoryTaskBuildDomain(dockerSocketPath?: string): Promise<TaskBuildDomainInventory>;
+export declare function planTaskBuildGc(domainId: string): Promise<TaskBuildGcPlan>;
+export interface TaskBuildGcOutcome {
+    readonly planId: string;
+    readonly domainId: string;
+    readonly outcomes: ReadonlyArray<{
+        readonly buildKey: string;
+        readonly status: "deleted" | "already-absent" | "skipped" | "failed";
+        readonly reason: string;
+    }>;
+}
+export declare function applyTaskBuildGc(domainId: string, planId: string): Promise<TaskBuildGcOutcome>;
+export declare const liveTaskBuildCacheAdminService: TaskBuildCacheAdminService;

package/dist/sandbox/docker-task-build-cache.d.ts

@@ -0,0 +1,68 @@
+import type { DockerCapacityObservation as ProviderCapacityObservation, DockerCacheDomainDescriptor as CacheDomainDescriptor } from "../docker/cache-administration.js";
+export interface TaskBuildInventoryEntry {
+    readonly buildKey: string;
+    readonly tag: string;
+    readonly imageId: string;
+    readonly createdAt: string;
+    readonly lastSuccessfulUseAt: string | null;
+    readonly protectedUntil: string;
+    readonly state: "active-leased" | "cold-reusable" | "unverified";
+}
+export interface TaskBuildDomainInventory {
+    readonly domainId: string;
+    readonly providerFamily: "docker";
+    readonly backendKind: "docker-images";
+    readonly state: "verified-managed";
+    readonly entries: readonly TaskBuildInventoryEntry[];
+}
+export interface TaskBuildCacheService {
+    lookup(buildKey: string, tag: string, manifestDigest: string, dockerSocketPath?: string): Promise<boolean>;
+    publish(buildKey: string, tag: string, manifestDigest: string, operationId: string, dockerSocketPath?: string): Promise<void>;
+    acquireUse(buildKey: string, tag: string, manifestDigest: string, dockerSocketPath?: string): Promise<{
+        release(): void;
+    }>;
+}
+export interface TaskBuildCacheAdminService {
+    inventory(): Promise<TaskBuildDomainInventory>;
+    planGc(domainId: string): Promise<TaskBuildGcPlan>;
+    applyGc(domainId: string, planId: string): Promise<TaskBuildGcOutcome>;
+}
+export interface TaskBuildGcPlan {
+    readonly schemaVersion: 1;
+    readonly planId: string;
+    readonly domainId: string;
+    readonly ownerId: string;
+    readonly backendIdentity: string;
+    readonly authorityEpoch: string;
+    readonly policyVersion: 1;
+    readonly registrySafetyRevision: number;
+    readonly observedAt: string;
+    readonly expiresAt: string;
+    readonly planDigest: string;
+    readonly candidates: ReadonlyArray<{
+        readonly buildKey: string;
+        readonly tag: string;
+        readonly imageId: string;
+        readonly manifestDigest: string;
+        readonly generation: number;
+        readonly evidenceDigest: string;
+        readonly ruleId: "max-age/task-build";
+    }>;
+}
+export declare function observeDockerBuildKitCapacity(): Promise<ProviderCapacityObservation>;
+export declare function listDockerCacheDomains(): Promise<readonly CacheDomainDescriptor[]>;
+export declare function dockerTaskBuildAuthorityFingerprint(): Promise<string>;
+export declare function makeTaskBuildCacheService(): TaskBuildCacheService;
+export declare function inventoryTaskBuildDomain(dockerSocketPath?: string): Promise<TaskBuildDomainInventory>;
+export declare function planTaskBuildGc(domainId: string): Promise<TaskBuildGcPlan>;
+export interface TaskBuildGcOutcome {
+    readonly planId: string;
+    readonly domainId: string;
+    readonly outcomes: ReadonlyArray<{
+        readonly buildKey: string;
+        readonly status: "deleted" | "already-absent" | "skipped" | "failed";
+        readonly reason: string;
+    }>;
+}
+export declare function applyTaskBuildGc(domainId: string, planId: string): Promise<TaskBuildGcOutcome>;
+export declare const liveTaskBuildCacheAdminService: TaskBuildCacheAdminService;

package/dist/sandbox/docker-task-build-cache.js

@@ -0,0 +1,20 @@
+import { createRequire as __niceevalCreateRequire } from "node:module";
+const __niceevalRequire = __niceevalCreateRequire(import.meta.url);
+const __niceevalCanonical = __niceevalRequire("./docker-task-build-cache.cjs");
+const __niceevalExport0 = __niceevalCanonical["applyTaskBuildGc"];
+export { __niceevalExport0 as applyTaskBuildGc };
+const __niceevalExport1 = __niceevalCanonical["dockerTaskBuildAuthorityFingerprint"];
+export { __niceevalExport1 as dockerTaskBuildAuthorityFingerprint };
+const __niceevalExport2 = __niceevalCanonical["inventoryTaskBuildDomain"];
+export { __niceevalExport2 as inventoryTaskBuildDomain };
+const __niceevalExport3 = __niceevalCanonical["listDockerCacheDomains"];
+export { __niceevalExport3 as listDockerCacheDomains };
+const __niceevalExport4 = __niceevalCanonical["liveTaskBuildCacheAdminService"];
+export { __niceevalExport4 as liveTaskBuildCacheAdminService };
+const __niceevalExport5 = __niceevalCanonical["makeTaskBuildCacheService"];
+export { __niceevalExport5 as makeTaskBuildCacheService };
+const __niceevalExport6 = __niceevalCanonical["observeDockerBuildKitCapacity"];
+export { __niceevalExport6 as observeDockerBuildKitCapacity };
+const __niceevalExport7 = __niceevalCanonical["planTaskBuildGc"];
+export { __niceevalExport7 as planTaskBuildGc };
+//# sourceMappingURL=docker-task-build-cache.js.map

package/dist/sandbox/docker-task-build-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-task-build-cache.js","sources":[],"names":[],"mappings":""}

package/dist/sandbox/docker.cjs

@@ -536,6 +536,54 @@ class DockerSandbox {
         }
         return sandbox;
     }
+    /** Control service owns create/remove; this handle only starts, initializes and detaches. */
+    static async createControlled(options, create) {
+        const sandbox = new DockerSandbox(options);
+        const imageName = sandbox.image ?? DOCKER_IMAGES[sandbox.runtime];
+        if (!imageName)
+            throw new Error((0, index_ts_1.t)("docker.unsupportedRuntime", { runtime: sandbox.runtime }));
+        await sandbox.ensureImage(imageName);
+        const isDind = sandbox.dockerAccess?.mode === "dind";
+        if (isDind) {
+            const inspectedImage = await sandbox.docker.getImage(imageName).inspect();
+            const declaredUser = inspectedImage.Config?.User?.trim();
+            sandbox.imageDefaultUser = declaredUser === "" ? undefined : declaredUser;
+        }
+        const ttlSec = Math.ceil(Math.max(sandbox.lifetimeMs ?? (sandbox.timeout ?? TTL_BASE_WITHOUT_DEADLINE) * TTL_MULTIPLIER, TTL_FLOOR_MS) / 1000);
+        sandbox.expiresAtMs = Date.now() + ttlSec * 1000;
+        const dindCommand = isDind ? (0, dind_supervisor_ts_1.dindContainerCommand)(ttlSec, CONTAINER_LOG) : undefined;
+        const tmpfs = dockerHostConfig(sandbox.privileged, sandbox.resources).Tmpfs ?? {};
+        const created = await create({
+            image: imageName,
+            command: dindCommand === undefined
+                ? ["sh", "-c", `touch ${CONTAINER_LOG}; chmod 666 ${CONTAINER_LOG}; exec timeout ${ttlSec} tail -n +1 -F ${CONTAINER_LOG}`]
+                : [...dindCommand.Entrypoint.slice(1), ...dindCommand.Cmd],
+            ...(dindCommand === undefined ? {} : { entrypoint: dindCommand.Entrypoint[0] }),
+            environment: [],
+            workingDir: sandbox.workdir,
+            ...(isDind ? { user: ROOT_USER } : sandbox.userOverride === undefined ? {} : { user: sandbox.userOverride }),
+            tmpfs,
+        });
+        sandbox.container = sandbox.docker.getContainer(created.containerId);
+        sandbox.network = sandbox.docker.getNetwork(created.networkId);
+        sandbox._containerId = created.containerId;
+        sandbox.releaseMode = "detach";
+        try {
+            await sandbox.container.start();
+            await sandbox.waitForReadiness();
+            await sandbox.ensureRunnerTools();
+            await sandbox.resolveDefaultIdentity();
+            await sandbox.runCommandAsRoot("mkdir", ["-p", sandbox.workdir]);
+            await sandbox.runCommandAsRoot("chown", ["-R", sandbox.chownTarget(), sandbox.workdir]);
+            await sandbox.runCommandAsRoot("mkdir", ["-p", sandbox.npmGlobalDir]);
+            await sandbox.runCommandAsRoot("chown", ["-R", sandbox.chownTarget(), sandbox.npmGlobalDir]);
+            await sandbox.runCommand("npm", ["config", "set", "prefix", sandbox.npmGlobalDir]);
+            return sandbox;
+        }
+        catch (error) {
+            throw await sandbox.withInitializationDiagnostics(error);
+        }
+    }
     /** DinD 容器 kill-on-failure 前收集有界诊断，普通 Docker 保持原错误形状。 */
     async withInitializationDiagnostics(error) {
         if (this.dockerAccess?.mode !== "dind" || this.container === null)
@@ -1254,6 +1302,8 @@ class DockerSandbox {
             return;
         if (this.releaseMode === "detach") {
             this.container = null;
+            this.network = null;
+            await this.afterStop?.();
             return;
         }
         const container = this.container;