redkite 0.1.6

package/dist/docker.js

@@ -0,0 +1,325 @@
+const RUNNING = new Set(["running", "restarting"]);
+// What a container was created from, recorded on the container itself. Docker
+// cannot change a label without recreating, which is exactly when it changes
+export const SPEC_LABEL = "redkite.spec";
+// One command in place of an inspect per object. Every guard in this file used
+// to be its own round trip, and a round trip here is a container exec
+const SNAPSHOT = [
+    `ps -a --format '{{.Names}}\t{{.State}}\t{{.Label "${SPEC_LABEL}"}}'`,
+    "docker image ls --format '{{.Repository}}:{{.Tag}}'",
+    "docker network ls --format '{{.Name}}'",
+].join("; echo --- ; ");
+export class Docker {
+    host;
+    network;
+    image;
+    container;
+    // The promise, not the state. Two builds and the infrastructure step all ask
+    // for this at once, and caching the result alone lets every one of them miss
+    state;
+    constructor(host) {
+        this.host = host;
+        this.network = new DockerNetwork(this);
+        this.image = new DockerImage(this);
+        this.container = new DockerContainer(this);
+    }
+    // Read once, then kept current by the mutations below. A deploy owns the
+    // host for its duration, so nothing else is moving underneath it
+    async snapshot() {
+        this.state ??= this.read();
+        return await this.state;
+    }
+    async read() {
+        const { stdout } = await this.run(SNAPSHOT);
+        const [containers = "", images = "", networks = ""] = stdout.split("---");
+        return {
+            containers: new Map(lines(containers).map((line) => {
+                const [name = "", state = "unknown", spec = ""] = line.split("\t");
+                return [name, { state, spec: spec || undefined }];
+            })),
+            // Both spellings, so a lookup by bare name and one by name:tag both hit
+            images: new Set(lines(images).flatMap((line) => [line, line.replace(/:latest$/, "")])),
+            networks: new Set(lines(networks)),
+        };
+    }
+    async run(command, onLine) {
+        return await this.host.sh(`docker ${command}`, onLine);
+    }
+    // Called by every mutation, so the snapshot never goes stale
+    async track(change) {
+        change(await this.snapshot());
+    }
+    async runOrThrow(command, message, onLine) {
+        const result = await this.run(command, onLine);
+        if (result.code === 0)
+            return result;
+        throw new Error(`${message}: ${result.stderr || result.stdout}`);
+    }
+}
+class DockerNetwork {
+    docker;
+    constructor(docker) {
+        this.docker = docker;
+    }
+    async exists(name) {
+        return (await this.docker.snapshot()).networks.has(name);
+    }
+    async create(name, subnet) {
+        if (await this.exists(name))
+            return false;
+        const suffix = subnet ? ` --subnet=${subnet}` : "";
+        await this.docker.runOrThrow(`network create ${name}${suffix}`, "Network creation failed");
+        await this.docker.track((state) => state.networks.add(name));
+        return true;
+    }
+    async remove(name) {
+        if (!(await this.exists(name)))
+            return false;
+        await this.docker.runOrThrow(`network rm ${name}`, "Network removal failed");
+        await this.docker.track((state) => state.networks.delete(name));
+        return true;
+    }
+    // Disconnect can fail because the container was never attached, which is not
+    // an error. Connect failing is, the address is what nginx resolves to
+    async reconnect(network, container, ip) {
+        if (!(await this.docker.container.exists(container)))
+            return false;
+        await this.docker.run(`network disconnect ${network} ${container}`);
+        await this.docker.runOrThrow(`network connect --ip ${ip} ${network} ${container}`, "Network connect failed");
+        return true;
+    }
+}
+class DockerImage {
+    docker;
+    constructor(docker) {
+        this.docker = docker;
+    }
+    async exists(name) {
+        return (await this.docker.snapshot()).images.has(name);
+    }
+    // Every version of one image the host is holding. A deploy tags what it built
+    // by release, and without this the previous ones are never reclaimed.
+    // :latest is not one of them: it is the moving name a container is created
+    // from, and reclaiming it leaves the host unable to start the app
+    async versionsOf(repository) {
+        const images = (await this.docker.snapshot()).images;
+        return [...images].filter((name) => name.startsWith(`${repository}:`) && name !== `${repository}:latest`);
+    }
+    // BuildKit is already inside the daemon that will run the container, so the
+    // image it produces never has to be serialised, transferred or loaded
+    async build(spec, onLine) {
+        const command = [
+            "build",
+            // Provenance attestations make the result a manifest list, which is a
+            // different thing to tag and nothing here consumes them
+            "--progress plain --provenance=false --pull",
+            `-f ${spec.dockerfile}`,
+            ...spec.tags.map((tag) => `-t ${tag}`),
+            ...Object.entries(spec.secrets ?? {}).map(([id, path]) => `--secret id=${id},src=${path}`),
+            ...(spec.target ? [`--target ${spec.target}`] : []),
+            spec.context,
+        ].join(" ");
+        await this.docker.runOrThrow(command, "Image build failed", onLine);
+        await this.docker.track((state) => {
+            for (const tag of spec.tags)
+                state.images.add(tag);
+        });
+        return true;
+    }
+    // A second name for an image that is already local. Costs nothing, and it is
+    // what lets the next deploy recognise a commit it already holds
+    async retag(from, to) {
+        await this.docker.runOrThrow(`tag ${from} ${to}`, "Image tagging failed");
+        await this.docker.track((state) => state.images.add(to));
+        return true;
+    }
+    async remove(name) {
+        if (!(await this.exists(name)))
+            return false;
+        await this.docker.runOrThrow(`image remove -f ${name}`, "Image removal failed");
+        await this.docker.track((state) => state.images.delete(name));
+        return true;
+    }
+}
+class DockerContainer {
+    docker;
+    constructor(docker) {
+        this.docker = docker;
+    }
+    async exists(name) {
+        return (await this.docker.snapshot()).containers.has(name);
+    }
+    async status(name) {
+        return (await this.docker.snapshot()).containers.get(name)?.state ?? "none";
+    }
+    // What the running container was created from. Absent for one redkite did not
+    // create, or created before it started recording it
+    async specOf(name) {
+        return (await this.docker.snapshot()).containers.get(name)?.spec;
+    }
+    async isRunning(name) {
+        return RUNNING.has(await this.status(name));
+    }
+    async start(name) {
+        if (!(await this.exists(name))) {
+            throw new Error(`Cannot start ${name}, it does not exist`);
+        }
+        await this.docker.runOrThrow(`container start ${name}`, "Container start failed");
+        await this.docker.track((state) => set(state, name, "running"));
+        return true;
+    }
+    async stop(name) {
+        if (!(await this.exists(name)))
+            return false;
+        await this.docker.runOrThrow(`container stop ${name}`, "Container stop failed");
+        await this.docker.track((state) => set(state, name, "exited"));
+        return true;
+    }
+    // Refuses rather than clobbers, a rename onto an existing name would lose
+    // whichever container is already there
+    async rename(from, to) {
+        if (!(await this.exists(from)))
+            return false;
+        if (await this.exists(to))
+            return false;
+        await this.docker.runOrThrow(`container rename ${from} ${to}`, "Container rename failed");
+        await this.docker.track((state) => {
+            const held = state.containers.get(from) ?? { state: "unknown" };
+            state.containers.delete(from);
+            state.containers.set(to, held);
+        });
+        return true;
+    }
+    async remove(name) {
+        if (!(await this.exists(name)))
+            return false;
+        if (await this.isRunning(name)) {
+            throw new Error(`Cannot remove ${name} while it is running`);
+        }
+        await this.docker.runOrThrow(`container rm ${name}`, "Container removal failed");
+        await this.docker.track((state) => state.containers.delete(name));
+        return true;
+    }
+    async create(builder) {
+        await this.docker.runOrThrow(builder.parse(), "Container create failed");
+        await this.docker.track((state) => state.containers.set(builder.named(), {
+            state: "created",
+            spec: builder.labelled(SPEC_LABEL),
+        }));
+        return true;
+    }
+    builder() {
+        return new DockerBuilder(this);
+    }
+}
+// A state change keeps whatever the container was created from: the label is
+// on the container, and only a recreate can move it
+function set(state, name, next) {
+    state.containers.set(name, { ...state.containers.get(name), state: next });
+}
+function lines(block) {
+    return block
+        .split("\n")
+        .map((line) => line.trim())
+        .filter(Boolean);
+}
+export class DockerBuilder {
+    container;
+    _name = "";
+    _image = "";
+    _hostname;
+    _ip;
+    _restart;
+    _networks = [];
+    _volumes = [];
+    _hosts = [];
+    _ports = [];
+    _env = [];
+    _labels = new Map();
+    _envFile;
+    constructor(container) {
+        this.container = container;
+    }
+    name(value) {
+        this._name = value;
+        return this;
+    }
+    image(value) {
+        this._image = value;
+        return this;
+    }
+    hostname(value) {
+        this._hostname = value;
+        return this;
+    }
+    network(value) {
+        this._networks.push(value);
+        return this;
+    }
+    volume(from, to) {
+        this._volumes.push(`${from}:${to}`);
+        return this;
+    }
+    extraHost(name, ip) {
+        this._hosts.push(`${name}:${ip}`);
+        return this;
+    }
+    restart(value) {
+        this._restart = value;
+        return this;
+    }
+    ip(value) {
+        this._ip = value;
+        return this;
+    }
+    env(name, value) {
+        this._env.push(`${name}=${value}`);
+        return this;
+    }
+    // A path on the host rather than the values themselves, so a password is
+    // never an argument in the process list or in the shell history
+    envFile(path) {
+        this._envFile = path;
+        return this;
+    }
+    label(name, value) {
+        this._labels.set(name, value);
+        return this;
+    }
+    labelled(name) {
+        return this._labels.get(name);
+    }
+    port(from, to) {
+        this._ports.push(`${from}:${to}`);
+        return this;
+    }
+    named() {
+        return this._name;
+    }
+    parse() {
+        if (!this._name)
+            throw new Error("A container needs a name");
+        if (!this._image)
+            throw new Error(`${this._name} has no image`);
+        // Defaults to the container name. The original emitted "--hostname
+        // undefined", because nothing ever called the setter
+        const hostname = this._hostname ?? this._name;
+        return [
+            `container create --name ${this._name} --hostname ${hostname}`,
+            ...this._volumes.map((volume) => `-v ${volume}`),
+            ...this._networks.map((network) => `--network ${network}`),
+            ...this._ports.map((port) => `-p ${port}`),
+            ...this._hosts.map((host) => `--add-host ${host}`),
+            ...[...this._labels].map(([name, value]) => `--label ${name}=${value}`),
+            ...(this._envFile ? [`--env-file ${this._envFile}`] : []),
+            ...this._env.map((entry) => `-e ${entry}`),
+            ...(this._ip ? [`--ip ${this._ip}`] : []),
+            ...(this._restart ? [`--restart ${this._restart}`] : []),
+            this._image,
+        ].join(" ");
+    }
+    async create() {
+        return await this.container.create(this);
+    }
+}
+//# sourceMappingURL=docker.js.map

package/dist/docker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker.js","sourceRoot":"","sources":["../src/docker.ts"],"names":[],"mappings":"AAqBA,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAEnD,8EAA8E;AAC9E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC;AAEzC,+EAA+E;AAC/E,sEAAsE;AACtE,MAAM,QAAQ,GAAG;IACf,qDAAqD,UAAU,MAAM;IACrE,qDAAqD;IACrD,wCAAwC;CACzC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AAUxB,MAAM,OAAO,MAAM;IASY;IARpB,OAAO,CAAgB;IACvB,KAAK,CAAc;IACnB,SAAS,CAAkB;IAEpC,6EAA6E;IAC7E,6EAA6E;IACrE,KAAK,CAAsB;IAEnC,YAA6B,IAAU;QAAV,SAAI,GAAJ,IAAI,CAAM;QACrC,IAAI,CAAC,OAAO,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,yEAAyE;IACzE,iEAAiE;IACjE,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3B,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,CAAC,UAAU,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,EAAE,QAAQ,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAE1E,OAAO;YACL,UAAU,EAAE,IAAI,GAAG,CACjB,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;gBAC7B,MAAM,CAAC,IAAI,GAAG,EAAE,EAAE,KAAK,GAAG,SAAS,EAAE,IAAI,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACnE,OAAO,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;YACpD,CAAC,CAAC,CACH;YACD,wEAAwE;YACxE,MAAM,EAAE,IAAI,GAAG,CACb,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CACtE;YACD,QAAQ,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;SACnC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAe,EAAE,MAAe;QACxC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IAED,6DAA6D;IAC7D,KAAK,CAAC,KAAK,CAAC,MAAkC;QAC5C,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,OAAe,EAAE,MAAe;QAChE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/C,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QAErC,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;CACF;AAED,MAAM,aAAa;IACY;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,MAAe;QACxC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAE1C,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAC1B,kBAAkB,IAAI,GAAG,MAAM,EAAE,EACjC,yBAAyB,CAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAE7C,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,cAAc,IAAI,EAAE,EAAE,wBAAwB,CAAC,CAAC;QAC7E,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IACtE,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,SAAiB,EAAE,EAAU;QAC5D,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAEnE,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,sBAAsB,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC;QACpE,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAC1B,wBAAwB,EAAE,IAAI,OAAO,IAAI,SAAS,EAAE,EACpD,wBAAwB,CACzB,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,MAAM,WAAW;IACc;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IAED,8EAA8E;IAC9E,sEAAsE;IACtE,2EAA2E;IAC3E,kEAAkE;IAClE,KAAK,CAAC,UAAU,CAAC,UAAkB;QACjC,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QAErD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CACvB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG,UAAU,SAAS,CAC/E,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,sEAAsE;IACtE,KAAK,CAAC,KAAK,CAAC,IAAqB,EAAE,MAAe;QAChD,MAAM,OAAO,GAAG;YACd,OAAO;YACP,sEAAsE;YACtE,wDAAwD;YACxD,4CAA4C;YAC5C,MAAM,IAAI,CAAC,UAAU,EAAE;YACvB,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC;YACtC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CACvC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,eAAe,EAAE,QAAQ,IAAI,EAAE,CAChD;YACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,OAAO;SACb,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,oBAAoB,EAAE,MAAM,CAAC,CAAC;QACpE,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YAChC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI;gBAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,gEAAgE;IAChE,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,EAAU;QAClC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,IAAI,IAAI,EAAE,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAC1E,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAE7C,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAC1B,mBAAmB,IAAI,EAAE,EACzB,sBAAsB,CACvB,CAAC;QAEF,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,MAAM,eAAe;IACU;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,MAAM,CAAC;IAC9E,CAAC;IAED,8EAA8E;IAC9E,oDAAoD;IACpD,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAY;QAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAY;QACtB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,qBAAqB,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAC1B,mBAAmB,IAAI,EAAE,EACzB,wBAAwB,CACzB,CAAC;QAEF,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY;QACrB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAE7C,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAC1B,kBAAkB,IAAI,EAAE,EACxB,uBAAuB,CACxB,CAAC;QAEF,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0EAA0E;IAC1E,uCAAuC;IACvC,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,EAAU;QACnC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7C,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QAExC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAC1B,oBAAoB,IAAI,IAAI,EAAE,EAAE,EAChC,yBAAyB,CAC1B,CAAC;QAEF,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YAChC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YAChE,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9B,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7C,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,sBAAsB,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAC1B,gBAAgB,IAAI,EAAE,EACtB,0BAA0B,CAC3B,CAAC;QAEF,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAsB;QACjC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,yBAAyB,CAAC,CAAC;QACzE,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAChC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE;YACpC,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;SACnC,CAAC,CACH,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;CACF;AAED,6EAA6E;AAC7E,oDAAoD;AACpD,SAAS,GAAG,CAAC,KAAgB,EAAE,IAAY,EAAE,IAAY;IACvD,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,KAAK,CAAC,KAAa;IAC1B,OAAO,KAAK;SACT,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,OAAO,aAAa;IAcK;IAbrB,KAAK,GAAG,EAAE,CAAC;IACX,MAAM,GAAG,EAAE,CAAC;IACZ,SAAS,CAAU;IACnB,GAAG,CAAU;IACb,QAAQ,CAAU;IACT,SAAS,GAAa,EAAE,CAAC;IACzB,QAAQ,GAAa,EAAE,CAAC;IACxB,MAAM,GAAa,EAAE,CAAC;IACtB,MAAM,GAAa,EAAE,CAAC;IACtB,IAAI,GAAa,EAAE,CAAC;IACpB,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,QAAQ,CAAU;IAE1B,YAA6B,SAA0B;QAA1B,cAAS,GAAT,SAAS,CAAiB;IAAG,CAAC;IAE3D,IAAI,CAAC,KAAa;QAChB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,KAAa;QACjB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,QAAQ,CAAC,KAAa;QACpB,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CAAC,KAAa;QACnB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,IAAY,EAAE,EAAU;QAC7B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,CAAC,IAAY,EAAE,EAAU;QAChC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CAAC,KAAa;QACnB,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,EAAE,CAAC,KAAa;QACd,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,IAAY,EAAE,KAAa;QAC7B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yEAAyE;IACzE,gEAAgE;IAChE,OAAO,CAAC,IAAY;QAClB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,IAAY,EAAE,KAAa;QAC/B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,QAAQ,CAAC,IAAY;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,IAAI,CAAC,IAAY,EAAE,EAAU;QAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,eAAe,CAAC,CAAC;QAEhE,mEAAmE;QACnE,qDAAqD;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC;QAE9C,OAAO;YACL,2BAA2B,IAAI,CAAC,KAAK,eAAe,QAAQ,EAAE;YAC9D,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,MAAM,EAAE,CAAC;YAChD,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,aAAa,OAAO,EAAE,CAAC;YAC1D,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC;YAC1C,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,IAAI,EAAE,CAAC;YAClD,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,WAAW,IAAI,IAAI,KAAK,EAAE,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC;YAC1C,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,MAAM;SACZ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IAED,KAAK,CAAC,MAAM;QACV,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;CACF"}

package/dist/dockerfile.d.ts

@@ -0,0 +1,14 @@
+import type { BuildSpec } from "./types.js";
+export type DockerfileContext = {
+    caches: Record<string, string>;
+    port: number;
+    release: string;
+    environment: string;
+    envSecret: string;
+    fileSecrets: Record<string, string>;
+    dir?: string;
+};
+export declare const BUILDER_STAGE = "builder";
+export declare function renderDockerignore(include?: string[]): string;
+export declare function renderDockerfile(spec: BuildSpec, context: DockerfileContext): string;
+//# sourceMappingURL=dockerfile.d.ts.map

package/dist/dockerfile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dockerfile.d.ts","sourceRoot":"","sources":["../src/dockerfile.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAa,MAAM,YAAY,CAAC;AAOvD,MAAM,MAAM,iBAAiB,GAAG;IAG9B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IAKpB,SAAS,EAAE,MAAM,CAAC;IAElB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAIpC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAIF,eAAO,MAAM,aAAa,YAAY,CAAC;AAMvC,wBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,UAMpD;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,iBAAiB,GACzB,MAAM,CAQR"}

package/dist/dockerfile.js

@@ -0,0 +1,160 @@
+import { appRoot, destinationFor, mountFor, rootedAt } from "./layout.js";
+// Named here because the build stops at this stage to keep an image a
+// step before the swap can run in, and two spellings of it would drift
+export const BUILDER_STAGE = "builder";
+// What BuildKit reads beside the Dockerfile. Without an include the checkout
+// keeps its own rules and only .git is held back. With one, everything is held
+// back and the named paths are let through again, so what the build sees is
+// what the release was taken over
+export function renderDockerignore(include) {
+    if (!include)
+        return ".git\n**/.git\n";
+    // .git after the exemptions, because the last rule to match is the one that
+    // decides and an included directory would otherwise carry it back in
+    return ["*", ...include.map((path) => `!${path}`), ".git", "**/.git", ""].join("\n");
+}
+export function renderDockerfile(spec, context) {
+    return [
+        "# syntax=docker/dockerfile:1.7",
+        ...builderStage(spec, context),
+        "",
+        ...runtimeStage(spec, context),
+        "",
+    ].join("\n");
+}
+function builderStage(spec, context) {
+    const mounts = cacheMounts(spec, context);
+    const workdir = appRoot(context.dir);
+    // The repository root, not the app's own directory: a workspace resolves one
+    // lockfile for every package in it, so the install below has to see them all
+    const lines = [
+        `FROM ${spec.builderImage} AS ${BUILDER_STAGE}`,
+        "WORKDIR /app",
+    ];
+    if (spec.aptPackages.length > 0) {
+        lines.push(`RUN apk add --no-cache ${spec.aptPackages.join(" ")}`);
+    }
+    lines.push(`ENV NODE_ENV=${context.environment}`);
+    lines.push("ENV NEXT_TELEMETRY_DISABLED=1");
+    if (spec.dependencies)
+        lines.push(...dependencyLayer(spec, mounts));
+    // Submodules are already in the context: the checkout on the host resolved
+    // them, so nothing in the build needs an agent or a .git directory
+    lines.push(copy(".", "/app"));
+    // Only now, so the steps below read the app's own manifest and write beside it
+    if (context.dir)
+        lines.push(`WORKDIR ${workdir}`);
+    lines.push(`RUN --mount=type=secret,id=${context.envSecret} cp /run/secrets/${context.envSecret} ${workdir}/.env`, `ENV SENTRY_RELEASE=${context.release}`);
+    // Unquoted: the shell form hands everything after RUN to sh -c, so a step is
+    // written exactly as it would be typed. Quoting it made the whole command one
+    // word, and the shell went looking for a program by that name
+    for (const step of spec.steps) {
+        lines.push(`RUN ${mounts}${step}`);
+    }
+    if (spec.sourcemaps) {
+        // The built .env ships inside the image, and an upload token is build-time
+        const token = spec.sourcemaps.stripFromImage;
+        lines.push(`RUN sed -i '/^${token}=/d' ${rootedAt(spec.output, context.dir)}/.env`);
+    }
+    return lines;
+}
+function runtimeStage(spec, context) {
+    const output = rootedAt(spec.output, context.dir);
+    // Where the app lands inside the tree that was just copied to /app. An output
+    // keeping the repository's structure puts it back under dir, and everything
+    // else flattens it to the top
+    const nested = spec.keepsLayout ? context.dir : undefined;
+    const lines = [`FROM ${spec.runtimeImage}`, `WORKDIR ${appRoot(nested)}`];
+    if (spec.runtimePackages.length > 0) {
+        lines.push(`RUN apk add --no-cache ${spec.runtimePackages.join(" ")}`);
+    }
+    // Before the output, which changes every commit: what these install is a
+    // property of the image, not of the release being deployed
+    for (const step of spec.runtimeSteps) {
+        lines.push(`RUN ${step}`);
+    }
+    // The one copy nothing can be allowed to skip: an image without it starts,
+    // answers, and serves a 404 for everything the app was supposed to be
+    lines.push(copy(output, "/app", BUILDER_STAGE));
+    // Directories the output does not contain but the runtime needs, such as a
+    // generated client or the static assets a standalone build leaves behind.
+    // The two sides are rooted separately: dir is where the app was built, and
+    // nested is where the output put it
+    for (const entry of spec.carry) {
+        const { path, optional } = carried(entry);
+        const from = rootedAt(path, context.dir);
+        const to = rootedAt(destinationFor(path, spec.output), nested);
+        lines.push(optional ? copyOrSkip(from, to, BUILDER_STAGE) : copy(from, to, BUILDER_STAGE));
+    }
+    for (const [path, secret] of Object.entries(context.fileSecrets)) {
+        lines.push(`RUN --mount=type=secret,id=${secret} cp /run/secrets/${secret} ${path}`);
+    }
+    lines.push(`EXPOSE ${context.port}`, `CMD ${JSON.stringify(spec.entrypoint)}`);
+    return lines;
+}
+function carried(entry) {
+    if (typeof entry === "string")
+        return { path: entry, optional: false };
+    return { path: entry.path, optional: entry.optional };
+}
+// A COPY whose source does not exist fails the build, which is what a source
+// the build was supposed to produce should do
+function copy(from, to, stage) {
+    return `COPY ${stage ? `--from=${stage} ` : ""}${from} ${to}`;
+}
+// Bracketing the last character makes the source a pattern, and a pattern
+// matching nothing is skipped: the only way a Dockerfile has to say "if it
+// exists". For a source whose absence is a fact about the repository
+function copyOrSkip(from, to, stage) {
+    const path = from.replace(/\/+$/, "");
+    const last = path.slice(-1);
+    // An empty pattern matches nothing and would be skipped in silence, which is
+    // the one outcome this whole distinction exists to prevent
+    if (!last)
+        return copy(from, to, stage);
+    return copy(`${path.slice(0, -1)}[${last}]`, to, stage);
+}
+// One mount per cache, repeated on every step, because a Dockerfile scopes a
+// cache to the RUN that asks for it rather than to the stage
+function cacheMounts(spec, context) {
+    // Only the caches the topology derived an id for. It drops any whose target
+    // another already covers, and two mounts on one target is a build that does
+    // not start
+    return spec.caches
+        .filter((name) => name in context.caches)
+        .map((name) => {
+        const id = context.caches[name] ?? name;
+        return `--mount=type=cache,id=${id},target=${mountFor(name, context.dir)} `;
+    })
+        .join("");
+}
+function dependencyLayer(spec, mounts) {
+    const { files, step, stripScripts = [] } = spec.dependencies ?? {
+        files: [],
+        step: "",
+    };
+    // A lockfile the repository does not have is not an error here. The install
+    // below is what decides that, and it says so in the package manager's words
+    const lines = files.map((file) => copyOrSkip(file, `/app/${file}`));
+    // This layer is the manifest and the lockfile, nothing else. A root prepare
+    // that installs git hooks or calls into scripts/ has neither
+    if (stripScripts.length > 0) {
+        lines.push(`RUN node --input-type=commonjs -e ${quote(strip(stripScripts))}`);
+    }
+    lines.push(`RUN ${mounts}${step}`);
+    return lines;
+}
+function strip(names) {
+    return [
+        'const fs = require("fs"), path = "/app/package.json";',
+        'const manifest = JSON.parse(fs.readFileSync(path, "utf8"));',
+        `for (const name of ${JSON.stringify(names)}) delete manifest.scripts?.[name];`,
+        "fs.writeFileSync(path, JSON.stringify(manifest, null, 2));",
+    ].join("");
+}
+// Only for a command passed as one argument to another. Single quotes are what
+// the shell strips, so a script containing double quotes survives
+function quote(command) {
+    return `'${command.replaceAll("'", `'\\''`)}'`;
+}
+//# sourceMappingURL=dockerfile.js.map

package/dist/dockerfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dockerfile.js","sourceRoot":"","sources":["../src/dockerfile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AA4B1E,sEAAsE;AACtE,uEAAuE;AACvE,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;AAEvC,6EAA6E;AAC7E,+EAA+E;AAC/E,4EAA4E;AAC5E,kCAAkC;AAClC,MAAM,UAAU,kBAAkB,CAAC,OAAkB;IACnD,IAAI,CAAC,OAAO;QAAE,OAAO,iBAAiB,CAAC;IAEvC,4EAA4E;IAC5E,qEAAqE;IACrE,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,IAAe,EACf,OAA0B;IAE1B,OAAO;QACL,gCAAgC;QAChC,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC;QAC9B,EAAE;QACF,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC;QAC9B,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,IAAe,EAAE,OAA0B;IAC/D,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAErC,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,KAAK,GAAG;QACZ,QAAQ,IAAI,CAAC,YAAY,OAAO,aAAa,EAAE;QAC/C,cAAc;KACf,CAAC;IAEF,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,0BAA0B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAClD,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAE5C,IAAI,IAAI,CAAC,YAAY;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAEpE,2EAA2E;IAC3E,mEAAmE;IACnE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IAE9B,+EAA+E;IAC/E,IAAI,OAAO,CAAC,GAAG;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;IAElD,KAAK,CAAC,IAAI,CACR,8BAA8B,OAAO,CAAC,SAAS,oBAAoB,OAAO,CAAC,SAAS,IAAI,OAAO,OAAO,EACtG,sBAAsB,OAAO,CAAC,OAAO,EAAE,CACxC,CAAC;IAEF,6EAA6E;IAC7E,8EAA8E;IAC9E,8DAA8D;IAC9D,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,OAAO,MAAM,GAAG,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,2EAA2E;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,iBAAiB,KAAK,QAAQ,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACtF,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,IAAe,EAAE,OAA0B;IAC/D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAElD,8EAA8E;IAC9E,4EAA4E;IAC5E,8BAA8B;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,MAAM,KAAK,GAAG,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,EAAE,WAAW,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAE1E,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,0BAA0B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,yEAAyE;IACzE,2DAA2D;IAC3D,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC5B,CAAC;IAED,2EAA2E;IAC3E,sEAAsE;IACtE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;IAEhD,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,oCAAoC;IACpC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,EAAE,GAAG,QAAQ,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAE/D,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACjE,KAAK,CAAC,IAAI,CACR,8BAA8B,MAAM,oBAAoB,MAAM,IAAI,IAAI,EAAE,CACzE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CACR,UAAU,OAAO,CAAC,IAAI,EAAE,EACxB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CACzC,CAAC;IAEF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,KAAgB;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACvE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;AACxD,CAAC;AAED,6EAA6E;AAC7E,8CAA8C;AAC9C,SAAS,IAAI,CAAC,IAAY,EAAE,EAAU,EAAE,KAAc;IACpD,OAAO,QAAQ,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;AAChE,CAAC;AAED,0EAA0E;AAC1E,2EAA2E;AAC3E,qEAAqE;AACrE,SAAS,UAAU,CAAC,IAAY,EAAE,EAAU,EAAE,KAAc;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5B,6EAA6E;IAC7E,2DAA2D;IAC3D,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAExC,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,6EAA6E;AAC7E,6DAA6D;AAC7D,SAAS,WAAW,CAAC,IAAe,EAAE,OAA0B;IAC9D,4EAA4E;IAC5E,4EAA4E;IAC5E,YAAY;IACZ,OAAO,IAAI,CAAC,MAAM;SACf,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC;SACxC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QACxC,OAAO,yBAAyB,EAAE,WAAW,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9E,CAAC,CAAC;SACD,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,IAAe,EAAE,MAAc;IACtD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,YAAY,IAAI;QAC9D,KAAK,EAAE,EAAE;QACT,IAAI,EAAE,EAAE;KACT,CAAC;IAEF,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpE,4EAA4E;IAC5E,6DAA6D;IAC7D,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,qCAAqC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAO,MAAM,GAAG,IAAI,EAAE,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,KAAK,CAAC,KAAe;IAC5B,OAAO;QACL,uDAAuD;QACvD,6DAA6D;QAC7D,sBAAsB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,oCAAoC;QAC/E,4DAA4D;KAC7D,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED,+EAA+E;AAC/E,kEAAkE;AAClE,SAAS,KAAK,CAAC,OAAe;IAC5B,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;AACjD,CAAC"}

package/dist/health.d.ts

@@ -0,0 +1,13 @@
+import { type Log } from "./log.js";
+import type { HealthSpec } from "./types.js";
+export type Probe = (container: string, url: string) => Promise<{
+    code: number;
+    output: string;
+}>;
+export type HealthDeps = {
+    probe: Probe;
+    sleep: (ms: number) => Promise<void>;
+    log?: Log;
+};
+export declare function healthcheck(container: string, port: number, spec: HealthSpec, deps: HealthDeps): Promise<boolean>;
+//# sourceMappingURL=health.d.ts.map

package/dist/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../src/health.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,GAAG,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAS7C,MAAM,MAAM,KAAK,GAAG,CAClB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,KACR,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE/C,MAAM,MAAM,UAAU,GAAG;IACvB,KAAK,EAAE,KAAK,CAAC;IACb,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,GAAG,CAAC,EAAE,GAAG,CAAC;CACX,CAAC;AAKF,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,OAAO,CAAC,CA6BlB"}

package/dist/health.js

@@ -0,0 +1,54 @@
+import { silent } from "./log.js";
+const RETRIES = 10;
+// Ceiling for the backoff, not a fixed wait
+const INTERVAL_MS = 5000;
+// The first probe is free, a container that is already up answers it
+const DELAY_MS = 0;
+const FIRST_BACKOFF_MS = 250;
+// One loop for every app. The two copies it replaces had already drifted: the
+// frontend never incremented its counter on a failed predicate, so a container
+// that answered but never became healthy span until the deploy was killed.
+export async function healthcheck(container, port, spec, deps) {
+    const retries = spec.retries ?? RETRIES;
+    const ceiling = spec.intervalMs ?? INTERVAL_MS;
+    const log = deps.log ?? silent;
+    const delay = spec.delayMs ?? DELAY_MS;
+    if (delay > 0)
+        await deps.sleep(delay);
+    let backoff = FIRST_BACKOFF_MS;
+    for (let attempt = 1; attempt <= retries; attempt += 1) {
+        const url = `localhost:${port}${spec.path}`;
+        const { code, output } = await deps.probe(container, url);
+        if (code === 0 && passes(spec, output, log, container)) {
+            log.done(`${container} is healthy`);
+            return true;
+        }
+        if (attempt === retries)
+            break;
+        // Doubling from a quarter second means a container that starts quickly
+        // costs almost nothing, and one that does not still gets the same budget
+        await deps.sleep(backoff);
+        backoff = Math.min(backoff * 2, ceiling);
+    }
+    log.fail(`${container} failed its health check after ${retries} attempts`);
+    return false;
+}
+// A body that parses but fails the predicate is a retry, not a verdict. The
+// container may still be warming up, and the caller has a retry budget for it
+function passes(spec, output, log, container) {
+    let body;
+    try {
+        body = JSON.parse(output);
+    }
+    catch {
+        log.warn(`${container} returned a body that is not JSON: ${output}`);
+        return false;
+    }
+    if (typeof body !== "object" || body === null)
+        return false;
+    if (spec.expect(body))
+        return true;
+    log.warn(`${container} is not healthy yet: ${output}`);
+    return false;
+}
+//# sourceMappingURL=health.js.map

package/dist/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../src/health.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAY,MAAM,UAAU,CAAC;AAG5C,MAAM,OAAO,GAAG,EAAE,CAAC;AACnB,4CAA4C;AAC5C,MAAM,WAAW,GAAG,IAAI,CAAC;AACzB,qEAAqE;AACrE,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAa7B,8EAA8E;AAC9E,+EAA+E;AAC/E,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB,EACjB,IAAY,EACZ,IAAgB,EAChB,IAAgB;IAEhB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,IAAI,WAAW,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC;IAEvC,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAEvC,IAAI,OAAO,GAAG,gBAAgB,CAAC;IAE/B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,OAAO,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,GAAG,GAAG,aAAa,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAE1D,IAAI,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,aAAa,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,OAAO,KAAK,OAAO;YAAE,MAAM;QAE/B,uEAAuE;QACvE,yEAAyE;QACzE,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1B,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,kCAAkC,OAAO,WAAW,CAAC,CAAC;IAC3E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,8EAA8E;AAC9E,SAAS,MAAM,CACb,IAAgB,EAChB,MAAc,EACd,GAAQ,EACR,SAAiB;IAEjB,IAAI,IAAa,CAAC;IAElB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,sCAAsC,MAAM,EAAE,CAAC,CAAC;QACrE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC5D,IAAI,IAAI,CAAC,MAAM,CAAC,IAA+B,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9D,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,wBAAwB,MAAM,EAAE,CAAC,CAAC;IACvD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/host.d.ts

@@ -0,0 +1,21 @@
+export type Result = {
+    code: number;
+    stdout: string;
+    stderr: string;
+};
+export type OnLine = (line: string) => void;
+export type Host = {
+    sh(command: string, onLine?: OnLine): Promise<Result>;
+    write(name: string, contents: string): Promise<string>;
+    readonly directory: string;
+    readonly cache: string;
+    pipe(local: string, remote: string, onLine?: OnLine): Promise<Result>;
+    stop(signal: "TERM" | "KILL"): Promise<number>;
+    close?(): Promise<void>;
+};
+export declare function tail(lines: string[]): string;
+export declare function lineReader(onLine: OnLine): {
+    push(chunk: string): void;
+    flush(): void;
+};
+//# sourceMappingURL=host.d.ts.map

package/dist/host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../src/host.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAItE,MAAM,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AAE5C,MAAM,MAAM,IAAI,GAAG;IAGjB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAGtD,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEvD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAGvB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAGtE,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB,CAAC;AAMF,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,UAEnC;AAGD,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM;gBAIzB,MAAM;;EAUrB"}