redkite 0.1.6

package/dist/presets/nextApp.js

@@ -0,0 +1,53 @@
+import { nodeApp } from "./nodeApp.js";
+// The standalone layout is three directories that have to land in the right
+// places, which is the only part of a Next build that is not a node build
+export function nextApp(options = {}) {
+    const port = options.port ?? 3000;
+    const standalone = options.standalone ?? true;
+    const shared = {
+        builder: options.builder ?? "24-alpine",
+        runtime: options.runtime ?? "22-alpine",
+        steps: options.steps ?? ["yarn build"],
+        dependencies: options.dependencies,
+    };
+    // Relative, because the runtime starts at the app's root and a monorepo puts
+    // that under its own directory rather than at the top of the image
+    const start = (command) => ["sh", "-c", `HOSTNAME=0.0.0.0 PORT=${port} ${command}`];
+    if (!standalone) {
+        return {
+            ...nodeApp({
+                ...shared,
+                // The whole tree, because next start reads the source layout it built
+                // from and resolves its own dependencies at runtime
+                output: "/app",
+                // npx resolves the binary from node_modules/.bin upwards, so this
+                // finds it whether a workspace hoisted it or the app owns it
+                entrypoint: start("npx --no-install next start"),
+                // Without the modules cache, so node_modules is a layer of the image
+                // rather than a mount the runtime stage never sees
+                caches: ["yarn", "npm", "next-app"],
+            }),
+            preset: "nextApp",
+            keepsLayout: true,
+        };
+    }
+    return {
+        ...nodeApp({
+            ...shared,
+            output: "/app/.next/standalone",
+            // static is what the build produced and the server serves. public is
+            // whatever the repository put there, and plenty of apps have none
+            carry: ["/app/.next/static", { path: "/app/public", optional: true }],
+            entrypoint: start("node server.js"),
+            // app-modules is what makes the build fast: node_modules on a mount
+            // rather than in a layer, which the standalone tree makes safe by
+            // carrying its own copy of everything the server reaches
+            caches: ["yarn", "npm", "modules", "app-modules", "next-app"],
+        }),
+        preset: "nextApp",
+        // The standalone tree traces from the workspace root, so an app in a
+        // subdirectory arrives at that subdirectory and not at the top of it
+        keepsLayout: true,
+    };
+}
+//# sourceMappingURL=nextApp.js.map

package/dist/presets/nextApp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nextApp.js","sourceRoot":"","sources":["../../src/presets/nextApp.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAavC,4EAA4E;AAC5E,0EAA0E;AAC1E,MAAM,UAAU,OAAO,CAAC,UAA0B,EAAE;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC;IAClC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;IAE9C,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,WAAW;QACvC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,WAAW;QACvC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC;QACtC,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC;IAEF,6EAA6E;IAC7E,mEAAmE;IACnE,MAAM,KAAK,GAAG,CAAC,OAAe,EAAE,EAAE,CAChC,CAAC,IAAI,EAAE,IAAI,EAAE,yBAAyB,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC;IAE3D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,GAAG,OAAO,CAAC;gBACT,GAAG,MAAM;gBACT,sEAAsE;gBACtE,oDAAoD;gBACpD,MAAM,EAAE,MAAM;gBACd,kEAAkE;gBAClE,6DAA6D;gBAC7D,UAAU,EAAE,KAAK,CAAC,6BAA6B,CAAC;gBAChD,qEAAqE;gBACrE,mDAAmD;gBACnD,MAAM,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC;aACpC,CAAC;YACF,MAAM,EAAE,SAAS;YACjB,WAAW,EAAE,IAAI;SAClB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,OAAO,CAAC;YACT,GAAG,MAAM;YACT,MAAM,EAAE,uBAAuB;YAC/B,qEAAqE;YACrE,kEAAkE;YAClE,KAAK,EAAE,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACrE,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC;YACnC,oEAAoE;YACpE,kEAAkE;YAClE,yDAAyD;YACzD,MAAM,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,CAAC;SAC9D,CAAC;QACF,MAAM,EAAE,SAAS;QACjB,qEAAqE;QACrE,qEAAqE;QACrE,WAAW,EAAE,IAAI;KAClB,CAAC;AACJ,CAAC"}

package/dist/presets/nodeApp.d.ts

@@ -0,0 +1,19 @@
+import type { BuildSpec, CarryPath, SourcemapSpec } from "../types.js";
+type NodeAppOptions = {
+    builder?: string;
+    runtime?: string;
+    steps: string[];
+    dependencies?: {
+        files: string[];
+        step: string;
+    } | false;
+    output: string;
+    entrypoint: string[];
+    carry?: CarryPath[];
+    submodules?: boolean;
+    caches?: string[];
+    sourcemaps?: SourcemapSpec;
+};
+export declare function nodeApp(options: NodeAppOptions): BuildSpec;
+export {};
+//# sourceMappingURL=nodeApp.d.ts.map

package/dist/presets/nodeApp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nodeApp.d.ts","sourceRoot":"","sources":["../../src/presets/nodeApp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEvE,KAAK,cAAc,GAAG;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAGhB,YAAY,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CAAC;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,aAAa,CAAC;CAC5B,CAAC;AAEF,wBAAgB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,SAAS,CA4B1D"}

package/dist/presets/nodeApp.js

@@ -0,0 +1,29 @@
+export function nodeApp(options) {
+    return {
+        preset: "nodeApp",
+        builderImage: `node:${options.builder ?? "22-alpine"}`,
+        runtimeImage: `node:${options.runtime ?? "24-alpine"}`,
+        dependencies: options.dependencies === false
+            ? undefined
+            : (options.dependencies ?? {
+                files: ["package.json", "yarn.lock"],
+                step: "yarn install --frozen-lockfile",
+                stripScripts: ["preinstall", "prepare", "postinstall"],
+            }),
+        steps: options.steps,
+        output: options.output,
+        carry: options.carry ?? [],
+        entrypoint: options.entrypoint,
+        // Not the app's own node_modules: a step after the build runs in this image
+        // without the mounts, and a migration that cannot find prisma is what a
+        // cache mount instead of a layer looks like from the outside
+        caches: options.caches ?? ["yarn", "npm", "modules"],
+        submodules: options.submodules ?? false,
+        // The checkout arrives complete, so this is what a build step itself needs
+        aptPackages: ["git"],
+        runtimePackages: ["curl"],
+        runtimeSteps: [],
+        sourcemaps: options.sourcemaps,
+    };
+}
+//# sourceMappingURL=nodeApp.js.map

package/dist/presets/nodeApp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nodeApp.js","sourceRoot":"","sources":["../../src/presets/nodeApp.ts"],"names":[],"mappings":"AAiBA,MAAM,UAAU,OAAO,CAAC,OAAuB;IAC7C,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,YAAY,EAAE,QAAQ,OAAO,CAAC,OAAO,IAAI,WAAW,EAAE;QACtD,YAAY,EAAE,QAAQ,OAAO,CAAC,OAAO,IAAI,WAAW,EAAE;QACtD,YAAY,EACV,OAAO,CAAC,YAAY,KAAK,KAAK;YAC5B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,IAAI;gBACvB,KAAK,EAAE,CAAC,cAAc,EAAE,WAAW,CAAC;gBACpC,IAAI,EAAE,gCAAgC;gBACtC,YAAY,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC;aACvD,CAAC;QACR,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,4EAA4E;QAC5E,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC;QACpD,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,KAAK;QACvC,2EAA2E;QAC3E,WAAW,EAAE,CAAC,KAAK,CAAC;QACpB,eAAe,EAAE,CAAC,MAAM,CAAC;QACzB,YAAY,EAAE,EAAE;QAChB,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC;AACJ,CAAC"}

package/dist/secrets/bitwarden.d.ts

@@ -0,0 +1,3 @@
+import type { SecretRef } from "../types.js";
+export declare function bitwarden(id: string): SecretRef;
+//# sourceMappingURL=bitwarden.d.ts.map

package/dist/secrets/bitwarden.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bitwarden.d.ts","sourceRoot":"","sources":["../../src/secrets/bitwarden.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAI7C,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,CAE/C"}

package/dist/secrets/bitwarden.js

@@ -0,0 +1,6 @@
+// Names an item in a Bitwarden vault. The id is not a secret, it is a pointer,
+// so it belongs in the config while the credentials arrive at deploy time
+export function bitwarden(id) {
+    return { provider: "bitwarden", id };
+}
+//# sourceMappingURL=bitwarden.js.map

package/dist/secrets/bitwarden.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bitwarden.js","sourceRoot":"","sources":["../../src/secrets/bitwarden.ts"],"names":[],"mappings":"AAEA,+EAA+E;AAC/E,0EAA0E;AAC1E,MAAM,UAAU,SAAS,CAAC,EAAU;IAClC,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AACvC,CAAC"}

package/dist/secrets/refs.d.ts

@@ -0,0 +1,9 @@
+import type { SecretRef, SecretRefs } from "../types.js";
+export type SecretStore = {
+    read(id: string): Promise<string>;
+};
+export type SecretStores = Record<string, SecretStore>;
+export declare function listRefs(refs: SecretRefs | undefined): SecretRef[];
+export declare function readRef(ref: SecretRef, stores: SecretStores): Promise<string>;
+export declare function readEnv(refs: SecretRefs | undefined, stores: SecretStores): Promise<string>;
+//# sourceMappingURL=refs.d.ts.map

package/dist/secrets/refs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refs.d.ts","sourceRoot":"","sources":["../../src/secrets/refs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzD,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAEvD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,EAAE,CAGlE;AAED,wBAAsB,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,mBAMjE;AAKD,wBAAsB,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,SAAS,EAAE,MAAM,EAAE,YAAY,mBAM/E"}

package/dist/secrets/refs.js

@@ -0,0 +1,20 @@
+export function listRefs(refs) {
+    if (!refs)
+        return [];
+    return Array.isArray(refs) ? refs : [refs];
+}
+export async function readRef(ref, stores) {
+    const store = stores[ref.provider];
+    if (store)
+        return await store.read(ref.id);
+    const known = Object.keys(stores).join(", ") || "none";
+    throw new Error(`No store for provider ${ref.provider}, deploy was given ${known}`);
+}
+// Concatenated in the order written. Every dotenv parser builds an object as it
+// reads, so a key that appears twice takes its later value, which is the
+// precedence the config file reads as having
+export async function readEnv(refs, stores) {
+    const contents = await Promise.all(listRefs(refs).map(async (ref) => await readRef(ref, stores)));
+    return contents.map((text) => (text.endsWith("\n") ? text : `${text}\n`)).join("");
+}
+//# sourceMappingURL=refs.js.map

package/dist/secrets/refs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refs.js","sourceRoot":"","sources":["../../src/secrets/refs.ts"],"names":[],"mappings":"AASA,MAAM,UAAU,QAAQ,CAAC,IAA4B;IACnD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAc,EAAE,MAAoB;IAChE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,KAAK;QAAE,OAAO,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAE3C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC;IACvD,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,QAAQ,sBAAsB,KAAK,EAAE,CAAC,CAAC;AACtF,CAAC;AAED,gFAAgF;AAChF,yEAAyE;AACzE,6CAA6C;AAC7C,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAA4B,EAAE,MAAoB;IAC9E,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAC9D,CAAC;IAEF,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACrF,CAAC"}

package/dist/secrets/store.d.ts

@@ -0,0 +1,9 @@
+import type { SecretStore } from "./refs.js";
+export type BitwardenCredentials = {
+    clientId: string;
+    clientSecret: string;
+    password: string;
+    detail?: (message: string) => void;
+};
+export declare function bitwardenStore(credentials: BitwardenCredentials): Promise<SecretStore>;
+//# sourceMappingURL=store.d.ts.map

package/dist/secrets/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/secrets/store.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAW7C,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC,CAAC;AAUF,wBAAsB,cAAc,CAClC,WAAW,EAAE,oBAAoB,GAChC,OAAO,CAAC,WAAW,CAAC,CA8DtB"}

package/dist/secrets/store.js

@@ -0,0 +1,104 @@
+import { execFile } from "node:child_process";
+import { existsSync } from "node:fs";
+import { mkdir } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { promisify } from "node:util";
+// One implementation of the interface deploy consumes. A second provider only
+// has to satisfy read().
+//
+// The CLI runs here as an ordinary process. It used to run inside a container
+// purely as a sandbox, which meant installing several thousand packages on
+// every deploy to read three items.
+const run = promisify(execFile);
+// Used when bw is not already on PATH. Pinned, because an unpinned CLI is a
+// different program on a machine that has never run a deploy before
+const CLI = "@bitwarden/cli@2026.4.2";
+// Where that install lands. Keyed by the pinned version, so bumping it installs
+// beside the old one rather than over a vault command that is mid-flight
+const CLIS = join(homedir(), ".cache", "redkite", "cli");
+export async function bitwardenStore(credentials) {
+    const detail = credentials.detail ?? (() => { });
+    // Its own state directory, so a deploy neither reads nor disturbs whatever
+    // vault the person running it happens to be logged into
+    const appdata = join(homedir(), ".cache", "redkite", "bitwarden");
+    await mkdir(appdata, { recursive: true });
+    const command = await resolveCli(detail);
+    const bw = async (args, env = {}) => await run(command.file, [...command.prefix, ...args], {
+        env: {
+            ...process.env,
+            BITWARDENCLI_APPDATA_DIR: appdata,
+            ...env,
+        },
+        maxBuffer: 32 * 1024 * 1024,
+    });
+    detail("unlocking the vault");
+    // Already logged in is not an error, the session is what matters
+    await bw(["login", "--apikey"], {
+        BW_CLIENTID: credentials.clientId,
+        BW_CLIENTSECRET: credentials.clientSecret,
+    }).catch(() => undefined);
+    const unlocked = await bw(["unlock", "--passwordenv", "BW_PASSWORD", "--raw"], {
+        BW_PASSWORD: credentials.password,
+    }).catch((error) => {
+        throw new Error(`Could not unlock the Bitwarden vault: ${messageOf(error)}`);
+    });
+    const session = unlocked.stdout.trim();
+    if (!session)
+        throw new Error("Bitwarden unlocked without a session");
+    // An item added since the last deploy is not in the local vault otherwise,
+    // and bw get answers "not found" rather than fetching it
+    await bw(["sync"], { BW_SESSION: session }).catch(() => undefined);
+    // Fetched once each. A second read of the same item during a deploy is the
+    // same answer, and this avoids a process per call site
+    const cache = new Map();
+    const fetch = async (id) => {
+        const item = await bw(["get", "notes", id, "--raw"], {
+            BW_SESSION: session,
+        }).catch((error) => {
+            throw new Error(`Could not read ${id} from Bitwarden: ${messageOf(error)}`);
+        });
+        return item.stdout;
+    };
+    return {
+        read: async (id) => {
+            const pending = cache.get(id) ?? fetch(id);
+            cache.set(id, pending);
+            return await pending;
+        },
+    };
+}
+// A machine with the CLI installed pays nothing. One without it installs the
+// pinned version once, rather than resolving it again on every call below
+async function resolveCli(detail) {
+    const override = process.env["REDKITE_BW_BIN"];
+    if (override)
+        return { file: override, prefix: [] };
+    const found = await run("bw", ["--version"]).then(() => true, () => false);
+    if (found)
+        return { file: "bw", prefix: [] };
+    return { file: await install(detail), prefix: [] };
+}
+// npx resolves the package again on every invocation, and unlocking a vault is
+// three commands plus one per secret. That was most of a second, six times over
+async function install(detail) {
+    const directory = join(CLIS, CLI.replace(/[^\w.]+/g, "-"));
+    const binary = join(directory, "node_modules", ".bin", "bw");
+    if (existsSync(binary))
+        return binary;
+    detail(`installing ${CLI}, once for this machine`);
+    await mkdir(directory, { recursive: true });
+    await run("npm", ["install", "--prefix", directory, "--no-save", "--no-audit", "--no-fund", CLI], { maxBuffer: 32 * 1024 * 1024 }).catch((error) => {
+        throw new Error(`Could not install ${CLI}: ${messageOf(error)}`);
+    });
+    return binary;
+}
+function messageOf(error) {
+    if (error instanceof Error && "stderr" in error) {
+        const stderr = String(error.stderr).trim();
+        if (stderr)
+            return stderr;
+    }
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=store.js.map

package/dist/secrets/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/secrets/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAItC,8EAA8E;AAC9E,yBAAyB;AACzB,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,oCAAoC;AAEpC,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAShC,4EAA4E;AAC5E,oEAAoE;AACpE,MAAM,GAAG,GAAG,yBAAyB,CAAC;AAEtC,gFAAgF;AAChF,yEAAyE;AACzE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;AAEzD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,WAAiC;IAEjC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAEhD,2EAA2E;IAC3E,wDAAwD;IACxD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IAClE,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1C,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;IAEzC,MAAM,EAAE,GAAG,KAAK,EAAE,IAAc,EAAE,MAA8B,EAAE,EAAE,EAAE,CACpE,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE;QACpD,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,wBAAwB,EAAE,OAAO;YACjC,GAAG,GAAG;SACP;QACD,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KAC5B,CAAC,CAAC;IAEL,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAE9B,iEAAiE;IACjE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE;QAC9B,WAAW,EAAE,WAAW,CAAC,QAAQ;QACjC,eAAe,EAAE,WAAW,CAAC,YAAY;KAC1C,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAE1B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,eAAe,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE;QAC7E,WAAW,EAAE,WAAW,CAAC,QAAQ;KAClC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC1B,MAAM,IAAI,KAAK,CAAC,yCAAyC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAEtE,2EAA2E;IAC3E,yDAAyD;IACzD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAEnE,2EAA2E;IAC3E,uDAAuD;IACvD,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEjD,MAAM,KAAK,GAAG,KAAK,EAAE,EAAU,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE;YACnD,UAAU,EAAE,OAAO;SACpB,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC1B,MAAM,IAAI,KAAK,CAAC,kBAAkB,EAAE,oBAAoB,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YACjB,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC;YAC3C,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACvB,OAAO,MAAM,OAAO,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC;AAID,6EAA6E;AAC7E,0EAA0E;AAC1E,KAAK,UAAU,UAAU,CAAC,MAAiC;IACzD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC/C,IAAI,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAEpD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAC/C,GAAG,EAAE,CAAC,IAAI,EACV,GAAG,EAAE,CAAC,KAAK,CACZ,CAAC;IAEF,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAE7C,OAAO,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACrD,CAAC;AAED,+EAA+E;AAC/E,gFAAgF;AAChF,KAAK,UAAU,OAAO,CAAC,MAAiC;IACtD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAE7D,IAAI,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAEtC,MAAM,CAAC,cAAc,GAAG,yBAAyB,CAAC,CAAC;IACnD,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,MAAM,GAAG,CACP,KAAK,EACL,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,CAAC,EAC/E,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAChC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACzB,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,YAAY,KAAK,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IAC5B,CAAC;IAED,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/services/ensure.d.ts

@@ -0,0 +1,18 @@
+import { type Docker } from "../docker.js";
+import type { Host } from "../host.js";
+import type { Log } from "../log.js";
+import { type SecretStores } from "../secrets/refs.js";
+import type { ServiceTopology, Topology } from "../topology.js";
+import type { ServiceSpec } from "../types.js";
+export type EnsureContext = {
+    host: Host;
+    docker: Docker;
+    topology: Topology;
+    files: Record<string, string>;
+    secrets: SecretStores;
+    log: Log;
+    publish?: number;
+};
+export type Ensured = "adopted" | "started" | "created" | "recreated";
+export declare function ensureService(spec: ServiceSpec, service: ServiceTopology, context: EnsureContext): Promise<Ensured>;
+//# sourceMappingURL=ensure.d.ts.map

package/dist/services/ensure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure.d.ts","sourceRoot":"","sources":["../../src/services/ensure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAW,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO/C,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;IAEnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAG9B,OAAO,EAAE,YAAY,CAAC;IACtB,GAAG,EAAE,GAAG,CAAC;IAGT,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAIF,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,CAAC;AAEtE,wBAAsB,aAAa,CACjC,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,OAAO,CAAC,CA8BlB"}

package/dist/services/ensure.js

@@ -0,0 +1,93 @@
+import { SPEC_LABEL } from "../docker.js";
+import { LISTEN_PORT } from "../nginx.js";
+import { readEnv } from "../secrets/refs.js";
+import { fingerprintOf } from "./planned.js";
+export async function ensureService(spec, service, context) {
+    const { docker } = context;
+    const name = service.container;
+    const fingerprint = fingerprintOf(plannedFrom(spec, service, context), context.topology);
+    if (await docker.container.exists(name)) {
+        // A service outlives a deploy, so being there is usually the whole answer.
+        // Being there having been created from something else is not: a changed
+        // public port or a rendered config only reaches a container that is made
+        if (await docker.container.specOf(name) === fingerprint) {
+            if (await docker.container.isRunning(name))
+                return "adopted";
+            context.log.warn(`${name} was not running, starting it`);
+            await docker.container.start(name);
+            return "started";
+        }
+        context.log(`${name} is not what the deployment says, recreating it`);
+        await docker.container.stop(name);
+        await docker.container.remove(name);
+        await createService(spec, service, context, fingerprint);
+        await docker.container.start(name);
+        return "recreated";
+    }
+    context.log(`Creating ${name} at ${service.address}`);
+    await createService(spec, service, context, fingerprint);
+    await docker.container.start(name);
+    return "created";
+}
+// The same shape the plan compares against, assembled from what this call was
+// handed. Two spellings of it would drift from each other rather than from the
+// host, which is the one drift nothing here would report
+function plannedFrom(spec, service, context) {
+    return { spec, service, files: context.files, publish: context.publish };
+}
+async function createService(spec, service, context, fingerprint) {
+    const { docker, topology } = context;
+    const name = service.container;
+    await buildImage(spec, name, context);
+    const builder = docker.container
+        .builder()
+        .name(name)
+        .image(name)
+        .network(topology.network)
+        .label(SPEC_LABEL, fingerprint)
+        .ip(service.address);
+    if (spec.restart)
+        builder.restart(spec.restart);
+    for (const [name, value] of Object.entries(spec.environment ?? {})) {
+        builder.env(name, value);
+    }
+    // Written to the host and handed over as a file, so the value never appears
+    // in an argument list. Docker reads it when the container is created and
+    // keeps the values, so the file goes with the rest of the deploy's scratch
+    if (spec.secrets) {
+        const contents = await readEnv(spec.secrets, context.secrets);
+        builder.envFile(await context.host.write(`services/${name}/env`, contents));
+    }
+    for (const volume of service.volumes) {
+        builder.volume(volume.volume, volume.mountPath);
+    }
+    if (context.publish) {
+        for (const [host, ip] of Object.entries(topology.extraHosts)) {
+            builder.extraHost(host, ip);
+        }
+        builder.port(context.publish, LISTEN_PORT);
+    }
+    await builder.create();
+}
+// Three lines of Dockerfile on the host, in place of a container assembled in
+// an engine, exported as a tarball and loaded back in
+async function buildImage(spec, name, context) {
+    const { host, docker } = context;
+    const directory = `services/${name}`;
+    const copies = await Promise.all(Object.entries(context.files).map(async ([path, contents], index) => {
+        await host.write(`${directory}/file.${index}`, contents);
+        return `COPY file.${index} ${path}`;
+    }));
+    const dockerfile = await host.write(`${directory}/Dockerfile`, [
+        `FROM ${spec.image}`,
+        ...copies,
+        ...(context.publish ? [`EXPOSE ${LISTEN_PORT}`] : []),
+        "",
+    ].join("\n"));
+    await docker.image.build({
+        context: `${host.directory}/${directory}`,
+        dockerfile,
+        tags: [name],
+    });
+}
+//# sourceMappingURL=ensure.js.map

package/dist/services/ensure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure.js","sourceRoot":"","sources":["../../src/services/ensure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAe,MAAM,cAAc,CAAC;AAGvD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAqB,MAAM,oBAAoB,CAAC;AAIhE,OAAO,EAAE,aAAa,EAAuB,MAAM,cAAc,CAAC;AAwBlE,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAiB,EACjB,OAAwB,EACxB,OAAsB;IAEtB,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC;IAC/B,MAAM,WAAW,GAAG,aAAa,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEzF,IAAI,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,2EAA2E;QAC3E,wEAAwE;QACxE,yEAAyE;QACzE,IAAI,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YACxD,IAAI,MAAM,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YAE7D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,+BAA+B,CAAC,CAAC;YACzD,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACnC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,iDAAiD,CAAC,CAAC;QACtE,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QACzD,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACtD,MAAM,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IACzD,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAEnC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,+EAA+E;AAC/E,yDAAyD;AACzD,SAAS,WAAW,CAClB,IAAiB,EACjB,OAAwB,EACxB,OAAsB;IAEtB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;AAC3E,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,IAAiB,EACjB,OAAwB,EACxB,OAAsB,EACtB,WAAmB;IAEnB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC;IAE/B,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAEtC,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS;SAC7B,OAAO,EAAE;SACT,IAAI,CAAC,IAAI,CAAC;SACV,KAAK,CAAC,IAAI,CAAC;SACX,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;SACzB,KAAK,CAAC,UAAU,EAAE,WAAW,CAAC;SAC9B,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEvB,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAEhD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9D,OAAO,CAAC,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACrC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7D,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9B,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;AACzB,CAAC;AAED,8EAA8E;AAC9E,sDAAsD;AACtD,KAAK,UAAU,UAAU,CACvB,IAAiB,EACjB,IAAY,EACZ,OAAsB;IAEtB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACjC,MAAM,SAAS,GAAG,YAAY,IAAI,EAAE,CAAC;IAErC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE;QAClE,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,SAAS,SAAS,KAAK,EAAE,EAAE,QAAQ,CAAC,CAAC;QACzD,OAAO,aAAa,KAAK,IAAI,IAAI,EAAE,CAAC;IACtC,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CACjC,GAAG,SAAS,aAAa,EACzB;QACE,QAAQ,IAAI,CAAC,KAAK,EAAE;QACpB,GAAG,MAAM;QACT,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IAEF,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;QACvB,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,IAAI,SAAS,EAAE;QACzC,UAAU;QACV,IAAI,EAAE,CAAC,IAAI,CAAC;KACb,CAAC,CAAC;AACL,CAAC"}

package/dist/services/index.d.ts

@@ -0,0 +1,19 @@
+import type { SecretRefs, ServiceSpec } from "../types.js";
+type RedisOptions = {
+    image?: string;
+    alias?: string;
+    address?: number;
+    volumes?: Record<string, string>;
+};
+export declare function redis(options?: RedisOptions): ServiceSpec;
+type PostgresOptions = {
+    secrets: SecretRefs;
+    image?: string;
+    alias?: string;
+    address?: number;
+    volumes?: Record<string, string>;
+    environment?: Record<string, string>;
+};
+export declare function postgres(options: PostgresOptions): ServiceSpec;
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/services/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/services/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE3D,KAAK,YAAY,GAAG;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CAAC;AAEF,wBAAgB,KAAK,CAAC,OAAO,GAAE,YAAiB,GAAG,WAAW,CAW7D;AAED,KAAK,eAAe,GAAG;IAGrB,OAAO,EAAE,UAAU,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEjC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC,CAAC;AAEF,wBAAgB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,WAAW,CAa9D"}

package/dist/services/index.js

@@ -0,0 +1,27 @@
+export function redis(options = {}) {
+    return {
+        name: "redis",
+        image: options.image ?? "redis:7",
+        alias: options.alias ?? "redis",
+        restart: "always",
+        address: options.address,
+        // The image declares VOLUME /data, so without this the data lands in an
+        // anonymous volume that survives nothing and can be named by no one
+        volumes: options.volumes ?? { data: "/data" },
+    };
+}
+export function postgres(options) {
+    return {
+        name: "postgres",
+        image: options.image ?? "postgres:17-alpine",
+        alias: options.alias ?? "postgres",
+        restart: "always",
+        address: options.address,
+        secrets: options.secrets,
+        environment: options.environment,
+        // The image declares VOLUME on this path, so without naming it the data
+        // lands in an anonymous volume that survives nothing and nobody can name
+        volumes: options.volumes ?? { data: "/var/lib/postgresql/data" },
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/services/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/services/index.ts"],"names":[],"mappings":"AASA,MAAM,UAAU,KAAK,CAAC,UAAwB,EAAE;IAC9C,OAAO;QACL,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,SAAS;QACjC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO;QAC/B,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,wEAAwE;QACxE,oEAAoE;QACpE,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE;KAC9C,CAAC;AACJ,CAAC;AAcD,MAAM,UAAU,QAAQ,CAAC,OAAwB;IAC/C,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,oBAAoB;QAC5C,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,UAAU;QAClC,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,wEAAwE;QACxE,yEAAyE;QACzE,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE,IAAI,EAAE,0BAA0B,EAAE;KACjE,CAAC;AACJ,CAAC"}

package/dist/services/planned.d.ts

@@ -0,0 +1,20 @@
+import type { Docker } from "../docker.js";
+import type { Run } from "../pipeline.js";
+import type { ServiceTopology, Topology } from "../topology.js";
+import type { Deployment, ServiceSpec } from "../types.js";
+export type PlannedService = {
+    spec: ServiceSpec;
+    service: ServiceTopology;
+    files: Record<string, string>;
+    publish?: number;
+};
+export declare function plannedServices(config: Deployment, topology: Topology, run?: Run): PlannedService[];
+export declare function router(config: Deployment): ServiceSpec;
+export declare function fingerprintOf(planned: PlannedService, topology: Topology): string;
+export type Drift = {
+    container: string;
+    name: string;
+    reason: "missing" | "stopped" | "changed" | "unrecognised";
+};
+export declare function driftOf(planned: PlannedService[], topology: Topology, docker: Docker): Promise<Drift[]>;
+//# sourceMappingURL=planned.d.ts.map

package/dist/services/planned.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"planned.d.ts","sourceRoot":"","sources":["../../src/services/planned.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO3D,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,eAAe,CAAC;IAEzB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,wBAAgB,eAAe,CAC7B,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,QAAQ,EAClB,GAAG,GAAE,GAAc,GAClB,cAAc,EAAE,CAsBlB;AAID,wBAAgB,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,WAAW,CAMtD;AAKD,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,UAkBxE;AAID,MAAM,MAAM,KAAK,GAAG;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,cAAc,CAAC;CAC5D,CAAC;AAEF,wBAAsB,OAAO,CAC3B,OAAO,EAAE,cAAc,EAAE,EACzB,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,KAAK,EAAE,CAAC,CASlB"}

package/dist/services/planned.js

@@ -0,0 +1,77 @@
+import { createHash } from "node:crypto";
+import { LISTEN_PORT, renderNginx } from "../nginx.js";
+export function plannedServices(config, topology, run = "deploy") {
+    const rest = config.services.map((spec) => {
+        const service = topology.services.find((item) => item.name === spec.name);
+        if (!service)
+            throw new Error(`No topology for service ${spec.name}`);
+        return { spec, service, files: spec.files ?? {} };
+    });
+    // Nothing serves in a verify run, so a proxy there would resolve upstreams
+    // that were never created and publish a port for them
+    if (run === "verify")
+        return rest;
+    const proxy = {
+        spec: router(config),
+        service: topology.router,
+        files: {
+            "/etc/nginx/conf.d/default.conf": renderNginx(topology, config.maxBodySize),
+        },
+        publish: topology.publicPort,
+    };
+    return [proxy, ...rest];
+}
+// Not something a deployment lists. Apps carry routes, routes need a proxy to
+// resolve them, and the one that renders them is this
+export function router(config) {
+    return {
+        name: "nginx",
+        image: config.proxyImage ?? "nginx:stable",
+        restart: "always",
+    };
+}
+// Everything a recreate would change, and nothing a deploy resolves. Secrets
+// are named by their refs rather than their values: whether the config is the
+// one running is a question a plan should answer without unlocking a vault
+export function fingerprintOf(planned, topology) {
+    const { spec, service, files, publish } = planned;
+    const shape = {
+        image: spec.image,
+        restart: spec.restart,
+        address: service.address,
+        network: topology.network,
+        volumes: service.volumes,
+        environment: spec.environment,
+        secrets: spec.secrets,
+        files,
+        // The proxy alone, and the two things being published costs it
+        publish: publish && { host: publish, container: LISTEN_PORT },
+        extraHosts: publish ? topology.extraHosts : undefined,
+    };
+    return createHash("sha256").update(JSON.stringify(shape)).digest("hex").slice(0, 16);
+}
+export async function driftOf(planned, topology, docker) {
+    const drifted = [];
+    for (const item of planned) {
+        const reason = await reasonFor(item, topology, docker);
+        if (reason)
+            drifted.push({ container: item.service.container, name: item.spec.name, reason });
+    }
+    return drifted;
+}
+async function reasonFor(planned, topology, docker) {
+    const name = planned.service.container;
+    if (!(await docker.container.exists(name)))
+        return "missing";
+    const held = await docker.container.specOf(name);
+    // Created by hand, or by a redkite that did not record what it created from.
+    // Either way nothing here can say it matches, so it is rebuilt once
+    if (!held)
+        return "unrecognised";
+    if (held !== fingerprintOf(planned, topology))
+        return "changed";
+    if (!(await docker.container.isRunning(name)))
+        return "stopped";
+    return undefined;
+}
+//# sourceMappingURL=planned.js.map

package/dist/services/planned.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"planned.js","sourceRoot":"","sources":["../../src/services/planned.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAkBvD,MAAM,UAAU,eAAe,CAC7B,MAAkB,EAClB,QAAkB,EAClB,MAAW,QAAQ;IAEnB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1E,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAEtE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,sDAAsD;IACtD,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAElC,MAAM,KAAK,GAAmB;QAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,OAAO,EAAE,QAAQ,CAAC,MAAM;QACxB,KAAK,EAAE;YACL,gCAAgC,EAAE,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC;SAC5E;QACD,OAAO,EAAE,QAAQ,CAAC,UAAU;KAC7B,CAAC;IAEF,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,8EAA8E;AAC9E,sDAAsD;AACtD,MAAM,UAAU,MAAM,CAAC,MAAkB;IACvC,OAAO;QACL,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,MAAM,CAAC,UAAU,IAAI,cAAc;QAC1C,OAAO,EAAE,QAAQ;KAClB,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,8EAA8E;AAC9E,2EAA2E;AAC3E,MAAM,UAAU,aAAa,CAAC,OAAuB,EAAE,QAAkB;IACvE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAElD,MAAM,KAAK,GAAG;QACZ,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,KAAK;QACL,+DAA+D;QAC/D,OAAO,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE;QAC7D,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;KACtD,CAAC;IAEF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACvF,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,OAAyB,EACzB,QAAkB,EAClB,MAAc;IAEd,MAAM,OAAO,GAAY,EAAE,CAAC;IAE5B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAChG,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAuB,EAAE,QAAkB,EAAE,MAAc;IAClF,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;IACvC,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,SAAkB,CAAC;IAEtE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjD,6EAA6E;IAC7E,oEAAoE;IACpE,IAAI,CAAC,IAAI;QAAE,OAAO,cAAuB,CAAC;IAE1C,IAAI,IAAI,KAAK,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC;QAAE,OAAO,SAAkB,CAAC;IACzE,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,SAAkB,CAAC;IAEzE,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/shell.d.ts

@@ -0,0 +1,11 @@
+import { type OnLine, type Result } from "./host.js";
+export type SpawnOptions = {
+    stdin?: string;
+    onLine?: OnLine;
+    signal?: AbortSignal;
+};
+export declare function signalEverything(name: NodeJS.Signals): number;
+export declare function stillRunning(): number;
+export declare function spawnCollect(command: string, args: string[], options?: SpawnOptions): Promise<Result>;
+export declare function quote(value: string): string;
+//# sourceMappingURL=shell.d.ts.map

package/dist/shell.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../src/shell.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoB,KAAK,MAAM,EAAE,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAKvE,MAAM,MAAM,YAAY,GAAG;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAIhB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AAQF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,UAUpD;AAED,wBAAgB,YAAY,WAE3B;AAED,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,MAAM,CAAC,CA8CjB;AAID,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,UAElC"}