spawnfile 0.1.10 → 0.1.12

package/dist/distribution/consumeImage.js

@@ -0,0 +1,254 @@
+import os from "node:os";
+import path from "node:path";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { acquireHomeDeploymentLock, createDockerDeploymentLabels, homeDeploymentExists, normalizeDeploymentName, readHomeDeploymentRecord, resolveDockerDeploymentTarget, verifyDockerDeploymentTarget, writeHomeDeployment } from "../deployment/index.js";
+import { SpawnfileError } from "../shared/index.js";
+import { deriveDeploymentName, deriveVolumeName, renderEnvFileContent, resolveImageEnvironment } from "./consumeImageSupport.js";
+import { createConsumerDockerRunner } from "./dockerRunner.js";
+import { extractImageReport, resolveDockerBaseArgs } from "./extractImage.js";
+import { parseImageReference } from "./imageRef.js";
+import { prepareImageRuntimeAuthMounts } from "./imageRuntimeAuth.js";
+import { runImagePreflight } from "./preflight.js";
+import { normalizeProjectLabelSlug } from "./projectName.js";
+const containerNameFor = (deploymentName) => `spawnfile-${deploymentName}`;
+const unitIdFor = (deploymentName) => `${deploymentName}-container`;
+const resolveRegistryDigest = async (imageRef, runDocker) => {
+    const fromRef = imageRef.includes("@") ? imageRef.slice(imageRef.indexOf("@") + 1) : null;
+    if (fromRef) {
+        return fromRef;
+    }
+    try {
+        const raw = (await runDocker([
+            "image",
+            "inspect",
+            "--format",
+            "{{json .RepoDigests}}",
+            imageRef
+        ])).toString("utf8").trim();
+        const digests = JSON.parse(raw);
+        const match = digests
+            .map((entry) => (entry.includes("@") ? entry.slice(entry.indexOf("@") + 1) : null))
+            .find((entry) => Boolean(entry));
+        return match ?? null;
+    }
+    catch {
+        return null;
+    }
+};
+const containerExists = async (runDocker, containerName) => {
+    try {
+        await runDocker(["container", "inspect", containerName]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+const resolveLocalImageId = async (imageRef, runDocker) => {
+    try {
+        const raw = (await runDocker([
+            "image",
+            "inspect",
+            "--format",
+            "{{.Id}}",
+            imageRef
+        ])).toString("utf8").trim();
+        return raw.length > 0 ? raw : null;
+    }
+    catch {
+        return null;
+    }
+};
+const networkIdsFrom = (report) => report.moltnet.networks.map((network) => network.id).sort();
+const buildContainsEntries = (report) => [
+    ...report.organization.agents.map((agent) => ({ id: agent.id, kind: "agent" })),
+    ...report.organization.teams.map((team) => ({ id: team.id, kind: "team" })),
+    ...networkIdsFrom(report).map((id) => ({ id, kind: "network" }))
+];
+export const consumeImageUp = async (imageRef, options = {}) => {
+    const parsedRef = parseImageReference(imageRef);
+    if (!parsedRef) {
+        throw new SpawnfileError("validation_error", `Invalid image reference: ${imageRef}`);
+    }
+    const deploymentName = normalizeDeploymentName(options.deploymentName ?? deriveDeploymentName(parsedRef));
+    const isExplicitName = Boolean(options.deploymentName);
+    // Hold an exclusive lock for the whole operation so a concurrent `up` for the
+    // same deployment cannot race on the record or orphan a container.
+    const releaseLock = await acquireHomeDeploymentLock(deploymentName);
+    try {
+        return await consumeImageUpLocked(imageRef, parsedRef, deploymentName, isExplicitName, options);
+    }
+    finally {
+        await releaseLock();
+    }
+};
+const consumeImageUpLocked = async (imageRef, parsedRef, deploymentName, isExplicitName, options) => {
+    void parsedRef;
+    const alreadyExists = await homeDeploymentExists(deploymentName);
+    if (alreadyExists && !isExplicitName) {
+        throw new SpawnfileError("validation_error", `Deployment "${deploymentName}" already exists (derived from image ${imageRef}). ` +
+            `To redeploy it, re-run with --deployment ${deploymentName}; ` +
+            "to create a separate one, pass a different --deployment <name>.");
+    }
+    const dockerCommand = options.dockerCommand ?? "docker";
+    const baseArgs = resolveDockerBaseArgs({
+        dockerContext: options.dockerContext,
+        dockerHost: options.dockerHost
+    });
+    const inspection = await extractImageReport(imageRef, {
+        dockerCommand,
+        dockerContext: options.dockerContext,
+        dockerHost: options.dockerHost,
+        pull: options.pull,
+        runDocker: options.runDocker
+    });
+    const report = inspection.report;
+    // Resolve the full environment first (auth profile, env file, process-env
+    // overrides, and generated runtime tokens), then preflight against it so
+    // required secrets supplied via any of those sources satisfy the check.
+    const env = resolveImageEnvironment({
+        authValues: options.authValues ?? {},
+        envFileEnv: options.envFileEnv,
+        report
+    });
+    const availableImports = options.authProfile
+        ? ["claude-code", "codex"].filter((kind) => options.authProfile.imports[kind])
+        : [];
+    runImagePreflight({ authValues: env, availableImports, report });
+    const target = await resolveExistingOrNewTarget(deploymentName, alreadyExists, options);
+    // Capture what this redeploy replaces so the caller can show previous → new
+    // ref/digest, per specs/DISTRIBUTION.md. Null on a first deploy.
+    const previous = alreadyExists ? await readPreviousSource(deploymentName) : null;
+    const runDocker = options.runDocker ?? createConsumerDockerRunner(dockerCommand, baseArgs);
+    const containerName = containerNameFor(deploymentName);
+    const projectSlug = normalizeProjectLabelSlug(report.organization.project);
+    const workDir = await mkdtemp(path.join(os.tmpdir(), "spawnfile-consume-"));
+    const envFilePath = path.join(workDir, "container.env");
+    // A redeploy reuses the live container's published host ports, and Docker
+    // cannot bind a host port twice. So when a live container exists we move it
+    // aside (rename + stop) to free its name and ports, start the new container,
+    // and on failure restore the old one — non-destructive without needing a free
+    // port for two containers at once. There is a brief restart gap, unavoidable
+    // when reusing host ports without a proxy.
+    const backupName = `${containerName}-previous-${Date.now().toString(36)}`;
+    try {
+        await writeFile(envFilePath, renderEnvFileContent(env), "utf8");
+        // Prepare import-based model auth (the consumer's Claude/Codex login) and
+        // validate its credentials BEFORE the destructive swap below. The OAuth-mode
+        // config is already baked into the image; this only resolves the credential
+        // mounts. Doing it first guarantees an unusable import fails while the live
+        // container is still untouched, never mid-swap.
+        const authMountArgs = options.authProfile && availableImports.length > 0
+            ? (await prepareImageRuntimeAuthMounts({
+                authProfile: options.authProfile,
+                report,
+                tempRoot: workDir
+            })).mountArgs
+            : [];
+        const liveExists = await containerExists(runDocker, containerName);
+        if (liveExists) {
+            await runDocker(["rename", containerName, backupName]);
+            await runDocker(["stop", backupName]).catch(() => undefined);
+        }
+        const runArgs = ["run", "-d", "--name", containerName, "--env-file", envFilePath];
+        for (const port of report.ports) {
+            runArgs.push("-p", `${port}:${port}`);
+        }
+        for (const mount of report.persistent_mounts) {
+            runArgs.push("-v", `${deriveVolumeName(deploymentName, mount.id)}:${mount.target}`);
+        }
+        runArgs.push(...authMountArgs);
+        const labels = createDockerDeploymentLabels({
+            compileFingerprint: inspection.compileFingerprint,
+            deployment: deploymentName,
+            project: projectSlug,
+            unit: unitIdFor(deploymentName),
+            version: "0.1"
+        });
+        for (const [name, value] of Object.entries(labels)) {
+            runArgs.push("--label", `${name}=${value}`);
+        }
+        runArgs.push(imageRef);
+        let runOutput;
+        try {
+            runOutput = (await runDocker(runArgs)).toString("utf8").trim();
+        }
+        catch (error) {
+            // The new container failed to start; remove the failed attempt and restore
+            // the previous deployment so a failed redeploy never loses the live one.
+            await runDocker(["rm", "-f", containerName]).catch(() => undefined);
+            if (liveExists) {
+                await runDocker(["rename", backupName, containerName]).catch(() => undefined);
+                await runDocker(["start", containerName]).catch(() => undefined);
+            }
+            throw error;
+        }
+        // The new container is up — discard the previous one.
+        if (liveExists) {
+            await runDocker(["rm", "-f", backupName]).catch(() => undefined);
+        }
+        const containerId = runOutput.split("\n").pop()?.trim() || null;
+        const imageId = await resolveLocalImageId(imageRef, runDocker);
+        const digest = await resolveRegistryDigest(imageRef, runDocker);
+        const record = {
+            auth_profile: options.authProfileName ?? null,
+            compile_fingerprint: inspection.compileFingerprint,
+            created_at: new Date().toISOString(),
+            ...(options.envFilePath ? { env_file: path.resolve(options.envFilePath) } : {}),
+            manager: "docker",
+            name: deploymentName,
+            output_directory: null,
+            source: { digest, kind: "image", ref: imageRef },
+            target,
+            units: [
+                {
+                    container_id: containerId,
+                    container_name: containerName,
+                    contains: buildContainsEntries(report),
+                    id: unitIdFor(deploymentName),
+                    image_id: imageId,
+                    image_tag: imageRef,
+                    kind: "container",
+                    runtime_instances: report.runtime_instances.map((instance) => instance.id).sort()
+                }
+            ],
+            version: "spawnfile.deployment.v2"
+        };
+        const written = await writeHomeDeployment(record, report);
+        return {
+            containerName,
+            deploymentName,
+            imageRef,
+            previous,
+            record,
+            recordPath: written.recordPath
+        };
+    }
+    finally {
+        await rm(workDir, { force: true, recursive: true }).catch(() => undefined);
+    }
+};
+const readPreviousSource = async (deploymentName) => {
+    try {
+        const existing = await readHomeDeploymentRecord(deploymentName);
+        if (existing.source.kind !== "image") {
+            return null;
+        }
+        return { digest: existing.source.digest, ref: existing.source.ref };
+    }
+    catch {
+        return null;
+    }
+};
+const resolveExistingOrNewTarget = async (deploymentName, alreadyExists, options) => {
+    if (alreadyExists && !options.dockerContext && !options.dockerHost) {
+        const existing = await readHomeDeploymentRecord(deploymentName);
+        await verifyDockerDeploymentTarget(existing.target, { dockerCommand: options.dockerCommand });
+        return existing.target;
+    }
+    return resolveDockerDeploymentTarget({
+        context: options.dockerContext ?? null,
+        dockerCommand: options.dockerCommand,
+        dockerHost: options.dockerHost ?? null
+    });
+};

package/dist/distribution/consumeImageSupport.d.ts

@@ -0,0 +1,18 @@
+import type { ParsedImageReference } from "./imageRef.js";
+import type { DistributionReport } from "./types.js";
+/** Derives a kebab-case deployment name from the image repository component. */
+export declare const deriveDeploymentName: (ref: ParsedImageReference) => string;
+/** Per-deployment volume name so two deployments never share a store. */
+export declare const deriveVolumeName: (deploymentName: string, mountId: string) => string;
+export interface ResolveImageEnvironmentInput {
+    authValues: Record<string, string>;
+    envFileEnv?: Record<string, string>;
+    report: DistributionReport;
+}
+/**
+ * Builds the container environment for a sourceless deployment: auth-profile
+ * and env-file values, process-env overrides for declared secrets, and
+ * generated runtime tokens that the user must never supply.
+ */
+export declare const resolveImageEnvironment: (input: ResolveImageEnvironmentInput) => Record<string, string>;
+export declare const renderEnvFileContent: (env: Record<string, string>) => string;

package/dist/distribution/consumeImageSupport.js

@@ -0,0 +1,63 @@
+import { randomBytes } from "node:crypto";
+const GENERATED_RUNTIME_SECRET_NAMES = new Set([
+    "OPENCLAW_GATEWAY_TOKEN",
+    "OPENCLAW_HOOKS_TOKEN"
+]);
+/** Derives a kebab-case deployment name from the image repository component. */
+export const deriveDeploymentName = (ref) => {
+    const base = ref.name.split("/").pop() ?? ref.name;
+    const normalized = base
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+    return normalized || "deployment";
+};
+/** Per-deployment volume name so two deployments never share a store. */
+export const deriveVolumeName = (deploymentName, mountId) => {
+    const safeMount = mountId.replace(/[^A-Za-z0-9_.-]+/g, "-");
+    return `spawnfile_${deploymentName}_${safeMount}`;
+};
+/**
+ * Builds the container environment for a sourceless deployment: auth-profile
+ * and env-file values, process-env overrides for declared secrets, and
+ * generated runtime tokens that the user must never supply.
+ */
+export const resolveImageEnvironment = (input) => {
+    const env = {
+        ...input.authValues,
+        ...(input.envFileEnv ?? {})
+    };
+    const declaredSecrets = new Set();
+    for (const category of ["model", "project", "runtime", "surface"]) {
+        for (const entry of input.report.secrets[category]) {
+            declaredSecrets.add(entry.name);
+        }
+    }
+    for (const name of new Set([...Object.keys(env), ...declaredSecrets])) {
+        const processValue = process.env[name];
+        if (typeof processValue === "string" && processValue.length > 0) {
+            env[name] = processValue;
+        }
+    }
+    for (const category of ["runtime"]) {
+        for (const entry of input.report.secrets[category]) {
+            if (!entry.generated) {
+                continue;
+            }
+            const hasValue = typeof env[entry.name] === "string" && env[entry.name].length > 0;
+            if (!hasValue && GENERATED_RUNTIME_SECRET_NAMES.has(entry.name)) {
+                env[entry.name] = randomBytes(24).toString("hex");
+            }
+        }
+    }
+    for (const [name, value] of Object.entries(env)) {
+        if (value.includes("\n")) {
+            delete env[name];
+        }
+    }
+    return env;
+};
+export const renderEnvFileContent = (env) => Object.entries(env)
+    .sort(([left], [right]) => left.localeCompare(right))
+    .map(([name, value]) => `${name}=${value}`)
+    .join("\n") + "\n";

package/dist/distribution/distributionReportSchema.d.ts

@@ -0,0 +1,84 @@
+import { z } from "zod";
+import type { DistributionReport } from "./types.js";
+export declare const distributionReportSchema: z.ZodObject<{
+    compile_fingerprint: z.ZodString;
+    generated_at: z.ZodString;
+    internal_ports: z.ZodArray<z.ZodNumber>;
+    model_auth_methods: z.ZodRecord<z.ZodString, z.ZodString>;
+    moltnet: z.ZodObject<{
+        networks: z.ZodArray<z.ZodObject<{
+            binding: z.ZodOptional<z.ZodLiteral<"env">>;
+            id: z.ZodString;
+            server_mode: z.ZodUnion<readonly [z.ZodLiteral<"external">, z.ZodLiteral<"managed">]>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    organization: z.ZodObject<{
+        agents: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            name: z.ZodString;
+            runtime: z.ZodNullable<z.ZodString>;
+            teams: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>>;
+        project: z.ZodString;
+        teams: z.ZodArray<z.ZodObject<{
+            agents: z.ZodArray<z.ZodString>;
+            id: z.ZodString;
+            name: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    persistent_mounts: z.ZodArray<z.ZodObject<{
+        durability: z.ZodLiteral<"persistent">;
+        id: z.ZodString;
+        kind: z.ZodLiteral<"volume">;
+        target: z.ZodString;
+    }, z.core.$strict>>;
+    port_mappings: z.ZodArray<z.ZodObject<{
+        internal_port: z.ZodNumber;
+        published_port: z.ZodNumber;
+    }, z.core.$strict>>;
+    ports: z.ZodArray<z.ZodNumber>;
+    resources: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        kind: z.ZodUnion<readonly [z.ZodLiteral<"git">, z.ZodLiteral<"volume">]>;
+        link_path: z.ZodString;
+        mode: z.ZodUnion<readonly [z.ZodLiteral<"mutable">, z.ZodLiteral<"readonly">]>;
+        mount: z.ZodString;
+        sharing: z.ZodUnion<readonly [z.ZodLiteral<"per_agent">, z.ZodLiteral<"team">]>;
+    }, z.core.$strict>>;
+    runtime_instances: z.ZodArray<z.ZodObject<{
+        config_path: z.ZodString;
+        home_path: z.ZodNullable<z.ZodString>;
+        id: z.ZodString;
+        internal_port: z.ZodNullable<z.ZodNumber>;
+        model_auth_methods: z.ZodRecord<z.ZodString, z.ZodString>;
+        model_secrets_required: z.ZodArray<z.ZodString>;
+        node_ids: z.ZodArray<z.ZodString>;
+        published_port: z.ZodNullable<z.ZodNumber>;
+        runtime: z.ZodString;
+        workspace_path: z.ZodString;
+    }, z.core.$strict>>;
+    secrets: z.ZodObject<{
+        model: z.ZodArray<z.ZodObject<{
+            generated: z.ZodBoolean;
+            name: z.ZodString;
+            required: z.ZodBoolean;
+        }, z.core.$strict>>;
+        project: z.ZodArray<z.ZodObject<{
+            generated: z.ZodBoolean;
+            name: z.ZodString;
+            required: z.ZodBoolean;
+        }, z.core.$strict>>;
+        runtime: z.ZodArray<z.ZodObject<{
+            generated: z.ZodBoolean;
+            name: z.ZodString;
+            required: z.ZodBoolean;
+        }, z.core.$strict>>;
+        surface: z.ZodArray<z.ZodObject<{
+            generated: z.ZodBoolean;
+            name: z.ZodString;
+            required: z.ZodBoolean;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    version: z.ZodLiteral<"spawnfile.distribution-report.v1">;
+}, z.core.$strict>;
+export declare const parseDistributionReport: (source: unknown, sourceLabel?: string) => DistributionReport;

package/dist/distribution/distributionReportSchema.js

@@ -0,0 +1,107 @@
+import { z } from "zod";
+import { SpawnfileError } from "../shared/index.js";
+import { DISTRIBUTION_REPORT_VERSION } from "./types.js";
+const secretEntrySchema = z.object({
+    generated: z.boolean(),
+    name: z.string().min(1),
+    required: z.boolean()
+}).strict();
+// Path fields from an untrusted image flow into `docker run -v` mount specs. A
+// crafted value containing `:` would inject extra mount fields (e.g. drop `:ro`
+// or add options), and `..` could redirect the mount target. Constrain every
+// path the consumer interpolates to a clean absolute POSIX path so a hostile
+// report is rejected up front; a legitimately compiled image always satisfies this.
+const containerPathSchema = z
+    .string()
+    .min(1)
+    .refine((value) => value.startsWith("/") &&
+    !value.includes(":") &&
+    !/\s/.test(value) &&
+    !value.split("/").includes(".."), { message: "must be a clean absolute POSIX path (no ':', whitespace, or '..' segment)" });
+// Ports are interpolated into `-p host:container`; bound them to the valid TCP range.
+const portSchema = z.number().int().min(1).max(65535);
+// A runtime instance id is interpolated into a host path (the auth-profiles temp
+// file) and then into a `docker run -v` source by the runtime adapters, so an
+// unconstrained value could traverse with `..` or inject mount fields with `:`.
+// Legitimate ids are compile-generated `<kind>-<slug>` identifiers.
+const instanceIdSchema = z
+    .string()
+    .min(1)
+    .refine((value) => /^[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(value) && !value.includes(".."), {
+    message: "must be an identifier (letters, digits, '_', '.', '-'; no '/', ':', whitespace, or '..')"
+});
+const runtimeInstanceSchema = z.object({
+    config_path: containerPathSchema,
+    home_path: containerPathSchema.nullable(),
+    id: instanceIdSchema,
+    internal_port: portSchema.nullable(),
+    model_auth_methods: z.record(z.string(), z.string()),
+    model_secrets_required: z.array(z.string()),
+    node_ids: z.array(z.string()),
+    published_port: portSchema.nullable(),
+    runtime: z.string().min(1),
+    workspace_path: containerPathSchema
+}).strict();
+export const distributionReportSchema = z.object({
+    compile_fingerprint: z.string().min(1),
+    generated_at: z.string().min(1),
+    internal_ports: z.array(portSchema),
+    model_auth_methods: z.record(z.string(), z.string()),
+    moltnet: z.object({
+        networks: z.array(z.object({
+            binding: z.literal("env").optional(),
+            id: z.string().min(1),
+            server_mode: z.union([z.literal("external"), z.literal("managed")])
+        }).strict())
+    }).strict(),
+    organization: z.object({
+        agents: z.array(z.object({
+            id: z.string().min(1),
+            name: z.string(),
+            runtime: z.string().nullable(),
+            teams: z.array(z.string())
+        }).strict()),
+        project: z.string().min(1),
+        teams: z.array(z.object({
+            agents: z.array(z.string()),
+            id: z.string().min(1),
+            name: z.string()
+        }).strict())
+    }).strict(),
+    persistent_mounts: z.array(z.object({
+        durability: z.literal("persistent"),
+        // Sanitized by deriveVolumeName before use, but constrained here too so the
+        // schema alone keeps the volume-name source clean (defense in depth).
+        id: instanceIdSchema,
+        kind: z.literal("volume"),
+        target: containerPathSchema
+    }).strict()),
+    port_mappings: z.array(z.object({
+        internal_port: portSchema,
+        published_port: portSchema
+    }).strict()),
+    ports: z.array(portSchema),
+    resources: z.array(z.object({
+        id: z.string().min(1),
+        kind: z.union([z.literal("git"), z.literal("volume")]),
+        link_path: z.string(),
+        mode: z.union([z.literal("mutable"), z.literal("readonly")]),
+        mount: z.string(),
+        sharing: z.union([z.literal("per_agent"), z.literal("team")])
+    }).strict()),
+    runtime_instances: z.array(runtimeInstanceSchema),
+    secrets: z.object({
+        model: z.array(secretEntrySchema),
+        project: z.array(secretEntrySchema),
+        runtime: z.array(secretEntrySchema),
+        surface: z.array(secretEntrySchema)
+    }).strict(),
+    version: z.literal(DISTRIBUTION_REPORT_VERSION)
+}).strict();
+export const parseDistributionReport = (source, sourceLabel = "distribution report") => {
+    const parsed = distributionReportSchema.safeParse(source);
+    if (!parsed.success) {
+        throw new SpawnfileError("validation_error", `Invalid ${sourceLabel}: ${z.prettifyError(parsed.error)}`);
+    }
+    return parsed.data;
+};

package/dist/distribution/dockerRunner.d.ts

@@ -0,0 +1,5 @@
+export interface DockerCommandRunner {
+    /** Runs docker with args; resolves stdout as a Buffer. Rejects on non-zero exit. */
+    (args: string[]): Promise<Buffer>;
+}
+export declare const createConsumerDockerRunner: (dockerCommand: string, baseArgs: string[]) => DockerCommandRunner;

package/dist/distribution/dockerRunner.js

@@ -0,0 +1,21 @@
+import { spawn } from "node:child_process";
+import { SpawnfileError } from "../shared/index.js";
+export const createConsumerDockerRunner = (dockerCommand, baseArgs) => async (args) => new Promise((resolve, reject) => {
+    const finalArgs = [...baseArgs, ...args];
+    const child = spawn(dockerCommand, finalArgs, {
+        env: { ...process.env },
+        stdio: ["ignore", "pipe", "pipe"]
+    });
+    const stdout = [];
+    const stderr = [];
+    child.stdout.on("data", (chunk) => stdout.push(chunk));
+    child.stderr.on("data", (chunk) => stderr.push(String(chunk)));
+    child.on("error", reject);
+    child.on("close", (code) => {
+        if (code === 0) {
+            resolve(Buffer.concat(stdout));
+            return;
+        }
+        reject(new SpawnfileError("runtime_error", `docker ${finalArgs[0]} failed (${code}): ${stderr.join("").trim()}`));
+    });
+});

package/dist/distribution/extractImage.d.ts

@@ -0,0 +1,25 @@
+import type { DockerCommandRunner } from "./dockerRunner.js";
+import type { DistributionReport } from "./types.js";
+export type { DockerCommandRunner } from "./dockerRunner.js";
+export interface ImageInspection {
+    compileFingerprint: string;
+    labels: Record<string, string>;
+    report: DistributionReport;
+}
+export interface ExtractImageOptions {
+    dockerCommand?: string;
+    dockerContext?: string;
+    dockerHost?: string;
+    pull?: boolean;
+    runDocker?: DockerCommandRunner;
+}
+export declare const resolveDockerBaseArgs: (options: {
+    dockerContext?: string;
+    dockerHost?: string;
+}) => string[];
+/**
+ * Pulls (optionally), inspects labels, and extracts the embedded distribution
+ * report from an image without starting its entrypoint. Uses a stopped helper
+ * container and guarantees cleanup.
+ */
+export declare const extractImageReport: (imageRef: string, options?: ExtractImageOptions) => Promise<ImageInspection>;