vouchington-tooling 0.0.14 → 0.0.16

package/dist/coverage-transport/lib.mjs

@@ -0,0 +1,84 @@
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { DEFAULT_COVERAGE_MANIFEST_FILENAME, DEFAULT_MAX_BODY_BYTES, assertCoverageManifestFilename, } from './constants.mjs';
+import { readTransportControl, } from './control.mjs';
+import { fetchGet, fetchPut, logTransport } from './http.mjs';
+import { downloadVitestBlobBundles, packVitestBlobBundle } from './vitest-blob-transport.mjs';
+export { DEFAULT_COVERAGE_MANIFEST_FILENAME } from './constants.mjs';
+export async function cmdUpload(controlPath, suite, options) {
+    const control = readTransportControl(controlPath, options.expectedIdentity);
+    if (control.mode === 'fallback-only') {
+        logTransport(options, `[coverage-transport] S3 unavailable for ${suite}; artifact fallback required`);
+        return { coverage: false, blob: false };
+    }
+    const cwd = options.cwd ?? process.cwd();
+    const manifestFilename = options.coverageManifestFilename ?? DEFAULT_COVERAGE_MANIFEST_FILENAME;
+    assertCoverageManifestFilename(manifestFilename);
+    const coverageUrls = control.coverage[suite];
+    const lcovPath = join(cwd, 'coverage', 'lcov.info');
+    const manifestPath = join(cwd, 'coverage', manifestFilename);
+    const maxBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
+    const lcov = coverageUrls && existsSync(lcovPath) && existsSync(manifestPath)
+        ? await readFile(lcovPath)
+        : null;
+    const manifest = lcov === null ? null : await readFile(manifestPath);
+    const lcovStored = coverageUrls &&
+        lcov !== null &&
+        manifest !== null &&
+        lcov.byteLength <= maxBytes &&
+        manifest.byteLength <= maxBytes
+        ? await fetchPut(coverageUrls.lcovPut, lcov, options)
+        : false;
+    const coverage = lcovStored && coverageUrls && manifest !== null && manifest.byteLength <= maxBytes
+        ? await fetchPut(coverageUrls.manifestPut, manifest, options)
+        : false;
+    if (coverageUrls && existsSync(lcovPath) && existsSync(manifestPath)) {
+        logTransport(options, coverage
+            ? `[coverage-transport] Uploaded coverage pair for ${suite}`
+            : `[coverage-transport] Coverage pair upload failed for ${suite}`);
+    }
+    const blobUrls = control.blobs[suite];
+    const blobData = blobUrls
+        ? packVitestBlobBundle(cwd, suite, options.expectedIdentity, options)
+        : null;
+    const blob = Boolean(blobUrls && blobData && (await fetchPut(blobUrls.put, blobData, options)));
+    if (blob)
+        logTransport(options, `[coverage-transport] Uploaded vitest blob for ${suite}`);
+    else if (blobUrls && blobData) {
+        logTransport(options, `[coverage-transport] Vitest blob upload failed for ${suite}`);
+    }
+    return { coverage, blob };
+}
+export async function cmdDownloadCoverage(controlPath, destinationRoot, options) {
+    const control = readTransportControl(controlPath, options.expectedIdentity);
+    if (control.mode === 'fallback-only') {
+        logTransport(options, '[coverage-transport] S3 unavailable; artifact fallback required');
+        return;
+    }
+    const manifestFilename = options.coverageManifestFilename ?? DEFAULT_COVERAGE_MANIFEST_FILENAME;
+    assertCoverageManifestFilename(manifestFilename);
+    await Promise.all(Object.entries(control.coverage).map(async ([suite, urls]) => {
+        const [lcov, manifest] = await Promise.all([
+            fetchGet(urls.lcovGet, options),
+            fetchGet(urls.manifestGet, options),
+        ]);
+        if (!lcov || !manifest) {
+            logTransport(options, `[coverage-transport] Skipped incomplete coverage pair for ${suite}`);
+            return;
+        }
+        const destination = join(destinationRoot, `coverage-${suite}`);
+        mkdirSync(destination, { recursive: true });
+        writeFileSync(join(destination, 'lcov.info'), lcov);
+        writeFileSync(join(destination, manifestFilename), manifest, { mode: 0o600 });
+        logTransport(options, `[coverage-transport] Downloaded coverage pair for ${suite}`);
+    }));
+}
+export async function cmdDownloadVitestBlobs(controlPath, destinationRoot, options) {
+    const control = readTransportControl(controlPath, options.expectedIdentity);
+    if (control.mode === 'fallback-only') {
+        logTransport(options, '[coverage-transport] S3 unavailable; artifact fallback required');
+        return;
+    }
+    await downloadVitestBlobBundles(control.blobs, destinationRoot, options);
+}

package/dist/coverage-transport/outcome.d.mts

@@ -0,0 +1,29 @@
+/**
+ * Transport exhaustion guards for a coverage pair and a Vitest blob, plus the
+ * `$GITHUB_OUTPUT` writer producers use when the upload exit code is not the blob signal.
+ */
+export type StepOutcome = 'success' | 'failure' | 'cancelled' | 'skipped';
+/**
+ * CLI argv values arrive as plain strings (or `undefined` when a positional arg was omitted); this
+ * narrows to `StepOutcome` so a caller can validate a step-outcome argument without an unchecked
+ * `as` cast.
+ */
+export declare function isStepOutcome(value: string | undefined): value is StepOutcome;
+export declare function assertCoverageTransportOutcome(suite: string, primary: StepOutcome, artifactAttempt1: StepOutcome, artifactAttempt2: StepOutcome, emit?: (line: string) => void): boolean;
+export type BlobPrimaryState = 'true' | 'false' | 'skipped';
+export declare function isBlobPrimaryState(value: string | undefined): value is BlobPrimaryState;
+/**
+ * Sibling to `assertCoverageTransportOutcome` for the Vitest blob. `true`/`false` are the S3
+ * upload step's `blob` output; `skipped` means that step never ran. GitHub fallback is always
+ * attempted when enabled — workflows must not gate it on `blob != 'true'`.
+ */
+export declare function assertCoverageTransportBlobOutcome(suite: string, primaryPersisted: BlobPrimaryState, artifactAttempt1: StepOutcome, artifactAttempt2: StepOutcome, emit?: (line: string) => void): boolean;
+export type AppendOutput = (path: string, data: string) => void;
+/**
+ * Writes `blob=true|false` to `$GITHUB_OUTPUT` for outcome reporting. GitHub-fallback blob upload
+ * must always be attempted when enabled; do not gate it on this signal. The upload subcommand's
+ * exit code tracks the coverage pair, not the blob. A no-op outside CI (`githubOutputPath` unset).
+ */
+export declare function writeUploadOutcomeOutput(outcome: {
+    readonly blob: boolean;
+}, githubOutputPath: string | undefined, appendOutput?: AppendOutput): void;

package/dist/coverage-transport/outcome.mjs

@@ -0,0 +1,70 @@
+import { appendFileSync } from 'node:fs';
+const STEP_OUTCOMES = new Set([
+    'success',
+    'failure',
+    'cancelled',
+    'skipped',
+]);
+/**
+ * CLI argv values arrive as plain strings (or `undefined` when a positional arg was omitted); this
+ * narrows to `StepOutcome` so a caller can validate a step-outcome argument without an unchecked
+ * `as` cast.
+ */
+export function isStepOutcome(value) {
+    return value !== undefined && STEP_OUTCOMES.has(value);
+}
+export function assertCoverageTransportOutcome(suite, primary, artifactAttempt1, artifactAttempt2, emit = (line) => process.stderr.write(`${line}\n`)) {
+    const primarySucceeded = primary === 'success';
+    const artifactSucceeded = artifactAttempt1 === 'success' || artifactAttempt2 === 'success';
+    if (primarySucceeded && artifactSucceeded)
+        return true;
+    if (primarySucceeded) {
+        emit(`::warning::Coverage persisted only to S3 for suite=${suite}; GitHub artifact fallback is degraded.`);
+        return true;
+    }
+    if (artifactSucceeded) {
+        emit(`::warning::Coverage persisted only to GitHub artifacts for suite=${suite}; S3 primary is degraded.`);
+        return true;
+    }
+    emit(`::error::COVERAGE_TRANSPORT_EXHAUSTED suite=${suite} Neither S3 nor GitHub artifacts persisted the coverage pair.`);
+    return false;
+}
+const BLOB_PRIMARY_STATES = new Set([
+    'true',
+    'false',
+    'skipped',
+]);
+export function isBlobPrimaryState(value) {
+    return value !== undefined && BLOB_PRIMARY_STATES.has(value);
+}
+/**
+ * Sibling to `assertCoverageTransportOutcome` for the Vitest blob. `true`/`false` are the S3
+ * upload step's `blob` output; `skipped` means that step never ran. GitHub fallback is always
+ * attempted when enabled — workflows must not gate it on `blob != 'true'`.
+ */
+export function assertCoverageTransportBlobOutcome(suite, primaryPersisted, artifactAttempt1, artifactAttempt2, emit = (line) => process.stderr.write(`${line}\n`)) {
+    const artifactSucceeded = artifactAttempt1 === 'success' || artifactAttempt2 === 'success';
+    if (primaryPersisted === 'true') {
+        if (!artifactSucceeded) {
+            emit(`::warning::Vitest blob persisted only to S3 for suite=${suite}; GitHub artifact fallback is degraded.`);
+        }
+        return true;
+    }
+    if (artifactSucceeded) {
+        if (primaryPersisted === 'false') {
+            emit(`::warning::Vitest blob persisted only to GitHub artifacts for suite=${suite}; S3 primary is degraded.`);
+        }
+        return true;
+    }
+    emit(`::error::COVERAGE_TRANSPORT_BLOB_EXHAUSTED suite=${suite} Neither S3 nor GitHub artifacts persisted the vitest blob.`);
+    return false;
+}
+/**
+ * Writes `blob=true|false` to `$GITHUB_OUTPUT` for outcome reporting. GitHub-fallback blob upload
+ * must always be attempted when enabled; do not gate it on this signal. The upload subcommand's
+ * exit code tracks the coverage pair, not the blob. A no-op outside CI (`githubOutputPath` unset).
+ */
+export function writeUploadOutcomeOutput(outcome, githubOutputPath, appendOutput = appendFileSync) {
+    if (githubOutputPath)
+        appendOutput(githubOutputPath, `blob=${String(outcome.blob)}\n`);
+}

package/dist/coverage-transport/presign.d.mts

@@ -0,0 +1,22 @@
+import type { PresignedTransportControl } from './control.mts';
+export interface PresignIdentity {
+    readonly repository: string;
+    readonly revision: string;
+    readonly runId: string;
+    readonly controlAttempt: number;
+}
+export interface ObjectSigner {
+    signPut(key: string, ttlSeconds: number): Promise<string>;
+    signGet(key: string, ttlSeconds: number): Promise<string>;
+}
+export interface MintPresignedControlOptions {
+    readonly ttlSeconds?: number;
+    readonly now?: () => Date;
+    readonly manifestFilename?: string;
+}
+export declare function transportObjectKeys(repository: string, runId: string, controlAttempt: number, suite: string, manifestFilename?: string): {
+    readonly lcov: string;
+    readonly manifest: string;
+    readonly blob: string;
+};
+export declare function mintPresignedControl(identity: PresignIdentity, coverageSuites: readonly string[], blobSuites: readonly string[], signer: ObjectSigner, options?: MintPresignedControlOptions): Promise<PresignedTransportControl>;

package/dist/coverage-transport/presign.mjs

@@ -0,0 +1,51 @@
+import { assertCoverageManifestFilename, DEFAULT_COVERAGE_MANIFEST_FILENAME } from './constants.mjs';
+const DEFAULT_PRESIGN_TTL_SECONDS = 14_400;
+export function transportObjectKeys(repository, runId, controlAttempt, suite, manifestFilename = DEFAULT_COVERAGE_MANIFEST_FILENAME) {
+    assertCoverageManifestFilename(manifestFilename);
+    if (repository.includes('..') ||
+        !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repository) ||
+        !/^[1-9][0-9]*$/.test(runId) ||
+        !Number.isSafeInteger(controlAttempt) ||
+        controlAttempt < 1 ||
+        !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(suite)) {
+        throw new Error('Coverage transport key identity is invalid');
+    }
+    const prefix = `coverage-transport/${repository}/${runId}/${controlAttempt}`;
+    return {
+        lcov: `${prefix}/coverage/${suite}/lcov.info`,
+        manifest: `${prefix}/coverage/${suite}/${manifestFilename}`,
+        blob: `${prefix}/blobs/${suite}.tar.gz`,
+    };
+}
+export async function mintPresignedControl(identity, coverageSuites, blobSuites, signer, options = {}) {
+    const ttlSeconds = options.ttlSeconds ?? DEFAULT_PRESIGN_TTL_SECONDS;
+    const expiresAt = new Date((options.now?.() ?? new Date()).getTime() + ttlSeconds * 1000);
+    const manifestFilename = options.manifestFilename ?? DEFAULT_COVERAGE_MANIFEST_FILENAME;
+    const control = {
+        version: 1,
+        mode: 'presigned',
+        repository: identity.repository,
+        revision: identity.revision,
+        run: { id: identity.runId, controlAttempt: identity.controlAttempt },
+        expiresAt: expiresAt.toISOString(),
+        coverage: {},
+        blobs: {},
+    };
+    for (const suite of coverageSuites) {
+        const keys = transportObjectKeys(identity.repository, identity.runId, identity.controlAttempt, suite, manifestFilename);
+        control.coverage[suite] = {
+            lcovPut: await signer.signPut(keys.lcov, ttlSeconds),
+            lcovGet: await signer.signGet(keys.lcov, ttlSeconds),
+            manifestPut: await signer.signPut(keys.manifest, ttlSeconds),
+            manifestGet: await signer.signGet(keys.manifest, ttlSeconds),
+        };
+    }
+    for (const suite of blobSuites) {
+        const key = transportObjectKeys(identity.repository, identity.runId, identity.controlAttempt, suite, manifestFilename).blob;
+        control.blobs[suite] = {
+            put: await signer.signPut(key, ttlSeconds),
+            get: await signer.signGet(key, ttlSeconds),
+        };
+    }
+    return control;
+}

package/dist/coverage-transport/vitest-blob-transport.d.mts

@@ -0,0 +1,5 @@
+import type { ExpectedTransportIdentity, PresignedBlobUrls, RequestOptions } from './control.mts';
+export declare function packVitestBlobBundle(cwd: string, suite: string, identity: ExpectedTransportIdentity, options: RequestOptions): Buffer | null;
+export declare function tarVerboseMemberSize(line: string): number;
+export declare function assertTarMemberSizes(verboseLines: readonly string[], maxMemberBytes?: number): void;
+export declare function downloadVitestBlobBundles(blobs: Readonly<Record<string, PresignedBlobUrls>>, destinationRoot: string, options: RequestOptions): Promise<void>;

package/dist/coverage-transport/vitest-blob-transport.mjs

@@ -0,0 +1,129 @@
+import { execFileSync } from 'node:child_process';
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+import { basename, join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { fetchGet, logTransport, redactTransportLog } from './http.mjs';
+import { inspectVitestBlobBundle, VITEST_BLOB_MANIFEST_FILENAME, VITEST_SUITE_PATTERN, vitestBlobBundlePaths, writeVitestBlobManifest, } from '../vitest-blob-manifest/index.mjs';
+function archiveWorkspace(suite) {
+    assertVitestSuite(suite);
+    const root = mkdtempSync(join(tmpdir(), `ct-blob-${suite}-`));
+    chmodSync(root, 0o700);
+    return { root, archive: join(root, 'bundle.tar.gz') };
+}
+function assertVitestSuite(suite) {
+    if (!VITEST_SUITE_PATTERN.test(suite))
+        throw new Error('Invalid Vitest suite');
+}
+export function packVitestBlobBundle(cwd, suite, identity, options) {
+    const directory = join(cwd, '.vitest-reports');
+    const { root, archive } = archiveWorkspace(suite);
+    try {
+        writeVitestBlobManifest(directory, {
+            suite,
+            repository: identity.repository,
+            revision: identity.revision,
+            runId: identity.runId,
+            runAttempt: identity.currentAttempt,
+        });
+        const paths = vitestBlobBundlePaths(directory, suite);
+        const limit = options.maxMemberBytes ?? MAX_VITEST_BLOB_MEMBER_BYTES;
+        if (paths.some((path) => statSync(path).size > limit)) {
+            throw new Error('Vitest blob member exceeds size limit');
+        }
+        const names = paths.map((path) => basename(path));
+        execFileSync('tar', ['czf', archive, '-C', directory, ...names], {
+            stdio: ['ignore', 'ignore', 'inherit'],
+        });
+        return readFileSync(archive);
+    }
+    catch (error) {
+        logTransport(options, `[coverage-transport] vitest blob pack failed: ${redactTransportLog(error)}`);
+        return null;
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+}
+export function tarVerboseMemberSize(line) {
+    const match = line.match(/\s(\d+)\s+\d{4}-\d{2}-\d{2}(?:\s|$)/) ??
+        line.match(/\s(\d+)\s+[A-Z][a-z]{2}\s+\d{1,2}\s/);
+    const size = match === null ? Number.NaN : Number(match[1]);
+    if (!Number.isSafeInteger(size) || size < 0) {
+        throw new Error('Vitest blob archive listing is malformed');
+    }
+    return size;
+}
+const MAX_VITEST_BLOB_MEMBER_BYTES = 32 * 1024 * 1024;
+export function assertTarMemberSizes(verboseLines, maxMemberBytes = MAX_VITEST_BLOB_MEMBER_BYTES) {
+    if (verboseLines.some((line) => tarVerboseMemberSize(line) > maxMemberBytes)) {
+        throw new Error('Vitest blob archive exceeds the member size limit');
+    }
+}
+function validateArchive(archive, suite, maxMemberBytes) {
+    const entries = execFileSync('tar', ['tzf', archive], { encoding: 'utf8' })
+        .split('\n')
+        .filter(Boolean);
+    const expected = [VITEST_BLOB_MANIFEST_FILENAME, `${suite}.json`].toSorted();
+    if (entries.length !== 2 || entries.toSorted().join('\0') !== expected.join('\0')) {
+        throw new Error(`Vitest blob archive for ${suite} has unexpected entries`);
+    }
+    const verbose = execFileSync('tar', ['tvzf', archive], { encoding: 'utf8' })
+        .split('\n')
+        .filter(Boolean);
+    if (verbose.length !== 2 || verbose.some((line) => !line.startsWith('-'))) {
+        throw new Error(`Vitest blob archive for ${suite} must contain regular files`);
+    }
+    assertTarMemberSizes(verbose, maxMemberBytes);
+    return entries;
+}
+function extractValidatedBundle(archive, destinationRoot, suite, maxMemberBytes) {
+    const entries = validateArchive(archive, suite, maxMemberBytes);
+    mkdirSync(destinationRoot, { recursive: true });
+    const temporary = mkdtempSync(join(destinationRoot, `.vitest-blob-${suite}-`));
+    try {
+        execFileSync('tar', ['xzf', archive, '-C', temporary, ...entries], {
+            stdio: ['ignore', 'ignore', 'inherit'],
+        });
+        for (const entry of entries)
+            chmodSync(join(temporary, entry), 0o600);
+        inspectVitestBlobBundle(temporary);
+        const destination = join(destinationRoot, `vitest-blob-${suite}`);
+        rmSync(destination, { recursive: true, force: true });
+        renameSync(temporary, destination);
+    }
+    finally {
+        rmSync(temporary, { recursive: true, force: true });
+    }
+}
+export async function downloadVitestBlobBundles(blobs, destinationRoot, options) {
+    mkdirSync(destinationRoot, { recursive: true });
+    await Promise.all(Object.entries(blobs).map(async ([suite, urls]) => {
+        assertVitestSuite(suite);
+        const data = await fetchGet(urls.get, options);
+        if (!data) {
+            logTransport(options, `[coverage-transport] No vitest blob available for ${suite}`);
+            return;
+        }
+        const { root, archive } = archiveWorkspace(suite);
+        const invalidMarker = join(destinationRoot, `.invalid-${suite}`);
+        try {
+            writeFileSync(archive, data, { flag: 'wx', mode: 0o600 });
+            extractValidatedBundle(archive, destinationRoot, suite, options.maxMemberBytes ?? MAX_VITEST_BLOB_MEMBER_BYTES);
+            rmSync(invalidMarker, { recursive: true, force: true });
+            logTransport(options, `[coverage-transport] Downloaded vitest blob for ${suite}`);
+        }
+        catch (error) {
+            try {
+                rmSync(invalidMarker, { force: true });
+                writeFileSync(invalidMarker, 'invalid archive\n', { flag: 'wx', mode: 0o600 });
+            }
+            catch {
+                // The original archive failure is more actionable than a diagnostic-write failure.
+            }
+            throw error;
+        }
+        finally {
+            rmSync(root, { recursive: true, force: true });
+        }
+    }));
+}

package/dist/dockerfile-parse/index.d.mts

@@ -0,0 +1,4 @@
+export { parseDockerfileRuntimeImages } from './runtime-cmd.mts';
+export type { DockerfileRuntimeImage, ParseDockerfileRuntimeImagesOptions } from './runtime-cmd.mts';
+export { parseDockerfilePrewarmStages } from './prewarm-ports.mts';
+export type { DockerfilePrewarmStage, ParseDockerfilePrewarmOptions } from './prewarm-ports.mts';

package/dist/dockerfile-parse/index.mjs

@@ -0,0 +1,2 @@
+export { parseDockerfileRuntimeImages } from './runtime-cmd.mjs';
+export { parseDockerfilePrewarmStages } from './prewarm-ports.mjs';

package/dist/dockerfile-parse/prewarm-ports.d.mts

@@ -0,0 +1,12 @@
+export interface DockerfilePrewarmStage {
+    stage: string;
+    copySource: string | undefined;
+    monitoredPort: number | undefined;
+    envPort: number | undefined;
+}
+export interface ParseDockerfilePrewarmOptions {
+    copySourcePrefix?: string;
+    prewarmBinary?: string;
+    prewarmPortEnv?: string;
+}
+export declare function parseDockerfilePrewarmStages(dockerfile: string, { copySourcePrefix, prewarmBinary, prewarmPortEnv, }?: ParseDockerfilePrewarmOptions): DockerfilePrewarmStage[];

package/dist/dockerfile-parse/prewarm-ports.mjs

@@ -0,0 +1,59 @@
+import { Copy, DockerfileParser, Run } from 'dockerfile-ast';
+import { collectStages } from './stages.mjs';
+export function parseDockerfilePrewarmStages(dockerfile, { copySourcePrefix = '/prod/', prewarmBinary = 'node-prewarm', prewarmPortEnv = 'NODE_PREWARM_PORT', } = {}) {
+    const parser = DockerfileParser.parse(dockerfile);
+    const stages = collectStages(parser);
+    const prewarmStages = [];
+    for (const { stage, instructions } of stages) {
+        const prewarmRun = instructions.find((instruction) => instruction instanceof Run && isPrewarmRun(instruction, prewarmBinary));
+        if (!prewarmRun)
+            continue;
+        const args = runArguments(prewarmRun);
+        prewarmStages.push({
+            stage,
+            copySource: matchCopySource(instructions, copySourcePrefix),
+            monitoredPort: matchMonitoredPort(args),
+            envPort: matchEnvPort(args, prewarmPortEnv),
+        });
+    }
+    return prewarmStages;
+}
+function runArguments(instruction) {
+    return instruction.getArguments().map((argument) => argument.getValue());
+}
+function isPrewarmRun(instruction, prewarmBinary) {
+    return runArguments(instruction).some((argument) => argument === prewarmBinary || argument.startsWith(`${prewarmBinary}@`));
+}
+function matchCopySource(instructions, copySourcePrefix) {
+    for (const instruction of instructions) {
+        if (!(instruction instanceof Copy))
+            continue;
+        if (!instruction.getFlags().some((flag) => flag.getName() === 'from'))
+            continue;
+        const args = instruction.getArguments();
+        if (args.at(-1)?.getValue() !== './' && args.at(-1)?.getValue() !== '.')
+            continue;
+        const sourcePath = args[0]?.getValue();
+        if (sourcePath?.startsWith(copySourcePrefix))
+            return sourcePath;
+    }
+    return undefined;
+}
+function matchMonitoredPort(args) {
+    const index = args.indexOf('--port');
+    if (index === -1)
+        return undefined;
+    const value = args[index + 1];
+    return value !== undefined && /^\d+$/.test(value) ? Number(value) : undefined;
+}
+function matchEnvPort(args, prewarmPortEnv) {
+    const prefix = `${prewarmPortEnv}=`;
+    for (const argument of args) {
+        if (!argument.startsWith(prefix))
+            continue;
+        const value = argument.slice(prefix.length);
+        if (/^\d+$/.test(value))
+            return Number(value);
+    }
+    return undefined;
+}

package/dist/dockerfile-parse/runtime-cmd.d.mts

@@ -0,0 +1,11 @@
+export interface DockerfileRuntimeImage {
+    stage: string;
+    pnpmFilter: string;
+    cmdPath: string;
+    workspaceDir: string;
+}
+export interface ParseDockerfileRuntimeImagesOptions {
+    monorepoRoot: string;
+    copySourcePrefix?: string;
+}
+export declare function parseDockerfileRuntimeImages(dockerfile: string, { monorepoRoot, copySourcePrefix }: ParseDockerfileRuntimeImagesOptions): DockerfileRuntimeImage[];

package/dist/dockerfile-parse/runtime-cmd.mjs

@@ -0,0 +1,142 @@
+import { existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import { Cmd, Copy, DockerfileParser, Run } from 'dockerfile-ast';
+import { expandWorkspaceGlob } from '../workspace-glob.mjs';
+import { collectStages } from './stages.mjs';
+const CMD_SCRIPT = /\.(?:[cm]?[jt]s|tsx)$/u;
+export function parseDockerfileRuntimeImages(dockerfile, { monorepoRoot, copySourcePrefix = '/prod/' }) {
+    const parser = DockerfileParser.parse(dockerfile);
+    const stages = collectStages(parser);
+    const targetToFilter = collectDeployTargets(stages);
+    const images = [];
+    for (const { stage, instructions } of stages) {
+        const target = matchCopyTarget(instructions, copySourcePrefix);
+        if (!target)
+            continue;
+        const pnpmFilter = targetToFilter.get(deployKey(target.fromStage, target.sourcePath));
+        if (!pnpmFilter)
+            continue;
+        const cmdPath = matchCmdScriptPath(instructions);
+        if (!cmdPath)
+            continue;
+        images.push({
+            stage,
+            pnpmFilter,
+            cmdPath,
+            workspaceDir: findWorkspaceDirByPackageName(monorepoRoot, pnpmFilter),
+        });
+    }
+    return images;
+}
+function deployKey(stage, target) {
+    return `${stage}\0${target}`;
+}
+function collectDeployTargets(stages) {
+    const targetToFilter = new Map();
+    for (const { stage, instructions } of stages) {
+        for (const instruction of instructions) {
+            if (!(instruction instanceof Run))
+                continue;
+            const runText = instruction
+                .getArguments()
+                .map((argument) => argument.getValue())
+                .join(' ');
+            for (const { filter, target } of parsePnpmDeploys(runText)) {
+                targetToFilter.set(deployKey(stage, target), filter);
+            }
+        }
+    }
+    return targetToFilter;
+}
+function parsePnpmDeploys(runText) {
+    const found = [];
+    for (const command of runText.split(/\s*(?:&&|;)\s*/)) {
+        const parsed = parsePnpmDeploy(command);
+        if (parsed)
+            found.push(parsed);
+    }
+    return found;
+}
+function parsePnpmDeploy(command) {
+    const tokens = command.split(/\s+/).filter(Boolean);
+    const pnpm = tokens.indexOf('pnpm');
+    if (pnpm === -1)
+        return undefined;
+    const deploy = tokens.indexOf('deploy', pnpm + 1);
+    if (deploy === -1)
+        return undefined;
+    const filter = flagValue(tokens, pnpm, tokens.length, 'filter');
+    const prodTarget = flagValue(tokens, deploy + 1, tokens.length, 'prod');
+    const positional = tokens[deploy + 1];
+    const target = prodTarget ??
+        (tokens.slice(pnpm, deploy).includes('--prod') && positional?.startsWith('/')
+            ? positional
+            : undefined);
+    return filter && target ? { filter, target } : undefined;
+}
+function flagValue(tokens, start, end, name) {
+    const flag = `--${name}`;
+    for (let index = start; index < end; index += 1) {
+        const token = tokens[index];
+        if (token === flag)
+            return tokens[index + 1];
+        if (token?.startsWith(`${flag}=`))
+            return token.slice(flag.length + 1);
+    }
+    return undefined;
+}
+function matchCopyTarget(instructions, copySourcePrefix) {
+    for (const instruction of instructions) {
+        if (!(instruction instanceof Copy))
+            continue;
+        const fromStage = instruction
+            .getFlags()
+            .find((flag) => flag.getName() === 'from')
+            ?.getValue();
+        if (!fromStage)
+            continue;
+        const args = instruction.getArguments();
+        if (args.at(-1)?.getValue() !== './' && args.at(-1)?.getValue() !== '.')
+            continue;
+        const sourcePath = args[0]?.getValue();
+        if (sourcePath?.startsWith(copySourcePrefix))
+            return { fromStage, sourcePath };
+    }
+    return undefined;
+}
+function matchCmdScriptPath(instructions) {
+    const cmds = instructions.filter((instruction) => instruction instanceof Cmd);
+    if (cmds.length === 0)
+        return undefined;
+    const parts = cmds
+        .at(-1)
+        .getJSONStrings()
+        ?.map((argument) => argument.getJSONValue());
+    return parts?.find((part) => CMD_SCRIPT.test(part));
+}
+function findWorkspaceDirByPackageName(monorepoRoot, packageName) {
+    if (packageName.startsWith('.') || packageName.startsWith('/')) {
+        const dir = path.resolve(monorepoRoot, packageName);
+        if (existsSync(path.join(dir, 'package.json')))
+            return dir;
+        throw new Error(`Workspace package not found for filter: ${packageName}`);
+    }
+    const monorepoPackage = JSON.parse(readFileSync(path.join(monorepoRoot, 'package.json'), 'utf8'));
+    const workspaces = Array.isArray(monorepoPackage.workspaces)
+        ? monorepoPackage.workspaces
+        : [];
+    for (const pattern of workspaces) {
+        for (const dir of expandWorkspaceGlob(monorepoRoot, pattern)) {
+            if (matchesPackage(dir, packageName))
+                return dir;
+        }
+    }
+    throw new Error(`Workspace package not found for filter: ${packageName}`);
+}
+function matchesPackage(dir, packageName) {
+    const pkgPath = path.join(dir, 'package.json');
+    if (!existsSync(pkgPath))
+        return false;
+    const { name } = JSON.parse(readFileSync(pkgPath, 'utf8'));
+    return name === packageName;
+}

package/dist/dockerfile-parse/stages.d.mts

@@ -0,0 +1,7 @@
+import { Cmd, Copy, From, Run, type Dockerfile } from 'dockerfile-ast';
+export type StageInstruction = From | Copy | Cmd | Run;
+export interface ParsedStage {
+    stage: string;
+    instructions: StageInstruction[];
+}
+export declare function collectStages(parser: Dockerfile): ParsedStage[];

package/dist/dockerfile-parse/stages.mjs

@@ -0,0 +1,18 @@
+import { Cmd, Copy, From, Run } from 'dockerfile-ast';
+export function collectStages(parser) {
+    const stages = [];
+    let currentStage;
+    for (const instruction of parser.getInstructions()) {
+        if (instruction instanceof From) {
+            const stage = instruction.getBuildStage() ?? String(stages.length);
+            currentStage = { stage, instructions: [instruction] };
+            stages.push(currentStage);
+            continue;
+        }
+        if (currentStage &&
+            (instruction instanceof Copy || instruction instanceof Cmd || instruction instanceof Run)) {
+            currentStage.instructions.push(instruction);
+        }
+    }
+    return stages;
+}