vyft 0.1.0-alpha

package/dist/docker.js

@@ -0,0 +1,855 @@
+import { execSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import path from "node:path";
+import { PassThrough } from "node:stream";
+import { log } from "@clack/prompts";
+import Docker from "dockerode";
+import tar from "tar-fs";
+import { buildStatic } from "./build.js";
+import { logger as defaultLogger } from "./logger.js";
+import { isInterpolation, isReference } from "./resource.js";
+const PROXY_SERVICE_NAME = "vyft-proxy";
+function resolveDockerHost() {
+    if (process.env.DOCKER_HOST)
+        return undefined;
+    try {
+        const host = execSync("docker context inspect --format '{{.Endpoints.docker.Host}}'", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+        if (host && host !== `unix:///var/run/docker.sock`)
+            return host;
+    }
+    catch { }
+    return undefined;
+}
+function secretMount(id, name) {
+    return {
+        SecretID: id,
+        SecretName: name,
+        File: { Name: name, UID: "0", GID: "0", Mode: 0o444 },
+    };
+}
+function parseDuration(duration) {
+    const match = duration.match(/^(\d+)(ms|s|m|h)$/);
+    if (!match || !match[1] || !match[2]) {
+        throw new Error(`Invalid duration format: ${duration}`);
+    }
+    const value = parseInt(match[1], 10);
+    const unit = match[2];
+    const multipliers = {
+        ms: 1_000_000,
+        s: 1_000_000_000,
+        m: 60_000_000_000,
+        h: 3_600_000_000_000,
+    };
+    return value * multipliers[unit];
+}
+function parseMemory(memory) {
+    const match = memory.match(/^(\d+)(B|KB|MB|GB)$/i);
+    if (!match || !match[1] || !match[2]) {
+        throw new Error(`Invalid memory format: ${memory}`);
+    }
+    const value = parseInt(match[1], 10);
+    const unit = match[2].toUpperCase();
+    const multipliers = {
+        B: 1,
+        KB: 1024,
+        MB: 1024 * 1024,
+        GB: 1024 * 1024 * 1024,
+    };
+    return value * multipliers[unit];
+}
+export function parseRoute(route) {
+    const slashIndex = route.indexOf("/");
+    if (slashIndex === -1) {
+        return { host: route };
+    }
+    return {
+        host: route.slice(0, slashIndex),
+        path: route.slice(slashIndex),
+    };
+}
+export function buildCaddyRoute(project, resourceId, route, handler) {
+    const { host, path } = parseRoute(route);
+    const match = { host: [host] };
+    if (path)
+        match.path = [path];
+    return {
+        "@id": `vyft-${project}-${resourceId}`,
+        match: [match],
+        terminal: true,
+        handle: [handler],
+    };
+}
+export class DockerClient {
+    docker;
+    project;
+    secretValues = new Map();
+    log;
+    verbose = false;
+    constructor(project, parentLogger) {
+        const contextHost = resolveDockerHost();
+        if (contextHost)
+            process.env.DOCKER_HOST = contextHost;
+        this.docker = new Docker();
+        this.project = project;
+        this.log = (parentLogger ?? defaultLogger).child({
+            component: "docker",
+            project,
+        });
+        if (contextHost)
+            this.log.debug({ host: contextHost }, "using docker context endpoint");
+    }
+    async ensureInfrastructure() {
+        const start = performance.now();
+        this.log.debug("checking proxy existence");
+        const exists = await this.serviceExists(PROXY_SERVICE_NAME);
+        if (exists) {
+            this.log.debug("proxy already exists");
+            return;
+        }
+        // Create network for services to communicate
+        const networks = await this.docker.listNetworks({
+            filters: JSON.stringify({ name: ["vyft-network"] }),
+        });
+        if (networks.length === 0) {
+            this.log.debug("creating network");
+            await this.docker.createNetwork({
+                Name: "vyft-network",
+                Driver: "overlay",
+                Attachable: true,
+                Labels: { "vyft.infrastructure": "true" },
+            });
+        }
+        this.log.debug("creating proxy service");
+        await this.docker.createService({
+            Name: PROXY_SERVICE_NAME,
+            Labels: { "vyft.infrastructure": "true" },
+            TaskTemplate: {
+                ContainerSpec: {
+                    Image: "caddy:latest",
+                    Command: ["caddy", "run", "--resume"],
+                    Mounts: [
+                        {
+                            Type: "volume",
+                            Source: "vyft-proxy-config",
+                            Target: "/config",
+                        },
+                        {
+                            Type: "volume",
+                            Source: "vyft-proxy-data",
+                            Target: "/data",
+                        },
+                    ],
+                    Labels: { "vyft.infrastructure": "true" },
+                },
+                Networks: [{ Target: "vyft-network" }],
+            },
+            EndpointSpec: {
+                Ports: [
+                    {
+                        Protocol: "tcp",
+                        TargetPort: 80,
+                        PublishedPort: 80,
+                        PublishMode: "ingress",
+                    },
+                    {
+                        Protocol: "tcp",
+                        TargetPort: 443,
+                        PublishedPort: 443,
+                        PublishMode: "ingress",
+                    },
+                ],
+            },
+            Mode: { Replicated: { Replicas: 1 } },
+        });
+        log.step("Created vyft-proxy");
+        await this.seedCaddyConfig();
+        const durationMs = Math.round(performance.now() - start);
+        this.log.info({ proxyCreated: true, durationMs }, "infrastructure ready");
+    }
+    async findProxyContainer() {
+        const containers = await this.docker.listContainers({
+            filters: JSON.stringify({
+                label: [`com.docker.swarm.service.name=${PROXY_SERVICE_NAME}`],
+            }),
+        });
+        if (containers.length === 0) {
+            throw new Error("vyft-proxy container not found");
+        }
+        return this.docker.getContainer(containers[0].Id);
+    }
+    async caddyApiRequest(method, path, body) {
+        const start = performance.now();
+        this.log.debug({ method, path }, "caddy request started");
+        const container = await this.findProxyContainer();
+        let cmd;
+        if (method === "POST") {
+            const bodyStr = body ? JSON.stringify(body) : "";
+            cmd = [
+                "wget",
+                "-q",
+                "-O",
+                "-",
+                "--timeout=10",
+                "--header=Content-Type: application/json",
+                `--post-data=${bodyStr}`,
+                `http://127.0.0.1:2019${path}`,
+            ];
+        }
+        else if (method === "DELETE") {
+            cmd = [
+                "curl",
+                "-s",
+                "--connect-timeout",
+                "5",
+                "--max-time",
+                "10",
+                "-X",
+                "DELETE",
+                `http://127.0.0.1:2019${path}`,
+            ];
+        }
+        else {
+            cmd = [
+                "wget",
+                "-q",
+                "-O",
+                "-",
+                "--timeout=10",
+                `http://127.0.0.1:2019${path}`,
+            ];
+        }
+        this.log.trace({ cmd }, "caddy exec command");
+        const exec = await container.exec({
+            Cmd: cmd,
+            AttachStdout: true,
+            AttachStderr: true,
+        });
+        const stream = await exec.start({});
+        return new Promise((resolve, reject) => {
+            const stdout = [];
+            const stderr = [];
+            const stdoutStream = new PassThrough();
+            const stderrStream = new PassThrough();
+            stdoutStream.on("data", (chunk) => stdout.push(chunk));
+            stderrStream.on("data", (chunk) => stderr.push(chunk));
+            this.docker.modem.demuxStream(stream, stdoutStream, stderrStream);
+            stream.on("end", () => {
+                const output = Buffer.concat(stdout).toString();
+                const errOutput = Buffer.concat(stderr).toString();
+                const durationMs = Math.round(performance.now() - start);
+                this.log.trace({ stdoutBytes: output.length, stderrBytes: errOutput.length }, "caddy exec output");
+                if (errOutput) {
+                    this.log.debug({ method, path, durationMs, stderr: errOutput }, "caddy request failed");
+                    reject(new Error(`Caddy API ${method} ${path} failed: ${errOutput}`));
+                }
+                else {
+                    this.log.debug({ method, path, durationMs }, "caddy request completed");
+                    resolve(output);
+                }
+            });
+        });
+    }
+    async seedCaddyConfig() {
+        const maxWait = 30000;
+        const interval = 2000;
+        let waited = 0;
+        this.log.debug("waiting for proxy container");
+        while (waited < maxWait) {
+            try {
+                await this.findProxyContainer();
+                break;
+            }
+            catch (err) {
+                this.log.debug({ err, waited, maxWait }, "proxy container not ready");
+                await new Promise((r) => setTimeout(r, interval));
+                waited += interval;
+            }
+        }
+        const baseConfig = {
+            apps: {
+                http: {
+                    servers: {
+                        main: {
+                            listen: [":443", ":80"],
+                            routes: [],
+                        },
+                    },
+                },
+            },
+        };
+        const maxAttempts = 5;
+        for (let attempt = 0; attempt < maxAttempts; attempt++) {
+            try {
+                this.log.debug({ attempt: attempt + 1, max: maxAttempts }, "seeding caddy config");
+                await this.caddyApiRequest("POST", "/load", baseConfig);
+                this.log.debug("caddy config seeded");
+                return;
+            }
+            catch (err) {
+                this.log.debug({ err, attempt: attempt + 1, max: maxAttempts }, "seed attempt failed");
+                if (attempt >= Math.floor(maxAttempts * 0.8)) {
+                    this.log.warn({ attempt: attempt + 1, max: maxAttempts }, "seed retry nearing limit");
+                }
+                await new Promise((r) => setTimeout(r, 2000));
+            }
+        }
+        this.log.error("caddy config seed exhausted retries");
+        throw new Error("Failed to seed Caddy config after retries");
+    }
+    async addRoute(resourceId, route, handler) {
+        this.log.debug({ resourceId, route }, "adding route");
+        const caddyRoute = buildCaddyRoute(this.project, resourceId, route, handler);
+        // Delete existing route for idempotency
+        try {
+            await this.caddyApiRequest("DELETE", `/id/vyft-${this.project}-${resourceId}`);
+        }
+        catch (err) {
+            this.log.debug({ err, resourceId }, "idempotent route delete failed");
+        }
+        const maxAttempts = 5;
+        for (let attempt = 0; attempt < maxAttempts; attempt++) {
+            try {
+                await this.caddyApiRequest("POST", "/config/apps/http/servers/main/routes", caddyRoute);
+                this.log.debug({ resourceId, route }, "route added");
+                return;
+            }
+            catch (err) {
+                this.log.debug({ err, resourceId, attempt: attempt + 1, max: maxAttempts }, "route add attempt failed");
+                if (attempt === maxAttempts - 1) {
+                    this.log.error({ resourceId, route }, "route add exhausted retries");
+                    throw new Error(`Failed to add route for ${resourceId}`);
+                }
+                await new Promise((r) => setTimeout(r, 2000));
+            }
+        }
+    }
+    async removeRoute(resourceId) {
+        this.log.debug({ resourceId }, "removing route");
+        try {
+            await this.caddyApiRequest("DELETE", `/id/vyft-${this.project}-${resourceId}`);
+            this.log.debug({ resourceId }, "route removed");
+        }
+        catch (err) {
+            this.log.debug({ err, resourceId }, "route removal failed (may not exist)");
+        }
+    }
+    async listManagedResources() {
+        const resources = [];
+        const [services, volumes, secrets] = await Promise.all([
+            this.docker.listServices({
+                filters: JSON.stringify({
+                    label: ["vyft.managed=true", `vyft.project=${this.project}`],
+                }),
+            }),
+            this.docker.listVolumes({
+                filters: JSON.stringify({
+                    label: ["vyft.managed=true", `vyft.project=${this.project}`],
+                }),
+            }),
+            this.docker.listSecrets({
+                filters: JSON.stringify({
+                    label: ["vyft.managed=true", `vyft.project=${this.project}`],
+                }),
+            }),
+        ]);
+        for (const svc of services) {
+            const labels = svc.Spec?.Labels || {};
+            resources.push({
+                id: svc.Spec?.Name || "",
+                type: labels["vyft.type"] || "service",
+                route: labels["vyft.route"],
+            });
+        }
+        for (const vol of volumes.Volumes || []) {
+            if (vol.Labels?.["vyft.static"])
+                continue;
+            resources.push({
+                id: vol.Name,
+                type: "volume",
+            });
+        }
+        for (const secret of secrets) {
+            const secretLabels = secret.Spec?.Labels || {};
+            resources.push({
+                id: secret.Spec?.Name || "",
+                type: "secret",
+                derived: secretLabels["vyft.derived"] === "true",
+                parentService: secretLabels["vyft.parent-service"],
+            });
+        }
+        return resources;
+    }
+    async create(resource) {
+        switch (resource.type) {
+            case "volume":
+                return this.createVolume(resource);
+            case "secret":
+                return this.createSecret(resource);
+            case "service":
+                return this.createService(resource);
+            case "site":
+                return this.createStatic(resource);
+        }
+    }
+    async exists(resource) {
+        switch (resource.type) {
+            case "volume":
+                return this.volumeExists(resource.id);
+            case "secret":
+                return this.secretExists(resource.id);
+            case "service":
+            case "site":
+                return this.serviceExists(resource.id);
+        }
+    }
+    async remove(resource) {
+        switch (resource.type) {
+            case "volume":
+                return this.removeVolume(resource.id);
+            case "secret":
+                return this.removeSecret(resource.id);
+            case "service":
+                return this.removeService(resource.id);
+            case "site":
+                return this.removeStatic(resource.id);
+        }
+    }
+    async createVolume(volume) {
+        const start = performance.now();
+        this.log.debug({ volumeName: volume.id }, "creating volume");
+        const config = volume.config;
+        const labels = {
+            "vyft.managed": "true",
+            "vyft.project": this.project,
+            "vyft.type": "volume",
+        };
+        if (config.size) {
+            labels["vyft.size"] = config.size;
+        }
+        await this.docker.createVolume({
+            Name: volume.id,
+            Labels: labels,
+        });
+        const durationMs = Math.round(performance.now() - start);
+        this.log.debug({ volumeName: volume.id, durationMs }, "volume created");
+        log.step(`Created ${volume.id}`);
+    }
+    async volumeExists(id) {
+        const start = performance.now();
+        try {
+            await this.docker.getVolume(id).inspect();
+            const durationMs = Math.round(performance.now() - start);
+            this.log.debug({ volumeName: id, exists: true, durationMs }, "volume exists check");
+            return true;
+        }
+        catch (err) {
+            const durationMs = Math.round(performance.now() - start);
+            this.log.debug({ err, volumeName: id, exists: false, durationMs }, "volume exists check");
+            return false;
+        }
+    }
+    async removeVolume(id) {
+        const start = performance.now();
+        this.log.debug({ volumeName: id }, "removing volume");
+        await this.docker.getVolume(id).remove();
+        const durationMs = Math.round(performance.now() - start);
+        this.log.debug({ volumeName: id, durationMs }, "volume removed");
+        log.step(`Removed ${id}`);
+    }
+    async createSecret(secret) {
+        const start = performance.now();
+        const length = secret.config.length || 32;
+        this.log.debug({ secretName: secret.id, length }, "creating secret");
+        const value = randomBytes(length).toString("base64url");
+        this.secretValues.set(secret.id, value);
+        await this.storeSecretData(secret.id, value, {
+            "vyft.length": length.toString(),
+        });
+        const durationMs = Math.round(performance.now() - start);
+        this.log.debug({ secretName: secret.id, length, durationMs }, "secret created");
+        log.step(`Created ${secret.id}`);
+    }
+    async secretExists(id) {
+        const start = performance.now();
+        try {
+            await this.docker.getSecret(id).inspect();
+            const durationMs = Math.round(performance.now() - start);
+            this.log.debug({ secretName: id, exists: true, durationMs }, "secret exists check");
+            return true;
+        }
+        catch (err) {
+            const durationMs = Math.round(performance.now() - start);
+            this.log.debug({ err, secretName: id, exists: false, durationMs }, "secret exists check");
+            return false;
+        }
+    }
+    async removeSecret(id) {
+        const start = performance.now();
+        this.log.debug({ secretName: id }, "removing secret");
+        await this.docker.getSecret(id).remove();
+        const durationMs = Math.round(performance.now() - start);
+        this.log.debug({ secretName: id, durationMs }, "secret removed");
+        log.step(`Removed ${id}`);
+    }
+    async storeSecretData(name, value, labels = {}) {
+        this.log.debug({ secretName: name }, "storing secret data");
+        await this.docker.createSecret({
+            Name: name,
+            Data: Buffer.from(value).toString("base64"),
+            Labels: {
+                "vyft.managed": "true",
+                "vyft.project": this.project,
+                "vyft.type": "secret",
+                ...labels,
+            },
+        });
+    }
+    async lookupSecretId(name) {
+        this.log.debug({ secretName: name }, "looking up secret id");
+        const secret = await this.docker.getSecret(name).inspect();
+        return secret.ID;
+    }
+    async createDerivedSecret(name, value, parentService) {
+        this.log.debug({ secretName: name, parentService }, "creating derived secret");
+        await this.storeSecretData(name, value, {
+            "vyft.derived": "true",
+            "vyft.parent-service": parentService,
+        });
+        log.step(`Created ${name}`);
+    }
+    async resolveEnv(serviceId, env) {
+        const envList = [];
+        const secrets = [];
+        for (const [key, value] of Object.entries(env)) {
+            if (typeof value === "string") {
+                envList.push(`${key}=${value}`);
+            }
+            else if (isReference(value)) {
+                const secretId = await this.lookupSecretId(value.id);
+                secrets.push(secretMount(secretId, value.id));
+                const envKey = key.endsWith("_FILE") ? key : `${key}_FILE`;
+                envList.push(`${envKey}=/run/secrets/${value.id}`);
+            }
+            else if (isInterpolation(value)) {
+                const parts = [];
+                for (let i = 0; i < value.strings.length; i++) {
+                    parts.push(value.strings[i]);
+                    if (i < value.values.length) {
+                        const v = value.values[i];
+                        if (isReference(v)) {
+                            const secretValue = this.secretValues.get(v.id);
+                            if (secretValue === undefined) {
+                                throw new Error(`Secret "${v.id}" value not available — it must be created in the same deploy session`);
+                            }
+                            parts.push(secretValue);
+                        }
+                        else {
+                            parts.push(v);
+                        }
+                    }
+                }
+                const derivedName = `${serviceId}-${key.toLowerCase().replace(/_/g, "-")}`;
+                await this.createDerivedSecret(derivedName, parts.join(""), serviceId);
+                const derivedId = await this.lookupSecretId(derivedName);
+                secrets.push(secretMount(derivedId, derivedName));
+                const envKey = key.endsWith("_FILE") ? key : `${key}_FILE`;
+                envList.push(`${envKey}=/run/secrets/${derivedName}`);
+            }
+        }
+        this.log.debug({ serviceId, envCount: envList.length, secretMountCount: secrets.length }, "env resolved");
+        return { envList, secrets };
+    }
+    async createService(service) {
+        const start = performance.now();
+        const config = service.config;
+        let imageName;
+        if (typeof config.image === "object") {
+            const { context = ".", dockerfile = "Dockerfile" } = config.image;
+            imageName = `${service.id}:latest`;
+            this.log.debug({ resourceId: service.id, context, dockerfile }, "image build started");
+            const buildStart = performance.now();
+            const tarStream = tar.pack(path.resolve(context));
+            const stream = await this.docker.buildImage(tarStream, {
+                t: imageName,
+                dockerfile,
+            });
+            await new Promise((resolve, reject) => {
+                this.docker.modem.followProgress(stream, (err) => (err ? reject(err) : resolve()), (event) => {
+                    if (event.error)
+                        log.error(event.error);
+                    else if (this.verbose && event.stream)
+                        process.stdout.write(event.stream);
+                    this.log.trace({ event }, "build progress");
+                });
+            });
+            const buildDurationMs = Math.round(performance.now() - buildStart);
+            this.log.debug({
+                resourceId: service.id,
+                image: imageName,
+                durationMs: buildDurationMs,
+            }, "image build completed");
+            const images = await this.docker.listImages({
+                filters: JSON.stringify({ reference: [imageName] }),
+            });
+            if (images.length === 0) {
+                throw new Error(`Image ${imageName} was not built successfully`);
+            }
+        }
+        else {
+            imageName = config.image;
+        }
+        // Build labels for service and container
+        const serviceLabels = {
+            "vyft.managed": "true",
+            "vyft.project": this.project,
+            "vyft.type": "service",
+        };
+        const containerLabels = {
+            "vyft.managed": "true",
+            "vyft.project": this.project,
+        };
+        if (config.route) {
+            serviceLabels["vyft.route"] = config.route;
+        }
+        const resolved = config.env
+            ? await this.resolveEnv(service.id, config.env)
+            : undefined;
+        const containerSpec = {
+            Image: imageName,
+            Labels: containerLabels,
+            Command: config.command,
+            Env: resolved?.envList,
+            Mounts: config.volumes?.map(({ volume, mount }) => ({
+                Type: "volume",
+                Source: volume.id,
+                Target: mount,
+            })),
+            Secrets: resolved?.secrets.length ? resolved.secrets : undefined,
+        };
+        if (config.healthCheck) {
+            containerSpec.HealthCheck = {
+                Test: ["CMD", ...config.healthCheck.command],
+                Interval: config.healthCheck.interval
+                    ? parseDuration(config.healthCheck.interval)
+                    : undefined,
+                Timeout: config.healthCheck.timeout
+                    ? parseDuration(config.healthCheck.timeout)
+                    : undefined,
+                Retries: config.healthCheck.retries,
+                StartPeriod: config.healthCheck.startPeriod
+                    ? parseDuration(config.healthCheck.startPeriod)
+                    : undefined,
+            };
+        }
+        const taskTemplate = {
+            ContainerSpec: containerSpec,
+            Networks: config.route ? [{ Target: "vyft-network" }] : undefined,
+        };
+        if (config.resources) {
+            taskTemplate.Resources = {
+                Limits: {
+                    MemoryBytes: config.resources.memory
+                        ? parseMemory(config.resources.memory)
+                        : undefined,
+                    NanoCPUs: config.resources.cpus
+                        ? config.resources.cpus * 1e9
+                        : undefined,
+                },
+            };
+        }
+        if (config.restartPolicy) {
+            const conditionMap = {
+                none: "none",
+                "on-failure": "on-failure",
+                any: "any",
+            };
+            taskTemplate.RestartPolicy = {
+                Condition: conditionMap[config.restartPolicy],
+            };
+        }
+        const serviceSpec = {
+            Name: service.id,
+            Labels: serviceLabels,
+            TaskTemplate: taskTemplate,
+            Mode: { Replicated: { Replicas: config.replicas ?? 1 } },
+            // Only publish ports directly if no route (internal service or direct access)
+            EndpointSpec: !config.route && config.port
+                ? {
+                    Ports: [
+                        {
+                            Protocol: "tcp",
+                            TargetPort: config.port,
+                            PublishedPort: config.port,
+                            PublishMode: "ingress",
+                        },
+                    ],
+                }
+                : undefined,
+        };
+        this.log.trace({ serviceSpec }, "docker create service spec");
+        this.log.debug({ resourceId: service.id }, "docker.createService called");
+        await this.docker.createService(serviceSpec);
+        if (config.route) {
+            const port = config.port || 3000;
+            await this.addRoute(service.id, config.route, {
+                handler: "reverse_proxy",
+                upstreams: [{ dial: `${service.id}:${port}` }],
+            });
+        }
+        const durationMs = Math.round(performance.now() - start);
+        this.log.info({
+            resourceId: service.id,
+            image: imageName,
+            hasRoute: !!config.route,
+            durationMs,
+        }, "service created");
+        log.step(`Created ${service.id}`);
+    }
+    async serviceExists(id) {
+        try {
+            await this.docker.getService(id).inspect();
+            return true;
+        }
+        catch (err) {
+            this.log.debug({ err, resourceId: id }, "service does not exist");
+            return false;
+        }
+    }
+    async removeService(id) {
+        const start = performance.now();
+        this.log.debug({ resourceId: id }, "removing service");
+        await this.removeRoute(id);
+        await this.docker.getService(id).remove();
+        const maxWait = 60000;
+        const interval = 2000;
+        let waited = 0;
+        this.log.debug({ resourceId: id, maxWait }, "container cleanup polling started");
+        while (waited < maxWait) {
+            const containers = await this.docker.listContainers({
+                all: true,
+                filters: JSON.stringify({
+                    label: [`com.docker.swarm.service.name=${id}`],
+                }),
+            });
+            if (containers.length === 0)
+                break;
+            if (waited >= maxWait * 0.8) {
+                this.log.warn({ resourceId: id, waited, maxWait, remaining: containers.length }, "cleanup polling nearing timeout");
+            }
+            await new Promise((r) => setTimeout(r, interval));
+            waited += interval;
+        }
+        const durationMs = Math.round(performance.now() - start);
+        this.log.info({ resourceId: id, durationMs }, "service removed");
+        log.step(`Removed ${id}`);
+    }
+    async createStatic(static_) {
+        const start = performance.now();
+        this.log.debug({ resourceId: static_.id, route: static_.config.route }, "creating static site");
+        this.log.debug({ resourceId: static_.id }, "static build starting");
+        const { outputPath } = await buildStatic(static_.config.build.cwd, {
+            output: static_.config.build.output,
+            command: static_.config.build.command,
+            env: static_.config.build.env,
+        }, this.log);
+        const volumeName = `${static_.id}-files`;
+        this.log.debug({ volumeName }, "creating static volume");
+        await this.docker.createVolume({
+            Name: volumeName,
+            Labels: {
+                "vyft.managed": "true",
+                "vyft.project": this.project,
+                "vyft.type": "volume",
+                "vyft.static": static_.id,
+            },
+        });
+        this.log.debug({ resourceId: static_.id, outputPath }, "tar copy started");
+        const tarStream = tar.pack(outputPath);
+        const container = await this.docker.createContainer({
+            Image: "alpine:latest",
+            Cmd: ["sleep", "3600"],
+            HostConfig: {
+                Mounts: [{ Type: "volume", Source: volumeName, Target: "/data" }],
+            },
+        });
+        await container.start();
+        await container.putArchive(tarStream, { path: "/data" });
+        await container.remove({ force: true });
+        this.log.debug({ resourceId: static_.id }, "tar copy completed");
+        const serviceLabels = {
+            "vyft.managed": "true",
+            "vyft.project": this.project,
+            "vyft.type": "site",
+            "vyft.route": static_.config.route,
+        };
+        const containerLabels = {
+            "vyft.managed": "true",
+            "vyft.project": this.project,
+        };
+        const command = static_.config.spa
+            ? [
+                "sh",
+                "-c",
+                "printf ':80 {\\nroot * /srv\\ntry_files {path} /index.html\\nfile_server\\n}\\n' > /etc/caddy/Caddyfile && caddy run --config /etc/caddy/Caddyfile --adapter caddyfile",
+            ]
+            : ["caddy", "file-server", "--root", "/srv", "--listen", ":80"];
+        this.log.debug({ resourceId: static_.id }, "creating caddy service for static site");
+        await this.docker.createService({
+            Name: static_.id,
+            Labels: serviceLabels,
+            TaskTemplate: {
+                ContainerSpec: {
+                    Image: "caddy:latest",
+                    Command: command,
+                    Mounts: [{ Type: "volume", Source: volumeName, Target: "/srv" }],
+                    Labels: containerLabels,
+                },
+                Networks: [{ Target: "vyft-network" }],
+            },
+            Mode: { Replicated: { Replicas: 1 } },
+        });
+        await this.addRoute(static_.id, static_.config.route, {
+            handler: "reverse_proxy",
+            upstreams: [{ dial: `${static_.id}:80` }],
+        });
+        const durationMs = Math.round(performance.now() - start);
+        this.log.info({ resourceId: static_.id, route: static_.config.route, durationMs }, "site created");
+        log.step(`Created ${static_.id}`);
+    }
+    async removeStatic(id) {
+        const start = performance.now();
+        this.log.debug({ resourceId: id }, "removing static site");
+        await this.removeRoute(id);
+        await this.docker.getService(id).remove();
+        const maxWait = 30000;
+        const interval = 2000;
+        let waited = 0;
+        this.log.debug({ resourceId: id, maxWait }, "static cleanup polling started");
+        while (waited < maxWait) {
+            const containers = await this.docker.listContainers({
+                all: true,
+                filters: JSON.stringify({
+                    label: [`com.docker.swarm.service.name=${id}`],
+                }),
+            });
+            if (containers.length === 0)
+                break;
+            if (waited >= maxWait * 0.8) {
+                this.log.warn({ resourceId: id, waited, maxWait, remaining: containers.length }, "cleanup polling nearing timeout");
+            }
+            await new Promise((r) => setTimeout(r, interval));
+            waited += interval;
+        }
+        const volumeName = `${id}-files`;
+        try {
+            this.log.debug({ volumeName }, "removing static volume");
+            await this.docker.getVolume(volumeName).remove();
+        }
+        catch (err) {
+            this.log.debug({ err, volumeName }, "static volume removal failed (may not exist)");
+        }
+        const durationMs = Math.round(performance.now() - start);
+        this.log.info({ resourceId: id, durationMs }, "site removed");
+        log.step(`Removed ${id}`);
+    }
+}