vyft 0.2.0-alpha → 0.4.0-alpha

package/dist/docker.js

@@ -1,25 +1,14 @@
-import { execSync } from "node:child_process";
 import { randomBytes } from "node:crypto";
+import http from "node:http";
 import path from "node:path";
 import { PassThrough } from "node:stream";
-import { log } from "@clack/prompts";
 import Docker from "dockerode";
+import { Client as SshClient } from "ssh2";
 import tar from "tar-fs";
 import { buildStatic } from "./build.js";
 import { logger as defaultLogger } from "./logger.js";
 import { isInterpolation, isReference } from "./resource.js";
-const PROXY_SERVICE_NAME = "vyft-proxy";
-function resolveDockerHost() {
-    if (process.env.DOCKER_HOST)
-        return undefined;
-    try {
-        const host = execSync("docker context inspect --format '{{.Endpoints.docker.Host}}'", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
-        if (host && host !== `unix:///var/run/docker.sock`)
-            return host;
-    }
-    catch { }
-    return undefined;
-}
+import { CaddyProxy } from "./swarm/proxy.js";
 function secretMount(id, name) {
     return {
         SecretID: id,
@@ -67,40 +56,88 @@ export function parseRoute(route) {
         path: route.slice(slashIndex),
     };
 }
-export function buildCaddyRoute(resourceId, route, handler) {
-    const { host, path } = parseRoute(route);
-    const match = { host: [host] };
-    if (path)
-        match.path = [path];
+/**
+ * Create a Docker client that reuses a single SSH connection instead of
+ * opening a new one for every API call (the docker-modem default).
+ */
+function createSshDocker(sshUrl) {
+    const parsed = new URL(sshUrl);
+    const conn = new SshClient();
+    let connected = false;
+    const ready = new Promise((resolve, reject) => {
+        conn.once("ready", () => {
+            connected = true;
+            resolve();
+        });
+        conn.once("error", reject);
+        conn.connect({
+            host: parsed.hostname,
+            port: parsed.port ? parseInt(parsed.port, 10) : 22,
+            username: parsed.username || undefined,
+            agent: process.env.SSH_AUTH_SOCK,
+        });
+    });
+    const agent = new http.Agent({ keepAlive: false });
+    // biome-ignore lint/suspicious/noExplicitAny: monkey-patching internal Agent method for SSH tunneling
+    agent.createConnection = (_opts, fn) => {
+        const exec = () => conn.exec("docker system dial-stdio", (err, stream) => {
+            if (err)
+                return fn(err);
+            fn(null, stream);
+        });
+        if (connected)
+            exec();
+        else
+            ready.then(exec).catch((err) => fn(err));
+    };
     return {
-        "@id": `vyft-${resourceId}`,
-        match: [match],
-        terminal: true,
-        handle: [handler],
+        docker: new Docker({
+            protocol: "http",
+            host: parsed.hostname,
+            agent,
+            // biome-ignore lint/suspicious/noExplicitAny: dockerode typing doesn't expose agent option
+        }),
+        sshClient: conn,
     };
 }
 export class DockerClient {
     docker;
     localDocker;
     isRemote;
+    sshClient = null;
     project;
     secretValues = new Map();
+    builtImages = new Map();
     log;
+    proxy;
     verbose = false;
-    constructor(project, parentLogger) {
+    constructor(project, opts) {
         this.localDocker = new Docker({ socketPath: "/var/run/docker.sock" });
-        const contextHost = resolveDockerHost();
-        if (contextHost)
-            process.env.DOCKER_HOST = contextHost;
-        this.docker = new Docker();
-        this.isRemote = !!(contextHost || process.env.DOCKER_HOST);
+        const host = opts?.host;
+        if (host?.startsWith("ssh://")) {
+            const { docker, sshClient } = createSshDocker(host);
+            this.docker = docker;
+            this.sshClient = sshClient;
+        }
+        else {
+            if (host)
+                process.env.DOCKER_HOST = host;
+            this.docker = new Docker();
+        }
+        this.isRemote = !!host;
         this.project = project;
-        this.log = (parentLogger ?? defaultLogger).child({
+        this.log = (opts?.parentLogger ?? defaultLogger).child({
             component: "docker",
             project,
         });
-        if (contextHost)
-            this.log.debug({ host: contextHost }, "using docker context endpoint");
+        this.proxy = new CaddyProxy(this.docker, this.log);
+        if (host)
+            this.log.debug({ host }, "using remote endpoint");
+    }
+    /** Close the SSH connection (if any), allowing the process to exit. */
+    destroy() {
+        this.sshClient?.end();
+        this.sshClient = null;
     }
     async ensureNetwork(name, labels = {}) {
         const networks = await this.docker.listNetworks({
@@ -125,247 +162,9 @@ export class DockerClient {
             "vyft.managed": "true",
             "vyft.project": this.project,
         });
-        this.log.debug("checking proxy existence");
-        const exists = await this.serviceExists(PROXY_SERVICE_NAME);
-        if (exists) {
-            this.log.debug("proxy already exists, verifying config structure");
-            try {
-                const raw = await this.caddyApiRequest("GET", "/config/");
-                const config = JSON.parse(raw);
-                if (!config?.apps?.http?.servers?.main) {
-                    this.log.debug("proxy config missing servers.main, re-seeding");
-                    await this.seedCaddyConfig();
-                }
-            }
-            catch {
-                this.log.debug("proxy config check failed, re-seeding");
-                await this.seedCaddyConfig();
-            }
-            return;
-        }
-        // Create shared proxy network
-        await this.ensureNetwork("vyft-network", { "vyft.infrastructure": "true" });
-        this.log.debug("creating proxy service");
-        await this.docker.createService({
-            Name: PROXY_SERVICE_NAME,
-            Labels: { "vyft.infrastructure": "true" },
-            TaskTemplate: {
-                ContainerSpec: {
-                    Image: "caddy:latest",
-                    Command: ["caddy", "run", "--resume"],
-                    Mounts: [
-                        {
-                            Type: "volume",
-                            Source: "vyft-proxy-config",
-                            Target: "/config",
-                        },
-                        {
-                            Type: "volume",
-                            Source: "vyft-proxy-data",
-                            Target: "/data",
-                        },
-                    ],
-                    Labels: { "vyft.infrastructure": "true" },
-                },
-                Networks: [{ Target: "vyft-network" }],
-            },
-            EndpointSpec: {
-                Ports: [
-                    {
-                        Protocol: "tcp",
-                        TargetPort: 80,
-                        PublishedPort: 80,
-                        PublishMode: "ingress",
-                    },
-                    {
-                        Protocol: "tcp",
-                        TargetPort: 443,
-                        PublishedPort: 443,
-                        PublishMode: "ingress",
-                    },
-                ],
-            },
-            Mode: { Replicated: { Replicas: 1 } },
-        });
-        log.step("Created vyft-proxy");
-        await this.seedCaddyConfig();
+        await this.proxy.ensure();
         const durationMs = Math.round(performance.now() - start);
-        this.log.info({ proxyCreated: true, durationMs }, "infrastructure ready");
-    }
-    async findProxyContainer() {
-        const containers = await this.docker.listContainers({
-            filters: JSON.stringify({
-                label: [`com.docker.swarm.service.name=${PROXY_SERVICE_NAME}`],
-            }),
-        });
-        if (containers.length === 0) {
-            throw new Error("vyft-proxy container not found");
-        }
-        return this.docker.getContainer(containers[0].Id);
-    }
-    async caddyApiRequest(method, path, body) {
-        const start = performance.now();
-        this.log.debug({ method, path }, "caddy request started");
-        const container = await this.findProxyContainer();
-        let cmd;
-        if (method === "POST") {
-            const bodyStr = body ? JSON.stringify(body) : "";
-            cmd = [
-                "wget",
-                "-q",
-                "-O",
-                "-",
-                "--timeout=10",
-                "--header=Content-Type: application/json",
-                `--post-data=${bodyStr}`,
-                `http://127.0.0.1:2019${path}`,
-            ];
-        }
-        else if (method === "DELETE") {
-            cmd = [
-                "curl",
-                "-s",
-                "--connect-timeout",
-                "5",
-                "--max-time",
-                "10",
-                "-X",
-                "DELETE",
-                `http://127.0.0.1:2019${path}`,
-            ];
-        }
-        else {
-            cmd = [
-                "wget",
-                "-q",
-                "-O",
-                "-",
-                "--timeout=10",
-                `http://127.0.0.1:2019${path}`,
-            ];
-        }
-        this.log.trace({ cmd }, "caddy exec command");
-        const exec = await container.exec({
-            Cmd: cmd,
-            AttachStdout: true,
-            AttachStderr: true,
-        });
-        const stream = await exec.start({});
-        return new Promise((resolve, reject) => {
-            const stdout = [];
-            const stderr = [];
-            const stdoutStream = new PassThrough();
-            const stderrStream = new PassThrough();
-            stdoutStream.on("data", (chunk) => stdout.push(chunk));
-            stderrStream.on("data", (chunk) => stderr.push(chunk));
-            this.docker.modem.demuxStream(stream, stdoutStream, stderrStream);
-            stream.on("end", () => {
-                const output = Buffer.concat(stdout).toString();
-                const errOutput = Buffer.concat(stderr).toString();
-                const durationMs = Math.round(performance.now() - start);
-                this.log.trace({ stdoutBytes: output.length, stderrBytes: errOutput.length }, "caddy exec output");
-                if (errOutput) {
-                    this.log.debug({ method, path, durationMs, stderr: errOutput }, "caddy request failed");
-                    reject(new Error(`Caddy API ${method} ${path} failed: ${errOutput}`));
-                }
-                else {
-                    this.log.debug({ method, path, durationMs }, "caddy request completed");
-                    resolve(output);
-                }
-            });
-        });
-    }
-    async seedCaddyConfig() {
-        const maxWait = 30000;
-        const interval = 2000;
-        let waited = 0;
-        this.log.debug("waiting for proxy container");
-        while (waited < maxWait) {
-            try {
-                await this.findProxyContainer();
-                break;
-            }
-            catch (err) {
-                this.log.debug({ err, waited, maxWait }, "proxy container not ready");
-                await new Promise((r) => setTimeout(r, interval));
-                waited += interval;
-            }
-        }
-        const baseConfig = {
-            logging: {
-                logs: {
-                    default: {
-                        level: "INFO",
-                    },
-                },
-            },
-            apps: {
-                http: {
-                    servers: {
-                        main: {
-                            listen: [":443", ":80"],
-                            routes: [],
-                            logs: {},
-                        },
-                    },
-                },
-            },
-        };
-        const maxAttempts = 5;
-        for (let attempt = 0; attempt < maxAttempts; attempt++) {
-            try {
-                this.log.debug({ attempt: attempt + 1, max: maxAttempts }, "seeding caddy config");
-                await this.caddyApiRequest("POST", "/load", baseConfig);
-                this.log.debug("caddy config seeded");
-                return;
-            }
-            catch (err) {
-                this.log.debug({ err, attempt: attempt + 1, max: maxAttempts }, "seed attempt failed");
-                if (attempt >= Math.floor(maxAttempts * 0.8)) {
-                    this.log.warn({ attempt: attempt + 1, max: maxAttempts }, "seed retry nearing limit");
-                }
-                await new Promise((r) => setTimeout(r, 2000));
-            }
-        }
-        this.log.error("caddy config seed exhausted retries");
-        throw new Error("Failed to seed Caddy config after retries");
-    }
-    async addRoute(resourceId, route, handler) {
-        this.log.debug({ resourceId, route }, "adding route");
-        const caddyRoute = buildCaddyRoute(resourceId, route, handler);
-        // Delete existing route for idempotency
-        try {
-            await this.caddyApiRequest("DELETE", `/id/vyft-${resourceId}`);
-        }
-        catch (err) {
-            this.log.debug({ err, resourceId }, "idempotent route delete failed");
-        }
-        const maxAttempts = 5;
-        for (let attempt = 0; attempt < maxAttempts; attempt++) {
-            try {
-                await this.caddyApiRequest("POST", "/config/apps/http/servers/main/routes", caddyRoute);
-                this.log.debug({ resourceId, route }, "route added");
-                return;
-            }
-            catch (err) {
-                this.log.debug({ err, resourceId, attempt: attempt + 1, max: maxAttempts }, "route add attempt failed");
-                if (attempt === maxAttempts - 1) {
-                    this.log.error({ resourceId, route }, "route add exhausted retries");
-                    throw new Error(`Failed to add route for ${resourceId}`);
-                }
-                await new Promise((r) => setTimeout(r, 2000));
-            }
-        }
-    }
-    async removeRoute(resourceId) {
-        this.log.debug({ resourceId }, "removing route");
-        try {
-            await this.caddyApiRequest("DELETE", `/id/vyft-${resourceId}`);
-            this.log.debug({ resourceId }, "route removed");
-        }
-        catch (err) {
-            this.log.debug({ err, resourceId }, "route removal failed (may not exist)");
-        }
+        this.log.info({ durationMs }, "infrastructure ready");
     }
     async listManagedResources() {
         const resources = [];
@@ -413,7 +212,7 @@ export class DockerClient {
         }
         return resources;
     }
-    async create(resource) {
+    async create(resource, options) {
         switch (resource.type) {
             case "volume":
                 return this.createVolume(resource);
@@ -422,7 +221,7 @@ export class DockerClient {
             case "service":
                 return this.createService(resource);
             case "site":
-                return this.createStatic(resource);
+                return this.createStatic(resource, options?.silent);
         }
     }
     async exists(resource) {
@@ -465,9 +264,9 @@ export class DockerClient {
             Name: volume.id,
             Labels: labels,
         });
-        const durationMs = Math.round(performance.now() - start);
-        this.log.debug({ volumeName: volume.id, durationMs }, "volume created");
-        log.step(`Created ${volume.id}`);
+        const duration = Math.round(performance.now() - start);
+        this.log.debug({ volumeName: volume.id, durationMs: duration }, "volume created");
+        return { action: "created", duration };
     }
     async volumeExists(id) {
         const start = performance.now();
@@ -489,7 +288,6 @@ export class DockerClient {
         await this.docker.getVolume(id).remove();
         const durationMs = Math.round(performance.now() - start);
         this.log.debug({ volumeName: id, durationMs }, "volume removed");
-        log.step(`Removed ${id}`);
     }
     async createSecret(secret) {
         const start = performance.now();
@@ -500,9 +298,9 @@ export class DockerClient {
         await this.storeSecretData(secret.id, value, {
             "vyft.length": length.toString(),
         });
-        const durationMs = Math.round(performance.now() - start);
-        this.log.debug({ secretName: secret.id, length, durationMs }, "secret created");
-        log.step(`Created ${secret.id}`);
+        const duration = Math.round(performance.now() - start);
+        this.log.debug({ secretName: secret.id, length, durationMs: duration }, "secret created");
+        return { action: "created", duration };
     }
     async secretExists(id) {
         const start = performance.now();
@@ -524,7 +322,6 @@ export class DockerClient {
         await this.docker.getSecret(id).remove();
         const durationMs = Math.round(performance.now() - start);
         this.log.debug({ secretName: id, durationMs }, "secret removed");
-        log.step(`Removed ${id}`);
     }
     async storeSecretData(name, value, labels = {}) {
         this.log.debug({ secretName: name }, "storing secret data");
@@ -551,7 +348,6 @@ export class DockerClient {
             "vyft.derived": "true",
             "vyft.parent-service": parentService,
         });
-        log.step(`Created ${name}`);
     }
     async resolveEnv(serviceId, env) {
         const envList = [];
@@ -609,60 +405,70 @@ export class DockerClient {
         this.log.debug({ serviceId, envCount: envList.length, secretMountCount: secrets.length }, "env resolved");
         return { envList, secrets };
     }
+    async buildImage(service) {
+        const config = service.config;
+        if (typeof config.image !== "object")
+            return null;
+        const { context = ".", dockerfile = "Dockerfile" } = config.image;
+        const buildTag = `${service.id}:latest`;
+        this.log.debug({ resourceId: service.id, context, dockerfile }, "image build started");
+        const buildStart = performance.now();
+        const tarStream = tar.pack(path.resolve(context));
+        const stream = await this.localDocker.buildImage(tarStream, {
+            t: buildTag,
+            dockerfile,
+        });
+        await new Promise((resolve, reject) => {
+            this.localDocker.modem.followProgress(stream, (err) => (err ? reject(err) : resolve()), (event) => {
+                if (event.error)
+                    this.log.error({ error: event.error }, "build error");
+                else if (this.verbose && event.stream)
+                    process.stdout.write(event.stream);
+                this.log.trace({ event }, "build progress");
+            });
+        });
+        const buildDurationMs = Math.round(performance.now() - buildStart);
+        this.log.debug({
+            resourceId: service.id,
+            image: buildTag,
+            durationMs: buildDurationMs,
+        }, "image build completed");
+        const images = await this.localDocker.listImages({
+            filters: JSON.stringify({ reference: [buildTag] }),
+        });
+        if (images.length === 0) {
+            throw new Error(`Image ${buildTag} was not built successfully`);
+        }
+        // Tag with content hash so the orchestrator detects the new image
+        const shortHash = images[0].Id.replace("sha256:", "").slice(0, 12);
+        const imageName = `${service.id}:${shortHash}`;
+        await this.localDocker.getImage(buildTag).tag({
+            repo: service.id,
+            tag: shortHash,
+        });
+        if (this.isRemote) {
+            this.log.debug({ image: imageName }, "transferring image to remote");
+            const transferStart = performance.now();
+            const imageStream = await this.localDocker.getImage(imageName).get();
+            await this.docker.loadImage(imageStream);
+            const transferDurationMs = Math.round(performance.now() - transferStart);
+            this.log.debug({ image: imageName, durationMs: transferDurationMs }, "image transferred to remote");
+        }
+        this.builtImages.set(service.id, imageName);
+        return imageName;
+    }
     async createService(service) {
         const start = performance.now();
-        await this.ensureNetwork(`${this.project}-internal`, {
-            "com.docker.stack.namespace": this.project,
-            "vyft.managed": "true",
-            "vyft.project": this.project,
-        });
         const config = service.config;
         let imageName;
         if (typeof config.image === "object") {
-            const { context = ".", dockerfile = "Dockerfile" } = config.image;
-            const buildTag = `${service.id}:latest`;
-            this.log.debug({ resourceId: service.id, context, dockerfile }, "image build started");
-            const buildStart = performance.now();
-            const tarStream = tar.pack(path.resolve(context));
-            const stream = await this.localDocker.buildImage(tarStream, {
-                t: buildTag,
-                dockerfile,
-            });
-            await new Promise((resolve, reject) => {
-                this.localDocker.modem.followProgress(stream, (err) => (err ? reject(err) : resolve()), (event) => {
-                    if (event.error)
-                        log.error(event.error);
-                    else if (this.verbose && event.stream)
-                        process.stdout.write(event.stream);
-                    this.log.trace({ event }, "build progress");
-                });
-            });
-            const buildDurationMs = Math.round(performance.now() - buildStart);
-            this.log.debug({
-                resourceId: service.id,
-                image: buildTag,
-                durationMs: buildDurationMs,
-            }, "image build completed");
-            const images = await this.localDocker.listImages({
-                filters: JSON.stringify({ reference: [buildTag] }),
-            });
-            if (images.length === 0) {
-                throw new Error(`Image ${buildTag} was not built successfully`);
+            const prebuilt = this.builtImages.get(service.id);
+            if (prebuilt) {
+                imageName = prebuilt;
             }
-            // Tag with content hash so the orchestrator detects the new image
-            const shortHash = images[0].Id.replace("sha256:", "").slice(0, 12);
-            imageName = `${service.id}:${shortHash}`;
-            await this.localDocker.getImage(buildTag).tag({
-                repo: service.id,
-                tag: shortHash,
-            });
-            if (this.isRemote) {
-                this.log.debug({ image: imageName }, "transferring image to remote");
-                const transferStart = performance.now();
-                const imageStream = await this.localDocker.getImage(imageName).get();
-                await this.docker.loadImage(imageStream);
-                const transferDurationMs = Math.round(performance.now() - transferStart);
-                this.log.debug({ image: imageName, durationMs: transferDurationMs }, "image transferred to remote");
+            else {
+                await this.buildImage(service);
+                imageName = this.builtImages.get(service.id);
             }
         }
         else {
@@ -781,19 +587,23 @@ export class DockerClient {
         }
         if (config.route) {
             const port = config.port || 3000;
-            await this.addRoute(service.id, config.route, {
-                handler: "reverse_proxy",
-                upstreams: [{ dial: `${service.id}:${port}` }],
+            await this.proxy.addRoute(service.id, config.route, {
+                host: service.id,
+                port,
             });
         }
-        const durationMs = Math.round(performance.now() - start);
+        const duration = Math.round(performance.now() - start);
         this.log.info({
             resourceId: service.id,
             image: imageName,
             hasRoute: !!config.route,
-            durationMs,
+            durationMs: duration,
         }, existing ? "service updated" : "service created");
-        log.step(`${existing ? "Updated" : "Created"} ${service.id}`);
+        return {
+            action: existing ? "updated" : "created",
+            route: config.route,
+            duration,
+        };
     }
     async serviceExists(id) {
         try {
@@ -805,10 +615,27 @@ export class DockerClient {
             return false;
         }
     }
+    async waitForHealthy(id, timeoutMs = 120000) {
+        const start = performance.now();
+        const interval = 2000;
+        this.log.debug({ resourceId: id }, "waiting for service to be healthy");
+        while (performance.now() - start < timeoutMs) {
+            const tasks = await this.docker.listTasks({
+                filters: { service: [id], "desired-state": ["running"] },
+            });
+            const healthy = tasks.some((t) => t.Status.State === "running");
+            if (healthy) {
+                this.log.debug({ resourceId: id }, "service is healthy");
+                return;
+            }
+            await new Promise((r) => setTimeout(r, interval));
+        }
+        throw new Error(`Service ${id} did not become healthy within ${timeoutMs}ms`);
+    }
     async removeService(id) {
         const start = performance.now();
         this.log.debug({ resourceId: id }, "removing service");
-        await this.removeRoute(id);
+        await this.proxy.removeRoute(id);
         await this.docker.getService(id).remove();
         const maxWait = 60000;
         const interval = 2000;
@@ -831,7 +658,6 @@ export class DockerClient {
         }
         const durationMs = Math.round(performance.now() - start);
         this.log.info({ resourceId: id, durationMs }, "service removed");
-        log.step(`Removed ${id}`);
     }
     async pullImage(image) {
         this.log.debug({ image }, "pulling image");
@@ -841,19 +667,15 @@ export class DockerClient {
         });
         this.log.debug({ image }, "image pulled");
     }
-    async createStatic(static_) {
+    async createStatic(static_, silent) {
         const start = performance.now();
-        await this.ensureNetwork(`${this.project}-internal`, {
-            "com.docker.stack.namespace": this.project,
-            "vyft.managed": "true",
-            "vyft.project": this.project,
-        });
         this.log.debug({ resourceId: static_.id, route: static_.config.route }, "creating static site");
         this.log.debug({ resourceId: static_.id }, "static build starting");
         const { outputPath } = await buildStatic(static_.config.build.cwd, {
             output: static_.config.build.output,
             command: static_.config.build.command,
             env: static_.config.build.env,
+            silent,
         }, this.log);
         const volumeName = `${static_.id}-files`;
         if (!(await this.volumeExists(volumeName))) {
@@ -901,13 +723,13 @@ export class DockerClient {
             "vyft.managed": "true",
             "vyft.project": this.project,
         };
-        const command = static_.config.spa
-            ? [
+        const command = static_.config.spa === false
+            ? ["caddy", "file-server", "--root", "/srv", "--listen", ":80"]
+            : [
                 "sh",
                 "-c",
                 "printf ':80 {\\nroot * /srv\\ntry_files {path} /index.html\\nfile_server\\n}\\n' > /etc/caddy/Caddyfile && caddy run --config /etc/caddy/Caddyfile --adapter caddyfile",
-            ]
-            : ["caddy", "file-server", "--root", "/srv", "--listen", ":80"];
+            ];
         const serviceSpec = {
             Name: static_.id,
             Labels: serviceLabels,
@@ -945,18 +767,26 @@ export class DockerClient {
             this.log.debug({ resourceId: static_.id }, "creating caddy service for static site");
             await this.docker.createService(serviceSpec);
         }
-        await this.addRoute(static_.id, static_.config.route, {
-            handler: "reverse_proxy",
-            upstreams: [{ dial: `${static_.id}:80` }],
+        await this.proxy.addRoute(static_.id, static_.config.route, {
+            host: static_.id,
+            port: 80,
         });
-        const durationMs = Math.round(performance.now() - start);
-        this.log.info({ resourceId: static_.id, route: static_.config.route, durationMs }, existing ? "site updated" : "site created");
-        log.step(`${existing ? "Updated" : "Created"} ${static_.id}`);
+        const duration = Math.round(performance.now() - start);
+        this.log.info({
+            resourceId: static_.id,
+            route: static_.config.route,
+            durationMs: duration,
+        }, existing ? "site updated" : "site created");
+        return {
+            action: existing ? "updated" : "created",
+            route: static_.config.route,
+            duration,
+        };
     }
     async removeStatic(id) {
         const start = performance.now();
         this.log.debug({ resourceId: id }, "removing static site");
-        await this.removeRoute(id);
+        await this.proxy.removeRoute(id);
         await this.docker.getService(id).remove();
         const maxWait = 30000;
         const interval = 2000;
@@ -987,12 +817,92 @@ export class DockerClient {
         }
         const durationMs = Math.round(performance.now() - start);
         this.log.info({ resourceId: id, durationMs }, "site removed");
-        log.step(`Removed ${id}`);
     }
-    async proxyLogs(options) {
-        const container = await this.findProxyContainer();
+    async *serviceLogs(options) {
+        const allServices = await this.docker.listServices({
+            filters: JSON.stringify({
+                label: ["vyft.managed=true", `vyft.project=${this.project}`],
+            }),
+        });
+        const prefix = `${this.project}-`;
+        let matched = allServices;
+        if (options.services && options.services.length > 0) {
+            const filter = new Set(options.services);
+            matched = allServices.filter((svc) => {
+                const name = svc.Spec?.Name || "";
+                const short = name.startsWith(prefix)
+                    ? name.slice(prefix.length)
+                    : name;
+                return filter.has(short) || filter.has(name);
+            });
+        }
+        if (matched.length === 0) {
+            this.log.warn("no matching services found");
+            return;
+        }
         const tail = options.tail ?? 100;
-        if (options.follow) {
+        // Collect all containers with their short service name (parallel)
+        const targets = (await Promise.all(matched.map(async (svc) => {
+            const name = svc.Spec?.Name || "";
+            const short = name.startsWith(prefix)
+                ? name.slice(prefix.length)
+                : name;
+            const containers = await this.docker.listContainers({
+                filters: JSON.stringify({
+                    label: [`com.docker.swarm.service.name=${name}`],
+                }),
+            });
+            return containers.map((cInfo) => ({
+                container: this.docker.getContainer(cInfo.Id),
+                short,
+            }));
+        }))).flat();
+        if (!options.follow) {
+            // Fetch all logs in parallel
+            const results = await Promise.all(targets.map(async ({ container, short }) => {
+                const buf = await container.logs({
+                    stdout: true,
+                    stderr: true,
+                    follow: false,
+                    tail,
+                    timestamps: true,
+                });
+                const entries = [];
+                let offset = 0;
+                while (offset + 8 <= buf.length) {
+                    const type = buf[offset];
+                    const size = buf.readUInt32BE(offset + 4);
+                    offset += 8;
+                    const text = buf.subarray(offset, offset + size).toString();
+                    entries.push({
+                        service: short,
+                        stream: type === 2 ? "stderr" : "stdout",
+                        text,
+                    });
+                    offset += size;
+                }
+                return entries;
+            }));
+            for (const entries of results) {
+                for (const entry of entries) {
+                    yield entry;
+                }
+            }
+            return;
+        }
+        // Follow mode: merge all container streams concurrently
+        const buffer = [];
+        let notify = null;
+        let active = targets.length;
+        const push = (entry) => {
+            buffer.push(entry);
+            if (notify) {
+                const n = notify;
+                notify = null;
+                n();
+            }
+        };
+        await Promise.all(targets.map(async ({ container, short }) => {
             const stream = await container.logs({
                 stdout: true,
                 stderr: true,
@@ -1000,38 +910,38 @@ export class DockerClient {
                 tail,
                 timestamps: true,
             });
-            const stdoutStream = new PassThrough();
-            const stderrStream = new PassThrough();
-            stdoutStream.pipe(process.stdout);
-            stderrStream.pipe(process.stderr);
-            this.docker.modem.demuxStream(stream, stdoutStream, stderrStream);
-            await new Promise((resolve) => {
-                stream.on("end", resolve);
-            });
-        }
-        else {
-            const buf = await container.logs({
-                stdout: true,
-                stderr: true,
-                follow: false,
-                tail,
-                timestamps: true,
+            const stdoutPT = new PassThrough();
+            const stderrPT = new PassThrough();
+            stdoutPT.on("data", (chunk) => {
+                for (const line of chunk.toString().split("\n")) {
+                    if (line)
+                        push({ service: short, stream: "stdout", text: line });
+                }
             });
-            // Demux the multiplexed buffer: each frame has an 8-byte header
-            // [stream_type(1), padding(3), size(4)] followed by the payload.
-            let offset = 0;
-            while (offset + 8 <= buf.length) {
-                const type = buf[offset];
-                const size = buf.readUInt32BE(offset + 4);
-                offset += 8;
-                const payload = buf.subarray(offset, offset + size);
-                if (type === 2) {
-                    process.stderr.write(payload);
+            stderrPT.on("data", (chunk) => {
+                for (const line of chunk.toString().split("\n")) {
+                    if (line)
+                        push({ service: short, stream: "stderr", text: line });
                 }
-                else {
-                    process.stdout.write(payload);
+            });
+            this.docker.modem.demuxStream(stream, stdoutPT, stderrPT);
+            stream.on("end", () => {
+                active--;
+                if (notify && active === 0) {
+                    const n = notify;
+                    notify = null;
+                    n();
                 }
-                offset += size;
+            });
+        }));
+        while (active > 0 || buffer.length > 0) {
+            if (buffer.length === 0) {
+                await new Promise((r) => {
+                    notify = r;
+                });
+            }
+            while (buffer.length > 0) {
+                yield buffer.shift();
             }
         }
     }