vyft 0.3.0-alpha → 0.4.1-alpha

package/dist/docker.js

@@ -1,876 +0,0 @@
-import { randomBytes } from "node:crypto";
-import path from "node:path";
-import { PassThrough } from "node:stream";
-import { log } from "@clack/prompts";
-import Docker from "dockerode";
-import tar from "tar-fs";
-import { buildStatic } from "./build.js";
-import { logger as defaultLogger } from "./logger.js";
-import { isInterpolation, isReference } from "./resource.js";
-import { CaddyProxy } from "./swarm/proxy.js";
-function secretMount(id, name) {
-    return {
-        SecretID: id,
-        SecretName: name,
-        File: { Name: name, UID: "0", GID: "0", Mode: 0o444 },
-    };
-}
-function parseDuration(duration) {
-    const match = duration.match(/^(\d+)(ms|s|m|h)$/);
-    if (!match || !match[1] || !match[2]) {
-        throw new Error(`Invalid duration format: ${duration}`);
-    }
-    const value = parseInt(match[1], 10);
-    const unit = match[2];
-    const multipliers = {
-        ms: 1_000_000,
-        s: 1_000_000_000,
-        m: 60_000_000_000,
-        h: 3_600_000_000_000,
-    };
-    return value * multipliers[unit];
-}
-function parseMemory(memory) {
-    const match = memory.match(/^(\d+)(B|KB|MB|GB)$/i);
-    if (!match || !match[1] || !match[2]) {
-        throw new Error(`Invalid memory format: ${memory}`);
-    }
-    const value = parseInt(match[1], 10);
-    const unit = match[2].toUpperCase();
-    const multipliers = {
-        B: 1,
-        KB: 1024,
-        MB: 1024 * 1024,
-        GB: 1024 * 1024 * 1024,
-    };
-    return value * multipliers[unit];
-}
-export function parseRoute(route) {
-    const slashIndex = route.indexOf("/");
-    if (slashIndex === -1) {
-        return { host: route };
-    }
-    return {
-        host: route.slice(0, slashIndex),
-        path: route.slice(slashIndex),
-    };
-}
-export class DockerClient {
-    docker;
-    localDocker;
-    isRemote;
-    project;
-    secretValues = new Map();
-    log;
-    proxy;
-    verbose = false;
-    constructor(project, opts) {
-        this.localDocker = new Docker({ socketPath: "/var/run/docker.sock" });
-        const host = opts?.host;
-        if (host)
-            process.env.DOCKER_HOST = host;
-        this.docker = new Docker();
-        this.isRemote = !!host;
-        this.project = project;
-        this.log = (opts?.parentLogger ?? defaultLogger).child({
-            component: "docker",
-            project,
-        });
-        this.proxy = new CaddyProxy(this.docker, this.log);
-        if (host)
-            this.log.debug({ host }, "using remote endpoint");
-    }
-    async ensureNetwork(name, labels = {}) {
-        const networks = await this.docker.listNetworks({
-            filters: JSON.stringify({ name: [name] }),
-        });
-        const exactMatch = networks.some((n) => n.Name === name);
-        if (!exactMatch) {
-            this.log.debug({ network: name }, "creating network");
-            await this.docker.createNetwork({
-                Name: name,
-                Driver: "overlay",
-                Attachable: true,
-                Labels: labels,
-            });
-        }
-    }
-    async ensureInfrastructure() {
-        const start = performance.now();
-        // Ensure per-project network for inter-service DNS
-        await this.ensureNetwork(`${this.project}-internal`, {
-            "com.docker.stack.namespace": this.project,
-            "vyft.managed": "true",
-            "vyft.project": this.project,
-        });
-        await this.proxy.ensure();
-        const durationMs = Math.round(performance.now() - start);
-        this.log.info({ durationMs }, "infrastructure ready");
-    }
-    async listManagedResources() {
-        const resources = [];
-        const [services, volumes, secrets] = await Promise.all([
-            this.docker.listServices({
-                filters: JSON.stringify({
-                    label: ["vyft.managed=true", `vyft.project=${this.project}`],
-                }),
-            }),
-            this.docker.listVolumes({
-                filters: JSON.stringify({
-                    label: ["vyft.managed=true", `vyft.project=${this.project}`],
-                }),
-            }),
-            this.docker.listSecrets({
-                filters: JSON.stringify({
-                    label: ["vyft.managed=true", `vyft.project=${this.project}`],
-                }),
-            }),
-        ]);
-        for (const svc of services) {
-            const labels = svc.Spec?.Labels || {};
-            resources.push({
-                id: svc.Spec?.Name || "",
-                type: labels["vyft.type"] || "service",
-                route: labels["vyft.route"],
-            });
-        }
-        for (const vol of volumes.Volumes || []) {
-            if (vol.Labels?.["vyft.static"])
-                continue;
-            resources.push({
-                id: vol.Name,
-                type: "volume",
-            });
-        }
-        for (const secret of secrets) {
-            const secretLabels = secret.Spec?.Labels || {};
-            resources.push({
-                id: secret.Spec?.Name || "",
-                type: "secret",
-                derived: secretLabels["vyft.derived"] === "true",
-                parentService: secretLabels["vyft.parent-service"],
-            });
-        }
-        return resources;
-    }
-    async create(resource) {
-        switch (resource.type) {
-            case "volume":
-                return this.createVolume(resource);
-            case "secret":
-                return this.createSecret(resource);
-            case "service":
-                return this.createService(resource);
-            case "site":
-                return this.createStatic(resource);
-        }
-    }
-    async exists(resource) {
-        switch (resource.type) {
-            case "volume":
-                return this.volumeExists(resource.id);
-            case "secret":
-                return this.secretExists(resource.id);
-            case "service":
-            case "site":
-                return this.serviceExists(resource.id);
-        }
-    }
-    async remove(resource) {
-        switch (resource.type) {
-            case "volume":
-                return this.removeVolume(resource.id);
-            case "secret":
-                return this.removeSecret(resource.id);
-            case "service":
-                return this.removeService(resource.id);
-            case "site":
-                return this.removeStatic(resource.id);
-        }
-    }
-    async createVolume(volume) {
-        const start = performance.now();
-        this.log.debug({ volumeName: volume.id }, "creating volume");
-        const config = volume.config;
-        const labels = {
-            "com.docker.stack.namespace": this.project,
-            "vyft.managed": "true",
-            "vyft.project": this.project,
-            "vyft.type": "volume",
-        };
-        if (config.size) {
-            labels["vyft.size"] = config.size;
-        }
-        await this.docker.createVolume({
-            Name: volume.id,
-            Labels: labels,
-        });
-        const durationMs = Math.round(performance.now() - start);
-        this.log.debug({ volumeName: volume.id, durationMs }, "volume created");
-        log.step(`Created ${volume.id}`);
-    }
-    async volumeExists(id) {
-        const start = performance.now();
-        try {
-            await this.docker.getVolume(id).inspect();
-            const durationMs = Math.round(performance.now() - start);
-            this.log.debug({ volumeName: id, exists: true, durationMs }, "volume exists check");
-            return true;
-        }
-        catch (err) {
-            const durationMs = Math.round(performance.now() - start);
-            this.log.debug({ err, volumeName: id, exists: false, durationMs }, "volume exists check");
-            return false;
-        }
-    }
-    async removeVolume(id) {
-        const start = performance.now();
-        this.log.debug({ volumeName: id }, "removing volume");
-        await this.docker.getVolume(id).remove();
-        const durationMs = Math.round(performance.now() - start);
-        this.log.debug({ volumeName: id, durationMs }, "volume removed");
-        log.step(`Removed ${id}`);
-    }
-    async createSecret(secret) {
-        const start = performance.now();
-        const length = secret.config.length || 32;
-        this.log.debug({ secretName: secret.id, length }, "creating secret");
-        const value = randomBytes(length).toString("base64url");
-        this.secretValues.set(secret.id, value);
-        await this.storeSecretData(secret.id, value, {
-            "vyft.length": length.toString(),
-        });
-        const durationMs = Math.round(performance.now() - start);
-        this.log.debug({ secretName: secret.id, length, durationMs }, "secret created");
-        log.step(`Created ${secret.id}`);
-    }
-    async secretExists(id) {
-        const start = performance.now();
-        try {
-            await this.docker.getSecret(id).inspect();
-            const durationMs = Math.round(performance.now() - start);
-            this.log.debug({ secretName: id, exists: true, durationMs }, "secret exists check");
-            return true;
-        }
-        catch (err) {
-            const durationMs = Math.round(performance.now() - start);
-            this.log.debug({ err, secretName: id, exists: false, durationMs }, "secret exists check");
-            return false;
-        }
-    }
-    async removeSecret(id) {
-        const start = performance.now();
-        this.log.debug({ secretName: id }, "removing secret");
-        await this.docker.getSecret(id).remove();
-        const durationMs = Math.round(performance.now() - start);
-        this.log.debug({ secretName: id, durationMs }, "secret removed");
-        log.step(`Removed ${id}`);
-    }
-    async storeSecretData(name, value, labels = {}) {
-        this.log.debug({ secretName: name }, "storing secret data");
-        await this.docker.createSecret({
-            Name: name,
-            Data: Buffer.from(value).toString("base64"),
-            Labels: {
-                "com.docker.stack.namespace": this.project,
-                "vyft.managed": "true",
-                "vyft.project": this.project,
-                "vyft.type": "secret",
-                ...labels,
-            },
-        });
-    }
-    async lookupSecretId(name) {
-        this.log.debug({ secretName: name }, "looking up secret id");
-        const secret = await this.docker.getSecret(name).inspect();
-        return secret.ID;
-    }
-    async createDerivedSecret(name, value, parentService) {
-        this.log.debug({ secretName: name, parentService }, "creating derived secret");
-        await this.storeSecretData(name, value, {
-            "vyft.derived": "true",
-            "vyft.parent-service": parentService,
-        });
-        log.step(`Created ${name}`);
-    }
-    async resolveEnv(serviceId, env) {
-        const envList = [];
-        const secrets = [];
-        for (const [key, value] of Object.entries(env)) {
-            if (typeof value === "string") {
-                envList.push(`${key}=${value}`);
-            }
-            else if (isReference(value)) {
-                const secretId = await this.lookupSecretId(value.id);
-                secrets.push(secretMount(secretId, value.id));
-                const envKey = key.endsWith("_FILE") ? key : `${key}_FILE`;
-                envList.push(`${envKey}=/run/secrets/${value.id}`);
-            }
-            else if (isInterpolation(value)) {
-                const derivedName = `${serviceId}-${key.toLowerCase().replace(/_/g, "-")}`;
-                // Check if all referenced secrets have their values available
-                let allValuesAvailable = true;
-                for (const v of value.values) {
-                    if (isReference(v) && !this.secretValues.has(v.id)) {
-                        allValuesAvailable = false;
-                        break;
-                    }
-                }
-                if (allValuesAvailable) {
-                    // Build the interpolated value and create/update the derived secret
-                    const parts = [];
-                    for (let i = 0; i < value.strings.length; i++) {
-                        parts.push(value.strings[i]);
-                        if (i < value.values.length) {
-                            const v = value.values[i];
-                            if (isReference(v)) {
-                                parts.push(this.secretValues.get(v.id));
-                            }
-                            else {
-                                parts.push(v);
-                            }
-                        }
-                    }
-                    await this.createDerivedSecret(derivedName, parts.join(""), serviceId);
-                }
-                else if (!(await this.secretExists(derivedName))) {
-                    // Source secret values not in memory and derived secret doesn't exist
-                    const missing = value.values
-                        .filter((v) => isReference(v) && !this.secretValues.has(v.id))
-                        .map((v) => v.id);
-                    throw new Error(`Secret(s) ${missing.join(", ")} value not available and derived secret "${derivedName}" does not exist — destroy and redeploy to regenerate`);
-                }
-                const derivedId = await this.lookupSecretId(derivedName);
-                secrets.push(secretMount(derivedId, derivedName));
-                const envKey = key.endsWith("_FILE") ? key : `${key}_FILE`;
-                envList.push(`${envKey}=/run/secrets/${derivedName}`);
-            }
-        }
-        this.log.debug({ serviceId, envCount: envList.length, secretMountCount: secrets.length }, "env resolved");
-        return { envList, secrets };
-    }
-    async createService(service) {
-        const start = performance.now();
-        await this.ensureNetwork(`${this.project}-internal`, {
-            "com.docker.stack.namespace": this.project,
-            "vyft.managed": "true",
-            "vyft.project": this.project,
-        });
-        const config = service.config;
-        let imageName;
-        if (typeof config.image === "object") {
-            const { context = ".", dockerfile = "Dockerfile" } = config.image;
-            const buildTag = `${service.id}:latest`;
-            this.log.debug({ resourceId: service.id, context, dockerfile }, "image build started");
-            const buildStart = performance.now();
-            const tarStream = tar.pack(path.resolve(context));
-            const stream = await this.localDocker.buildImage(tarStream, {
-                t: buildTag,
-                dockerfile,
-            });
-            await new Promise((resolve, reject) => {
-                this.localDocker.modem.followProgress(stream, (err) => (err ? reject(err) : resolve()), (event) => {
-                    if (event.error)
-                        log.error(event.error);
-                    else if (this.verbose && event.stream)
-                        process.stdout.write(event.stream);
-                    this.log.trace({ event }, "build progress");
-                });
-            });
-            const buildDurationMs = Math.round(performance.now() - buildStart);
-            this.log.debug({
-                resourceId: service.id,
-                image: buildTag,
-                durationMs: buildDurationMs,
-            }, "image build completed");
-            const images = await this.localDocker.listImages({
-                filters: JSON.stringify({ reference: [buildTag] }),
-            });
-            if (images.length === 0) {
-                throw new Error(`Image ${buildTag} was not built successfully`);
-            }
-            // Tag with content hash so the orchestrator detects the new image
-            const shortHash = images[0].Id.replace("sha256:", "").slice(0, 12);
-            imageName = `${service.id}:${shortHash}`;
-            await this.localDocker.getImage(buildTag).tag({
-                repo: service.id,
-                tag: shortHash,
-            });
-            if (this.isRemote) {
-                this.log.debug({ image: imageName }, "transferring image to remote");
-                const transferStart = performance.now();
-                const imageStream = await this.localDocker.getImage(imageName).get();
-                await this.docker.loadImage(imageStream);
-                const transferDurationMs = Math.round(performance.now() - transferStart);
-                this.log.debug({ image: imageName, durationMs: transferDurationMs }, "image transferred to remote");
-            }
-        }
-        else {
-            imageName = config.image;
-        }
-        // Build labels for service and container
-        const serviceLabels = {
-            "com.docker.stack.namespace": this.project,
-            "vyft.managed": "true",
-            "vyft.project": this.project,
-            "vyft.type": "service",
-        };
-        const containerLabels = {
-            "com.docker.stack.namespace": this.project,
-            "vyft.managed": "true",
-            "vyft.project": this.project,
-        };
-        if (config.route) {
-            serviceLabels["vyft.route"] = config.route;
-        }
-        const resolved = config.env
-            ? await this.resolveEnv(service.id, config.env)
-            : undefined;
-        const containerSpec = {
-            Image: imageName,
-            Labels: containerLabels,
-            Command: config.command,
-            Env: resolved?.envList,
-            Mounts: config.volumes?.map(({ volume, mount }) => ({
-                Type: "volume",
-                Source: volume.id,
-                Target: mount,
-            })),
-            Secrets: resolved?.secrets.length ? resolved.secrets : undefined,
-        };
-        if (config.healthCheck) {
-            containerSpec.HealthCheck = {
-                Test: ["CMD", ...config.healthCheck.command],
-                Interval: config.healthCheck.interval
-                    ? parseDuration(config.healthCheck.interval)
-                    : undefined,
-                Timeout: config.healthCheck.timeout
-                    ? parseDuration(config.healthCheck.timeout)
-                    : undefined,
-                Retries: config.healthCheck.retries,
-                StartPeriod: config.healthCheck.startPeriod
-                    ? parseDuration(config.healthCheck.startPeriod)
-                    : undefined,
-            };
-        }
-        const networks = [
-            { Target: `${this.project}-internal` },
-        ];
-        if (config.route) {
-            networks.push({ Target: "vyft-network" });
-        }
-        const taskTemplate = {
-            ContainerSpec: containerSpec,
-            Networks: networks,
-        };
-        if (config.resources) {
-            taskTemplate.Resources = {
-                Limits: {
-                    MemoryBytes: config.resources.memory
-                        ? parseMemory(config.resources.memory)
-                        : undefined,
-                    NanoCPUs: config.resources.cpus
-                        ? config.resources.cpus * 1e9
-                        : undefined,
-                },
-            };
-        }
-        if (config.restartPolicy) {
-            const conditionMap = {
-                none: "none",
-                "on-failure": "on-failure",
-                any: "any",
-            };
-            taskTemplate.RestartPolicy = {
-                Condition: conditionMap[config.restartPolicy],
-            };
-        }
-        const serviceSpec = {
-            Name: service.id,
-            Labels: serviceLabels,
-            TaskTemplate: taskTemplate,
-            Mode: { Replicated: { Replicas: config.replicas ?? 1 } },
-            // Only publish ports directly if no route (internal service or direct access)
-            EndpointSpec: !config.route && config.port
-                ? {
-                    Ports: [
-                        {
-                            Protocol: "tcp",
-                            TargetPort: config.port,
-                            PublishedPort: config.port,
-                            PublishMode: "ingress",
-                        },
-                    ],
-                }
-                : undefined,
-        };
-        this.log.trace({ serviceSpec }, "docker create service spec");
-        const existing = await this.serviceExists(service.id);
-        if (existing) {
-            this.log.debug({ resourceId: service.id }, "updating existing service");
-            const svc = this.docker.getService(service.id);
-            const info = await svc.inspect();
-            await svc.update({
-                ...serviceSpec,
-                version: info.Version.Index,
-            });
-        }
-        else {
-            this.log.debug({ resourceId: service.id }, "creating new service");
-            await this.docker.createService(serviceSpec);
-        }
-        if (config.route) {
-            const port = config.port || 3000;
-            await this.proxy.addRoute(service.id, config.route, {
-                host: service.id,
-                port,
-            });
-        }
-        const durationMs = Math.round(performance.now() - start);
-        this.log.info({
-            resourceId: service.id,
-            image: imageName,
-            hasRoute: !!config.route,
-            durationMs,
-        }, existing ? "service updated" : "service created");
-        log.step(`${existing ? "Updated" : "Created"} ${service.id}`);
-    }
-    async serviceExists(id) {
-        try {
-            await this.docker.getService(id).inspect();
-            return true;
-        }
-        catch (err) {
-            this.log.debug({ err, resourceId: id }, "service does not exist");
-            return false;
-        }
-    }
-    async waitForHealthy(id, timeoutMs = 120000) {
-        const start = performance.now();
-        const interval = 2000;
-        this.log.debug({ resourceId: id }, "waiting for service to be healthy");
-        while (performance.now() - start < timeoutMs) {
-            const tasks = await this.docker.listTasks({
-                filters: { service: [id], "desired-state": ["running"] },
-            });
-            const healthy = tasks.some((t) => t.Status.State === "running");
-            if (healthy) {
-                this.log.debug({ resourceId: id }, "service is healthy");
-                return;
-            }
-            await new Promise((r) => setTimeout(r, interval));
-        }
-        throw new Error(`Service ${id} did not become healthy within ${timeoutMs}ms`);
-    }
-    async removeService(id) {
-        const start = performance.now();
-        this.log.debug({ resourceId: id }, "removing service");
-        await this.proxy.removeRoute(id);
-        await this.docker.getService(id).remove();
-        const maxWait = 60000;
-        const interval = 2000;
-        let waited = 0;
-        this.log.debug({ resourceId: id, maxWait }, "container cleanup polling started");
-        while (waited < maxWait) {
-            const containers = await this.docker.listContainers({
-                all: true,
-                filters: JSON.stringify({
-                    label: [`com.docker.swarm.service.name=${id}`],
-                }),
-            });
-            if (containers.length === 0)
-                break;
-            if (waited >= maxWait * 0.8) {
-                this.log.warn({ resourceId: id, waited, maxWait, remaining: containers.length }, "cleanup polling nearing timeout");
-            }
-            await new Promise((r) => setTimeout(r, interval));
-            waited += interval;
-        }
-        const durationMs = Math.round(performance.now() - start);
-        this.log.info({ resourceId: id, durationMs }, "service removed");
-        log.step(`Removed ${id}`);
-    }
-    async pullImage(image) {
-        this.log.debug({ image }, "pulling image");
-        const stream = await this.docker.pull(image);
-        await new Promise((resolve, reject) => {
-            this.docker.modem.followProgress(stream, (err) => err ? reject(err) : resolve());
-        });
-        this.log.debug({ image }, "image pulled");
-    }
-    async createStatic(static_) {
-        const start = performance.now();
-        await this.ensureNetwork(`${this.project}-internal`, {
-            "com.docker.stack.namespace": this.project,
-            "vyft.managed": "true",
-            "vyft.project": this.project,
-        });
-        this.log.debug({ resourceId: static_.id, route: static_.config.route }, "creating static site");
-        this.log.debug({ resourceId: static_.id }, "static build starting");
-        const { outputPath } = await buildStatic(static_.config.build.cwd, {
-            output: static_.config.build.output,
-            command: static_.config.build.command,
-            env: static_.config.build.env,
-        }, this.log);
-        const volumeName = `${static_.id}-files`;
-        if (!(await this.volumeExists(volumeName))) {
-            this.log.debug({ volumeName }, "creating static volume");
-            await this.docker.createVolume({
-                Name: volumeName,
-                Labels: {
-                    "com.docker.stack.namespace": this.project,
-                    "vyft.managed": "true",
-                    "vyft.project": this.project,
-                    "vyft.type": "volume",
-                    "vyft.static": static_.id,
-                },
-            });
-        }
-        this.log.debug({ resourceId: static_.id, outputPath }, "tar copy started");
-        await this.pullImage("alpine:latest");
-        const tarStream = tar.pack(outputPath);
-        const container = await this.docker.createContainer({
-            Image: "alpine:latest",
-            Cmd: ["sleep", "3600"],
-            HostConfig: {
-                Mounts: [{ Type: "volume", Source: volumeName, Target: "/data" }],
-            },
-        });
-        await container.start();
-        // Clear old files before copying new ones
-        await container.exec({
-            Cmd: ["sh", "-c", "rm -rf /data/*"],
-            AttachStdout: true,
-            AttachStderr: true,
-        });
-        await container.putArchive(tarStream, { path: "/data" });
-        await container.remove({ force: true });
-        this.log.debug({ resourceId: static_.id }, "tar copy completed");
-        const serviceLabels = {
-            "com.docker.stack.namespace": this.project,
-            "vyft.managed": "true",
-            "vyft.project": this.project,
-            "vyft.type": "site",
-            "vyft.route": static_.config.route,
-        };
-        const containerLabels = {
-            "com.docker.stack.namespace": this.project,
-            "vyft.managed": "true",
-            "vyft.project": this.project,
-        };
-        const command = static_.config.spa === false
-            ? ["caddy", "file-server", "--root", "/srv", "--listen", ":80"]
-            : [
-                "sh",
-                "-c",
-                "printf ':80 {\\nroot * /srv\\ntry_files {path} /index.html\\nfile_server\\n}\\n' > /etc/caddy/Caddyfile && caddy run --config /etc/caddy/Caddyfile --adapter caddyfile",
-            ];
-        const serviceSpec = {
-            Name: static_.id,
-            Labels: serviceLabels,
-            TaskTemplate: {
-                ContainerSpec: {
-                    Image: "caddy:latest",
-                    Command: command,
-                    Mounts: [
-                        { Type: "volume", Source: volumeName, Target: "/srv" },
-                    ],
-                    Labels: containerLabels,
-                },
-                Networks: [
-                    { Target: `${this.project}-internal` },
-                    { Target: "vyft-network" },
-                ],
-            },
-            Mode: { Replicated: { Replicas: 1 } },
-        };
-        const existing = await this.serviceExists(static_.id);
-        if (existing) {
-            this.log.debug({ resourceId: static_.id }, "updating static site service");
-            const svc = this.docker.getService(static_.id);
-            const info = await svc.inspect();
-            await svc.update({
-                ...serviceSpec,
-                version: info.Version.Index,
-                TaskTemplate: {
-                    ...serviceSpec.TaskTemplate,
-                    ForceUpdate: (info.Spec?.TaskTemplate?.ForceUpdate ?? 0) + 1,
-                },
-            });
-        }
-        else {
-            this.log.debug({ resourceId: static_.id }, "creating caddy service for static site");
-            await this.docker.createService(serviceSpec);
-        }
-        await this.proxy.addRoute(static_.id, static_.config.route, {
-            host: static_.id,
-            port: 80,
-        });
-        const durationMs = Math.round(performance.now() - start);
-        this.log.info({ resourceId: static_.id, route: static_.config.route, durationMs }, existing ? "site updated" : "site created");
-        log.step(`${existing ? "Updated" : "Created"} ${static_.id}`);
-    }
-    async removeStatic(id) {
-        const start = performance.now();
-        this.log.debug({ resourceId: id }, "removing static site");
-        await this.proxy.removeRoute(id);
-        await this.docker.getService(id).remove();
-        const maxWait = 30000;
-        const interval = 2000;
-        let waited = 0;
-        this.log.debug({ resourceId: id, maxWait }, "static cleanup polling started");
-        while (waited < maxWait) {
-            const containers = await this.docker.listContainers({
-                all: true,
-                filters: JSON.stringify({
-                    label: [`com.docker.swarm.service.name=${id}`],
-                }),
-            });
-            if (containers.length === 0)
-                break;
-            if (waited >= maxWait * 0.8) {
-                this.log.warn({ resourceId: id, waited, maxWait, remaining: containers.length }, "cleanup polling nearing timeout");
-            }
-            await new Promise((r) => setTimeout(r, interval));
-            waited += interval;
-        }
-        const volumeName = `${id}-files`;
-        try {
-            this.log.debug({ volumeName }, "removing static volume");
-            await this.docker.getVolume(volumeName).remove();
-        }
-        catch (err) {
-            this.log.debug({ err, volumeName }, "static volume removal failed (may not exist)");
-        }
-        const durationMs = Math.round(performance.now() - start);
-        this.log.info({ resourceId: id, durationMs }, "site removed");
-        log.step(`Removed ${id}`);
-    }
-    async *serviceLogs(options) {
-        const allServices = await this.docker.listServices({
-            filters: JSON.stringify({
-                label: ["vyft.managed=true", `vyft.project=${this.project}`],
-            }),
-        });
-        const prefix = `${this.project}-`;
-        let matched = allServices;
-        if (options.services && options.services.length > 0) {
-            const filter = new Set(options.services);
-            matched = allServices.filter((svc) => {
-                const name = svc.Spec?.Name || "";
-                const short = name.startsWith(prefix)
-                    ? name.slice(prefix.length)
-                    : name;
-                return filter.has(short) || filter.has(name);
-            });
-        }
-        if (matched.length === 0) {
-            log.warn("No matching services found");
-            return;
-        }
-        const tail = options.tail ?? 100;
-        // Collect all containers with their short service name
-        const targets = [];
-        for (const svc of matched) {
-            const name = svc.Spec?.Name || "";
-            const short = name.startsWith(prefix) ? name.slice(prefix.length) : name;
-            const containers = await this.docker.listContainers({
-                filters: JSON.stringify({
-                    label: [`com.docker.swarm.service.name=${name}`],
-                }),
-            });
-            for (const cInfo of containers) {
-                targets.push({ container: this.docker.getContainer(cInfo.Id), short });
-            }
-        }
-        if (!options.follow) {
-            for (const { container, short } of targets) {
-                const buf = await container.logs({
-                    stdout: true,
-                    stderr: true,
-                    follow: false,
-                    tail,
-                    timestamps: true,
-                });
-                let offset = 0;
-                while (offset + 8 <= buf.length) {
-                    const type = buf[offset];
-                    const size = buf.readUInt32BE(offset + 4);
-                    offset += 8;
-                    const text = buf.subarray(offset, offset + size).toString();
-                    yield {
-                        service: short,
-                        stream: type === 2 ? "stderr" : "stdout",
-                        text,
-                    };
-                    offset += size;
-                }
-            }
-            return;
-        }
-        // Follow mode: merge all container streams concurrently
-        const buffer = [];
-        let notify = null;
-        let active = targets.length;
-        const push = (entry) => {
-            buffer.push(entry);
-            if (notify) {
-                const n = notify;
-                notify = null;
-                n();
-            }
-        };
-        for (const { container, short } of targets) {
-            const stream = await container.logs({
-                stdout: true,
-                stderr: true,
-                follow: true,
-                tail,
-                timestamps: true,
-            });
-            const stdoutPT = new PassThrough();
-            const stderrPT = new PassThrough();
-            stdoutPT.on("data", (chunk) => {
-                for (const line of chunk.toString().split("\n")) {
-                    if (line)
-                        push({ service: short, stream: "stdout", text: line });
-                }
-            });
-            stderrPT.on("data", (chunk) => {
-                for (const line of chunk.toString().split("\n")) {
-                    if (line)
-                        push({ service: short, stream: "stderr", text: line });
-                }
-            });
-            this.docker.modem.demuxStream(stream, stdoutPT, stderrPT);
-            stream.on("end", () => {
-                active--;
-                if (notify && active === 0) {
-                    const n = notify;
-                    notify = null;
-                    n();
-                }
-            });
-        }
-        while (active > 0 || buffer.length > 0) {
-            if (buffer.length === 0) {
-                await new Promise((r) => {
-                    notify = r;
-                });
-            }
-            while (buffer.length > 0) {
-                yield buffer.shift();
-            }
-        }
-    }
-    async removeProjectNetwork() {
-        const name = `${this.project}-internal`;
-        try {
-            await this.docker.getNetwork(name).remove();
-            this.log.debug({ network: name }, "project network removed");
-        }
-        catch {
-            this.log.debug({ network: name }, "project network removal skipped");
-        }
-    }
-}