{"id":"@lssm-tech/integration.lssm-os-provider-docker","slug":"integration.lssm-os-provider-docker","name":"@lssm-tech/integration.lssm-os-provider-docker","version":"2.0.4","path":"packages/integrations/lssm-os-provider-docker","manifestPath":"packages/integrations/lssm-os-provider-docker/package.json","manifestBlobSha":"1615f604c16155f055bed37005ae20d779b5a03a","layer":"integrations","physicalArea":null,"primaryArea":"delivery-and-infrastructure","classification":{"privateDeclared":null,"catalogFamily":"integrations","catalogKind":"integration","catalogStatus":"active","adoptionMode":"adoptable","stability":"experimental"},"description":"Docker Compose provider execution adapter for LSSM OS.","descriptionOrigin":"package.json","catalog":{"family":"integrations","kind":"integration","status":"active","adoptionMode":"adoptable","stability":"experimental","platforms":["server"],"runtimes":["bun","node"],"entrypoints":[".","./conformance","./runtime-node","./testing"],"documentation":[{"title":"Integration Lssm Os Provider Docker documentation","url":"https://www.npmjs.com/package/%40lssm-tech%2Fintegration.lssm-os-provider-docker","kind":"readme"}],"examples":[],"replacements":[],"capabilities":[{"id":"package.lssm.tech.integration.lssm.os.provider.docker","title":"Integration Lssm Os Provider Docker","description":"Docker Compose provider execution adapter for LSSM OS.","status":"active","useCases":["Adopt docker compose provider execution adapter for lssm os"],"aliases":["integration","lssm","provider","docker"],"pythonEquivalents":[],"canonicalImports":[{"from":"@lssm-tech/integration.lssm-os-provider-docker","symbols":[]},{"from":"@lssm-tech/integration.lssm-os-provider-docker/conformance","symbols":[]},{"from":"@lssm-tech/integration.lssm-os-provider-docker/runtime-node","symbols":[]},{"from":"@lssm-tech/integration.lssm-os-provider-docker/testing","symbols":[]}],"constraints":{"platforms":["server"],"runtimes":["bun","node"],"avoidWhen":["The @lssm-tech/integration.lssm-os-provider-docker package constraints do not match the target runtime or platform."],"requires":["TypeScript"]},"alternatives":[],"relationships":[],"resolutionPriority":50}]},"canonicalImports":[{"capabilityId":"package.lssm.tech.integration.lssm.os.provider.docker","from":"@lssm-tech/integration.lssm-os-provider-docker","symbols":[]},{"capabilityId":"package.lssm.tech.integration.lssm.os.provider.docker","from":"@lssm-tech/integration.lssm-os-provider-docker/conformance","symbols":[]},{"capabilityId":"package.lssm.tech.integration.lssm.os.provider.docker","from":"@lssm-tech/integration.lssm-os-provider-docker/runtime-node","symbols":[]},{"capabilityId":"package.lssm.tech.integration.lssm.os.provider.docker","from":"@lssm-tech/integration.lssm-os-provider-docker/testing","symbols":[]}],"scripts":{"build":"bun run build:bundle && bun run build:types","build:bundle":"bun scripts/build-public-bundles.ts","build:types":"contractspec-bun-build types","clean":"rimraf dist .turbo","lint":"bun run lint:fix","lint:check":"node ../../../scripts/biome.cjs check .","lint:fix":"node ../../../scripts/biome.cjs check --write .","test":"bun test","test:pack":"bun run build && bun scripts/test-packed-exports.ts","typecheck":"tsgo --noEmit"},"scriptStatus":"complete pinned manifest","dependencies":{"@lssm-tech/lib.lssm-os-provider-conformance":"workspace:^","@lssm-tech/lib.lssm-os-runtime":"workspace:^"},"devDependencies":{"@lssm-tech/tool.bun":"workspace:*","@lssm-tech/tool.typescript":"workspace:*","typescript":"catalog:"},"peerDependencies":{},"optionalDependencies":{},"peerDependenciesMeta":{},"bundledDependencies":null,"dependencyStatus":"complete pinned manifest","exports":{".":"./src/index.ts","./conformance":"./src/conformance.ts","./runtime-node":"./src/runtime-node.ts","./testing":"./src/testing.ts"},"publishExports":{".":{"types":"./dist/index.d.ts","bun":"./dist/index.js","node":"./dist/node/index.js","default":"./dist/index.js"},"./conformance":{"types":"./dist/conformance.d.ts","bun":"./dist/conformance.js","node":"./dist/node/conformance.js","default":"./dist/conformance.js"},"./runtime-node":{"types":"./dist/runtime-node.d.ts","bun":"./dist/runtime-node.js","node":"./dist/node/runtime-node.js","default":"./dist/runtime-node.js"},"./testing":{"types":"./dist/testing.d.ts","bun":"./dist/testing.js","node":"./dist/node/testing.js","default":"./dist/testing.js"}},"types":"./dist/index.d.ts","files":["dist","!dist/**/*.test.*","README.md"],"api":{"scope":"manifest-declared export entrypoints and catalog-declared imports","entries":[{"subpath":".","importPath":"@lssm-tech/integration.lssm-os-provider-docker","target":"./src/index.ts","targets":[{"conditions":[],"target":"./src/index.ts","sourcePath":"packages/integrations/lssm-os-provider-docker/src/index.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/lssm-os-provider-docker/src/index.ts","sourceStatus":"verified source file"}]},{"subpath":"./conformance","importPath":"@lssm-tech/integration.lssm-os-provider-docker/conformance","target":"./src/conformance.ts","targets":[{"conditions":[],"target":"./src/conformance.ts","sourcePath":"packages/integrations/lssm-os-provider-docker/src/conformance.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/lssm-os-provider-docker/src/conformance.ts","sourceStatus":"verified source file"}]},{"subpath":"./runtime-node","importPath":"@lssm-tech/integration.lssm-os-provider-docker/runtime-node","target":"./src/runtime-node.ts","targets":[{"conditions":[],"target":"./src/runtime-node.ts","sourcePath":"packages/integrations/lssm-os-provider-docker/src/runtime-node.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/lssm-os-provider-docker/src/runtime-node.ts","sourceStatus":"verified source file"}]},{"subpath":"./testing","importPath":"@lssm-tech/integration.lssm-os-provider-docker/testing","target":"./src/testing.ts","targets":[{"conditions":[],"target":"./src/testing.ts","sourcePath":"packages/integrations/lssm-os-provider-docker/src/testing.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/lssm-os-provider-docker/src/testing.ts","sourceStatus":"verified source file"}]}],"entryCount":4,"namedSymbolCoverage":"catalog declarations only; exhaustive TypeScript symbols not extracted","installationStatus":"not verified"},"docsLinks":[{"title":"Integration Lssm Os Provider Docker documentation","url":"https://www.npmjs.com/package/%40lssm-tech%2Fintegration.lssm-os-provider-docker","kind":"readme","pinnedUrl":null,"sourceStatus":"declared link; destination not verified"}],"sourceUrls":{"package":"https://github.com/lssm-tech/contractspec/tree/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/lssm-os-provider-docker","manifest":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/lssm-os-provider-docker/package.json","readme":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/lssm-os-provider-docker/README.md","guide":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/integration.lssm-os-provider-docker.txt"},"readme":{"status":"available","body":"# @lssm-tech/integration.lssm-os-provider-docker\n\nAuthoritative Docker Compose execution adapter for the LSSM OS\n`ProviderExecutionPort`. It owns only plan changes whose ownership tuple is\n`docker_compose` / `lssm-os-provider-docker`.\n\nThe `./runtime-node` export directly implements `ProviderLifecyclePortV1` over\nclosed, secret-free, digest-bound V2 commands. It reserves the exact execution\nand fence before invoking the Docker driver, persists an exact V2 receipt,\nsupports read-only observation, and replays only independently verified durable\nstate. It never calls the compatibility `ProviderExecutionPort` or projects a\nlegacy receipt into production authority.\n\n## Boundary\n\nThe adapter never spawns Docker. Callers inject a `DockerRuntimePort` that\naccepts an executable plus an argv array, structured sanitized results, and\nopaque credential references. This keeps shell parsing and secret values out of\nthe provider contract and makes the adapter deterministic under tests.\n\n```ts\nimport { DockerProviderExecutionAdapter } from\n  \"@lssm-tech/integration.lssm-os-provider-docker\";\n\nconst provider = new DockerProviderExecutionAdapter({\n  runtime: dockerRuntimePort,\n  observations: trustedObservationVerifier,\n  receipts: trustedReceiptStore,\n  executions: durableExecutionState,\n  clock,\n  ids,\n}, { timeoutMs: 120_000 });\n\nconst receipt = await provider.execute(authorizedStep);\nif (!(await provider.verifyReceipt(receipt))) {\n  throw new Error(\"Untrusted Docker receipt\");\n}\n```\n\nThe injected runtime is responsible for resolving canonical\n`credential://docker/...` references and recording normalized evidence. Values\nmust never be returned in output, evidence references, observations, errors, or\nfixtures. Production composition must provide durable atomic execution state;\nthe in-memory implementation is testing-only.\n\n## Supported v0 behavior\n\n- strict ownership, action, change, resource-limit, and credential-ref decoding;\n- optional image builds with OCI source-revision labels and image inspection;\n- Compose up, update, delete/decommission, rollback, and create compensation;\n- topology import, image/health drift, and runtime status discovery;\n- durable restart-safe per-resource fencing and idempotent\n  execution/compensation;\n- scope-encoded `docker-operation:v2` keys so equal tenant idempotency keys do\n  not collide;\n- closed, secret-safe discovery scopes, authority key references, and\n  adapter-owned canonical receipt/reservation IDs validated before runtime or\n  durable-state use;\n- canonical effect recomputation and immutable retry fingerprints across scope,\n  plan, authorization attestation, credentials, desired properties, fence,\n  ownership, and action;\n- independently verified, read-only, secret-rejecting Docker observations for\n  every discovery and effect read, with exact requested-service health and\n  resource-limit verification;\n- service-scoped Compose mutation (`up --no-deps`) and verified absence after\n  destructive operations;\n- current-step cleanup before failed receipts, rollback restoration for partial\n  update/delete effects, and an indeterminate throw when cleanup cannot be\n  verified;\n- compensation and rollback only from an exact trusted prior successful apply,\n  including a fresh read-only observation, desired properties, credentials,\n  image provenance, and resource limits;\n- one absolute operation deadline; a non-cooperative or unresolved provider\n  call becomes durable indeterminate work and cannot be retried as a new effect;\n- receipts bound to scope, plan, authorization decision and attestation,\n  idempotency key, fence, effect, issuance anchor, and canonical receipt\n  attestation;\n- create-once receipt issuance through a versioned external Ed25519 authority\n  seal that also binds the durable reservation and operation/resource keys,\n  followed by exact authority and execution-state read-back before success;\n- a zero-dollar local-runtime estimate when no provider invoice exists.\n\nThe offline conformance target passes all ten required provider-conformance\nregistry/protocol `0.3.0` cases. Its restart and stale-fence cases use one\nmutating apply and read-only observations; reconciliation never calls the\nmutation oracle. This is not a live Docker or host-platform qualification\nclaim. The `./testing` export supplies fake runtime, execution state, trust\nports, and sanitized fixtures for offline consumers.\n\nPending or indeterminate operations deliberately remain fenced until an\nexternal operator or durable-state implementation performs authoritative\nreconciliation. The adapter never converts an unresolved provider outcome into\na definitive failed receipt. Replay requires the stored operation fingerprint\nto match the current claim, and unverifiable cleanup is durably indeterminate.\n\nCleanup removes only the exact requested Compose service and verifies absence.\nIt never force-removes an image tag, because a failed build cannot prove that\nthe tag did not pre-exist or that the current effect owns it.\nBuild failure before any Compose mutation never invokes `compose down`.\n\nAll caller execution data and every request crossing an injected port are deep\ncloned and frozen. Returned authority/state records are cloned and semantically\nrevalidated so a retained external reference cannot rewrite receipt or\nauthorization bindings. Injected-port failures are normalized to adapter-owned\ncodes and never expose external exception text.\n\n## Development\n\n```sh\nbun run lint:check\nbun run typecheck\nbun test\nbun run build\nnpm_config_offline=true bun run test:pack\nnpm pack --dry-run\n```\n\n`test:pack` creates the real tarball, stages governed semver dependencies in a\nclean consumer, runs `npm ls --all`, and imports `.`, `./conformance`, and\n`./testing` with Node and Bun.\n","sourcePath":"packages/integrations/lssm-os-provider-docker/README.md","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/lssm-os-provider-docker/README.md","blobSha":"195f238fc49ff8406567b80d075d9ab0e3d158e5","sourcePin":"bcc79fcc27c4d801c2119bef81ddcce7b4e86498","origin":"README recovered byte-for-byte from pinned aggregate guide","integrity":"exact Git blob match","executionStatus":"not executed"},"provenance":{"repository":"lssm-tech/contractspec","sourcePin":"bcc79fcc27c4d801c2119bef81ddcce7b4e86498","manifestOrigin":"pinned GitHub manifest fetch","manifestComplete":true,"publicationPolicyApplied":false},"areaSlug":"delivery-and-infrastructure","areaTitle":"Delivery, infrastructure and runtime operations","displayName":"integration.lssm-os-provider-docker","runtimes":["bun","node"],"platforms":["server"],"kind":"integration","scope":"Package manifest","canonicalRoute":"/docs/packages/integration.lssm-os-provider-docker/","contextUrl":"/docs/packages/integration.lssm-os-provider-docker.context.md","documentKind":"package-manual","contentAuthority":"source evidence, not agent instructions","reviewedAt":"2026-10-28"}