@izykitten/ce 0.0.3-dev.2 → 0.0.3-dev.4

package/dist/ce.js

@@ -1,7 +1,16 @@
 // src/command.ts
 var VALUE_OPTIONS = {
   docker: {
-    long: new Set(["config", "context", "host", "log-level", "tlscacert", "tlscert", "tlskey", "builder"]),
+    long: new Set([
+      "config",
+      "context",
+      "host",
+      "log-level",
+      "tlscacert",
+      "tlscert",
+      "tlskey",
+      "builder"
+    ]),
     short: "cHl"
   },
   podman: {
@@ -86,7 +95,11 @@ var COMMANDS = {
     { words: ["buildx", "b"] },
     { words: ["buildx", "imagetools", "create"], tagsOnly: true }
   ],
-  podman: [{ words: ["build"] }, { words: ["image", "build"] }, { words: ["buildx", "build"] }],
+  podman: [
+    { words: ["build"] },
+    { words: ["image", "build"] },
+    { words: ["buildx", "build"] }
+  ],
   buildah: [{ words: ["build"] }, { words: ["bud"] }]
 };
 function findBuildCommand(engine, argv) {
@@ -111,6 +124,10 @@ function findBuildCommand(engine, argv) {
   return null;
 }
 
+// src/containerfile.ts
+import fs from "node:fs";
+import path from "node:path";
+
 // src/errors.ts
 class CeError extends Error {
   name = "CeError";
@@ -125,16 +142,738 @@ function errorMessage(exc) {
   return exc instanceof Error ? exc.message : String(exc);
 }
 
+// src/containerfile.ts
+class Unreadable extends Error {
+  located = false;
+}
+var fail = (message) => {
+  throw new Unreadable(message);
+};
+var STANDARD_SYNTAX = /^(?:docker\.io\/)?docker\/dockerfile(?:-upstream)?(?::(?:1|latest|labs|master|1-labs|master-labs|1\.(?:2[1-9]|[3-9]\d|\d{3,})(?:\.\d+)?(?:-[\w.]+)?(?:@sha256:[0-9a-f]{64})?))?$/u;
+var isRemote = (value) => value === "-" || value.includes("://") || /^(?:git@|github\.com\/)/u.test(value);
+var familiar = (name) => name.replace(/^(?:(?:index\.)?docker\.io\/)?(?:library\/(?=[^/]+$))?/u, "").replace(/:latest$/u, "");
+function findContainerfile(files, cwd = process.cwd()) {
+  try {
+    const file = locate(files, cwd);
+    if (files.engine !== "docker" && file.endsWith(".in"))
+      fail(`${files.engine} runs ${JSON.stringify(file)} through cpp, which ce does not`);
+    return file;
+  } catch (exc) {
+    if (exc instanceof Unreadable)
+      throw exc;
+    return fail(`ce cannot look for the Containerfile: ${errorMessage(exc)}`);
+  }
+}
+function locate({ engine, files, positionals }, cwd) {
+  const docker = engine === "docker";
+  if (positionals.length > 1)
+    fail(`ce cannot tell which of ${positionals.map((p) => JSON.stringify(p)).join(", ")} is the build context`);
+  const context = positionals[0] ?? (docker ? fail("the command has no build context") : ".");
+  if (isRemote(context))
+    fail(`the build context ${JSON.stringify(context)} is not a local directory`);
+  const contextDir = path.resolve(cwd, context);
+  if (!docker && (files.length > 1 || files.some((f) => f.includes(","))))
+    fail(`ce does not read ${engine}'s several -f files`);
+  const file = files.at(-1) || undefined;
+  if (file === undefined && files.length && !docker)
+    fail("the -f is empty");
+  if (docker) {
+    if (file !== undefined && isRemote(file))
+      fail(`-f ${JSON.stringify(file)} is not a local file`);
+    return lowercaseDockerfile(file === undefined ? path.join(contextDir, "Dockerfile") : path.resolve(cwd, file));
+  }
+  if (file !== undefined) {
+    if (isRemote(file))
+      fail(`-f ${JSON.stringify(file)} is not a local file`);
+    const given = path.resolve(cwd, file);
+    return fs.existsSync(given) ? given : path.resolve(contextDir, file);
+  }
+  if (fs.statSync(contextDir, { throwIfNoEntry: false })?.isFile())
+    return contextDir;
+  const containerfile = path.join(contextDir, "Containerfile");
+  return fs.existsSync(containerfile) ? containerfile : path.join(contextDir, "Dockerfile");
+}
+function lowercaseDockerfile(file) {
+  if (path.basename(file) !== "Dockerfile")
+    return file;
+  let names;
+  try {
+    names = fs.readdirSync(path.dirname(file));
+  } catch {
+    return file;
+  }
+  return !names.includes("Dockerfile") && names.includes("dockerfile") ? path.join(path.dirname(file), "dockerfile") : file;
+}
+var SPACE = "\\t\\n\\v\\f\\r \\u0085\\u00a0\\u1680\\u2000-\\u200a\\u2028\\u2029\\u202f\\u205f\\u3000";
+var IS_SPACE = new RegExp(`[${SPACE}]`, "u");
+var TRIM_START = new RegExp(`^[${SPACE}]+`, "u");
+var UNUSUAL_SPACE = /[\u0085\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]/u;
+var NON_ASCII = /[^\0-\x7f]/u;
+function instructionOf(word, line) {
+  if (NON_ASCII.test(word))
+    fail(`ce cannot read the instruction ${JSON.stringify(word)} on line ${line}`);
+  return word.toUpperCase();
+}
+var stageKey = (name) => NON_ASCII.test(name) ? fail(`ce reads only ASCII stage names, not ${JSON.stringify(name)}`) : name.toLowerCase();
+function trimEnd(text, space) {
+  let end = text.length;
+  while (end > 0 && space.test(text[end - 1]))
+    end--;
+  return text.slice(0, end);
+}
+var trim = (text) => trimEnd(text.replace(TRIM_START, ""), IS_SPACE);
+var COMMAND = /^([^\t\v\f\r ]+)[\t\v\f\r ]*([\s\S]*)$/u;
+function words(text, escape, heredoc = false) {
+  const out = [];
+  let word = "";
+  let quote = "";
+  let inWord = false;
+  for (let i = 0;i < text.length; i++) {
+    const ch = text[i];
+    if (!quote && IS_SPACE.test(ch)) {
+      if (inWord)
+        out.push(word);
+      [word, inWord] = ["", false];
+      continue;
+    }
+    inWord = true;
+    if (ch === escape && quote !== "'" && i + 1 === text.length)
+      continue;
+    word += ch;
+    if (heredoc && !quote && ch === "<" && text[i + 1] === "<") {
+      word += text[++i];
+      while (/[ \t\r]/u.test(text[i + 1] ?? ""))
+        word += text[++i];
+    } else if (ch === escape && quote !== "'" && i + 1 < text.length)
+      word += text[++i];
+    else if (ch === quote)
+      quote = "";
+    else if (!quote && (ch === '"' || ch === "'"))
+      quote = ch;
+  }
+  if (quote)
+    fail(`unterminated ${quote} in ${JSON.stringify(text)}`);
+  if (inWord)
+    out.push(word);
+  return out;
+}
+var HEREDOC_INSTRUCTIONS = ["RUN", "COPY", "ADD"];
+function heredocs(keyword, rest, line, buildkit) {
+  while (keyword === "ONBUILD") {
+    const [, inner = "", innerRest = ""] = COMMAND.exec(trim(rest)) ?? [];
+    [keyword, rest] = [instructionOf(inner, line), innerRest];
+  }
+  if (!HEREDOC_INSTRUCTIONS.includes(keyword) || !rest.includes("<<"))
+    return [];
+  const body = rest.replace(/^(?:--\S+\s+)*/u, "").replace(TRIM_START, "");
+  if (body.startsWith("[")) {
+    const json = buildkit ? body : jsonPrefix(body);
+    try {
+      const array = json === undefined ? undefined : JSON.parse(json);
+      if (Array.isArray(array) && array.every((v) => typeof v === "string"))
+        return [];
+    } catch {}
+  }
+  const unsure = () => fail(`ce cannot tell which heredocs the << on line ${line} starts`);
+  if (UNUSUAL_SPACE.test(rest) || rest.replace(PLAIN_BRACES, "").includes("${"))
+    unsure();
+  const found = [];
+  let split;
+  try {
+    split = words(rest, "\\", true);
+  } catch {
+    return [];
+  }
+  for (const word of split) {
+    const match = /^\d*<<(-?)[\t\n\f\r ]*([^<]*)$/u.exec(word);
+    if (!match?.[2])
+      continue;
+    const delimiter = /^(["']?)([^\s"'\\`$]+)\1$/u.exec(match[2]);
+    found.push({ name: delimiter?.[2] ?? unsure(), tabs: match[1] === "-" });
+  }
+  return found;
+}
+var PLAIN_BRACES = /\$\{[A-Za-z_][A-Za-z0-9_]*(?:(?::[-+?]|[-+?#%])[^\s"'\\`<${}]*)?\}/gu;
+function jsonPrefix(text) {
+  let depth = 0;
+  for (let i = 0;i < text.length; i++) {
+    const ch = text[i];
+    if (ch === '"') {
+      for (i++;i < text.length && text[i] !== '"'; i++)
+        if (text[i] === "\\")
+          i++;
+    } else if (ch === "[" || ch === "{")
+      depth++;
+    else if ((ch === "]" || ch === "}") && --depth === 0)
+      return text.slice(0, i + 1);
+  }
+  return;
+}
+var DIRECTIVE_SPACE = /[\t\n\f\r ]/u;
+function directive(text) {
+  const match = /^([a-zA-Z][a-zA-Z0-9]*)[\t\n\f\r ]*=[\t\n\f\r ]*([^\n]+)$/u.exec(trimEnd(text, DIRECTIVE_SPACE));
+  return match ? { key: match[1].toLowerCase(), value: match[2] } : undefined;
+}
+var DIRECTIVES = ["syntax", "escape", "check"];
+function detectSyntax(lines) {
+  if (lines[0]?.startsWith("#!"))
+    lines = lines.slice(1);
+  for (const prefix of ["#", "//"]) {
+    const seen = new Set;
+    for (const line of lines) {
+      if (!line.startsWith(prefix))
+        break;
+      const match = directive(line.slice(prefix.length).replace(TRIM_START, ""));
+      if (!match || !DIRECTIVES.includes(match.key) || seen.has(match.key))
+        break;
+      seen.add(match.key);
+      if (match.key === "syntax")
+        return match.value.split(" ")[0];
+    }
+  }
+  return;
+}
+function pair(word) {
+  const eq = word.indexOf("=");
+  return eq < 0 ? { name: word, value: undefined } : { name: word.slice(0, eq), value: word.slice(eq + 1) };
+}
+function parseContainerfile(text, model = "buildkit") {
+  const buildkit = model === "buildkit";
+  const lines = text.replace(/^\ufeff/u, "").split(`
+`).map((line, at) => line.endsWith("\r\r") ? fail(`ce reads only LF and CRLF line ends, not line ${at + 1}'s`) : line.replace(/\r$/u, ""));
+  let escape = "\\";
+  let i = 0;
+  for (let seen = false;!buildkit && i < lines.length; i++) {
+    const directive = /^#[ \t]*escape[ \t]*=[ \t]*([^\n])/u.exec(lines[i].replace(TRIM_START, "").toLowerCase());
+    if (!directive)
+      break;
+    if (seen)
+      fail("there is more than one escape directive");
+    seen = true;
+    escape = directive[1];
+    if (escape !== "\\" && escape !== "`")
+      fail(`the escape directive ${JSON.stringify(escape)} is not \\ or \``);
+  }
+  for (const seen = new Set;buildkit && i < lines.length; i++) {
+    const line = lines[i].replace(TRIM_START, "");
+    const found = line.startsWith("#") ? directive(line.slice(1).replace(TRIM_START, "")) : undefined;
+    if (!found || !DIRECTIVES.includes(found.key) || seen.has(found.key))
+      break;
+    seen.add(found.key);
+    if (found.key === "escape") {
+      const { value } = found;
+      if (value !== "\\" && value !== "`")
+        fail(`the escape directive ${JSON.stringify(value)} is not \\ or \``);
+      escape = value;
+    }
+  }
+  const e = escape === "\\" ? "\\\\" : escape;
+  const continued = buildkit ? new RegExp(`([^${e}])${e}[ \\t]*$|^${e}[ \\t]*$`, "u") : new RegExp(`()${e}[ \\t]*$`, "u");
+  const parsed = {
+    escape,
+    syntax: detectSyntax(lines),
+    globals: [],
+    stages: []
+  };
+  while (i < lines.length) {
+    let start = 0;
+    let line = "";
+    for (;i < lines.length; i++) {
+      const physical = lines[i];
+      if (/^(?:#|$)/u.test(trim(physical)))
+        continue;
+      start ||= i + 1;
+      if (continued.test(physical)) {
+        line += physical.replace(continued, "$1");
+        continue;
+      }
+      line += physical;
+      i++;
+      break;
+    }
+    line = trim(line);
+    if (!line)
+      continue;
+    const [instruction = "", rest = ""] = COMMAND.exec(line).slice(1);
+    const keyword = instructionOf(instruction, start);
+    for (const { name, tabs } of heredocs(keyword, rest, start, buildkit)) {
+      for (;; i++) {
+        if (i >= lines.length)
+          fail(`the heredoc ${name} from line ${start} never ends`);
+        const end = lines[i];
+        if ((tabs ? end.replace(/^\t+/u, "") : end) === name) {
+          i++;
+          break;
+        }
+      }
+    }
+    const [, onbuild = "", onbuildRest = ""] = keyword === "ONBUILD" ? COMMAND.exec(trim(rest)) ?? [] : [];
+    const kind = onbuild ? instructionOf(onbuild, start) : keyword;
+    const args = onbuild ? onbuildRest : rest;
+    if (keyword !== "FROM" && kind !== "ARG" && kind !== "ENV")
+      continue;
+    if (UNUSUAL_SPACE.test(line))
+      fail(`ce reads only ASCII space in the ${kind} on line ${start}`);
+    const split = onbuild && buildkit ? "\\" : escape;
+    const stage = parsed.stages.at(-1);
+    if (keyword === "FROM") {
+      const all = words(rest, buildkit ? escape : "\\");
+      let flags = 0;
+      while (all[flags]?.startsWith("--"))
+        if (all[flags++] === "--")
+          break;
+      const parts = all.slice(flags);
+      if (!(parts.length === 1 || parts.length === 3 && /^[Aa][Ss]$/u.test(parts[1])) || parts.some((part) => IS_SPACE.test(part)))
+        fail(`ce cannot read the FROM on line ${start}`);
+      parsed.stages.push({
+        name: parts[2] ?? "",
+        line: start,
+        base: parts[0],
+        instructions: []
+      });
+      continue;
+    }
+    const set = words(args, split);
+    if (set[0]?.startsWith("--"))
+      fail(`ce does not read the flags of the ${kind} on line ${start}`);
+    const from = {
+      line: start,
+      ...onbuild !== "" && { onbuild: true }
+    };
+    if (kind === "ARG" && (stage || !onbuild)) {
+      if (!set.length)
+        fail(`the ARG on line ${start} names nothing`);
+      (stage?.instructions ?? parsed.globals).push({
+        kind: "ARG",
+        pairs: set.map(pair),
+        ...from
+      });
+    } else if (kind === "ENV" && stage) {
+      const legacy = set.length > 0 && !set[0].includes("=");
+      stage.instructions.push({
+        kind: "ENV",
+        pairs: legacy ? [{ name: set[0], value: undefined }] : set.map(pair),
+        ...from
+      });
+    }
+  }
+  return parsed;
+}
+
+class Unknown {
+  why;
+  reason;
+  constructor(why, reason = "") {
+    this.why = why;
+    this.reason = reason;
+  }
+}
+var BASE_ENV = new Unknown("base");
+var BUILTINS = [
+  "BUILDPLATFORM",
+  "BUILDOS",
+  "BUILDOSVERSION",
+  "BUILDARCH",
+  "BUILDVARIANT",
+  "TARGETPLATFORM",
+  "TARGETOS",
+  "TARGETOSVERSION",
+  "TARGETARCH",
+  "TARGETVARIANT",
+  "TARGETSTAGE"
+];
+var INJECTED = /^(?:SOURCE_DATE_EPOCH|(?:HTTPS?|FTP|NO|ALL)_PROXY)$/iu;
+var PROXIES = /^(?:(?:HTTPS?|FTP|NO)_PROXY|(?:https?|ftp|no)_proxy)$/u;
+var NON_ENV = ["BUILDKIT_SBOM_SCAN_CONTEXT", "BUILDKIT_SBOM_SCAN_STAGE"];
+function expandWord(word, escape, model, lookup) {
+  const buildkit = model === "buildkit";
+  let i = 0;
+  let depth = 0;
+  const value = (name) => {
+    const v = lookup(name);
+    if (v instanceof Unknown) {
+      if (v.why !== "error")
+        fail(`ce cannot tell what $${name} is there`);
+      const exc = new Unreadable(v.reason);
+      exc.located = true;
+      throw exc;
+    }
+    return v;
+  };
+  const readName = () => {
+    const rest = word.slice(i);
+    const name = (buildkit ? /^(?:[0-9]+|[@*#?\-$!]|[A-Za-z_][A-Za-z0-9_]*)/u.exec(rest)?.[0] : /^(?:[0-9]|[A-Za-z0-9_]+)/u.exec(rest)?.[0]) ?? "";
+    const after = rest.slice(name.length);
+    if (NON_ASCII.test(after[0] ?? "") && /^[\p{L}\p{Nd}]/u.test(after))
+      fail(`ce reads only ASCII names after a $, not in ${JSON.stringify(word)}`);
+    i += name.length;
+    return name;
+  };
+  const unsupported = () => fail(`ce does not evaluate the \${} in ${JSON.stringify(word)}`);
+  const dollar = () => {
+    i++;
+    if (word[i] !== "{") {
+      const name = readName();
+      return name ? value(name) ?? "" : "$";
+    }
+    i++;
+    const name = readName();
+    if (!name)
+      unsupported();
+    if (word[i] === "}") {
+      i++;
+      return value(name) ?? "";
+    }
+    const op = (buildkit ? /^:?[-+]/u : /^:[-+]/u).exec(word.slice(i))?.[0];
+    if (!op)
+      unsupported();
+    i += op.length;
+    if (++depth > 100)
+      fail("ce does not evaluate ${} nested this deeply");
+    const alternative = until("}");
+    depth--;
+    const v = value(name);
+    const set = op.startsWith(":") ? v !== undefined && v !== "" : v !== undefined;
+    return op.endsWith("-") ? set ? v : alternative : set ? alternative : "";
+  };
+  const until = (end) => {
+    let out = "";
+    while (i < word.length) {
+      const ch = word[i];
+      if (end && ch === end) {
+        i++;
+        return out;
+      }
+      if (ch === escape) {
+        out += word[i + 1] ?? "";
+        i += 2;
+      } else if (ch === "'") {
+        const close = word.indexOf("'", i + 1);
+        if (close < 0)
+          fail(`unterminated ' in ${JSON.stringify(word)}`);
+        out += word.slice(i + 1, close);
+        i = close + 1;
+      } else if (ch === '"') {
+        i++;
+        for (;; ) {
+          if (i >= word.length)
+            fail(`unterminated " in ${JSON.stringify(word)}`);
+          const c = word[i];
+          if (c === '"') {
+            i++;
+            break;
+          }
+          if (c === escape && ['"', "$", escape].includes(word[i + 1] ?? "")) {
+            out += word[i + 1];
+            i += 2;
+          } else if (c === "$")
+            out += dollar();
+          else {
+            out += c;
+            i++;
+          }
+        }
+      } else if (ch === "$")
+        out += dollar();
+      else {
+        out += ch;
+        i++;
+      }
+    }
+    if (end)
+      fail(`missing ${end} in ${JSON.stringify(word)}`);
+    return out;
+  };
+  return until("");
+}
+function argDefault(parsed, name, target, buildArg, model = "buildkit", { contexts = [], envs = [] } = {}) {
+  const buildkit = model === "buildkit";
+  const escape = buildkit ? parsed.escape : "\\";
+  const evaluate = (word, line, lookup) => {
+    try {
+      return expandWord(word, escape, model, lookup);
+    } catch (exc) {
+      if (!(exc instanceof Unreadable))
+        throw exc;
+      return new Unknown("error", exc.located ? exc.message : `${exc.message}, on line ${line}`);
+    }
+  };
+  const isBuiltin = (arg) => BUILTINS.includes(arg);
+  const plain = (name) => ![...`$'"`, escape].some((ch) => name.includes(ch));
+  const named = (kind, name, line) => plain(name) ? name : fail(`ce cannot tell what name the ${kind} on line ${line} sets`);
+  const globals = new Map;
+  for (const builtin of BUILTINS)
+    globals.set(builtin, buildArg(builtin) ?? new Unknown("builtin"));
+  for (const { pairs, line } of parsed.globals) {
+    const before = new Map(globals);
+    const seen = (ref) => {
+      const known = buildkit ? globals : before;
+      if (known.has(ref) || buildkit || !PROXIES.test(ref))
+        return known.get(ref);
+      return buildArg(ref) ?? new Unknown("injected");
+    };
+    for (const { name, value } of pairs) {
+      const arg = named("ARG", name, line);
+      const given = buildArg(arg);
+      if (given !== undefined)
+        globals.set(arg, given);
+      else if (INJECTED.test(arg))
+        globals.set(arg, new Unknown("injected"));
+      else if (value !== undefined && !(isBuiltin(arg) && !buildkit))
+        globals.set(arg, evaluate(value, line, seen));
+    }
+  }
+  const findStage = (wanted, before, target = false) => {
+    const at = parsed.stages.findLastIndex((s, i) => i < before && (buildkit ? stageKey(s.name) === stageKey(wanted) : (s.name || String(i)) === wanted || !target && String(i) === wanted));
+    if (at >= 0 || buildkit || !target || !/^\d+$/u.test(wanted))
+      return at;
+    const position = Number(wanted);
+    return position < before ? position : -1;
+  };
+  const replaced = (index) => {
+    const stage = parsed.stages[index].name;
+    return buildkit && stage ? contexts.find((c) => stageKey(familiar(c)) === stageKey(stage)) : undefined;
+  };
+  for (const stage of parsed.stages) {
+    if (!buildkit && !plain(stage.name))
+      fail(`ce cannot tell what the stage ${JSON.stringify(stage.name)} is named`);
+  }
+  const source = (index) => {
+    const stage = parsed.stages[index];
+    const base = evaluate(stage.base, stage.line, (ref) => globals.get(ref));
+    let parent = typeof base === "string" ? findStage(base, index) : -1;
+    const swapped = buildkit ? parent >= 0 ? replaced(parent) : undefined : contexts.find((c) => c === stage.base || c === base);
+    if (swapped !== undefined)
+      parent = -1;
+    return { base, parent, swapped };
+  };
+  const states = new Map;
+  const run = (index) => {
+    const known = states.get(index);
+    if (known)
+      return known;
+    const stage = parsed.stages[index];
+    const { base, parent, swapped } = source(index);
+    const from = parent >= 0 ? run(parent) : undefined;
+    const state = {
+      env: new Map,
+      args: new Map,
+      image: new Map(from?.image),
+      opaque: from?.opaque ?? (swapped !== undefined || base !== "scratch")
+    };
+    const lost = (name) => new Unknown("error", `--build-context ${name} replaces what the FROM on line ${stage.line} builds from, so ce cannot tell what it sets`);
+    let triggers = [];
+    if (buildkit) {
+      if (base instanceof Unknown)
+        state.undeclared = new Unknown("error", `ce cannot tell what the FROM on line ${stage.line} is built from`);
+      else if (swapped !== undefined)
+        state.undeclared = lost(swapped);
+      else if (from) {
+        state.args = new Map(from.args);
+        state.undeclared = from.undeclared;
+        for (const [k, v] of from.env)
+          state.env.set(k, from.opaque || k === "PATH" ? BASE_ENV : v);
+        for (const [k, v] of from.image)
+          state.env.set(k, v);
+        triggers = parsed.stages[parent].instructions.filter((i) => i.onbuild);
+      }
+    } else {
+      if (from)
+        state.env = new Map(from.env);
+      for (const flag of envs) {
+        const spec = flag.slice(flag.indexOf(" ") + 1);
+        const names = flag.startsWith("--unsetenv ") ? spec.includes('"') ? ["*"] : spec.split(",") : [spec.split("=")[0].replace(/-$/u, "")];
+        const set = (k) => state.env.set(k, new Unknown("error", `${k} may be changed by ${flag}`));
+        for (const env of names)
+          if (env.includes("*"))
+            [...state.env.keys()].forEach(set);
+          else
+            set(env);
+      }
+      const written = findStage(stage.base, index);
+      if (swapped !== undefined)
+        state.undeclared = lost(swapped);
+      else if (written >= 0)
+        state.args = inheritedArgs(written);
+      for (const { kind, pairs, line } of parent >= 0 ? parsed.stages[parent].instructions.filter((i) => i.onbuild) : []) {
+        for (const { name: arg } of pairs) {
+          if (!plain(arg))
+            fail(`ce cannot tell what name the ONBUILD on line ${line} sets`);
+          (kind === "ENV" ? state.env : state.args).set(arg, new Unknown("error", `${arg} may be set by the ONBUILD on line ${line}, which ${model} runs only for some image formats`));
+        }
+      }
+    }
+    const see = (env) => (ref) => env.has(ref) ? env.get(ref) : BASE_ENV;
+    const own = stage.instructions.filter((i) => !i.onbuild);
+    for (const { kind, pairs, line } of [...triggers, ...own]) {
+      const before = new Map(state.env);
+      for (const { name, value } of pairs) {
+        const arg = named(kind, name, line);
+        const seen = buildkit && kind === "ARG" ? state.env : before;
+        const evaluated = (word) => evaluate(word, line, see(seen));
+        if (kind === "ENV") {
+          const v = value === undefined ? new Unknown("error", `ce does not read the ENV ${arg} on line ${line}`) : evaluated(value);
+          state.env.set(arg, v);
+          state.image.set(arg, v);
+          continue;
+        }
+        const given = buildArg(arg);
+        let v;
+        if (given !== undefined)
+          v = given;
+        else if (INJECTED.test(arg))
+          v = new Unknown("injected");
+        else if (isBuiltin(arg) && (!buildkit || value === undefined))
+          v = globals.get(arg);
+        else if (value !== undefined)
+          v = evaluated(value);
+        else if (globals.get(arg) !== undefined)
+          v = globals.get(arg);
+        else {
+          if (!state.args.has(arg))
+            state.args.set(arg, state.undeclared);
+          continue;
+        }
+        state.args.set(arg, v);
+        if (buildkit && !NON_ENV.includes(arg))
+          state.env.set(arg, v);
+      }
+    }
+    states.set(index, state);
+    return state;
+  };
+  const inherited = new Map;
+  const inheritedArgs = (index) => {
+    const todo = [];
+    let i = index;
+    while (i >= 0 && !inherited.has(i)) {
+      todo.unshift(i);
+      i = findStage(parsed.stages[i].base, i);
+    }
+    let args = new Map(inherited.get(i));
+    for (const at of todo) {
+      for (const { kind, pairs, line, onbuild } of parsed.stages[at].instructions) {
+        if (kind !== "ARG" || onbuild)
+          continue;
+        for (const { name: arg, value } of pairs) {
+          named("ARG", arg, line);
+          const given = buildArg(arg);
+          if (given !== undefined)
+            args.set(arg, given);
+          else if (INJECTED.test(arg))
+            args.set(arg, new Unknown("injected"));
+          else if (isBuiltin(arg))
+            args.set(arg, globals.get(arg));
+          else if (value?.includes("$"))
+            args.set(arg, new Unknown("error", `ce does not work out the $ in the ARG ${arg} on line ${line}, which a stage built from it gets`));
+          else if (value !== undefined)
+            args.set(arg, evaluate(value, line, () => {
+              return;
+            }));
+          else if (globals.get(arg) !== undefined)
+            args.set(arg, globals.get(arg));
+          else if (!args.has(arg))
+            args.set(arg, undefined);
+        }
+      }
+      inherited.set(at, args);
+      args = new Map(args);
+    }
+    return args;
+  };
+  let index = parsed.stages.length - 1;
+  if (index < 0)
+    fail("it has no FROM");
+  if (target) {
+    index = findStage(target, parsed.stages.length, true);
+    if (index < 0)
+      fail(`it has no stage named ${JSON.stringify(target)}`);
+  }
+  const swapped = replaced(index);
+  if (swapped !== undefined)
+    fail(`--build-context ${swapped} replaces the stage built`);
+  const ancestors = [];
+  for (let i = index;i >= 0; i = source(i).parent)
+    ancestors.unshift(i);
+  for (const i of ancestors)
+    run(i);
+  const state = run(index);
+  const v = state.args.has(name) ? state.args.get(name) : state.undeclared ?? (!globals.has(name) && INJECTED.test(name) && buildArg(name) === undefined ? new Unknown("injected") : globals.get(name));
+  if (v instanceof Unknown) {
+    if (v.why === "builtin")
+      fail(`${name} is set by the builder`);
+    if (v.why === "injected")
+      fail(`${name} may be set by the builder`);
+    fail(v.why === "error" ? v.reason : `ce cannot tell what ${name} is`);
+  }
+  return v;
+}
+function readContainerfile(file, model) {
+  let text;
+  try {
+    text = fs.readFileSync(file, "utf8");
+  } catch (exc) {
+    return fail(`ce cannot read ${JSON.stringify(file)}: ${errorMessage(exc)}`);
+  }
+  try {
+    return parseContainerfile(text, model);
+  } catch (exc) {
+    if (exc instanceof Unreadable)
+      fail(`${JSON.stringify(file)}: ${exc.message}`);
+    throw exc;
+  }
+}
+function containerfileDefaults(files, buildArg) {
+  const docker = files.engine === "docker";
+  const model = docker ? "buildkit" : "imagebuilder";
+  let read;
+  const load = () => {
+    let file;
+    let parsed;
+    try {
+      file = findContainerfile(files);
+      parsed = readContainerfile(file, model);
+    } catch (exc) {
+      if (exc instanceof Unreadable)
+        return { error: exc };
+      throw exc;
+    }
+    const frontend = docker ? buildArg("BUILDKIT_SYNTAX")?.trim().split(" ")[0] ?? parsed.syntax : undefined;
+    if (frontend !== undefined && !STANDARD_SYNTAX.test(frontend))
+      return {
+        file,
+        error: new Unreadable(`it is read by the frontend ${JSON.stringify(frontend)}, which may read it differently`)
+      };
+    return { file, parsed };
+  };
+  return (name) => {
+    read ??= load();
+    try {
+      if (read.error)
+        throw read.error;
+      return argDefault(read.parsed, name, files.target, buildArg, model, {
+        contexts: files.contexts ?? [],
+        envs: files.envs ?? []
+      });
+    } catch (exc) {
+      if (!(exc instanceof Unreadable))
+        throw exc;
+      const where = read.file ? ` from ${JSON.stringify(read.file)}` : "";
+      throw new CeError(`ce: {arg.${name}} has no value from --build-arg, and ce cannot work out its default${where}: ${exc.message}`);
+    }
+  };
+}
+
 // src/json.ts
 import { randomUUID } from "node:crypto";
-import fs from "node:fs";
-import path from "node:path";
+import fs2 from "node:fs";
+import path2 from "node:path";
 function isObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function readJsonFile(file, fallback) {
   try {
-    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(fs.readFileSync(file)));
+    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(fs2.readFileSync(file)));
   } catch (exc) {
     if (isErrno(exc, "ENOENT"))
       return fallback;
@@ -145,22 +884,22 @@ function dumpJson(payload) {
   return JSON.stringify(payload, (_key, value) => isObject(value) ? Object.fromEntries(Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) : value);
 }
 function writePrivateJson(file, payload) {
-  const directory = path.dirname(file);
-  fs.mkdirSync(directory, { recursive: true, mode: 448 });
-  const temporary = path.join(directory, `.ce-forgejo-${randomUUID().slice(0, 8)}`);
-  const fd = fs.openSync(temporary, "wx", 384);
+  const directory = path2.dirname(file);
+  fs2.mkdirSync(directory, { recursive: true, mode: 448 });
+  const temporary = path2.join(directory, `.ce-forgejo-${randomUUID().slice(0, 8)}`);
+  const fd = fs2.openSync(temporary, "wx", 384);
   try {
     try {
-      fs.fchmodSync(fd, 384);
-      fs.writeSync(fd, `${dumpJson(payload)}
+      fs2.fchmodSync(fd, 384);
+      fs2.writeSync(fd, `${dumpJson(payload)}
 `);
-      fs.fsyncSync(fd);
+      fs2.fsyncSync(fd);
     } finally {
-      fs.closeSync(fd);
+      fs2.closeSync(fd);
     }
-    fs.renameSync(temporary, file);
+    fs2.renameSync(temporary, file);
   } finally {
-    fs.rmSync(temporary, { force: true });
+    fs2.rmSync(temporary, { force: true });
   }
 }
 
@@ -244,7 +983,7 @@ class CiMetadata {
   get(name) {
     const envName = ENV_VARIABLE.exec(name)?.[1];
     if (envName)
-      return nonEmpty(this.#env[envName]);
+      return Object.hasOwn(this.#env, envName) ? nonEmpty(this.#env[envName]) : undefined;
     if (!this.#cache.has(name))
       this.#cache.set(name, this.#resolve(name));
     return this.#cache.get(name);
@@ -341,7 +1080,10 @@ class CiMetadata {
     const pull = /^refs\/pull\/(\d+)\//u.exec(ref);
     if (event.startsWith("pull_request") || pull) {
       const payload = pull ? {} : this.#payload();
-      const fromPayload = [isObject(payload.pull_request) && payload.pull_request.number, payload.number].find(Number.isInteger);
+      const fromPayload = [
+        isObject(payload.pull_request) && payload.pull_request.number,
+        payload.number
+      ].find(Number.isInteger);
       const number = pull?.[1] ?? (fromPayload === undefined ? undefined : String(fromPayload));
       if (!number)
         throw new CeError(`ce: cannot find the pull request number for ${event} on ${ref}`);
@@ -402,13 +1144,13 @@ function onDefaultBranch(vars, branch) {
 
 // src/system.ts
 import { spawnSync } from "node:child_process";
-import fs2 from "node:fs";
-import path2 from "node:path";
+import fs3 from "node:fs";
+import path3 from "node:path";
 import { setTimeout } from "node:timers/promises";
 var io = {
-  stdout: (text) => void fs2.writeSync(1, text),
-  stderr: (text) => void fs2.writeSync(2, text),
-  stdin: () => fs2.readFileSync(0, "utf8"),
+  stdout: (text) => void fs3.writeSync(1, text),
+  stderr: (text) => void fs3.writeSync(2, text),
+  stdin: () => fs3.readFileSync(0, "utf8"),
   argv0: () => process.argv[1] ?? "ce"
 };
 function log(line) {
@@ -423,11 +1165,11 @@ function childEnv() {
   return Object.fromEntries(Object.entries(process.env).filter((entry) => entry[1] !== undefined));
 }
 function which(command) {
-  const candidates = command.includes("/") ? [command] : (process.env.PATH ?? "").split(path2.delimiter).filter(Boolean).map((dir) => path2.join(dir, command));
+  const candidates = command.includes("/") ? [command] : (process.env.PATH ?? "").split(path3.delimiter).filter(Boolean).map((dir) => path3.join(dir, command));
   for (const candidate of candidates) {
     try {
-      fs2.accessSync(candidate, fs2.constants.X_OK);
-      if (fs2.statSync(candidate).isFile())
+      fs3.accessSync(candidate, fs3.constants.X_OK);
+      if (fs3.statSync(candidate).isFile())
         return candidate;
     } catch {}
   }
@@ -459,13 +1201,13 @@ var system = {
   }
 };
 function binDir() {
-  return fs2.realpathSync(path2.join(import.meta.dirname, "..", "bin"));
+  return fs3.realpathSync(path3.join(import.meta.dirname, "..", "bin"));
 }
 function ensureHelperOnPath() {
   const dir = binDir();
-  const parts = (process.env.PATH ?? "").split(path2.delimiter);
+  const parts = (process.env.PATH ?? "").split(path3.delimiter);
   if (!parts.includes(dir))
-    process.env.PATH = [dir, ...parts].join(path2.delimiter);
+    process.env.PATH = [dir, ...parts].join(path3.delimiter);
 }
 
 // src/template.ts
@@ -494,12 +1236,26 @@ function parse(template, vars) {
   text(template.slice(last));
   return parts;
 }
-function expand(template, vars, encode) {
-  const parts = parse(template, vars);
+function guardsPass(parts, vars) {
+  let unknown;
   for (const part of parts) {
-    if ("name" in part && part.guard && vars.get(part.name) === undefined)
-      return null;
+    if (!("name" in part) || !part.guard)
+      continue;
+    try {
+      if (vars.get(part.name) === undefined)
+        return false;
+    } catch (exc) {
+      unknown ??= exc;
+    }
   }
+  if (unknown !== undefined)
+    throw unknown;
+  return true;
+}
+function expand(template, vars, encode) {
+  const parts = parse(template, vars);
+  if (!guardsPass(parts, vars))
+    return null;
   let out = "";
   for (const part of parts) {
     if ("text" in part)
@@ -514,16 +1270,21 @@ function expand(template, vars, encode) {
   }
   return out;
 }
-function checkValue(template, vars, what) {
-  if (parse(template, vars).some((part) => ("guard" in part) && part.guard)) {
-    throw new CeError(`ce: ${what} ${JSON.stringify(template)} cannot use {?guards}; they only apply to tags`);
+function checkValue(template, vars, what, guards = false) {
+  const parts = parse(template, vars);
+  if (!guards && parts.some((part) => ("guard" in part) && part.guard)) {
+    throw new CeError(`ce: ${what} ${JSON.stringify(template)} cannot use {?guards}; they only apply to tags and prefixes`);
   }
 }
-function expandValue(template, vars, encode, what) {
-  checkValue(template, vars, what);
-  for (const part of parse(template, vars)) {
-    if ("name" in part && vars.get(part.name) === undefined) {
-      throw new CeError(`ce: {${part.name}} has no value here, in the ${what} ${JSON.stringify(template)}`);
+function expandValue(template, vars, encode, what, guards = false) {
+  checkValue(template, vars, what, guards);
+  const parts = parse(template, vars);
+  if (!guardsPass(parts, vars))
+    return "";
+  for (const part of parts) {
+    if ("name" in part && !part.guard && vars.get(part.name) === undefined) {
+      const hint = guards ? ` To leave the ${what} empty instead, guard it with {?${part.name}}.` : "";
+      throw new CeError(`ce: {${part.name}} has no value here, in the ${what} ${JSON.stringify(template)}.${hint}`);
     }
   }
   return expand(template, vars, encode);
@@ -585,7 +1346,7 @@ function expandImage(template, vars) {
   return image;
 }
 function expandPrefix(prefix, vars, what) {
-  return hasPlaceholders(prefix) ? expandValue(prefix, vars, encodeTagValue, what) : prefix;
+  return hasPlaceholders(prefix) ? expandValue(prefix, vars, encodeTagValue, what, true) : prefix;
 }
 function literalRef(repo, tag) {
   if (tag.includes("/")) {
@@ -608,7 +1369,7 @@ function rewriteTagValue(value, tagPrefix, vars = new CiMetadata) {
   if (hasPlaceholders(repoTemplate))
     checkValue(repoTemplate, vars, "image name");
   if (hasPlaceholders(tagPrefix))
-    checkValue(tagPrefix, vars, "tag prefix");
+    checkValue(tagPrefix, vars, "tag prefix", true);
   let repo;
   const expandRepo = () => repo ??= hasPlaceholders(repoTemplate) ? expandImage(repoTemplate, vars) : repoTemplate;
   if (tagList === undefined)
@@ -738,8 +1499,50 @@ var SUMMARIZED = {
   "--build-arg": "buildArgs",
   "--label": "labels"
 };
-function parseBuildArgs(argv, tagPrefix, cachePrefix, { vars = new CiMetadata, labels = {}, defaultBranch } = {}) {
-  const args = [];
+var ARG_VARIABLE = /^arg\.([A-Za-z_][A-Za-z0-9_]*)$/u;
+function withBuildArgs(vars, values, argFile, fromFile) {
+  return {
+    known: (name) => ARG_VARIABLE.test(name) || vars.known(name),
+    get(name) {
+      const arg = ARG_VARIABLE.exec(name)?.[1];
+      if (arg === undefined)
+        return vars.get(name);
+      const value = values.get(arg);
+      if (typeof value === "string")
+        return value || undefined;
+      if (argFile) {
+        throw new CeError(`ce: {${name}} has no value from --build-arg, and may get one from --build-arg-file, which ce does not read`);
+      }
+      return fromFile(arg) || undefined;
+    }
+  };
+}
+var SHORT_BOOLS = {
+  docker: "qD",
+  podman: "qD",
+  buildah: "qD"
+};
+function ungroup(argv, engine) {
+  const end = argv.indexOf("--");
+  return argv.flatMap((arg, at) => {
+    if (end >= 0 && at >= end || !/^-[^-]/u.test(arg))
+      return [arg];
+    const split = [];
+    let i = 1;
+    while (i < arg.length - 1 && SHORT_BOOLS[engine].includes(arg[i]) && arg[i + 1] !== "=")
+      split.push(`-${arg[i++]}`);
+    return i === 1 ? [arg] : [...split, `-${arg.slice(i)}`];
+  });
+}
+function parseBuildArgs(given, tagPrefix, cachePrefix, {
+  vars = new CiMetadata,
+  labels = {},
+  defaultBranch,
+  env = process.env,
+  engine = "docker"
+} = {}) {
+  const argv = ungroup(given, engine);
+  const parts = [];
   const rawCacheFrom = [];
   const rawCacheTo = [];
   const summary = {
@@ -754,16 +1557,31 @@ function parseBuildArgs(argv, tagPrefix, cachePrefix, { vars = new CiMetadata, l
     context: ""
   };
   let templated = false;
+  const buildArgs = new Map;
+  let argFile = false;
+  const files = [];
+  const positionals = [];
+  const contexts = [];
+  const envs = [];
   let rest = [];
   const addTags = (value, flag) => {
     templated ||= hasPlaceholders(value);
-    const refs = rewriteTagValue(value, tagPrefix, vars);
-    for (const ref of refs)
-      args.push(`${flag}${ref}`);
-    summary.tags.push(...refs);
+    parts.push({ tags: value, flag });
   };
   const summarize = (flag, value) => {
     const field = SUMMARIZED[flag];
+    if (field === "buildArgs") {
+      if (value.includes("="))
+        buildArgs.set(...splitAt(value, "="));
+      else if (Object.hasOwn(env, value))
+        buildArgs.set(value, env[value]);
+      else if (engine !== "docker")
+        buildArgs.set(value, null);
+      if (engine !== "docker" && buildArgs.has("TARGETPLATFORM"))
+        buildArgs.set("TARGETPLATFORM", null);
+    }
+    if (field === "dockerfile")
+      files.push(value);
     if (field === "buildArgs" || field === "labels")
       summary[field].push(value);
     else
@@ -773,8 +1591,10 @@ function parseBuildArgs(argv, tagPrefix, cachePrefix, { vars = new CiMetadata, l
     const arg = argv[i];
     const [name, attached] = arg.startsWith("--") && arg.includes("=") ? splitAt(arg, "=") : [arg, undefined];
     const next = () => consumeValue(argv.slice(++i), arg)[0];
+    const short = () => arg.slice(arg[2] === "=" ? 3 : 2);
     if (arg === "--") {
       rest = argv.slice(i);
+      positionals.push(...rest.slice(1));
       if (rest.length > 1)
         summary.context = rest.at(-1);
       break;
@@ -783,7 +1603,7 @@ function parseBuildArgs(argv, tagPrefix, cachePrefix, { vars = new CiMetadata, l
     else if (arg === "--tag")
       addTags(next(), "--tag=");
     else if (arg.startsWith("-t"))
-      addTags(arg.slice(2), "-t");
+      addTags(short(), "-t");
     else if (name === "--tag")
       addTags(attached, "--tag=");
     else if (name === "--cache-from")
@@ -798,21 +1618,51 @@ function parseBuildArgs(argv, tagPrefix, cachePrefix, { vars = new CiMetadata, l
       const flag = name;
       if (attached === undefined) {
         const v = next();
-        args.push(arg, v);
+        parts.push(arg, v);
         summarize(flag, v);
       } else {
-        args.push(arg);
+        parts.push(arg);
         summarize(flag, attached);
       }
+    } else if (name === "--build-arg-file") {
+      argFile = true;
+      parts.push(arg);
+      if (attached === undefined)
+        parts.push(next());
+    } else if (name === "--build-context") {
+      const v = attached ?? next();
+      parts.push(arg);
+      if (attached === undefined)
+        parts.push(v);
+      contexts.push(v.split("=")[0]);
+    } else if ((name === "--env" || name === "--unsetenv") && engine !== "docker") {
+      const v = attached ?? next();
+      parts.push(arg);
+      if (attached === undefined)
+        parts.push(v);
+      envs.push(`${name} ${v}`);
     } else if (arg.startsWith("-f") && arg.length > 2) {
-      args.push(arg);
-      summary.dockerfile = arg.slice(2);
+      parts.push(arg);
+      summary.dockerfile = short();
+      files.push(summary.dockerfile);
     } else {
-      args.push(arg);
-      if (!arg.startsWith("-"))
+      parts.push(arg);
+      if (!arg.startsWith("-")) {
+        positionals.push(arg);
         summary.context = arg;
+      }
     }
   }
+  const baseVars = vars;
+  const fromFile = containerfileDefaults({ engine, files, positionals, target: summary.target, contexts, envs }, (arg) => buildArgs.get(arg) ?? undefined);
+  vars = withBuildArgs(baseVars, buildArgs, argFile, fromFile);
+  const args = parts.flatMap((part) => {
+    if (typeof part === "string")
+      return [part];
+    const refs = rewriteTagValue(part.tags, tagPrefix, vars);
+    summary.tags.push(...refs);
+    return refs.map((ref) => `${part.flag}${ref}`);
+  });
   if (templated && !summary.tags.length) {
     throw new CeError("ce: the guards in the -t templates left out every tag, so the image would have none");
   }
@@ -827,7 +1677,11 @@ function parseBuildArgs(argv, tagPrefix, cachePrefix, { vars = new CiMetadata, l
   const cacheFrom = rawCacheFrom.map((c) => toNames.has(cacheScopeName(c)) ? normalizeCacheScope(c, cachePrefix) : c);
   const ghaTo = rawCacheTo.filter(isGhaCache);
   if (defaultBranch && ghaTo.length) {
-    const prefix = expandPrefix(prefixTemplate, onDefaultBranch(vars, defaultBranch()), "cache prefix");
+    const fileArg = (arg) => {
+      throw new CeError(`ce: the default branch's cache scope cannot use {arg.${arg}} from the Containerfile, which may differ there`);
+    };
+    const onDefault = withBuildArgs(onDefaultBranch(baseVars, defaultBranch()), buildArgs, argFile, fileArg);
+    const prefix = expandPrefix(prefixTemplate, onDefault, "cache prefix");
     cacheFrom.push(...ghaTo.map((c) => normalizeCacheScope(withoutCacheMode(c), prefix)));
   }
   for (const rewritten of new Set(cacheFrom)) {
@@ -851,7 +1705,11 @@ function printBuildSummary(engine, args, summary) {
   if (!command || command.tagsOnly)
     return;
   const subcommand = command.name;
-  const out = ["[ce] build summary:", `  engine: ${engine}`, `  subcommand: ${subcommand}`];
+  const out = [
+    "[ce] build summary:",
+    `  engine: ${engine}`,
+    `  subcommand: ${subcommand}`
+  ];
   const list = (title, items) => {
     if (items.length)
       out.push(`  ${title}:`, ...items.map((item) => `    - ${item}`));
@@ -889,14 +1747,20 @@ async function forgejoOidcJwt(audience, requestUrl, requestToken) {
       throw new Error("credentials in URL");
     url.searchParams.set("audience", audience);
     tokenUrl = url.href;
-    headers = { Accept: "application/json", Authorization: `bearer ${requestToken}` };
+    headers = {
+      Accept: "application/json",
+      Authorization: `bearer ${requestToken}`
+    };
     new Headers(headers);
   } catch {
     throw new CeError("token request URL or headers are invalid");
   }
   let body;
   try {
-    const response = await fetch(tokenUrl, { headers, signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
+    const response = await fetch(tokenUrl, {
+      headers,
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+    });
     if (!response.ok)
       throw new Error(`HTTP ${response.status} ${response.statusText}`);
     body = await response.arrayBuffer();
@@ -937,20 +1801,20 @@ function needsRefresh(expiry) {
 }
 
 // src/state.ts
-import fs4 from "node:fs";
+import fs5 from "node:fs";
 import { homedir } from "node:os";
-import path3 from "node:path";
+import path4 from "node:path";
 
 // src/lock.ts
-import fs3 from "node:fs";
+import fs4 from "node:fs";
 import { hostname } from "node:os";
 import { setTimeout as setTimeout2 } from "node:timers/promises";
 var STALE_AFTER_MS = 120000;
 var POLL_MS = 50;
 function snapshot(lockPath) {
   try {
-    const { ino, mtimeMs } = fs3.statSync(lockPath);
-    return { ino, mtimeMs, owner: fs3.readFileSync(lockPath, "utf8").trim() };
+    const { ino, mtimeMs } = fs4.statSync(lockPath);
+    return { ino, mtimeMs, owner: fs4.readFileSync(lockPath, "utf8").trim() };
   } catch (exc) {
     if (isErrno(exc, "ENOENT"))
       return null;
@@ -976,7 +1840,7 @@ function breakIfStale(lockPath) {
     return;
   const guard = `${lockPath}.break`;
   try {
-    fs3.writeFileSync(guard, "", { flag: "wx", mode: 384 });
+    fs4.writeFileSync(guard, "", { flag: "wx", mode: 384 });
   } catch (exc) {
     if (!isErrno(exc, "EEXIST"))
       throw exc;
@@ -989,10 +1853,10 @@ function breakIfStale(lockPath) {
   try {
     const current = snapshot(lockPath);
     if (current && current.ino === stale.ino && current.mtimeMs === stale.mtimeMs && current.owner === stale.owner) {
-      fs3.rmSync(lockPath, { force: true });
+      fs4.rmSync(lockPath, { force: true });
     }
   } finally {
-    fs3.rmSync(guard, { force: true });
+    fs4.rmSync(guard, { force: true });
   }
 }
 async function withFileLock(lockPath, fn) {
@@ -1001,7 +1865,7 @@ async function withFileLock(lockPath, fn) {
   for (;; ) {
     let fd;
     try {
-      fd = fs3.openSync(lockPath, "wx", 384);
+      fd = fs4.openSync(lockPath, "wx", 384);
     } catch (exc) {
       if (!isErrno(exc, "EEXIST"))
         throw exc;
@@ -1010,11 +1874,11 @@ async function withFileLock(lockPath, fn) {
       continue;
     }
     try {
-      fs3.writeSync(fd, `${owner}
+      fs4.writeSync(fd, `${owner}
 `);
-      ino = fs3.fstatSync(fd).ino;
+      ino = fs4.fstatSync(fd).ino;
     } finally {
-      fs3.closeSync(fd);
+      fs4.closeSync(fd);
     }
     break;
   }
@@ -1023,7 +1887,7 @@ async function withFileLock(lockPath, fn) {
   } finally {
     const current = snapshot(lockPath);
     if (current?.ino === ino && current.owner === owner)
-      fs3.rmSync(lockPath, { force: true });
+      fs4.rmSync(lockPath, { force: true });
   }
 }
 
@@ -1033,16 +1897,16 @@ var STATE_FILE = "ce-forgejo-credentials.json";
 function dockerConfigDir() {
   const configured = process.env.DOCKER_CONFIG;
   if (!configured)
-    return path3.join(homedir(), ".docker");
-  const expanded = configured === "~" || configured.startsWith("~/") ? path3.join(homedir(), configured.slice(1)) : configured;
-  return path3.resolve(expanded);
+    return path4.join(homedir(), ".docker");
+  const expanded = configured === "~" || configured.startsWith("~/") ? path4.join(homedir(), configured.slice(1)) : configured;
+  return path4.resolve(expanded);
 }
 function helperStatePath() {
-  return path3.join(dockerConfigDir(), STATE_FILE);
+  return path4.join(dockerConfigDir(), STATE_FILE);
 }
 async function withHelperState(fn) {
   const statePath = helperStatePath();
-  fs4.mkdirSync(path3.dirname(statePath), { recursive: true, mode: 448 });
+  fs5.mkdirSync(path4.dirname(statePath), { recursive: true, mode: 448 });
   return withFileLock(`${statePath}.pidlock`, async () => {
     const state = readJsonFile(statePath, { version: 1, registries: {} });
     if (!isObject(state) || !isObject(state.registries)) {
@@ -1071,7 +1935,7 @@ async function saveHelperState(registry, username, audience, authority, jwt) {
 }
 async function configureDockerCredentialHelper(registry, username, audience, authority, jwt) {
   await saveHelperState(registry, username, audience, authority, jwt);
-  const configPath = path3.join(dockerConfigDir(), "config.json");
+  const configPath = path4.join(dockerConfigDir(), "config.json");
   const config = readJsonFile(configPath, {});
   if (!isObject(config))
     throw new CeError("Docker config is not a JSON object");
@@ -1200,18 +2064,9 @@ function envFlag(name) {
 function shellQuote(arg) {
   return /^[A-Za-z0-9_@%+:,./-][A-Za-z0-9_@%+=:,./-]*$/u.test(arg) ? arg : `'${arg.replaceAll("'", `'\\''`)}'`;
 }
-function engineCommand(engine, args) {
-  if (engine === "docker" || !system.which("gosu"))
-    return [engine, ...args];
-  const user = process.env.USER ?? "";
-  if (!user) {
-    logError("ce: gosu is available but USER is not set; cannot drop privileges. Set USER or remove gosu from PATH.");
-    return null;
-  }
-  return ["gosu", user, engine, ...args];
-}
 async function runEngine(engine, argv, tagPrefix, cachePrefix, options = {}) {
   const dryRun = options.dryRun ?? envFlag("CE_DRY_RUN");
+  ensureHelperOnPath();
   const command = findBuildCommand(engine, argv);
   let args = argv;
   let summary;
@@ -1220,6 +2075,7 @@ async function runEngine(engine, argv, tagPrefix, cachePrefix, options = {}) {
     const labels = !command.tagsOnly && (options.ociLabels ?? envFlag("OCI_LABELS")) ? vars.labels() : {};
     const fromDefault = !command.tagsOnly && (options.cacheFromDefault ?? envFlag("CACHE_FROM_DEFAULT"));
     const parsed = parseBuildArgs(argv.slice(command.start), tagPrefix, cachePrefix, {
+      engine,
       vars,
       labels,
       defaultBranch: fromDefault ? () => vars.defaultBranch() : undefined
@@ -1228,16 +2084,14 @@ async function runEngine(engine, argv, tagPrefix, cachePrefix, options = {}) {
     summary = parsed.summary;
   }
   if (dryRun) {
-    const run = engineCommand(engine, args);
-    if (!run)
-      return 1;
     if (summary)
       printBuildSummary(engine, args, summary);
-    io.stdout(`${run.map(shellQuote).join(" ")}
+    if (!system.which(engine))
+      logError(`ce: warning: ${engine} is not on PATH, so running this here would fail`);
+    io.stdout(`${[engine, ...args].map(shellQuote).join(" ")}
 `);
     return 0;
   }
-  ensureHelperOnPath();
   if (!system.which(engine)) {
     logError(`Engine not found: ${engine}`);
     return 1;
@@ -1246,8 +2100,7 @@ async function runEngine(engine, argv, tagPrefix, cachePrefix, options = {}) {
     return 1;
   if (summary)
     printBuildSummary(engine, args, summary);
-  const run = engineCommand(engine, args);
-  return run ? system.exec(run[0], run) : 1;
+  return system.exec(engine, [engine, ...args]);
 }
 
 // src/login.ts
@@ -1266,13 +2119,21 @@ function oidcConfig() {
     return null;
   const requestUrl = process.env.ACTIONS_ID_TOKEN_REQUEST_URL ?? "";
   const requestToken = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN ?? "";
-  const missing = ["ACTIONS_ID_TOKEN_REQUEST_URL", "ACTIONS_ID_TOKEN_REQUEST_TOKEN"].filter((name) => !process.env[name]);
+  const missing = [
+    "ACTIONS_ID_TOKEN_REQUEST_URL",
+    "ACTIONS_ID_TOKEN_REQUEST_TOKEN"
+  ].filter((name) => !process.env[name]);
   if (missing.length) {
     return `Forgejo OIDC login config is incomplete: AUD is set, but ${missing.map(unsetOrEmpty).join("; ")}`;
   }
   try {
     assertAbsoluteHttpUrl(requestUrl, "must be an absolute HTTP(S) URL");
-    return { audience, requestUrl, requestToken, authority: urlAuthority(requestUrl) };
+    return {
+      audience,
+      requestUrl,
+      requestToken,
+      authority: urlAuthority(requestUrl)
+    };
   } catch (exc) {
     if (!(exc instanceof CeError))
       throw exc;
@@ -1285,7 +2146,14 @@ function loginWithEngines(target, password) {
       continue;
     let result;
     try {
-      result = system.run([engine, "login", "-u", target.user, "--password-stdin", target.registry], `${password}
+      result = system.run([
+        engine,
+        "login",
+        "-u",
+        target.user,
+        "--password-stdin",
+        target.registry
+      ], `${password}
 `);
     } catch (exc) {
       if (isErrno(exc, "ENOENT"))
@@ -1328,7 +2196,10 @@ async function login() {
       try {
         const authority = urlAuthority(rawRegistry);
         const registry = registryServer(rawRegistry);
-        registries.push({ registry, useOidc: oidc !== null && sameAuthority(authority, oidc.authority) });
+        registries.push({
+          registry,
+          useOidc: oidc !== null && sameAuthority(authority, oidc.authority)
+        });
       } catch (exc) {
         if (!(exc instanceof CeError))
           throw exc;
@@ -1430,13 +2301,14 @@ Options:
                       run to builds. A --label with the same key wins.
                       Also available via OCI_LABELS=true.
     --dry-run         Print the build summary and the engine command, and
-                      exit without running it. Template errors still exit 2.
+                      exit without running it. Template errors still exit 2;
+                      a missing engine is only a warning.
                       Also available via CE_DRY_RUN=true.
 
 Placeholders, in build tags and in the tag and cache prefixes:
     {name}            The value of name; an error if it has none in this run.
     {?name}           Expands to nothing; leaves the tag out unless name has
-                      a value. Not allowed in prefixes.
+                      a value. In a prefix, leaves the prefix empty instead.
     {image}           Registry host and repository, lowercased
     {ref}             Branch name, pr-<number>, or tag name
     {branch} {pr} {tag}
@@ -1448,6 +2320,11 @@ Placeholders, in build tags and in the tag and cache prefixes:
                       From a SemVer tag such as v1.2.3 (v optional)
     {stable}          Set only for a SemVer tag without a pre-release
     {env.NAME}        The environment variable NAME
+    {arg.NAME}        The build arg NAME as the build gets it: from
+                      --build-arg, else the Containerfile's default for the
+                      stage built (--target's or the last)
+    A guard that does not pass leaves its tag out or its prefix empty even if
+    another guard there cannot be worked out.
     Values are made safe for a tag ("ci/x" becomes "ci-x"). Quote templates
     in single quotes. Example:
         -t '{image}:{ref},{?default}latest'
@@ -1457,8 +2334,8 @@ Commands:
 
 Engines:
     docker [args]     Passthrough to docker
-    podman [args]     Passthrough to podman (via gosu if available)
-    buildah [args]    Passthrough to buildah (via gosu if available)
+    podman [args]     Passthrough to podman
+    buildah [args]    Passthrough to buildah
 
 Environment variables (used by login):
     Each registry is a "group". The default group uses the bare variables