@rakay-technology/kraft 0.7.4

package/dist/chunk-N4OALTFK.js

@@ -0,0 +1,295 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  formatDuration,
+  isRemoteConnectionError,
+  systemDebug
+} from "./chunk-3CJLKL6E.js";
+import {
+  safeErrorMessage,
+  shellQuote
+} from "./chunk-PVOWHIND.js";
+
+// ../../packages/adapters/src/system/probe-exec.ts
+async function tryExec(executor, command, opts) {
+  try {
+    return opts ? await executor.exec(command, opts) : await executor.exec(command);
+  } catch {
+    return null;
+  }
+}
+async function probeExec(executor, command, scope) {
+  const startedAt = Date.now();
+  systemDebug(scope, `exec:start ${command}`);
+  try {
+    const result = await executor.exec(command, { timeout: 1e4 });
+    systemDebug(scope, `exec:ok ${command} (${formatDuration(startedAt)})`);
+    return { output: result.trim(), error: null };
+  } catch (err) {
+    const msg = safeErrorMessage(err);
+    if (isRemoteConnectionError(err)) {
+      systemDebug(
+        scope,
+        `exec:abort ${command} (${formatDuration(startedAt)}) ${msg}`
+      );
+      throw err;
+    }
+    systemDebug(
+      scope,
+      `exec:fail ${command} (${formatDuration(startedAt)}) ${msg}`
+    );
+    return { output: "", error: msg || `\`${command}\` failed` };
+  }
+}
+function looksPrivileged(error) {
+  return /you (must|need to) be root|permission denied|\beacces\b|operation not permitted/i.test(
+    error
+  );
+}
+async function probeExecElevated(executor, command, scope) {
+  const first = await probeExec(executor, command, scope);
+  if (!first.error || !looksPrivileged(first.error)) return first;
+  const elevated = await probeExec(executor, `sudo -n ${command}`, scope);
+  if (!elevated.error) return elevated;
+  return {
+    output: elevated.output,
+    error: `${first.error} \u2014 sudo -n also failed: ${elevated.error}`
+  };
+}
+function withReason(message, error) {
+  if (!error) return message;
+  const first = error.split("\n").map((line) => line.trim()).find(Boolean);
+  if (!first) return message;
+  return `${message} \u2014 ${first.length > 200 ? `${first.slice(0, 199)}\u2026` : first}`;
+}
+
+// ../../packages/adapters/src/infra/mail-container.ts
+var MAIL_HOST_STATE_DIR = "/var/lib/kraft/mail";
+var MAIL_CONTAINER_MOUNTS = [
+  { host: `${MAIL_HOST_STATE_DIR}/vmail`, container: "/var/vmail" },
+  // The Postfix queue. A recreate on an ephemeral layer would drop in-flight and
+  // deferred mail without this — keep it on the host.
+  { host: `${MAIL_HOST_STATE_DIR}/spool`, container: "/var/spool/postfix" },
+  // DKIM private keys. NEVER baked, never regenerated on pull — a fresh selector
+  // breaks DMARC until DNS repropagates.
+  { host: `${MAIL_HOST_STATE_DIR}/dkim`, container: "/var/lib/dkim" },
+  // Mutable daemon config the admin layer edits (sasl_passwd, relayhost maps,
+  // amavis 50-user). Seeded from baked defaults on first boot.
+  {
+    host: `${MAIL_HOST_STATE_DIR}/config/postfix`,
+    container: "/etc/postfix",
+    seed: true
+  },
+  {
+    host: `${MAIL_HOST_STATE_DIR}/config/dovecot`,
+    container: "/etc/dovecot",
+    seed: true
+  },
+  {
+    host: `${MAIL_HOST_STATE_DIR}/config/amavis`,
+    container: "/etc/amavis/conf.d",
+    seed: true
+  },
+  // ClamAV signatures — bind-mounted so a pull doesn't force a multi-hundred-MB
+  // freshclam re-download and delay readiness. `seed: true` because that same mount
+  // HIDES the database baked into the image: with nothing copying it across, clamd
+  // finds an empty database directory and exits (issue #565).
+  {
+    host: `${MAIL_HOST_STATE_DIR}/clamav`,
+    container: "/var/lib/clamav",
+    seed: true
+  },
+  { host: "/etc/letsencrypt", container: "/etc/letsencrypt", readonly: true }
+];
+var MAIL_DB_HOST_DATA_DIR = `${MAIL_HOST_STATE_DIR}/pgdata`;
+var MAIL_DB_CONTAINER_DATA_DIR = "/var/lib/postgresql/data";
+var MAIL_DB_PGDATA = `${MAIL_DB_CONTAINER_DATA_DIR}/pgdata`;
+var MAIL_HOST_PATHS = {
+  saslPasswd: `${MAIL_HOST_STATE_DIR}/config/postfix/sasl_passwd`,
+  senderRelayhost: `${MAIL_HOST_STATE_DIR}/config/postfix/sender_relayhost`,
+  // Per-nexthop TLS policy. Only split ("selected"-scope) relaying writes it: the
+  // relay hop must be `encrypt` so SASL credentials never cross a plaintext
+  // connection, while direct-to-MX delivery for the un-relayed domains stays
+  // opportunistic. A GLOBAL smtp_tls_security_level can't express both.
+  relayTlsPolicy: `${MAIL_HOST_STATE_DIR}/config/postfix/kraft_tls_policy`,
+  amavisUserConf: `${MAIL_HOST_STATE_DIR}/config/amavis/50-user`
+};
+
+// ../../packages/adapters/src/system/port-owner.ts
+var KRAFT_LABEL = {
+  project: "kraft.project",
+  deployment: "kraft.deployment",
+  service: "kraft.service",
+  build: "kraft.build"
+};
+var PS_FIELDS = [
+  "{{.ID}}",
+  "{{.Names}}",
+  "{{.Image}}",
+  `{{.Label "${KRAFT_LABEL.project}"}}`,
+  `{{.Label "${KRAFT_LABEL.deployment}"}}`,
+  `{{.Label "${KRAFT_LABEL.service}"}}`,
+  `{{.Label "${KRAFT_LABEL.build}"}}`,
+  '{{.Label "com.docker.compose.project"}}',
+  '{{.Label "com.docker.compose.service"}}'
+];
+var PS_FORMAT = PS_FIELDS.join("\\t");
+function parsePsLines(out) {
+  const containers = [];
+  for (const line of out.split("\n")) {
+    if (!line.trim()) continue;
+    const f = line.split("	");
+    const id = f[0]?.trim();
+    const name = f[1]?.trim();
+    if (!id || !name || !/^[0-9a-f]{12,64}$/i.test(id)) continue;
+    containers.push({
+      id,
+      name: name.replace(/^\//, ""),
+      image: f[2]?.trim() ?? "",
+      ...f[3]?.trim() ? { projectId: f[3].trim() } : {},
+      ...f[4]?.trim() ? { deploymentId: f[4].trim() } : {},
+      ...f[5]?.trim() ? { serviceName: f[5].trim() } : {},
+      ...f[6]?.trim() ? { buildSessionId: f[6].trim() } : {},
+      ...f[7]?.trim() ? { composeProject: f[7].trim() } : {},
+      ...f[8]?.trim() ? { composeService: f[8].trim() } : {}
+    });
+  }
+  return containers;
+}
+async function queryContainers(executor, filter) {
+  const out = await tryExec(
+    executor,
+    `docker ps --no-trunc --filter ${filter} --format '${PS_FORMAT}' 2>/dev/null`
+  );
+  return out === null ? null : parsePsLines(out);
+}
+async function resolveContainerPublishingPort(executor, port) {
+  if (!Number.isInteger(port) || port < 1 || port > 65535)
+    return { kind: "unknown" };
+  const containers = await queryContainers(executor, `publish=${port}`);
+  if (containers === null) return { kind: "unknown" };
+  if (containers.length === 0) return { kind: "none" };
+  if (containers.length === 1)
+    return { kind: "one", container: containers[0] };
+  return { kind: "ambiguous", containers };
+}
+function containerIdFromCgroup(cgroup) {
+  const match = cgroup?.match(/(?:^|[^0-9a-f])([0-9a-f]{64})(?:[^0-9a-f]|$)/);
+  return match?.[1] ?? null;
+}
+async function stopContainerDurably(executor, ref) {
+  await tryExec(
+    executor,
+    `docker update --restart=no ${shellQuote(ref)} 2>/dev/null || true`
+  );
+  await tryExec(executor, `docker stop ${shellQuote(ref)} 2>/dev/null || true`);
+}
+async function describeContainerById(executor, containerId) {
+  if (!/^[0-9a-f]{12,64}$/i.test(containerId)) return null;
+  const containers = await queryContainers(
+    executor,
+    `id=${shellQuote(containerId)}`
+  );
+  return containers?.[0] ?? null;
+}
+var EDGE_CONTAINER_NAME = "kraft-edge";
+function isOurEdgeContainer(name, image) {
+  return /kraft-edge/i.test(`${name ?? ""} ${image ?? ""}`);
+}
+var PORT_FORWARDER_NAMES = [
+  "docker-proxy",
+  "rootlesskit",
+  "rootlesskit-docker-proxy",
+  "slirp4netns",
+  "pasta",
+  // LXD/Incus publish a container port with `forkproxy`, whose cgroup is the snap's
+  // daemon unit — the same misattribution with a different daemon.
+  "forkproxy"
+];
+function isContainerPortForwarder(command) {
+  const argv0 = command?.trim().split(/\s+/)[0];
+  if (!argv0) return false;
+  const base = argv0.replace(/.*\//, "");
+  return PORT_FORWARDER_NAMES.some(
+    (name) => base === name || base.startsWith(`${name}-`) || base.length >= 15 && name.startsWith(base)
+  );
+}
+var MANAGED_DEPLOYMENT_UNIT_RE = /^kraft-(dep_[A-Za-z0-9_-]+)\.service$/;
+function managedDeploymentUnitName(deploymentId) {
+  return `kraft-${deploymentId}.service`;
+}
+function managedDeploymentIdFromUnit(unit) {
+  return unit?.match(MANAGED_DEPLOYMENT_UNIT_RE)?.[1] ?? null;
+}
+var PROTECTED_UNITS = /* @__PURE__ */ new Set([
+  "docker",
+  "docker.socket",
+  "dockerd",
+  "snap.docker.dockerd",
+  "containerd",
+  "containerd.socket",
+  "podman",
+  // Other container/VM supervisors whose forwarders land on their daemon unit.
+  "lxd",
+  "snap.lxd.daemon",
+  "incus",
+  "k3s",
+  "k3s-agent",
+  "kubelet",
+  "libvirtd",
+  "ssh",
+  "sshd",
+  "dbus",
+  "systemd-resolved",
+  "systemd-networkd",
+  "systemd-logind",
+  // The control plane itself, and a from-source dev install of it.
+  "kraft",
+  "kraft-dev"
+]);
+var USER_MANAGER_UNIT_RE = /^user@\d+$/;
+function classifyProxy(text) {
+  if (!text) return void 0;
+  const t = text.toLowerCase();
+  if (t.includes("openresty")) return "openresty";
+  if (/(^|[\s/:])nginx/.test(t)) return "nginx";
+  if (/(^|[\s/:])caddy/.test(t)) return "caddy";
+  if (/(apache2|httpd)/.test(t)) return "apache";
+  if (/(^|[\s/:])traefik/.test(t)) return "traefik";
+  if (/(^|[\s/:])haproxy/.test(t)) return "haproxy";
+  return void 0;
+}
+function bareUnit(unit) {
+  return unit.replace(/\.service$/, "");
+}
+function isProtectedUnit(unit) {
+  const bare = bareUnit(unit);
+  return PROTECTED_UNITS.has(bare) || USER_MANAGER_UNIT_RE.test(bare);
+}
+function mayStopUnitForEdgeTakeover(unit) {
+  if (!unit) return false;
+  if (managedDeploymentIdFromUnit(unit)) return true;
+  return !isProtectedUnit(unit);
+}
+
+export {
+  MAIL_HOST_STATE_DIR,
+  tryExec,
+  probeExec,
+  probeExecElevated,
+  withReason,
+  KRAFT_LABEL,
+  resolveContainerPublishingPort,
+  containerIdFromCgroup,
+  stopContainerDurably,
+  describeContainerById,
+  EDGE_CONTAINER_NAME,
+  isOurEdgeContainer,
+  isContainerPortForwarder,
+  managedDeploymentUnitName,
+  managedDeploymentIdFromUnit,
+  classifyProxy,
+  mayStopUnitForEdgeTakeover
+};