@rakay-technology/kraft 0.7.4

package/dist/chunk-THTEUDBC.js

@@ -0,0 +1,3188 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  containerCommand,
+  edgeContainerExecutor,
+  isSafeCertPath,
+  readDeclaredPair,
+  readMaybeInContainer,
+  validateCertFor
+} from "./chunk-Y7PVJUXJ.js";
+import {
+  EdgeConflictError,
+  EdgeMigrateRequested,
+  detectEdgeContainer,
+  edgeCrashReason,
+  edgeFailureReason,
+  edgeIsBroken,
+  freeEdgeTargets,
+  invalidateEdgeContainer,
+  probeEdge,
+  resolveOurEdgeContainer,
+  sanitizeEdgeVhosts,
+  sq as sq2,
+  stopTargetsForStatus
+} from "./chunk-YZUKHG3S.js";
+import {
+  privilegedExecutor,
+  rootChecked,
+  rootOrDegrade
+} from "./chunk-S3QBGGVP.js";
+import {
+  EDGE_CHALLENGE_HOST_DIR,
+  EDGE_CONTAINER_MOUNTS,
+  EDGE_HOST_PATHS,
+  OPENRESTY_DEFAULT_PATHS
+} from "./chunk-BQMFIXHI.js";
+import {
+  waitForPortListening
+} from "./chunk-WYNM7L22.js";
+import {
+  EDGE_CONTAINER_NAME,
+  probeExec,
+  probeExecElevated,
+  tryExec,
+  withReason
+} from "./chunk-N4OALTFK.js";
+import {
+  envOps,
+  opScript
+} from "./chunk-YRSZPVMB.js";
+import {
+  resolveEnvironment
+} from "./chunk-OFXBNFNL.js";
+import {
+  formatDuration,
+  systemDebug
+} from "./chunk-3CJLKL6E.js";
+import {
+  sq
+} from "./chunk-MNV2QFHW.js";
+import {
+  AppError,
+  PROXY_DIRECTIVES,
+  answered,
+  buildEdgeImageRef,
+  compareSemver,
+  firewallActiveSteps,
+  firewallVersionSteps,
+  isLoopbackHost,
+  parseProxyValue,
+  safeErrorMessage,
+  sanitizeProxySettings,
+  shellQuote
+} from "./chunk-PVOWHIND.js";
+
+// ../../packages/adapters/src/system/managed-image.ts
+import { posix } from "path";
+function log(message, level = "info") {
+  return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
+}
+function titleCase(label) {
+  return label.charAt(0).toUpperCase() + label.slice(1);
+}
+var fromSourceManaged = {
+  edge: false,
+  mail: false
+};
+function managedImagesAreFromSource(kind) {
+  return fromSourceManaged[kind];
+}
+function fromSourceImageMissingMessage(label, image) {
+  return `The from-source ${label} image ${image} isn't on this server \u2014 the control-plane build or transfer didn't complete (see the log above). It's an unpublished dev tag, so there's nothing to pull; fix the build and retry.`;
+}
+async function dockerAvailable(executor) {
+  return executor.exec("docker version --format '{{.Server.Version}}' 2>/dev/null").then((v) => Boolean(v.trim())).catch(() => false);
+}
+async function containerState(executor, container) {
+  const out = await executor.exec(
+    `docker inspect -f '{{.State.Running}}	{{.Config.Image}}' ${sq(container)} 2>/dev/null`
+  ).catch(() => "");
+  const line = out.split("\n").map((l) => l.trim()).find(Boolean);
+  if (!line) return null;
+  const [running, image] = line.split("	");
+  return { running: running?.trim() === "true", image: image?.trim() || null };
+}
+async function containerImageRef(executor, container) {
+  return (await containerState(executor, container))?.image ?? null;
+}
+async function imageExistsLocally(executor, ref) {
+  const out = await executor.exec(`docker image inspect -f '{{.Id}}' ${sq(ref)} 2>/dev/null`).catch(() => "");
+  return Boolean(out.trim());
+}
+async function swapManagedImage(executor, opts) {
+  const { kind, from, to, label, onLog, start } = opts;
+  const Label = titleCase(label);
+  onLog(log(`Updating the ${label}: ${from} \u2192 ${to}`));
+  if (!await imageExistsLocally(executor, to)) {
+    if (managedImagesAreFromSource(kind)) {
+      onLog(log(fromSourceImageMissingMessage(label, to), "warn"));
+      return { swapped: false, down: false };
+    }
+    const pull = await executor.streamExec(
+      `docker pull ${sq(to)}`,
+      onLog
+    );
+    if (pull.code !== 0) {
+      onLog(
+        log(`Could not pull ${to} \u2014 the ${label} stays on ${from}.`, "warn")
+      );
+      return { swapped: false, down: false };
+    }
+  }
+  if (await start(to)) {
+    onLog(log(`${Label} updated to ${to}`));
+    return { swapped: true, down: false };
+  }
+  onLog(
+    log(
+      `${Label} ${to} failed to come up \u2014 rolling back to ${from}...`,
+      "error"
+    )
+  );
+  if (await start(from)) {
+    return { swapped: false, down: false };
+  }
+  onLog(
+    log(
+      `Rollback to ${from} ALSO failed \u2014 the ${label} is down on this server.`,
+      "error"
+    )
+  );
+  return { swapped: false, down: true };
+}
+
+// ../../packages/adapters/src/system/proxy/takeover-journal.ts
+var JOURNAL_DIR = "/var/lib/kraft";
+var JOURNAL_PATH = `${JOURNAL_DIR}/edge-takeover.json`;
+function log2(message, level = "info") {
+  return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
+}
+async function buildJournal(executor, status, onLog) {
+  const units = /* @__PURE__ */ new Map();
+  const containers = /* @__PURE__ */ new Map();
+  const processes = /* @__PURE__ */ new Map();
+  for (const o of status.occupants) {
+    if (o.containerName && !containers.has(o.containerName)) {
+      const r = await tryExec(
+        executor,
+        `docker inspect -f '{{.HostConfig.RestartPolicy.Name}}' ${sq2(o.containerName)} 2>/dev/null`
+      );
+      if (r === null) {
+        onLog?.(
+          log2(
+            `Could not read ${o.containerName}'s restart policy. If this takeover is rolled back it will be started again, but its policy left untouched \u2014 check it with \`docker inspect -f '{{.HostConfig.RestartPolicy.Name}}' ${o.containerName}\`.`,
+            "warn"
+          )
+        );
+        containers.set(o.containerName, { name: o.containerName });
+      } else {
+        containers.set(o.containerName, {
+          name: o.containerName,
+          restart: r.trim() || "no"
+        });
+      }
+    } else if (o.systemdUnit && !units.has(o.systemdUnit)) {
+      const en = await tryExec(
+        executor,
+        `systemctl is-enabled ${sq2(o.systemdUnit)} 2>/dev/null`
+      );
+      units.set(o.systemdUnit, {
+        unit: o.systemdUnit,
+        wasEnabled: en?.trim() === "enabled"
+      });
+    } else if (!o.containerName && !o.systemdUnit && o.pid && !processes.has(o.pid)) {
+      processes.set(o.pid, { pid: o.pid, command: o.rawCommand });
+    }
+  }
+  return {
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    units: [...units.values()],
+    containers: [...containers.values()],
+    processes: [...processes.values()]
+  };
+}
+function journalFileExecutor(executor) {
+  return rootOrDegrade(executor, {
+    purpose: "Writing the edge-takeover rollback journal",
+    consequence: "An interrupted takeover won't be repaired automatically on the next boot.",
+    report: () => {
+    }
+  });
+}
+async function writeJournal(executor, journal) {
+  try {
+    const privileged = await journalFileExecutor(executor);
+    await privileged.mkdir(JOURNAL_DIR);
+    await privileged.writeFile(JOURNAL_PATH, JSON.stringify(journal, null, 2));
+  } catch {
+  }
+}
+async function clearJournal(executor) {
+  await tryExec(await journalFileExecutor(executor), `rm -f ${JOURNAL_PATH}`);
+}
+async function readJournal(executor, onLog) {
+  const privileged = await journalFileExecutor(executor);
+  const raw = await tryExec(privileged, `cat ${JOURNAL_PATH} 2>/dev/null`);
+  if (raw === null) {
+    const listed = await tryExec(privileged, `ls ${JOURNAL_PATH} 2>/dev/null`);
+    if (listed?.trim()) {
+      onLog?.(
+        log2(
+          `An unfinished edge takeover is recorded at ${JOURNAL_PATH}, but Kraft could not read it as this user \u2014 the previous proxy will NOT be restored automatically. Re-run as root, or restore it by hand.`,
+          "error"
+        )
+      );
+    }
+    return null;
+  }
+  if (!raw.trim()) {
+    await clearJournal(executor);
+    return null;
+  }
+  try {
+    return JSON.parse(raw);
+  } catch {
+    await clearJournal(executor);
+    return null;
+  }
+}
+async function rollback(executor, journal, onLog) {
+  onLog(log2("Rolling back \u2014 restoring the previous proxy...", "warn"));
+  const restore = await rootOrDegrade(executor, {
+    purpose: "Restarting the proxy that was holding ports 80/443",
+    consequence: "Restarting and re-enabling it will likely be refused \u2014 so if :80 is served after this, it is because nothing was ever stopped, not because Kraft put it back.",
+    report: (message) => onLog(log2(message, "warn"))
+  });
+  await tryExec(
+    restore,
+    `docker update --restart=no ${sq2(EDGE_CONTAINER_NAME)} 2>/dev/null || true`
+  );
+  await tryExec(
+    restore,
+    `docker stop ${sq2(EDGE_CONTAINER_NAME)} 2>/dev/null || true`
+  );
+  await tryExec(
+    restore,
+    "systemctl disable --now openresty 2>/dev/null || systemctl stop openresty 2>/dev/null || true; systemctl reset-failed openresty 2>/dev/null || true"
+  );
+  for (const u of journal.units) {
+    await tryExec(
+      restore,
+      u.wasEnabled ? `systemctl enable --now ${sq2(u.unit)} 2>/dev/null || true` : `systemctl start ${sq2(u.unit)} 2>/dev/null || true`
+    );
+  }
+  for (const c of journal.containers) {
+    if (c.restart) {
+      await tryExec(
+        restore,
+        `docker update --restart=${sq2(c.restart)} ${sq2(c.name)} 2>/dev/null || true`
+      );
+    } else {
+      onLog(
+        log2(
+          `Starting ${c.name} without setting a restart policy \u2014 Kraft never managed to read the one it had. Confirm it still comes back on reboot.`,
+          "warn"
+        )
+      );
+    }
+    await tryExec(restore, `docker start ${sq2(c.name)} 2>/dev/null || true`);
+  }
+  for (const p of journal.processes ?? []) {
+    if (p.command) {
+      await tryExec(
+        restore,
+        `setsid -f sh -c ${sq2(p.command)} 2>/dev/null || (nohup sh -c ${sq2(p.command)} >/dev/null 2>&1 &) || true`
+      );
+    } else {
+      onLog(
+        log2(
+          `Could not restore process ${p.pid} \u2014 no command captured.`,
+          "warn"
+        )
+      );
+    }
+  }
+  const restored = await portIsServed(executor, 80);
+  if (!restored) {
+    onLog(
+      log2(
+        "Nothing is listening on :80 after the restore \u2014 the box is NOT serving. Start your proxy by hand (e.g. `systemctl start nginx`, or `docker start <name>`).",
+        "error"
+      )
+    );
+  }
+  return restored;
+}
+async function portIsServed(executor, port) {
+  const hex = port.toString(16).toUpperCase().padStart(4, "0");
+  const out = await tryExec(
+    executor,
+    `(command -v ss >/dev/null 2>&1 && ss -ltn 2>/dev/null | grep -qE ':${port}[[:space:]]' && echo yes) || (grep -qiE '^[[:space:]]*[0-9]+:[[:space:]]*[0-9A-F]{8}:${hex}[[:space:]]+[0-9A-F]{8}:0000[[:space:]]+0A' /proc/net/tcp 2>/dev/null && echo yes) || true`
+  );
+  return (out ?? "").includes("yes");
+}
+var EDGE_STOP_ELEVATION = {
+  purpose: "Stopping the proxy that holds ports 80/443",
+  consequence: "Stopping and disabling it will likely be refused, leaving the ports bound."
+};
+async function beginEdgeTakeover(executor, status, onLog, targets) {
+  await writeJournal(executor, await buildJournal(executor, status, onLog));
+  let privilegeDegraded = false;
+  const stopExecutor = await rootOrDegrade(executor, {
+    ...EDGE_STOP_ELEVATION,
+    report: (message) => {
+      privilegeDegraded = true;
+      onLog(log2(message, "warn"));
+    }
+  });
+  const freed = await freeEdgeTargets(
+    stopExecutor,
+    targets?.length ? targets : stopTargetsForStatus(status),
+    (m, l) => onLog(log2(m, l))
+  );
+  return { ...freed, privilegeDegraded };
+}
+async function rollbackEdgeTakeover(executor, onLog) {
+  const journal = await readJournal(executor, onLog);
+  if (!journal || journal.completed) return false;
+  const restored = await rollback(executor, journal, onLog);
+  await clearJournal(executor);
+  return restored;
+}
+async function completeEdgeTakeover(executor) {
+  const journal = await readJournal(executor);
+  if (journal) {
+    journal.completed = true;
+    await writeJournal(executor, journal);
+  }
+  await clearJournal(executor);
+}
+async function recoverInterruptedTakeover(executor, onLog, isEdgeHealthy) {
+  const journal = await readJournal(executor, onLog);
+  if (!journal) return;
+  if (journal.completed) {
+    await clearJournal(executor);
+    return;
+  }
+  if (isEdgeHealthy && await isEdgeHealthy()) {
+    onLog(
+      log2(
+        "Found an unfinished edge takeover, but our edge is serving \u2014 keeping it.",
+        "warn"
+      )
+    );
+    await clearJournal(executor);
+    return;
+  }
+  onLog(
+    log2(
+      "Found an interrupted edge takeover \u2014 restoring the previous proxy.",
+      "warn"
+    )
+  );
+  await rollback(executor, journal, onLog);
+  await clearJournal(executor);
+}
+
+// ../../packages/adapters/src/system/proxy/import/parse-utils.ts
+function stripComments(text) {
+  return text.split("\n").map((line) => {
+    let quote;
+    for (let i = 0; i < line.length; i++) {
+      const ch = line[i];
+      if (quote) {
+        if (ch === "\\")
+          i++;
+        else if (ch === quote) quote = void 0;
+      } else if (ch === '"' || ch === "'") {
+        quote = ch;
+      } else if (ch === "#") {
+        return line.slice(0, i);
+      }
+    }
+    return line;
+  }).join("\n");
+}
+function extractBlocks(text, keyword) {
+  const blocks = [];
+  const re = new RegExp(`(?:^|[\\s;}])${keyword}\\b[^{;]*\\{`, "g");
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    const openIdx = m.index + m[0].length - 1;
+    let depth = 1;
+    let i = openIdx + 1;
+    for (; i < text.length && depth > 0; i++) {
+      if (text[i] === "{") depth++;
+      else if (text[i] === "}") depth--;
+    }
+    if (depth === 0) {
+      blocks.push(text.slice(openIdx + 1, i - 1));
+      re.lastIndex = i;
+    } else {
+      break;
+    }
+  }
+  return blocks;
+}
+function collapseByHost(items, hostsOf, score) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const item of items) {
+    const key = [...hostsOf(item)].sort().join(" ");
+    const bag = groups.get(key);
+    if (bag) bag.push(item);
+    else groups.set(key, [item]);
+  }
+  const kept = [];
+  const dropped = [];
+  for (const bag of groups.values()) {
+    let winner = bag[0];
+    for (const cand of bag) if (score(cand) > score(winner)) winner = cand;
+    kept.push(winner);
+    for (const loser of bag) if (loser !== winner) dropped.push(loser);
+  }
+  return { kept, dropped };
+}
+
+// ../../packages/adapters/src/system/proxy/import/nginx.ts
+async function dumpResolvedConfig(executor, bins) {
+  for (const bin of bins) {
+    const dumped = await tryExec(executor, `${bin} -T 2>/dev/null`);
+    if (dumped && /server\s*\{/.test(dumped)) return dumped;
+  }
+  return null;
+}
+async function nginxPrefix(executor, bins) {
+  for (const bin of bins) {
+    const out = await tryExec(executor, `${bin} -V 2>&1`);
+    const prefix = out?.match(/--prefix=(\S+)/)?.[1];
+    if (prefix) return prefix;
+  }
+  return null;
+}
+async function loadNginxConfig(executor) {
+  const dumped = await dumpResolvedConfig(executor, ["nginx", "openresty"]);
+  if (dumped) return dumped;
+  const cat = await tryExec(
+    executor,
+    "cat /etc/nginx/nginx.conf /etc/nginx/sites-enabled/* /etc/nginx/conf.d/*.conf 2>/dev/null"
+  );
+  return cat ?? "";
+}
+function firstDirective(body, name) {
+  const m = body.match(new RegExp(`(?:^|[;{\\s])${name}\\s+([^;]+);`));
+  return m?.[1]?.trim();
+}
+function parseUpstreams(config) {
+  const map = /* @__PURE__ */ new Map();
+  const re = /(?:^|[\s;}])upstream\s+(\S+)\s*\{([^}]*)\}/g;
+  let m;
+  while ((m = re.exec(config)) !== null) {
+    const name = m[1];
+    const body = m[2] ?? "";
+    const targets = [...body.matchAll(/(?:^|[\s;{])server\s+([^;\s]+)/g)].map((server) => server[1]?.trim()).filter((target) => Boolean(target));
+    if (name && targets.length > 0) map.set(name, targets);
+  }
+  return map;
+}
+var HTTP_PROXY_TARGET_RE = /^(https?:\/\/)([^/?#]+)([/?#].*)?$/i;
+function resolveProxyTarget(proxyPass, upstreams, opts = {}) {
+  const raw = proxyPass.replace(/;$/, "").trim();
+  const parsed = raw.match(HTTP_PROXY_TARGET_RE);
+  if (raw.includes("$")) {
+    const authority2 = parsed?.[2];
+    if (!opts.allowVariablesAfterAuthority || !authority2 || authority2.includes("$")) {
+      return { reason: `proxy_pass "${raw}" uses an nginx variable` };
+    }
+  }
+  if (/\/\/unix:/i.test(raw))
+    return { reason: `proxy_pass "${raw}" targets a unix socket` };
+  const m = parsed;
+  if (!m) return { reason: `unrecognized proxy_pass "${raw}"` };
+  const scheme = m[1];
+  const authority = m[2];
+  const host = authority.replace(/:\d+$/, "");
+  const declaredUpstream = upstreams.get(authority);
+  if (declaredUpstream?.[0]) return { url: `${scheme}${declaredUpstream[0]}` };
+  const isIp = /^\d{1,3}(\.\d{1,3}){3}$/.test(host);
+  if (host === "localhost" || host === "ip6-localhost") {
+    return { url: raw.replace(/^(https?:\/\/)[^/:]+/i, "$1127.0.0.1") };
+  }
+  if (isIp || host.includes(".") || host.startsWith("[") && host.endsWith("]")) {
+    return { url: raw };
+  }
+  return {
+    reason: `proxy_pass host "${host}" is an undeclared upstream \u2014 not migratable`
+  };
+}
+function strictLoopbackUpstreamPorts(config) {
+  const normalized = stripComments(config);
+  const upstreams = parseUpstreams(normalized);
+  const ports = /* @__PURE__ */ new Set();
+  for (const match of normalized.matchAll(
+    /(?:^|[;{}\s])proxy_pass\s+([^;]+);/g
+  )) {
+    const raw = match[1]?.trim();
+    if (!raw) continue;
+    const resolved = resolveProxyTarget(raw, upstreams, {
+      allowVariablesAfterAuthority: true
+    });
+    if ("reason" in resolved) {
+      if (/\/\/unix:/i.test(raw)) continue;
+      throw new Error(`Cannot inventory Kraft edge routes: ${resolved.reason}`);
+    }
+    const parsed = raw.match(HTTP_PROXY_TARGET_RE);
+    const authority = parsed?.[2];
+    const scheme = parsed?.[1];
+    const targets = authority && scheme && upstreams.has(authority) ? upstreams.get(authority).map((target) => `${scheme}${target}`) : [resolved.url];
+    for (const target of targets) {
+      let url;
+      try {
+        url = new URL(target);
+      } catch {
+        throw new Error(
+          `Cannot inventory Kraft edge routes: invalid proxy_pass "${raw}"`
+        );
+      }
+      if (!isLoopbackHost(url.hostname)) continue;
+      const port = url.port ? Number(url.port) : url.protocol === "https:" ? 443 : 80;
+      if (!Number.isSafeInteger(port) || port < 1 || port > 65535) {
+        throw new Error(
+          `Cannot inventory Kraft edge routes: invalid loopback port in "${raw}"`
+        );
+      }
+      ports.add(port);
+    }
+  }
+  return ports;
+}
+function parseStrictEdgeConfig(raw) {
+  return {
+    ...parseNginxConfig(raw),
+    loopbackUpstreamPorts: strictLoopbackUpstreamPorts(raw)
+  };
+}
+function locationBlocks(serverBody) {
+  const out = [];
+  const re = /(?:^|[\s;}])location\s+([^{]+?)\s*\{/g;
+  let m;
+  while ((m = re.exec(serverBody)) !== null) {
+    const path = m[1].trim();
+    const openIdx = m.index + m[0].length - 1;
+    let depth = 1;
+    let i = openIdx + 1;
+    for (; i < serverBody.length && depth > 0; i++) {
+      if (serverBody[i] === "{") depth++;
+      else if (serverBody[i] === "}") depth--;
+    }
+    if (depth !== 0) break;
+    out.push({ path, body: serverBody.slice(openIdx + 1, i - 1) });
+    re.lastIndex = i;
+  }
+  return out;
+}
+function extractLocationProxies(serverBody) {
+  const routes = [];
+  const unsupported = [];
+  let sawProxyLocation = false;
+  for (const loc of locationBlocks(serverBody)) {
+    const pp = firstDirective(loc.body, "proxy_pass");
+    if (!pp) continue;
+    sawProxyLocation = true;
+    const exact = loc.path.match(/^=\s+(.+)$/);
+    if (exact) {
+      routes.push({ path: exact[1].trim(), proxyPass: pp, exact: true });
+      continue;
+    }
+    const strongPrefix = loc.path.match(/^\^~\s+(.+)$/);
+    if (strongPrefix) {
+      routes.push({ path: strongPrefix[1].trim(), proxyPass: pp });
+      continue;
+    }
+    if (/^~\*?(?:\s|$)/.test(loc.path) || loc.path.startsWith("@")) {
+      unsupported.push(loc.path);
+      continue;
+    }
+    routes.push({ path: loc.path, proxyPass: pp });
+  }
+  return { routes, unsupported, sawProxyLocation };
+}
+function withoutQuotedValues(body) {
+  return body.replace(/'[^'\n]*'/g, "''").replace(/"[^"\n]*"/g, '""');
+}
+var SERVING_DIRECTIVE_RE = /(?:^|[;{}\s])(?:proxy_pass|root|alias|fastcgi_pass|uwsgi_pass|scgi_pass|grpc_pass)\s/;
+function servesNothing(locationBody) {
+  return !SERVING_DIRECTIVE_RE.test(withoutQuotedValues(locationBody));
+}
+function isHttpsUpgradeForSelf(body, names) {
+  const targets = [
+    ...body.matchAll(/(?:^|[\s;{])return\s+30[1-8]\s+([^;]+);/g),
+    ...body.matchAll(/(?:^|[\s;{])rewrite\s+\S+\s+([^;]+?)\s+permanent\s*;/g)
+  ].map((m) => m[1].trim());
+  if (targets.length === 0) return false;
+  return targets.every((raw) => {
+    if (!/^https:\/\//i.test(raw)) return false;
+    const authority = raw.replace(/^https:\/\//i, "").split(/[/\s]/)[0] ?? "";
+    const host = (authority.match(/^(\$[a-z_]+|[^$:]+)/i)?.[1] ?? "").replace(
+      /:\d+$/,
+      ""
+    );
+    if (host === "$host" || host === "$server_name" || host === "$http_host")
+      return true;
+    return names.includes(host);
+  });
+}
+var CHALLENGE_LOCATION_RE = /\.well-known\/(acme-challenge|oblien-proxy-challenge)/i;
+function isAcmeWebrootOnly(body) {
+  const locations = locationBlocks(body);
+  if (locations.length === 0) {
+    const root = firstDirective(body, "root") ?? "";
+    return /letsencrypt|acme|certbot/i.test(root);
+  }
+  if (!locations.some((l) => CHALLENGE_LOCATION_RE.test(l.path))) return false;
+  return locations.every(
+    (l) => CHALLENGE_LOCATION_RE.test(l.path) || servesNothing(l.body)
+  );
+}
+function parseProxyDirectives(body) {
+  const raw = {};
+  const candidate = {};
+  for (const spec of PROXY_DIRECTIVES) {
+    const found = firstDirective(body, spec.directive);
+    if (found === void 0) continue;
+    raw[spec.key] = found;
+    const parsed = parseProxyValue(spec, found);
+    if (parsed !== void 0) candidate[spec.key] = parsed;
+  }
+  const settings = sanitizeProxySettings(candidate);
+  return {
+    ...settings ? { settings } : {},
+    ...Object.keys(raw).length > 0 ? { raw } : {}
+  };
+}
+var LOOPBACK_SERVER_NAMES = /* @__PURE__ */ new Set([
+  "localhost",
+  "localhost.localdomain",
+  "ip6-localhost",
+  "ip6-loopback"
+]);
+function resolveStaticRoot(root, prefix) {
+  if (root.startsWith("/")) return { root };
+  if (!prefix) {
+    return {
+      reason: `static root "${root}" is relative to nginx's compiled prefix, which this host didn't report`
+    };
+  }
+  return { root: `${prefix.replace(/\/+$/, "")}/${root}` };
+}
+function parseServer(body, source, upstreams, prefix) {
+  const warnings = [];
+  const names = firstDirective(body, "server_name")?.split(/\s+/).filter(
+    (n) => n && n !== "_" && !n.startsWith("~") && !LOOPBACK_SERVER_NAMES.has(n.toLowerCase())
+  ) ?? [];
+  const listens = [...body.matchAll(/(?:^|[;{\s])listen\s+([^;]+);/g)].map(
+    (m) => m[1]
+  );
+  const ssl = listens.some((l) => /\bssl\b/.test(l) || /\b443\b/.test(l));
+  const root = firstDirective(body, "root");
+  const certPath = firstDirective(body, "ssl_certificate");
+  const keyPath = firstDirective(body, "ssl_certificate_key");
+  if (names.length === 0) return { warnings: [] };
+  const extracted = extractLocationProxies(body);
+  const rawTargets = extracted.routes;
+  for (const selector of extracted.unsupported) {
+    warnings.push(
+      `nginx: ${names[0]} location "${selector}" uses an unsupported regex or named selector (skipped)`
+    );
+  }
+  if (rawTargets.length === 0 && !extracted.sawProxyLocation) {
+    const serverLevel = firstDirective(body, "proxy_pass");
+    if (serverLevel) rawTargets.push({ path: "/", proxyPass: serverLevel });
+  }
+  const resolved = [];
+  for (const t of rawTargets) {
+    const r = resolveProxyTarget(t.proxyPass, upstreams);
+    if ("reason" in r)
+      warnings.push(`nginx: ${names[0]} ${t.path} \u2014 ${r.reason} (skipped)`);
+    else
+      resolved.push({
+        path: t.path,
+        url: r.url,
+        ...t.exact ? { exact: true } : {}
+      });
+  }
+  let target;
+  let routes;
+  if (resolved.length > 0) {
+    const primary = resolved.find((r) => r.path === "/" && !r.exact) ?? resolved[0];
+    target = { kind: "proxy", url: primary.url };
+    routes = resolved;
+  } else if (isHttpsUpgradeForSelf(body, names)) {
+    return { warnings: [] };
+  } else if (root && !isAcmeWebrootOnly(body)) {
+    const resolved2 = resolveStaticRoot(root.replace(/;$/, ""), prefix);
+    if ("reason" in resolved2) {
+      warnings.push(`nginx: ${names[0]} \u2014 ${resolved2.reason} (skipped)`);
+      return { warnings };
+    }
+    target = { kind: "static", root: resolved2.root };
+  } else if (root) {
+    return { warnings: [] };
+  } else {
+    warnings.push(
+      `nginx: ${names[0]} has neither proxy_pass nor root \u2014 skipped (${source})`
+    );
+    return { warnings };
+  }
+  const site = { serverNames: names, ssl, target, source };
+  if (routes) site.routes = routes;
+  if (certPath && keyPath) site.tls = { certPath, keyPath };
+  const tunables = parseProxyDirectives(body);
+  if (tunables.settings) site.proxy = tunables.settings;
+  if (tunables.raw) site.proxyRaw = tunables.raw;
+  return { site, warnings };
+}
+function parseNginxConfig(raw, prefix) {
+  const warnings = [];
+  const sites = [];
+  if (!raw.trim()) {
+    return {
+      proxy: "nginx",
+      sites,
+      warnings: ["nginx: no readable configuration found"]
+    };
+  }
+  const config = stripComments(raw);
+  const upstreams = parseUpstreams(config);
+  const blocks = extractBlocks(config, "server");
+  if (blocks.length === 0) {
+    warnings.push("nginx: no server blocks found");
+  }
+  for (const body of blocks) {
+    const { site, warnings: blockWarnings } = parseServer(
+      body,
+      "nginx",
+      upstreams,
+      prefix
+    );
+    warnings.push(...blockWarnings);
+    if (site) sites.push(site);
+  }
+  const { kept } = collapseByHost(
+    sites,
+    (s) => s.serverNames,
+    (s) => (s.ssl ? 2 : 0) + (s.target.kind === "proxy" ? 1 : 0)
+  );
+  return { proxy: "nginx", sites: kept, warnings };
+}
+async function scanNginx(executor) {
+  const raw = await loadNginxConfig(executor);
+  const relativeRoot = /(?:^|[;{\s])root\s+[^/;\s]/.test(raw);
+  const prefix = relativeRoot ? await nginxPrefix(executor, ["nginx", "openresty"]) : null;
+  return parseNginxConfig(raw, prefix ?? void 0);
+}
+var OUR_EDGE_SITE_GLOBS = [
+  `${EDGE_HOST_PATHS.sitesDir}/*.conf`,
+  `${OPENRESTY_DEFAULT_PATHS.sitesDir}/*.conf`,
+  "/etc/openresty/sites-enabled/*.conf"
+];
+async function scanForeignOpenResty(executor) {
+  const dump = await dumpResolvedConfig(executor, ["openresty"]);
+  if (dump) return parseNginxConfig(dump);
+  return scanKraftEdge(executor);
+}
+async function scanKraftEdge(executor) {
+  const cat = `cat ${OUR_EDGE_SITE_GLOBS.join(" ")} 2>/dev/null`;
+  const raw = await tryExec(executor, cat);
+  if (raw?.trim()) return parseNginxConfig(raw);
+  const container = await resolveOurEdgeContainer(executor);
+  if (!container) return parseNginxConfig("");
+  const fromContainer = await tryExec(
+    executor,
+    containerCommand(container, cat)
+  );
+  return parseNginxConfig(fromContainer ?? "");
+}
+async function scanKraftEdgeStrict(executor, knownContainer) {
+  const detected = await detectEdgeContainer(executor);
+  if (!detected) {
+    const bareConfig = await dumpResolvedConfig(executor, ["openresty"]);
+    if (bareConfig) return parseStrictEdgeConfig(bareConfig);
+    throw new Error(
+      "Cannot read Kraft edge routes: neither Docker nor bare OpenResty inventory is available"
+    );
+  }
+  if (!detected.exists) {
+    const bareConfig = await dumpResolvedConfig(executor, ["openresty"]);
+    if (bareConfig) return parseStrictEdgeConfig(bareConfig);
+    throw new Error(
+      "Cannot read Kraft edge routes: no running Kraft edge or bare OpenResty inventory is available"
+    );
+  }
+  if (!detected.running) {
+    throw new Error(
+      "Cannot read Kraft edge routes: the edge container is not running"
+    );
+  }
+  const container = knownContainer ?? detected.name;
+  if (!container)
+    throw new Error(
+      "Cannot read Kraft edge routes: container identity missing"
+    );
+  const fromContainer = await executor.exec(
+    containerCommand(container, "openresty -T 2>/dev/null")
+  );
+  if (!fromContainer.trim() || !/server\s*\{/.test(fromContainer)) {
+    throw new Error(
+      "Cannot read Kraft edge routes: active OpenResty config dump was empty"
+    );
+  }
+  return parseStrictEdgeConfig(fromContainer);
+}
+
+// ../../packages/adapters/src/system/proxy/import/caddy.ts
+var CADDYFILE_PATHS = ["/etc/caddy/Caddyfile", "/etc/Caddyfile"];
+async function loadCaddyAdminConfig(executor) {
+  const endpoint = "http://localhost:2019/config/";
+  const out = await tryExec(executor, `curl -fsS ${endpoint} 2>/dev/null`) || await tryExec(executor, `wget -qO- ${endpoint} 2>/dev/null`);
+  return out && out.trim().startsWith("{") ? out : null;
+}
+async function loadCaddyJson(executor) {
+  for (const p of CADDYFILE_PATHS) {
+    const out = await tryExec(
+      executor,
+      `caddy adapt --adapter caddyfile --config ${p} 2>/dev/null`
+    );
+    if (out && out.trim().startsWith("{")) return out;
+  }
+  return null;
+}
+function flattenHandlers(handlers, scoped = false, out = []) {
+  for (const h of handlers ?? []) {
+    if (h.handler === "subroute") {
+      for (const r of h.routes ?? []) {
+        flattenHandlers(r.handle, scoped || (r.match?.length ?? 0) > 0, out);
+      }
+    } else {
+      out.push({ h, scoped });
+    }
+  }
+  return out;
+}
+var UNMIGRATABLE_HANDLERS = {
+  php_fastcgi: "a PHP-FPM site (php_fastcgi)",
+  fastcgi: "a FastCGI backend",
+  static_response: "a static inline response (respond)",
+  templates: "Caddy templates",
+  encode: "",
+  headers: "",
+  authentication: "Caddy authentication",
+  rewrite: "",
+  acme_server: "an embedded ACME server"
+};
+function targetFromRoute(route) {
+  const flat = flattenHandlers(route.handle);
+  const proxies = flat.filter((f) => f.h.handler === "reverse_proxy");
+  const chosen = proxies.find((f) => !f.scoped) ?? proxies[0];
+  const proxy = chosen?.h;
+  if (proxy?.transport?.protocol === "fastcgi") {
+    return {
+      note: "serves a PHP-FPM/FastCGI site (php_fastcgi) \u2014 not an HTTP upstream"
+    };
+  }
+  const pathScopedOnly = Boolean(chosen?.scoped);
+  const hasScopedSibling = proxies.some((f) => f.scoped);
+  const dials = (proxy?.upstreams ?? []).map((u) => u.dial).filter((d) => Boolean(d));
+  if (dials.length > 0) {
+    const dial = dials[0];
+    if (/^unix\//i.test(dial)) {
+      return {
+        note: `proxies to the unix socket "${dial}", which needs a manual upstream`
+      };
+    }
+    return {
+      target: {
+        kind: "proxy",
+        url: /^https?:\/\//.test(dial) ? dial : `http://${dial}`
+      },
+      extraUpstreams: dials.length - 1,
+      pathScopedOnly,
+      hasScopedSibling
+    };
+  }
+  const root = flat.find(
+    (f) => f.h.handler === "vars" && typeof f.h.root === "string"
+  )?.h.root;
+  if (root && flat.some((f) => f.h.handler === "file_server")) {
+    return { target: { kind: "static", root } };
+  }
+  for (const { h } of flat) {
+    const label = h.handler ? UNMIGRATABLE_HANDLERS[h.handler] : void 0;
+    if (label) return { note: `serves ${label}` };
+  }
+  return {};
+}
+function parseCaddyJson(raw) {
+  let cfg;
+  try {
+    cfg = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  const servers = cfg.apps?.http?.servers;
+  if (!servers) return null;
+  const sites = [];
+  const warnings = [];
+  for (const srv of Object.values(servers)) {
+    const ssl = (srv.listen ?? []).some((l) => l.endsWith(":443"));
+    for (const route of srv.routes ?? []) {
+      const hosts = (route.match ?? []).flatMap((m) => m.host ?? []).filter((h) => h && h !== "*");
+      if (hosts.length === 0) continue;
+      const outcome = targetFromRoute(route);
+      if (outcome.note) {
+        warnings.push(
+          `caddy: ${hosts.join(", ")} ${outcome.note} \u2014 re-add it manually`
+        );
+        continue;
+      }
+      if (!outcome.target) continue;
+      if (outcome.extraUpstreams) {
+        warnings.push(
+          `caddy: ${hosts.join(", ")} load-balances across ${outcome.extraUpstreams + 1} upstreams \u2014 only the first is migrated`
+        );
+      }
+      if (outcome.hasScopedSibling || (route.match ?? []).some((m) => m.path?.length)) {
+        warnings.push(
+          `caddy: ${hosts.join(", ")} routes some paths to other upstreams \u2014 only the catch-all is migrated; re-add path rules manually`
+        );
+      }
+      if (outcome.pathScopedOnly) {
+        warnings.push(
+          `caddy: ${hosts.join(", ")} has no catch-all upstream \u2014 used its path-scoped one; verify the target`
+        );
+      }
+      sites.push({
+        serverNames: hosts,
+        ssl,
+        target: outcome.target,
+        source: "caddy (adapt)"
+      });
+    }
+  }
+  const { kept, dropped } = collapseByHost(
+    sites,
+    (s) => s.serverNames,
+    (s) => s.ssl ? 1 : 0
+  );
+  for (const d of dropped) {
+    warnings.push(
+      `caddy: ${d.serverNames.join(", ")} had a second (non-TLS) block \u2014 kept the TLS one`
+    );
+  }
+  return { sites: kept, warnings };
+}
+async function loadCaddyfile(executor) {
+  for (const p of CADDYFILE_PATHS) {
+    const out = await tryExec(executor, `cat ${p} 2>/dev/null`);
+    if (out && out.trim()) return out;
+  }
+  return "";
+}
+function caddyBlocks(text) {
+  const out = [];
+  let i = 0;
+  let headerStart = 0;
+  while (i < text.length) {
+    if (text[i] === "{") {
+      const header = text.slice(headerStart, i).trim();
+      let depth = 1;
+      let j = i + 1;
+      for (; j < text.length && depth > 0; j++) {
+        if (text[j] === "{") depth++;
+        else if (text[j] === "}") depth--;
+      }
+      if (depth !== 0) break;
+      out.push({ header, body: text.slice(i + 1, j - 1) });
+      i = j;
+      headerStart = j;
+    } else {
+      i++;
+    }
+  }
+  return out;
+}
+function parseAddresses(header) {
+  return header.split(/[\s,]+/).filter(Boolean).map((addr) => {
+    const httpScheme = /^http:\/\//i.test(addr);
+    const host = addr.replace(/^https?:\/\//i, "").replace(/:\d+$/, "");
+    const isPort80 = /:80$/.test(addr);
+    return { host, ssl: !httpScheme && !isPort80 };
+  }).filter((a) => a.host && !a.host.startsWith(":") && a.host !== "*");
+}
+async function scanCaddy(executor) {
+  for (const load of [loadCaddyAdminConfig, loadCaddyJson]) {
+    const json = await load(executor);
+    if (!json) continue;
+    const parsed = parseCaddyJson(json);
+    if (parsed && (parsed.sites.length > 0 || parsed.warnings.length > 0)) {
+      return { proxy: "caddy", sites: parsed.sites, warnings: parsed.warnings };
+    }
+  }
+  return scanCaddyText(executor);
+}
+async function scanCaddyText(executor) {
+  const raw = await loadCaddyfile(executor);
+  const warnings = [];
+  const sites = [];
+  if (!raw.trim()) {
+    return {
+      proxy: "caddy",
+      sites,
+      warnings: ["caddy: no readable Caddyfile found"]
+    };
+  }
+  const text = stripComments(raw);
+  let blocks = caddyBlocks(text);
+  if (blocks.length === 0) {
+    const lines = text.split("\n").map((l) => l.trim()).filter(Boolean);
+    if (lines.length > 0) {
+      blocks = [{ header: lines[0], body: lines.slice(1).join("\n") }];
+    } else {
+      warnings.push("caddy: config present but no parseable site blocks");
+    }
+  }
+  for (const { header, body } of blocks) {
+    if (!header) continue;
+    const addrs = parseAddresses(header);
+    if (addrs.length === 0) {
+      warnings.push(
+        `caddy: skipped a block with no usable address (${header.slice(0, 40)})`
+      );
+      continue;
+    }
+    const inlineProxy = body.match(/(?:^|\s)reverse_proxy\s+([^\n{]+)/);
+    const blockProxy = body.match(/(?:^|\s)reverse_proxy\s*\{([\s\S]*?)\}/);
+    const blockTo = blockProxy?.[1].match(/(?:^|\n)\s*to\s+([^\n]+)/);
+    const rootMatch = body.match(/(?:^|\s)root\s+\*?\s*([^\n\s]+)/);
+    const tlsMatch = body.match(/(?:^|\s)tls\s+(\S+)\s+(\S+)/);
+    const upstreams = (inlineProxy?.[1] ?? blockTo?.[1] ?? "").trim().split(/\s+/).filter(Boolean);
+    const host = addrs[0].host;
+    let target;
+    if (upstreams.length > 0) {
+      const upstream = upstreams[0];
+      if (/^unix\//i.test(upstream)) {
+        warnings.push(
+          `caddy: ${host} proxies to the unix socket "${upstream}" \u2014 needs a manual upstream, skipped`
+        );
+        continue;
+      }
+      if (upstreams.length > 1) {
+        warnings.push(
+          `caddy: ${host} load-balances across ${upstreams.length} upstreams \u2014 only the first is migrated`
+        );
+      }
+      target = {
+        kind: "proxy",
+        url: /^https?:\/\//.test(upstream) ? upstream : `http://${upstream}`
+      };
+    } else if (/(?:^|\s)php_fastcgi\s/.test(body)) {
+      warnings.push(
+        `caddy: ${host} serves a PHP-FPM site (php_fastcgi) \u2014 not migratable as a static root; re-add it manually`
+      );
+      continue;
+    } else if (rootMatch) {
+      target = { kind: "static", root: rootMatch[1] };
+    } else {
+      warnings.push(`caddy: ${host} has no reverse_proxy or root \u2014 skipped`);
+      continue;
+    }
+    if (/(?:^|\s)(handle_path|handle)\s+\//.test(body)) {
+      warnings.push(
+        `caddy: ${host} routes by path (handle/handle_path) \u2014 only one upstream is migrated; re-add path rules manually`
+      );
+    }
+    const site = {
+      serverNames: addrs.map((a) => a.host),
+      ssl: addrs.some((a) => a.ssl),
+      target,
+      source: "caddy"
+    };
+    if (tlsMatch && tlsMatch[1].includes("/")) {
+      site.tls = { certPath: tlsMatch[1], keyPath: tlsMatch[2] };
+    }
+    sites.push(site);
+  }
+  const { kept, dropped } = collapseByHost(
+    sites,
+    (s) => s.serverNames,
+    (s) => s.ssl ? 1 : 0
+  );
+  for (const d of dropped) {
+    warnings.push(
+      `caddy: ${d.serverNames.join(", ")} had a second (non-TLS) block \u2014 kept the TLS one`
+    );
+  }
+  return { proxy: "caddy", sites: kept, warnings };
+}
+
+// ../../packages/adapters/src/system/proxy/import/apache.ts
+async function vhostFilesFromDump(executor) {
+  const dump = await tryExec(
+    executor,
+    "apachectl -S 2>/dev/null || apache2ctl -S 2>/dev/null || httpd -S 2>/dev/null"
+  );
+  if (!dump) return [];
+  const files = /* @__PURE__ */ new Set();
+  for (const m of dump.matchAll(/\(([^()]+?):\d+\)/g)) {
+    const f = m[1].trim();
+    if (f.startsWith("/")) files.add(f);
+  }
+  return [...files];
+}
+async function loadApacheConfig(executor) {
+  const files = await vhostFilesFromDump(executor);
+  if (files.length > 0) {
+    const cat2 = await tryExec(
+      executor,
+      `cat ${files.map(shellQuote).join(" ")} 2>/dev/null`
+    );
+    if (cat2 && cat2.trim()) return cat2;
+  }
+  const cat = await tryExec(
+    executor,
+    "cat /etc/apache2/sites-enabled/*.conf /etc/apache2/apache2.conf /etc/httpd/conf.d/*.conf /etc/httpd/conf/httpd.conf 2>/dev/null"
+  );
+  return cat ?? "";
+}
+function unquote(value) {
+  return value.replace(/^["']|["']$/g, "");
+}
+function directive(body, name) {
+  const m = body.match(new RegExp(`(?:^|\\n)\\s*${name}\\s+([^\\n]+)`, "i"));
+  const value = m?.[1]?.trim();
+  return value === void 0 ? void 0 : unquote(value);
+}
+function directiveAll(body, name) {
+  return [
+    ...body.matchAll(new RegExp(`(?:^|\\n)\\s*${name}\\s+([^\\n]+)`, "gi"))
+  ].map((m) => m[1].trim());
+}
+function isHttpsRedirectOnly(body) {
+  const hasProxy = /(?:^|\n)\s*ProxyPass\s+\S+\s+(?!!)\S/i.test(body);
+  if (hasProxy) return false;
+  const redirects = [
+    ...body.matchAll(
+      /(?:^|\n)\s*Redirect(?:Permanent|Match)?\s+(?:\d{3}\s+|permanent\s+|temp\s+)?\S*\s*(\S+)/gi
+    ),
+    ...body.matchAll(
+      /(?:^|\n)\s*RewriteRule\s+\S+\s+(\S+)\s*\[[^\]]*R=?3\d\d[^\]]*\]/gi
+    )
+  ].map((m) => m[1]);
+  return redirects.length > 0 && redirects.some((t) => /^https:\/\//i.test(t));
+}
+function hostOnly(name) {
+  return unquote(name.trim()).replace(/^https?:\/\//i, "").replace(/:\d+$/, "");
+}
+function proxyRoutes(body) {
+  const routes = [];
+  const scopes = [];
+  let regexScoped = false;
+  for (const line of body.split("\n")) {
+    const open = line.match(/^\s*<Location(Match)?\s+([^>]*)>/i);
+    if (open) {
+      const regex = Boolean(open[1]);
+      const arg = unquote(open[2].trim());
+      scopes.push({ path: !regex && arg.startsWith("/") ? arg : null, regex });
+      continue;
+    }
+    if (/^\s*<\/Location(?:Match)?\s*>/i.test(line)) {
+      scopes.pop();
+      continue;
+    }
+    const m = line.match(/^\s*ProxyPass\s+(\S+)(?:\s+(\S+))?/i);
+    if (!m) continue;
+    const first = unquote(m[1]);
+    if (first.startsWith("/")) {
+      routes.push({ path: first, url: m[2] ? unquote(m[2]) : "" });
+      continue;
+    }
+    const scope = scopes[scopes.length - 1];
+    if (scope?.path) routes.push({ path: scope.path, url: first });
+    else if (scope?.regex) regexScoped = true;
+  }
+  return { routes, regexScoped };
+}
+function parseVhost(body, portHint) {
+  const serverName = directive(body, "ServerName")?.split(/\s+/)[0];
+  const aliases = directiveAll(body, "ServerAlias").flatMap(
+    (line) => line.split(/\s+/)
+  );
+  const names = [serverName, ...aliases].filter((n) => Boolean(n)).map(hostOnly).filter(Boolean);
+  if (names.length === 0) {
+    return { warning: "apache: skipped a VirtualHost with no ServerName" };
+  }
+  if (isHttpsRedirectOnly(body)) return null;
+  const proxy = proxyRoutes(body);
+  const routes = proxy.routes.filter((p) => p.url && p.url !== "!");
+  const docRoot = directive(body, "DocumentRoot");
+  const fcgiMatch = /(?:^|\n)\s*ProxyPassMatch\s+[^\n]*(fcgi:|php-fpm|php\d*-fpm|\.sock)/i.test(
+    body
+  );
+  const certPath = directive(body, "SSLCertificateFile");
+  const keyPath = directive(body, "SSLCertificateKeyFile");
+  const ssl = /:443/.test(portHint) || /SSLEngine\s+on/i.test(body) || Boolean(certPath);
+  let target;
+  if (routes.length > 0) {
+    const primary = routes.find((r) => r.path === "/") ?? routes[0];
+    if (/^balancer:\/\//i.test(primary.url)) {
+      return {
+        warning: `apache: ${names[0]} proxies to an mod_proxy_balancer cluster (${primary.url}) \u2014 re-add its members manually`
+      };
+    }
+    target = { kind: "proxy", url: primary.url };
+  } else if (fcgiMatch) {
+    return {
+      warning: `apache: ${names[0]} is a PHP-FPM site (ProxyPassMatch \u2192 FastCGI) \u2014 not migratable as a static root; re-add it manually`
+    };
+  } else if (docRoot) {
+    target = { kind: "static", root: docRoot };
+  } else if (/(?:^|\n)\s*ProxyPassMatch\s/i.test(body)) {
+    return {
+      warning: `apache: ${names[0]} uses ProxyPassMatch (regex proxying) \u2014 re-add it manually`
+    };
+  } else if (proxy.regexScoped) {
+    return {
+      warning: `apache: ${names[0]} proxies from inside a <LocationMatch> (regex proxying) \u2014 re-add it manually`
+    };
+  } else {
+    return {
+      warning: `apache: ${names[0]} has neither ProxyPass nor DocumentRoot \u2014 skipped`
+    };
+  }
+  const site = {
+    serverNames: names,
+    ssl,
+    target,
+    source: "apache"
+  };
+  if (routes.length > 0) site.routes = routes;
+  if (certPath && keyPath) site.tls = { certPath, keyPath };
+  return site;
+}
+function redirectVhostNames(body) {
+  const serverName = directive(body, "ServerName")?.split(/\s+/)[0];
+  const aliases = directiveAll(body, "ServerAlias").flatMap(
+    (l) => l.split(/\s+/)
+  );
+  return [serverName, ...aliases].filter((n) => Boolean(n)).map(hostOnly).filter(Boolean);
+}
+function vhostBlocks(text) {
+  const out = [];
+  const re = /<VirtualHost([^>]*)>([\s\S]*?)<\/VirtualHost>/gi;
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    out.push({ args: m[1].trim(), body: m[2] });
+  }
+  return out;
+}
+async function scanApache(executor) {
+  const raw = await loadApacheConfig(executor);
+  const warnings = [];
+  const sites = [];
+  if (!raw.trim()) {
+    return {
+      proxy: "apache",
+      sites,
+      warnings: ["apache: no readable configuration found"]
+    };
+  }
+  const text = stripComments(raw);
+  const blocks = vhostBlocks(text);
+  if (blocks.length === 0)
+    warnings.push("apache: no <VirtualHost> blocks found");
+  const redirectOnlyHosts = [];
+  for (const { args, body } of blocks) {
+    const parsed = parseVhost(body, args);
+    if (parsed === null) {
+      redirectOnlyHosts.push(redirectVhostNames(body));
+      continue;
+    }
+    if ("warning" in parsed) warnings.push(parsed.warning);
+    else sites.push(parsed);
+  }
+  const served = new Set(sites.flatMap((s) => s.serverNames));
+  for (const names of redirectOnlyHosts) {
+    const orphaned = names.filter((n) => !served.has(n));
+    if (orphaned.length > 0) {
+      warnings.push(
+        `apache: ${orphaned.join(", ")} only redirected to HTTPS and has no TLS VirtualHost here \u2014 nothing to serve it after migration`
+      );
+    }
+  }
+  const { kept, dropped } = collapseByHost(
+    sites,
+    (s) => s.serverNames,
+    (s) => (s.ssl ? 2 : 0) + (s.target.kind === "proxy" ? 1 : 0)
+  );
+  for (const d of dropped) {
+    warnings.push(
+      `apache: ${d.serverNames.join(", ")} had a second VirtualHost (${d.ssl ? "TLS" : "plain HTTP"}, ${d.target.kind}) \u2014 kept the TLS/proxy one`
+    );
+  }
+  return { proxy: "apache", sites: kept, warnings };
+}
+
+// ../../packages/adapters/src/system/proxy/import/traefik.ts
+function lowerKeys(labels) {
+  const out = {};
+  for (const [k, v] of Object.entries(labels)) out[k.toLowerCase()] = v;
+  return out;
+}
+function extractHosts(rule) {
+  const hosts = [];
+  for (const call of rule.matchAll(/\bHost\(([^)]*)\)/gi)) {
+    for (const m of call[1].matchAll(/[`'"]([^`'"]+)[`'"]/g)) {
+      const h = m[1].trim();
+      if (h) hosts.push(h);
+    }
+  }
+  return [...new Set(hosts)];
+}
+function extraMatchers(rule) {
+  const found = /* @__PURE__ */ new Set();
+  for (const m of rule.matchAll(
+    /\b(PathPrefix|PathRegexp|Path|HeadersRegexp|Headers|Method|Query|ClientIP|HostRegexp)\b/gi
+  )) {
+    found.add(m[1]);
+  }
+  return [...found];
+}
+function collectDefinitions(containers) {
+  const services = /* @__PURE__ */ new Map();
+  const redirectMiddlewares = /* @__PURE__ */ new Set();
+  const streamRouters = [];
+  let fileProvider = false;
+  let exposedByDefault = true;
+  for (const c of containers) {
+    const labels = lowerKeys(c.labels);
+    for (const [k, v] of Object.entries(labels)) {
+      let m = k.match(
+        /^traefik\.http\.services\.([^.]+)\.loadbalancer\.server\.(port|scheme)$/
+      );
+      if (m) {
+        const def = services.get(m[1]) ?? {};
+        if (m[2] === "port") def.port = v;
+        else def.scheme = v;
+        services.set(m[1], def);
+        continue;
+      }
+      m = k.match(/^traefik\.http\.middlewares\.([^.]+)\.redirectscheme\./);
+      if (m) {
+        redirectMiddlewares.add(m[1]);
+        continue;
+      }
+      m = k.match(/^traefik\.(tcp|udp)\.routers\.([^.]+)\.rule$/);
+      if (m) streamRouters.push(`${m[1]} router "${m[2]}"`);
+    }
+    const cmd = c.cmd ?? "";
+    if (/--?providers\.file/i.test(cmd)) fileProvider = true;
+    if (/--?providers\.docker\.exposedbydefault[= ]?false/i.test(cmd))
+      exposedByDefault = false;
+  }
+  return {
+    services,
+    redirectMiddlewares,
+    streamRouters,
+    fileProvider,
+    exposedByDefault
+  };
+}
+function resolveIp(c, labels) {
+  const wanted = labels["traefik.docker.network"];
+  if (wanted && c.networks?.[wanted]) return c.networks[wanted];
+  if (c.ip) return c.ip;
+  const first = Object.values(c.networks ?? {}).find(Boolean);
+  return first || void 0;
+}
+function parseTraefikLabels(containers) {
+  const warnings = [];
+  const defs = collectDefinitions(containers);
+  const candidates = [];
+  for (const c of containers) {
+    const labels = lowerKeys(c.labels);
+    if (labels["traefik.enable"] === "false") continue;
+    if (!defs.exposedByDefault && labels["traefik.enable"] !== "true") continue;
+    const routers = /* @__PURE__ */ new Map();
+    for (const [key, val] of Object.entries(labels)) {
+      const r = key.match(/^traefik\.http\.routers\.([^.]+)\.(.+)$/);
+      if (!r) continue;
+      const bag = routers.get(r[1]) ?? {};
+      bag[r[2]] = val;
+      routers.set(r[1], bag);
+    }
+    for (const [rname, props] of routers) {
+      const rule = props.rule;
+      if (!rule) continue;
+      const hosts = extractHosts(rule);
+      if (hosts.length === 0) {
+        warnings.push(
+          /HostRegexp/i.test(rule) ? `traefik: router "${rname}" uses HostRegexp (${rule}) \u2014 regex hosts aren't migratable` : `traefik: router "${rname}" has no Host() rule (${rule}) \u2014 skipped`
+        );
+        continue;
+      }
+      const ip = resolveIp(c, labels);
+      if (!ip) {
+        warnings.push(
+          `traefik: ${hosts.join(", ")} \u2014 couldn't resolve container ${c.name}'s IP; re-add the upstream manually`
+        );
+        continue;
+      }
+      const svc = props.service?.replace(/@.*$/, "");
+      const def = (svc ? defs.services.get(svc) : void 0) ?? (defs.services.size === 1 ? [...defs.services.values()][0] : void 0);
+      const onlyExposed = c.exposedPorts?.length === 1 ? c.exposedPorts[0].split("/")[0] : void 0;
+      const rawPort = def?.port ?? onlyExposed;
+      const port = /^\d{1,5}$/.test(String(rawPort)) ? String(rawPort) : "80";
+      const scheme = def?.scheme?.toLowerCase() === "https" ? "https" : "http";
+      const middlewares = (props.middlewares ?? "").split(",").map((m) => m.trim().replace(/@.*$/, "")).filter(Boolean);
+      candidates.push({
+        hosts,
+        ssl: Object.keys(props).some(
+          (p) => p === "tls" || p.startsWith("tls.")
+        ),
+        url: `${scheme}://${ip}:${port}`,
+        container: c.name,
+        router: rname,
+        rule,
+        middlewares,
+        redirectOnly: middlewares.length > 0 && middlewares.every((m) => defs.redirectMiddlewares.has(m)),
+        portGuessed: rawPort === void 0
+      });
+    }
+  }
+  const { kept: sites, dropped } = collapseByHost(
+    candidates,
+    (c) => c.hosts,
+    (c) => c.redirectOnly ? 0 : c.ssl ? 2 : 1
+  );
+  for (const cand of sites) {
+    const extras = extraMatchers(cand.rule);
+    if (extras.length > 0) {
+      warnings.push(
+        `traefik: ${cand.hosts.join(", ")} also matches ${extras.join(", ")} \u2014 only the Host() part is migrated; re-add path/header rules manually`
+      );
+    }
+    const carried = cand.middlewares.filter(
+      (m) => !defs.redirectMiddlewares.has(m)
+    );
+    if (carried.length > 0) {
+      warnings.push(
+        `traefik: ${cand.hosts.join(", ")} uses middleware(s) "${carried.join(", ")}" \u2014 not migrated`
+      );
+    }
+    if (cand.portGuessed) {
+      warnings.push(
+        `traefik: ${cand.hosts.join(", ")} \u2014 no service port label and no single exposed port on ${cand.container}; assumed :80, check the upstream`
+      );
+    }
+  }
+  for (const d of dropped) {
+    warnings.push(
+      `traefik: ${d.hosts.join(", ")} router "${d.router}" is an http\u2192https redirect \u2014 Kraft's edge does that itself (nothing to migrate)`
+    );
+  }
+  for (const s of defs.streamRouters) {
+    warnings.push(
+      `traefik: ${s} can't migrate \u2014 Kraft's edge routes HTTP(S), not raw TCP/UDP`
+    );
+  }
+  if (defs.fileProvider) {
+    warnings.push(
+      "traefik: a file provider is configured \u2014 routes defined in its YAML/TOML files are NOT read here, only container labels. Re-add those domains manually."
+    );
+  }
+  return {
+    proxy: "traefik",
+    sites: sites.map((cand) => ({
+      serverNames: cand.hosts,
+      ssl: cand.ssl,
+      target: { kind: "proxy", url: cand.url },
+      source: `traefik container ${cand.container}`
+    })),
+    warnings
+  };
+}
+async function scanTraefik(executor) {
+  const out = await tryExec(
+    executor,
+    `docker ps -q 2>/dev/null | xargs -r docker inspect --format '{{.Name}}	{{json .Config.Labels}}	{{range $n, $v := .NetworkSettings.Networks}}{{$n}}={{$v.IPAddress}} {{end}}	{{range $p, $v := .Config.ExposedPorts}}{{$p}} {{end}}	{{if .Config.Cmd}}{{join .Config.Cmd " "}}{{end}}' 2>/dev/null`
+  );
+  if (!out) {
+    return {
+      proxy: "traefik",
+      sites: [],
+      warnings: ["traefik: couldn't read container labels via docker inspect"]
+    };
+  }
+  const containers = [];
+  for (const line of out.split("\n")) {
+    const [rawName, rawLabels, rawNets, rawPorts, rawCmd] = line.split("	");
+    if (!rawName || !rawLabels) continue;
+    let labels;
+    try {
+      labels = JSON.parse(rawLabels) ?? {};
+    } catch {
+      continue;
+    }
+    const networks = {};
+    let bareIp;
+    for (const pair of (rawNets ?? "").trim().split(/\s+/)) {
+      if (!pair) continue;
+      const eq = pair.indexOf("=");
+      if (eq > 0) {
+        const ip = pair.slice(eq + 1);
+        if (ip) networks[pair.slice(0, eq)] = ip;
+      } else if (!bareIp) {
+        bareIp = pair;
+      }
+    }
+    const exposedPorts = (rawPorts ?? "").trim().split(/\s+/).filter(Boolean);
+    const hasTraefikLabels = Object.keys(labels).some(
+      (k) => k.toLowerCase().startsWith("traefik.")
+    );
+    const looksLikeTraefik = /traefik/i.test(rawCmd ?? "") || /--?providers\./i.test(rawCmd ?? "");
+    if (!hasTraefikLabels && !looksLikeTraefik) continue;
+    containers.push({
+      name: rawName.replace(/^\//, ""),
+      labels,
+      ip: Object.values(networks)[0] ?? bareIp,
+      networks,
+      exposedPorts,
+      cmd: rawCmd ?? void 0
+    });
+  }
+  return parseTraefikLabels(containers);
+}
+
+// ../../packages/adapters/src/system/proxy/import/index.ts
+var INSTALLED_MARKERS = [
+  { proxy: "nginx", paths: ["/etc/nginx/nginx.conf"] },
+  { proxy: "caddy", paths: ["/etc/caddy/Caddyfile"] },
+  {
+    proxy: "apache",
+    paths: ["/etc/apache2/apache2.conf", "/etc/httpd/conf/httpd.conf"]
+  },
+  {
+    proxy: "openresty",
+    paths: [
+      "/usr/local/openresty/nginx/conf/nginx.conf",
+      "/etc/openresty/nginx.conf"
+    ]
+  }
+];
+async function detectInstalledProxy(executor) {
+  const probe = INSTALLED_MARKERS.map(({ proxy, paths }) => {
+    const test = paths.map((p) => `[ -f '${p}' ]`).join(" || ");
+    return `{ ${test}; } && echo ${proxy}`;
+  }).join("; ");
+  let out = "";
+  try {
+    out = await executor.exec(`{ ${probe}; } 2>/dev/null; true`, {
+      timeout: 1e4
+    });
+  } catch {
+    return null;
+  }
+  const found = new Set(
+    out.split("\n").map((l) => l.trim()).filter(Boolean)
+  );
+  return INSTALLED_MARKERS.find((m) => found.has(m.proxy))?.proxy ?? null;
+}
+async function scanImportableSites(executor, proxy) {
+  switch (proxy) {
+    case "nginx":
+      return scanNginx(executor);
+    case "caddy":
+      return scanCaddy(executor);
+    case "apache":
+      return scanApache(executor);
+    case "traefik":
+      return scanTraefik(executor);
+    case "openresty":
+      return scanForeignOpenResty(executor);
+    default:
+      return {
+        proxy,
+        sites: [],
+        warnings: [`${proxy}: config import not supported \u2014 takeover only`]
+      };
+  }
+}
+function canImportProxy(proxy) {
+  return proxy === "nginx" || proxy === "caddy" || proxy === "apache" || proxy === "traefik" || proxy === "openresty";
+}
+function unreachableStaticRoots(sites, opts) {
+  if (!opts.containerEdge) return [];
+  const visible = EDGE_CONTAINER_MOUNTS.map((m) => m.host.replace(/\/+$/, ""));
+  const out = [];
+  for (const site of sites) {
+    if (site.target.kind !== "static") continue;
+    const root = site.target.root.replace(/\/+$/, "");
+    const reachable = visible.some(
+      (v) => root === v || root.startsWith(`${v}/`)
+    );
+    if (!reachable)
+      out.push({ host: site.serverNames[0] ?? root, root: site.target.root });
+  }
+  return out;
+}
+var EDGE_STATIC_MOUNT = EDGE_CONTAINER_MOUNTS.find((m) => m.host === "/opt/kraft/static")?.host ?? "/opt/kraft/static";
+async function copyStaticRootIntoEdge(executor, opts) {
+  const slug = opts.host.replace(/[^a-zA-Z0-9._-]/g, "-").replace(/^-+|-+$/g, "").toLowerCase() || "site";
+  const src = opts.root.replace(/\/+$/, "");
+  const dest = `${EDGE_STATIC_MOUNT}/_adopted/${slug}`;
+  await executor.exec(`mkdir -p ${sq2(dest)}`);
+  await executor.exec(`cp -a ${sq2(`${src}/.`)} ${sq2(`${dest}/`)}`);
+  return dest;
+}
+
+// ../../packages/adapters/src/system/proxy/import/caddy-certs.ts
+var CADDY_DATA_ROOTS = [
+  "/var/lib/caddy/.local/share/caddy",
+  "/root/.local/share/caddy",
+  "/home/caddy/.local/share/caddy",
+  "/data/caddy"
+];
+function candidateNames(host) {
+  const names = [host];
+  const dot = host.indexOf(".");
+  if (dot > 0) names.push(`wildcard_${host.slice(dot)}`);
+  return names;
+}
+async function findPairIn(exec, root, host, container) {
+  for (const name of candidateNames(host)) {
+    const glob = `${root}/certificates/*/${name}/${name}.crt`;
+    let certPath = firstCrt(await tryExec(exec, `ls -1 ${glob} 2>/dev/null`));
+    if (!certPath && container) {
+      certPath = firstCrt(
+        await tryExec(
+          exec,
+          containerCommand(container, `ls -1 ${glob} 2>/dev/null`)
+        )
+      );
+    }
+    if (certPath)
+      return { certPath, keyPath: certPath.replace(/\.crt$/, ".key") };
+  }
+  return null;
+}
+function firstCrt(listing) {
+  return (listing ?? "").split("\n").map((l) => l.trim()).find((l) => l.endsWith(".crt"));
+}
+async function caddyStoreCert(exec, host, container) {
+  for (const root of CADDY_DATA_ROOTS) {
+    const pair = await findPairIn(exec, root, host, container);
+    if (!pair) continue;
+    const certPem = await readMaybeInContainer(exec, pair.certPath, container);
+    const keyPem = await readMaybeInContainer(exec, pair.keyPath, container);
+    if (certPem.trim() && keyPem.trim()) {
+      return { certPem, keyPem, source: `caddy store ${pair.certPath}` };
+    }
+  }
+  return null;
+}
+
+// ../../packages/adapters/src/system/proxy/import/traefik-certs.ts
+var DEFAULT_ACME_PATHS = [
+  "/acme.json",
+  "/etc/traefik/acme.json",
+  "/data/acme.json",
+  "/letsencrypt/acme.json"
+];
+var TRAEFIK_STATIC_CONFIGS = [
+  "/etc/traefik/traefik.yml",
+  "/etc/traefik/traefik.yaml",
+  "/etc/traefik/traefik.toml"
+];
+function prop(obj, name) {
+  const hit = Object.keys(obj).find(
+    (k) => k.toLowerCase() === name.toLowerCase()
+  );
+  return hit === void 0 ? void 0 : obj[hit];
+}
+async function candidateStoragePaths(exec, container) {
+  const found = [];
+  const collect = (text) => {
+    for (const m of (text ?? "").matchAll(
+      /acme\.storage[=:\s]+["']?(\/[^\s"',}]+)/gi
+    )) {
+      if (isSafeCertPath(m[1])) found.push(m[1]);
+    }
+    for (const m of (text ?? "").matchAll(
+      /(?:^|\s)storage:\s*["']?(\/[^\s"',}]+\.json)/gi
+    )) {
+      if (isSafeCertPath(m[1])) found.push(m[1]);
+    }
+  };
+  if (container) {
+    collect(
+      await tryExec(
+        exec,
+        `docker inspect ${sq2(container)} --format '{{json .Config.Cmd}} {{json .Args}} {{json .Config.Env}}' 2>/dev/null`
+      )
+    );
+    for (const cfg of TRAEFIK_STATIC_CONFIGS) {
+      collect(await readMaybeInContainer(exec, cfg, container));
+    }
+  }
+  return [.../* @__PURE__ */ new Set([...found, ...DEFAULT_ACME_PATHS])];
+}
+async function loadAcmeJson(exec, container) {
+  for (const path of await candidateStoragePaths(exec, container)) {
+    const raw = await readMaybeInContainer(exec, path, container);
+    if (raw.trim().startsWith("{")) return { raw, path };
+  }
+  return null;
+}
+function certFromAcmeJson(raw, host) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  const target = host.toLowerCase();
+  const matches = (name) => {
+    const n = (name ?? "").toLowerCase();
+    if (!n) return false;
+    if (n === target) return true;
+    if (!n.startsWith("*.")) return false;
+    const suffix = n.slice(1);
+    return target.endsWith(suffix) && !target.slice(0, -suffix.length).includes(".");
+  };
+  for (const [resolver, value] of Object.entries(parsed)) {
+    if (!value || typeof value !== "object") continue;
+    const certs = prop(value, "certificates");
+    if (!Array.isArray(certs)) continue;
+    for (const entry of certs) {
+      const domain = entry && prop(entry, "domain");
+      const names = [domain?.main, ...domain?.sans ?? []];
+      if (!names.some(matches)) continue;
+      const certB64 = prop(entry, "certificate");
+      const keyB64 = prop(entry, "key");
+      if (typeof certB64 !== "string" || typeof keyB64 !== "string") continue;
+      const certPem = Buffer.from(certB64, "base64").toString("utf-8");
+      const keyPem = Buffer.from(keyB64, "base64").toString("utf-8");
+      if (!certPem.includes("-----BEGIN") || !keyPem.includes("-----BEGIN"))
+        continue;
+      return { certPem, keyPem, resolver };
+    }
+  }
+  return null;
+}
+async function traefikAcmeCert(exec, host, container) {
+  const loaded = await loadAcmeJson(exec, container);
+  if (!loaded) return null;
+  const hit = certFromAcmeJson(loaded.raw, host);
+  if (!hit) return null;
+  return {
+    certPem: hit.certPem,
+    keyPem: hit.keyPem,
+    source: `traefik ${loaded.path} (resolver ${hit.resolver})`
+  };
+}
+async function traefikDeclaredCertPaths(exec, container) {
+  const pairs = [];
+  for (const cfg of TRAEFIK_STATIC_CONFIGS) {
+    const text = await readMaybeInContainer(exec, cfg, container);
+    if (!text.trim()) continue;
+    const certFiles = [
+      ...text.matchAll(/certFile:\s*["']?(\/[^\s"',}]+)/gi)
+    ].map((m) => m[1]);
+    const keyFiles = [...text.matchAll(/keyFile:\s*["']?(\/[^\s"',}]+)/gi)].map(
+      (m) => m[1]
+    );
+    for (let i = 0; i < Math.min(certFiles.length, keyFiles.length); i++) {
+      if (isSafeCertPath(certFiles[i]) && isSafeCertPath(keyFiles[i])) {
+        pairs.push({ certPath: certFiles[i], keyPath: keyFiles[i] });
+      }
+    }
+  }
+  return pairs;
+}
+
+// ../../packages/adapters/src/system/proxy/api.ts
+function buildProxyRouteIndex(sites) {
+  const byPort = /* @__PURE__ */ new Map();
+  for (const site of sites) {
+    const upstreams = site.routes ?? (site.target.kind === "proxy" ? [{ path: "/", url: site.target.url }] : []);
+    for (const up of upstreams) {
+      let port;
+      try {
+        port = Number(new URL(up.url).port);
+      } catch {
+        continue;
+      }
+      if (!Number.isFinite(port) || port <= 0) continue;
+      const list = byPort.get(port) ?? [];
+      const existing = list.find(
+        (r) => r.path === up.path && Boolean(r.exact) === Boolean(up.exact)
+      );
+      if (existing) {
+        existing.domains = [
+          .../* @__PURE__ */ new Set([...existing.domains, ...site.serverNames])
+        ];
+        if (site.ssl) {
+          existing.ssl.enabled = true;
+          if (!existing.ssl.certPath && site.tls) {
+            existing.ssl.certPath = site.tls.certPath;
+            existing.ssl.keyPath = site.tls.keyPath;
+          }
+        }
+        if (site.proxy && (site.ssl || !existing.proxy))
+          existing.proxy = site.proxy;
+      } else {
+        list.push({
+          port,
+          path: up.path,
+          ...up.exact ? { exact: true } : {},
+          domains: [...site.serverNames],
+          ...site.proxy ? { proxy: site.proxy } : {},
+          ssl: site.ssl ? {
+            enabled: true,
+            certPath: site.tls?.certPath,
+            keyPath: site.tls?.keyPath
+          } : { enabled: false },
+          source: site.source
+        });
+      }
+      byPort.set(port, list);
+    }
+  }
+  return byPort;
+}
+async function declaredCert(ctx) {
+  const tls = ctx.site?.tls;
+  if (!tls) return null;
+  const pems = await readDeclaredPair(
+    ctx.exec,
+    tls.certPath,
+    tls.keyPath,
+    ctx.container
+  );
+  return pems ? { ...pems, source: tls.certPath } : null;
+}
+var CERT_SOURCES = {
+  nginx: [declaredCert],
+  openresty: [declaredCert],
+  apache: [declaredCert],
+  caddy: [declaredCert, (c) => caddyStoreCert(c.exec, c.host, c.container)],
+  traefik: [
+    (c) => traefikAcmeCert(c.exec, c.host, c.container),
+    // File provider: paths aren't bound to a hostname (traefik picks by SNI), so
+    // hand every declared pair to the validator and let coverage decide.
+    async (c) => {
+      for (const pair of await traefikDeclaredCertPaths(c.exec, c.container)) {
+        const pems = await readDeclaredPair(
+          c.exec,
+          pair.certPath,
+          pair.keyPath,
+          c.container
+        );
+        if (!pems) continue;
+        if (validateCertFor(c.host, pems, pair.certPath).cert) {
+          return { ...pems, source: pair.certPath };
+        }
+      }
+      return null;
+    }
+  ],
+  // Takeover-only: no importable config, so no cert to find either.
+  haproxy: []
+};
+async function edgeProxy(exec, opts = {}) {
+  const status = opts.status ?? await probeEdge(exec).catch(() => null);
+  if (!status) return null;
+  let kind = null;
+  let ours = false;
+  if (status.classification === "ours") {
+    kind = "openresty";
+    ours = true;
+  } else if (status.classification === "known") {
+    const found = status.occupants.find((o) => o.proxy)?.proxy;
+    kind = found && canImportProxy(found) ? found : null;
+  }
+  if (!kind) kind = await detectInstalledProxy(exec).catch(() => null);
+  if (!kind) return null;
+  const container = status.occupants.find((o) => o.proxy === kind)?.containerName ?? null;
+  return makeApi(exec, kind, ours, container);
+}
+function edgeProxyFor(exec, kind, opts = {}) {
+  return makeApi(exec, kind, opts.ours ?? false, opts.container ?? null);
+}
+async function collectProxyCerts(api, sites) {
+  const certPems = {};
+  const warnings = [];
+  const hosts = [
+    ...new Set(sites.filter((s) => s.ssl).flatMap((s) => s.serverNames))
+  ];
+  for (const host of hosts) {
+    const candidate = await api.certCandidateFor(host).catch(() => null);
+    if (candidate?.cert) {
+      certPems[host] = {
+        certPem: candidate.cert.certPem,
+        keyPem: candidate.cert.keyPem
+      };
+    } else if (candidate?.reason) {
+      warnings.push(`${host}: no reusable certificate \u2014 ${candidate.reason}`);
+    }
+  }
+  return { certPems, warnings };
+}
+function makeApi(exec, kind, ours, container) {
+  let scan = null;
+  const listSites = () => {
+    scan ??= (ours ? scanKraftEdge(exec) : scanImportableSites(exec, kind)).catch(() => ({
+      proxy: kind,
+      sites: [],
+      warnings: [`${kind}: config scan failed`]
+    }));
+    return scan;
+  };
+  let strictLoopbackPorts = null;
+  const listLoopbackUpstreamPortsStrict = (opts = {}) => {
+    if (!ours) {
+      return Promise.reject(
+        new Error(
+          "Strict loopback upstream inventory is only available for the Kraft edge"
+        )
+      );
+    }
+    if (opts.refresh || !strictLoopbackPorts) {
+      const nextScan = scanKraftEdgeStrict(exec, container).then(
+        ({ loopbackUpstreamPorts }) => loopbackUpstreamPorts
+      );
+      strictLoopbackPorts = nextScan;
+      void nextScan.catch(() => {
+        if (strictLoopbackPorts === nextScan) strictLoopbackPorts = null;
+      });
+    }
+    return strictLoopbackPorts;
+  };
+  const siteFor = async (host) => {
+    const target = host.toLowerCase();
+    const { sites } = await listSites();
+    return sites.find(
+      (s) => s.serverNames.some((n) => n.toLowerCase() === target)
+    ) ?? // A wildcard vhost (`*.example.com`) serves the host without naming it.
+    sites.find(
+      (s) => s.serverNames.some((n) => {
+        const name = n.toLowerCase();
+        if (!name.startsWith("*.")) return false;
+        const suffix = name.slice(1);
+        return target.endsWith(suffix) && !target.slice(0, -suffix.length).includes(".");
+      })
+    ) ?? null;
+  };
+  const certCandidateFor = async (host) => {
+    const site = await siteFor(host);
+    const ctx = { exec, host, site, container };
+    let lastReason = null;
+    for (const source of CERT_SOURCES[kind] ?? []) {
+      const raw = await source(ctx).catch(() => null);
+      if (!raw) continue;
+      const candidate = validateCertFor(host, raw, raw.source);
+      if (candidate.cert) return candidate;
+      lastReason = candidate.reason;
+    }
+    return {
+      cert: null,
+      reason: lastReason ?? `${kind}: no certificate found for ${host}`
+    };
+  };
+  return {
+    kind,
+    ours,
+    container,
+    listSites,
+    listLoopbackUpstreamPortsStrict,
+    sitesByPort: async () => buildProxyRouteIndex((await listSites()).sites),
+    siteFor,
+    certFor: async (host) => (await certCandidateFor(host)).cert,
+    certCandidateFor
+  };
+}
+
+// ../../packages/adapters/src/system/catalog.ts
+var MIN_DOCKER_VERSION = "20.10";
+function dockerInstallPlan(profile) {
+  const ops = envOps(profile);
+  const install = ops.dockerInstall();
+  if (!install.supported) return install;
+  const start = ops.dockerStart();
+  return answered({
+    installCommand: opScript(install.value),
+    service: start.supported ? answered(opScript(start.value)) : start,
+    verifyCommand: "docker --version"
+  });
+}
+function packagePlan(profile, pkg, verifyCommand) {
+  const install = envOps(profile).pkgInstall([pkg]);
+  return install.supported ? answered({ installCommand: opScript(install.value), verifyCommand }) : install;
+}
+var systemCatalog = {
+  checks: {
+    docker: {
+      versionCommand: "docker --version",
+      // A POSITIVE signal, not a bare exit code: only a daemon that answered can
+      // name its version. `docker info >/dev/null && echo ok` prints ok on ANY
+      // exit-0, so a daemon answering nothing would read as healthy — trading #408's
+      // false negative for a false positive. Leave stderr alone too; `checkDocker`
+      // puts the failure text in the component message.
+      daemonCommand: "docker info --format '{{.ServerVersion}}'",
+      parseVersion: (output) => output.match(/Docker version ([^\s,]+)/)?.[1] ?? output,
+      missingMessage: "Docker is not installed",
+      notRunningMessage: "Docker is installed but the daemon is not running",
+      // Deliberately does NOT claim the daemon is up or down: the socket's permission
+      // is checked before the daemon is asked, so this arm proves only that we may not
+      // ask. What it can state is the fix, which is the part "not running" got wrong.
+      deniedMessage: "Docker is installed but this connection is not allowed to use its socket \u2014 add the login user to the `docker` group, or connect as root"
+    },
+    openresty: {
+      versionCommand: "openresty -v 2>&1 || /usr/local/openresty/bin/openresty -v 2>&1",
+      runningCommands: [
+        "pgrep -f 'nginx.*openresty' || pgrep -f '/usr/local/openresty'"
+      ],
+      parseVersion: (output) => output.match(/openresty\/(\S+)/)?.[1] ?? output.match(/nginx\/(\S+)/)?.[1] ?? output,
+      missingMessage: "OpenResty is not installed",
+      notRunningMessage: "OpenResty is installed but not running"
+    },
+    certbot: {
+      versionCommand: "certbot --version 2>/dev/null",
+      parseVersion: (output) => output.match(/certbot\s+(\S+)/)?.[1] ?? output,
+      missingMessage: "Certbot is not installed"
+    },
+    git: {
+      versionCommand: "git --version",
+      parseVersion: (output) => output.match(/git version (\S+)/)?.[1] ?? output,
+      missingMessage: "Git is not installed"
+    },
+    rsync: {
+      versionCommand: "rsync --version | head -n 1",
+      parseVersion: (output) => output.match(/rsync\s+version\s+(\S+)/i)?.[1] ?? output,
+      missingMessage: "rsync is not installed"
+    },
+    ufw: {
+      versionCommand: firewallVersionSteps("ufw")[0],
+      parseVersion: (output) => output.match(/ufw\s+(\S+)/i)?.[1] ?? output,
+      missingMessage: "UFW is not installed"
+    },
+    fail2ban: {
+      versionCommand: "fail2ban-client --version 2>&1",
+      parseVersion: (output) => output.match(/fail2ban\s+v?([\d.]+)/i)?.[1] ?? output,
+      missingMessage: "fail2ban is not installed"
+    }
+  },
+  // No `openresty` / `certbot` plans: nothing apt-installs an edge any more. Both
+  // shipped inside the `kraft-edge` image, and their host-package plans (with the
+  // openresty.org apt-repo codename probing that came with them) went with the
+  // installers. `checks.openresty` stays — it parses the version out of the
+  // CONTAINER. See installer.ts `installContainerEdge`.
+  installs: {
+    docker: dockerInstallPlan,
+    git: (profile) => packagePlan(profile, "git", "git --version"),
+    rsync: (profile) => packagePlan(profile, "rsync", "rsync --version | head -n 1"),
+    // Package only, deliberately NOT enabled: `ufw enable` with no allow rule
+    // severs the very SSH connection that ran it. Rules (and enabling) stay an
+    // explicit operator act in the Firewall tab.
+    ufw: (profile) => packagePlan(profile, "ufw", firewallVersionSteps("ufw")[0]),
+    fail2ban: (profile) => packagePlan(profile, "fail2ban", "fail2ban-client --version 2>&1")
+  }
+};
+
+// ../../packages/adapters/src/system/available-version.ts
+var PACKAGE_NAMES = {
+  git: "git",
+  rsync: "rsync",
+  ufw: "ufw",
+  fail2ban: "fail2ban",
+  // The edge is an IMAGE, not a repo package — its "newer version available" comes
+  // from the registry (see the update scanner's imageDigest), never from apt.
+  edge: null,
+  docker: null
+};
+function normalizePkgVersion(raw) {
+  let v = raw.trim();
+  const colon = v.lastIndexOf(":");
+  if (colon !== -1) v = v.slice(colon + 1);
+  const dash = v.indexOf("-");
+  if (dash !== -1) v = v.slice(0, dash);
+  return v.trim();
+}
+var READ_CANDIDATE = {
+  // `apt-cache policy` prints "  Candidate: <version>".
+  apt: (out) => out.match(/Candidate:\s*(\S+)/)?.[1]?.trim() ?? null,
+  // Cached list; the last "pkg.arch  version  repo" row carries the newest avail.
+  dnf: (out) => out.trim().split(/\s+/)[1]?.trim() ?? null,
+  yum: (out) => out.trim().split(/\s+/)[1]?.trim() ?? null,
+  // `apk policy` prints one `  <version>:` line per available version (colon at end
+  // of line), each followed by indented source lines (installed marker, repo URLs);
+  // the last version line is newest.
+  apk: (out) => {
+    const versions = [...out.matchAll(/^\s+([\w.+~-]+):\s*$/gm)].map(
+      (m) => m[1]
+    );
+    return versions.length ? versions[versions.length - 1] : null;
+  },
+  // Both refuse the probe itself, so there is no output to read. Stated rather than
+  // omitted — `null` here is paired with a refusal, not with a missing branch.
+  brew: null,
+  none: null
+};
+async function probeCandidate(executor, profile, pkg) {
+  const read = READ_CANDIDATE[profile.packageManager];
+  const probe = envOps(profile).pkgAvailableVersion(pkg);
+  if (!read || !probe.supported) return null;
+  const out = await tryExec(executor, opScript(probe.value));
+  return out ? read(out) : null;
+}
+async function enrichAvailableVersions(executor, profile, statuses) {
+  const targets = statuses.filter(
+    (s) => s.installed && s.version && PACKAGE_NAMES[s.name]
+  );
+  await Promise.all(
+    targets.map(async (s) => {
+      try {
+        const pkg = PACKAGE_NAMES[s.name];
+        const candidate = await probeCandidate(executor, profile, pkg);
+        if (!candidate) return;
+        const avail = normalizePkgVersion(candidate);
+        const installed = normalizePkgVersion(s.version);
+        if (avail && compareSemver(avail, installed) > 0) {
+          s.availableVersion = avail;
+          s.updateAvailable = true;
+        }
+      } catch {
+      }
+    })
+  );
+}
+
+// ../../packages/adapters/src/system/components.ts
+var SYSTEM_COMPONENTS = [
+  {
+    name: "docker",
+    label: "Docker",
+    description: "Container runtime for deployments",
+    installable: true,
+    category: "core"
+  },
+  {
+    name: "git",
+    label: "Git",
+    description: "Version control for source code",
+    installable: true,
+    category: "core"
+  },
+  {
+    // ONE component for the edge, because it is ONE artifact: the kraft-edge
+    // image. OpenResty, its Lua, and certbot all ship inside it — they were three
+    // rows in this list for a thing that is installed, checked, and removed as a
+    // unit, and neither "openresty" nor "certbot" was independently installable
+    // on a converted box.
+    name: "edge",
+    label: "Edge",
+    description: "Routing + TLS \u2014 the kraft-edge container (OpenResty, Lua, certbot)",
+    installable: true,
+    category: "infrastructure"
+  },
+  {
+    name: "rsync",
+    label: "rsync",
+    description: "Fast directory sync for remote local-build transfers",
+    installable: true,
+    category: "infrastructure"
+  },
+  {
+    name: "ufw",
+    label: "UFW",
+    description: "Host firewall frontend",
+    installable: true,
+    category: "infrastructure",
+    proposeWhenMissing: true
+  },
+  {
+    name: "fail2ban",
+    label: "fail2ban",
+    description: "Brute-force protection",
+    installable: true,
+    category: "infrastructure",
+    proposeWhenMissing: true
+  }
+];
+var SYSTEM_COMPONENTS_BY_NAME = new Map(
+  SYSTEM_COMPONENTS.map((component) => [component.name, component])
+);
+function getSystemComponentDefinition(name) {
+  return SYSTEM_COMPONENTS_BY_NAME.get(name) ?? {
+    name,
+    label: name,
+    description: `${name} component`,
+    installable: false,
+    category: "infrastructure"
+  };
+}
+
+// ../../packages/adapters/src/system/checks.ts
+function isSocketDenied(error) {
+  return error != null && /permission denied|eacces/i.test(error);
+}
+function healthy(name, version, running) {
+  const component = getSystemComponentDefinition(name);
+  return {
+    name,
+    label: component.label,
+    description: component.description,
+    installable: component.installable,
+    installed: true,
+    version,
+    running,
+    healthy: running !== void 0 ? running : true,
+    message: running ? `${name} ${version} - running` : `${name} ${version} - installed`
+  };
+}
+function unhealthy(name, message, opts) {
+  const component = getSystemComponentDefinition(name);
+  return {
+    name,
+    label: component.label,
+    description: component.description,
+    installable: component.installable,
+    installed: !!opts?.version,
+    version: opts?.version,
+    running: opts?.running,
+    healthy: false,
+    message
+  };
+}
+async function checkDocker(executor) {
+  const startedAt = Date.now();
+  const recipe = systemCatalog.checks.docker;
+  const version = await probeExec(executor, recipe.versionCommand, "checks");
+  if (!version.output) {
+    systemDebug("checks", `docker:missing (${formatDuration(startedAt)})`);
+    return unhealthy(
+      "docker",
+      withReason(recipe.missingMessage, version.error)
+    );
+  }
+  const parsed = recipe.parseVersion(version.output);
+  const info = await probeExec(executor, recipe.daemonCommand, "checks");
+  if (!info.output) {
+    const denied = isSocketDenied(info.error);
+    systemDebug(
+      "checks",
+      `docker:${denied ? "denied" : "not-running"} (${formatDuration(startedAt)}) ${info.error ?? "probe exited 0 with no server version"}`
+    );
+    return unhealthy(
+      "docker",
+      withReason(
+        denied && recipe.deniedMessage || recipe.notRunningMessage,
+        info.error
+      ),
+      {
+        version: parsed,
+        // Left UNSET when denied: `running: false` would be a fact we don't have. The
+        // permission check happens before the daemon is consulted, so a refusal is
+        // equally consistent with a healthy daemon, and asserting it is stopped is the
+        // same class of guess the message above stopped making.
+        ...denied ? {} : { running: false }
+      }
+    );
+  }
+  systemDebug("checks", `docker:healthy (${formatDuration(startedAt)})`);
+  return healthy("docker", parsed, true);
+}
+async function checkGit(executor) {
+  const startedAt = Date.now();
+  const recipe = systemCatalog.checks.git;
+  const version = await probeExec(executor, recipe.versionCommand, "checks");
+  if (!version.output) {
+    systemDebug("checks", `git:missing (${formatDuration(startedAt)})`);
+    return unhealthy("git", withReason(recipe.missingMessage, version.error));
+  }
+  const parsed = recipe.parseVersion(version.output);
+  systemDebug("checks", `git:healthy (${formatDuration(startedAt)})`);
+  return healthy("git", parsed);
+}
+async function checkRsync(executor) {
+  const startedAt = Date.now();
+  const recipe = systemCatalog.checks.rsync;
+  const version = await probeExec(executor, recipe.versionCommand, "checks");
+  if (!version.output) {
+    systemDebug("checks", `rsync:missing (${formatDuration(startedAt)})`);
+    return unhealthy("rsync", withReason(recipe.missingMessage, version.error));
+  }
+  const parsed = recipe.parseVersion(version.output);
+  systemDebug("checks", `rsync:healthy (${formatDuration(startedAt)})`);
+  return healthy("rsync", parsed);
+}
+async function checkUfw(executor) {
+  const startedAt = Date.now();
+  const recipe = systemCatalog.checks.ufw;
+  const version = await probeExec(executor, recipe.versionCommand, "checks");
+  if (!version.output) {
+    systemDebug("checks", `ufw:missing (${formatDuration(startedAt)})`);
+    return unhealthy("ufw", withReason(recipe.missingMessage, version.error));
+  }
+  const parsed = recipe.parseVersion(version.output);
+  const status = await probeExecElevated(
+    executor,
+    firewallActiveSteps("ufw")[0],
+    "checks"
+  );
+  const observed = (status.output ?? "").split("\n")[0]?.trim() ?? "";
+  if (/Status:\s*active/i.test(observed)) {
+    systemDebug("checks", `ufw:healthy (${formatDuration(startedAt)})`);
+    return healthy("ufw", parsed, true);
+  }
+  if (/Status:\s*inactive/i.test(observed)) {
+    systemDebug("checks", `ufw:inactive (${formatDuration(startedAt)})`);
+    return unhealthy(
+      "ufw",
+      `UFW is installed but reports "${observed}" \u2014 enable it on the host after allowing SSH.`,
+      {
+        version: parsed,
+        running: false
+      }
+    );
+  }
+  systemDebug("checks", `ufw:unreadable (${formatDuration(startedAt)})`);
+  return unhealthy(
+    "ufw",
+    withReason(
+      "UFW is installed but its status could not be read here",
+      status.error
+    ),
+    { version: parsed }
+  );
+}
+async function checkFail2ban(executor) {
+  const startedAt = Date.now();
+  const recipe = systemCatalog.checks.fail2ban;
+  const version = await probeExec(executor, recipe.versionCommand, "checks");
+  if (!version.output) {
+    systemDebug("checks", `fail2ban:missing (${formatDuration(startedAt)})`);
+    return unhealthy(
+      "fail2ban",
+      withReason(recipe.missingMessage, version.error)
+    );
+  }
+  const parsed = recipe.parseVersion(version.output);
+  const pong = await probeExecElevated(
+    executor,
+    "fail2ban-client ping 2>&1",
+    "checks"
+  );
+  if (/pong/i.test(pong.output ?? "")) {
+    systemDebug("checks", `fail2ban:healthy (${formatDuration(startedAt)})`);
+    return healthy("fail2ban", parsed, true);
+  }
+  const cause = (pong.error ?? "").replace(
+    /^.*fail2ban\[\d+\]:\s*(ERROR\s*)?/i,
+    ""
+  );
+  systemDebug("checks", `fail2ban:not-running (${formatDuration(startedAt)})`);
+  return unhealthy(
+    "fail2ban",
+    withReason("fail2ban is installed but not running", cause),
+    {
+      version: parsed,
+      running: false
+    }
+  );
+}
+async function checkEdge(executor) {
+  const startedAt = Date.now();
+  const container = await resolveOurEdgeContainer(executor);
+  if (!container) {
+    systemDebug("checks", `edge:missing (${formatDuration(startedAt)})`);
+    return unhealthy(
+      "edge",
+      "No edge on this server. The edge is the kraft-edge container \u2014 install it (requires Docker)."
+    );
+  }
+  const verdict = await verifyEdgeServing(executor, container);
+  if (!verdict.serving) {
+    systemDebug("checks", `edge:not-serving (${formatDuration(startedAt)})`);
+    return unhealthy(
+      "edge",
+      `The edge container ${container} is not serving \u2014 ${verdict.reason ?? "it is not listening on :80"}`,
+      { running: false }
+    );
+  }
+  const version = await probeExec(
+    executor,
+    containerCommand(container, "openresty -v 2>&1"),
+    "checks"
+  );
+  if (!version.output) {
+    systemDebug(
+      "checks",
+      `edge:container-unresponsive (${formatDuration(startedAt)})`
+    );
+    return unhealthy(
+      "edge",
+      withReason(
+        `The edge container ${container} is serving on :80 but not answering \u2014 check \`docker logs ${container}\``,
+        version.error
+      ),
+      { running: false }
+    );
+  }
+  systemDebug("checks", `edge:healthy (${formatDuration(startedAt)})`);
+  return healthy(
+    "edge",
+    systemCatalog.checks.openresty.parseVersion(version.output),
+    true
+  );
+}
+var COMPONENT_CHECKS = {
+  docker: checkDocker,
+  edge: checkEdge,
+  git: checkGit,
+  rsync: checkRsync,
+  ufw: checkUfw,
+  fail2ban: checkFail2ban
+};
+async function mapWithConcurrency(items, limit, fn) {
+  const results = new Array(items.length);
+  let cursor = 0;
+  const worker = async () => {
+    while (cursor < items.length) {
+      const index = cursor++;
+      results[index] = await fn(items[index]);
+    }
+  };
+  await Promise.all(
+    Array.from({ length: Math.min(limit, items.length) }, worker)
+  );
+  return results;
+}
+var CHECK_CONCURRENCY = 4;
+async function checkAll(executor) {
+  const startedAt = Date.now();
+  const entries = SYSTEM_COMPONENTS.map(
+    (component) => [component.name, COMPONENT_CHECKS[component.name]]
+  ).filter((entry) => Boolean(entry[1]));
+  systemDebug(
+    "checks",
+    `checkAll:start [${entries.map(([name]) => name).join(", ")}]`
+  );
+  const results = await mapWithConcurrency(
+    entries,
+    CHECK_CONCURRENCY,
+    ([, fn]) => fn(executor)
+  );
+  await enrichAvailable(executor, results);
+  systemDebug("checks", `checkAll:done (${formatDuration(startedAt)})`);
+  return results;
+}
+async function enrichAvailable(executor, results) {
+  try {
+    const profile = await resolveEnvironment(executor);
+    await enrichAvailableVersions(executor, profile, results);
+  } catch {
+  }
+}
+async function checkComponents(executor, names) {
+  const startedAt = Date.now();
+  const fns = names.map((name) => COMPONENT_CHECKS[name]).filter((fn) => Boolean(fn));
+  systemDebug("checks", `checkComponents:start [${names.join(", ")}]`);
+  const results = await mapWithConcurrency(
+    fns,
+    CHECK_CONCURRENCY,
+    (fn) => fn(executor)
+  );
+  await enrichAvailable(executor, results);
+  systemDebug(
+    "checks",
+    `checkComponents:done [${names.join(", ")}] (${formatDuration(startedAt)})`
+  );
+  return results;
+}
+
+// ../../packages/adapters/src/system/installer.ts
+function log3(message, level = "info") {
+  return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
+}
+async function prepareExecutor(executor, component) {
+  const grant = await privilegedExecutor(executor, `Installing ${component}`);
+  if (!grant.supported) {
+    return {
+      ok: false,
+      result: { component, success: false, error: grant.reason }
+    };
+  }
+  return {
+    ok: true,
+    executor: grant.value.executor,
+    profile: grant.value.profile
+  };
+}
+function describeInstallFailure(label, code, output) {
+  const lines = output.split("\n").map((line) => line.replace(/\r/g, "").trim()).filter(Boolean);
+  const flagged = lines.filter(
+    (line) => /^(e:|err:|error:|dpkg:|fatal:)/i.test(line)
+  );
+  const picked = (flagged.length ? flagged : lines).slice(-3).join(" \xB7 ");
+  const detail = picked.length > 400 ? `${picked.slice(0, 399)}\u2026` : picked;
+  const held = /held packages?|--allow-change-held-packages/i.test(output) ? " Packages are held on this host (`apt-mark hold`) and Kraft does not override a hold \u2014 unhold them first if you do want this install." : "";
+  return `${label} install failed (exit ${code})${detail ? `: ${detail}` : ""}.${held}`;
+}
+async function probeDocker(executor) {
+  const status = await checkDocker(executor);
+  const version = status.version;
+  if (!status.installed) return { verdict: "missing", message: status.message };
+  if (!status.healthy)
+    return { verdict: "stopped", version, message: status.message };
+  if (version && compareSemver(version, MIN_DOCKER_VERSION) < 0) {
+    return { verdict: "outdated", version, message: status.message };
+  }
+  return { verdict: "ok", version, message: status.message };
+}
+function dockerAlreadyThere(present, onLog) {
+  const named = present.version ? `Docker ${present.version}` : "Docker";
+  onLog(
+    log3(
+      `${named} is installed and its daemon is answering \u2014 nothing to install`
+    )
+  );
+  return { component: "docker", success: true, version: present.version };
+}
+async function installDocker(executor, onLog, config) {
+  const forced = config?.reinstall === true;
+  let present = forced ? null : await probeDocker(executor);
+  if (present?.verdict === "ok") return dockerAlreadyThere(present, onLog);
+  const prep = await prepareExecutor(executor, "docker");
+  if (!prep.ok) return prep.result;
+  executor = prep.executor;
+  const profile = prep.profile;
+  if (present && present.verdict !== "missing" && !profile.isRoot) {
+    present = await probeDocker(executor);
+    if (present.verdict === "ok") return dockerAlreadyThere(present, onLog);
+  }
+  const plan = systemCatalog.installs.docker(profile);
+  const service = plan.supported ? plan.value.service : plan;
+  if (present?.verdict === "stopped" && service?.supported) {
+    onLog(log3(`${present.message} \u2014 starting the Docker service`, "warn"));
+    await executor.streamExec(service.value, onLog).catch(() => void 0);
+    present = await probeDocker(executor);
+    if (present.verdict === "ok") {
+      onLog(log3(`Docker ${present.version} is running`));
+      return { component: "docker", success: true, version: present.version };
+    }
+  }
+  if (present && present.verdict !== "missing") {
+    const cannotStart = present.verdict === "stopped" && service && !service.supported ? ` Kraft could not start it for you: ${service.reason}` : "";
+    const error = (present.verdict === "outdated" ? `Docker ${present.version} is installed but Kraft needs ${MIN_DOCKER_VERSION} or newer. Upgrading Docker restarts the daemon and every container on this server, so it is never done as part of another step \u2014 upgrade it on the host, or use Reinstall on the Docker component to run the official installer.` : `${present.message}. Start Docker on this server and retry. Kraft will not reinstall Docker over a daemon that is merely unreachable: the installer would also upgrade the engine and restart every container on this host. Use Reinstall on the Docker component if that is what you want.`) + cannotStart;
+    onLog(log3(error, "error"));
+    return {
+      component: "docker",
+      success: false,
+      version: present.version,
+      error
+    };
+  }
+  if (!plan.supported) {
+    onLog(log3(plan.reason, "error"));
+    return { component: "docker", success: false, error: plan.reason };
+  }
+  onLog(
+    forced ? log3(
+      "Running the Docker installer \u2014 it may upgrade the engine, which restarts the daemon and every container on this host...",
+      "warn"
+    ) : log3("Installing Docker Engine...")
+  );
+  try {
+    const { code, output } = await executor.streamExec(
+      plan.value.installCommand,
+      onLog
+    );
+    if (code !== 0) {
+      const error = describeInstallFailure("Docker", code, output);
+      onLog(log3(error, "error"));
+      return { component: "docker", success: false, error };
+    }
+    if (service?.supported) {
+      onLog(log3("Starting Docker service..."));
+      await executor.streamExec(
+        service.value,
+        onLog
+      );
+    } else if (service) {
+      onLog(
+        log3(
+          `Docker is installed but Kraft cannot start it here: ${service.reason}`,
+          "warn"
+        )
+      );
+    }
+    const version = await executor.exec(plan.value.verifyCommand);
+    const parsed = systemCatalog.checks.docker.parseVersion(version);
+    onLog(log3(`Docker ${parsed} installed`));
+    return { component: "docker", success: true, version: parsed };
+  } catch (err) {
+    const msg = safeErrorMessage(err);
+    onLog(log3(`Docker installation failed: ${msg}`, "error"));
+    return { component: "docker", success: false, error: msg };
+  }
+}
+async function installPackaged(executor, onLog, component, label, where) {
+  const prep = await prepareExecutor(executor, component);
+  if (!prep.ok) return prep.result;
+  executor = prep.executor;
+  const plan = systemCatalog.installs[component](prep.profile);
+  if (!plan.supported) {
+    onLog(log3(plan.reason, "error"));
+    return { component, success: false, error: plan.reason };
+  }
+  const inside = where ? ` in ${where}` : "";
+  onLog(log3(`Installing ${label}${inside}...`));
+  try {
+    const { code, output } = await executor.streamExec(
+      plan.value.installCommand,
+      onLog
+    );
+    if (code !== 0) {
+      const error = describeInstallFailure(label, code, output);
+      onLog(log3(error, "error"));
+      return { component, success: false, error };
+    }
+    const version = await executor.exec(plan.value.verifyCommand);
+    const parsed = systemCatalog.checks[component].parseVersion(version);
+    onLog(log3(`${label} ${parsed} installed${inside}`));
+    return { component, success: true, version: parsed };
+  } catch (err) {
+    const msg = safeErrorMessage(err);
+    onLog(log3(`${label} installation failed: ${msg}`, "error"));
+    return { component, success: false, error: msg };
+  }
+}
+function installGit(executor, onLog, opts) {
+  return installPackaged(executor, onLog, "git", "Git", opts?.label);
+}
+function installRsync(executor, onLog) {
+  return installPackaged(executor, onLog, "rsync", "rsync");
+}
+function installUfw(executor, onLog) {
+  return installPackaged(executor, onLog, "ufw", "UFW");
+}
+function installFail2ban(executor, onLog) {
+  return installPackaged(executor, onLog, "fail2ban", "fail2ban");
+}
+async function installContainerEdge(executor, onLog, config) {
+  const prep = await prepareExecutor(executor, "edge");
+  if (!prep.ok) return prep.result;
+  executor = prep.executor;
+  if (!await dockerAvailable(executor)) {
+    const error = "The edge is a container image and needs Docker on this server. Install the Docker component first, then install the edge.";
+    onLog(log3(error, "error"));
+    return { component: "edge", success: false, error };
+  }
+  try {
+    const result = await ensureContainerEdge(executor, {
+      onLog,
+      config,
+      image: config?.edgeImage
+    });
+    if (result.converted) {
+      onLog(
+        log3("Edge moved from host OpenResty to the container edge", "warn")
+      );
+    }
+    const version = await executor.exec(containerCommand(result.container, "openresty -v 2>&1")).catch(() => "");
+    return {
+      component: "edge",
+      success: true,
+      version: version ? systemCatalog.checks.openresty.parseVersion(version) : void 0
+    };
+  } catch (err) {
+    if (err instanceof EdgeMigrateRequested) throw err;
+    const msg = safeErrorMessage(err);
+    onLog(log3(`Edge setup failed: ${msg}`, "error"));
+    return { component: "edge", success: false, error: msg };
+  }
+}
+var COMPONENT_INSTALLERS = {
+  docker: (exec, log6, config) => installDocker(exec, log6, config),
+  // The edge is ONE component and it is a container image — there is no
+  // host-OpenResty or host-certbot installer to reach for any more.
+  edge: (exec, log6, config) => installContainerEdge(exec, log6, config),
+  git: (exec, log6) => installGit(exec, log6),
+  rsync: (exec, log6) => installRsync(exec, log6),
+  ufw: (exec, log6) => installUfw(exec, log6),
+  fail2ban: (exec, log6) => installFail2ban(exec, log6)
+};
+
+// ../../packages/adapters/src/system/proxy/index.ts
+async function importSites(executor, status) {
+  const proxy = status.occupants.find((o) => o.proxy)?.proxy;
+  if (!proxy) return { proxy: "nginx", sites: [], warnings: [] };
+  if (canImportProxy(proxy)) return scanImportableSites(executor, proxy);
+  return {
+    proxy,
+    sites: [],
+    warnings: [`${proxy}: config import not supported \u2014 takeover only`]
+  };
+}
+async function foreignProxyOnEdge(executor) {
+  const status = await probeEdge(executor);
+  const blocked = !status.canProceedClean && status.occupants.length > 0;
+  return { status, blocked, owner: describeEdgeOwner(status.occupants) };
+}
+function describeEdgeOwner(occupants) {
+  const labels = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const o of occupants) {
+    const identity = o.systemdUnit ?? o.containerName ?? (o.pid ? `pid:${o.pid}` : o.command ?? `port:${o.port}`);
+    if (seen.has(identity)) continue;
+    seen.add(identity);
+    labels.push(
+      o.systemdUnit ?? (o.containerName ? `docker container ${o.containerName}` : void 0) ?? (o.proxy && o.pid ? `${o.proxy} (PID ${o.pid})` : void 0) ?? o.proxy ?? o.command ?? `port ${o.port}`
+    );
+  }
+  return labels.join(", ");
+}
+
+// ../../packages/adapters/src/system/proxy/consent.ts
+function log4(message, level = "info") {
+  return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
+}
+async function ensureEdgeClear(executor, config, onLog) {
+  const status = await probeEdge(executor);
+  if (status.canProceedClean) return { tookOver: false, status };
+  const takeover = async () => {
+    onLog(
+      log4(
+        `Taking over ports from ${status.occupants.map((o) => o.command ?? o.port).join(", ")}...`,
+        "warn"
+      )
+    );
+    const freed = await beginEdgeTakeover(
+      executor,
+      status,
+      onLog,
+      config?.edgePolicy?.stopTargets ?? []
+    );
+    if (!freed.freed) {
+      await rollbackEdgeTakeover(executor, onLog);
+      const plural = freed.stillBound.length > 1;
+      const ports = `port${plural ? "s" : ""} ${freed.stillBound.join(" and ")} ${plural ? "are" : "is"} still in use, so the edge can't bind. Nothing was installed`;
+      throw new AppError(
+        // The advice has to match the actual cause. Told to hunt for another holder, an
+        // operator retries the same unprivileged takeover forever — and "stopped the
+        // existing proxy" is untrue on this arm, since the stop is what was refused.
+        freed.privilegeDegraded ? `The ${ports} \u2014 and Kraft could not run the stop as root on this host (see the privilege warning above), so stopping the existing proxy was almost certainly refused. Retrying as this user will fail the same way: reconnect as root, or as a user with passwordless sudo.` : `Stopped the existing proxy, but ${ports} and the previous proxy has been restored \u2014 find what else is holding the port and retry.`,
+        409,
+        "EDGE_PORTS_STILL_BOUND"
+      );
+    }
+  };
+  if (config?.edgePolicy?.mode === "takeover") {
+    await takeover();
+    return { tookOver: true, status };
+  }
+  if (config?.promptUser) {
+    const known = status.classification === "known";
+    const owner = status.occupants.map((o) => o.command ?? `port ${o.port}`).join(", ");
+    const scan = await importSites(executor, status);
+    const migratable = scan.sites.length > 0;
+    const message = migratable ? `Kraft runs its own load balancer (OpenResty) on ports 80 and 443, but ${owner} is already serving them (${scan.sites.length} site${scan.sites.length === 1 ? "" : "s"}). Migrate those sites into Kraft and take over, just stop it and take over, or cancel?` : known ? `Kraft runs its own load balancer (OpenResty) on ports 80 and 443, but ${owner} is already serving them. Stop it and take over, or cancel and leave it running?` : `Kraft runs its own load balancer (OpenResty) on ports 80 and 443, but ${owner} is already using them and we can't identify it. Stop it and take over, or cancel and leave it running?`;
+    const details = {
+      edge: status,
+      sites: scan.sites,
+      warnings: scan.warnings
+    };
+    const action = await config.promptUser({
+      promptId: "edge_conflict",
+      title: known ? "Existing reverse proxy detected" : "Ports 80/443 are in use",
+      message,
+      actions: [
+        ...migratable ? [
+          {
+            id: "migrate",
+            label: `Migrate ${scan.sites.length} site(s) & take over`,
+            variant: "primary"
+          }
+        ] : [],
+        { id: "override", label: "Stop it & take over", variant: "danger" },
+        { id: "cancel", label: "Cancel", variant: "secondary" }
+      ],
+      details
+    });
+    if (action === "migrate") {
+      throw new EdgeMigrateRequested(status, scan.sites, scan.warnings);
+    }
+    if (action === "override") {
+      await takeover();
+      return { tookOver: true, status };
+    }
+    throw new EdgeConflictError(status);
+  }
+  throw new EdgeConflictError(status);
+}
+
+// ../../packages/adapters/src/system/proxy/ensure-container-edge.ts
+function log5(message, level = "info") {
+  return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
+}
+var injectedDefaultImage;
+function setDefaultEdgeImage(image) {
+  injectedDefaultImage = image?.trim() || void 0;
+}
+function resolveEdgeImage(explicit) {
+  return buildEdgeImageRef({ explicit, injectedDefault: injectedDefaultImage });
+}
+function edgeHostExecutor(executor) {
+  return rootOrDegrade(executor, {
+    purpose: "Configuring routing and TLS",
+    consequence: "Vhosts and certificates may not be writable, and routing will be incomplete \u2014 the deploy continues and the app still runs on its port.",
+    report: (message) => console.error(`[edge] ${message}`)
+  });
+}
+async function containerEdgeProvider(executor, container, opts) {
+  const { NginxProvider: Provider } = await import("./nginx-VITTWZZU.js");
+  return new Provider({
+    ...opts,
+    // Vhosts go to the BIND-MOUNTED HOST dir (so every host-side reader — the
+    // migrate proxy scan, cert reuse, the mail cert symlinks — keeps working),
+    // while reload/certbot run inside the container.
+    paths: EDGE_HOST_PATHS,
+    executor: edgeContainerExecutor(
+      await edgeHostExecutor(executor),
+      container
+    ),
+    // Challenge tokens go to the HOST side of the ACME mount, for the same reason
+    // vhosts do. This is the ONE mount whose two sides differ
+    // (/var/lib/kraft/edge/acme → /var/www/acme), so the write path and the
+    // vhost's `root` are genuinely different strings — `root` stays the container
+    // path. Overridden here and nowhere else, next to the `paths` override it
+    // mirrors, so the two cannot drift.
+    challengeDir: EDGE_CHALLENGE_HOST_DIR,
+    // MUST be pinned: re-detection answers from inside the container and would
+    // repoint sitesDir at a host dir the edge never reads.
+    pinPaths: true,
+    // Reload runs INSIDE the container, where the master is pid 1 — so a failed
+    // reload must never fall back to killing it (#292).
+    containerEdge: true
+  });
+}
+async function localContainerEdgeProvider(container, opts) {
+  const { DockerEdgeExecutor } = await import("./docker-edge-executor-VO6JHHW2.js");
+  const { NginxProvider: Provider } = await import("./nginx-VITTWZZU.js");
+  return new Provider({
+    ...opts,
+    paths: OPENRESTY_DEFAULT_PATHS,
+    // The one place the privilege gate is the WRONG instrument, so the reason is stated
+    // instead: this executor's commands run inside the EDGE container, so probing
+    // through it would measure that container's interior and brand the result with a
+    // verdict about the wrong machine. Privilege here comes from the deployment shape —
+    // the api process is root in its own container, the vhost dir is a bind mount it
+    // owns, and the daemon socket is mounted in. There is no login to elevate.
+    executor: rootChecked(
+      new DockerEdgeExecutor({ containerName: container }),
+      "compose: api is root in its own container, writing shared mounts over a mounted socket"
+    ),
+    // nginx.conf + the Lua are BAKED into the image — nothing to detect, install
+    // or patch, and detection would answer from inside the container anyway.
+    pinPaths: true,
+    // `docker exec`s into the edge, so the master is pid 1 there too (#292).
+    containerEdge: true
+  });
+}
+async function startEdgeContainer(executor, container, image, onLog, mounts) {
+  await sanitizeEdgeVhosts(executor, EDGE_HOST_PATHS.sitesDir, onLog).catch(
+    () => {
+    }
+  );
+  await executor.exec(`docker rm -f ${sq(container)} 2>/dev/null || true`).catch(() => {
+  });
+  const run = await executor.streamExec(
+    buildEdgeRunCommand(container, image, mounts),
+    onLog
+  );
+  invalidateEdgeContainer(executor);
+  return run.code === 0;
+}
+var MOUNT_RESOLVE_MARKER = "__KRAFT_MOUNT__";
+async function resolveEdgeContainerMounts(executor) {
+  const script = EDGE_CONTAINER_MOUNTS.map(
+    (mount) => `echo ${MOUNT_RESOLVE_MARKER}; (cd ${sq(mount.host)} && pwd -P) 2>&1`
+  ).join("; ") + "; true";
+  let raw;
+  try {
+    raw = await executor.exec(script);
+  } catch (err) {
+    throw new Error(
+      `Could not resolve edge bind-mount sources on the target host: ${safeErrorMessage(err)}`
+    );
+  }
+  const segments = raw.split(MOUNT_RESOLVE_MARKER).slice(1);
+  if (segments.length !== EDGE_CONTAINER_MOUNTS.length) {
+    throw new Error(
+      `Could not resolve edge bind-mount sources on the target host: expected ${EDGE_CONTAINER_MOUNTS.length} paths, received ${JSON.stringify(raw)}.`
+    );
+  }
+  return EDGE_CONTAINER_MOUNTS.map((mount, i) => {
+    const host = segments[i].trim();
+    if (!host.startsWith("/") || host.includes("\n")) {
+      throw new Error(
+        `Could not resolve edge bind-mount source ${mount.host} on the target host: expected one absolute path, received ${JSON.stringify(host)}.`
+      );
+    }
+    return { host, container: mount.container };
+  });
+}
+function buildEdgeRunCommand(container, image, edgeMounts = EDGE_CONTAINER_MOUNTS) {
+  const mounts = edgeMounts.map(
+    // `:z` relabels for SELinux-enforcing hosts; a no-op elsewhere.
+    (m) => `-v ${sq(`${m.host}:${m.container}:z`)}`
+  ).join(" ");
+  return [
+    "docker run -d",
+    `--name ${sq(container)}`,
+    "--network host",
+    "--restart unless-stopped",
+    mounts,
+    sq(image)
+  ].join(" ");
+}
+async function edgeContainerMountsMatch(executor, container, expected) {
+  let raw;
+  try {
+    raw = await executor.exec(
+      `docker inspect -f '{{range .HostConfig.Binds}}{{println .}}{{end}}' ${sq(container)}`
+    );
+  } catch {
+    return null;
+  }
+  const actual = /* @__PURE__ */ new Map();
+  for (const line of raw.split("\n")) {
+    const [source, destination] = line.trim().split(":");
+    if (!source || !destination) continue;
+    actual.set(destination, source);
+  }
+  return expected.every((mount) => actual.get(mount.container) === mount.host);
+}
+function makeEdgeStart(executor, container, opts, mounts) {
+  const { onLog } = opts;
+  return async (image) => {
+    if (!await startEdgeContainer(executor, container, image, onLog, mounts))
+      return false;
+    const verdict = await verifyEdgeServing(executor, container, {
+      timeoutMs: opts.verifyTimeoutMs ?? 3e4
+    });
+    if (!verdict.serving && verdict.reason)
+      onLog(log5(`Edge ${image}: ${verdict.reason}`, "warn"));
+    return verdict.serving;
+  };
+}
+async function verifyEdgeServing(executor, container, opts = {}) {
+  if (await edgeIsBroken(executor, container)) {
+    const reason = await edgeCrashReason(executor, container);
+    return {
+      serving: false,
+      reason: reason ?? "the edge container is not running"
+    };
+  }
+  if (opts.configTest) {
+    try {
+      await executor.exec(containerCommand(container, "openresty -t 2>&1"));
+    } catch (err) {
+      const out = safeErrorMessage(err);
+      return { serving: false, reason: edgeFailureReason(out) ?? out };
+    }
+  }
+  const listening = await waitForPortListening(executor, 80, {
+    timeoutMs: opts.timeoutMs ?? 0
+  });
+  if (listening.checked && !listening.listening) {
+    const reason = await edgeCrashReason(executor, container);
+    return {
+      serving: false,
+      reason: reason ?? "the edge container is up but nothing is listening on :80"
+    };
+  }
+  return { serving: true };
+}
+async function ensureContainerEdge(executor, opts) {
+  const { onLog } = opts;
+  const container = opts.container?.trim() || EDGE_CONTAINER_NAME;
+  const image = resolveEdgeImage(opts.image);
+  let resolvedMounts = null;
+  const targetMounts = async (checked) => {
+    if (resolvedMounts) return resolvedMounts;
+    const host = checked ?? await rootOrDegrade(executor, {
+      purpose: "Resolving the edge's bind-mount sources",
+      consequence: "Docker may mount a different host directory than Kraft writes.",
+      report: (message) => onLog(log5(message, "warn"))
+    });
+    resolvedMounts = await resolveEdgeContainerMounts(host);
+    return resolvedMounts;
+  };
+  const existing = await resolveOurEdgeContainer(executor, { fresh: true });
+  if (existing) {
+    const verdict = await verifyEdgeServing(executor, existing);
+    if (!verdict.serving) {
+      onLog(
+        log5(
+          `The edge container exists but isn't serving: ${verdict.reason}`,
+          "warn"
+        )
+      );
+      onLog(log5("Recreating it...", "warn"));
+    } else {
+      const mounts2 = await targetMounts();
+      const mountsMatch = await edgeContainerMountsMatch(
+        executor,
+        existing,
+        mounts2
+      );
+      if (mountsMatch === false) {
+        onLog(
+          log5(
+            "The edge container uses stale or non-canonical bind mounts; recreating it...",
+            "warn"
+          )
+        );
+      } else {
+        const current = await containerImageRef(executor, existing);
+        const stale = current != null && current !== image;
+        if (stale) {
+          const start = makeEdgeStart(executor, existing, opts, mounts2);
+          const swap = await swapManagedImage(executor, {
+            kind: "edge",
+            from: current ?? image,
+            to: image,
+            label: "edge",
+            onLog,
+            start
+          });
+          return {
+            container: existing,
+            image,
+            converted: false,
+            updated: swap.swapped,
+            edgeDown: swap.down
+          };
+        }
+        return { container: existing, image, converted: false };
+      }
+    }
+  }
+  if (!await dockerAvailable(executor)) {
+    throw new Error(
+      "Docker isn't available on this server, and the edge now runs as a container. Install the Docker component first, then set up the edge."
+    );
+  }
+  if (!await imageExistsLocally(executor, image)) {
+    if (managedImagesAreFromSource("edge")) {
+      throw new Error(fromSourceImageMissingMessage("edge", image));
+    }
+    onLog(log5(`Pulling edge image ${image}...`));
+    const pull = await executor.streamExec(
+      `docker pull ${sq(image)}`,
+      onLog
+    );
+    if (pull.code !== 0) {
+      throw new Error(
+        `Could not pull the edge image ${image} \u2014 the box is unchanged and still serving. Check the server's network access to the registry, then retry.`
+      );
+    }
+  }
+  const hostState = await rootOrDegrade(executor, {
+    purpose: "Creating the edge's state directories",
+    consequence: "Docker will create them empty, so vhosts and certificates may not persist.",
+    report: (message) => onLog(log5(message, "warn"))
+  });
+  for (const mount of EDGE_CONTAINER_MOUNTS) {
+    await hostState.exec(`mkdir -p ${sq(mount.host)}`).catch((err) => {
+      onLog(
+        log5(
+          `Could not create the edge state directory ${mount.host}: ${safeErrorMessage(err)}. Docker will create it empty, so vhosts and certificates may not persist.`,
+          "warn"
+        )
+      );
+    });
+  }
+  const mounts = await targetMounts(hostState);
+  const clear = await ensureEdgeClear(executor, opts.config, onLog);
+  try {
+    onLog(log5("Starting the edge container..."));
+    if (!await startEdgeContainer(executor, container, image, onLog, mounts)) {
+      throw new Error("the edge container failed to start");
+    }
+    const verdict = await verifyEdgeServing(executor, container, {
+      configTest: true,
+      timeoutMs: opts.verifyTimeoutMs ?? 3e4
+    });
+    if (!verdict.serving) {
+      throw new Error(
+        verdict.reason ?? "the edge container started but isn't serving"
+      );
+    }
+    if (clear.tookOver) await completeEdgeTakeover(executor);
+    const version = await executor.exec(containerCommand(container, "openresty -v 2>&1")).catch(() => "");
+    onLog(
+      log5(
+        `Edge container running${version.trim() ? ` (${version.trim()})` : ""}`
+      )
+    );
+    return { container, image, converted: clear.tookOver };
+  } catch (err) {
+    const msg = safeErrorMessage(err);
+    onLog(log5(`Edge container setup failed: ${msg}`, "error"));
+    const logs = await executor.exec(`docker logs --tail 40 ${sq(container)} 2>&1 || true`).catch(() => "");
+    if (logs.trim()) onLog(log5(`Edge container logs:
+${logs}`, "error"));
+    await executor.exec(`docker rm -f ${sq(container)} 2>/dev/null || true`).catch(() => {
+    });
+    invalidateEdgeContainer(executor);
+    if (clear.tookOver) await rollbackEdgeTakeover(executor, onLog);
+    const reason = edgeFailureReason(logs);
+    throw new Error(
+      `Edge container setup failed: ${reason ? `${reason} (${msg})` : msg}`
+    );
+  }
+}
+
+export {
+  beginEdgeTakeover,
+  rollbackEdgeTakeover,
+  completeEdgeTakeover,
+  recoverInterruptedTakeover,
+  detectInstalledProxy,
+  scanImportableSites,
+  unreachableStaticRoots,
+  copyStaticRootIntoEdge,
+  edgeProxy,
+  edgeProxyFor,
+  collectProxyCerts,
+  systemCatalog,
+  COMPONENT_CHECKS,
+  checkAll,
+  checkComponents,
+  COMPONENT_INSTALLERS,
+  importSites,
+  foreignProxyOnEdge,
+  setDefaultEdgeImage,
+  resolveEdgeImage,
+  containerEdgeProvider,
+  localContainerEdgeProvider,
+  resolveEdgeContainerMounts,
+  buildEdgeRunCommand,
+  verifyEdgeServing,
+  ensureContainerEdge
+};