@rakay-technology/kraft 0.7.4

package/dist/chunk-YRSZPVMB.js

@@ -0,0 +1,306 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  answered,
+  firewallAllowSteps,
+  firewallManager,
+  firewallPersists,
+  firewallRevokeSteps,
+  refused,
+  shellQuote
+} from "./chunk-PVOWHIND.js";
+
+// ../../packages/adapters/src/system/environment-ops.ts
+function opScript(steps) {
+  return steps.join(" && ");
+}
+function releaseArchOf(profile) {
+  return profile.arch === "unknown" ? refused(
+    "This host's CPU architecture could not be determined, and Kraft will not default to amd64 \u2014 a release artifact for the wrong architecture installs cleanly and then fails to execute."
+  ) : answered(profile.arch);
+}
+var HOST_STATE_DIR = "/root/.kraft";
+var PACKAGE_NAME = /^[A-Za-z0-9][A-Za-z0-9._+@-]*$/;
+function joinPackages(packages) {
+  if (packages.length === 0) {
+    return refused("No packages were named, so there is nothing to run.");
+  }
+  const bad = packages.find((name) => !PACKAGE_NAME.test(name));
+  if (bad !== void 0) {
+    return refused(`${JSON.stringify(bad)} is not a package name.`);
+  }
+  return answered(packages.join(" "));
+}
+var INSTALL = {
+  // `update` first because an install against a stale index fails on a
+  // just-provisioned box; `-qq` because this output streams into the UI.
+  apt: (names) => answered(["apt-get update -qq", `apt-get install -y -qq ${names}`]),
+  dnf: (names) => answered([`dnf install -y ${names}`]),
+  yum: (names) => answered([`yum install -y ${names}`]),
+  apk: (names) => answered([`apk add --no-cache ${names}`]),
+  brew: (names) => answered([`brew install ${names}`]),
+  none: (names) => refused(
+    `No package manager is available to install ${names} \u2014 Kraft looked for apt-get, dnf, yum, apk and brew and found none.`
+  )
+};
+var REMOVE = {
+  // `purge` + `autoremove`, matching what the uninstallers did before this table: a
+  // component Kraft installed should leave no config behind when removed.
+  apt: (names) => answered([`apt-get purge -y -qq ${names}`, "apt-get autoremove -y -qq"]),
+  dnf: (names) => answered([`dnf remove -y ${names}`]),
+  yum: (names) => answered([`yum remove -y ${names}`]),
+  apk: (names) => answered([`apk del ${names}`]),
+  brew: (names) => answered([`brew uninstall --force ${names}`]),
+  none: (names) => refused(`No package manager is available to remove ${names}.`)
+};
+var AVAILABLE_VERSION = {
+  apt: (names) => answered([`apt-cache policy ${names} 2>/dev/null`]),
+  dnf: (names) => answered([
+    `dnf -q --cacheonly list available ${names} 2>/dev/null | tail -n1`
+  ]),
+  yum: (names) => answered([
+    `yum -q --cacheonly list available ${names} 2>/dev/null | tail -n1`
+  ]),
+  apk: (names) => answered([`apk policy ${names} 2>/dev/null`]),
+  brew: (names) => refused(
+    `Kraft does not read Homebrew's available version for ${names} \u2014 it reports the installed version only on macOS.`
+  ),
+  none: (names) => refused(
+    `No package manager is available to look up an installable version of ${names}.`
+  )
+};
+function noServiceManager(reason) {
+  const refuse = () => refused(reason);
+  return { enableStart: refuse, isActive: refuse };
+}
+var SERVICE = {
+  systemd: {
+    enableStart: (unit) => answered([`systemctl enable --now ${unit}`]),
+    // `--quiet` because the caller wants the exit code, and a unit name echoed onto
+    // stdout is the kind of thing a `!output` check reads as "running".
+    isActive: (unit) => answered([`systemctl is-active --quiet ${unit}`])
+  },
+  openrc: {
+    // Two steps, not one: `rc-update add` is persistence and `rc-service start` is now.
+    // OpenRC has no `--now`, which is why Alpine used to get a start command of
+    // `undefined` from a table that assumed systemd.
+    enableStart: (unit) => answered([`rc-update add ${unit} default`, `rc-service ${unit} start`]),
+    // Exits 0 started / 3 stopped, and prints to stdout — silenced so the contract
+    // matches systemd's `is-active --quiet`.
+    isActive: (unit) => answered([`rc-service ${unit} status >/dev/null 2>&1`])
+  },
+  launchd: noServiceManager(
+    "This host runs launchd, and Kraft does not manage macOS system services \u2014 launchd jobs are addressed by label rather than by unit name, and starting or stopping one is the operator's call."
+  ),
+  none: noServiceManager(
+    "This host has no service manager Kraft can drive (no running systemd, no OpenRC, no launchd), so services cannot be started, stopped or inspected. A container started without an init system is the usual cause."
+  )
+};
+var GET_DOCKER_IDS = /* @__PURE__ */ new Set([
+  "ubuntu",
+  "debian",
+  "raspbian",
+  "centos",
+  "fedora",
+  "rhel",
+  "rocky"
+]);
+var DOCKER_CE_REPO_FILE = "/etc/yum.repos.d/docker-ce.repo";
+function dockerCeRepoSteps(profile) {
+  const write = `curl -fsSL https://download.docker.com/linux/centos/docker-ce.repo -o ${DOCKER_CE_REPO_FILE}`;
+  const major = /^(\d+)/.exec(profile.versionId ?? "")?.[1];
+  if (!major) return [write];
+  return [write, `sed -i 's|\\$releasever|${major}|g' ${DOCKER_CE_REPO_FILE}`];
+}
+var DOCKER_CE_PACKAGES = "docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin";
+var COMPOSE_PLUGIN_VERSION = "v5.4.0";
+var COMPOSE_PLUGIN_DIR = "/usr/local/lib/docker/cli-plugins";
+var COMPOSE_PLUGIN_PATH = `${COMPOSE_PLUGIN_DIR}/docker-compose`;
+var COMPOSE_PLUGIN_ASSET = {
+  amd64: "x86_64",
+  arm64: "aarch64"
+};
+function withComposePlugin(profile, engine) {
+  const arch = releaseArchOf(profile);
+  if (!arch.supported) return arch;
+  const asset = `docker-compose-linux-${COMPOSE_PLUGIN_ASSET[arch.value]}`;
+  return answered([
+    ...engine,
+    `mkdir -p ${COMPOSE_PLUGIN_DIR}`,
+    `curl -fsSL https://github.com/docker/compose/releases/download/${COMPOSE_PLUGIN_VERSION}/${asset} -o ${COMPOSE_PLUGIN_PATH}`,
+    `chmod 0755 ${COMPOSE_PLUGIN_PATH}`
+  ]);
+}
+function dockerInstallSteps(profile) {
+  if (profile.os === "darwin") {
+    return refused(
+      "Kraft does not install Docker on macOS \u2014 Docker Desktop (or OrbStack/Colima) is a GUI application an operator installs and licenses themselves."
+    );
+  }
+  if (profile.os !== "linux") {
+    return refused("Docker can only be installed on a Linux or macOS host.");
+  }
+  const id = profile.distroId?.trim().toLowerCase() ?? "";
+  if (GET_DOCKER_IDS.has(id)) {
+    return answered(["curl -fsSL https://get.docker.com | sh"]);
+  }
+  switch (profile.distroFamily) {
+    case "rhel":
+      if (id === "amzn") {
+        return withComposePlugin(
+          profile,
+          profile.packageManager === "yum" ? (
+            // `amazon-linux-extras` exits 13 with "Installation failed" AFTER yum has
+            // printed "Complete!" and left dockerd on disk — seen once in four runs
+            // against a real amazonlinux:2. `opScript` joins with `&&`, so that exit
+            // aborted the plugin steps below and produced the engine-without-`docker
+            // compose` host {@link withComposePlugin} exists to prevent. Tolerate a
+            // non-zero exit only when the binary is actually there; a real failure has
+            // nothing to find and still aborts. Braced so it stays one step if a step
+            // is ever prepended — `&&` and `||` bind equally and left-associatively.
+            [
+              "{ amazon-linux-extras install -y docker || command -v docker >/dev/null 2>&1; }"
+            ]
+          ) : ["dnf install -y docker"]
+        );
+      }
+      return answered([
+        ...dockerCeRepoSteps(profile),
+        `${profile.packageManager} install -y ${DOCKER_CE_PACKAGES}`
+      ]);
+    case "debian":
+      return withComposePlugin(profile, [
+        "apt-get update -qq",
+        "apt-get install -y -qq docker.io"
+      ]);
+    case "alpine":
+      return answered([
+        "apk add --no-cache docker docker-cli docker-cli-compose"
+      ]);
+    case "suse":
+    case "arch":
+    case "unknown":
+      return refused(
+        `Kraft has no Docker install path for this host (os-release ID=${JSON.stringify(profile.distroId ?? "")}, family ${profile.distroFamily}).`
+      );
+  }
+}
+function homeOf(profile) {
+  const home = profile.home.trim();
+  if (home) return home;
+  if (profile.isRoot) return "/root";
+  const user = profile.loginUser.trim();
+  return user ? `/home/${user}` : "/root";
+}
+function describeProfile(profile) {
+  const name = profile.prettyName?.trim() || profile.distroId?.trim() || profile.os;
+  const parts = [
+    name,
+    `${profile.os}/${profile.arch}`,
+    `pm=${profile.packageManager}`,
+    `init=${profile.serviceManager}`,
+    `firewall=${profile.firewall}`,
+    profile.isRoot ? "root" : profile.canSudo ? `${profile.loginUser}+sudo` : profile.loginUser
+  ];
+  if (profile.isContainer) parts.push("container");
+  return parts.filter(Boolean).join(" \xB7 ");
+}
+function sshdEnableHintFor(profile) {
+  switch (profile.serviceManager) {
+    case "systemd":
+      return profile.distroFamily === "debian" ? "sudo systemctl enable --now ssh" : "sudo systemctl enable --now sshd";
+    case "openrc":
+      return "sudo rc-update add sshd default && sudo rc-service sshd start";
+    case "launchd":
+      return "sudo systemsetup -setremotelogin on";
+    case "none":
+      return "start this host's SSH server (no service manager was detected, so start it however this host does)";
+  }
+}
+function hostFacts(profile) {
+  const home = homeOf(profile);
+  return {
+    profile,
+    describe: () => describeProfile(profile),
+    sshdEnableHint: () => sshdEnableHintFor(profile),
+    // Both delegate: these are facts about a `SystemFirewall`, not about a profile, and
+    // the CLI reads them off a locally-measured firewall with no profile in hand.
+    firewallManager: () => firewallManager(profile.firewall),
+    firewallPersists: () => firewallPersists(profile.firewall),
+    home: () => home,
+    // macOS has no /root to own anything, and there it is a local target rather than
+    // a provisioned server, so the invoking user's home is the only sensible anchor.
+    stateDir: () => profile.os === "darwin" ? `${home}/.kraft` : HOST_STATE_DIR,
+    scratchDir: () => `${home}/.kraft`,
+    installsNeedRoot: () => profile.os !== "darwin"
+  };
+}
+function withPackages(packages, rule) {
+  const names = joinPackages(packages);
+  return names.supported ? rule(names.value) : names;
+}
+function hostCommands(profile) {
+  const pm = profile.packageManager;
+  const service = SERVICE[profile.serviceManager];
+  const unit = (name) => shellQuote(name);
+  const firewallScoped = (scope, steps) => {
+    const manager = firewallManager(profile.firewall);
+    return manager.supported ? steps(manager.value, scope) : manager;
+  };
+  return {
+    pkgInstall: (packages) => withPackages(packages, INSTALL[pm]),
+    pkgInstallVariants: (variants) => {
+      if (pm === "none") return INSTALL.none("this package");
+      const chosen = variants[pm];
+      return chosen.supported ? withPackages(chosen.value, INSTALL[pm]) : chosen;
+    },
+    pkgRemove: (packages) => withPackages(packages, REMOVE[pm]),
+    pkgAvailableVersion: (pkg) => withPackages([pkg], AVAILABLE_VERSION[pm]),
+    // Unit names are quoted rather than validated: unlike package names they are
+    // data-derived (a project slug, a unit read off a `systemctl list-units` scan), so
+    serviceEnableStart: (name) => service.enableStart(unit(name)),
+    serviceIsActive: (name) => service.isActive(unit(name)),
+    firewallAllow: (scope) => firewallScoped(scope, firewallAllowSteps),
+    firewallRevoke: (scope) => firewallScoped(scope, firewallRevokeSteps),
+    dockerInstall: () => dockerInstallSteps(profile),
+    // Through `unit()` like every other unit name, so there is one path to a service verb
+    // rather than one path plus an exception that happens to be safe today.
+    dockerStart: () => service.enableStart(unit("docker")),
+    releaseArch: () => releaseArchOf(profile)
+  };
+}
+function mapRefusals(commands, onRefusal, gate) {
+  const out = {};
+  for (const name of Object.keys(commands)) {
+    const fn = commands[name];
+    out[name] = ((...args) => {
+      if (gate !== null) return refused(gate);
+      const answer = fn(...args);
+      return answer.supported ? answer : refused(onRefusal(answer.reason));
+    });
+  }
+  return out;
+}
+function hostRefusal(profile) {
+  if (profile.supported) return null;
+  const reason = profile.unsupportedReason ?? "Kraft cannot drive this host, and the detector recorded no reason.";
+  return `${reason} (host: ${describeProfile(profile)})`;
+}
+function envOps(profile) {
+  const facts = hostFacts(profile);
+  const label = describeProfile(profile);
+  const withHost = (reason) => `${reason} (host: ${label})`;
+  return {
+    ...facts,
+    ...mapRefusals(hostCommands(profile), withHost, hostRefusal(profile))
+  };
+}
+
+export {
+  opScript,
+  HOST_STATE_DIR,
+  hostRefusal,
+  envOps
+};

package/dist/chunk-YZUKHG3S.js

@@ -0,0 +1,362 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  describeProcess,
+  probeListeningPort,
+  waitForPortFree
+} from "./chunk-WYNM7L22.js";
+import {
+  EDGE_CONTAINER_NAME,
+  classifyProxy,
+  describeContainerById,
+  isOurEdgeContainer,
+  mayStopUnitForEdgeTakeover,
+  resolveContainerPublishingPort,
+  stopContainerDurably,
+  tryExec
+} from "./chunk-N4OALTFK.js";
+import {
+  AppError,
+  shellQuote
+} from "./chunk-PVOWHIND.js";
+
+// ../../packages/adapters/src/system/proxy/detect.ts
+var EDGE_PORTS = [80, 443];
+var EdgeConflictError = class extends AppError {
+  constructor(status) {
+    super(
+      `Ports ${status.occupants.map((o) => o.port).join("/") || "80/443"} are in use by another service (${status.classification}). Accept a migrate or takeover to continue.`,
+      409,
+      "EDGE_CONFLICT"
+    );
+    this.status = status;
+    this.name = "EdgeConflictError";
+  }
+};
+var EdgeMigrateRequested = class extends Error {
+  constructor(status, sites, warnings = []) {
+    super("Edge migration requested by user");
+    this.status = status;
+    this.sites = sites;
+    this.warnings = warnings;
+    this.name = "EdgeMigrateRequested";
+  }
+};
+var sq = shellQuote;
+function vhostLog(message, level = "info") {
+  return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
+}
+async function sanitizeEdgeVhosts(executor, sitesDir, onLog) {
+  const script = [
+    `for f in ${sq(sitesDir)}/*.conf; do`,
+    // A host-side vhost may be a symlink into /etc/nginx/sites-available. That
+    // target is deliberately not mounted in the edge container, so leaving the
+    // link here makes nginx's include glob fail at startup. Materialize valid
+    // links before the container mounts this directory; remove dangling ones.
+    `  [ -e "$f" ] || [ -L "$f" ] || continue;`,
+    `  if [ -L "$f" ]; then`,
+    `    if [ ! -e "$f" ]; then`,
+    `      echo "dropped-dangling-link $f"; rm -f "$f"; continue;`,
+    `    fi;`,
+    `    if cat "$f" > "$f.osh-link"; then`,
+    `      rm -f "$f"; mv "$f.osh-link" "$f"; echo "materialized-link $f";`,
+    `    else`,
+    `      rm -f "$f.osh-link"; echo "dropped-unreadable-link $f"; rm -f "$f"; continue;`,
+    `    fi;`,
+    `  fi;`,
+    // A real server_name is anything that isn't the `_` wildcard.
+    `  if ! grep -qE '^[[:space:]]*server_name[[:space:]]+[^_;[:space:]]' "$f"; then`,
+    `    echo "dropped-catchall $f"; rm -f "$f"; continue;`,
+    `  fi;`,
+    `  if grep -qE '[[:space:]]default_server' "$f"; then`,
+    `    sed -E 's/([[:space:]]listen[^;]*)[[:space:]]+default_server/\\1/g' "$f" > "$f.osh" && mv "$f.osh" "$f" && echo "unset-default $f";`,
+    `  fi;`,
+    `done`
+  ].join(" ");
+  const out = await executor.exec(script).catch(() => "");
+  for (const line of out.split("\n").map((l) => l.trim()).filter(Boolean)) {
+    const [action, file] = [
+      line.slice(0, line.indexOf(" ")),
+      line.slice(line.indexOf(" ") + 1)
+    ];
+    if (action === "dropped-catchall") {
+      onLog(
+        vhostLog(
+          `Dropped catch-all vhost ${file} \u2014 the edge image provides it.`,
+          "warn"
+        )
+      );
+    } else if (action === "unset-default") {
+      onLog(
+        vhostLog(
+          `Removed default_server from ${file} \u2014 the edge image owns it.`,
+          "warn"
+        )
+      );
+    } else if (action === "materialized-link") {
+      onLog(
+        vhostLog(
+          `Materialized linked edge vhost ${file} for the container mount.`,
+          "warn"
+        )
+      );
+    } else if (action === "dropped-dangling-link") {
+      onLog(vhostLog(`Dropped dangling edge vhost link ${file}.`, "warn"));
+    } else if (action === "dropped-unreadable-link") {
+      onLog(vhostLog(`Dropped unreadable edge vhost link ${file}.`, "warn"));
+    }
+  }
+}
+async function edgeIsBroken(executor, container = EDGE_CONTAINER_NAME) {
+  const status = await tryExec(
+    executor,
+    `docker inspect -f '{{.State.Status}}' ${sq(container)} 2>/dev/null`
+  );
+  const state = (status ?? "").trim();
+  return state === "restarting" || state === "exited" || state === "dead";
+}
+async function edgeCrashReason(executor, container = EDGE_CONTAINER_NAME) {
+  const logs = await tryExec(
+    executor,
+    `docker logs --tail 40 ${sq(container)} 2>&1`
+  );
+  return logs ? edgeFailureReason(logs) : null;
+}
+function edgeFailureReason(containerLog) {
+  const lines = containerLog.split("\n").map((l) => l.trim()).filter(Boolean);
+  const emerg = lines.find((l) => l.includes("[emerg]"));
+  if (emerg) return emerg.replace(/^.*\[emerg\]\s*\d*#\d*:\s*/, "");
+  return null;
+}
+async function ourEdgeContainerRunning(executor) {
+  return Boolean(await resolveOurEdgeContainer(executor));
+}
+var EDGE_CONTAINER_TTL_MS = 2e4;
+var edgeContainerMemo = /* @__PURE__ */ new WeakMap();
+var edgeMemoGeneration = 0;
+function invalidateEdgeContainer(executor) {
+  if (executor) edgeContainerMemo.delete(executor);
+  else edgeMemoGeneration++;
+}
+async function resolveOurEdgeContainer(executor, opts) {
+  if (!opts?.fresh) {
+    const hit = edgeContainerMemo.get(executor);
+    if (hit && hit.generation === edgeMemoGeneration && Date.now() - hit.at < EDGE_CONTAINER_TTL_MS) {
+      return hit.value;
+    }
+  }
+  const resolved = await probeOurEdgeContainer(executor);
+  edgeContainerMemo.set(executor, {
+    value: resolved,
+    at: Date.now(),
+    generation: edgeMemoGeneration
+  });
+  return resolved;
+}
+async function detectEdgeContainer(executor) {
+  const out = await tryExec(
+    executor,
+    `docker ps -a --format '{{.Names}}	{{.Image}}	{{.State}}' 2>/dev/null`
+  );
+  if (out === null) return null;
+  const absent = { name: null, running: false, image: null, exists: false };
+  for (const line of out.split("\n").map((l) => l.trim()).filter(Boolean)) {
+    const [name, image, state] = line.split("	");
+    if (!name) continue;
+    if (name === EDGE_CONTAINER_NAME || isOurEdgeContainer(name, image)) {
+      return {
+        name,
+        image: image || null,
+        running: state === "running",
+        exists: true
+      };
+    }
+  }
+  return absent;
+}
+async function probeOurEdgeContainer(executor) {
+  const byName = await tryExec(
+    executor,
+    `docker ps --filter name=kraft-edge --format '{{.Names}}' 2>/dev/null | head -1`
+  );
+  if (byName?.trim()) return byName.trim();
+  const all = await tryExec(
+    executor,
+    `docker ps --format '{{.Names}}	{{.Image}}' 2>/dev/null`
+  );
+  if (!all) return null;
+  for (const line of all.split("\n").map((l) => l.trim()).filter(Boolean)) {
+    const [name, image] = line.split("	");
+    if (name && isOurEdgeContainer(name, image)) return name;
+  }
+  return null;
+}
+async function detectDockerOnPort(executor, port) {
+  const onPort = await resolveContainerPublishingPort(executor, port);
+  const container = onPort.kind === "one" ? onPort.container : onPort.kind === "ambiguous" ? onPort.containers[0] : null;
+  return container ? { id: container.id, name: container.name, image: container.image } : null;
+}
+var WORKER_RE = /\b(?:nginx|openresty)\s*:\s*worker process/i;
+var MASTER_RE = /\b(?:nginx|openresty)\s*:\s*master process/i;
+async function resolveProxyMaster(executor, listener) {
+  if (!listener?.pid) return listener;
+  if (!WORKER_RE.test(`${listener.rawCommand ?? ""} ${listener.command ?? ""}`))
+    return listener;
+  const ppidRaw = await tryExec(
+    executor,
+    `awk '/^PPid:/{print $2}' /proc/${listener.pid}/status 2>/dev/null || true`
+  );
+  const ppid = Number.parseInt((ppidRaw ?? "").trim(), 10);
+  if (!Number.isInteger(ppid) || ppid <= 1) return listener;
+  const master = await describeProcess(executor, ppid);
+  if (!master || !MASTER_RE.test(`${master.rawCommand ?? ""} ${master.command ?? ""}`)) {
+    return listener;
+  }
+  return master;
+}
+async function probeEdgePort(executor, port, ours) {
+  const listener = await resolveProxyMaster(
+    executor,
+    await probeListeningPort(executor, port)
+  );
+  const docker = await detectDockerOnPort(executor, port);
+  if (!listener && !docker) return null;
+  const cgroupContainer = !docker && listener?.containerId ? await describeContainerById(executor, listener.containerId) : null;
+  const proxy = classifyProxy(
+    [
+      docker?.image ?? cgroupContainer?.image,
+      docker?.name ?? cgroupContainer?.name,
+      listener?.rawCommand,
+      listener?.command,
+      listener?.systemdUnit
+    ].filter(Boolean).join(" ")
+  );
+  const foreignDockerProxy = Boolean(docker) && !isOurEdgeContainer(docker?.name, docker?.image);
+  const managedByKraft = isOurEdgeContainer(docker?.name, docker?.image) || ours.containerRunning && !foreignDockerProxy;
+  return {
+    port,
+    pid: listener?.pid ?? void 0,
+    command: docker ? `docker container ${docker.name} (${docker.image})` : listener?.command,
+    rawCommand: listener?.rawCommand,
+    systemdUnit: listener?.systemdUnit,
+    systemdDescription: listener?.systemdDescription,
+    isDocker: Boolean(docker) || Boolean(listener?.dockerPublished) || Boolean(listener?.containerId),
+    containerName: docker?.name ?? cgroupContainer?.name,
+    // Without a container the takeover falls through to `kill -9` on a process INSIDE
+    // somebody's container, which frees nothing durably.
+    containerId: docker?.id ?? listener?.containerId,
+    dockerPublished: listener?.dockerPublished,
+    proxy,
+    managedByKraft
+  };
+}
+async function probeEdge(executor) {
+  const container = await resolveOurEdgeContainer(executor);
+  const containerRunning = Boolean(container) && !await edgeIsBroken(executor, container);
+  const occupants = [];
+  for (const port of EDGE_PORTS) {
+    const occ = await probeEdgePort(executor, port, { containerRunning });
+    if (occ) occupants.push(occ);
+  }
+  const foreign = occupants.filter((o) => !o.managedByKraft);
+  let classification;
+  if (occupants.length === 0) classification = "free";
+  else if (foreign.length === 0) classification = "ours";
+  else if (foreign.every((o) => o.proxy)) classification = "known";
+  else classification = "unknown";
+  return {
+    classification,
+    occupants: foreign,
+    canProceedClean: classification === "free" || classification === "ours"
+  };
+}
+function stopTargetsForStatus(status) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const o of status.occupants) {
+    const identity = o.containerName ?? o.containerId ?? o.systemdUnit ?? (o.pid ? `pid:${o.pid}` : `port:${o.port}`);
+    if (seen.has(identity)) continue;
+    seen.add(identity);
+    out.push({
+      port: o.port,
+      unit: o.systemdUnit,
+      // A forwarder's pid is dockerd's, not the workload's: killing it severs a live
+      // container's port mapping and frees nothing durably. With no container resolved
+      // there is nothing here to stop, and freeEdgeTargets reports the port still bound
+      // rather than claiming a takeover that did not happen.
+      pid: o.dockerPublished && !o.containerName && !o.containerId ? void 0 : o.pid,
+      container: o.containerName ?? o.containerId,
+      // Prefer the proxy kind over the raw cmdline — `nginx (PID 123)` reads
+      // better in "Stopping …" than `nginx: master process /usr/sbin/nginx …`.
+      label: o.proxy && o.pid ? `${o.proxy} (PID ${o.pid})` : o.command
+    });
+  }
+  return out;
+}
+async function freeEdgeTargets(executor, targets, onLog, opts = {}) {
+  for (const t of targets) {
+    const where = t.port ? ` (port ${t.port})` : "";
+    if (t.container) {
+      onLog(`Stopping container ${t.container}${where}...`, "warn");
+      await stopContainerDurably(executor, t.container);
+    } else if (t.unit && mayStopUnitForEdgeTakeover(t.unit)) {
+      onLog(`Stopping & disabling service ${t.unit}${where}...`, "warn");
+      await tryExec(
+        executor,
+        `systemctl disable --now ${sq(t.unit)} 2>/dev/null || systemctl stop ${sq(t.unit)} 2>/dev/null || true; systemctl reset-failed ${sq(t.unit)} 2>/dev/null || true`
+      );
+    } else if (t.unit) {
+      onLog(
+        `Refusing to stop ${t.unit}${where} \u2014 free that port manually.`,
+        "error"
+      );
+    } else if (t.pid) {
+      onLog(`Stopping ${t.label ?? `process ${t.pid}`}${where}...`, "warn");
+      await tryExec(executor, `kill ${t.pid} 2>/dev/null || true`);
+      await new Promise((r) => setTimeout(r, 800));
+      await tryExec(executor, `kill -9 ${t.pid} 2>/dev/null || true`);
+    }
+  }
+  const named = [
+    ...new Set(
+      targets.map((t) => t.port).filter((p) => typeof p === "number")
+    )
+  ];
+  const stillBound = [];
+  for (const port of named.length ? named : [...EDGE_PORTS]) {
+    const { free, checked } = await waitForPortFree(executor, port, {
+      ...opts.timeoutMs === void 0 ? {} : { timeoutMs: opts.timeoutMs }
+    });
+    if (!checked) {
+      onLog(
+        `Couldn't confirm port ${port} was released (socket table unreadable) \u2014 continuing.`,
+        "warn"
+      );
+      continue;
+    }
+    if (!free) {
+      stillBound.push(port);
+      onLog(`Port ${port} is STILL bound after stopping its owner.`, "error");
+    }
+  }
+  return { freed: stillBound.length === 0, stillBound };
+}
+
+export {
+  EdgeConflictError,
+  EdgeMigrateRequested,
+  sq,
+  sanitizeEdgeVhosts,
+  edgeIsBroken,
+  edgeCrashReason,
+  edgeFailureReason,
+  ourEdgeContainerRunning,
+  invalidateEdgeContainer,
+  resolveOurEdgeContainer,
+  detectEdgeContainer,
+  probeEdge,
+  stopTargetsForStatus,
+  freeEdgeTargets
+};