@rakay-technology/kraft 0.7.4

package/dist/chunk-AJ4QZLZ2.js

@@ -0,0 +1,1069 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  sq
+} from "./chunk-MNV2QFHW.js";
+import {
+  nodeBinDirs,
+  nodeBinPathExport,
+  packageManagerEnsureCommand,
+  safeErrorMessage,
+  shellQuote
+} from "./chunk-PVOWHIND.js";
+
+// ../../packages/adapters/src/runtime/git-clone.ts
+var sq2 = shellQuote;
+function gitCredentialPair(hostname, token) {
+  if (hostname === "github.com" && !token.startsWith("ghs_")) {
+    return { username: token, password: "x-oauth-basic" };
+  }
+  return { username: "x-access-token", password: token };
+}
+function injectGitToken(repoUrl, token) {
+  const secret = token?.trim();
+  if (!secret) return repoUrl;
+  try {
+    const url = new URL(repoUrl);
+    if (url.protocol !== "https:") return repoUrl;
+    const { username, password } = gitCredentialPair(url.hostname, secret);
+    url.username = username;
+    url.password = password;
+    return url.toString();
+  } catch {
+    return repoUrl;
+  }
+}
+function toGitHubSshUrl(repoUrl) {
+  try {
+    const url = new URL(repoUrl);
+    const host = url.hostname;
+    const repoPath = url.pathname.replace(/^\/+/, "").replace(/\.git$/, "");
+    return `git@${host}:${repoPath}.git`;
+  } catch {
+    return repoUrl;
+  }
+}
+var TERMINAL_PROMPT = ["GIT_TERMINAL_PROMPT", "0", false];
+function invocation(cloneUrl, entries, disableHelper) {
+  return {
+    cloneUrl,
+    gitEnv: entries.map(([k, v, q]) => `${k}=${q ? sq2(v) : v}`).join(" "),
+    credFlag: disableHelper ? "-c credential.helper=" : "",
+    env: Object.fromEntries(entries.map(([k, v]) => [k, v])),
+    credArgs: disableHelper ? ["-c", "credential.helper="] : []
+  };
+}
+function assertNotOptionLike(repoUrl) {
+  if (repoUrl.trimStart().startsWith("-")) {
+    throw new Error(
+      `Refusing to clone from ${JSON.stringify(repoUrl)}: a repository URL must not start with "-" (git would read it as an option).`
+    );
+  }
+}
+function assembleGitClone(auth) {
+  assertNotOptionLike(auth.repoUrl);
+  if (auth.ssh) {
+    const sshCmd = `ssh -i ${sq2(auth.ssh.keyFile)} -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=${sq2(auth.ssh.knownHostsFile)}`;
+    return invocation(
+      toGitHubSshUrl(auth.repoUrl),
+      [TERMINAL_PROMPT, ["GIT_SSH_COMMAND", sshCmd, true]],
+      false
+    );
+  }
+  if (auth.gitCredentialHelperPath) {
+    const base = invocation(
+      auth.repoUrl,
+      [
+        TERMINAL_PROMPT,
+        // An empty helper value resets helpers inherited from the host before
+        // adding the deployment-scoped relay. Without the reset, a server's
+        // stale/global helper can answer first and silently override the
+        // forwarded identity named in the deployment log.
+        ["GIT_CONFIG_COUNT", "3", false],
+        ["GIT_CONFIG_KEY_0", "credential.helper", false],
+        ["GIT_CONFIG_VALUE_0", "", true],
+        ["GIT_CONFIG_KEY_1", "credential.helper", false],
+        ["GIT_CONFIG_VALUE_1", auth.gitCredentialHelperPath, true],
+        ["GIT_CONFIG_KEY_2", "credential.useHttpPath", false],
+        ["GIT_CONFIG_VALUE_2", "true", false]
+      ],
+      false
+    );
+    let url;
+    try {
+      url = new URL(auth.repoUrl);
+    } catch {
+      throw new Error(
+        "Git credential forwarding requires an absolute HTTPS repository URL"
+      );
+    }
+    if (url.protocol !== "https:") {
+      throw new Error(
+        "Git credential forwarding requires an HTTPS repository URL"
+      );
+    }
+    const protocol = url.protocol.slice(0, -1);
+    const path = url.pathname.replace(/^\/+/, "");
+    const headerVar = "KRAFT_GIT_AUTH_HEADER";
+    const headerCommand = `${sq2(auth.gitCredentialHelperPath)} auth-header ${sq2(protocol)} ${sq2(url.hostname)} ${sq2(path)}`;
+    return {
+      ...base,
+      // `auth-header` returns only the Basic header, never prints it to the
+      // build log, and keeps the token out of the command text and filesystem.
+      // The value exists only in the remote shell/git process for this command.
+      shellPrelude: `${headerVar}="$(${headerCommand})" && test -n "$${headerVar}"`,
+      // The argv representation above remains a valid challenge-based helper
+      // invocation for local spawn users. Remote shell users call
+      // gitShellCommand(), which adds the preemptive header as config slot 3.
+      gitEnv: `${base.gitEnv.replace("GIT_CONFIG_COUNT=3", "GIT_CONFIG_COUNT=4")} GIT_CONFIG_KEY_3=http.extraHeader GIT_CONFIG_VALUE_3="$${headerVar}"`
+    };
+  }
+  if (auth.ambient) {
+    if (auth.ambient.via === "ssh") {
+      return invocation(toGitHubSshUrl(auth.repoUrl), [TERMINAL_PROMPT], false);
+    }
+    if (auth.ambient.via === "gh") {
+      return invocation(
+        auth.repoUrl,
+        [
+          TERMINAL_PROMPT,
+          ["GIT_CONFIG_COUNT", "1", false],
+          ["GIT_CONFIG_KEY_0", "credential.helper", false],
+          ["GIT_CONFIG_VALUE_0", "!gh auth git-credential", true]
+        ],
+        false
+      );
+    }
+    return invocation(auth.repoUrl, [TERMINAL_PROMPT], false);
+  }
+  return invocation(
+    injectGitToken(auth.repoUrl, auth.gitToken),
+    [TERMINAL_PROMPT, ["GIT_ASKPASS", "/bin/echo", false]],
+    true
+  );
+}
+function gitShellCommand(invocation2, args) {
+  const env = invocation2.gitEnv ? `${invocation2.gitEnv} ` : "";
+  const flags = invocation2.credFlag ? `${invocation2.credFlag} ` : "";
+  const command = `${env}git ${flags}${args}`;
+  return invocation2.shellPrelude ? `${invocation2.shellPrelude} && ${command}` : command;
+}
+
+// ../../packages/adapters/src/runtime/git-ssh-material.ts
+import { mkdir, rm, writeFile } from "fs/promises";
+async function materializeGitSsh(writer, dir, gitSsh) {
+  const keyFile = `${dir}/id`;
+  const knownHostsFile = `${dir}/known_hosts`;
+  await writer.ensureDir(dir);
+  try {
+    await writer.writeSecret(keyFile, gitSsh.privateKey);
+    await writer.writeSecret(knownHostsFile, gitSsh.knownHosts);
+  } catch (err) {
+    await writer.remove(dir);
+    throw err;
+  }
+  return {
+    keyFile,
+    knownHostsFile,
+    cleanup: () => writer.remove(dir)
+  };
+}
+function shellGitSshWriter(io) {
+  return {
+    ensureDir: async (dir) => {
+      await io.exec(`mkdir -p ${sq2(dir)} && chmod 700 ${sq2(dir)}`);
+    },
+    writeSecret: async (path, content) => {
+      await io.writeSecret(path, content);
+      await io.exec(`chmod 600 ${sq2(path)}`);
+    },
+    remove: async (dir) => {
+      await io.exec(`rm -rf ${sq2(dir)}`).catch(() => {
+      });
+    }
+  };
+}
+function localGitSshWriter() {
+  return {
+    ensureDir: (dir) => mkdir(dir, { recursive: true, mode: 448 }).then(() => {
+    }),
+    writeSecret: (path, content) => writeFile(path, content, { mode: 384 }),
+    remove: (dir) => rm(dir, { recursive: true, force: true }).catch(() => {
+    })
+  };
+}
+
+// ../../packages/adapters/src/runtime/build-pipeline.ts
+var BuildLogger = class {
+  constructor(onLog) {
+    this.onLog = onLog;
+  }
+  /** Emit a plain log line. */
+  log(message, level = "info", meta) {
+    this.onLog?.({
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      message,
+      level,
+      ...meta
+    });
+  }
+  /** Emit a step lifecycle event (running / completed / failed / skipped). */
+  step(step, status, message) {
+    this.onLog?.({
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      message,
+      level: status === "failed" ? "error" : "info",
+      step,
+      stepStatus: status
+    });
+  }
+  /**
+   * Run a step: emit running → execute → emit completed/failed.
+   * Throws on failure so the caller can handle it.
+   */
+  async runStep(step, label, fn) {
+    this.step(step, "running", label);
+    try {
+      await fn();
+      this.step(step, "completed", `${label} - done`);
+    } catch (err) {
+      const msg = safeErrorMessage(err);
+      this.step(step, "failed", `${label} - ${msg}`);
+      throw err;
+    }
+  }
+  /** Get the underlying callback for passing to exec / stream functions. */
+  get callback() {
+    return (entry) => this.onLog?.(entry);
+  }
+};
+var BuildCancelledError = class extends Error {
+  constructor(message = "Build cancelled") {
+    super(message);
+    this.name = "BuildCancelledError";
+  }
+};
+async function killProcessesUnderDir(executor, dir, opts) {
+  const quoted = sq2(dir);
+  const roots = opts?.includeSuffixed ? [quoted, `${quoted}-*`] : [quoted];
+  const patterns = roots.flatMap((root) => [
+    root,
+    `${root}/*`,
+    `${root}" (deleted)"`,
+    `${root}/*" (deleted)"`
+  ]);
+  const scan = (sig) => `for p in /proc/[0-9]*; do c=$(readlink "$p/cwd" 2>/dev/null); case "$c" in ${patterns.join("|")}) kill -${sig} "\${p##*/}" 2>/dev/null || true;; esac; done`;
+  await executor.exec(`${scan("TERM")}; sleep 2; ${scan("KILL")}`).catch(() => {
+  });
+}
+async function runBuildPipeline(env, config, logger) {
+  let startTime = Date.now();
+  let currentStep = "prepare";
+  const exec = (command) => env.exec(command, logger.callback);
+  const buildDir = resolveBuildDirectory(env.projectDir, config.rootDirectory);
+  if (env.hasNativeEnv) {
+    const { cpuCores, memoryMb, diskMb } = config.resources;
+    logger.log(
+      `Machine: ${cpuCores} CPU \xB7 ${memoryMb} MB RAM \xB7 ${diskMb} MB Disk`
+    );
+  }
+  try {
+    if (env.preflight) {
+      await logger.runStep("prepare", "Preparing server", async () => {
+        await env.preflight(config, logger);
+      });
+    }
+    startTime = Date.now();
+    currentStep = "clone";
+    if (config.localPath || config.sourceStaged) {
+      logger.step("clone", "completed", "Source ready");
+    } else {
+      await logger.runStep(
+        "clone",
+        `Cloning ${config.repoUrl} (branch: ${config.branch})`,
+        async () => {
+          let sshMaterial;
+          if (config.gitSsh) {
+            const writeSecretFile = env.writeSecretFile;
+            if (!writeSecretFile) {
+              throw new Error(
+                "SSH-based GitHub auth isn't supported on this build runtime \u2014 use a token or the tunnel relay."
+              );
+            }
+            sshMaterial = await materializeGitSsh(
+              shellGitSshWriter({ exec, writeSecret: writeSecretFile }),
+              `${env.projectDir}.gitssh`,
+              config.gitSsh
+            );
+          }
+          const gitInvocation = assembleGitClone({
+            repoUrl: config.repoUrl,
+            gitToken: config.gitToken,
+            gitCredentialHelperPath: config.gitCredentialHelperPath,
+            ssh: sshMaterial,
+            ambient: config.gitAmbient
+          });
+          const { cloneUrl, credFlag: CRED } = gitInvocation;
+          try {
+            if (config.commitSha) {
+              await exec(
+                gitShellCommand(
+                  gitInvocation,
+                  `clone --progress --depth 50 --branch ${sq2(config.branch)} ${sq2(cloneUrl)} ${sq2(env.projectDir)}`
+                )
+              );
+              const commitPresent = await exec(
+                `cd ${sq2(env.projectDir)} && git ${CRED} cat-file -e ${sq2(`${config.commitSha}^{commit}`)}`
+              ).then(
+                () => true,
+                () => false
+              );
+              if (!commitPresent) {
+                logger.log(
+                  `Commit ${config.commitSha} is not in the depth-50 clone; fetching full history before checkout.`,
+                  "warn"
+                );
+                await exec(
+                  `cd ${sq2(env.projectDir)} && ${gitShellCommand(gitInvocation, "fetch --progress --unshallow")}`
+                );
+              }
+              await exec(
+                `cd ${sq2(env.projectDir)} && ${gitShellCommand(
+                  gitInvocation,
+                  `-c advice.detachedHead=false checkout ${sq2(config.commitSha)}`
+                )}`
+              );
+            } else {
+              await exec(
+                gitShellCommand(
+                  gitInvocation,
+                  `clone --progress --depth 1 --branch ${sq2(config.branch)} ${sq2(cloneUrl)} ${sq2(env.projectDir)}`
+                )
+              );
+            }
+          } finally {
+            await sshMaterial?.cleanup();
+          }
+        }
+      );
+    }
+    const envPrefix = env.hasNativeEnv ? "" : Object.entries(config.envVars).filter(([k]) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(k)).map(([k, v]) => `export ${k}=${sq2(v)}`).join(" && ");
+    const binPathExport = nodeBinPathExport(config.packageManager, [
+      buildDir,
+      env.projectDir
+    ]);
+    const inDir = (cmd) => {
+      const full = `cd ${sq2(buildDir)} && ${cmd}`;
+      const prefix = [envPrefix, binPathExport].filter(Boolean).join(" && ");
+      return prefix ? `${prefix} && ${full}` : full;
+    };
+    const pmEnsure = packageManagerEnsureCommand(config.packageManager);
+    currentStep = "install";
+    if (config.installCommand) {
+      const installCmd = pmEnsure ? `${pmEnsure} && ${config.installCommand}` : config.installCommand;
+      await logger.runStep(
+        "install",
+        `Installing dependencies (${config.packageManager})`,
+        async () => {
+          await exec(inDir(installCmd));
+        }
+      );
+    } else {
+      logger.step("install", "skipped", "No install command configured");
+    }
+    if (config.buildCommand) {
+      currentStep = "build";
+      const buildCmd = pmEnsure && !config.installCommand ? `${pmEnsure} && ${config.buildCommand}` : config.buildCommand;
+      await logger.runStep(
+        "build",
+        `Building (${config.buildCommand})`,
+        async () => {
+          await exec(inDir(buildCmd));
+        }
+      );
+    } else {
+      logger.step("build", "skipped", "No build command configured");
+    }
+    const durationMs = Date.now() - startTime;
+    return { status: "deploying", durationMs };
+  } catch (err) {
+    const durationMs = Date.now() - startTime;
+    if (err instanceof BuildCancelledError) {
+      return { status: "cancelled", durationMs, errorMessage: err.message };
+    }
+    const errorMessage = safeErrorMessage(err);
+    return {
+      status: "failed",
+      failedStep: currentStep,
+      durationMs,
+      errorMessage
+    };
+  }
+}
+function resolveBuildDirectory(projectDir, rootDirectory) {
+  const normalized = rootDirectory?.trim().replace(/^\/+|\/+$/g, "");
+  if (!normalized || normalized === ".") {
+    return projectDir;
+  }
+  return `${projectDir}/${normalized}`;
+}
+function parseLogLevel(message) {
+  if (/\b(error|fatal|panic)\b/i.test(message)) return "error";
+  if (/\bwarn(ing)?\b/i.test(message)) return "warn";
+  return "info";
+}
+function detectBuildKillHint(output) {
+  if (!output) return null;
+  const tail = output.slice(-4096);
+  if (/\bsigkill\b|\bKilled\b|out of memory|JavaScript heap out of memory|Allocation failed/i.test(
+    tail
+  )) {
+    return "Build process was killed - typically because the target ran out of memory during the build. Increase RAM on the target, add swap, or build locally and ship the dist.";
+  }
+  return null;
+}
+
+// ../../packages/adapters/src/runtime/managed-artifact.ts
+var MANAGED_ARTIFACT_BASE = "/opt/kraft";
+var PROTECTED_ROOTS = /* @__PURE__ */ new Set([
+  MANAGED_ARTIFACT_BASE,
+  // BareRuntime's own layout (workDir = MANAGED_ARTIFACT_BASE): releases/<depId>,
+  // .builds/<sessionId>. The parents hold every project's releases at once.
+  `${MANAGED_ARTIFACT_BASE}/releases`,
+  `${MANAGED_ARTIFACT_BASE}/.builds`,
+  // The static tree, whose parent is ALSO the one directory bind-mounted into the
+  // edge container — removing it stops the box serving every static site it hosts.
+  `${MANAGED_ARTIFACT_BASE}/static`,
+  `${MANAGED_ARTIFACT_BASE}/static/releases`,
+  `${MANAGED_ARTIFACT_BASE}/static/.builds`
+]);
+function canonical(ref) {
+  const trimmed = ref.trim();
+  return trimmed.length > 1 ? trimmed.replace(/\/+$/, "") : trimmed;
+}
+function assertManagedArtifactPath(ref) {
+  const target = canonical(ref);
+  if (!target.startsWith("/") || target.includes("..")) {
+    throw new Error(
+      `Refusing to remove "${ref}": an artifact path must be absolute and free of "..".`
+    );
+  }
+  if (PROTECTED_ROOTS.has(target)) {
+    throw new Error(
+      `Refusing to remove "${ref}": that is a shared parent directory, not one deployment's output.`
+    );
+  }
+  if (target !== MANAGED_ARTIFACT_BASE && !target.startsWith(`${MANAGED_ARTIFACT_BASE}/`)) {
+    throw new Error(
+      `Refusing to remove "${ref}": outside ${MANAGED_ARTIFACT_BASE}. Kraft removes only directories it created (release dirs, static doc-roots, build dirs).`
+    );
+  }
+}
+async function removeManagedArtifact(executor, ref) {
+  assertManagedArtifactPath(ref);
+  const target = canonical(ref);
+  if (executor) {
+    await executor.exec(`rm -rf ${sq(target)}`);
+    if (await executor.exists(target)) {
+      throw new Error(
+        `Failed to remove ${target}: still present after rm -rf.`
+      );
+    }
+    return;
+  }
+  const { rm: rm2, access: access2 } = await import("fs/promises");
+  await rm2(target, { recursive: true, force: true });
+  const stillThere = await access2(target).then(
+    () => true,
+    () => false
+  );
+  if (stillThere)
+    throw new Error(`Failed to remove ${target}: still present after rm.`);
+}
+function isArtifactPathRef(ref) {
+  return ref.startsWith("/");
+}
+
+// ../../packages/adapters/src/runtime/docker-paths.ts
+import { access, readdir } from "fs/promises";
+import { isAbsolute, join, relative, resolve, sep } from "path";
+function toPosixPath(value) {
+  return value.split(sep).filter(Boolean).join("/");
+}
+function toSafeSegments(value, label) {
+  const segments = value.split(/[\\/]/).filter((segment) => segment && segment !== ".");
+  if (segments.includes("..")) {
+    throw new Error(
+      `Invalid ${label} ${JSON.stringify(value)}: path segments must not contain "..".`
+    );
+  }
+  return segments;
+}
+function normalizeDockerRelativePath(value) {
+  const normalized = value?.trim().replace(/^\.\//, "").replace(/^\/+|\/+$/g, "");
+  if (!normalized || normalized === ".") {
+    return "";
+  }
+  return toSafeSegments(normalized, "path").join("/");
+}
+function resolveWithinDirectory(baseDir, relativePath) {
+  const base = resolve(baseDir);
+  const target = resolve(
+    base,
+    ...toSafeSegments(relativePath?.trim() ?? "", "path")
+  );
+  const escape = relative(base, target);
+  if (escape === ".." || escape.startsWith(`..${sep}`) || isAbsolute(escape)) {
+    throw new Error(
+      `Resolved path ${JSON.stringify(target)} escapes ${JSON.stringify(base)}.`
+    );
+  }
+  return target;
+}
+function normalizeDockerRootDirectory(rootDirectory, localPath) {
+  let normalized = rootDirectory?.trim() ?? "";
+  if (!normalized) {
+    return "";
+  }
+  if (localPath && isAbsolute(normalized)) {
+    const relativePath = relative(localPath, normalized);
+    if (!relativePath || relativePath === ".") {
+      return "";
+    }
+    if (!relativePath.startsWith("..") && !isAbsolute(relativePath)) {
+      normalized = relativePath;
+    }
+  }
+  normalized = normalized.replace(/^\.\//, "").replace(/^\/+|\/+$/g, "");
+  if (!normalized || normalized === ".") {
+    return "";
+  }
+  return toSafeSegments(normalized, "rootDirectory").join("/");
+}
+function resolveExplicitDockerfileCandidate(rootDirectory, dockerfilePath) {
+  const normalizedRootDirectory = normalizeDockerRelativePath(rootDirectory);
+  const normalizedDockerfilePath = normalizeDockerRelativePath(dockerfilePath);
+  if (!normalizedDockerfilePath) {
+    return "";
+  }
+  if (!normalizedRootDirectory) {
+    return normalizedDockerfilePath;
+  }
+  if (normalizedDockerfilePath.startsWith(`${normalizedRootDirectory}/`)) {
+    return normalizedDockerfilePath;
+  }
+  return `${normalizedRootDirectory}/${normalizedDockerfilePath}`;
+}
+function resolveDockerfileCandidates(rootDirectory, explicitDockerfilePath) {
+  const normalizedRootDirectory = normalizeDockerRelativePath(rootDirectory);
+  return [
+    resolveExplicitDockerfileCandidate(rootDirectory, explicitDockerfilePath),
+    normalizedRootDirectory ? `${normalizedRootDirectory}/Dockerfile` : "Dockerfile",
+    "Dockerfile"
+  ].filter(
+    (candidate, index, values) => Boolean(candidate) && values.indexOf(candidate) === index
+  );
+}
+function dockerBuildContextDirectory(config) {
+  return normalizeDockerRelativePath(config.buildContextDirectory);
+}
+function resolveContextDockerfileCandidates(contextDirectory, explicitDockerfilePath) {
+  const context = normalizeDockerRelativePath(contextDirectory);
+  const explicit = normalizeDockerRelativePath(explicitDockerfilePath);
+  const candidates = [];
+  if (explicit) {
+    candidates.push(explicit);
+    if (context && explicit.startsWith(`${context}/`)) {
+      candidates.push(explicit.slice(context.length + 1));
+    }
+  }
+  candidates.push("Dockerfile");
+  return candidates.filter(
+    (candidate, index, values) => Boolean(candidate) && values.indexOf(candidate) === index
+  );
+}
+var ROOT_MANIFESTS = [
+  "package.json",
+  "pyproject.toml",
+  "requirements.txt",
+  "Pipfile",
+  "go.mod",
+  "Cargo.toml",
+  "Gemfile",
+  "composer.json",
+  "pom.xml",
+  "build.gradle",
+  "build.gradle.kts",
+  "mix.exs",
+  "Dockerfile"
+];
+var IGNORED_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  ".next",
+  ".nuxt",
+  ".output",
+  ".turbo",
+  ".venv",
+  "__pycache__",
+  "build",
+  "dist",
+  "target",
+  "vendor"
+]);
+async function pathExists(path) {
+  return access(path).then(() => true).catch(() => false);
+}
+async function manifestCount(dir) {
+  let count = 0;
+  for (const file of ROOT_MANIFESTS) {
+    if (await pathExists(join(dir, file))) {
+      count += 1;
+    }
+  }
+  return count;
+}
+function pathSegments(path) {
+  return path.toLowerCase().split("/").filter(Boolean);
+}
+function scorePathHints(relativePath) {
+  const segments = pathSegments(relativePath);
+  let score = 0;
+  for (const segment of segments) {
+    if ([
+      "app",
+      "apps",
+      "site",
+      "sites",
+      "web",
+      "www",
+      "service",
+      "services"
+    ].includes(segment)) {
+      score += 12;
+    }
+    if (["docs", "example", "examples", "test", "tests", "storybook"].includes(
+      segment
+    )) {
+      score -= 18;
+    }
+  }
+  return score;
+}
+async function scoreCandidate(dir, relativePath) {
+  let score = scorePathHints(relativePath);
+  score += await manifestCount(dir) * 20;
+  if (relativePath) {
+    score += 6;
+  }
+  return score;
+}
+async function collectCandidates(rootDir, currentDir, depth, candidates) {
+  const relativePath = toPosixPath(relative(rootDir, currentDir));
+  if (await manifestCount(currentDir) > 0) {
+    candidates.push({
+      path: relativePath,
+      score: await scoreCandidate(currentDir, relativePath)
+    });
+  }
+  if (depth >= 6) {
+    return;
+  }
+  const entries = await readdir(currentDir, { withFileTypes: true }).catch(
+    () => []
+  );
+  for (const entry of entries) {
+    if (!entry.isDirectory() || IGNORED_DIRS.has(entry.name)) {
+      continue;
+    }
+    await collectCandidates(
+      rootDir,
+      join(currentDir, entry.name),
+      depth + 1,
+      candidates
+    );
+  }
+}
+async function resolveDockerRootDirectory(contextDir, rootDirectory, localPath) {
+  const hasExplicitRootDirectory = typeof rootDirectory === "string";
+  const normalized = normalizeDockerRootDirectory(rootDirectory, localPath);
+  if (hasExplicitRootDirectory) {
+    return normalized;
+  }
+  if (normalized) {
+    return normalized;
+  }
+  const candidates = [];
+  await collectCandidates(contextDir, contextDir, 0, candidates);
+  if (candidates.length === 0) {
+    return "";
+  }
+  candidates.sort((left, right) => right.score - left.score);
+  const bestNonRoot = candidates.find((candidate) => candidate.path);
+  if (bestNonRoot && bestNonRoot.score > 0) {
+    return bestNonRoot.path;
+  }
+  return candidates[0]?.path ?? "";
+}
+
+// ../../packages/adapters/src/runtime/docker-build-plan.ts
+var DOCKER_BUILD_EVENT_PREFIX = "[kraft-build]";
+var INLINE_BUILD_ENV_EXCLUDES = /* @__PURE__ */ new Set(["FORCE_COLOR", "TERM", "PATH"]);
+function formatDockerBuildEvent(step, status) {
+  return `${DOCKER_BUILD_EVENT_PREFIX} step=${step} status=${status}`;
+}
+function normalizeRelativePath(value) {
+  const normalized = value?.trim().replace(/^\.\//, "").replace(/^\/+|\/+$/g, "");
+  if (!normalized || normalized === ".") {
+    return "";
+  }
+  return normalized;
+}
+function builderSourceDir(rootDirectory) {
+  const normalized = normalizeDockerRootDirectory(rootDirectory);
+  return normalized ? `/workspace/${normalized}` : "/workspace";
+}
+function buildEnvPrefix(envVars) {
+  const assignments = Object.entries(envVars).filter(([key]) => !INLINE_BUILD_ENV_EXCLUDES.has(key)).filter(([key]) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(key)).map(([key, value]) => `${key}=${sq2(value)}`);
+  if (!envVars.NO_COLOR) {
+    assignments.push("NO_COLOR='1'");
+  }
+  if (assignments.length === 0) {
+    return "";
+  }
+  return `export ${assignments.join(" ")} && `;
+}
+function buildRunCommand(command, envPrefix) {
+  return `${envPrefix}${command}`;
+}
+function runtimeCopyDirectives(config, sourceDir) {
+  if (config.productionPaths && config.productionPaths.length > 0) {
+    return config.productionPaths.map((path) => {
+      const normalized = normalizeRelativePath(path);
+      const source = normalized ? `${sourceDir}/${normalized}` : sourceDir;
+      const target = normalized ? `/app/${normalized}` : "/app";
+      return `COPY --from=builder ${source} ${target}`;
+    });
+  }
+  return [`COPY --from=builder ${sourceDir} /app`];
+}
+function needsMultiStage(config) {
+  return config.buildImage !== config.runtimeImage;
+}
+function nodeBinPathEnvLine(packageManager, roots) {
+  const dirs = nodeBinDirs(packageManager, roots);
+  return dirs.length > 0 ? `ENV PATH="${dirs.join(":")}:$PATH"` : null;
+}
+function workspacePrepareRunLine(config, envPrefix, workspacePrepare) {
+  const pmEnsure = packageManagerEnsureCommand(config.packageManager);
+  const body = pmEnsure ? `${pmEnsure} && ${workspacePrepare}` : workspacePrepare;
+  return `RUN ${envPrefix}${body}`;
+}
+function stepsRunLine(config, envPrefix, opts) {
+  const install = opts.install ? config.installCommand : "";
+  const build = opts.build ? config.buildCommand : "";
+  const steps = [];
+  const pmEnsure = packageManagerEnsureCommand(
+    opts.packageManager ?? config.packageManager
+  );
+  if (pmEnsure && (install || build)) {
+    steps.push(pmEnsure);
+  }
+  if (install) {
+    steps.push(`printf '${formatDockerBuildEvent("install", "running")}\\n'`);
+    steps.push(buildRunCommand(install, envPrefix));
+    steps.push(`printf '${formatDockerBuildEvent("install", "completed")}\\n'`);
+  }
+  if (build) {
+    steps.push(`printf '${formatDockerBuildEvent("build", "running")}\\n'`);
+    steps.push(buildRunCommand(build, envPrefix));
+    steps.push(`printf '${formatDockerBuildEvent("build", "completed")}\\n'`);
+  }
+  return steps.length > 0 ? `RUN ${steps.join(" && ")}` : null;
+}
+function installBuildRunLine(config, envPrefix) {
+  return stepsRunLine(config, envPrefix, { install: true, build: true });
+}
+function installRunLine(config, envPrefix) {
+  return stepsRunLine(config, envPrefix, { install: true });
+}
+var JS_PACKAGE_MANAGERS = ["pnpm", "yarn", "bun", "npm"];
+function assetStagePackageManager(config) {
+  const command = config.buildCommand?.trim() ?? "";
+  return JS_PACKAGE_MANAGERS.find(
+    (pm) => new RegExp(`(^|\\s|&&\\s*)${pm}\\s`).test(command)
+  ) ?? "npm";
+}
+function buildOnlyRunLine(config, envPrefix) {
+  const command = config.buildCommand?.trim() ?? "";
+  const packageManager = JS_PACKAGE_MANAGERS.find(
+    (pm) => new RegExp(`(^|\\s|&&\\s*)${pm}\\s`).test(command)
+  );
+  return stepsRunLine(config, envPrefix, { build: true, packageManager });
+}
+function isPhpRuntime(config) {
+  return /^php:/.test(config.runtimeImage) || /frankenphp/i.test(config.runtimeImage);
+}
+var PHP_EXTENSIONS = [
+  "pdo_mysql",
+  "pdo_pgsql",
+  "redis",
+  "pcntl",
+  "bcmath",
+  "intl",
+  "zip",
+  "gd",
+  "opcache"
+];
+var PHP_EXT_INSTALLER_IMAGE = "mlocati/php-extension-installer:2";
+var PHP_ASSET_BUILD_IMAGE = "node:22-bookworm-slim";
+var PHP_EXT_INSTALL_LINE = `RUN install-php-extensions ${PHP_EXTENSIONS.join(" ")} > /dev/null`;
+function generatePhpDockerfile(config) {
+  const sourceDir = builderSourceDir(
+    normalizeDockerRootDirectory(config.rootDirectory, config.localPath)
+  );
+  const envPrefix = buildEnvPrefix(config.envVars);
+  const installLine = installRunLine(config, envPrefix);
+  const assetBuildLine = buildOnlyRunLine(config, envPrefix);
+  const lines = [
+    `FROM ${config.buildImage} AS builder`,
+    // php:*-cli ships no Composer — pull the binary from the official image.
+    `COPY --from=composer:2 /usr/bin/composer /usr/bin/composer`,
+    `COPY --from=${PHP_EXT_INSTALLER_IMAGE} /usr/bin/install-php-extensions /usr/bin/install-php-extensions`,
+    PHP_EXT_INSTALL_LINE,
+    `WORKDIR /workspace`,
+    `COPY . /workspace`,
+    `WORKDIR ${sourceDir}`
+  ];
+  if (installLine) lines.push(installLine);
+  if (assetBuildLine) {
+    const assetBinPath = nodeBinPathEnvLine(assetStagePackageManager(config), [
+      sourceDir,
+      "/workspace"
+    ]);
+    lines.push(
+      `FROM ${PHP_ASSET_BUILD_IMAGE} AS assets`,
+      ...assetBinPath ? [assetBinPath] : [],
+      `WORKDIR /workspace`,
+      `COPY . /workspace`,
+      `WORKDIR ${sourceDir}`,
+      assetBuildLine
+    );
+  }
+  const docroot = normalizeRelativePath(config.outputDirectory) || "public";
+  lines.push(
+    `FROM ${config.runtimeImage} AS runtime`,
+    PHP_EXT_INSTALL_LINE,
+    // --chown on the COPY instead of a trailing `chown -R`: the recursive form
+    // rewrites every file into a second layer, doubling the app's size on disk.
+    // Ownership has to be settled HERE, before anything mounts: Docker seeds a
+    // fresh named volume from the image directory it covers, ownership included,
+    // so `/app/storage` is only writable by the runtime user if it was already
+    // owned by them in the image (see @repo/core volumes.ts).
+    `COPY --from=builder --chown=www-data:www-data ${sourceDir} /app`
+  );
+  if (assetBuildLine) {
+    lines.push(
+      `COPY --from=assets --chown=www-data:www-data ${sourceDir}/${docroot} /app/${docroot}`
+    );
+  }
+  lines.push(
+    `WORKDIR /app`,
+    // FrankenPHP's bundled Caddyfile reads the docroot from SERVER_ROOT (default
+    // `public/`, resolved against WORKDIR). Setting it keeps the project's
+    // outputDirectory authoritative for BOTH what gets served and where the asset
+    // stage's output lands — otherwise a project that renamed its docroot builds
+    // assets into one directory and serves another.
+    `ENV SERVER_ROOT=${docroot}/`,
+    // Caddy's config + data dirs are root-owned in the base image, and it writes
+    // to both on startup — without this the non-root switch below fails at boot.
+    `RUN mkdir -p /data/caddy /config/caddy && chown -R www-data:www-data /data/caddy /config/caddy`,
+    // The frankenphp binary carries cap_net_bind_service, so dropping root here
+    // still leaves any port bindable.
+    `USER www-data`,
+    `EXPOSE ${config.port}`
+  );
+  if (config.startCommand) {
+    lines.push(`CMD ["sh", "-c", ${JSON.stringify(config.startCommand)}]`);
+  }
+  return lines.join("\n");
+}
+function staticNginxTemplateLines(port) {
+  return [
+    "server {",
+    `    listen ${port} default_server;`,
+    "    root /usr/share/nginx/html;",
+    "    index index.html;",
+    "    location / { try_files $uri $uri/ /index.html; }",
+    "}"
+  ];
+}
+function builderContextRoot(config) {
+  return builderSourceDir(
+    normalizeDockerRootDirectory(config.rootDirectory, config.localPath)
+  );
+}
+function isExcludedDocRootEntry(name) {
+  return name === ".dockerignore" || name === ".git" || name === "Dockerfile" || name.startsWith("Dockerfile.");
+}
+function staticBuilderOutputPath(config) {
+  const sourceDir = builderSourceDir(
+    normalizeDockerRootDirectory(config.rootDirectory, config.localPath)
+  );
+  const output = normalizeRelativePath(config.outputDirectory);
+  return output ? `${sourceDir}/${output}` : sourceDir;
+}
+function generateStaticDockerfile(config) {
+  const sourceDir = builderSourceDir(
+    normalizeDockerRootDirectory(config.rootDirectory, config.localPath)
+  );
+  const envPrefix = buildEnvPrefix(config.envVars);
+  const workspacePrepare = config.workspacePrepareCommand?.trim();
+  const outputPath = staticBuilderOutputPath(config);
+  const nginxTemplate = staticNginxTemplateLines(config.port).map((line) => `'${line}'`).join(" ");
+  const lines = [`FROM ${config.buildImage} AS builder`];
+  const buildBinPath = nodeBinPathEnvLine(config.packageManager, [
+    sourceDir,
+    "/workspace"
+  ]);
+  if (buildBinPath) lines.push(buildBinPath);
+  lines.push(`WORKDIR /workspace`, `COPY . /workspace`);
+  if (workspacePrepare) {
+    lines.push(workspacePrepareRunLine(config, envPrefix, workspacePrepare));
+  }
+  lines.push(`WORKDIR ${sourceDir}`);
+  const stepsLine = installBuildRunLine(config, envPrefix);
+  if (stepsLine) lines.push(stepsLine);
+  if (config.staticExtractOnly) return lines.join("\n");
+  lines.push(
+    `FROM nginx:alpine AS runtime`,
+    `RUN rm -f /etc/nginx/conf.d/default.conf`,
+    `COPY --from=builder ${outputPath} /usr/share/nginx/html`,
+    `RUN printf '%s\\n' ${nginxTemplate} > /etc/nginx/conf.d/app.conf`,
+    `EXPOSE ${config.port}`,
+    `CMD ["nginx", "-g", "daemon off;"]`
+  );
+  return lines.join("\n");
+}
+function generateDockerfile(config) {
+  if (config.isStatic) {
+    return generateStaticDockerfile(config);
+  }
+  if (isPhpRuntime(config) && needsMultiStage(config)) {
+    return generatePhpDockerfile(config);
+  }
+  const sourceDir = builderSourceDir(
+    normalizeDockerRootDirectory(config.rootDirectory, config.localPath)
+  );
+  const multiStage = needsMultiStage(config);
+  const envPrefix = buildEnvPrefix(config.envVars);
+  const workspacePrepare = config.workspacePrepareCommand?.trim();
+  const lines = [
+    multiStage ? `FROM ${config.buildImage} AS builder` : `FROM ${config.runtimeImage}`
+  ];
+  const buildBinPath = nodeBinPathEnvLine(config.packageManager, [
+    sourceDir,
+    "/workspace"
+  ]);
+  if (buildBinPath) lines.push(buildBinPath);
+  lines.push(`WORKDIR /workspace`, `COPY . /workspace`);
+  if (workspacePrepare) {
+    lines.push(workspacePrepareRunLine(config, envPrefix, workspacePrepare));
+  }
+  lines.push(`WORKDIR ${sourceDir}`);
+  const stepsLine = installBuildRunLine(config, envPrefix);
+  if (stepsLine) {
+    lines.push(stepsLine);
+  }
+  if (multiStage) {
+    lines.push(`FROM ${config.runtimeImage} AS runtime`);
+    lines.push(...runtimeCopyDirectives(config, sourceDir));
+    lines.push(`WORKDIR /app`);
+    const runtimeBinPath = nodeBinPathEnvLine(config.packageManager, ["/app"]);
+    if (runtimeBinPath) lines.push(runtimeBinPath);
+  }
+  lines.push(`EXPOSE ${config.port}`);
+  if (config.startCommand) {
+    lines.push(`CMD ["sh", "-c", ${JSON.stringify(config.startCommand)}]`);
+  }
+  return lines.join("\n");
+}
+
+// ../../packages/adapters/src/runtime/transfer.ts
+async function transferLocalDirectory(localPath, target, logger, options) {
+  logger.log(`Transferring ${localPath} \u2192 ${target.path}...
+`);
+  await target.executor.transferIn(localPath, target.path, logger.callback, {
+    excludes: options?.excludes,
+    includes: options?.includes,
+    alsoInclude: options?.alsoInclude
+  });
+  await verifyExecutorTransfer(target.executor, target.path, logger);
+}
+async function verifyExecutorTransfer(executor, targetPath, logger) {
+  try {
+    const countOutput = await executor.exec(
+      `find ${sq2(targetPath)} -mindepth 1 -maxdepth 1 | head -5 | wc -l`
+    );
+    const fileCount = parseInt(countOutput.trim(), 10);
+    if (fileCount === 0) {
+      throw new Error(
+        `Transfer target ${targetPath} is empty - files were not copied`
+      );
+    }
+    logger.log(`Transfer verified (${fileCount}+ entries in target).
+`);
+  } catch (err) {
+    if (err instanceof Error && err.message.includes("is empty")) throw err;
+    throw new Error(`Transfer verification failed: ${safeErrorMessage(err)}`);
+  }
+}
+
+// ../../packages/adapters/src/runtime/runtime-env.ts
+var RUNTIME_ENV_EXCLUDES = /* @__PURE__ */ new Set(["PATH"]);
+function splitRuntimeEnv(envVars) {
+  const entries = [];
+  const dropped = [];
+  for (const [key, value] of Object.entries(envVars)) {
+    if (RUNTIME_ENV_EXCLUDES.has(key)) dropped.push(key);
+    else entries.push([key, value]);
+  }
+  return { entries, dropped };
+}
+function droppedRuntimeEnvMessage(dropped) {
+  if (dropped.length === 0) return "";
+  return `Ignoring ${dropped.join(", ")} from this project's environment: it would replace the runtime's own value and stop the start command from resolving. Remove it to silence this.
+`;
+}
+
+export {
+  sq2 as sq,
+  assembleGitClone,
+  gitShellCommand,
+  materializeGitSsh,
+  shellGitSshWriter,
+  localGitSshWriter,
+  BuildLogger,
+  BuildCancelledError,
+  killProcessesUnderDir,
+  runBuildPipeline,
+  parseLogLevel,
+  detectBuildKillHint,
+  removeManagedArtifact,
+  isArtifactPathRef,
+  normalizeDockerRelativePath,
+  resolveWithinDirectory,
+  resolveDockerfileCandidates,
+  dockerBuildContextDirectory,
+  resolveContextDockerfileCandidates,
+  resolveDockerRootDirectory,
+  builderContextRoot,
+  isExcludedDocRootEntry,
+  staticBuilderOutputPath,
+  generateDockerfile,
+  transferLocalDirectory,
+  splitRuntimeEnv,
+  droppedRuntimeEnvMessage
+};