@rakay-technology/kraft 0.7.4

package/dist/chunk-DM3PKWDC.js

@@ -0,0 +1,2453 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  BuildCancelledError,
+  BuildLogger,
+  detectBuildKillHint,
+  droppedRuntimeEnvMessage,
+  isArtifactPathRef,
+  isExcludedDocRootEntry,
+  killProcessesUnderDir,
+  parseLogLevel,
+  removeManagedArtifact,
+  runBuildPipeline,
+  splitRuntimeEnv,
+  sq,
+  transferLocalDirectory
+} from "./chunk-AJ4QZLZ2.js";
+import {
+  LocalExecutor
+} from "./chunk-XVKUFMIB.js";
+import {
+  privilegedExecutor
+} from "./chunk-S3QBGGVP.js";
+import {
+  portOccupantDetails,
+  probeListeningPort
+} from "./chunk-WYNM7L22.js";
+import {
+  managedDeploymentUnitName,
+  probeExec,
+  withReason
+} from "./chunk-N4OALTFK.js";
+import {
+  HOST_STATE_DIR,
+  envOps,
+  hostRefusal,
+  opScript
+} from "./chunk-YRSZPVMB.js";
+import {
+  ensureOwnedDir,
+  resolveEnvironment
+} from "./chunk-OFXBNFNL.js";
+import {
+  formatDuration,
+  isRemoteConnectionError,
+  isRetryableRemoteConnectionError,
+  systemDebug
+} from "./chunk-3CJLKL6E.js";
+import {
+  sq as sq2,
+  wrapLocalBuildCommand
+} from "./chunk-MNV2QFHW.js";
+import {
+  DeployError,
+  LANGUAGES,
+  STACKS,
+  answered,
+  appVolumeTargets,
+  buildOutputTransferExcludes,
+  missingOutputDirectoryMessage,
+  nodeBinPathExport,
+  packageManagerEnsureCommand,
+  refused,
+  safeErrorMessage,
+  shellQuote
+} from "./chunk-PVOWHIND.js";
+
+// ../../packages/adapters/src/system/remote-journal.ts
+var OPSH_RUN_VERSION = 1;
+var DEFAULT_JOURNAL_BASE = HOST_STATE_DIR;
+var REMOTE_ENV_PREFIX = "export DEBIAN_FRONTEND=noninteractive DPKG_FORCE=confnew && ";
+var OPSH_RUN_SCRIPT = `#!/bin/sh
+# opsh-run \u2014 kraft reliable command journal. Managed file; do not edit.
+VERSION=${OPSH_RUN_VERSION}
+
+BASE="$OPSH_BASE"
+[ -z "$BASE" ] && BASE=${HOST_STATE_DIR}
+OPS="$BASE/ops"
+
+if [ "$1" = "--version" ]; then echo "$VERSION"; exit 0; fi
+
+if [ "$1" = "--gc" ]; then
+  TTLMIN=1440
+  [ -n "$2" ] && TTLMIN="$2"
+  [ -d "$OPS" ] || exit 0
+  for d in "$OPS"/*; do
+    [ -d "$d" ] || continue
+    if [ -f "$d/exit" ]; then
+      [ -n "$(find "$d/exit" -mmin +"$TTLMIN" 2>/dev/null)" ] && rm -rf "$d"
+    else
+      if [ -n "$(find "$d" -maxdepth 0 -mmin +1440 2>/dev/null)" ]; then
+        p="$(cat "$d/pid" 2>/dev/null)"
+        { [ -z "$p" ] || ! kill -0 "$p" 2>/dev/null; } && rm -rf "$d"
+      fi
+    fi
+  done
+  exit 0
+fi
+
+OPID="$1"
+CMDB64="$2"
+shift 2
+WAIT=25
+ENVPREFIX=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --wait) [ $# -ge 2 ] && WAIT="$2"; shift 2 2>/dev/null || shift ;;
+    --env-prefix) [ $# -ge 2 ] && ENVPREFIX="$(printf %s "$2" | openssl base64 -d -A 2>/dev/null)"; shift 2 2>/dev/null || shift ;;
+    *) shift ;;
+  esac
+done
+
+DIR="$OPS/$OPID"
+CMD="$(printf %s "$CMDB64" | openssl base64 -d -A 2>/dev/null)"
+[ -z "$CMD" ] && { echo "OPSH-EIO badcmd"; exit 0; }
+HASH="$(printf %s "$CMD" | openssl dgst -sha256 2>/dev/null | awk '{print $NF}')"
+
+if mkdir -p "$OPS" 2>/dev/null && mkdir "$DIR" 2>/dev/null; then
+  # Launcher: exactly one invocation per opId reaches here (mkdir is atomic).
+  if ! printf %s "$HASH" > "$DIR/cmdhash" 2>/dev/null; then
+    rm -rf "$DIR" 2>/dev/null; echo "OPSH-EIO nowrite"; exit 0
+  fi
+  printf %s "$CMD" > "$DIR/cmd" 2>/dev/null
+  # Subshell (not brace group) so a command that calls \`exit\` terminates only
+  # the subshell \u2014 the exit code is still captured and journaled.
+  RUN="( $ENVPREFIX $CMD ) > $DIR/stdout 2> $DIR/stderr; "'c=$?; echo $c'" > $DIR/exit.tmp && mv $DIR/exit.tmp $DIR/exit"
+  # nohup + </dev/null + & detaches from the SSH channel: a dropped connection
+  # (channel SIGHUP) can't kill the work. $! stays the running shell's pid.
+  nohup sh -c "$RUN" </dev/null >/dev/null 2>&1 &
+  echo $! > "$DIR/pid" 2>/dev/null
+else
+  # Attach/harvest. Guard against a reused opId carrying a different command.
+  [ -d "$DIR" ] || { echo "OPSH-EIO nodir"; exit 0; }
+  prev="$(cat "$DIR/cmdhash" 2>/dev/null)"
+  [ -n "$prev" ] && [ "$prev" != "$HASH" ] && { echo "OPSH-COLLISION"; exit 0; }
+fi
+
+# Wait up to WAIT seconds for the exit file (published atomically AFTER the
+# stdout/stderr fds close \u2192 a visible exit means output is final).
+i=0
+max=$((WAIT * 5))
+while [ ! -f "$DIR/exit" ]; do
+  p="$(cat "$DIR/pid" 2>/dev/null)"
+  if [ -n "$p" ] && ! kill -0 "$p" 2>/dev/null; then
+    [ -f "$DIR/exit" ] && break
+    echo "OPSH-DEAD"; exit 0
+  fi
+  i=$((i + 1))
+  if [ "$i" -ge "$max" ]; then echo "OPSH-RUNNING $p"; exit 0; fi
+  sleep 0.2
+done
+
+CODE="$(cat "$DIR/exit" 2>/dev/null)"
+[ -z "$CODE" ] && CODE=1
+OUT="$(openssl base64 -A < "$DIR/stdout" 2>/dev/null)"
+ERR="$(openssl base64 -A < "$DIR/stderr" 2>/dev/null)"
+echo "OPSH1 $CODE $OUT $ERR"
+exit 0
+`;
+async function resolveJournalBase(exec) {
+  try {
+    return envOps(await resolveEnvironment(exec)).scratchDir();
+  } catch (err) {
+    if (isRemoteConnectionError(err)) throw err;
+    return DEFAULT_JOURNAL_BASE;
+  }
+}
+async function ensureRemoteJournal(exec, baseDir) {
+  const runner = `${baseDir}/bin/opsh-run`;
+  let current = -1;
+  try {
+    const out = await exec.exec(
+      `OPSH_BASE=${sq2(baseDir)} sh ${sq2(runner)} --version 2>/dev/null`,
+      { timeout: 1e4 }
+    );
+    current = Number.parseInt(out.trim(), 10);
+  } catch {
+    current = -1;
+  }
+  if (current !== OPSH_RUN_VERSION) {
+    const tmp = `${runner}.tmp`;
+    await exec.writeFile(tmp, OPSH_RUN_SCRIPT);
+    await exec.exec(
+      `mkdir -p ${sq2(`${baseDir}/ops`)} && chmod 0700 ${sq2(tmp)} && mv -f ${sq2(tmp)} ${sq2(runner)}`
+    );
+  }
+  try {
+    await exec.exec(
+      `OPSH_BASE=${sq2(baseDir)} sh ${sq2(runner)} --gc 2>/dev/null`,
+      {
+        timeout: 15e3
+      }
+    );
+  } catch {
+  }
+}
+async function runJournaled(exec, opId, command, opts) {
+  const waitSecs = Math.max(1, Math.min(300, opts.waitSecs ?? 25));
+  const runner = `${opts.baseDir}/bin/opsh-run`;
+  const cmdB64 = Buffer.from(command, "utf8").toString("base64");
+  const envPrefix = opts.envPrefix ?? REMOTE_ENV_PREFIX;
+  const envB64 = Buffer.from(envPrefix, "utf8").toString("base64");
+  let invocation = `OPSH_BASE=${sq2(opts.baseDir)} sh ${sq2(runner)} ${sq2(opId)} ${cmdB64} --wait ${waitSecs}`;
+  if (envB64) invocation += ` --env-prefix ${envB64}`;
+  const raw = await exec.exec(invocation, { timeout: (waitSecs + 20) * 1e3 });
+  return parseFrame(raw);
+}
+function parseFrame(raw) {
+  const line = raw.trim().split("\n").map((l) => l.trim()).filter(Boolean).pop() ?? "";
+  if (line.startsWith("OPSH1 ")) {
+    const parts = line.split(" ");
+    const code = Number.parseInt(parts[1] ?? "", 10);
+    const decode = (b64) => b64 ? Buffer.from(b64, "base64").toString("utf8") : "";
+    return {
+      status: "done",
+      code: Number.isFinite(code) ? code : 1,
+      stdout: decode(parts[2]),
+      stderr: decode(parts[3])
+    };
+  }
+  if (line.startsWith("OPSH-RUNNING")) return { status: "running" };
+  if (line === "OPSH-DEAD") return { status: "dead" };
+  if (line === "OPSH-COLLISION") return { status: "collision" };
+  if (line.startsWith("OPSH-EIO")) {
+    return {
+      status: "eio",
+      message: line.slice("OPSH-EIO ".length).trim() || "journal I/O error"
+    };
+  }
+  return {
+    status: "eio",
+    message: `unrecognized journal frame: ${line.slice(0, 160)}`
+  };
+}
+var OpInterruptedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "OpInterruptedError";
+  }
+};
+var DEFAULT_RELIABLE_TIMEOUT_MS = 15 * 6e4;
+var DEFAULT_RECONNECT_MIN_MS = 1e3;
+var DEFAULT_RECONNECT_MAX_MS = 3e4;
+function sleep(ms) {
+  return new Promise((resolve) => {
+    const t = setTimeout(resolve, ms);
+    t.unref?.();
+  });
+}
+async function runReliable(acquire, opId, command, opts) {
+  let baseDir = opts.baseDir ?? null;
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_RELIABLE_TIMEOUT_MS;
+  const deadline = Date.now() + timeoutMs;
+  const minMs = opts.reconnectMinMs ?? DEFAULT_RECONNECT_MIN_MS;
+  const maxMs = opts.reconnectMaxMs ?? DEFAULT_RECONNECT_MAX_MS;
+  const envPrefix = opts.envPrefix ?? REMOTE_ENV_PREFIX;
+  let backoff = minMs;
+  for (; ; ) {
+    if (Date.now() >= deadline) {
+      throw new Error(`Op '${opId}' timed out after ${timeoutMs}ms`);
+    }
+    let executor;
+    try {
+      executor = await acquire();
+    } catch (err) {
+      const wait = Math.min(backoff, deadline - Date.now());
+      if (wait <= 0) throw err;
+      await sleep(wait);
+      backoff = Math.min(backoff * 2, maxMs);
+      continue;
+    }
+    try {
+      baseDir ??= await resolveJournalBase(executor);
+      if (!opts.ensured || !opts.ensured.has(executor)) {
+        await ensureRemoteJournal(executor, baseDir);
+        opts.ensured?.add(executor);
+      }
+      const waitSecs = Math.min(
+        opts.waitSecs ?? 25,
+        Math.max(1, Math.ceil((deadline - Date.now()) / 1e3))
+      );
+      const r = await runJournaled(executor, opId, command, {
+        baseDir,
+        waitSecs,
+        envPrefix
+      });
+      switch (r.status) {
+        case "done":
+          opts.onSuccess?.();
+          return {
+            code: r.code ?? 0,
+            stdout: r.stdout ?? "",
+            stderr: r.stderr ?? ""
+          };
+        case "running":
+          backoff = minMs;
+          continue;
+        case "dead":
+          throw new OpInterruptedError(
+            `Op '${opId}' was interrupted and did not complete (no exit recorded).`
+          );
+        case "collision":
+          throw new Error(
+            `Op id '${opId}' was reused with a different command.`
+          );
+        case "eio":
+          throw new Error(
+            `Remote journal error for op '${opId}': ${r.message ?? "unknown"}`
+          );
+      }
+    } catch (err) {
+      if (err instanceof OpInterruptedError) throw err;
+      if (isRetryableRemoteConnectionError(err)) {
+        opts.onRetryableDrop?.(err);
+        const wait = Math.min(backoff, deadline - Date.now());
+        if (wait <= 0) throw err;
+        await sleep(wait);
+        backoff = Math.min(backoff * 2, maxMs);
+        continue;
+      }
+      throw err;
+    }
+  }
+}
+async function execReliable(executor, opId, command, opts = {}) {
+  if (executor instanceof LocalExecutor) {
+    return executor.exec(command);
+  }
+  const r = await runReliable(
+    () => Promise.resolve(executor),
+    opId,
+    command,
+    opts
+  );
+  if (r.code !== 0) {
+    throw new Error(
+      r.stderr.trim() || r.stdout.trim() || `Exit code ${r.code}`
+    );
+  }
+  return r.stdout.trim();
+}
+
+// ../../packages/adapters/src/toolchain/catalog.ts
+var CHECKS = {
+  node: {
+    label: "Node.js",
+    versionCommand: "node --version",
+    parseVersion: (output) => output.replace(/^v/, "").trim(),
+    missingMessage: "Node.js is not installed",
+    installable: true
+  },
+  bun: {
+    label: "Bun",
+    versionCommand: "bun --version",
+    parseVersion: (output) => output.trim(),
+    missingMessage: "Bun is not installed",
+    installable: true
+  },
+  npm: {
+    label: "npm",
+    versionCommand: "npm --version",
+    parseVersion: (output) => output.trim(),
+    missingMessage: "npm is not installed",
+    installable: false,
+    providedBy: "node"
+  },
+  go: {
+    label: "Go",
+    versionCommand: "go version",
+    parseVersion: (output) => output.match(/go(\d+\.\d+(?:\.\d+)?)/)?.[1] ?? output.trim(),
+    missingMessage: "Go is not installed",
+    installable: true
+  },
+  rustc: {
+    label: "Rust compiler",
+    versionCommand: "rustc --version",
+    parseVersion: (output) => output.match(/rustc (\S+)/)?.[1] ?? output.trim(),
+    missingMessage: "Rust compiler is not installed",
+    installable: true
+  },
+  cargo: {
+    label: "Cargo",
+    versionCommand: "cargo --version",
+    parseVersion: (output) => output.match(/cargo (\S+)/)?.[1] ?? output.trim(),
+    missingMessage: "Cargo is not installed",
+    installable: false,
+    providedBy: "rustc"
+  },
+  python3: {
+    label: "Python 3",
+    versionCommand: "python3 --version",
+    parseVersion: (output) => output.match(/Python (\S+)/)?.[1] ?? output.trim(),
+    missingMessage: "Python 3 is not installed",
+    installable: true
+  },
+  pip: {
+    label: "pip",
+    versionCommand: "pip3 --version || pip --version",
+    parseVersion: (output) => output.match(/pip (\S+)/)?.[1] ?? output.trim(),
+    missingMessage: "pip is not installed",
+    installable: true,
+    providedBy: "python3"
+  },
+  ruby: {
+    label: "Ruby",
+    versionCommand: "ruby --version",
+    parseVersion: (output) => output.match(/ruby (\S+)/)?.[1] ?? output.trim(),
+    missingMessage: "Ruby is not installed",
+    installable: true
+  },
+  bundler: {
+    label: "Bundler",
+    versionCommand: "bundler --version",
+    parseVersion: (output) => output.match(/(\d+\.\d+\.\d+)/)?.[1] ?? output.trim(),
+    missingMessage: "Bundler is not installed",
+    installable: true,
+    providedBy: "ruby"
+  },
+  php: {
+    label: "PHP",
+    versionCommand: "php --version",
+    parseVersion: (output) => output.match(/PHP (\S+)/)?.[1] ?? output.trim(),
+    missingMessage: "PHP is not installed",
+    installable: true
+  },
+  composer: {
+    label: "Composer",
+    versionCommand: "composer --version",
+    parseVersion: (output) => output.match(/(\d+\.\d+\.\d+)/)?.[1] ?? output.trim(),
+    missingMessage: "Composer is not installed",
+    installable: true,
+    providedBy: "php"
+  },
+  java: {
+    label: "Java",
+    versionCommand: "java --version 2>&1 || java -version 2>&1",
+    parseVersion: (output) => output.match(/(\d+\.\d+)/)?.[1] ?? output.trim(),
+    missingMessage: "Java is not installed",
+    installable: true
+  },
+  javac: {
+    label: "Java compiler",
+    versionCommand: "javac --version 2>&1 || javac -version 2>&1",
+    parseVersion: (output) => output.match(/javac (\S+)/)?.[1] ?? output.trim(),
+    missingMessage: "Java compiler (javac) is not installed",
+    installable: false,
+    providedBy: "java"
+  },
+  maven: {
+    label: "Maven",
+    versionCommand: "mvn -version 2>&1",
+    parseVersion: (output) => output.match(/Apache Maven (\S+)/)?.[1] ?? output.trim(),
+    missingMessage: "Maven is not installed",
+    installable: true
+  },
+  gradle: {
+    label: "Gradle",
+    versionCommand: "gradle --version 2>&1",
+    parseVersion: (output) => output.match(/Gradle (\S+)/)?.[1] ?? output.trim(),
+    missingMessage: "Gradle is not installed",
+    installable: true
+  },
+  dotnet: {
+    label: ".NET SDK",
+    versionCommand: "dotnet --version",
+    parseVersion: (output) => output.trim(),
+    missingMessage: ".NET SDK is not installed",
+    installable: true
+  },
+  elixir: {
+    label: "Elixir",
+    versionCommand: "elixir --version 2>&1",
+    parseVersion: (output) => output.match(/Elixir (\S+)/)?.[1] ?? output.trim(),
+    missingMessage: "Elixir is not installed",
+    installable: true
+  },
+  mix: {
+    label: "Mix",
+    versionCommand: "mix --version 2>&1",
+    parseVersion: (output) => output.match(/Mix (\S+)/)?.[1] ?? output.trim(),
+    missingMessage: "Mix is not installed",
+    installable: false,
+    providedBy: "elixir"
+  }
+};
+function label(as, parts) {
+  const steps = [];
+  for (const part of parts) {
+    if (typeof part === "string") {
+      steps.push({ command: part, as });
+      continue;
+    }
+    if (!part.supported) return part;
+    for (const command of part.value) steps.push({ command, as });
+  }
+  return answered(steps);
+}
+function asRoot(...parts) {
+  return label("root", parts);
+}
+function asLogin(...parts) {
+  return label("login", parts);
+}
+function chain(...parts) {
+  const steps = [];
+  for (const part of parts) {
+    if (!part.supported) return part;
+    steps.push(...part.value);
+  }
+  return answered(steps);
+}
+function isAmazon(profile) {
+  return profile.distroId?.trim().toLowerCase() === "amzn";
+}
+var NODE_LTS_MAJOR = 22;
+var GO_VERSION = "1.22.5";
+var BUN_VERSION = "1.2.0";
+var DOTNET_CHANNEL = "8.0";
+var COMPOSER_INSTALL = "curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer";
+var NO_EPEL = "and Kraft does not enable third-party repositories (EPEL) on a host it did not provision. Install it yourself, or build in a container.";
+var NO_GRADLE_RPM = `The RHEL family ships no gradle package ${NO_EPEL} Most projects include a ./gradlew wrapper, which the build prefers anyway and which needs only a JDK.`;
+var NO_ELIXIR_RPM = `The RHEL family ships no elixir or erlang package ${NO_EPEL}`;
+function ensureUnzip(ops) {
+  if (ops.profile.os === "darwin") return answered([]);
+  const install = ops.pkgInstall(["unzip"]);
+  if (!install.supported) return answered([]);
+  return asRoot(
+    `command -v unzip >/dev/null 2>&1 || { ${opScript(install.value)}; }`
+  );
+}
+var RECIPES = {
+  node: {
+    verify: "node --version",
+    // Total over `SystemPackageManager` with no `default`, so a new manager is a
+    // "function lacks ending return statement" error rather than a silent fallthrough.
+    steps: (ops) => {
+      switch (ops.profile.packageManager) {
+        case "apt":
+          return asRoot(
+            "rm -f /etc/apt/sources.list.d/nodesource.list",
+            ops.pkgInstall(["curl", "gnupg", "ca-certificates"]),
+            "curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor --yes -o /usr/share/keyrings/nodesource.gpg",
+            `echo "deb [signed-by=/usr/share/keyrings/nodesource.gpg] https://deb.nodesource.com/node_${NODE_LTS_MAJOR}.x nodistro main" > /etc/apt/sources.list.d/nodesource.list`,
+            ops.pkgInstall(["nodejs"])
+          );
+        case "dnf":
+          return asRoot(
+            `curl -fsSL https://rpm.nodesource.com/setup_${NODE_LTS_MAJOR}.x | bash -`,
+            ops.pkgInstall(["nodejs"])
+          );
+        case "yum":
+          return refused(
+            `Node ${NODE_LTS_MAJOR} needs glibc 2.28 or newer and this host's release (${ops.profile.prettyName ?? ops.profile.distroId ?? "unknown"}) ships an older one, so the vendor package would install and then fail to load. Use a newer OS release, or build in a container.`
+          );
+        case "apk":
+          return asRoot(ops.pkgInstall(["nodejs", "npm"]));
+        case "brew":
+          return asRoot(ops.pkgInstall(["node"]));
+        case "none":
+          return asRoot(ops.pkgInstall(["nodejs"]));
+      }
+    }
+  },
+  bun: {
+    verify: "bun --version",
+    steps: (ops) => {
+      if (ops.profile.libc === "musl") {
+        return refused(
+          "Bun's official installer is a bash script and this host is musl-based (Alpine), which ships busybox ash and no bash. Kraft will not add a shell to a host to satisfy an installer. Use Node for this project, or build in a container."
+        );
+      }
+      return chain(
+        ensureUnzip(ops),
+        // The download lands in the login user's own home, so it must NOT be elevated:
+        // under sudo, HOME becomes root's and root would own ~/.bun, leaving `bun install`
+        // unable to write its own cache while `verify` still passes because it only reads.
+        //
+        // HOME is pinned to `home()` rather than left to `$HOME` so the install prefix and
+        // the symlink target below are derived from the same value and cannot diverge. The
+        // assignment sits on the `bash`, not the `curl` — it prefixes exactly one command,
+        // and it is the interpreter that chooses the prefix.
+        asLogin(
+          `curl -fsSL https://bun.sh/install | HOME=${shellQuote(ops.home())} bash -s 'bun-v${BUN_VERSION}'`
+        ),
+        // /usr/local/bin is root-owned, and this is what puts bun on PATH for a build.
+        asRoot(
+          `ln -sf ${shellQuote(`${ops.home()}/.bun/bin/bun`)} /usr/local/bin/bun`
+        )
+      );
+    }
+  },
+  go: {
+    verify: "go version",
+    steps: (ops) => {
+      if (ops.profile.libc === "musl") return asRoot(ops.pkgInstall(["go"]));
+      if (ops.profile.os === "darwin") return asRoot(ops.pkgInstall(["go"]));
+      const arch = ops.releaseArch();
+      if (!arch.supported) return arch;
+      return asRoot(
+        `curl -fsSL https://go.dev/dl/go${GO_VERSION}.linux-${arch.value}.tar.gz -o /tmp/go.tar.gz`,
+        "rm -rf /usr/local/go",
+        "tar -C /usr/local -xzf /tmp/go.tar.gz",
+        "rm -f /tmp/go.tar.gz",
+        // The profile.d line is for an operator's interactive login only. A build runs
+        // through a NON-login `ssh host 'go build'`, which sources nothing, so this was
+        // the only recipe of the fifteen whose payload never reached a build's PATH: the
+        // install went green and `go build` then exited 127. The symlink is what actually
+        // puts it there — Go resolves GOROOT from /proc/self/exe, so a link is transparent.
+        "ln -sf /usr/local/go/bin/go /usr/local/bin/go",
+        "ln -sf /usr/local/go/bin/gofmt /usr/local/bin/gofmt",
+        "echo 'export PATH=$PATH:/usr/local/go/bin' > /etc/profile.d/go.sh"
+      );
+    }
+  },
+  rustc: {
+    verify: ". $HOME/.cargo/env 2>/dev/null; rustc --version",
+    steps: (ops) => (
+      // rustup's default host triple is gnu, so on musl it fetches a toolchain that
+      // cannot run. Alpine's rust package is built for the box it's on.
+      ops.profile.libc === "musl" ? asRoot(ops.pkgInstall(["rust", "cargo"])) : chain(
+        // Unelevated for the same reason as bun, and doubly so here: rustup owns BOTH
+        // ~/.cargo and ~/.rustup, and `cargo build` writes into the registry cache
+        // under ~/.cargo on every build. Pinned HOME also makes `verify`
+        // (`. $HOME/.cargo/env`, run unelevated) look where the toolchain landed.
+        asLogin(
+          `curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | HOME=${shellQuote(ops.home())} sh -s -- -y --no-modify-path`
+        ),
+        asRoot(
+          `ln -sf ${shellQuote(`${ops.home()}/.cargo/bin/cargo`)} ${shellQuote(`${ops.home()}/.cargo/bin/rustc`)} /usr/local/bin/`
+        )
+      )
+    )
+  },
+  python3: {
+    verify: "python3 --version",
+    steps: (ops) => asRoot(
+      ops.pkgInstallVariants({
+        apt: answered(["python3", "python3-pip", "python3-venv"]),
+        // No `python3-venv` on the RPM side — venv lives in `python3-libs` there.
+        dnf: answered(["python3", "python3-pip"]),
+        yum: answered(["python3", "python3-pip"]),
+        apk: answered(["python3", "py3-pip"]),
+        brew: answered(["python3"])
+      })
+    )
+  },
+  pip: {
+    verify: "pip3 --version || pip --version",
+    steps: (ops) => asRoot(
+      ops.pkgInstallVariants({
+        apt: answered(["python3-pip"]),
+        dnf: answered(["python3-pip"]),
+        yum: answered(["python3-pip"]),
+        apk: answered(["py3-pip"]),
+        // Homebrew has no `pip` formula; pip arrives with its python.
+        brew: refused(
+          "Homebrew installs pip as part of Python \u2014 install the python3 tool instead."
+        )
+      })
+    )
+  },
+  ruby: {
+    verify: "ruby --version",
+    steps: (ops) => asRoot(
+      ops.pkgInstallVariants({
+        apt: answered(["ruby-full", "build-essential"]),
+        // AL2023 has no unversioned `ruby`; Rocky/Alma/RHEL/Fedora do. Both are dnf,
+        // which is exactly the split a package-manager-keyed table cannot express.
+        dnf: answered(
+          isAmazon(ops.profile) ? ["ruby3.2", "ruby3.2-devel"] : ["ruby", "ruby-devel"]
+        ),
+        yum: answered(["ruby", "ruby-devel"]),
+        // `build-base` because musl has no prebuilt native gems to fall back on.
+        apk: answered(["ruby", "ruby-dev", "build-base"]),
+        brew: answered(["ruby"])
+      })
+    )
+  },
+  bundler: {
+    verify: "bundler --version",
+    // Ships with every supported Ruby as a default gem; `gem install` only upgrades it.
+    // No distro package is worth preferring here.
+    steps: () => asRoot("gem install bundler")
+  },
+  php: {
+    verify: "php --version",
+    steps: (ops) => asRoot(
+      ops.pkgInstallVariants({
+        apt: answered([
+          "php-cli",
+          "php-mbstring",
+          "php-xml",
+          "php-curl",
+          "unzip"
+        ]),
+        // There is no `php-curl` anywhere on the RPM side — curl support ships in
+        // `php-common`, which the cli package pulls in. AL2023 versions every name.
+        dnf: answered(
+          isAmazon(ops.profile) ? ["php8.2-cli", "php8.2-mbstring", "php8.2-xml"] : ["php-cli", "php-mbstring", "php-xml"]
+        ),
+        yum: answered(["php-cli", "php-mbstring", "php-xml"]),
+        // Alpine versions the package and symlinks /usr/bin/php → php83, so `verify`
+        // holds without the recipe naming a version.
+        apk: answered(["php83"]),
+        brew: answered(["php"])
+      })
+    )
+  },
+  composer: {
+    verify: "composer --version",
+    steps: (ops) => {
+      if (ops.profile.packageManager === "brew")
+        return asRoot(ops.pkgInstall(["composer"]));
+      if (ops.profile.libc === "musl") {
+        return refused(
+          "Composer needs PHP's phar and openssl extensions, and on musl hosts (Alpine) those ship as separate packages that Kraft does not install. Add php-phar and php-openssl for your PHP version yourself, or build in a container."
+        );
+      }
+      return asRoot(COMPOSER_INSTALL);
+    }
+  },
+  java: {
+    verify: "java --version 2>&1",
+    steps: (ops) => asRoot(
+      ops.pkgInstallVariants({
+        apt: answered(["openjdk-21-jdk"]),
+        // Amazon ships Corretto in place of OpenJDK — `java-21-openjdk-devel` does not
+        // exist on AL2023, so a Java build there installed nothing and then failed on a
+        // missing `javac`.
+        dnf: answered(
+          isAmazon(ops.profile) ? ["java-21-amazon-corretto-devel"] : ["java-21-openjdk-devel"]
+        ),
+        // AL2 and CentOS 7 top out far below 21 (AL2's newest is
+        // `java-1.8.0-openjdk-devel`). Installing Java 8 for a recipe that promises 21 is
+        // the silent wrong answer, so name the release as the problem instead.
+        yum: refused(
+          "This host's release carries no OpenJDK 21 package \u2014 the newest it has is Java 8/11, and Kraft will not install a JDK older than the toolchain asks for. Use a newer OS release, or build in a container."
+        ),
+        apk: answered(["openjdk21-jdk"]),
+        brew: answered(["openjdk@21"])
+      })
+    )
+  },
+  maven: {
+    verify: "mvn -version",
+    steps: (ops) => asRoot(ops.pkgInstall(["maven"]))
+  },
+  gradle: {
+    verify: "gradle --version",
+    steps: (ops) => asRoot(
+      ops.pkgInstallVariants({
+        apt: answered(["gradle"]),
+        dnf: refused(NO_GRADLE_RPM),
+        yum: refused(NO_GRADLE_RPM),
+        apk: answered(["gradle"]),
+        brew: answered(["gradle"])
+      })
+    )
+  },
+  dotnet: {
+    verify: "dotnet --version",
+    steps: (ops) => {
+      if (ops.profile.libc === "musl")
+        return asRoot(ops.pkgInstall(["dotnet8-sdk"]));
+      if (ops.profile.packageManager === "brew")
+        return asRoot(ops.pkgInstall(["dotnet"]));
+      if (ops.profile.os !== "linux") {
+        return refused(
+          `Kraft installs the .NET SDK on Linux, and on macOS through Homebrew. This host reports os=${ops.profile.os}.`
+        );
+      }
+      return asRoot(
+        "curl -fsSL https://dot.net/v1/dotnet-install.sh -o /tmp/dotnet-install.sh",
+        `bash /tmp/dotnet-install.sh --channel ${DOTNET_CHANNEL} --install-dir /usr/local/share/dotnet`,
+        "rm -f /tmp/dotnet-install.sh",
+        "ln -sf /usr/local/share/dotnet/dotnet /usr/local/bin/dotnet"
+      );
+    }
+  },
+  elixir: {
+    verify: "elixir --version 2>&1",
+    steps: (ops) => asRoot(
+      ops.pkgInstallVariants({
+        apt: answered(["erlang", "elixir"]),
+        // Keyed on the distro, not the package manager, because the two disagree here:
+        // Fedora carries elixir and erlang in its own repos, while AL2023 and Rocky 9
+        // — same `dnf` — carry neither. Refusing all of dnf told a Fedora operator to go
+        // enable EPEL for a package Fedora already has, and EPEL does not target Fedora
+        // at all, so the advice was not just unnecessary but impossible to follow.
+        //
+        // This is the first production reader of `profile.distro`.
+        dnf: ops.profile.distro === "fedora" ? answered(["erlang", "elixir"]) : refused(NO_ELIXIR_RPM),
+        yum: refused(NO_ELIXIR_RPM),
+        apk: answered(["elixir", "erlang"]),
+        brew: answered(["elixir"])
+      })
+    )
+  }
+};
+var INSTALLS = Object.fromEntries(
+  Object.entries(RECIPES).map(([tool, recipe]) => [
+    tool,
+    (profile) => {
+      const gate = hostRefusal(profile);
+      if (gate !== null) return refused(gate);
+      const ops = envOps(profile);
+      const steps = recipe.steps(ops);
+      return steps.supported ? answered({ steps: steps.value, verifyCommand: recipe.verify }) : steps;
+    }
+  ])
+);
+var toolchainCatalog = {
+  /**
+   * Check recipes — how to detect each tool and parse its version.
+   *
+   * Every tool named in `LANGUAGES[lang].requiredTools` must have an entry here.
+   */
+  checks: CHECKS,
+  /**
+   * Install plan factories — how to install each tool on a given host.
+   *
+   * Only `installable` tools have one. npm, cargo, javac and mix arrive with their
+   * parent and say so through `providedBy`.
+   */
+  installs: INSTALLS
+};
+
+// ../../packages/adapters/src/toolchain/checks.ts
+function parseVersionParts(version) {
+  const match = version.match(/\d+(?:\.\d+)*/)?.[0] ?? "0";
+  return match.split(".").map((part) => parseInt(part, 10) || 0);
+}
+function compareVersions(actual, minimum) {
+  const actualParts = parseVersionParts(actual);
+  const minimumParts = parseVersionParts(minimum);
+  const maxLength = Math.max(actualParts.length, minimumParts.length);
+  for (let index = 0; index < maxLength; index += 1) {
+    const left = actualParts[index] ?? 0;
+    const right = minimumParts[index] ?? 0;
+    if (left > right) return 1;
+    if (left < right) return -1;
+  }
+  return 0;
+}
+function meetsMinVersion(actual, minimum) {
+  return compareVersions(actual, minimum) >= 0;
+}
+async function checkTool(executor, name, opts) {
+  const recipe = toolchainCatalog.checks[name];
+  if (!recipe) {
+    return {
+      name,
+      label: name,
+      installed: false,
+      healthy: false,
+      message: `Unknown tool: ${name}`
+    };
+  }
+  const probe = await probeExec(executor, recipe.versionCommand, "toolchain");
+  if (!probe.output) {
+    systemDebug(
+      "toolchain",
+      `${name}:missing ${probe.error ?? "exited 0 with no version"}`
+    );
+    return {
+      name,
+      label: recipe.label,
+      installed: false,
+      healthy: false,
+      // A tool that isn't there and a tool whose `--version` was refused ("permission
+      // denied", "Command timed out") both land here, and only the second can say why —
+      // #408, the same conflation `system/checks.ts` reports its way out of.
+      message: withReason(recipe.missingMessage, probe.error)
+    };
+  }
+  const version = recipe.parseVersion(probe.output);
+  if (opts?.minVersion && compareVersions(version, opts.minVersion) < 0) {
+    systemDebug(
+      "toolchain",
+      `${name}:outdated v${version} < ${opts.minVersion}`
+    );
+    return {
+      name,
+      label: recipe.label,
+      installed: true,
+      version,
+      requiredVersion: opts.minVersion,
+      healthy: false,
+      message: `${recipe.label} ${version} is installed but ${opts.minVersion}+ is required`
+    };
+  }
+  systemDebug("toolchain", `${name}:healthy v${version}`);
+  return {
+    name,
+    label: recipe.label,
+    installed: true,
+    version,
+    requiredVersion: opts?.minVersion,
+    healthy: true,
+    message: `${recipe.label} ${version}`
+  };
+}
+async function checkTools(executor, toolNames, requiredVersions) {
+  const startedAt = Date.now();
+  systemDebug("toolchain", `checkTools:start [${toolNames.join(", ")}]`);
+  const tools = await Promise.all(
+    toolNames.map(
+      (name) => checkTool(executor, name, { minVersion: requiredVersions?.[name] })
+    )
+  );
+  const missing = tools.filter((t) => !t.installed).map((t) => t.name);
+  const outdated = tools.filter((t) => t.installed && !t.healthy).map((t) => t.name);
+  const ready = missing.length === 0 && outdated.length === 0;
+  systemDebug(
+    "toolchain",
+    `checkTools:done (${formatDuration(startedAt)}) ready=${ready} missing=[${missing.join(", ")}] outdated=[${outdated.join(", ")}]`
+  );
+  return { tools, ready, missing, outdated };
+}
+async function checkToolchain(executor, language, requiredVersions) {
+  const lang = LANGUAGES[language];
+  if (!lang || lang.requiredTools.length === 0) {
+    return { tools: [], ready: true, missing: [], outdated: [] };
+  }
+  return checkTools(executor, lang.requiredTools, requiredVersions);
+}
+async function checkToolchainForStack(executor, stackId) {
+  const stack = STACKS[stackId];
+  if (!stack) {
+    return { tools: [], ready: true, missing: [], outdated: [] };
+  }
+  if (stack.requiredTools && stack.requiredTools.length > 0) {
+    return checkTools(
+      executor,
+      stack.requiredTools,
+      stack.requiredToolVersions
+    );
+  }
+  return checkToolchain(executor, stack.language, stack.requiredToolVersions);
+}
+
+// ../../packages/adapters/src/toolchain/installer.ts
+function groupStepsByAuthority(steps, hostNeedsRoot) {
+  const groups = [];
+  for (const step of steps) {
+    const as = step.as === "root" && hostNeedsRoot ? "root" : "login";
+    const open = groups.at(-1);
+    if (open && open.as === as) open.commands.push(step.command);
+    else groups.push({ as, commands: [step.command] });
+  }
+  return groups;
+}
+async function installTool(executor, name, onLog, requiredVersion) {
+  const startedAt = Date.now();
+  const recipe = toolchainCatalog.checks[name];
+  if (!recipe) {
+    return { tool: name, success: false, error: `Unknown tool: ${name}` };
+  }
+  if (recipe.providedBy && !toolchainCatalog.installs[name]) {
+    const status = await checkTool(executor, name, {
+      minVersion: requiredVersion
+    });
+    if (status.healthy) {
+      return { tool: name, success: true, version: status.version };
+    }
+    return {
+      tool: name,
+      success: false,
+      error: `${recipe.label} should be installed by ${recipe.providedBy}`
+    };
+  }
+  const factory = toolchainCatalog.installs[name];
+  if (!factory) {
+    return { tool: name, success: false, error: `No installer for ${name}` };
+  }
+  const profile = await resolveEnvironment(executor);
+  const plan = factory(profile);
+  if (!plan.supported) {
+    onLog?.({
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      message: `Cannot install ${recipe.label} on ${envOps(profile).describe()}: ${plan.reason}`,
+      level: "error"
+    });
+    return { tool: name, success: false, error: plan.reason };
+  }
+  const groups = groupStepsByAuthority(
+    plan.value.steps,
+    envOps(profile).installsNeedRoot()
+  );
+  let elevated = null;
+  if (groups.some((group) => group.as === "root")) {
+    const grant = await privilegedExecutor(
+      executor,
+      `Installing ${recipe.label}`
+    );
+    if (!grant.supported) {
+      onLog?.({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        message: grant.reason,
+        level: "error"
+      });
+      return { tool: name, success: false, error: grant.reason };
+    }
+    elevated = grant.value.executor;
+  }
+  systemDebug("toolchain", `install:start ${name}`);
+  onLog?.({
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    message: `Installing ${recipe.label}...`,
+    level: "info"
+  });
+  try {
+    for (const group of groups) {
+      const runner = group.as === "root" ? elevated : executor;
+      const { code } = await runner.streamExec(
+        opScript(group.commands),
+        (entry) => {
+          onLog?.(entry);
+        }
+      );
+      if (code !== 0) {
+        throw new Error(`Install command failed with exit code ${code}`);
+      }
+    }
+    const verifyResult = await executor.exec(plan.value.verifyCommand, { timeout: 1e4 }).catch(() => null);
+    if (!verifyResult) {
+      throw new Error(`${recipe.label} installed but verification failed`);
+    }
+    const version = recipe.parseVersion(verifyResult);
+    if (requiredVersion && !meetsMinVersion(version, requiredVersion)) {
+      throw new Error(
+        `${recipe.label} ${version} was installed but this project needs ${requiredVersion} or newer, and this host has no newer package. Use a newer OS release, or build in a container.`
+      );
+    }
+    systemDebug(
+      "toolchain",
+      `install:done ${name} v${version} (${formatDuration(startedAt)})`
+    );
+    onLog?.({
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      message: `${recipe.label} ${version} installed successfully`,
+      level: "info"
+    });
+    return { tool: name, success: true, version };
+  } catch (err) {
+    const msg = safeErrorMessage(err);
+    systemDebug(
+      "toolchain",
+      `install:fail ${name} (${formatDuration(startedAt)}) ${msg}`
+    );
+    onLog?.({
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      message: `Failed to install ${recipe.label}: ${msg}`,
+      level: "error"
+    });
+    return { tool: name, success: false, error: msg };
+  }
+}
+async function installTools(executor, toolNames, onLog, requiredVersions) {
+  const sorted = [...toolNames].sort((a, b) => {
+    const aEntry = toolchainCatalog.checks[a];
+    const bEntry = toolchainCatalog.checks[b];
+    if (aEntry?.providedBy === b) return 1;
+    if (bEntry?.providedBy === a) return -1;
+    if (aEntry?.installable && !bEntry?.installable) return -1;
+    if (!aEntry?.installable && bEntry?.installable) return 1;
+    return 0;
+  });
+  const results = [];
+  for (const name of sorted) {
+    const status = await checkTool(executor, name, {
+      minVersion: requiredVersions?.[name]
+    });
+    if (status.healthy) {
+      onLog?.({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        message: `${status.label} ${status.version ?? ""} already installed, skipping`,
+        level: "info"
+      });
+      results.push({ tool: name, success: true, version: status.version });
+      continue;
+    }
+    const result = await installTool(
+      executor,
+      name,
+      onLog,
+      requiredVersions?.[name]
+    );
+    results.push(result);
+  }
+  return results;
+}
+
+// ../../packages/adapters/src/runtime/local-build.ts
+var LOCAL_BUILD_DIR = "/tmp/kraft/.builds";
+async function runLocalBuild(opts) {
+  const { config, logger, abort } = opts;
+  const localExec = new LocalExecutor();
+  const buildDir = `${LOCAL_BUILD_DIR}/${config.sessionId}`;
+  await localExec.rm(buildDir);
+  await localExec.mkdir(buildDir);
+  const buildEnv = {
+    projectDir: buildDir,
+    exec: async (command, logCb) => {
+      if (abort?.aborted) throw new Error("Build cancelled");
+      const { code, output } = await localExec.streamExec(
+        wrapLocalBuildCommand(command),
+        logCb
+      );
+      if (abort?.aborted) throw new Error("Build cancelled");
+      if (code !== 0) {
+        const hint = detectBuildKillHint(output);
+        throw new Error(
+          `Command failed with exit code ${code}${hint ? ` - ${hint}` : ""}`
+        );
+      }
+    },
+    preflight: async (cfg, plog) => {
+      if (abort?.aborted) throw new Error("Build cancelled");
+      if (opts.preflight) {
+        await opts.preflight(cfg, plog, localExec);
+      }
+      if (cfg.localPath) {
+        await transferLocalDirectory(
+          cfg.localPath,
+          {
+            kind: "executor",
+            executor: localExec,
+            path: buildDir
+          },
+          plog
+        );
+      }
+    }
+  };
+  try {
+    const result = await runBuildPipeline(buildEnv, config, logger);
+    if (result.status === "deploying") {
+      await opts.transferOutput(buildDir);
+    }
+    return result;
+  } finally {
+    await localExec.rm(buildDir).catch(() => {
+    });
+    await localExec.dispose();
+  }
+}
+
+// ../../packages/adapters/src/runtime/stack-output.ts
+import { join as join2, posix as pathPosix } from "path";
+
+// ../../packages/adapters/src/runtime/nextjs-standalone.ts
+import { cp, stat } from "fs/promises";
+import { join } from "path";
+async function exists(p) {
+  try {
+    await stat(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function prepareNextStandalone(projectDir) {
+  const bundleDir = join(projectDir, ".next", "standalone");
+  if (!await exists(join(bundleDir, "server.js"))) return null;
+  const staticSrc = join(projectDir, ".next", "static");
+  if (await exists(staticSrc)) {
+    await cp(staticSrc, join(bundleDir, ".next", "static"), {
+      recursive: true
+    });
+  }
+  const publicSrc = join(projectDir, "public");
+  if (await exists(publicSrc)) {
+    await cp(publicSrc, join(bundleDir, "public"), { recursive: true });
+  }
+  return { bundleDir, startCommand: "node server.js" };
+}
+
+// ../../packages/adapters/src/runtime/stack-output.ts
+var STACK_OUTPUT_PREPARERS = {
+  nextjs: prepareNextStandalone
+};
+async function prepareStackOutput(stack, projectDir) {
+  const prepare = STACK_OUTPUT_PREPARERS[stack];
+  return prepare ? prepare(projectDir) : null;
+}
+function resolveProjectDir(buildDir, rootDirectory) {
+  const normalized = rootDirectory?.trim().replace(/^\/+|\/+$/g, "");
+  return normalized ? join2(buildDir, normalized) : buildDir;
+}
+function resolveStaticOutputPath(base, outputDirectory) {
+  const normalizedBase = base.replace(/\/+$/, "");
+  if (!outputDirectory || outputDirectory === ".") {
+    return normalizedBase;
+  }
+  if (outputDirectory.startsWith("/")) {
+    throw new Error(
+      `Invalid outputDirectory "${outputDirectory}": must be relative to the project (absolute paths are not allowed).`
+    );
+  }
+  const resolved = pathPosix.normalize(
+    pathPosix.join(normalizedBase, outputDirectory)
+  );
+  if (resolved !== normalizedBase && !resolved.startsWith(`${normalizedBase}/`)) {
+    throw new Error(
+      `Invalid outputDirectory "${outputDirectory}": escapes the deployment directory.`
+    );
+  }
+  return resolved;
+}
+
+// ../../packages/adapters/src/runtime/supervisor/usage.ts
+var SAMPLE_MS = 250;
+var ZERO_USAGE = {
+  cpuPercent: 0,
+  memoryMb: 0,
+  diskMb: 0,
+  networkRxBytes: 0,
+  networkTxBytes: 0
+};
+function buildProbe(pid, cgroupCandidates) {
+  const p = sq(String(pid));
+  const cgList = cgroupCandidates.map(sq).join(" ");
+  return [
+    `P=${p}`,
+    // Locate a readable cgroup v2 dir for this unit, if any.
+    `CG=""`,
+    `for c in ${cgList}; do if [ -r "$c/cpu.stat" ]; then CG="$c"; break; fi; done`,
+    // ── cgroup v2 ──
+    `if [ -n "$CG" ]; then`,
+    `  C1=$(awk '/^usage_usec/{print $2}' "$CG/cpu.stat" 2>/dev/null)`,
+    `  sleep ${(SAMPLE_MS / 1e3).toFixed(3)}`,
+    `  C2=$(awk '/^usage_usec/{print $2}' "$CG/cpu.stat" 2>/dev/null)`,
+    `  M=$(cat "$CG/memory.current" 2>/dev/null)`,
+    // io.stat is "<maj:min> rbytes=N wbytes=N rios=N wios=N" per device — summed
+    // across devices. Read and write are kept apart so the parser adds each once.
+    `  R=$(awk '{for(i=1;i<=NF;i++){split($i,kv,"=");if(kv[1]=="rbytes")r+=kv[2]}}END{print r+0}' "$CG/io.stat" 2>/dev/null)`,
+    `  W=$(awk '{for(i=1;i<=NF;i++){split($i,kv,"=");if(kv[1]=="wbytes")w+=kv[2]}}END{print w+0}' "$CG/io.stat" 2>/dev/null)`,
+    `  echo "cgroup \${C1:-0} \${C2:-0} \${M:-0} \${R:-0} \${W:-0}"`,
+    // ── /proc/<pid> ──
+    `elif [ -r "/proc/$P/stat" ]; then`,
+    // utime (14) + stime (15) in clock ticks. comm can contain spaces, so cut
+    // everything up to the closing paren before counting fields.
+    `  T=$(getconf CLK_TCK 2>/dev/null || echo 100)`,
+    `  C1=$(sed 's/.*) //' "/proc/$P/stat" 2>/dev/null | awk -v t="$T" '{print int((($12+$13)/t)*1000000)}')`,
+    `  sleep ${(SAMPLE_MS / 1e3).toFixed(3)}`,
+    `  C2=$(sed 's/.*) //' "/proc/$P/stat" 2>/dev/null | awk -v t="$T" '{print int((($12+$13)/t)*1000000)}')`,
+    `  M=$(awk '/^VmRSS:/{print $2*1024}' "/proc/$P/status" 2>/dev/null)`,
+    `  R=$(awk '/^read_bytes:/{print $2}' "/proc/$P/io" 2>/dev/null)`,
+    `  W=$(awk '/^write_bytes:/{print $2}' "/proc/$P/io" 2>/dev/null)`,
+    `  echo "proc \${C1:-0} \${C2:-0} \${M:-0} \${R:-0} \${W:-0}"`,
+    // ── ps (macOS / no procfs) ──
+    `else`,
+    // ps %cpu is a LIFETIME average, not a rate — reported as-is and flagged by the
+    // `ps` source so the parser doesn't pretend it's an instantaneous sample.
+    `  X=$(ps -o rss=,%cpu= -p "$P" 2>/dev/null | awk '{print ($1*1024)" "$2}')`,
+    `  echo "ps \${X:-0 0}"`,
+    `fi`
+  ].join("; ");
+}
+function parseProbe(out) {
+  const parts = out.trim().split(/\s+/);
+  const source = parts[0];
+  const n = (i) => {
+    const v = Number(parts[i]);
+    return Number.isFinite(v) && v >= 0 ? v : 0;
+  };
+  let cpuPercent;
+  let memoryMb;
+  let diskMb = 0;
+  if (source === "ps") {
+    if (parts.length < 3) return { ...ZERO_USAGE, source: "none" };
+    memoryMb = n(1) / (1024 * 1024);
+    cpuPercent = n(2);
+  } else if (source === "cgroup" || source === "proc") {
+    if (parts.length < 6) return { ...ZERO_USAGE, source: "none" };
+    const deltaUsec = Math.max(0, n(2) - n(1));
+    cpuPercent = deltaUsec / (SAMPLE_MS * 1e3) * 100;
+    memoryMb = n(3) / (1024 * 1024);
+    diskMb = (n(4) + n(5)) / (1024 * 1024);
+  } else {
+    return { ...ZERO_USAGE, source: "none" };
+  }
+  return {
+    cpuPercent: Math.round(cpuPercent * 100) / 100,
+    memoryMb: Math.round(memoryMb * 100) / 100,
+    diskMb: Math.round(diskMb * 100) / 100,
+    // Per-process network accounting needs eBPF or a per-unit netns, neither of
+    // which a bare deploy has. Zero here means "not measured", and the dashboard
+    // shows network only for container runtimes.
+    networkRxBytes: 0,
+    networkTxBytes: 0,
+    source
+  };
+}
+async function sampleBareUsage(executor, pid, cgroupCandidates = []) {
+  if (!Number.isInteger(pid) || pid <= 0) return { ...ZERO_USAGE };
+  try {
+    const out = await executor.exec(buildProbe(pid, cgroupCandidates));
+    const { source: _source, ...usage } = parseProbe(out);
+    return usage;
+  } catch {
+    return { ...ZERO_USAGE };
+  }
+}
+
+// ../../packages/adapters/src/runtime/supervisor/systemd.ts
+function escapeSystemdEnvValue(value) {
+  return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/%/g, "%%").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t");
+}
+var SystemdSupervisor = class {
+  constructor(executor, workDir) {
+    this.executor = executor;
+    this.workDir = workDir;
+  }
+  name = "systemd";
+  // ── Helpers ──────────────────────────────────────────────────────────
+  unitName(deploymentId) {
+    return managedDeploymentUnitName(deploymentId);
+  }
+  unitPath(deploymentId) {
+    return `/etc/systemd/system/${this.unitName(deploymentId)}`;
+  }
+  artifactFile(id) {
+    return `${this.workDir}/.artifacts/${id}.path`;
+  }
+  async writeArtifactPath(id, path) {
+    await this.executor.mkdir(`${this.workDir}/.artifacts`);
+    await this.executor.writeFile(this.artifactFile(id), path);
+  }
+  async readArtifactPath(id) {
+    try {
+      const content = await this.executor.readFile(this.artifactFile(id));
+      return content.trim() || null;
+    } catch {
+      return null;
+    }
+  }
+  async removeArtifactPath(id) {
+    await this.executor.rm(this.artifactFile(id));
+  }
+  /**
+   * Build a systemd unit file contents string.
+   *
+   * Uses Type=exec so systemd tracks the actual process (not the shell wrapper).
+   * Environment vars are set via Environment= directives (one per line), which
+   * avoids any SHELL quoting issues - but systemd does its own parsing, so each
+   * assignment is double-quoted and escaped (see escapeSystemdEnvValue).
+   */
+  buildUnitFile(opts) {
+    const envLines = Object.entries(opts.env).filter(([key]) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(key)).map(([k, v]) => `Environment="${k}=${escapeSystemdEnvValue(v)}"`).join("\n");
+    return `[Unit]
+Description=Kraft deployment ${opts.deploymentId}
+After=network.target
+
+[Service]
+Type=exec
+WorkingDirectory=${opts.workDir}
+ExecStart=/bin/sh -lc ${sq(opts.startCommand)}
+${envLines}
+Restart=on-failure
+RestartSec=3
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=${this.unitName(opts.deploymentId).replace(/\.service$/, "")}
+
+[Install]
+WantedBy=multi-user.target
+`;
+  }
+  // ── Lifecycle ────────────────────────────────────────────────────────
+  async deploy(opts) {
+    const unitContent = this.buildUnitFile(opts);
+    const unitPath = this.unitPath(opts.deploymentId);
+    const unitName = this.unitName(opts.deploymentId);
+    await this.executor.writeFile(unitPath, unitContent);
+    await this.executor.exec("systemctl daemon-reload");
+    await execReliable(
+      this.executor,
+      `deploy:${opts.deploymentId}:activate`,
+      `systemctl enable --now ${sq(unitName)}`
+    );
+    await this.writeArtifactPath(opts.deploymentId, opts.workDir);
+    await new Promise((r) => setTimeout(r, 1500));
+    if (!await this.isRunning(opts.deploymentId)) {
+      let hint = "";
+      try {
+        const tail = await this.executor.exec(
+          `journalctl -u ${sq(unitName)} -n 10 --no-pager 2>/dev/null`
+        );
+        hint = tail.trim();
+      } catch {
+      }
+      if (hint.includes("EADDRINUSE")) {
+        const occupant = await probeListeningPort(this.executor, opts.port);
+        throw new DeployError(
+          `Port ${opts.port} is already in use` + (occupant ? ` by ${occupant.command}` : "") + ". Stop the existing process before deploying.",
+          "PORT_IN_USE",
+          portOccupantDetails(opts.port, occupant)
+        );
+      }
+      const msg = hint ? `Process exited immediately after start. Last output:
+${hint}` : "Process exited immediately after start (no output captured)";
+      throw new Error(msg);
+    }
+  }
+  async stop(deploymentId) {
+    const unitName = this.unitName(deploymentId);
+    try {
+      await this.executor.exec(
+        `systemctl stop ${sq(unitName)} 2>/dev/null || true`
+      );
+    } catch {
+    }
+  }
+  async start(deploymentId) {
+    const unitName = this.unitName(deploymentId);
+    await this.executor.exec(`systemctl start ${sq(unitName)}`);
+  }
+  async restart(deploymentId) {
+    const unitName = this.unitName(deploymentId);
+    await this.executor.exec(`systemctl restart ${sq(unitName)}`);
+  }
+  async destroy(deploymentId) {
+    const unitName = this.unitName(deploymentId);
+    const unitPath = this.unitPath(deploymentId);
+    await this.executor.exec(
+      `systemctl disable --now ${sq(unitName)} 2>/dev/null || true`
+    );
+    await this.executor.rm(unitPath);
+    await this.executor.exec("systemctl daemon-reload");
+    const artifactPath = await this.readArtifactPath(deploymentId);
+    if (artifactPath) {
+      await this.executor.rm(artifactPath);
+    }
+    await this.removeArtifactPath(deploymentId);
+  }
+  async isRunning(deploymentId) {
+    const unitName = this.unitName(deploymentId);
+    try {
+      const result = await this.executor.exec(
+        `systemctl is-active ${sq(unitName)} 2>/dev/null || true`
+      );
+      return result.trim() === "active";
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Usage for the unit. Prefers the unit's cgroup, which accounts for the whole
+   * process tree — a `npm start` that forks the real server would otherwise report
+   * only the wrapper's near-zero usage.
+   *
+   * `MainPID` is fetched as the fallback identity (and as the liveness check) for a
+   * host without a readable cgroup; the probe picks the tier itself. `--value` is
+   * used so a stopped unit yields "0" rather than a `MainPID=0` line to parse.
+   */
+  async getUsage(deploymentId) {
+    const unitName = this.unitName(deploymentId);
+    try {
+      const out = await this.executor.exec(
+        `systemctl show ${sq(unitName)} -p MainPID --value 2>/dev/null || true`
+      );
+      const pid = Number.parseInt(out.trim(), 10);
+      if (!Number.isFinite(pid) || pid <= 0) return { ...ZERO_USAGE };
+      return sampleBareUsage(this.executor, pid, [
+        // Where systemd places a unit started from /etc/systemd/system. The delegate
+        // path appears when the unit sets Delegate=yes; harmless to probe either way.
+        `/sys/fs/cgroup/system.slice/${unitName}`,
+        `/sys/fs/cgroup/system.slice/${unitName}/init.scope`
+      ]);
+    } catch {
+      return { ...ZERO_USAGE };
+    }
+  }
+  async getLogs(deploymentId, tail) {
+    const unitName = this.unitName(deploymentId);
+    const tailArg = tail ? `-n ${tail}` : `-n 200`;
+    try {
+      const output = await this.executor.exec(
+        `journalctl -u ${sq(unitName)} ${tailArg} --no-pager -o short-iso 2>/dev/null`
+      );
+      return output.split("\n").filter(Boolean).map((line) => {
+        const match = line.match(/^(\S+)\s+\S+\s+\S+\s+(.*)/);
+        return {
+          timestamp: match?.[1] ?? (/* @__PURE__ */ new Date()).toISOString(),
+          message: match?.[2] ?? line,
+          level: parseLogLevel(line)
+        };
+      });
+    } catch {
+      return [];
+    }
+  }
+  async streamLogs(deploymentId, onLog, opts) {
+    const unitName = this.unitName(deploymentId);
+    const tailN = opts?.tail ?? 100;
+    let stopped = false;
+    const promise = this.executor.streamExec(
+      `journalctl -u ${sq(unitName)} -n ${tailN} -f --no-pager -o short-iso 2>/dev/null`,
+      (entry) => {
+        if (stopped) return;
+        const match = entry.message.match(/^(\S+)\s+\S+\s+\S+\s+(.*)/);
+        const cleaned = match ? { ...entry, timestamp: match[1], message: match[2] + "\r\n" } : { ...entry, message: entry.message + "\r\n" };
+        onLog(cleaned);
+      }
+    );
+    promise.catch(() => {
+    });
+    return () => {
+      stopped = true;
+      this.executor.exec(`pkill -f ${sq(`journalctl.*${unitName}`)} 2>/dev/null || true`).catch(() => {
+      });
+    };
+  }
+};
+
+// ../../packages/adapters/src/runtime/supervisor/nohup.ts
+var NohupSupervisor = class {
+  constructor(executor, workDir) {
+    this.executor = executor;
+    this.workDir = workDir;
+  }
+  name = "nohup";
+  // ── Path helpers ─────────────────────────────────────────────────────
+  pidFile(id) {
+    return `${this.workDir}/.pids/${id}.pid`;
+  }
+  logFile(id) {
+    return `${this.workDir}/.logs/${id}.log`;
+  }
+  artifactFile(id) {
+    return `${this.workDir}/.artifacts/${id}.path`;
+  }
+  // ── PID helpers ──────────────────────────────────────────────────────
+  async readPid(id) {
+    try {
+      const content = await this.executor.readFile(this.pidFile(id));
+      const pid = parseInt(content.trim(), 10);
+      return isNaN(pid) ? null : pid;
+    } catch {
+      return null;
+    }
+  }
+  async writePid(id, pid) {
+    await this.executor.mkdir(`${this.workDir}/.pids`);
+    await this.executor.writeFile(this.pidFile(id), String(pid));
+  }
+  async removePid(id) {
+    await this.executor.rm(this.pidFile(id));
+  }
+  async isAlive(pid) {
+    try {
+      await this.executor.exec(`kill -0 ${pid} 2>/dev/null`);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  // ── Artifact path tracking ───────────────────────────────────────────
+  async readArtifactPath(id) {
+    try {
+      const content = await this.executor.readFile(this.artifactFile(id));
+      return content.trim() || null;
+    } catch {
+      return null;
+    }
+  }
+  async writeArtifactPath(id, path) {
+    await this.executor.mkdir(`${this.workDir}/.artifacts`);
+    await this.executor.writeFile(this.artifactFile(id), path);
+  }
+  async removeArtifactPath(id) {
+    await this.executor.rm(this.artifactFile(id));
+  }
+  // ── Lifecycle ────────────────────────────────────────────────────────
+  async deploy(opts) {
+    await this.executor.mkdir(`${this.workDir}/.logs`);
+    const envExports = Object.entries(opts.env).filter(([key]) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(key)).map(([k, v]) => `export ${k}=${sq(v)}`).join("; ");
+    const logPath = this.logFile(opts.deploymentId);
+    const shellBody = envExports ? `${envExports}; cd ${opts.workDir} && ${opts.startCommand}` : `cd ${opts.workDir} && ${opts.startCommand}`;
+    const runner = `nohup sh -lc ${sq(shellBody)} >> ${sq(logPath)} 2>&1 < /dev/null`;
+    const hasSetsid = await this.executor.exec(
+      "command -v setsid >/dev/null 2>&1 && echo y || echo n"
+    );
+    const detach = hasSetsid.trim() === "y" ? `setsid ${runner}` : runner;
+    const spawnCmd = `{ ${detach} & echo $!; }`;
+    const pidStr = await execReliable(
+      this.executor,
+      `deploy:${opts.deploymentId}:spawn`,
+      spawnCmd
+    );
+    const pid = parseInt(pidStr.trim(), 10);
+    if (isNaN(pid) || pid <= 0) {
+      throw new Error("Deploy failed: could not capture process ID");
+    }
+    await this.writePid(opts.deploymentId, pid);
+    await this.writeArtifactPath(opts.deploymentId, opts.workDir);
+    await new Promise((r) => setTimeout(r, 1500));
+    if (!await this.isAlive(pid)) {
+      let hint = "";
+      try {
+        const tail = await this.executor.exec(`tail -n 10 ${sq(logPath)}`);
+        hint = tail.trim();
+      } catch {
+      }
+      if (hint.includes("EADDRINUSE")) {
+        const occupant = await probeListeningPort(this.executor, opts.port);
+        throw new DeployError(
+          `Port ${opts.port} is already in use` + (occupant ? ` by ${occupant.command}` : "") + ". Stop the existing process before deploying.",
+          "PORT_IN_USE",
+          portOccupantDetails(opts.port, occupant)
+        );
+      }
+      const msg = hint ? `Process exited immediately after spawn. Last output:
+${hint}` : "Process exited immediately after spawn (no output captured)";
+      throw new Error(msg);
+    }
+  }
+  async stop(deploymentId) {
+    const pid = await this.readPid(deploymentId);
+    if (!pid) return;
+    if (await this.isAlive(pid)) {
+      await this.executor.exec(
+        `kill -- -${pid} 2>/dev/null || kill ${pid} 2>/dev/null || true`
+      );
+      const deadline = Date.now() + 1e4;
+      while (Date.now() < deadline && await this.isAlive(pid)) {
+        await new Promise((r) => setTimeout(r, 500));
+      }
+      if (await this.isAlive(pid)) {
+        await this.executor.exec(
+          `kill -9 -- -${pid} 2>/dev/null || kill -9 ${pid} 2>/dev/null || true`
+        );
+      }
+    }
+  }
+  async start(_deploymentId) {
+    throw new Error(
+      "Nohup processes cannot be started after stopping. Trigger a new deployment."
+    );
+  }
+  async restart(deploymentId) {
+    await this.stop(deploymentId);
+  }
+  async destroy(deploymentId) {
+    await this.stop(deploymentId);
+    await this.removePid(deploymentId);
+    await this.executor.rm(this.logFile(deploymentId));
+    const artifactPath = await this.readArtifactPath(deploymentId);
+    if (artifactPath) {
+      await this.executor.rm(artifactPath);
+    }
+    await this.removeArtifactPath(deploymentId);
+  }
+  async isRunning(deploymentId) {
+    const pid = await this.readPid(deploymentId);
+    if (!pid) return false;
+    return this.isAlive(pid);
+  }
+  /**
+   * Usage for the tracked process.
+   *
+   * No cgroup candidates: nohup does not create one (that's the documented
+   * limitation above), so the probe uses /proc on Linux and `ps` on macOS. Both
+   * measure the LEADER only — a start command that forks will under-report, which
+   * is the same tradeoff as this supervisor's lack of restart and reboot handling.
+   */
+  async getUsage(deploymentId) {
+    const pid = await this.readPid(deploymentId);
+    if (!pid) return { ...ZERO_USAGE };
+    return sampleBareUsage(this.executor, pid);
+  }
+  async getLogs(deploymentId, tail) {
+    const logPath = this.logFile(deploymentId);
+    try {
+      const lines = tail ? await this.executor.exec(`tail -n ${tail} ${sq(logPath)}`) : await this.executor.readFile(logPath);
+      return lines.split("\n").filter(Boolean).map((line) => ({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        message: line,
+        level: parseLogLevel(line)
+      }));
+    } catch {
+      return [];
+    }
+  }
+  async streamLogs(deploymentId, onLog, opts) {
+    const logPath = this.logFile(deploymentId);
+    const tailN = opts?.tail ?? 100;
+    let stopped = false;
+    if (!await this.executor.exists(logPath).catch(() => true)) {
+      onLog({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        message: "No supervisor log for this deployment \u2014 the process is supervised elsewhere (container logs, or `kraft logs` on the host). Streaming anyway in case it starts writing.\r\n",
+        level: "info"
+      });
+    }
+    const promise = this.executor.streamExec(
+      `mkdir -p ${sq(`${this.workDir}/.logs`)} 2>/dev/null; touch ${sq(logPath)} 2>/dev/null; tail -n ${tailN} -F ${sq(logPath)} 2>/dev/null`,
+      (entry) => {
+        if (!stopped) onLog({ ...entry, message: entry.message + "\r\n" });
+      }
+    );
+    promise.catch(() => {
+    });
+    return () => {
+      stopped = true;
+      this.executor.exec(`pkill -f ${sq(`tail.*${logPath}`)} 2>/dev/null || true`).catch(() => {
+      });
+    };
+  }
+};
+
+// ../../packages/adapters/src/runtime/supervisor/detect.ts
+async function detectSupervisor(executor, workDir) {
+  const profile = await resolveEnvironment(executor).catch((err) => {
+    systemDebug(
+      "supervisor",
+      `detect: host unreachable, using nohup \u2014 ${safeErrorMessage(err)}`
+    );
+    return null;
+  });
+  if (profile?.serviceManager === "systemd")
+    return new SystemdSupervisor(executor, workDir);
+  const unmeasured = profile?.probeError ?? (profile?.supported === false ? profile.unsupportedReason : null);
+  if (unmeasured) {
+    console.warn(
+      `[supervisor] could not confirm this host's init system, so the service will run under nohup and will NOT restart after a reboot: ${unmeasured}`
+    );
+  }
+  return new NohupSupervisor(executor, workDir);
+}
+
+// ../../packages/adapters/src/runtime/bare.ts
+function parentPath(path) {
+  const idx = path.replace(/\/+$/, "").lastIndexOf("/");
+  return idx > 0 ? path.slice(0, idx) : "/";
+}
+var DEFAULT_WORK_DIR = "/opt/kraft";
+var DEFAULT_BUILD_TIMEOUT = 10 * 60 * 1e3;
+var STATIC_RELEASE_BASE = "/opt/kraft/static";
+var BareRuntime = class {
+  name = "bare";
+  capabilities = /* @__PURE__ */ new Set([
+    "build",
+    "deploy",
+    "stop",
+    "start",
+    "restart",
+    "destroy",
+    "runtimeLogs",
+    "streamLogs",
+    // Real measurements now (cgroup → /proc → ps, via the supervisor), so this can
+    // finally be declared. It was absent while getUsage returned a zeros stub — but
+    // nothing checked, so callers rendered those zeros as data. Anything reading
+    // usage should gate on supports("usage") rather than trust the numbers.
+    // Network is the one gap: per-process rx/tx needs eBPF or a netns, so it stays 0.
+    "usage",
+    "containerIp",
+    "rollback",
+    // The release dir + supervisor unit survive a redeploy, so restoring a
+    // past release really is an in-place unit swap (see makeActive).
+    "unitRestore",
+    "inContainerExec"
+  ]);
+  workDir;
+  buildTimeout;
+  executor;
+  systemManager;
+  /** True if we created the executor ourselves (must dispose on cleanup) */
+  ownsExecutor;
+  /** Track active builds by sessionId for cancellation */
+  activeBuilds = /* @__PURE__ */ new Map();
+  /** Process lifecycle delegate - resolved lazily on first deploy/stop/etc. */
+  _supervisor = null;
+  _supervisorPromise = null;
+  constructor(opts) {
+    this.workDir = opts?.workDir ?? DEFAULT_WORK_DIR;
+    this.buildTimeout = opts?.buildTimeout ?? DEFAULT_BUILD_TIMEOUT;
+    if (opts?.executor) {
+      this.executor = opts.executor;
+      this.ownsExecutor = false;
+    } else {
+      this.executor = new LocalExecutor();
+      this.ownsExecutor = true;
+    }
+    this.systemManager = opts?.systemManager ?? null;
+  }
+  /** The underlying command executor (local or SSH). Exposed so the
+   *  backup subsystem's bare executor can stream commands over the same
+   *  connection (mirrors how DockerRuntime exposes its client). */
+  get commandExecutor() {
+    return this.executor;
+  }
+  /** A bare deployment is a host process, so "inside the instance" == the host.
+   *  The host executor already sees the process's listeners (shared netns). */
+  async inContainerExecutor() {
+    return this.executor;
+  }
+  /**
+   * Resolve a retained application release for an env-only refresh.
+   * Deployment ids originate in our database, but reject path-shaped input at
+   * this boundary so an imported/corrupt row cannot escape releases/.
+   */
+  async retainedReleaseArtifact(deploymentId) {
+    if (!deploymentId || deploymentId.includes("/") || deploymentId.includes("\\"))
+      return null;
+    const path = this.releaseDir(deploymentId);
+    return await this.executor.exists(path).catch(() => false) ? path : null;
+  }
+  /** Get or lazily initialise the process supervisor. */
+  async supervisor() {
+    if (this._supervisor) return this._supervisor;
+    if (!this._supervisorPromise) {
+      this._supervisorPromise = detectSupervisor(
+        this.executor,
+        this.workDir
+      ).then((s) => {
+        this._supervisor = s;
+        return s;
+      });
+    }
+    return this._supervisorPromise;
+  }
+  supports(cap) {
+    return this.capabilities.has(cap);
+  }
+  async dispose() {
+    if (this.ownsExecutor) {
+      await this.executor.dispose();
+    }
+  }
+  // ─── Path helpers ────────────────────────────────────────────────────
+  projectDir(projectId) {
+    return `${this.workDir}/${projectId}`;
+  }
+  buildDir(sessionId) {
+    return `${this.workDir}/.builds/${sessionId}`;
+  }
+  releaseDir(deploymentId) {
+    return `${this.workDir}/releases/${deploymentId}`;
+  }
+  /** Per-project directory holding the paths that must survive a release swap.
+   *  The `shared/` half of the Capistrano layout `releases/` already implements. */
+  sharedDir(projectId) {
+    return `${this.workDir}/shared/${projectId}`;
+  }
+  /**
+   * Repoint the release's persistent paths at `shared/`, so a redeploy doesn't
+   * take the app's data with the old release.
+   *
+   * Docker gets this from a volume; bare has no mount to hang it on, so the
+   * equivalent is the deploy convention: keep the state outside the release tree
+   * and symlink it in. The first release that ships the path SEEDS the shared
+   * copy from it — frameworks ship a skeleton there (Laravel's `storage/` has
+   * `framework/cache`, `framework/sessions`, …) and an app handed an empty
+   * directory instead would fail on write.
+   *
+   * Best-effort per path: a box without the shared dir writable is a storage
+   * problem to report, not a reason to fail an otherwise good release.
+   */
+  async linkPersistentPaths(releaseDir, projectId, volumes, log) {
+    const targets = appVolumeTargets(volumes ?? []);
+    if (targets.length === 0) return;
+    const shared = this.sharedDir(projectId);
+    for (const relative of targets) {
+      const sharedPath = `${shared}/${relative}`;
+      const releasePath = `${releaseDir}/${relative}`;
+      try {
+        if (!await this.executor.exists(sharedPath)) {
+          await this.executor.mkdir(parentPath(sharedPath));
+          if (await this.executor.exists(releasePath)) {
+            await this.executor.exec(
+              `cp -a ${sq(releasePath)} ${sq(sharedPath)}`
+            );
+          } else {
+            await this.executor.mkdir(sharedPath);
+          }
+        }
+        await this.executor.rm(releasePath);
+        await this.executor.mkdir(parentPath(releasePath));
+        await this.executor.exec(
+          `ln -sfn ${sq(sharedPath)} ${sq(releasePath)}`
+        );
+        log?.({
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          message: `Persistent path ${relative} \u2192 ${sharedPath}
+`,
+          level: "info"
+        });
+      } catch (err) {
+        log?.({
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          message: `Could not persist ${relative}: ${safeErrorMessage(err)}
+`,
+          level: "warn"
+        });
+      }
+    }
+  }
+  async promoteBuildArtifact(artifactPath, deploymentId, previousDeploymentId) {
+    const releaseDir = this.releaseDir(deploymentId);
+    if (artifactPath === releaseDir) return releaseDir;
+    const consumeSource = !artifactPath.startsWith(`${this.workDir}/releases/`);
+    await ensureOwnedDir(this.executor, `${this.workDir}/releases`);
+    await this.executor.rm(releaseDir);
+    const previousReleaseDir = previousDeploymentId ? this.releaseDir(previousDeploymentId) : void 0;
+    if (previousReleaseDir && await this.executor.exists(previousReleaseDir)) {
+      try {
+        await execReliable(
+          this.executor,
+          `deploy:${deploymentId}:promote-rsync`,
+          `rsync -a --delete --link-dest=${sq(previousReleaseDir)} ${sq(artifactPath)}/ ${sq(releaseDir)}/`
+        );
+        if (consumeSource) await this.executor.rm(artifactPath).catch(() => {
+        });
+        return releaseDir;
+      } catch {
+        await this.executor.rm(releaseDir).catch(() => {
+        });
+      }
+    }
+    if (!consumeSource) {
+      await execReliable(
+        this.executor,
+        `deploy:${deploymentId}:promote-copy`,
+        `mkdir -p ${sq(releaseDir)} && cp -a ${sq(artifactPath)}/. ${sq(releaseDir)}/`
+      );
+      return releaseDir;
+    }
+    await execReliable(
+      this.executor,
+      `deploy:${deploymentId}:promote-mv`,
+      `mv ${sq(artifactPath)} ${sq(releaseDir)}`
+    );
+    return releaseDir;
+  }
+  // ── File transfer ──────────────────────────────────────────────────────
+  /**
+   * Transfer files from a local path on the API server into the build/deploy dir.
+   *
+   * Delegates entirely to the executor - LocalExecutor does cp,
+   * SshExecutor does tar+pipe. No branching here.
+   */
+  async transferFiles(localPath, remotePath, logger) {
+    await transferLocalDirectory(
+      localPath,
+      {
+        kind: "executor",
+        executor: this.executor,
+        path: remotePath
+      },
+      logger
+    );
+  }
+  // ── Build lifecycle ────────────────────────────────────────────────────
+  async build(config, logger) {
+    const log = logger ?? new BuildLogger();
+    const buildLocally = config.buildStrategy === "local" && !(this.executor instanceof LocalExecutor);
+    const abort = new AbortController();
+    this.activeBuilds.set(config.sessionId, abort);
+    try {
+      if (buildLocally) {
+        return await this.buildLocally(config, log, abort);
+      }
+      return await this.buildOnTarget(config, log, abort);
+    } finally {
+      this.activeBuilds.delete(config.sessionId);
+    }
+  }
+  /** Build on the API host, then transfer output to the target server. */
+  async buildLocally(config, log, abort) {
+    log.log("Build strategy: local (build on API host, transfer to server)\n");
+    const remoteDir = this.buildDir(config.sessionId);
+    const stackDef = STACKS[config.stack];
+    let standaloneStartCommand;
+    let result;
+    try {
+      result = await runLocalBuild({
+        config,
+        logger: log,
+        abort: abort.signal,
+        preflight: async (cfg, plog, localExec) => {
+          await this.ensureToolchain(localExec, cfg.stack, plog);
+          plog.log("Checking runtime tools on target server...\n");
+          await this.ensureToolchain(this.executor, cfg.stack, plog);
+          if (this.systemManager) {
+            plog.log("Ensuring rsync is installed on target server...\n");
+            await this.systemManager.ensureComponents(
+              ["rsync"],
+              (entry) => plog.callback(entry)
+            );
+          }
+        },
+        transferOutput: async (buildDir) => {
+          await this.executor.rm(remoteDir);
+          await this.executor.mkdir(remoteDir);
+          const selfContained = await prepareStackOutput(
+            config.stack,
+            resolveProjectDir(buildDir, config.rootDirectory)
+          );
+          if (selfContained) {
+            log.log(
+              "Detected self-contained build output \u2014 shipping the bundle (no install on target).\n"
+            );
+            await transferLocalDirectory(
+              selfContained.bundleDir,
+              { kind: "executor", executor: this.executor, path: remoteDir },
+              log,
+              { excludes: [] }
+              // ship everything, incl. traced node_modules
+            );
+            standaloneStartCommand = selfContained.startCommand;
+            return;
+          }
+          if (stackDef?.productionPaths?.length) {
+            log.log(
+              `Transferring production paths: ${stackDef.productionPaths.join(", ")}
+`
+            );
+            await transferLocalDirectory(
+              buildDir,
+              { kind: "executor", executor: this.executor, path: remoteDir },
+              log,
+              { includes: [...stackDef.productionPaths] }
+            );
+          } else {
+            await transferLocalDirectory(
+              buildDir,
+              { kind: "executor", executor: this.executor, path: remoteDir },
+              log,
+              {
+                excludes: buildOutputTransferExcludes(stackDef),
+                alsoInclude: stackDef?.outputDirectory ? [stackDef.outputDirectory] : void 0
+              }
+            );
+          }
+          const installCmd = config.installCommand?.trim();
+          if (installCmd) {
+            const pmEnsure = packageManagerEnsureCommand(config.packageManager);
+            const fullInstall = pmEnsure ? `${pmEnsure} && ${installCmd}` : installCmd;
+            log.log("Installing production dependencies on target...\n");
+            const { code } = await this.executor.streamExec(
+              `cd ${sq(remoteDir)} && ${fullInstall}`,
+              log.callback
+            );
+            if (code !== 0) {
+              throw new Error(
+                "Failed to install production dependencies on target"
+              );
+            }
+            log.log("Production dependencies installed.\n");
+          }
+        }
+      });
+    } catch (err) {
+      const msg = safeErrorMessage(err);
+      log.log(`Failed to transfer local build output: ${msg}`, "error");
+      return {
+        sessionId: config.sessionId,
+        status: "failed",
+        imageRef: remoteDir,
+        errorMessage: `Failed to transfer build output: ${msg}`
+      };
+    }
+    return {
+      sessionId: config.sessionId,
+      status: result.status,
+      imageRef: remoteDir,
+      durationMs: result.durationMs,
+      errorMessage: result.errorMessage,
+      startCommand: standaloneStartCommand
+    };
+  }
+  /** Build directly on the target machine via the executor. */
+  async buildOnTarget(config, log, abort) {
+    log.log("Build strategy: server (build on target)\n");
+    const dir = this.buildDir(config.sessionId);
+    await this.executor.rm(dir);
+    await this.executor.mkdir(dir);
+    const buildEnv = {
+      projectDir: dir,
+      exec: async (command, logCb) => {
+        if (abort.signal.aborted) throw new BuildCancelledError();
+        const effectiveCommand = this.executor instanceof LocalExecutor ? wrapLocalBuildCommand(command) : command;
+        const { code, output } = await this.executor.streamExec(
+          effectiveCommand,
+          logCb
+        );
+        if (abort.signal.aborted) throw new BuildCancelledError();
+        if (code !== 0) {
+          const hint = detectBuildKillHint(output);
+          throw new Error(
+            `Command failed with exit code ${code}${hint ? ` - ${hint}` : ""}`
+          );
+        }
+      },
+      preflight: async (cfg, plog) => {
+        if (abort.signal.aborted) throw new BuildCancelledError();
+        await this.ensureToolchain(this.executor, cfg.stack, plog);
+        if (cfg.localPath) {
+          await this.transferFiles(cfg.localPath, dir, plog);
+        }
+      },
+      // Out-of-band secret write (SSH key + known_hosts) — goes through the
+      // executor's file channel, never the streamed `exec`, so key bytes never
+      // reach the build log. Works for both local and SSH executors.
+      writeSecretFile: (p, content) => this.executor.writeFile(p, content)
+    };
+    const result = await runBuildPipeline(buildEnv, config, log);
+    return {
+      sessionId: config.sessionId,
+      status: result.status,
+      imageRef: dir,
+      durationMs: result.durationMs,
+      errorMessage: result.errorMessage
+    };
+  }
+  /**
+   * Check that the target executor has the required toolchain for a stack,
+   * and install any missing or outdated tools.
+   */
+  async ensureToolchain(executor, stack, plog) {
+    const toolcheck = await checkToolchainForStack(executor, stack);
+    if (toolcheck.ready) return;
+    const requiredTools = toolcheck.tools.filter((tool) => !tool.healthy);
+    plog.log("Installing build tools (one-time server setup)\u2026\n");
+    plog.log(`${requiredTools.map((tool) => tool.message).join("\n")}
+`);
+    const results = await installTools(
+      executor,
+      requiredTools.map((tool) => tool.name),
+      plog.callback,
+      Object.fromEntries(
+        requiredTools.filter((tool) => tool.requiredVersion).map((tool) => [tool.name, tool.requiredVersion])
+      )
+    );
+    const failed = results.filter((r) => !r.success);
+    if (failed.length > 0) {
+      throw new Error(
+        `Failed to install required tools: ${failed.map((f) => `${f.tool} (${f.error})`).join(", ")}`
+      );
+    }
+  }
+  async cancelBuild(sessionId) {
+    const abort = this.activeBuilds.get(sessionId);
+    if (abort) {
+      abort.abort();
+      this.activeBuilds.delete(sessionId);
+    }
+    await killProcessesUnderDir(this.executor, this.buildDir(sessionId));
+  }
+  async getBuildLogs(sessionId) {
+    void sessionId;
+    return [];
+  }
+  // ── Deploy lifecycle ───────────────────────────────────────────────────
+  async deploy(config, _onLog) {
+    if (config.adopt) {
+      const occupant = await probeListeningPort(this.executor, config.port);
+      _onLog?.({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        level: occupant ? "info" : "warn",
+        message: occupant ? `[adopt] attached to process on port ${config.port}: ${occupant.command}
+` : `[adopt] no process is listening on port ${config.port} yet \u2014 routing will attach when it comes up
+`
+      });
+      return {
+        deploymentId: config.deploymentId,
+        containerId: config.deploymentId,
+        status: "running"
+      };
+    }
+    const stagedDir = config.imageRef ?? this.projectDir(config.projectId);
+    const workDir = config.imageRef ? await this.promoteBuildArtifact(
+      stagedDir,
+      config.deploymentId,
+      config.previousDeploymentId
+    ) : stagedDir;
+    await this.linkPersistentPaths(
+      workDir,
+      config.projectId,
+      config.volumes,
+      _onLog
+    );
+    const sv = await this.supervisor();
+    const projectEnv = splitRuntimeEnv(
+      Object.fromEntries(
+        Object.entries(config.envVars ?? {}).map(([k, v]) => [k, String(v)])
+      )
+    );
+    if (projectEnv.dropped.length > 0) {
+      _onLog?.({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        level: "warn",
+        message: droppedRuntimeEnvMessage(projectEnv.dropped)
+      });
+    }
+    const env = {
+      ...Object.fromEntries(projectEnv.entries),
+      PORT: String(config.port),
+      NODE_ENV: config.environment === "production" ? "production" : "development"
+    };
+    const startBinPath = nodeBinPathExport(config.packageManager, [workDir]);
+    const resolvedStart = config.startCommand || "npm start";
+    try {
+      await sv.deploy({
+        deploymentId: config.deploymentId,
+        projectId: config.projectId,
+        workDir,
+        startCommand: startBinPath ? `${startBinPath} && ${resolvedStart}` : resolvedStart,
+        port: config.port,
+        env
+      });
+    } catch (err) {
+      if (workDir !== stagedDir) {
+        await sv.destroy(config.deploymentId).catch(() => {
+        });
+        await this.executor.rm(workDir).catch(() => {
+        });
+      }
+      throw err;
+    }
+    return {
+      deploymentId: config.deploymentId,
+      containerId: config.deploymentId,
+      status: "running"
+    };
+  }
+  async deployStatic(config) {
+    const workDir = await this.promoteStaticRelease({
+      artifactPath: config.imageRef ?? this.projectDir(config.projectId),
+      releaseId: config.deploymentId,
+      previousReleaseId: config.previousDeploymentId,
+      outputDirectory: config.outputDirectory,
+      promote: Boolean(config.imageRef)
+    });
+    return {
+      deploymentId: config.deploymentId,
+      containerId: workDir,
+      status: "running"
+    };
+  }
+  /**
+   * Promote an extracted static build into a stable release directory and PROVE it
+   * can serve, returning the release dir.
+   *
+   * Split out of `deployStatic` so the compose/monorepo static path reuses the
+   * identical promote + validation instead of registering a vhost straight at the
+   * `.builds/<session>` staging dir. Two things came from that shortcut: the
+   * public doc-root of a compose static sub-app was a per-build-session scratch
+   * directory (nothing owned its lifetime, so superseded copies accumulated and
+   * any sweep of `.builds` would take the live site down), and it skipped the only
+   * HARD deploy-time output gate we have — so an extract that produced nothing
+   * deployed green and 404'd.
+   *
+   * `releaseId` is the release's identity, not necessarily a deployment id: the
+   * compose path passes `<deploymentId>-<serviceId>` so each static sub-app owns
+   * its own release dir under one deployment.
+   */
+  async promoteStaticRelease(opts) {
+    const stagedDir = opts.artifactPath;
+    const workDir = opts.promote === false ? stagedDir : await this.promoteBuildArtifact(
+      stagedDir,
+      opts.releaseId,
+      opts.previousReleaseId
+    );
+    const staticRoot = resolveStaticOutputPath(workDir, opts.outputDirectory);
+    const abort = async (message) => {
+      if (workDir !== stagedDir) {
+        await this.executor.rm(workDir).catch(() => {
+        });
+      }
+      throw new Error(message);
+    };
+    if (!await this.executor.exists(staticRoot)) {
+      return abort(missingOutputDirectoryMessage(opts.outputDirectory));
+    }
+    if (staticRoot === workDir) {
+      const undeleted = await this.pruneBuildFilesFromDocRoot(staticRoot);
+      if (undeleted.length > 0) {
+        return abort(
+          `Refusing to publish ${staticRoot}: could not remove ${undeleted.join(", ")} from the document root. Serving them would expose the repository (and, for a private repo, the access token in .git/config) at the site's public URL.`
+        );
+      }
+    }
+    if (await this.isEmptyDir(staticRoot)) {
+      return abort(
+        `The output directory "${opts.outputDirectory || "."}" is empty \u2014 the build produced no files to serve, so every request would 404. Check the build command and the Output Directory setting.`
+      );
+    }
+    return workDir;
+  }
+  /**
+   * Remove top-level build inputs from a doc root, returning the names it could NOT
+   * remove (empty on success, and on "there was nothing to remove").
+   *
+   * Reuses `isExcludedDocRootEntry` rather than re-listing the names, because the
+   * Docker sandbox already owns that list and two copies of "what must not be
+   * served" is precisely how the bare path came to serve `.git`.
+   *
+   * An unreadable listing returns empty — a probe that cannot read must not fail a
+   * deploy — but a listed entry that survives its `rm` is reported, because the
+   * caller must refuse to publish rather than expose a token.
+   */
+  async pruneBuildFilesFromDocRoot(root) {
+    const listed = await this.executor.exec(`ls -A ${sq(root)} 2>/dev/null; true`).catch(() => null);
+    if (listed === null) return [];
+    const doomed = listed.split("\n").map((l) => l.trim()).filter(Boolean).filter(isExcludedDocRootEntry);
+    if (doomed.length === 0) return [];
+    await this.executor.exec(`rm -rf ${doomed.map((n) => sq(`${root}/${n}`)).join(" ")}`).catch(() => {
+    });
+    const survivors = [];
+    for (const name of doomed) {
+      if (await this.executor.exists(`${root}/${name}`)) survivors.push(name);
+    }
+    return survivors;
+  }
+  /**
+   * Is this an existing directory with no entries? Any inconclusive answer (not a
+   * directory, unreadable, exec failed) returns false — a probe that can't read
+   * must never be the thing that fails a deploy.
+   */
+  async isEmptyDir(path) {
+    const p = sq(path);
+    const out = await this.executor.exec(
+      `if [ -d ${p} ]; then echo DIR; ls -A ${p} 2>/dev/null | head -1; fi; true`
+    ).catch(() => null);
+    if (out === null) return false;
+    const lines = out.split("\n").map((l) => l.trim()).filter(Boolean);
+    return lines.length === 1 && lines[0] === "DIR";
+  }
+  async stop(containerId) {
+    const sv = await this.supervisor();
+    await sv.stop(containerId);
+  }
+  async start(containerId) {
+    const sv = await this.supervisor();
+    if (await sv.isRunning(containerId)) return;
+    await sv.start(containerId);
+  }
+  async restart(containerId) {
+    const sv = await this.supervisor();
+    await sv.restart(containerId);
+  }
+  async destroy(containerId) {
+    if (isArtifactPathRef(containerId)) {
+      await removeManagedArtifact(this.executor, containerId);
+      return;
+    }
+    const sv = await this.supervisor();
+    await sv.destroy(containerId);
+  }
+  // ── Rollback primitives ──────────────────────────────────────────────
+  //
+  // Bare semantics:
+  //   The release dir at workDir/releases/<deploymentId> IS the artifact.
+  //   The supervisor unit is the activation. Rollback flips which
+  //   release the supervisor unit serves by stop/start sequencing.
+  //
+  //   makeActive — stop `from`'s supervisor unit, then start `to`'s.
+  //     The release dirs are stable on disk; we're just changing which
+  //     unit is running. Matches the user's "mv path + reload" mental
+  //     model — the path doesn't physically move, but the active one
+  //     swaps via the supervisor.
+  //   archive   — stop the supervisor unit. Release dir stays on disk
+  //     (the actual rollback-restorable artifact).
+  //   purge     — destroy the supervisor unit + rm -rf the release dir.
+  async makeActive(input) {
+    if (input.from?.containerId) {
+      try {
+        await this.stop(input.from.containerId);
+      } catch {
+      }
+    }
+    if (!input.to.containerId) {
+      throw new Error(
+        `Cannot make deployment ${input.to.id} active: supervisor unit is gone. Artifact has been purged.`
+      );
+    }
+    await this.start(input.to.containerId);
+    return { containerId: input.to.containerId };
+  }
+  async archive(deployment) {
+    if (!deployment.containerId) return;
+    try {
+      await this.stop(deployment.containerId);
+    } catch {
+    }
+  }
+  async purge(deployment) {
+    const failures = [];
+    if (deployment.containerId) {
+      await this.destroy(deployment.containerId).catch(
+        (err) => failures.push(err)
+      );
+    }
+    const releaseDir = this.releaseDir(deployment.id);
+    if (releaseDir !== deployment.containerId) {
+      await removeManagedArtifact(this.executor, releaseDir).catch(
+        (err) => failures.push(err)
+      );
+    }
+    if (failures.length === 1) throw failures[0];
+    if (failures.length > 1) {
+      throw new Error(
+        failures.map((err) => err instanceof Error ? err.message : String(err)).join("; ")
+      );
+    }
+  }
+  // ── Observability ──────────────────────────────────────────────────────
+  async getContainerInfo(containerId) {
+    const sv = await this.supervisor();
+    const running = await sv.isRunning(containerId);
+    return {
+      containerId,
+      status: running ? "running" : "stopped"
+    };
+  }
+  async getRuntimeLogs(containerId, tail) {
+    const sv = await this.supervisor();
+    return sv.getLogs(containerId, tail);
+  }
+  async streamRuntimeLogs(containerId, onLog, opts) {
+    const sv = await this.supervisor();
+    return sv.streamLogs(containerId, onLog, opts);
+  }
+  /**
+   * CPU / memory / disk-IO for the deployment's process.
+   *
+   * `containerId` is the DEPLOYMENT id here, not a docker container id — that's the
+   * bare runtime's convention throughout (it's what the supervisor keys units and
+   * PID files on).
+   *
+   * The supervisor owns the measurement because the identity differs: systemd has a
+   * unit and a cgroup, nohup has a PID file. Both land on the same probe.
+   */
+  async getUsage(containerId) {
+    const sv = await this.supervisor();
+    return sv.getUsage(containerId);
+  }
+  // ── Network ────────────────────────────────────────────────────────────
+  async getContainerIp(_containerId) {
+    return "127.0.0.1";
+  }
+};
+
+export {
+  STATIC_RELEASE_BASE,
+  BareRuntime
+};