@rakay-technology/kraft 0.7.5 → 0.7.7

package/dist/{chunk-CO6FAYLO.js → chunk-HLF5PMKE.js}

@@ -7,7 +7,7 @@ import {
   COMPONENT_INSTALLERS,
   checkAll,
   checkComponents
-} from "./chunk-TVURAFJ5.js";
+} from "./chunk-MOSINQAM.js";
 
 // ../../packages/adapters/src/system/requirements.ts
 var REMOTE_SERVER_REQUIRED_COMPONENTS = ["docker", "git"];

package/dist/{chunk-4UITBYUK.js → chunk-IGTODKUA.js}

@@ -19,7 +19,7 @@ import {
   rollbackEdgeTakeover,
   scanImportableSites,
   unreachableStaticRoots
-} from "./chunk-TVURAFJ5.js";
+} from "./chunk-MOSINQAM.js";
 import {
   ourEdgeContainerRunning
 } from "./chunk-PCOTSRS4.js";
@@ -263,7 +263,7 @@ async function repairEdgeConflict(mode, apiPort, onLog) {
   }
   spawnSync("docker", ["restart", "kraft-edge"], { stdio: "ignore" });
   if (mode === "migrate" && scan.sites.length > 0) {
-    const { importMigratedSites } = await import("./edge-import-YDPEIQDU.js");
+    const { importMigratedSites } = await import("./edge-import-RZD7MMOE.js");
     const outcome = await importMigratedSites(apiPort, scan.sites, certPems);
     if (outcome.registered.length === 0) {
       return {

package/dist/{chunk-TVURAFJ5.js → chunk-MOSINQAM.js}

@@ -2639,6 +2639,20 @@ async function installDocker(executor, onLog, config) {
     return { component: "docker", success: false, error: msg };
   }
 }
+function rhelRepoHint(profile, component, output) {
+  if (profile.distroFamily !== "rhel") return "";
+  if (!/no match for argument|unable to find a match|no package .* available/i.test(
+    output
+  ))
+    return "";
+  if (component === "fail2ban") {
+    return ` On RHEL-family hosts, \`fail2ban\` lives in EPEL, which Kraft does not enable itself: install the \`epel-release\` package first, then retry this install.`;
+  }
+  if (component === "ufw") {
+    return ` The \`ufw\` command is not packaged for RHEL-family hosts \u2014 \`firewalld\` is the native firewall and Kraft already drives it, so nothing needs installing.`;
+  }
+  return "";
+}
 async function installPackaged(executor, onLog, component, label, where) {
   const prep = await prepareExecutor(executor, component);
   if (!prep.ok) return prep.result;
@@ -2656,7 +2670,7 @@ async function installPackaged(executor, onLog, component, label, where) {
       onLog
     );
     if (code !== 0) {
-      const error = describeInstallFailure(label, code, output);
+      const error = describeInstallFailure(label, code, output) + rhelRepoHint(prep.profile, component, output);
       onLog(log3(error, "error"));
       return { component, success: false, error };
     }

package/dist/{chunk-TSDJJP6M.js → chunk-OQ5TBV4T.js}

@@ -16,7 +16,7 @@ import {
   planAndApplyHostEdge,
   previewHostEdge,
   rollbackHostEdge
-} from "./chunk-4UITBYUK.js";
+} from "./chunk-IGTODKUA.js";
 import {
   DEFAULT_REPO,
   PORTS_FILE,
@@ -43,7 +43,7 @@ import {
   resolvePorts,
   sourceBuildDir,
   verifyHostChannel
-} from "./chunk-TCB6MMZZ.js";
+} from "./chunk-RU2BVUEV.js";
 import {
   startUnitHint,
   thisHost
@@ -87,7 +87,7 @@ import { dirname as dirname2, join as join6 } from "path";
 import { fileURLToPath } from "url";
 
 // src/lib/dashboard.ts
-import { spawnSync } from "child_process";
+import { spawnSync as spawnSync2 } from "child_process";
 import { existsSync as existsSync2, mkdirSync as mkdirSync3, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
 import { join as join3 } from "path";
 
@@ -105,6 +105,7 @@ import {
 } from "fs";
 import { homedir } from "os";
 import { join } from "path";
+import { spawnSync } from "child_process";
 var GITHUB_TOKEN_FILENAME = ".github-token";
 function githubTokenFile(dir = OS_DIR) {
   return join(dir, GITHUB_TOKEN_FILENAME);
@@ -195,6 +196,26 @@ function dockerHasAuthFor(host) {
     return false;
   }
 }
+function dockerAvailable() {
+  try {
+    return spawnSync("docker", ["--version"], { stdio: "ignore" }).status === 0;
+  } catch {
+    return false;
+  }
+}
+function dockerLogin(host, username, token) {
+  try {
+    const r = spawnSync(
+      "docker",
+      ["login", host, "-u", username, "--password-stdin"],
+      { input: token, encoding: "utf8" }
+    );
+    const detail = `${r.stdout ?? ""}${r.stderr ?? ""}`.trim();
+    return { ok: r.status === 0, detail };
+  } catch (e) {
+    return { ok: false, detail: e.message };
+  }
+}
 
 // src/lib/cache.ts
 var CACHE_DIR = join2(OS_DIR, "cache");
@@ -367,7 +388,7 @@ async function fetchBundle(tag, onProgress) {
       `Dashboard bundle checksum mismatch (expected ${expected}, got ${sha256}).`
     );
   }
-  const untar = spawnSync("tar", ["-xzf", tarball, "-C", dir], {
+  const untar = spawnSync2("tar", ["-xzf", tarball, "-C", dir], {
     stdio: "inherit"
   });
   if (untar.status !== 0) {
@@ -387,7 +408,7 @@ async function fetchBundle(tag, onProgress) {
 }
 
 // src/lib/service.ts
-import { spawnSync as spawnSync2 } from "child_process";
+import { spawnSync as spawnSync3 } from "child_process";
 import {
   existsSync as existsSync4,
   mkdirSync as mkdirSync5,
@@ -466,7 +487,7 @@ function runArgv(flags) {
   return [runtime, ...args, ...upArgs(flags)];
 }
 function run(cmd, args) {
-  const r = spawnSync2(cmd, args, { encoding: "utf8" });
+  const r = spawnSync3(cmd, args, { encoding: "utf8" });
   return {
     ok: r.status === 0,
     out: `${r.stdout ?? ""}${r.stderr ?? ""}`.trim()
@@ -1921,7 +1942,7 @@ async function runForeground(opts, source) {
     const uiSpinner = ora("Preparing the dashboard\u2026").start();
     try {
       const bundle = await ensureDashboard({
-        tag: source ? "local" : opts.uiVersion || `v${"0.7.5"}`,
+        tag: source ? "local" : opts.uiVersion || `v${"0.7.7"}`,
         onProgress: (received, total) => {
           if (total) {
             uiSpinner.text = `Downloading dashboard\u2026 ${Math.round(received / total * 100)}%`;
@@ -2038,6 +2059,7 @@ async function runForeground(opts, source) {
 }
 
 export {
+  readStoredGithubToken,
   githubToken,
   githubTokenSource,
   storeGithubToken,
@@ -2046,6 +2068,8 @@ export {
   validateGithubToken,
   checkRepoReleases,
   dockerHasAuthFor,
+  dockerAvailable,
+  dockerLogin,
   CACHE_DIR,
   RELEASES_DIR,
   releaseDir,

package/dist/{chunk-TCB6MMZZ.js → chunk-RU2BVUEV.js}

@@ -16,7 +16,7 @@ import {
 } from "./chunk-5GPXMTE4.js";
 import {
   systemCatalog
-} from "./chunk-TVURAFJ5.js";
+} from "./chunk-MOSINQAM.js";
 import {
   invalidateEdgeContainer,
   sanitizeEdgeVhosts
@@ -1776,7 +1776,7 @@ function operatorEnvPassthrough(managed, prev) {
 }
 var PRESERVED_ENV_HEADER = "# Preserved from your existing .env \u2014 set by you, not by `kraft up` (#485).";
 function resolveImageVersion(opts) {
-  return opts.version?.trim() || process.env.KRAFT_VERSION?.trim() || (true ? "0.7.5" : "latest");
+  return opts.version?.trim() || process.env.KRAFT_VERSION?.trim() || (true ? "0.7.7" : "latest");
 }
 function managedEnvLines(opts, host, cfg, prev) {
   const lines = [

package/dist/{edge-import-YDPEIQDU.js → edge-import-RZD7MMOE.js}

@@ -18,8 +18,8 @@ import "./chunk-DRK3MEDS.js";
 import "./chunk-3NQQXMDR.js";
 import "./chunk-RHLNVZMS.js";
 import "./chunk-MC4X55BW.js";
-import "./chunk-CO6FAYLO.js";
-import "./chunk-TVURAFJ5.js";
+import "./chunk-HLF5PMKE.js";
+import "./chunk-MOSINQAM.js";
 import "./chunk-VFPLICBX.js";
 import "./chunk-I3DPMTSF.js";
 import "./chunk-PCOTSRS4.js";

package/dist/{edge-preflight-TT2777R5.js → edge-preflight-6YO27PPQ.js}

@@ -13,9 +13,9 @@ import {
   renderEdgeConflict,
   repairEdgeConflict,
   rollbackHostEdge
-} from "./chunk-4UITBYUK.js";
+} from "./chunk-IGTODKUA.js";
 import "./chunk-5GPXMTE4.js";
-import "./chunk-TVURAFJ5.js";
+import "./chunk-MOSINQAM.js";
 import "./chunk-VFPLICBX.js";
 import "./chunk-I3DPMTSF.js";
 import "./chunk-PCOTSRS4.js";

package/dist/{ensure-container-edge-T5WRCJSE.js → ensure-container-edge-ZKEKC47H.js}

@@ -11,7 +11,7 @@ import {
   resolveEdgeImage,
   setDefaultEdgeImage,
   verifyEdgeServing
-} from "./chunk-TVURAFJ5.js";
+} from "./chunk-MOSINQAM.js";
 import "./chunk-VFPLICBX.js";
 import "./chunk-I3DPMTSF.js";
 import "./chunk-PCOTSRS4.js";

package/dist/{host-channel-preflight-625L6RNO.js → host-channel-preflight-QMAF2BQW.js}

@@ -5,7 +5,7 @@ const require = __ospCreateRequire(import.meta.url);
 import {
   checkHostChannel,
   verifyHostChannel
-} from "./chunk-TCB6MMZZ.js";
+} from "./chunk-RU2BVUEV.js";
 import "./chunk-2UQFOUSZ.js";
 import "./chunk-5GPXMTE4.js";
 import "./chunk-XZYFZ6A5.js";
@@ -17,8 +17,8 @@ import "./chunk-DRK3MEDS.js";
 import "./chunk-3NQQXMDR.js";
 import "./chunk-RHLNVZMS.js";
 import "./chunk-MC4X55BW.js";
-import "./chunk-CO6FAYLO.js";
-import "./chunk-TVURAFJ5.js";
+import "./chunk-HLF5PMKE.js";
+import "./chunk-MOSINQAM.js";
 import "./chunk-VFPLICBX.js";
 import "./chunk-I3DPMTSF.js";
 import "./chunk-PCOTSRS4.js";

package/dist/index.js

@@ -8,7 +8,9 @@ import {
   assetUrl,
   checkRepoReleases,
   clearGithubToken,
+  dockerAvailable,
   dockerHasAuthFor,
+  dockerLogin,
   downloadToFile,
   ensureDashboard,
   expectedSha256,
@@ -23,6 +25,7 @@ import {
   normalizeUrl,
   parseSha256,
   readCliInstall,
+  readStoredGithubToken,
   releaseDir,
   releasesPage,
   resolveLatestTag,
@@ -35,7 +38,7 @@ import {
   upCommand,
   validateGithubToken,
   writeCliInstall
-} from "./chunk-TSDJJP6M.js";
+} from "./chunk-OQ5TBV4T.js";
 import {
   bootstrapAdmin,
   detectPublicIp,
@@ -55,7 +58,7 @@ import {
   renderEdgeConflict,
   repairEdgeConflict,
   rollbackHostEdge
-} from "./chunk-4UITBYUK.js";
+} from "./chunk-IGTODKUA.js";
 import {
   composeDown,
   composeInternalToken,
@@ -89,7 +92,7 @@ import {
   sourceBuildDir,
   storedApiPort,
   storedDashboardPort
-} from "./chunk-TCB6MMZZ.js";
+} from "./chunk-RU2BVUEV.js";
 import {
   startUnitHint
 } from "./chunk-2UQFOUSZ.js";
@@ -107,11 +110,11 @@ import "./chunk-DRK3MEDS.js";
 import "./chunk-3NQQXMDR.js";
 import "./chunk-RHLNVZMS.js";
 import "./chunk-MC4X55BW.js";
-import "./chunk-CO6FAYLO.js";
+import "./chunk-HLF5PMKE.js";
 import {
   detectInstalledProxy,
   scanImportableSites
-} from "./chunk-TVURAFJ5.js";
+} from "./chunk-MOSINQAM.js";
 import "./chunk-VFPLICBX.js";
 import "./chunk-I3DPMTSF.js";
 import "./chunk-PCOTSRS4.js";
@@ -327,7 +330,7 @@ function getDashboardUrl(name) {
 }
 
 // src/lib/api-client.ts
-var USER_AGENT = `kraft-cli/${true ? "0.7.5" : "dev"}`;
+var USER_AGENT = `kraft-cli/${true ? "0.7.7" : "dev"}`;
 function getApiUrl2() {
   return `${getApiUrl()}/api`;
 }
@@ -1226,7 +1229,7 @@ function looksCorrupted() {
   const err2 = lastServiceError();
   return !!err2 && CORRUPTION_RE.test(err2);
 }
-function dockerAvailable() {
+function dockerAvailable2() {
   const r = spawnSync(
     "docker",
     ["version", "--format", "{{.Server.Version}}"],
@@ -1244,7 +1247,7 @@ function mapState(dockerState) {
   return "stopped";
 }
 function dockerServices() {
-  if (!dockerAvailable()) return [];
+  if (!dockerAvailable2()) return [];
   const fmt = '{{.Names}}	{{.State}}	{{.Label "kraft.project"}}';
   const r = spawnSync(
     "docker",
@@ -1263,7 +1266,7 @@ function dockerServices() {
   });
 }
 function dockerNameRunning(nameFilter) {
-  if (!dockerAvailable()) return null;
+  if (!dockerAvailable2()) return null;
   const r = spawnSync(
     "docker",
     ["ps", "--filter", `name=${nameFilter}`, "--format", "{{.Names}}"],
@@ -1273,7 +1276,7 @@ function dockerNameRunning(nameFilter) {
   return r.stdout.trim().length > 0;
 }
 async function hostControlCheck(api) {
-  const { checkHostChannel } = await import("./host-channel-preflight-625L6RNO.js");
+  const { checkHostChannel } = await import("./host-channel-preflight-QMAF2BQW.js");
   return hostControlRow(await checkHostChannel().catch(() => null), api);
 }
 var NEVER_PROVISIONED_DETAIL = `never provisioned \u2014 run \`${HOST_CHANNEL_PROVISION_COMMAND}\``;
@@ -1832,7 +1835,7 @@ async function interactiveDoctor() {
       continue;
     }
     if (action2 === "host-control") {
-      const { verifyHostChannel } = await import("./host-channel-preflight-625L6RNO.js");
+      const { verifyHostChannel } = await import("./host-channel-preflight-QMAF2BQW.js");
       const report3 = await verifyHostChannel().catch(() => null);
       if (report3?.status === "fixed")
         log2.success("Host control is reachable now.");
@@ -4224,7 +4227,7 @@ async function runRepair2(mode) {
     mode === "migrate" ? "Migrating the existing proxy's sites into the edge\u2026" : "Taking over :80/:443\u2026"
   );
   try {
-    const { repairEdgeConflict: repairEdgeConflict2 } = await import("./edge-preflight-TT2777R5.js");
+    const { repairEdgeConflict: repairEdgeConflict2 } = await import("./edge-preflight-6YO27PPQ.js");
     sp?.stop();
     const res = await repairEdgeConflict2(mode, apiPort(), onLog);
     reportRepair(res);
@@ -4387,7 +4390,7 @@ async function panelRepair(mode) {
     mode === "migrate" ? "Migrating the existing proxy's sites\u2026" : "Taking over :80/:443\u2026"
   );
   try {
-    const { repairEdgeConflict: repairEdgeConflict2 } = await import("./edge-preflight-TT2777R5.js");
+    const { repairEdgeConflict: repairEdgeConflict2 } = await import("./edge-preflight-6YO27PPQ.js");
     sp?.stop();
     const res = await repairEdgeConflict2(mode, apiPort(), onLog);
     renderRepair(res);
@@ -5492,7 +5495,7 @@ function printMonitoringNextSteps() {
   info("    kraft edge analytics -p <project>            per-domain analytics");
 }
 async function runMonitoringInstall(opts) {
-  const up = await import("./up-G7ASYVWR.js");
+  const up = await import("./up-IYR35YWW.js");
   let adminName = opts.adminName;
   let adminEmail = opts.adminEmail;
   let adminPassword = opts.adminPassword;
@@ -8066,7 +8069,7 @@ function applyOnlyArgv(selfArgs, json) {
 // src/commands/update.ts
 async function verifyHostChannelAfterUpdate() {
   if (isJsonMode()) return;
-  const { verifyHostChannel } = await import("./host-channel-preflight-625L6RNO.js");
+  const { verifyHostChannel } = await import("./host-channel-preflight-QMAF2BQW.js");
   await verifyHostChannel().catch(() => {
   });
 }
@@ -8166,7 +8169,7 @@ async function runSourceUpdate(source, opts) {
 }
 var REINSTALL_HINT = "curl -fsSL https://get.kraft.io | sh";
 async function runTarballUpdate(install, opts) {
-  const current = "0.7.5";
+  const current = "0.7.7";
   let latest;
   try {
     latest = (await resolveLatestTag()).replace(/^v/, "");
@@ -8287,7 +8290,7 @@ var updateCommand = new Command26("update").description("Update the Kraft CLI +
   const cliInstall = readCliInstall();
   if (cliInstall?.method === "tarball")
     return runTarballUpdate(cliInstall, opts);
-  const current = "0.7.5";
+  const current = "0.7.7";
   let latest;
   try {
     latest = (await resolveLatestTag()).replace(/^v/, "");
@@ -8492,22 +8495,6 @@ function registryHost() {
   const raw = process.env.KRAFT_IMAGE_REGISTRY?.trim() || DEFAULT_IMAGE_REGISTRY;
   return raw.split("/")[0] || "ghcr.io";
 }
-function dockerAvailable2() {
-  try {
-    return spawnSync8("docker", ["--version"], { stdio: "ignore" }).status === 0;
-  } catch {
-    return false;
-  }
-}
-function dockerLogin(host, username, token) {
-  const r = spawnSync8(
-    "docker",
-    ["login", host, "-u", username, "--password-stdin"],
-    { input: token, encoding: "utf8" }
-  );
-  const detail = `${r.stdout ?? ""}${r.stderr ?? ""}`.trim();
-  return { ok: r.status === 0, detail };
-}
 function cancelled(v) {
   return typeof v === "symbol";
 }
@@ -8524,6 +8511,26 @@ async function runAuth(opts) {
   const repo = opts.repo?.trim() || githubRepo();
   const host = registryHost();
   let token = opts.token?.trim();
+  let tokenReused = false;
+  if (!token) {
+    const stored = readStoredGithubToken();
+    if (stored) {
+      const prev = await validateGithubToken(stored);
+      if (prev.valid) {
+        token = stored;
+        tokenReused = true;
+        if (!isJsonMode())
+          info(`  Reusing stored token (${maskToken(stored)}).`);
+      } else if (!process.stdin.isTTY) {
+        err(
+          "\n  Stored token is no longer valid and there's no TTY to ask for a new one \u2014 re-run with `kraft gh auth --token <tok>`.\n"
+        );
+        process.exit(1);
+      } else {
+        info("  Stored token is no longer valid \u2014 let's replace it.\n");
+      }
+    }
+  }
   if (!token) {
     if (!process.stdin.isTTY) {
       err(
@@ -8565,13 +8572,15 @@ async function runAuth(opts) {
   }
   storeGithubToken(token);
   if (!isJsonMode()) {
-    ok(`  GitHub token stored (~/.kraft/.github-token, 0600).`);
+    ok(
+      tokenReused ? `  GitHub token still valid (${maskToken(token)}).` : `  GitHub token stored (~/.kraft/.github-token, 0600).`
+    );
     if (releases.tag) info(`  Latest release on ${repo}: ${releases.tag}`);
   }
   let docker = { loggedIn: false };
   if (opts.docker === false) {
     docker = { loggedIn: false, skipped: "opt-out (--no-docker)" };
-  } else if (!dockerAvailable2()) {
+  } else if (!dockerAvailable()) {
     docker = { loggedIn: false, skipped: "no docker on PATH" };
     if (!isJsonMode()) info("  No docker on PATH \u2014 skipping registry login.");
   } else {
@@ -9128,7 +9137,7 @@ async function runWizard() {
       }
     }
   }
-  const uiTag = `v${"0.7.5"}`;
+  const uiTag = `v${"0.7.7"}`;
   if (method === "bare") {
     const dl = spinner4();
     dl.start("Pulling the Kraft dist from GitHub");
@@ -9196,7 +9205,7 @@ async function runWizard() {
     const dashboardPort = String(ports.dashboard);
     const moved = portMoveNotice(ports, composeTrustedOriginUrls());
     if (moved.length) log5.info(moved.join("\n"));
-    if (!pinnedImagesReady({ version: "0.7.5" })) {
+    if (!pinnedImagesReady({ version: "0.7.7" })) {
       cancel4(
         "The pinned Kraft image tag isn't in the registry yet \u2014 nothing on this box was changed."
       );
@@ -9218,6 +9227,27 @@ async function runWizard() {
       );
       process.exit(1);
     }
+    const regHost = registryHost();
+    if (!dockerHasAuthFor(regHost)) {
+      const regToken = githubToken();
+      if (regToken) {
+        const username = ensure2(
+          await text3({
+            message: `GitHub username for the registry login (${regHost})`,
+            placeholder: process.env.USER || "username",
+            validate: (v) => v?.trim() ? void 0 : "A username is required."
+          })
+        );
+        const logged = dockerLogin(regHost, username.trim(), regToken);
+        if (logged.ok) {
+          log5.info(`Registry login OK (${regHost} as ${username.trim()}).`);
+        } else {
+          log5.warn(
+            `Registry login failed (${regHost}): ${logged.detail || "unknown error"} \u2014 the pull below will report it. Fix with \`kraft gh auth\`.`
+          );
+        }
+      }
+    }
     log5.step(
       sourceBuildDir() ? "Building the Kraft images before touching :80/:443 (first run takes a few minutes)\u2026" : "Pulling images before touching :80/:443\u2026"
     );
@@ -9226,7 +9256,7 @@ async function runWizard() {
       dashboardPort,
       publicUrl,
       trustProxy: behindProxy,
-      version: "0.7.5",
+      version: "0.7.7",
       noHostControl: !allowHostControl
     });
     if (!fetched.ok) {
@@ -9257,7 +9287,7 @@ async function runWizard() {
       dashboardPort,
       publicUrl,
       trustProxy: behindProxy,
-      version: "0.7.5",
+      version: "0.7.7",
       noHostControl: !allowHostControl
     });
     if (!up.ok) {
@@ -9349,7 +9379,7 @@ async function runWizard() {
     if (!result.domainRegistered)
       liveUrl2 = `http://localhost:${started.dashPort}`;
     for (const w of result.warnings) log5.warn(w);
-    const { verifyHostChannel } = await import("./host-channel-preflight-625L6RNO.js");
+    const { verifyHostChannel } = await import("./host-channel-preflight-QMAF2BQW.js");
     await verifyHostChannel().catch(() => {
     });
     finishSetup({
@@ -9653,7 +9683,7 @@ function attachCompletion(program2) {
 
 // src/index.ts
 var program = new Command29();
-program.name("kraft").description("Kraft CLI \u2014 install, run, and manage Kraft from your terminal").version("0.7.5").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
+program.name("kraft").description("Kraft CLI \u2014 install, run, and manage Kraft from your terminal").version("0.7.7").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
   if (thisCommand.opts().json) setJsonMode(true);
 }).action(async () => {
   const installed = serviceStatus().installed || readInstallMethod() === "compose";

package/dist/node-bootstrap.js

@@ -1,11 +1,11 @@
 // src/node-bootstrap.ts
-import { spawnSync as spawnSync2 } from "child_process";
+import { spawnSync as spawnSync3 } from "child_process";
 import { existsSync as existsSync3 } from "fs";
 import { join as join5 } from "path";
 import { createInterface } from "readline";
 
 // src/lib/node-runtime.ts
-import { execFileSync, spawnSync } from "child_process";
+import { execFileSync, spawnSync as spawnSync2 } from "child_process";
 import {
   chmodSync,
   existsSync as existsSync2,
@@ -42,6 +42,7 @@ import {
 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join2 } from "path";
+import { spawnSync } from "child_process";
 var GITHUB_TOKEN_FILENAME = ".github-token";
 function githubTokenFile(dir = OS_DIR) {
   return join2(dir, GITHUB_TOKEN_FILENAME);
@@ -211,7 +212,7 @@ async function fetchVendoredNode(onLog) {
   }
   const unpacked = join4(RUNTIME_DIR, `node-${ver}-${os}-${arch}`);
   rmSync2(unpacked, { recursive: true, force: true });
-  const untar = spawnSync("tar", ["-xzf", tarball, "-C", RUNTIME_DIR], {
+  const untar = spawnSync2("tar", ["-xzf", tarball, "-C", RUNTIME_DIR], {
     stdio: "inherit"
   });
   if (untar.status !== 0)
@@ -242,7 +243,7 @@ var NODE_REEXEC_ENV = "KRAFT_NODE_REEXEC";
 var VENDOR_ENV = "KRAFT_VENDOR_NODE";
 var vendoredNode = () => join5(OS_DIR, "runtime", "current", "bin", "node");
 function majorOf2(bin) {
-  const out = spawnSync2(
+  const out = spawnSync3(
     bin,
     ["-e", "process.stdout.write(process.versions.node)"],
     {
@@ -253,7 +254,7 @@ function majorOf2(bin) {
   return Number.parseInt(out.stdout.trim().split(".")[0] ?? "", 10) || 0;
 }
 function reexec(nodeBin, cliPath) {
-  const res = spawnSync2(nodeBin, [cliPath, ...process.argv.slice(2)], {
+  const res = spawnSync3(nodeBin, [cliPath, ...process.argv.slice(2)], {
     stdio: "inherit",
     env: { ...process.env, [NODE_REEXEC_ENV]: "1" }
   });

package/dist/server/index.js

@@ -110595,6 +110595,19 @@ async function installDocker(executor, onLog, config2) {
     return { component: "docker", success: false, error: msg };
   }
 }
+function rhelRepoHint(profile, component, output) {
+  if (profile.distroFamily !== "rhel")
+    return "";
+  if (!/no match for argument|unable to find a match|no package .* available/i.test(output))
+    return "";
+  if (component === "fail2ban") {
+    return ` On RHEL-family hosts, \`fail2ban\` lives in EPEL, which Kraft does not` + ` enable itself: install the \`epel-release\` package first, then retry this install.`;
+  }
+  if (component === "ufw") {
+    return ` The \`ufw\` command is not packaged for RHEL-family hosts — \`firewalld\`` + ` is the native firewall and Kraft already drives it, so nothing needs installing.`;
+  }
+  return "";
+}
 async function installPackaged(executor, onLog, component, label2, where) {
   const prep = await prepareExecutor(executor, component);
   if (!prep.ok)
@@ -110610,7 +110623,7 @@ async function installPackaged(executor, onLog, component, label2, where) {
   try {
     const { code, output } = await executor.streamExec(plan.value.installCommand, onLog);
     if (code !== 0) {
-      const error51 = describeInstallFailure(label2, code, output);
+      const error51 = describeInstallFailure(label2, code, output) + rhelRepoHint(prep.profile, component, output);
       onLog(log3(error51, "error"));
       return { component, success: false, error: error51 };
     }
@@ -111649,6 +111662,28 @@ async function startEngine(executor, container, image, hostname3, onLog) {
   const run2 = await executor.streamExec(buildMailRunCommand(container, image, hostname3), onLog);
   return run2.code === 0;
 }
+async function startStoppedMailStack(executor, container, dbContainer, onLog) {
+  const db = await containerState(executor, dbContainer).catch(() => null);
+  if (db && !db.running) {
+    onLog(log7("Starting the mail database (postgres sidecar)..."));
+    const started = await executor.streamExec(`docker start ${sq2(dbContainer)}`, onLog).catch(() => ({ code: 1 }));
+    if (started.code !== 0) {
+      onLog(log7("Could not start the mail database container — the health check will report it.", "warn"));
+      return;
+    }
+    const listening = await waitForPortListening(executor, MAIL_DB_PORT, {
+      timeoutMs: 60000
+    }).catch(() => null);
+    if (listening && listening.checked && !listening.listening) {
+      onLog(log7(`The mail database is not listening on :${MAIL_DB_PORT} after start.`, "warn"));
+    }
+  }
+  const engine = await containerState(executor, container).catch(() => null);
+  if (engine && !engine.running) {
+    onLog(log7("Starting the mail engine container..."));
+    await executor.streamExec(`docker start ${sq2(container)}`, onLog).catch(() => ({ code: 1 }));
+  }
+}
 async function verifyMailEngine(executor, opts) {
   const timeoutMs = opts.verifyTimeoutMs ?? 180000;
   const smtp = await waitForPortListening(executor, 25, { timeoutMs });
@@ -111685,8 +111720,10 @@ async function ensureContainerMail(executor, opts) {
   const image = resolveMailImage(opts.image);
   const current = await containerImageRef(executor, container);
   if (current) {
-    if (current === image)
+    if (current === image) {
+      await startStoppedMailStack(executor, container, dbContainer, onLog);
       return { container, dbContainer, image, updated: false };
+    }
     await handOverEnvFile(executor, ENGINE_ENV_FILE, onLog);
     const start2 = makeMailStart(executor, container, opts);
     const swap = await swapManagedImage(executor, {
@@ -272200,10 +272237,11 @@ async function stepDeployEngine(exec2, domain4, log11, config5) {
   if (health) {
     const down = health.filter((c2) => requiresMailComponent(c2.key) && c2.status !== "active");
     if (down.length > 0) {
+      const describeDown = (c2) => `${c2.label} [${c2.status}${c2.subState ? `/${c2.subState}` : ""}${c2.detail ? `: ${c2.detail}` : ""}]`;
       return {
         stepId,
         success: false,
-        message: `Mail engine started but these components are not running: ${down.map((c2) => c2.label).join(", ")}.`
+        message: `Mail engine started but these components are not running: ${down.map(describeDown).join(", ")}.`
       };
     }
   }
@@ -273236,7 +273274,7 @@ function validateDisplayName(name2) {
 async function listMailboxes(serverId, domain4) {
   validateDomain(domain4);
   return sshManager.withExecutor(serverId, async (exec2) => {
-    const rows = await queryRows(exec2, `SELECT${SELECT_COLUMNS} ${SELECT_FROM} WHERE domain = ${q3(domain4.toLowerCase())} ORDER BY mailbox.username`);
+    const rows = await queryRows(exec2, `SELECT${SELECT_COLUMNS} ${SELECT_FROM} WHERE mailbox.domain = ${q3(domain4.toLowerCase())} ORDER BY mailbox.username`);
     const state = await readState(exec2);
     return rows.map((row) => annotatePlatformMailbox(row, state?.domain));
   });
@@ -273409,18 +273447,18 @@ async function hardDeleteMailbox(serverId, email6) {
 }
 var EMAIL_RE, LOCAL_PART_RE, SELECT_COLUMNS = `
   mailbox.username,
-  name,
-  domain,
-  quota AS "quotaMB",
+  mailbox.name,
+  mailbox.domain,
+  mailbox.quota AS "quotaMB",
   uq.bytes AS "usedBytes",
-  storagebasedirectory,
-  storagenode,
-  maildir,
-  (active = 1) AS active,
-  (isadmin = 1) AS "isAdmin",
-  (isglobaladmin = 1) AS "isGlobalAdmin",
-  created::text AS "createdAt",
-  passwordlastchange::text AS "passwordLastChange"
+  mailbox.storagebasedirectory,
+  mailbox.storagenode,
+  mailbox.maildir,
+  (mailbox.active = 1) AS active,
+  (mailbox.isadmin = 1) AS "isAdmin",
+  (mailbox.isglobaladmin = 1) AS "isGlobalAdmin",
+  mailbox.created::text AS "createdAt",
+  mailbox.passwordlastchange::text AS "passwordLastChange"
 `, SELECT_FROM = `FROM mailbox LEFT JOIN used_quota AS uq ON uq.username = mailbox.username`, PlatformMailboxProtectedError, MailboxExistsError, MailboxNotFoundError;
 var init_mailboxes_service = __esm(async () => {
   init_src();
@@ -321467,7 +321505,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@repo/api",
-    version: "0.7.5",
+    version: "0.7.7",
     license: "Apache-2.0",
     private: true,
     type: "module",

package/dist/{setup-I3MTOIPW.js → setup-Q6GGIJ4Q.js}

@@ -4,8 +4,8 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   SystemManager
-} from "./chunk-CO6FAYLO.js";
-import "./chunk-TVURAFJ5.js";
+} from "./chunk-HLF5PMKE.js";
+import "./chunk-MOSINQAM.js";
 import "./chunk-VFPLICBX.js";
 import "./chunk-I3DPMTSF.js";
 import "./chunk-PCOTSRS4.js";

package/dist/{up-G7ASYVWR.js → up-IYR35YWW.js}

@@ -7,10 +7,10 @@ import {
   runHeadlessProvision,
   startService,
   upCommand
-} from "./chunk-TSDJJP6M.js";
+} from "./chunk-OQ5TBV4T.js";
 import "./chunk-JK7KKBXI.js";
-import "./chunk-4UITBYUK.js";
-import "./chunk-TCB6MMZZ.js";
+import "./chunk-IGTODKUA.js";
+import "./chunk-RU2BVUEV.js";
 import "./chunk-2UQFOUSZ.js";
 import "./chunk-5GPXMTE4.js";
 import "./chunk-XZYFZ6A5.js";
@@ -22,8 +22,8 @@ import "./chunk-DRK3MEDS.js";
 import "./chunk-3NQQXMDR.js";
 import "./chunk-RHLNVZMS.js";
 import "./chunk-MC4X55BW.js";
-import "./chunk-CO6FAYLO.js";
-import "./chunk-TVURAFJ5.js";
+import "./chunk-HLF5PMKE.js";
+import "./chunk-MOSINQAM.js";
 import "./chunk-VFPLICBX.js";
 import "./chunk-I3DPMTSF.js";
 import "./chunk-PCOTSRS4.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rakay-technology/kraft",
-  "version": "0.7.5",
+  "version": "0.7.7",
   "description": "Kraft CLI - deploy, manage, and open your Kraft platform from the terminal",
   "license": "Apache-2.0",
   "repository": {