@thebaycloud/cli 1.0.0

package/lib/exec-args.js

@@ -0,0 +1,40 @@
+"use strict";
+
+/**
+ * Turn the words after `--` into one command for a remote `sh`.
+ *
+ * Two shapes reach this, and joining them the same way breaks one of them:
+ *
+ *   bay exec app -- "ls | wc -l"           one argument, already a shell
+ *                                                 snippet — the pipe is meant
+ *   bay exec app -- python -c 'print(1)'   argv, and the local shell has
+ *                                                 already removed the quotes
+ *
+ * A plain `.join(" ")` served the first and silently corrupted the second. The
+ * server base64s whatever it is given and pipes it to `sh`, so `print(1)`
+ * arrives bare and sh answers `Syntax error: "(" unexpected`. Anything with a
+ * parenthesis, a quote, a `$`, a `;` or a space inside one argv word was
+ * affected, which is most non-trivial one-liners.
+ *
+ * One argument stays raw, because the user wrote shell and means it. Several
+ * arguments are quoted individually, because the shell already split them and
+ * the quotes it removed have to be put back. `docker exec` and `kubectl exec`
+ * draw the line in the same place.
+ */
+function joinExecArgs(words) {
+  const w = Array.isArray(words) ? words : [];
+  if (w.length <= 1) return String(w[0] ?? "").trim();
+  return w.map(shellQuote).join(" ").trim();
+}
+
+/**
+ * POSIX single-quoting. Everything is literal inside '…', and a single quote is
+ * itself escaped by closing the string, adding \' , and reopening.
+ */
+function shellQuote(word) {
+  const s = String(word);
+  if (s !== "" && /^[A-Za-z0-9_@%+=:,.\/-]+$/.test(s)) return s;
+  return "'" + s.replace(/'/g, "'\\''") + "'";
+}
+
+module.exports = { joinExecArgs, shellQuote };

package/lib/prebuilt.js

@@ -0,0 +1,86 @@
+"use strict";
+/**
+ * Deciding whether to build here or in the cloud, and hashing what we built.
+ *
+ * The decision is a pure function so it can be tested without running builds, and so
+ * the reason for every choice is written down in one place rather than spread through
+ * the deploy command.
+ */
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const path = require("node:path");
+
+/**
+ * What to do with a project, given what the detector said about it.
+ *
+ * `container` never builds locally: its artifact is an image, not a directory, and we
+ * are not building images on someone else's machine.
+ */
+function planFor(stack) {
+  const serve = stack && stack.serve;
+  if (!serve || serve.mode !== "static") {
+    return { mode: "cloud", reason: "this app runs a server, so it is built in the cloud" };
+  }
+  const outputDir = String(serve.outputDir || ".");
+  if (!stack.buildCommand) {
+    // Nothing to build — the folder already is the site.
+    return { mode: "upload", outputDir, reason: "no build step — uploading the folder as-is" };
+  }
+  return {
+    mode: "build",
+    outputDir,
+    installCommand: stack.installCommand || null,
+    buildCommand: stack.buildCommand,
+  };
+}
+
+/** Files under a directory, relative and slash-separated, sorted. */
+function listFiles(root, dir = root, out = []) {
+  for (const item of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, item.name);
+    if (item.isDirectory()) listFiles(root, full, out);
+    else if (item.isFile()) out.push(path.relative(root, full).split(path.sep).join("/"));
+  }
+  return out.sort();
+}
+
+/**
+ * Content hash of a built directory. Must match apps/web/lib/dirhash.ts exactly —
+ * the two are compared across the wire, and a mismatch in either direction silently
+ * disables the skip rather than failing loudly.
+ */
+function hashDir(root) {
+  const h = crypto.createHash("sha256");
+  for (const rel of listFiles(root)) {
+    h.update(rel);
+    h.update("\0");
+    h.update(fs.readFileSync(path.join(root, rel)));
+    h.update("\0");
+  }
+  return h.digest("hex");
+}
+
+/** True when the build output exists and has something in it. */
+function hasOutput(dir) {
+  try {
+    return fs.statSync(dir).isDirectory() && listFiles(dir).length > 0;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Warn when the local Node major differs from what the project asks for. This is the
+ * single most likely cause of "it built on my machine and broke in production", and a
+ * word at build time is worth more than a support conversation afterwards.
+ */
+function nodeVersionWarning(stack, localVersion = process.version) {
+  const runtime = String((stack && stack.runtime) || "");
+  if (!runtime.startsWith("node:")) return null;
+  const want = runtime.slice(5).match(/\d+/);
+  const have = String(localVersion).match(/\d+/);
+  if (!want || !have || want[0] === have[0]) return null;
+  return `this project targets Node ${want[0]} but you are on Node ${have[0]} — building anyway`;
+}
+
+module.exports = { planFor, hashDir, listFiles, hasOutput, nodeVersionWarning };

package/lib/resolver.js

@@ -0,0 +1,63 @@
+"use strict";
+/**
+ * The one door between the CLI and the control plane's resolution logic.
+ *
+ * `vendor/resolve.js` is apps/web/lib/{resolve,app-config,infer-services,
+ * repo-facts,lanes,plan-deps}.ts compiled by scripts/bundle-resolver.mjs — the
+ * same source the server runs, not a port of it. Everything in this package that
+ * needs to know what a repository deploys to goes through here, so there is
+ * exactly one answer to that question in the repository and no way for a second
+ * one to appear without deleting this file.
+ *
+ * Loaded lazily and through a named function rather than at require() time: the
+ * bundle is generated, an old global install can be missing it, and a missing
+ * bundle must fail `supersonic check` with a sentence naming the fix rather than
+ * crashing `supersonic logs`, which does not use it at all.
+ */
+const path = require("node:path");
+
+let cached = null;
+
+/** The bundled resolver, or a thrown error saying how to build it. */
+function resolver() {
+  if (cached) return cached;
+  try {
+    cached = require("../vendor/resolve.js");
+  } catch (e) {
+    throw new Error(
+      "this build of the CLI has no bundled resolver (vendor/resolve.js).\n" +
+      "  From a checkout: npm run bundle -w supersonic-cli\n" +
+      `  Underlying error: ${e && e.message ? e.message : String(e)}`,
+    );
+  }
+  return cached;
+}
+
+/**
+ * The stack detector, as the async `Detect` that inferAppConfig expects.
+ *
+ * Synchronous in the CLI — there is one process, one repo, and nothing else
+ * waiting on the event loop. The control plane spawns the deploy-agent as a
+ * subprocess for the same job, which is why the interface is a promise at all;
+ * matching the interface rather than the transport is what lets both callers
+ * share inferAppConfig unchanged.
+ */
+function detector() {
+  const { detectStack } = require("../vendor/detector.js");
+  return async (absoluteDir) => detectStack(absoluteDir);
+}
+
+/**
+ * Resolve a directory the way a deploy will, with inference as the fallback.
+ *
+ * The detector is passed in every time. resolve() without one throws on a repo
+ * that has no supersonic.json — correct for the server, which must not guess
+ * silently, and useless for a CLI whose entire job here is to show the user what
+ * the guess would be before it costs eleven minutes.
+ */
+async function resolveHere(dir) {
+  const r = resolver();
+  return r.resolve(dir, detector());
+}
+
+module.exports = { resolver, detector, resolveHere, BUNDLE: path.join(__dirname, "..", "vendor", "resolve.js") };

package/lib/who.js

@@ -0,0 +1,14 @@
+"use strict";
+/**
+ * Who is shipping, as declared — never as inferred.
+ *
+ * An agent sets BAY_WHO=agent (SUPERSONIC_WHO still works). Nothing else is consulted: a TTY check
+ * would call CI an agent, and the platform would then draw a figure that was
+ * never there. The absence of a name is a fact; a wrong name is a lie.
+ */
+function whoHeader(env) {
+  const v = String(env.BAY_WHO || env.SUPERSONIC_WHO || "").trim().toLowerCase();
+  return v === "you" || v === "agent" || v === "platform" ? v : "someone";
+}
+
+module.exports = { whoHeader };

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@thebaycloud/cli",
+  "version": "1.0.0",
+  "description": "Deploy & debug Bay apps from your coding agent — the agent-native CLI.",
+  "bin": {
+    "bay": "index.js",
+    "supersonic": "index.js"
+  },
+  "type": "commonjs",
+  "engines": {
+    "node": ">=20"
+  },
+  "files": [
+    "index.js",
+    "lib/",
+    "vendor/",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "scripts": {
+    "bundle-detector": "node scripts/bundle-detector.mjs",
+    "bundle-resolver": "node scripts/bundle-resolver.mjs",
+    "bundle": "npm run bundle-detector && npm run bundle-resolver",
+    "test": "node --test 'test/**/*.test.js'",
+    "prepublishOnly": "npm run bundle && npm test"
+  },
+  "keywords": [
+    "deploy",
+    "cloud",
+    "gcp",
+    "vibecoding",
+    "bay",
+    "coding-agent"
+  ],
+  "homepage": "https://thebay.cloud",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/thebaycloud/bay.git",
+    "directory": "packages/cli"
+  },
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/The-Red-Onion/supersonic/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/vendor/README.md

@@ -0,0 +1,6 @@
+Generated. Do not edit — `npm run bundle` rebuilds all of it.
+
+- detector.js — scripts/bundle-detector.mjs, from services/deploy-agent
+- resolve.js  — scripts/bundle-resolver.mjs, from apps/web/lib
+- inputs.json — every repository file esbuild inlined into each bundle, from its metafile.
+                test/vendor.test.js hashes these to prove the bundles are not stale.

package/vendor/detector.js

@@ -0,0 +1,423 @@
+// supersonic-vendor-stamp 541ed09e927ae777
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  astroServe: () => astroServe,
+  detectStack: () => detectStack,
+  dockerfile: () => dockerfile,
+  installFor: () => installFor,
+  nextServe: () => nextServe,
+  provisionPlan: () => provisionPlan
+});
+module.exports = __toCommonJS(index_exports);
+var import_node_fs = require("node:fs");
+var import_node_path = require("node:path");
+var import_node_os = require("node:os");
+var import_node_child_process = require("node:child_process");
+var import_node_url = require("node:url");
+
+// ../../apps/web/lib/plan-deps.ts
+var RUNTIME_VERSIONS = { python: "3.14", node: "24" };
+
+// src/index.ts
+var import_meta = {};
+var CONTAINER = { mode: "container" };
+function installFor(pm, hasNpmLock) {
+  switch (pm) {
+    case "pnpm":
+      return "pnpm i --frozen-lockfile";
+    case "yarn":
+      return "yarn --frozen-lockfile";
+    case "bun":
+      return "bun install";
+    default:
+      return hasNpmLock ? "npm ci" : "npm install";
+  }
+}
+function astroServe(configSource) {
+  const src = configSource ?? "";
+  const hasAdapter = /adapter\s*:/.test(src) || /@astrojs\/(node|vercel|netlify|cloudflare|deno)/.test(src);
+  return hasAdapter ? CONTAINER : { mode: "static", outputDir: "dist" };
+}
+function nextServe(configSource) {
+  const src = configSource ?? "";
+  return /output\s*:\s*["'`]export["'`]/.test(src) ? { mode: "static", outputDir: "out" } : CONTAINER;
+}
+function read(dir, file) {
+  const p = (0, import_node_path.join)(dir, file);
+  return (0, import_node_fs.existsSync)(p) ? (0, import_node_fs.readFileSync)(p, "utf8") : null;
+}
+function has(dir, file) {
+  return (0, import_node_fs.existsSync)((0, import_node_path.join)(dir, file));
+}
+var SDK_SECRETS = {
+  stripe: "STRIPE_SECRET_KEY",
+  openai: "OPENAI_API_KEY",
+  "@anthropic-ai/sdk": "ANTHROPIC_API_KEY",
+  "@google/generative-ai": "GEMINI_API_KEY",
+  resend: "RESEND_API_KEY",
+  "@sendgrid/mail": "SENDGRID_API_KEY",
+  twilio: "TWILIO_AUTH_TOKEN",
+  "aws-sdk": "AWS_ACCESS_KEY_ID"
+};
+function detectStack(dir) {
+  const notes = [];
+  const pkg = read(dir, "package.json");
+  if (pkg) return detectNode(dir, pkg, notes);
+  if (has(dir, "requirements.txt") || has(dir, "pyproject.toml") || has(dir, "manage.py"))
+    return detectPython(dir, notes);
+  if (has(dir, "go.mod")) return detectGo(notes);
+  if (has(dir, "Gemfile")) return detectRuby(dir, notes);
+  if (has(dir, "composer.json")) return detectPhp(dir, notes);
+  if (has(dir, "index.html")) return staticSite(notes);
+  notes.push("No recognized manifest \u2014 treating as a static site.");
+  return staticSite(notes);
+}
+function detectNode(dir, pkgRaw, notes) {
+  let pkg = {};
+  try {
+    pkg = JSON.parse(pkgRaw);
+  } catch {
+    notes.push("package.json is not valid JSON.");
+  }
+  const deps = { ...pkg.dependencies || {}, ...pkg.devDependencies || {} };
+  const scripts = pkg.scripts || {};
+  const dep = (n) => n in deps;
+  const language = dep("typescript") || has(dir, "tsconfig.json") ? "TypeScript" : "JavaScript";
+  const pm = has(dir, "pnpm-lock.yaml") ? "pnpm" : has(dir, "yarn.lock") ? "yarn" : has(dir, "bun.lockb") ? "bun" : "npm";
+  const installCommand = installFor(pm, has(dir, "package-lock.json"));
+  let framework = "Node";
+  let buildCommand = scripts.build ? `${pm} run build` : null;
+  let startCommand = scripts.start ? `${pm} start` : "node index.js";
+  let port = 3e3;
+  let serve = CONTAINER;
+  if (dep("next")) {
+    framework = "Next.js";
+    buildCommand = `${pm} run build`;
+    startCommand = `${pm} start`;
+    serve = nextServe(nextConfig(dir));
+  } else if (dep("@remix-run/node") || dep("@remix-run/react")) {
+    framework = "Remix";
+    buildCommand = `${pm} run build`;
+    startCommand = `${pm} start`;
+  } else if (dep("nuxt")) {
+    framework = "Nuxt";
+    buildCommand = `${pm} run build`;
+    startCommand = "node .output/server/index.mjs";
+  } else if (dep("@sveltejs/kit")) {
+    framework = "SvelteKit";
+    buildCommand = `${pm} run build`;
+    startCommand = "node build";
+  } else if (dep("astro")) {
+    framework = "Astro";
+    buildCommand = `${pm} run build`;
+    startCommand = "node ./dist/server/entry.mjs";
+    port = 4321;
+    serve = astroServe(astroConfig(dir));
+  } else if (dep("@nestjs/core")) {
+    framework = "NestJS";
+    buildCommand = `${pm} run build`;
+    startCommand = "node dist/main.js";
+  } else if (dep("vite")) {
+    framework = "Vite (SPA)";
+    buildCommand = `${pm} run build`;
+    startCommand = "(static)";
+    port = 80;
+    serve = { mode: "static", outputDir: "dist" };
+    notes.push("SPA \u2014 served as static assets behind the CDN.");
+  } else if (dep("react-scripts")) {
+    framework = "Create React App";
+    buildCommand = `${pm} run build`;
+    startCommand = "(static)";
+    port = 80;
+    serve = { mode: "static", outputDir: "build" };
+  } else if (dep("express") || dep("fastify") || dep("koa")) {
+    framework = dep("express") ? "Express" : dep("fastify") ? "Fastify" : "Koa";
+  }
+  let engine = null;
+  let via = null;
+  if (dep("@prisma/client") || dep("prisma") || has(dir, "prisma/schema.prisma")) {
+    via = "Prisma";
+    engine = prismaEngine(dir) ?? "postgres";
+  } else if (dep("drizzle-orm")) {
+    via = "Drizzle";
+    engine = dep("mysql2") ? "mysql" : dep("better-sqlite3") ? "sqlite" : "postgres";
+  } else if (dep("mongoose")) {
+    via = "Mongoose";
+    engine = "mongodb";
+  } else if (dep("typeorm")) {
+    via = "TypeORM";
+    engine = dep("mysql2") || dep("mysql") ? "mysql" : "postgres";
+  } else if (dep("sequelize")) {
+    via = "Sequelize";
+    engine = dep("mysql2") || dep("mysql") ? "mysql" : "postgres";
+  } else if (dep("pg") || dep("postgres")) {
+    via = "pg";
+    engine = "postgres";
+  } else if (dep("mysql2") || dep("mysql")) {
+    via = "mysql";
+    engine = "mysql";
+  }
+  const cache = dep("redis") || dep("ioredis") ? "redis" : null;
+  const secretsNeeded = Object.keys(SDK_SECRETS).filter(dep).map((k) => SDK_SECRETS[k]);
+  const nodeMajor = pkg.engines?.node?.match(/\d+/)?.[0] ?? "22";
+  return {
+    language,
+    framework,
+    packageManager: pm,
+    runtime: `node:${nodeMajor}`,
+    installCommand,
+    buildCommand,
+    startCommand,
+    port,
+    database: { engine, via },
+    cache,
+    secretsNeeded,
+    serve,
+    confidence: framework === "Node" ? 0.6 : 0.95,
+    notes
+  };
+}
+function nextConfig(dir) {
+  for (const f of ["next.config.js", "next.config.mjs", "next.config.ts"]) {
+    const s = read(dir, f);
+    if (s) return s;
+  }
+  return null;
+}
+function astroConfig(dir) {
+  for (const f of ["astro.config.mjs", "astro.config.js", "astro.config.ts"]) {
+    const s = read(dir, f);
+    if (s) return s;
+  }
+  return null;
+}
+function prismaEngine(dir) {
+  const s = read(dir, "prisma/schema.prisma");
+  if (!s) return null;
+  const p = s.match(/provider\s*=\s*"(\w+)"/)?.[1];
+  return p === "postgresql" ? "postgres" : p === "mysql" ? "mysql" : p === "sqlite" ? "sqlite" : p === "mongodb" ? "mongodb" : "postgres";
+}
+function detectPython(dir, notes) {
+  const reqs = (read(dir, "requirements.txt") || "") + (read(dir, "pyproject.toml") || "");
+  const m = (s) => new RegExp(s, "i").test(reqs);
+  let framework = "Python";
+  let startCommand = "python app.py";
+  let port = 8e3;
+  if (has(dir, "manage.py") || m("django")) {
+    framework = "Django";
+    startCommand = "gunicorn ${MODULE}.wsgi --bind 0.0.0.0:8000";
+    notes.push("Set ${MODULE} to your Django project package.");
+  } else if (m("fastapi")) {
+    framework = "FastAPI";
+    startCommand = "uvicorn main:app --host 0.0.0.0 --port 8000";
+  } else if (m("flask")) {
+    framework = "Flask";
+    startCommand = "gunicorn app:app --bind 0.0.0.0:8000";
+  }
+  let engine = null;
+  let via = null;
+  if (m("psycopg") || m("django")) {
+    engine = "postgres";
+    via = m("psycopg") ? "psycopg" : "Django ORM";
+  } else if (m("sqlalchemy")) {
+    engine = "postgres";
+    via = "SQLAlchemy";
+  } else if (m("pymysql") || m("mysqlclient")) {
+    engine = "mysql";
+    via = "mysql";
+  } else if (m("pymongo")) {
+    engine = "mongodb";
+    via = "pymongo";
+  }
+  const cache = m("redis") ? "redis" : null;
+  const secretsNeeded = [];
+  if (m("openai")) secretsNeeded.push("OPENAI_API_KEY");
+  if (m("stripe")) secretsNeeded.push("STRIPE_SECRET_KEY");
+  return {
+    language: "Python",
+    framework,
+    packageManager: "pip",
+    runtime: `python:${RUNTIME_VERSIONS.python}`,
+    installCommand: "pip install --no-cache-dir -r requirements.txt",
+    buildCommand: null,
+    startCommand,
+    port,
+    database: { engine, via },
+    cache,
+    secretsNeeded,
+    serve: CONTAINER,
+    confidence: framework === "Python" ? 0.6 : 0.9,
+    notes
+  };
+}
+function detectGo(notes) {
+  return { language: "Go", framework: "Go", packageManager: "go", runtime: "golang:1.22", installCommand: "go mod download", buildCommand: "go build -o server ./...", startCommand: "./server", port: 8080, database: { engine: null, via: null }, cache: null, secretsNeeded: [], serve: CONTAINER, confidence: 0.75, notes };
+}
+function detectRuby(dir, notes) {
+  const rails = (read(dir, "Gemfile") || "").match(/rails/i) != null;
+  return { language: "Ruby", framework: rails ? "Rails" : "Ruby", packageManager: "bundler", runtime: "ruby:3.3", installCommand: "bundle install", buildCommand: rails ? "bundle exec rails assets:precompile" : null, startCommand: rails ? "bundle exec rails server -b 0.0.0.0" : "ruby app.rb", port: 3e3, database: { engine: rails ? "postgres" : null, via: rails ? "ActiveRecord" : null }, cache: null, secretsNeeded: [], serve: CONTAINER, confidence: rails ? 0.9 : 0.6, notes };
+}
+function detectPhp(dir, notes) {
+  const laravel = (read(dir, "composer.json") || "").match(/laravel\/framework/i) != null;
+  return { language: "PHP", framework: laravel ? "Laravel" : "PHP", packageManager: "composer", runtime: "php:8.3", installCommand: "composer install --no-dev", buildCommand: null, startCommand: laravel ? "php artisan serve --host 0.0.0.0 --port 8000" : "php -S 0.0.0.0:8000", port: 8e3, database: { engine: laravel ? "mysql" : null, via: laravel ? "Eloquent" : null }, cache: null, secretsNeeded: [], serve: CONTAINER, confidence: laravel ? 0.9 : 0.6, notes };
+}
+function staticSite(notes) {
+  return { language: "Static", framework: "Static site", packageManager: null, runtime: "nginx", installCommand: null, buildCommand: null, startCommand: "(nginx)", port: 80, database: { engine: null, via: null }, cache: null, secretsNeeded: [], serve: { mode: "static", outputDir: "." }, confidence: 0.8, notes };
+}
+function dockerfile(s) {
+  if (s.runtime.startsWith("node")) return nodeDockerfile(s);
+  if (s.runtime.startsWith("python")) return pythonDockerfile(s);
+  if (s.runtime === "nginx") return `FROM nginx:alpine
+COPY . /usr/share/nginx/html
+EXPOSE 80
+`;
+  const v = s.runtime.split(":")[1] ?? "latest";
+  const base = s.runtime.split(":")[0];
+  return `FROM ${base}:${v}
+WORKDIR /app
+COPY . .
+${s.installCommand ? `RUN ${s.installCommand}
+` : ""}${s.buildCommand ? `RUN ${s.buildCommand}
+` : ""}ENV PORT=${s.port}
+EXPOSE ${s.port}
+CMD ${s.startCommand}
+`;
+}
+function nodeDockerfile(s) {
+  const v = s.runtime.split(":")[1];
+  return [
+    `FROM node:${v}-slim AS deps`,
+    `WORKDIR /app`,
+    `COPY package*.json pnpm-lock.yaml* yarn.lock* ./`,
+    `RUN ${s.installCommand}`,
+    ``,
+    `FROM node:${v}-slim AS build`,
+    `WORKDIR /app`,
+    `COPY --from=deps /app/node_modules ./node_modules`,
+    `COPY . .`,
+    s.buildCommand ? `RUN ${s.buildCommand}` : `# no build step`,
+    ``,
+    `FROM node:${v}-slim`,
+    `WORKDIR /app`,
+    `ENV NODE_ENV=production PORT=${s.port}`,
+    `COPY --from=build /app ./`,
+    `EXPOSE ${s.port}`,
+    `CMD ["sh","-c","${s.startCommand}"]`,
+    ``
+  ].join("\n");
+}
+function pythonDockerfile(s) {
+  const v = s.runtime.split(":")[1];
+  return [
+    `FROM python:${v}-slim`,
+    `WORKDIR /app`,
+    `COPY requirements.txt ./`,
+    `RUN ${s.installCommand}`,
+    `COPY . .`,
+    `ENV PORT=${s.port}`,
+    `EXPOSE ${s.port}`,
+    `CMD ["sh","-c","${s.startCommand}"]`,
+    ``
+  ].join("\n");
+}
+function provisionPlan(s) {
+  const plan = [];
+  if (s.database.engine) plan.push(`Provision ${s.database.engine} (detected via ${s.database.via})`);
+  if (s.cache) plan.push(`Provision ${s.cache} cache`);
+  plan.push("Wire managed auth (Identity Platform)");
+  plan.push("Wire transactional email + object storage + CDN");
+  plan.push("Embed analytics (PostHog)");
+  plan.push("Apply security baseline (secret scan, rate limits, WAF)");
+  plan.push("Enable daily backups");
+  if (s.secretsNeeded.length) plan.push(`Ask user for secrets: ${s.secretsNeeded.join(", ")}`);
+  plan.push(`Deploy to Cloud Run on :${s.port} \u2192 <slug>.supersonic.cv`);
+  return plan;
+}
+function cloneToTemp(url) {
+  const dir = (0, import_node_fs.mkdtempSync)((0, import_node_path.join)((0, import_node_os.tmpdir)(), "ss-"));
+  (0, import_node_child_process.execSync)(`git clone --depth 1 ${url} ${dir}`, { stdio: "pipe" });
+  return dir;
+}
+function printSummary(stack) {
+  const line = "\u2500".repeat(52);
+  const db = stack.database.engine ? `${stack.database.engine} (${stack.database.via})` : "none";
+  console.log(line);
+  console.log(`  DETECTED   ${stack.framework}  \xB7  ${stack.language}  \xB7  ${Math.round(stack.confidence * 100)}% confidence`);
+  console.log(line);
+  console.log(`  runtime    ${stack.runtime}`);
+  if (stack.packageManager) console.log(`  pkg mgr    ${stack.packageManager}`);
+  if (stack.installCommand) console.log(`  install    ${stack.installCommand}`);
+  if (stack.buildCommand) console.log(`  build      ${stack.buildCommand}`);
+  console.log(`  start      ${stack.startCommand}`);
+  console.log(`  port       ${stack.port}`);
+  console.log(`  database   ${db}`);
+  if (stack.cache) console.log(`  cache      ${stack.cache}`);
+  console.log(`  secrets    ${stack.secretsNeeded.length ? stack.secretsNeeded.join(", ") : "none needed"}`);
+  if (stack.notes.length) stack.notes.forEach((n) => console.log(`  note       ${n}`));
+  console.log(line);
+  console.log("  PROVISION PLAN");
+  provisionPlan(stack).forEach((p, i) => console.log(`   ${String(i + 1).padStart(2, "0")}  ${p}`));
+  console.log(line);
+}
+function main() {
+  const args = process.argv.slice(2);
+  const target = args.find((a) => !a.startsWith("--")) ?? ".";
+  let dir = target;
+  if (/^(https?:\/\/|git@)/.test(target)) {
+    try {
+      dir = cloneToTemp(target);
+    } catch (e) {
+      console.error(`Clone failed: ${e.message}`);
+      process.exit(1);
+    }
+  }
+  if (!(0, import_node_fs.existsSync)(dir)) {
+    console.error(`Path not found: ${dir}`);
+    process.exit(1);
+  }
+  const stack = detectStack(dir);
+  if (args.includes("--api")) {
+    process.stdout.write(JSON.stringify({ stack, provisionPlan: provisionPlan(stack) }));
+    return;
+  }
+  if (args.includes("--emit")) {
+    process.stdout.write(dockerfile(stack));
+    return;
+  }
+  printSummary(stack);
+  if (args.includes("--dockerfile")) {
+    console.log("\nDockerfile\n" + "\u2500".repeat(52) + "\n" + dockerfile(stack));
+  }
+  if (args.includes("--json")) {
+    console.log("\n" + JSON.stringify({ stack, dockerfile: dockerfile(stack), provisionPlan: provisionPlan(stack) }, null, 2));
+  }
+}
+if (import_meta.url === (0, import_node_url.pathToFileURL)(process.argv[1] ?? "").href) main();
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  astroServe,
+  detectStack,
+  dockerfile,
+  installFor,
+  nextServe,
+  provisionPlan
+});