@vercel/container 0.0.0 → 0.0.2

package/dist/index.js

@@ -0,0 +1,1680 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  build: () => build,
+  prepareCache: () => prepareCache,
+  startDevServer: () => startDevServer,
+  version: () => version
+});
+module.exports = __toCommonJS(src_exports);
+var import_node_fs6 = require("fs");
+var import_node_path6 = __toESM(require("path"));
+
+// src/util.ts
+var import_build_utils = require("@vercel/build-utils");
+var import_node_child_process = require("child_process");
+var import_node_crypto = require("crypto");
+var import_node_fs = require("fs");
+var import_node_os = require("os");
+var import_node_path = require("path");
+var DEBUG = Boolean((0, import_build_utils.getPlatformEnv)("BUILDER_DEBUG"));
+function write(line) {
+  process.stderr.write(`${line}
+`);
+}
+function info(message) {
+  write(`\u25B2 container  ${message}`);
+}
+function step(message) {
+  write(`  \u2192 ${message}`);
+}
+function done(message) {
+  write(`  \u2713 ${message}`);
+}
+function debug(message) {
+  if (DEBUG) {
+    write(`  \xB7 ${message}`);
+  }
+}
+function elapsed(since) {
+  return `${((Date.now() - since) / 1e3).toFixed(1)}s`;
+}
+function shortDigest(digest) {
+  return digest.startsWith("sha256:") ? `${digest.slice(0, 19)}\u2026` : digest;
+}
+async function withSpan(parent, name, attrs, fn) {
+  if (!parent) {
+    return fn(void 0);
+  }
+  return parent.child(name, attrs).trace((span) => fn(span));
+}
+function toTag(value) {
+  return String(value);
+}
+function readString(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function run(cmd, args, opts = {}) {
+  return new Promise((resolve, reject) => {
+    const child = (0, import_node_child_process.spawn)(cmd, args, {
+      cwd: opts.cwd,
+      stdio: [opts.input !== void 0 ? "pipe" : "ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.on("data", (chunk) => {
+      const text = chunk.toString();
+      stdout += text;
+      if (!opts.quiet) {
+        process.stderr.write(text);
+      }
+    });
+    child.stderr?.on("data", (chunk) => {
+      const text = chunk.toString();
+      stderr += text;
+      if (!opts.quiet) {
+        process.stderr.write(text);
+      }
+    });
+    child.on("error", (err) => {
+      if (err.code === "ENOENT") {
+        reject(
+          new Error(
+            `Command not found: \`${cmd}\`. Ensure \`${cmd}\` is installed and on your PATH.`
+          )
+        );
+        return;
+      }
+      reject(err);
+    });
+    child.on("close", (code) => {
+      if (code === 0) {
+        resolve({ stdout, stderr });
+      } else {
+        const detail = stderr.trim().split("\n").slice(-5).join("\n");
+        reject(
+          new Error(
+            `\`${cmd} ${args.join(" ")}\` exited with code ${code}` + (detail ? `
+${detail}` : "")
+          )
+        );
+      }
+    });
+    if (opts.input !== void 0) {
+      child.stdin?.end(opts.input);
+    }
+  });
+}
+function extractField(text, label) {
+  const match = text.match(new RegExp(`^\\s*${label}:\\s*(.+)$`, "m"));
+  return match?.[1]?.trim();
+}
+function tokenFingerprint(token) {
+  if (!token)
+    return "absent";
+  const sha = (0, import_node_crypto.createHash)("sha256").update(token).digest("hex").slice(0, 8);
+  return `present(len=${token.length}, sha256=${sha})`;
+}
+function debugTokenClaims(label, token) {
+  if (!DEBUG)
+    return;
+  if (!token) {
+    debug(`${label}: <absent>`);
+    return;
+  }
+  try {
+    const payload = token.split(".")[1];
+    if (!payload) {
+      debug(`${label}: <not a JWT>`);
+      return;
+    }
+    const claims = JSON.parse(
+      Buffer.from(payload, "base64url").toString("utf8")
+    );
+    const safe = {
+      iss: claims.iss,
+      aud: claims.aud,
+      sub: claims.sub,
+      scope: claims.scope,
+      owner: claims.owner,
+      owner_id: claims.owner_id,
+      project: claims.project,
+      project_id: claims.project_id,
+      exp: typeof claims.exp === "number" ? `${new Date(claims.exp * 1e3).toISOString()} (in ${Math.round(
+        (claims.exp * 1e3 - Date.now()) / 1e3
+      )}s)` : claims.exp
+    };
+    debug(`${label}: ${JSON.stringify(safe)}`);
+  } catch (err) {
+    debug(`${label}: <unparseable claims> (${err.message})`);
+  }
+}
+function decodeOidcClaims(token) {
+  if (!token)
+    return {};
+  try {
+    const payload = token.split(".")[1];
+    if (!payload)
+      return {};
+    const json = Buffer.from(payload, "base64url").toString("utf8");
+    return JSON.parse(json);
+  } catch {
+    return {};
+  }
+}
+function isBuildContainer() {
+  return Boolean(readString(process.env.VERCEL_BUILD_IMAGE));
+}
+function existingRegistryAuthFile() {
+  const explicit = readString(process.env.REGISTRY_AUTH_FILE);
+  if (explicit) {
+    return (0, import_node_fs.existsSync)(explicit) ? explicit : void 0;
+  }
+  const fromXdg = readString(process.env.XDG_CONFIG_HOME);
+  const configHome = fromXdg || (0, import_node_path.join)((0, import_node_os.homedir)(), ".config");
+  const defaultPath = (0, import_node_path.join)(configHome, "containers", "auth.json");
+  return (0, import_node_fs.existsSync)(defaultPath) ? defaultPath : void 0;
+}
+
+// src/engines/buildah.ts
+var import_node_fs3 = require("fs");
+var import_node_os3 = require("os");
+var import_node_path3 = require("path");
+
+// src/storage-driver.ts
+var import_node_fs2 = require("fs");
+var import_node_os2 = require("os");
+var import_node_path2 = require("path");
+var BUILDAH_GRAPH_ROOT = "/vercel/.containers/storage";
+var BUILDAH_RUN_ROOT = "/run/containers/storage";
+var REQUIRED_BUILD_CONTAINER_DRIVER = "overlay";
+async function hasBinary(name) {
+  try {
+    await run("which", [name], { quiet: true });
+    return true;
+  } catch {
+    return false;
+  }
+}
+var cachedStorageDriver;
+function selectStorageDriver() {
+  if (!cachedStorageDriver) {
+    cachedStorageDriver = (async () => {
+      const override = readString(process.env.VERCEL_VCR_DOCKER_STORAGE_DRIVER);
+      if (override) {
+        return override;
+      }
+      if (isBuildContainer()) {
+        return void 0;
+      }
+      if (await hasBinary("fuse-overlayfs") && (0, import_node_fs2.existsSync)("/dev/fuse")) {
+        return "fuse-overlayfs";
+      }
+      return "vfs";
+    })();
+  }
+  return cachedStorageDriver;
+}
+var BUILDAH_REGISTRIES_CONF = `unqualified-search-registries = ["docker.io"]
+short-name-mode = "permissive"
+`;
+var cachedRegistriesConfPath;
+function buildahRegistriesConfPath() {
+  if (!cachedRegistriesConfPath) {
+    const dir = (0, import_node_fs2.mkdtempSync)((0, import_node_path2.join)((0, import_node_os2.tmpdir)(), "vercel-container-registries-"));
+    cachedRegistriesConfPath = (0, import_node_path2.join)(dir, "registries.conf");
+    (0, import_node_fs2.writeFileSync)(cachedRegistriesConfPath, BUILDAH_REGISTRIES_CONF);
+  }
+  return cachedRegistriesConfPath;
+}
+async function buildahStorageArgs() {
+  const driver = await selectStorageDriver();
+  const rootArgs = isBuildContainer() ? ["--root", BUILDAH_GRAPH_ROOT, "--runroot", BUILDAH_RUN_ROOT] : [];
+  const registriesArgs = [
+    "--registries-conf",
+    buildahRegistriesConfPath()
+  ];
+  if (!driver) {
+    return [...rootArgs, ...registriesArgs];
+  }
+  if (driver === "fuse-overlayfs") {
+    return [
+      ...rootArgs,
+      ...registriesArgs,
+      "--storage-driver",
+      "overlay",
+      "--storage-opt",
+      "overlay.mount_program=/usr/bin/fuse-overlayfs"
+    ];
+  }
+  return [...rootArgs, ...registriesArgs, "--storage-driver", driver];
+}
+async function readBuildahStoreInfo() {
+  const args = await buildahStorageArgs();
+  const { stdout } = await run("buildah", [...args, "info"], { quiet: true });
+  const store = JSON.parse(stdout).store;
+  if (!store) {
+    return void 0;
+  }
+  const graphStatus = store.GraphStatus;
+  return {
+    graphRoot: String(store.GraphRoot ?? ""),
+    runRoot: String(store.RunRoot ?? ""),
+    driver: String(store.GraphDriverName ?? ""),
+    backingFs: String(
+      graphStatus?.["Backing Filesystem"] ?? graphStatus?.["Backing filesystem"] ?? ""
+    )
+  };
+}
+async function assertBuildContainerStorage(log = () => {
+}) {
+  if (!isBuildContainer()) {
+    return;
+  }
+  if (readString(process.env.VERCEL_VCR_DOCKER_STORAGE_DRIVER)) {
+    return;
+  }
+  const strict = Boolean(readString(process.env.VERCEL_VCR_STRICT_STORAGE));
+  let storeInfo;
+  try {
+    storeInfo = await readBuildahStoreInfo();
+  } catch (err) {
+    const message = `Could not verify buildah storage via \`buildah info\`: ${err.message}`;
+    if (strict) {
+      throw new Error(message);
+    }
+    log(message);
+    return;
+  }
+  if (!storeInfo) {
+    const message = "Could not verify buildah storage: `buildah info` returned no store data.";
+    if (strict) {
+      throw new Error(message);
+    }
+    log(message);
+    return;
+  }
+  const problems = [];
+  if (storeInfo.driver !== REQUIRED_BUILD_CONTAINER_DRIVER) {
+    problems.push(
+      `storage driver is "${storeInfo.driver}", expected "${REQUIRED_BUILD_CONTAINER_DRIVER}"`
+    );
+  }
+  if (storeInfo.graphRoot !== BUILDAH_GRAPH_ROOT) {
+    problems.push(
+      `graphRoot is "${storeInfo.graphRoot}", expected the mounted volume "${BUILDAH_GRAPH_ROOT}"`
+    );
+  }
+  if (storeInfo.backingFs && storeInfo.backingFs === "overlayfs") {
+    problems.push(
+      `backing filesystem is "${storeInfo.backingFs}" (the overlay rootfs), not the mounted volume`
+    );
+  }
+  const summary = `buildah storage: driver=${storeInfo.driver} graphRoot=${storeInfo.graphRoot} runRoot=${storeInfo.runRoot} backingFs=${storeInfo.backingFs || "?"}`;
+  if (problems.length === 0) {
+    log(`${summary} \u2014 verified`);
+    return;
+  }
+  const detail = `${summary}
+Problems: ${problems.join("; ")}.
+Expected the native overlay driver with the graphroot under the XFS \`/vercel\` cell volume (requires vercel/hive#2310 capabilities + the storage.conf from vercel/api#76567).`;
+  if (strict) {
+    throw new Error(
+      `Container build storage is not configured as intended.
+${detail}`
+    );
+  }
+  log(
+    `${detail}
+Continuing (set VERCEL_VCR_STRICT_STORAGE=1 to fail builds).`
+  );
+}
+
+// src/oidc.ts
+function parseOidcToken(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    throw new Error(
+      "VERCEL_OIDC_TOKEN is not a valid JWT (expected 3 dot-separated segments)."
+    );
+  }
+  try {
+    const json = Buffer.from(parts[1], "base64url").toString("utf8");
+    return JSON.parse(json);
+  } catch {
+    throw new Error("VERCEL_OIDC_TOKEN has an unreadable JWT payload.");
+  }
+}
+function resolveProjectContext(token) {
+  const claims = parseOidcToken(token);
+  return {
+    projectId: readString(process.env.VERCEL_PROJECT_ID) ?? claims.project_id,
+    teamId: readString(process.env.VERCEL_TEAM_ID) ?? readString(process.env.VERCEL_ORG_ID) ?? claims.owner_id
+  };
+}
+async function mintProjectOidcToken(params) {
+  const apiUrl = (readString(process.env.VERCEL_API_URL) ?? "https://api.vercel.com").replace(/\/+$/, "");
+  const query = new URLSearchParams({ source: "vercel-container-build" });
+  if (params.teamId) {
+    query.set("teamId", params.teamId);
+  }
+  const url = `${apiUrl}/v1/projects/${encodeURIComponent(params.projectId)}/token?${query}`;
+  debug(`OIDC mint: POST ${url}`);
+  const res = await fetch(url, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${params.authToken}`,
+      "content-type": "application/json"
+    }
+  });
+  if (!res.ok) {
+    const body = (await res.text()).trim();
+    throw new Error(
+      `Failed to mint OIDC token: HTTP ${res.status}` + (body ? ` \u2014 ${body.split("\n").slice(-3).join("\n")}` : "")
+    );
+  }
+  const payload = await res.json();
+  if (!payload.token) {
+    throw new Error("Failed to mint OIDC token: response missing `token`.");
+  }
+  return payload.token;
+}
+async function resolveOidcTokenForBuild(span) {
+  const existing = readString(process.env.VERCEL_OIDC_TOKEN);
+  if (!existing) {
+    throw new Error(
+      "Missing VERCEL_OIDC_TOKEN for the container registry (set by the platform or `vercel pull`)."
+    );
+  }
+  const authToken = readString(process.env.VERCEL_TOKEN);
+  if (!authToken) {
+    debug(
+      "No VERCEL_TOKEN available to mint; using existing VERCEL_OIDC_TOKEN"
+    );
+    span?.setAttributes({ "oidc.mint_result": "reused_existing" });
+    debug(`registry token: ${tokenFingerprint(existing)}`);
+    return existing;
+  }
+  const { projectId, teamId } = resolveProjectContext(existing);
+  if (!projectId) {
+    debug("No project id available to mint; using existing VERCEL_OIDC_TOKEN");
+    span?.setAttributes({ "oidc.mint_result": "reused_existing" });
+    return existing;
+  }
+  step("Minting fresh OIDC token for container registry");
+  let token;
+  try {
+    token = await mintProjectOidcToken({
+      projectId,
+      teamId,
+      authToken
+    });
+  } catch (err) {
+    debug(`OIDC mint failed, using existing token: ${err.message}`);
+    span?.setAttributes({ "oidc.mint_result": "failed_reused_existing" });
+    return existing;
+  }
+  process.env.VERCEL_OIDC_TOKEN = token;
+  span?.setAttributes({
+    "oidc.mint_result": "minted",
+    "project.id": projectId,
+    ...teamId ? { "team.id": teamId } : {}
+  });
+  done("OIDC token minted");
+  debug(`registry token: ${tokenFingerprint(token)}`);
+  return token;
+}
+function formatVcrAuthError(registry, username, detail) {
+  return [
+    `Authentication to ${registry} as "${username}" was rejected.`,
+    "",
+    `Make sure your team ("${username}") is enrolled in the`,
+    "`vercel-enable-vcr` flag and that the OIDC token is valid for it.",
+    ...detail ? ["", detail] : []
+  ].join("\n");
+}
+
+// src/engines/types.ts
+var VCR_REGISTRY = process.env.VERCEL_VCR_REGISTRY || "vcr.vercel.com";
+var TARGET_PLATFORM = "linux/amd64";
+function buildArgFlags(params) {
+  const flags = [];
+  for (const [key, value] of Object.entries(params.buildArgs ?? {})) {
+    flags.push("--build-arg", `${key}=${value}`);
+  }
+  return flags;
+}
+
+// src/engines/buildah.ts
+async function runBuildah(args, opts = {}) {
+  const storageArgs = await buildahStorageArgs();
+  const fullArgs = [...storageArgs, ...args];
+  debug(`exec: buildah ${fullArgs.join(" ")}`);
+  return run("buildah", fullArgs, opts);
+}
+function logLayerCacheSummary(output) {
+  const steps = (output.match(/^STEP\s+\d+\/\d+:/gm) || []).length;
+  const cached = (output.match(/-->\s+Using cache\b/gi) || []).length;
+  if (steps === 0) {
+    return;
+  }
+  const built = Math.max(steps - cached, 0);
+  info(`layer cache: ${cached}/${steps} steps reused, ${built} rebuilt`);
+}
+var buildahEngine = {
+  name: "buildah",
+  async ensureReady(span) {
+    try {
+      const storageDriver = await selectStorageDriver();
+      const { stdout } = await runBuildah(["--version"], { quiet: true });
+      span?.setAttributes({
+        "buildah.version": stdout.trim().split("\n")[0],
+        "buildah.storage_driver": storageDriver ?? "storage.conf"
+      });
+    } catch (err) {
+      const message = err.message;
+      if (/Command not found/i.test(message)) {
+        throw new Error(
+          isBuildContainer() ? "The `buildah` CLI is not available in this build container. Install buildah (via SPAL) in the build image." : "Buildah was not found on your PATH. Install buildah or run the build on Vercel where the build container provides it."
+        );
+      }
+      throw err;
+    }
+  },
+  async logDiagnostics(span) {
+    try {
+      const storageDriver = await selectStorageDriver();
+      const version2 = (await runBuildah(["--version"], { quiet: true })).stdout.trim();
+      info(
+        `buildah: ${version2.split("\n")[0] ?? version2} (storage-driver=${storageDriver ?? "storage.conf"})`
+      );
+      span?.setAttributes({
+        "container.engine": "buildah",
+        "buildah.version": toTag(version2.split("\n")[0]),
+        "buildah.storage_driver": toTag(storageDriver ?? "storage.conf")
+      });
+    } catch (err) {
+      debug(`buildah diagnostics unavailable: ${err.message}`);
+    }
+  },
+  async withRuntime(_span, fn) {
+    return fn();
+  },
+  async build(params) {
+    try {
+      const { stdout: stdout2 } = await runBuildah(["images", "--quiet"], {
+        quiet: true
+      });
+      const imageCount = stdout2.trim() ? stdout2.trim().split("\n").length : 0;
+      info(
+        imageCount > 0 ? `layer store: warm (${imageCount} image(s) present before build)` : "layer store: cold (no cached images; first build or cache miss)"
+      );
+    } catch (err) {
+      debug(`could not read store warmth: ${err.message}`);
+    }
+    const { stdout, stderr } = await runBuildah([
+      "build",
+      "--platform",
+      TARGET_PLATFORM,
+      // Commit and cache a layer per Dockerfile instruction so unchanged steps
+      // (base image, dependency installs, etc.) can be reused on later builds
+      // when the image store is warm. Without this buildah squashes the build
+      // and no per-step caching happens.
+      "--layers",
+      // Use the host network namespace for RUN steps. The build runs inside a
+      // restricted Hive cell that cannot program iptables, so buildah's default
+      // rootless networking (netavark) fails with
+      // "netavark: iptables ... Could not fetch rule set generation id".
+      // Host networking skips per-container network setup and reuses the cell's
+      // existing egress.
+      "--network",
+      "host",
+      ...buildArgFlags(params),
+      "-t",
+      params.imageRef,
+      "-f",
+      params.dockerfilePath,
+      params.contextDir
+    ]);
+    logLayerCacheSummary(`${stdout}
+${stderr}`);
+  },
+  async login(params) {
+    try {
+      await runBuildah(
+        [
+          "login",
+          params.registry,
+          "--username",
+          params.username,
+          "--password-stdin"
+        ],
+        { input: params.token, quiet: !DEBUG }
+      );
+    } catch (err) {
+      const message = err.message;
+      if (/denied|forbidden|unauthorized|401|403/i.test(message)) {
+        throw new Error(
+          formatVcrAuthError(
+            params.registry,
+            params.username,
+            `Underlying error: ${message}`
+          )
+        );
+      }
+      throw err;
+    }
+  },
+  async verifyStorage(span) {
+    await assertBuildContainerStorage((message) => {
+      info(message);
+      const info0 = message.split("\n")[0];
+      span?.setAttributes({ "buildah.storage.verify": info0 });
+    });
+  },
+  async reportStorage(span) {
+    if (!DEBUG) {
+      return;
+    }
+    try {
+      const storeInfo = await readBuildahStoreInfo();
+      if (!storeInfo) {
+        debug("buildah info: no `store` field in output");
+        return;
+      }
+      info(
+        `buildah storage: graphRoot=${storeInfo.graphRoot} runRoot=${storeInfo.runRoot} driver=${storeInfo.driver} backingFs=${storeInfo.backingFs || "?"}`
+      );
+      span?.setAttributes({
+        "buildah.storage.graph_root": storeInfo.graphRoot,
+        "buildah.storage.run_root": storeInfo.runRoot,
+        "buildah.storage.driver": storeInfo.driver,
+        "buildah.storage.backing_fs": storeInfo.backingFs
+      });
+    } catch (err) {
+      debug(`buildah storage report unavailable: ${err.message}`);
+    }
+  },
+  async push(params) {
+    const digestDir = (0, import_node_fs3.mkdtempSync)((0, import_node_path3.join)((0, import_node_os3.tmpdir)(), "vercel-container-digest-"));
+    const digestFile = (0, import_node_path3.join)(digestDir, "digest");
+    const zstdEnabled = !readString(process.env.VERCEL_VCR_DISABLE_ZSTD);
+    const zstdArgs = zstdEnabled ? [
+      "--compression-format",
+      "zstd",
+      "--compression-level",
+      "3",
+      "--force-compression",
+      "--format",
+      "oci"
+    ] : [];
+    info(
+      `pushing ${params.imageRef} ` + (zstdEnabled ? "with zstd compression (level=3, force, oci)" : "with default compression (zstd disabled)")
+    );
+    const pushStart = Date.now();
+    try {
+      await runBuildah([
+        "push",
+        ...zstdArgs,
+        "--digestfile",
+        digestFile,
+        params.imageRef
+      ]);
+      const digest = (0, import_node_fs3.readFileSync)(digestFile, "utf8").trim();
+      const resolved = digest.match(/sha256:[a-f0-9]{64}/)?.[0] ?? (digest || void 0);
+      debug(
+        `push completed in ${Date.now() - pushStart}ms` + (resolved ? ` (digest ${resolved})` : "")
+      );
+      return resolved;
+    } catch (err) {
+      const message = err.message;
+      if (/denied|forbidden|unauthorized|not found|401|403|404/i.test(message)) {
+        throw new Error(
+          [
+            `Pushing ${params.imageRef} was denied.`,
+            "",
+            `The build tried to ensure the "${params.repository}" repository exists, but`,
+            "the push was still rejected. Verify access (or create the repository under",
+            "your project's Sandboxes \u2192 Container Registry tab), then re-run the build.",
+            "",
+            `Underlying error: ${message}`
+          ].join("\n")
+        );
+      }
+      throw err;
+    } finally {
+      (0, import_node_fs3.rmSync)(digestDir, { recursive: true, force: true });
+    }
+  }
+};
+
+// src/engines/docker.ts
+var import_node_child_process2 = require("child_process");
+function runDocker(args, opts = {}) {
+  debug(`exec: docker ${args.join(" ")}`);
+  return run("docker", args, opts);
+}
+async function hasBinary2(name) {
+  try {
+    await run("which", [name], { quiet: true });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function isDockerDaemonReachable() {
+  try {
+    await run("docker", ["version", "--format", "{{.Server.Version}}"], {
+      quiet: true
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function tail(text, n = 12) {
+  return text.trim().split("\n").slice(-n).join("\n");
+}
+async function startDockerDaemon(span) {
+  const driver = await selectStorageDriver() ?? "vfs";
+  const args = ["--storage-driver", driver];
+  const extra = readString(process.env.VERCEL_VCR_DOCKERD_ARGS);
+  if (extra) {
+    args.push(...extra.split(" ").filter(Boolean));
+  }
+  span?.setAttributes({ "docker.storage_driver": driver });
+  step(`Starting Docker daemon (storage-driver=${driver})`);
+  debug(`exec: dockerd ${args.join(" ")}`);
+  const child = (0, import_node_child_process2.spawn)("dockerd", args, {
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  let log = "";
+  const capture = (chunk) => {
+    const text = chunk.toString();
+    log += text;
+    if (DEBUG) {
+      process.stderr.write(text);
+    }
+  };
+  child.stdout?.on("data", capture);
+  child.stderr?.on("data", capture);
+  let exitInfo;
+  child.on("exit", (code, signal) => {
+    exitInfo = `code=${code ?? "null"} signal=${signal ?? "null"}`;
+  });
+  const timeoutMs = Number(process.env.VERCEL_VCR_DOCKERD_TIMEOUT_MS) || 3e4;
+  const deadline = Date.now() + timeoutMs;
+  for (; ; ) {
+    if (exitInfo !== void 0) {
+      throw new Error(
+        [
+          `The Docker daemon exited before becoming ready (${exitInfo}).`,
+          "In a build container this usually means the environment is missing the",
+          `kernel capabilities dockerd needs, or the "${driver}" storage driver`,
+          "is unavailable. Override the storage driver with",
+          "VERCEL_VCR_DOCKER_STORAGE_DRIVER, or pass extra daemon flags with",
+          'VERCEL_VCR_DOCKERD_ARGS (e.g. "--iptables=false") for networking issues.',
+          "",
+          tail(log)
+        ].join("\n")
+      );
+    }
+    if (await isDockerDaemonReachable()) {
+      done("Docker daemon ready");
+      return { child, logTail: () => log };
+    }
+    if (Date.now() >= deadline) {
+      child.kill("SIGKILL");
+      throw new Error(
+        [
+          `The Docker daemon did not become ready within ${Math.round(
+            timeoutMs / 1e3
+          )}s.`,
+          "In a build container this usually means the environment is missing the",
+          `kernel capabilities dockerd needs, or the "${driver}" storage driver`,
+          "is unavailable. Override it with VERCEL_VCR_DOCKER_STORAGE_DRIVER.",
+          "",
+          tail(log)
+        ].join("\n")
+      );
+    }
+    await new Promise((resolve) => setTimeout(resolve, 500));
+  }
+}
+async function stopDockerDaemon(daemon, span) {
+  const { child } = daemon;
+  if (child.exitCode !== null || child.signalCode !== null) {
+    return;
+  }
+  step("Stopping Docker daemon");
+  const stopTimeoutMs = Number(process.env.VERCEL_VCR_DOCKERD_STOP_TIMEOUT_MS) || 1e4;
+  await new Promise((resolve) => {
+    let settled = false;
+    const finish = () => {
+      if (!settled) {
+        settled = true;
+        resolve();
+      }
+    };
+    child.once("exit", finish);
+    child.kill("SIGTERM");
+    setTimeout(() => {
+      try {
+        child.kill("SIGKILL");
+      } catch {
+      }
+      finish();
+    }, stopTimeoutMs).unref?.();
+  });
+  span?.setAttributes({ "docker.daemon_stopped": "true" });
+  done("Docker daemon stopped");
+}
+function detachDaemon(daemon) {
+  const { child } = daemon;
+  child.stdout?.removeAllListeners("data");
+  child.stderr?.removeAllListeners("data");
+  child.stdout?.destroy();
+  child.stderr?.destroy();
+  child.unref();
+}
+async function withManagedDaemon(span, fn) {
+  if (await isDockerDaemonReachable()) {
+    return fn();
+  }
+  if (!await hasBinary2("dockerd")) {
+    return fn();
+  }
+  const daemon = await withSpan(
+    span,
+    "container.start_daemon",
+    void 0,
+    (s) => startDockerDaemon(s)
+  );
+  try {
+    return await fn();
+  } finally {
+    if (isBuildContainer()) {
+      detachDaemon(daemon);
+    } else {
+      await withSpan(
+        span,
+        "container.stop_daemon",
+        void 0,
+        (s) => stopDockerDaemon(daemon, s)
+      );
+    }
+  }
+}
+var dockerEngine = {
+  name: "docker",
+  async ensureReady(span) {
+    try {
+      const { stdout } = await run(
+        "docker",
+        ["version", "--format", "{{.Server.Version}}"],
+        { quiet: true }
+      );
+      span?.setAttributes({ "docker.server_version": stdout.trim() });
+    } catch (err) {
+      const message = err.message;
+      const onVercel = isBuildContainer();
+      if (/Command not found/i.test(message)) {
+        throw new Error(
+          onVercel ? "The `docker` CLI is not available in this build container." : "Docker CLI was not found on your PATH. Install Docker and make sure the `docker` command is available so the container image can be built."
+        );
+      }
+      throw new Error(
+        (onVercel ? [
+          "The Docker daemon is not available in this build container.",
+          "",
+          "Container builds start and manage their own dockerd; not being able",
+          "to reach it points at a missing Docker install or insufficient kernel",
+          "capabilities in the build image rather than anything in your project."
+        ] : [
+          "Cannot connect to the Docker daemon \u2014 is Docker running?",
+          "",
+          "Start Docker (Docker Desktop, Colima, or OrbStack) and verify it with",
+          "`docker info`, then re-run the build."
+        ]).concat(["", `Underlying error: ${message}`]).join("\n")
+      );
+    }
+  },
+  async logDiagnostics(span) {
+    try {
+      const [version2, dockerInfo] = await Promise.all([
+        run("docker", ["version"], { quiet: true }).then((r) => r.stdout).catch(() => ""),
+        run("docker", ["info"], { quiet: true }).then((r) => r.stdout).catch(() => "")
+      ]);
+      const clientVersion = extractField(
+        version2.split(/^Server:/m)[0] ?? version2,
+        "Version"
+      );
+      const serverBlock = version2.split(/^Server:/m)[1] ?? "";
+      const serverVersion = extractField(serverBlock, "Version") ?? extractField(dockerInfo, "Server Version");
+      const storageDriver = extractField(dockerInfo, "Storage Driver");
+      info(
+        `docker: client=${clientVersion ?? "?"} server=${serverVersion ?? "?"} storage-driver=${storageDriver ?? "?"}`
+      );
+      debug(`--- docker version ---
+${version2.trim()}`);
+      span?.setAttributes({
+        "container.engine": "docker",
+        "docker.client_version": toTag(clientVersion),
+        "docker.server_version": toTag(serverVersion),
+        "docker.storage_driver": toTag(storageDriver)
+      });
+    } catch (err) {
+      debug(`docker diagnostics unavailable: ${err.message}`);
+    }
+  },
+  withRuntime: withManagedDaemon,
+  async build(params) {
+    await runDocker([
+      "build",
+      "--platform",
+      TARGET_PLATFORM,
+      ...buildArgFlags(params),
+      "-t",
+      params.imageRef,
+      "-f",
+      params.dockerfilePath,
+      params.contextDir
+    ]);
+  },
+  async login(params) {
+    try {
+      await runDocker(
+        [
+          "login",
+          params.registry,
+          "--username",
+          params.username,
+          "--password-stdin"
+        ],
+        { input: params.token, quiet: !DEBUG }
+      );
+    } catch (err) {
+      const message = err.message;
+      if (/denied|forbidden|unauthorized|401|403/i.test(message)) {
+        throw new Error(
+          formatVcrAuthError(
+            params.registry,
+            params.username,
+            `Underlying error: ${message}`
+          )
+        );
+      }
+      throw err;
+    }
+  },
+  async push(params) {
+    try {
+      info(`pushing ${params.imageRef}`);
+      const pushStart = Date.now();
+      const { stdout } = await runDocker(["push", params.imageRef]);
+      debug(`push completed in ${Date.now() - pushStart}ms`);
+      let resolvedDigest = stdout.match(/sha256:[a-f0-9]{64}/)?.[0];
+      if (!resolvedDigest) {
+        debug("digest not found in push output \u2014 inspecting RepoDigests");
+        const inspect = await run(
+          "docker",
+          ["inspect", "--format", "{{index .RepoDigests 0}}", params.imageRef],
+          { quiet: true }
+        );
+        resolvedDigest = inspect.stdout.match(/sha256:[a-f0-9]{64}/)?.[0];
+      }
+      return resolvedDigest;
+    } catch (err) {
+      const message = err.message;
+      if (/denied|forbidden|unauthorized|not found|401|403|404/i.test(message)) {
+        throw new Error(
+          [
+            `Pushing ${params.imageRef} was denied.`,
+            "",
+            `The build tried to ensure the "${params.repository}" repository exists, but`,
+            "the push was still rejected. Verify access (or create the repository under",
+            "your project's Sandboxes \u2192 Container Registry tab), then re-run the build.",
+            "",
+            `Underlying error: ${message}`
+          ].join("\n")
+        );
+      }
+      throw err;
+    }
+  }
+};
+
+// src/engines/index.ts
+function selectContainerEngine() {
+  const override = readString(
+    process.env.VERCEL_CONTAINER_ENGINE
+  )?.toLowerCase();
+  if (override === "buildah")
+    return buildahEngine;
+  if (override === "docker")
+    return dockerEngine;
+  return isBuildContainer() ? buildahEngine : dockerEngine;
+}
+
+// src/registry.ts
+async function ensureRepository(repository, token, claims, span) {
+  if (repository.includes("/")) {
+    debug(`skipping repository auto-create (fully-qualified "${repository}")`);
+    span?.setAttributes({ "repository.create_result": "skipped_qualified" });
+    return;
+  }
+  const teamId = claims.owner_id;
+  const projectId = claims.project_id;
+  if (!teamId || !projectId) {
+    debug(
+      `skipping repository auto-create (missing ${!teamId ? "team id" : "project id"})`
+    );
+    span?.setAttributes({
+      "repository.create_result": "skipped_missing_ids"
+    });
+    return;
+  }
+  span?.setAttributes({ "team.id": teamId, "project.id": projectId });
+  const apiUrl = (readString(process.env.VERCEL_API_URL) ?? "https://api.vercel.com").replace(/\/+$/, "");
+  const url = `${apiUrl}/v1/vcr/repository?teamId=${encodeURIComponent(teamId)}`;
+  const body = JSON.stringify({ name: repository, projectId });
+  step(`Ensuring registry repository "${repository}"`);
+  debug(`repository create: POST ${url}`);
+  try {
+    const res = await fetch(url, {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${token}`,
+        "content-type": "application/json"
+      },
+      body
+    });
+    span?.setAttributes({ "repository.create_status": toTag(res.status) });
+    if (res.ok) {
+      span?.setAttributes({ "repository.create_result": "created" });
+      done(`created repository "${repository}"`);
+    } else if (res.status === 409) {
+      span?.setAttributes({ "repository.create_result": "already_exists" });
+      done(`repository "${repository}" already exists`);
+    } else {
+      span?.setAttributes({ "repository.create_result": "unexpected_status" });
+      done("continuing \u2014 push will validate the repository");
+    }
+  } catch (err) {
+    debug(`repository auto-create failed: ${err.message}`);
+    span?.setAttributes({ "repository.create_result": "error" });
+    done("continuing \u2014 push will validate the repository");
+  }
+}
+
+// src/dev.ts
+var import_node_child_process3 = require("child_process");
+var import_node_fs4 = require("fs");
+var import_node_os4 = require("os");
+var import_node_path4 = __toESM(require("path"));
+var HOST_ONLY_ENV = /* @__PURE__ */ new Set([
+  "TMPDIR",
+  "TMP",
+  "TEMP",
+  "HOME",
+  "PATH",
+  "PWD",
+  "OLDPWD",
+  "SHELL",
+  "SHLVL",
+  "USER",
+  "LOGNAME",
+  "TERM",
+  "TERM_PROGRAM",
+  "TERM_PROGRAM_VERSION",
+  "TERM_SESSION_ID",
+  "COLORTERM",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "COMMAND_MODE",
+  "SECURITYSESSIONID",
+  "__CF_USER_TEXT_ENCODING",
+  "__CFBundleIdentifier"
+]);
+function isHostOnlyEnvVar(key) {
+  return HOST_ONLY_ENV.has(key) || key.startsWith("__") || key.startsWith("XPC_") || key.startsWith("SSH_") || key.startsWith("Apple");
+}
+function writeEnvFile(env) {
+  const dir = (0, import_node_fs4.mkdtempSync)(import_node_path4.default.join((0, import_node_os4.tmpdir)(), "vercel-container-dev-env-"));
+  const file = import_node_path4.default.join(dir, "env");
+  const lines = [];
+  for (const [key, value] of Object.entries(env)) {
+    if (value.includes("\n")) {
+      continue;
+    }
+    lines.push(`${key}=${value}`);
+  }
+  (0, import_node_fs4.writeFileSync)(file, `${lines.join("\n")}
+`);
+  return file;
+}
+function emit(out, line) {
+  if (out.onStderr) {
+    out.onStderr(Buffer.from(`${line}
+`));
+  } else {
+    process.stderr.write(`${line}
+`);
+  }
+}
+function runForwarded(cmd, args, out, opts = {}) {
+  return new Promise((resolve, reject) => {
+    const child = (0, import_node_child_process3.spawn)(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk.toString();
+      if (!opts.quiet) {
+        if (out.onStdout) {
+          out.onStdout(chunk);
+        } else {
+          process.stderr.write(chunk.toString());
+        }
+      }
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += chunk.toString();
+      if (!opts.quiet) {
+        if (out.onStderr) {
+          out.onStderr(chunk);
+        } else {
+          process.stderr.write(chunk.toString());
+        }
+      }
+    });
+    child.on("error", (err) => {
+      if (err.code === "ENOENT") {
+        reject(
+          new Error(
+            `Command not found: \`${cmd}\`. Ensure \`${cmd}\` is installed and on your PATH (Docker is required for \`vercel dev\` with container services).`
+          )
+        );
+        return;
+      }
+      reject(err);
+    });
+    child.on("close", (code) => {
+      if (code === 0) {
+        resolve({ stdout });
+      } else {
+        const detail = stderr.trim().split("\n").slice(-5).join("\n");
+        reject(
+          new Error(
+            `\`${cmd} ${args.join(" ")}\` exited with code ${code}` + (detail ? `
+${detail}` : "")
+          )
+        );
+      }
+    });
+  });
+}
+function devImageTag(serviceName) {
+  const safe = serviceName.toLowerCase().replace(/[^a-z0-9-_.]/g, "-");
+  return `vercel-dev/${safe || "service"}:dev`;
+}
+function isDockerfileRef(ref) {
+  const base = import_node_path4.default.basename(ref).toLowerCase();
+  return base === "dockerfile" || base === "containerfile" || base.endsWith(".dockerfile");
+}
+function normalizeCommand(command) {
+  if (typeof command === "string") {
+    return [command];
+  }
+  if (Array.isArray(command) && command.every((item) => typeof item === "string")) {
+    return command;
+  }
+  return void 0;
+}
+async function resolveDevImage(options, out, span) {
+  const { config, workPath, entrypoint } = options;
+  const entrypointRef = readString(entrypoint);
+  const dockerfileConfigured = entrypointRef && isDockerfileRef(entrypointRef) ? entrypointRef : void 0;
+  const dockerfileRel = dockerfileConfigured ?? "Dockerfile";
+  const dockerfilePath = import_node_path4.default.join(workPath, dockerfileRel);
+  const hasDockerfile = dockerfileConfigured !== void 0 || (0, import_node_fs4.existsSync)(dockerfilePath);
+  const prebuiltImage = readString(config.handler) ?? (hasDockerfile ? void 0 : entrypointRef);
+  if (!hasDockerfile) {
+    if (!prebuiltImage) {
+      throw new Error(
+        "Container service must specify an entrypoint: a prebuilt OCI image reference, or a Dockerfile path to run with `vercel dev`."
+      );
+    }
+    span?.setAttributes({ "container.dev_mode": "prebuilt" });
+    emit(out, `\u25B2 container  vercel dev: using prebuilt image ${prebuiltImage}`);
+    return prebuiltImage;
+  }
+  if (!(0, import_node_fs4.existsSync)(dockerfilePath)) {
+    throw new Error(
+      `Dockerfile not found at "${dockerfilePath}" for container service.`
+    );
+  }
+  const serviceName = options.service?.name ?? "service";
+  const tag = devImageTag(serviceName);
+  const contextDir = import_node_path4.default.dirname(dockerfilePath);
+  const buildArgFlags2 = [];
+  const buildEnv = options.meta?.buildEnv ?? {};
+  for (const [key, value] of Object.entries(buildEnv)) {
+    if (typeof value === "string") {
+      buildArgFlags2.push("--build-arg", `${key}=${value}`);
+    }
+  }
+  span?.setAttributes({ "container.dev_mode": "build", "image.tag": tag });
+  emit(out, `\u25B2 container  vercel dev: building ${tag} (docker, host platform)`);
+  await runForwarded(
+    "docker",
+    ["build", ...buildArgFlags2, "-t", tag, "-f", dockerfilePath, contextDir],
+    out
+  );
+  emit(out, `\u25B2 container  built ${tag}`);
+  return tag;
+}
+async function resolveContainerPort(image, out) {
+  try {
+    const { stdout } = await runForwarded(
+      "docker",
+      ["image", "inspect", "--format", "{{json .Config.ExposedPorts}}", image],
+      out,
+      { quiet: true }
+    );
+    const exposed = JSON.parse(stdout.trim() || "null");
+    if (exposed) {
+      const ports = Object.keys(exposed).map((key) => Number(key.split("/")[0])).filter((n) => Number.isFinite(n)).sort((a, b) => a - b);
+      if (ports.length > 0) {
+        return ports[0];
+      }
+    }
+  } catch (err) {
+    debug(`could not inspect EXPOSE for ${image}: ${err.message}`);
+  }
+  return 3e3;
+}
+async function readMappedHostPort(containerName, containerPort, out) {
+  const { stdout } = await runForwarded(
+    "docker",
+    ["port", containerName, `${containerPort}/tcp`],
+    out,
+    { quiet: true }
+  );
+  const match = stdout.match(/:(\d+)\s*$/m);
+  if (!match) {
+    throw new Error(
+      `Could not determine mapped host port for ${containerName} (${containerPort}/tcp). Got: ${stdout.trim()}`
+    );
+  }
+  return Number(match[1]);
+}
+function uniqueContainerName(serviceName) {
+  const safe = serviceName.toLowerCase().replace(/[^a-z0-9-_.]/g, "-");
+  return `vercel-dev-${safe || "service"}-${process.pid}-${Date.now().toString(36)}`;
+}
+async function startDevServer(options) {
+  return withSpan(
+    options.span,
+    "container.dev.start",
+    { "service.name": options.service?.name },
+    async (span) => {
+      const { config, meta, onStdout, onStderr } = options;
+      const out = { onStdout, onStderr };
+      const image = await withSpan(
+        span,
+        "container.dev.resolve_image",
+        {},
+        (s) => resolveDevImage(options, out, s)
+      );
+      const containerPort = await resolveContainerPort(image, out);
+      const containerName = uniqueContainerName(
+        options.service?.name ?? "service"
+      );
+      const mergedEnv = {};
+      for (const [key, value] of Object.entries(process.env)) {
+        if (typeof value === "string" && !isHostOnlyEnvVar(key)) {
+          mergedEnv[key] = value;
+        }
+      }
+      const metaEnv = meta?.env ?? {};
+      for (const [key, value] of Object.entries(metaEnv)) {
+        if (typeof value === "string" && !isHostOnlyEnvVar(key)) {
+          mergedEnv[key] = value;
+        }
+      }
+      mergedEnv.PORT = String(containerPort);
+      const envFilePath = writeEnvFile(mergedEnv);
+      const command = normalizeCommand(
+        config.command
+      );
+      const requestedHostPort = typeof meta?.port === "number" ? meta.port : 0;
+      const args = [
+        "run",
+        "--rm",
+        "--name",
+        containerName,
+        // Publish the container port to the orchestrator-provided host port, or
+        // an ephemeral host port chosen by Docker when none was requested.
+        "-p",
+        `127.0.0.1:${requestedHostPort}:${containerPort}`,
+        "--env-file",
+        envFilePath,
+        image,
+        ...command ?? []
+      ];
+      emit(out, `\u25B2 container  vercel dev: starting container ${image}`);
+      debug(`docker ${args.join(" ")}`);
+      const child = (0, import_node_child_process3.spawn)("docker", args, {
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      child.stdout?.on("data", (data) => onStdout?.(data));
+      child.stderr?.on("data", (data) => onStderr?.(data));
+      const cleanupEnvFile = () => {
+        (0, import_node_fs4.rmSync)(import_node_path4.default.dirname(envFilePath), { recursive: true, force: true });
+      };
+      const shutdown = async () => {
+        try {
+          await runForwarded("docker", ["stop", containerName], out, {
+            quiet: true
+          });
+        } catch (err) {
+          debug(
+            `docker stop ${containerName} failed: ${err.message}`
+          );
+        } finally {
+          cleanupEnvFile();
+        }
+      };
+      let hostPort;
+      const deadline = Date.now() + 3e4;
+      let lastErr;
+      try {
+        while (Date.now() < deadline) {
+          if (child.exitCode !== null) {
+            throw new Error(
+              `Container "${options.service?.name}" exited (code ${child.exitCode}) before becoming ready.`
+            );
+          }
+          try {
+            hostPort = await readMappedHostPort(
+              containerName,
+              containerPort,
+              out
+            );
+            break;
+          } catch (err) {
+            lastErr = err;
+            await new Promise((resolve) => setTimeout(resolve, 250));
+          }
+        }
+        if (hostPort === void 0) {
+          throw new Error(
+            `Timed out waiting for container "${options.service?.name}" to publish port ${containerPort}.` + (lastErr ? ` Last error: ${lastErr.message}` : "")
+          );
+        }
+      } catch (err) {
+        await shutdown();
+        throw err;
+      }
+      span?.setAttributes({
+        "container.dev.host_port": String(hostPort),
+        "container.dev.container_port": String(containerPort),
+        "container.name": containerName
+      });
+      emit(out, `\u25B2 container  container ready on localhost:${hostPort}`);
+      return {
+        port: hostPort,
+        pid: child.pid ?? 0,
+        shutdown
+      };
+    }
+  );
+}
+
+// src/prepare-cache.ts
+var import_build_utils2 = require("@vercel/build-utils");
+var import_node_fs5 = require("fs");
+var import_node_path5 = require("path");
+var CACHE_ROOT = "/vercel";
+var GRAPH_ROOT_REL = import_node_path5.posix.relative(CACHE_ROOT, BUILDAH_GRAPH_ROOT);
+async function prepareCache(_options) {
+  if (process.env.VERCEL_VCR_DISABLE_LAYER_CACHE) {
+    debug("layer cache disabled (VERCEL_VCR_DISABLE_LAYER_CACHE)");
+    return {};
+  }
+  if (!isBuildContainer()) {
+    debug("skipping container layer cache (not in build container)");
+    return {};
+  }
+  if (!(0, import_node_fs5.existsSync)(BUILDAH_GRAPH_ROOT)) {
+    debug(`no buildah store to cache at ${BUILDAH_GRAPH_ROOT}`);
+    return {};
+  }
+  const start = Date.now();
+  const files = await (0, import_build_utils2.glob)(`${GRAPH_ROOT_REL}/**`, CACHE_ROOT);
+  const count = Object.keys(files).length;
+  info(
+    `cached container layer store: ${count} files from ${BUILDAH_GRAPH_ROOT} in ${Date.now() - start}ms`
+  );
+  return files;
+}
+
+// src/index.ts
+var version = 2;
+function normalizeCommand2(command) {
+  if (typeof command === "string") {
+    return [command];
+  }
+  if (Array.isArray(command) && command.every((item) => typeof item === "string")) {
+    return command;
+  }
+  return void 0;
+}
+function isDockerfileRef2(ref) {
+  const base = import_node_path6.default.basename(ref).toLowerCase();
+  return base === "dockerfile" || base === "containerfile" || base.endsWith(".dockerfile") || // Vercel-specific container opt-in markers, used to deploy a project as a
+  // container even when another framework (e.g. Next.js) is also present.
+  base === "dockerfile.vercel" || base === "containerfile.vercel";
+}
+var DOCKERFILE_CANDIDATES = ["Dockerfile.vercel", "Containerfile.vercel"];
+function findDockerfile(workPath) {
+  return DOCKERFILE_CANDIDATES.find(
+    (name) => (0, import_node_fs6.existsSync)(import_node_path6.default.join(workPath, name))
+  );
+}
+function sanitizeRepository(name) {
+  const sanitized = name.toLowerCase().replace(/[^a-z0-9-_./]/g, "-").replace(/-+/g, "-").replace(/(^[-/.]+)|([-/.]+$)/g, "");
+  return sanitized || "service";
+}
+function resolveImageTag() {
+  const sha = readString(process.env.VERCEL_GIT_COMMIT_SHA);
+  if (sha) {
+    return sha.slice(0, 12);
+  }
+  const deploymentId = readString(process.env.VERCEL_DEPLOYMENT_ID);
+  if (deploymentId) {
+    return deploymentId.replace(/[^a-z0-9-_.]/gi, "-");
+  }
+  return `build-${Date.now().toString(36)}`;
+}
+async function buildAndPushImage(params) {
+  const { contextDir, dockerfilePath, repository, tag, buildArgs, parentSpan } = params;
+  const engine = selectContainerEngine();
+  return withSpan(
+    parentSpan,
+    "container.build_and_push",
+    {
+      "container.engine": engine.name,
+      "container.registry": VCR_REGISTRY,
+      "container.repository": repository
+    },
+    async (buildSpan) => {
+      const token = await withSpan(
+        buildSpan,
+        "container.mint_oidc",
+        {},
+        (s) => resolveOidcTokenForBuild(s)
+      );
+      const claims = decodeOidcClaims(token);
+      debug(`registry token: ${tokenFingerprint(token)}`);
+      debugTokenClaims("OIDC token claims", token);
+      const username = claims.owner_id;
+      if (!username) {
+        throw new Error(
+          "VERCEL_OIDC_TOKEN is missing the `owner_id` (team id) claim required to authenticate to the container registry."
+        );
+      }
+      const fullRepository = [claims.owner, claims.project, repository].join(
+        "/"
+      );
+      const imageRef = `${VCR_REGISTRY}/${fullRepository}:${tag}`;
+      buildSpan?.setAttributes({
+        "container.repository": fullRepository,
+        "image.tag": tag,
+        "image.ref": imageRef,
+        "registry.username": username
+      });
+      return engine.withRuntime(buildSpan, async () => {
+        await withSpan(
+          buildSpan,
+          "container.ensure_toolchain_ready",
+          { "container.engine": engine.name },
+          (s) => engine.ensureReady(s)
+        );
+        await withSpan(
+          buildSpan,
+          "container.toolchain_diagnostics",
+          { "container.engine": engine.name },
+          (s) => engine.logDiagnostics(s)
+        );
+        await withSpan(
+          buildSpan,
+          "container.verify_storage",
+          { "container.engine": engine.name },
+          (s) => engine.verifyStorage?.(s) ?? Promise.resolve()
+        );
+        const buildParams = {
+          contextDir,
+          dockerfilePath,
+          imageRef,
+          registry: VCR_REGISTRY,
+          username,
+          token,
+          repository,
+          buildArgs,
+          span: buildSpan
+        };
+        const forceLogin = readString(process.env.VERCEL_VCR_FORCE_LOGIN) === "1";
+        const authFile = forceLogin ? void 0 : existingRegistryAuthFile();
+        if (authFile) {
+          debug(`registry auth file present: ${authFile}`);
+          step(`Using registry credentials from ${authFile}`);
+          buildSpan?.setAttributes({
+            "container.registry": VCR_REGISTRY,
+            "registry.username": username,
+            "registry.auth_file": authFile,
+            "registry.login_skipped": toTag(true)
+          });
+          done("authenticated via provisioned credentials");
+        } else {
+          step(`Authenticating to ${VCR_REGISTRY} as ${username}`);
+          await withSpan(
+            buildSpan,
+            "container.registry_login",
+            {
+              "container.registry": VCR_REGISTRY,
+              "registry.username": username
+            },
+            () => engine.login(buildParams)
+          );
+          done("authenticated");
+        }
+        await withSpan(
+          buildSpan,
+          "container.ensure_repository",
+          { "container.repository": repository },
+          (s) => ensureRepository(repository, token, claims, s)
+        );
+        info(`Building image ${imageRef} (${engine.name})`);
+        debug(`dockerfile: ${dockerfilePath}`);
+        debug(`context:    ${contextDir}`);
+        debug(`platform:   ${TARGET_PLATFORM}`);
+        debug(
+          `build args:  ${buildArgs ? Object.keys(buildArgs).length : 0} (from project build env)`
+        );
+        const buildStart = Date.now();
+        step(`${engine.name} build (${TARGET_PLATFORM})`);
+        await withSpan(
+          buildSpan,
+          "container.image_build",
+          { "image.ref": imageRef, "image.platform": TARGET_PLATFORM },
+          () => engine.build(buildParams)
+        );
+        done(`built in ${elapsed(buildStart)}`);
+        const pushStart = Date.now();
+        step(`Pushing ${imageRef}`);
+        const digest = await withSpan(
+          buildSpan,
+          "container.push",
+          { "image.ref": imageRef },
+          () => engine.push(buildParams)
+        );
+        done(
+          digest ? `pushed ${shortDigest(digest)} in ${elapsed(pushStart)}` : `pushed in ${elapsed(pushStart)}`
+        );
+        await withSpan(
+          buildSpan,
+          "container.report_storage",
+          { "container.engine": engine.name },
+          (s) => engine.reportStorage?.(s) ?? Promise.resolve()
+        );
+        const resolvedRef = digest ? `${VCR_REGISTRY}/${fullRepository}@${digest}` : imageRef;
+        buildSpan?.setAttributes({
+          "image.digest": digest,
+          "image.resolved_ref": resolvedRef
+        });
+        info(`Image reference ${resolvedRef}`);
+        debug(
+          `container build_and_push total: ${elapsed(buildStart)} (build + push + storage report)`
+        );
+        return resolvedRef;
+      });
+    }
+  );
+}
+async function resolveImageHandler(options, span) {
+  const { config, workPath, entrypoint, meta } = options;
+  const entrypointRef = readString(entrypoint);
+  const dockerfileConfigured = entrypointRef && isDockerfileRef2(entrypointRef) ? entrypointRef : findDockerfile(workPath);
+  const dockerfileRel = dockerfileConfigured ?? "Dockerfile";
+  const dockerfilePath = import_node_path6.default.join(workPath, dockerfileRel);
+  const hasDockerfile = dockerfileConfigured !== void 0 || (0, import_node_fs6.existsSync)(dockerfilePath);
+  const prebuiltImage = readString(config.handler) ?? (hasDockerfile ? void 0 : entrypointRef);
+  span?.setAttributes({
+    "container.has_dockerfile": toTag(hasDockerfile),
+    "container.is_dev": toTag(Boolean(meta?.isDev))
+  });
+  if (!hasDockerfile) {
+    if (!prebuiltImage) {
+      throw new Error(
+        "Container service must specify an entrypoint: a prebuilt OCI image reference, or a Dockerfile path to build."
+      );
+    }
+    span?.setAttributes({ "container.mode": "prebuilt" });
+    info(`Using prebuilt image ${prebuiltImage}`);
+    return prebuiltImage;
+  }
+  if (meta?.isDev) {
+    if (prebuiltImage) {
+      span?.setAttributes({ "container.mode": "prebuilt_dev" });
+      info(`vercel dev: using prebuilt image ${prebuiltImage}`);
+      return prebuiltImage;
+    }
+    throw new Error(
+      '`vercel dev` cannot build container images from a Dockerfile. Specify a prebuilt "image" for local development.'
+    );
+  }
+  if (!(0, import_node_fs6.existsSync)(dockerfilePath)) {
+    throw new Error(
+      `Dockerfile not found at "${dockerfilePath}" for container service.`
+    );
+  }
+  const serviceName = options.service?.name;
+  const repository = sanitizeRepository(
+    serviceName ?? import_node_path6.default.basename(dockerfileRel).split(".")[0]
+  );
+  const tag = resolveImageTag();
+  const contextDir = import_node_path6.default.dirname(dockerfilePath);
+  const buildArgs = buildArgsFromEnv(meta?.buildEnv);
+  span?.setAttributes({
+    "container.mode": "build_and_push",
+    "container.repository": repository,
+    "image.tag": tag
+  });
+  return buildAndPushImage({
+    contextDir,
+    dockerfilePath,
+    repository,
+    tag,
+    buildArgs,
+    parentSpan: span
+  });
+}
+function buildArgsFromEnv(env) {
+  if (!env) {
+    return void 0;
+  }
+  const out = {};
+  for (const [key, value] of Object.entries(env)) {
+    if (typeof value === "string") {
+      out[key] = value;
+    }
+  }
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+async function build(options) {
+  const image = await withSpan(
+    options.span,
+    "container.resolve_image",
+    { "service.name": options.service?.name },
+    (span) => resolveImageHandler(options, span)
+  );
+  const command = normalizeCommand2(options.config.command);
+  const routes = [
+    { handle: "filesystem" },
+    { src: "/(.*)", dest: "/index" }
+  ];
+  return {
+    routes,
+    output: {
+      index: {
+        type: "Lambda",
+        files: {},
+        // For `runtime: 'container'` the OCI image reference is carried in
+        // `handler`; the platform surfaces it as the container image downstream
+        // (vercel/api#76729).
+        handler: image,
+        runtime: "container",
+        environment: {},
+        ...command ? { command } : {}
+      }
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  build,
+  prepareCache,
+  startDevServer,
+  version
+});