@vercel/container 7.0.3 → 8.1.0

package/dist/index.js

@@ -38,7 +38,7 @@ __export(src_exports, {
   version: () => version
 });
 module.exports = __toCommonJS(src_exports);
-var import_build_utils4 = require("@vercel/build-utils");
+var import_build_utils6 = require("@vercel/build-utils");
 
 // src/diagnostics.ts
 var import_build_utils = require("@vercel/build-utils");
@@ -62,17 +62,25 @@ async function generateProjectManifest({
 var diagnostics = (0, import_build_utils.createDiagnostics)("container");
 
 // src/index.ts
-var import_node_fs6 = require("fs");
-var import_node_path6 = __toESM(require("path"));
+var import_node_fs14 = require("fs");
+var import_node_path14 = __toESM(require("path"));
 
 // src/util.ts
 var import_build_utils2 = require("@vercel/build-utils");
 var import_node_child_process = require("child_process");
-var import_node_crypto = require("crypto");
 var import_node_fs = require("fs");
 var import_node_os = require("os");
 var import_node_path = require("path");
 var DEBUG = Boolean((0, import_build_utils2.getPlatformEnv)("BUILDER_DEBUG"));
+function normalizeCommand(command) {
+  if (typeof command === "string") {
+    return [command];
+  }
+  if (Array.isArray(command) && command.every((item) => typeof item === "string")) {
+    return command;
+  }
+  return void 0;
+}
 function write(line) {
   process.stderr.write(`${line}
 `);
@@ -125,9 +133,10 @@ function devImageTag(serviceName) {
   return `vercel-dev/${safe || "service"}:dev`;
 }
 function run(cmd, args, opts = {}) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const child = (0, import_node_child_process.spawn)(cmd, args, {
       cwd: opts.cwd,
+      env: opts.env,
       stdio: [opts.input !== void 0 ? "pipe" : "ignore", "pipe", "pipe"]
     });
     let stdout = "";
@@ -159,15 +168,15 @@ function run(cmd, args, opts = {}) {
     });
     child.on("close", (code) => {
       if (code === 0) {
-        resolve({ stdout, stderr });
+        resolve2({ stdout, stderr });
       } else {
         const detail = stderr.trim().split("\n").slice(-5).join("\n");
-        reject(
-          new Error(
-            `\`${cmd} ${args.join(" ")}\` exited with code ${code}` + (detail ? `
+        const error = new Error(
+          `\`${cmd} ${args.join(" ")}\` exited with code ${code}` + (detail ? `
 ${detail}` : "")
-          )
         );
+        error.exitCode = code ?? void 0;
+        reject(error);
       }
     });
     if (opts.input !== void 0) {
@@ -179,59 +188,6 @@ function extractField(text, label) {
   const match = text.match(new RegExp(`^\\s*${label}:\\s*(.+)$`, "m"));
   return match?.[1]?.trim();
 }
-function tokenFingerprint(token) {
-  if (!token)
-    return "absent";
-  const sha = (0, import_node_crypto.createHash)("sha256").update(token).digest("hex").slice(0, 8);
-  return `present(len=${token.length}, sha256=${sha})`;
-}
-function debugTokenClaims(label, token) {
-  if (!DEBUG)
-    return;
-  if (!token) {
-    debug(`${label}: <absent>`);
-    return;
-  }
-  try {
-    const payload = token.split(".")[1];
-    if (!payload) {
-      debug(`${label}: <not a JWT>`);
-      return;
-    }
-    const claims = JSON.parse(
-      Buffer.from(payload, "base64url").toString("utf8")
-    );
-    const safe = {
-      iss: claims.iss,
-      aud: claims.aud,
-      sub: claims.sub,
-      scope: claims.scope,
-      owner: claims.owner,
-      owner_id: claims.owner_id,
-      project: claims.project,
-      project_id: claims.project_id,
-      exp: typeof claims.exp === "number" ? `${new Date(claims.exp * 1e3).toISOString()} (in ${Math.round(
-        (claims.exp * 1e3 - Date.now()) / 1e3
-      )}s)` : claims.exp
-    };
-    debug(`${label}: ${JSON.stringify(safe)}`);
-  } catch (err) {
-    debug(`${label}: <unparseable claims> (${err.message})`);
-  }
-}
-function decodeOidcClaims(token) {
-  if (!token)
-    return {};
-  try {
-    const payload = token.split(".")[1];
-    if (!payload)
-      return {};
-    const json = Buffer.from(payload, "base64url").toString("utf8");
-    return JSON.parse(json);
-  } catch {
-    return {};
-  }
-}
 function isBuildContainer() {
   return Boolean(readString(process.env.VERCEL_BUILD_IMAGE));
 }
@@ -401,6 +357,7 @@ Continuing (set VERCEL_VCR_STRICT_STORAGE=1 to fail builds).`
 }
 
 // src/oidc.ts
+var import_node_crypto = require("crypto");
 function parseOidcToken(token) {
   const parts = token.split(".");
   if (parts.length !== 3) {
@@ -415,6 +372,59 @@ function parseOidcToken(token) {
     throw new Error("VERCEL_OIDC_TOKEN has an unreadable JWT payload.");
   }
 }
+function decodeOidcClaims(token) {
+  if (!token)
+    return {};
+  try {
+    const payload = token.split(".")[1];
+    if (!payload)
+      return {};
+    const json = Buffer.from(payload, "base64url").toString("utf8");
+    return JSON.parse(json);
+  } catch {
+    return {};
+  }
+}
+function tokenFingerprint(token) {
+  if (!token)
+    return "absent";
+  const sha = (0, import_node_crypto.createHash)("sha256").update(token).digest("hex").slice(0, 8);
+  return `present(len=${token.length}, sha256=${sha})`;
+}
+function debugTokenClaims(label, token) {
+  if (!DEBUG)
+    return;
+  if (!token) {
+    debug(`${label}: <absent>`);
+    return;
+  }
+  try {
+    const payload = token.split(".")[1];
+    if (!payload) {
+      debug(`${label}: <not a JWT>`);
+      return;
+    }
+    const claims = JSON.parse(
+      Buffer.from(payload, "base64url").toString("utf8")
+    );
+    const safe = {
+      iss: claims.iss,
+      aud: claims.aud,
+      sub: claims.sub,
+      scope: claims.scope,
+      owner: claims.owner,
+      owner_id: claims.owner_id,
+      project: claims.project,
+      project_id: claims.project_id,
+      exp: typeof claims.exp === "number" ? `${new Date(claims.exp * 1e3).toISOString()} (in ${Math.round(
+        (claims.exp * 1e3 - Date.now()) / 1e3
+      )}s)` : claims.exp
+    };
+    debug(`${label}: ${JSON.stringify(safe)}`);
+  } catch (err) {
+    debug(`${label}: <unparseable claims> (${err.message})`);
+  }
+}
 function resolveProjectContext(token) {
   const claims = parseOidcToken(token);
   return {
@@ -507,6 +517,7 @@ function formatVcrAuthError(registry, username, detail) {
 // src/engines/types.ts
 var VCR_REGISTRY = process.env.VERCEL_VCR_REGISTRY || "vcr.vercel.com";
 var TARGET_PLATFORM = "linux/amd64";
+var DIGEST_RE = /sha256:[a-f0-9]{64}/;
 function buildArgFlags(params) {
   const flags = [];
   for (const [key, value] of Object.entries(params.buildArgs ?? {})) {
@@ -808,7 +819,7 @@ async function startDockerDaemon(span) {
         ].join("\n")
       );
     }
-    await new Promise((resolve) => setTimeout(resolve, 500));
+    await new Promise((resolve2) => setTimeout(resolve2, 500));
   }
 }
 async function stopDockerDaemon(daemon, span) {
@@ -818,12 +829,12 @@ async function stopDockerDaemon(daemon, span) {
   }
   step("Stopping Docker daemon");
   const stopTimeoutMs = Number(process.env.VERCEL_VCR_DOCKERD_STOP_TIMEOUT_MS) || 1e4;
-  await new Promise((resolve) => {
+  await new Promise((resolve2) => {
     let settled = false;
     const finish = () => {
       if (!settled) {
         settled = true;
-        resolve();
+        resolve2();
       }
     };
     child.once("exit", finish);
@@ -1026,7 +1037,39 @@ function selectContainerEngine() {
   return isBuildContainer() ? buildahEngine : dockerEngine;
 }
 
+// src/buildpacks/build.ts
+var import_node_fs10 = require("fs");
+var import_node_os7 = require("os");
+var import_node_path10 = require("path");
+
 // src/registry.ts
+async function resolveRegistryTarget(params) {
+  const token = await withSpan(
+    params.span,
+    "container.mint_oidc",
+    {},
+    (s) => resolveOidcTokenForBuild(s)
+  );
+  const claims = decodeOidcClaims(token);
+  debug(`registry token: ${tokenFingerprint(token)}`);
+  debugTokenClaims("OIDC token claims", token);
+  const username = claims.owner_id;
+  if (!username) {
+    throw new Error(
+      "VERCEL_OIDC_TOKEN is missing the `owner_id` (team id) claim required to authenticate to the container registry."
+    );
+  }
+  const fullRepository = [claims.owner, claims.project, params.repository].join(
+    "/"
+  );
+  return {
+    token,
+    claims,
+    username,
+    fullRepository,
+    imageRef: `${VCR_REGISTRY}/${fullRepository}:${params.tag}`
+  };
+}
 async function ensureRepository(repository, token, claims, span) {
   if (repository.includes("/")) {
     debug(`skipping repository auto-create (fully-qualified "${repository}")`);
@@ -1077,95 +1120,1156 @@ async function ensureRepository(repository, token, claims, span) {
   }
 }
 
-// src/dev.ts
-var import_node_child_process3 = require("child_process");
+// src/buildpacks/lifecycle/lifecycle.ts
+var import_build_utils3 = require("@vercel/build-utils");
+var import_node_crypto2 = require("crypto");
 var import_node_fs4 = require("fs");
 var import_node_os4 = require("os");
-var import_node_path4 = __toESM(require("path"));
-var HOST_ONLY_ENV = /* @__PURE__ */ new Set([
-  "TMPDIR",
-  "TMP",
-  "TEMP",
-  "HOME",
-  "PATH",
-  "PWD",
-  "OLDPWD",
-  "SHELL",
-  "SHLVL",
-  "USER",
-  "LOGNAME",
-  "TERM",
-  "TERM_PROGRAM",
-  "TERM_PROGRAM_VERSION",
-  "TERM_SESSION_ID",
-  "COLORTERM",
-  "LANG",
-  "LC_ALL",
-  "LC_CTYPE",
-  "COMMAND_MODE",
-  "SECURITYSESSIONID",
-  "__CF_USER_TEXT_ENCODING",
-  "__CFBundleIdentifier"
-]);
-function isHostOnlyEnvVar(key) {
-  return HOST_ONLY_ENV.has(key) || key.startsWith("__") || key.startsWith("XPC_") || key.startsWith("SSH_") || key.startsWith("Apple");
+var import_node_path4 = require("path");
+var import_smol_toml = require("smol-toml");
+var import_tar = require("tar");
+
+// src/buildpacks/distribution.json
+var distribution_default = {
+  $comment: "Pinned lifecycle and buildpack archives",
+  baseUrl: "https://lwnhvkbwb2b5igkl.public.blob.vercel-storage.com",
+  lifecycle: {
+    version: "0.21.18",
+    sha256: "45e4ac394fe8194b909002571c25479dcb39f2ecabecad4105621369c279c78e"
+  },
+  buildpacks: {
+    ruby: {
+      id: "vercel/ruby",
+      version: "0.1.0",
+      sha256: "e204724b690ee3f64d28455d06efd3c7fce9189057ba4d3f702e27c24b8bdee5"
+    }
+  }
+};
+
+// src/buildpacks/distribution.ts
+var distribution = distribution_default;
+var BUILDPACK_DIST_BASE_URL = distribution.baseUrl;
+var LIFECYCLE_VERSION = distribution.lifecycle.version;
+var LIFECYCLE = {
+  url: `${BUILDPACK_DIST_BASE_URL}/lifecycle/${LIFECYCLE_VERSION}/lifecycle-v${LIFECYCLE_VERSION}-linux-x86-64.tgz`,
+  sha256: distribution.lifecycle.sha256
+};
+function vercelBuildpack(name) {
+  const pinned = distribution.buildpacks[name];
+  if (!pinned) {
+    throw new Error(
+      `distribution.json does not pin a "${name}" buildpack; add it under "buildpacks".`
+    );
+  }
+  return { name, ...pinned };
 }
-function writeEnvFile(env) {
-  const dir = (0, import_node_fs4.mkdtempSync)(import_node_path4.default.join((0, import_node_os4.tmpdir)(), "vercel-container-dev-env-"));
-  const file = import_node_path4.default.join(dir, "env");
-  const lines = [];
-  for (const [key, value] of Object.entries(env)) {
-    if (value.includes("\n")) {
+function vercelBuildpackArtifact(buildpack) {
+  const { name, version: version2 } = buildpack;
+  return {
+    url: `${BUILDPACK_DIST_BASE_URL}/buildpacks/${name}/${version2}/vercel-${name}-${version2}.cnb`,
+    sha256: buildpack.sha256
+  };
+}
+
+// src/buildpacks/lifecycle/lifecycle.ts
+var BUILD_USER_ID = 1001;
+var BUILD_GROUP_ID = 1001;
+var BUILD_USER = `${BUILD_USER_ID}:${BUILD_GROUP_ID}`;
+var CNB_PLATFORM_API = "0.13";
+var ORDER_MOUNT_DIR = "/platform/order";
+var ORDER_FILE = `${ORDER_MOUNT_DIR}/order.toml`;
+var ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+async function stageWorkspace({ files, workPath }, destinationDir) {
+  const staged = /* @__PURE__ */ Object.create(null);
+  const symlinks = /* @__PURE__ */ new Set();
+  for (const [name, file] of Object.entries(files)) {
+    const portable = name.replace(/\\/g, "/");
+    const normalized = import_node_path4.posix.normalize(portable).replace(/\/$/, "");
+    if (!normalized || normalized === "." || import_node_path4.win32.isAbsolute(name) || import_node_path4.posix.isAbsolute(portable) || portable.split("/").includes("..") || normalized in staged) {
+      throw new Error(`Invalid buildpack source path ${JSON.stringify(name)}.`);
+    }
+    staged[normalized] = file;
+    if (!(0, import_build_utils3.isSymbolicLink)(file.mode))
       continue;
+    let target = (0, import_build_utils3.getSymlinkTarget)(file);
+    if (target === null && file.type === "FileRef") {
+      target = (await (0, import_build_utils3.streamToBuffer)(await file.toStreamAsync())).toString();
+    }
+    if (!target) {
+      throw new Error(`Cannot read buildpack source symlink ${name}.`);
+    }
+    if ((0, import_node_path4.isAbsolute)(target)) {
+      target = (0, import_node_path4.relative)((0, import_node_path4.resolve)(workPath, import_node_path4.posix.dirname(normalized)), target) || ".";
+    } else if (import_node_path4.win32.isAbsolute(target)) {
+      throw new Error(
+        `Buildpack source symlink ${name} has an absolute target.`
+      );
+    }
+    target = target.replace(/\\/g, "/");
+    const resolved = import_node_path4.posix.join(import_node_path4.posix.dirname(normalized), target);
+    if (resolved === ".." || resolved.startsWith("../")) {
+      throw new Error(
+        `Buildpack source symlink ${name} escapes the service root. Ruby buildpack services must be self-contained.`
+      );
+    }
+    staged[normalized] = new import_build_utils3.FileBlob({ data: target, mode: file.mode });
+    symlinks.add(normalized);
+  }
+  for (const name of Object.keys(staged)) {
+    for (let parent = import_node_path4.posix.dirname(name); parent !== "."; parent = import_node_path4.posix.dirname(parent)) {
+      if (symlinks.has(parent)) {
+        throw new Error(
+          `Buildpack source ${name} is inside symlink ${parent}.`
+        );
+      }
+    }
+    const file = staged[name];
+    if (file.type === "FileFsRef" && !(0, import_build_utils3.isSymbolicLink)(file.mode)) {
+      const sourcePath = (0, import_node_path4.resolve)(file.fsPath);
+      const sourceRelative = (0, import_node_path4.relative)((0, import_node_path4.resolve)(workPath), sourcePath);
+      if (sourceRelative.startsWith(`..${import_node_path4.sep}`) || sourceRelative === ".." || (0, import_node_path4.isAbsolute)(sourceRelative)) {
+        continue;
+      }
+      const sourceRoot = import_node_fs4.realpathSync.native(workPath);
+      const sourceTarget = import_node_fs4.realpathSync.native(sourcePath);
+      if (sourceTarget !== (0, import_node_path4.resolve)(sourceRoot, sourceRelative)) {
+        const target = (0, import_node_path4.relative)(sourceRoot, sourceTarget).split(import_node_path4.sep).join("/");
+        if (target === ".." || target.startsWith("../") || (0, import_node_path4.isAbsolute)(target) || !(target in staged)) {
+          throw new Error(
+            `Buildpack source ${name} follows a symlink to an excluded or outside-root file. Ruby buildpack services must be self-contained.`
+          );
+        }
+      }
+    }
+  }
+  await (0, import_build_utils3.download)(staged, destinationDir);
+  const root = import_node_fs4.realpathSync.native(destinationDir);
+  for (const name of symlinks) {
+    let target;
+    try {
+      target = (0, import_node_path4.relative)(root, import_node_fs4.realpathSync.native((0, import_node_path4.join)(destinationDir, name)));
+    } catch {
+      throw new Error(
+        `Buildpack source symlink ${name} has no target in the staged service.`
+      );
+    }
+    if (target === ".." || target.startsWith(`..${import_node_path4.sep}`) || (0, import_node_path4.isAbsolute)(target)) {
+      throw new Error(
+        `Buildpack source symlink ${name} escapes the staged service.`
+      );
     }
-    lines.push(`${key}=${value}`);
   }
-  (0, import_node_fs4.writeFileSync)(file, `${lines.join("\n")}
-`);
-  return file;
 }
-function useContainerHost(endpoint) {
-  try {
-    const url = new URL(endpoint);
-    if (url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]") {
-      url.hostname = "host.docker.internal";
-      return url.toString();
+function writePlatformEnvDir(buildEnv, config, parentDir = (0, import_node_os4.tmpdir)()) {
+  const environment = { ...buildEnv };
+  delete environment.VERCEL_NODE_HOME;
+  delete environment.VERCEL_COMMAND;
+  if (config.nodeHome) {
+    environment.VERCEL_NODE_HOME = config.nodeHome;
+  }
+  const dir = (0, import_node_fs4.mkdtempSync)((0, import_node_path4.join)(parentDir, "vercel-cnb-env-"));
+  (0, import_node_fs4.chmodSync)(dir, 493);
+  for (const [key, value] of Object.entries(environment)) {
+    if (!ENV_NAME_RE.test(key)) {
+      debug(`skipping build env var with an unsupported name: ${key}`);
+      continue;
     }
+    const file = (0, import_node_path4.join)(dir, key);
+    (0, import_node_fs4.writeFileSync)(file, value);
+    (0, import_node_fs4.chmodSync)(file, 420);
+  }
+  return dir;
+}
+function readReportDigest(report) {
+  let parsed;
+  try {
+    parsed = (0, import_smol_toml.parse)(report);
   } catch {
+    return void 0;
   }
-  return endpoint;
+  const digest = parsed?.image?.digest;
+  if (typeof digest !== "string" || !DIGEST_RE.test(digest)) {
+    return void 0;
+  }
+  return digest;
 }
-function emit(out, line) {
-  if (out.onStderr) {
-    out.onStderr(Buffer.from(`${line}
-`));
-  } else {
-    process.stderr.write(`${line}
-`);
+function describeCreatorExitCode(code) {
+  if (code === void 0)
+    return void 0;
+  if (code === 20)
+    return "no buildpack detected the app";
+  if (code === 21) {
+    return "no buildpack detected the app and at least one errored during detection";
+  }
+  if (code >= 22 && code <= 29)
+    return "the detect phase failed";
+  if (code >= 30 && code <= 39)
+    return "the analyze phase failed";
+  if (code >= 40 && code <= 49)
+    return "the restore phase failed";
+  if (code === 51) {
+    return "a buildpack failed while building the app (e.g. installing dependencies) \u2014 its error is in the build output above";
+  }
+  if (code >= 50 && code <= 59)
+    return "the build phase failed";
+  if (code >= 60 && code <= 69) {
+    return "the export phase failed to write the image";
   }
+  return void 0;
 }
-function runForwarded(cmd, args, out, opts = {}) {
-  return new Promise((resolve, reject) => {
-    const child = (0, import_node_child_process3.spawn)(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
-    let stdout = "";
-    let stderr = "";
-    child.stdout?.on("data", (chunk) => {
-      stdout += chunk.toString();
-      if (!opts.quiet) {
-        if (out.onStdout) {
-          out.onStdout(chunk);
-        } else {
-          process.stderr.write(chunk.toString());
-        }
+function writeOrderDir(buildpack, parentDir = (0, import_node_os4.tmpdir)()) {
+  const order = {
+    order: [
+      {
+        group: buildpack.buildpacks.map((entry) => ({
+          id: entry.id,
+          version: entry.version
+        }))
       }
-    });
-    child.stderr?.on("data", (chunk) => {
-      stderr += chunk.toString();
-      if (!opts.quiet) {
-        if (out.onStderr) {
-          out.onStderr(chunk);
-        } else {
-          process.stderr.write(chunk.toString());
+    ]
+  };
+  const dir = (0, import_node_fs4.mkdtempSync)((0, import_node_path4.join)(parentDir, "vercel-cnb-order-"));
+  (0, import_node_fs4.chmodSync)(dir, 493);
+  const file = (0, import_node_path4.join)(dir, "order.toml");
+  (0, import_node_fs4.writeFileSync)(file, (0, import_smol_toml.stringify)(order));
+  (0, import_node_fs4.chmodSync)(file, 420);
+  return dir;
+}
+function cnbRegistryAuth(credentials) {
+  const { registry, username, token } = credentials;
+  const basic = Buffer.from(`${username}:${token}`).toString("base64");
+  return JSON.stringify({ [registry]: `Basic ${basic}` });
+}
+function assertPublishedArchive(name, archive) {
+  if (/^0{64}$/.test(archive.sha256)) {
+    throw new Error(
+      `The ${name} archive has not been published. Publish it and update its checksum in distribution.json.`
+    );
+  }
+}
+function assertPublishedDistribution(buildpack) {
+  assertPublishedArchive("CNB lifecycle", LIFECYCLE);
+  for (const entry of buildpack.buildpacks) {
+    assertPublishedArchive(
+      `${entry.id}@${entry.version} buildpack`,
+      vercelBuildpackArtifact(entry)
+    );
+  }
+}
+function distributionUrls(buildpack) {
+  return {
+    lifecycle: LIFECYCLE.url,
+    buildpacks: buildpack.buildpacks.map(
+      (entry) => vercelBuildpackArtifact(entry).url
+    )
+  };
+}
+async function downloadPinnedArchive(archive, destinationPath) {
+  const response = await fetch(archive.url);
+  if (!response.ok) {
+    throw new Error(
+      `Failed to fetch ${archive.url}: HTTP ${response.status} ${response.statusText}`
+    );
+  }
+  const contents = new Uint8Array(await response.arrayBuffer());
+  const checksum = (0, import_node_crypto2.createHash)("sha256").update(contents).digest("hex");
+  if (checksum !== archive.sha256) {
+    throw new Error(
+      `Checksum mismatch for ${archive.url}: expected ${archive.sha256}, received ${checksum}.`
+    );
+  }
+  (0, import_node_fs4.writeFileSync)(destinationPath, contents);
+}
+async function fetchPinnedArchive(archive, destinationDir) {
+  const archivePath = (0, import_node_path4.join)(destinationDir, `${archive.sha256}.tgz`);
+  try {
+    await downloadPinnedArchive(archive, archivePath);
+    (0, import_tar.extract)({ file: archivePath, cwd: destinationDir, sync: true });
+  } finally {
+    (0, import_node_fs4.rmSync)(archivePath, { force: true });
+  }
+}
+var LAYER_MEDIA_TYPE_RE = /(\.tar\.gzip|\.tar\+gzip|\.tar)$/;
+function readOciJson(path4) {
+  return JSON.parse((0, import_node_fs4.readFileSync)(path4, "utf8"));
+}
+function blobPath(layoutDir, digest) {
+  const match = digest.match(/^sha256:([0-9a-f]{64})$/);
+  if (!match) {
+    throw new Error(`Unsupported OCI digest ${JSON.stringify(digest)}.`);
+  }
+  return (0, import_node_path4.join)(layoutDir, "blobs", "sha256", match[1]);
+}
+async function fetchBuildpackage(archive, cnbDir) {
+  const layoutDir = (0, import_node_fs4.mkdtempSync)((0, import_node_path4.join)((0, import_node_os4.tmpdir)(), "vercel-cnb-buildpackage-"));
+  const archivePath = (0, import_node_path4.join)(layoutDir, "buildpackage.cnb");
+  try {
+    await downloadPinnedArchive(archive, archivePath);
+    await (0, import_tar.extract)({ file: archivePath, cwd: layoutDir });
+    const index = readOciJson(
+      (0, import_node_path4.join)(layoutDir, "index.json")
+    );
+    const manifestDigest = index.manifests?.[0]?.digest;
+    if (!manifestDigest) {
+      throw new Error(`${archive.url} has no image manifest in index.json.`);
+    }
+    const manifest = readOciJson(
+      blobPath(layoutDir, manifestDigest)
+    );
+    if (!manifest.layers?.length) {
+      throw new Error(`${archive.url} has an image manifest with no layers.`);
+    }
+    for (const layer of manifest.layers) {
+      if (!layer.digest || !LAYER_MEDIA_TYPE_RE.test(layer.mediaType ?? "")) {
+        throw new Error(
+          `${archive.url} has an unsupported layer media type ${JSON.stringify(
+            layer.mediaType
+          )}.`
+        );
+      }
+      const layerPath = blobPath(layoutDir, layer.digest);
+      const actual = (0, import_node_crypto2.createHash)("sha256").update(new Uint8Array((0, import_node_fs4.readFileSync)(layerPath))).digest("hex");
+      if (`sha256:${actual}` !== layer.digest) {
+        throw new Error(
+          `${archive.url} layer ${layer.digest} hashes to sha256:${actual}.`
+        );
+      }
+      await (0, import_tar.extract)({
+        file: layerPath,
+        cwd: cnbDir,
+        strict: true,
+        filter: (_path, entry) => {
+          if (!("path" in entry))
+            return false;
+          const match = entry.path.match(/^\/?cnb\/(buildpacks\/.*)$/);
+          if (!match || match[1].split("/").includes("..")) {
+            return false;
+          }
+          entry.path = match[1];
+          if (entry.type === "Link" && entry.linkpath) {
+            entry.linkpath = entry.linkpath.replace(/^\/?cnb\//, "");
+          }
+          return true;
+        }
+      });
+    }
+  } finally {
+    (0, import_node_fs4.rmSync)(layoutDir, { recursive: true, force: true });
+  }
+}
+async function fetchDistribution(buildpack, cnbDir) {
+  await Promise.all([
+    fetchPinnedArchive(LIFECYCLE, cnbDir),
+    ...buildpack.buildpacks.map(
+      (entry) => fetchBuildpackage(vercelBuildpackArtifact(entry), cnbDir)
+    )
+  ]);
+  for (const entry of buildpack.buildpacks) {
+    const directory = (0, import_node_path4.join)(
+      cnbDir,
+      "buildpacks",
+      entry.id.replace("/", "_"),
+      entry.version
+    );
+    for (const file of ["buildpack.toml", "bin/detect", "bin/build"]) {
+      if (!(0, import_node_fs4.statSync)((0, import_node_path4.join)(directory, file), { throwIfNoEntry: false })?.isFile()) {
+        throw new Error(
+          `Buildpack ${entry.id}@${entry.version} is missing ${file}.`
+        );
+      }
+    }
+  }
+}
+function creatorArgs(image, imageRef) {
+  return [
+    "-app=/workspace",
+    `-order=${ORDER_FILE}`,
+    "-skip-restore",
+    `-run-image=${image.runImage}`,
+    "-report=/platform-output/report.toml",
+    imageRef
+  ];
+}
+
+// src/buildpacks/lifecycle/buildah.ts
+var import_node_fs5 = require("fs");
+var import_node_crypto3 = require("crypto");
+var import_node_os5 = require("os");
+var import_node_path5 = require("path");
+async function runBuildah2(args, env) {
+  const storageArgs = await buildahStorageArgs();
+  return run("buildah", [...storageArgs, ...args], { env });
+}
+async function removeContainer(name) {
+  try {
+    await runBuildah2(["rm", name]);
+  } catch (error) {
+    debug(
+      `could not remove Buildah CNB container ${name}: ${error.message}`
+    );
+  }
+}
+var buildAndPushWithLifecycle = async (buildpack, params, span) => {
+  const urls = distributionUrls(buildpack);
+  return withSpan(
+    span,
+    "container.buildpack.lifecycle_registry_build",
+    {
+      "buildpack.runtime": buildpack.runtime,
+      "buildpack.runtime_version": params.image.version,
+      "buildpack.build_image": params.image.buildImage,
+      "buildpack.run_image": params.image.runImage,
+      "buildpack.lifecycle_url": urls.lifecycle,
+      "buildpack.archive_url": urls.buildpacks.join(","),
+      "buildpack.node_version": params.nodeToolchain?.version,
+      "image.ref": params.imageRef
+    },
+    async (lifecycleSpan) => {
+      assertPublishedDistribution(buildpack);
+      const suffix = `${process.pid}-${(0, import_node_crypto3.randomBytes)(4).toString("hex")}`;
+      const buildContainer = `vercel-cnb-${buildpack.runtime}-${suffix}`;
+      let cnbDir;
+      let reportDir;
+      let orderDir;
+      let platformEnvDir;
+      try {
+        reportDir = (0, import_node_fs5.mkdtempSync)((0, import_node_path5.join)((0, import_node_os5.tmpdir)(), "vercel-cnb-report-"));
+        const reportPath = (0, import_node_path5.join)(reportDir, "report.toml");
+        (0, import_node_fs5.chownSync)(reportDir, BUILD_USER_ID, BUILD_GROUP_ID);
+        (0, import_node_fs5.chmodSync)(reportDir, 493);
+        cnbDir = (0, import_node_fs5.mkdtempSync)((0, import_node_path5.join)((0, import_node_os5.tmpdir)(), "vercel-cnb-"));
+        (0, import_node_fs5.chmodSync)(cnbDir, 493);
+        orderDir = writeOrderDir(buildpack);
+        platformEnvDir = writePlatformEnvDir(params.buildEnv, {
+          nodeHome: params.nodeToolchain?.home
+        });
+        step("Fetching the CNB lifecycle and buildpacks...");
+        await fetchDistribution(buildpack, cnbDir);
+        done("fetched the CNB lifecycle and buildpacks");
+        step(
+          `Preparing ${buildpack.runtime} ${params.image.version} stock image and Vercel buildpacks`
+        );
+        await runBuildah2([
+          "from",
+          "--pull=always",
+          "--platform",
+          TARGET_PLATFORM,
+          "--name",
+          buildContainer,
+          params.image.buildImage
+        ]);
+        await runBuildah2([
+          "run",
+          "--network",
+          "host",
+          buildContainer,
+          "--",
+          "sh",
+          "-c",
+          `groupadd -g ${BUILD_GROUP_ID} cnb && useradd -m -u ${BUILD_USER_ID} -g ${BUILD_GROUP_ID} cnb && mkdir -p /layers /platform /workspace && chown -R ${BUILD_USER} /layers /platform /workspace /home/cnb`
+        ]);
+        await runBuildah2([
+          "copy",
+          "--chown",
+          BUILD_USER,
+          buildContainer,
+          params.workPath,
+          "/workspace"
+        ]);
+        const platformEnvMount = [
+          "--volume",
+          `${platformEnvDir}:/platform/env:ro`
+        ];
+        const nodeToolchainMount = params.nodeToolchain ? [
+          "--volume",
+          `${params.nodeToolchain.home}:${params.nodeToolchain.home}:ro`
+        ] : [];
+        const lifecycleEnv = {
+          ...process.env,
+          CNB_REGISTRY_AUTH: cnbRegistryAuth(params.credentials)
+        };
+        step(
+          `Building and publishing ${params.imageRef} via Vercel ${buildpack.runtime} buildpacks`
+        );
+        await runBuildah2(
+          [
+            "run",
+            "--network",
+            "host",
+            "--user",
+            BUILD_USER,
+            "--env",
+            "HOME=/home/cnb",
+            "--env",
+            `CNB_USER_ID=${BUILD_USER_ID}`,
+            "--env",
+            `CNB_GROUP_ID=${BUILD_GROUP_ID}`,
+            "--env",
+            `CNB_PLATFORM_API=${CNB_PLATFORM_API}`,
+            "--env",
+            "CNB_REGISTRY_AUTH",
+            "--volume",
+            `${cnbDir}:/cnb:ro`,
+            "--volume",
+            `${reportDir}:/platform-output`,
+            "--volume",
+            `${orderDir}:${ORDER_MOUNT_DIR}:ro`,
+            ...nodeToolchainMount,
+            ...platformEnvMount,
+            buildContainer,
+            "--",
+            "/cnb/lifecycle/creator",
+            ...creatorArgs(params.image, params.imageRef)
+          ],
+          lifecycleEnv
+        );
+        const digest = readReportDigest((0, import_node_fs5.readFileSync)(reportPath, "utf8"));
+        if (!digest) {
+          throw new Error(
+            `${buildpack.runtime} buildpack lifecycle did not report a digest.`
+          );
+        }
+        done(`built and published ${params.imageRef}@${digest}`);
+        lifecycleSpan?.setAttributes({ "image.digest": digest });
+        return {
+          imageRef: params.imageRef,
+          digest,
+          buildImage: params.image.buildImage,
+          runImage: params.image.runImage,
+          runtimeVersion: params.image.version
+        };
+      } catch (error) {
+        const exitCode = error.exitCode;
+        const hint = describeCreatorExitCode(exitCode);
+        lifecycleSpan?.setAttributes({
+          ...exitCode !== void 0 ? { "buildpack.lifecycle.exit_code": String(exitCode) } : {},
+          ...hint ? { "buildpack.lifecycle.failure_phase": hint } : {}
+        });
+        throw new Error(
+          [
+            `${buildpack.runtime} buildpack build failed via lifecycle/creator (${params.image.buildImage}).`,
+            `Lifecycle archive: ${urls.lifecycle}`,
+            ...urls.buildpacks.map((url) => `Buildpack archive: ${url}`),
+            ...hint ? [`The lifecycle exited with code ${exitCode}: ${hint}.`] : [],
+            "",
+            `Underlying error: ${error.message}`,
+            "",
+            `Buildpack project is ${params.workPath}`
+          ].join("\n")
+        );
+      } finally {
+        await removeContainer(buildContainer);
+        for (const dir of [cnbDir, reportDir, orderDir, platformEnvDir]) {
+          if (dir) {
+            try {
+              (0, import_node_fs5.rmSync)(dir, { recursive: true, force: true });
+            } catch {
+              debug(`Could not remove Buildah build scratch directory ${dir}.`);
+            }
+          }
+        }
+      }
+    }
+  );
+};
+
+// src/buildpacks/lifecycle/docker.ts
+var import_node_crypto4 = require("crypto");
+var import_node_fs6 = require("fs");
+var import_node_os6 = require("os");
+var import_node_path6 = require("path");
+function localBuildImageDockerfile(buildImage, nodeMajor) {
+  const lines = [];
+  if (nodeMajor !== void 0) {
+    lines.push(
+      `FROM docker.io/library/node:${nodeMajor}-bookworm-slim AS node`
+    );
+  }
+  lines.push(`FROM ${buildImage}`);
+  if (nodeMajor !== void 0) {
+    lines.push(`COPY --from=node /usr/local /node${nodeMajor}`);
+  }
+  lines.push(
+    `RUN groupadd --gid ${BUILD_GROUP_ID} cnb && useradd --create-home --uid ${BUILD_USER_ID} --gid ${BUILD_GROUP_ID} cnb && mkdir -p /layers /platform /workspace && chown -R ${BUILD_USER} /layers /workspace /home/cnb`
+  );
+  return `${lines.join("\n")}
+`;
+}
+function localBuildImageTag(dockerfile) {
+  const hash = (0, import_node_crypto4.createHash)("sha256").update(dockerfile).digest("hex");
+  return `vercel-cnb-build:${hash.slice(0, 16)}`;
+}
+async function runDocker2(args, opts = {}) {
+  debug(`exec: docker ${args.join(" ")}`);
+  return run("docker", args, opts);
+}
+var buildAndPushWithLifecycleDocker = async (buildpack, params, span) => {
+  const urls = distributionUrls(buildpack);
+  return withSpan(
+    span,
+    "container.buildpack.lifecycle_docker_build",
+    {
+      "buildpack.runtime": buildpack.runtime,
+      "buildpack.runtime_version": params.image.version,
+      "buildpack.build_image": params.image.buildImage,
+      "buildpack.run_image": params.image.runImage,
+      "buildpack.lifecycle_url": urls.lifecycle,
+      "buildpack.archive_url": urls.buildpacks.join(","),
+      "buildpack.node_version": params.nodeToolchain?.version,
+      "image.ref": params.imageRef
+    },
+    async (lifecycleSpan) => {
+      assertPublishedDistribution(buildpack);
+      let stageDir;
+      const containers = [];
+      try {
+        stageDir = (0, import_node_fs6.mkdtempSync)((0, import_node_path6.join)((0, import_node_os6.tmpdir)(), "vercel-cnb-"));
+        const cnbDir = (0, import_node_path6.join)(stageDir, "cnb");
+        (0, import_node_fs6.mkdirSync)(cnbDir, { mode: 493 });
+        const orderDir = writeOrderDir(buildpack, stageDir);
+        const platformEnvDir = writePlatformEnvDir(
+          params.buildEnv,
+          { nodeHome: params.nodeToolchain?.home },
+          stageDir
+        );
+        step("Fetching the CNB lifecycle and buildpacks...");
+        await fetchDistribution(buildpack, cnbDir);
+        done("fetched the CNB lifecycle and buildpacks");
+        const dockerfile = localBuildImageDockerfile(
+          params.image.buildImage,
+          params.nodeToolchain?.major
+        );
+        const buildImageTag = localBuildImageTag(dockerfile);
+        const buildImageIdPath = (0, import_node_path6.join)(stageDir, "build-image.id");
+        step(
+          `Preparing ${buildpack.runtime} ${params.image.version} build image` + (params.nodeToolchain ? ` with Node.js ${params.nodeToolchain.major}` : "")
+        );
+        await runDocker2(
+          [
+            "build",
+            "--pull",
+            "--platform",
+            TARGET_PLATFORM,
+            "--tag",
+            buildImageTag,
+            "--iidfile",
+            buildImageIdPath,
+            "-"
+          ],
+          { input: dockerfile }
+        );
+        const buildImageId = (0, import_node_fs6.readFileSync)(buildImageIdPath, "utf8").trim();
+        if (!/^sha256:[a-f0-9]{64}$/.test(buildImageId)) {
+          throw new Error("Docker build did not report a valid image ID.");
+        }
+        const containerName = `vercel-cnb-${buildpack.runtime}-${process.pid}-${(0, import_node_crypto4.randomBytes)(8).toString("hex")}`;
+        const initContainerName = `${containerName}-init`;
+        containers.push(initContainerName);
+        await runDocker2([
+          "create",
+          "--name",
+          initContainerName,
+          "--platform",
+          TARGET_PLATFORM,
+          "--user",
+          "0:0",
+          "--network",
+          "none",
+          "--volume",
+          "/workspace",
+          "--volume",
+          "/layers",
+          "--volume",
+          "/platform-output",
+          "--volume",
+          "/cnb",
+          "--volume",
+          "/platform",
+          "--entrypoint",
+          "/bin/sh",
+          buildImageId,
+          "-c",
+          `chown -R -h ${BUILD_USER} /workspace /layers /platform-output && chown -R -h 0:0 /cnb /platform`
+        ]);
+        step("Copying the project into the build workspace");
+        await runDocker2([
+          "cp",
+          `${params.workPath}/.`,
+          `${initContainerName}:/workspace`
+        ]);
+        for (const [source, destination] of [
+          [`${cnbDir}/.`, "/cnb"],
+          [orderDir, ORDER_MOUNT_DIR],
+          [platformEnvDir, "/platform/env"]
+        ]) {
+          await runDocker2([
+            "cp",
+            source,
+            `${initContainerName}:${destination}`
+          ]);
+        }
+        await runDocker2(["start", "--attach", initContainerName]);
+        const lifecycleEnv = {
+          ...process.env,
+          CNB_REGISTRY_AUTH: cnbRegistryAuth(params.credentials)
+        };
+        containers.push(containerName);
+        await runDocker2(
+          [
+            "create",
+            "--name",
+            containerName,
+            "--platform",
+            TARGET_PLATFORM,
+            "--user",
+            BUILD_USER,
+            "--env",
+            "HOME=/home/cnb",
+            "--env",
+            `CNB_USER_ID=${BUILD_USER_ID}`,
+            "--env",
+            `CNB_GROUP_ID=${BUILD_GROUP_ID}`,
+            "--env",
+            `CNB_PLATFORM_API=${CNB_PLATFORM_API}`,
+            "--env",
+            "CNB_REGISTRY_AUTH",
+            "--volumes-from",
+            initContainerName,
+            "--entrypoint",
+            "/cnb/lifecycle/creator",
+            buildImageId,
+            ...creatorArgs(params.image, params.imageRef)
+          ],
+          { env: lifecycleEnv }
+        );
+        step(
+          `Building and publishing ${params.imageRef} via Vercel ${buildpack.runtime} buildpacks`
+        );
+        await runDocker2(["start", "--attach", containerName]);
+        const reportPath = (0, import_node_path6.join)(stageDir, "report.toml");
+        await runDocker2([
+          "cp",
+          `${containerName}:/platform-output/report.toml`,
+          reportPath
+        ]);
+        const digest = readReportDigest((0, import_node_fs6.readFileSync)(reportPath, "utf8"));
+        if (!digest) {
+          throw new Error(
+            `${buildpack.runtime} buildpack lifecycle did not report a digest.`
+          );
+        }
+        done(`built and published ${params.imageRef}@${digest}`);
+        lifecycleSpan?.setAttributes({ "image.digest": digest });
+        return {
+          imageRef: params.imageRef,
+          digest,
+          buildImage: params.image.buildImage,
+          runImage: params.image.runImage,
+          runtimeVersion: params.image.version
+        };
+      } catch (error) {
+        const exitCode = error.exitCode;
+        const hint = describeCreatorExitCode(exitCode);
+        lifecycleSpan?.setAttributes({
+          ...exitCode !== void 0 ? { "buildpack.lifecycle.exit_code": String(exitCode) } : {},
+          ...hint ? { "buildpack.lifecycle.failure_phase": hint } : {}
+        });
+        throw new Error(
+          [
+            `${buildpack.runtime} buildpack build failed via docker (${params.image.buildImage}).`,
+            ...hint ? [`The lifecycle exited with code ${exitCode}: ${hint}.`] : [],
+            "",
+            `Underlying error: ${error.message}`,
+            "",
+            `Buildpack project is ${params.workPath}`
+          ].join("\n")
+        );
+      } finally {
+        for (const container of containers.reverse()) {
+          try {
+            await runDocker2(["rm", "--force", "--volumes", container], {
+              quiet: true
+            });
+          } catch {
+            debug(`Could not remove Docker build container ${container}.`);
+          }
+        }
+        if (stageDir) {
+          try {
+            (0, import_node_fs6.rmSync)(stageDir, { recursive: true, force: true });
+          } catch {
+            debug(
+              `Could not remove Docker build scratch directory ${stageDir}.`
+            );
+          }
+        }
+      }
+    }
+  );
+};
+
+// src/buildpacks/node-toolchain.ts
+var import_build_utils4 = require("@vercel/build-utils");
+var import_node_fs7 = require("fs");
+var import_node_path7 = require("path");
+async function selectNodeMajor(workPath, config, meta) {
+  if (!(0, import_node_fs7.existsSync)((0, import_node_path7.join)(workPath, "package.json"))) {
+    return void 0;
+  }
+  const version2 = await (0, import_build_utils4.getNodeVersion)(workPath, void 0, config, meta);
+  if ((0, import_build_utils4.isBunVersion)(version2)) {
+    throw new Error(
+      "Buildpack asset builds require Node.js. Bun is not supported yet; configure engines.node or use Dockerfile.vercel."
+    );
+  }
+  return {
+    home: `/node${version2.major}`,
+    version: version2.range,
+    major: version2.major
+  };
+}
+async function resolveNodeToolchain(workPath, config, meta) {
+  const toolchain = await selectNodeMajor(workPath, config, meta);
+  if (!toolchain) {
+    return void 0;
+  }
+  for (const executable of ["node", "npm"]) {
+    if (!(0, import_node_fs7.existsSync)((0, import_node_path7.join)(toolchain.home, "bin", executable))) {
+      throw new Error(
+        `The selected Node.js ${toolchain.version} installation is missing ${toolchain.home}/bin/${executable} in the build environment.`
+      );
+    }
+  }
+  return toolchain;
+}
+async function resolveLocalNodeToolchain(workPath, config, meta) {
+  return selectNodeMajor(workPath, config, meta);
+}
+
+// src/buildpacks/registry.ts
+var import_node_fs9 = require("fs");
+var import_node_path9 = require("path");
+
+// src/buildpacks/ruby.ts
+var import_node_fs8 = require("fs");
+var import_node_path8 = require("path");
+var import_smol_toml2 = require("smol-toml");
+var DEFAULT_RUBY_VERSION = "3.4";
+var RUBY_IMAGE_REPOSITORY = "docker.io/library/ruby";
+var RUBY_VERSION_DOCS = "https://vercel.link/ruby-version";
+var RUBY_VERSION_FILES = [
+  ".ruby-version",
+  ".tool-versions",
+  "mise.toml"
+];
+var VERSION_FILE_RE = /^ruby[\s-]*(?:=\s*)?["']?([^\s#"']+)["']?/m;
+var VERSION_RE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)(?:\.(0|[1-9]\d*))?$/;
+var GEMFILE_RUBY_CALL_RE = /^\s*ruby\b(?!\s*:)/;
+var GEMFILE_RUBY_LINE_RE = /^\s*ruby(?:\s*\(\s*("[^"]*"|'[^']*')\s*\)|\s*("[^"]*"|'[^']*'))\s*(?:#.*)?$/;
+var ruby = {
+  runtime: "ruby",
+  projectMarkers: ["Gemfile"],
+  buildpacks: [vercelBuildpack("ruby")],
+  async resolveImage(workPath) {
+    const version2 = selectRubyVersion(workPath) ?? DEFAULT_RUBY_VERSION;
+    const image = `${RUBY_IMAGE_REPOSITORY}:${version2}`;
+    return { version: version2, buildImage: image, runImage: image };
+  }
+};
+function isValidVersion(version2) {
+  return VERSION_RE.test(version2) && version2.split(".").every((n) => Number.isSafeInteger(+n));
+}
+function selectRubyVersion(workPath) {
+  for (const name of RUBY_VERSION_FILES) {
+    const file = (0, import_node_path8.join)(workPath, name);
+    if ((0, import_node_fs8.existsSync)(file)) {
+      return parseVersionFile(name, (0, import_node_fs8.readFileSync)(file, "utf8"));
+    }
+  }
+  const gemfile = (0, import_node_path8.join)(workPath, "Gemfile");
+  return (0, import_node_fs8.existsSync)(gemfile) ? parseGemfileRubyVersion((0, import_node_fs8.readFileSync)(gemfile, "utf8")) : void 0;
+}
+function parseVersionFile(name, contents) {
+  let version2;
+  if (name === "mise.toml") {
+    try {
+      const { tools } = (0, import_smol_toml2.parse)(contents);
+      version2 = typeof tools === "object" && "ruby" in tools ? tools.ruby : void 0;
+    } catch (error) {
+      throw new Error(`Invalid ${name}: ${error.message}`);
+    }
+  } else {
+    version2 = VERSION_FILE_RE.exec(contents)?.[1] ?? contents.trim();
+  }
+  if (typeof version2 !== "string" || !isValidVersion(version2)) {
+    throw new Error(
+      `Invalid Ruby version in ${name}: ${JSON.stringify(version2)}. Expected a numeric major.minor or major.minor.patch version such as 3.4.1; only MRI is supported. Learn more: ${RUBY_VERSION_DOCS}`
+    );
+  }
+  return version2;
+}
+function parseGemfileRubyVersion(contents) {
+  const lines = contents.split(/\r?\n/).filter((line2) => GEMFILE_RUBY_CALL_RE.test(line2));
+  if (lines.length === 0)
+    return void 0;
+  const [line] = lines;
+  const match = lines.length === 1 ? GEMFILE_RUBY_LINE_RE.exec(line) : null;
+  const version2 = (match?.[1] ?? match?.[2])?.slice(1, -1);
+  if (version2 === void 0 || !isValidVersion(version2)) {
+    throw new Error(
+      `Unsupported ruby declaration in Gemfile: ${JSON.stringify(line.trim())}. Pin Ruby with a .ruby-version, .tool-versions, or mise.toml file, or declare an exact version such as ruby "3.4.1". Version operators, engine:, patchlevel:, file:, and computed values are not supported. Learn more: ${RUBY_VERSION_DOCS}`
+    );
+  }
+  return [...version2.split("."), "0"].slice(0, 3).join(".");
+}
+
+// src/buildpacks/registry.ts
+var BUILDPACKS = [ruby];
+function requestedBuildpack(config) {
+  if (!config)
+    return void 0;
+  return BUILDPACKS.find((bp) => bp.runtime === config.buildpack);
+}
+function hasProjectMarkers(buildpack, workPath) {
+  return buildpack.projectMarkers.some(
+    (name) => (0, import_node_fs9.existsSync)((0, import_node_path9.join)(workPath, name))
+  );
+}
+
+// src/buildpacks/build.ts
+async function buildAndPushBuildpack(params) {
+  const sourceDir = (0, import_node_fs10.mkdtempSync)((0, import_node_path10.join)((0, import_node_os7.tmpdir)(), "vercel-cnb-source-"));
+  try {
+    step("Staging buildpack source files");
+    await stageWorkspace(params, sourceDir);
+    const engine = selectContainerEngine();
+    if (!hasProjectMarkers(params.buildpack, sourceDir)) {
+      throw new Error(
+        `The ${params.buildpack.runtime} buildpack was selected, but no supported project marker was found in the service sources. Add ${params.buildpack.projectMarkers.join(" or ")}, or add a Dockerfile.vercel to control the image build.`
+      );
+    }
+    const image = await params.buildpack.resolveImage(sourceDir);
+    const nodeToolchain = engine.name === "buildah" ? await resolveNodeToolchain(sourceDir, params.config, params.meta) : await resolveLocalNodeToolchain(
+      sourceDir,
+      params.config,
+      params.meta
+    );
+    return await withSpan(
+      params.parentSpan,
+      "container.buildpack.build_and_push",
+      {
+        "buildpack.runtime": params.buildpack.runtime,
+        "buildpack.runtime_version": image.version,
+        "buildpack.node_version": nodeToolchain?.version,
+        "container.engine": engine.name,
+        "container.repository": params.repository
+      },
+      async (buildSpan) => {
+        const target = await resolveRegistryTarget({
+          repository: params.repository,
+          tag: params.tag,
+          span: buildSpan
+        });
+        buildSpan?.setAttributes({
+          "container.repository": target.fullRepository,
+          "image.tag": params.tag,
+          "image.ref": target.imageRef,
+          "registry.username": target.username
+        });
+        return engine.withRuntime(buildSpan, async () => {
+          await withSpan(
+            buildSpan,
+            "container.ensure_toolchain_ready",
+            { "container.engine": engine.name },
+            (s) => engine.ensureReady(s)
+          );
+          await withSpan(
+            buildSpan,
+            "container.verify_storage",
+            { "container.engine": engine.name },
+            (s) => engine.verifyStorage?.(s) ?? Promise.resolve()
+          );
+          const credentials = {
+            registry: VCR_REGISTRY,
+            username: target.username,
+            token: target.token
+          };
+          step(`Authenticating to ${VCR_REGISTRY} as ${target.username}`);
+          await withSpan(
+            buildSpan,
+            "container.registry_login",
+            {
+              "container.registry": VCR_REGISTRY,
+              "registry.username": target.username
+            },
+            () => engine.login(credentials)
+          );
+          done("authenticated");
+          await withSpan(
+            buildSpan,
+            "container.ensure_repository",
+            { "container.repository": params.repository },
+            (s) => ensureRepository(
+              params.repository,
+              target.token,
+              target.claims,
+              s
+            )
+          );
+          const runLifecycle = engine.name === "buildah" ? buildAndPushWithLifecycle : buildAndPushWithLifecycleDocker;
+          const result = await runLifecycle(
+            params.buildpack,
+            {
+              workPath: sourceDir,
+              image,
+              imageRef: target.imageRef,
+              credentials,
+              buildEnv: params.buildEnv,
+              nodeToolchain
+            },
+            buildSpan
+          );
+          const resolvedRef = `${VCR_REGISTRY}/${target.fullRepository}@${result.digest}`;
+          buildSpan?.setAttributes({
+            "image.digest": result.digest,
+            "image.resolved_ref": resolvedRef
+          });
+          info(`Image reference ${resolvedRef}`);
+          return resolvedRef;
+        });
+      }
+    );
+  } finally {
+    try {
+      (0, import_node_fs10.rmSync)(sourceDir, { recursive: true, force: true });
+    } catch {
+      debug(`Could not remove buildpack source snapshot ${sourceDir}.`);
+    }
+  }
+}
+
+// src/image-source.ts
+var import_node_fs11 = require("fs");
+var import_node_path11 = __toESM(require("path"));
+var DETECT_SENTINEL = "<detect>";
+function resolveImageSource(options, context) {
+  const { config, workPath, entrypoint } = options;
+  const entrypointRef = readString(entrypoint);
+  const isDetectSentinel = entrypointRef === DETECT_SENTINEL;
+  const buildpack = requestedBuildpack(config);
+  if (buildpack && !isDetectSentinel) {
+    throw new Error(
+      "Buildpack builds are selected by Vercel from the project's framework or the service's runtime; `buildpack` is not a `builds` configuration option."
+    );
+  }
+  const dockerfileConfigured = entrypointRef && isDockerfileRef(entrypointRef) ? entrypointRef : findDockerfile(workPath);
+  const dockerfileRel = dockerfileConfigured ?? "Dockerfile";
+  const dockerfilePath = import_node_path11.default.join(workPath, dockerfileRel);
+  const hasDockerfile = dockerfileConfigured !== void 0 || !buildpack && (0, import_node_fs11.existsSync)(dockerfilePath);
+  if (hasDockerfile) {
+    return { kind: "dockerfile", dockerfileRel, dockerfilePath };
+  }
+  const prebuiltImage = readString(config.handler) ?? (isDetectSentinel ? void 0 : entrypointRef);
+  if (prebuiltImage) {
+    return { kind: "prebuilt", imageRef: prebuiltImage };
+  }
+  if (buildpack) {
+    return { kind: "buildpack", buildpack };
+  }
+  throw new Error(
+    "Container service must specify an entrypoint: a prebuilt OCI image reference, or a Dockerfile path to " + (context === "dev" ? "run with `vercel dev`." : "build.")
+  );
+}
+
+// src/dev.ts
+var import_node_child_process3 = require("child_process");
+var import_node_fs12 = require("fs");
+var import_node_os8 = require("os");
+var import_node_path12 = __toESM(require("path"));
+var HOST_ONLY_ENV = /* @__PURE__ */ new Set([
+  "TMPDIR",
+  "TMP",
+  "TEMP",
+  "HOME",
+  "PATH",
+  "PWD",
+  "OLDPWD",
+  "SHELL",
+  "SHLVL",
+  "USER",
+  "LOGNAME",
+  "TERM",
+  "TERM_PROGRAM",
+  "TERM_PROGRAM_VERSION",
+  "TERM_SESSION_ID",
+  "COLORTERM",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "COMMAND_MODE",
+  "SECURITYSESSIONID",
+  "__CF_USER_TEXT_ENCODING",
+  "__CFBundleIdentifier"
+]);
+function isHostOnlyEnvVar(key) {
+  return HOST_ONLY_ENV.has(key) || key.startsWith("__") || key.startsWith("XPC_") || key.startsWith("SSH_") || key.startsWith("Apple");
+}
+function writeEnvFile(env) {
+  const dir = (0, import_node_fs12.mkdtempSync)(import_node_path12.default.join((0, import_node_os8.tmpdir)(), "vercel-container-dev-env-"));
+  const file = import_node_path12.default.join(dir, "env");
+  const lines = [];
+  for (const [key, value] of Object.entries(env)) {
+    if (value.includes("\n")) {
+      continue;
+    }
+    lines.push(`${key}=${value}`);
+  }
+  (0, import_node_fs12.writeFileSync)(file, `${lines.join("\n")}
+`);
+  return file;
+}
+function useContainerHost(endpoint) {
+  try {
+    const url = new URL(endpoint);
+    if (url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]") {
+      url.hostname = "host.docker.internal";
+      return url.toString();
+    }
+  } catch {
+  }
+  return endpoint;
+}
+function emit(out, line) {
+  if (out.onStderr) {
+    out.onStderr(Buffer.from(`${line}
+`));
+  } else {
+    process.stderr.write(`${line}
+`);
+  }
+}
+function runForwarded(cmd, args, out, opts = {}) {
+  return new Promise((resolve2, reject) => {
+    const child = (0, import_node_child_process3.spawn)(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk.toString();
+      if (!opts.quiet) {
+        if (out.onStdout) {
+          out.onStdout(chunk);
+        } else {
+          process.stderr.write(chunk.toString());
+        }
+      }
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += chunk.toString();
+      if (!opts.quiet) {
+        if (out.onStderr) {
+          out.onStderr(chunk);
+        } else {
+          process.stderr.write(chunk.toString());
         }
       }
     });
@@ -1182,7 +2286,7 @@ function runForwarded(cmd, args, out, opts = {}) {
     });
     child.on("close", (code) => {
       if (code === 0) {
-        resolve({ stdout });
+        resolve2({ stdout });
       } else {
         const detail = stderr.trim().split("\n").slice(-5).join("\n");
         reject(
@@ -1195,41 +2299,30 @@ ${detail}` : "")
     });
   });
 }
-function normalizeCommand(command) {
-  if (typeof command === "string") {
-    return [command];
-  }
-  if (Array.isArray(command) && command.every((item) => typeof item === "string")) {
-    return command;
-  }
-  return void 0;
-}
 async function resolveDevImage(options, out, span) {
-  const { config, workPath, entrypoint } = options;
-  const entrypointRef = readString(entrypoint);
-  const dockerfileConfigured = entrypointRef && isDockerfileRef(entrypointRef) ? entrypointRef : findDockerfile(workPath);
-  const dockerfileRel = dockerfileConfigured ?? "Dockerfile";
-  const dockerfilePath = import_node_path4.default.join(workPath, dockerfileRel);
-  const hasDockerfile = dockerfileConfigured !== void 0 || (0, import_node_fs4.existsSync)(dockerfilePath);
-  const prebuiltImage = readString(config.handler) ?? (hasDockerfile ? void 0 : entrypointRef);
-  if (!hasDockerfile) {
-    if (!prebuiltImage) {
-      throw new Error(
-        "Container service must specify an entrypoint: a prebuilt OCI image reference, or a Dockerfile path to run with `vercel dev`."
-      );
-    }
+  const source = resolveImageSource(options, "dev");
+  if (source.kind === "prebuilt") {
     span?.setAttributes({ "container.dev_mode": "prebuilt" });
-    emit(out, `\u25B2 container  vercel dev: using prebuilt image ${prebuiltImage}`);
-    return prebuiltImage;
+    emit(
+      out,
+      `\u25B2 container  vercel dev: using prebuilt image ${source.imageRef}`
+    );
+    return { image: source.imageRef };
+  }
+  if (source.kind === "buildpack") {
+    throw new Error(
+      `Unexpected buildpack image source in \`vercel dev\` for "${options.workPath}".`
+    );
   }
-  if (!(0, import_node_fs4.existsSync)(dockerfilePath)) {
+  const { dockerfilePath } = source;
+  if (!(0, import_node_fs12.existsSync)(dockerfilePath)) {
     throw new Error(
       `Dockerfile not found at "${dockerfilePath}" for container service.`
     );
   }
   const serviceName = options.service?.name ?? "service";
   const tag = devImageTag(serviceName);
-  const contextDir = import_node_path4.default.dirname(dockerfilePath);
+  const contextDir = import_node_path12.default.dirname(dockerfilePath);
   const buildArgFlags2 = [];
   const buildEnv = options.meta?.buildEnv ?? {};
   for (const [key, value] of Object.entries(buildEnv)) {
@@ -1245,7 +2338,7 @@ async function resolveDevImage(options, out, span) {
     out
   );
   emit(out, `\u25B2 container  built ${tag}`);
-  return tag;
+  return { image: tag };
 }
 async function resolveContainerPort(image, out) {
   try {
@@ -1355,7 +2448,7 @@ async function startContainer(options, reuseKey) {
       const { config, meta, onStdout, onStderr } = options;
       const out = { onStdout, onStderr };
       await assertDockerAvailable(out);
-      const image = await withSpan(
+      const { image } = await withSpan(
         span,
         "container.dev.resolve_image",
         {},
@@ -1385,9 +2478,8 @@ async function startContainer(options, reuseKey) {
       }
       mergedEnv.PORT = String(containerPort);
       const envFilePath = writeEnvFile(mergedEnv);
-      const command = normalizeCommand(
-        config.command
-      );
+      const rawCommand = config.command;
+      const command = normalizeCommand(rawCommand);
       const requestedHostPort = typeof meta?.port === "number" ? meta.port : 0;
       const args = [
         "run",
@@ -1421,7 +2513,7 @@ async function startContainer(options, reuseKey) {
         }
       });
       const cleanupEnvFile = () => {
-        (0, import_node_fs4.rmSync)(import_node_path4.default.dirname(envFilePath), { recursive: true, force: true });
+        (0, import_node_fs12.rmSync)(import_node_path12.default.dirname(envFilePath), { recursive: true, force: true });
       };
       const shutdown = async () => {
         runningContainers.delete(reuseKey);
@@ -1454,7 +2546,7 @@ async function startContainer(options, reuseKey) {
             break;
           } catch (err) {
             lastErr = err;
-            await new Promise((resolve) => setTimeout(resolve, 250));
+            await new Promise((resolve2) => setTimeout(resolve2, 250));
           }
         }
         if (hostPort === void 0) {
@@ -1497,11 +2589,11 @@ async function startContainer(options, reuseKey) {
 }
 
 // src/prepare-cache.ts
-var import_build_utils3 = require("@vercel/build-utils");
-var import_node_fs5 = require("fs");
-var import_node_path5 = require("path");
+var import_build_utils5 = require("@vercel/build-utils");
+var import_node_fs13 = require("fs");
+var import_node_path13 = require("path");
 var CACHE_ROOT = "/vercel";
-var GRAPH_ROOT_REL = import_node_path5.posix.relative(CACHE_ROOT, BUILDAH_GRAPH_ROOT);
+var GRAPH_ROOT_REL = import_node_path13.posix.relative(CACHE_ROOT, BUILDAH_GRAPH_ROOT);
 async function prepareCache(_options) {
   if (process.env.VERCEL_VCR_DISABLE_LAYER_CACHE) {
     debug("layer cache disabled (VERCEL_VCR_DISABLE_LAYER_CACHE)");
@@ -1511,12 +2603,12 @@ async function prepareCache(_options) {
     debug("skipping container layer cache (not in build container)");
     return {};
   }
-  if (!(0, import_node_fs5.existsSync)(BUILDAH_GRAPH_ROOT)) {
+  if (!(0, import_node_fs13.existsSync)(BUILDAH_GRAPH_ROOT)) {
     debug(`no buildah store to cache at ${BUILDAH_GRAPH_ROOT}`);
     return {};
   }
   const start = Date.now();
-  const files = await (0, import_build_utils3.glob)(`${GRAPH_ROOT_REL}/**`, CACHE_ROOT);
+  const files = await (0, import_build_utils5.glob)(`${GRAPH_ROOT_REL}/**`, CACHE_ROOT);
   const count = Object.keys(files).length;
   info(
     `cached container layer store: ${count} files from ${BUILDAH_GRAPH_ROOT} in ${Date.now() - start}ms`
@@ -1534,15 +2626,6 @@ function resolveFunctionSourceFile(options) {
   }
   return entrypoint;
 }
-function normalizeCommand2(command) {
-  if (typeof command === "string") {
-    return [command];
-  }
-  if (Array.isArray(command) && command.every((item) => typeof item === "string")) {
-    return command;
-  }
-  return void 0;
-}
 function sanitizeRepository(name) {
   const sanitized = name.toLowerCase().replace(/[^a-z0-9-_./]/g, "-").replace(/-+/g, "-").replace(/(^[-/.]+)|([-/.]+$)/g, "");
   return sanitized || "service";
@@ -1558,6 +2641,33 @@ function resolveImageTag() {
   }
   return `build-${Date.now().toString(36)}`;
 }
+async function authenticateRegistry(engine, buildParams, span) {
+  const forceLogin = readString(process.env.VERCEL_VCR_FORCE_LOGIN) === "1";
+  const authFile = forceLogin ? void 0 : existingRegistryAuthFile();
+  if (authFile) {
+    debug(`registry auth file present: ${authFile}`);
+    step(`Using registry credentials from ${authFile}`);
+    span?.setAttributes({
+      "container.registry": VCR_REGISTRY,
+      "registry.username": buildParams.username,
+      "registry.auth_file": authFile,
+      "registry.login_skipped": toTag(true)
+    });
+    done("authenticated via provisioned credentials");
+    return;
+  }
+  step(`Authenticating to ${VCR_REGISTRY} as ${buildParams.username}`);
+  await withSpan(
+    span,
+    "container.registry_login",
+    {
+      "container.registry": VCR_REGISTRY,
+      "registry.username": buildParams.username
+    },
+    () => engine.login(buildParams)
+  );
+  done("authenticated");
+}
 async function buildAndPushImage(params) {
   const { contextDir, dockerfilePath, repository, tag, buildArgs, parentSpan } = params;
   const engine = selectContainerEngine();
@@ -1570,25 +2680,12 @@ async function buildAndPushImage(params) {
       "container.repository": repository
     },
     async (buildSpan) => {
-      const token = await withSpan(
-        buildSpan,
-        "container.mint_oidc",
-        {},
-        (s) => resolveOidcTokenForBuild(s)
-      );
-      const claims = decodeOidcClaims(token);
-      debug(`registry token: ${tokenFingerprint(token)}`);
-      debugTokenClaims("OIDC token claims", token);
-      const username = claims.owner_id;
-      if (!username) {
-        throw new Error(
-          "VERCEL_OIDC_TOKEN is missing the `owner_id` (team id) claim required to authenticate to the container registry."
-        );
-      }
-      const fullRepository = [claims.owner, claims.project, repository].join(
-        "/"
-      );
-      const imageRef = `${VCR_REGISTRY}/${fullRepository}:${tag}`;
+      const target = await resolveRegistryTarget({
+        repository,
+        tag,
+        span: buildSpan
+      });
+      const { token, claims, username, fullRepository, imageRef } = target;
       buildSpan?.setAttributes({
         "container.repository": fullRepository,
         "image.tag": tag,
@@ -1625,31 +2722,7 @@ async function buildAndPushImage(params) {
           buildArgs,
           span: buildSpan
         };
-        const forceLogin = readString(process.env.VERCEL_VCR_FORCE_LOGIN) === "1";
-        const authFile = forceLogin ? void 0 : existingRegistryAuthFile();
-        if (authFile) {
-          debug(`registry auth file present: ${authFile}`);
-          step(`Using registry credentials from ${authFile}`);
-          buildSpan?.setAttributes({
-            "container.registry": VCR_REGISTRY,
-            "registry.username": username,
-            "registry.auth_file": authFile,
-            "registry.login_skipped": toTag(true)
-          });
-          done("authenticated via provisioned credentials");
-        } else {
-          step(`Authenticating to ${VCR_REGISTRY} as ${username}`);
-          await withSpan(
-            buildSpan,
-            "container.registry_login",
-            {
-              "container.registry": VCR_REGISTRY,
-              "registry.username": username
-            },
-            () => engine.login(buildParams)
-          );
-          done("authenticated");
-        }
+        await authenticateRegistry(engine, buildParams, buildSpan);
         await withSpan(
           buildSpan,
           "container.ensure_repository",
@@ -1703,47 +2776,70 @@ async function buildAndPushImage(params) {
     }
   );
 }
-async function resolveImageHandler(options, span) {
-  const { config, workPath, entrypoint, meta } = options;
-  const entrypointRef = readString(entrypoint);
-  const dockerfileConfigured = entrypointRef && isDockerfileRef(entrypointRef) ? entrypointRef : findDockerfile(workPath);
-  const dockerfileRel = dockerfileConfigured ?? "Dockerfile";
-  const dockerfilePath = import_node_path6.default.join(workPath, dockerfileRel);
-  const hasDockerfile = dockerfileConfigured !== void 0 || (0, import_node_fs6.existsSync)(dockerfilePath);
-  const prebuiltImage = readString(config.handler) ?? (hasDockerfile ? void 0 : entrypointRef);
+async function resolveImageHandler(options, source, span) {
+  const { config, meta } = options;
   span?.setAttributes({
-    "container.has_dockerfile": toTag(hasDockerfile),
+    "container.has_dockerfile": toTag(source.kind === "dockerfile"),
     "container.is_dev": toTag(Boolean(meta?.isDev))
   });
-  if (!hasDockerfile) {
-    if (!prebuiltImage) {
-      throw new Error(
-        "Container service must specify an entrypoint: a prebuilt OCI image reference, or a Dockerfile path to build."
-      );
-    }
+  if (source.kind === "prebuilt") {
     span?.setAttributes({ "container.mode": "prebuilt" });
-    info(`Using prebuilt image ${prebuiltImage}`);
-    return prebuiltImage;
+    info(`Using prebuilt image ${source.imageRef}`);
+    return source.imageRef;
+  }
+  if (source.kind === "buildpack") {
+    const { buildpack } = source;
+    if (meta?.isDev) {
+      const tag3 = devImageTag(options.service?.name ?? "service");
+      span?.setAttributes({
+        "container.mode": "buildpack-dev",
+        "buildpack.runtime": buildpack.runtime,
+        "image.tag": tag3
+      });
+      return tag3;
+    }
+    const repository2 = sanitizeRepository(
+      options.service?.name ?? buildpack.runtime
+    );
+    const tag2 = resolveImageTag();
+    span?.setAttributes({
+      "container.mode": "buildpack-build-and-push",
+      "buildpack.runtime": buildpack.runtime,
+      "container.repository": repository2,
+      "image.tag": tag2
+    });
+    return buildAndPushBuildpack({
+      buildpack,
+      files: options.files,
+      workPath: options.workPath,
+      repository: repository2,
+      tag: tag2,
+      config,
+      meta,
+      buildEnv: buildArgsFromEnv(meta?.buildEnv),
+      parentSpan: span
+    });
   }
+  const { dockerfileRel, dockerfilePath } = source;
   if (meta?.isDev) {
     const serviceName2 = options.service?.name;
     const tag2 = devImageTag(
-      serviceName2 ?? import_node_path6.default.basename(dockerfileRel).split(".")[0]
+      serviceName2 ?? import_node_path14.default.basename(dockerfileRel).split(".")[0]
     );
     span?.setAttributes({ "container.mode": "dev", "image.tag": tag2 });
     return tag2;
   }
-  if (!(0, import_node_fs6.existsSync)(dockerfilePath)) {
+  if (!(0, import_node_fs14.existsSync)(dockerfilePath)) {
     throw new Error(
       `Dockerfile not found at "${dockerfilePath}" for container service.`
     );
   }
   const serviceName = options.service?.name;
   const repository = sanitizeRepository(
-    serviceName ?? import_node_path6.default.basename(dockerfileRel).split(".")[0]
+    serviceName ?? import_node_path14.default.basename(dockerfileRel).split(".")[0]
   );
   const tag = resolveImageTag();
-  const contextDir = import_node_path6.default.dirname(dockerfilePath);
+  const contextDir = import_node_path14.default.dirname(dockerfilePath);
   const buildArgs = buildArgsFromEnv(meta?.buildEnv);
   span?.setAttributes({
     "container.mode": "build_and_push",
@@ -1772,21 +2868,22 @@ function buildArgsFromEnv(env) {
   return Object.keys(out).length > 0 ? out : void 0;
 }
 async function build(options) {
+  const source = resolveImageSource(options, "build");
   const image = await withSpan(
     options.span,
     "container.resolve_image",
     { "service.name": options.service?.name },
-    (span) => resolveImageHandler(options, span)
+    (span) => resolveImageHandler(options, source, span)
   );
-  const lambdaOptions = await (0, import_build_utils4.getLambdaOptionsFromFunction)({
+  const lambdaOptions = await (0, import_build_utils6.getLambdaOptionsFromFunction)({
     sourceFile: resolveFunctionSourceFile(options),
     config: options.config
   });
-  const command = normalizeCommand2(options.config.command);
+  const command = source.kind === "buildpack" ? void 0 : normalizeCommand(options.config.command);
   await generateProjectManifest({
     workPath: options.workPath,
     framework: options.config.framework ?? void 0,
-    serviceType: options.service ? (0, import_build_utils4.getReportedServiceType)(options.service) : void 0
+    serviceType: options.service ? (0, import_build_utils6.getReportedServiceType)(options.service) : void 0
   });
   const routes = [
     { handle: "filesystem" },