openship 0.2.3 → 0.4.0

package/dist/chunk-WJPCBU7Z.js

@@ -0,0 +1,3147 @@
+import {
+  checkGit,
+  installGit
+} from "./chunk-46YJFP4S.js";
+import {
+  createDockerBuildContext,
+  normalizeDockerRelativePath,
+  resolveDockerfileCandidates
+} from "./chunk-HFYDYK4D.js";
+import {
+  prepareStackOutput,
+  resolveProjectDir,
+  resolveStaticOutputPath,
+  runLocalBuild
+} from "./chunk-NB2VEIWG.js";
+import {
+  BuildLogger,
+  injectGitToken,
+  runBuildPipeline,
+  sq,
+  transferLocalDirectory
+} from "./chunk-YL67EWYZ.js";
+import {
+  isRuntimeNotFoundError
+} from "./chunk-4LEL3H2Z.js";
+import {
+  STACKS,
+  SYSTEM,
+  TRANSFER_EXCLUDES,
+  buildOutputTransferExcludes,
+  missingOutputDirectoryMessage,
+  packageManagerEnsureCommand,
+  safeErrorMessage
+} from "./chunk-JZLNHGLW.js";
+
+// ../../packages/adapters/src/runtime/cloud.ts
+import { readFile } from "fs/promises";
+import { join, posix } from "path";
+
+// ../../packages/adapters/src/types.ts
+var DEFAULT_RESOURCE_CONFIG = {
+  cpuCores: 0.5,
+  memoryMb: 512,
+  diskMb: 5120
+};
+function cloudCpus(cpuCores) {
+  return Math.max(0.25, cpuCores);
+}
+
+// ../../packages/adapters/src/runtime/cloud.ts
+import { PassThrough, Writable } from "stream";
+
+// ../../packages/adapters/src/dockerfile/parser.ts
+var KNOWN_KEYWORDS = /* @__PURE__ */ new Set([
+  "ADD",
+  "ARG",
+  "CMD",
+  "COPY",
+  "ENTRYPOINT",
+  "ENV",
+  "EXPOSE",
+  "FROM",
+  "HEALTHCHECK",
+  "LABEL",
+  "RUN",
+  "SHELL",
+  "STOPSIGNAL",
+  "USER",
+  "VOLUME",
+  "WORKDIR",
+  "ONBUILD",
+  "MAINTAINER"
+]);
+var FLAGGED_KEYWORDS = /* @__PURE__ */ new Set([
+  "ADD",
+  "COPY",
+  "FROM",
+  "RUN"
+]);
+function isCommentLine(line) {
+  return line.trimStart().startsWith("#");
+}
+function endsWithContinuation(line) {
+  let slashCount = 0;
+  for (let i = line.length - 1; i >= 0 && line[i] === "\\"; i--) {
+    slashCount++;
+  }
+  return slashCount % 2 === 1;
+}
+function joinLogicalLines(source) {
+  const result = [];
+  const lines = source.replace(/\r\n/g, "\n").split("\n");
+  let current = "";
+  let startLine = 0;
+  for (let i = 0; i < lines.length; i++) {
+    const lineNo = i + 1;
+    const stripped = lines[i].trimEnd();
+    if (!current && (!stripped.trim() || isCommentLine(stripped))) {
+      continue;
+    }
+    if (current && isCommentLine(stripped)) {
+      continue;
+    }
+    if (!current) {
+      startLine = lineNo;
+    }
+    if (endsWithContinuation(stripped)) {
+      current += `${stripped.slice(0, -1).trimEnd()} `;
+      continue;
+    }
+    current += stripped;
+    const raw = current.trim();
+    if (raw) {
+      result.push({ line: startLine, raw });
+    }
+    current = "";
+  }
+  if (current.trim()) {
+    result.push({ line: startLine, raw: current.trim() });
+  }
+  return result;
+}
+function parseLeadingFlags(value) {
+  const flags = {};
+  let rest = value.trimStart();
+  while (rest.startsWith("--")) {
+    const match = rest.match(/^--([A-Za-z0-9_.-]+)(?:=("[^"]*"|'[^']*'|\S+))?(?=\s|$)/);
+    if (!match) break;
+    const [, name, rawValue] = match;
+    flags[name] = rawValue === void 0 ? true : rawValue.replace(/^["']|["']$/g, "");
+    rest = rest.slice(match[0].length).trimStart();
+  }
+  return { flags, rest };
+}
+function toKeyword(value) {
+  const upper = value.toUpperCase();
+  return KNOWN_KEYWORDS.has(upper) ? upper : "OTHER";
+}
+function parseDockerfile(source) {
+  const diagnostics = [];
+  const instructions = [];
+  for (const logical of joinLogicalLines(source)) {
+    const match = logical.raw.match(/^([A-Za-z][A-Za-z0-9_-]*)\s*(.*)$/);
+    if (!match) {
+      diagnostics.push({
+        severity: "warning",
+        line: logical.line,
+        message: `Could not parse Dockerfile instruction: ${logical.raw}`
+      });
+      continue;
+    }
+    const originalKeyword = match[1];
+    const keyword = toKeyword(originalKeyword);
+    const rawValue = match[2] ?? "";
+    const parsed = FLAGGED_KEYWORDS.has(keyword) ? parseLeadingFlags(rawValue) : { flags: {}, rest: rawValue.trimStart() };
+    instructions.push({
+      keyword,
+      originalKeyword,
+      value: parsed.rest,
+      flags: parsed.flags,
+      line: logical.line,
+      raw: logical.raw
+    });
+  }
+  return { instructions, warnings: diagnostics };
+}
+
+// ../../packages/adapters/src/dockerfile/compiler.ts
+var DEFAULT_WORKDIR = "/";
+var PATHLIKE_RE = /^[A-Za-z0-9_@%+=:,./-]+$/;
+function diagnostic(instruction, severity, message) {
+  return {
+    severity,
+    instruction: instruction.keyword,
+    line: instruction.line,
+    message
+  };
+}
+function splitFirstEquals(value) {
+  const index = value.indexOf("=");
+  if (index === -1) {
+    return [value, null];
+  }
+  return [value.slice(0, index), value.slice(index + 1)];
+}
+function parseJsonArray(value) {
+  const trimmed = value.trim();
+  if (!trimmed.startsWith("[")) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(trimmed);
+    if (!Array.isArray(parsed)) {
+      return null;
+    }
+    return parsed.map((part) => String(part));
+  } catch {
+    return null;
+  }
+}
+function splitWords(value) {
+  const words = [];
+  let current = "";
+  let inSingle = false;
+  let inDouble = false;
+  let escaped = false;
+  for (const char of value.trim()) {
+    if (escaped) {
+      current += char;
+      escaped = false;
+      continue;
+    }
+    if (char === "\\") {
+      escaped = true;
+      continue;
+    }
+    if (char === "'" && !inDouble) {
+      inSingle = !inSingle;
+      continue;
+    }
+    if (char === '"' && !inSingle) {
+      inDouble = !inDouble;
+      continue;
+    }
+    if (/\s/.test(char) && !inSingle && !inDouble) {
+      if (current) {
+        words.push(current);
+        current = "";
+      }
+      continue;
+    }
+    current += char;
+  }
+  if (escaped) {
+    current += "\\";
+  }
+  if (current) {
+    words.push(current);
+  }
+  return words;
+}
+function shellQuote(value) {
+  if (PATHLIKE_RE.test(value)) {
+    return value;
+  }
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function commandToShell(command) {
+  if (command.form === "exec") {
+    return command.value.map(shellQuote).join(" ");
+  }
+  return command.value;
+}
+function toWorkspaceCommand(instruction) {
+  const exec = parseJsonArray(instruction.value);
+  if (exec) {
+    return {
+      form: "exec",
+      value: exec,
+      raw: instruction.value
+    };
+  }
+  return {
+    form: "shell",
+    value: instruction.value.trim(),
+    raw: instruction.value
+  };
+}
+function combineStartCommand(entrypoint, cmd) {
+  if (!entrypoint && !cmd) {
+    return void 0;
+  }
+  if (!entrypoint) {
+    return commandToShell(cmd);
+  }
+  if (!cmd) {
+    return commandToShell(entrypoint);
+  }
+  if (entrypoint.form === "shell") {
+    return commandToShell(entrypoint);
+  }
+  const entrypointShell = commandToShell(entrypoint);
+  const cmdShell = commandToShell(cmd);
+  return cmdShell ? `${entrypointShell} ${cmdShell}` : entrypointShell;
+}
+function normalizeWorkdir(current, next) {
+  const value = next.trim();
+  if (!value) {
+    return current;
+  }
+  const raw = value.startsWith("/") ? value : `${current.replace(/\/+$/g, "")}/${value}`;
+  const parts = [];
+  for (const part of raw.split("/")) {
+    if (!part || part === ".") {
+      continue;
+    }
+    if (part === "..") {
+      parts.pop();
+      continue;
+    }
+    parts.push(part);
+  }
+  return `/${parts.join("/")}`;
+}
+function parseKeyValueList(value) {
+  const tokens = splitWords(value);
+  const result = {};
+  if (tokens.length === 0) {
+    return result;
+  }
+  if (!tokens[0].includes("=") && tokens.length >= 2) {
+    result[tokens[0]] = tokens.slice(1).join(" ");
+    return result;
+  }
+  for (const token of tokens) {
+    const [key, tokenValue] = splitFirstEquals(token);
+    if (!key || tokenValue === null) {
+      continue;
+    }
+    result[key] = tokenValue;
+  }
+  return result;
+}
+function parseFromInstruction(instruction) {
+  const parts = splitWords(instruction.value);
+  const platformFlag = instruction.flags.platform;
+  const platform = typeof platformFlag === "string" ? platformFlag : void 0;
+  if (parts.length === 0) {
+    return {
+      baseImage: "",
+      platform,
+      diagnostic: diagnostic(instruction, "error", "FROM is missing a base image.")
+    };
+  }
+  const baseImage = parts[0];
+  let name;
+  let warning;
+  if (parts.length >= 3 && parts[1]?.toUpperCase() === "AS") {
+    name = parts[2];
+    if (parts.length > 3) {
+      warning = diagnostic(instruction, "warning", "Ignoring extra tokens after FROM stage alias.");
+    }
+  } else if (parts.length > 1) {
+    warning = diagnostic(
+      instruction,
+      "warning",
+      "FROM contains extra tokens that are not part of a stage alias."
+    );
+  }
+  return { baseImage, name, platform, diagnostic: warning };
+}
+function createStage(index, from, defaultWorkdir) {
+  return {
+    index,
+    name: from.name,
+    baseImage: from.baseImage,
+    platform: from.platform,
+    workdir: defaultWorkdir,
+    env: {},
+    args: {},
+    labels: {},
+    copies: [],
+    runs: [],
+    steps: [],
+    exposedPorts: [],
+    unsupported: []
+  };
+}
+function parseCopyLikeInstruction(instruction, kind, workdir) {
+  const diagnostics = [];
+  const parts = parseJsonArray(instruction.value) ?? splitWords(instruction.value);
+  if (parts.length < 2) {
+    return {
+      diagnostics: [
+        diagnostic(
+          instruction,
+          "error",
+          `${instruction.keyword} needs at least one source and one destination.`
+        )
+      ]
+    };
+  }
+  const from = typeof instruction.flags.from === "string" ? instruction.flags.from : void 0;
+  const sources = parts.slice(0, -1);
+  const destination = parts[parts.length - 1] ?? "";
+  if (kind === "add") {
+    diagnostics.push(
+      diagnostic(
+        instruction,
+        "warning",
+        "ADD is recorded, but remote URLs and archive extraction need explicit workspace execution support."
+      )
+    );
+  }
+  for (const flag of ["chown", "chmod", "link"]) {
+    if (instruction.flags[flag] !== void 0) {
+      diagnostics.push(
+        diagnostic(
+          instruction,
+          "warning",
+          `${instruction.keyword} --${flag} is Docker-specific metadata and needs explicit workspace handling.`
+        )
+      );
+    }
+  }
+  return {
+    step: {
+      kind,
+      sources,
+      destination,
+      from,
+      workdir,
+      flags: instruction.flags,
+      line: instruction.line,
+      raw: instruction.value
+    },
+    diagnostics
+  };
+}
+function parseExposeInstruction(instruction) {
+  const ports = [];
+  const diagnostics = [];
+  for (const token of splitWords(instruction.value)) {
+    const match = token.match(/^(\d+)(?:\/(tcp|udp))?$/i);
+    if (!match) {
+      diagnostics.push(
+        diagnostic(instruction, "warning", `Could not parse EXPOSE value "${token}".`)
+      );
+      continue;
+    }
+    ports.push({
+      port: Number(match[1]),
+      protocol: match[2]?.toLowerCase() ?? "tcp"
+    });
+  }
+  return { ports, diagnostics };
+}
+function parseArgInstruction(instruction, buildArgs) {
+  const [rawKey, rawDefault] = splitFirstEquals(instruction.value.trim());
+  const key = rawKey.trim();
+  if (!key) {
+    return {
+      diagnostic: diagnostic(instruction, "warning", "ARG is missing a name.")
+    };
+  }
+  return {
+    key,
+    value: buildArgs[key] ?? rawDefault
+  };
+}
+function currentOrDiagnostic(currentStage, instruction) {
+  if (currentStage) {
+    return { stage: currentStage };
+  }
+  return {
+    diagnostic: diagnostic(
+      instruction,
+      instruction.keyword === "ARG" ? "warning" : "error",
+      `${instruction.keyword} appears before the first FROM stage.`
+    )
+  };
+}
+function selectFinalStage(stages, targetStage) {
+  if (stages.length === 0) {
+    return null;
+  }
+  if (!targetStage) {
+    return stages[stages.length - 1] ?? null;
+  }
+  return stages.find((stage) => stage.name === targetStage || String(stage.index) === targetStage) ?? null;
+}
+function isPreviousStageReference(stages, currentStage, ref) {
+  const numeric = Number(ref);
+  if (Number.isInteger(numeric) && String(numeric) === ref) {
+    return numeric >= 0 && numeric < currentStage.index;
+  }
+  return stages.some((stage) => stage.index < currentStage.index && stage.name === ref);
+}
+function findPreviousStageReference(stages, ref) {
+  const numeric = Number(ref);
+  if (Number.isInteger(numeric) && String(numeric) === ref) {
+    return stages[numeric] ?? null;
+  }
+  return stages.find((stage) => stage.name === ref) ?? null;
+}
+function inheritStageImageConfig(target, base) {
+  target.workdir = base.workdir;
+  target.env = { ...base.env };
+  target.labels = { ...base.labels };
+  target.exposedPorts = [...base.exposedPorts];
+  target.cmd = base.cmd;
+  target.entrypoint = base.entrypoint;
+  target.startCommand = base.startCommand;
+  target.user = base.user;
+  target.shell = base.shell ? [...base.shell] : void 0;
+}
+function validateStageArtifactCopies(stages) {
+  const diagnostics = [];
+  for (const stage of stages) {
+    for (const copy of stage.copies) {
+      if (!copy.from) continue;
+      if (isPreviousStageReference(stages, stage, copy.from)) continue;
+      diagnostics.push({
+        severity: "unsupported",
+        instruction: copy.kind === "copy" ? "COPY" : "ADD",
+        line: copy.line,
+        message: `${copy.kind.toUpperCase()} --from=${copy.from} references an external image, current stage, or later stage. Cloud Dockerfile builds currently support --from only for previous stages in the same Dockerfile.`
+      });
+    }
+  }
+  return diagnostics;
+}
+function compileDockerfileParseResult(parseResult, options = {}) {
+  const defaultWorkdir = normalizeWorkdir("/", options.defaultWorkdir ?? DEFAULT_WORKDIR);
+  const buildArgs = options.buildArgs ?? {};
+  const diagnostics = [...parseResult.warnings];
+  const globalArgs = {};
+  const stages = [];
+  let currentStage = null;
+  for (const instruction of parseResult.instructions) {
+    if (instruction.keyword === "ARG" && !currentStage) {
+      const parsedArg = parseArgInstruction(instruction, buildArgs);
+      if (parsedArg.diagnostic) {
+        diagnostics.push(parsedArg.diagnostic);
+        continue;
+      }
+      if (parsedArg.key) {
+        globalArgs[parsedArg.key] = parsedArg.value ?? null;
+      }
+      continue;
+    }
+    if (instruction.keyword === "FROM") {
+      const parsedFrom = parseFromInstruction(instruction);
+      if (parsedFrom.diagnostic) {
+        diagnostics.push(parsedFrom.diagnostic);
+      }
+      currentStage = createStage(stages.length, parsedFrom, defaultWorkdir);
+      const baseStage = findPreviousStageReference(stages, parsedFrom.baseImage);
+      if (baseStage) {
+        inheritStageImageConfig(currentStage, baseStage);
+      }
+      stages.push(currentStage);
+      continue;
+    }
+    const stageResult = currentOrDiagnostic(currentStage, instruction);
+    if (!stageResult.stage) {
+      if (stageResult.diagnostic) {
+        diagnostics.push(stageResult.diagnostic);
+      }
+      continue;
+    }
+    const stage = stageResult.stage;
+    switch (instruction.keyword) {
+      case "ARG": {
+        const parsedArg = parseArgInstruction(instruction, buildArgs);
+        if (parsedArg.diagnostic) {
+          diagnostics.push(parsedArg.diagnostic);
+        } else if (parsedArg.key) {
+          stage.args[parsedArg.key] = parsedArg.value ?? null;
+        }
+        break;
+      }
+      case "ENV":
+        Object.assign(stage.env, parseKeyValueList(instruction.value));
+        break;
+      case "LABEL":
+        Object.assign(stage.labels, parseKeyValueList(instruction.value));
+        break;
+      case "WORKDIR":
+        stage.workdir = normalizeWorkdir(stage.workdir, instruction.value);
+        break;
+      case "COPY":
+      case "ADD": {
+        const parsedCopy = parseCopyLikeInstruction(
+          instruction,
+          instruction.keyword === "COPY" ? "copy" : "add",
+          stage.workdir
+        );
+        if (parsedCopy.step) {
+          stage.copies.push(parsedCopy.step);
+          stage.steps.push({ type: "copy", copy: parsedCopy.step });
+        }
+        diagnostics.push(...parsedCopy.diagnostics);
+        break;
+      }
+      case "RUN": {
+        const command = toWorkspaceCommand(instruction);
+        const runStep = {
+          command: commandToShell(command),
+          form: command.form,
+          workdir: stage.workdir,
+          env: { ...stage.env },
+          args: { ...stage.args },
+          flags: instruction.flags,
+          line: instruction.line,
+          raw: instruction.value
+        };
+        if (command.form === "exec") {
+          runStep.exec = command.value;
+        }
+        stage.runs.push(runStep);
+        stage.steps.push({ type: "run", run: runStep });
+        for (const flag of Object.keys(instruction.flags)) {
+          diagnostics.push(
+            diagnostic(
+              instruction,
+              "warning",
+              `RUN --${flag} is a Docker BuildKit feature and needs explicit workspace support.`
+            )
+          );
+        }
+        break;
+      }
+      case "EXPOSE": {
+        const exposed = parseExposeInstruction(instruction);
+        stage.exposedPorts.push(...exposed.ports);
+        diagnostics.push(...exposed.diagnostics);
+        break;
+      }
+      case "CMD":
+        stage.cmd = toWorkspaceCommand(instruction);
+        stage.startCommand = combineStartCommand(stage.entrypoint, stage.cmd);
+        break;
+      case "ENTRYPOINT":
+        stage.entrypoint = toWorkspaceCommand(instruction);
+        stage.startCommand = combineStartCommand(stage.entrypoint, stage.cmd);
+        break;
+      case "USER":
+        stage.user = instruction.value.trim();
+        break;
+      case "SHELL": {
+        const shell = parseJsonArray(instruction.value);
+        if (shell) {
+          stage.shell = shell;
+          diagnostics.push(
+            diagnostic(
+              instruction,
+              "warning",
+              "SHELL changes how later shell-form RUN/CMD instructions execute; the plan records it but does not emulate shell behavior."
+            )
+          );
+        } else {
+          const item = diagnostic(
+            instruction,
+            "unsupported",
+            "SHELL must use JSON array form to be planned."
+          );
+          diagnostics.push(item);
+          stage.unsupported.push(item);
+        }
+        break;
+      }
+      case "HEALTHCHECK":
+      case "ONBUILD":
+      case "STOPSIGNAL":
+      case "VOLUME": {
+        const item = diagnostic(
+          instruction,
+          "unsupported",
+          `${instruction.keyword} is runtime/image metadata and cannot be represented as workspace build commands yet.`
+        );
+        diagnostics.push(item);
+        stage.unsupported.push(item);
+        break;
+      }
+      case "MAINTAINER":
+        diagnostics.push(
+          diagnostic(
+            instruction,
+            "warning",
+            "MAINTAINER is deprecated and ignored by the workspace plan."
+          )
+        );
+        break;
+      case "OTHER": {
+        const item = diagnostic(
+          instruction,
+          "unsupported",
+          `Unsupported Dockerfile instruction "${instruction.originalKeyword}".`
+        );
+        diagnostics.push(item);
+        stage.unsupported.push(item);
+        break;
+      }
+    }
+  }
+  if (stages.length === 0) {
+    diagnostics.push({
+      severity: "error",
+      message: "Dockerfile does not contain a FROM instruction."
+    });
+  }
+  const finalStage = selectFinalStage(stages, options.targetStage);
+  if (options.targetStage && !finalStage) {
+    diagnostics.push({
+      severity: "error",
+      message: `Target Dockerfile stage "${options.targetStage}" was not found.`
+    });
+  }
+  diagnostics.push(...validateStageArtifactCopies(stages));
+  const runtime = finalStage ? {
+    baseImage: finalStage.baseImage,
+    workdir: finalStage.workdir,
+    env: { ...finalStage.env },
+    exposedPort: finalStage.exposedPorts[0]?.port,
+    exposedPorts: [...finalStage.exposedPorts],
+    startCommand: finalStage.startCommand,
+    user: finalStage.user
+  } : null;
+  const hasStageArtifactCopies = stages.some((stage) => stage.copies.some((copy) => copy.from));
+  const requiresDockerSemantics = diagnostics.some((item) => item.severity === "unsupported") || stages.length > 1 || hasStageArtifactCopies;
+  return {
+    source: "dockerfile",
+    globalArgs,
+    stages,
+    finalStage,
+    runtime,
+    diagnostics,
+    isMultiStage: stages.length > 1,
+    requiresDockerSemantics
+  };
+}
+function compileDockerfileToWorkspacePlan(source, options) {
+  return compileDockerfileParseResult(parseDockerfile(source), options);
+}
+
+// ../../packages/adapters/src/runtime/cloud/compose.ts
+function now() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function toEnvArray(env) {
+  return Object.entries(env).map(([k, v]) => `${k}=${v}`);
+}
+function firstContainerPort(portSpecs) {
+  for (const spec of portSpecs) {
+    const clean = spec.trim();
+    if (!clean) continue;
+    const parts = clean.split(":");
+    const raw = parts.length >= 2 ? parts[parts.length - 1] : parts[0];
+    const match = raw?.match(/^(\d+)(?:\/(?:tcp|udp))?$/i);
+    if (match) return Number(match[1]);
+  }
+  return void 0;
+}
+function restartPolicyForWorkload(policy) {
+  const base = policy?.split(":")[0];
+  if (base === "no" || base === "never") return "never";
+  if (base === "on-failure") return "on-failure";
+  return "always";
+}
+function exposeTarget(port, serviceName, slug, domain = SYSTEM.DOMAINS.CLOUD_DOMAIN) {
+  const service = `service "${serviceName}" on port ${port}`;
+  return slug ? `${service} for slug "${slug}" (${slug}.${domain})` : service;
+}
+function errorMessage(err) {
+  return safeErrorMessage(err);
+}
+async function withCloudOperationTimeout(operation, label, timeoutMs = 3e5) {
+  let timer;
+  try {
+    return await Promise.race([
+      operation,
+      new Promise((_, reject) => {
+        timer = setTimeout(() => {
+          reject(new Error(`${label} timed out after ${Math.round(timeoutMs / 1e3)}s`));
+        }, timeoutMs);
+      })
+    ]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+var CloudComposeSupport = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  groups = /* @__PURE__ */ new Map();
+  async ensureServiceGroup(config) {
+    const id = `cloud-compose:${config.deploymentId}`;
+    if (!this.groups.has(id)) {
+      this.groups.set(id, {
+        id,
+        resources: config.resources,
+        services: /* @__PURE__ */ new Map()
+      });
+    }
+    return { id };
+  }
+  /** Seed an already-running peer into the group WITHOUT deploying it, so the
+   *  next finalizeGroup rewrites the full mesh (/etc/hosts + private links)
+   *  including it. Used by the decoupled single-service add — only the new
+   *  service is deployed, but its peers must remain reachable by name. */
+  registerExistingWorkload(group, service) {
+    const groupState = this.groups.get(group.id);
+    if (!groupState) return;
+    if (groupState.services.has(service.serviceName)) return;
+    const ports = [
+      ...new Set(
+        (service.portSpecs ?? []).map((item) => firstContainerPort([item])).filter((item) => typeof item === "number")
+      )
+    ];
+    groupState.services.set(service.serviceName, {
+      serviceName: service.serviceName,
+      workspaceId: service.workspaceId,
+      ip: service.ip,
+      ports
+    });
+  }
+  async deployServiceWorkload(group, config, onLog) {
+    const log = onLog ?? (() => {
+    });
+    const groupState = this.groups.get(group.id) ?? {
+      id: group.id,
+      services: /* @__PURE__ */ new Map()
+    };
+    this.groups.set(group.id, groupState);
+    const builtArtifact = this.deps.builtArtifacts.get(config.image);
+    let workspaceId;
+    try {
+      workspaceId = builtArtifact?.workspaceId ?? await this.createImageServiceWorkspace(config, log);
+      const ws = this.deps.workspace(workspaceId);
+      if (builtArtifact?.workspaceId) {
+        await this.shrinkToRuntimeTier(ws, config, log);
+      }
+      await withCloudOperationTimeout(
+        ws.lifecycle.makePermanent(),
+        `Making cloud service "${config.serviceName}" permanent`
+      ).catch((err) => {
+        throw new Error(`Failed to make service workspace permanent: ${errorMessage(err)}`);
+      });
+      const runtimeEnv = {
+        ...builtArtifact?.runtime.env ?? {},
+        ...config.environment
+      };
+      const port = config.publicPort ?? firstContainerPort(config.ports) ?? builtArtifact?.runtime.exposedPort;
+      const workdir = builtArtifact?.runtime.workdir ?? "/";
+      const startCommand = config.command ?? builtArtifact?.runtime.startCommand;
+      log({
+        timestamp: now(),
+        message: `Deploying cloud service "${config.serviceName}" in workspace ${workspaceId}...
+`,
+        level: "info"
+      });
+      if (startCommand) {
+        log({
+          timestamp: now(),
+          message: `Creating workload for service "${config.serviceName}"...
+`,
+          level: "info"
+        });
+        await withCloudOperationTimeout(
+          ws.workloads.delete("app").catch(() => {
+          }),
+          `Replacing workload for service "${config.serviceName}"`
+        );
+        await withCloudOperationTimeout(
+          ws.workloads.create({
+            id: "app",
+            name: "app",
+            cmd: ["sh", "-c", `cd ${sq(workdir)} && ${startCommand}`],
+            working_dir: workdir,
+            env: [...toEnvArray(runtimeEnv), ...port ? [`PORT=${port}`] : []],
+            restart_policy: restartPolicyForWorkload(config.restart),
+            max_restarts: 10
+          }),
+          `Creating workload for service "${config.serviceName}"`
+        );
+        log({
+          timestamp: now(),
+          message: `Workload for service "${config.serviceName}" is ready.
+`,
+          level: "info"
+        });
+      } else {
+        log({
+          timestamp: now(),
+          message: `No command configured for "${config.serviceName}". Using the workspace image default process.
+`,
+          level: "warn"
+        });
+      }
+      if (config.expose && port) {
+        if (config.customDomain) {
+          log({
+            timestamp: now(),
+            message: `Opening ${exposeTarget(port, config.serviceName, config.publicSlug)}...
+`,
+            level: "info"
+          });
+          await withCloudOperationTimeout(
+            ws.network.update({ ingress_ports: [port] }),
+            `Opening network port for service "${config.serviceName}"`
+          ).catch((err) => {
+            throw new Error(
+              `Failed to open ${exposeTarget(port, config.serviceName, config.publicSlug)}: ${errorMessage(err)}`
+            );
+          });
+          log({
+            timestamp: now(),
+            message: `Opened ${exposeTarget(port, config.serviceName, config.publicSlug)}.
+`,
+            level: "info"
+          });
+          log({
+            timestamp: now(),
+            message: `Connecting custom domain "${config.customDomain}" for service "${config.serviceName}"...
+`,
+            level: "info"
+          });
+          await withCloudOperationTimeout(
+            ws.domains.connect({ domain: config.customDomain, port }),
+            `Connecting custom domain for service "${config.serviceName}"`
+          ).catch((err) => {
+            throw new Error(
+              `Failed to connect custom domain "${config.customDomain}" for service "${config.serviceName}" on port ${port}: ${errorMessage(err)}`
+            );
+          });
+          log({
+            timestamp: now(),
+            message: `Custom domain "${config.customDomain}" connected for service "${config.serviceName}".
+`,
+            level: "info"
+          });
+        } else if (config.publicSlug) {
+          log({
+            timestamp: now(),
+            message: `Exposing ${exposeTarget(port, config.serviceName, config.publicSlug)}...
+`,
+            level: "info"
+          });
+          await withCloudOperationTimeout(
+            ws.publicAccess.expose({
+              port,
+              domain: SYSTEM.DOMAINS.CLOUD_DOMAIN,
+              slug: config.publicSlug
+            }),
+            `Exposing public access for service "${config.serviceName}"`
+          ).catch((err) => {
+            throw new Error(
+              `Failed to expose ${exposeTarget(port, config.serviceName, config.publicSlug)}: ${errorMessage(err)}`
+            );
+          });
+          log({
+            timestamp: now(),
+            message: `Exposed ${exposeTarget(port, config.serviceName, config.publicSlug)}.
+`,
+            level: "info"
+          });
+        }
+      }
+      const ip = await this.resolveWorkspaceIpWithRetry(ws);
+      const ports = [
+        .../* @__PURE__ */ new Set([
+          ...config.ports.map((item) => firstContainerPort([item])).filter((item) => typeof item === "number"),
+          ...port ? [port] : []
+        ])
+      ];
+      groupState.services.set(config.serviceName, {
+        serviceName: config.serviceName,
+        workspaceId,
+        ip: ip ?? void 0,
+        ports
+      });
+      await this.syncServiceDiscovery(groupState, log);
+      log({
+        timestamp: now(),
+        message: `Cloud service "${config.serviceName}" started${ip ? ` at ${ip}` : ""}.
+`,
+        level: "info"
+      });
+      return {
+        containerId: workspaceId,
+        status: "running",
+        ip: ip ?? void 0,
+        hostPort: port
+      };
+    } catch (err) {
+      if (workspaceId) {
+        groupState.services.delete(config.serviceName);
+        await this.deps.workspace(workspaceId).delete().catch(() => {
+        });
+      }
+      throw err;
+    }
+  }
+  /**
+   * Shrink a source-built server's workspace from the BUILD tier (4cpu/8GB/10GB)
+   * down to its production/runtime tier. The build workspace is reused as the
+   * runtime, so without this every deployed app holds build-sized resources
+   * permanently and saturates the cloud pool — new builds then fail to place
+   * (CREATE_FAILED).
+   *
+   * Mandatory by design: a resize failure THROWS and fails the deploy. Leaving a
+   * service oversized is not an acceptable escape hatch — it silently poisons the
+   * shared pool. (cpu + memory are the pool/cost constraint; disk isn't in the
+   * deploy config and shrinking a data volume is unreliable, so it's left alone.)
+   */
+  async shrinkToRuntimeTier(ws, config, log) {
+    const cpus = cloudCpus(config.resources?.cpuCores ?? DEFAULT_RESOURCE_CONFIG.cpuCores);
+    const memory_mb = config.resources?.memoryMb ?? DEFAULT_RESOURCE_CONFIG.memoryMb;
+    try {
+      await withCloudOperationTimeout(
+        ws.resources.update({ cpus, memory_mb, apply: true }),
+        `Resizing service "${config.serviceName}" to its runtime tier`
+      );
+    } catch (err) {
+      throw new Error(
+        `Failed to shrink service "${config.serviceName}" from the build tier to its runtime tier: ${errorMessage(err)}`
+      );
+    }
+    log({
+      timestamp: now(),
+      message: `Sized "${config.serviceName}" to its runtime tier (${cpus} vCPU \xB7 ${memory_mb} MB).
+`,
+      level: "info"
+    });
+  }
+  async createImageServiceWorkspace(config, onLog) {
+    if (config.previousWorkspaceId) {
+      try {
+        const existing = this.deps.workspace(config.previousWorkspaceId);
+        await existing.get();
+        onLog({
+          timestamp: now(),
+          message: `Reusing existing workspace ${config.previousWorkspaceId} for service "${config.serviceName}" (preserves its disk/data).
+`,
+          level: "info"
+        });
+        return config.previousWorkspaceId;
+      } catch {
+        onLog({
+          timestamp: now(),
+          message: `Previous workspace for "${config.serviceName}" is gone \u2014 creating a fresh one (its prior data is not recoverable).
+`,
+          level: "warn"
+        });
+      }
+    }
+    const diskMb = config.volumes.length ? Math.max(DEFAULT_RESOURCE_CONFIG.diskMb, 20480) : DEFAULT_RESOURCE_CONFIG.diskMb;
+    const resources = {
+      cpuCores: config.resources?.cpuCores ?? DEFAULT_RESOURCE_CONFIG.cpuCores,
+      memoryMb: config.resources?.memoryMb ?? DEFAULT_RESOURCE_CONFIG.memoryMb,
+      diskMb
+    };
+    const sharedOrBind = config.volumes.filter((v) => v.includes(":/") && v.startsWith("/"));
+    if (sharedOrBind.length) {
+      onLog({
+        timestamp: now(),
+        message: `Warning: bind-mount volumes are not supported on cloud and were ignored for "${config.serviceName}": ${sharedOrBind.join(", ")}
+`,
+        level: "warn"
+      });
+    }
+    onLog({
+      timestamp: now(),
+      message: `Creating cloud service "${config.serviceName}" from image "${config.image}"...
+`,
+      level: "info"
+    });
+    let wsData;
+    try {
+      wsData = await this.deps.client.workspaces.create({
+        name: `${config.slug}-${config.serviceName}`.slice(0, 60),
+        image: config.image,
+        mode: "permanent",
+        config: {
+          cpus: cloudCpus(resources.cpuCores),
+          memory_mb: resources.memoryMb,
+          disk_size_mb: resources.diskMb,
+          env: toEnvArray(config.environment)
+        }
+      });
+    } catch (err) {
+      const message = safeErrorMessage(err);
+      onLog({
+        timestamp: now(),
+        message: `Failed to create cloud service "${config.serviceName}" from image "${config.image}": ${message}
+`,
+        level: "error"
+      });
+      throw err;
+    }
+    return wsData.id;
+  }
+  async resolveWorkspaceIp(ws) {
+    try {
+      const raw = await ws.apiAccess.rawToken();
+      if (raw?.ip) return raw.ip;
+    } catch {
+    }
+    try {
+      const network = await ws.network.get();
+      if (network.ip) return network.ip;
+    } catch {
+    }
+    try {
+      const data = await ws.get();
+      return data.ip ?? null;
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Oblien may assign the private IP a beat after the workspace starts. Poll
+   * (bounded) so a transient null never permanently drops a service from the
+   * mesh — the original bug was resolving once with no retry.
+   */
+  async resolveWorkspaceIpWithRetry(ws, attempts = 10, delayMs = 1e3) {
+    for (let attempt = 0; attempt < attempts; attempt++) {
+      const ip = await this.resolveWorkspaceIp(ws);
+      if (ip) return ip;
+      if (attempt < attempts - 1) {
+        await new Promise((resolve) => setTimeout(resolve, delayMs));
+      }
+    }
+    return null;
+  }
+  async syncServiceDiscovery(group, onLog) {
+    const services = [...group.services.values()].filter((service) => service.ip);
+    if (services.length === 0) return;
+    const workspaceIds = [...new Set(services.map((service) => service.workspaceId))];
+    const hostsLines = services.map(
+      (service) => `${service.ip} ${service.serviceName} # openship-compose:${group.id}`
+    );
+    const hostsBlock = hostsLines.join("\n");
+    for (const service of services) {
+      const ws = this.deps.workspace(service.workspaceId);
+      const privateLinks = workspaceIds.filter(
+        (workspaceId) => workspaceId !== service.workspaceId
+      );
+      const currentNetwork = await ws.network.get().catch(() => null);
+      const currentIngress = Array.isArray(
+        currentNetwork?.ingress_ports
+      ) ? currentNetwork.ingress_ports : [];
+      const ingressPorts = [.../* @__PURE__ */ new Set([...currentIngress, ...service.ports])];
+      if (ingressPorts.length > 0 || privateLinks.length > 0) {
+        await ws.network.update({
+          ...privateLinks.length ? { private_link_ids: privateLinks } : {},
+          ...ingressPorts.length ? { ingress_ports: ingressPorts } : {}
+        }).catch((err) => {
+          onLog({
+            timestamp: now(),
+            message: `Warning: failed to link private network for "${service.serviceName}": ${err instanceof Error ? err.message : err}
+`,
+            level: "warn"
+          });
+        });
+      }
+      try {
+        const rt = await ws.runtime();
+        const script = `set -e
+tmp=$(mktemp)
+grep -v ' # openship-compose:${group.id}' /etc/hosts > "$tmp" || true
+cat >> "$tmp" <<'EOF'
+${hostsBlock}
+EOF
+cat "$tmp" > /etc/hosts
+rm -f "$tmp"`;
+        await this.deps.execAndStream(rt, ["sh", "-c", script], onLog);
+      } catch (err) {
+        onLog({
+          timestamp: now(),
+          message: `Warning: failed to update service discovery for "${service.serviceName}": ${err instanceof Error ? err.message : err}
+`,
+          level: "warn"
+        });
+      }
+    }
+  }
+  /**
+   * Final convergence pass — run ONCE after every service in the group has
+   * deployed. The per-service `syncServiceDiscovery` is incremental and only
+   * ever sees the IPs known at that moment; a service whose private IP hadn't
+   * been assigned during its own deploy would otherwise stay permanently absent
+   * from the mesh. This re-resolves any still-missing IP (bounded retry) and
+   * rewrites the FULL /etc/hosts + private links + ingress across the whole
+   * group, so the finished stack has every peer reachable by name.
+   *
+   * Note: we deliberately do NOT blanket-restart workloads here — that would
+   * take stateful services (Postgres, …) down needlessly, and standard clients
+   * resolve DNS per connection, so they read the completed /etc/hosts without a
+   * restart. (A boot-time-cache app is the rare exception.)
+   */
+  async finalizeGroup(groupId, onLog) {
+    const log = onLog ?? (() => {
+    });
+    const group = this.groups.get(groupId);
+    if (!group) return;
+    for (const service of group.services.values()) {
+      if (service.ip) continue;
+      const ip = await this.resolveWorkspaceIpWithRetry(
+        this.deps.workspace(service.workspaceId)
+      );
+      if (ip) {
+        service.ip = ip;
+      } else {
+        log({
+          timestamp: now(),
+          message: `Warning: service "${service.serviceName}" never received a private IP \u2014 peers cannot reach it by name.
+`,
+          level: "warn"
+        });
+      }
+    }
+    await this.syncServiceDiscovery(group, log);
+  }
+};
+
+// ../../packages/adapters/src/runtime/cloud.ts
+var DOCKERFILE_SOURCE_IMAGE = "node:22";
+var WORKSPACE_STREAM_EXEC_TIMEOUT_MS = 15 * 60 * 1e3;
+function formatCloudError(err) {
+  const base = safeErrorMessage(err);
+  if (!err || typeof err !== "object") return base;
+  const e = err;
+  const tags = [];
+  const codePart = [e.code, typeof e.status === "number" ? `HTTP ${e.status}` : null].filter(Boolean).join(" ");
+  if (codePart) tags.push(codePart);
+  if (e.requestId) tags.push(`requestId=${e.requestId}`);
+  let detail = "";
+  if (e.details != null) {
+    try {
+      detail = typeof e.details === "string" ? e.details : JSON.stringify(e.details);
+    } catch {
+    }
+  }
+  return `${base}${tags.length ? ` [${tags.join(", ")}]` : ""}${detail ? ` \u2014 ${detail.slice(0, 800)}` : ""}`;
+}
+function now2() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function applyTail(entries, tail) {
+  if (typeof tail !== "number") return entries;
+  if (tail <= 0) return [];
+  return entries.slice(-tail);
+}
+function summarizeCommandOutput(output) {
+  const lines = output.replace(/\x1B(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~])/g, "").split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+  const lastLine = lines.at(-1) ?? "";
+  return lastLine.length > 300 ? `${lastLine.slice(0, 297)}...` : lastLine;
+}
+function exposeTarget2(port, slug, domain = SYSTEM.DOMAINS.CLOUD_DOMAIN) {
+  return slug ? `port ${port} for slug "${slug}" (${slug}.${domain})` : `port ${port}`;
+}
+function primaryPublicEndpoint(config) {
+  return config.publicEndpoints?.[0];
+}
+function endpointSlug(endpoint) {
+  const slug = endpoint?.domain?.trim();
+  return endpoint?.domainType === "free" && slug ? slug : void 0;
+}
+function endpointCustomDomain(endpoint) {
+  const domain = endpoint?.customDomain?.trim();
+  return endpoint?.domainType === "custom" && domain ? domain : void 0;
+}
+function fallbackRuntimeName(config) {
+  const raw = config.runtimeName ?? `${config.projectId.slice(0, 20)}-${config.deploymentId.slice(0, 8)}`;
+  const normalized = raw.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/^-+|-+$/g, "").slice(0, 60);
+  return normalized || `deploy-${config.deploymentId.slice(0, 8)}`;
+}
+function toEnvArray2(env) {
+  return Object.entries(env).map(([k, v]) => `${k}=${v}`);
+}
+function validEnvKey(key) {
+  return /^[A-Za-z_][A-Za-z0-9_]*$/.test(key);
+}
+function envExportPrefix(env) {
+  const parts = Object.entries(env).filter(([key]) => validEnvKey(key)).map(([key, value]) => `export ${key}=${sq(value ?? "")}`);
+  return parts.length ? `${parts.join(" && ")} && ` : "";
+}
+function joinWorkspacePath(base, ...parts) {
+  return posix.normalize(posix.join(base, ...parts.filter(Boolean)));
+}
+function resolveVmPath(workdir, target) {
+  if (!target || target === ".") return workdir || "/";
+  if (target.startsWith("/")) return posix.normalize(target);
+  return posix.normalize(posix.join(workdir || "/", target));
+}
+function hasGlob(value) {
+  return /[*?[\]]/.test(value);
+}
+function sourceExpression(baseDir, source) {
+  const normalized = source === "." ? "." : source.replace(/^\/+/, "");
+  const full = normalized === "." ? `${baseDir}/.` : `${baseDir}/${normalized}`;
+  if (hasGlob(normalized)) {
+    if (!/^[A-Za-z0-9_@%+=:,./*?[\]-]+$/.test(normalized)) {
+      throw new Error(`Unsafe glob source in Dockerfile COPY: ${source}`);
+    }
+    return full;
+  }
+  return sq(full);
+}
+function dockerCopyShellCommands(opts) {
+  const { sources, destination, destinationIsDir, destinationTarget } = opts;
+  const destinationExpr = sq(destination);
+  const destinationTargetExpr = sq(destinationTarget);
+  return sources.flatMap((source) => [
+    `for src in ${source}; do`,
+    '  if [ ! -e "$src" ]; then',
+    '    echo "COPY source not found: $src" >&2',
+    "    exit 1",
+    "  fi",
+    '  if [ -d "$src" ]; then',
+    destinationIsDir ? `    mkdir -p ${destinationExpr}` : `    rm -rf ${destinationExpr} && mkdir -p ${destinationExpr}`,
+    // Docker COPY copies directory contents, not the directory wrapper.
+    `    cp -a "$src/." ${destinationExpr}/`,
+    "  else",
+    `    mkdir -p ${destinationTargetExpr}`,
+    `    cp -a "$src" ${destinationExpr}`,
+    "  fi",
+    "done"
+  ]);
+}
+function stageArtifactDownloadPath(source) {
+  const normalized = source.trim();
+  if (!normalized || normalized === ".") {
+    return "/";
+  }
+  if (normalized.startsWith("/")) {
+    return posix.normalize(normalized);
+  }
+  return posix.normalize(`/${normalized}`);
+}
+function substituteDockerArgs(value, args) {
+  return value.replace(/\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?/g, (match, key) => {
+    const replacement = args[key];
+    return replacement === void 0 || replacement === null ? match : replacement;
+  });
+}
+function stageBaseLabel(stageBaseImage, requestedBaseImage, stageAlias) {
+  if (stageAlias) {
+    return `${requestedBaseImage} (stage alias -> ${stageBaseImage})`;
+  }
+  return stageBaseImage === requestedBaseImage ? requestedBaseImage : `${requestedBaseImage} (resolved to ${stageBaseImage})`;
+}
+function resolveCopyDestinationPath(copy, sourcePath, destination, destinationIsDir) {
+  if (!destinationIsDir) {
+    return destination;
+  }
+  const basename = posix.basename(sourcePath.replace(/\/+$/g, "")) || ".";
+  return posix.normalize(posix.join(destination, basename));
+}
+var PAGE_CONTAINER_PREFIX = "page:";
+async function provisionCloudWorkspace(client, config, logger) {
+  logger?.log(`Creating workspace from image "${config.image}"...
+`);
+  let wsData;
+  try {
+    wsData = await client.workspaces.create({
+      name: config.name,
+      image: config.image,
+      mode: config.mode,
+      config: {
+        cpus: cloudCpus(config.resources.cpuCores),
+        memory_mb: config.resources.memoryMb,
+        disk_size_mb: config.resources.diskMb,
+        env: toEnvArray2(config.env ?? {})
+      }
+    });
+  } catch (err) {
+    logger?.log(`Failed to create workspace from image "${config.image}": ${formatCloudError(err)}
+`, "error");
+    throw err;
+  }
+  const ws = client.workspace(wsData.id);
+  try {
+    if (config.mode === "temporary" && config.ttl) {
+      try {
+        await ws.lifecycle.makeTemporary({ ttl: config.ttl, ttl_action: "remove", remove_on_exit: true });
+      } catch {
+      }
+    }
+    logger?.log("Connecting to build environment...\n");
+    let rt;
+    for (let attempt = 0; attempt < 3; attempt++) {
+      try {
+        rt = await ws.runtime();
+        break;
+      } catch (err) {
+        if (attempt < 2) await new Promise((r) => setTimeout(r, 2e3));
+        else throw err;
+      }
+    }
+    if (!rt) throw new Error("Failed to connect to build environment");
+    logger?.log("Build environment ready\n");
+    return { workspaceId: wsData.id, runtime: rt };
+  } catch (err) {
+    await ws.delete().catch(() => {
+    });
+    logger?.log(`Failed to prepare workspace "${wsData.id}": ${formatCloudError(err)}
+`, "error");
+    throw err;
+  }
+}
+var CloudRuntime = class {
+  name = "cloud";
+  capabilities = /* @__PURE__ */ new Set([
+    "build",
+    "deploy",
+    "multiServiceDeploy",
+    "stop",
+    "start",
+    "restart",
+    "destroy",
+    "containerInfo",
+    "runtimeLogs",
+    "streamLogs",
+    "usage",
+    "containerIp",
+    "rollback",
+    "serviceShell",
+    "inContainerExec"
+  ]);
+  /**
+   * Services map to Oblien workspaces, not Docker containers, so host-level
+   * compose extras have no equivalent. `healthcheck` is dropped-with-a-warning
+   * here (A1); host-level keys — caps/devices/privileged/sysctls/ulimits/
+   * logging/dns — join this set as they're added in later phases.
+   */
+  unsupportedComposeKeys = /* @__PURE__ */ new Set([
+    "healthcheck"
+  ]);
+  client;
+  // Optional admin-scoped proxy. Set when this runtime is constructed
+  // by a local/desktop instance whose `client` is a namespace token —
+  // admin-scoped operations (e.g. creating pages on shared `.opsh.io`)
+  // get handed off to the SaaS through this callback. SaaS instances
+  // construct CloudRuntime with master creds and leave it null;
+  // `this.client` already has the needed scope there.
+  adminProxy;
+  builtArtifacts = /* @__PURE__ */ new Map();
+  activeBuilds = /* @__PURE__ */ new Map();
+  compose;
+  constructor(client, opts) {
+    this.client = client;
+    this.adminProxy = opts?.adminProxy;
+    this.compose = new CloudComposeSupport({
+      client,
+      builtArtifacts: this.builtArtifacts,
+      workspace: (workspaceId) => this.ws(workspaceId),
+      provisionWorkspace: (config, logger) => this.provisionWorkspace(config, logger),
+      execAndStream: (runtime, command, onLog, timeoutSeconds) => this.execAndStream(runtime, command, onLog, timeoutSeconds)
+    });
+  }
+  supports(cap) {
+    return this.capabilities.has(cap);
+  }
+  async dispose() {
+  }
+  /** Get a scoped workspace handle. */
+  ws(workspaceId) {
+    return this.client.workspace(workspaceId);
+  }
+  /**
+   * Connect a custom domain to `workspaceId`, REASSIGNING it from a previous
+   * deployment if needed.
+   *
+   * Each cloud deploy is a fresh workspace, but the custom domain is still
+   * bound to the PREVIOUS (still-live) deployment's workspace during cutover —
+   * so a plain connect returns "Domain is unavailable". That's a false
+   * conflict when the project is re-pointing its OWN domain. We look up the
+   * domain's current owner: if it's already this workspace, we're done
+   * (idempotent); if it's another workspace we own (the prior deploy), we
+   * disconnect it there and retry. A domain owned by anything else (another
+   * account's route, a page, etc.) still errors — no silent takeover.
+   */
+  async connectCustomDomainReassigning(workspaceId, domain, port, log) {
+    const ws = this.ws(workspaceId);
+    try {
+      await ws.domains.connect({ domain, port });
+      return;
+    } catch (err) {
+      const owner = await this.findDomainOwner(domain).catch(() => null);
+      if (owner && owner.owner_id === workspaceId) return;
+      if (!owner || owner.owner_type !== "workspace") throw err;
+      log?.({
+        timestamp: now2(),
+        level: "info",
+        message: `Reassigning ${domain} from the previous deployment...
+`
+      });
+      await this.ws(owner.owner_id).domains.disconnect().catch(() => {
+      });
+      await ws.domains.connect({ domain, port });
+    }
+  }
+  /** Find the current owner route for a hostname among the caller's routes. */
+  async findDomainOwner(domain) {
+    const target = domain.trim().toLowerCase();
+    const res = await this.client.domain.routes();
+    const routes = res?.data ?? [];
+    const match = routes.find(
+      (r) => (r.hostname ?? "").toLowerCase() === target || (r.domain ?? "").toLowerCase() === target
+    );
+    return match ? { owner_id: match.owner_id, owner_type: match.owner_type } : null;
+  }
+  createActiveBuild(sessionId) {
+    const activeBuild = {
+      abort: new AbortController(),
+      workspaceIds: /* @__PURE__ */ new Set()
+    };
+    this.activeBuilds.set(sessionId, activeBuild);
+    return activeBuild;
+  }
+  trackActiveBuildWorkspace(sessionId, workspaceId) {
+    this.activeBuilds.get(sessionId)?.workspaceIds.add(workspaceId);
+  }
+  untrackActiveBuildWorkspace(sessionId, workspaceId) {
+    this.activeBuilds.get(sessionId)?.workspaceIds.delete(workspaceId);
+  }
+  // ── Build lifecycle ────────────────────────────────────────────────────
+  async build(config, logger) {
+    const log = logger ?? new BuildLogger();
+    const activeBuild = this.createActiveBuild(config.sessionId);
+    try {
+      if (config.stack === "docker" || config.dockerfilePath) {
+        const result2 = await this.buildDockerfileWorkspace(config, log);
+        return activeBuild.abort.signal.aborted ? { ...result2, status: "cancelled", errorMessage: void 0 } : result2;
+      }
+      const buildLocally = config.buildStrategy === "local";
+      let wsId;
+      let rt;
+      try {
+        if (config.cloudWorkspaceId) {
+          log.log("Attaching to uploaded workspace...\n");
+          wsId = config.cloudWorkspaceId;
+          rt = await this.adoptWorkspaceRuntime(wsId);
+          this.trackActiveBuildWorkspace(config.sessionId, wsId);
+          log.log("Build environment ready\n");
+        } else {
+          const provisioned = await this.provisionBuildWorkspace(config, log);
+          wsId = provisioned.workspaceId;
+          rt = provisioned.runtime;
+          this.trackActiveBuildWorkspace(config.sessionId, wsId);
+        }
+      } catch (err) {
+        const msg = formatCloudError(err);
+        log.log(`Failed to provision build environment: ${msg}`, "error");
+        return {
+          sessionId: config.sessionId,
+          status: activeBuild.abort.signal.aborted ? "cancelled" : "failed",
+          durationMs: 0,
+          errorMessage: activeBuild.abort.signal.aborted ? void 0 : `Failed to provision build environment: ${msg}`
+        };
+      }
+      if (buildLocally) {
+        log.log("Build strategy: local (build on API host, upload to cloud)\n");
+        const stackDef = STACKS[config.stack];
+        let standaloneStartCommand;
+        let result2;
+        try {
+          result2 = await runLocalBuild({
+            config,
+            logger: log,
+            abort: activeBuild.abort.signal,
+            transferOutput: async (buildDir) => {
+              if (activeBuild.abort.signal.aborted) {
+                throw new Error("Build cancelled");
+              }
+              const selfContained = await prepareStackOutput(
+                config.stack,
+                resolveProjectDir(buildDir, config.rootDirectory)
+              );
+              if (selfContained) {
+                log.log("Detected self-contained build output \u2014 uploading the bundle (no install on cloud).\n");
+                await transferLocalDirectory(
+                  selfContained.bundleDir,
+                  { kind: "cloud-runtime", runtime: rt, path: "/app" },
+                  log,
+                  { excludes: [] }
+                );
+                standaloneStartCommand = selfContained.startCommand;
+                return;
+              }
+              if (stackDef?.productionPaths?.length) {
+                log.log(`Transferring production paths: ${stackDef.productionPaths.join(", ")}
+`);
+                await transferLocalDirectory(
+                  buildDir,
+                  { kind: "cloud-runtime", runtime: rt, path: "/app" },
+                  log,
+                  { includes: [...stackDef.productionPaths] }
+                );
+              } else {
+                await transferLocalDirectory(
+                  buildDir,
+                  { kind: "cloud-runtime", runtime: rt, path: "/app" },
+                  log,
+                  {
+                    excludes: buildOutputTransferExcludes(stackDef),
+                    alsoInclude: stackDef?.outputDirectory ? [stackDef.outputDirectory] : void 0
+                  }
+                );
+              }
+              if (activeBuild.abort.signal.aborted) {
+                throw new Error("Build cancelled");
+              }
+              const installCmd = config.installCommand?.trim();
+              if (installCmd) {
+                log.log("Installing production dependencies on cloud...\n");
+                const pmEnsure = packageManagerEnsureCommand(config.packageManager);
+                const fullInstall = pmEnsure ? `${pmEnsure} && ${installCmd}` : installCmd;
+                await this.execAndStream(rt, ["sh", "-c", `cd /app && ${fullInstall}`], log.callback);
+              }
+            }
+          });
+        } catch (err) {
+          const msg = safeErrorMessage(err);
+          log.log(`Failed to upload local build output: ${msg}`, "error");
+          return {
+            sessionId: config.sessionId,
+            status: activeBuild.abort.signal.aborted ? "cancelled" : "failed",
+            imageRef: wsId,
+            errorMessage: activeBuild.abort.signal.aborted ? void 0 : `Failed to upload local build output: ${msg}`
+          };
+        }
+        return {
+          sessionId: config.sessionId,
+          status: activeBuild.abort.signal.aborted ? "cancelled" : result2.status,
+          imageRef: wsId,
+          durationMs: result2.durationMs,
+          errorMessage: activeBuild.abort.signal.aborted ? void 0 : result2.errorMessage,
+          startCommand: standaloneStartCommand
+        };
+      }
+      log.log("Build strategy: server (build in cloud workspace)\n");
+      const buildEnv = {
+        projectDir: "/app",
+        // A provisioned workspace gets env baked in at create time (native), so
+        // the pipeline skips the shell export prefix. An ADOPTED upload
+        // workspace was created before the deploy's env vars were known, so it
+        // has none — the pipeline must inject them inline instead.
+        hasNativeEnv: !config.cloudWorkspaceId,
+        exec: async (command, logCb) => {
+          if (activeBuild.abort.signal.aborted) {
+            throw new Error("Build cancelled");
+          }
+          await this.execAndStream(rt, ["sh", "-c", command], logCb);
+          if (activeBuild.abort.signal.aborted) {
+            throw new Error("Build cancelled");
+          }
+        },
+        preflight: async (cfg, plog) => {
+          if (activeBuild.abort.signal.aborted) {
+            throw new Error("Build cancelled");
+          }
+          if (cfg.sourceStaged) {
+            return;
+          }
+          if (!cfg.localPath) {
+            await this.ensureWorkspaceGit(rt, plog, "build workspace");
+            return;
+          }
+          await transferLocalDirectory(
+            cfg.localPath,
+            {
+              kind: "cloud-runtime",
+              runtime: rt,
+              path: "/app"
+            },
+            plog
+          );
+        }
+      };
+      const result = await runBuildPipeline(buildEnv, config, log);
+      return {
+        sessionId: config.sessionId,
+        status: activeBuild.abort.signal.aborted ? "cancelled" : result.status,
+        imageRef: wsId,
+        durationMs: result.durationMs,
+        errorMessage: activeBuild.abort.signal.aborted ? void 0 : result.errorMessage
+      };
+    } finally {
+      this.activeBuilds.delete(config.sessionId);
+    }
+  }
+  async buildDockerfileWorkspace(config, log) {
+    const startedAt = Date.now();
+    const createdWorkspaceIds = [];
+    let finalWorkspaceId;
+    let source;
+    try {
+      log.log("Build strategy: Dockerfile plan (build in Oblien workspaces)\n");
+      source = await this.resolveDockerfileBuildSource(config, log);
+      const plan = compileDockerfileToWorkspacePlan(source.dockerfile);
+      const blocking = plan.diagnostics.filter(
+        (item) => item.severity === "error" || item.severity === "unsupported"
+      );
+      if (blocking.length > 0) {
+        throw new Error(
+          blocking.map((item) => item.line ? `line ${item.line}: ${item.message}` : item.message).join("\n")
+        );
+      }
+      if (plan.stages.length === 0 || !plan.finalStage || !plan.runtime) {
+        throw new Error("Dockerfile did not produce a deployable final stage.");
+      }
+      const unsafe = this.getUnsupportedDockerfilePlanFeatures(plan);
+      if (unsafe.length > 0) {
+        throw new Error(unsafe.join("\n"));
+      }
+      for (const warning of plan.diagnostics.filter((item) => item.severity === "warning")) {
+        log.log(
+          `${warning.line ? `Dockerfile line ${warning.line}: ` : ""}${warning.message}
+`,
+          "warn"
+        );
+      }
+      const built = await this.executeDockerfilePlan({
+        config,
+        plan,
+        source,
+        logger: log,
+        onWorkspaceCreated: (workspaceId) => {
+          createdWorkspaceIds.push(workspaceId);
+          this.trackActiveBuildWorkspace(config.sessionId, workspaceId);
+        }
+      });
+      finalWorkspaceId = built.workspaceId;
+      this.builtArtifacts.set(built.workspaceId, {
+        workspaceId: built.workspaceId,
+        runtime: built.runtime
+      });
+      log.log(
+        `Dockerfile runtime plan: workdir ${built.runtime.workdir}${built.runtime.exposedPort ? ` \xB7 port ${built.runtime.exposedPort}` : " \xB7 no EXPOSE port"}${built.runtime.startCommand ? ` \xB7 start ${built.runtime.startCommand}` : " \xB7 no start command"}
+`
+      );
+      return {
+        sessionId: config.sessionId,
+        status: "deploying",
+        imageRef: built.workspaceId,
+        durationMs: Date.now() - startedAt
+      };
+    } catch (err) {
+      for (const workspaceId of createdWorkspaceIds) {
+        if (workspaceId === finalWorkspaceId) continue;
+        await this.ws(workspaceId).delete().catch(() => {
+        });
+        this.untrackActiveBuildWorkspace(config.sessionId, workspaceId);
+      }
+      const message = safeErrorMessage(err);
+      log.log(`Dockerfile build failed: ${message}
+`, "error");
+      return {
+        sessionId: config.sessionId,
+        status: "failed",
+        durationMs: Date.now() - startedAt,
+        errorMessage: message
+      };
+    } finally {
+      await source?.cleanup().catch(() => {
+      });
+    }
+  }
+  async resolveDockerfileBuildSource(config, logger) {
+    if (config.dockerfileContent?.trim()) {
+      logger.log("Using Dockerfile content from source metadata.\n");
+      return {
+        kind: "remote",
+        contextRelativePath: normalizeDockerRelativePath(config.rootDirectory),
+        dockerfile: config.dockerfileContent,
+        cleanup: async () => {
+        }
+      };
+    }
+    if (!config.localPath) {
+      return this.resolveRemoteDockerfileBuildSource(config, logger);
+    }
+    logger.log("Preparing local Dockerfile source...\n");
+    const context = await createDockerBuildContext(config, {
+      requireRepositoryDockerfile: true,
+      onLog: logger.callback
+    });
+    const dockerfilePath = join(context.contextDir, ...context.dockerfileName.split("/"));
+    const dockerfile = await readFile(dockerfilePath, "utf-8");
+    const contextRoot = join(
+      context.contextDir,
+      ...normalizeDockerRelativePath(context.rootDirectory).split("/").filter(Boolean)
+    );
+    return {
+      kind: "local",
+      contextRoot,
+      dockerfile,
+      cleanup: context.cleanup
+    };
+  }
+  async resolveRemoteDockerfileBuildSource(config, logger) {
+    const candidates = resolveDockerfileCandidates(config.rootDirectory, config.dockerfilePath);
+    const sourceLabel = config.commitSha ? `${config.branch}@${config.commitSha.slice(0, 7)}` : config.branch;
+    const checkoutRef = config.commitSha ?? "FETCH_HEAD";
+    const sourceDir = "/openship/dockerfile-source";
+    let sourceWorkspaceId;
+    try {
+      logger.log(`Resolving Dockerfile source in cloud workspace (${sourceLabel})...
+`);
+      const provisioned = await this.provisionWorkspace(
+        {
+          name: `${config.slug ?? config.projectId}-source`.slice(0, 60),
+          image: DOCKERFILE_SOURCE_IMAGE,
+          mode: "temporary",
+          resources: config.resources,
+          env: config.envVars,
+          ttl: "10m"
+        },
+        logger
+      );
+      sourceWorkspaceId = provisioned.workspaceId;
+      this.trackActiveBuildWorkspace(config.sessionId, provisioned.workspaceId);
+      await this.ensureWorkspaceGit(provisioned.runtime, logger, "Dockerfile source workspace");
+      const executor = this.workspaceExecutor(provisioned.runtime);
+      const cloneUrl = injectGitToken(config.repoUrl, config.gitToken);
+      const fetchCommand = [
+        "set -e",
+        `rm -rf ${sq(sourceDir)}`,
+        `mkdir -p ${sq(sourceDir)}`,
+        `cd ${sq(sourceDir)}`,
+        "git init -q",
+        `git remote add origin ${sq(cloneUrl)}`,
+        // GIT_TERMINAL_PROMPT=0 + GIT_ASKPASS=/bin/echo prevent the
+        // process from hanging on a credential prompt when a non-tty
+        // build runner has no token; --progress forces git to emit
+        // progress lines to stderr so they reach the build log stream.
+        `GIT_TERMINAL_PROMPT=0 GIT_ASKPASS=/bin/echo git -c credential.helper= fetch --progress --depth ${config.commitSha ? "50" : "1"} origin ${sq(config.branch)}`,
+        `git -c credential.helper= -c advice.detachedHead=false checkout -q ${sq(checkoutRef)}`,
+        'echo "Dockerfile source fetch ready."'
+      ].join("\n");
+      const fetchResult = await executor.streamExec(fetchCommand, logger.callback);
+      if (fetchResult.code !== 0) {
+        throw new Error(
+          summarizeCommandOutput(fetchResult.output) || "Failed to fetch Dockerfile source"
+        );
+      }
+      for (const candidate of candidates) {
+        logger.log(`Checking Dockerfile candidate: ${candidate}
+`);
+        const dockerfile = await executor.exec(
+          [
+            `cd ${sq(sourceDir)}`,
+            `test -f ${sq(candidate)}`,
+            `cat ${sq(candidate)}`
+          ].join(" && "),
+          { timeout: 3e4 }
+        ).catch(() => null);
+        if (dockerfile !== null) {
+          logger.log(`Dockerfile source resolved: ${candidate}
+`);
+          const workspaceId = sourceWorkspaceId;
+          sourceWorkspaceId = void 0;
+          return {
+            kind: "remote",
+            contextRelativePath: normalizeDockerRelativePath(config.rootDirectory),
+            dockerfile,
+            cleanup: async () => {
+              await this.ws(workspaceId).delete().catch(() => {
+              });
+              this.untrackActiveBuildWorkspace(config.sessionId, workspaceId);
+            }
+          };
+        }
+      }
+      const discovered = await executor.exec(
+        `cd ${sq(sourceDir)} && find . -maxdepth 5 -type f -iname Dockerfile | sed 's#^./##' | head -20`,
+        { timeout: 3e4 }
+      ).then((value) => value.trim()).catch(() => "");
+      throw new Error(
+        `No Dockerfile found. Checked: ${candidates.join(", ")}${discovered ? `. Found: ${discovered.replace(/\n/g, ", ")}` : ""}`
+      );
+    } finally {
+      if (sourceWorkspaceId) {
+        await this.ws(sourceWorkspaceId).delete().catch(() => {
+        });
+        this.untrackActiveBuildWorkspace(config.sessionId, sourceWorkspaceId);
+      }
+    }
+  }
+  getUnsupportedDockerfilePlanFeatures(plan) {
+    const errors = [];
+    for (const stage of plan.stages) {
+      if (stage.shell && stage.shell.join("\0") !== ["/bin/sh", "-c"].join("\0")) {
+        errors.push(
+          `Dockerfile stage "${stage.name ?? stage.index}" uses SHELL ${JSON.stringify(stage.shell)}, which is not supported by cloud Dockerfile builds yet.`
+        );
+      }
+      for (const run of stage.runs) {
+        const flags = Object.keys(run.flags);
+        if (flags.length > 0) {
+          errors.push(
+            `Dockerfile line ${run.line}: RUN flags (${flags.map((flag) => `--${flag}`).join(", ")}) are not supported by cloud Dockerfile builds yet.`
+          );
+        }
+      }
+      for (const copy of stage.copies) {
+        if (copy.kind === "add") {
+          errors.push(
+            `Dockerfile line ${copy.line}: ADD is not supported by cloud Dockerfile builds yet. Use COPY for local files.`
+          );
+        }
+        const flags = Object.keys(copy.flags).filter((flag) => flag !== "from");
+        if (flags.length > 0) {
+          errors.push(
+            `Dockerfile line ${copy.line}: ${copy.kind.toUpperCase()} flags (${flags.map((flag) => `--${flag}`).join(", ")}) are not supported by cloud Dockerfile builds yet.`
+          );
+        }
+      }
+    }
+    return errors;
+  }
+  async executeDockerfilePlan(opts) {
+    const { config, plan, source, logger, onWorkspaceCreated } = opts;
+    const plannedStageRefs = /* @__PURE__ */ new Map();
+    const resolvedStageBaseImages = /* @__PURE__ */ new Map();
+    const stageBaseLabels = /* @__PURE__ */ new Map();
+    let workspaceBaseImage;
+    let workspaceId;
+    try {
+      for (const stage of plan.stages) {
+        const stageName = stage.name ?? String(stage.index);
+        const allArgs = { ...plan.globalArgs, ...stage.args };
+        const requestedBaseImage = substituteDockerArgs(stage.baseImage, allArgs);
+        const baseStageRef = plannedStageRefs.get(requestedBaseImage);
+        const baseImage = baseStageRef ? resolvedStageBaseImages.get(baseStageRef.index) : requestedBaseImage;
+        if (!baseImage || baseImage.includes("$")) {
+          throw new Error(
+            `Dockerfile stage "${stageName}" has unresolved base image "${stage.baseImage}".`
+          );
+        }
+        const baseLabel = stageBaseLabel(baseImage, requestedBaseImage, baseStageRef?.name);
+        if (workspaceBaseImage && workspaceBaseImage !== baseImage) {
+          throw new Error(
+            `Dockerfile stage "${stageName}" uses base image "${baseLabel}", but cloud Dockerfile builds run one workspace per service and only support one base image per Dockerfile. Use stage aliases that resolve to "${workspaceBaseImage}" or deploy this service with Docker support.`
+          );
+        }
+        workspaceBaseImage ??= baseImage;
+        stageBaseLabels.set(stage.index, baseLabel);
+        resolvedStageBaseImages.set(stage.index, baseImage);
+        plannedStageRefs.set(String(stage.index), stage);
+        if (stage.name) plannedStageRefs.set(stage.name, stage);
+      }
+      if (!workspaceBaseImage) {
+        throw new Error("Dockerfile did not define a base image.");
+      }
+      const provisioned = await this.provisionWorkspace(
+        {
+          name: `${config.slug ?? config.projectId}-dockerfile`.slice(0, 60),
+          image: workspaceBaseImage,
+          mode: "temporary",
+          resources: config.resources,
+          env: config.envVars,
+          ttl: "15m"
+        },
+        logger
+      );
+      workspaceId = provisioned.workspaceId;
+      onWorkspaceCreated(provisioned.workspaceId);
+      if (plan.stages.some(
+        (stage) => stage.steps.some((step) => step.type === "copy" && !step.copy.from)
+      )) {
+        await this.transferDockerfileContext(config, source, provisioned.runtime, logger);
+      }
+      const completedStageRefs = /* @__PURE__ */ new Map();
+      for (const stage of plan.stages) {
+        const stageName = stage.name ?? String(stage.index);
+        const baseLabel = stageBaseLabels.get(stage.index) ?? workspaceBaseImage;
+        logger.log(`Preparing Dockerfile stage "${stageName}" from ${baseLabel}...
+`);
+        await this.execAndStream(
+          provisioned.runtime,
+          ["sh", "-c", `mkdir -p ${sq(stage.workdir || "/")}`],
+          logger.callback
+        );
+        for (const step of stage.steps) {
+          if (step.type === "copy") {
+            await this.applyDockerfileCopyStep({
+              copy: step.copy,
+              stageRefs: completedStageRefs,
+              runtime: provisioned.runtime,
+              logger
+            });
+          } else {
+            await this.applyDockerfileRunStep({
+              run: step.run,
+              runtime: provisioned.runtime,
+              logger,
+              env: {
+                ...config.envVars,
+                ...plan.globalArgs,
+                ...stage.args,
+                ...step.run.env
+              }
+            });
+          }
+        }
+        completedStageRefs.set(String(stage.index), stage);
+        if (stage.name) completedStageRefs.set(stage.name, stage);
+      }
+      if (!plan.runtime) {
+        throw new Error("Dockerfile final stage workspace was not created.");
+      }
+      return { workspaceId: provisioned.workspaceId, runtime: plan.runtime };
+    } catch (err) {
+      if (workspaceId) {
+        await this.ws(workspaceId).delete().catch(() => {
+        });
+      }
+      throw err;
+    }
+  }
+  async transferDockerfileContext(config, source, runtime, logger) {
+    if (source.kind === "local") {
+      await transferLocalDirectory(
+        source.contextRoot,
+        { kind: "cloud-runtime", runtime, path: "/openship/context" },
+        logger,
+        { excludes: [...TRANSFER_EXCLUDES] }
+      );
+      return;
+    }
+    await this.cloneDockerfileContext(config, source, runtime, logger);
+  }
+  async cloneDockerfileContext(config, source, targetRuntime, logger) {
+    const repoRoot = "/openship/repo";
+    const contextRoot = "/openship/context";
+    const contextRelativePath = normalizeDockerRelativePath(source.contextRelativePath);
+    if (contextRelativePath.startsWith("..")) {
+      throw new Error("Dockerfile build context escapes the repository source.");
+    }
+    const cloneUrl = injectGitToken(config.repoUrl, config.gitToken);
+    const depthArgs = config.commitSha ? "--depth 50 " : "--depth 1 ";
+    const cloneTarget = contextRelativePath ? repoRoot : contextRoot;
+    const contextSource = contextRelativePath ? joinWorkspacePath(repoRoot, contextRelativePath) : contextRoot;
+    const prepareContextCommands = contextRelativePath ? [
+      `echo "Copying Dockerfile context ${contextRelativePath}..."`,
+      `mkdir -p ${sq(contextRoot)}`,
+      `cp -a ${sq(`${contextSource}/.`)} ${sq(contextRoot)}/`
+    ] : ['echo "Using repository root as Dockerfile context."'];
+    const cloneCommand = [
+      "set -e",
+      `rm -rf ${sq(repoRoot)} ${sq(contextRoot)}`,
+      "mkdir -p /openship",
+      // See fetchCommand above for env-var rationale; --progress keeps
+      // the clone visible in the streamed log even though stdout/stderr
+      // are pipes, not a tty.
+      `GIT_TERMINAL_PROMPT=0 GIT_ASKPASS=/bin/echo git -c credential.helper= clone --progress ${depthArgs}--branch ${sq(config.branch)} ${sq(cloneUrl)} ${sq(cloneTarget)}`
+    ].join("\n");
+    const checkoutCommand = config.commitSha ? `cd ${sq(cloneTarget)} && git -c credential.helper= -c advice.detachedHead=false checkout ${sq(config.commitSha)}` : "";
+    const prepareCommand = [
+      "set -e",
+      `rm -rf ${sq(joinWorkspacePath(cloneTarget, ".git"))}`,
+      ...prepareContextCommands,
+      'echo "Dockerfile context prepared."'
+    ].join("\n");
+    logger.log(`Preparing Dockerfile build workspace for repository clone (branch: ${config.branch})...
+`);
+    await this.ensureWorkspaceGit(targetRuntime, logger, "Dockerfile build workspace");
+    logger.log(`Cloning Dockerfile context in build workspace (branch: ${config.branch})...
+`);
+    await this.execAndStream(targetRuntime, ["sh", "-c", cloneCommand], logger.callback, 900);
+    if (checkoutCommand) {
+      await this.execAndStream(targetRuntime, ["sh", "-c", checkoutCommand], logger.callback, 300);
+    }
+    await this.execAndStream(targetRuntime, ["sh", "-c", prepareCommand], logger.callback, 300);
+    logger.log("Dockerfile context ready.\n");
+  }
+  async applyDockerfileRunStep(opts) {
+    const { run, runtime, logger, env } = opts;
+    const command = `mkdir -p ${sq(run.workdir)} && cd ${sq(run.workdir)} && ${envExportPrefix(env)}${run.command}`;
+    logger.log(`[Dockerfile] RUN ${run.command}
+`);
+    await this.execAndStream(runtime, ["sh", "-c", command], logger.callback);
+  }
+  async applyDockerfileCopyStep(opts) {
+    const { copy, stageRefs, runtime, logger } = opts;
+    let sourceBase = "/openship/context";
+    let sourcePaths = copy.sources;
+    let copyFromStage = false;
+    if (copy.from) {
+      const sourceStage = stageRefs.get(copy.from);
+      if (!sourceStage) {
+        throw new Error(
+          `COPY --from=${copy.from} references an external image, current stage, later stage, or unknown stage. Cloud Dockerfile builds support --from only for previous stages in the same Dockerfile.`
+        );
+      }
+      if (copy.sources.some(hasGlob)) {
+        throw new Error(
+          `COPY --from=${copy.from} uses glob sources (${copy.sources.join(", ")}), which are not supported in cloud Dockerfile stage artifact copies yet.`
+        );
+      }
+      const downloadPaths = copy.sources.map(stageArtifactDownloadPath);
+      const sourceLabel = downloadPaths.join(" ");
+      logger.log(`[Dockerfile] COPY artifacts from stage "${copy.from}": ${sourceLabel}
+`);
+      copyFromStage = true;
+      sourceBase = "";
+      sourcePaths = downloadPaths;
+    }
+    const destination = resolveVmPath(copy.workdir, copy.destination);
+    const destinationIsDir = copy.sources.length > 1 || copy.destination.endsWith("/") || copy.destination === "." || copy.destination.endsWith("/.");
+    const destinationTarget = destinationIsDir ? destination : posix.dirname(destination);
+    const sourceExprs = copyFromStage ? sourcePaths.map((source) => sq(source)) : sourcePaths.map((source) => sourceExpression(sourceBase, source));
+    if (copyFromStage) {
+      const samePathCopies = sourcePaths.map((source) => ({
+        source: posix.normalize(source),
+        target: posix.normalize(
+          resolveCopyDestinationPath(copy, source, destination, destinationIsDir)
+        )
+      }));
+      if (samePathCopies.every(({ source, target }) => source === target)) {
+        const verifyCommand = samePathCopies.map(({ source }) => `test -e ${sq(source)}`).join(" && ");
+        await this.execAndStream(runtime, ["sh", "-c", verifyCommand], logger.callback);
+        logger.log("[Dockerfile] COPY artifacts already available in current workspace.\n");
+        return;
+      }
+    }
+    const command = [
+      "set -e",
+      `mkdir -p ${sq(destinationTarget)}`,
+      ...dockerCopyShellCommands({
+        sources: sourceExprs,
+        destination,
+        destinationIsDir,
+        destinationTarget
+      })
+    ].join("\n");
+    logger.log(
+      `[Dockerfile] ${copy.kind.toUpperCase()} ${copy.sources.join(" ")} ${copy.destination}
+`
+    );
+    await this.execAndStream(runtime, ["sh", "-c", command], logger.callback);
+  }
+  /**
+   * Provision a temporary cloud workspace for a build.
+   *
+   * This is the cloud-specific "prepare" phase:
+   *   1. Create workspace (image + resources + env vars)
+   *   2. Set TTL for auto-cleanup
+   *   3. Acquire runtime token (enable API server + get JWT)
+   *
+   * Output streams to the terminal via logger so the user sees
+   * progress before the numbered build steps begin.
+   */
+  async provisionWorkspace(config, logger) {
+    return provisionCloudWorkspace(this.client, config, logger);
+  }
+  /**
+   * Folder-upload flow: attach to a workspace the browser already uploaded its
+   * source into and acquire its runtime handle. Mirrors the connect-with-retry
+   * in `provisionBuildWorkspace`, but creates nothing — the workspace already
+   * exists (provisioned when the upload session was opened).
+   */
+  async adoptWorkspaceRuntime(workspaceId) {
+    const ws = this.ws(workspaceId);
+    let rt;
+    for (let attempt = 0; attempt < 3; attempt++) {
+      try {
+        rt = await ws.runtime();
+        break;
+      } catch (err) {
+        if (attempt < 2) await new Promise((r) => setTimeout(r, 2e3));
+        else throw err;
+      }
+    }
+    if (!rt) throw new Error("Failed to connect to uploaded workspace");
+    return rt;
+  }
+  async provisionBuildWorkspace(config, logger) {
+    logger.log("Provisioning build environment...\n");
+    const envArray = Object.entries(config.envVars).map(([k, v]) => `${k}=${v}`);
+    logger.log(`Creating build workspace from image "${config.buildImage}"...
+`);
+    let wsData;
+    try {
+      wsData = await this.client.workspaces.create({
+        name: config.slug ?? `build-${config.projectId.slice(0, 20)}`,
+        image: config.buildImage,
+        mode: "temporary",
+        config: {
+          cpus: cloudCpus(config.resources.cpuCores),
+          memory_mb: config.resources.memoryMb,
+          disk_size_mb: config.resources.diskMb,
+          env: envArray
+        }
+      });
+    } catch (err) {
+      const message = formatCloudError(err);
+      logger.log(
+        `Failed to create build workspace from image "${config.buildImage}": ${message}
+`,
+        "error"
+      );
+      throw err;
+    }
+    const ws = this.ws(wsData.id);
+    try {
+      try {
+        await ws.lifecycle.makeTemporary({
+          ttl: "15m",
+          ttl_action: "remove",
+          remove_on_exit: true
+        });
+      } catch {
+      }
+      logger.log("Connecting to build environment...\n");
+      let rt;
+      for (let attempt = 0; attempt < 3; attempt++) {
+        try {
+          rt = await ws.runtime();
+          break;
+        } catch (err) {
+          if (attempt < 2) {
+            await new Promise((r) => setTimeout(r, 2e3));
+          } else {
+            throw err;
+          }
+        }
+      }
+      if (!rt) throw new Error("Failed to connect to build environment");
+      logger.log("Build environment ready\n");
+      return { workspaceId: wsData.id, runtime: rt };
+    } catch (err) {
+      await ws.delete().catch(() => {
+      });
+      const message = formatCloudError(err);
+      logger.log(`Failed to prepare build workspace "${wsData.id}": ${message}
+`, "error");
+      throw err;
+    }
+  }
+  async cancelBuild(sessionId) {
+    const activeBuild = this.activeBuilds.get(sessionId);
+    if (!activeBuild) {
+      return;
+    }
+    activeBuild.abort.abort();
+    const workspaceIds = [...activeBuild.workspaceIds];
+    await Promise.allSettled(
+      workspaceIds.map(async (workspaceId) => {
+        await this.destroy(workspaceId).catch(() => {
+        });
+        activeBuild.workspaceIds.delete(workspaceId);
+      })
+    );
+  }
+  async getBuildLogs(sessionId) {
+    void sessionId;
+    return [];
+  }
+  // ── Deploy lifecycle ───────────────────────────────────────────────────
+  async deploy(config, onLog) {
+    const workspaceId = config.imageRef;
+    if (!workspaceId) {
+      return {
+        deploymentId: config.deploymentId,
+        status: "failed"
+      };
+    }
+    const ws = this.ws(workspaceId);
+    const log = onLog ?? (() => {
+    });
+    try {
+      await ws.lifecycle.makePermanent();
+    } catch (err) {
+      throw new Error(
+        `Failed to make workspace permanent: ${err instanceof Error ? err.message : err}`
+      );
+    }
+    const prodResources = config.resources ?? DEFAULT_RESOURCE_CONFIG;
+    let resized = false;
+    for (let attempt = 1; attempt <= 3 && !resized; attempt++) {
+      try {
+        await ws.resources.update({
+          cpus: cloudCpus(prodResources.cpuCores),
+          memory_mb: prodResources.memoryMb,
+          apply: true
+        });
+        resized = true;
+        log({
+          timestamp: now2(),
+          level: "info",
+          message: `Resized workspace to ${prodResources.cpuCores} vCPU \xB7 ${prodResources.memoryMb} MB.
+`
+        });
+      } catch (err) {
+        if (attempt === 3) {
+          throw new Error(
+            `Failed to shrink workspace from the build tier to ${prodResources.cpuCores} vCPU \xB7 ${prodResources.memoryMb} MB after 3 attempts \u2014 refusing to promote a build-sized workspace: ${safeErrorMessage(err)}`
+          );
+        }
+        log({
+          timestamp: now2(),
+          level: "warn",
+          message: `Resize attempt ${attempt} failed, retrying\u2026 ${safeErrorMessage(err)}
+`
+        });
+        await new Promise((r) => setTimeout(r, 1e3 * attempt));
+      }
+    }
+    const builtArtifact = this.builtArtifacts.get(workspaceId);
+    const prodPaths = config.productionPaths;
+    const workDir = builtArtifact?.runtime.workdir ?? (prodPaths?.length ? "/app/production" : "/app");
+    if (prodPaths?.length) {
+      try {
+        const rt = await ws.runtime();
+        const logCb = onLog ?? (() => {
+        });
+        const safePaths = prodPaths.filter((p) => {
+          const normalized = p.replace(/\/+/g, "/").replace(/^\/|\/$/g, "");
+          return normalized.length > 0 && normalized !== ".." && !normalized.startsWith("../") && !normalized.includes("/../") && !normalized.includes("\\");
+        });
+        if (safePaths.length === 0) {
+          throw new Error("No valid production paths after sanitization");
+        }
+        const sq2 = (s) => s.replace(/'/g, "'\\''");
+        const moveLines = safePaths.map((p) => {
+          const e = sq2(p);
+          return `if [ -e '/app/${e}' ]; then
+  d=$(dirname '${e}')
+  mkdir -p "/app/.staging/$d"
+  mv '/app/${e}' '/app/.staging/${e}'
+  echo '  moved /app/${e}'
+else
+  echo '  skip /app/${e} (not found)'
+fi`;
+        }).join("\n");
+        const script = `set -e
+cleanup() { echo "Cleaning up staging dir"; rm -rf /app/.staging; }
+echo "Preparing production directory..."
+rm -rf /app/.staging
+mkdir -p /app/.staging
+${moveLines}
+if [ "$(ls -A /app/.staging)" ]; then
+  rm -rf /app/production
+  mv /app/.staging /app/production
+  echo "Production directory ready"
+else
+  cleanup
+  echo "ERROR: no files were moved - check production paths"
+  exit 1
+fi`;
+        await this.execAndStream(rt, ["sh", "-c", script], logCb);
+      } catch (err) {
+        throw new Error(
+          `Failed to prepare production directory: ${err instanceof Error ? err.message : err}`
+        );
+      }
+    }
+    const startCommand = builtArtifact?.runtime.startCommand || config.startCommand || "npm start";
+    const envArray = toEnvArray2({
+      ...builtArtifact?.runtime.env ?? {},
+      ...config.envVars
+    });
+    const restartPolicy = config.restartPolicy === "no" ? "never" : config.restartPolicy ?? "always";
+    try {
+      await ws.workloads.create({
+        name: "app",
+        cmd: ["sh", "-c", `cd ${workDir} && ${startCommand}`],
+        working_dir: workDir,
+        env: [...envArray, `PORT=${config.port}`],
+        restart_policy: restartPolicy,
+        max_restarts: 10
+      });
+    } catch (err) {
+      throw new Error(`Failed to create workload: ${err instanceof Error ? err.message : err}`);
+    }
+    let url;
+    const primaryEndpoint = primaryPublicEndpoint(config);
+    const primarySlug = endpointSlug(primaryEndpoint);
+    const primaryCustomDomain = endpointCustomDomain(primaryEndpoint);
+    const primaryPort = primaryEndpoint?.port ?? config.port;
+    if (primaryCustomDomain) {
+      try {
+        await ws.network.update({ ingress_ports: [primaryPort] });
+        await this.connectCustomDomainReassigning(
+          workspaceId,
+          primaryCustomDomain,
+          primaryPort,
+          log
+        );
+        url = `https://${primaryCustomDomain}`;
+      } catch (err) {
+        throw new Error(
+          `Failed to connect custom domain ${primaryCustomDomain}: ${safeErrorMessage(err)}`
+        );
+      }
+    } else if (primarySlug) {
+      try {
+        log({
+          timestamp: now2(),
+          level: "info",
+          message: `Exposing ${exposeTarget2(primaryPort, primarySlug)}...
+`
+        });
+        const exposeResult = await ws.publicAccess.expose({
+          port: primaryPort,
+          domain: SYSTEM.DOMAINS.CLOUD_DOMAIN,
+          slug: primarySlug
+        });
+        url = exposeResult.url;
+      } catch (err) {
+        throw new Error(
+          `Failed to expose ${exposeTarget2(primaryPort, primarySlug)}: ${safeErrorMessage(err)}`
+        );
+      }
+    } else {
+      log({
+        timestamp: now2(),
+        level: "info",
+        message: "No public endpoint configured; skipping cloud public exposure.\n"
+      });
+    }
+    return {
+      deploymentId: config.deploymentId,
+      containerId: workspaceId,
+      url: url ?? void 0,
+      status: "running"
+    };
+  }
+  /**
+   * Deploy a static site via Oblien Pages.
+   *
+   * Flow:
+   *   1. Create a page from the workspace build output → files copied to edge
+   *   2. Page goes live immediately on CDN
+   *   3. Delete the workspace - page is independent, no VM needed
+   *
+   * The "containerId" in the result is the page ID (for future updates/teardown).
+   */
+  async deployStatic(config) {
+    const workspaceId = config.imageRef;
+    if (!workspaceId) {
+      return { deploymentId: config.deploymentId, status: "failed" };
+    }
+    const primaryEndpoint = primaryPublicEndpoint(config);
+    const primarySlug = endpointSlug(primaryEndpoint);
+    const primaryCustomDomain = endpointCustomDomain(primaryEndpoint);
+    const pageSlug = primarySlug ?? fallbackRuntimeName(config);
+    const wantFree = !primaryCustomDomain && !!primarySlug;
+    const outputDirError = () => new Error(missingOutputDirectoryMessage(config.outputDirectory, pageSlug));
+    const isOutputPathError = (err) => {
+      const msg = safeErrorMessage(err).toLowerCase();
+      return msg.includes("path is required") || msg.includes("folder inside vm") || msg.includes("no such") || msg.includes("not found") || msg.includes("does not exist");
+    };
+    const trimmedOutput = config.outputDirectory?.trim();
+    if (!trimmedOutput || trimmedOutput === "/") {
+      throw outputDirError();
+    }
+    const outputPath = resolveStaticOutputPath("/app", config.outputDirectory);
+    console.log(
+      `Deploying static site from workspace ${workspaceId}, output path ${outputPath}...`
+    );
+    const createFresh = async () => {
+      if (primaryCustomDomain) {
+        let pg2;
+        try {
+          const result = await this.client.pages.create({
+            workspace_id: workspaceId,
+            path: outputPath,
+            name: config.projectName ?? pageSlug,
+            slug: pageSlug
+          });
+          pg2 = result.page;
+        } catch (err) {
+          if (isOutputPathError(err)) throw outputDirError();
+          throw new Error(
+            `Failed to create static page for slug "${pageSlug}" with custom domain "${primaryCustomDomain}": ${safeErrorMessage(err)}`
+          );
+        }
+        await this.client.pages.connectDomain(pg2.slug, { domain: primaryCustomDomain }).catch(() => {
+        });
+        return { ...pg2, url: pg2.url ?? `https://${primaryCustomDomain}` };
+      }
+      if (wantFree) {
+        const createOnSharedZone = this.adminProxy?.createPage ?? ((input) => this.client.pages.create(input));
+        try {
+          const result = await createOnSharedZone({
+            workspace_id: workspaceId,
+            path: outputPath,
+            name: config.projectName ?? pageSlug,
+            slug: pageSlug,
+            domain: SYSTEM.DOMAINS.CLOUD_DOMAIN
+          });
+          return result.page;
+        } catch (err) {
+          if (isOutputPathError(err)) throw outputDirError();
+          throw new Error(
+            `Failed to create static page for slug "${pageSlug}" (${pageSlug}.opsh.io): ${safeErrorMessage(err)}`
+          );
+        }
+      }
+      let pg;
+      try {
+        const result = await this.client.pages.create({
+          workspace_id: workspaceId,
+          path: outputPath,
+          name: config.projectName ?? pageSlug,
+          slug: pageSlug
+        });
+        pg = result.page;
+      } catch (err) {
+        if (isOutputPathError(err)) throw outputDirError();
+        throw new Error(`Failed to create static page for slug "${pageSlug}": ${safeErrorMessage(err)}`);
+      }
+      return { ...pg, url: void 0 };
+    };
+    let page;
+    const existingPage = (await this.client.pages.get(pageSlug).catch(() => null))?.page ?? null;
+    const bindingMatches = !!existingPage && (primaryCustomDomain ? existingPage.custom_domain === primaryCustomDomain : wantFree ? existingPage.domain === SYSTEM.DOMAINS.CLOUD_DOMAIN : true);
+    if (existingPage && bindingMatches) {
+      try {
+        const result = await this.client.pages.deploy(pageSlug, {
+          workspace_id: workspaceId,
+          path: outputPath
+        });
+        page = result.page;
+      } catch (err) {
+        throw new Error(`Failed to redeploy static page for slug "${pageSlug}": ${safeErrorMessage(err)}`);
+      }
+    } else {
+      if (existingPage) {
+        await this.client.pages.delete(pageSlug).catch(() => {
+        });
+      }
+      page = await createFresh();
+    }
+    await this.ws(workspaceId).delete().catch(() => {
+    });
+    return {
+      deploymentId: config.deploymentId,
+      containerId: `${PAGE_CONTAINER_PREFIX}${page.slug}`,
+      url: page.url ?? void 0,
+      status: "running"
+    };
+  }
+  async stop(containerId) {
+    if (containerId.startsWith(PAGE_CONTAINER_PREFIX)) {
+      const slug = containerId.slice(5);
+      if (this.adminProxy?.disablePage) {
+        await this.adminProxy.disablePage(slug);
+      } else {
+        await this.client.pages.disable(slug);
+      }
+    } else {
+      await this.ws(containerId).stop();
+    }
+  }
+  async start(containerId) {
+    if (containerId.startsWith(PAGE_CONTAINER_PREFIX)) {
+      const slug = containerId.slice(5);
+      if (this.adminProxy?.enablePage) {
+        await this.adminProxy.enablePage(slug);
+      } else {
+        await this.client.pages.enable(slug);
+      }
+    } else {
+      await this.ws(containerId).start();
+    }
+  }
+  async restart(containerId) {
+    if (containerId.startsWith(PAGE_CONTAINER_PREFIX)) {
+      return;
+    }
+    await this.ws(containerId).restart();
+  }
+  async destroy(containerId) {
+    try {
+      if (containerId.startsWith(PAGE_CONTAINER_PREFIX)) {
+        const slug = containerId.slice(5);
+        if (this.adminProxy?.deletePage) {
+          await this.adminProxy.deletePage(slug);
+        } else {
+          await this.client.pages.delete(slug);
+        }
+      } else {
+        await this.ws(containerId).delete();
+        this.builtArtifacts.delete(containerId);
+      }
+    } catch (err) {
+      if (isRuntimeNotFoundError(err)) {
+        this.builtArtifacts.delete(containerId);
+        return;
+      }
+      throw err;
+    }
+  }
+  // ── Rollback primitives ──────────────────────────────────────────────
+  //
+  // Cloud semantics — internal to Oblien, no external object store:
+  //
+  //   archive    — `snapshots.createArchive` captures the workspace disk
+  //                as a point-in-time Oblien archive (file + metadata
+  //                stored next to the workspace), then `ws.stop` powers
+  //                down compute. Compute billing pauses; the workspace
+  //                slot + archive remain claimed.
+  //   makeActive — stops the outgoing workspace, starts the target.
+  //                Workspace IDs are stable across stop/start, so no new
+  //                containerId is minted.
+  //   purge      — deletes every archive of the workspace (with their
+  //                files) then deletes the workspace itself. Past this
+  //                point rollback is impossible.
+  //
+  // Why archive PLUS stop, not archive INSTEAD OF the running workspace:
+  // Oblien's archives are workspace-scoped (`/workspace/{id}/archives`).
+  // Deleting the workspace orphans the archive — there's no
+  // `workspaces.create({ from_archive })` to bring it back. So keeping
+  // the workspace alive in stopped state is what makes rollback work,
+  // and the explicit `createArchive` call gives us a defense-in-depth
+  // snapshot we can restore over the same workspace if its disk drifts.
+  //
+  // Pages (static deployments, containerId starts with "page:") archive
+  // via `pages.disable` and purge via `pages.delete`. No tar.gz involved.
+  //
+  // All three primitives are idempotent.
+  async makeActive(input) {
+    if (input.from?.containerId) {
+      try {
+        await this.stop(input.from.containerId);
+      } catch {
+      }
+    }
+    if (!input.to.containerId) {
+      throw new Error(
+        `Cannot make deployment ${input.to.id} active: workspace is gone. Artifact has been purged.`
+      );
+    }
+    await this.start(input.to.containerId);
+    return { containerId: input.to.containerId };
+  }
+  async archive(deployment) {
+    if (deployment.containerId?.startsWith(PAGE_CONTAINER_PREFIX)) {
+      const slug = deployment.containerId.slice(5);
+      try {
+        if (this.adminProxy?.disablePage) {
+          await this.adminProxy.disablePage(slug);
+        } else {
+          await this.client.pages.disable(slug);
+        }
+      } catch {
+      }
+      return;
+    }
+    if (!deployment.containerId) return;
+    const ws = this.ws(deployment.containerId);
+    try {
+      await ws.snapshots.createArchive({});
+    } catch (err) {
+      console.warn(
+        `[CloudRuntime.archive] snapshots.createArchive failed for ${deployment.id}:`,
+        err instanceof Error ? err.message : err
+      );
+    }
+    try {
+      await this.stop(deployment.containerId);
+    } catch {
+    }
+  }
+  async purge(deployment) {
+    if (deployment.containerId?.startsWith(PAGE_CONTAINER_PREFIX)) {
+      const slug = deployment.containerId.slice(5);
+      try {
+        if (this.adminProxy?.deletePage) {
+          await this.adminProxy.deletePage(slug);
+        } else {
+          await this.client.pages.delete(slug);
+        }
+      } catch {
+      }
+      return;
+    }
+    if (!deployment.containerId) return;
+    try {
+      await this.ws(deployment.containerId).snapshots.deleteAllArchives({
+        delete_files: true
+      });
+    } catch (err) {
+      console.warn(
+        `[CloudRuntime.purge] deleteAllArchives failed for ${deployment.id}:`,
+        err instanceof Error ? err.message : err
+      );
+    }
+    try {
+      await this.destroy(deployment.containerId);
+    } catch {
+    }
+  }
+  // ── Observability ──────────────────────────────────────────────────────
+  async getContainerInfo(containerId) {
+    const ws = this.ws(containerId);
+    let data;
+    try {
+      data = await ws.get();
+    } catch (err) {
+      if (isRuntimeNotFoundError(err)) {
+        return { containerId, status: "missing" };
+      }
+      throw err;
+    }
+    const statusMap = {
+      running: "running",
+      stopped: "stopped",
+      starting: "deploying",
+      stopping: "stopped",
+      creating: "building",
+      error: "failed"
+    };
+    let status = statusMap[data.status] ?? "stopped";
+    if (status === "running") {
+      try {
+        const workloads = await ws.workloads.list();
+        if (workloads && workloads.length > 0) {
+          const states = workloads.map(
+            (w) => String(
+              w.status ?? w.states ?? ""
+            ).toLowerCase()
+          );
+          if (states.some((s) => s.includes("run"))) status = "running";
+          else if (states.some((s) => /(fail|exit|error|crash|dead)/.test(s))) status = "failed";
+          else status = "deploying";
+        }
+      } catch {
+      }
+    }
+    let ip = data.ip;
+    try {
+      const raw = await ws.apiAccess.rawToken();
+      if (raw?.ip) ip = raw.ip;
+    } catch {
+    }
+    return { containerId, status, ip };
+  }
+  async getRuntimeLogs(containerId, tail) {
+    try {
+      const result = await this.ws(containerId).workloads.logs("app");
+      const raw = result;
+      if (typeof raw.logs === "string") {
+        const logStr = raw.logs;
+        return applyTail(
+          logStr.split("\n").filter(Boolean).map((line) => {
+            const match = line.match(/^\[([^\]]+)\]\s+(stdout|stderr):\s?(.*)/);
+            if (match) {
+              return {
+                timestamp: match[1],
+                message: match[3],
+                level: match[2] === "stderr" ? "warn" : "info"
+              };
+            }
+            return { timestamp: now2(), message: line, level: "info" };
+          }),
+          tail
+        );
+      }
+      const lines = Array.isArray(raw.logs) ? raw.logs : Array.isArray(raw.entries) ? raw.entries : Array.isArray(result) ? result : [];
+      if (lines.length === 0) return [];
+      return applyTail(
+        lines.map((line) => {
+          if (typeof line === "string") {
+            return { timestamp: now2(), message: line, level: "info" };
+          }
+          const entry = line;
+          const message = entry.message ?? entry.data ?? String(line);
+          return {
+            timestamp: entry.timestamp ?? now2(),
+            message,
+            level: entry.stream === "stderr" ? "warn" : "info"
+          };
+        }).filter((e) => e.message),
+        tail
+      );
+    } catch {
+      const result = await this.ws(containerId).logs.get({
+        source: "cmd",
+        tail_lines: tail ?? 100
+      });
+      const lines = result.logs;
+      if (!Array.isArray(lines)) return [];
+      return applyTail(
+        lines.map((line) => {
+          if (typeof line === "string") {
+            return { timestamp: now2(), message: line, level: "info" };
+          }
+          const entry = line;
+          return {
+            timestamp: entry.timestamp ?? now2(),
+            message: entry.message ?? String(line),
+            level: "info"
+          };
+        }),
+        tail
+      );
+    }
+  }
+  async streamRuntimeLogs(containerId, onLog, opts) {
+    let cancelled = false;
+    const emitText = (text, level, timestamp) => {
+      if (!text) return;
+      const rawData = Buffer.from(text).toString("base64");
+      onLog({ timestamp: timestamp ?? now2(), message: text, level, rawData });
+    };
+    const run = async () => {
+      try {
+        const replayTail = opts?.tail ?? 100;
+        if (replayTail > 0) {
+          try {
+            const history = await this.getRuntimeLogs(containerId, replayTail);
+            for (const entry of history) {
+              if (cancelled) return;
+              if (!entry.message) continue;
+              const rawData = entry.rawData ?? Buffer.from(entry.message).toString("base64");
+              onLog({ ...entry, rawData });
+            }
+          } catch {
+          }
+        }
+        if (cancelled) return;
+        try {
+          const stream = this.ws(containerId).workloads.logsStream("app");
+          for await (const event of stream) {
+            if (cancelled) break;
+            const ev = event;
+            const text = ev.message ?? event.data ?? "";
+            emitText(text, event.stream === "stderr" ? "warn" : "info", event.timestamp);
+          }
+        } catch {
+          if (cancelled) return;
+          try {
+            const stream = this.ws(containerId).logs.streamCmd({
+              tail_lines: opts?.tail ?? 100
+            });
+            for await (const event of stream) {
+              if (cancelled) break;
+              emitText(event.message, "info", event.timestamp);
+            }
+          } catch {
+          }
+        }
+      } catch {
+      }
+    };
+    void run();
+    return () => {
+      cancelled = true;
+    };
+  }
+  async getUsage(containerId) {
+    const result = await this.ws(containerId).metrics.stats();
+    const stats = result;
+    return {
+      cpuPercent: stats.cpu_usage ?? 0,
+      memoryMb: stats.memory_usage ?? 0,
+      diskMb: stats.disk_usage ?? 0,
+      networkRxBytes: stats.network?.rx ?? 0,
+      networkTxBytes: stats.network?.tx ?? 0
+    };
+  }
+  // ── Network ────────────────────────────────────────────────────────────
+  async getContainerIp(containerId) {
+    const data = await this.ws(containerId).get();
+    return data.ip ?? null;
+  }
+  /**
+   * Open an interactive PTY shell inside an Oblien workspace. Powers
+   * the in-dashboard service terminal — see apps/api/src/modules/service-terminal/.
+   *
+   * Two-step Oblien API:
+   *   1. `rt.terminal.create({shell, cols, rows})` → registers a
+   *      terminal session in the workspace and returns its numeric id.
+   *   2. `rt.ws()` → opens a multiplexed WebSocket carrying binary
+   *      stdin/stdout (prefixed with the terminal id byte) plus JSON
+   *      control frames (resize, exit).
+   *
+   * We bridge that WS into the same ShellSession contract as
+   * SshExecutor and DockerRuntime so the upstream WS bridge in
+   * service-terminal.controller.ts is identical across runtimes.
+   *
+   * Note on workspace id: for the cloud runtime, `containerId` IS the
+   * workspace id (see how cloud.ts already passes containerId into
+   * `this.ws(containerId)` throughout this file).
+   */
+  async openServiceShell(containerId, opts) {
+    const cols = clampShellWindow(opts?.cols, 80, 1, 1e3);
+    const rows = clampShellWindow(opts?.rows, 24, 1, 500);
+    const shellPath = "/bin/sh";
+    const ws = this.ws(containerId);
+    const rt = await ws.runtime();
+    const session = await rt.terminal.create({
+      shell: shellPath,
+      cols,
+      rows
+    });
+    const terminalId = String(session.id);
+    const wsConn = rt.ws({ reconnect: false });
+    const stdout = new PassThrough();
+    const stderr = new PassThrough();
+    const closeListeners = [];
+    let closed = false;
+    const fireClose = (code, signal) => {
+      if (closed) return;
+      closed = true;
+      try {
+        wsConn.close();
+      } catch {
+      }
+      stdout.end();
+      stderr.end();
+      for (const cb of closeListeners) {
+        try {
+          cb(code, signal);
+        } catch {
+        }
+      }
+    };
+    wsConn.onTerminalOutput((id, data) => {
+      if (id === terminalId) stdout.write(Buffer.from(data));
+    });
+    wsConn.onTerminalExit((id, code) => {
+      if (id === terminalId) fireClose(code ?? null);
+    });
+    wsConn.onClose(() => fireClose(null));
+    wsConn.onError(() => fireClose(null));
+    wsConn.connect();
+    const stdin = new Writable({
+      write: (chunk, _enc, cb) => {
+        try {
+          wsConn.writeTerminalInput(
+            terminalId,
+            chunk instanceof Buffer ? new Uint8Array(chunk) : chunk
+          );
+          cb();
+        } catch (err) {
+          cb(err);
+        }
+      },
+      final(cb) {
+        try {
+          wsConn.close();
+        } catch {
+        }
+        cb();
+      }
+    });
+    return {
+      stdin,
+      stdout,
+      stderr,
+      setWindow: (c, r) => {
+        const sc = clampShellWindow(c, 80, 1, 1e3);
+        const sr = clampShellWindow(r, 24, 1, 500);
+        try {
+          wsConn.resizeTerminal(terminalId, sc, sr);
+        } catch {
+        }
+      },
+      close: () => {
+        rt.terminal.close(terminalId).catch(() => void 0).finally(() => fireClose(null));
+      },
+      onClose: (cb) => {
+        closeListeners.push(cb);
+      }
+    };
+  }
+  // ── Compose / multi-service ────────────────────────────────────────────
+  async ensureServiceGroup(config) {
+    return this.compose.ensureServiceGroup(config);
+  }
+  async deployServiceWorkload(group, config, onLog) {
+    return this.compose.deployServiceWorkload(group, config, onLog);
+  }
+  async finalizeServiceGroup(group, onLog) {
+    return this.compose.finalizeGroup(group.id, onLog);
+  }
+  registerExistingWorkload(group, service) {
+    this.compose.registerExistingWorkload(group, service);
+  }
+  // ── Account ────────────────────────────────────────────────────────────
+  /** Check cloud credentials and account status. Throws on failure. */
+  async getQuota() {
+    return this.client.workspaces.getQuota();
+  }
+  // ── Domain / Slug checks ───────────────────────────────────────────────
+  /**
+   * Check whether a subdomain slug is available on opsh.io.
+   * Uses Oblien's standalone `domain.checkSlug()` - no workspace needed.
+   */
+  async checkSlug(slug, domain = SYSTEM.DOMAINS.CLOUD_DOMAIN) {
+    const result = await this.client.domain.checkSlug({ slug, domain });
+    return { available: result.available, url: result.url };
+  }
+  /**
+   * Verify DNS records for a custom domain.
+   * Uses Oblien's standalone `domain.verify()` - no workspace needed.
+   */
+  async verifyDomain(domain, resourceId) {
+    const result = await this.client.domain.verify({ domain, resource_id: resourceId });
+    return {
+      verified: result.verified,
+      cname: result.cname,
+      ownership: result.ownership,
+      errors: result.errors,
+      requiredRecords: {
+        cname: result.required_records.cname,
+        txt: result.required_records.txt
+      }
+    };
+  }
+  // ── Edge routing ───────────────────────────────────────────────────────
+  /**
+   * Atomically set a hostname's edge routing table — the CLOUD counterpart to
+   * the self-hosted OpenResty route registration. Compile a project's
+   * `RoutingConfig` with `compileRoutingToOblien` (static Page at `/`, backend
+   * workspace proxied at `/api/*`, redirects/headers), then hand the result
+   * here. Versioned + applied with no redeploy, so it also backs live edits
+   * from the Routing/Domains tab.
+   */
+  async setDomainRoutes(hostname, input) {
+    return this.client.routes.set(hostname, input);
+  }
+  // ── Private helpers ────────────────────────────────────────────────────
+  /** Command runner INSIDE the workspace named by `containerId` (the stored
+   *  workspace id) — reuses the same runtime-token path as `openServiceShell`.
+   *  Powers the advisory post-deploy port probe. */
+  async inContainerExecutor(containerId) {
+    const rt = await this.ws(containerId).runtime();
+    return this.workspaceExecutor(rt);
+  }
+  workspaceExecutor(rt) {
+    const run = async (command, onLog, timeoutMs) => {
+      let output = "";
+      const collect = (entry) => {
+        output += entry.message;
+        onLog?.(entry);
+      };
+      try {
+        await this.execAndStream(
+          rt,
+          ["sh", "-c", command],
+          collect,
+          timeoutMs ? Math.ceil(timeoutMs / 1e3) : void 0
+        );
+        return { code: 0, output };
+      } catch (err) {
+        const message = safeErrorMessage(err);
+        return { code: 1, output: output || message };
+      }
+    };
+    return {
+      exec: async (command, opts) => {
+        const result = await run(command, void 0, opts?.timeout);
+        if (result.code !== 0) {
+          throw new Error(result.output);
+        }
+        return result.output;
+      },
+      streamExec: async (command, onLog) => run(command, onLog, WORKSPACE_STREAM_EXEC_TIMEOUT_MS),
+      writeFile: async () => {
+        throw new Error("Workspace file writes are not supported by this executor");
+      },
+      readFile: async () => {
+        throw new Error("Workspace file reads are not supported by this executor");
+      },
+      exists: async () => {
+        throw new Error("Workspace file checks are not supported by this executor");
+      },
+      mkdir: async () => {
+        throw new Error("Workspace mkdir is not supported by this executor");
+      },
+      rm: async () => {
+        throw new Error("Workspace rm is not supported by this executor");
+      },
+      transferIn: async () => {
+        throw new Error("Workspace transferIn is not supported by this executor");
+      },
+      dispose: async () => {
+      }
+    };
+  }
+  async ensureWorkspaceGit(rt, logger, label = "workspace") {
+    const executor = this.workspaceExecutor(rt);
+    const git = await checkGit(executor);
+    if (git.healthy) {
+      logger.log(`Git ready in ${label}.
+`);
+      return;
+    }
+    const result = await installGit(executor, logger.callback, { label });
+    if (!result.success) {
+      const rechecked = await checkGit(executor);
+      if (rechecked.healthy) {
+        logger.log(`Git ready in ${label}.
+`);
+        return;
+      }
+      throw new Error(result.error ?? rechecked.message ?? "Git installation failed");
+    }
+  }
+  /**
+   * Execute a command via the runtime exec API and stream output to the log callback.
+   * Oblien returns stdout/stderr as native base64 - we pass it through directly
+   * via rawData so session-manager forwards it to the frontend without re-encoding.
+   * message is set to decoded text for DB storage / display.
+   * Throws on non-zero exit code.
+   */
+  async execAndStream(rt, cmd, onLog, timeoutSeconds) {
+    const params = timeoutSeconds ? { timeoutSeconds } : void 0;
+    const stream = rt.exec.stream(cmd, params);
+    const recentOutput = [];
+    const MAX_OUTPUT_LINES = 50;
+    const emit = (b64, level) => {
+      const message = Buffer.from(b64, "base64").toString("utf-8");
+      onLog({ timestamp: now2(), message, level, rawData: b64 });
+      recentOutput.push(message);
+      if (recentOutput.length > MAX_OUTPUT_LINES) recentOutput.shift();
+    };
+    let exitCode;
+    for await (const event of stream) {
+      switch (event.event) {
+        case "stdout":
+          emit(event.data, "info");
+          break;
+        case "stderr":
+          emit(event.data, "warn");
+          break;
+        case "exit":
+          exitCode = event.exit_code;
+          break;
+        case "output":
+          if (event.stdout) emit(event.stdout, "info");
+          if (event.stderr) emit(event.stderr, "warn");
+          break;
+      }
+    }
+    if (exitCode !== void 0 && exitCode !== 0) {
+      const output = recentOutput.join("").trim();
+      const summary = summarizeCommandOutput(output);
+      const detail = summary ? `: ${summary}` : "";
+      throw new Error(`Command failed with exit code ${exitCode}${detail}`);
+    }
+  }
+};
+function clampShellWindow(value, fallback, min, max) {
+  const n = Number.isFinite(value) ? Number(value) : fallback;
+  if (n < min) return min;
+  if (n > max) return max;
+  return Math.floor(n);
+}
+
+export {
+  PAGE_CONTAINER_PREFIX,
+  provisionCloudWorkspace,
+  CloudRuntime
+};