openship 0.3.0 → 0.4.0

package/dist/chunk-ZKJOFWBJ.js

@@ -0,0 +1,1879 @@
+import {
+  prepareStackOutput,
+  resolveProjectDir,
+  resolveStaticOutputPath,
+  runLocalBuild
+} from "./chunk-NB2VEIWG.js";
+import {
+  probeListeningPort,
+  resolveEnvironment
+} from "./chunk-3U4SPZD5.js";
+import {
+  BuildCancelledError,
+  BuildLogger,
+  detectBuildKillHint,
+  parseLogLevel,
+  runBuildPipeline,
+  sq,
+  transferLocalDirectory
+} from "./chunk-YL67EWYZ.js";
+import {
+  LocalExecutor
+} from "./chunk-U2DPZSXA.js";
+import {
+  formatDuration,
+  isRemoteConnectionError,
+  isRetryableRemoteConnectionError,
+  systemDebug
+} from "./chunk-4LEL3H2Z.js";
+import {
+  sq as sq2,
+  wrapLocalBuildCommand
+} from "./chunk-4CQWT2WL.js";
+import {
+  DeployError,
+  LANGUAGES,
+  STACKS,
+  buildOutputTransferExcludes,
+  missingOutputDirectoryMessage,
+  packageManagerEnsureCommand,
+  safeErrorMessage
+} from "./chunk-JZLNHGLW.js";
+
+// ../../packages/adapters/src/system/remote-journal.ts
+var OPSH_RUN_VERSION = 1;
+var DEFAULT_JOURNAL_BASE = "/root/.openship";
+var REMOTE_ENV_PREFIX = "export DEBIAN_FRONTEND=noninteractive DPKG_FORCE=confnew && ";
+var OPSH_RUN_SCRIPT = `#!/bin/sh
+# opsh-run \u2014 openship reliable command journal. Managed file; do not edit.
+VERSION=${OPSH_RUN_VERSION}
+
+BASE="$OPSH_BASE"
+[ -z "$BASE" ] && BASE=/root/.openship
+OPS="$BASE/ops"
+
+if [ "$1" = "--version" ]; then echo "$VERSION"; exit 0; fi
+
+if [ "$1" = "--gc" ]; then
+  TTLMIN=1440
+  [ -n "$2" ] && TTLMIN="$2"
+  [ -d "$OPS" ] || exit 0
+  for d in "$OPS"/*; do
+    [ -d "$d" ] || continue
+    if [ -f "$d/exit" ]; then
+      [ -n "$(find "$d/exit" -mmin +"$TTLMIN" 2>/dev/null)" ] && rm -rf "$d"
+    else
+      if [ -n "$(find "$d" -maxdepth 0 -mmin +1440 2>/dev/null)" ]; then
+        p="$(cat "$d/pid" 2>/dev/null)"
+        { [ -z "$p" ] || ! kill -0 "$p" 2>/dev/null; } && rm -rf "$d"
+      fi
+    fi
+  done
+  exit 0
+fi
+
+OPID="$1"
+CMDB64="$2"
+shift 2
+WAIT=25
+ENVPREFIX=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --wait) [ $# -ge 2 ] && WAIT="$2"; shift 2 2>/dev/null || shift ;;
+    --env-prefix) [ $# -ge 2 ] && ENVPREFIX="$(printf %s "$2" | openssl base64 -d -A 2>/dev/null)"; shift 2 2>/dev/null || shift ;;
+    *) shift ;;
+  esac
+done
+
+DIR="$OPS/$OPID"
+CMD="$(printf %s "$CMDB64" | openssl base64 -d -A 2>/dev/null)"
+[ -z "$CMD" ] && { echo "OPSH-EIO badcmd"; exit 0; }
+HASH="$(printf %s "$CMD" | openssl dgst -sha256 2>/dev/null | awk '{print $NF}')"
+
+if mkdir -p "$OPS" 2>/dev/null && mkdir "$DIR" 2>/dev/null; then
+  # Launcher: exactly one invocation per opId reaches here (mkdir is atomic).
+  if ! printf %s "$HASH" > "$DIR/cmdhash" 2>/dev/null; then
+    rm -rf "$DIR" 2>/dev/null; echo "OPSH-EIO nowrite"; exit 0
+  fi
+  printf %s "$CMD" > "$DIR/cmd" 2>/dev/null
+  # Subshell (not brace group) so a command that calls \`exit\` terminates only
+  # the subshell \u2014 the exit code is still captured and journaled.
+  RUN="( $ENVPREFIX $CMD ) > $DIR/stdout 2> $DIR/stderr; "'c=$?; echo $c'" > $DIR/exit.tmp && mv $DIR/exit.tmp $DIR/exit"
+  # nohup + </dev/null + & detaches from the SSH channel: a dropped connection
+  # (channel SIGHUP) can't kill the work. $! stays the running shell's pid.
+  nohup sh -c "$RUN" </dev/null >/dev/null 2>&1 &
+  echo $! > "$DIR/pid" 2>/dev/null
+else
+  # Attach/harvest. Guard against a reused opId carrying a different command.
+  [ -d "$DIR" ] || { echo "OPSH-EIO nodir"; exit 0; }
+  prev="$(cat "$DIR/cmdhash" 2>/dev/null)"
+  [ -n "$prev" ] && [ "$prev" != "$HASH" ] && { echo "OPSH-COLLISION"; exit 0; }
+fi
+
+# Wait up to WAIT seconds for the exit file (published atomically AFTER the
+# stdout/stderr fds close \u2192 a visible exit means output is final).
+i=0
+max=$((WAIT * 5))
+while [ ! -f "$DIR/exit" ]; do
+  p="$(cat "$DIR/pid" 2>/dev/null)"
+  if [ -n "$p" ] && ! kill -0 "$p" 2>/dev/null; then
+    [ -f "$DIR/exit" ] && break
+    echo "OPSH-DEAD"; exit 0
+  fi
+  i=$((i + 1))
+  if [ "$i" -ge "$max" ]; then echo "OPSH-RUNNING $p"; exit 0; fi
+  sleep 0.2
+done
+
+CODE="$(cat "$DIR/exit" 2>/dev/null)"
+[ -z "$CODE" ] && CODE=1
+OUT="$(openssl base64 -A < "$DIR/stdout" 2>/dev/null)"
+ERR="$(openssl base64 -A < "$DIR/stderr" 2>/dev/null)"
+echo "OPSH1 $CODE $OUT $ERR"
+exit 0
+`;
+async function ensureRemoteJournal(exec, baseDir) {
+  const runner = `${baseDir}/bin/opsh-run`;
+  let current = -1;
+  try {
+    const out = await exec.exec(
+      `OPSH_BASE=${sq2(baseDir)} sh ${sq2(runner)} --version 2>/dev/null`,
+      { timeout: 1e4 }
+    );
+    current = Number.parseInt(out.trim(), 10);
+  } catch {
+    current = -1;
+  }
+  if (current !== OPSH_RUN_VERSION) {
+    const tmp = `${runner}.tmp`;
+    await exec.writeFile(tmp, OPSH_RUN_SCRIPT);
+    await exec.exec(
+      `mkdir -p ${sq2(`${baseDir}/ops`)} && chmod 0700 ${sq2(tmp)} && mv -f ${sq2(tmp)} ${sq2(runner)}`
+    );
+  }
+  try {
+    await exec.exec(`OPSH_BASE=${sq2(baseDir)} sh ${sq2(runner)} --gc 2>/dev/null`, {
+      timeout: 15e3
+    });
+  } catch {
+  }
+}
+async function runJournaled(exec, opId, command, opts) {
+  const waitSecs = Math.max(1, Math.min(300, opts.waitSecs ?? 25));
+  const runner = `${opts.baseDir}/bin/opsh-run`;
+  const cmdB64 = Buffer.from(command, "utf8").toString("base64");
+  const envPrefix = opts.envPrefix ?? REMOTE_ENV_PREFIX;
+  const envB64 = Buffer.from(envPrefix, "utf8").toString("base64");
+  let invocation = `OPSH_BASE=${sq2(opts.baseDir)} sh ${sq2(runner)} ${sq2(opId)} ${cmdB64} --wait ${waitSecs}`;
+  if (envB64) invocation += ` --env-prefix ${envB64}`;
+  const raw = await exec.exec(invocation, { timeout: (waitSecs + 20) * 1e3 });
+  return parseFrame(raw);
+}
+function parseFrame(raw) {
+  const line = raw.trim().split("\n").map((l) => l.trim()).filter(Boolean).pop() ?? "";
+  if (line.startsWith("OPSH1 ")) {
+    const parts = line.split(" ");
+    const code = Number.parseInt(parts[1] ?? "", 10);
+    const decode = (b64) => b64 ? Buffer.from(b64, "base64").toString("utf8") : "";
+    return {
+      status: "done",
+      code: Number.isFinite(code) ? code : 1,
+      stdout: decode(parts[2]),
+      stderr: decode(parts[3])
+    };
+  }
+  if (line.startsWith("OPSH-RUNNING")) return { status: "running" };
+  if (line === "OPSH-DEAD") return { status: "dead" };
+  if (line === "OPSH-COLLISION") return { status: "collision" };
+  if (line.startsWith("OPSH-EIO")) {
+    return { status: "eio", message: line.slice("OPSH-EIO ".length).trim() || "journal I/O error" };
+  }
+  return { status: "eio", message: `unrecognized journal frame: ${line.slice(0, 160)}` };
+}
+var OpInterruptedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "OpInterruptedError";
+  }
+};
+var DEFAULT_RELIABLE_TIMEOUT_MS = 15 * 6e4;
+var DEFAULT_RECONNECT_MIN_MS = 1e3;
+var DEFAULT_RECONNECT_MAX_MS = 3e4;
+function sleep(ms) {
+  return new Promise((resolve) => {
+    const t = setTimeout(resolve, ms);
+    t.unref?.();
+  });
+}
+async function runReliable(acquire, opId, command, opts) {
+  const baseDir = opts.baseDir ?? DEFAULT_JOURNAL_BASE;
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_RELIABLE_TIMEOUT_MS;
+  const deadline = Date.now() + timeoutMs;
+  const minMs = opts.reconnectMinMs ?? DEFAULT_RECONNECT_MIN_MS;
+  const maxMs = opts.reconnectMaxMs ?? DEFAULT_RECONNECT_MAX_MS;
+  const envPrefix = opts.envPrefix ?? REMOTE_ENV_PREFIX;
+  let backoff = minMs;
+  for (; ; ) {
+    if (Date.now() >= deadline) {
+      throw new Error(`Op '${opId}' timed out after ${timeoutMs}ms`);
+    }
+    let executor;
+    try {
+      executor = await acquire();
+    } catch (err) {
+      const wait = Math.min(backoff, deadline - Date.now());
+      if (wait <= 0) throw err;
+      await sleep(wait);
+      backoff = Math.min(backoff * 2, maxMs);
+      continue;
+    }
+    try {
+      if (!opts.ensured || !opts.ensured.has(executor)) {
+        await ensureRemoteJournal(executor, baseDir);
+        opts.ensured?.add(executor);
+      }
+      const waitSecs = Math.min(
+        opts.waitSecs ?? 25,
+        Math.max(1, Math.ceil((deadline - Date.now()) / 1e3))
+      );
+      const r = await runJournaled(executor, opId, command, {
+        baseDir,
+        waitSecs,
+        envPrefix
+      });
+      switch (r.status) {
+        case "done":
+          opts.onSuccess?.();
+          return { code: r.code ?? 0, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
+        case "running":
+          backoff = minMs;
+          continue;
+        case "dead":
+          throw new OpInterruptedError(
+            `Op '${opId}' was interrupted and did not complete (no exit recorded).`
+          );
+        case "collision":
+          throw new Error(`Op id '${opId}' was reused with a different command.`);
+        case "eio":
+          throw new Error(`Remote journal error for op '${opId}': ${r.message ?? "unknown"}`);
+      }
+    } catch (err) {
+      if (err instanceof OpInterruptedError) throw err;
+      if (isRetryableRemoteConnectionError(err)) {
+        opts.onRetryableDrop?.(err);
+        const wait = Math.min(backoff, deadline - Date.now());
+        if (wait <= 0) throw err;
+        await sleep(wait);
+        backoff = Math.min(backoff * 2, maxMs);
+        continue;
+      }
+      throw err;
+    }
+  }
+}
+async function execReliable(executor, opId, command, opts = {}) {
+  if (executor instanceof LocalExecutor) {
+    return executor.exec(command);
+  }
+  const r = await runReliable(() => Promise.resolve(executor), opId, command, opts);
+  if (r.code !== 0) {
+    throw new Error(r.stderr.trim() || r.stdout.trim() || `Exit code ${r.code}`);
+  }
+  return r.stdout.trim();
+}
+
+// ../../packages/adapters/src/toolchain/catalog.ts
+function nodeInstallPlan(profile) {
+  if (profile.os === "linux" && ["apt", "dnf", "yum"].includes(profile.packageManager)) {
+    const installCommands = {
+      // NodeSource's `setup_lts.x` pins the apt repo to $(lsb_release -sc), so it
+      // breaks on a new/unpublished Ubuntu codename exactly like the OpenResty
+      // #86 bug (and can leave a poisoned nodesource.list that fails later apt
+      // runs). Their node_XX.x repos use the distro-agnostic `nodistro` suite, so
+      // add it directly (no codename, no `curl | bash` of a remote script) and
+      // heal a stale list first. Pinned to the current LTS major (bump on new LTS).
+      apt: [
+        "set -e",
+        "rm -f /etc/apt/sources.list.d/nodesource.list",
+        "apt-get update -qq && apt-get install -y -qq curl gnupg ca-certificates",
+        "curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor --yes -o /usr/share/keyrings/nodesource.gpg",
+        'echo "deb [signed-by=/usr/share/keyrings/nodesource.gpg] https://deb.nodesource.com/node_22.x nodistro main" > /etc/apt/sources.list.d/nodesource.list',
+        "apt-get update -qq && apt-get install -y -qq nodejs"
+      ].join("\n"),
+      dnf: "curl -fsSL https://rpm.nodesource.com/setup_lts.x | bash - && dnf install -y nodejs",
+      yum: "curl -fsSL https://rpm.nodesource.com/setup_lts.x | bash - && yum install -y nodejs"
+    };
+    return {
+      supported: true,
+      installCommand: installCommands[profile.packageManager],
+      verifyCommand: "node --version"
+    };
+  }
+  const fallbacks = {
+    brew: "brew install node"
+  };
+  const fallback = fallbacks[profile.packageManager];
+  if (!fallback) {
+    return {
+      supported: false,
+      unsupportedReason: "No supported package manager found for Node.js installation"
+    };
+  }
+  return {
+    supported: true,
+    installCommand: fallback,
+    verifyCommand: "node --version"
+  };
+}
+function goInstallPlan(profile) {
+  if (profile.os === "linux") {
+    const arch = profile.arch === "arm64" ? "arm64" : "amd64";
+    return {
+      supported: true,
+      installCommand: [
+        `curl -fsSL https://go.dev/dl/go1.22.5.linux-${arch}.tar.gz -o /tmp/go.tar.gz`,
+        "rm -rf /usr/local/go",
+        "tar -C /usr/local -xzf /tmp/go.tar.gz",
+        "rm /tmp/go.tar.gz",
+        "echo 'export PATH=$PATH:/usr/local/go/bin' >> /etc/profile.d/go.sh",
+        "export PATH=$PATH:/usr/local/go/bin"
+      ].join(" && "),
+      verifyCommand: "/usr/local/go/bin/go version || go version"
+    };
+  }
+  if (profile.packageManager === "brew") {
+    return {
+      supported: true,
+      installCommand: "brew install go",
+      verifyCommand: "go version"
+    };
+  }
+  return {
+    supported: false,
+    unsupportedReason: "Go installation is only supported on Linux and macOS (brew)"
+  };
+}
+function rustInstallPlan(_profile) {
+  return {
+    supported: true,
+    installCommand: "curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && . $HOME/.cargo/env",
+    verifyCommand: ". $HOME/.cargo/env && rustc --version"
+  };
+}
+function pythonInstallPlan(profile) {
+  const commands = {
+    apt: "apt-get update -qq && apt-get install -y -qq python3 python3-pip python3-venv",
+    dnf: "dnf install -y python3 python3-pip",
+    yum: "yum install -y python3 python3-pip",
+    brew: "brew install python3"
+  };
+  const installCommand = commands[profile.packageManager];
+  if (!installCommand) {
+    return {
+      supported: false,
+      unsupportedReason: "No supported package manager found for Python installation"
+    };
+  }
+  return {
+    supported: true,
+    installCommand,
+    verifyCommand: "python3 --version"
+  };
+}
+function rubyInstallPlan(profile) {
+  const commands = {
+    apt: "apt-get update -qq && apt-get install -y -qq ruby-full build-essential",
+    dnf: "dnf install -y ruby ruby-devel",
+    yum: "yum install -y ruby ruby-devel",
+    brew: "brew install ruby"
+  };
+  const installCommand = commands[profile.packageManager];
+  if (!installCommand) {
+    return {
+      supported: false,
+      unsupportedReason: "No supported package manager found for Ruby installation"
+    };
+  }
+  return {
+    supported: true,
+    installCommand,
+    verifyCommand: "ruby --version"
+  };
+}
+function phpInstallPlan(profile) {
+  if (profile.packageManager === "apt") {
+    return {
+      supported: true,
+      installCommand: [
+        "apt-get update -qq",
+        "apt-get install -y -qq php-cli php-mbstring php-xml php-curl unzip",
+        "curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer"
+      ].join(" && "),
+      verifyCommand: "php --version && composer --version"
+    };
+  }
+  const commands = {
+    dnf: "dnf install -y php-cli php-mbstring php-xml php-curl composer",
+    yum: "yum install -y php-cli php-mbstring php-xml php-curl",
+    brew: "brew install php composer"
+  };
+  const installCommand = commands[profile.packageManager];
+  if (!installCommand) {
+    return {
+      supported: false,
+      unsupportedReason: "No supported package manager found for PHP installation"
+    };
+  }
+  return {
+    supported: true,
+    installCommand,
+    verifyCommand: "php --version"
+  };
+}
+function javaInstallPlan(profile) {
+  const commands = {
+    apt: "apt-get update -qq && apt-get install -y -qq openjdk-21-jdk",
+    dnf: "dnf install -y java-21-openjdk-devel",
+    yum: "yum install -y java-21-openjdk-devel",
+    brew: "brew install openjdk@21"
+  };
+  const installCommand = commands[profile.packageManager];
+  if (!installCommand) {
+    return {
+      supported: false,
+      unsupportedReason: "No supported package manager found for Java installation"
+    };
+  }
+  return {
+    supported: true,
+    installCommand,
+    verifyCommand: "java --version 2>&1"
+  };
+}
+function mavenInstallPlan(profile) {
+  const commands = {
+    apt: "apt-get update -qq && apt-get install -y -qq maven",
+    dnf: "dnf install -y maven",
+    yum: "yum install -y maven",
+    brew: "brew install maven"
+  };
+  const installCommand = commands[profile.packageManager];
+  if (!installCommand) {
+    return {
+      supported: false,
+      unsupportedReason: "No supported package manager found for Maven installation"
+    };
+  }
+  return {
+    supported: true,
+    installCommand,
+    verifyCommand: "mvn -version"
+  };
+}
+function gradleInstallPlan(profile) {
+  const commands = {
+    apt: "apt-get update -qq && apt-get install -y -qq gradle",
+    brew: "brew install gradle"
+  };
+  const installCommand = commands[profile.packageManager];
+  if (!installCommand) {
+    return {
+      supported: false,
+      unsupportedReason: "No supported package manager found for Gradle installation (use the ./gradlew wrapper instead)"
+    };
+  }
+  return {
+    supported: true,
+    installCommand,
+    verifyCommand: "gradle --version"
+  };
+}
+function dotnetInstallPlan(profile) {
+  if (profile.os === "linux") {
+    return {
+      supported: true,
+      installCommand: "curl -fsSL https://dot.net/v1/dotnet-install.sh | bash -s -- --channel 8.0 --install-dir /usr/local/share/dotnet && ln -sf /usr/local/share/dotnet/dotnet /usr/local/bin/dotnet",
+      verifyCommand: "dotnet --version"
+    };
+  }
+  if (profile.packageManager === "brew") {
+    return {
+      supported: true,
+      installCommand: "brew install dotnet-sdk",
+      verifyCommand: "dotnet --version"
+    };
+  }
+  return {
+    supported: false,
+    unsupportedReason: ".NET SDK installation is only supported on Linux and macOS (brew)"
+  };
+}
+function elixirInstallPlan(profile) {
+  const commands = {
+    apt: "apt-get update -qq && apt-get install -y -qq erlang elixir",
+    dnf: "dnf install -y erlang elixir",
+    brew: "brew install elixir"
+  };
+  const installCommand = commands[profile.packageManager];
+  if (!installCommand) {
+    return {
+      supported: false,
+      unsupportedReason: "No supported package manager found for Elixir installation"
+    };
+  }
+  return {
+    supported: true,
+    installCommand,
+    verifyCommand: "elixir --version"
+  };
+}
+function bundlerInstallPlan(_profile) {
+  return {
+    supported: true,
+    installCommand: "gem install bundler",
+    verifyCommand: "bundler --version"
+  };
+}
+function composerInstallPlan(profile) {
+  if (profile.packageManager === "brew") {
+    return {
+      supported: true,
+      installCommand: "brew install composer",
+      verifyCommand: "composer --version"
+    };
+  }
+  return {
+    supported: true,
+    installCommand: "curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer",
+    verifyCommand: "composer --version"
+  };
+}
+function bunInstallPlan(_profile) {
+  return {
+    supported: true,
+    installCommand: [
+      "curl -fsSL https://bun.sh/install | bash -s 'bun-v1.2.0'",
+      "ln -sf $HOME/.bun/bin/bun /usr/local/bin/bun"
+    ].join(" && "),
+    verifyCommand: "bun --version"
+  };
+}
+function pipInstallPlan(profile) {
+  const commands = {
+    apt: "apt-get update -qq && apt-get install -y -qq python3-pip",
+    dnf: "dnf install -y python3-pip",
+    yum: "yum install -y python3-pip",
+    brew: "python3 -m ensurepip --upgrade"
+  };
+  const installCommand = commands[profile.packageManager];
+  if (!installCommand) {
+    return {
+      supported: false,
+      unsupportedReason: "No supported package manager found for pip installation"
+    };
+  }
+  return {
+    supported: true,
+    installCommand,
+    verifyCommand: "pip3 --version || pip --version"
+  };
+}
+var toolchainCatalog = {
+  /**
+   * Check recipes - how to detect each tool and parse its version.
+   *
+   * Every tool in LANGUAGES[lang].requiredTools must have an entry here.
+   */
+  checks: {
+    node: {
+      label: "Node.js",
+      versionCommand: "node --version",
+      parseVersion: (output) => output.replace(/^v/, "").trim(),
+      missingMessage: "Node.js is not installed",
+      installable: true
+    },
+    bun: {
+      label: "Bun",
+      versionCommand: "bun --version",
+      parseVersion: (output) => output.trim(),
+      missingMessage: "Bun is not installed",
+      installable: true
+    },
+    npm: {
+      label: "npm",
+      versionCommand: "npm --version",
+      parseVersion: (output) => output.trim(),
+      missingMessage: "npm is not installed",
+      installable: false,
+      providedBy: "node"
+    },
+    go: {
+      label: "Go",
+      versionCommand: "go version",
+      parseVersion: (output) => output.match(/go(\d+\.\d+(\.\d+)?)/)?.[1] ?? output.trim(),
+      missingMessage: "Go is not installed",
+      installable: true
+    },
+    rustc: {
+      label: "Rust compiler",
+      versionCommand: "rustc --version",
+      parseVersion: (output) => output.match(/rustc (\S+)/)?.[1] ?? output.trim(),
+      missingMessage: "Rust compiler is not installed",
+      installable: true
+    },
+    cargo: {
+      label: "Cargo",
+      versionCommand: "cargo --version",
+      parseVersion: (output) => output.match(/cargo (\S+)/)?.[1] ?? output.trim(),
+      missingMessage: "Cargo is not installed",
+      installable: false,
+      providedBy: "rustc"
+    },
+    python3: {
+      label: "Python 3",
+      versionCommand: "python3 --version",
+      parseVersion: (output) => output.match(/Python (\S+)/)?.[1] ?? output.trim(),
+      missingMessage: "Python 3 is not installed",
+      installable: true
+    },
+    pip: {
+      label: "pip",
+      versionCommand: "pip3 --version || pip --version",
+      parseVersion: (output) => output.match(/pip (\S+)/)?.[1] ?? output.trim(),
+      missingMessage: "pip is not installed",
+      installable: true,
+      providedBy: "python3"
+    },
+    ruby: {
+      label: "Ruby",
+      versionCommand: "ruby --version",
+      parseVersion: (output) => output.match(/ruby (\S+)/)?.[1] ?? output.trim(),
+      missingMessage: "Ruby is not installed",
+      installable: true
+    },
+    bundler: {
+      label: "Bundler",
+      versionCommand: "bundler --version",
+      parseVersion: (output) => output.match(/(\d+\.\d+\.\d+)/)?.[1] ?? output.trim(),
+      missingMessage: "Bundler is not installed",
+      installable: true,
+      providedBy: "ruby"
+    },
+    php: {
+      label: "PHP",
+      versionCommand: "php --version",
+      parseVersion: (output) => output.match(/PHP (\S+)/)?.[1] ?? output.trim(),
+      missingMessage: "PHP is not installed",
+      installable: true
+    },
+    composer: {
+      label: "Composer",
+      versionCommand: "composer --version",
+      parseVersion: (output) => output.match(/(\d+\.\d+\.\d+)/)?.[1] ?? output.trim(),
+      missingMessage: "Composer is not installed",
+      installable: true,
+      providedBy: "php"
+    },
+    java: {
+      label: "Java",
+      versionCommand: "java --version 2>&1 || java -version 2>&1",
+      parseVersion: (output) => output.match(/(\d+\.\d+)/)?.[1] ?? output.trim(),
+      missingMessage: "Java is not installed",
+      installable: true
+    },
+    javac: {
+      label: "Java compiler",
+      versionCommand: "javac --version 2>&1 || javac -version 2>&1",
+      parseVersion: (output) => output.match(/javac (\S+)/)?.[1] ?? output.trim(),
+      missingMessage: "Java compiler (javac) is not installed",
+      installable: false,
+      providedBy: "java"
+    },
+    maven: {
+      label: "Maven",
+      versionCommand: "mvn -version 2>&1",
+      parseVersion: (output) => output.match(/Apache Maven (\S+)/)?.[1] ?? output.trim(),
+      missingMessage: "Maven is not installed",
+      installable: true
+    },
+    gradle: {
+      label: "Gradle",
+      versionCommand: "gradle --version 2>&1",
+      parseVersion: (output) => output.match(/Gradle (\S+)/)?.[1] ?? output.trim(),
+      missingMessage: "Gradle is not installed",
+      installable: true
+    },
+    dotnet: {
+      label: ".NET SDK",
+      versionCommand: "dotnet --version",
+      parseVersion: (output) => output.trim(),
+      missingMessage: ".NET SDK is not installed",
+      installable: true
+    },
+    elixir: {
+      label: "Elixir",
+      versionCommand: "elixir --version 2>&1",
+      parseVersion: (output) => output.match(/Elixir (\S+)/)?.[1] ?? output.trim(),
+      missingMessage: "Elixir is not installed",
+      installable: true
+    },
+    mix: {
+      label: "Mix",
+      versionCommand: "mix --version 2>&1",
+      parseVersion: (output) => output.match(/Mix (\S+)/)?.[1] ?? output.trim(),
+      missingMessage: "Mix is not installed",
+      installable: false,
+      providedBy: "elixir"
+    }
+  },
+  /**
+   * Install plan factories - how to install each tool on a given OS.
+   *
+   * Only tools with `installable: true` (and no `providedBy`) need an entry.
+   * Tools like npm, cargo, mix are installed as part of their parent.
+   */
+  installs: {
+    node: nodeInstallPlan,
+    bun: bunInstallPlan,
+    go: goInstallPlan,
+    rustc: rustInstallPlan,
+    python3: pythonInstallPlan,
+    pip: pipInstallPlan,
+    ruby: rubyInstallPlan,
+    bundler: bundlerInstallPlan,
+    php: phpInstallPlan,
+    composer: composerInstallPlan,
+    java: javaInstallPlan,
+    maven: mavenInstallPlan,
+    gradle: gradleInstallPlan,
+    dotnet: dotnetInstallPlan,
+    elixir: elixirInstallPlan
+  }
+};
+
+// ../../packages/adapters/src/toolchain/checks.ts
+function parseVersionParts(version) {
+  const match = version.match(/\d+(?:\.\d+)*/)?.[0] ?? "0";
+  return match.split(".").map((part) => parseInt(part, 10) || 0);
+}
+function compareVersions(actual, minimum) {
+  const actualParts = parseVersionParts(actual);
+  const minimumParts = parseVersionParts(minimum);
+  const maxLength = Math.max(actualParts.length, minimumParts.length);
+  for (let index = 0; index < maxLength; index += 1) {
+    const left = actualParts[index] ?? 0;
+    const right = minimumParts[index] ?? 0;
+    if (left > right) return 1;
+    if (left < right) return -1;
+  }
+  return 0;
+}
+async function tryExec(executor, command) {
+  const startedAt = Date.now();
+  systemDebug("toolchain", `exec:start ${command}`);
+  try {
+    const result = await executor.exec(command, { timeout: 1e4 });
+    systemDebug(
+      "toolchain",
+      `exec:ok ${command} (${formatDuration(startedAt)})`
+    );
+    return result;
+  } catch (err) {
+    if (isRemoteConnectionError(err)) {
+      systemDebug(
+        "toolchain",
+        `exec:abort ${command} (${formatDuration(startedAt)}) ${safeErrorMessage(err)}`
+      );
+      throw err;
+    }
+    const msg = safeErrorMessage(err);
+    systemDebug(
+      "toolchain",
+      `exec:fail ${command} (${formatDuration(startedAt)}) ${msg}`
+    );
+    return null;
+  }
+}
+async function checkTool(executor, name, opts) {
+  const recipe = toolchainCatalog.checks[name];
+  if (!recipe) {
+    return {
+      name,
+      label: name,
+      installed: false,
+      healthy: false,
+      message: `Unknown tool: ${name}`
+    };
+  }
+  const output = await tryExec(executor, recipe.versionCommand);
+  if (!output) {
+    systemDebug("toolchain", `${name}:missing`);
+    return {
+      name,
+      label: recipe.label,
+      installed: false,
+      healthy: false,
+      message: recipe.missingMessage
+    };
+  }
+  const version = recipe.parseVersion(output);
+  if (opts?.minVersion && compareVersions(version, opts.minVersion) < 0) {
+    systemDebug("toolchain", `${name}:outdated v${version} < ${opts.minVersion}`);
+    return {
+      name,
+      label: recipe.label,
+      installed: true,
+      version,
+      requiredVersion: opts.minVersion,
+      healthy: false,
+      message: `${recipe.label} ${version} is installed but ${opts.minVersion}+ is required`
+    };
+  }
+  systemDebug("toolchain", `${name}:healthy v${version}`);
+  return {
+    name,
+    label: recipe.label,
+    installed: true,
+    version,
+    requiredVersion: opts?.minVersion,
+    healthy: true,
+    message: `${recipe.label} ${version}`
+  };
+}
+async function checkTools(executor, toolNames, requiredVersions) {
+  const startedAt = Date.now();
+  systemDebug("toolchain", `checkTools:start [${toolNames.join(", ")}]`);
+  const tools = await Promise.all(
+    toolNames.map(
+      (name) => checkTool(executor, name, { minVersion: requiredVersions?.[name] })
+    )
+  );
+  const missing = tools.filter((t) => !t.installed).map((t) => t.name);
+  const outdated = tools.filter((t) => t.installed && !t.healthy).map((t) => t.name);
+  const ready = missing.length === 0 && outdated.length === 0;
+  systemDebug(
+    "toolchain",
+    `checkTools:done (${formatDuration(startedAt)}) ready=${ready} missing=[${missing.join(", ")}] outdated=[${outdated.join(", ")}]`
+  );
+  return { tools, ready, missing, outdated };
+}
+async function checkToolchain(executor, language, requiredVersions) {
+  const lang = LANGUAGES[language];
+  if (!lang || lang.requiredTools.length === 0) {
+    return { tools: [], ready: true, missing: [], outdated: [] };
+  }
+  return checkTools(executor, lang.requiredTools, requiredVersions);
+}
+async function checkToolchainForStack(executor, stackId) {
+  const stack = STACKS[stackId];
+  if (!stack) {
+    return { tools: [], ready: true, missing: [], outdated: [] };
+  }
+  if (stack.requiredTools && stack.requiredTools.length > 0) {
+    return checkTools(executor, stack.requiredTools, stack.requiredToolVersions);
+  }
+  return checkToolchain(executor, stack.language, stack.requiredToolVersions);
+}
+
+// ../../packages/adapters/src/toolchain/installer.ts
+async function installTool(executor, name, onLog, requiredVersion) {
+  const startedAt = Date.now();
+  const recipe = toolchainCatalog.checks[name];
+  if (!recipe) {
+    return { tool: name, success: false, error: `Unknown tool: ${name}` };
+  }
+  if (recipe.providedBy && !toolchainCatalog.installs[name]) {
+    const status = await checkTool(executor, name, { minVersion: requiredVersion });
+    if (status.healthy) {
+      return { tool: name, success: true, version: status.version };
+    }
+    return {
+      tool: name,
+      success: false,
+      error: `${recipe.label} should be installed by ${recipe.providedBy}`
+    };
+  }
+  const factory = toolchainCatalog.installs[name];
+  if (!factory) {
+    return { tool: name, success: false, error: `No installer for ${name}` };
+  }
+  const profile = await resolveEnvironment(executor);
+  const plan = factory(profile);
+  if (!plan.supported) {
+    const msg = plan.unsupportedReason ?? `${recipe.label} installation not supported on this system`;
+    onLog?.({
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      message: msg,
+      level: "error"
+    });
+    return { tool: name, success: false, error: msg };
+  }
+  systemDebug("toolchain", `install:start ${name}`);
+  onLog?.({
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    message: `Installing ${recipe.label}...`,
+    level: "info"
+  });
+  try {
+    const { code } = await executor.streamExec(plan.installCommand, (entry) => {
+      onLog?.(entry);
+    });
+    if (code !== 0) {
+      if (plan.fallbackInstallCommands?.length) {
+        for (const fallback of plan.fallbackInstallCommands) {
+          onLog?.({
+            timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+            message: `Primary install failed, trying fallback...`,
+            level: "warn"
+          });
+          const fb = await executor.streamExec(fallback, (entry) => onLog?.(entry));
+          if (fb.code === 0) break;
+        }
+      } else {
+        throw new Error(`Install command failed with exit code ${code}`);
+      }
+    }
+    if (plan.startCommand) {
+      await executor.streamExec(plan.startCommand, (entry) => onLog?.(entry));
+    }
+    const verifyCmd = plan.verifyCommand ?? recipe.versionCommand;
+    const verifyResult = await executor.exec(verifyCmd, { timeout: 1e4 }).catch(() => null);
+    if (!verifyResult) {
+      throw new Error(`${recipe.label} installed but verification failed`);
+    }
+    const version = recipe.parseVersion(verifyResult);
+    systemDebug("toolchain", `install:done ${name} v${version} (${formatDuration(startedAt)})`);
+    onLog?.({
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      message: `${recipe.label} ${version} installed successfully`,
+      level: "info"
+    });
+    return { tool: name, success: true, version };
+  } catch (err) {
+    const msg = safeErrorMessage(err);
+    systemDebug("toolchain", `install:fail ${name} (${formatDuration(startedAt)}) ${msg}`);
+    onLog?.({
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      message: `Failed to install ${recipe.label}: ${msg}`,
+      level: "error"
+    });
+    return { tool: name, success: false, error: msg };
+  }
+}
+async function installTools(executor, toolNames, onLog, requiredVersions) {
+  const sorted = [...toolNames].sort((a, b) => {
+    const aEntry = toolchainCatalog.checks[a];
+    const bEntry = toolchainCatalog.checks[b];
+    if (aEntry?.providedBy === b) return 1;
+    if (bEntry?.providedBy === a) return -1;
+    if (aEntry?.installable && !bEntry?.installable) return -1;
+    if (!aEntry?.installable && bEntry?.installable) return 1;
+    return 0;
+  });
+  const results = [];
+  for (const name of sorted) {
+    const status = await checkTool(executor, name, {
+      minVersion: requiredVersions?.[name]
+    });
+    if (status.healthy) {
+      onLog?.({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        message: `${status.label} ${status.version ?? ""} already installed, skipping`,
+        level: "info"
+      });
+      results.push({ tool: name, success: true, version: status.version });
+      continue;
+    }
+    const result = await installTool(executor, name, onLog, requiredVersions?.[name]);
+    results.push(result);
+  }
+  return results;
+}
+
+// ../../packages/adapters/src/runtime/supervisor/systemd.ts
+var UNIT_PREFIX = "openship";
+function escapeSystemdEnvValue(value) {
+  return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/%/g, "%%").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t");
+}
+var SystemdSupervisor = class {
+  constructor(executor, workDir) {
+    this.executor = executor;
+    this.workDir = workDir;
+  }
+  name = "systemd";
+  // ── Helpers ──────────────────────────────────────────────────────────
+  unitName(deploymentId) {
+    return `${UNIT_PREFIX}-${deploymentId}.service`;
+  }
+  unitPath(deploymentId) {
+    return `/etc/systemd/system/${this.unitName(deploymentId)}`;
+  }
+  artifactFile(id) {
+    return `${this.workDir}/.artifacts/${id}.path`;
+  }
+  async writeArtifactPath(id, path) {
+    await this.executor.mkdir(`${this.workDir}/.artifacts`);
+    await this.executor.writeFile(this.artifactFile(id), path);
+  }
+  async readArtifactPath(id) {
+    try {
+      const content = await this.executor.readFile(this.artifactFile(id));
+      return content.trim() || null;
+    } catch {
+      return null;
+    }
+  }
+  async removeArtifactPath(id) {
+    await this.executor.rm(this.artifactFile(id));
+  }
+  /**
+   * Build a systemd unit file contents string.
+   *
+   * Uses Type=exec so systemd tracks the actual process (not the shell wrapper).
+   * Environment vars are set via Environment= directives (one per line), which
+   * avoids any SHELL quoting issues - but systemd does its own parsing, so each
+   * assignment is double-quoted and escaped (see escapeSystemdEnvValue).
+   */
+  buildUnitFile(opts) {
+    const envLines = Object.entries(opts.env).filter(([key]) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(key)).map(([k, v]) => `Environment="${k}=${escapeSystemdEnvValue(v)}"`).join("\n");
+    return `[Unit]
+Description=Openship deployment ${opts.deploymentId}
+After=network.target
+
+[Service]
+Type=exec
+WorkingDirectory=${opts.workDir}
+ExecStart=/bin/sh -lc ${sq(opts.startCommand)}
+${envLines}
+Restart=on-failure
+RestartSec=3
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=${UNIT_PREFIX}-${opts.deploymentId}
+
+[Install]
+WantedBy=multi-user.target
+`;
+  }
+  // ── Lifecycle ────────────────────────────────────────────────────────
+  async deploy(opts) {
+    const unitContent = this.buildUnitFile(opts);
+    const unitPath = this.unitPath(opts.deploymentId);
+    const unitName = this.unitName(opts.deploymentId);
+    await this.executor.writeFile(unitPath, unitContent);
+    await this.executor.exec("systemctl daemon-reload");
+    await execReliable(
+      this.executor,
+      `deploy:${opts.deploymentId}:activate`,
+      `systemctl enable --now ${sq(unitName)}`
+    );
+    await this.writeArtifactPath(opts.deploymentId, opts.workDir);
+    await new Promise((r) => setTimeout(r, 1500));
+    if (!await this.isRunning(opts.deploymentId)) {
+      let hint = "";
+      try {
+        const tail = await this.executor.exec(
+          `journalctl -u ${sq(unitName)} -n 10 --no-pager 2>/dev/null`
+        );
+        hint = tail.trim();
+      } catch {
+      }
+      if (hint.includes("EADDRINUSE")) {
+        const occupant = await probeListeningPort(this.executor, opts.port);
+        throw new DeployError(
+          `Port ${opts.port} is already in use` + (occupant ? ` by ${occupant.command}` : "") + ". Stop the existing process before deploying.",
+          "PORT_IN_USE",
+          {
+            port: opts.port,
+            pid: occupant?.pid,
+            command: occupant?.command,
+            rawCommand: occupant?.rawCommand,
+            systemdUnit: occupant?.systemdUnit,
+            systemdDescription: occupant?.systemdDescription,
+            deploymentId: occupant?.deploymentId,
+            isManagedDeployment: occupant?.isManagedDeployment
+          }
+        );
+      }
+      const msg = hint ? `Process exited immediately after start. Last output:
+${hint}` : "Process exited immediately after start (no output captured)";
+      throw new Error(msg);
+    }
+  }
+  async stop(deploymentId) {
+    const unitName = this.unitName(deploymentId);
+    try {
+      await this.executor.exec(`systemctl stop ${sq(unitName)} 2>/dev/null || true`);
+    } catch {
+    }
+  }
+  async start(deploymentId) {
+    const unitName = this.unitName(deploymentId);
+    await this.executor.exec(`systemctl start ${sq(unitName)}`);
+  }
+  async restart(deploymentId) {
+    const unitName = this.unitName(deploymentId);
+    await this.executor.exec(`systemctl restart ${sq(unitName)}`);
+  }
+  async destroy(deploymentId) {
+    const unitName = this.unitName(deploymentId);
+    const unitPath = this.unitPath(deploymentId);
+    await this.executor.exec(
+      `systemctl disable --now ${sq(unitName)} 2>/dev/null || true`
+    );
+    await this.executor.rm(unitPath);
+    await this.executor.exec("systemctl daemon-reload");
+    const artifactPath = await this.readArtifactPath(deploymentId);
+    if (artifactPath) {
+      await this.executor.rm(artifactPath);
+    }
+    await this.removeArtifactPath(deploymentId);
+  }
+  async isRunning(deploymentId) {
+    const unitName = this.unitName(deploymentId);
+    try {
+      const result = await this.executor.exec(
+        `systemctl is-active ${sq(unitName)} 2>/dev/null || true`
+      );
+      return result.trim() === "active";
+    } catch {
+      return false;
+    }
+  }
+  async getLogs(deploymentId, tail) {
+    const unitName = this.unitName(deploymentId);
+    const tailArg = tail ? `-n ${tail}` : `-n 200`;
+    try {
+      const output = await this.executor.exec(
+        `journalctl -u ${sq(unitName)} ${tailArg} --no-pager -o short-iso 2>/dev/null`
+      );
+      return output.split("\n").filter(Boolean).map((line) => {
+        const match = line.match(/^(\S+)\s+\S+\s+\S+\s+(.*)/);
+        return {
+          timestamp: match?.[1] ?? (/* @__PURE__ */ new Date()).toISOString(),
+          message: match?.[2] ?? line,
+          level: parseLogLevel(line)
+        };
+      });
+    } catch {
+      return [];
+    }
+  }
+  async streamLogs(deploymentId, onLog, opts) {
+    const unitName = this.unitName(deploymentId);
+    const tailN = opts?.tail ?? 100;
+    let stopped = false;
+    const promise = this.executor.streamExec(
+      `journalctl -u ${sq(unitName)} -n ${tailN} -f --no-pager -o short-iso 2>/dev/null`,
+      (entry) => {
+        if (stopped) return;
+        const match = entry.message.match(/^(\S+)\s+\S+\s+\S+\s+(.*)/);
+        const cleaned = match ? { ...entry, timestamp: match[1], message: match[2] + "\r\n" } : { ...entry, message: entry.message + "\r\n" };
+        onLog(cleaned);
+      }
+    );
+    promise.catch(() => {
+    });
+    return () => {
+      stopped = true;
+      this.executor.exec(`pkill -f ${sq(`journalctl.*${unitName}`)} 2>/dev/null || true`).catch(() => {
+      });
+    };
+  }
+};
+
+// ../../packages/adapters/src/runtime/supervisor/nohup.ts
+var NohupSupervisor = class {
+  constructor(executor, workDir) {
+    this.executor = executor;
+    this.workDir = workDir;
+  }
+  name = "nohup";
+  // ── Path helpers ─────────────────────────────────────────────────────
+  pidFile(id) {
+    return `${this.workDir}/.pids/${id}.pid`;
+  }
+  logFile(id) {
+    return `${this.workDir}/.logs/${id}.log`;
+  }
+  artifactFile(id) {
+    return `${this.workDir}/.artifacts/${id}.path`;
+  }
+  // ── PID helpers ──────────────────────────────────────────────────────
+  async readPid(id) {
+    try {
+      const content = await this.executor.readFile(this.pidFile(id));
+      const pid = parseInt(content.trim(), 10);
+      return isNaN(pid) ? null : pid;
+    } catch {
+      return null;
+    }
+  }
+  async writePid(id, pid) {
+    await this.executor.mkdir(`${this.workDir}/.pids`);
+    await this.executor.writeFile(this.pidFile(id), String(pid));
+  }
+  async removePid(id) {
+    await this.executor.rm(this.pidFile(id));
+  }
+  async isAlive(pid) {
+    try {
+      await this.executor.exec(`kill -0 ${pid} 2>/dev/null`);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  // ── Artifact path tracking ───────────────────────────────────────────
+  async readArtifactPath(id) {
+    try {
+      const content = await this.executor.readFile(this.artifactFile(id));
+      return content.trim() || null;
+    } catch {
+      return null;
+    }
+  }
+  async writeArtifactPath(id, path) {
+    await this.executor.mkdir(`${this.workDir}/.artifacts`);
+    await this.executor.writeFile(this.artifactFile(id), path);
+  }
+  async removeArtifactPath(id) {
+    await this.executor.rm(this.artifactFile(id));
+  }
+  // ── Lifecycle ────────────────────────────────────────────────────────
+  async deploy(opts) {
+    await this.executor.mkdir(`${this.workDir}/.logs`);
+    const envExports = Object.entries(opts.env).filter(([key]) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(key)).map(([k, v]) => `export ${k}=${sq(v)}`).join("; ");
+    const logPath = this.logFile(opts.deploymentId);
+    const shellBody = envExports ? `${envExports}; cd ${opts.workDir} && ${opts.startCommand}` : `cd ${opts.workDir} && ${opts.startCommand}`;
+    const runner = `nohup sh -lc ${sq(shellBody)} >> ${sq(logPath)} 2>&1 < /dev/null`;
+    const hasSetsid = await this.executor.exec("command -v setsid >/dev/null 2>&1 && echo y || echo n");
+    const detach = hasSetsid.trim() === "y" ? `setsid ${runner}` : runner;
+    const spawnCmd = `{ ${detach} & echo $!; }`;
+    const pidStr = await execReliable(
+      this.executor,
+      `deploy:${opts.deploymentId}:spawn`,
+      spawnCmd
+    );
+    const pid = parseInt(pidStr.trim(), 10);
+    if (isNaN(pid) || pid <= 0) {
+      throw new Error("Deploy failed: could not capture process ID");
+    }
+    await this.writePid(opts.deploymentId, pid);
+    await this.writeArtifactPath(opts.deploymentId, opts.workDir);
+    await new Promise((r) => setTimeout(r, 1500));
+    if (!await this.isAlive(pid)) {
+      let hint = "";
+      try {
+        const tail = await this.executor.exec(`tail -n 10 ${sq(logPath)}`);
+        hint = tail.trim();
+      } catch {
+      }
+      if (hint.includes("EADDRINUSE")) {
+        const occupant = await probeListeningPort(this.executor, opts.port);
+        throw new DeployError(
+          `Port ${opts.port} is already in use` + (occupant ? ` by ${occupant.command}` : "") + ". Stop the existing process before deploying.",
+          "PORT_IN_USE",
+          { port: opts.port, pid: occupant?.pid, command: occupant?.command }
+        );
+      }
+      const msg = hint ? `Process exited immediately after spawn. Last output:
+${hint}` : "Process exited immediately after spawn (no output captured)";
+      throw new Error(msg);
+    }
+  }
+  async stop(deploymentId) {
+    const pid = await this.readPid(deploymentId);
+    if (!pid) return;
+    if (await this.isAlive(pid)) {
+      await this.executor.exec(`kill -- -${pid} 2>/dev/null || kill ${pid} 2>/dev/null || true`);
+      const deadline = Date.now() + 1e4;
+      while (Date.now() < deadline && await this.isAlive(pid)) {
+        await new Promise((r) => setTimeout(r, 500));
+      }
+      if (await this.isAlive(pid)) {
+        await this.executor.exec(`kill -9 -- -${pid} 2>/dev/null || kill -9 ${pid} 2>/dev/null || true`);
+      }
+    }
+  }
+  async start(_deploymentId) {
+    throw new Error(
+      "Nohup processes cannot be started after stopping. Trigger a new deployment."
+    );
+  }
+  async restart(deploymentId) {
+    await this.stop(deploymentId);
+  }
+  async destroy(deploymentId) {
+    await this.stop(deploymentId);
+    await this.removePid(deploymentId);
+    await this.executor.rm(this.logFile(deploymentId));
+    const artifactPath = await this.readArtifactPath(deploymentId);
+    if (artifactPath) {
+      await this.executor.rm(artifactPath);
+    }
+    await this.removeArtifactPath(deploymentId);
+  }
+  async isRunning(deploymentId) {
+    const pid = await this.readPid(deploymentId);
+    if (!pid) return false;
+    return this.isAlive(pid);
+  }
+  async getLogs(deploymentId, tail) {
+    const logPath = this.logFile(deploymentId);
+    try {
+      const lines = tail ? await this.executor.exec(`tail -n ${tail} ${sq(logPath)}`) : await this.executor.readFile(logPath);
+      return lines.split("\n").filter(Boolean).map((line) => ({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        message: line,
+        level: parseLogLevel(line)
+      }));
+    } catch {
+      return [];
+    }
+  }
+  async streamLogs(deploymentId, onLog, opts) {
+    const logPath = this.logFile(deploymentId);
+    const tailN = opts?.tail ?? 100;
+    let stopped = false;
+    if (!await this.executor.exists(logPath).catch(() => true)) {
+      onLog({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        message: "No supervisor log for this deployment \u2014 the process is supervised elsewhere (container logs, or `openship logs` on the host). Streaming anyway in case it starts writing.\r\n",
+        level: "info"
+      });
+    }
+    const promise = this.executor.streamExec(
+      `mkdir -p ${sq(`${this.workDir}/.logs`)} 2>/dev/null; touch ${sq(logPath)} 2>/dev/null; tail -n ${tailN} -F ${sq(logPath)} 2>/dev/null`,
+      (entry) => {
+        if (!stopped) onLog({ ...entry, message: entry.message + "\r\n" });
+      }
+    );
+    promise.catch(() => {
+    });
+    return () => {
+      stopped = true;
+      this.executor.exec(`pkill -f ${sq(`tail.*${logPath}`)} 2>/dev/null || true`).catch(() => {
+      });
+    };
+  }
+};
+
+// ../../packages/adapters/src/runtime/supervisor/detect.ts
+async function detectSupervisor(executor, workDir) {
+  const hasSystemd = await probeSystemd(executor);
+  if (hasSystemd) {
+    return new SystemdSupervisor(executor, workDir);
+  }
+  return new NohupSupervisor(executor, workDir);
+}
+async function probeSystemd(executor) {
+  try {
+    const result = await executor.exec(
+      `[ -d /run/systemd/system ] && command -v systemctl >/dev/null 2>&1 && echo y || echo n`
+    );
+    return result.trim() === "y";
+  } catch {
+    return false;
+  }
+}
+
+// ../../packages/adapters/src/runtime/bare.ts
+var DEFAULT_WORK_DIR = "/opt/openship";
+var DEFAULT_BUILD_TIMEOUT = 10 * 60 * 1e3;
+var STATIC_RELEASE_BASE = "/opt/openship/static";
+var BareRuntime = class {
+  name = "bare";
+  capabilities = /* @__PURE__ */ new Set([
+    "build",
+    "deploy",
+    "stop",
+    "start",
+    "restart",
+    "destroy",
+    "runtimeLogs",
+    "streamLogs",
+    "containerIp",
+    "rollback",
+    "inContainerExec"
+  ]);
+  workDir;
+  buildTimeout;
+  executor;
+  systemManager;
+  /** True if we created the executor ourselves (must dispose on cleanup) */
+  ownsExecutor;
+  /** Track active builds by sessionId for cancellation */
+  activeBuilds = /* @__PURE__ */ new Map();
+  /** Process lifecycle delegate - resolved lazily on first deploy/stop/etc. */
+  _supervisor = null;
+  _supervisorPromise = null;
+  constructor(opts) {
+    this.workDir = opts?.workDir ?? DEFAULT_WORK_DIR;
+    this.buildTimeout = opts?.buildTimeout ?? DEFAULT_BUILD_TIMEOUT;
+    if (opts?.executor) {
+      this.executor = opts.executor;
+      this.ownsExecutor = false;
+    } else {
+      this.executor = new LocalExecutor();
+      this.ownsExecutor = true;
+    }
+    this.systemManager = opts?.systemManager ?? null;
+  }
+  /** The underlying command executor (local or SSH). Exposed so the
+   *  backup subsystem's bare executor can stream commands over the same
+   *  connection (mirrors how DockerRuntime exposes its client). */
+  get commandExecutor() {
+    return this.executor;
+  }
+  /** A bare deployment is a host process, so "inside the instance" == the host.
+   *  The host executor already sees the process's listeners (shared netns). */
+  async inContainerExecutor() {
+    return this.executor;
+  }
+  /** Get or lazily initialise the process supervisor. */
+  async supervisor() {
+    if (this._supervisor) return this._supervisor;
+    if (!this._supervisorPromise) {
+      this._supervisorPromise = detectSupervisor(this.executor, this.workDir).then((s) => {
+        this._supervisor = s;
+        return s;
+      });
+    }
+    return this._supervisorPromise;
+  }
+  supports(cap) {
+    return this.capabilities.has(cap);
+  }
+  async dispose() {
+    if (this.ownsExecutor) {
+      await this.executor.dispose();
+    }
+  }
+  // ─── Path helpers ────────────────────────────────────────────────────
+  projectDir(projectId) {
+    return `${this.workDir}/${projectId}`;
+  }
+  buildDir(sessionId) {
+    return `${this.workDir}/.builds/${sessionId}`;
+  }
+  releaseDir(deploymentId) {
+    return `${this.workDir}/releases/${deploymentId}`;
+  }
+  async promoteBuildArtifact(artifactPath, deploymentId, previousDeploymentId) {
+    const releaseDir = this.releaseDir(deploymentId);
+    if (artifactPath === releaseDir) return releaseDir;
+    await this.executor.mkdir(`${this.workDir}/releases`);
+    await this.executor.rm(releaseDir);
+    const previousReleaseDir = previousDeploymentId ? this.releaseDir(previousDeploymentId) : void 0;
+    if (previousReleaseDir && await this.executor.exists(previousReleaseDir)) {
+      try {
+        await execReliable(
+          this.executor,
+          `deploy:${deploymentId}:promote-rsync`,
+          `rsync -a --delete --link-dest=${sq(previousReleaseDir)} ${sq(artifactPath)}/ ${sq(releaseDir)}/`
+        );
+        await this.executor.rm(artifactPath).catch(() => {
+        });
+        return releaseDir;
+      } catch {
+        await this.executor.rm(releaseDir).catch(() => {
+        });
+      }
+    }
+    await execReliable(
+      this.executor,
+      `deploy:${deploymentId}:promote-mv`,
+      `mv ${sq(artifactPath)} ${sq(releaseDir)}`
+    );
+    return releaseDir;
+  }
+  // ── File transfer ──────────────────────────────────────────────────────
+  /**
+   * Transfer files from a local path on the API server into the build/deploy dir.
+   *
+   * Delegates entirely to the executor - LocalExecutor does cp,
+   * SshExecutor does tar+pipe. No branching here.
+   */
+  async transferFiles(localPath, remotePath, logger) {
+    await transferLocalDirectory(
+      localPath,
+      {
+        kind: "executor",
+        executor: this.executor,
+        path: remotePath
+      },
+      logger
+    );
+  }
+  // ── Build lifecycle ────────────────────────────────────────────────────
+  async build(config, logger) {
+    const log = logger ?? new BuildLogger();
+    const buildLocally = config.buildStrategy === "local" && !(this.executor instanceof LocalExecutor);
+    const abort = new AbortController();
+    this.activeBuilds.set(config.sessionId, abort);
+    try {
+      if (buildLocally) {
+        return await this.buildLocally(config, log, abort);
+      }
+      return await this.buildOnTarget(config, log, abort);
+    } finally {
+      this.activeBuilds.delete(config.sessionId);
+    }
+  }
+  /** Build on the API host, then transfer output to the target server. */
+  async buildLocally(config, log, abort) {
+    log.log("Build strategy: local (build on API host, transfer to server)\n");
+    const remoteDir = this.buildDir(config.sessionId);
+    const stackDef = STACKS[config.stack];
+    let standaloneStartCommand;
+    let result;
+    try {
+      result = await runLocalBuild({
+        config,
+        logger: log,
+        abort: abort.signal,
+        preflight: async (cfg, plog, localExec) => {
+          await this.ensureToolchain(localExec, cfg.stack, plog);
+          plog.log("Checking runtime tools on target server...\n");
+          await this.ensureToolchain(this.executor, cfg.stack, plog);
+          if (this.systemManager) {
+            plog.log("Ensuring rsync is installed on target server...\n");
+            await this.systemManager.ensureComponents(["rsync"], (entry) => plog.callback(entry));
+          }
+        },
+        transferOutput: async (buildDir) => {
+          await this.executor.rm(remoteDir);
+          await this.executor.mkdir(remoteDir);
+          const selfContained = await prepareStackOutput(
+            config.stack,
+            resolveProjectDir(buildDir, config.rootDirectory)
+          );
+          if (selfContained) {
+            log.log("Detected self-contained build output \u2014 shipping the bundle (no install on target).\n");
+            await transferLocalDirectory(
+              selfContained.bundleDir,
+              { kind: "executor", executor: this.executor, path: remoteDir },
+              log,
+              { excludes: [] }
+              // ship everything, incl. traced node_modules
+            );
+            standaloneStartCommand = selfContained.startCommand;
+            return;
+          }
+          if (stackDef?.productionPaths?.length) {
+            log.log(`Transferring production paths: ${stackDef.productionPaths.join(", ")}
+`);
+            await transferLocalDirectory(
+              buildDir,
+              { kind: "executor", executor: this.executor, path: remoteDir },
+              log,
+              { includes: [...stackDef.productionPaths] }
+            );
+          } else {
+            await transferLocalDirectory(
+              buildDir,
+              { kind: "executor", executor: this.executor, path: remoteDir },
+              log,
+              {
+                excludes: buildOutputTransferExcludes(stackDef),
+                alsoInclude: stackDef?.outputDirectory ? [stackDef.outputDirectory] : void 0
+              }
+            );
+          }
+          const installCmd = config.installCommand?.trim();
+          if (installCmd) {
+            const pmEnsure = packageManagerEnsureCommand(config.packageManager);
+            const fullInstall = pmEnsure ? `${pmEnsure} && ${installCmd}` : installCmd;
+            log.log("Installing production dependencies on target...\n");
+            const { code } = await this.executor.streamExec(
+              `cd ${sq(remoteDir)} && ${fullInstall}`,
+              log.callback
+            );
+            if (code !== 0) {
+              throw new Error("Failed to install production dependencies on target");
+            }
+            log.log("Production dependencies installed.\n");
+          }
+        }
+      });
+    } catch (err) {
+      const msg = safeErrorMessage(err);
+      log.log(`Failed to transfer local build output: ${msg}`, "error");
+      return {
+        sessionId: config.sessionId,
+        status: "failed",
+        imageRef: remoteDir,
+        errorMessage: `Failed to transfer build output: ${msg}`
+      };
+    }
+    return {
+      sessionId: config.sessionId,
+      status: result.status,
+      imageRef: remoteDir,
+      durationMs: result.durationMs,
+      errorMessage: result.errorMessage,
+      startCommand: standaloneStartCommand
+    };
+  }
+  /** Build directly on the target machine via the executor. */
+  async buildOnTarget(config, log, abort) {
+    log.log("Build strategy: server (build on target)\n");
+    const dir = this.buildDir(config.sessionId);
+    await this.executor.rm(dir);
+    await this.executor.mkdir(dir);
+    const buildEnv = {
+      projectDir: dir,
+      exec: async (command, logCb) => {
+        if (abort.signal.aborted) throw new BuildCancelledError();
+        const effectiveCommand = this.executor instanceof LocalExecutor ? wrapLocalBuildCommand(command) : command;
+        const { code, output } = await this.executor.streamExec(effectiveCommand, logCb);
+        if (abort.signal.aborted) throw new BuildCancelledError();
+        if (code !== 0) {
+          const hint = detectBuildKillHint(output);
+          throw new Error(
+            `Command failed with exit code ${code}${hint ? ` - ${hint}` : ""}`
+          );
+        }
+      },
+      preflight: async (cfg, plog) => {
+        if (abort.signal.aborted) throw new BuildCancelledError();
+        await this.ensureToolchain(this.executor, cfg.stack, plog);
+        if (cfg.localPath) {
+          await this.transferFiles(cfg.localPath, dir, plog);
+        }
+      },
+      // Out-of-band secret write (SSH key + known_hosts) — goes through the
+      // executor's file channel, never the streamed `exec`, so key bytes never
+      // reach the build log. Works for both local and SSH executors.
+      writeSecretFile: (p, content) => this.executor.writeFile(p, content)
+    };
+    const result = await runBuildPipeline(buildEnv, config, log);
+    return {
+      sessionId: config.sessionId,
+      status: result.status,
+      imageRef: dir,
+      durationMs: result.durationMs,
+      errorMessage: result.errorMessage
+    };
+  }
+  /**
+   * Check that the target executor has the required toolchain for a stack,
+   * and install any missing or outdated tools.
+   */
+  async ensureToolchain(executor, stack, plog) {
+    const toolcheck = await checkToolchainForStack(executor, stack);
+    if (toolcheck.ready) return;
+    const requiredTools = toolcheck.tools.filter((tool) => !tool.healthy);
+    plog.log("Installing build tools (one-time server setup)\u2026\n");
+    plog.log(`${requiredTools.map((tool) => tool.message).join("\n")}
+`);
+    const results = await installTools(
+      executor,
+      requiredTools.map((tool) => tool.name),
+      plog.callback,
+      Object.fromEntries(
+        requiredTools.filter((tool) => tool.requiredVersion).map((tool) => [tool.name, tool.requiredVersion])
+      )
+    );
+    const failed = results.filter((r) => !r.success);
+    if (failed.length > 0) {
+      throw new Error(
+        `Failed to install required tools: ${failed.map((f) => `${f.tool} (${f.error})`).join(", ")}`
+      );
+    }
+  }
+  async cancelBuild(sessionId) {
+    const abort = this.activeBuilds.get(sessionId);
+    if (abort) {
+      abort.abort();
+      this.activeBuilds.delete(sessionId);
+    }
+    const dir = sq(this.buildDir(sessionId));
+    const scan = (sig) => `for p in /proc/[0-9]*; do c=$(readlink "$p/cwd" 2>/dev/null); case "$c" in ${dir}|${dir}/*) kill -${sig} "\${p##*/}" 2>/dev/null || true;; esac; done`;
+    await this.executor.exec(`${scan("TERM")}; sleep 2; ${scan("KILL")}`).catch(() => {
+    });
+  }
+  async getBuildLogs(sessionId) {
+    void sessionId;
+    return [];
+  }
+  // ── Deploy lifecycle ───────────────────────────────────────────────────
+  async deploy(config, _onLog) {
+    if (config.adopt) {
+      const occupant = await probeListeningPort(this.executor, config.port);
+      _onLog?.({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        level: occupant ? "info" : "warn",
+        message: occupant ? `[adopt] attached to process on port ${config.port}: ${occupant.command}
+` : `[adopt] no process is listening on port ${config.port} yet \u2014 routing will attach when it comes up
+`
+      });
+      return {
+        deploymentId: config.deploymentId,
+        containerId: config.deploymentId,
+        status: "running"
+      };
+    }
+    const stagedDir = config.imageRef ?? this.projectDir(config.projectId);
+    const workDir = config.imageRef ? await this.promoteBuildArtifact(
+      stagedDir,
+      config.deploymentId,
+      config.previousDeploymentId
+    ) : stagedDir;
+    const sv = await this.supervisor();
+    const env = {
+      ...Object.fromEntries(
+        Object.entries(config.envVars ?? {}).map(([k, v]) => [k, String(v)])
+      ),
+      PORT: String(config.port),
+      NODE_ENV: config.environment === "production" ? "production" : "development"
+    };
+    try {
+      await sv.deploy({
+        deploymentId: config.deploymentId,
+        projectId: config.projectId,
+        workDir,
+        startCommand: config.startCommand || "npm start",
+        port: config.port,
+        env
+      });
+    } catch (err) {
+      if (workDir !== stagedDir) {
+        await sv.destroy(config.deploymentId).catch(() => {
+        });
+        await this.executor.rm(workDir).catch(() => {
+        });
+      }
+      throw err;
+    }
+    return {
+      deploymentId: config.deploymentId,
+      containerId: config.deploymentId,
+      status: "running"
+    };
+  }
+  async deployStatic(config) {
+    const stagedDir = config.imageRef ?? this.projectDir(config.projectId);
+    const workDir = config.imageRef ? await this.promoteBuildArtifact(
+      stagedDir,
+      config.deploymentId,
+      config.previousDeploymentId
+    ) : stagedDir;
+    const staticRoot = this.resolveStaticRoot(workDir, config.outputDirectory);
+    if (!await this.executor.exists(staticRoot)) {
+      if (workDir !== stagedDir) {
+        await this.executor.rm(workDir).catch(() => {
+        });
+      }
+      throw new Error(missingOutputDirectoryMessage(config.outputDirectory));
+    }
+    return {
+      deploymentId: config.deploymentId,
+      containerId: workDir,
+      status: "running"
+    };
+  }
+  resolveStaticRoot(containerId, outputDirectory) {
+    return resolveStaticOutputPath(containerId, outputDirectory);
+  }
+  async stop(containerId) {
+    const sv = await this.supervisor();
+    await sv.stop(containerId);
+  }
+  async start(containerId) {
+    const sv = await this.supervisor();
+    if (await sv.isRunning(containerId)) return;
+    await sv.start(containerId);
+  }
+  async restart(containerId) {
+    const sv = await this.supervisor();
+    await sv.restart(containerId);
+  }
+  async destroy(containerId) {
+    if (containerId.includes("/")) {
+      await this.executor.rm(containerId);
+      return;
+    }
+    const sv = await this.supervisor();
+    await sv.destroy(containerId);
+  }
+  // ── Rollback primitives ──────────────────────────────────────────────
+  //
+  // Bare semantics:
+  //   The release dir at workDir/releases/<deploymentId> IS the artifact.
+  //   The supervisor unit is the activation. Rollback flips which
+  //   release the supervisor unit serves by stop/start sequencing.
+  //
+  //   makeActive — stop `from`'s supervisor unit, then start `to`'s.
+  //     The release dirs are stable on disk; we're just changing which
+  //     unit is running. Matches the user's "mv path + reload" mental
+  //     model — the path doesn't physically move, but the active one
+  //     swaps via the supervisor.
+  //   archive   — stop the supervisor unit. Release dir stays on disk
+  //     (the actual rollback-restorable artifact).
+  //   purge     — destroy the supervisor unit + rm -rf the release dir.
+  async makeActive(input) {
+    if (input.from?.containerId) {
+      try {
+        await this.stop(input.from.containerId);
+      } catch {
+      }
+    }
+    if (!input.to.containerId) {
+      throw new Error(
+        `Cannot make deployment ${input.to.id} active: supervisor unit is gone. Artifact has been purged.`
+      );
+    }
+    await this.start(input.to.containerId);
+    return { containerId: input.to.containerId };
+  }
+  async archive(deployment) {
+    if (!deployment.containerId) return;
+    try {
+      await this.stop(deployment.containerId);
+    } catch {
+    }
+  }
+  async purge(deployment) {
+    if (deployment.containerId) {
+      try {
+        await this.destroy(deployment.containerId);
+      } catch {
+      }
+    }
+    try {
+      await this.executor.rm(this.releaseDir(deployment.id));
+    } catch {
+    }
+  }
+  // ── Observability ──────────────────────────────────────────────────────
+  async getContainerInfo(containerId) {
+    const sv = await this.supervisor();
+    const running = await sv.isRunning(containerId);
+    return {
+      containerId,
+      status: running ? "running" : "stopped"
+    };
+  }
+  async getRuntimeLogs(containerId, tail) {
+    const sv = await this.supervisor();
+    return sv.getLogs(containerId, tail);
+  }
+  async streamRuntimeLogs(containerId, onLog, opts) {
+    const sv = await this.supervisor();
+    return sv.streamLogs(containerId, onLog, opts);
+  }
+  async getUsage(_containerId) {
+    return { cpuPercent: 0, memoryMb: 0, diskMb: 0, networkRxBytes: 0, networkTxBytes: 0 };
+  }
+  // ── Network ────────────────────────────────────────────────────────────
+  async getContainerIp(_containerId) {
+    return "127.0.0.1";
+  }
+};
+
+export {
+  STATIC_RELEASE_BASE,
+  BareRuntime
+};