openship 0.4.8 → 0.5.0

package/dist/{chunk-6APULWSU.js → chunk-UMQP7SYT.js}

@@ -52,8 +52,15 @@ var LANGUAGES = {
   },
   php: {
     name: "PHP",
-    buildImage: "php:8.3-cli",
-    runtimeImage: "php:8.3-fpm",
+    buildImage: "php:8.4-cli",
+    // FrankenPHP, not php:*-fpm. An fpm image is a FastCGI backend, not a
+    // process host: it ships no web server, and pairing it with an apt nginx
+    // means two processes under a shell that swallows SIGTERM — a container stop
+    // then kills in-flight work instead of draining it. FrankenPHP is ONE
+    // process that owns both the HTTP server and PHP, so signals land where they
+    // should with no supervision tree, it runs fine as a non-root user, and its
+    // docroot convention (`/app/public`) is already the layout our recipes emit.
+    runtimeImage: "dunglas/frankenphp:1-php8.4-bookworm",
     packageManagers: ["composer"],
     requiredTools: ["php", "composer"]
   },
@@ -515,18 +522,28 @@ var STACKS = {
     }
   },
   // ── PHP ────────────────────────────────────────────────────────────────────
-  // PHP stacks run php-fpm behind nginx (docroot public/). The generated
-  // Dockerfile (docker-build-plan.ts PHP branch) installs nginx + writes the
-  // config template; this start command renders it for the injected $PORT and
-  // launches both processes. Runtime image inherits php:8.3-fpm from the language.
+  // PHP stacks serve `public/` from FrankenPHP (see LANGUAGES.php). `exec` hands
+  // the container's PID to frankenphp so SIGTERM drains in-flight requests
+  // instead of being swallowed by the shell; SERVER_NAME carries the injected
+  // $PORT (a bare `:port` also keeps Caddy's automatic HTTPS out of the way —
+  // TLS terminates at the edge). No build command: `composer install` is the
+  // INSTALL step, and the build step is where a JS asset pipeline goes (the
+  // detector fills it in when the repo has one).
   laravel: {
     name: "Laravel",
     language: "php",
     category: "fullstack",
     outputDirectory: "public",
     defaultPort: 8e3,
-    defaultBuildCommand: "composer install --no-dev --optimize-autoloader",
-    defaultStartCommand: "envsubst '$PORT' < /etc/nginx/app.conf.template > /etc/nginx/conf.d/default.conf && php-fpm -D && nginx -g 'daemon off;'",
+    defaultBuildCommand: "",
+    defaultStartCommand: 'SERVER_NAME=":$PORT" exec frankenphp run --config /etc/frankenphp/Caddyfile --adapter caddyfile',
+    // Everything a stock Laravel app writes lives here: uploads
+    // (storage/app), sessions + cache when the drivers are `file`, and the
+    // framework's own scratch space. `database/` is deliberately NOT persisted —
+    // it holds migrations, so mounting over it would hide the ones a later
+    // release adds. A SQLite app should point DB_DATABASE at a persisted path or
+    // (better) use a database service.
+    persistentPaths: ["storage"],
     detection: {
       rootMarkers: ["artisan", "composer.json"],
       deps: ["laravel/framework"]
@@ -538,8 +555,10 @@ var STACKS = {
     category: "fullstack",
     outputDirectory: "public",
     defaultPort: 8e3,
-    defaultBuildCommand: "composer install --no-dev --optimize-autoloader",
-    defaultStartCommand: "envsubst '$PORT' < /etc/nginx/app.conf.template > /etc/nginx/conf.d/default.conf && php-fpm -D && nginx -g 'daemon off;'",
+    defaultBuildCommand: "",
+    defaultStartCommand: 'SERVER_NAME=":$PORT" exec frankenphp run --config /etc/frankenphp/Caddyfile --adapter caddyfile',
+    // No persistentPaths: Symfony's `var/` is cache + logs, both regenerated,
+    // and it has no convention for where user uploads land.
     detection: {
       rootMarkers: ["composer.json", "symfony.lock"],
       deps: ["symfony/framework-bundle"]
@@ -778,6 +797,9 @@ var STACK_ROOT_MARKERS = new Set(
   Object.values(STACKS).flatMap((stack) => stack.detection?.rootMarkers ?? []).map((marker) => marker.toLowerCase())
 );
 function packageManagerEnsureCommand(packageManager) {
+  if (packageManager === "bun") {
+    return `(command -v bun >/dev/null 2>&1 || npm i -g bun) >/dev/null 2>&1 || true`;
+  }
   if (packageManager !== "pnpm" && packageManager !== "yarn") return "";
   return `(corepack enable ${packageManager} || corepack enable || npm i -g ${packageManager}) >/dev/null 2>&1 || true`;
 }
@@ -841,6 +863,22 @@ var STACK_ICONS = {
   "docker-compose": `${DI}/docker/docker-original.svg`
 };
 
+// ../../packages/core/src/volumes.ts
+var APP_DIR = "/app";
+var MODE_SUFFIX = /:(ro|rw|z|Z|nocopy)$/;
+function appVolumeTargets(volumes, appDir = APP_DIR) {
+  const out = [];
+  for (const spec of volumes) {
+    const body = spec.replace(MODE_SUFFIX, "");
+    const idx = body.indexOf(":");
+    if (idx < 0) continue;
+    const target = body.slice(idx + 1);
+    if (!target.startsWith(`${appDir}/`)) continue;
+    out.push(target.slice(appDir.length + 1));
+  }
+  return out;
+}
+
 // ../../packages/core/src/constants.ts
 var DEFAULT_IMAGE_REGISTRY = "ghcr.io/oblien";
 var PLANS = {
@@ -1017,7 +1055,35 @@ var SYSTEM = {
     /** Maximum length of the error message stored in DB */
     MAX_ERROR_MESSAGE_LENGTH: 512,
     /** Default restart policy for production containers */
-    DEFAULT_RESTART_POLICY: "always"
+    DEFAULT_RESTART_POLICY: "always",
+    /**
+     * How long a just-started container is watched before a deploy may call
+     * itself ready. Container-create succeeding proves nothing: a bad start
+     * command exits within milliseconds and `restart: always` hides it behind a
+     * bounce loop. Measured from each container's OWN start time, so a stack
+     * whose earlier services have already been up this long waits only for the
+     * last one.
+     */
+    STABILIZE_WINDOW_MS: 15e3,
+    /** Inspect poll interval inside that window. */
+    STABILIZE_POLL_MS: 1e3,
+    /**
+     * Restarts within the window that mean "crash loop" rather than "waited for
+     * a dependency and recovered". Docker's restart backoff (100ms doubling)
+     * takes an instantly-exiting process past this in ~2s, while a service that
+     * times out waiting on a slow database manages one or two.
+     */
+    STABILIZE_CRASH_RESTARTS: 3,
+    /** Log lines folded into the failure message, so diagnosing needs no SSH. */
+    STABILIZE_LOG_TAIL_LINES: 20,
+    /**
+     * Readiness-probe budget when a project OPTS IN to the health check. Only
+     * reached with `readiness.enabled` — an unconfigured deploy runs no probe
+     * at all, so this never sits on the default critical path.
+     */
+    READINESS_TIMEOUT_MS: 45e3,
+    /** Readiness-probe poll interval. */
+    READINESS_INTERVAL_MS: 1e3
   },
   // ── SSE / Build Streaming ────────────────────────────────────────────
   SSE: {
@@ -1071,11 +1137,12 @@ var SYSTEM = {
     /** Port range */
     MIN_PORT: 1,
     MAX_PORT: 65535,
-    /** Resource limits */
-    MIN_CPU_CORES: 0.25,
-    MAX_CPU_CORES: 4,
-    MIN_MEMORY_MB: 128,
-    MAX_MEMORY_MB: 8192,
+    // Resource bounds deliberately do NOT live here. They belong to
+    // ./resources.ts, which is the single source of truth: the floors
+    // (MIN_CPU_CORES / MIN_MEMORY_MB) plus the rule that the UPPER bound is the
+    // target machine's probed capacity, not a constant. The unread
+    // MAX_CPU_CORES: 4 / MAX_MEMORY_MB: 8192 pair that used to sit here encoded
+    // exactly the fixed ceiling that made a large self-hosted box unusable.
     /** Pagination */
     DEFAULT_PAGE: 1,
     DEFAULT_PER_PAGE: 20,
@@ -1083,6 +1150,41 @@ var SYSTEM = {
   }
 };
 
+// ../../packages/core/src/utils.ts
+var REDIRECT_STATUSES = [301, 302, 307, 308];
+var DEFAULT_REDIRECT_STATUS = 301;
+function resolveRedirectStatus(status) {
+  return REDIRECT_STATUSES.includes(status) ? status : DEFAULT_REDIRECT_STATUS;
+}
+function isValidEmail(value) {
+  const email3 = value?.trim() ?? "";
+  if (!email3 || email3.length > 254) return false;
+  return /^[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}$/.test(email3);
+}
+function formatBytes(bytes, decimals = 2) {
+  if (bytes <= 0) return "0 B";
+  const k = 1024;
+  const sizes = ["B", "KB", "MB", "GB", "TB"];
+  const i = Math.min(Math.max(Math.floor(Math.log(bytes) / Math.log(k)), 0), sizes.length - 1);
+  return `${parseFloat((bytes / Math.pow(k, i)).toFixed(decimals))} ${sizes[i]}`;
+}
+function withTimeout(promise2, ms, message) {
+  if (!ms) return promise2;
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error(message)), ms);
+    promise2.then(
+      (v) => {
+        clearTimeout(timer);
+        resolve(v);
+      },
+      (e) => {
+        clearTimeout(timer);
+        reject(e);
+      }
+    );
+  });
+}
+
 // ../../packages/core/src/errors.ts
 var AppError = class extends Error {
   constructor(message, statusCode = 500, code) {
@@ -1106,6 +1208,12 @@ function safeErrorMessage(err) {
   return String(err).slice(0, 2e3);
 }
 
+// ../../packages/core/src/types.ts
+var OPENSHIP_READINESS_FAILURE_ACTIONS = [
+  "warn",
+  "fail"
+];
+
 // ../../packages/core/src/openship-config/schema.ts
 var OPENSHIP_RUNTIMES = ["bare", "docker"];
 var OPENSHIP_PRODUCTION_MODES = [
@@ -1121,6 +1229,7 @@ var OPENSHIP_RESTARTS = [
   "unless-stopped"
 ];
 var OPENSHIP_RESOURCE_TIERS = [
+  "unlimited",
   "micro",
   "low",
   "medium",
@@ -1133,12 +1242,14 @@ var TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "framework",
   "packageManager",
   "rootDirectory",
+  "composePath",
   "installCommand",
   "buildCommand",
   "startCommand",
   "outputDirectory",
   "buildImage",
   "productionPaths",
+  "volumes",
   "runtime",
   "productionMode",
   "port",
@@ -1146,6 +1257,7 @@ var TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "domains",
   "routes",
   "resources",
+  "readiness",
   "services",
   "monorepo"
 ]);
@@ -1320,12 +1432,28 @@ function parseResources(ctx, v, path) {
   }
   const r = {
     tier: ctx.enumOf(v.tier, `${path}.tier`, OPENSHIP_RESOURCE_TIERS),
-    cpuCores: ctx.int(v.cpuCores, `${path}.cpuCores`, 0.25, 4),
-    memoryMb: ctx.int(v.memoryMb, `${path}.memoryMb`, 128, 8192),
-    diskMb: ctx.int(v.diskMb, `${path}.diskMb`, 64, 204800)
+    cpuCores: ctx.int(v.cpuCores, `${path}.cpuCores`, 0, 1024),
+    memoryMb: ctx.int(v.memoryMb, `${path}.memoryMb`, 0, 4194304),
+    diskMb: ctx.int(v.diskMb, `${path}.diskMb`, 0, 204800)
   };
   return r;
 }
+function parseReadiness(ctx, v, path) {
+  if (v === void 0) return void 0;
+  if (!ctx.isObj(v)) {
+    ctx.err(path, "must be an object");
+    return void 0;
+  }
+  return {
+    enabled: ctx.bool(v.enabled, `${path}.enabled`),
+    path: ctx.str(v.path, `${path}.path`),
+    port: ctx.int(v.port, `${path}.port`, 1, 65535),
+    timeoutSeconds: ctx.int(v.timeoutSeconds, `${path}.timeoutSeconds`, 1, 600),
+    stabilization: ctx.bool(v.stabilization, `${path}.stabilization`),
+    stabilizationSeconds: ctx.int(v.stabilizationSeconds, `${path}.stabilizationSeconds`, 1, 600),
+    onFailure: ctx.enumOf(v.onFailure, `${path}.onFailure`, OPENSHIP_READINESS_FAILURE_ACTIONS)
+  };
+}
 function parseHealthcheck(ctx, v, path) {
   if (v === void 0) return void 0;
   if (!ctx.isObj(v)) {
@@ -1374,7 +1502,9 @@ function parseServices(ctx, v, path) {
       exposed: ctx.bool(item.exposed, `${p}.exposed`),
       exposedPort: ctx.str(item.exposedPort, `${p}.exposedPort`),
       domain: ctx.str(item.domain, `${p}.domain`),
-      healthcheck: parseHealthcheck(ctx, item.healthcheck, `${p}.healthcheck`)
+      healthcheck: parseHealthcheck(ctx, item.healthcheck, `${p}.healthcheck`),
+      readiness: parseReadiness(ctx, item.readiness, `${p}.readiness`),
+      resources: parseResources(ctx, item.resources, `${p}.resources`)
     });
   });
   return out;
@@ -1458,12 +1588,14 @@ function parseOpenshipConfig(raw) {
     framework: ctx.enumOf(raw.framework, "framework", STACK_IDS),
     packageManager: parsePackageManager(ctx, raw.packageManager, "packageManager"),
     rootDirectory: ctx.str(raw.rootDirectory, "rootDirectory"),
+    composePath: ctx.str(raw.composePath, "composePath"),
     installCommand: ctx.str(raw.installCommand, "installCommand"),
     buildCommand: ctx.str(raw.buildCommand, "buildCommand"),
     startCommand: ctx.str(raw.startCommand, "startCommand"),
     outputDirectory: ctx.str(raw.outputDirectory, "outputDirectory"),
     buildImage: ctx.str(raw.buildImage, "buildImage"),
     productionPaths: ctx.strArray(raw.productionPaths, "productionPaths"),
+    volumes: ctx.strArray(raw.volumes, "volumes"),
     runtime: ctx.enumOf(raw.runtime, "runtime", OPENSHIP_RUNTIMES),
     productionMode: ctx.enumOf(raw.productionMode, "productionMode", OPENSHIP_PRODUCTION_MODES),
     port: ctx.int(raw.port, "port", 1, 65535),
@@ -1471,6 +1603,7 @@ function parseOpenshipConfig(raw) {
     domains: parseDomains(ctx, raw.domains, "domains"),
     routes: parseRoutes(ctx, raw.routes, "routes"),
     resources: parseResources(ctx, raw.resources, "resources"),
+    readiness: parseReadiness(ctx, raw.readiness, "readiness"),
     services: parseServices(ctx, raw.services, "services"),
     monorepo: parseMonorepo(ctx, raw.monorepo, "monorepo")
   };
@@ -1888,34 +2021,57 @@ function sanitizeProxySettings(input) {
   return Object.keys(out).length > 0 ? out : void 0;
 }
 
-// ../../packages/core/src/utils.ts
-function isValidEmail(value) {
-  const email3 = value?.trim() ?? "";
-  if (!email3 || email3.length > 254) return false;
-  return /^[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}$/.test(email3);
-}
-function formatBytes(bytes, decimals = 2) {
-  if (bytes <= 0) return "0 B";
-  const k = 1024;
-  const sizes = ["B", "KB", "MB", "GB", "TB"];
-  const i = Math.min(Math.max(Math.floor(Math.log(bytes) / Math.log(k)), 0), sizes.length - 1);
-  return `${parseFloat((bytes / Math.pow(k, i)).toFixed(decimals))} ${sizes[i]}`;
+// ../../packages/core/src/object-storage.ts
+function isAwsS3Endpoint(endpoint2) {
+  return !endpoint2 || endpoint2.includes(".amazonaws.com");
 }
-function withTimeout(promise2, ms, message) {
-  if (!ms) return promise2;
-  return new Promise((resolve, reject) => {
-    const timer = setTimeout(() => reject(new Error(message)), ms);
-    promise2.then(
-      (v) => {
-        clearTimeout(timer);
-        resolve(v);
-      },
-      (e) => {
-        clearTimeout(timer);
-        reject(e);
+
+// ../../packages/core/src/shell-split.ts
+function shellSplitWords(value) {
+  const words = [];
+  let current = "";
+  let quoted = false;
+  let inSingle = false;
+  let inDouble = false;
+  let escaped = false;
+  for (const char of value.trim()) {
+    if (escaped) {
+      current += char;
+      escaped = false;
+      continue;
+    }
+    if (char === "\\" && !inSingle) {
+      escaped = true;
+      continue;
+    }
+    if (char === "'" && !inDouble) {
+      inSingle = !inSingle;
+      quoted = true;
+      continue;
+    }
+    if (char === '"' && !inSingle) {
+      inDouble = !inDouble;
+      quoted = true;
+      continue;
+    }
+    if (/\s/.test(char) && !inSingle && !inDouble) {
+      if (current || quoted) {
+        words.push(current);
+        current = "";
+        quoted = false;
       }
-    );
-  });
+      continue;
+    }
+    current += char;
+  }
+  if (escaped) current += "\\";
+  if (current || quoted) words.push(current);
+  return words;
+}
+function commandToArgv(command) {
+  if (command == null) return null;
+  if (Array.isArray(command)) return command.map((part) => String(part));
+  return shellSplitWords(command);
 }
 
 // ../../packages/core/src/runtime-config.ts
@@ -1977,6 +2133,36 @@ var dashboardRuntimeOrigins = Object.values(DASHBOARD_RUNTIME_TARGETS).flatMap(
   ({ dashboard, api }) => [dashboard, api]
 );
 
+// ../../packages/core/src/resources.ts
+var RESOURCE_TIER_ORDER = ["micro", "low", "medium", "high"];
+var ALL_RESOURCE_TIERS = [
+  "unlimited",
+  ...RESOURCE_TIER_ORDER,
+  "custom"
+];
+var CLOUD_RESOURCE_TIER_IDS = [
+  ...RESOURCE_TIER_ORDER,
+  "custom"
+];
+function hasCpuLimit(r) {
+  return typeof r?.cpuCores === "number" && r.cpuCores > 0;
+}
+function hasMemoryLimit(r) {
+  return typeof r?.memoryMb === "number" && r.memoryMb > 0;
+}
+function formatMemoryMb(mb) {
+  if (!mb || mb <= 0) return "no limit";
+  if (mb >= 1024) return `${(mb / 1024).toFixed(mb % 1024 === 0 ? 0 : 1)} GB`;
+  return `${mb} MB`;
+}
+function formatCpuCores(cores) {
+  if (!cores || cores <= 0) return "no limit";
+  return `${cores} vCPU`;
+}
+
+// ../../packages/core/src/rollback-window.ts
+var ROLLBACK_DISK_BUDGET_CAP_BYTES = 20 * 1024 * 1024 * 1024;
+
 // ../../packages/core/src/workspaces/toml-helpers.ts
 function extractStringArrayFromSection(content, sectionPath, key) {
   const sectionHeader = new RegExp(
@@ -2158,14 +2344,33 @@ var goWorkspaceDetector = {
 };
 
 // ../../packages/core/src/workspaces/gradle.ts
+function readIncludeArgs(content, start) {
+  let i = start;
+  while (content[i] === " " || content[i] === "	") i++;
+  if (content[i] === "(") {
+    let depth = 0;
+    for (let j = i; j < content.length; j++) {
+      if (content[j] === "(") depth++;
+      else if (content[j] === ")" && --depth === 0) return content.slice(i + 1, j);
+    }
+    return content.slice(i + 1);
+  }
+  let args = "";
+  for (; ; ) {
+    const newline = content.indexOf("\n", i);
+    const line = newline === -1 ? content.slice(i) : content.slice(i, newline);
+    args += line;
+    if (newline === -1 || !line.trimEnd().endsWith(",")) return args;
+    i = newline + 1;
+  }
+}
 function parseGradleSettings(content) {
   const cleaned = content.replace(/\/\*[\s\S]*?\*\//g, "").split("\n").map((line) => line.replace(/\/\/.*$/, "")).join("\n");
   const paths = [];
-  const includePattern = /include\s*(?:\(\s*)?((?:[^()\n]+))(?:\))?/g;
+  const includePattern = /\binclude\b/g;
   let match;
   while ((match = includePattern.exec(cleaned)) !== null) {
-    const args = match[1];
-    if (/^Build\b/.test(args)) continue;
+    const args = readIncludeArgs(cleaned, match.index + match[0].length);
     const stringPattern = /"([^"]+)"|'([^']+)'/g;
     let stringMatch;
     while ((stringMatch = stringPattern.exec(args)) !== null) {
@@ -2190,9 +2395,49 @@ var gradleWorkspaceDetector = {
   parseSubProjects: parseGradleSettings
 };
 
+// ../../packages/core/src/workspaces/comments.ts
+function stripJsonComments(content) {
+  let out = "";
+  let inString = false;
+  for (let i = 0; i < content.length; i++) {
+    const ch = content[i];
+    if (inString) {
+      out += ch;
+      if (ch === "\\") {
+        out += content[++i] ?? "";
+        continue;
+      }
+      if (ch === '"') inString = false;
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+      out += ch;
+      continue;
+    }
+    if (ch === "/" && content[i + 1] === "/") {
+      const newline = content.indexOf("\n", i);
+      if (newline === -1) break;
+      i = newline - 1;
+      continue;
+    }
+    if (ch === "/" && content[i + 1] === "*") {
+      const end = content.indexOf("*/", i + 2);
+      if (end === -1) break;
+      i = end + 1;
+      continue;
+    }
+    out += ch;
+  }
+  return out;
+}
+function stripXmlComments(content) {
+  return content.replace(/<!--[\s\S]*?-->/g, "");
+}
+
 // ../../packages/core/src/workspaces/maven.ts
 function parsePomXml(content) {
-  const modulesBlock = content.match(/<modules\b[^>]*>([\s\S]*?)<\/modules>/i);
+  const modulesBlock = stripXmlComments(content).match(/<modules\b[^>]*>([\s\S]*?)<\/modules>/i);
   if (!modulesBlock) return [];
   const moduleEntries = modulesBlock[1].matchAll(/<module\b[^>]*>\s*([\s\S]*?)\s*<\/module>/gi);
   const paths = [];
@@ -2289,7 +2534,7 @@ var uvWorkspaceDetector = {
 function parseRushJson(content) {
   let parsed = null;
   try {
-    parsed = JSON.parse(content);
+    parsed = JSON.parse(stripJsonComments(content));
   } catch {
     return [];
   }
@@ -2367,8 +2612,11 @@ var dockerLanguageDetector = {
 // ../../packages/core/src/languages/elixir.ts
 function parseMixExs2(content) {
   const deps = {};
-  for (const m of content.matchAll(/\{:([\w]+),/g)) {
-    deps[m[1]] = "*";
+  for (const line of content.split("\n")) {
+    if (line.trim().startsWith("#")) continue;
+    for (const m of line.matchAll(/\{:([\w]+),/g)) {
+      deps[m[1]] = "*";
+    }
   }
   return deps;
 }
@@ -2416,6 +2664,34 @@ function clampPort(raw) {
   const port = parseInt(raw, 10);
   return port > 0 && port <= 65535 ? port : null;
 }
+var YAML_PORT_RE = /^port:\s*["']?(\d{2,5})/;
+function springYamlPort(yml) {
+  const inline = yml.match(/^server:\s*\{[^}]*\bport:\s*["']?(\d{2,5})/m);
+  if (inline) return inline[1];
+  let inServer = false;
+  let childIndent = null;
+  for (const raw of yml.split("\n")) {
+    const trimmed2 = raw.trim();
+    if (!trimmed2 || trimmed2.startsWith("#")) continue;
+    const indent = raw.length - raw.trimStart().length;
+    if (inServer) {
+      if (indent > 0) {
+        if (childIndent === null) childIndent = indent;
+        if (indent === childIndent) {
+          const m = trimmed2.match(YAML_PORT_RE);
+          if (m) return m[1];
+        }
+        continue;
+      }
+      inServer = false;
+    }
+    if (indent === 0 && /^server:$/.test(trimmed2)) {
+      inServer = true;
+      childIndent = null;
+    }
+  }
+  return null;
+}
 function detectJavaPort(context) {
   const fc = context.fileContents;
   if (!fc) return null;
@@ -2427,8 +2703,8 @@ function detectJavaPort(context) {
   for (const name of ["application.yml", "application.yaml"]) {
     const yml = fc[name];
     if (!yml) continue;
-    const m = yml.match(/server:[\s\S]*?\bport:\s*["']?(\d{2,5})/) ?? yml.match(/^\s*port:\s*["']?(\d{2,5})/m);
-    if (m) return clampPort(m[1]);
+    const port = springYamlPort(yml) ?? yml.match(/^port:\s*["']?(\d{2,5})/m)?.[1];
+    if (port) return clampPort(port);
   }
   return null;
 }
@@ -2515,11 +2791,30 @@ function parseRequirementsTxt(content) {
   }
   return deps;
 }
+function sliceArrayValue(body, key) {
+  const open = body.match(new RegExp(`(?:^|\\n)\\s*${key}\\s*=\\s*\\[`));
+  if (!open || open.index === void 0) return null;
+  const from = open.index + open[0].length;
+  let depth = 1;
+  let quote = null;
+  for (let i = from; i < body.length; i++) {
+    const char = body[i];
+    if (quote) {
+      if (char === quote) quote = null;
+      continue;
+    }
+    if (char === '"' || char === "'") quote = char;
+    else if (char === "[") depth++;
+    else if (char === "]" && --depth === 0) return body.slice(from, i);
+  }
+  return null;
+}
 function parsePyprojectToml(content) {
   const deps = {};
-  const pep621 = content.match(/\[project\][^[]*?dependencies\s*=\s*\[([\s\S]*?)\]/);
-  if (pep621) {
-    const items = pep621[1].matchAll(/["']([^"']+)["']/g);
+  const project = content.match(/\[project\]([\s\S]*?)(?=\n\[|$)/);
+  const pep621 = project ? sliceArrayValue(project[1], "dependencies") : null;
+  if (pep621 !== null) {
+    const items = pep621.matchAll(/["']([^"']+)["']/g);
     for (const item of items) {
       const m = item[1].match(/^([A-Za-z0-9][A-Za-z0-9._-]*)/);
       if (m) deps[normalizeName(m[1])] = "*";
@@ -2576,8 +2871,11 @@ var pythonLanguageDetector = {
 // ../../packages/core/src/languages/ruby.ts
 function parseGemfile(content) {
   const deps = {};
-  for (const m of content.matchAll(/gem\s+['"]([^'"]+)['"]/g)) {
-    deps[m[1].toLowerCase()] = "*";
+  for (const line of content.split("\n")) {
+    if (line.trim().startsWith("#")) continue;
+    for (const m of line.matchAll(/gem\s+['"]([^'"]+)['"]/g)) {
+      deps[m[1].toLowerCase()] = "*";
+    }
   }
   return deps;
 }
@@ -4060,7 +4358,7 @@ var catalog_default = {
       verified: true,
       id: "minio",
       name: "MinIO",
-      description: "S3-compatible object storage with a web console \u2014 point any S3 client (aws-cli, SDKs) at it.",
+      description: "S3-compatible object storage with a web console \u2014 point any S3 client (aws-cli, SDKs) at it, or bind a bucket straight into another project's uploads.",
       kind: "template",
       logo: "minio",
       category: "database",
@@ -4119,6 +4417,29 @@ var catalog_default = {
           help: "Auto-generated. The S3 admin secret \u2014 shown once after install.",
           generate: "secret",
           secret: true
+        },
+        {
+          key: "OPENSHIP_BUCKET",
+          service: "minio",
+          label: "First bucket",
+          help: "Created on the first deploy so an app can use this storage immediately. More can be added from the console.",
+          type: "text",
+          default: "uploads",
+          required: true
+        }
+      ],
+      prepare: [
+        {
+          service: "minio",
+          command: `mc alias set local http://127.0.0.1:9000 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD" > /dev/null && mc mb --ignore-existing "local/$OPENSHIP_BUCKET" > /dev/null && printf '%s' "$OPENSHIP_BUCKET"`,
+          capture: "bucket",
+          phase: "post-ready",
+          readiness: {
+            test: 'mc alias set local http://127.0.0.1:9000 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"',
+            interval: 1e3,
+            retries: 30
+          },
+          once: true
         }
       ],
       endpoints: [
@@ -4147,21 +4468,54 @@ var catalog_default = {
           {
             id: "endpoint",
             label: "S3 endpoint",
-            source: "publicUrl:minio:9000"
+            source: "publicUrl:minio:9000",
+            service: "minio",
+            envKey: "S3_ENDPOINT",
+            recommended: true
           },
           {
             id: "accessKey",
             label: "Access key",
-            source: "env:minio:MINIO_ROOT_USER"
+            source: "env:minio:MINIO_ROOT_USER",
+            service: "minio",
+            envKey: "S3_ACCESS_KEY_ID",
+            recommended: true
           },
           {
             id: "secretKey",
             label: "Secret key",
             source: "env:minio:MINIO_ROOT_PASSWORD",
-            secret: true
+            service: "minio",
+            envKey: "S3_SECRET_ACCESS_KEY",
+            secret: true,
+            recommended: true
+          },
+          {
+            id: "bucket",
+            label: "Bucket",
+            source: "env:minio:OPENSHIP_BUCKET",
+            service: "minio",
+            envKey: "S3_BUCKET"
           }
-        ]
-      }
+        ],
+        guide: {
+          intro: "Your app gets an S3-compatible bucket it can write uploads to.",
+          useHint: "Bind it from the consuming project's Configuration \u2192 Object storage to get the framework's own env names (Laravel gets FILESYSTEM_DISK + AWS_*), or wire these values by hand.",
+          defaultMode: "internal"
+        }
+      },
+      provides: [
+        {
+          id: "s3",
+          outputRefs: [
+            "endpoint",
+            "accessKey",
+            "secretKey",
+            "bucket"
+          ],
+          category: "database"
+        }
+      ]
     },
     {
       available: true,
@@ -19143,9 +19497,14 @@ export {
   buildOutputTransferExcludes,
   PACKAGE_ROOT_ONLY_EXCLUDES,
   packageManagerEnsureCommand,
+  appVolumeTargets,
+  isAwsS3Endpoint,
   DEFAULT_IMAGE_REGISTRY,
+  shellSplitWords,
+  commandToArgv,
   buildEdgeImageRef,
   SYSTEM,
+  resolveRedirectStatus,
   isValidEmail,
   formatBytes,
   withTimeout,
@@ -19155,6 +19514,10 @@ export {
   LOCAL_DASHBOARD_URL,
   LOCAL_API_URL,
   CLOUD_DASHBOARD_URL,
+  hasCpuLimit,
+  hasMemoryLimit,
+  formatMemoryMb,
+  formatCpuCores,
   parseOpenshipConfigJson,
   missingOutputDirectoryMessage,
   compareSemver,