openship 0.6.5 → 0.6.6

package/dist/chunk-Q7WGTQQ5.js

@@ -0,0 +1,88 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  PACKAGE_ROOT_ONLY_EXCLUDES
+} from "./chunk-UJ6JZM65.js";
+
+// ../../packages/adapters/src/archive.ts
+import { execFile } from "child_process";
+import { mkdtemp, rm, stat, writeFile } from "fs/promises";
+import { tmpdir } from "os";
+import { join } from "path";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+var ROOT_ONLY_EXCLUDES = new Set(PACKAGE_ROOT_ONLY_EXCLUDES);
+var NOOP_CLEANUP = async () => {
+};
+function getTarCreateEnv() {
+  return {
+    ...process.env,
+    COPYFILE_DISABLE: "1",
+    COPY_EXTENDED_ATTRIBUTES_DISABLE: "1"
+  };
+}
+function tarCreateBaseArgs(localPath) {
+  const darwinFlags = process.platform === "darwin" ? ["--no-mac-metadata", "--no-xattrs", "--no-acls", "--no-fflags"] : [];
+  return [...darwinFlags, "-czf", "-", "-C", localPath];
+}
+async function gitTrackedFiles(localPath) {
+  try {
+    const { stdout } = await execFileAsync(
+      "git",
+      ["-C", localPath, "ls-files", "-z", "--cached", "--others", "--exclude-standard"],
+      { maxBuffer: 256 * 1024 * 1024 }
+    );
+    const files = stdout.split("\0").filter(Boolean);
+    return files.length > 0 ? files : null;
+  } catch {
+    return null;
+  }
+}
+async function existingRelativePaths(root, paths) {
+  if (!paths?.length) return [];
+  const found = [];
+  for (const p of paths) {
+    try {
+      await stat(join(root, p));
+      found.push(p);
+    } catch {
+    }
+  }
+  return found;
+}
+async function prepareSourceTarArgs(localPath, options) {
+  if (options?.includes?.length) {
+    return { args: getTarCreateArgs(localPath, options), cleanup: NOOP_CLEANUP };
+  }
+  const files = await gitTrackedFiles(localPath);
+  if (files) {
+    const extra = await existingRelativePaths(localPath, options?.alsoInclude);
+    const entries = extra.length ? [...files, ...extra] : files;
+    const tmpDir = await mkdtemp(join(tmpdir(), "openship-tarlist-"));
+    const listFile = join(tmpDir, "files.null");
+    await writeFile(listFile, entries.join("\0"));
+    const args = [...tarCreateBaseArgs(localPath), "--null", "-T", listFile];
+    return { args, cleanup: () => rm(tmpDir, { recursive: true, force: true }) };
+  }
+  return { args: getTarCreateArgs(localPath, options), cleanup: NOOP_CLEANUP };
+}
+function getTarCreateArgs(localPath, options) {
+  const args = tarCreateBaseArgs(localPath);
+  if (options?.includes?.length) {
+    args.push(...options.includes);
+    return args;
+  }
+  for (const exclude of options?.excludes ?? []) {
+    const pattern = ROOT_ONLY_EXCLUDES.has(exclude) ? `./${exclude}` : exclude;
+    args.push(`--exclude=${pattern}`);
+  }
+  args.push(".");
+  return args;
+}
+
+export {
+  getTarCreateEnv,
+  prepareSourceTarArgs
+};

package/dist/{chunk-VLQ3UIVO.js → chunk-QVW76WDL.js}

@@ -2,14 +2,6 @@
 ":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
-import {
-  edgeDownExplanation,
-  explainEdgeDown,
-  isEdgeDownFailure
-} from "./chunk-I3DPMTSF.js";
-import {
-  edgeFailureReason
-} from "./chunk-WE7BXW6L.js";
 import {
   ACME_CHALLENGE_LOCATION,
   ACME_HTTP01_PORT,
@@ -26,14 +18,25 @@ import {
   edgeChallengeVhostConf,
   isCloudFrontedHost,
   luaSourceAvailable
-} from "./chunk-PZRRL5PC.js";
+} from "./chunk-RSR7PFIQ.js";
+import {
+  edgeDownExplanation,
+  explainEdgeDown,
+  isEdgeDownFailure
+} from "./chunk-I3DPMTSF.js";
 import {
   EXECUTOR_DELEGATE
-} from "./chunk-WFRXYWK2.js";
+} from "./chunk-UVNMQM7W.js";
 import {
   logEntry,
   sq
 } from "./chunk-ZFJXPCQP.js";
+import {
+  edgeFailureReason
+} from "./chunk-2YM3NI2E.js";
+import {
+  probeListeningPort
+} from "./chunk-SM26HDS2.js";
 import {
   PROXY_DIRECTIVES,
   parseProxyValue,
@@ -41,7 +44,7 @@ import {
   resolveRedirectStatus,
   safeErrorMessage,
   sanitizeProxySettings
-} from "./chunk-LEYSL46B.js";
+} from "./chunk-UJ6JZM65.js";
 
 // ../../packages/adapters/src/infra/nginx.ts
 import {
@@ -321,14 +324,15 @@ var PROXY_HEADERS = `proxy_set_header Host $host;
         proxy_set_header X-Forwarded-Proto $openship_fwd_proto;
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";`;
+        proxy_set_header Connection "upgrade";
+        proxy_pass_header X-Accel-Buffering;`;
 var FORWARD_VARS = `    set $openship_fwd_proto $scheme;
     set $openship_redirect_https 1;
     if ($http_x_forwarded_proto = "https") {
         set $openship_fwd_proto https;
         set $openship_redirect_https 0;
     }`;
-var VHOST_GENERATION = 1;
+var VHOST_GENERATION = 2;
 var GENERATION_MARKER = `# openship-vhost-gen: ${VHOST_GENERATION}`;
 var GENERATED_HEADER = `# Auto-generated by Openship - do not edit manually
 ${GENERATION_MARKER}`;
@@ -638,6 +642,11 @@ function assertValidStaticRoot(root, opts) {
   }
 }
 var execFileAsync = promisify(cpExecFile);
+function isAcmePortBindFailure(output) {
+  return /could not bind (?:tcp )?port|address already in use|problem binding to port/i.test(
+    output || ""
+  );
+}
 function summarizeCertbotFailure(output, domain) {
   const edgeDown = edgeDownExplanation(output);
   if (edgeDown) return edgeDown;
@@ -654,7 +663,9 @@ function certbotDiagnosis(output, domain) {
   const challengeUrl = pick(/https?:\/\/\S*\.well-known\/acme-challenge\/\S*/i);
   const redirectedToHttps = /^https:/i.test(challengeUrl ?? "");
   let diagnosis;
-  if (/timeout during connect|connection refused|failed to connect|Timeout/i.test(text)) {
+  if (isAcmePortBindFailure(text)) {
+    diagnosis = `Couldn't start the certificate challenge listener for ${domain} on port ${ACME_HTTP01_PORT}: something on this server is already holding it. That port is used only while a certificate is being issued, so this is almost always a certificate run from an earlier attempt that hasn't exited \u2014 retry, and if it persists find the holder with \`ss -ltnp | grep ${ACME_HTTP01_PORT}\` and stop it. Nothing was requested from Let's Encrypt, so this is not a DNS or routing problem.`;
+  } else if (/timeout during connect|connection refused|failed to connect|Timeout/i.test(text)) {
     diagnosis = `Port 80 for ${domain} isn't reachable from the internet \u2014 a firewall / cloud security group is blocking it, the domain doesn't point at this server, or another proxy is still bound to :80.`;
   } else if (/NXDOMAIN|no\s+(A|AAAA)\s+record|DNS problem|could not be resolved|no records? found/i.test(text)) {
     diagnosis = `${domain} doesn't resolve to this server yet \u2014 the DNS A record is missing or hasn't propagated. Wait for propagation, then retry from the Domains tab.`;
@@ -1450,18 +1461,24 @@ ${serveLocation}
   /**
    * Provision a TLS certificate using certbot.
    *
-   * Runs `certbot certonly` in webroot mode using the ACME challenge
-   * directory served by OpenResty, then rewrites the config to include
-   * SSL and reloads.
+   * HTTP-01 ONLY — there is no DNS-01 path anywhere in this file, and the DNS credentials the
+   * product stores are for record MANAGEMENT, not for challenges.
+   *
+   * The authenticator is `--standalone` on {@link ACME_HTTP01_PORT} (a loopback alt-port), with
+   * the edge proxying `/.well-known/acme-challenge/` to it — see `ACME_CHALLENGE_LOCATION`. So
+   * Let's Encrypt fetches the challenge over :80 from OpenResty, which forwards it to certbot's
+   * transient listener. No port-80 fight, no webroot directory to keep in sync, and zero
+   * downtime: certbot holds that port only while issuing.
+   *
+   * THIS COMMENT USED TO DESCRIBE `--webroot`, and argued that `--standalone` was dead code
+   * because "certbot --standalone binds to port 80 itself, but OpenResty already owns 80". That
+   * was true of plain `--standalone`, and it is exactly the problem `--http-01-port` solves —
+   * the two sat contradicting each other in one file, with the doc describing a mechanism the
+   * code below had stopped using. Left recorded because the stale version's reasoning is
+   * persuasive enough to "fix" the code back.
    *
-   * Only --webroot is attempted. The previous --standalone fallback was
-   * dead code on any normal install: certbot --standalone binds to port
-   * 80 itself, but OpenResty already owns 80 on the same box, so the
-   * fallback would always fail with EADDRINUSE — amplifying a transient
-   * --webroot failure into an immediate hard error. The caller
-   * (route-registration.ts) already wraps provisionCert in try/catch so
-   * a webroot failure becomes a "deploy continues on HTTP, retry from
-   * Domains tab" warning instead of a deploy abort.
+   * The caller (route-registration.ts) wraps this in try/catch, so a failure becomes a "deploy
+   * continues on HTTP, retry from the Domains tab" warning rather than a deploy abort.
    */
   async provisionCert(domain, opts) {
     assertValidDomain(domain);
@@ -1493,7 +1510,15 @@ ${serveLocation}
         ...opts?.force ? ["--force-renewal"] : []
       ], opts?.onLog);
     } catch (err) {
-      throw new Error(summarizeCertbotFailure(this.redactAcmeSecrets(safeErrorMessage(err)), domain));
+      const raw = this.redactAcmeSecrets(safeErrorMessage(err));
+      let summary = summarizeCertbotFailure(raw, domain);
+      if (isAcmePortBindFailure(raw) && this.executor) {
+        const occupant = await probeListeningPort(this.executor, ACME_HTTP01_PORT).catch(() => null);
+        if (occupant) {
+          summary += ` Currently held by ${occupant.command}` + (occupant.pid !== null ? ` (pid ${occupant.pid})` : "") + (occupant.systemdUnit ? ` via ${occupant.systemdUnit}` : "") + `.`;
+        }
+      }
+      throw new Error(summary);
     } finally {
       if (eabConfig) await this._rm(dirname(eabConfig)).catch(() => void 0);
     }
@@ -1965,6 +1990,7 @@ export {
   acmeKeyArgs,
   assertValidChallengeToken,
   MANAGED_STATIC_BASE,
+  isAcmePortBindFailure,
   summarizeCertbotFailure,
   NginxProvider
 };

package/dist/{chunk-PZRRL5PC.js → chunk-RSR7PFIQ.js}

@@ -5,10 +5,10 @@ const require = __ospCreateRequire(import.meta.url);
 import {
   envOps,
   opScript
-} from "./chunk-EZPPTWJQ.js";
+} from "./chunk-YMMQRE5J.js";
 import {
   resolveEnvironment
-} from "./chunk-WFRXYWK2.js";
+} from "./chunk-UVNMQM7W.js";
 import {
   sq
 } from "./chunk-ZFJXPCQP.js";
@@ -17,7 +17,7 @@ import {
   answered,
   refused,
   safeErrorMessage
-} from "./chunk-LEYSL46B.js";
+} from "./chunk-UJ6JZM65.js";
 
 // ../../packages/adapters/src/infra/openresty-lua.ts
 import { createHash, randomBytes } from "crypto";
@@ -248,6 +248,7 @@ var OPENRESTY_MGMT_PORT = 9145;
 var OPENRESTY_SITE_LUALIB = OPENRESTY_LUA_DIR.replace(/\/[^/]+$/, "");
 var EDGE_LUA_PACKAGE_PATH = `${OPENRESTY_SITE_LUALIB}/?.lua;;`;
 var EDGE_SERVER_NAMES_HASH_BUCKET_SIZE = 128;
+var EDGE_CLIENT_MAX_BODY_SIZE = "50m";
 var EDGE_SHARED_DICTS = [
   /** Analytics counters. */
   { name: "analytics", size: "256m" },
@@ -440,6 +441,12 @@ async function ensureOpenRestyConfig(executor, paths) {
       );
     }
   }
+  const hasBodySize = await executor.exec(`grep -qE '^[[:space:]]*client_max_body_size' ${paths.confPath}`).then(() => true).catch(() => false);
+  if (!hasBodySize) {
+    await executor.exec(
+      `sed -i '/http *{/a \\    client_max_body_size ${EDGE_CLIENT_MAX_BODY_SIZE};' ${paths.confPath}`
+    );
+  }
 }
 function MINIMAL_NGINX_CONF(confDir, sitesDir) {
   return `# Auto-generated by Openship - safe to extend
@@ -456,6 +463,9 @@ http {
     # \`nginx -t\` outright for any server_name past ~63 chars, refusing the reload
     # and wedging every route on the box, not just the long one.
     server_names_hash_bucket_size ${EDGE_SERVER_NAMES_HASH_BUCKET_SIZE};
+    # See EDGE_CLIENT_MAX_BODY_SIZE \u2014 nginx's 1 MB default 413s an upload before the app
+    # ever sees it. A project's own value overrides this (server beats http).
+    client_max_body_size ${EDGE_CLIENT_MAX_BODY_SIZE};
     include ${sitesDir}/*.conf;
 }
 `;
@@ -715,6 +725,7 @@ export {
   OPENRESTY_MGMT_PORT,
   EDGE_LUA_PACKAGE_PATH,
   EDGE_SERVER_NAMES_HASH_BUCKET_SIZE,
+  EDGE_CLIENT_MAX_BODY_SIZE,
   EDGE_SHARED_DICTS,
   parseNginxVersion,
   OPENRESTY_DEFAULT_PATHS,

package/dist/{chunk-A7EWM2KA.js → chunk-SM26HDS2.js}

@@ -7,7 +7,7 @@ import {
   isRemoteConnectionError,
   safeErrorMessage,
   systemDebug
-} from "./chunk-LEYSL46B.js";
+} from "./chunk-UJ6JZM65.js";
 
 // ../../packages/adapters/src/system/probe-exec.ts
 async function tryExec(executor, command, opts) {