openship 0.6.5 → 0.6.7

package/dist/chunk-XRNRT37W.js

@@ -1,316 +0,0 @@
-#!/usr/bin/env sh
-":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
-import { createRequire as __ospCreateRequire } from "node:module";
-const require = __ospCreateRequire(import.meta.url);
-import {
-  composeHostChannel,
-  composeHostChannelExpected,
-  composePaths,
-  thisHost
-} from "./chunk-QLX7NBEA.js";
-import {
-  HOST_CHANNEL_BLOCKED,
-  HOST_CHANNEL_NOT_PROVISIONED,
-  HOST_CHANNEL_OPT_OUT,
-  HOST_CHANNEL_RECHECK,
-  HOST_CHANNEL_SYMPTOM,
-  HOST_CHANNEL_UNAFFECTED,
-  HOST_CHANNEL_UNPROVISIONED,
-  explainHostChannelCause,
-  firewallAllowSteps,
-  firewallManager,
-  firewallPersists,
-  hostChannelRuleScope,
-  hostFirewallRule,
-  hostFirewallRuleRemoval,
-  wrapText
-} from "./chunk-LEYSL46B.js";
-
-// src/lib/host-channel-preflight.ts
-import { spawnSync } from "child_process";
-import chalk from "chalk";
-import { confirm, isCancel } from "@clack/prompts";
-var INDENT = "  ";
-function dimWrapped(text, width = 84) {
-  return wrapText(text, width).map((l) => chalk.dim(`${INDENT}${l}
-`)).join("");
-}
-function blockedTail() {
-  return "\n" + dimWrapped(HOST_CHANNEL_RECHECK) + dimWrapped(HOST_CHANNEL_OPT_OUT);
-}
-var PROBE_SCRIPT = `const net = require("node:net");
-const s = net.connect({ host: process.env.OPENSHIP_PROBE_HOST, port: Number(process.env.OPENSHIP_PROBE_PORT) });
-const done = (m) => { console.log("openship-probe:" + m); try { s.destroy(); } catch {} process.exit(0); };
-s.setTimeout(Number(process.env.OPENSHIP_PROBE_TIMEOUT || 4000));
-s.on("connect", () => done("open"));
-s.on("timeout", () => done("timeout"));
-s.on("error", (e) => done("error:" + (e && e.code ? e.code : String(e && e.message))));`;
-async function realProbe(host, port) {
-  const r = spawnSync(
-    "docker",
-    [
-      "compose",
-      "-f",
-      composePaths.file,
-      "exec",
-      "-T",
-      "-e",
-      `OPENSHIP_PROBE_HOST=${host}`,
-      "-e",
-      `OPENSHIP_PROBE_PORT=${port}`,
-      "api",
-      "bun",
-      "-e",
-      PROBE_SCRIPT
-    ],
-    { cwd: composePaths.dir, encoding: "utf8", timeout: 3e4 }
-  );
-  const token = (r.stdout || "").match(/openship-probe:(\S+)/)?.[1];
-  if (!token) {
-    const why = (r.stderr || r.stdout || r.error?.message || "").trim().split("\n").pop();
-    return { code: "unavailable", detail: why || void 0 };
-  }
-  if (token === "open" || token === "timeout") return { code: token };
-  const errno = token.startsWith("error:") ? token.slice("error:".length) : token;
-  if (errno === "ECONNREFUSED" || errno === "ECONNRESET") return { code: "refused", detail: errno };
-  if (errno === "ENOTFOUND" || errno === "EAI_AGAIN") return { code: "unresolved", detail: errno };
-  if (errno === "ENETUNREACH" || errno === "EHOSTUNREACH" || errno === "EHOSTDOWN") {
-    return { code: "no_route", detail: errno };
-  }
-  return { code: "error", detail: errno };
-}
-function realSourceCidrs() {
-  const id = spawnSync("docker", ["compose", "-f", composePaths.file, "ps", "-q", "api"], {
-    cwd: composePaths.dir,
-    encoding: "utf8"
-  }).stdout?.trim().split("\n")[0];
-  if (!id) return [];
-  const nets = spawnSync(
-    "docker",
-    ["inspect", id, "--format", "{{range $k, $v := .NetworkSettings.Networks}}{{$k}}\n{{end}}"],
-    { encoding: "utf8" }
-  ).stdout;
-  const cidrs = /* @__PURE__ */ new Set();
-  for (const net of (nets || "").split("\n").map((n) => n.trim()).filter(Boolean)) {
-    const subnets = spawnSync(
-      "docker",
-      ["network", "inspect", net, "--format", "{{range .IPAM.Config}}{{.Subnet}}\n{{end}}"],
-      { encoding: "utf8" }
-    ).stdout;
-    for (const s of (subnets || "").split("\n").map((v) => v.trim())) {
-      if (/^\d+\.\d+\.\d+\.\d+\/\d+$/.test(s)) cidrs.add(s);
-    }
-  }
-  return [...cidrs];
-}
-function sudoPrefix() {
-  if (typeof process.getuid === "function" && process.getuid() === 0) return [];
-  return process.stdin.isTTY ? ["sudo"] : ["sudo", "-n"];
-}
-function realApplyRule(fw, cidrs, port) {
-  const steps = firewallAllowSteps(fw, hostChannelRuleScope(cidrs, port));
-  if (!steps.supported) return { ok: false, detail: steps.reason };
-  for (const step of steps.value) {
-    const [cmd, ...rest] = [...sudoPrefix(), "sh", "-c", step];
-    const r = spawnSync(cmd, rest, { encoding: "utf8", stdio: ["inherit", "pipe", "pipe"] });
-    if (r.status !== 0) {
-      return { ok: false, detail: (r.stderr || r.stdout || "").trim().split("\n").pop() };
-    }
-  }
-  return { ok: true };
-}
-function defaultDeps() {
-  return {
-    platform: process.platform,
-    interactive: Boolean(process.stdin.isTTY && process.stdout.isTTY),
-    channel: composeHostChannel,
-    expected: composeHostChannelExpected,
-    probe: realProbe,
-    sourceCidrs: realSourceCidrs,
-    // All three off the one resolver, which measures this box once. This file used to
-    // run its own `command -v ufw` + `ufw status` ladder, so the CLI and the API could
-    // reach different conclusions about the same host — and it had no way at all to
-    // report nftables, the RHEL-family default.
-    firewall: () => thisHost().profile.firewall,
-    distroFamily: () => thisHost().profile.distroFamily,
-    sshdEnableHint: () => thisHost().sshdEnableHint(),
-    applyRule: realApplyRule,
-    confirmOpen: async ({ rule, port }) => {
-      const ok = await confirm({
-        message: `Open the host firewall so containers can reach port ${port}?`,
-        // Never default-yes: this edits the host's firewall.
-        initialValue: false
-      });
-      return !isCancel(ok) && ok === true;
-    },
-    print: (text) => console.log(text)
-  };
-}
-function impactLines() {
-  return dimWrapped(HOST_CHANNEL_UNAFFECTED) + chalk.dim(`${INDENT}Blocked until the channel works:
-`) + HOST_CHANNEL_BLOCKED.map((l) => chalk.dim(`${INDENT}  \xB7 ${l}
-`)).join("") + dimWrapped(HOST_CHANNEL_SYMPTOM);
-}
-function causeOf(code) {
-  switch (code) {
-    case "timeout":
-    case "refused":
-    case "unresolved":
-    case "no_route":
-    case "error":
-      return code;
-    default:
-      return null;
-  }
-}
-function diagnose(target, probe, sshdEnableHint) {
-  const cause = causeOf(probe.code);
-  if (!cause) {
-    return {
-      firewall: false,
-      text: chalk.yellow(`${INDENT}${target} \u2014 ${probe.detail || "the connection failed"}
-`)
-    };
-  }
-  const { headline, body, firewallShaped } = explainHostChannelCause(cause, {
-    target,
-    host: target.split(":")[0],
-    detail: probe.detail,
-    sshdEnableHint
-  });
-  return {
-    firewall: firewallShaped,
-    text: chalk.yellow(`${INDENT}${headline}
-
-`) + (body ? dimWrapped(body) : "")
-  };
-}
-async function checkHostChannel(overrides = {}) {
-  const deps = { ...defaultDeps(), ...overrides };
-  if (deps.platform !== "linux") return { configured: false };
-  const channel = deps.channel();
-  if (!channel) return { configured: false, unprovisioned: deps.expected() };
-  const probe = await deps.probe(channel.host, channel.port);
-  return {
-    configured: true,
-    target: `${channel.host}:${channel.port}`,
-    code: probe.code,
-    detail: probe.detail
-  };
-}
-async function verifyHostChannel(opts = {}, overrides = {}) {
-  const deps = { ...defaultDeps(), ...overrides };
-  if (deps.platform !== "linux") return { status: "skipped" };
-  const channel = deps.channel();
-  if (!channel) {
-    if (!deps.expected()) return { status: "skipped" };
-    deps.print(
-      chalk.yellow(`
-${INDENT}Host control was not provisioned on this box.
-
-`) + dimWrapped(HOST_CHANNEL_UNPROVISIONED) + "\n" + impactLines() + // The remedy, not a firewall rule: nothing was dialed, so no packet filter has
-      // been established — the same line core's `firewallShaped` draws. It carries the
-      // recheck command itself, so `blockedTail` would only repeat it.
-      chalk.dim(`
-${INDENT}Fix:
-`) + dimWrapped(HOST_CHANNEL_NOT_PROVISIONED) + dimWrapped(HOST_CHANNEL_OPT_OUT)
-    );
-    return { status: "unprovisioned" };
-  }
-  const target = `${channel.host}:${channel.port}`;
-  const probe = await deps.probe(channel.host, channel.port);
-  if (probe.code === "open") return { status: "ok", code: "open" };
-  if (probe.code === "unavailable") {
-    deps.print(
-      chalk.dim(
-        `
-${INDENT}Couldn't check the host channel from the api container${probe.detail ? ` (${probe.detail})` : ""}.
-${INDENT}Verify it later with \`openship doctor\`.
-`
-      )
-    );
-    return { status: "skipped", code: "unavailable" };
-  }
-  const { text, firewall: firewallShaped } = diagnose(target, probe, deps.sshdEnableHint());
-  deps.print(
-    chalk.yellow(`
-${INDENT}Host control is configured, but the api container can't reach it.
-
-`) + text + "\n" + impactLines()
-  );
-  if (!firewallShaped) {
-    deps.print(blockedTail());
-    return { status: "blocked", code: probe.code };
-  }
-  const cidrs = deps.sourceCidrs();
-  const firewall = deps.firewall();
-  const rule = hostFirewallRule(firewall, cidrs, channel.port, deps.distroFamily());
-  const ruleBlock = chalk.dim(`
-${INDENT}Rule to allow it${cidrs.length ? "" : ` (docker's default pool \u2014 the exact subnet couldn't be read)`}:
-`) + rule.split("\n").map((l) => `${INDENT}  ${chalk.cyan(l)}`).join("\n") + "\n";
-  const offerOnly = (why) => {
-    deps.print(ruleBlock + "\n" + dimWrapped(why) + blockedTail());
-    return { status: "blocked", code: probe.code, rule };
-  };
-  const manager = firewallManager(firewall);
-  if (!manager.supported) return offerOnly(manager.reason);
-  if (!firewallPersists(firewall)) {
-    return offerOnly(
-      `Openship won't add this ${firewall} rule for you: it lives in the running ruleset only, so it would not survive a reboot unless something saves it \u2014 and where that is depends on this box. A rule that quietly disappears is worse than one you installed knowing where it lives.`
-    );
-  }
-  deps.print(ruleBlock);
-  const consented = opts.openFirewall ? true : deps.interactive ? await deps.confirmOpen({ rule, port: channel.port }) : false;
-  if (!consented) {
-    deps.print(
-      chalk.dim(
-        `
-${INDENT}Left the firewall alone \u2014 apply the rule above when you're ready.
-` + (deps.interactive ? "" : `${INDENT}To have \`openship up\` add it for you: --open-host-firewall
-`)
-      ) + blockedTail()
-    );
-    return { status: "blocked", code: probe.code, rule };
-  }
-  const applied = deps.applyRule(manager.value, cidrs, channel.port);
-  if (!applied.ok) {
-    deps.print(
-      chalk.red(
-        `
-${INDENT}Couldn't add the rule${applied.detail ? `: ${applied.detail}` : "."}
-`
-      ) + chalk.dim(`${INDENT}Run it yourself with the command above.
-`) + blockedTail()
-    );
-    return { status: "blocked", code: probe.code, rule };
-  }
-  const again = await deps.probe(channel.host, channel.port);
-  if (again.code === "open") {
-    deps.print(chalk.green(`
-${INDENT}Opened \u2014 the host channel is reachable.
-`));
-    return { status: "fixed", code: "open", rule };
-  }
-  deps.print(
-    chalk.yellow(`
-${INDENT}Rule added, but ${target} still isn't reachable.
-
-`) + (again.code === probe.code ? chalk.dim(
-      `${INDENT}Nothing changed, so something ahead of ${firewall} is dropping it \u2014 check
-${INDENT}the DOCKER-USER chain and any cloud/provider firewall.
-`
-    ) : diagnose(target, again, deps.sshdEnableHint()).text) + // The rule is a host change made on the premise that it was the blocker, so it
-    // must not be left invisible. It is deliberately NOT reverted for us: a failure
-    // that changed shape means the rule did something, and it may well be needed
-    // once the real cause is fixed.
-    chalk.dim(`
-${INDENT}The rule is in place; to undo it:
-`) + hostFirewallRuleRemoval(firewall, cidrs, channel.port).split("\n").map((l) => `${INDENT}  ${chalk.cyan(l)}`).join("\n") + "\n" + blockedTail()
-  );
-  return { status: "blocked", code: again.code, rule };
-}
-
-export {
-  checkHostChannel,
-  verifyHostChannel
-};

package/dist/cloud-3DODOWTR.js

@@ -1,36 +0,0 @@
-#!/usr/bin/env sh
-":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
-import { createRequire as __ospCreateRequire } from "node:module";
-const require = __ospCreateRequire(import.meta.url);
-import {
-  CloudRuntime,
-  HostBuildForbiddenError,
-  PAGE_CONTAINER_PREFIX,
-  isHostBuildForbiddenError,
-  provisionCloudWorkspace
-} from "./chunk-3ZAGC5NT.js";
-import "./chunk-7334NSJL.js";
-import "./chunk-VLQ3UIVO.js";
-import "./chunk-I3DPMTSF.js";
-import "./chunk-LFCSC4IU.js";
-import "./chunk-MSZUCNPV.js";
-import "./chunk-TM2IQPYU.js";
-import "./chunk-VHMOQL5Y.js";
-import "./chunk-5OUWIPOB.js";
-import "./chunk-6FH4AXVY.js";
-import "./chunk-RFWJE7ZN.js";
-import "./chunk-WE7BXW6L.js";
-import "./chunk-A7EWM2KA.js";
-import "./chunk-PZRRL5PC.js";
-import "./chunk-EZPPTWJQ.js";
-import "./chunk-WFRXYWK2.js";
-import "./chunk-ZFJXPCQP.js";
-import "./chunk-LEYSL46B.js";
-import "./chunk-PXKCZB2I.js";
-export {
-  CloudRuntime,
-  HostBuildForbiddenError,
-  PAGE_CONTAINER_PREFIX,
-  isHostBuildForbiddenError,
-  provisionCloudWorkspace
-};

package/dist/edge-import-MCJNVTZ2.js

@@ -1,51 +0,0 @@
-#!/usr/bin/env sh
-":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
-import { createRequire as __ospCreateRequire } from "node:module";
-const require = __ospCreateRequire(import.meta.url);
-import {
-  importMigratedSites,
-  waitForApiHealth,
-  waitForEdgeRunning
-} from "./chunk-6HOA5JT7.js";
-import "./chunk-QLX7NBEA.js";
-import "./chunk-QWHBRY2K.js";
-import "./chunk-ELGRMZOW.js";
-import "./chunk-ONKEYSMY.js";
-import "./chunk-XZYFZ6A5.js";
-import "./chunk-PDW4L3NV.js";
-import "./chunk-DOD2BXHQ.js";
-import "./chunk-42WQABXM.js";
-import "./chunk-DRK3MEDS.js";
-import "./chunk-3NQQXMDR.js";
-import "./chunk-ZWLDLTJP.js";
-import "./chunk-6JELW75A.js";
-import "./chunk-3ZAGC5NT.js";
-import "./chunk-WNWQBB7F.js";
-import "./chunk-2GWYYHOR.js";
-import "./chunk-RXQBD4ZY.js";
-import "./chunk-XVOBL7BC.js";
-import "./chunk-7334NSJL.js";
-import "./chunk-VLQ3UIVO.js";
-import "./chunk-I3DPMTSF.js";
-import "./chunk-VDESJSG6.js";
-import "./chunk-LFCSC4IU.js";
-import "./chunk-GRTXMUHA.js";
-import "./chunk-MSZUCNPV.js";
-import "./chunk-TM2IQPYU.js";
-import "./chunk-VHMOQL5Y.js";
-import "./chunk-5OUWIPOB.js";
-import "./chunk-6FH4AXVY.js";
-import "./chunk-RFWJE7ZN.js";
-import "./chunk-WE7BXW6L.js";
-import "./chunk-A7EWM2KA.js";
-import "./chunk-PZRRL5PC.js";
-import "./chunk-EZPPTWJQ.js";
-import "./chunk-WFRXYWK2.js";
-import "./chunk-ZFJXPCQP.js";
-import "./chunk-LEYSL46B.js";
-import "./chunk-PXKCZB2I.js";
-export {
-  importMigratedSites,
-  waitForApiHealth,
-  waitForEdgeRunning
-};

package/dist/host-channel-preflight-MUXE3KZU.js

@@ -1,49 +0,0 @@
-#!/usr/bin/env sh
-":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
-import { createRequire as __ospCreateRequire } from "node:module";
-const require = __ospCreateRequire(import.meta.url);
-import {
-  checkHostChannel,
-  verifyHostChannel
-} from "./chunk-XRNRT37W.js";
-import "./chunk-QLX7NBEA.js";
-import "./chunk-QWHBRY2K.js";
-import "./chunk-ELGRMZOW.js";
-import "./chunk-ONKEYSMY.js";
-import "./chunk-XZYFZ6A5.js";
-import "./chunk-PDW4L3NV.js";
-import "./chunk-DOD2BXHQ.js";
-import "./chunk-42WQABXM.js";
-import "./chunk-DRK3MEDS.js";
-import "./chunk-3NQQXMDR.js";
-import "./chunk-ZWLDLTJP.js";
-import "./chunk-6JELW75A.js";
-import "./chunk-3ZAGC5NT.js";
-import "./chunk-WNWQBB7F.js";
-import "./chunk-2GWYYHOR.js";
-import "./chunk-RXQBD4ZY.js";
-import "./chunk-XVOBL7BC.js";
-import "./chunk-7334NSJL.js";
-import "./chunk-VLQ3UIVO.js";
-import "./chunk-I3DPMTSF.js";
-import "./chunk-VDESJSG6.js";
-import "./chunk-LFCSC4IU.js";
-import "./chunk-GRTXMUHA.js";
-import "./chunk-MSZUCNPV.js";
-import "./chunk-TM2IQPYU.js";
-import "./chunk-VHMOQL5Y.js";
-import "./chunk-5OUWIPOB.js";
-import "./chunk-6FH4AXVY.js";
-import "./chunk-RFWJE7ZN.js";
-import "./chunk-WE7BXW6L.js";
-import "./chunk-A7EWM2KA.js";
-import "./chunk-PZRRL5PC.js";
-import "./chunk-EZPPTWJQ.js";
-import "./chunk-WFRXYWK2.js";
-import "./chunk-ZFJXPCQP.js";
-import "./chunk-LEYSL46B.js";
-import "./chunk-PXKCZB2I.js";
-export {
-  checkHostChannel,
-  verifyHostChannel
-};

package/dist/setup-WUUZURHS.js

@@ -1,22 +0,0 @@
-#!/usr/bin/env sh
-":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
-import { createRequire as __ospCreateRequire } from "node:module";
-const require = __ospCreateRequire(import.meta.url);
-import {
-  SystemManager
-} from "./chunk-XVOBL7BC.js";
-import "./chunk-7334NSJL.js";
-import "./chunk-VLQ3UIVO.js";
-import "./chunk-I3DPMTSF.js";
-import "./chunk-RFWJE7ZN.js";
-import "./chunk-WE7BXW6L.js";
-import "./chunk-A7EWM2KA.js";
-import "./chunk-PZRRL5PC.js";
-import "./chunk-EZPPTWJQ.js";
-import "./chunk-WFRXYWK2.js";
-import "./chunk-ZFJXPCQP.js";
-import "./chunk-LEYSL46B.js";
-import "./chunk-PXKCZB2I.js";
-export {
-  SystemManager
-};

package/dist/up-XEO3SR6Z.js

@@ -1,58 +0,0 @@
-#!/usr/bin/env sh
-":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
-import { createRequire as __ospCreateRequire } from "node:module";
-const require = __ospCreateRequire(import.meta.url);
-import {
-  ensureInternalToken,
-  normalizeUrl,
-  runHeadlessProvision,
-  startService,
-  upCommand
-} from "./chunk-7S4USQYF.js";
-import "./chunk-6HOA5JT7.js";
-import "./chunk-HPXP6LXZ.js";
-import "./chunk-XRNRT37W.js";
-import "./chunk-QLX7NBEA.js";
-import "./chunk-QWHBRY2K.js";
-import "./chunk-ELGRMZOW.js";
-import "./chunk-ONKEYSMY.js";
-import "./chunk-XZYFZ6A5.js";
-import "./chunk-PDW4L3NV.js";
-import "./chunk-DOD2BXHQ.js";
-import "./chunk-42WQABXM.js";
-import "./chunk-DRK3MEDS.js";
-import "./chunk-3NQQXMDR.js";
-import "./chunk-ZWLDLTJP.js";
-import "./chunk-6JELW75A.js";
-import "./chunk-3ZAGC5NT.js";
-import "./chunk-WNWQBB7F.js";
-import "./chunk-2GWYYHOR.js";
-import "./chunk-RXQBD4ZY.js";
-import "./chunk-XVOBL7BC.js";
-import "./chunk-7334NSJL.js";
-import "./chunk-VLQ3UIVO.js";
-import "./chunk-I3DPMTSF.js";
-import "./chunk-VDESJSG6.js";
-import "./chunk-LFCSC4IU.js";
-import "./chunk-GRTXMUHA.js";
-import "./chunk-MSZUCNPV.js";
-import "./chunk-TM2IQPYU.js";
-import "./chunk-VHMOQL5Y.js";
-import "./chunk-5OUWIPOB.js";
-import "./chunk-6FH4AXVY.js";
-import "./chunk-RFWJE7ZN.js";
-import "./chunk-WE7BXW6L.js";
-import "./chunk-A7EWM2KA.js";
-import "./chunk-PZRRL5PC.js";
-import "./chunk-EZPPTWJQ.js";
-import "./chunk-WFRXYWK2.js";
-import "./chunk-ZFJXPCQP.js";
-import "./chunk-LEYSL46B.js";
-import "./chunk-PXKCZB2I.js";
-export {
-  ensureInternalToken,
-  normalizeUrl,
-  runHeadlessProvision,
-  startService,
-  upCommand
-};