openship 0.6.6 → 0.6.7

package/dist/{chunk-LFE5KQ7Y.js → chunk-S6B2Z3OO.js}

@@ -7,42 +7,59 @@ import {
   resolveProjectDir,
   resolveStaticOutputPath,
   runLocalBuild
-} from "./chunk-YIMOCZBZ.js";
+} from "./chunk-MEE6OZFP.js";
+import {
+  isArtifactPathRef,
+  removeManagedArtifact
+} from "./chunk-WU54BXFE.js";
 import {
   BuildCancelledError,
   BuildLogger,
   detectBuildKillHint,
+  droppedRuntimeEnvMessage,
+  isExcludedDocRootEntry,
   killProcessesUnderDir,
   parseLogLevel,
   runBuildPipeline,
+  splitRuntimeEnv,
   sq,
   transferLocalDirectory
-} from "./chunk-LH2PLRQO.js";
+} from "./chunk-H4FS5BED.js";
 import {
   LocalExecutor
-} from "./chunk-6FH4AXVY.js";
+} from "./chunk-E2X26PXR.js";
 import {
   privilegedExecutor
-} from "./chunk-4I2BM2DT.js";
+} from "./chunk-PVP4RGWT.js";
 import {
   HOST_STATE_DIR,
   envOps,
   hostRefusal,
   opScript
-} from "./chunk-YMMQRE5J.js";
+} from "./chunk-BLEXTYRK.js";
 import {
   ensureOwnedDir,
   resolveEnvironment
-} from "./chunk-UVNMQM7W.js";
+} from "./chunk-FZ6QCF6B.js";
 import {
   sq as sq2,
   wrapLocalBuildCommand
-} from "./chunk-ZFJXPCQP.js";
+} from "./chunk-H3WT3A6R.js";
+import {
+  portOccupantDetails,
+  probeListeningPort
+} from "./chunk-VSTFHUCV.js";
 import {
+  managedDeploymentUnitName,
   probeExec,
-  probeListeningPort,
   withReason
-} from "./chunk-SM26HDS2.js";
+} from "./chunk-UWEV6XTS.js";
+import {
+  formatDuration,
+  isRemoteConnectionError,
+  isRetryableRemoteConnectionError,
+  systemDebug
+} from "./chunk-N5YZMO33.js";
 import {
   DeployError,
   LANGUAGES,
@@ -50,16 +67,13 @@ import {
   answered,
   appVolumeTargets,
   buildOutputTransferExcludes,
-  formatDuration,
-  isRemoteConnectionError,
-  isRetryableRemoteConnectionError,
   missingOutputDirectoryMessage,
+  nodeBinPathExport,
   packageManagerEnsureCommand,
   refused,
   safeErrorMessage,
-  shellQuote,
-  systemDebug
-} from "./chunk-UJ6JZM65.js";
+  shellQuote
+} from "./chunk-2VSW6Q6C.js";
 
 // ../../packages/adapters/src/system/remote-journal.ts
 var OPSH_RUN_VERSION = 1;
@@ -1114,7 +1128,6 @@ async function sampleBareUsage(executor, pid, cgroupCandidates = []) {
 }
 
 // ../../packages/adapters/src/runtime/supervisor/systemd.ts
-var UNIT_PREFIX = "openship";
 function escapeSystemdEnvValue(value) {
   return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/%/g, "%%").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t");
 }
@@ -1126,7 +1139,7 @@ var SystemdSupervisor = class {
   name = "systemd";
   // ── Helpers ──────────────────────────────────────────────────────────
   unitName(deploymentId) {
-    return `${UNIT_PREFIX}-${deploymentId}.service`;
+    return managedDeploymentUnitName(deploymentId);
   }
   unitPath(deploymentId) {
     return `/etc/systemd/system/${this.unitName(deploymentId)}`;
@@ -1172,7 +1185,7 @@ Restart=on-failure
 RestartSec=3
 StandardOutput=journal
 StandardError=journal
-SyslogIdentifier=${UNIT_PREFIX}-${opts.deploymentId}
+SyslogIdentifier=${this.unitName(opts.deploymentId).replace(/\.service$/, "")}
 
 [Install]
 WantedBy=multi-user.target
@@ -1206,16 +1219,7 @@ WantedBy=multi-user.target
         throw new DeployError(
           `Port ${opts.port} is already in use` + (occupant ? ` by ${occupant.command}` : "") + ". Stop the existing process before deploying.",
           "PORT_IN_USE",
-          {
-            port: opts.port,
-            pid: occupant?.pid,
-            command: occupant?.command,
-            rawCommand: occupant?.rawCommand,
-            systemdUnit: occupant?.systemdUnit,
-            systemdDescription: occupant?.systemdDescription,
-            deploymentId: occupant?.deploymentId,
-            isManagedDeployment: occupant?.isManagedDeployment
-          }
+          portOccupantDetails(opts.port, occupant)
         );
       }
       const msg = hint ? `Process exited immediately after start. Last output:
@@ -1424,7 +1428,7 @@ var NohupSupervisor = class {
         throw new DeployError(
           `Port ${opts.port} is already in use` + (occupant ? ` by ${occupant.command}` : "") + ". Stop the existing process before deploying.",
           "PORT_IN_USE",
-          { port: opts.port, pid: occupant?.pid, command: occupant?.command }
+          portOccupantDetails(opts.port, occupant)
         );
       }
       const msg = hint ? `Process exited immediately after spawn. Last output:
@@ -1690,6 +1694,7 @@ var BareRuntime = class {
   async promoteBuildArtifact(artifactPath, deploymentId, previousDeploymentId) {
     const releaseDir = this.releaseDir(deploymentId);
     if (artifactPath === releaseDir) return releaseDir;
+    const consumeSource = !artifactPath.startsWith(`${this.workDir}/releases/`);
     await ensureOwnedDir(this.executor, `${this.workDir}/releases`);
     await this.executor.rm(releaseDir);
     const previousReleaseDir = previousDeploymentId ? this.releaseDir(previousDeploymentId) : void 0;
@@ -1700,7 +1705,7 @@ var BareRuntime = class {
           `deploy:${deploymentId}:promote-rsync`,
           `rsync -a --delete --link-dest=${sq(previousReleaseDir)} ${sq(artifactPath)}/ ${sq(releaseDir)}/`
         );
-        await this.executor.rm(artifactPath).catch(() => {
+        if (consumeSource) await this.executor.rm(artifactPath).catch(() => {
         });
         return releaseDir;
       } catch {
@@ -1708,6 +1713,14 @@ var BareRuntime = class {
         });
       }
     }
+    if (!consumeSource) {
+      await execReliable(
+        this.executor,
+        `deploy:${deploymentId}:promote-copy`,
+        `mkdir -p ${sq(releaseDir)} && cp -a ${sq(artifactPath)}/. ${sq(releaseDir)}/`
+      );
+      return releaseDir;
+    }
     await execReliable(
       this.executor,
       `deploy:${deploymentId}:promote-mv`,
@@ -1947,19 +1960,29 @@ var BareRuntime = class {
     ) : stagedDir;
     await this.linkPersistentPaths(workDir, config.projectId, config.volumes, _onLog);
     const sv = await this.supervisor();
+    const projectEnv = splitRuntimeEnv(
+      Object.fromEntries(Object.entries(config.envVars ?? {}).map(([k, v]) => [k, String(v)]))
+    );
+    if (projectEnv.dropped.length > 0) {
+      _onLog?.({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        level: "warn",
+        message: droppedRuntimeEnvMessage(projectEnv.dropped)
+      });
+    }
     const env = {
-      ...Object.fromEntries(
-        Object.entries(config.envVars ?? {}).map(([k, v]) => [k, String(v)])
-      ),
+      ...Object.fromEntries(projectEnv.entries),
       PORT: String(config.port),
       NODE_ENV: config.environment === "production" ? "production" : "development"
     };
+    const startBinPath = nodeBinPathExport(config.packageManager, [workDir]);
+    const resolvedStart = config.startCommand || "npm start";
     try {
       await sv.deploy({
         deploymentId: config.deploymentId,
         projectId: config.projectId,
         workDir,
-        startCommand: config.startCommand || "npm start",
+        startCommand: startBinPath ? `${startBinPath} && ${resolvedStart}` : resolvedStart,
         port: config.port,
         env
       });
@@ -1979,13 +2002,40 @@ var BareRuntime = class {
     };
   }
   async deployStatic(config) {
-    const stagedDir = config.imageRef ?? this.projectDir(config.projectId);
-    const workDir = config.imageRef ? await this.promoteBuildArtifact(
-      stagedDir,
-      config.deploymentId,
-      config.previousDeploymentId
-    ) : stagedDir;
-    const staticRoot = resolveStaticOutputPath(workDir, config.outputDirectory);
+    const workDir = await this.promoteStaticRelease({
+      artifactPath: config.imageRef ?? this.projectDir(config.projectId),
+      releaseId: config.deploymentId,
+      previousReleaseId: config.previousDeploymentId,
+      outputDirectory: config.outputDirectory,
+      promote: Boolean(config.imageRef)
+    });
+    return {
+      deploymentId: config.deploymentId,
+      containerId: workDir,
+      status: "running"
+    };
+  }
+  /**
+   * Promote an extracted static build into a stable release directory and PROVE it
+   * can serve, returning the release dir.
+   *
+   * Split out of `deployStatic` so the compose/monorepo static path reuses the
+   * identical promote + validation instead of registering a vhost straight at the
+   * `.builds/<session>` staging dir. Two things came from that shortcut: the
+   * public doc-root of a compose static sub-app was a per-build-session scratch
+   * directory (nothing owned its lifetime, so superseded copies accumulated and
+   * any sweep of `.builds` would take the live site down), and it skipped the only
+   * HARD deploy-time output gate we have — so an extract that produced nothing
+   * deployed green and 404'd.
+   *
+   * `releaseId` is the release's identity, not necessarily a deployment id: the
+   * compose path passes `<deploymentId>-<serviceId>` so each static sub-app owns
+   * its own release dir under one deployment.
+   */
+  async promoteStaticRelease(opts) {
+    const stagedDir = opts.artifactPath;
+    const workDir = opts.promote === false ? stagedDir : await this.promoteBuildArtifact(stagedDir, opts.releaseId, opts.previousReleaseId);
+    const staticRoot = resolveStaticOutputPath(workDir, opts.outputDirectory);
     const abort = async (message) => {
       if (workDir !== stagedDir) {
         await this.executor.rm(workDir).catch(() => {
@@ -1994,18 +2044,47 @@ var BareRuntime = class {
       throw new Error(message);
     };
     if (!await this.executor.exists(staticRoot)) {
-      return abort(missingOutputDirectoryMessage(config.outputDirectory));
+      return abort(missingOutputDirectoryMessage(opts.outputDirectory));
+    }
+    if (staticRoot === workDir) {
+      const undeleted = await this.pruneBuildFilesFromDocRoot(staticRoot);
+      if (undeleted.length > 0) {
+        return abort(
+          `Refusing to publish ${staticRoot}: could not remove ${undeleted.join(", ")} from the document root. Serving them would expose the repository (and, for a private repo, the access token in .git/config) at the site's public URL.`
+        );
+      }
     }
     if (await this.isEmptyDir(staticRoot)) {
       return abort(
-        `The output directory "${config.outputDirectory || "."}" is empty \u2014 the build produced no files to serve, so every request would 404. Check the build command and the Output Directory setting.`
+        `The output directory "${opts.outputDirectory || "."}" is empty \u2014 the build produced no files to serve, so every request would 404. Check the build command and the Output Directory setting.`
       );
     }
-    return {
-      deploymentId: config.deploymentId,
-      containerId: workDir,
-      status: "running"
-    };
+    return workDir;
+  }
+  /**
+   * Remove top-level build inputs from a doc root, returning the names it could NOT
+   * remove (empty on success, and on "there was nothing to remove").
+   *
+   * Reuses `isExcludedDocRootEntry` rather than re-listing the names, because the
+   * Docker sandbox already owns that list and two copies of "what must not be
+   * served" is precisely how the bare path came to serve `.git`.
+   *
+   * An unreadable listing returns empty — a probe that cannot read must not fail a
+   * deploy — but a listed entry that survives its `rm` is reported, because the
+   * caller must refuse to publish rather than expose a token.
+   */
+  async pruneBuildFilesFromDocRoot(root) {
+    const listed = await this.executor.exec(`ls -A ${sq(root)} 2>/dev/null; true`).catch(() => null);
+    if (listed === null) return [];
+    const doomed = listed.split("\n").map((l) => l.trim()).filter(Boolean).filter(isExcludedDocRootEntry);
+    if (doomed.length === 0) return [];
+    await this.executor.exec(`rm -rf ${doomed.map((n) => sq(`${root}/${n}`)).join(" ")}`).catch(() => {
+    });
+    const survivors = [];
+    for (const name of doomed) {
+      if (await this.executor.exists(`${root}/${name}`)) survivors.push(name);
+    }
+    return survivors;
   }
   /**
    * Is this an existing directory with no entries? Any inconclusive answer (not a
@@ -2033,8 +2112,8 @@ var BareRuntime = class {
     await sv.restart(containerId);
   }
   async destroy(containerId) {
-    if (containerId.includes("/")) {
-      await this.executor.rm(containerId);
+    if (isArtifactPathRef(containerId)) {
+      await removeManagedArtifact(this.executor, containerId);
       return;
     }
     const sv = await this.supervisor();
@@ -2078,15 +2157,21 @@ var BareRuntime = class {
     }
   }
   async purge(deployment) {
+    const failures = [];
     if (deployment.containerId) {
-      try {
-        await this.destroy(deployment.containerId);
-      } catch {
-      }
+      await this.destroy(deployment.containerId).catch((err) => failures.push(err));
     }
-    try {
-      await this.executor.rm(this.releaseDir(deployment.id));
-    } catch {
+    const releaseDir = this.releaseDir(deployment.id);
+    if (releaseDir !== deployment.containerId) {
+      await removeManagedArtifact(this.executor, releaseDir).catch(
+        (err) => failures.push(err)
+      );
+    }
+    if (failures.length === 1) throw failures[0];
+    if (failures.length > 1) {
+      throw new Error(
+        failures.map((err) => err instanceof Error ? err.message : String(err)).join("; ")
+      );
     }
   }
   // ── Observability ──────────────────────────────────────────────────────

package/dist/chunk-UWEV6XTS.js

@@ -0,0 +1,249 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  formatDuration,
+  isRemoteConnectionError,
+  systemDebug
+} from "./chunk-N5YZMO33.js";
+import {
+  safeErrorMessage,
+  shellQuote
+} from "./chunk-2VSW6Q6C.js";
+
+// ../../packages/adapters/src/system/probe-exec.ts
+async function tryExec(executor, command, opts) {
+  try {
+    return opts ? await executor.exec(command, opts) : await executor.exec(command);
+  } catch {
+    return null;
+  }
+}
+async function probeExec(executor, command, scope) {
+  const startedAt = Date.now();
+  systemDebug(scope, `exec:start ${command}`);
+  try {
+    const result = await executor.exec(command, { timeout: 1e4 });
+    systemDebug(scope, `exec:ok ${command} (${formatDuration(startedAt)})`);
+    return { output: result.trim(), error: null };
+  } catch (err) {
+    const msg = safeErrorMessage(err);
+    if (isRemoteConnectionError(err)) {
+      systemDebug(scope, `exec:abort ${command} (${formatDuration(startedAt)}) ${msg}`);
+      throw err;
+    }
+    systemDebug(scope, `exec:fail ${command} (${formatDuration(startedAt)}) ${msg}`);
+    return { output: "", error: msg || `\`${command}\` failed` };
+  }
+}
+function withReason(message, error) {
+  if (!error) return message;
+  const first = error.split("\n").map((line) => line.trim()).find(Boolean);
+  if (!first) return message;
+  return `${message} \u2014 ${first.length > 200 ? `${first.slice(0, 199)}\u2026` : first}`;
+}
+
+// ../../packages/adapters/src/infra/mail-container.ts
+var MAIL_HOST_STATE_DIR = "/var/lib/openship/mail";
+var MAIL_CONTAINER_MOUNTS = [
+  { host: `${MAIL_HOST_STATE_DIR}/vmail`, container: "/var/vmail" },
+  // The Postfix queue. A recreate on an ephemeral layer would drop in-flight and
+  // deferred mail without this — keep it on the host.
+  { host: `${MAIL_HOST_STATE_DIR}/spool`, container: "/var/spool/postfix" },
+  // DKIM private keys. NEVER baked, never regenerated on pull — a fresh selector
+  // breaks DMARC until DNS repropagates.
+  { host: `${MAIL_HOST_STATE_DIR}/dkim`, container: "/var/lib/dkim" },
+  // Mutable daemon config the admin layer edits (sasl_passwd, relayhost maps,
+  // amavis 50-user). Seeded from baked defaults on first boot.
+  { host: `${MAIL_HOST_STATE_DIR}/config/postfix`, container: "/etc/postfix", seed: true },
+  { host: `${MAIL_HOST_STATE_DIR}/config/dovecot`, container: "/etc/dovecot", seed: true },
+  { host: `${MAIL_HOST_STATE_DIR}/config/amavis`, container: "/etc/amavis/conf.d", seed: true },
+  // ClamAV signatures — bind-mounted so a pull doesn't force a multi-hundred-MB
+  // freshclam re-download and delay readiness. `seed: true` because that same mount
+  // HIDES the database baked into the image: with nothing copying it across, clamd
+  // finds an empty database directory and exits (issue #565).
+  { host: `${MAIL_HOST_STATE_DIR}/clamav`, container: "/var/lib/clamav", seed: true },
+  { host: "/etc/letsencrypt", container: "/etc/letsencrypt", readonly: true }
+];
+var MAIL_DB_HOST_DATA_DIR = `${MAIL_HOST_STATE_DIR}/pgdata`;
+var MAIL_DB_CONTAINER_DATA_DIR = "/var/lib/postgresql/data";
+var MAIL_DB_PGDATA = `${MAIL_DB_CONTAINER_DATA_DIR}/pgdata`;
+var MAIL_HOST_PATHS = {
+  saslPasswd: `${MAIL_HOST_STATE_DIR}/config/postfix/sasl_passwd`,
+  senderRelayhost: `${MAIL_HOST_STATE_DIR}/config/postfix/sender_relayhost`,
+  // Per-nexthop TLS policy. Only split ("selected"-scope) relaying writes it: the
+  // relay hop must be `encrypt` so SASL credentials never cross a plaintext
+  // connection, while direct-to-MX delivery for the un-relayed domains stays
+  // opportunistic. A GLOBAL smtp_tls_security_level can't express both.
+  relayTlsPolicy: `${MAIL_HOST_STATE_DIR}/config/postfix/openship_tls_policy`,
+  amavisUserConf: `${MAIL_HOST_STATE_DIR}/config/amavis/50-user`
+};
+
+// ../../packages/adapters/src/system/port-owner.ts
+var OPENSHIP_LABEL = {
+  project: "openship.project",
+  deployment: "openship.deployment",
+  service: "openship.service",
+  build: "openship.build"
+};
+var PS_FIELDS = [
+  "{{.ID}}",
+  "{{.Names}}",
+  "{{.Image}}",
+  `{{.Label "${OPENSHIP_LABEL.project}"}}`,
+  `{{.Label "${OPENSHIP_LABEL.deployment}"}}`,
+  `{{.Label "${OPENSHIP_LABEL.service}"}}`,
+  `{{.Label "${OPENSHIP_LABEL.build}"}}`,
+  '{{.Label "com.docker.compose.project"}}',
+  '{{.Label "com.docker.compose.service"}}'
+];
+var PS_FORMAT = PS_FIELDS.join("\\t");
+function parsePsLines(out) {
+  const containers = [];
+  for (const line of out.split("\n")) {
+    if (!line.trim()) continue;
+    const f = line.split("	");
+    const id = f[0]?.trim();
+    const name = f[1]?.trim();
+    if (!id || !name || !/^[0-9a-f]{12,64}$/i.test(id)) continue;
+    containers.push({
+      id,
+      name: name.replace(/^\//, ""),
+      image: f[2]?.trim() ?? "",
+      ...f[3]?.trim() ? { projectId: f[3].trim() } : {},
+      ...f[4]?.trim() ? { deploymentId: f[4].trim() } : {},
+      ...f[5]?.trim() ? { serviceName: f[5].trim() } : {},
+      ...f[6]?.trim() ? { buildSessionId: f[6].trim() } : {},
+      ...f[7]?.trim() ? { composeProject: f[7].trim() } : {},
+      ...f[8]?.trim() ? { composeService: f[8].trim() } : {}
+    });
+  }
+  return containers;
+}
+async function queryContainers(executor, filter) {
+  const out = await tryExec(
+    executor,
+    `docker ps --no-trunc --filter ${filter} --format '${PS_FORMAT}' 2>/dev/null`
+  );
+  return out === null ? null : parsePsLines(out);
+}
+async function resolveContainerPublishingPort(executor, port) {
+  if (!Number.isInteger(port) || port < 1 || port > 65535) return { kind: "unknown" };
+  const containers = await queryContainers(executor, `publish=${port}`);
+  if (containers === null) return { kind: "unknown" };
+  if (containers.length === 0) return { kind: "none" };
+  if (containers.length === 1) return { kind: "one", container: containers[0] };
+  return { kind: "ambiguous", containers };
+}
+function containerIdFromCgroup(cgroup) {
+  const match = cgroup?.match(/(?:^|[^0-9a-f])([0-9a-f]{64})(?:[^0-9a-f]|$)/);
+  return match?.[1] ?? null;
+}
+async function stopContainerDurably(executor, ref) {
+  await tryExec(executor, `docker update --restart=no ${shellQuote(ref)} 2>/dev/null || true`);
+  await tryExec(executor, `docker stop ${shellQuote(ref)} 2>/dev/null || true`);
+}
+async function describeContainerById(executor, containerId) {
+  if (!/^[0-9a-f]{12,64}$/i.test(containerId)) return null;
+  const containers = await queryContainers(executor, `id=${shellQuote(containerId)}`);
+  return containers?.[0] ?? null;
+}
+var EDGE_CONTAINER_NAME = "openship-edge";
+function isOurEdgeContainer(name, image) {
+  return /openship-edge/i.test(`${name ?? ""} ${image ?? ""}`);
+}
+var PORT_FORWARDER_NAMES = [
+  "docker-proxy",
+  "rootlesskit",
+  "rootlesskit-docker-proxy",
+  "slirp4netns",
+  "pasta",
+  // LXD/Incus publish a container port with `forkproxy`, whose cgroup is the snap's
+  // daemon unit — the same misattribution with a different daemon.
+  "forkproxy"
+];
+function isContainerPortForwarder(command) {
+  const argv0 = command?.trim().split(/\s+/)[0];
+  if (!argv0) return false;
+  const base = argv0.replace(/.*\//, "");
+  return PORT_FORWARDER_NAMES.some(
+    (name) => base === name || base.startsWith(`${name}-`) || base.length >= 15 && name.startsWith(base)
+  );
+}
+var MANAGED_DEPLOYMENT_UNIT_RE = /^openship-(dep_[A-Za-z0-9_-]+)\.service$/;
+function managedDeploymentUnitName(deploymentId) {
+  return `openship-${deploymentId}.service`;
+}
+function managedDeploymentIdFromUnit(unit) {
+  return unit?.match(MANAGED_DEPLOYMENT_UNIT_RE)?.[1] ?? null;
+}
+var PROTECTED_UNITS = /* @__PURE__ */ new Set([
+  "docker",
+  "docker.socket",
+  "dockerd",
+  "snap.docker.dockerd",
+  "containerd",
+  "containerd.socket",
+  "podman",
+  // Other container/VM supervisors whose forwarders land on their daemon unit.
+  "lxd",
+  "snap.lxd.daemon",
+  "incus",
+  "k3s",
+  "k3s-agent",
+  "kubelet",
+  "libvirtd",
+  "ssh",
+  "sshd",
+  "dbus",
+  "systemd-resolved",
+  "systemd-networkd",
+  "systemd-logind",
+  // The control plane itself, and a from-source dev install of it.
+  "openship",
+  "openship-dev"
+]);
+var USER_MANAGER_UNIT_RE = /^user@\d+$/;
+function classifyProxy(text) {
+  if (!text) return void 0;
+  const t = text.toLowerCase();
+  if (t.includes("openresty")) return "openresty";
+  if (/(^|[\s/:])nginx/.test(t)) return "nginx";
+  if (/(^|[\s/:])caddy/.test(t)) return "caddy";
+  if (/(apache2|httpd)/.test(t)) return "apache";
+  if (/(^|[\s/:])traefik/.test(t)) return "traefik";
+  if (/(^|[\s/:])haproxy/.test(t)) return "haproxy";
+  return void 0;
+}
+function bareUnit(unit) {
+  return unit.replace(/\.service$/, "");
+}
+function isProtectedUnit(unit) {
+  const bare = bareUnit(unit);
+  return PROTECTED_UNITS.has(bare) || USER_MANAGER_UNIT_RE.test(bare);
+}
+function mayStopUnitForEdgeTakeover(unit) {
+  if (!unit) return false;
+  if (managedDeploymentIdFromUnit(unit)) return true;
+  return !isProtectedUnit(unit);
+}
+
+export {
+  MAIL_HOST_STATE_DIR,
+  tryExec,
+  probeExec,
+  withReason,
+  OPENSHIP_LABEL,
+  resolveContainerPublishingPort,
+  containerIdFromCgroup,
+  stopContainerDurably,
+  describeContainerById,
+  EDGE_CONTAINER_NAME,
+  isOurEdgeContainer,
+  isContainerPortForwarder,
+  managedDeploymentUnitName,
+  managedDeploymentIdFromUnit,
+  classifyProxy,
+  mayStopUnitForEdgeTakeover
+};