openship 0.6.6 → 0.6.8

package/dist/{chunk-LUKYPVJ4.js → chunk-6GU6JSK6.js}

@@ -4,17 +4,23 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   assembleGitClone,
+  dockerBuildContextDirectory,
+  generateDockerfile,
   localGitSshWriter,
   materializeGitSsh,
-  sq
-} from "./chunk-LH2PLRQO.js";
+  normalizeDockerRelativePath,
+  resolveContextDockerfileCandidates,
+  resolveDockerRootDirectory,
+  resolveDockerfileCandidates,
+  resolveWithinDirectory
+} from "./chunk-AHJYP7DG.js";
 import {
   getTarCreateEnv,
   prepareSourceTarArgs
-} from "./chunk-Q7WGTQQ5.js";
+} from "./chunk-VAI5VOOI.js";
 import {
-  packageManagerEnsureCommand
-} from "./chunk-UJ6JZM65.js";
+  isValidEnvKey
+} from "./chunk-WEZFTL4V.js";
 import {
   __commonJS,
   __toESM
@@ -478,451 +484,242 @@ var require_ignore = __commonJS({
   }
 });
 
-// ../../packages/adapters/src/runtime/docker-paths.ts
-import { access, readdir } from "fs/promises";
-import { isAbsolute, join, relative, resolve, sep } from "path";
-function toPosixPath(value) {
-  return value.split(sep).filter(Boolean).join("/");
-}
-function toSafeSegments(value, label) {
-  const segments = value.split(/[\\/]/).filter((segment) => segment && segment !== ".");
-  if (segments.includes("..")) {
-    throw new Error(
-      `Invalid ${label} ${JSON.stringify(value)}: path segments must not contain "..".`
-    );
+// ../../packages/adapters/src/runtime/docker-build-args.ts
+function resolveDockerBuildArgs(config) {
+  const invalidExplicit = Object.keys(config.buildArgs ?? {}).filter((key) => !isValidEnvKey(key));
+  if (invalidExplicit.length > 0) {
+    throw new Error(`Invalid Docker build argument name(s): ${invalidExplicit.join(", ")}`);
   }
-  return segments;
-}
-function normalizeDockerRelativePath(value) {
-  const normalized = value?.trim().replace(/^\.\//, "").replace(/^\/+|\/+$/g, "");
-  if (!normalized || normalized === ".") {
-    return "";
-  }
-  return toSafeSegments(normalized, "path").join("/");
+  const inherited = Object.fromEntries(
+    Object.entries({
+      ...config.envVars,
+      NODE_ENV: "production"
+    }).filter(([key]) => isValidEnvKey(key))
+  );
+  return { ...inherited, ...config.buildArgs };
 }
-function resolveWithinDirectory(baseDir, relativePath) {
-  const base = resolve(baseDir);
-  const target = resolve(base, ...toSafeSegments(relativePath?.trim() ?? "", "path"));
-  const escape = relative(base, target);
-  if (escape === ".." || escape.startsWith(`..${sep}`) || isAbsolute(escape)) {
-    throw new Error(`Resolved path ${JSON.stringify(target)} escapes ${JSON.stringify(base)}.`);
+
+// ../../packages/adapters/src/runtime/docker-buildkit-trace.ts
+var WIRE_VARINT = 0;
+var WIRE_64BIT = 1;
+var WIRE_LENGTH = 2;
+var WIRE_32BIT = 5;
+var WireReader = class {
+  constructor(buf) {
+    this.buf = buf;
   }
-  return target;
-}
-function normalizeDockerRootDirectory(rootDirectory, localPath) {
-  let normalized = rootDirectory?.trim() ?? "";
-  if (!normalized) {
-    return "";
+  pos = 0;
+  get done() {
+    return this.pos >= this.buf.length;
   }
-  if (localPath && isAbsolute(normalized)) {
-    const relativePath = relative(localPath, normalized);
-    if (!relativePath || relativePath === ".") {
-      return "";
+  /** Varint as a Number. Bails past 10 bytes (the protobuf maximum) so a corrupt
+   *  buffer cannot spin. Values we actually read (`stream`, `cached`) are tiny. */
+  varint() {
+    let result = 0;
+    let shift = 0;
+    for (let i = 0; i < 10; i += 1) {
+      if (this.done) return null;
+      const byte = this.buf[this.pos];
+      this.pos += 1;
+      result += (byte & 127) * 2 ** shift;
+      if ((byte & 128) === 0) return result;
+      shift += 7;
     }
-    if (!relativePath.startsWith("..") && !isAbsolute(relativePath)) {
-      normalized = relativePath;
-    }
-  }
-  normalized = normalized.replace(/^\.\//, "").replace(/^\/+|\/+$/g, "");
-  if (!normalized || normalized === ".") {
-    return "";
-  }
-  return toSafeSegments(normalized, "rootDirectory").join("/");
-}
-function resolveExplicitDockerfileCandidate(rootDirectory, dockerfilePath) {
-  const normalizedRootDirectory = normalizeDockerRelativePath(rootDirectory);
-  const normalizedDockerfilePath = normalizeDockerRelativePath(dockerfilePath);
-  if (!normalizedDockerfilePath) {
-    return "";
+    return null;
   }
-  if (!normalizedRootDirectory) {
-    return normalizedDockerfilePath;
+  /** Field header → { field, wire }. */
+  key() {
+    const tag = this.varint();
+    if (tag === null) return null;
+    const field = Math.floor(tag / 8);
+    if (field <= 0) return null;
+    return { field, wire: tag % 8 };
   }
-  if (normalizedDockerfilePath.startsWith(`${normalizedRootDirectory}/`)) {
-    return normalizedDockerfilePath;
+  bytes() {
+    const length = this.varint();
+    if (length === null || length < 0 || this.pos + length > this.buf.length) return null;
+    const slice = this.buf.subarray(this.pos, this.pos + length);
+    this.pos += length;
+    return slice;
   }
-  return `${normalizedRootDirectory}/${normalizedDockerfilePath}`;
-}
-function resolveDockerfileCandidates(rootDirectory, explicitDockerfilePath) {
-  const normalizedRootDirectory = normalizeDockerRelativePath(rootDirectory);
-  return [
-    resolveExplicitDockerfileCandidate(rootDirectory, explicitDockerfilePath),
-    normalizedRootDirectory ? `${normalizedRootDirectory}/Dockerfile` : "Dockerfile",
-    "Dockerfile"
-  ].filter(
-    (candidate, index, values) => Boolean(candidate) && values.indexOf(candidate) === index
-  );
-}
-var ROOT_MANIFESTS = [
-  "package.json",
-  "pyproject.toml",
-  "requirements.txt",
-  "Pipfile",
-  "go.mod",
-  "Cargo.toml",
-  "Gemfile",
-  "composer.json",
-  "pom.xml",
-  "build.gradle",
-  "build.gradle.kts",
-  "mix.exs",
-  "Dockerfile"
-];
-var IGNORED_DIRS = /* @__PURE__ */ new Set([
-  "node_modules",
-  ".git",
-  ".next",
-  ".nuxt",
-  ".output",
-  ".turbo",
-  ".venv",
-  "__pycache__",
-  "build",
-  "dist",
-  "target",
-  "vendor"
-]);
-async function pathExists(path) {
-  return access(path).then(() => true).catch(() => false);
-}
-async function manifestCount(dir) {
-  let count = 0;
-  for (const file of ROOT_MANIFESTS) {
-    if (await pathExists(join(dir, file))) {
-      count += 1;
+  /** Advance past a field we don't read. Returns false when the buffer is
+   *  malformed, which ends the scan. */
+  skip(wire) {
+    switch (wire) {
+      case WIRE_VARINT:
+        return this.varint() !== null;
+      case WIRE_64BIT:
+        this.pos += 8;
+        return this.pos <= this.buf.length;
+      case WIRE_LENGTH:
+        return this.bytes() !== null;
+      case WIRE_32BIT:
+        this.pos += 4;
+        return this.pos <= this.buf.length;
+      default:
+        return false;
     }
   }
-  return count;
-}
-function pathSegments(path) {
-  return path.toLowerCase().split("/").filter(Boolean);
+};
+var decoder = new TextDecoder("utf-8", { fatal: false });
+function text(bytes) {
+  return decoder.decode(bytes);
 }
-function scorePathHints(relativePath) {
-  const segments = pathSegments(relativePath);
-  let score = 0;
-  for (const segment of segments) {
-    if (["app", "apps", "site", "sites", "web", "www", "service", "services"].includes(segment)) {
-      score += 12;
-    }
-    if (["docs", "example", "examples", "test", "tests", "storybook"].includes(segment)) {
-      score -= 18;
+function decodeVertex(bytes) {
+  const reader = new WireReader(bytes);
+  const vertex = {
+    digest: "",
+    name: "",
+    cached: false,
+    started: false,
+    completed: false,
+    error: ""
+  };
+  while (!reader.done) {
+    const key = reader.key();
+    if (!key) return null;
+    if (key.field === 1 && key.wire === WIRE_LENGTH) {
+      const value = reader.bytes();
+      if (!value) return null;
+      vertex.digest = text(value);
+    } else if (key.field === 3 && key.wire === WIRE_LENGTH) {
+      const value = reader.bytes();
+      if (!value) return null;
+      vertex.name = text(value);
+    } else if (key.field === 4 && key.wire === WIRE_VARINT) {
+      const value = reader.varint();
+      if (value === null) return null;
+      vertex.cached = value !== 0;
+    } else if (key.field === 5 && key.wire === WIRE_LENGTH) {
+      if (!reader.bytes()) return null;
+      vertex.started = true;
+    } else if (key.field === 6 && key.wire === WIRE_LENGTH) {
+      if (!reader.bytes()) return null;
+      vertex.completed = true;
+    } else if (key.field === 7 && key.wire === WIRE_LENGTH) {
+      const value = reader.bytes();
+      if (!value) return null;
+      vertex.error = text(value);
+    } else if (!reader.skip(key.wire)) {
+      return null;
     }
   }
-  return score;
+  return vertex;
 }
-async function scoreCandidate(dir, relativePath) {
-  let score = scorePathHints(relativePath);
-  score += await manifestCount(dir) * 20;
-  if (relativePath) {
-    score += 6;
-  }
-  return score;
-}
-async function collectCandidates(rootDir, currentDir, depth, candidates) {
-  const relativePath = toPosixPath(relative(rootDir, currentDir));
-  if (await manifestCount(currentDir) > 0) {
-    candidates.push({
-      path: relativePath,
-      score: await scoreCandidate(currentDir, relativePath)
-    });
-  }
-  if (depth >= 6) {
-    return;
-  }
-  const entries = await readdir(currentDir, { withFileTypes: true }).catch(() => []);
-  for (const entry of entries) {
-    if (!entry.isDirectory() || IGNORED_DIRS.has(entry.name)) {
-      continue;
+function decodeLog(bytes) {
+  const reader = new WireReader(bytes);
+  let vertex = "";
+  let msg = null;
+  while (!reader.done) {
+    const key = reader.key();
+    if (!key) return null;
+    if (key.field === 1 && key.wire === WIRE_LENGTH) {
+      const value = reader.bytes();
+      if (!value) return null;
+      vertex = text(value);
+    } else if (key.field === 4 && key.wire === WIRE_LENGTH) {
+      const value = reader.bytes();
+      if (!value) return null;
+      msg = value;
+    } else if (!reader.skip(key.wire)) {
+      return null;
     }
-    await collectCandidates(rootDir, join(currentDir, entry.name), depth + 1, candidates);
-  }
-}
-async function resolveDockerRootDirectory(contextDir, rootDirectory, localPath) {
-  const hasExplicitRootDirectory = typeof rootDirectory === "string";
-  const normalized = normalizeDockerRootDirectory(rootDirectory, localPath);
-  if (hasExplicitRootDirectory) {
-    return normalized;
-  }
-  if (normalized) {
-    return normalized;
-  }
-  const candidates = [];
-  await collectCandidates(contextDir, contextDir, 0, candidates);
-  if (candidates.length === 0) {
-    return "";
-  }
-  candidates.sort((left, right) => right.score - left.score);
-  const bestNonRoot = candidates.find((candidate) => candidate.path);
-  if (bestNonRoot && bestNonRoot.score > 0) {
-    return bestNonRoot.path;
-  }
-  return candidates[0]?.path ?? "";
-}
-
-// ../../packages/adapters/src/runtime/docker-build-plan.ts
-var DOCKER_BUILD_EVENT_PREFIX = "[openship-build]";
-var INLINE_BUILD_ENV_EXCLUDES = /* @__PURE__ */ new Set(["FORCE_COLOR", "TERM"]);
-function formatDockerBuildEvent(step, status) {
-  return `${DOCKER_BUILD_EVENT_PREFIX} step=${step} status=${status}`;
-}
-function normalizeRelativePath(value) {
-  const normalized = value?.trim().replace(/^\.\//, "").replace(/^\/+|\/+$/g, "");
-  if (!normalized || normalized === ".") {
-    return "";
-  }
-  return normalized;
-}
-function builderSourceDir(rootDirectory) {
-  const normalized = normalizeDockerRootDirectory(rootDirectory);
-  return normalized ? `/workspace/${normalized}` : "/workspace";
-}
-function buildEnvPrefix(envVars) {
-  const assignments = Object.entries(envVars).filter(([key]) => !INLINE_BUILD_ENV_EXCLUDES.has(key)).filter(([key]) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(key)).map(([key, value]) => `${key}=${sq(value)}`);
-  if (!envVars.NO_COLOR) {
-    assignments.push("NO_COLOR='1'");
-  }
-  if (assignments.length === 0) {
-    return "";
-  }
-  return `export ${assignments.join(" ")} && `;
-}
-function buildRunCommand(command, envPrefix) {
-  return `${envPrefix}${command}`;
-}
-function runtimeCopyDirectives(config, sourceDir) {
-  if (config.productionPaths && config.productionPaths.length > 0) {
-    return config.productionPaths.map((path) => {
-      const normalized = normalizeRelativePath(path);
-      const source = normalized ? `${sourceDir}/${normalized}` : sourceDir;
-      const target = normalized ? `/app/${normalized}` : "/app";
-      return `COPY --from=builder ${source} ${target}`;
-    });
-  }
-  return [`COPY --from=builder ${sourceDir} /app`];
-}
-function needsMultiStage(config) {
-  return config.buildImage !== config.runtimeImage;
-}
-function workspacePrepareRunLine(config, envPrefix, workspacePrepare) {
-  const pmEnsure = packageManagerEnsureCommand(config.packageManager);
-  const body = pmEnsure ? `${pmEnsure} && ${workspacePrepare}` : workspacePrepare;
-  return `RUN ${envPrefix}${body}`;
-}
-function stepsRunLine(config, envPrefix, opts) {
-  const install = opts.install ? config.installCommand : "";
-  const build = opts.build ? config.buildCommand : "";
-  const steps = [];
-  const pmEnsure = packageManagerEnsureCommand(opts.packageManager ?? config.packageManager);
-  if (pmEnsure && (install || build)) {
-    steps.push(pmEnsure);
-  }
-  if (install) {
-    steps.push(`printf '${formatDockerBuildEvent("install", "running")}\\n'`);
-    steps.push(buildRunCommand(install, envPrefix));
-    steps.push(`printf '${formatDockerBuildEvent("install", "completed")}\\n'`);
-  }
-  if (build) {
-    steps.push(`printf '${formatDockerBuildEvent("build", "running")}\\n'`);
-    steps.push(buildRunCommand(build, envPrefix));
-    steps.push(`printf '${formatDockerBuildEvent("build", "completed")}\\n'`);
-  }
-  return steps.length > 0 ? `RUN ${steps.join(" && ")}` : null;
-}
-function installBuildRunLine(config, envPrefix) {
-  return stepsRunLine(config, envPrefix, { install: true, build: true });
-}
-function installRunLine(config, envPrefix) {
-  return stepsRunLine(config, envPrefix, { install: true });
-}
-var JS_PACKAGE_MANAGERS = ["pnpm", "yarn", "bun", "npm"];
-function buildOnlyRunLine(config, envPrefix) {
-  const command = config.buildCommand?.trim() ?? "";
-  const packageManager = JS_PACKAGE_MANAGERS.find(
-    (pm) => new RegExp(`(^|\\s|&&\\s*)${pm}\\s`).test(command)
-  );
-  return stepsRunLine(config, envPrefix, { build: true, packageManager });
-}
-function isPhpRuntime(config) {
-  return /^php:/.test(config.runtimeImage) || /frankenphp/i.test(config.runtimeImage);
-}
-var PHP_EXTENSIONS = [
-  "pdo_mysql",
-  "pdo_pgsql",
-  "redis",
-  "pcntl",
-  "bcmath",
-  "intl",
-  "zip",
-  "gd",
-  "opcache"
-];
-var PHP_EXT_INSTALLER_IMAGE = "mlocati/php-extension-installer:2";
-var PHP_ASSET_BUILD_IMAGE = "node:22-bookworm-slim";
-var PHP_EXT_INSTALL_LINE = `RUN install-php-extensions ${PHP_EXTENSIONS.join(" ")} > /dev/null`;
-function generatePhpDockerfile(config) {
-  const sourceDir = builderSourceDir(
-    normalizeDockerRootDirectory(config.rootDirectory, config.localPath)
-  );
-  const envPrefix = buildEnvPrefix(config.envVars);
-  const installLine = installRunLine(config, envPrefix);
-  const assetBuildLine = buildOnlyRunLine(config, envPrefix);
-  const lines = [
-    `FROM ${config.buildImage} AS builder`,
-    // php:*-cli ships no Composer — pull the binary from the official image.
-    `COPY --from=composer:2 /usr/bin/composer /usr/bin/composer`,
-    `COPY --from=${PHP_EXT_INSTALLER_IMAGE} /usr/bin/install-php-extensions /usr/bin/install-php-extensions`,
-    PHP_EXT_INSTALL_LINE,
-    `WORKDIR /workspace`,
-    `COPY . /workspace`,
-    `WORKDIR ${sourceDir}`
-  ];
-  if (installLine) lines.push(installLine);
-  if (assetBuildLine) {
-    lines.push(
-      `FROM ${PHP_ASSET_BUILD_IMAGE} AS assets`,
-      `WORKDIR /workspace`,
-      `COPY . /workspace`,
-      `WORKDIR ${sourceDir}`,
-      assetBuildLine
-    );
-  }
-  const docroot = normalizeRelativePath(config.outputDirectory) || "public";
-  lines.push(
-    `FROM ${config.runtimeImage} AS runtime`,
-    PHP_EXT_INSTALL_LINE,
-    // --chown on the COPY instead of a trailing `chown -R`: the recursive form
-    // rewrites every file into a second layer, doubling the app's size on disk.
-    // Ownership has to be settled HERE, before anything mounts: Docker seeds a
-    // fresh named volume from the image directory it covers, ownership included,
-    // so `/app/storage` is only writable by the runtime user if it was already
-    // owned by them in the image (see @repo/core volumes.ts).
-    `COPY --from=builder --chown=www-data:www-data ${sourceDir} /app`
-  );
-  if (assetBuildLine) {
-    lines.push(
-      `COPY --from=assets --chown=www-data:www-data ${sourceDir}/${docroot} /app/${docroot}`
-    );
-  }
-  lines.push(
-    `WORKDIR /app`,
-    // FrankenPHP's bundled Caddyfile reads the docroot from SERVER_ROOT (default
-    // `public/`, resolved against WORKDIR). Setting it keeps the project's
-    // outputDirectory authoritative for BOTH what gets served and where the asset
-    // stage's output lands — otherwise a project that renamed its docroot builds
-    // assets into one directory and serves another.
-    `ENV SERVER_ROOT=${docroot}/`,
-    // Caddy's config + data dirs are root-owned in the base image, and it writes
-    // to both on startup — without this the non-root switch below fails at boot.
-    `RUN mkdir -p /data/caddy /config/caddy && chown -R www-data:www-data /data/caddy /config/caddy`,
-    // The frankenphp binary carries cap_net_bind_service, so dropping root here
-    // still leaves any port bindable.
-    `USER www-data`,
-    `EXPOSE ${config.port}`
-  );
-  if (config.startCommand) {
-    lines.push(`CMD ["sh", "-c", ${JSON.stringify(config.startCommand)}]`);
-  }
-  return lines.join("\n");
-}
-function staticNginxTemplateLines(port) {
-  return [
-    "server {",
-    `    listen ${port} default_server;`,
-    "    root /usr/share/nginx/html;",
-    "    index index.html;",
-    "    location / { try_files $uri $uri/ /index.html; }",
-    "}"
-  ];
-}
-function staticBuilderOutputPath(config) {
-  const sourceDir = builderSourceDir(
-    normalizeDockerRootDirectory(config.rootDirectory, config.localPath)
-  );
-  const output = normalizeRelativePath(config.outputDirectory);
-  return output ? `${sourceDir}/${output}` : sourceDir;
-}
-function generateStaticDockerfile(config) {
-  const sourceDir = builderSourceDir(
-    normalizeDockerRootDirectory(config.rootDirectory, config.localPath)
-  );
-  const envPrefix = buildEnvPrefix(config.envVars);
-  const workspacePrepare = config.workspacePrepareCommand?.trim();
-  const outputPath = staticBuilderOutputPath(config);
-  const nginxTemplate = staticNginxTemplateLines(config.port).map((line) => `'${line}'`).join(" ");
-  const lines = [
-    `FROM ${config.buildImage} AS builder`,
-    `WORKDIR /workspace`,
-    `COPY . /workspace`
-  ];
-  if (workspacePrepare) {
-    lines.push(workspacePrepareRunLine(config, envPrefix, workspacePrepare));
   }
-  lines.push(`WORKDIR ${sourceDir}`);
-  const stepsLine = installBuildRunLine(config, envPrefix);
-  if (stepsLine) lines.push(stepsLine);
-  if (config.staticExtractOnly) return lines.join("\n");
-  lines.push(
-    `FROM nginx:alpine AS runtime`,
-    `RUN rm -f /etc/nginx/conf.d/default.conf`,
-    `COPY --from=builder ${outputPath} /usr/share/nginx/html`,
-    `RUN printf '%s\\n' ${nginxTemplate} > /etc/nginx/conf.d/app.conf`,
-    `EXPOSE ${config.port}`,
-    `CMD ["nginx", "-g", "daemon off;"]`
-  );
-  return lines.join("\n");
+  if (!vertex.startsWith("sha256:") || !msg?.length) return null;
+  return { vertex, msg: text(msg) };
 }
-function generateDockerfile(config) {
-  if (config.isStatic) {
-    return generateStaticDockerfile(config);
-  }
-  if (isPhpRuntime(config) && needsMultiStage(config)) {
-    return generatePhpDockerfile(config);
+var BuildKitTraceDecoder = class {
+  numbers = /* @__PURE__ */ new Map();
+  announced = /* @__PURE__ */ new Set();
+  settled = /* @__PURE__ */ new Set();
+  /** Decode one `aux` payload into the lines it should add to the build log. */
+  push(auxBase64) {
+    let payload;
+    try {
+      payload = Uint8Array.from(Buffer.from(auxBase64, "base64"));
+    } catch {
+      return [];
+    }
+    if (payload.length === 0) return [];
+    const lines = [];
+    const reader = new WireReader(payload);
+    while (!reader.done) {
+      const key = reader.key();
+      if (!key) break;
+      if (key.field === 1 && key.wire === WIRE_LENGTH) {
+        const bytes = reader.bytes();
+        if (!bytes) break;
+        const vertex = decodeVertex(bytes);
+        if (vertex) lines.push(...this.renderVertex(vertex));
+        continue;
+      }
+      if (key.field === 3 && key.wire === WIRE_LENGTH) {
+        const bytes = reader.bytes();
+        if (!bytes) break;
+        const entry = decodeLog(bytes);
+        if (entry) lines.push(...this.renderLog(entry));
+        continue;
+      }
+      if (!reader.skip(key.wire)) break;
+    }
+    return lines;
   }
-  const sourceDir = builderSourceDir(
-    normalizeDockerRootDirectory(config.rootDirectory, config.localPath)
-  );
-  const multiStage = needsMultiStage(config);
-  const envPrefix = buildEnvPrefix(config.envVars);
-  const workspacePrepare = config.workspacePrepareCommand?.trim();
-  const lines = multiStage ? [
-    `FROM ${config.buildImage} AS builder`,
-    `WORKDIR /workspace`,
-    `COPY . /workspace`
-  ] : [
-    `FROM ${config.runtimeImage}`,
-    `WORKDIR /workspace`,
-    `COPY . /workspace`
-  ];
-  if (workspacePrepare) {
-    lines.push(workspacePrepareRunLine(config, envPrefix, workspacePrepare));
+  numberFor(digest) {
+    const existing = this.numbers.get(digest);
+    if (existing !== void 0) return existing;
+    const next = this.numbers.size + 1;
+    this.numbers.set(digest, next);
+    return next;
   }
-  lines.push(`WORKDIR ${sourceDir}`);
-  const stepsLine = installBuildRunLine(config, envPrefix);
-  if (stepsLine) {
-    lines.push(stepsLine);
+  renderVertex(vertex) {
+    if (!vertex.digest) return [];
+    const number = this.numberFor(vertex.digest);
+    const lines = [];
+    if (vertex.name && !this.announced.has(vertex.digest)) {
+      this.announced.add(vertex.digest);
+      lines.push({ message: `#${number} ${vertex.name}`, level: "info" });
+    }
+    if ((vertex.completed || vertex.error) && !this.settled.has(vertex.digest)) {
+      this.settled.add(vertex.digest);
+      if (vertex.error) {
+        lines.push({ message: `#${number} ERROR: ${vertex.error}`, level: "error" });
+      } else if (vertex.cached) {
+        lines.push({ message: `#${number} CACHED`, level: "info" });
+      } else {
+        lines.push({ message: `#${number} DONE`, level: "info" });
+      }
+    }
+    return lines;
   }
-  if (multiStage) {
-    lines.push(`FROM ${config.runtimeImage} AS runtime`);
-    lines.push(...runtimeCopyDirectives(config, sourceDir));
-    lines.push(`WORKDIR /app`);
+  renderLog(entry) {
+    const number = this.numberFor(entry.vertex);
+    return entry.msg.split(/\r?\n/).filter((line) => line.trim().length > 0).map((line) => ({ message: `#${number} ${line}`, level: "info" }));
   }
-  lines.push(`EXPOSE ${config.port}`);
-  if (config.startCommand) {
-    lines.push(`CMD ["sh", "-c", ${JSON.stringify(config.startCommand)}]`);
+};
+function dockerfileNeedsBuildKit(contents) {
+  if (/^\s*#\s*syntax\s*=/im.test(contents.slice(0, 4096))) return true;
+  for (const line of contents.split(/\r?\n/)) {
+    if (/^\s*#/.test(line)) continue;
+    const match = /^\s*(RUN|COPY|ADD)((?:\s+--[^\s]+)*)/i.exec(line);
+    if (!match) continue;
+    const flags = match[2] ?? "";
+    if (/--(mount|network|security)\b/i.test(flags)) return true;
+    if (/--(link|checksum|keep-git-dir)\b/i.test(flags)) return true;
+    if (/(?:^|\s)<<-?\s*['"]?[A-Za-z_][A-Za-z0-9_]*['"]?(?:\s|$)/.test(line)) return true;
   }
-  return lines.join("\n");
+  return false;
 }
 
 // ../../packages/adapters/src/runtime/docker-build-context.ts
 var import_ignore = __toESM(require_ignore(), 1);
 import { spawn } from "child_process";
-import { access as access2, mkdtemp, readdir as readdir2, readFile, rm, writeFile } from "fs/promises";
+import { access, mkdtemp, readdir, readFile, realpath, rm, stat, writeFile } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join2, relative as relative2, sep as sep2 } from "path";
+import { isAbsolute, join, relative, sep } from "path";
 var GIT_CLONE_IDLE_TIMEOUT_MS = 5 * 6e4;
 var GIT_CHECKOUT_IDLE_TIMEOUT_MS = 6e4;
 function spawnGit(args, opts) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve, reject) => {
     const child = spawn("git", args, {
       stdio: ["ignore", "pipe", "pipe"],
       env: {
@@ -961,9 +758,9 @@ function spawnGit(args, opts) {
     });
     child.stderr?.on("data", (buf) => {
       armIdle();
-      const text = buf.toString();
-      stderr += text;
-      for (const ln of text.split(/\r?\n/)) flushLine(ln);
+      const text2 = buf.toString();
+      stderr += text2;
+      for (const ln of text2.split(/\r?\n/)) flushLine(ln);
     });
     armIdle();
     child.on("error", (err) => {
@@ -972,14 +769,14 @@ function spawnGit(args, opts) {
     });
     child.on("close", (code) => {
       clearTimeout(idleTimer);
-      if (code === 0) resolve2();
+      if (code === 0) resolve();
       else reject(new Error(`git exited with code ${code}: ${stderr.trim().slice(-500) || "no stderr"}`));
     });
   });
 }
 var GENERATED_DOCKERFILE_NAME = "Dockerfile.openship";
-function toPosixPath2(value) {
-  return value.split(sep2).filter(Boolean).join("/");
+function toPosixPath(value) {
+  return value.split(sep).filter(Boolean).join("/");
 }
 function anchorDockerignorePattern(line) {
   const trimmed = line.trim();
@@ -992,7 +789,7 @@ function anchorDockerignorePattern(line) {
 }
 async function loadDockerignoreMatcher(rootPath) {
   try {
-    const contents = await readFile(join2(rootPath, ".dockerignore"), "utf-8");
+    const contents = await readFile(join(rootPath, ".dockerignore"), "utf-8");
     return (0, import_ignore.default)().add(contents.split(/\r?\n/).map(anchorDockerignorePattern));
   } catch {
     return void 0;
@@ -1009,16 +806,45 @@ function buildFilePaths(config) {
   }
   return paths;
 }
+function contextKeepPaths(dockerfileName) {
+  const paths = /* @__PURE__ */ new Set([".dockerignore"]);
+  const segments = dockerfileName.split("/").filter(Boolean);
+  for (let depth = 1; depth <= segments.length; depth += 1) {
+    paths.add(segments.slice(0, depth).join("/"));
+  }
+  return paths;
+}
+async function loadContextIgnore(buildContextDir, keep) {
+  const matcher = await loadDockerignoreMatcher(buildContextDir);
+  if (!matcher) return void 0;
+  return (relativePosixPath) => !keep.has(relativePosixPath) && matcher.ignores(relativePosixPath);
+}
+async function resolveBuildContextDir(treeDir, contextSubdir) {
+  const target = resolveWithinDirectory(treeDir, contextSubdir);
+  if (!contextSubdir) return target;
+  const stats = await stat(target).catch(() => null);
+  if (!stats?.isDirectory()) {
+    throw new Error(
+      `Build context "${contextSubdir}" is not a directory in this source. Check the service's build path.`
+    );
+  }
+  const [realTree, realTarget] = await Promise.all([realpath(treeDir), realpath(target)]);
+  const escape = relative(realTree, realTarget);
+  if (escape === ".." || escape.startsWith(`..${sep}`) || isAbsolute(escape)) {
+    throw new Error(`Build context "${contextSubdir}" resolves outside the source tree.`);
+  }
+  return target;
+}
 async function applyDockerignore(contextDir, config) {
   const matcher = await loadDockerignoreMatcher(contextDir);
   if (!matcher) return;
   const buildFiles = buildFilePaths(config);
   const prune = async (currentPath) => {
-    const entries = await readdir2(currentPath, { withFileTypes: true });
+    const entries = await readdir(currentPath, { withFileTypes: true });
     await Promise.all(
       entries.map(async (entry) => {
-        const absolutePath = join2(currentPath, entry.name);
-        const relativePath = toPosixPath2(relative2(contextDir, absolutePath));
+        const absolutePath = join(currentPath, entry.name);
+        const relativePath = toPosixPath(relative(contextDir, absolutePath));
         if (!buildFiles.has(relativePath) && matcher.ignores(relativePath)) {
           await rm(absolutePath, { recursive: true, force: true });
           return;
@@ -1029,10 +855,12 @@ async function applyDockerignore(contextDir, config) {
   };
   await prune(contextDir);
 }
-async function materializeLocalSource(sourcePath, targetPath) {
-  const { args, cleanup } = await prepareSourceTarArgs(sourcePath);
+async function materializeLocalSource(sourcePath, targetPath, outputDirectory) {
+  const outDir = outputDirectory?.trim().replace(/^\.\//, "").replace(/^\/+|\/+$/g, "");
+  const alsoInclude = outDir && outDir !== "." ? [outDir] : void 0;
+  const { args, cleanup } = await prepareSourceTarArgs(sourcePath, { alsoInclude });
   try {
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve, reject) => {
       const create = spawn("tar", args, { env: getTarCreateEnv() });
       const extract = spawn("tar", ["-xzf", "-", "-C", targetPath]);
       let err = "";
@@ -1045,7 +873,7 @@ async function materializeLocalSource(sourcePath, targetPath) {
       create.on("close", (code) => createCode = code);
       create.stdout.pipe(extract.stdin);
       extract.on("close", (code) => {
-        if (code === 0 && (createCode ?? 0) === 0) return resolve2();
+        if (code === 0 && (createCode ?? 0) === 0) return resolve();
         const parts = [
           createCode ? `pack exited ${createCode}: ${createErr.trim().slice(-500)}` : "",
           code ? `extract exited ${code}: ${err.trim().slice(-500)}` : ""
@@ -1057,23 +885,28 @@ async function materializeLocalSource(sourcePath, targetPath) {
     await cleanup();
   }
 }
-async function resolveDockerfileName(contextDir, rootDirectory, explicitDockerfilePath) {
-  const candidates = resolveDockerfileCandidates(rootDirectory, explicitDockerfilePath);
+async function firstExistingCandidate(dir, candidates) {
   for (const candidate of candidates) {
-    const candidatePath = join2(contextDir, ...candidate.split("/"));
-    const exists = await access2(candidatePath).then(() => true).catch(() => false);
+    const candidatePath = join(dir, ...candidate.split("/"));
+    const exists = await access(candidatePath).then(() => true).catch(() => false);
     if (exists) {
       return candidate;
     }
   }
   return null;
 }
+async function resolveDockerfileName(contextDir, rootDirectory, explicitDockerfilePath) {
+  return firstExistingCandidate(
+    contextDir,
+    resolveDockerfileCandidates(rootDirectory, explicitDockerfilePath)
+  );
+}
 async function cloneGitSource(config, targetPath, onLog) {
   let sshMaterial;
   if (config.gitSsh) {
     sshMaterial = await materializeGitSsh(
       localGitSshWriter(),
-      await mkdtemp(join2(tmpdir(), "opsh-ghkey-")),
+      await mkdtemp(join(tmpdir(), "opsh-ghkey-")),
       config.gitSsh
     );
   }
@@ -1104,22 +937,24 @@ async function cloneGitSource(config, targetPath, onLog) {
         env: gitEnv
       });
     }
-    await rm(join2(targetPath, ".git"), { recursive: true, force: true });
+    await rm(join(targetPath, ".git"), { recursive: true, force: true });
   } finally {
     await sshMaterial?.cleanup();
   }
 }
 async function prepareSourceTree(config, opts) {
-  const contextDir = await mkdtemp(join2(tmpdir(), "openship-docker-context-"));
+  const contextDir = await mkdtemp(join(tmpdir(), "openship-docker-context-"));
   try {
+    const pruneDockerignore = !opts?.perServiceBuildContexts && !dockerBuildContextDirectory(config);
     if (config.localPath) {
-      await materializeLocalSource(config.localPath, contextDir);
+      await materializeLocalSource(config.localPath, contextDir, config.outputDirectory);
     } else {
       await cloneGitSource(config, contextDir, opts?.onLog);
     }
-    await applyDockerignore(contextDir, config);
+    if (pruneDockerignore) await applyDockerignore(contextDir, config);
     return {
       contextDir,
+      dockerignorePruned: pruneDockerignore,
       cleanup: async () => {
         await rm(contextDir, { recursive: true, force: true }).catch(() => {
         });
@@ -1131,20 +966,42 @@ async function prepareSourceTree(config, opts) {
     throw error;
   }
 }
+function missingContextDockerfileMessage(contextSubdir, dockerfilePath, opts) {
+  const expected = normalizeDockerRelativePath(dockerfilePath) || "Dockerfile";
+  const at = `${contextSubdir}/${expected.startsWith(`${contextSubdir}/`) ? expected.slice(contextSubdir.length + 1) : expected}`;
+  return `No Dockerfile found in the build context "${contextSubdir}". Expected ${at}.` + // Names the file the build used to fall back to. Before #634 a build dir with no
+  // Dockerfile silently built the REPO ROOT's one under this service's tag, so an
+  // upgrade turns those deploys from "green with the wrong image" to red — and
+  // without this sentence the red gives no clue why.
+  (opts?.rootDockerfileExists ? " The source root has a Dockerfile, but it is outside this service's build context, so it is not used \u2014 set the service's build path to the directory that holds the Dockerfile you want, or add one there." : "") + (opts?.generatedRecipeRefused ? " A declared build context builds from its own Dockerfile \u2014 Openship will not generate one for it, because a generated recipe copies from the source root." : "");
+}
 async function resolveServiceDockerfile(contextDir, config, opts) {
   const requireRepositoryDockerfile = opts?.requireRepositoryDockerfile ?? false;
   const generatedName = opts?.generatedName ?? GENERATED_DOCKERFILE_NAME;
-  const resolvedRootDirectory = await resolveDockerRootDirectory(
-    contextDir,
-    config.rootDirectory,
-    config.localPath
-  );
-  const repositoryDockerfileName = await resolveDockerfileName(
-    contextDir,
-    resolvedRootDirectory,
-    config.dockerfilePath
-  );
+  const contextSubdir = dockerBuildContextDirectory(config);
+  const buildContextDir = await resolveBuildContextDir(contextDir, contextSubdir);
+  const resolvedRootDirectory = contextSubdir ? contextSubdir : await resolveDockerRootDirectory(contextDir, config.rootDirectory, config.localPath);
+  const repositoryDockerfileName = contextSubdir ? await firstExistingCandidate(
+    buildContextDir,
+    resolveContextDockerfileCandidates(contextSubdir, config.dockerfilePath)
+  ) : await resolveDockerfileName(contextDir, resolvedRootDirectory, config.dockerfilePath);
   const hasRepositoryDockerfile = repositoryDockerfileName !== null;
+  if (!hasRepositoryDockerfile && contextSubdir) {
+    throw new Error(
+      missingContextDockerfileMessage(contextSubdir, config.dockerfilePath, {
+        generatedRecipeRefused: !requireRepositoryDockerfile,
+        rootDockerfileExists: await access(join(contextDir, "Dockerfile")).then(() => true).catch(() => false)
+      })
+    );
+  }
+  const explicitDockerfile = normalizeDockerRelativePath(config.dockerfilePath);
+  if (contextSubdir && explicitDockerfile && repositoryDockerfileName === "Dockerfile" && explicitDockerfile !== "Dockerfile" && explicitDockerfile !== `${contextSubdir}/Dockerfile`) {
+    opts?.onLog?.({
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      message: `Configured Dockerfile "${config.dockerfilePath}" was not found in build context "${contextSubdir}" \u2014 using ${contextSubdir}/Dockerfile instead.`,
+      level: "warn"
+    });
+  }
   if (!hasRepositoryDockerfile && requireRepositoryDockerfile) {
     const expectedDockerfile = config.dockerfilePath?.trim() || "Dockerfile";
     throw new Error(
@@ -1153,7 +1010,7 @@ async function resolveServiceDockerfile(contextDir, config, opts) {
   }
   if (!hasRepositoryDockerfile) {
     await writeFile(
-      join2(contextDir, generatedName),
+      join(contextDir, generatedName),
       generateDockerfile({
         ...config,
         rootDirectory: resolvedRootDirectory
@@ -1161,26 +1018,34 @@ async function resolveServiceDockerfile(contextDir, config, opts) {
       "utf-8"
     );
   }
-  const contextEntries = await readdir2(contextDir);
+  const dockerfileName = repositoryDockerfileName ?? generatedName;
+  const requiresBuildKit = hasRepositoryDockerfile ? await readFile(join(buildContextDir, ...dockerfileName.split("/")), "utf-8").then(dockerfileNeedsBuildKit).catch(() => false) : false;
+  const ignoreContextPath = opts?.dockerignorePruned === false ? await loadContextIgnore(buildContextDir, contextKeepPaths(dockerfileName)) : void 0;
+  const contextEntries = (await readdir(buildContextDir)).filter(
+    (entry) => !ignoreContextPath?.(entry)
+  );
   return {
+    buildContextDir,
+    contextSubdir,
     contextEntries,
-    dockerfileName: repositoryDockerfileName ?? generatedName,
+    ignoreContextPath,
+    dockerfileName,
     rootDirectory: resolvedRootDirectory,
-    usesRepositoryDockerfile: hasRepositoryDockerfile
+    usesRepositoryDockerfile: hasRepositoryDockerfile,
+    requiresBuildKit
   };
 }
 async function createDockerBuildContext(config, opts) {
   const tree = await prepareSourceTree(config, { onLog: opts?.onLog });
   try {
     const resolved = await resolveServiceDockerfile(tree.contextDir, config, {
-      requireRepositoryDockerfile: opts?.requireRepositoryDockerfile
+      requireRepositoryDockerfile: opts?.requireRepositoryDockerfile,
+      dockerignorePruned: tree.dockerignorePruned,
+      onLog: opts?.onLog
     });
     return {
+      ...resolved,
       contextDir: tree.contextDir,
-      contextEntries: resolved.contextEntries,
-      dockerfileName: resolved.dockerfileName,
-      rootDirectory: resolved.rootDirectory,
-      usesRepositoryDockerfile: resolved.usesRepositoryDockerfile,
       cleanup: tree.cleanup
     };
   } catch (error) {
@@ -1190,12 +1055,10 @@ async function createDockerBuildContext(config, opts) {
 }
 
 export {
-  normalizeDockerRelativePath,
-  resolveWithinDirectory,
-  resolveDockerfileCandidates,
-  staticBuilderOutputPath,
-  generateDockerfile,
+  resolveDockerBuildArgs,
+  BuildKitTraceDecoder,
   prepareSourceTree,
+  missingContextDockerfileMessage,
   resolveServiceDockerfile,
   createDockerBuildContext
 };