openship 0.6.7 → 0.6.8

package/dist/{chunk-PPEBIY5F.js → chunk-5I3COAFH.js}

@@ -10,28 +10,28 @@ import {
   readComposeEnvFile,
   resolveLocalEnvironmentSync,
   thisHost
-} from "./chunk-VQM6JHJB.js";
+} from "./chunk-5UXHT6ED.js";
 import {
   OS_DIR
 } from "./chunk-ELGRMZOW.js";
 import {
   systemCatalog
-} from "./chunk-ZPJ74LXE.js";
+} from "./chunk-NIYD7MD2.js";
 import {
   EDGE_CONTAINER_MOUNTS,
   EDGE_HOST_STATE_DIR
-} from "./chunk-QHMDCYZ3.js";
+} from "./chunk-7PEXM2UI.js";
 import {
   DEFAULT_DOCKER_SOCKET_PATH,
   resolveLocalDockerSocketPath
-} from "./chunk-LHFXSC36.js";
+} from "./chunk-3MP6ACKM.js";
 import {
   LocalExecutor
-} from "./chunk-E2X26PXR.js";
+} from "./chunk-T6DVUX4F.js";
 import {
   invalidateEdgeContainer,
   sanitizeEdgeVhosts
-} from "./chunk-GIPJNNI5.js";
+} from "./chunk-X53JXRS4.js";
 import {
   DEFAULT_IMAGE_REGISTRY,
   HOST_CHANNEL_BLOCKED,
@@ -51,7 +51,7 @@ import {
   hostFirewallRule,
   hostFirewallRuleRemoval,
   wrapText
-} from "./chunk-2VSW6Q6C.js";
+} from "./chunk-WEZFTL4V.js";
 
 // src/lib/host-channel-preflight.ts
 import { spawnSync as spawnSync4 } from "child_process";
@@ -66,13 +66,14 @@ import {
   existsSync as existsSync4,
   mkdirSync as mkdirSync3,
   readFileSync as readFileSync3,
+  realpathSync,
   renameSync,
   rmSync,
   statSync,
   writeFileSync as writeFileSync2
 } from "fs";
 import { homedir, userInfo } from "os";
-import { dirname, join as join4, resolve as resolve2 } from "path";
+import { dirname, join as join4, relative, resolve as resolve2 } from "path";
 
 // src/lib/ports.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
@@ -400,8 +401,30 @@ async function rebuildFromSource(info) {
 // src/lib/compose.ts
 var EDGE_SITES_HOST_DIR = `${EDGE_HOST_STATE_DIR}/sites-enabled`;
 var EDGE_ACME_HOST_DIR = `${EDGE_HOST_STATE_DIR}/acme`;
+function canonicalComposeHostPath(target, platform = process.platform, resolvePath = realpathSync) {
+  if (platform !== "darwin") return target;
+  try {
+    return resolvePath(target);
+  } catch {
+    let parent = target;
+    while (parent !== dirname(parent)) {
+      parent = dirname(parent);
+      try {
+        return join4(resolvePath(parent), relative(parent, target));
+      } catch {
+      }
+    }
+    throw new Error(`Could not resolve edge bind-mount source ${target} on this Mac.`);
+  }
+}
+function composeEdgeMounts() {
+  return EDGE_CONTAINER_MOUNTS.map((mount) => ({
+    ...mount,
+    host: canonicalComposeHostPath(mount.host)
+  }));
+}
 function edgeVolumeYaml(indent) {
-  return EDGE_CONTAINER_MOUNTS.map((m) => `${indent}- ${m.host}:${m.container}:z`).join("\n");
+  return composeEdgeMounts().map((m) => `${indent}- ${m.host}:${m.container}:z`).join("\n");
 }
 var DOCKER_CONFIG_MOUNT_MARKER = "__OPENSHIP_DOCKER_CONFIG_MOUNT__";
 function dockerConfigMountYaml(indent) {
@@ -1604,7 +1627,7 @@ function operatorEnvPassthrough(managed, prev) {
 }
 var PRESERVED_ENV_HEADER = "# Preserved from your existing .env \u2014 set by you, not by `openship up` (#485).";
 function resolveImageVersion(opts) {
-  return opts.version?.trim() || process.env.OPENSHIP_VERSION?.trim() || (true ? "0.6.7" : "latest");
+  return opts.version?.trim() || process.env.OPENSHIP_VERSION?.trim() || (true ? "0.6.8" : "latest");
 }
 function managedEnvLines(opts, host, cfg, prev) {
   const lines = [
@@ -1774,7 +1797,7 @@ function composePlan(opts) {
     secretRotation: opts.resetSecrets ? null : secretRotationRisk(prev),
     pgDataRisk: pgDataDetectionRisk(prev),
     existing: Object.keys(prev).length > 0,
-    mountDirs: EDGE_CONTAINER_MOUNTS.map((m) => m.host),
+    mountDirs: composeEdgeMounts().map((m) => m.host),
     buildDir,
     hostChannel
   };
@@ -1854,7 +1877,7 @@ function composePrefetch(opts) {
 }
 function ensureEdgeMountDirs() {
   const failed = [];
-  for (const { host } of EDGE_CONTAINER_MOUNTS) {
+  for (const { host } of composeEdgeMounts()) {
     try {
       mkdirSync3(host, { recursive: true });
     } catch (err) {

package/dist/{chunk-VQM6JHJB.js → chunk-5UXHT6ED.js}

@@ -134,10 +134,10 @@ import {
 } from "./chunk-ZWLDLTJP.js";
 import {
   CloudRuntime
-} from "./chunk-CIJV43LH.js";
+} from "./chunk-MUWVC5R4.js";
 import {
   OPENRESTY_DEFAULT_PATHS
-} from "./chunk-QHMDCYZ3.js";
+} from "./chunk-7PEXM2UI.js";
 import {
   DockerRuntime,
   daemonConnectionFrom,
@@ -146,26 +146,26 @@ import {
   resolveExecExitCode,
   startAttachStream,
   startExecStream
-} from "./chunk-LHFXSC36.js";
+} from "./chunk-3MP6ACKM.js";
 import {
   BareRuntime
-} from "./chunk-S6B2Z3OO.js";
+} from "./chunk-ENKJ7XIF.js";
 import {
   createExecutor
-} from "./chunk-GGIAIGUL.js";
+} from "./chunk-UAWY6X7V.js";
 import {
   envOps
-} from "./chunk-BLEXTYRK.js";
+} from "./chunk-GNOMEMNI.js";
 import {
   ENVIRONMENT_PROBE_SCRIPT,
   ENVIRONMENT_PROBE_TIMEOUT_MS,
   cacheEnvironment,
   parseEnvironmentProbe,
   profileIsFresh
-} from "./chunk-FZ6QCF6B.js";
+} from "./chunk-NPSRGIHV.js";
 import {
   MAIL_HOST_STATE_DIR
-} from "./chunk-UWEV6XTS.js";
+} from "./chunk-D6HU4VUZ.js";
 import {
   FAMILY_BY_DISTRO,
   isAwsS3Endpoint,
@@ -177,7 +177,7 @@ import {
   validateBackupPath,
   validateClearPath,
   withTimeout
-} from "./chunk-2VSW6Q6C.js";
+} from "./chunk-WEZFTL4V.js";
 
 // ../../packages/adapters/src/runtime/image-transfer.ts
 import { Transform } from "stream";

package/dist/{chunk-XWHWTHEL.js → chunk-6GU6JSK6.js}

@@ -13,11 +13,14 @@ import {
   resolveDockerRootDirectory,
   resolveDockerfileCandidates,
   resolveWithinDirectory
-} from "./chunk-H4FS5BED.js";
+} from "./chunk-AHJYP7DG.js";
 import {
   getTarCreateEnv,
   prepareSourceTarArgs
-} from "./chunk-2ANV5ZQ5.js";
+} from "./chunk-VAI5VOOI.js";
+import {
+  isValidEnvKey
+} from "./chunk-WEZFTL4V.js";
 import {
   __commonJS,
   __toESM
@@ -481,6 +484,21 @@ var require_ignore = __commonJS({
   }
 });
 
+// ../../packages/adapters/src/runtime/docker-build-args.ts
+function resolveDockerBuildArgs(config) {
+  const invalidExplicit = Object.keys(config.buildArgs ?? {}).filter((key) => !isValidEnvKey(key));
+  if (invalidExplicit.length > 0) {
+    throw new Error(`Invalid Docker build argument name(s): ${invalidExplicit.join(", ")}`);
+  }
+  const inherited = Object.fromEntries(
+    Object.entries({
+      ...config.envVars,
+      NODE_ENV: "production"
+    }).filter(([key]) => isValidEnvKey(key))
+  );
+  return { ...inherited, ...config.buildArgs };
+}
+
 // ../../packages/adapters/src/runtime/docker-buildkit-trace.ts
 var WIRE_VARINT = 0;
 var WIRE_64BIT = 1;
@@ -1037,6 +1055,7 @@ async function createDockerBuildContext(config, opts) {
 }
 
 export {
+  resolveDockerBuildArgs,
   BuildKitTraceDecoder,
   prepareSourceTree,
   missingContextDockerfileMessage,

package/dist/{chunk-QHMDCYZ3.js → chunk-7PEXM2UI.js}

@@ -5,19 +5,23 @@ const require = __ospCreateRequire(import.meta.url);
 import {
   envOps,
   opScript
-} from "./chunk-BLEXTYRK.js";
+} from "./chunk-GNOMEMNI.js";
 import {
   resolveEnvironment
-} from "./chunk-FZ6QCF6B.js";
+} from "./chunk-NPSRGIHV.js";
 import {
   sq
-} from "./chunk-H3WT3A6R.js";
+} from "./chunk-P7RCYELG.js";
+import {
+  describeProcess,
+  probeListeningPortOwners
+} from "./chunk-BO6CY4V2.js";
 import {
   SYSTEM,
   answered,
   refused,
   safeErrorMessage
-} from "./chunk-2VSW6Q6C.js";
+} from "./chunk-WEZFTL4V.js";
 
 // ../../packages/adapters/src/infra/openresty-lua.ts
 import { createHash, randomBytes } from "crypto";
@@ -240,6 +244,184 @@ var EDGE_NOT_FOUND_LOCATION = `    server_tokens off;
         return 404 '${EDGE_NOT_FOUND_HTML}';
     }`;
 
+// ../../packages/adapters/src/infra/openresty-reload.ts
+var NGINX_MASTER_RE = /\b(?:nginx|openresty)\s*:\s*master process/i;
+var NGINX_WORKER_RE = /\b(?:nginx|openresty)\s*:\s*worker process/i;
+var NGINX_PROCESS_RE = /\b(?:nginx|openresty)\b/i;
+async function canonicalRemotePath(executor, path) {
+  const resolved = await executor.exec(`readlink -f ${sq(path)} 2>/dev/null || true`, { timeout: 5e3 }).catch(() => "");
+  return resolved.trim() || null;
+}
+function explicitNginxConfig(rawCommand) {
+  const match = rawCommand.match(/(?:^|\s)-c(?:(?:\s+|=)(?:"([^"]+)"|'([^']+)'|(\S+))|(\S+))/);
+  if (!match) return void 0;
+  const value = match[1] ?? match[2] ?? match[3] ?? match[4] ?? "";
+  return value.startsWith("/") ? value : null;
+}
+function hasExplicitNginxPrefix(rawCommand) {
+  return /(?:^|\s)-p(?:\s+|=|\S)/.test(rawCommand);
+}
+async function processStartTime(executor, pid) {
+  const value = await executor.exec(
+    `awk '{ line=$0; sub(/^.*\\) /, "", line); split(line, fields, " "); print fields[20] }' /proc/${pid}/stat 2>/dev/null || true`,
+    { timeout: 5e3 }
+  ).catch(() => "");
+  return /^\d+$/.test(value.trim()) ? value.trim() : null;
+}
+async function verifyNginxProcessIdentity(executor, occupant, paths) {
+  if (!occupant.pid) return "unknown";
+  const rawCommand = occupant.rawCommand?.trim();
+  if (!rawCommand || !NGINX_MASTER_RE.test(rawCommand)) return "unknown";
+  const [actualExe, expectedExe] = await Promise.all([
+    canonicalRemotePath(executor, `/proc/${occupant.pid}/exe`),
+    canonicalRemotePath(executor, paths.bin)
+  ]);
+  if (!actualExe || !expectedExe) return "unknown";
+  if (actualExe !== expectedExe) return "foreign";
+  if (hasExplicitNginxPrefix(rawCommand)) return "unknown";
+  const explicitConfig = explicitNginxConfig(rawCommand);
+  if (explicitConfig === null) return "unknown";
+  const effectiveConfig = explicitConfig ?? paths.compiledConfPath;
+  const [actualConfig, expectedConfig] = await Promise.all([
+    canonicalRemotePath(executor, effectiveConfig),
+    canonicalRemotePath(executor, paths.confPath)
+  ]);
+  if (!actualConfig || !expectedConfig || actualConfig !== expectedConfig) return "unknown";
+  return "match";
+}
+async function resolveListeningNginxMaster(executor, occupant) {
+  const description = `${occupant.rawCommand ?? ""} ${occupant.command}`;
+  if (!occupant.pid || !NGINX_WORKER_RE.test(description)) return occupant;
+  const rawParent = await executor.exec(`awk '/^PPid:/{print $2}' /proc/${occupant.pid}/status 2>/dev/null || true`).catch(() => "");
+  const parentPid = Number.parseInt(rawParent.trim(), 10);
+  if (!Number.isInteger(parentPid) || parentPid <= 1) return occupant;
+  const parent = await describeProcess(executor, parentPid).catch(() => null);
+  if (!parent) return occupant;
+  const parentDescription = `${parent.rawCommand ?? ""} ${parent.command}`;
+  return NGINX_MASTER_RE.test(parentDescription) ? parent : occupant;
+}
+async function reloadBareOpenResty(executor, paths, opts = {}) {
+  await executor.exec(`${sq(paths.bin)} -t -c ${sq(paths.confPath)} 2>&1`, {
+    timeout: 15e3
+  });
+  const listenerStates = await Promise.all([
+    probeListeningPortOwners(executor, 80),
+    probeListeningPortOwners(executor, 443)
+  ]);
+  if (listenerStates.some((state) => !state.checked)) {
+    throw new Error(
+      "OpenResty config is valid, but the port 80/443 listener probe was inconclusive; refusing to assume the managed daemon is stopped."
+    );
+  }
+  if (listenerStates.some((state) => !state.ownershipComplete)) {
+    throw new Error(
+      "OpenResty config is valid, but every listener on port 80/443 could not be identified; refusing to signal an unknown or mixed owner."
+    );
+  }
+  const occupants = listenerStates.flatMap((state) => state.occupants);
+  const verifiedMasters = /* @__PURE__ */ new Map();
+  let foreignListenerOwner = false;
+  let ambiguousNginxOwner = false;
+  let containerBackedNginxOwner = false;
+  for (const occupant of occupants) {
+    if (!occupant.rawCommand?.trim()) {
+      ambiguousNginxOwner = true;
+      continue;
+    }
+    const description = [
+      occupant.rawCommand,
+      occupant.command,
+      occupant.systemdUnit,
+      occupant.systemdDescription
+    ].filter(Boolean).join(" ");
+    if (!NGINX_PROCESS_RE.test(description)) {
+      foreignListenerOwner = true;
+      continue;
+    }
+    if (occupant.containerId) {
+      containerBackedNginxOwner = true;
+      continue;
+    }
+    const master = await resolveListeningNginxMaster(executor, occupant);
+    if (master.containerId) {
+      containerBackedNginxOwner = true;
+      continue;
+    }
+    const initialIdentity = await verifyNginxProcessIdentity(executor, master, paths);
+    if (initialIdentity === "foreign") {
+      foreignListenerOwner = true;
+      continue;
+    }
+    if (initialIdentity === "unknown" || !master.pid) {
+      ambiguousNginxOwner = true;
+      continue;
+    }
+    if (master.cgroupVerified !== true || !master.processCgroup) {
+      ambiguousNginxOwner = true;
+      continue;
+    }
+    const startTime = await processStartTime(executor, master.pid);
+    if (!startTime) {
+      ambiguousNginxOwner = true;
+      continue;
+    }
+    const refreshedMaster = await describeProcess(executor, master.pid).catch(() => null);
+    const confirmedStartTime = await processStartTime(executor, master.pid);
+    if (!refreshedMaster || confirmedStartTime !== startTime || refreshedMaster.cgroupVerified !== true || !refreshedMaster.processCgroup) {
+      ambiguousNginxOwner = true;
+      continue;
+    }
+    if (refreshedMaster.containerId) {
+      containerBackedNginxOwner = true;
+      continue;
+    }
+    const identity = await verifyNginxProcessIdentity(executor, refreshedMaster, paths);
+    if (identity !== "match") {
+      ambiguousNginxOwner = true;
+      continue;
+    }
+    verifiedMasters.set(master.pid, {
+      pid: master.pid,
+      startTime,
+      processCgroup: refreshedMaster.processCgroup
+    });
+  }
+  if (containerBackedNginxOwner) {
+    throw new Error(
+      "A container-backed nginx/OpenResty listener owns port 80/443; refusing to signal it from bare-host reload."
+    );
+  }
+  if (ambiguousNginxOwner) {
+    throw new Error(
+      "A live nginx/OpenResty listener was found, but its executable and configuration could not be verified, or its host ownership could not be proven; refusing to signal an ambiguous process."
+    );
+  }
+  if (foreignListenerOwner) {
+    throw new Error(
+      verifiedMasters.size > 0 ? "The managed OpenResty master shares ports 80/443 with a foreign listener; refusing a reload that cannot apply the validated configuration safely." : "A foreign listener owns port 80/443; refusing to treat a live daemon as stopped or report the managed route reload as complete."
+    );
+  }
+  if (verifiedMasters.size === 0) {
+    if (opts.allowStopped && occupants.length === 0) return;
+    const owners = occupants.map((occupant) => occupant.command).filter(Boolean);
+    throw new Error(
+      "OpenResty config is valid, but no verified bare-host master is listening on port 80/443" + (owners.length > 0 ? ` (found: ${owners.join(", ")})` : "") + "; refusing to start a second daemon."
+    );
+  }
+  if (verifiedMasters.size !== 1) {
+    throw new Error(
+      `Found ${verifiedMasters.size} verified nginx/OpenResty masters on ports 80/443; refusing an ambiguous reload.`
+    );
+  }
+  const target = [...verifiedMasters.values()][0];
+  await executor.exec(
+    `current_exe=$(readlink -f /proc/${target.pid}/exe 2>/dev/null || true); expected_exe=$(readlink -f ${sq(paths.bin)} 2>/dev/null || true); current_start=$(awk '{ line=$0; sub(/^.*\\) /, "", line); split(line, fields, " "); print fields[20] }' /proc/${target.pid}/stat 2>/dev/null || true); current_cgroup=$(cat /proc/${target.pid}/cgroup 2>/dev/null) || { echo "nginx master cgroup became unreadable; refusing reload" >&2; exit 1; }; [ -n "$current_exe" ] && [ "$current_exe" = "$expected_exe" ] && [ "$current_start" = ${sq(target.startTime)} ] && [ -n "$current_cgroup" ] && [ "$current_cgroup" = ${sq(target.processCgroup)} ] || { echo "nginx master identity changed; refusing reload" >&2; exit 1; }; kill -HUP ${target.pid}`,
+    { timeout: 5e3 }
+  ).catch((err) => {
+    throw new Error(`Safe bare-host OpenResty reload failed: ${safeErrorMessage(err)}`);
+  });
+}
+
 // ../../packages/adapters/src/infra/openresty-lua.ts
 var OPENRESTY_LUA_DIR = "/usr/local/openresty/site/lualib/openship";
 var LUA_LOGGER_PATH = `${OPENRESTY_LUA_DIR}/site_logger.lua`;
@@ -293,6 +475,7 @@ function parseNginxVersion(raw) {
 }
 var OPENRESTY_DEFAULT_PATHS = {
   bin: "/usr/local/openresty/bin/openresty",
+  compiledConfPath: "/usr/local/openresty/nginx/conf/nginx.conf",
   confPath: "/usr/local/openresty/nginx/conf/nginx.conf",
   confDir: "/usr/local/openresty/nginx/conf",
   sitesDir: "/usr/local/openresty/nginx/conf/sites-enabled",
@@ -316,6 +499,7 @@ var EDGE_SAME_PATH_MOUNTS = EDGE_CONTAINER_MOUNTS.filter(
 ).map((m) => m.host.replace(/\/+$/, ""));
 var EDGE_HOST_PATHS = {
   bin: OPENRESTY_DEFAULT_PATHS.bin,
+  compiledConfPath: OPENRESTY_DEFAULT_PATHS.compiledConfPath,
   confPath: OPENRESTY_DEFAULT_PATHS.confPath,
   confDir: OPENRESTY_DEFAULT_PATHS.confDir,
   sitesDir: `${EDGE_HOST_STATE_DIR}/sites-enabled`,
@@ -333,7 +517,8 @@ async function detectOpenRestyPaths(executor) {
     return m ? m[1] : null;
   };
   const bin = parseFlag("sbin-path") ?? OPENRESTY_DEFAULT_PATHS.bin;
-  let confPath = parseFlag("conf-path") ?? OPENRESTY_DEFAULT_PATHS.confPath;
+  const compiledConfPath = parseFlag("conf-path") ?? OPENRESTY_DEFAULT_PATHS.compiledConfPath;
+  let confPath = compiledConfPath;
   const pidPath = parseFlag("pid-path") ?? OPENRESTY_DEFAULT_PATHS.pidPath;
   if (!await executor.exists(confPath)) {
     let found = false;
@@ -351,6 +536,7 @@ async function detectOpenRestyPaths(executor) {
   const nginxVersion = parseNginxVersion(raw);
   return {
     bin,
+    compiledConfPath,
     confPath,
     confDir,
     sitesDir: `${confDir}/sites-enabled`,
@@ -358,28 +544,11 @@ async function detectOpenRestyPaths(executor) {
     ...nginxVersion ? { nginxVersion } : {}
   };
 }
-function buildReloadCommand(paths, opts = {}) {
-  if (opts.containerEdge) {
-    return `${paths.bin} -t 2>&1 || exit 1
-${paths.bin} -s reload 2>&1 || exit 1`;
-  }
-  return `${paths.bin} -t 2>&1 || exit 1
-
-reload_err=$(${paths.bin} -s reload 2>&1) && exit 0
-
-if [ "$(cat /proc/1/comm 2>/dev/null)" = "openresty" ] || [ "$(cat /proc/1/comm 2>/dev/null)" = "nginx" ]; then
-  echo "openresty reload failed and openresty is PID 1 (containerized edge) \u2014 not killing it; the container supervisor owns restarts." >&2
-  echo "$reload_err" >&2
-  exit 1
-fi
-
-if [ -f ${paths.pidPath} ] && kill -0 "$(cat ${paths.pidPath} 2>/dev/null)" 2>/dev/null; then
-  echo "openresty (pid $(cat ${paths.pidPath})) is running but refused -s reload" >&2
-  exit 1
-fi
-
-rm -f ${paths.pidPath}
-${paths.bin}`;
+function buildReloadCommand(paths) {
+  const bin = sq(paths?.bin || "openresty");
+  const config = sq(paths?.confPath || "/etc/openresty/nginx.conf");
+  return `${bin} -t -c ${config} 2>&1 || exit 1
+${bin} -s reload -c ${config} 2>&1 || exit 1`;
 }
 async function ensureEdgeDefaultCert(executor, confDir) {
   const { dir, certPath, keyPath } = edgeDefaultCertPaths(confDir);
@@ -422,10 +591,7 @@ async function ensureOpenRestyConfig(executor, paths) {
   await executor.writeFile(`${paths.sitesDir}/_default.conf`, edgeDefaultCatchAllConf(defaultCert));
   if (!await executor.exists(paths.confPath)) {
     await executor.mkdir(paths.confDir);
-    await executor.writeFile(
-      paths.confPath,
-      MINIMAL_NGINX_CONF(paths.confDir, paths.sitesDir)
-    );
+    await executor.writeFile(paths.confPath, MINIMAL_NGINX_CONF(paths.confDir, paths.sitesDir));
     return;
   }
   const hasCorrectInclude = await executor.exec(`grep -qF 'include ${paths.sitesDir}/' ${paths.confPath}`).then(() => true).catch(() => false);
@@ -518,11 +684,11 @@ var ACME_CHALLENGE_LOCATION = `    location ^~ /.well-known/acme-challenge/ {
     }`;
 var EDGE_CHALLENGE_URL_PREFIX = "/.well-known/oblien-proxy-challenge/";
 var EDGE_CHALLENGE_ROOT = "/var/www/acme/oblien";
-var EDGE_CHALLENGE_DIR = `${EDGE_CHALLENGE_ROOT}${EDGE_CHALLENGE_URL_PREFIX}`.replace(/\/$/, "");
-var EDGE_CHALLENGE_HOST_DIR = `${EDGE_HOST_STATE_DIR}/acme/oblien${EDGE_CHALLENGE_URL_PREFIX}`.replace(
+var EDGE_CHALLENGE_DIR = `${EDGE_CHALLENGE_ROOT}${EDGE_CHALLENGE_URL_PREFIX}`.replace(
   /\/$/,
   ""
 );
+var EDGE_CHALLENGE_HOST_DIR = `${EDGE_HOST_STATE_DIR}/acme/oblien${EDGE_CHALLENGE_URL_PREFIX}`.replace(/\/$/, "");
 var EDGE_CHALLENGE_LOCATION = `    location ^~ ${EDGE_CHALLENGE_URL_PREFIX} {
         root ${EDGE_CHALLENGE_ROOT};
         default_type text/plain;
@@ -635,7 +801,9 @@ async function ensureLuaScripts(executor, paths) {
     const expected = luaBundleHash();
     await executor.mkdir(OPENRESTY_LUA_DIR);
     const listing = await executor.exec(`ls -1 '${OPENRESTY_LUA_DIR}' 2>/dev/null || true`).catch(() => "");
-    const present = new Set(listing.split("\n").map((s) => s.trim()).filter(Boolean));
+    const present = new Set(
+      listing.split("\n").map((s) => s.trim()).filter(Boolean)
+    );
     const missing = LUA_SCRIPTS.filter((name) => !present.has(name));
     const onBoxVersion = (await executor.readFile(LUA_VERSION_MARKER).catch(() => "")).trim();
     if (missing.length === 0 && onBoxVersion === expected) {
@@ -647,12 +815,14 @@ async function ensureLuaScripts(executor, paths) {
     await executor.writeFile(LUA_VERSION_MARKER, expected);
     const reason = missing.length ? `missing: ${missing.join(", ")}` : "version changed";
     console.warn(`[openresty] (re)installed Lua (${reason}) \u2014 reloading edge.`);
-    await executor.exec(buildReloadCommand(paths)).catch((err) => {
+    await reloadBareOpenResty(executor, paths).catch((err) => {
       console.error(`[openresty] reload after Lua (re)install failed: ${safeErrorMessage(err)}`);
     });
     return { repaired: missing.length ? missing : [...LUA_SCRIPTS], available: true };
   } catch (err) {
-    console.error(`[openresty] ensureLuaScripts failed (deploy continues): ${safeErrorMessage(err)}`);
+    console.error(
+      `[openresty] ensureLuaScripts failed (deploy continues): ${safeErrorMessage(err)}`
+    );
     return { repaired: [], available: false };
   }
 }
@@ -672,15 +842,15 @@ async function installGeoDeps(executor) {
       );
     });
   } else {
-    console.warn(`[openresty] libmaxminddb not installed \u2014 geo lookups return nil: ${install.reason}`);
+    console.warn(
+      `[openresty] libmaxminddb not installed \u2014 geo lookups return nil: ${install.reason}`
+    );
   }
   try {
     const exists = await executor.exists(GEOIP_DB_PATH);
     if (!exists) {
       await executor.mkdir(GEOIP_DIR);
-      await executor.exec(
-        `curl -fsSL -o ${GEOIP_DB_PATH} "${GEOIP_DB_URL}"`
-      );
+      await executor.exec(`curl -fsSL -o ${GEOIP_DB_PATH} "${GEOIP_DB_URL}"`);
     }
   } catch {
   }
@@ -694,10 +864,7 @@ async function deployLuaScripts(executor, paths) {
   }
   await executor.mkdir(OPENRESTY_LUA_DIR);
   for (const name of LUA_SCRIPTS) {
-    await executor.writeFile(
-      `${OPENRESTY_LUA_DIR}/${name}`,
-      readLua(name)
-    );
+    await executor.writeFile(`${OPENRESTY_LUA_DIR}/${name}`, readLua(name));
   }
   await ensureOpenRestyConfig(executor, paths);
   for (const dict of EDGE_SHARED_DICTS) {
@@ -713,12 +880,13 @@ async function deployLuaScripts(executor, paths) {
   await executor.exec(
     `grep -q '${EDGE_REAL_IP_CONF_NAME}' '${paths.confPath}' || sed -i '/http *{/a \\    include ${realIpPath};' '${paths.confPath}'`
   );
-  await executor.exec(buildReloadCommand(paths));
+  await reloadBareOpenResty(executor, paths);
 }
 
 export {
   isCloudFrontedHost,
   cloudEdgeRealIpConf,
+  reloadBareOpenResty,
   OPENRESTY_LUA_DIR,
   LUA_LOGGER_PATH,
   RULES_GUARD_PATH,

package/dist/{chunk-RDXT4BQB.js → chunk-7YBWXEM6.js}

@@ -7,20 +7,20 @@ import {
   composeInstallExists,
   readComposeEnvFile,
   startUnitHint
-} from "./chunk-VQM6JHJB.js";
+} from "./chunk-5UXHT6ED.js";
 import {
   INTERNAL_TOKEN_FILE,
   OS_DIR
 } from "./chunk-ELGRMZOW.js";
 import {
   LocalExecutor
-} from "./chunk-E2X26PXR.js";
+} from "./chunk-T6DVUX4F.js";
 import {
   edgeCrashReason
-} from "./chunk-GIPJNNI5.js";
+} from "./chunk-X53JXRS4.js";
 import {
   EDGE_CONTAINER_NAME
-} from "./chunk-UWEV6XTS.js";
+} from "./chunk-D6HU4VUZ.js";
 
 // src/lib/edge-import.ts
 import chalk from "chalk";

package/dist/{chunk-H4FS5BED.js → chunk-AHJYP7DG.js}

@@ -5,7 +5,7 @@ const require = __ospCreateRequire(import.meta.url);
 import {
   getTarCreateEnv,
   prepareSourceTarArgs
-} from "./chunk-2ANV5ZQ5.js";
+} from "./chunk-VAI5VOOI.js";
 import {
   TRANSFER_EXCLUDES,
   nodeBinDirs,
@@ -13,23 +13,25 @@ import {
   packageManagerEnsureCommand,
   safeErrorMessage,
   shellQuote
-} from "./chunk-2VSW6Q6C.js";
+} from "./chunk-WEZFTL4V.js";
 
 // ../../packages/adapters/src/runtime/git-clone.ts
 var sq = shellQuote;
+function gitCredentialPair(hostname, token) {
+  if (hostname === "github.com" && !token.startsWith("ghs_")) {
+    return { username: token, password: "x-oauth-basic" };
+  }
+  return { username: "x-access-token", password: token };
+}
 function injectGitToken(repoUrl, token) {
-  if (!token) return repoUrl;
+  const secret = token?.trim();
+  if (!secret) return repoUrl;
   try {
     const url = new URL(repoUrl);
     if (url.protocol !== "https:") return repoUrl;
-    const isGitHub = /(^|\.)github\.com$/.test(url.hostname);
-    if (isGitHub && !token.startsWith("ghs_")) {
-      url.username = token;
-      url.password = "";
-    } else {
-      url.username = "x-access-token";
-      url.password = token;
-    }
+    const { username, password } = gitCredentialPair(url.hostname, secret);
+    url.username = username;
+    url.password = password;
     return url.toString();
   } catch {
     return repoUrl;