openship 0.6.7 → 0.6.9

package/dist/{chunk-NRTJRNAE.js → chunk-IAMOUDHY.js}

@@ -17,8 +17,9 @@ import {
   detectOpenRestyPaths,
   edgeChallengeVhostConf,
   isCloudFrontedHost,
-  luaSourceAvailable
-} from "./chunk-QHMDCYZ3.js";
+  luaSourceAvailable,
+  reloadBareOpenResty
+} from "./chunk-7PEXM2UI.js";
 import {
   edgeDownExplanation,
   explainEdgeDown,
@@ -29,17 +30,17 @@ import {
 } from "./chunk-R4VDPFLS.js";
 import {
   EXECUTOR_DELEGATE
-} from "./chunk-FZ6QCF6B.js";
+} from "./chunk-NPSRGIHV.js";
 import {
   logEntry,
   sq
-} from "./chunk-H3WT3A6R.js";
+} from "./chunk-P7RCYELG.js";
 import {
   edgeFailureReason
-} from "./chunk-GIPJNNI5.js";
+} from "./chunk-X53JXRS4.js";
 import {
   probeListeningPort
-} from "./chunk-VSTFHUCV.js";
+} from "./chunk-BO6CY4V2.js";
 import {
   PROXY_DIRECTIVES,
   parseProxyValue,
@@ -47,7 +48,7 @@ import {
   resolveRedirectStatus,
   safeErrorMessage,
   sanitizeProxySettings
-} from "./chunk-2VSW6Q6C.js";
+} from "./chunk-WEZFTL4V.js";
 
 // ../../packages/adapters/src/infra/nginx.ts
 import {
@@ -593,7 +594,7 @@ function acmeKeyArgs(keyType) {
       return [];
   }
 }
-var DOMAIN_RE = /^[a-zA-Z0-9]([a-zA-Z0-9.-]*[a-zA-Z0-9])?$/;
+var DOMAIN_RE = /^(\*\.)?[a-zA-Z0-9]([a-zA-Z0-9.-]*[a-zA-Z0-9])?$/;
 function assertValidDomain(domain) {
   if (!DOMAIN_RE.test(domain) || domain.length > 253) {
     throw new Error(`Invalid domain: ${domain}`);
@@ -601,7 +602,9 @@ function assertValidDomain(domain) {
 }
 function assertNoNginxInjection(value, what) {
   if (/[\s;{}#\\'"]/.test(value)) {
-    throw new Error(`Invalid ${what} (contains characters that could inject nginx config): ${value}`);
+    throw new Error(
+      `Invalid ${what} (contains characters that could inject nginx config): ${value}`
+    );
   }
 }
 function assertNoRuntimeVariable(value, what, allowCaptures = false) {
@@ -698,7 +701,9 @@ function certbotDiagnosis(output, domain) {
     diagnosis = `Couldn't start the certificate challenge listener for ${domain} on port ${ACME_HTTP01_PORT}: something on this server is already holding it. That port is used only while a certificate is being issued, so this is almost always a certificate run from an earlier attempt that hasn't exited \u2014 retry, and if it persists find the holder with \`ss -ltnp | grep ${ACME_HTTP01_PORT}\` and stop it. Nothing was requested from Let's Encrypt, so this is not a DNS or routing problem.`;
   } else if (/timeout during connect|connection refused|failed to connect|Timeout/i.test(text)) {
     diagnosis = `Port 80 for ${domain} isn't reachable from the internet \u2014 a firewall / cloud security group is blocking it, the domain doesn't point at this server, or another proxy is still bound to :80.`;
-  } else if (/NXDOMAIN|no\s+(A|AAAA)\s+record|DNS problem|could not be resolved|no records? found/i.test(text)) {
+  } else if (/NXDOMAIN|no\s+(A|AAAA)\s+record|DNS problem|could not be resolved|no records? found/i.test(
+    text
+  )) {
     diagnosis = `${domain} doesn't resolve to this server yet \u2014 the DNS A record is missing or hasn't propagated. Wait for propagation, then retry from the Domains tab.`;
   } else if (/\b52[56]\b|ssl handshake failed/i.test(text)) {
     diagnosis = `Cloudflare's proxy is answering the certificate challenge for ${domain} instead of forwarding it to this server: it redirects the request to HTTPS, then rejects the origin's TLS. Fix it one of three ways \u2014 set SSL/TLS \u2192 Overview to "Full" (not "Full (strict)") until the first certificate is issued, or turn the orange cloud off for this record until it is, or upload a Cloudflare Origin CA certificate from the Domains tab and skip Let's Encrypt entirely.`;
@@ -721,6 +726,7 @@ var NginxProvider = class {
   acmeTosAgreed;
   certDir;
   executor;
+  paths;
   reloadCommand;
   pinPaths;
   containerEdge;
@@ -744,8 +750,9 @@ var NginxProvider = class {
     this.acmeTosAgreed = opts.acmeTosAgreed ?? true;
     this.certDir = opts.certDir ?? DEFAULT_CERT_DIR;
     this.executor = opts.executor ?? null;
+    this.paths = opts.paths;
     this.containerEdge = opts.containerEdge ?? false;
-    this.reloadCommand = buildReloadCommand(opts.paths, { containerEdge: this.containerEdge });
+    this.reloadCommand = buildReloadCommand(opts.paths);
     this.pinPaths = opts.pinPaths ?? false;
     this.challengeDir = opts.challengeDir ?? EDGE_CHALLENGE_DIR;
   }
@@ -1094,6 +1101,31 @@ eab-hmac-key = ${this.acmeEabHmacKey}
     }
     return path;
   }
+  /** Materialize generated DNS hooks on the same target where Certbot runs. */
+  async createEphemeralDnsHooks(opts) {
+    if (!opts?.dnsAuthHookScript) return null;
+    const dir = join(dirname(this.certDir), `.openship-dns-${randomBytes(12).toString("hex")}`);
+    const authPath = join(dir, "auth.sh");
+    const cleanupPath = join(dir, "cleanup.sh");
+    const recordPath = join(dir, "record-id.txt");
+    await this._mkdir(dir);
+    try {
+      await this._chmod(dir, 448);
+      await this._writeFile(authPath, opts.dnsAuthHookScript, 448);
+      if (opts.dnsCleanupHookScript) {
+        await this._writeFile(cleanupPath, opts.dnsCleanupHookScript, 448);
+      }
+    } catch (err) {
+      await this._rm(dir).catch(() => void 0);
+      throw err;
+    }
+    const recordEnv = `OPENSHIP_DNS_RECORD_FILE=${sq(recordPath)}`;
+    return {
+      dir,
+      authCommand: `${recordEnv} ${sq(authPath)}`,
+      cleanupCommand: opts.dnsCleanupHookScript ? `${recordEnv} ${sq(cleanupPath)}` : void 0
+    };
+  }
   async _captureFile(path) {
     if (!await this._exists(path)) {
       return { exists: false };
@@ -1347,7 +1379,9 @@ ${serveLocation}
    */
   async _lsSites() {
     if (!this.executor) return fsReaddir(this.sitesDir);
-    const out = await this.executor.exec(`ls -1 ${sq(this._commandSitesDir())} 2>/dev/null || true`);
+    const out = await this.executor.exec(
+      `ls -1 ${sq(this._commandSitesDir())} 2>/dev/null || true`
+    );
     return out.split("\n").map((l) => l.trim()).filter(Boolean);
   }
   /**
@@ -1410,8 +1444,11 @@ ${serveLocation}
    * from the old in-memory config (an inconsistent half-state that would silently
    * vanish on the next unrelated reload). The error is re-thrown for retry.
    */
-  async removeRoute(domain) {
+  async removeRoute(domain, opts) {
     assertValidDomain(domain);
+    if (opts?.signal?.aborted) {
+      throw new Error(`Route removal aborted before it started: ${domain}`);
+    }
     const slug = await this.resolveSlug(domain);
     const configPath = join(this.sitesDir, `${slug}.conf`);
     const statePath = this.routeStatePath(slug);
@@ -1420,11 +1457,20 @@ ${serveLocation}
     await this._rm(configPath);
     await this._rm(statePath).catch(() => void 0);
     try {
-      await this.reload();
+      await this.reload({ allowStopped: true });
     } catch (err) {
-      await this._restoreFile(configPath, confSnapshot);
-      await this._restoreFile(statePath, stateSnapshot);
-      await this.reload().catch(() => void 0);
+      try {
+        if (!opts?.signal?.aborted) await this._restoreFile(configPath, confSnapshot);
+        if (!opts?.signal?.aborted) await this._restoreFile(statePath, stateSnapshot);
+        if (!opts?.signal?.aborted) {
+          await this.reload({ allowStopped: true }).catch(() => void 0);
+        }
+      } finally {
+        if (opts?.signal?.aborted) {
+          await this._rm(configPath).catch(() => void 0);
+          await this._rm(statePath).catch(() => void 0);
+        }
+      }
       throw err;
     }
     await this._rm(this.bootstrapCertDir(domain)).catch(() => void 0);
@@ -1531,31 +1577,47 @@ ${serveLocation}
     const emailArgs = validEmail ? ["--email", this.acmeEmail] : ["--register-unsafely-without-email"];
     let certonlyOut = "";
     const eabConfig = await this.createEphemeralEabConfig();
+    let generatedDnsHooks = null;
     try {
-      certonlyOut = await this._execCertbot([
-        ...eabConfig ? ["--config", eabConfig] : [],
+      generatedDnsHooks = await this.createEphemeralDnsHooks(opts);
+      const isDnsChallenge = opts?.challenge === "dns-01" || domain.startsWith("*.");
+      const challengeArgs = isDnsChallenge ? [
         "certonly",
-        "--standalone",
-        "--http-01-port",
-        String(ACME_HTTP01_PORT),
-        "--cert-name",
-        domain,
-        "-d",
-        domain,
-        ...this.acmeDirectoryUrl ? ["--server", this.acmeDirectoryUrl] : [],
-        ...acmeKeyArgs(this.acmeKeyType),
-        ...emailArgs,
-        ...this.acmeTosAgreed ? ["--agree-tos"] : [],
-        "--non-interactive",
-        // Forced reissue: certbot would otherwise print "not due for renewal"
-        // (exit 0) when a lineage exists, leaving the stale cert in place.
-        ...opts?.force ? ["--force-renewal"] : []
-      ], opts?.onLog);
+        "--manual",
+        "--preferred-challenges",
+        "dns",
+        ...generatedDnsHooks?.authCommand || opts?.dnsAuthHook ? ["--manual-auth-hook", generatedDnsHooks?.authCommand ?? opts.dnsAuthHook] : [],
+        ...generatedDnsHooks?.cleanupCommand || opts?.dnsCleanupHook ? [
+          "--manual-cleanup-hook",
+          generatedDnsHooks?.cleanupCommand ?? opts.dnsCleanupHook
+        ] : []
+      ] : ["certonly", "--standalone", "--http-01-port", String(ACME_HTTP01_PORT)];
+      certonlyOut = await this._execCertbot(
+        [
+          ...eabConfig ? ["--config", eabConfig] : [],
+          ...challengeArgs,
+          "--cert-name",
+          domain,
+          "-d",
+          domain,
+          ...this.acmeDirectoryUrl ? ["--server", this.acmeDirectoryUrl] : [],
+          ...acmeKeyArgs(this.acmeKeyType),
+          ...emailArgs,
+          ...this.acmeTosAgreed ? ["--agree-tos"] : [],
+          "--non-interactive",
+          // Forced reissue: certbot would otherwise print "not due for renewal"
+          // (exit 0) when a lineage exists, leaving the stale cert in place.
+          ...opts?.force ? ["--force-renewal"] : []
+        ],
+        opts?.onLog
+      );
     } catch (err) {
       const raw = this.redactAcmeSecrets(safeErrorMessage(err));
       let summary = summarizeCertbotFailure(raw, domain);
       if (isAcmePortBindFailure(raw) && this.executor) {
-        const occupant = await probeListeningPort(this.executor, ACME_HTTP01_PORT).catch(() => null);
+        const occupant = await probeListeningPort(this.executor, ACME_HTTP01_PORT).catch(
+          () => null
+        );
         if (occupant) {
           summary += ` Currently held by ${occupant.command}` + (occupant.pid !== null ? ` (pid ${occupant.pid})` : "") + (occupant.systemdUnit ? ` via ${occupant.systemdUnit}` : "") + `.`;
         }
@@ -1563,6 +1625,7 @@ ${serveLocation}
       throw new Error(summary);
     } finally {
       if (eabConfig) await this._rm(dirname(eabConfig)).catch(() => void 0);
+      if (generatedDnsHooks) await this._rm(generatedDnsHooks.dir).catch(() => void 0);
     }
     const slug = await this.resolveSlug(domain);
     const configPath = join(this.sitesDir, `${slug}.conf`);
@@ -1630,24 +1693,24 @@ ${tail}` : "")
   /**
    * Renew a TLS certificate using certbot.
    */
-  async renewCert(domain) {
+  async renewCert(domain, opts) {
     assertValidDomain(domain);
+    if (opts?.challenge === "dns-01" || domain.startsWith("*.")) {
+      return this.provisionCert(domain, { ...opts, challenge: "dns-01", force: true });
+    }
     if (!await this.certsExist(domain)) {
-      return this.provisionCert(domain);
+      return this.provisionCert(domain, opts);
     }
     if (!await this.hasCertbotLineage(domain)) {
-      return this.provisionCert(domain, { force: true });
+      return this.provisionCert(domain, { ...opts, force: true });
     }
     if (!await this.lineageServerMatches(domain)) {
-      return this.provisionCert(domain, { force: true });
+      return this.provisionCert(domain, { ...opts, force: true });
     }
-    await this._execCertbot([
-      "renew",
-      "--cert-name",
-      domain,
-      ...acmeKeyArgs(this.acmeKeyType),
-      "--non-interactive"
-    ]);
+    await this._execCertbot(
+      ["renew", "--cert-name", domain, ...acmeKeyArgs(this.acmeKeyType), "--non-interactive"],
+      opts?.onLog
+    );
     await this.reload();
     return this.readCertInfo(domain);
   }
@@ -1805,23 +1868,42 @@ ${tail}` : "")
    * config may move). Re-detecting on every reload keeps the provider
    * in sync without requiring an API restart.
    */
-  async reload() {
+  async reload(opts = {}) {
     if (this.executor) {
       if (!this.pinPaths) {
         try {
           const freshPaths = await detectOpenRestyPaths(this.executor);
+          this.paths = freshPaths;
           this.sitesDir = freshPaths.sitesDir;
           this.nginxVersion = freshPaths.nginxVersion ?? this.nginxVersion;
-          this.reloadCommand = buildReloadCommand(freshPaths, {
-            containerEdge: this.containerEdge
-          });
+          this.reloadCommand = buildReloadCommand(freshPaths);
         } catch {
         }
       }
-      await this.executor.exec(this.reloadCommand);
+      if (this.containerEdge) {
+        await this.executor.exec(this.reloadCommand, { timeout: 15e3 });
+      } else {
+        await reloadBareOpenResty(this.executor, this.paths, {
+          allowStopped: opts.allowStopped ?? false
+        });
+      }
       return;
     }
-    await execFileAsync("sh", ["-lc", this.reloadCommand]);
+    if (this.containerEdge) {
+      await execFileAsync("sh", ["-lc", this.reloadCommand], { timeout: 15e3 });
+      return;
+    }
+    const localExecutor = {
+      exec: async (command, execOpts) => {
+        const { stdout } = await execFileAsync("sh", ["-lc", command], {
+          timeout: execOpts?.timeout
+        });
+        return String(stdout);
+      }
+    };
+    await reloadBareOpenResty(localExecutor, this.paths, {
+      allowStopped: opts.allowStopped ?? false
+    });
   }
   async certsExist(domain) {
     const certPath = join(this.certDir, domain, "fullchain.pem");
@@ -2003,7 +2085,9 @@ ${geoEntries.join("\n")}
     if (!foundDesiredInclude) {
       const httpIndex = nextLines.findIndex((line) => /^\s*http\s*\{\s*$/.test(line));
       if (httpIndex === -1) {
-        throw new Error(`Failed to ensure rate-limit include: ${confPath} is missing an http block`);
+        throw new Error(
+          `Failed to ensure rate-limit include: ${confPath} is missing an http block`
+        );
       }
       const indent = nextLines[httpIndex].match(/^\s*/)?.[0] ?? "";
       nextLines.splice(httpIndex + 1, 0, `${indent}    ${desiredIncludeLine}`);

package/dist/{chunk-CIJV43LH.js → chunk-MUWVC5R4.js}

@@ -5,16 +5,17 @@ const require = __ospCreateRequire(import.meta.url);
 import {
   checkGit,
   installGit
-} from "./chunk-ZPJ74LXE.js";
+} from "./chunk-NIYD7MD2.js";
 import {
-  createDockerBuildContext
-} from "./chunk-XWHWTHEL.js";
+  createDockerBuildContext,
+  resolveDockerBuildArgs
+} from "./chunk-6GU6JSK6.js";
 import {
   prepareStackOutput,
   resolveProjectDir,
   resolveStaticOutputPath,
   runLocalBuild
-} from "./chunk-MEE6OZFP.js";
+} from "./chunk-5DJOB7IX.js";
 import {
   BuildLogger,
   dockerBuildContextDirectory,
@@ -28,7 +29,7 @@ import {
   splitRuntimeEnv,
   sq,
   transferLocalDirectory
-} from "./chunk-H4FS5BED.js";
+} from "./chunk-AHJYP7DG.js";
 import {
   isRuntimeNotFoundError
 } from "./chunk-N5YZMO33.js";
@@ -43,7 +44,7 @@ import {
   packageManagerEnsureCommand,
   safeErrorMessage,
   shellSplitWords
-} from "./chunk-2VSW6Q6C.js";
+} from "./chunk-WEZFTL4V.js";
 
 // ../../packages/adapters/src/runtime/cloud.ts
 import { readFile } from "fs/promises";
@@ -1332,6 +1333,11 @@ function resolveCopyDestinationPath(copy, sourcePath, destination, destinationIs
 function cloudBuildContextPath(config) {
   return dockerBuildContextDirectory(config) || normalizeDockerRelativePath(config.rootDirectory);
 }
+function compileCloudDockerfilePlan(source, config) {
+  return compileDockerfileToWorkspacePlan(source, {
+    buildArgs: resolveDockerBuildArgs(config)
+  });
+}
 var PAGE_CONTAINER_PREFIX = "page:";
 async function provisionCloudWorkspace(client, config, logger) {
   logger?.log(`Creating workspace from image "${config.image}"...
@@ -1350,15 +1356,22 @@ async function provisionCloudWorkspace(client, config, logger) {
       }
     });
   } catch (err) {
-    logger?.log(`Failed to create workspace from image "${config.image}": ${formatCloudError(err)}
-`, "error");
+    logger?.log(
+      `Failed to create workspace from image "${config.image}": ${formatCloudError(err)}
+`,
+      "error"
+    );
     throw err;
   }
   const ws = client.workspace(wsData.id);
   try {
     if (config.mode === "temporary" && config.ttl) {
       try {
-        await ws.lifecycle.makeTemporary({ ttl: config.ttl, ttl_action: "remove", remove_on_exit: true });
+        await ws.lifecycle.makeTemporary({
+          ttl: config.ttl,
+          ttl_action: "remove",
+          remove_on_exit: true
+        });
       } catch {
       }
     }
@@ -1398,6 +1411,7 @@ var CloudRuntime = class {
   name = "cloud";
   capabilities = /* @__PURE__ */ new Set([
     "build",
+    "prebuiltImage",
     "deploy",
     "multiServiceDeploy",
     "stop",
@@ -1549,6 +1563,94 @@ var CloudRuntime = class {
     this.activeBuilds.get(sessionId)?.workspaceIds.delete(workspaceId);
   }
   // ── Build lifecycle ────────────────────────────────────────────────────
+  /**
+   * Materialize a prebuilt container image as the same opaque artifact Cloud's
+   * deploy path already understands: a temporary workspace id.
+   *
+   * Unlike a source build, no command is executed in the workspace. Creating it
+   * directly from the application image preserves the image's own ENTRYPOINT,
+   * CMD and WORKDIR; deploy keeps those defaults when `prebuiltImage` is set.
+   */
+  async prepareImage(config, logger) {
+    const log = logger ?? new BuildLogger();
+    const startedAt = Date.now();
+    const activeBuild = this.createActiveBuild(config.sessionId);
+    let workspaceId;
+    const discardWorkspace = async () => {
+      if (!workspaceId) return;
+      await this.ws(workspaceId).delete().catch(() => {
+      });
+      this.builtArtifacts.delete(workspaceId);
+      this.untrackActiveBuildWorkspace(config.sessionId, workspaceId);
+    };
+    const cancelled = async () => {
+      await discardWorkspace();
+      log.step("build", "failed", "Image preparation cancelled");
+      return {
+        sessionId: config.sessionId,
+        status: "cancelled",
+        // Keep the ref even after our best-effort delete: the pipeline can make
+        // an idempotent cleanup retry if that delete failed mid-cancellation.
+        imageRef: workspaceId,
+        durationMs: Date.now() - startedAt,
+        artifactOwned: true
+      };
+    };
+    try {
+      if (activeBuild.abort.signal.aborted) return await cancelled();
+      const imageRef = config.imageRef.trim();
+      if (!imageRef) throw new Error("Prebuilt image reference is required");
+      log.step("build", "running", `Creating workspace from prebuilt image ${imageRef}`);
+      const provisioned = await this.provisionWorkspace(
+        {
+          name: config.slug ?? `image-${config.projectId.slice(0, 20)}`,
+          image: imageRef,
+          mode: "temporary",
+          resources: config.resources,
+          env: config.envVars,
+          ttl: "15m"
+        },
+        log
+      );
+      workspaceId = provisioned.workspaceId;
+      this.trackActiveBuildWorkspace(config.sessionId, workspaceId);
+      if (activeBuild.abort.signal.aborted) return await cancelled();
+      this.builtArtifacts.set(workspaceId, {
+        workspaceId,
+        runtime: {
+          workdir: "/",
+          env: {},
+          exposedPorts: [],
+          baseImage: imageRef
+        }
+      });
+      log.step("build", "completed", `Prebuilt image workspace ${workspaceId} is ready`);
+      return {
+        sessionId: config.sessionId,
+        status: "deploying",
+        imageRef: workspaceId,
+        durationMs: Date.now() - startedAt,
+        artifactOwned: true
+      };
+    } catch (err) {
+      if (activeBuild.abort.signal.aborted) return await cancelled();
+      await discardWorkspace();
+      const message = formatCloudError(err);
+      log.step("build", "failed", `Image preparation failed: ${message}`);
+      return {
+        sessionId: config.sessionId,
+        status: "failed",
+        // Same retry contract as cancellation. Undefined means provisioning
+        // failed before Oblien handed us an owned workspace.
+        imageRef: workspaceId,
+        durationMs: Date.now() - startedAt,
+        errorMessage: `Image preparation failed: ${message}`,
+        artifactOwned: true
+      };
+    } finally {
+      this.activeBuilds.delete(config.sessionId);
+    }
+  }
   async build(config, logger) {
     const log = logger ?? new BuildLogger();
     const activeBuild = this.createActiveBuild(config.sessionId);
@@ -1607,7 +1709,9 @@ var CloudRuntime = class {
                 resolveProjectDir(buildDir, config.rootDirectory)
               );
               if (selfContained) {
-                log.log("Detected self-contained build output \u2014 uploading the bundle (no install on cloud).\n");
+                log.log(
+                  "Detected self-contained build output \u2014 uploading the bundle (no install on cloud).\n"
+                );
                 await transferLocalDirectory(
                   selfContained.bundleDir,
                   { kind: "cloud-runtime", runtime: rt, path: "/app" },
@@ -1645,7 +1749,11 @@ var CloudRuntime = class {
                 log.log("Installing production dependencies on cloud...\n");
                 const pmEnsure = packageManagerEnsureCommand(config.packageManager);
                 const fullInstall = pmEnsure ? `${pmEnsure} && ${installCmd}` : installCmd;
-                await this.execAndStream(rt, ["sh", "-c", `cd /app && ${fullInstall}`], log.callback);
+                await this.execAndStream(
+                  rt,
+                  ["sh", "-c", `cd /app && ${fullInstall}`],
+                  log.callback
+                );
               }
             }
           });
@@ -1730,7 +1838,7 @@ var CloudRuntime = class {
     try {
       log.log("Build strategy: Dockerfile plan (build in Oblien workspaces)\n");
       source = await this.resolveDockerfileBuildSource(config, log);
-      const plan = compileDockerfileToWorkspacePlan(source.dockerfile);
+      const plan = compileCloudDockerfilePlan(source.dockerfile, config);
       const blocking = plan.diagnostics.filter(
         (item) => item.severity === "error" || item.severity === "unsupported"
       );
@@ -1819,10 +1927,7 @@ var CloudRuntime = class {
       requireRepositoryDockerfile: true,
       onLog: logger.callback
     });
-    const dockerfilePath = resolveWithinDirectory(
-      context.buildContextDir,
-      context.dockerfileName
-    );
+    const dockerfilePath = resolveWithinDirectory(context.buildContextDir, context.dockerfileName);
     const dockerfile = await readFile(dockerfilePath, "utf-8");
     const contextRoot = context.contextSubdir ? context.buildContextDir : resolveWithinDirectory(context.contextDir, context.rootDirectory);
     return {
@@ -1885,11 +1990,9 @@ var CloudRuntime = class {
         logger.log(`Checking Dockerfile candidate: ${candidate}
 `);
         const dockerfile = await executor.exec(
-          [
-            `cd ${sq(sourceDir)}`,
-            `test -f ${sq(candidate)}`,
-            `cat ${sq(candidate)}`
-          ].join(" && "),
+          [`cd ${sq(sourceDir)}`, `test -f ${sq(candidate)}`, `cat ${sq(candidate)}`].join(
+            " && "
+          ),
           { timeout: 3e4 }
         ).catch(() => null);
         if (dockerfile !== null) {
@@ -2119,8 +2222,10 @@ var CloudRuntime = class {
       ...prepareContextCommands,
       'echo "Dockerfile context prepared."'
     ].join("\n");
-    logger.log(`Preparing Dockerfile build workspace for repository clone (branch: ${config.branch})...
-`);
+    logger.log(
+      `Preparing Dockerfile build workspace for repository clone (branch: ${config.branch})...
+`
+    );
     await this.ensureWorkspaceGit(targetRuntime, logger, "Dockerfile build workspace");
     logger.log(`Cloning Dockerfile context in build workspace (branch: ${config.branch})...
 `);
@@ -2373,8 +2478,8 @@ var CloudRuntime = class {
       }
     }
     const builtArtifact = this.builtArtifacts.get(workspaceId);
-    const prodPaths = config.productionPaths;
-    const workDir = builtArtifact?.runtime.workdir ?? (prodPaths?.length ? "/app/production" : "/app");
+    const prodPaths = config.prebuiltImage ? void 0 : config.productionPaths;
+    const workDir = config.prebuiltImage ? "/" : builtArtifact?.runtime.workdir ?? (prodPaths?.length ? "/app/production" : "/app");
     if (prodPaths?.length) {
       try {
         const rt = await ws.runtime();
@@ -2421,7 +2526,7 @@ fi`;
         );
       }
     }
-    const startCommand = builtArtifact?.runtime.startCommand || config.startCommand || "npm start";
+    const startCommand = builtArtifact?.runtime.startCommand || config.startCommand || (config.prebuiltImage ? void 0 : "npm start");
     const projectEnv = splitRuntimeEnv(config.envVars);
     if (projectEnv.dropped.length > 0) {
       onLog?.({
@@ -2438,19 +2543,31 @@ fi`;
     const workloadCmd = resolveCloudWorkloadCmd({
       startCommand,
       workdir: workDir,
-      binPathExport: builtArtifact ? "" : nodeBinPathExport(config.packageManager, [workDir, "/app"])
+      binPathExport: builtArtifact || config.prebuiltImage ? "" : nodeBinPathExport(config.packageManager, [workDir, "/app"])
     });
-    try {
-      await ws.workloads.create({
-        name: "app",
-        cmd: workloadCmd,
-        working_dir: workDir,
-        env: [...envArray, `PORT=${config.port}`],
-        restart_policy: restartPolicy,
-        max_restarts: 10
+    if (workloadCmd) {
+      try {
+        if (config.prebuiltImage) {
+          await ws.workloads.delete("app").catch(() => {
+          });
+        }
+        await ws.workloads.create({
+          name: "app",
+          cmd: workloadCmd,
+          working_dir: workDir,
+          env: [...envArray, `PORT=${config.port}`],
+          restart_policy: restartPolicy,
+          max_restarts: 10
+        });
+      } catch (err) {
+        throw new Error(`Failed to create workload: ${err instanceof Error ? err.message : err}`);
+      }
+    } else {
+      log({
+        timestamp: now2(),
+        level: "info",
+        message: "Using the prebuilt image's default command and working directory.\n"
       });
-    } catch (err) {
-      throw new Error(`Failed to create workload: ${err instanceof Error ? err.message : err}`);
     }
     let url;
     const primaryEndpoint = primaryPublicEndpoint(config);
@@ -2588,7 +2705,9 @@ fi`;
         pg = result.page;
       } catch (err) {
         if (isOutputPathError(err)) throw outputDirError();
-        throw new Error(`Failed to create static page for slug "${pageSlug}": ${safeErrorMessage(err)}`);
+        throw new Error(
+          `Failed to create static page for slug "${pageSlug}": ${safeErrorMessage(err)}`
+        );
       }
       return { ...pg, url: void 0 };
     };
@@ -2603,7 +2722,9 @@ fi`;
         });
         page = result.page;
       } catch (err) {
-        throw new Error(`Failed to redeploy static page for slug "${pageSlug}": ${safeErrorMessage(err)}`);
+        throw new Error(
+          `Failed to redeploy static page for slug "${pageSlug}": ${safeErrorMessage(err)}`
+        );
       }
     } else {
       if (existingPage) {
@@ -3222,6 +3343,7 @@ function clampShellWindow(value, fallback, min, max) {
 }
 
 export {
+  compileCloudDockerfilePlan,
   PAGE_CONTAINER_PREFIX,
   provisionCloudWorkspace,
   HostBuildForbiddenError,