openship 0.6.7 → 0.6.9

package/dist/{chunk-ZPJ74LXE.js → chunk-NIYD7MD2.js}

@@ -9,31 +9,32 @@ import {
   readDeclaredPair,
   readMaybeInContainer,
   validateCertFor
-} from "./chunk-NRTJRNAE.js";
+} from "./chunk-IAMOUDHY.js";
 import {
   EDGE_CHALLENGE_HOST_DIR,
   EDGE_CONTAINER_MOUNTS,
   EDGE_HOST_PATHS,
   OPENRESTY_DEFAULT_PATHS
-} from "./chunk-QHMDCYZ3.js";
+} from "./chunk-7PEXM2UI.js";
 import {
   privilegedExecutor,
   rootChecked,
   rootOrDegrade
-} from "./chunk-PVP4RGWT.js";
+} from "./chunk-T46BQOLY.js";
 import {
   envOps,
   opScript
-} from "./chunk-BLEXTYRK.js";
+} from "./chunk-GNOMEMNI.js";
 import {
   resolveEnvironment
-} from "./chunk-FZ6QCF6B.js";
+} from "./chunk-NPSRGIHV.js";
 import {
   sq
-} from "./chunk-H3WT3A6R.js";
+} from "./chunk-P7RCYELG.js";
 import {
   EdgeConflictError,
   EdgeMigrateRequested,
+  detectEdgeContainer,
   edgeCrashReason,
   edgeFailureReason,
   edgeIsBroken,
@@ -44,16 +45,16 @@ import {
   sanitizeEdgeVhosts,
   sq as sq2,
   stopTargetsForStatus
-} from "./chunk-GIPJNNI5.js";
+} from "./chunk-X53JXRS4.js";
 import {
   waitForPortListening
-} from "./chunk-VSTFHUCV.js";
+} from "./chunk-BO6CY4V2.js";
 import {
   EDGE_CONTAINER_NAME,
   probeExec,
   tryExec,
   withReason
-} from "./chunk-UWEV6XTS.js";
+} from "./chunk-D6HU4VUZ.js";
 import {
   formatDuration,
   systemDebug
@@ -64,11 +65,12 @@ import {
   answered,
   buildEdgeImageRef,
   compareSemver,
+  isLoopbackHost,
   parseProxyValue,
   safeErrorMessage,
   sanitizeProxySettings,
   shellQuote
-} from "./chunk-2VSW6Q6C.js";
+} from "./chunk-WEZFTL4V.js";
 
 // ../../packages/adapters/src/system/managed-image.ts
 import { posix } from "path";
@@ -425,8 +427,9 @@ function parseUpstreams(config) {
   let m;
   while ((m = re.exec(config)) !== null) {
     const name = m[1];
-    const server = m[2].match(/(?:^|[\s;{])server\s+([^;\s]+)/);
-    if (name && server?.[1]) map.set(name, server[1].trim());
+    const body = m[2] ?? "";
+    const targets = [...body.matchAll(/(?:^|[\s;{])server\s+([^;\s]+)/g)].map((server) => server[1]?.trim()).filter((target) => Boolean(target));
+    if (name && targets.length > 0) map.set(name, targets);
   }
   return map;
 }
@@ -439,14 +442,55 @@ function resolveProxyTarget(proxyPass, upstreams) {
   const scheme = m[1];
   const authority = m[2];
   const host = authority.replace(/:\d+$/, "");
-  if (upstreams.has(host)) return { url: `${scheme}${upstreams.get(host)}` };
+  const declaredUpstream = upstreams.get(authority);
+  if (declaredUpstream?.[0]) return { url: `${scheme}${declaredUpstream[0]}` };
   const isIp = /^\d{1,3}(\.\d{1,3}){3}$/.test(host);
   if (host === "localhost" || host === "ip6-localhost") {
     return { url: raw.replace(/^(https?:\/\/)[^/:]+/i, "$1127.0.0.1") };
   }
-  if (isIp || host.includes(".")) return { url: raw };
+  if (isIp || host.includes(".") || host.startsWith("[") && host.endsWith("]")) {
+    return { url: raw };
+  }
   return { reason: `proxy_pass host "${host}" is an undeclared upstream \u2014 not migratable` };
 }
+function strictLoopbackUpstreamPorts(config) {
+  const normalized = stripComments(config);
+  const upstreams = parseUpstreams(normalized);
+  const ports = /* @__PURE__ */ new Set();
+  for (const match of normalized.matchAll(/(?:^|[;{}\s])proxy_pass\s+([^;]+);/g)) {
+    const raw = match[1]?.trim();
+    if (!raw) continue;
+    const resolved = resolveProxyTarget(raw, upstreams);
+    if ("reason" in resolved) {
+      if (/\/\/unix:/i.test(raw)) continue;
+      throw new Error(`Cannot inventory Openship edge routes: ${resolved.reason}`);
+    }
+    const authority = raw.match(/^https?:\/\/([^/]+)/i)?.[1];
+    const scheme = raw.match(/^(https?:\/\/)/i)?.[1];
+    const targets = authority && scheme && upstreams.has(authority) ? upstreams.get(authority).map((target) => `${scheme}${target}`) : [resolved.url];
+    for (const target of targets) {
+      let url;
+      try {
+        url = new URL(target);
+      } catch {
+        throw new Error(`Cannot inventory Openship edge routes: invalid proxy_pass "${raw}"`);
+      }
+      if (!isLoopbackHost(url.hostname)) continue;
+      const port = url.port ? Number(url.port) : url.protocol === "https:" ? 443 : 80;
+      if (!Number.isSafeInteger(port) || port < 1 || port > 65535) {
+        throw new Error(`Cannot inventory Openship edge routes: invalid loopback port in "${raw}"`);
+      }
+      ports.add(port);
+    }
+  }
+  return ports;
+}
+function parseStrictEdgeConfig(raw) {
+  return {
+    ...parseNginxConfig(raw),
+    loopbackUpstreamPorts: strictLoopbackUpstreamPorts(raw)
+  };
+}
 function locationBlocks(serverBody) {
   const out = [];
   const re = /(?:^|[\s;}])location\s+([^{]+?)\s*\{/g;
@@ -538,7 +582,9 @@ function resolveStaticRoot(root, prefix) {
 }
 function parseServer(body, source, upstreams, prefix) {
   const warnings = [];
-  const names = firstDirective(body, "server_name")?.split(/\s+/).filter((n) => n && n !== "_" && !n.startsWith("~") && !LOOPBACK_SERVER_NAMES.has(n.toLowerCase())) ?? [];
+  const names = firstDirective(body, "server_name")?.split(/\s+/).filter(
+    (n) => n && n !== "_" && !n.startsWith("~") && !LOOPBACK_SERVER_NAMES.has(n.toLowerCase())
+  ) ?? [];
   const listens = [...body.matchAll(/(?:^|[;{\s])listen\s+([^;]+);/g)].map((m) => m[1]);
   const ssl = listens.some((l) => /\bssl\b/.test(l) || /\b443\b/.test(l));
   const root = firstDirective(body, "root");
@@ -634,6 +680,35 @@ async function scanOpenshipEdge(executor) {
   const fromContainer = await tryExec(executor, containerCommand(container, cat));
   return parseNginxConfig(fromContainer ?? "");
 }
+async function scanOpenshipEdgeStrict(executor, knownContainer) {
+  const detected = await detectEdgeContainer(executor);
+  if (!detected) {
+    const bareConfig = await dumpResolvedConfig(executor, ["openresty"]);
+    if (bareConfig) return parseStrictEdgeConfig(bareConfig);
+    throw new Error(
+      "Cannot read Openship edge routes: neither Docker nor bare OpenResty inventory is available"
+    );
+  }
+  if (!detected.exists) {
+    const bareConfig = await dumpResolvedConfig(executor, ["openresty"]);
+    if (bareConfig) return parseStrictEdgeConfig(bareConfig);
+    throw new Error(
+      "Cannot read Openship edge routes: no running Openship edge or bare OpenResty inventory is available"
+    );
+  }
+  if (!detected.running) {
+    throw new Error("Cannot read Openship edge routes: the edge container is not running");
+  }
+  const container = knownContainer ?? detected.name;
+  if (!container) throw new Error("Cannot read Openship edge routes: container identity missing");
+  const fromContainer = await executor.exec(
+    containerCommand(container, "openresty -T 2>/dev/null")
+  );
+  if (!fromContainer.trim() || !/server\s*\{/.test(fromContainer)) {
+    throw new Error("Cannot read Openship edge routes: active OpenResty config dump was empty");
+  }
+  return parseStrictEdgeConfig(fromContainer);
+}
 
 // ../../packages/adapters/src/system/proxy/import/caddy.ts
 var CADDYFILE_PATHS = ["/etc/caddy/Caddyfile", "/etc/Caddyfile"];
@@ -1613,6 +1688,24 @@ function makeApi(exec, kind, ours, container) {
     }));
     return scan;
   };
+  let strictLoopbackPorts = null;
+  const listLoopbackUpstreamPortsStrict = (opts = {}) => {
+    if (!ours) {
+      return Promise.reject(
+        new Error("Strict loopback upstream inventory is only available for the Openship edge")
+      );
+    }
+    if (opts.refresh || !strictLoopbackPorts) {
+      const nextScan = scanOpenshipEdgeStrict(exec, container).then(
+        ({ loopbackUpstreamPorts }) => loopbackUpstreamPorts
+      );
+      strictLoopbackPorts = nextScan;
+      void nextScan.catch(() => {
+        if (strictLoopbackPorts === nextScan) strictLoopbackPorts = null;
+      });
+    }
+    return strictLoopbackPorts;
+  };
   const siteFor = async (host) => {
     const target = host.toLowerCase();
     const { sites } = await listSites();
@@ -1644,6 +1737,7 @@ function makeApi(exec, kind, ours, container) {
     ours,
     container,
     listSites,
+    listLoopbackUpstreamPortsStrict,
     sitesByPort: async () => buildProxyRouteIndex((await listSites()).sites),
     siteFor,
     certFor: async (host) => (await certCandidateFor(host)).cert,
@@ -2310,7 +2404,7 @@ function edgeHostExecutor(executor) {
   });
 }
 async function containerEdgeProvider(executor, container, opts) {
-  const { NginxProvider: Provider } = await import("./nginx-KLFF43TC.js");
+  const { NginxProvider: Provider } = await import("./nginx-4U4C2XUS.js");
   return new Provider({
     ...opts,
     // Vhosts go to the BIND-MOUNTED HOST dir (so every host-side reader — the
@@ -2334,8 +2428,8 @@ async function containerEdgeProvider(executor, container, opts) {
   });
 }
 async function localContainerEdgeProvider(container, opts) {
-  const { DockerEdgeExecutor } = await import("./docker-edge-executor-QFXD3337.js");
-  const { NginxProvider: Provider } = await import("./nginx-KLFF43TC.js");
+  const { DockerEdgeExecutor } = await import("./docker-edge-executor-E5TOTLMR.js");
+  const { NginxProvider: Provider } = await import("./nginx-4U4C2XUS.js");
   return new Provider({
     ...opts,
     paths: OPENRESTY_DEFAULT_PATHS,
@@ -2356,20 +2450,40 @@ async function localContainerEdgeProvider(container, opts) {
     containerEdge: true
   });
 }
-async function startEdgeContainer(executor, container, image, onLog) {
+async function startEdgeContainer(executor, container, image, onLog, mounts) {
   await sanitizeEdgeVhosts(executor, EDGE_HOST_PATHS.sitesDir, onLog).catch(() => {
   });
   await executor.exec(`docker rm -f ${sq(container)} 2>/dev/null || true`).catch(() => {
   });
   const run = await executor.streamExec(
-    buildEdgeRunCommand(container, image),
+    buildEdgeRunCommand(container, image, mounts),
     onLog
   );
   invalidateEdgeContainer(executor);
   return run.code === 0;
 }
-function buildEdgeRunCommand(container, image) {
-  const mounts = EDGE_CONTAINER_MOUNTS.map(
+async function resolveEdgeContainerMounts(executor) {
+  return Promise.all(
+    EDGE_CONTAINER_MOUNTS.map(async (mount) => {
+      let host;
+      try {
+        host = (await executor.exec(`cd ${sq(mount.host)} && pwd -P`)).trim();
+      } catch (err) {
+        throw new Error(
+          `Could not resolve edge bind-mount source ${mount.host} on the target host: ${safeErrorMessage(err)}`
+        );
+      }
+      if (!host.startsWith("/") || host.includes("\n")) {
+        throw new Error(
+          `Could not resolve edge bind-mount source ${mount.host} on the target host: expected one absolute path, received ${JSON.stringify(host)}.`
+        );
+      }
+      return { host, container: mount.container };
+    })
+  );
+}
+function buildEdgeRunCommand(container, image, edgeMounts = EDGE_CONTAINER_MOUNTS) {
+  const mounts = edgeMounts.map(
     // `:z` relabels for SELinux-enforcing hosts; a no-op elsewhere.
     (m) => `-v ${sq(`${m.host}:${m.container}:z`)}`
   ).join(" ");
@@ -2382,10 +2496,27 @@ function buildEdgeRunCommand(container, image) {
     sq(image)
   ].join(" ");
 }
-function makeEdgeStart(executor, container, opts) {
+async function edgeContainerMountsMatch(executor, container, expected) {
+  let raw;
+  try {
+    raw = await executor.exec(
+      `docker inspect -f '{{range .HostConfig.Binds}}{{println .}}{{end}}' ${sq(container)}`
+    );
+  } catch {
+    return null;
+  }
+  const actual = /* @__PURE__ */ new Map();
+  for (const line of raw.split("\n")) {
+    const [source, destination] = line.trim().split(":");
+    if (!source || !destination) continue;
+    actual.set(destination, source);
+  }
+  return expected.every((mount) => actual.get(mount.container) === mount.host);
+}
+function makeEdgeStart(executor, container, opts, mounts) {
   const { onLog } = opts;
   return async (image) => {
-    if (!await startEdgeContainer(executor, container, image, onLog)) return false;
+    if (!await startEdgeContainer(executor, container, image, onLog, mounts)) return false;
     const verdict = await verifyEdgeServing(executor, container, {
       timeoutMs: opts.verifyTimeoutMs ?? 3e4
     });
@@ -2420,6 +2551,17 @@ async function ensureContainerEdge(executor, opts) {
   const { onLog } = opts;
   const container = opts.container?.trim() || EDGE_CONTAINER_NAME;
   const image = resolveEdgeImage(opts.image);
+  let resolvedMounts = null;
+  const targetMounts = async (checked) => {
+    if (resolvedMounts) return resolvedMounts;
+    const host = checked ?? await rootOrDegrade(executor, {
+      purpose: "Resolving the edge's bind-mount sources",
+      consequence: "Docker may mount a different host directory than Openship writes.",
+      report: (message) => onLog(log5(message, "warn"))
+    });
+    resolvedMounts = await resolveEdgeContainerMounts(host);
+    return resolvedMounts;
+  };
   const existing = await resolveOurEdgeContainer(executor, { fresh: true });
   if (existing) {
     const verdict = await verifyEdgeServing(executor, existing);
@@ -2427,27 +2569,35 @@ async function ensureContainerEdge(executor, opts) {
       onLog(log5(`The edge container exists but isn't serving: ${verdict.reason}`, "warn"));
       onLog(log5("Recreating it...", "warn"));
     } else {
-      const current = await containerImageRef(executor, existing);
-      const stale = current != null && current !== image;
-      if (stale) {
-        const start = makeEdgeStart(executor, existing, opts);
-        const swap = await swapManagedImage(executor, {
-          kind: "edge",
-          from: current ?? image,
-          to: image,
-          label: "edge",
-          onLog,
-          start
-        });
-        return {
-          container: existing,
-          image,
-          converted: false,
-          updated: swap.swapped,
-          edgeDown: swap.down
-        };
+      const mounts2 = await targetMounts();
+      const mountsMatch = await edgeContainerMountsMatch(executor, existing, mounts2);
+      if (mountsMatch === false) {
+        onLog(
+          log5("The edge container uses stale or non-canonical bind mounts; recreating it...", "warn")
+        );
+      } else {
+        const current = await containerImageRef(executor, existing);
+        const stale = current != null && current !== image;
+        if (stale) {
+          const start = makeEdgeStart(executor, existing, opts, mounts2);
+          const swap = await swapManagedImage(executor, {
+            kind: "edge",
+            from: current ?? image,
+            to: image,
+            label: "edge",
+            onLog,
+            start
+          });
+          return {
+            container: existing,
+            image,
+            converted: false,
+            updated: swap.swapped,
+            edgeDown: swap.down
+          };
+        }
+        return { container: existing, image, converted: false };
       }
-      return { container: existing, image, converted: false };
     }
   }
   if (!await dockerAvailable(executor)) {
@@ -2482,10 +2632,11 @@ async function ensureContainerEdge(executor, opts) {
       );
     });
   }
+  const mounts = await targetMounts(hostState);
   const clear = await ensureEdgeClear(executor, opts.config, onLog);
   try {
     onLog(log5("Starting the edge container..."));
-    if (!await startEdgeContainer(executor, container, image, onLog)) {
+    if (!await startEdgeContainer(executor, container, image, onLog, mounts)) {
       throw new Error("the edge container failed to start");
     }
     const verdict = await verifyEdgeServing(executor, container, {
@@ -2535,6 +2686,7 @@ export {
   resolveEdgeImage,
   containerEdgeProvider,
   localContainerEdgeProvider,
+  resolveEdgeContainerMounts,
   buildEdgeRunCommand,
   verifyEdgeServing,
   ensureContainerEdge,

package/dist/{chunk-FZ6QCF6B.js → chunk-NPSRGIHV.js}

@@ -4,7 +4,7 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   sq
-} from "./chunk-H3WT3A6R.js";
+} from "./chunk-P7RCYELG.js";
 import {
   formatDuration,
   isRemoteConnectionError,
@@ -17,7 +17,7 @@ import {
   parseSystemArch,
   parseSystemOs,
   safeErrorMessage
-} from "./chunk-2VSW6Q6C.js";
+} from "./chunk-WEZFTL4V.js";
 
 // ../../packages/adapters/src/system/elevated-executor.ts
 import { randomBytes } from "crypto";

package/dist/{chunk-2GWYYHOR.js → chunk-NRU2EBYZ.js}

@@ -13,11 +13,11 @@ var CloudInfraProvider = class {
   async registerRoute(route) {
     void route;
   }
-  async removeRoute(domain) {
+  async removeRoute(domain, _opts) {
     void domain;
   }
   // ── SSL ──────────────────────────────────────────────────────────────
-  async provisionCert(domain) {
+  async provisionCert(domain, _opts) {
     return { domain, expiresAt: "", issuer: "oblien", verified: false };
   }
   async renewCert(domain) {

package/dist/{chunk-J2XM3QSP.js → chunk-NUT6HKK6.js}

@@ -19,16 +19,16 @@ import {
   rollbackEdgeTakeover,
   scanImportableSites,
   unreachableStaticRoots
-} from "./chunk-ZPJ74LXE.js";
+} from "./chunk-NIYD7MD2.js";
 import {
   LocalExecutor
-} from "./chunk-E2X26PXR.js";
+} from "./chunk-T6DVUX4F.js";
 import {
   ourEdgeContainerRunning
-} from "./chunk-GIPJNNI5.js";
+} from "./chunk-X53JXRS4.js";
 import {
   isOurEdgeContainer
-} from "./chunk-UWEV6XTS.js";
+} from "./chunk-D6HU4VUZ.js";
 
 // src/lib/edge-preflight.ts
 import { spawnSync } from "child_process";
@@ -243,7 +243,7 @@ async function repairEdgeConflict(mode, apiPort, onLog) {
   }
   spawnSync("docker", ["restart", "openship-edge"], { stdio: "ignore" });
   if (mode === "migrate" && scan.sites.length > 0) {
-    const { importMigratedSites } = await import("./edge-import-CRFVSR6P.js");
+    const { importMigratedSites } = await import("./edge-import-YJVJUGYC.js");
     const outcome = await importMigratedSites(apiPort, scan.sites, certPems);
     if (outcome.registered.length === 0) {
       return {

package/dist/{chunk-H3WT3A6R.js → chunk-P7RCYELG.js}

@@ -4,7 +4,7 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   shellQuote
-} from "./chunk-2VSW6Q6C.js";
+} from "./chunk-WEZFTL4V.js";
 
 // ../../packages/adapters/src/system/local-shell.ts
 import { execFile } from "child_process";

package/dist/{chunk-FYPFEDPZ.js → chunk-R5DC5PEF.js}

@@ -7,7 +7,7 @@ import {
   COMPONENT_INSTALLERS,
   checkAll,
   checkComponents
-} from "./chunk-ZPJ74LXE.js";
+} from "./chunk-NIYD7MD2.js";
 
 // ../../packages/adapters/src/system/state.ts
 var DEFAULT_STATE_PATH = "/etc/openship/setup-state.json";

package/dist/{chunk-RXQBD4ZY.js → chunk-RHLNVZMS.js}

@@ -7,9 +7,9 @@ const require = __ospCreateRequire(import.meta.url);
 var NoopInfraProvider = class {
   async registerRoute(_route) {
   }
-  async removeRoute(_domain) {
+  async removeRoute(_domain, _opts) {
   }
-  async provisionCert(domain) {
+  async provisionCert(domain, _opts) {
     return { domain, expiresAt: "", issuer: "none", verified: false };
   }
   async renewCert(domain) {

package/dist/{chunk-WU54BXFE.js → chunk-SK4FFCFR.js}

@@ -4,7 +4,7 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   sq
-} from "./chunk-H3WT3A6R.js";
+} from "./chunk-P7RCYELG.js";
 
 // ../../packages/adapters/src/runtime/managed-artifact.ts
 var MANAGED_ARTIFACT_BASE = "/opt/openship";

package/dist/{chunk-PVP4RGWT.js → chunk-T46BQOLY.js}

@@ -4,15 +4,15 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   hostRefusal
-} from "./chunk-BLEXTYRK.js";
+} from "./chunk-GNOMEMNI.js";
 import {
   elevatedExecutor,
   resolveEnvironment
-} from "./chunk-FZ6QCF6B.js";
+} from "./chunk-NPSRGIHV.js";
 import {
   answered,
   refused
-} from "./chunk-2VSW6Q6C.js";
+} from "./chunk-WEZFTL4V.js";
 
 // ../../packages/adapters/src/system/privilege.ts
 function rootChecked(executor, why) {

package/dist/{chunk-E2X26PXR.js → chunk-T6DVUX4F.js}

@@ -8,7 +8,7 @@ import {
   getLocalShellPath,
   logEntry,
   sq
-} from "./chunk-H3WT3A6R.js";
+} from "./chunk-P7RCYELG.js";
 
 // ../../packages/adapters/src/system/local-executor.ts
 import { exec, spawn } from "child_process";

package/dist/{chunk-5T4UVOM3.js → chunk-TAZZZKYO.js}

@@ -12,7 +12,7 @@ import {
   HOST_CHANNEL_ROW_CREDENTIALS_UNUSED,
   hostFirewallRule,
   safeErrorMessage
-} from "./chunk-2VSW6Q6C.js";
+} from "./chunk-WEZFTL4V.js";
 
 // ../../packages/adapters/src/system/ssh-client.ts
 import { Client } from "ssh2";