openship 0.6.9 → 0.7.0

package/dist/{chunk-GNOMEMNI.js → chunk-3LWGDMJU.js}

@@ -9,7 +9,7 @@ import {
   firewallPersists,
   refused,
   shellQuote
-} from "./chunk-WEZFTL4V.js";
+} from "./chunk-IVRTIKNZ.js";
 
 // ../../packages/adapters/src/system/environment-ops.ts
 function opScript(steps) {

package/dist/{chunk-ENKJ7XIF.js → chunk-5CFUYMPE.js}

@@ -7,11 +7,11 @@ import {
   resolveProjectDir,
   resolveStaticOutputPath,
   runLocalBuild
-} from "./chunk-5DJOB7IX.js";
+} from "./chunk-ZFA3MZ5N.js";
 import {
   isArtifactPathRef,
   removeManagedArtifact
-} from "./chunk-SK4FFCFR.js";
+} from "./chunk-MZYD3LFP.js";
 import {
   BuildCancelledError,
   BuildLogger,
@@ -24,36 +24,36 @@ import {
   splitRuntimeEnv,
   sq,
   transferLocalDirectory
-} from "./chunk-AHJYP7DG.js";
+} from "./chunk-SYQ3FOLE.js";
 import {
   LocalExecutor
-} from "./chunk-T6DVUX4F.js";
+} from "./chunk-J4SYG2LC.js";
 import {
   privilegedExecutor
-} from "./chunk-T46BQOLY.js";
+} from "./chunk-RHHCAWW3.js";
 import {
   HOST_STATE_DIR,
   envOps,
   hostRefusal,
   opScript
-} from "./chunk-GNOMEMNI.js";
+} from "./chunk-3LWGDMJU.js";
 import {
   ensureOwnedDir,
   resolveEnvironment
-} from "./chunk-NPSRGIHV.js";
+} from "./chunk-JWW5YAFL.js";
 import {
   sq as sq2,
   wrapLocalBuildCommand
-} from "./chunk-P7RCYELG.js";
+} from "./chunk-J2NDOB7D.js";
 import {
   portOccupantDetails,
   probeListeningPort
-} from "./chunk-BO6CY4V2.js";
+} from "./chunk-GEHV7JBS.js";
 import {
   managedDeploymentUnitName,
   probeExec,
   withReason
-} from "./chunk-D6HU4VUZ.js";
+} from "./chunk-CMGRMPRQ.js";
 import {
   formatDuration,
   isRemoteConnectionError,
@@ -73,7 +73,7 @@ import {
   refused,
   safeErrorMessage,
   shellQuote
-} from "./chunk-WEZFTL4V.js";
+} from "./chunk-IVRTIKNZ.js";
 
 // ../../packages/adapters/src/system/remote-journal.ts
 var OPSH_RUN_VERSION = 1;

package/dist/{chunk-NUT6HKK6.js → chunk-5D27WZBW.js}

@@ -19,16 +19,16 @@ import {
   rollbackEdgeTakeover,
   scanImportableSites,
   unreachableStaticRoots
-} from "./chunk-NIYD7MD2.js";
+} from "./chunk-7MKZP4TW.js";
 import {
   LocalExecutor
-} from "./chunk-T6DVUX4F.js";
+} from "./chunk-J4SYG2LC.js";
 import {
   ourEdgeContainerRunning
-} from "./chunk-X53JXRS4.js";
+} from "./chunk-YGA52DHX.js";
 import {
   isOurEdgeContainer
-} from "./chunk-D6HU4VUZ.js";
+} from "./chunk-CMGRMPRQ.js";
 
 // src/lib/edge-preflight.ts
 import { spawnSync } from "child_process";
@@ -243,7 +243,7 @@ async function repairEdgeConflict(mode, apiPort, onLog) {
   }
   spawnSync("docker", ["restart", "openship-edge"], { stdio: "ignore" });
   if (mode === "migrate" && scan.sites.length > 0) {
-    const { importMigratedSites } = await import("./edge-import-YJVJUGYC.js");
+    const { importMigratedSites } = await import("./edge-import-UXD52WQR.js");
     const outcome = await importMigratedSites(apiPort, scan.sites, certPems);
     if (outcome.registered.length === 0) {
       return {

package/dist/{chunk-NIYD7MD2.js → chunk-7MKZP4TW.js}

@@ -9,28 +9,28 @@ import {
   readDeclaredPair,
   readMaybeInContainer,
   validateCertFor
-} from "./chunk-IAMOUDHY.js";
+} from "./chunk-AUBB5DLY.js";
 import {
   EDGE_CHALLENGE_HOST_DIR,
   EDGE_CONTAINER_MOUNTS,
   EDGE_HOST_PATHS,
   OPENRESTY_DEFAULT_PATHS
-} from "./chunk-7PEXM2UI.js";
+} from "./chunk-BOD2IQ3P.js";
 import {
   privilegedExecutor,
   rootChecked,
   rootOrDegrade
-} from "./chunk-T46BQOLY.js";
+} from "./chunk-RHHCAWW3.js";
 import {
   envOps,
   opScript
-} from "./chunk-GNOMEMNI.js";
+} from "./chunk-3LWGDMJU.js";
 import {
   resolveEnvironment
-} from "./chunk-NPSRGIHV.js";
+} from "./chunk-JWW5YAFL.js";
 import {
   sq
-} from "./chunk-P7RCYELG.js";
+} from "./chunk-J2NDOB7D.js";
 import {
   EdgeConflictError,
   EdgeMigrateRequested,
@@ -45,16 +45,16 @@ import {
   sanitizeEdgeVhosts,
   sq as sq2,
   stopTargetsForStatus
-} from "./chunk-X53JXRS4.js";
+} from "./chunk-YGA52DHX.js";
 import {
   waitForPortListening
-} from "./chunk-BO6CY4V2.js";
+} from "./chunk-GEHV7JBS.js";
 import {
   EDGE_CONTAINER_NAME,
   probeExec,
   tryExec,
   withReason
-} from "./chunk-D6HU4VUZ.js";
+} from "./chunk-CMGRMPRQ.js";
 import {
   formatDuration,
   systemDebug
@@ -70,7 +70,7 @@ import {
   safeErrorMessage,
   sanitizeProxySettings,
   shellQuote
-} from "./chunk-WEZFTL4V.js";
+} from "./chunk-IVRTIKNZ.js";
 
 // ../../packages/adapters/src/system/managed-image.ts
 import { posix } from "path";
@@ -433,11 +433,18 @@ function parseUpstreams(config) {
   }
   return map;
 }
-function resolveProxyTarget(proxyPass, upstreams) {
+var HTTP_PROXY_TARGET_RE = /^(https?:\/\/)([^/?#]+)([/?#].*)?$/i;
+function resolveProxyTarget(proxyPass, upstreams, opts = {}) {
   const raw = proxyPass.replace(/;$/, "").trim();
-  if (raw.includes("$")) return { reason: `proxy_pass "${raw}" uses an nginx variable` };
+  const parsed = raw.match(HTTP_PROXY_TARGET_RE);
+  if (raw.includes("$")) {
+    const authority2 = parsed?.[2];
+    if (!opts.allowVariablesAfterAuthority || !authority2 || authority2.includes("$")) {
+      return { reason: `proxy_pass "${raw}" uses an nginx variable` };
+    }
+  }
   if (/\/\/unix:/i.test(raw)) return { reason: `proxy_pass "${raw}" targets a unix socket` };
-  const m = raw.match(/^(https?:\/\/)([^/]+)(\/.*)?$/i);
+  const m = parsed;
   if (!m) return { reason: `unrecognized proxy_pass "${raw}"` };
   const scheme = m[1];
   const authority = m[2];
@@ -460,13 +467,14 @@ function strictLoopbackUpstreamPorts(config) {
   for (const match of normalized.matchAll(/(?:^|[;{}\s])proxy_pass\s+([^;]+);/g)) {
     const raw = match[1]?.trim();
     if (!raw) continue;
-    const resolved = resolveProxyTarget(raw, upstreams);
+    const resolved = resolveProxyTarget(raw, upstreams, { allowVariablesAfterAuthority: true });
     if ("reason" in resolved) {
       if (/\/\/unix:/i.test(raw)) continue;
       throw new Error(`Cannot inventory Openship edge routes: ${resolved.reason}`);
     }
-    const authority = raw.match(/^https?:\/\/([^/]+)/i)?.[1];
-    const scheme = raw.match(/^(https?:\/\/)/i)?.[1];
+    const parsed = raw.match(HTTP_PROXY_TARGET_RE);
+    const authority = parsed?.[2];
+    const scheme = parsed?.[1];
     const targets = authority && scheme && upstreams.has(authority) ? upstreams.get(authority).map((target) => `${scheme}${target}`) : [resolved.url];
     for (const target of targets) {
       let url;
@@ -511,12 +519,30 @@ function locationBlocks(serverBody) {
   return out;
 }
 function extractLocationProxies(serverBody) {
-  const out = [];
+  const routes = [];
+  const unsupported = [];
+  let sawProxyLocation = false;
   for (const loc of locationBlocks(serverBody)) {
     const pp = firstDirective(loc.body, "proxy_pass");
-    if (pp) out.push({ path: loc.path, proxyPass: pp });
+    if (!pp) continue;
+    sawProxyLocation = true;
+    const exact = loc.path.match(/^=\s+(.+)$/);
+    if (exact) {
+      routes.push({ path: exact[1].trim(), proxyPass: pp, exact: true });
+      continue;
+    }
+    const strongPrefix = loc.path.match(/^\^~\s+(.+)$/);
+    if (strongPrefix) {
+      routes.push({ path: strongPrefix[1].trim(), proxyPass: pp });
+      continue;
+    }
+    if (/^~\*?(?:\s|$)/.test(loc.path) || loc.path.startsWith("@")) {
+      unsupported.push(loc.path);
+      continue;
+    }
+    routes.push({ path: loc.path, proxyPass: pp });
   }
-  return out;
+  return { routes, unsupported, sawProxyLocation };
 }
 function withoutQuotedValues(body) {
   return body.replace(/'[^'\n]*'/g, "''").replace(/"[^"\n]*"/g, '""');
@@ -591,8 +617,14 @@ function parseServer(body, source, upstreams, prefix) {
   const certPath = firstDirective(body, "ssl_certificate");
   const keyPath = firstDirective(body, "ssl_certificate_key");
   if (names.length === 0) return { warnings: [] };
-  const rawTargets = extractLocationProxies(body);
-  if (rawTargets.length === 0) {
+  const extracted = extractLocationProxies(body);
+  const rawTargets = extracted.routes;
+  for (const selector of extracted.unsupported) {
+    warnings.push(
+      `nginx: ${names[0]} location "${selector}" uses an unsupported regex or named selector (skipped)`
+    );
+  }
+  if (rawTargets.length === 0 && !extracted.sawProxyLocation) {
     const serverLevel = firstDirective(body, "proxy_pass");
     if (serverLevel) rawTargets.push({ path: "/", proxyPass: serverLevel });
   }
@@ -600,12 +632,12 @@ function parseServer(body, source, upstreams, prefix) {
   for (const t of rawTargets) {
     const r = resolveProxyTarget(t.proxyPass, upstreams);
     if ("reason" in r) warnings.push(`nginx: ${names[0]} ${t.path} \u2014 ${r.reason} (skipped)`);
-    else resolved.push({ path: t.path, url: r.url });
+    else resolved.push({ path: t.path, url: r.url, ...t.exact ? { exact: true } : {} });
   }
   let target;
   let routes;
   if (resolved.length > 0) {
-    const primary = resolved.find((r) => r.path === "/") ?? resolved[0];
+    const primary = resolved.find((r) => r.path === "/" && !r.exact) ?? resolved[0];
     target = { kind: "proxy", url: primary.url };
     routes = resolved;
   } else if (isHttpsUpgradeForSelf(body, names)) {
@@ -1589,7 +1621,9 @@ function buildProxyRouteIndex(sites) {
       }
       if (!Number.isFinite(port) || port <= 0) continue;
       const list = byPort.get(port) ?? [];
-      const existing = list.find((r) => r.path === up.path);
+      const existing = list.find(
+        (r) => r.path === up.path && Boolean(r.exact) === Boolean(up.exact)
+      );
       if (existing) {
         existing.domains = [.../* @__PURE__ */ new Set([...existing.domains, ...site.serverNames])];
         if (site.ssl) {
@@ -1604,6 +1638,7 @@ function buildProxyRouteIndex(sites) {
         list.push({
           port,
           path: up.path,
+          ...up.exact ? { exact: true } : {},
           domains: [...site.serverNames],
           ...site.proxy ? { proxy: site.proxy } : {},
           ssl: site.ssl ? { enabled: true, certPath: site.tls?.certPath, keyPath: site.tls?.keyPath } : { enabled: false },
@@ -2404,7 +2439,7 @@ function edgeHostExecutor(executor) {
   });
 }
 async function containerEdgeProvider(executor, container, opts) {
-  const { NginxProvider: Provider } = await import("./nginx-4U4C2XUS.js");
+  const { NginxProvider: Provider } = await import("./nginx-JMLAS7YS.js");
   return new Provider({
     ...opts,
     // Vhosts go to the BIND-MOUNTED HOST dir (so every host-side reader — the
@@ -2428,8 +2463,8 @@ async function containerEdgeProvider(executor, container, opts) {
   });
 }
 async function localContainerEdgeProvider(container, opts) {
-  const { DockerEdgeExecutor } = await import("./docker-edge-executor-E5TOTLMR.js");
-  const { NginxProvider: Provider } = await import("./nginx-4U4C2XUS.js");
+  const { DockerEdgeExecutor } = await import("./docker-edge-executor-HUQOWFQU.js");
+  const { NginxProvider: Provider } = await import("./nginx-JMLAS7YS.js");
   return new Provider({
     ...opts,
     paths: OPENRESTY_DEFAULT_PATHS,
@@ -2462,25 +2497,34 @@ async function startEdgeContainer(executor, container, image, onLog, mounts) {
   invalidateEdgeContainer(executor);
   return run.code === 0;
 }
+var MOUNT_RESOLVE_MARKER = "__OPENSHIP_MOUNT__";
 async function resolveEdgeContainerMounts(executor) {
-  return Promise.all(
-    EDGE_CONTAINER_MOUNTS.map(async (mount) => {
-      let host;
-      try {
-        host = (await executor.exec(`cd ${sq(mount.host)} && pwd -P`)).trim();
-      } catch (err) {
-        throw new Error(
-          `Could not resolve edge bind-mount source ${mount.host} on the target host: ${safeErrorMessage(err)}`
-        );
-      }
-      if (!host.startsWith("/") || host.includes("\n")) {
-        throw new Error(
-          `Could not resolve edge bind-mount source ${mount.host} on the target host: expected one absolute path, received ${JSON.stringify(host)}.`
-        );
-      }
-      return { host, container: mount.container };
-    })
-  );
+  const script = EDGE_CONTAINER_MOUNTS.map(
+    (mount) => `echo ${MOUNT_RESOLVE_MARKER}; (cd ${sq(mount.host)} && pwd -P) 2>&1`
+  ).join("; ") + "; true";
+  let raw;
+  try {
+    raw = await executor.exec(script);
+  } catch (err) {
+    throw new Error(
+      `Could not resolve edge bind-mount sources on the target host: ${safeErrorMessage(err)}`
+    );
+  }
+  const segments = raw.split(MOUNT_RESOLVE_MARKER).slice(1);
+  if (segments.length !== EDGE_CONTAINER_MOUNTS.length) {
+    throw new Error(
+      `Could not resolve edge bind-mount sources on the target host: expected ${EDGE_CONTAINER_MOUNTS.length} paths, received ${JSON.stringify(raw)}.`
+    );
+  }
+  return EDGE_CONTAINER_MOUNTS.map((mount, i) => {
+    const host = segments[i].trim();
+    if (!host.startsWith("/") || host.includes("\n")) {
+      throw new Error(
+        `Could not resolve edge bind-mount source ${mount.host} on the target host: expected one absolute path, received ${JSON.stringify(host)}.`
+      );
+    }
+    return { host, container: mount.container };
+  });
 }
 function buildEdgeRunCommand(container, image, edgeMounts = EDGE_CONTAINER_MOUNTS) {
   const mounts = edgeMounts.map(

package/dist/{chunk-IAMOUDHY.js → chunk-AUBB5DLY.js}

@@ -19,7 +19,7 @@ import {
   isCloudFrontedHost,
   luaSourceAvailable,
   reloadBareOpenResty
-} from "./chunk-7PEXM2UI.js";
+} from "./chunk-BOD2IQ3P.js";
 import {
   edgeDownExplanation,
   explainEdgeDown,
@@ -30,17 +30,17 @@ import {
 } from "./chunk-R4VDPFLS.js";
 import {
   EXECUTOR_DELEGATE
-} from "./chunk-NPSRGIHV.js";
+} from "./chunk-JWW5YAFL.js";
 import {
   logEntry,
   sq
-} from "./chunk-P7RCYELG.js";
+} from "./chunk-J2NDOB7D.js";
 import {
   edgeFailureReason
-} from "./chunk-X53JXRS4.js";
+} from "./chunk-YGA52DHX.js";
 import {
   probeListeningPort
-} from "./chunk-BO6CY4V2.js";
+} from "./chunk-GEHV7JBS.js";
 import {
   PROXY_DIRECTIVES,
   parseProxyValue,
@@ -48,7 +48,7 @@ import {
   resolveRedirectStatus,
   safeErrorMessage,
   sanitizeProxySettings
-} from "./chunk-WEZFTL4V.js";
+} from "./chunk-IVRTIKNZ.js";
 
 // ../../packages/adapters/src/infra/nginx.ts
 import {
@@ -92,8 +92,9 @@ async function readMaybeInContainer(exec, path, container) {
   if (!name) return "";
   return exec.exec(containerCommand(name, `cat ${sq(path)}`)).catch(() => "");
 }
-async function writeEdgeFileIn(inner, container, path, content) {
-  await inner.writeFile(path, content);
+async function writeEdgeFileIn(inner, container, path, content, opts) {
+  if (opts === void 0) await inner.writeFile(path, content);
+  else await inner.writeFile(path, content, opts);
   if (!container) return;
   const visible = await inner.exec(containerCommand(container, `test -e ${sq(path)} && echo visible`)).catch(() => "");
   if (visible.trim() === "visible") return;
@@ -149,7 +150,7 @@ ${result.output}` };
   if (opts?.files === "auto") {
     Object.assign(overrides, {
       readFile: (path) => readMaybeInContainer(inner, path, container),
-      writeFile: (path, content) => writeEdgeFileIn(inner, container, path, content),
+      writeFile: (path, content, writeOpts) => writeEdgeFileIn(inner, container, path, content, writeOpts),
       exists: async (path) => {
         if (await inner.exists(path).catch(() => false)) return true;
         const { code } = await inner.streamExec(inContainer(`test -e ${sq(path)}`), () => {
@@ -381,7 +382,13 @@ var WEBHOOK_LOCATION_PREFIX = "/_openship/hooks/";
 function renderProxyLocations(route, opts) {
   if (!route.proxyLocations || route.proxyLocations.length === 0) return "";
   const head = `${opts.httpsUpgrade ? HTTPS_UPGRADE : ""}${renderRedirectRules(route, "        ")}`;
-  const claimed = /* @__PURE__ */ new Set(["/", WEBHOOK_LOCATION_PREFIX]);
+  const claimed = /* @__PURE__ */ new Set([
+    "prefix:/",
+    `prefix:${WEBHOOK_LOCATION_PREFIX}`,
+    // An exact webhook match would not be a duplicate, but it would outrank and
+    // hijack the edge-owned delivery endpoint just as surely as a prefix would.
+    `exact:${WEBHOOK_LOCATION_PREFIX}`
+  ]);
   const blocks = [];
   for (const loc of route.proxyLocations) {
     assertValidUpstream(loc.targetUrl);
@@ -389,10 +396,12 @@ function renderProxyLocations(route, opts) {
     const headers = loc.external ? externalProxyHeaders(loc.targetUrl) : PROXY_HEADERS;
     if (!loc.pattern || !loc.upstreamPath) {
       assertValidLiteralPath(loc.pathPrefix, "proxy location prefix");
-      if (claimed.has(loc.pathPrefix)) continue;
-      claimed.add(loc.pathPrefix);
+      const kind = loc.exact ? "exact" : "prefix";
+      const key = `${kind}:${loc.pathPrefix}`;
+      if (claimed.has(key)) continue;
+      claimed.add(key);
       blocks.push(`
-    location ^~ ${loc.pathPrefix} {
+    location ${loc.exact ? "=" : "^~"} ${loc.pathPrefix} {
         ${head}proxy_pass ${loc.targetUrl};
         ${headers}
     }`);
@@ -403,8 +412,8 @@ function renderProxyLocations(route, opts) {
     assertNoNginxInjection(loc.upstreamPath, "rewrite upstream path");
     assertNoRuntimeVariable(loc.upstreamPath, "rewrite upstream path", true);
     const match = `^${toNginxPattern(loc.pattern)}$`;
-    if (claimed.has(`~ ${match}`)) continue;
-    claimed.add(`~ ${match}`);
+    if (claimed.has(`regex:${match}`)) continue;
+    claimed.add(`regex:${match}`);
     blocks.push(`
     location ~ ${match} {
         ${head}rewrite ${match} ${loc.upstreamPath} break;