percher 0.5.9 → 0.5.10

package/dist/bin/percher.js

@@ -90873,10 +90873,6 @@ var CAC = class extends EventTarget {
 };
 var cac = (name = "") => new CAC(name);
 
-// ../core/dist/app-name.js
-import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-
 // ../toml/dist/errors.js
 class PercherTomlError extends Error {
   code;
@@ -104801,6 +104797,8 @@ function serialize(config2) {
   return import_toml2.default.stringify(config2);
 }
 // ../core/dist/app-name.js
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
 function readPercherTomlAppName(cwd) {
   const p = join(cwd, "percher.toml");
   if (!existsSync(p))
@@ -105526,7 +105524,7 @@ async function appstoreKit(ctx, input = {}) {
   const themeHex = themeColorForToken(null);
   const base = resolve3(ctx.cwd, input.outDir ?? ".");
   const baseRel = relative(ctx.cwd, base);
-  if (baseRel.startsWith("..") || isAbsolute(baseRel)) {
+  if (baseRel === ".." || baseRel.startsWith(`..${sep}`) || isAbsolute(baseRel)) {
     throw new PercherCoreError("Output directory must stay inside the project", {
       code: "appstore-kit.bad-out-dir",
       hint: "Pass a path inside the current project (e.g. --out public), not an absolute or parent path."
@@ -109566,7 +109564,8 @@ FROM caddy:2-alpine AS caddy-source
 FROM alpine:3.21
 COPY --from=caddy-source /usr/bin/caddy /usr/bin/caddy
 RUN apk add --no-cache libcap \\
- && setcap -r /usr/bin/caddy \\
+ && (setcap -r /usr/bin/caddy 2>/dev/null || true) \\
+ && test -z "$(getcap /usr/bin/caddy)" \\
  && apk del libcap \\
  && rm -rf /var/cache/apk/*
 COPY Caddyfile /etc/caddy/Caddyfile
@@ -114449,6 +114448,17 @@ async function runDeployWithRetry(opts) {
   throw lastErr;
 }
 
+// ../core/dist/toml-recovery.js
+function tomlErrorToRecoveryProblems(err) {
+  if (err.issues?.length) {
+    return err.issues.map((i) => ({
+      file: "percher.toml",
+      message: `${i.path.join(".") || "(root)"}: ${i.message}`
+    }));
+  }
+  return [{ file: "percher.toml", message: err.message }];
+}
+
 // ../core/dist/commands/env-scan.js
 import { readdirSync as readdirSync3, readFileSync as readFileSync10, statSync as statSync3 } from "node:fs";
 import { join as join22 } from "node:path";
@@ -114964,9 +114974,9 @@ function buildLiveSummary(opts) {
   const replaced = opts.replacedPreview ? " — replaced previous preview" : "";
   return `${opts.appName} ${verb}${fwSuffix} → ${opts.url}${replaced}`;
 }
-async function publish(ctx, input = {}) {
+async function publish(ctx, input = {}, preParsedConfig) {
   try {
-    return await publishInner(ctx, input);
+    return await publishInner(ctx, input, preParsedConfig);
   } catch (err) {
     const classified = classifyPublishApiError(err, {
       configPath: tomlPathFor2(ctx.cwd),
@@ -114995,7 +115005,7 @@ async function publish(ctx, input = {}) {
     };
   }
 }
-async function publishInner(ctx, input) {
+async function publishInner(ctx, input, preParsedConfig) {
   const t0 = Date.now();
   if (!input.dryRun) {
     try {
@@ -115006,7 +115016,7 @@ async function publishInner(ctx, input) {
   ctx.status("[1/4] Reading config...");
   let config2;
   try {
-    config2 = await loadOrGenerate(ctx);
+    config2 = await loadOrGenerate(ctx, preParsedConfig);
   } catch (err) {
     if (err instanceof PercherTomlError) {
       if (err.code === "PARSE_ERROR") {
@@ -115020,7 +115030,7 @@ async function publishInner(ctx, input) {
             suggestion: "Fix the syntax error and retry publish."
           },
           recovery: recoveryFixConfig({
-            problems: [{ file: "percher.toml", message: err.message }],
+            problems: tomlErrorToRecoveryProblems(err),
             reasonCode: "config_invalid"
           }),
           summary: "percher.toml has invalid TOML syntax — fix and retry.",
@@ -115029,10 +115039,7 @@ async function publishInner(ctx, input) {
         };
       }
       if (err.code === "VALIDATION_ERROR") {
-        const problems = (err.issues ?? []).map((i) => ({
-          file: "percher.toml",
-          message: `${i.path.join(".") || "(root)"}: ${i.message}`
-        }));
+        const problems = tomlErrorToRecoveryProblems(err);
         const bullets = problems.map((p) => `  - ${p.message}`).join(`
 `);
         const count = problems.length;
@@ -115076,6 +115083,30 @@ ${bullets}`,
       bundle: { fileCount: 0, bytes: 0 }
     };
   }
+  if (preParsedConfig && !input.dryRun && !existsSync15(join24(ctx.cwd, "percher.toml"))) {
+    return {
+      status: "failed",
+      fileCount: 0,
+      bytes: 0,
+      error: {
+        title: "percher.toml missing from the project",
+        explanation: "A pre-parsed config was supplied, but no percher.toml exists in the project directory. The file is packaged into the upload, so it must be present on disk for a real deploy.",
+        suggestion: "Run `percher init` (or write percher.toml) before publishing."
+      },
+      recovery: recoveryFixConfig({
+        problems: [
+          {
+            file: "percher.toml",
+            message: "percher.toml must exist on disk for a real upload (it ships in the tarball)."
+          }
+        ],
+        reasonCode: "config_missing"
+      }),
+      summary: "percher.toml missing — required on disk for a real upload.",
+      configPath: tomlPathFor2(ctx.cwd),
+      bundle: { fileCount: 0, bytes: 0 }
+    };
+  }
   ctx.status("[2/4] Packaging files...");
   const tarball = await createTarball({ cwd: ctx.cwd, config: config2 });
   const packageMs = Date.now() - t0;
@@ -115581,11 +115612,14 @@ async function handleAnonymousPublish(ctx, config2, input, tarball) {
     ]
   };
 }
-async function loadOrGenerate(ctx) {
+async function loadOrGenerate(ctx, preParsed) {
+  if (preParsed)
+    return structuredClone(preParsed);
   const tomlPath = join24(ctx.cwd, "percher.toml");
   if (!existsSync15(tomlPath)) {
     ctx.status("No percher.toml found — detecting framework...");
-    await init(ctx);
+    const generated = await init(ctx);
+    return validate(generated.config);
   }
   return parseFile(tomlPath);
 }
@@ -119014,7 +119048,7 @@ async function renderError(stderr, error48) {
 // package.json
 var package_default = {
   name: "percher",
-  version: "0.5.9",
+  version: "0.5.10",
   description: "CLI for the Percher hosting platform — publish apps with one command",
   type: "module",
   bin: {

package/dist/package.json

@@ -1,7 +1,7 @@
 {
     "name": "percher",
-    "version": "0.5.9",
-    "description": "CLI for the Percher hosting platform — publish apps with one command",
+    "version": "0.5.10",
+    "description": "CLI for the Percher hosting platform \u2014 publish apps with one command",
     "type": "module",
     "bin": {
         "percher": "./dist/bin/percher.js"

package/dist/templates/astro/Dockerfile

@@ -1,34 +1,35 @@
-# Multi-stage build: a Bun stage compiles the static bundle, then a
-# minimal Caddy image serves it. This project uses runtime = "docker"
-# (not "static") because Percher's static runtime serves pre-built
-# files only — it does not run a build command. Generated by Percher;
-# safe to edit and own.
-
-# --- Build stage: install deps and build the static bundle -----------
-FROM oven/bun:1-alpine AS build
-WORKDIR /app
-COPY . .
-RUN bun install && bun run build
-
-# --- Serve stage: minimal Caddy image --------------------------------
-# caddy:2-alpine ships /usr/bin/caddy with cap_net_bind_service file
-# caps. Percher runs every container with --security-opt
-# no-new-privileges, which makes execve refuse a cap-bearing binary
-# (an "operation not permitted" crash-loop). Copy Caddy onto a plain
-# alpine base and strip the caps with setcap -r — Caddy never needs
-# the cap here, it listens on :8080 (>= 1024).
-FROM caddy:2-alpine AS caddy-source
-FROM alpine:3.21
-COPY --from=caddy-source /usr/bin/caddy /usr/bin/caddy
-RUN apk add --no-cache libcap \
- && setcap -r /usr/bin/caddy \
- && apk del libcap \
- && rm -rf /var/cache/apk/*
-COPY Caddyfile /etc/caddy/Caddyfile
-COPY --from=build /app/dist /srv
-# HOME points at the writable tmpfs so non-root Caddy can persist its
-# XDG state (storage-clean lock, config autosave) under Percher's
-# read-only root filesystem.
-ENV HOME=/tmp
-EXPOSE 8080
-CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
+# Multi-stage build: a Bun stage compiles the static bundle, then a
+# minimal Caddy image serves it. This project uses runtime = "docker"
+# (not "static") because Percher's static runtime serves pre-built
+# files only — it does not run a build command. Generated by Percher;
+# safe to edit and own.
+
+# --- Build stage: install deps and build the static bundle -----------
+FROM oven/bun:1-alpine AS build
+WORKDIR /app
+COPY . .
+RUN bun install && bun run build
+
+# --- Serve stage: minimal Caddy image --------------------------------
+# caddy:2-alpine ships /usr/bin/caddy with cap_net_bind_service file
+# caps. Percher runs every container with --security-opt
+# no-new-privileges, which makes execve refuse a cap-bearing binary
+# (an "operation not permitted" crash-loop). Copy Caddy onto a plain
+# alpine base and strip the caps with setcap -r — Caddy never needs
+# the cap here, it listens on :8080 (>= 1024).
+FROM caddy:2-alpine AS caddy-source
+FROM alpine:3.21
+COPY --from=caddy-source /usr/bin/caddy /usr/bin/caddy
+RUN apk add --no-cache libcap \
+ && (setcap -r /usr/bin/caddy 2>/dev/null || true) \
+ && test -z "$(getcap /usr/bin/caddy)" \
+ && apk del libcap \
+ && rm -rf /var/cache/apk/*
+COPY Caddyfile /etc/caddy/Caddyfile
+COPY --from=build /app/dist /srv
+# HOME points at the writable tmpfs so non-root Caddy can persist its
+# XDG state (storage-clean lock, config autosave) under Percher's
+# read-only root filesystem.
+ENV HOME=/tmp
+EXPOSE 8080
+CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]

package/dist/templates/astro/src/pages/index.astro

@@ -1,5 +1,5 @@
 ---
-const _title = "__APP_NAME__";
+const title = "__APP_NAME__";
 ---
 
 <html lang="en">

package/dist/templates/eleventy/Dockerfile

@@ -1,34 +1,35 @@
-# Multi-stage build: a Bun stage compiles the static bundle, then a
-# minimal Caddy image serves it. This project uses runtime = "docker"
-# (not "static") because Percher's static runtime serves pre-built
-# files only — it does not run a build command. Generated by Percher;
-# safe to edit and own.
-
-# --- Build stage: install deps and build the static bundle -----------
-FROM oven/bun:1-alpine AS build
-WORKDIR /app
-COPY . .
-RUN bun install && bun run build
-
-# --- Serve stage: minimal Caddy image --------------------------------
-# caddy:2-alpine ships /usr/bin/caddy with cap_net_bind_service file
-# caps. Percher runs every container with --security-opt
-# no-new-privileges, which makes execve refuse a cap-bearing binary
-# (an "operation not permitted" crash-loop). Copy Caddy onto a plain
-# alpine base and strip the caps with setcap -r — Caddy never needs
-# the cap here, it listens on :8080 (>= 1024).
-FROM caddy:2-alpine AS caddy-source
-FROM alpine:3.21
-COPY --from=caddy-source /usr/bin/caddy /usr/bin/caddy
-RUN apk add --no-cache libcap \
- && setcap -r /usr/bin/caddy \
- && apk del libcap \
- && rm -rf /var/cache/apk/*
-COPY Caddyfile /etc/caddy/Caddyfile
-COPY --from=build /app/_site /srv
-# HOME points at the writable tmpfs so non-root Caddy can persist its
-# XDG state (storage-clean lock, config autosave) under Percher's
-# read-only root filesystem.
-ENV HOME=/tmp
-EXPOSE 8080
-CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
+# Multi-stage build: a Bun stage compiles the static bundle, then a
+# minimal Caddy image serves it. This project uses runtime = "docker"
+# (not "static") because Percher's static runtime serves pre-built
+# files only — it does not run a build command. Generated by Percher;
+# safe to edit and own.
+
+# --- Build stage: install deps and build the static bundle -----------
+FROM oven/bun:1-alpine AS build
+WORKDIR /app
+COPY . .
+RUN bun install && bun run build
+
+# --- Serve stage: minimal Caddy image --------------------------------
+# caddy:2-alpine ships /usr/bin/caddy with cap_net_bind_service file
+# caps. Percher runs every container with --security-opt
+# no-new-privileges, which makes execve refuse a cap-bearing binary
+# (an "operation not permitted" crash-loop). Copy Caddy onto a plain
+# alpine base and strip the caps with setcap -r — Caddy never needs
+# the cap here, it listens on :8080 (>= 1024).
+FROM caddy:2-alpine AS caddy-source
+FROM alpine:3.21
+COPY --from=caddy-source /usr/bin/caddy /usr/bin/caddy
+RUN apk add --no-cache libcap \
+ && (setcap -r /usr/bin/caddy 2>/dev/null || true) \
+ && test -z "$(getcap /usr/bin/caddy)" \
+ && apk del libcap \
+ && rm -rf /var/cache/apk/*
+COPY Caddyfile /etc/caddy/Caddyfile
+COPY --from=build /app/_site /srv
+# HOME points at the writable tmpfs so non-root Caddy can persist its
+# XDG state (storage-clean lock, config autosave) under Percher's
+# read-only root filesystem.
+ENV HOME=/tmp
+EXPOSE 8080
+CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]

package/dist/templates/hugo/Dockerfile

@@ -1,32 +1,33 @@
-# Multi-stage build: Hugo compiles the site, then a minimal Caddy
-# image serves it. runtime = "docker" because Percher's static runtime
-# serves pre-built files only — it does not run Hugo. Edit and own freely.
-
-# --- Build stage: compile the Hugo site ------------------------------
-FROM hugomods/hugo:exts-0.139.4 AS build
-WORKDIR /site
-COPY . .
-RUN hugo --minify
-
-# --- Serve stage: minimal Caddy image --------------------------------
-# caddy:2-alpine ships /usr/bin/caddy with cap_net_bind_service file
-# caps. Percher runs every container with --security-opt
-# no-new-privileges, which makes execve refuse a cap-bearing binary
-# (an "operation not permitted" crash-loop). Copy Caddy onto a plain
-# alpine base and strip the caps with setcap -r — Caddy never needs
-# the cap here, it listens on :8080 (>= 1024).
-FROM caddy:2-alpine AS caddy-source
-FROM alpine:3.21
-COPY --from=caddy-source /usr/bin/caddy /usr/bin/caddy
-RUN apk add --no-cache libcap \
- && setcap -r /usr/bin/caddy \
- && apk del libcap \
- && rm -rf /var/cache/apk/*
-COPY Caddyfile /etc/caddy/Caddyfile
-COPY --from=build /site/public /srv
-# HOME points at the writable tmpfs so non-root Caddy can persist its
-# XDG state (storage-clean lock, config autosave) under Percher's
-# read-only root filesystem.
-ENV HOME=/tmp
-EXPOSE 8080
-CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
+# Multi-stage build: Hugo compiles the site, then a minimal Caddy
+# image serves it. runtime = "docker" because Percher's static runtime
+# serves pre-built files only — it does not run Hugo. Edit and own freely.
+
+# --- Build stage: compile the Hugo site ------------------------------
+FROM hugomods/hugo:exts-0.139.4 AS build
+WORKDIR /site
+COPY . .
+RUN hugo --minify
+
+# --- Serve stage: minimal Caddy image --------------------------------
+# caddy:2-alpine ships /usr/bin/caddy with cap_net_bind_service file
+# caps. Percher runs every container with --security-opt
+# no-new-privileges, which makes execve refuse a cap-bearing binary
+# (an "operation not permitted" crash-loop). Copy Caddy onto a plain
+# alpine base and strip the caps with setcap -r — Caddy never needs
+# the cap here, it listens on :8080 (>= 1024).
+FROM caddy:2-alpine AS caddy-source
+FROM alpine:3.21
+COPY --from=caddy-source /usr/bin/caddy /usr/bin/caddy
+RUN apk add --no-cache libcap \
+ && (setcap -r /usr/bin/caddy 2>/dev/null || true) \
+ && test -z "$(getcap /usr/bin/caddy)" \
+ && apk del libcap \
+ && rm -rf /var/cache/apk/*
+COPY Caddyfile /etc/caddy/Caddyfile
+COPY --from=build /site/public /srv
+# HOME points at the writable tmpfs so non-root Caddy can persist its
+# XDG state (storage-clean lock, config autosave) under Percher's
+# read-only root filesystem.
+ENV HOME=/tmp
+EXPOSE 8080
+CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]

package/dist/templates/laravel/Dockerfile

@@ -5,11 +5,15 @@ RUN composer install --no-dev --no-scripts --no-autoloader --prefer-dist
 
 FROM php:8.3-cli-alpine
 WORKDIR /app
-RUN addgroup -S app && adduser -S app -G app
+# tini as PID 1 forwards SIGTERM to php; without it `php -S` as PID 1 ignores
+# SIGTERM (Linux PID-1 special case) and is SIGKILLed on every stop/redeploy.
+RUN apk add --no-cache tini \
+ && addgroup -S app && adduser -S app -G app
 COPY --from=vendor --chown=app:app /app/vendor ./vendor
 COPY --chown=app:app . .
 RUN composer dump-autoload --no-dev --optimize 2>/dev/null || true \
  && chown -R app:app /app
 USER app
 EXPOSE 8000
+ENTRYPOINT ["/sbin/tini", "--"]
 CMD ["php", "-S", "0.0.0.0:8000", "-t", "public", "public/index.php"]

package/dist/templates/nextjs/next.config.mjs

@@ -0,0 +1,8 @@
+// Plain ESM (not next.config.ts) on purpose: `next start` loads the config at
+// RUNTIME, and a .ts config would require the `typescript` package in the slim
+// runtime image — but typescript is a build-only devDependency (pruned from the
+// runtime stage). A .mjs config loads with no typescript at run time.
+/** @type {import('next').NextConfig} */
+const nextConfig = {};
+
+export default nextConfig;

package/dist/templates/nextjs/package.json

@@ -11,5 +11,11 @@
     "next": "^15.0.0",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.6.0",
+    "@types/node": "^22.0.0",
+    "@types/react": "^19.0.0",
+    "@types/react-dom": "^19.0.0"
   }
 }

package/dist/templates/preact/Dockerfile

@@ -1,34 +1,35 @@
-# Multi-stage build: a Bun stage compiles the static bundle, then a
-# minimal Caddy image serves it. This project uses runtime = "docker"
-# (not "static") because Percher's static runtime serves pre-built
-# files only — it does not run a build command. Generated by Percher;
-# safe to edit and own.
-
-# --- Build stage: install deps and build the static bundle -----------
-FROM oven/bun:1-alpine AS build
-WORKDIR /app
-COPY . .
-RUN bun install && bun run build
-
-# --- Serve stage: minimal Caddy image --------------------------------
-# caddy:2-alpine ships /usr/bin/caddy with cap_net_bind_service file
-# caps. Percher runs every container with --security-opt
-# no-new-privileges, which makes execve refuse a cap-bearing binary
-# (an "operation not permitted" crash-loop). Copy Caddy onto a plain
-# alpine base and strip the caps with setcap -r — Caddy never needs
-# the cap here, it listens on :8080 (>= 1024).
-FROM caddy:2-alpine AS caddy-source
-FROM alpine:3.21
-COPY --from=caddy-source /usr/bin/caddy /usr/bin/caddy
-RUN apk add --no-cache libcap \
- && setcap -r /usr/bin/caddy \
- && apk del libcap \
- && rm -rf /var/cache/apk/*
-COPY Caddyfile /etc/caddy/Caddyfile
-COPY --from=build /app/dist /srv
-# HOME points at the writable tmpfs so non-root Caddy can persist its
-# XDG state (storage-clean lock, config autosave) under Percher's
-# read-only root filesystem.
-ENV HOME=/tmp
-EXPOSE 8080
-CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
+# Multi-stage build: a Bun stage compiles the static bundle, then a
+# minimal Caddy image serves it. This project uses runtime = "docker"
+# (not "static") because Percher's static runtime serves pre-built
+# files only — it does not run a build command. Generated by Percher;
+# safe to edit and own.
+
+# --- Build stage: install deps and build the static bundle -----------
+FROM oven/bun:1-alpine AS build
+WORKDIR /app
+COPY . .
+RUN bun install && bun run build
+
+# --- Serve stage: minimal Caddy image --------------------------------
+# caddy:2-alpine ships /usr/bin/caddy with cap_net_bind_service file
+# caps. Percher runs every container with --security-opt
+# no-new-privileges, which makes execve refuse a cap-bearing binary
+# (an "operation not permitted" crash-loop). Copy Caddy onto a plain
+# alpine base and strip the caps with setcap -r — Caddy never needs
+# the cap here, it listens on :8080 (>= 1024).
+FROM caddy:2-alpine AS caddy-source
+FROM alpine:3.21
+COPY --from=caddy-source /usr/bin/caddy /usr/bin/caddy
+RUN apk add --no-cache libcap \
+ && (setcap -r /usr/bin/caddy 2>/dev/null || true) \
+ && test -z "$(getcap /usr/bin/caddy)" \
+ && apk del libcap \
+ && rm -rf /var/cache/apk/*
+COPY Caddyfile /etc/caddy/Caddyfile
+COPY --from=build /app/dist /srv
+# HOME points at the writable tmpfs so non-root Caddy can persist its
+# XDG state (storage-clean lock, config autosave) under Percher's
+# read-only root filesystem.
+ENV HOME=/tmp
+EXPOSE 8080
+CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]

package/dist/templates/python/nixpacks.toml

@@ -0,0 +1,8 @@
+# Pin the start command for the default nixpacks build path. Without this,
+# nixpacks' Python provider can default to `python main.py`, which imports the
+# FastAPI app and exits without serving — the container exits immediately and
+# the health check fails. `python -m uvicorn` doesn't depend on `uvicorn` being
+# on PATH. Mirrors `[web].command` in percher.toml (used by the Percher-owned
+# python build bypass).
+[start]
+cmd = "python -m uvicorn main:app --host 0.0.0.0 --port 8000"

package/dist/templates/python/percher.toml

@@ -6,6 +6,7 @@ framework = "fastapi"
 [web]
 port = 8000
 health = "/health"
+command = "python -m uvicorn main:app --host 0.0.0.0 --port 8000"
 
 [data]
 mode = "none"

package/dist/templates/rust/Dockerfile

@@ -6,9 +6,13 @@ COPY src ./src
 RUN cargo build --release --bin app
 
 FROM alpine:3.20
-RUN apk add --no-cache ca-certificates \
+# tini as PID 1 forwards SIGTERM to the app; without it the bare binary as PID 1
+# ignores SIGTERM (Linux PID-1 special case) and the container is SIGKILLed on
+# every stop/redeploy instead of shutting down cleanly.
+RUN apk add --no-cache ca-certificates tini \
  && addgroup -S app && adduser -S app -G app
 COPY --from=build --chown=app:app /src/target/release/app /app
 USER app
 EXPOSE 8080
+ENTRYPOINT ["/sbin/tini", "--"]
 CMD ["/app"]

package/dist/templates/solid/Dockerfile

@@ -1,34 +1,35 @@
-# Multi-stage build: a Bun stage compiles the static bundle, then a
-# minimal Caddy image serves it. This project uses runtime = "docker"
-# (not "static") because Percher's static runtime serves pre-built
-# files only — it does not run a build command. Generated by Percher;
-# safe to edit and own.
-
-# --- Build stage: install deps and build the static bundle -----------
-FROM oven/bun:1-alpine AS build
-WORKDIR /app
-COPY . .
-RUN bun install && bun run build
-
-# --- Serve stage: minimal Caddy image --------------------------------
-# caddy:2-alpine ships /usr/bin/caddy with cap_net_bind_service file
-# caps. Percher runs every container with --security-opt
-# no-new-privileges, which makes execve refuse a cap-bearing binary
-# (an "operation not permitted" crash-loop). Copy Caddy onto a plain
-# alpine base and strip the caps with setcap -r — Caddy never needs
-# the cap here, it listens on :8080 (>= 1024).
-FROM caddy:2-alpine AS caddy-source
-FROM alpine:3.21
-COPY --from=caddy-source /usr/bin/caddy /usr/bin/caddy
-RUN apk add --no-cache libcap \
- && setcap -r /usr/bin/caddy \
- && apk del libcap \
- && rm -rf /var/cache/apk/*
-COPY Caddyfile /etc/caddy/Caddyfile
-COPY --from=build /app/dist /srv
-# HOME points at the writable tmpfs so non-root Caddy can persist its
-# XDG state (storage-clean lock, config autosave) under Percher's
-# read-only root filesystem.
-ENV HOME=/tmp
-EXPOSE 8080
-CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
+# Multi-stage build: a Bun stage compiles the static bundle, then a
+# minimal Caddy image serves it. This project uses runtime = "docker"
+# (not "static") because Percher's static runtime serves pre-built
+# files only — it does not run a build command. Generated by Percher;
+# safe to edit and own.
+
+# --- Build stage: install deps and build the static bundle -----------
+FROM oven/bun:1-alpine AS build
+WORKDIR /app
+COPY . .
+RUN bun install && bun run build
+
+# --- Serve stage: minimal Caddy image --------------------------------
+# caddy:2-alpine ships /usr/bin/caddy with cap_net_bind_service file
+# caps. Percher runs every container with --security-opt
+# no-new-privileges, which makes execve refuse a cap-bearing binary
+# (an "operation not permitted" crash-loop). Copy Caddy onto a plain
+# alpine base and strip the caps with setcap -r — Caddy never needs
+# the cap here, it listens on :8080 (>= 1024).
+FROM caddy:2-alpine AS caddy-source
+FROM alpine:3.21
+COPY --from=caddy-source /usr/bin/caddy /usr/bin/caddy
+RUN apk add --no-cache libcap \
+ && (setcap -r /usr/bin/caddy 2>/dev/null || true) \
+ && test -z "$(getcap /usr/bin/caddy)" \
+ && apk del libcap \
+ && rm -rf /var/cache/apk/*
+COPY Caddyfile /etc/caddy/Caddyfile
+COPY --from=build /app/dist /srv
+# HOME points at the writable tmpfs so non-root Caddy can persist its
+# XDG state (storage-clean lock, config autosave) under Percher's
+# read-only root filesystem.
+ENV HOME=/tmp
+EXPOSE 8080
+CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]

package/dist/templates/vite-react/Dockerfile

@@ -1,34 +1,35 @@
-# Multi-stage build: a Bun stage compiles the static bundle, then a
-# minimal Caddy image serves it. This project uses runtime = "docker"
-# (not "static") because Percher's static runtime serves pre-built
-# files only — it does not run a build command. Generated by Percher;
-# safe to edit and own.
-
-# --- Build stage: install deps and build the static bundle -----------
-FROM oven/bun:1-alpine AS build
-WORKDIR /app
-COPY . .
-RUN bun install && bun run build
-
-# --- Serve stage: minimal Caddy image --------------------------------
-# caddy:2-alpine ships /usr/bin/caddy with cap_net_bind_service file
-# caps. Percher runs every container with --security-opt
-# no-new-privileges, which makes execve refuse a cap-bearing binary
-# (an "operation not permitted" crash-loop). Copy Caddy onto a plain
-# alpine base and strip the caps with setcap -r — Caddy never needs
-# the cap here, it listens on :8080 (>= 1024).
-FROM caddy:2-alpine AS caddy-source
-FROM alpine:3.21
-COPY --from=caddy-source /usr/bin/caddy /usr/bin/caddy
-RUN apk add --no-cache libcap \
- && setcap -r /usr/bin/caddy \
- && apk del libcap \
- && rm -rf /var/cache/apk/*
-COPY Caddyfile /etc/caddy/Caddyfile
-COPY --from=build /app/dist /srv
-# HOME points at the writable tmpfs so non-root Caddy can persist its
-# XDG state (storage-clean lock, config autosave) under Percher's
-# read-only root filesystem.
-ENV HOME=/tmp
-EXPOSE 8080
-CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
+# Multi-stage build: a Bun stage compiles the static bundle, then a
+# minimal Caddy image serves it. This project uses runtime = "docker"
+# (not "static") because Percher's static runtime serves pre-built
+# files only — it does not run a build command. Generated by Percher;
+# safe to edit and own.
+
+# --- Build stage: install deps and build the static bundle -----------
+FROM oven/bun:1-alpine AS build
+WORKDIR /app
+COPY . .
+RUN bun install && bun run build
+
+# --- Serve stage: minimal Caddy image --------------------------------
+# caddy:2-alpine ships /usr/bin/caddy with cap_net_bind_service file
+# caps. Percher runs every container with --security-opt
+# no-new-privileges, which makes execve refuse a cap-bearing binary
+# (an "operation not permitted" crash-loop). Copy Caddy onto a plain
+# alpine base and strip the caps with setcap -r — Caddy never needs
+# the cap here, it listens on :8080 (>= 1024).
+FROM caddy:2-alpine AS caddy-source
+FROM alpine:3.21
+COPY --from=caddy-source /usr/bin/caddy /usr/bin/caddy
+RUN apk add --no-cache libcap \
+ && (setcap -r /usr/bin/caddy 2>/dev/null || true) \
+ && test -z "$(getcap /usr/bin/caddy)" \
+ && apk del libcap \
+ && rm -rf /var/cache/apk/*
+COPY Caddyfile /etc/caddy/Caddyfile
+COPY --from=build /app/dist /srv
+# HOME points at the writable tmpfs so non-root Caddy can persist its
+# XDG state (storage-clean lock, config autosave) under Percher's
+# read-only root filesystem.
+ENV HOME=/tmp
+EXPOSE 8080
+CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]

package/dist/templates/vite-vue/Dockerfile

@@ -1,34 +1,35 @@
-# Multi-stage build: a Bun stage compiles the static bundle, then a
-# minimal Caddy image serves it. This project uses runtime = "docker"
-# (not "static") because Percher's static runtime serves pre-built
-# files only — it does not run a build command. Generated by Percher;
-# safe to edit and own.
-
-# --- Build stage: install deps and build the static bundle -----------
-FROM oven/bun:1-alpine AS build
-WORKDIR /app
-COPY . .
-RUN bun install && bun run build
-
-# --- Serve stage: minimal Caddy image --------------------------------
-# caddy:2-alpine ships /usr/bin/caddy with cap_net_bind_service file
-# caps. Percher runs every container with --security-opt
-# no-new-privileges, which makes execve refuse a cap-bearing binary
-# (an "operation not permitted" crash-loop). Copy Caddy onto a plain
-# alpine base and strip the caps with setcap -r — Caddy never needs
-# the cap here, it listens on :8080 (>= 1024).
-FROM caddy:2-alpine AS caddy-source
-FROM alpine:3.21
-COPY --from=caddy-source /usr/bin/caddy /usr/bin/caddy
-RUN apk add --no-cache libcap \
- && setcap -r /usr/bin/caddy \
- && apk del libcap \
- && rm -rf /var/cache/apk/*
-COPY Caddyfile /etc/caddy/Caddyfile
-COPY --from=build /app/dist /srv
-# HOME points at the writable tmpfs so non-root Caddy can persist its
-# XDG state (storage-clean lock, config autosave) under Percher's
-# read-only root filesystem.
-ENV HOME=/tmp
-EXPOSE 8080
-CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
+# Multi-stage build: a Bun stage compiles the static bundle, then a
+# minimal Caddy image serves it. This project uses runtime = "docker"
+# (not "static") because Percher's static runtime serves pre-built
+# files only — it does not run a build command. Generated by Percher;
+# safe to edit and own.
+
+# --- Build stage: install deps and build the static bundle -----------
+FROM oven/bun:1-alpine AS build
+WORKDIR /app
+COPY . .
+RUN bun install && bun run build
+
+# --- Serve stage: minimal Caddy image --------------------------------
+# caddy:2-alpine ships /usr/bin/caddy with cap_net_bind_service file
+# caps. Percher runs every container with --security-opt
+# no-new-privileges, which makes execve refuse a cap-bearing binary
+# (an "operation not permitted" crash-loop). Copy Caddy onto a plain
+# alpine base and strip the caps with setcap -r — Caddy never needs
+# the cap here, it listens on :8080 (>= 1024).
+FROM caddy:2-alpine AS caddy-source
+FROM alpine:3.21
+COPY --from=caddy-source /usr/bin/caddy /usr/bin/caddy
+RUN apk add --no-cache libcap \
+ && (setcap -r /usr/bin/caddy 2>/dev/null || true) \
+ && test -z "$(getcap /usr/bin/caddy)" \
+ && apk del libcap \
+ && rm -rf /var/cache/apk/*
+COPY Caddyfile /etc/caddy/Caddyfile
+COPY --from=build /app/dist /srv
+# HOME points at the writable tmpfs so non-root Caddy can persist its
+# XDG state (storage-clean lock, config autosave) under Percher's
+# read-only root filesystem.
+ENV HOME=/tmp
+EXPOSE 8080
+CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "percher",
-  "version": "0.5.9",
-  "description": "CLI for the Percher hosting platform — publish apps with one command",
+  "version": "0.5.10",
+  "description": "CLI for the Percher hosting platform \u2014 publish apps with one command",
   "type": "module",
   "bin": {
     "percher": "./dist/bin/percher.js"

package/dist/templates/nextjs/next.config.ts

@@ -1,5 +0,0 @@
-import type { NextConfig } from "next";
-
-const nextConfig: NextConfig = {};
-
-export default nextConfig;

package/dist/templates/node/index.ts

@@ -1,12 +0,0 @@
-const server = Bun.serve({
-  port: Number(process.env.PORT ?? 3000),
-  fetch(req) {
-    const url = new URL(req.url);
-    if (url.pathname === "/health") {
-      return Response.json({ status: "ok" });
-    }
-    return new Response("Hello from __APP_NAME__!");
-  },
-});
-
-console.log(`Listening on http://localhost:${server.port}`);