percher 1.3.0 → 1.4.1

package/dist/src/output.js.map

@@ -1 +1 @@
-{"version":3,"file":"output.js","sourceRoot":"","sources":["../../src/output.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAkC,EAClC,KAAc;IAEd,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,0BAA0B,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACjE,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACvC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QACxC,uEAAuE;QACvE,uEAAuE;QACvE,yDAAyD;QACzD,IAAI,KAAK,CAAC,QAAQ,KAAK,uBAAuB,EAAE,CAAC;YAC/C,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,gDAAgD,CAAC,EAAE,CAAC,CAAC;YAC7E,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC1B,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,GAAG,CACJ,wGAAwG,KAAK,CAAC,YAAY,EAAE,CAC7H,CACF,CAAC;YACF,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,GAAG,CACJ,wFAAwF,CACzF,CACF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,iDAAiD,CAAC,EAAE,CAAC,CAAC;YAC9E,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC1B,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,GAAG,CACJ,sEAAsE,KAAK,CAAC,YAAY,EAAE,CAC3F,CACF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,0BAA0B,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;SAAM,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;QAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACjD,KAAK,CAAC,IAAI,CACR,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,iDAAiD,KAAK,CAAC,MAAM,gCAAgC,CACjH,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACnD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,UAAU,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,KAAK,CAAC,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAC3E,CAAC;SAAM,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC;SAAM,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,IAAI,KAAK,CAAC,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtF,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../../src/output.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAkC,EAClC,KAAc;IAEd,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,0BAA0B,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACjE,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACvC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QACxC,uEAAuE;QACvE,uEAAuE;QACvE,yDAAyD;QACzD,IAAI,KAAK,CAAC,QAAQ,KAAK,uBAAuB,EAAE,CAAC;YAC/C,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,gDAAgD,CAAC,EAAE,CAAC,CAAC;YAC7E,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC1B,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,GAAG,CACJ,wGAAwG,KAAK,CAAC,YAAY,EAAE,CAC7H,CACF,CAAC;YACF,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,GAAG,CACJ,wFAAwF,CACzF,CACF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,iDAAiD,CAAC,EAAE,CAAC,CAAC;YAC9E,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC1B,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,GAAG,CACJ,sEAAsE,KAAK,CAAC,YAAY,EAAE,CAC3F,CACF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,0BAA0B,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;SAAM,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,4BAA4B,CAAC,KAAK,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACvE,MAAM,OAAO,GACX,KAAK;YACL,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,uBAAuB,IAAI,KAAK,CAAC,MAAM,KAAK,eAAe,CAAC;gBAC3E,CAAC,KAAK,CAAC,IAAI,KAAK,2BAA2B,IAAI,KAAK,CAAC,MAAM,KAAK,kBAAkB,CAAC,CAAC,CAAC;QACzF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAClE,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAC1B,CAAC;aAAM,IACL,KAAK,CAAC,IAAI,KAAK,2BAA2B;YAC1C,KAAK,CAAC,IAAI,KAAK,uBAAuB,EACtC,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxD,KAAK,CAAC,IAAI,CACR,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,iDAAiD,KAAK,CAAC,MAAM,gCAAgC,CACjH,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACnD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,UAAU,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,KAAK,CAAC,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAC3E,CAAC;SAAM,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;SAAM,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,IAAI,KAAK,CAAC,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtF,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/src/security-output.d.ts

@@ -0,0 +1,3 @@
+/** Plain diagnostic lines; control characters are refused by the shared decoder. */
+export declare function securityOutputLines(value: unknown, includeSummary?: boolean): string[];
+//# sourceMappingURL=security-output.d.ts.map

package/dist/src/security-output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-output.d.ts","sourceRoot":"","sources":["../../src/security-output.ts"],"names":[],"mappings":"AAMA,oFAAoF;AACpF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,cAAc,UAAO,GAAG,MAAM,EAAE,CAkBnF"}

package/dist/src/security-output.js

@@ -0,0 +1,22 @@
+import { deploymentSecurityActionText, deploymentSecuritySummary, parseDeploymentSecurityBlock, } from "@percher/shared";
+/** Plain diagnostic lines; control characters are refused by the shared decoder. */
+export function securityOutputLines(value, includeSummary = true) {
+    const block = parseDeploymentSecurityBlock(value);
+    if (!block)
+        return [];
+    const lines = includeSummary
+        ? [
+            deploymentSecuritySummary(block),
+            ...block.actions.map((action) => deploymentSecurityActionText(action, block.context)),
+        ]
+        : [];
+    for (const f of block.findings) {
+        lines.push(`${f.cve}: ${f.component}${f.version ? ` ${f.version}` : ""}; ${f.fixedIn ? `reported fixed versions: ${f.fixedIn}` : "no fixed version reported"}; ${f.responsibility === "percher" ? "Percher component" : "app dependency"}${f.exploitedKev ? "; known exploited" : ""}.`);
+    }
+    if (block.truncated)
+        lines.push(`Showing ${block.findings.length} of ${block.totalFindings} findings.`);
+    if (block.imageId)
+        lines.push(`Image: ${block.imageId}`);
+    return lines;
+}
+//# sourceMappingURL=security-output.js.map

package/dist/src/security-output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-output.js","sourceRoot":"","sources":["../../src/security-output.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AAEzB,oFAAoF;AACpF,MAAM,UAAU,mBAAmB,CAAC,KAAc,EAAE,cAAc,GAAG,IAAI;IACvE,MAAM,KAAK,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,KAAK,GAAG,cAAc;QAC1B,CAAC,CAAC;YACE,yBAAyB,CAAC,KAAK,CAAC;YAChC,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,4BAA4B,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;SACtF;QACH,CAAC,CAAC,EAAE,CAAC;IACP,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,2BAA2B,KAAK,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,gBAAgB,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,GAAG,CAC7Q,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,SAAS;QACjB,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,QAAQ,CAAC,MAAM,OAAO,KAAK,CAAC,aAAa,YAAY,CAAC,CAAC;IACrF,IAAI,KAAK,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/templates/astro/Caddyfile

@@ -2,5 +2,9 @@
 	bind 0.0.0.0
 	root * /srv
 	encode gzip zstd
-	file_server
+	route {
+		@percher_platform path_regexp percher_platform (?i)(?:^/+(?:percher[.]toml|[.]percherignore|pb|Dockerfile|Caddyfile|[.]git|[.]env|[.]env[.][^/]*|[.]percher-[^/]*)(?:/|$)|(?:^|/)(?:[.]npmrc|[.]pypirc|[.]netrc|_netrc|[.]git-credentials|[.]htpasswd|[.]pgpass|[.]my[.]cnf|[.]dev[.]vars|id_rsa|id_dsa|id_ecdsa|id_ed25519|credentials[.]json|secrets[.]toml|wp-config[.]php|[.]env|[.]ssh|[.]aws|[.]gnupg|[.]docker/config[.]json|[.]kube/config|[.]env[.][^/]*|[.]dev[.]vars[.][^/]*|[^/]*[.]pem|[^/]*[.]key|[^/]*[.]p12|[^/]*[.]pfx|[^/]*[.]jks|[^/]*[.]keystore)(?:/|$))
+		respond @percher_platform 404
+		file_server
+	}
 }

package/dist/templates/astro/Dockerfile

@@ -10,27 +10,26 @@ WORKDIR /app
 COPY . .
 RUN bun install && bun run build
 
+# Preserve build inputs for deployment; only this filtered copy reaches /srv.
+FROM build AS static-content
+RUN bun -e 'const fs=require("node:fs"),path=require("node:path");const root=fs.realpathSync(process.argv[1]),dir=fs.realpathSync(process.argv[2]),dest=process.argv[3];const deny=new RegExp("(?:^/+(?:percher[.]toml|[.]percherignore|pb|Dockerfile|Caddyfile|[.]git|[.]env|[.]env[.][^/]*|[.]percher-[^/]*)(?:/|$)|(?:^|/)(?:[.]npmrc|[.]pypirc|[.]netrc|_netrc|[.]git-credentials|[.]htpasswd|[.]pgpass|[.]my[.]cnf|[.]dev[.]vars|id_rsa|id_dsa|id_ecdsa|id_ed25519|credentials[.]json|secrets[.]toml|wp-config[.]php|[.]env|[.]ssh|[.]aws|[.]gnupg|[.]docker/config[.]json|[.]kube/config|[.]env[.][^/]*|[.]dev[.]vars[.][^/]*|[^/]*[.]pem|[^/]*[.]key|[^/]*[.]p12|[^/]*[.]pfx|[^/]*[.]jks|[^/]*[.]keystore)(?:/|$))","i");const reserved=p=>deny.test("/"+p.split(path.sep).join("/"));if((dir!==root&&!dir.startsWith(root+path.sep))||reserved(path.relative(root,dir)))throw Error("Static output escapes the project or selects platform content");if(fs.existsSync(dest))throw Error("Reserved static staging directory already exists");fs.cpSync(dir,dest,{recursive:true,filter:p=>{if(reserved(path.relative(dir,p))||reserved(path.relative(root,p)))return false;if(fs.lstatSync(p).isSymbolicLink())throw Error("Static content cannot contain symlinks");return true}})' '/app' '/app/dist' '/percher-static-content'
+
 # --- Serve stage: minimal Caddy image --------------------------------
 # Build pinned Caddy source with refreshed security modules. The scratch
 # runtime carries no shell, package manager, or file capabilities and listens
 # on the unprivileged port :8080.
-FROM golang:1.26.9-alpine3.23@sha256:6750308561953d451210ed1a8086d36c8c8bdcbf672d38d9d0d424b8a7a0216c AS caddy-source
-ADD --checksum=sha256:78e660d838e45c0b8c89338b325946238f153641aa9925df9ef2ad5e8eced31b \
-  https://github.com/caddyserver/caddy/commit/b2693fb63a30e6d7be0972c3645e9a2c0a500e93.patch /tmp/caddy-cel-go.patch
-RUN go mod download github.com/caddyserver/caddy/v2@v2.11.4 \
- && cp -R /go/pkg/mod/github.com/caddyserver/caddy/v2@v2.11.4 /src \
+FROM golang:1.26.10-alpine3.23@sha256:0525c952defebc693cdaf62cdf43afa32be5a7f377e99260642ea19c240c708e AS caddy-source
+RUN go mod download github.com/caddyserver/caddy/v2@v2.11.7 \
+ && cp -R /go/pkg/mod/github.com/caddyserver/caddy/v2@v2.11.7 /src \
  && chmod -R u+w /src
 WORKDIR /src
-RUN apk add --no-cache patch \
- && patch -p1 < /tmp/caddy-cel-go.patch \
- && go get github.com/go-chi/chi/v5@v5.3.0 github.com/google/cel-go@v0.29.2 \
-      github.com/klauspost/compress@v1.18.7 go.opentelemetry.io/otel@v1.45.0 \
-      go.opentelemetry.io/otel/sdk/log@v0.21.0 \
-      go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc@v0.21.0 \
-      go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.21.0 \
-      go.opentelemetry.io/otel/exporters/stdout/stdoutlog@v0.21.0 \
-      go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.45.0 \
-      go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.45.0 \
+RUN go get github.com/go-chi/chi/v5@v5.3.2 github.com/klauspost/compress@v1.20.1 \
+      go.opentelemetry.io/otel@v1.46.0 go.opentelemetry.io/otel/sdk/log@v0.22.0 \
+      go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc@v0.22.0 \
+      go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.22.0 \
+      go.opentelemetry.io/otel/exporters/stdout/stdoutlog@v0.22.0 \
+      go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.46.0 \
+      go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.46.0 \
       golang.org/x/crypto@v0.57.0 golang.org/x/net@v0.60.0 \
       golang.org/x/text@v0.42.0 google.golang.org/grpc@v1.83.2 \
  && go mod tidy \
@@ -46,7 +45,7 @@ COPY --from=caddy-source /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-ce
 COPY --from=caddy-source /out/caddy /usr/bin/caddy
 COPY --from=caddy-source /out/percher-healthcheck /usr/bin/percher-healthcheck
 COPY Caddyfile /etc/caddy/Caddyfile
-COPY --from=build /app/dist /srv
+COPY --from=static-content /percher-static-content /srv
 LABEL dev.percher.health-client="static-http-v1"
 # HOME points at the writable tmpfs so non-root Caddy can persist its
 # XDG state (storage-clean lock, config autosave) under Percher's

package/dist/templates/capsule/Dockerfile

@@ -21,23 +21,18 @@ RUN bun install && bun run build
 # Build pinned Caddy source with refreshed security modules. The scratch
 # runtime carries no shell, package manager, or file capabilities and listens
 # on the unprivileged port :8080.
-FROM golang:1.26.9-alpine3.23@sha256:6750308561953d451210ed1a8086d36c8c8bdcbf672d38d9d0d424b8a7a0216c AS caddy-source
-ADD --checksum=sha256:78e660d838e45c0b8c89338b325946238f153641aa9925df9ef2ad5e8eced31b \
-  https://github.com/caddyserver/caddy/commit/b2693fb63a30e6d7be0972c3645e9a2c0a500e93.patch /tmp/caddy-cel-go.patch
-RUN go mod download github.com/caddyserver/caddy/v2@v2.11.4 \
- && cp -R /go/pkg/mod/github.com/caddyserver/caddy/v2@v2.11.4 /src \
+FROM golang:1.26.10-alpine3.23@sha256:0525c952defebc693cdaf62cdf43afa32be5a7f377e99260642ea19c240c708e AS caddy-source
+RUN go mod download github.com/caddyserver/caddy/v2@v2.11.7 \
+ && cp -R /go/pkg/mod/github.com/caddyserver/caddy/v2@v2.11.7 /src \
  && chmod -R u+w /src
 WORKDIR /src
-RUN apk add --no-cache patch \
- && patch -p1 < /tmp/caddy-cel-go.patch \
- && go get github.com/go-chi/chi/v5@v5.3.0 github.com/google/cel-go@v0.29.2 \
-      github.com/klauspost/compress@v1.18.7 go.opentelemetry.io/otel@v1.45.0 \
-      go.opentelemetry.io/otel/sdk/log@v0.21.0 \
-      go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc@v0.21.0 \
-      go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.21.0 \
-      go.opentelemetry.io/otel/exporters/stdout/stdoutlog@v0.21.0 \
-      go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.45.0 \
-      go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.45.0 \
+RUN go get github.com/go-chi/chi/v5@v5.3.2 github.com/klauspost/compress@v1.20.1 \
+      go.opentelemetry.io/otel@v1.46.0 go.opentelemetry.io/otel/sdk/log@v0.22.0 \
+      go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc@v0.22.0 \
+      go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.22.0 \
+      go.opentelemetry.io/otel/exporters/stdout/stdoutlog@v0.22.0 \
+      go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.46.0 \
+      go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.46.0 \
       golang.org/x/crypto@v0.57.0 golang.org/x/net@v0.60.0 \
       golang.org/x/text@v0.42.0 google.golang.org/grpc@v1.83.2 \
  && go mod tidy \

package/dist/templates/eleventy/Caddyfile

@@ -2,5 +2,9 @@
 	bind 0.0.0.0
 	root * /srv
 	encode gzip zstd
-	file_server
+	route {
+		@percher_platform path_regexp percher_platform (?i)(?:^/+(?:percher[.]toml|[.]percherignore|pb|Dockerfile|Caddyfile|[.]git|[.]env|[.]env[.][^/]*|[.]percher-[^/]*)(?:/|$)|(?:^|/)(?:[.]npmrc|[.]pypirc|[.]netrc|_netrc|[.]git-credentials|[.]htpasswd|[.]pgpass|[.]my[.]cnf|[.]dev[.]vars|id_rsa|id_dsa|id_ecdsa|id_ed25519|credentials[.]json|secrets[.]toml|wp-config[.]php|[.]env|[.]ssh|[.]aws|[.]gnupg|[.]docker/config[.]json|[.]kube/config|[.]env[.][^/]*|[.]dev[.]vars[.][^/]*|[^/]*[.]pem|[^/]*[.]key|[^/]*[.]p12|[^/]*[.]pfx|[^/]*[.]jks|[^/]*[.]keystore)(?:/|$))
+		respond @percher_platform 404
+		file_server
+	}
 }

package/dist/templates/eleventy/Dockerfile

@@ -10,27 +10,26 @@ WORKDIR /app
 COPY . .
 RUN bun install && bun run build
 
+# Preserve build inputs for deployment; only this filtered copy reaches /srv.
+FROM build AS static-content
+RUN bun -e 'const fs=require("node:fs"),path=require("node:path");const root=fs.realpathSync(process.argv[1]),dir=fs.realpathSync(process.argv[2]),dest=process.argv[3];const deny=new RegExp("(?:^/+(?:percher[.]toml|[.]percherignore|pb|Dockerfile|Caddyfile|[.]git|[.]env|[.]env[.][^/]*|[.]percher-[^/]*)(?:/|$)|(?:^|/)(?:[.]npmrc|[.]pypirc|[.]netrc|_netrc|[.]git-credentials|[.]htpasswd|[.]pgpass|[.]my[.]cnf|[.]dev[.]vars|id_rsa|id_dsa|id_ecdsa|id_ed25519|credentials[.]json|secrets[.]toml|wp-config[.]php|[.]env|[.]ssh|[.]aws|[.]gnupg|[.]docker/config[.]json|[.]kube/config|[.]env[.][^/]*|[.]dev[.]vars[.][^/]*|[^/]*[.]pem|[^/]*[.]key|[^/]*[.]p12|[^/]*[.]pfx|[^/]*[.]jks|[^/]*[.]keystore)(?:/|$))","i");const reserved=p=>deny.test("/"+p.split(path.sep).join("/"));if((dir!==root&&!dir.startsWith(root+path.sep))||reserved(path.relative(root,dir)))throw Error("Static output escapes the project or selects platform content");if(fs.existsSync(dest))throw Error("Reserved static staging directory already exists");fs.cpSync(dir,dest,{recursive:true,filter:p=>{if(reserved(path.relative(dir,p))||reserved(path.relative(root,p)))return false;if(fs.lstatSync(p).isSymbolicLink())throw Error("Static content cannot contain symlinks");return true}})' '/app' '/app/_site' '/percher-static-content'
+
 # --- Serve stage: minimal Caddy image --------------------------------
 # Build pinned Caddy source with refreshed security modules. The scratch
 # runtime carries no shell, package manager, or file capabilities and listens
 # on the unprivileged port :8080.
-FROM golang:1.26.9-alpine3.23@sha256:6750308561953d451210ed1a8086d36c8c8bdcbf672d38d9d0d424b8a7a0216c AS caddy-source
-ADD --checksum=sha256:78e660d838e45c0b8c89338b325946238f153641aa9925df9ef2ad5e8eced31b \
-  https://github.com/caddyserver/caddy/commit/b2693fb63a30e6d7be0972c3645e9a2c0a500e93.patch /tmp/caddy-cel-go.patch
-RUN go mod download github.com/caddyserver/caddy/v2@v2.11.4 \
- && cp -R /go/pkg/mod/github.com/caddyserver/caddy/v2@v2.11.4 /src \
+FROM golang:1.26.10-alpine3.23@sha256:0525c952defebc693cdaf62cdf43afa32be5a7f377e99260642ea19c240c708e AS caddy-source
+RUN go mod download github.com/caddyserver/caddy/v2@v2.11.7 \
+ && cp -R /go/pkg/mod/github.com/caddyserver/caddy/v2@v2.11.7 /src \
  && chmod -R u+w /src
 WORKDIR /src
-RUN apk add --no-cache patch \
- && patch -p1 < /tmp/caddy-cel-go.patch \
- && go get github.com/go-chi/chi/v5@v5.3.0 github.com/google/cel-go@v0.29.2 \
-      github.com/klauspost/compress@v1.18.7 go.opentelemetry.io/otel@v1.45.0 \
-      go.opentelemetry.io/otel/sdk/log@v0.21.0 \
-      go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc@v0.21.0 \
-      go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.21.0 \
-      go.opentelemetry.io/otel/exporters/stdout/stdoutlog@v0.21.0 \
-      go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.45.0 \
-      go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.45.0 \
+RUN go get github.com/go-chi/chi/v5@v5.3.2 github.com/klauspost/compress@v1.20.1 \
+      go.opentelemetry.io/otel@v1.46.0 go.opentelemetry.io/otel/sdk/log@v0.22.0 \
+      go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc@v0.22.0 \
+      go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.22.0 \
+      go.opentelemetry.io/otel/exporters/stdout/stdoutlog@v0.22.0 \
+      go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.46.0 \
+      go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.46.0 \
       golang.org/x/crypto@v0.57.0 golang.org/x/net@v0.60.0 \
       golang.org/x/text@v0.42.0 google.golang.org/grpc@v1.83.2 \
  && go mod tidy \
@@ -46,7 +45,7 @@ COPY --from=caddy-source /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-ce
 COPY --from=caddy-source /out/caddy /usr/bin/caddy
 COPY --from=caddy-source /out/percher-healthcheck /usr/bin/percher-healthcheck
 COPY Caddyfile /etc/caddy/Caddyfile
-COPY --from=build /app/_site /srv
+COPY --from=static-content /percher-static-content /srv
 LABEL dev.percher.health-client="static-http-v1"
 # HOME points at the writable tmpfs so non-root Caddy can persist its
 # XDG state (storage-clean lock, config autosave) under Percher's

package/dist/templates/hugo/Dockerfile

@@ -12,23 +12,18 @@ RUN hugo --minify
 # Build pinned Caddy source with refreshed security modules. The scratch
 # runtime carries no shell, package manager, or file capabilities and listens
 # on the unprivileged port :8080.
-FROM golang:1.26.9-alpine3.23@sha256:6750308561953d451210ed1a8086d36c8c8bdcbf672d38d9d0d424b8a7a0216c AS caddy-source
-ADD --checksum=sha256:78e660d838e45c0b8c89338b325946238f153641aa9925df9ef2ad5e8eced31b \
-  https://github.com/caddyserver/caddy/commit/b2693fb63a30e6d7be0972c3645e9a2c0a500e93.patch /tmp/caddy-cel-go.patch
-RUN go mod download github.com/caddyserver/caddy/v2@v2.11.4 \
- && cp -R /go/pkg/mod/github.com/caddyserver/caddy/v2@v2.11.4 /src \
+FROM golang:1.26.10-alpine3.23@sha256:0525c952defebc693cdaf62cdf43afa32be5a7f377e99260642ea19c240c708e AS caddy-source
+RUN go mod download github.com/caddyserver/caddy/v2@v2.11.7 \
+ && cp -R /go/pkg/mod/github.com/caddyserver/caddy/v2@v2.11.7 /src \
  && chmod -R u+w /src
 WORKDIR /src
-RUN apk add --no-cache patch \
- && patch -p1 < /tmp/caddy-cel-go.patch \
- && go get github.com/go-chi/chi/v5@v5.3.0 github.com/google/cel-go@v0.29.2 \
-      github.com/klauspost/compress@v1.18.7 go.opentelemetry.io/otel@v1.45.0 \
-      go.opentelemetry.io/otel/sdk/log@v0.21.0 \
-      go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc@v0.21.0 \
-      go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.21.0 \
-      go.opentelemetry.io/otel/exporters/stdout/stdoutlog@v0.21.0 \
-      go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.45.0 \
-      go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.45.0 \
+RUN go get github.com/go-chi/chi/v5@v5.3.2 github.com/klauspost/compress@v1.20.1 \
+      go.opentelemetry.io/otel@v1.46.0 go.opentelemetry.io/otel/sdk/log@v0.22.0 \
+      go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc@v0.22.0 \
+      go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.22.0 \
+      go.opentelemetry.io/otel/exporters/stdout/stdoutlog@v0.22.0 \
+      go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.46.0 \
+      go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.46.0 \
       golang.org/x/crypto@v0.57.0 golang.org/x/net@v0.60.0 \
       golang.org/x/text@v0.42.0 google.golang.org/grpc@v1.83.2 \
  && go mod tidy \