ysk-server-core 1.0.0

package/dist/hosting/runtime.js

@@ -0,0 +1,709 @@
+/**
+ * Multi-version hosting runtime selection contracts.
+ * Process apps: node | python | go | rust | java | kotlin | bun
+ * PHP-FPM: php · Static files: static
+ */
+import { existsSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { ErrorCodes, YskError, tl } from 'ysk-server-shared';
+/**
+ * @deprecated NOT a source of truth for installable versions.
+ * Installable pins come from version-discovery (upstream APIs).
+ * Kept only so older tests/imports compile; values are empty.
+ */
+export const NODE_SUPPORTED = [];
+export const PHP_SUPPORTED = [];
+export const PYTHON_SUPPORTED = [];
+export const GO_SUPPORTED = [];
+/** @deprecated removed — use go.dev live list via pickLatestGoDownloadVersion(available) */
+export const GO_LAST_KNOWN_PATCH = {};
+export const RUST_SUPPORTED = [];
+export const JAVA_SUPPORTED = [];
+export const KOTLIN_SUPPORTED = [];
+export const BUN_SUPPORTED = [];
+const PROCESS_RUNTIMES = new Set(['node', 'python', 'go', 'rust', 'java', 'kotlin', 'bun']);
+export function isProcessRuntime(runtime) {
+    return PROCESS_RUNTIMES.has(runtime);
+}
+export function isHostingRuntime(value) {
+    return (value === 'node' ||
+        value === 'php' ||
+        value === 'static' ||
+        value === 'python' ||
+        value === 'go' ||
+        value === 'rust' ||
+        value === 'java' ||
+        value === 'kotlin' ||
+        value === 'bun');
+}
+/** Default version string per runtime when client omits runtimeVersion. */
+export function defaultRuntimeVersion(runtime) {
+    if (runtime === 'php')
+        return '8.2';
+    if (runtime === 'node')
+        return '20';
+    if (runtime === 'python')
+        return '3.12';
+    if (runtime === 'go')
+        return '1.22';
+    if (runtime === 'rust')
+        return 'stable';
+    if (runtime === 'java')
+        return '21';
+    if (runtime === 'kotlin')
+        return '2.1.0';
+    if (runtime === 'bun')
+        return 'latest';
+    return '';
+}
+/**
+ * Normalize / repair stored runtimeVersion.
+ * Accepts any shape-valid version from discovery — does NOT clamp to a hardcoded list.
+ * Fixes historical bug: PHP projects incorrectly defaulted to Node "20".
+ */
+export function normalizeRuntimeVersion(runtime, version) {
+    const raw = (version ?? '').trim();
+    if (runtime === 'static')
+        return '';
+    if (runtime === 'php') {
+        // Node majors wrongly stored as PHP
+        if (!raw || raw === '18' || raw === '20' || raw === '22') {
+            return defaultRuntimeVersion('php');
+        }
+        const normalized = raw.startsWith('php') ? raw.slice(3).replace(/^\s+/, '') : raw;
+        if (/^\d+$/.test(normalized) && !normalized.includes('.')) {
+            return defaultRuntimeVersion('php');
+        }
+        const minor = normalized.match(/^(\d+\.\d+)/)?.[1];
+        return minor ?? defaultRuntimeVersion('php');
+    }
+    if (runtime === 'node') {
+        if (!raw)
+            return defaultRuntimeVersion('node');
+        const major = raw.replace(/^v/, '').split('.')[0];
+        return /^\d+$/.test(major) ? major : defaultRuntimeVersion('node');
+    }
+    if (runtime === 'python') {
+        if (!raw)
+            return defaultRuntimeVersion('python');
+        const m = raw.replace(/^python/, '').trim();
+        const minor = m.match(/^(\d+\.\d+)/)?.[1];
+        return minor ?? defaultRuntimeVersion('python');
+    }
+    if (runtime === 'go') {
+        if (!raw)
+            return defaultRuntimeVersion('go');
+        const m = raw.replace(/^go/, '').trim();
+        const full = m.match(/^(\d+\.\d+\.\d+)/)?.[1];
+        if (full)
+            return full;
+        const minor = m.match(/^(\d+\.\d+)/)?.[1];
+        return minor ?? defaultRuntimeVersion('go');
+    }
+    if (runtime === 'rust') {
+        if (!raw)
+            return defaultRuntimeVersion('rust');
+        if (raw === 'stable' || raw === 'nightly' || raw === 'beta')
+            return raw;
+        const minor = raw.match(/^(\d+\.\d+(\.\d+)?)/)?.[1];
+        return minor ?? defaultRuntimeVersion('rust');
+    }
+    if (runtime === 'java') {
+        if (!raw)
+            return defaultRuntimeVersion('java');
+        const major = raw.replace(/^jdk-?|^java-?/i, '').split('.')[0];
+        return /^\d+$/.test(major) ? major : defaultRuntimeVersion('java');
+    }
+    if (runtime === 'kotlin') {
+        if (!raw || raw === 'stable' || raw === 'latest')
+            return defaultRuntimeVersion('kotlin');
+        const v = raw.replace(/^v/i, '');
+        return /^\d+\.\d+/.test(v) ? v : defaultRuntimeVersion('kotlin');
+    }
+    if (runtime === 'bun') {
+        if (!raw)
+            return defaultRuntimeVersion('bun');
+        if (raw === 'latest')
+            return 'latest';
+        return /^\d+\.\d+/.test(raw) ? raw : defaultRuntimeVersion('bun');
+    }
+    return raw;
+}
+/**
+ * Shape-only validation — versions come from version-discovery / user choice,
+ * NOT a hardcoded allow-list of release numbers.
+ */
+function assertVersionShape(kind, version, ok) {
+    if (ok)
+        return;
+    throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.t0254', {
+        v0: version,
+        v1: `${kind}: invalid version shape (discover via software/versions API)`,
+    }), { httpStatus: 400 });
+}
+export function selectNodeRuntime(version) {
+    const major = version.replace(/^v/, '').split('.')[0];
+    assertVersionShape('node', version, /^\d+$/.test(major) && Number(major) >= 12);
+    return {
+        kind: 'node',
+        version: major,
+        binaryPath: `/usr/local/ysk/node/${major}/bin/node`,
+        manager: 'fnm',
+    };
+}
+export function selectPhpRuntime(version) {
+    const normalized = (version.startsWith('php') ? version.slice(3) : version).trim();
+    const minor = normalized.match(/^(\d+\.\d+)/)?.[1] ?? normalized;
+    assertVersionShape('php', version, /^\d+\.\d+$/.test(minor));
+    return {
+        kind: 'php',
+        version: minor,
+        binaryPath: `/usr/bin/php${minor}`,
+        manager: 'sury-php',
+    };
+}
+export function selectPythonRuntime(version) {
+    const raw = (version ?? '').replace(/^python/, '').trim();
+    const minor = raw.match(/^(\d+\.\d+)/)?.[1] ?? raw;
+    assertVersionShape('python', version, /^\d+\.\d+$/.test(minor));
+    return {
+        kind: 'python',
+        version: minor,
+        binaryPath: `/usr/bin/python${minor}`,
+        manager: 'deadsnakes',
+    };
+}
+export function selectGoRuntime(version) {
+    const raw = (version ?? '').replace(/^go/, '').trim();
+    // Accept full patch (1.26.5) or minor (1.26). Panel + managed path SSOT is always minor.
+    const minor = raw.match(/^(\d+\.\d+)/)?.[1] ?? raw;
+    assertVersionShape('go', version, /^\d+\.\d+(\.\d+)?$/.test(raw));
+    return {
+        kind: 'go',
+        version: minor,
+        binaryPath: `/usr/local/ysk/go/${minor}/bin/go`,
+        manager: 'go-official',
+    };
+}
+/**
+ * go.dev/dl only ships full patch tarballs (go1.21.13.linux-amd64.tar.gz).
+ * Resolve minor "1.21" to newest matching patch from **live** go.dev version list.
+ * When `available` is empty, returns full version if already x.y.z, else minor+".0"
+ * (caller should re-fetch go.dev — no hardcoded patch table).
+ */
+export function pickLatestGoDownloadVersion(panelVersion, available) {
+    const raw = panelVersion.replace(/^go/i, '').trim();
+    // Already full x.y.z
+    if (/^\d+\.\d+\.\d+$/.test(raw))
+        return raw;
+    const minor = raw.match(/^(\d+\.\d+)/)?.[1] ?? raw;
+    const patches = [];
+    for (const entry of available) {
+        const v = String(entry).replace(/^go/i, '').trim();
+        if (v === minor) {
+            patches.push(`${minor}.0`);
+            continue;
+        }
+        if (v.startsWith(`${minor}.`) && /^\d+\.\d+\.\d+/.test(v)) {
+            const full = v.match(/^(\d+\.\d+\.\d+)/)?.[1];
+            if (full)
+                patches.push(full);
+        }
+    }
+    if (patches.length === 0) {
+        // No hardcoded fallback table — prefer explicit full version from discovery
+        return /^\d+\.\d+\.\d+$/.test(raw) ? raw : `${minor}.0`;
+    }
+    const rank = (s) => s.split('.').map((n) => parseInt(n, 10) || 0);
+    patches.sort((a, b) => {
+        const aa = rank(a);
+        const bb = rank(b);
+        for (let i = 0; i < 3; i++) {
+            const d = (aa[i] ?? 0) - (bb[i] ?? 0);
+            if (d !== 0)
+                return d;
+        }
+        return 0;
+    });
+    return patches[patches.length - 1];
+}
+/**
+ * @deprecated No hardcoded patch map — kept empty for older install scripts.
+ * Prefer live go.dev list in runtime-probe.
+ */
+export function goLastKnownPatchShellCase() {
+    return '    *) echo "" ;;';
+}
+export function selectRustRuntime(version) {
+    const raw = (version ?? '').trim() || 'stable';
+    const ok = raw === 'stable' ||
+        raw === 'beta' ||
+        raw === 'nightly' ||
+        /^\d+\.\d+(\.\d+)?$/.test(raw);
+    assertVersionShape('rust', version, ok);
+    return {
+        kind: 'rust',
+        version: raw,
+        binaryPath: '/usr/local/ysk/rust/cargo/bin/cargo',
+        manager: 'rustup',
+    };
+}
+export function selectJavaRuntime(version) {
+    const major = (version ?? '').replace(/^jdk-?/i, '').split('.')[0];
+    assertVersionShape('java', version, /^\d+$/.test(major) && Number(major) >= 8);
+    return {
+        kind: 'java',
+        version: major,
+        binaryPath: `/usr/lib/jvm/java-${major}-openjdk-amd64/bin/java`,
+        manager: 'openjdk-apt',
+    };
+}
+export function selectKotlinRuntime(version) {
+    const v = (version ?? '').replace(/^v/i, '').trim();
+    // Allow stable (2.4.10) and prerelease tags from GitHub (2.4.20-Beta2, 2.4.10-RC)
+    assertVersionShape('kotlin', version, /^\d+\.\d+(\.\d+)?(-[\w.]+)?$/.test(v));
+    return {
+        kind: 'kotlin',
+        version: v,
+        binaryPath: `/usr/local/ysk/kotlin/bin/kotlinc`,
+        manager: 'kotlin-official',
+    };
+}
+export function selectBunRuntime(version) {
+    const raw = (version ?? '').trim() || 'latest';
+    const ok = raw === 'latest' || /^\d+\.\d+/.test(raw);
+    assertVersionShape('bun', version, ok);
+    return {
+        kind: 'bun',
+        version: raw,
+        binaryPath: '/usr/local/ysk/bun/bin/bun',
+        manager: 'bun-official',
+    };
+}
+export function selectRuntime(kind, version) {
+    if (kind === 'node')
+        return selectNodeRuntime(version);
+    if (kind === 'php')
+        return selectPhpRuntime(version);
+    if (kind === 'python')
+        return selectPythonRuntime(version);
+    if (kind === 'go')
+        return selectGoRuntime(version);
+    if (kind === 'rust')
+        return selectRustRuntime(version);
+    if (kind === 'java')
+        return selectJavaRuntime(version);
+    if (kind === 'kotlin')
+        return selectKotlinRuntime(version);
+    if (kind === 'bun')
+        return selectBunRuntime(version);
+    throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.t0258', { v0: (kind) }), { httpStatus: 400 });
+}
+/**
+ * Generate PM2 / systemd unit skeleton for a Node project.
+ */
+export function renderNodeProcessUnit(opts) {
+    return renderProcessUnit({
+        projectName: opts.projectName,
+        linuxUser: opts.linuxUser,
+        appDir: opts.appDir,
+        execStart: `${shellQuoteUnitArg(opts.nodeBinary)} ${shellQuoteUnitArg(opts.entry)}`,
+        port: opts.port,
+        env: {
+            NODE_ENV: 'production',
+            PORT: String(opts.port),
+            ...(opts.env ?? {}),
+        },
+        memoryMax: opts.memoryMax,
+        cpuQuotaPercent: opts.cpuQuotaPercent,
+        limitNOFILE: opts.limitNOFILE,
+    });
+}
+/** Quote ExecStart tokens that contain spaces/meta (systemd argv split). */
+export function shellQuoteUnitArg(s) {
+    const v = String(s ?? '');
+    if (!v)
+        return "''";
+    if (/^[A-Za-z0-9_./:=+-]+$/.test(v))
+        return v;
+    return `'${v.replace(/'/g, `'\\''`)}'`;
+}
+/** Generic process unit for node/python/go/rust — runs as project Linux user. */
+export function renderProcessUnit(opts) {
+    const limits = [];
+    if (opts.memoryMax) {
+        limits.push(`MemoryMax=${opts.memoryMax}`);
+        limits.push(`MemoryHigh=${opts.memoryMax}`);
+    }
+    if (opts.cpuQuotaPercent != null && opts.cpuQuotaPercent > 0) {
+        limits.push(`CPUQuota=${Math.min(10000, Math.floor(opts.cpuQuotaPercent))}%`);
+    }
+    if (opts.limitNOFILE != null && opts.limitNOFILE > 0) {
+        limits.push(`LimitNOFILE=${opts.limitNOFILE}`);
+    }
+    if (opts.tasksMax != null && opts.tasksMax > 0) {
+        limits.push(`TasksMax=${Math.floor(opts.tasksMax)}`);
+    }
+    const home = opts.homeDir ??
+        (opts.appDir.endsWith('/app') ? opts.appDir.slice(0, -4) : opts.appDir);
+    const harden = opts.harden !== false;
+    const hardenLines = harden
+        ? [
+            'NoNewPrivileges=yes',
+            'PrivateTmp=yes',
+            'ProtectSystem=strict',
+            // WorkingDirectory is under home; allow RW only there
+            `ReadWritePaths=${home}`,
+            // ProtectHome would block /home — we pin RW paths instead
+            'ProtectKernelTunables=yes',
+            'ProtectControlGroups=yes',
+            'RestrictSUIDSGID=yes',
+        ].join('\n') + '\n'
+        : '';
+    const limitBlock = limits.length ? limits.join('\n') + '\n' : '';
+    const envLines = Object.entries({
+        PORT: String(opts.port),
+        ...opts.env,
+    })
+        .map(([k, v]) => `Environment=${k}=${v}`)
+        .join('\n');
+    return `[Unit]
+Description=YSK Server project ${opts.projectName}
+After=network.target
+
+[Service]
+Type=simple
+User=${opts.linuxUser}
+Group=${opts.linuxUser}
+WorkingDirectory=${opts.appDir}
+${envLines}
+ExecStart=${opts.execStart}
+Restart=on-failure
+RestartSec=5
+# Cap crash loops (wrong binary / 203/EXEC) — avoid hundreds of restarts
+StartLimitIntervalSec=120
+StartLimitBurst=5
+${hardenLines}${limitBlock}
+[Install]
+WantedBy=multi-user.target
+`;
+}
+/**
+ * Shell env + cargo build for project isolation.
+ * Uses YSK managed CARGO_HOME/RUSTUP_HOME and RUSTUP_TOOLCHAIN so cargo never
+ * requires a per-user `rustup default` (project users have empty ~/.rustup).
+ *
+ * IMPORTANT:
+ * - Must NOT join discovery with bare `&&` after a successful `command -v cargo`
+ *   (that short-circuits the rest of the chain).
+ * - Must NOT `.join('; ')` across `then` / `elif` / `fi` lines — that becomes
+ *   `then;` which is a bash syntax error (create/goLive failed with
+ *   "syntax error near unexpected token `;'").
+ */
+export function rustCargoBuildShell(version) {
+    const raw = (version ?? 'stable').trim() || 'stable';
+    // rustup channel or X.Y / X.Y.Z
+    const toolchain = raw === 'stable' || raw === 'beta' || raw === 'nightly' || /^\d+\.\d+(\.\d+)?$/.test(raw)
+        ? raw
+        : 'stable';
+    // Safe for bash -lc (shape-validated)
+    const tc = toolchain.replace(/[^a-zA-Z0-9._+-]/g, '') || 'stable';
+    // Prefer managed cargo first (readable by all project users), then PATH.
+    // Newline-joined script so if/fi blocks stay valid under `bash -c`.
+    return `
+export CARGO_HOME="\${CARGO_HOME:-/usr/local/ysk/rust/cargo}"
+export RUSTUP_HOME="\${RUSTUP_HOME:-/usr/local/ysk/rust/rustup}"
+export PATH="/usr/local/ysk/rust/cargo/bin:/usr/local/ysk/rust/bin:\$HOME/.cargo/bin:\$PATH"
+export RUSTUP_TOOLCHAIN="${tc}"
+CARGO_BIN=""
+if [ -x /usr/local/ysk/rust/cargo/bin/cargo ]; then
+  CARGO_BIN=/usr/local/ysk/rust/cargo/bin/cargo
+elif [ -x /usr/local/ysk/rust/bin/cargo ]; then
+  CARGO_BIN=/usr/local/ysk/rust/bin/cargo
+elif command -v cargo >/dev/null 2>&1; then
+  CARGO_BIN="\$(command -v cargo)"
+fi
+if [ -z "\$CARGO_BIN" ]; then
+  echo "cargo not found — install Rust runtime in panel (Runtimes → Rust)" >&2
+  exit 127
+fi
+echo "ysk rust build: cargo=\$CARGO_BIN toolchain=${tc}" >&2
+# Explicit +toolchain so rustup never needs \`rustup default\`.
+# If pin missing (panel shows rustc patch), fall back to +stable once.
+set +e
+"\$CARGO_BIN" "+${tc}" build --release
+_ysk_ec=\$?
+if [ "\$_ysk_ec" -ne 0 ] && [ "${tc}" != "stable" ]; then
+  echo "ysk rust: toolchain ${tc} exit=\$_ysk_ec, retry +stable" >&2
+  export RUSTUP_TOOLCHAIN=stable
+  "\$CARGO_BIN" +stable build --release
+  _ysk_ec=\$?
+fi
+exit \$_ysk_ec
+`.trim();
+}
+/**
+ * Default ExecStart / build hints per process runtime.
+ */
+export function defaultProcessCommands(runtime, opts) {
+    if (runtime === 'python') {
+        // Django WSGI: "mysite.wsgi:application" → gunicorn
+        // FastAPI/ASGI: "main:app" → uvicorn
+        // Plain script: app.py / main.py
+        const entry = opts.entry ?? 'main:app';
+        // Prefer project pin pythonX.Y (deadsnakes multi-version); fall back to python3
+        const pyMinor = (opts.version ?? '').replace(/^python/, '').match(/^(\d+\.\d+)/)?.[1];
+        const pyBin = pyMinor ? `python${pyMinor}` : 'python3';
+        // Honest: if requirements.txt exists it must install; missing file is skip
+        // Create venv with the pinned interpreter so site-packages match runtimeVersion
+        const pyBuild = `${pyBin} -m venv venv && ./venv/bin/pip install -U pip && if [ -f requirements.txt ]; then ./venv/bin/pip install -r requirements.txt; else echo "no requirements.txt — skip deps"; fi`;
+        const isWsgi = /\.wsgi:application$/.test(entry) ||
+            entry.endsWith('.wsgi:app') ||
+            entry.startsWith('gunicorn:');
+        const wsgiTarget = entry.startsWith('gunicorn:') ? entry.slice('gunicorn:'.length) : entry;
+        // Prefer venv → pinned binary → python3
+        const pyFallback = `elif command -v ${pyBin} >/dev/null 2>&1; then exec ${pyBin}`;
+        if (isWsgi) {
+            return {
+                build: pyBuild,
+                execStart: `/bin/bash -lc 'cd "$PWD" && if [ -x venv/bin/gunicorn ]; then exec venv/bin/gunicorn ${wsgiTarget} --bind 127.0.0.1:"\${PORT:-3000}" --workers 2; elif [ -x venv/bin/python ]; then exec venv/bin/python -m gunicorn ${wsgiTarget} --bind 127.0.0.1:"\${PORT:-3000}"; ${pyFallback} -m gunicorn ${wsgiTarget} --bind 127.0.0.1:"\${PORT:-3000}"; else exec python3 -m gunicorn ${wsgiTarget} --bind 127.0.0.1:"\${PORT:-3000}"; fi'`,
+                entry: wsgiTarget,
+            };
+        }
+        const isAsgi = entry.includes(':') && !entry.endsWith('.py');
+        if (isAsgi) {
+            return {
+                build: pyBuild,
+                execStart: `/bin/bash -lc 'cd "$PWD" && if [ -x venv/bin/uvicorn ]; then exec venv/bin/uvicorn ${entry} --host 127.0.0.1 --port "\${PORT:-3000}"; elif [ -x venv/bin/python ]; then exec venv/bin/python -m uvicorn ${entry} --host 127.0.0.1 --port "\${PORT:-3000}"; ${pyFallback} -m uvicorn ${entry} --host 127.0.0.1 --port "\${PORT:-3000}"; else exec python3 -m uvicorn ${entry} --host 127.0.0.1 --port "\${PORT:-3000}"; fi'`,
+                entry,
+            };
+        }
+        return {
+            build: pyBuild,
+            execStart: `/bin/bash -lc 'cd "$PWD" && if [ -x venv/bin/python ]; then exec venv/bin/python ${entry}; ${pyFallback} ${entry}; else exec python3 ${entry}; fi'`,
+            entry,
+        };
+    }
+    if (runtime === 'go') {
+        const entry = opts.entry ?? './app';
+        return {
+            build: 'go build -o app .',
+            execStart: entry.startsWith('./') || entry.startsWith('/') ? entry : `./${entry}`,
+            entry,
+        };
+    }
+    if (runtime === 'rust') {
+        const bin = opts.cargoName ?? 'app';
+        const entry = opts.entry ?? `./target/release/${bin}`;
+        // Managed rustup + explicit toolchain — never depend on per-user `rustup default`
+        // (project users have empty $HOME/.rustup → "could not choose a version of cargo").
+        return {
+            build: rustCargoBuildShell(opts.version),
+            execStart: entry,
+            entry,
+        };
+    }
+    if (runtime === 'java' || runtime === 'kotlin') {
+        // JVM apps: single-file hello (HelloServer.java/.kt), fat jar, or Maven/Gradle
+        const entry = opts.entry ?? 'app.jar';
+        const entryBase = entry.replace(/^\.\//, '');
+        const ver = (opts.version ?? '').replace(/^jdk-?/i, '').split('.')[0] || '21';
+        const javaHome = `/usr/lib/jvm/java-${ver}-openjdk-amd64`;
+        const javaBin = `[ -x ${javaHome}/bin/java ] && echo ${javaHome}/bin/java || command -v java`;
+        const javacBin = `[ -x ${javaHome}/bin/javac ] && echo ${javaHome}/bin/javac || command -v javac`;
+        // Plain Java source (YSK hello template)
+        if (entryBase.endsWith('.java')) {
+            const cls = entryBase.replace(/\.java$/i, '').replace(/^.*\//, '');
+            const build = `JAVA_BIN=$(${javaBin}); JAVAC_BIN=$(${javacBin}); ` +
+                `if [ -z "$JAVAC_BIN" ]; then echo "javac not found — install Java ${ver} runtime" >&2; exit 127; fi; ` +
+                `echo "ysk java build: javac=$JAVAC_BIN class=${cls}" >&2; ` +
+                `"$JAVAC_BIN" -encoding UTF-8 ${entryBase}`;
+            return {
+                build,
+                execStart: `/bin/bash -lc 'JAVA_BIN=$(${javaBin}); export SERVER_PORT="\${PORT:-3000}"; exec "$JAVA_BIN" -cp . ${cls}'`,
+                entry: entryBase,
+            };
+        }
+        // Kotlin single-file hello
+        if (entryBase.endsWith('.kt')) {
+            const jarOut = 'hello-server.jar';
+            const build = `KOTLINC=$(command -v kotlinc || true); ` +
+                `if [ -z "$KOTLINC" ] && [ -x /usr/local/ysk/kotlin/bin/kotlinc ]; then KOTLINC=/usr/local/ysk/kotlin/bin/kotlinc; fi; ` +
+                `if [ -z "$KOTLINC" ]; then echo "kotlinc not found — install Kotlin runtime" >&2; exit 127; fi; ` +
+                `echo "ysk kotlin build: kotlinc=$KOTLINC entry=${entryBase}" >&2; ` +
+                `"$KOTLINC" ${entryBase} -include-runtime -d ${jarOut}`;
+            return {
+                build,
+                execStart: `/bin/bash -lc 'JAVA_BIN=$(${javaBin}); export SERVER_PORT="\${PORT:-3000}"; exec "$JAVA_BIN" -jar ./${jarOut}'`,
+                entry: `./${jarOut}`,
+            };
+        }
+        // Prefer fat jar; build via Maven wrapper / Gradle when present
+        const build = 'if [ -x ./mvnw ]; then ./mvnw -q -DskipTests package; ' +
+            'elif [ -x ./gradlew ]; then ./gradlew -q bootJar || ./gradlew -q jar; ' +
+            'elif [ -f pom.xml ]; then mvn -q -DskipTests package; ' +
+            'elif [ -f build.gradle ] || [ -f build.gradle.kts ]; then gradle -q bootJar || gradle -q jar; ' +
+            'elif [ -f HelloServer.java ]; then ' +
+            `JAVA_BIN=$(${javaBin}); JAVAC_BIN=$(${javacBin}); ` +
+            '"$JAVAC_BIN" -encoding UTF-8 HelloServer.java; ' +
+            'elif [ -f HelloServer.kt ]; then ' +
+            'KOTLINC=$(command -v kotlinc || true); ' +
+            '[ -z "$KOTLINC" ] && [ -x /usr/local/ysk/kotlin/bin/kotlinc ] && KOTLINC=/usr/local/ysk/kotlin/bin/kotlinc; ' +
+            '"$KOTLINC" HelloServer.kt -include-runtime -d hello-server.jar; ' +
+            'else echo "no Maven/Gradle/HelloServer — expecting existing jar" >&2; fi';
+        const jar = entry.startsWith('./') || entry.startsWith('/') ? entry : `./${entry}`;
+        // If still on default app.jar but HelloServer was compiled, run class instead
+        const execStart = `/bin/bash -lc '` +
+            `JAVA_BIN=$(${javaBin}); export SERVER_PORT="\${PORT:-3000}"; ` +
+            `if [ -f ${jar} ]; then exec "$JAVA_BIN" -jar ${jar}; ` +
+            `elif [ -f hello-server.jar ]; then exec "$JAVA_BIN" -jar ./hello-server.jar; ` +
+            `elif [ -f HelloServer.class ]; then exec "$JAVA_BIN" -cp . HelloServer; ` +
+            `else echo "no runnable jar/class found" >&2; exit 127; fi'`;
+        return {
+            build,
+            execStart,
+            entry: jar,
+        };
+    }
+    if (runtime === 'bun') {
+        const entry = opts.entry ?? 'index.ts';
+        return {
+            build: 'if [ -f package.json ]; then bun install; else echo "no package.json — skip bun install"; fi',
+            execStart: `/bin/bash -lc 'if [ -f package.json ] && bun run --silent start >/dev/null 2>&1; then exec bun run start; else exec bun ${entry}; fi'`,
+            entry,
+        };
+    }
+    // node (default process fallback only for kind=node)
+    const entry = opts.entry ?? 'server.js';
+    return {
+        execStart: `node ${entry}`,
+        entry,
+    };
+}
+/** Detect a reasonable jar / hello source under appDir (Maven/Gradle/hello layouts). */
+export function detectJavaEntry(appDir) {
+    // YSK single-file hello templates first
+    for (const rel of ['HelloServer.java', 'HelloServer.kt', 'Main.java', 'App.java']) {
+        if (existsSync(join(appDir, rel)))
+            return rel;
+    }
+    if (existsSync(join(appDir, 'HelloServer.class')))
+        return 'HelloServer.java';
+    if (existsSync(join(appDir, 'hello-server.jar')))
+        return './hello-server.jar';
+    const candidates = [
+        'app.jar',
+        'application.jar',
+        join('target', 'app.jar'),
+        join('build', 'libs'),
+        'target',
+    ];
+    for (const rel of candidates) {
+        const abs = join(appDir, rel);
+        try {
+            if (!existsSync(abs))
+                continue;
+            const st = statSync(abs);
+            if (st.isFile() && abs.endsWith('.jar'))
+                return `./${rel}`;
+            if (st.isDirectory()) {
+                const jars = readdirSync(abs)
+                    .filter((n) => n.endsWith('.jar') &&
+                    !n.endsWith('-sources.jar') &&
+                    !n.endsWith('-javadoc.jar'))
+                    .sort();
+                const boot = jars.find((n) => n.includes('boot') || n.includes('SNAPSHOT') || n.includes('all'));
+                const pick = boot ?? jars[jars.length - 1];
+                if (pick)
+                    return `./${rel}/${pick}`;
+            }
+        }
+        catch {
+            /* skip */
+        }
+    }
+    return undefined;
+}
+/** Detect Bun/TS entry under appDir. */
+export function detectBunEntry(appDir) {
+    for (const rel of [
+        'index.ts',
+        'server.ts',
+        'src/index.ts',
+        'src/server.ts',
+        'index.js',
+        'server.js',
+    ]) {
+        if (existsSync(join(appDir, rel)))
+            return rel;
+    }
+    return undefined;
+}
+/** Apache backend bind for PHP (Nginx owns public :80/:443). */
+export function apacheBackendBind() {
+    const b = (process.env.YSK_APACHE_BACKEND_BIND || '127.0.0.1').trim();
+    return b || '127.0.0.1';
+}
+/** Apache backend port (default 8080). */
+export function apacheBackendPort() {
+    const n = Number(process.env.YSK_APACHE_BACKEND_PORT || 8080);
+    return Number.isFinite(n) && n > 0 && n < 65536 ? Math.floor(n) : 8080;
+}
+/** Upstream URL Nginx uses to reach Apache PHP backend. */
+export function apacheBackendUpstream() {
+    return `http://${apacheBackendBind()}:${apacheBackendPort()}`;
+}
+/**
+ * Render Apache VirtualHost for PHP via PHP-FPM (proxy_fcgi).
+ * Listens on backend bind:port only — not public :80 (Nginx terminates public HTTP/S).
+ */
+export function renderPhpVhost(opts) {
+    const bind = opts.bind ?? apacheBackendBind();
+    const port = opts.port ?? apacheBackendPort();
+    const aliasesRaw = Array.isArray(opts.serverAliases)
+        ? opts.serverAliases.join(' ')
+        : opts.serverAliases || '';
+    const aliases = aliasesRaw
+        .split(/\s+/)
+        .map((s) => s.trim())
+        .filter((s) => s && s !== opts.domain);
+    const aliasLine = aliases.length ? `  ServerAlias ${aliases.join(' ')}\n` : '';
+    const sock = `/run/php/php${opts.phpVersion}-fpm-${opts.poolName}.sock`;
+    return `# YSK PHP site — Apache backend (Nginx proxies here; FPM handles .php)
+<VirtualHost ${bind}:${port}>
+  ServerName ${opts.domain}
+${aliasLine}  DocumentRoot ${opts.docRoot}
+  DirectoryIndex index.php index.html
+  <Directory ${opts.docRoot}>
+    Options FollowSymLinks
+    AllowOverride All
+    Require all granted
+  </Directory>
+  <FilesMatch \\.php$>
+    SetHandler "proxy:unix:${sock}|fcgi://localhost"
+  </FilesMatch>
+  # Trust X-Forwarded-* from local Nginx
+  SetEnvIf X-Forwarded-Proto https HTTPS=on
+  ErrorLog \${APACHE_LOG_DIR}/ysk-${opts.poolName}-error.log
+  CustomLog \${APACHE_LOG_DIR}/ysk-${opts.poolName}-access.log combined
+</VirtualHost>
+`;
+}
+/**
+ * Installable version lists are empty by design — clients must use
+ * GET /api/v1/system/software/versions (dynamic discovery).
+ * Probe still finds *installed* pins via host scan (runtime-probe).
+ */
+export function listSupportedRuntimes() {
+    return {
+        node: [],
+        php: [],
+        python: [],
+        go: [],
+        rust: [],
+        java: [],
+        kotlin: [],
+        bun: [],
+    };
+}
+//# sourceMappingURL=runtime.js.map