openship 0.1.10 → 0.2.0

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command24 } from "commander";
+import { Command as Command25 } from "commander";
 
 // src/lib/output.ts
 import chalk from "chalk";
@@ -902,11 +902,13 @@ var PLANS = {
   free: {
     id: "free",
     name: "Free",
-    description: "Get started with 500 credits per month",
+    description: "Get started for free",
     price: { monthly: 0, annual: 0 },
     stripePriceId: { monthly: null, annual: null },
-    monthlyCredits: 5e5,
-    // milli-credits
+    // Paid tiers below are `null` (price + credits) until Openship Cloud pricing
+    // is finalized — the UI renders "coming soon". Self-hosted is free and never
+    // surfaces any of these numbers.
+    monthlyCredits: null,
     oblienLimits: {
       max_workspaces: 1,
       max_vcpus: 2,
@@ -914,7 +916,6 @@ var PLANS = {
       max_disk_gb: 10
     },
     features: [
-      "500 credits/mo",
       "1 workspace",
       "Community support"
     ],
@@ -925,13 +926,13 @@ var PLANS = {
     id: "pro",
     name: "Pro",
     description: "For solo builders shipping production workloads",
-    price: { monthly: 2e3, annual: 19200 },
-    // cents (20% annual discount)
+    price: { monthly: null, annual: null },
+    // coming soon
     stripePriceId: {
       monthly: process.env.STRIPE_PRICE_PRO_MONTHLY ?? "price_pro_monthly_placeholder",
       annual: process.env.STRIPE_PRICE_PRO_ANNUAL ?? "price_pro_annual_placeholder"
     },
-    monthlyCredits: 5e6,
+    monthlyCredits: null,
     oblienLimits: {
       max_workspaces: 10,
       max_vcpus: 16,
@@ -939,7 +940,6 @@ var PLANS = {
       max_disk_gb: 100
     },
     features: [
-      "5,000 credits/mo",
       "Up to 10 workspaces",
       "Email support"
     ],
@@ -950,12 +950,13 @@ var PLANS = {
     id: "team",
     name: "Team",
     description: "For teams collaborating on shared infra",
-    price: { monthly: 5e3, annual: 48e3 },
+    price: { monthly: null, annual: null },
+    // coming soon
     stripePriceId: {
       monthly: process.env.STRIPE_PRICE_TEAM_MONTHLY ?? "price_team_monthly_placeholder",
       annual: process.env.STRIPE_PRICE_TEAM_ANNUAL ?? "price_team_annual_placeholder"
     },
-    monthlyCredits: 25e6,
+    monthlyCredits: null,
     oblienLimits: {
       max_workspaces: 50,
       max_vcpus: 64,
@@ -963,7 +964,6 @@ var PLANS = {
       max_disk_gb: 500
     },
     features: [
-      "25,000 credits/mo",
       "Up to 50 workspaces",
       "Team collaboration",
       "Priority email support"
@@ -1128,8 +1128,12 @@ var localhost = (port) => `http://localhost:${port}`;
 var LOCAL_WEB_URL = localhost(DEFAULT_PORT.web);
 var LOCAL_DASHBOARD_URL = localhost(DEFAULT_PORT.dashboard);
 var LOCAL_API_URL = localhost(DEFAULT_PORT.api);
-var CLOUD_DASHBOARD_URL = "https://app.openship.io";
-var CLOUD_API_URL = "https://api.openship.io";
+var envUrl = (key) => {
+  const v = typeof process !== "undefined" ? process.env?.[key] : void 0;
+  return v && v.trim() ? v.trim() : void 0;
+};
+var CLOUD_DASHBOARD_URL = envUrl("OPENSHIP_CLOUD_DASHBOARD_URL") ?? "https://app.openship.io";
+var CLOUD_API_URL = envUrl("OPENSHIP_CLOUD_API_URL") ?? "https://api.openship.io";
 var DASHBOARD_RUNTIME_TARGETS = {
   local: {
     dashboard: LOCAL_DASHBOARD_URL,
@@ -2230,8 +2234,8 @@ var loginCommand = new Command("login").description("Authenticate with a Persona
       chalk2.bold("\n  Openship login\n") + chalk2.dim("  Create a Personal Access Token in Settings \u2192 Personal Access Tokens,\n") + chalk2.dim("  then paste it here.\n")
     );
     try {
-      const { default: open } = await import("open");
-      await open(settingsUrl);
+      const { default: open2 } = await import("open");
+      await open2(settingsUrl);
     } catch {
     }
     console.log(
@@ -2350,8 +2354,8 @@ var openCommand = new Command3("open").description("Open the Openship dashboard
     }
   }
   try {
-    const { default: open } = await import("open");
-    await open(target);
+    const { default: open2 } = await import("open");
+    await open2(target);
     console.log(chalk4.dim(`
   Opening ${target}
 `));
@@ -2367,9 +2371,9 @@ import chalk5 from "chalk";
 import ora from "ora";
 import { spawn } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname2, join as join4 } from "path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync2, writeFileSync as writeFileSync4 } from "fs";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname2, join as join5 } from "path";
 import { fileURLToPath } from "url";
 
 // src/lib/dashboard.ts
@@ -2419,8 +2423,8 @@ async function downloadToFile(url, dest, onProgress) {
   } finally {
     file.end();
   }
-  await new Promise((resolve, reject2) => {
-    file.on("finish", () => resolve());
+  await new Promise((resolve2, reject2) => {
+    file.on("finish", () => resolve2());
     file.on("error", reject2);
   });
   return { sha256: hash.digest("hex"), size: received };
@@ -2474,6 +2478,17 @@ function assetName(tag) {
   return `openship-dashboard-${tag}.tar.gz`;
 }
 async function ensureDashboard(opts = {}) {
+  const override = process.env.OPENSHIP_DASHBOARD_DIR?.trim();
+  if (override) {
+    const cwd2 = join3(override, "apps", "dashboard");
+    const entry2 = join3(cwd2, "server.js");
+    if (!existsSync2(entry2)) {
+      throw new Error(
+        `OPENSHIP_DASHBOARD_DIR=${override} but ${entry2} is missing \u2014 build the dashboard standalone first (see docs).`
+      );
+    }
+    return { tag: "local", entry: entry2, cwd: cwd2 };
+  }
   const tag = opts.tag ?? await resolveLatestTag();
   const dir = join3(DASHBOARD_CACHE, tag);
   const cwd = join3(dir, "apps", "dashboard");
@@ -2510,47 +2525,349 @@ async function ensureDashboard(opts = {}) {
   return { tag, entry, cwd };
 }
 
+// src/lib/service.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { existsSync as existsSync3, mkdirSync as mkdirSync4, writeFileSync as writeFileSync3, rmSync as rmSync2 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join4, resolve } from "path";
+var HOME = homedir3();
+var OS_DIR = join4(HOME, ".openship");
+var LOG_DIR = join4(OS_DIR, "logs");
+var MAC_LABEL = "io.openship.up";
+var MAC_PLIST = join4(HOME, "Library", "LaunchAgents", `${MAC_LABEL}.plist`);
+var SYSTEMD_NAME = "openship";
+var WIN_TASK = "Openship";
+function selfInvocation() {
+  const runtime = process.execPath;
+  const entry = resolve(process.argv[1] ?? "");
+  return { runtime, args: [entry] };
+}
+function upArgs(flags) {
+  const a = ["up", "--foreground"];
+  if (flags.port) a.push("--port", flags.port);
+  if (flags.dataDir) a.push("--data-dir", flags.dataDir);
+  if (flags.dashboardPort) a.push("--dashboard-port", flags.dashboardPort);
+  if (flags.ui === false) a.push("--no-ui");
+  if (flags.uiVersion) a.push("--ui-version", flags.uiVersion);
+  if (flags.publicUrl) a.push("--public-url", flags.publicUrl);
+  if (flags.trustProxy) a.push("--trust-proxy");
+  if (flags.managedEdge) a.push("--managed-edge");
+  if (flags.acmeEmail) a.push("--acme-email", flags.acmeEmail);
+  return a;
+}
+function runArgv(flags) {
+  const { runtime, args } = selfInvocation();
+  return [runtime, ...args, ...upArgs(flags)];
+}
+function run(cmd, args) {
+  const r = spawnSync2(cmd, args, { encoding: "utf8" });
+  return { ok: r.status === 0, out: `${r.stdout ?? ""}${r.stderr ?? ""}`.trim() };
+}
+function isRoot() {
+  return typeof process.getuid === "function" && process.getuid() === 0;
+}
+function detectKind() {
+  if (process.platform === "darwin") return "launchd";
+  if (process.platform === "linux") {
+    if (!hasSystemd()) return "unsupported";
+    return isRoot() ? "systemd-system" : "systemd-user";
+  }
+  if (process.platform === "win32") return "schtasks";
+  return "unsupported";
+}
+function hasSystemd() {
+  return spawnSync2("sh", ["-c", "command -v systemctl"]).status === 0;
+}
+function xmlEscape(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function serviceEnv() {
+  const extra = {};
+  const dashDir = process.env.OPENSHIP_DASHBOARD_DIR?.trim();
+  if (dashDir) extra.OPENSHIP_DASHBOARD_DIR = dashDir;
+  return extra;
+}
+function plist(flags) {
+  const argv = runArgv(flags);
+  const items = argv.map((a) => `      <string>${xmlEscape(a)}</string>`).join("\n");
+  const path2 = ["/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin", join4(HOME, ".bun/bin")].join(":");
+  const extraEnv = Object.entries(serviceEnv()).map(([k, v]) => `<key>${xmlEscape(k)}</key><string>${xmlEscape(v)}</string>`).join("");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key><string>${MAC_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+${items}
+  </array>
+  <key>RunAtLoad</key><true/>
+  <key>KeepAlive</key><true/>
+  <key>StandardOutPath</key><string>${join4(LOG_DIR, "up.log")}</string>
+  <key>StandardErrorPath</key><string>${join4(LOG_DIR, "up.err.log")}</string>
+  <key>EnvironmentVariables</key>
+  <dict><key>PATH</key><string>${path2}</string>${extraEnv}</dict>
+</dict>
+</plist>
+`;
+}
+function systemdUnit(flags) {
+  const argv = runArgv(flags);
+  const execStart = argv.map((a) => /\s/.test(a) ? `"${a}"` : a).join(" ");
+  const extraEnv = Object.entries(serviceEnv()).map(([k, v]) => `Environment=${k}=${v}
+`).join("");
+  return `[Unit]
+Description=Openship control plane
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=${execStart}
+Restart=always
+RestartSec=2
+Environment=NODE_ENV=production
+${extraEnv}
+[Install]
+WantedBy=default.target
+`;
+}
+function preview(flags) {
+  const kind = detectKind();
+  if (kind === "launchd") return { kind, path: MAC_PLIST, content: plist(flags) };
+  if (kind === "systemd-user") return { kind, path: join4(HOME, ".config/systemd/user", `${SYSTEMD_NAME}.service`), content: systemdUnit(flags) };
+  if (kind === "systemd-system") return { kind, path: `/etc/systemd/system/${SYSTEMD_NAME}.service`, content: systemdUnit(flags) };
+  if (kind === "schtasks") return { kind, path: WIN_TASK, content: runArgv(flags).join(" ") };
+  return { kind, path: "", content: "" };
+}
+function installAndStart(flags) {
+  mkdirSync4(LOG_DIR, { recursive: true });
+  const kind = detectKind();
+  if (kind === "launchd") {
+    mkdirSync4(join4(HOME, "Library", "LaunchAgents"), { recursive: true });
+    run("launchctl", ["bootout", `gui/${process.getuid?.() ?? ""}/${MAC_LABEL}`]);
+    writeFileSync3(MAC_PLIST, plist(flags));
+    const uid = String(process.getuid?.() ?? "");
+    let r = run("launchctl", ["bootstrap", `gui/${uid}`, MAC_PLIST]);
+    if (!r.ok) r = run("launchctl", ["load", "-w", MAC_PLIST]);
+    if (!r.ok) throw new Error(`launchctl failed to load the agent: ${r.out}`);
+    return { kind, detail: `launchd agent ${MAC_LABEL} (logs: ${LOG_DIR})` };
+  }
+  if (kind === "systemd-user" || kind === "systemd-system") {
+    const sysArgs = kind === "systemd-user" ? ["--user"] : [];
+    const unitPath = kind === "systemd-user" ? join4(HOME, ".config/systemd/user", `${SYSTEMD_NAME}.service`) : `/etc/systemd/system/${SYSTEMD_NAME}.service`;
+    mkdirSync4(unitPath.slice(0, unitPath.lastIndexOf("/")), { recursive: true });
+    writeFileSync3(unitPath, systemdUnit(flags));
+    run("systemctl", [...sysArgs, "daemon-reload"]);
+    const r = run("systemctl", [...sysArgs, "enable", "--now", SYSTEMD_NAME]);
+    if (!r.ok) throw new Error(`systemctl enable failed: ${r.out}`);
+    if (kind === "systemd-user") {
+      run("loginctl", ["enable-linger", process.env.USER ?? ""]);
+    }
+    return { kind, detail: `systemd unit ${SYSTEMD_NAME} (${kind === "systemd-user" ? "--user" : "system"})` };
+  }
+  if (kind === "schtasks") {
+    const tr = runArgv(flags).map((a) => `\\"${a}\\"`).join(" ");
+    const r = run("schtasks", ["/Create", "/TN", WIN_TASK, "/SC", "ONLOGON", "/RL", "HIGHEST", "/TR", tr, "/F"]);
+    if (!r.ok) throw new Error(`schtasks create failed: ${r.out}`);
+    run("schtasks", ["/Run", "/TN", WIN_TASK]);
+    return { kind, detail: `Scheduled Task ${WIN_TASK} (best-effort; runs at logon)` };
+  }
+  throw new Error(
+    "No supported service manager found (need systemd on Linux). Run `openship up --foreground` instead, or use docker compose for always-on."
+  );
+}
+function restart() {
+  const kind = detectKind();
+  if (kind === "launchd") {
+    if (!existsSync3(MAC_PLIST)) return { restarted: false, detail: "no launchd agent installed" };
+    const uid = String(process.getuid?.() ?? "");
+    const r = run("launchctl", ["kickstart", "-k", `gui/${uid}/${MAC_LABEL}`]);
+    return { restarted: r.ok, detail: r.ok ? `restarted ${MAC_LABEL}` : r.out };
+  }
+  if (kind === "systemd-user" || kind === "systemd-system") {
+    const sysArgs = kind === "systemd-user" ? ["--user"] : [];
+    const unitPath = kind === "systemd-user" ? join4(HOME, ".config/systemd/user", `${SYSTEMD_NAME}.service`) : `/etc/systemd/system/${SYSTEMD_NAME}.service`;
+    if (!existsSync3(unitPath)) return { restarted: false, detail: "no systemd unit installed" };
+    const r = run("systemctl", [...sysArgs, "restart", SYSTEMD_NAME]);
+    return { restarted: r.ok, detail: r.ok ? `restarted ${SYSTEMD_NAME}` : r.out };
+  }
+  if (kind === "schtasks") {
+    run("schtasks", ["/End", "/TN", WIN_TASK]);
+    const r = run("schtasks", ["/Run", "/TN", WIN_TASK]);
+    return { restarted: r.ok, detail: r.ok ? `restarted ${WIN_TASK}` : r.out };
+  }
+  return { restarted: false, detail: "no supported service manager" };
+}
+function stop() {
+  const kind = detectKind();
+  if (kind === "launchd") {
+    run("launchctl", ["bootout", `gui/${process.getuid?.() ?? ""}/${MAC_LABEL}`]);
+    if (existsSync3(MAC_PLIST)) rmSync2(MAC_PLIST, { force: true });
+    return { kind, detail: `launchd agent ${MAC_LABEL} stopped + removed` };
+  }
+  if (kind === "systemd-user" || kind === "systemd-system") {
+    const sysArgs = kind === "systemd-user" ? ["--user"] : [];
+    run("systemctl", [...sysArgs, "disable", "--now", SYSTEMD_NAME]);
+    const unitPath = kind === "systemd-user" ? join4(HOME, ".config/systemd/user", `${SYSTEMD_NAME}.service`) : `/etc/systemd/system/${SYSTEMD_NAME}.service`;
+    if (existsSync3(unitPath)) rmSync2(unitPath, { force: true });
+    run("systemctl", [...sysArgs, "daemon-reload"]);
+    return { kind, detail: `systemd unit ${SYSTEMD_NAME} stopped + disabled` };
+  }
+  if (kind === "schtasks") {
+    run("schtasks", ["/End", "/TN", WIN_TASK]);
+    run("schtasks", ["/Delete", "/TN", WIN_TASK, "/F"]);
+    return { kind, detail: `Scheduled Task ${WIN_TASK} stopped + removed` };
+  }
+  return { kind, detail: "no supported service manager \u2014 nothing to stop" };
+}
+
 // src/commands/up.ts
+function normalizeUrl(raw) {
+  const value = /^https?:\/\//i.test(raw) ? raw : `https://${raw}`;
+  try {
+    const u = new URL(value);
+    return `${u.protocol}//${u.host}`;
+  } catch {
+    return null;
+  }
+}
+function normalizePublicUrl(raw) {
+  const url = normalizeUrl(raw);
+  if (!url) {
+    console.error(
+      chalk5.red(`
+  Invalid --public-url: ${raw}`) + chalk5.dim("\n  Expected something like https://ops.example.com\n")
+    );
+    process.exit(1);
+  }
+  return url;
+}
 var DIST_DIR = dirname2(fileURLToPath(import.meta.url));
-var SERVER_DIR = join4(DIST_DIR, "server");
-var OS_DIR = join4(homedir3(), ".openship");
+var SERVER_DIR = join5(DIST_DIR, "server");
+var OS_DIR2 = join5(homedir4(), ".openship");
 function ensureAuthSecret() {
-  const path2 = join4(OS_DIR, "auth-secret");
-  if (existsSync3(path2)) return readFileSync2(path2, "utf8").trim();
-  mkdirSync4(OS_DIR, { recursive: true, mode: 448 });
+  const path2 = join5(OS_DIR2, "auth-secret");
+  if (existsSync4(path2)) return readFileSync2(path2, "utf8").trim();
+  mkdirSync5(OS_DIR2, { recursive: true, mode: 448 });
   const secret = randomBytes(32).toString("hex");
-  writeFileSync3(path2, secret, { mode: 384 });
+  writeFileSync4(path2, secret, { mode: 384 });
   return secret;
 }
-var upCommand = new Command4("up").description("Run the Openship control plane locally (bundled API + embedded database)").option("--port <port>", "API port to listen on", "4000").option("--data-dir <dir>", "Directory for the embedded database").option("--dashboard-port <port>", "Dashboard port", "3001").option("--no-ui", "Run the API only \u2014 don't download/serve the dashboard").option("--ui-version <tag>", "Dashboard release tag to run (default: this CLI's version)").action(async (opts) => {
-  const serverEntry = join4(SERVER_DIR, "index.js");
-  if (!existsSync3(serverEntry)) {
+function ensureInternalToken() {
+  const path2 = join5(OS_DIR2, "internal-token");
+  if (existsSync4(path2)) return readFileSync2(path2, "utf8").trim();
+  mkdirSync5(OS_DIR2, { recursive: true, mode: 448 });
+  const token = randomBytes(32).toString("hex");
+  writeFileSync4(path2, token, { mode: 384 });
+  return token;
+}
+var upCommand = new Command4("up").description("Start Openship as a persistent service (boot + auto-restart); --foreground to run attached").option("--port <port>", "API port to listen on", "4000").option("--data-dir <dir>", "Directory for the embedded database").option("--dashboard-port <port>", "Dashboard port", "3001").option("--no-ui", "Run the API only \u2014 don't download/serve the dashboard").option("--ui-version <tag>", "Dashboard release tag to run (default: this CLI's version)").option("-f, --foreground", "Run attached in this terminal instead of as a background service").option("--dry-run", "Print the service definition that would be installed, then exit").option(
+  "--public-url <url>",
+  "Serve remotely at this public URL (VPS): binds the dashboard to all interfaces, proxies the API same-origin, and requires login"
+).option(
+  "--trust-proxy",
+  "Trust the X-Real-IP set by a reverse proxy in front (the proxy MUST overwrite X-Real-IP with the real client IP, e.g. `proxy_set_header X-Real-IP $remote_addr`, and the app port MUST be firewalled so only the proxy can reach it; enables per-client rate limiting)"
+).option(
+  "--managed-edge",
+  "Managed edge: install OpenResty + a free Let's Encrypt cert on this box and route --public-url's domain to the dashboard (no reverse proxy needed)"
+).option("--acme-email <email>", "Contact email for Let's Encrypt certificates (managed edge)").action(async (opts) => {
+  if (opts.foreground) return runForeground(opts);
+  startService(opts);
+});
+function startService(opts, runOpts = {}) {
+  const publicUrl = opts.publicUrl ? normalizePublicUrl(opts.publicUrl) : void 0;
+  const port = String(opts.port || "4000");
+  const dashPort = String(opts.dashboardPort || "3001");
+  const flags = {
+    port: opts.port,
+    dataDir: opts.dataDir,
+    dashboardPort: opts.dashboardPort,
+    ui: opts.ui,
+    uiVersion: opts.uiVersion,
+    publicUrl,
+    trustProxy: opts.trustProxy || opts.managedEdge,
+    // managed edge = OpenResty sets XFF
+    managedEdge: opts.managedEdge,
+    acmeEmail: opts.acmeEmail
+  };
+  if (opts.dryRun) {
+    const p = preview(flags);
+    console.log(
+      chalk5.dim(`
+  service manager: ${p.kind}
+  path: ${p.path}
+
+`) + p.content + "\n"
+    );
+    return { port, dashPort, publicUrl };
+  }
+  try {
+    const res = installAndStart(flags);
+    if (!runOpts.quiet) {
+      const dashboardLine = publicUrl ? chalk5.dim(`  Dashboard: ${publicUrl}  (login required)
+`) : chalk5.dim(`  Dashboard: http://localhost:${dashPort}  (login required)
+`);
+      console.log(
+        chalk5.green("\n  \u2714 Openship is running as a service.\n") + (opts.ui !== false ? dashboardLine : "") + (publicUrl ? chalk5.dim("  API is proxied through the dashboard (not exposed). Point your reverse proxy / DNS at the dashboard port.\n") : chalk5.dim(`  API:       http://localhost:${port}/api
+`)) + chalk5.dim(`  ${res.detail}
+`) + chalk5.dim("  Starts on boot and auto-restarts. Stop with `openship stop`.\n")
+      );
+    }
+    return { port, dashPort, publicUrl };
+  } catch (e) {
+    if (runOpts.quiet) throw e;
+    console.error(
+      chalk5.red(`
+  Couldn't install the service: ${e.message}
+`) + chalk5.dim("  Run `openship up --foreground` to run it attached instead.\n")
+    );
+    process.exit(1);
+  }
+}
+async function runForeground(opts) {
+  const serverEntry = join5(SERVER_DIR, "index.js");
+  if (!existsSync4(serverEntry)) {
     console.error(
       chalk5.red("\n  Bundled server not found in this install.") + chalk5.dim("\n  Reinstall with `openship update` (or `npm i -g openship`).\n")
     );
     process.exit(1);
   }
   const port = String(opts.port || "4000");
-  const dataDir = opts.dataDir || join4(OS_DIR, "data");
-  mkdirSync4(dataDir, { recursive: true });
+  const dashPort = String(opts.dashboardPort || "3001");
+  const publicUrl = opts.publicUrl ? normalizePublicUrl(opts.publicUrl) : void 0;
+  const managedEdge = Boolean(opts.managedEdge && publicUrl);
+  const dataDir = opts.dataDir || join5(OS_DIR2, "data");
+  mkdirSync5(dataDir, { recursive: true });
   const env = {
     ...process.env,
     PORT: port,
     NODE_ENV: "production",
-    // desktop mode → in-process job runner (no Redis) + loopback zero-auth,
-    // so a local single-user box needs no PAT over 127.0.0.1.
+    // desktop mode → in-process job runner (no Redis).
     DEPLOY_MODE: "desktop",
     OPENSHIP_TARGET: "local",
     OPENSHIP_JOB_RUNNER: "in-process",
-    OPENSHIP_ALLOW_ZERO_AUTH: "true",
     PGLITE_DATA_DIR: dataDir,
-    OPENSHIP_MIGRATIONS_DIR: join4(SERVER_DIR, "migrations"),
-    OPENSHIP_PGLITE_ASSETS_DIR: join4(SERVER_DIR, "pglite"),
+    OPENSHIP_MIGRATIONS_DIR: join5(SERVER_DIR, "migrations"),
+    OPENSHIP_PGLITE_ASSETS_DIR: join5(SERVER_DIR, "pglite"),
     BETTER_AUTH_SECRET: ensureAuthSecret()
   };
+  env.OPENSHIP_REQUIRE_AUTH = "true";
+  env.INTERNAL_TOKEN = ensureInternalToken();
+  env.OPENSHIP_API_HOST = "127.0.0.1";
+  delete env.OPENSHIP_ALLOW_ZERO_AUTH;
+  if (publicUrl) {
+    env.OPENSHIP_PUBLIC_URL = publicUrl;
+  }
+  if (opts.trustProxy || managedEdge) env.TRUST_PROXY = "true";
+  if (managedEdge) {
+    env.OPENSHIP_MANAGED_EDGE = "true";
+    env.OPENSHIP_DASHBOARD_PORT = dashPort;
+    if (opts.acmeEmail) env.OPENSHIP_ACME_EMAIL = opts.acmeEmail;
+  }
   delete env.DATABASE_URL;
   delete env.POSTGRES_URL;
-  const spinner2 = ora(`Starting Openship on http://localhost:${port} \u2026`).start();
+  const spinner3 = ora(`Starting Openship on http://localhost:${port} \u2026`).start();
   const child = spawn(process.execPath, [serverEntry], { env, stdio: ["ignore", "pipe", "pipe"] });
   let buffered = "";
   const buffer = (d) => {
@@ -2560,7 +2877,7 @@ var upCommand = new Command4("up").description("Run the Openship control plane l
   child.stderr.on("data", buffer);
   child.on("exit", (code) => {
     if (code && code !== 0) {
-      spinner2.fail(`Openship server exited (code ${code})`);
+      spinner3.fail(`Openship server exited (code ${code})`);
       process.stderr.write(buffered.slice(-2e3));
       process.exit(code);
     }
@@ -2579,12 +2896,12 @@ var upCommand = new Command4("up").description("Run the Openship control plane l
     }
   }
   if (!healthy) {
-    spinner2.fail("Openship did not become healthy in time");
+    spinner3.fail("Openship did not become healthy in time");
     process.stderr.write(buffered.slice(-2e3));
     child.kill("SIGTERM");
     process.exit(1);
   }
-  spinner2.succeed(`Openship API running at http://localhost:${port}`);
+  spinner3.succeed(`Openship API running at http://localhost:${port}`);
   const children = [child];
   const stopAll = () => {
     for (const c of children) {
@@ -2602,11 +2919,10 @@ var upCommand = new Command4("up").description("Run the Openship control plane l
   };
   let dashboardUrl = null;
   if (opts.ui !== false) {
-    const dashPort = String(opts.dashboardPort || "3001");
     const uiSpinner = ora("Preparing the dashboard\u2026").start();
     try {
       const bundle = await ensureDashboard({
-        tag: opts.uiVersion || `v${"0.1.10"}`,
+        tag: opts.uiVersion || `v${"0.2.0"}`,
         onProgress: (received, total) => {
           if (total) {
             uiSpinner.text = `Downloading dashboard\u2026 ${Math.round(received / total * 100)}%`;
@@ -2621,12 +2937,18 @@ var upCommand = new Command4("up").description("Run the Openship control plane l
           NODE_ENV: "production",
           OPENSHIP_TARGET: "local",
           PORT: dashPort,
-          HOSTNAME: "127.0.0.1",
-          // The dashboard reads this (SSR) and mirrors it into the browser as
-          // window.__OPENSHIP_API_ORIGIN__ so both target our local API. It
-          // does NOT read API_INTERNAL_URL — using that leaves it defaulting
-          // to :4000 (possibly a different instance).
-          OPENSHIP_LOCAL_API_URL: `http://127.0.0.1:${port}`
+          // Reachable remotely when public; loopback-only otherwise. Under
+          // managed edge the local OpenResty fronts the dashboard, so it stays
+          // on loopback even though there's a public URL.
+          HOSTNAME: publicUrl && !managedEdge ? "0.0.0.0" : "127.0.0.1",
+          // The dashboard's same-origin proxy (NEXT_PUBLIC_API_PROXY, baked
+          // into the release build) forwards /api/proxy/* to this address, so
+          // the browser never needs to know where the API lives. Set in every
+          // mode; loopback because the dashboard runs on the same box.
+          INTERNAL_API_URL: `http://127.0.0.1:${port}`,
+          // Public URL feeds the SSR proxy-origin resolver; local mode keeps
+          // the window.__OPENSHIP_API_ORIGIN__ fallback for direct API calls.
+          ...publicUrl ? { OPENSHIP_PUBLIC_URL: publicUrl } : { OPENSHIP_LOCAL_API_URL: `http://127.0.0.1:${port}` }
         },
         stdio: ["ignore", "pipe", "pipe"]
       });
@@ -2650,7 +2972,7 @@ var upCommand = new Command4("up").description("Run the Openship control plane l
         }
       }
       if (dashUp) {
-        dashboardUrl = `http://localhost:${dashPort}`;
+        dashboardUrl = publicUrl ?? `http://localhost:${dashPort}`;
         uiSpinner.succeed(`Dashboard running at ${dashboardUrl}`);
         dash.stdout.off("data", onDash);
         dash.stderr.off("data", onDash);
@@ -2669,12 +2991,20 @@ var upCommand = new Command4("up").description("Run the Openship control plane l
       );
     }
   }
-  console.log(
-    chalk5.dim(`  API:       http://localhost:${port}/api
-`) + (dashboardUrl ? chalk5.dim(`  Dashboard: ${dashboardUrl}
+  if (publicUrl) {
+    console.log(
+      (dashboardUrl ? chalk5.dim(`  Dashboard: ${dashboardUrl}  (login required)
+`) : "") + chalk5.dim("  API is proxied through the dashboard (bound to loopback, not exposed).\n") + chalk5.dim(`  Data:      ${dataDir}
+`) + (managedEdge ? chalk5.dim("  Managed edge (OpenResty + Let's Encrypt) fronts this box \u2014 point your domain's A record at this server's IP. Stop with Ctrl-C.\n") : chalk5.dim("  Point your reverse proxy / DNS at the dashboard port. Stop with Ctrl-C.\n"))
+    );
+  } else {
+    console.log(
+      chalk5.dim(`  API:       http://localhost:${port}/api
+`) + (dashboardUrl ? chalk5.dim(`  Dashboard: ${dashboardUrl}  (login required)
 `) : "") + chalk5.dim(`  Data:      ${dataDir}
-`) + chalk5.dim("  Local access needs no token (loopback). Stop with Ctrl-C.\n")
-  );
+`) + chalk5.dim("  Log in with your admin account (run `openship` to create one). Stop with Ctrl-C.\n")
+    );
+  }
   child.stdout.off("data", buffer);
   child.stderr.off("data", buffer);
   child.stdout.on("data", (d) => process.stdout.write(d));
@@ -2685,19 +3015,35 @@ var upCommand = new Command4("up").description("Run the Openship control plane l
     stopAll();
     process.exit(code ?? 0);
   });
+}
+
+// src/commands/stop.ts
+import { Command as Command5 } from "commander";
+import chalk6 from "chalk";
+var stopCommand = new Command5("stop").description("Stop the Openship service (started by `openship up`) \u2014 it won't restart or return on reboot").action(() => {
+  try {
+    const res = stop();
+    console.log(chalk6.green("\n  \u2714 Openship stopped.\n") + chalk6.dim(`  ${res.detail}
+`));
+  } catch (e) {
+    console.error(chalk6.red(`
+  Couldn't stop the service: ${e.message}
+`));
+    process.exit(1);
+  }
 });
 
 // src/commands/init.ts
-import { Command as Command5 } from "commander";
-import { existsSync as existsSync4, mkdirSync as mkdirSync5, writeFileSync as writeFileSync4 } from "fs";
+import { Command as Command6 } from "commander";
+import { existsSync as existsSync5, mkdirSync as mkdirSync6, writeFileSync as writeFileSync5 } from "fs";
 import { createInterface as createInterface2 } from "readline/promises";
 import { stdin as input2, stdout as output2 } from "process";
-import { join as join5 } from "path";
-var initCommand = new Command5("init").description("Link the current directory to an Openship project (.openship/project.json)").option("--project <id>", "Project id to link (skips the picker)").option("--environment <name>", "Default deploy environment", "production").option("--dir <path>", "Directory to initialize", process.cwd()).option("--force", "Overwrite an existing project link").option("-y, --yes", "Non-interactive: fail instead of prompting").action(async (opts) => {
+import { join as join6 } from "path";
+var initCommand = new Command6("init").description("Link the current directory to an Openship project (.openship/project.json)").option("--project <id>", "Project id to link (skips the picker)").option("--environment <name>", "Default deploy environment", "production").option("--dir <path>", "Directory to initialize", process.cwd()).option("--force", "Overwrite an existing project link").option("-y, --yes", "Non-interactive: fail instead of prompting").action(async (opts) => {
   const root = opts.dir || process.cwd();
-  const linkDir = join5(root, ".openship");
-  const linkPath = join5(linkDir, "project.json");
-  if (existsSync4(linkPath) && !opts.force) {
+  const linkDir = join6(root, ".openship");
+  const linkPath = join6(linkDir, "project.json");
+  if (existsSync5(linkPath) && !opts.force) {
     err(`Already linked (${linkPath}). Re-run with --force to overwrite.`);
     process.exit(1);
   }
@@ -2750,8 +3096,8 @@ var initCommand = new Command5("init").description("Link the current directory t
     context: getActiveContext(),
     defaults: { environment: opts.environment || "production" }
   };
-  mkdirSync5(linkDir, { recursive: true });
-  writeFileSync4(linkPath, JSON.stringify(link, null, 2) + "\n");
+  mkdirSync6(linkDir, { recursive: true });
+  writeFileSync5(linkPath, JSON.stringify(link, null, 2) + "\n");
   if (isJsonMode()) {
     printJson({ path: linkPath, link });
     return;
@@ -2762,7 +3108,7 @@ var initCommand = new Command5("init").description("Link the current directory t
 });
 
 // src/commands/context.ts
-import { Command as Command6 } from "commander";
+import { Command as Command7 } from "commander";
 function renderContexts() {
   const rows = listContexts().map((c) => ({
     current: c.current ? "*" : "",
@@ -2773,8 +3119,8 @@ function renderContexts() {
   }));
   printTable(rows, ["current", "name", "apiUrl", "dashboardUrl", "auth"]);
 }
-var listCmd = new Command6("list").alias("ls").description("List configured contexts").action(renderContexts);
-var useCmd = new Command6("use").description("Switch the active context").argument("<name>", "Context name").action((name) => {
+var listCmd = new Command7("list").alias("ls").description("List configured contexts").action(renderContexts);
+var useCmd = new Command7("use").description("Switch the active context").argument("<name>", "Context name").action((name) => {
   try {
     setActiveContext(name);
     ok(`
@@ -2785,7 +3131,7 @@ var useCmd = new Command6("use").description("Switch the active context").argume
     process.exit(1);
   }
 });
-var addCmd = new Command6("add").description("Create or update a context's endpoints/token").argument("<name>", "Context name").option("--api-url <url>", "API base URL").option("--dashboard-url <url>", "Dashboard base URL").option("--token <token>", "Personal Access Token to store").option("--use", "Switch to this context after adding").action((name, opts) => {
+var addCmd = new Command7("add").description("Create or update a context's endpoints/token").argument("<name>", "Context name").option("--api-url <url>", "API base URL").option("--dashboard-url <url>", "Dashboard base URL").option("--token <token>", "Personal Access Token to store").option("--use", "Switch to this context after adding").action((name, opts) => {
   addContext(name, {
     apiUrl: opts.apiUrl,
     dashboardUrl: opts.dashboardUrl,
@@ -2796,7 +3142,7 @@ var addCmd = new Command6("add").description("Create or update a context's endpo
   Saved context "${name}"${opts.use ? " (now active)" : ""}.
 `);
 });
-var rmCmd = new Command6("rm").alias("remove").description("Remove a context (cannot remove the active one)").argument("<name>", "Context name").action((name) => {
+var rmCmd = new Command7("rm").alias("remove").description("Remove a context (cannot remove the active one)").argument("<name>", "Context name").action((name) => {
   try {
     removeContext(name);
     ok(`
@@ -2807,15 +3153,15 @@ var rmCmd = new Command6("rm").alias("remove").description("Remove a context (ca
     process.exit(1);
   }
 });
-var contextCommand = new Command6("context").alias("ctx").description("Manage connection contexts (list/use/add/rm)").action(() => {
+var contextCommand = new Command7("context").alias("ctx").description("Manage connection contexts (list/use/add/rm)").action(() => {
   ok(`  Active context: ${getActiveContext()}`);
   renderContexts();
 }).addCommand(listCmd).addCommand(useCmd).addCommand(addCmd).addCommand(rmCmd);
 
 // src/commands/status.ts
-import { Command as Command7 } from "commander";
-import chalk6 from "chalk";
-var statusCommand = new Command7("status").description("Show the active context's API health and deployment info").action(async () => {
+import { Command as Command8 } from "commander";
+import chalk7 from "chalk";
+var statusCommand = new Command8("status").description("Show the active context's API health and deployment info").action(async () => {
   const context = getActiveContext();
   const apiUrl = getApiUrl2();
   let health;
@@ -2838,18 +3184,18 @@ var statusCommand = new Command7("status").description("Show the active context'
     printJson({ context, apiUrl, reachable: true, health, env: envInfo });
     return;
   }
-  const row = (label, value) => `  ${chalk6.dim(label.padEnd(14))}${value ?? chalk6.dim("-")}
+  const row = (label, value) => `  ${chalk7.dim(label.padEnd(14))}${value ?? chalk7.dim("-")}
 `;
   process.stdout.write(
-    chalk6.bold("\n  Openship status\n\n") + row("Context", context) + row("API", apiUrl) + row("Health", chalk6.green(health.status ?? "ok")) + row("Mode", envInfo.selfHosted ? "self-hosted" : "cloud") + row("Deploy", envInfo.deployMode) + row("Auth", envInfo.authMode) + row("Team", envInfo.teamMode) + (envInfo.hostDomain ? row("Host domain", envInfo.hostDomain) : "") + (envInfo.machineName ? row("Machine", envInfo.machineName) : "") + "\n"
+    chalk7.bold("\n  Openship status\n\n") + row("Context", context) + row("API", apiUrl) + row("Health", chalk7.green(health.status ?? "ok")) + row("Mode", envInfo.selfHosted ? "self-hosted" : "cloud") + row("Deploy", envInfo.deployMode) + row("Auth", envInfo.authMode) + row("Team", envInfo.teamMode) + (envInfo.hostDomain ? row("Host domain", envInfo.hostDomain) : "") + (envInfo.machineName ? row("Machine", envInfo.machineName) : "") + "\n"
   );
 });
 
 // src/commands/doctor.ts
-import { Command as Command8 } from "commander";
-import { existsSync as existsSync5 } from "fs";
+import { Command as Command9 } from "commander";
+import { existsSync as existsSync6 } from "fs";
 import { execFileSync } from "child_process";
-import chalk7 from "chalk";
+import chalk8 from "chalk";
 function bunVersion() {
   const embedded = process.versions.bun;
   if (embedded) return embedded;
@@ -2859,9 +3205,9 @@ function bunVersion() {
     return null;
   }
 }
-var doctorCommand = new Command8("doctor").description("Diagnose the CLI setup (config, active context, runtime)").action(async () => {
+var doctorCommand = new Command9("doctor").description("Diagnose the CLI setup (config, active context, runtime)").action(async () => {
   const checks = [];
-  const hasConfig = existsSync5(CONFIG_PATH);
+  const hasConfig = existsSync6(CONFIG_PATH);
   checks.push({
     name: "config",
     status: hasConfig ? "pass" : "warn",
@@ -2897,10 +3243,10 @@ var doctorCommand = new Command8("doctor").description("Diagnose the CLI setup (
   if (isJsonMode()) {
     printJson({ context, apiUrl, reachable, checks });
   } else {
-    const glyph = { pass: chalk7.green("\u2713"), warn: chalk7.yellow("!"), fail: chalk7.red("\u2717") };
-    process.stdout.write(chalk7.bold("\n  Openship doctor\n\n"));
+    const glyph = { pass: chalk8.green("\u2713"), warn: chalk8.yellow("!"), fail: chalk8.red("\u2717") };
+    process.stdout.write(chalk8.bold("\n  Openship doctor\n\n"));
     for (const c of checks) {
-      process.stdout.write(`  ${glyph[c.status]} ${chalk7.bold(c.name.padEnd(8))} ${c.detail}
+      process.stdout.write(`  ${glyph[c.status]} ${chalk8.bold(c.name.padEnd(8))} ${c.detail}
 `);
     }
     process.stdout.write("\n");
@@ -2909,20 +3255,20 @@ var doctorCommand = new Command8("doctor").description("Diagnose the CLI setup (
 });
 
 // src/commands/deploy.ts
-import { Command as Command9 } from "commander";
+import { Command as Command10 } from "commander";
 import { execFileSync as execFileSync3 } from "child_process";
 import ora2 from "ora";
 
 // src/lib/project-link.ts
-import { readFileSync as readFileSync3, existsSync as existsSync6 } from "fs";
-import { join as join6, dirname as dirname3, parse } from "path";
-var LINK_REL = join6(".openship", "project.json");
+import { readFileSync as readFileSync3, existsSync as existsSync7 } from "fs";
+import { join as join7, dirname as dirname3, parse } from "path";
+var LINK_REL = join7(".openship", "project.json");
 function findProjectLinkPath(from = process.cwd()) {
   let dir = from;
   const root = parse(dir).root;
   for (; ; ) {
-    const candidate = join6(dir, LINK_REL);
-    if (existsSync6(candidate)) return candidate;
+    const candidate = join7(dir, LINK_REL);
+    if (existsSync7(candidate)) return candidate;
     if (dir === root) return null;
     dir = dirname3(dir);
   }
@@ -2939,21 +3285,21 @@ function readProjectLink(from) {
 
 // src/lib/folder-deploy.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { readFileSync as readFileSync4, existsSync as existsSync7, rmSync as rmSync2 } from "fs";
+import { readFileSync as readFileSync4, existsSync as existsSync8, rmSync as rmSync3 } from "fs";
 import { tmpdir } from "os";
-import { join as join7, basename } from "path";
+import { join as join8, basename } from "path";
 function detectPackageManager(dir) {
-  if (existsSync7(join7(dir, "bun.lockb")) || existsSync7(join7(dir, "bun.lock"))) return "bun";
-  if (existsSync7(join7(dir, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync7(join7(dir, "yarn.lock"))) return "yarn";
-  if (existsSync7(join7(dir, "package.json"))) return "npm";
+  if (existsSync8(join8(dir, "bun.lockb")) || existsSync8(join8(dir, "bun.lock"))) return "bun";
+  if (existsSync8(join8(dir, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync8(join8(dir, "yarn.lock"))) return "yarn";
+  if (existsSync8(join8(dir, "package.json"))) return "npm";
   return void 0;
 }
 function detectStack(dir) {
-  if (existsSync7(join7(dir, "go.mod"))) return "go";
-  if (existsSync7(join7(dir, "Cargo.toml"))) return "rust";
-  if (existsSync7(join7(dir, "requirements.txt")) || existsSync7(join7(dir, "pyproject.toml"))) return "python";
-  if (existsSync7(join7(dir, "package.json"))) return "node";
+  if (existsSync8(join8(dir, "go.mod"))) return "go";
+  if (existsSync8(join8(dir, "Cargo.toml"))) return "rust";
+  if (existsSync8(join8(dir, "requirements.txt")) || existsSync8(join8(dir, "pyproject.toml"))) return "python";
+  if (existsSync8(join8(dir, "package.json"))) return "node";
   return void 0;
 }
 async function deployFolder(opts) {
@@ -2970,7 +3316,7 @@ async function deployFolder(opts) {
     throw new Error(session.error || "Failed to open upload session");
   }
   step("Packaging folder");
-  const tarball = join7(tmpdir(), `openship-upload-${session.sessionId}.tar.gz`);
+  const tarball = join8(tmpdir(), `openship-upload-${session.sessionId}.tar.gz`);
   execFileSync2(
     "tar",
     [
@@ -2996,7 +3342,7 @@ async function deployFolder(opts) {
     if (!res.ok) throw new Error(`upload failed (HTTP ${res.status})`);
   } finally {
     try {
-      rmSync2(tarball, { force: true });
+      rmSync3(tarball, { force: true });
     } catch {
     }
   }
@@ -3170,7 +3516,7 @@ function git(args) {
     return void 0;
   }
 }
-var deployCommand = new Command9("deploy").description("Trigger a deployment for the current project").option("--project <id>", "Project ID (defaults to the linked project in .openship/project.json)").option("--branch <name>", "Git branch to deploy (defaults to the current branch)").option("--commit <sha>", "Specific commit SHA (defaults to the latest commit on the branch)").option("--env <environment>", "Target environment: production | preview", "production").option("--force-all", "Rebuild every enabled service (skip smart per-service routing)").option("--service-ids <ids>", "Comma-separated service IDs to deploy (smart routing)").option("--smart-route", "Rebuild only services changed since the active deploy").option("--refresh", "Re-apply current env to the active deploy (no git pull, no rebuild)").option("--name <name>", "Project name for a folder (non-git) deploy (defaults to the directory name)").option("--watch", "Stream the deployment logs until it finishes").action(async (opts) => {
+var deployCommand = new Command10("deploy").description("Trigger a deployment for the current project").option("--project <id>", "Project ID (defaults to the linked project in .openship/project.json)").option("--branch <name>", "Git branch to deploy (defaults to the current branch)").option("--commit <sha>", "Specific commit SHA (defaults to the latest commit on the branch)").option("--env <environment>", "Target environment: production | preview", "production").option("--force-all", "Rebuild every enabled service (skip smart per-service routing)").option("--service-ids <ids>", "Comma-separated service IDs to deploy (smart routing)").option("--smart-route", "Rebuild only services changed since the active deploy").option("--refresh", "Re-apply current env to the active deploy (no git pull, no rebuild)").option("--name <name>", "Project name for a folder (non-git) deploy (defaults to the directory name)").option("--watch", "Stream the deployment logs until it finishes").action(async (opts) => {
   const link = readProjectLink();
   const env = opts.env;
   if (env !== "production" && env !== "preview") {
@@ -3182,7 +3528,7 @@ var deployCommand = new Command9("deploy").description("Trigger a deployment for
   let deploymentId;
   let payload;
   if (!inGitRepo && !gitOnlyFlags) {
-    const spinner2 = isJsonMode() ? null : ora2("Deploying folder").start();
+    const spinner3 = isJsonMode() ? null : ora2("Deploying folder").start();
     try {
       const result2 = await deployFolder({
         cwd: process.cwd(),
@@ -3190,14 +3536,14 @@ var deployCommand = new Command9("deploy").description("Trigger a deployment for
         projectId: opts.project || link?.projectId,
         environment: env,
         onStep: (m) => {
-          if (spinner2) spinner2.text = m;
+          if (spinner3) spinner3.text = m;
         }
       });
       deploymentId = result2.deploymentId;
       payload = { success: true, deployment_id: result2.deploymentId, project_id: result2.projectId };
-      spinner2?.succeed(deploymentId ? `Deployment queued: ${deploymentId}` : "Deployment queued");
+      spinner3?.succeed(deploymentId ? `Deployment queued: ${deploymentId}` : "Deployment queued");
     } catch (e) {
-      spinner2?.fail("Folder deploy failed");
+      spinner3?.fail("Folder deploy failed");
       err(e instanceof ApiError ? e.message : String(e));
       process.exit(1);
     }
@@ -3219,7 +3565,7 @@ var deployCommand = new Command9("deploy").description("Trigger a deployment for
       smartRoute: opts.smartRoute || void 0,
       refresh: opts.refresh || void 0
     };
-    const spinner2 = isJsonMode() ? null : ora2("Triggering deployment").start();
+    const spinner3 = isJsonMode() ? null : ora2("Triggering deployment").start();
     let res;
     try {
       res = await apiRequest("/deployments", {
@@ -3227,13 +3573,13 @@ var deployCommand = new Command9("deploy").description("Trigger a deployment for
         body: JSON.stringify(body)
       });
     } catch (e) {
-      spinner2?.fail("Deployment failed to start");
+      spinner3?.fail("Deployment failed to start");
       err(e instanceof ApiError ? e.message : String(e));
       process.exit(1);
     }
     deploymentId = res.data?.deployment_id;
     payload = res.data ?? res;
-    spinner2?.succeed(deploymentId ? `Deployment queued: ${deploymentId}` : "Deployment queued");
+    spinner3?.succeed(deploymentId ? `Deployment queued: ${deploymentId}` : "Deployment queued");
   }
   if (isJsonMode() && !opts.watch) {
     printJson(payload ?? {});
@@ -3252,9 +3598,9 @@ var deployCommand = new Command9("deploy").description("Trigger a deployment for
 });
 
 // src/commands/deployment.ts
-import { Command as Command10 } from "commander";
+import { Command as Command11 } from "commander";
 import { createInterface as createInterface3 } from "readline";
-function run(fn) {
+function run2(fn) {
   return async (...args) => {
     try {
       await fn(...args);
@@ -3274,12 +3620,12 @@ function shortSha(v) {
 async function confirm(question) {
   if (!process.stdin.isTTY) return true;
   const rl = createInterface3({ input: process.stdin, output: process.stderr });
-  const answer = await new Promise((resolve) => rl.question(`${question} [y/N] `, resolve));
+  const answer = await new Promise((resolve2) => rl.question(`${question} [y/N] `, resolve2));
   rl.close();
   return /^y(es)?$/i.test(answer.trim());
 }
-var list = new Command10("list").description("List deployments (org-wide, or scoped to a project)").option("--project <id>", "Scope to a project (defaults to the linked project)").option("--env <environment>", "Filter by environment: production | preview").option("--limit <n>", "Max rows to fetch", "50").action(
-  run(async (opts) => {
+var list = new Command11("list").description("List deployments (org-wide, or scoped to a project)").option("--project <id>", "Scope to a project (defaults to the linked project)").option("--env <environment>", "Filter by environment: production | preview").option("--limit <n>", "Max rows to fetch", "50").action(
+  run2(async (opts) => {
     const projectId = opts.project || readProjectLink()?.projectId;
     const params = new URLSearchParams();
     if (projectId) params.set("projectId", projectId);
@@ -3301,8 +3647,8 @@ var list = new Command10("list").description("List deployments (org-wide, or sco
     printTable(rows, ["id", "status", "env", "branch", "commit", "active", "created"]);
   })
 );
-var get = new Command10("get").description("Show a single deployment").argument("<id>", "Deployment ID").action(
-  run(async (id) => {
+var get = new Command11("get").description("Show a single deployment").argument("<id>", "Deployment ID").action(
+  run2(async (id) => {
     const res = await apiRequest(`/deployments/${id}`);
     const d = res.data ?? {};
     if (isJsonMode()) return printJson(d);
@@ -3322,20 +3668,20 @@ var get = new Command10("get").description("Show a single deployment").argument(
     );
   })
 );
-var info2 = new Command10("info").description("Show container info for a deployment").argument("<id>", "Deployment ID").action(
-  run(async (id) => {
+var info2 = new Command11("info").description("Show container info for a deployment").argument("<id>", "Deployment ID").action(
+  run2(async (id) => {
     const res = await apiRequest(`/deployments/${id}/info`);
     printJson(res.data ?? res);
   })
 );
-var usage = new Command10("usage").description("Show container resource usage for a deployment").argument("<id>", "Deployment ID").action(
-  run(async (id) => {
+var usage = new Command11("usage").description("Show container resource usage for a deployment").argument("<id>", "Deployment ID").action(
+  run2(async (id) => {
     const res = await apiRequest(`/deployments/${id}/usage`);
     printJson(res.data ?? res);
   })
 );
-var redeploy = new Command10("redeploy").description("Redeploy from an existing deployment").argument("<id>", "Deployment ID").option("--use-existing-commit", "Rebuild the same commit instead of the latest on the branch").action(
-  run(async (id, opts) => {
+var redeploy = new Command11("redeploy").description("Redeploy from an existing deployment").argument("<id>", "Deployment ID").option("--use-existing-commit", "Rebuild the same commit instead of the latest on the branch").action(
+  run2(async (id, opts) => {
     const res = await apiRequest(`/deployments/${id}/redeploy`, {
       method: "POST",
       body: JSON.stringify({ useExistingCommit: opts.useExistingCommit === true })
@@ -3343,14 +3689,14 @@ var redeploy = new Command10("redeploy").description("Redeploy from an existing
     report(res, `Redeploy triggered for ${id}`);
   })
 );
-var rollback = new Command10("rollback").description("Roll back to a previous deployment").argument("<id>", "Deployment ID to roll back to").action(
-  run(async (id) => {
+var rollback = new Command11("rollback").description("Roll back to a previous deployment").argument("<id>", "Deployment ID to roll back to").action(
+  run2(async (id) => {
     const res = await apiRequest(`/deployments/${id}/rollback`, { method: "POST" });
     report(res, `Rolled back to ${id}`);
   })
 );
-var pin = new Command10("pin").description("Pin (or unpin) a deployment's rollback artifact").argument("<id>", "Deployment ID").option("--off", "Unpin instead of pin").action(
-  run(async (id, opts) => {
+var pin = new Command11("pin").description("Pin (or unpin) a deployment's rollback artifact").argument("<id>", "Deployment ID").option("--off", "Unpin instead of pin").action(
+  run2(async (id, opts) => {
     const pinned = !opts.off;
     const res = await apiRequest(`/deployments/${id}/pin`, {
       method: "POST",
@@ -3359,32 +3705,32 @@ var pin = new Command10("pin").description("Pin (or unpin) a deployment's rollba
     report(res, `${pinned ? "Pinned" : "Unpinned"} ${id}`);
   })
 );
-var cancel = new Command10("cancel").description("Cancel an in-progress deployment").argument("<id>", "Deployment ID").action(
-  run(async (id) => {
+var cancel = new Command11("cancel").description("Cancel an in-progress deployment").argument("<id>", "Deployment ID").action(
+  run2(async (id) => {
     const res = await apiRequest(`/deployments/${id}/cancel`, { method: "POST" });
     report(res, `Cancelled ${id}`);
   })
 );
-var restart = new Command10("restart").description("Restart a deployment's container").argument("<id>", "Deployment ID").action(
-  run(async (id) => {
+var restart2 = new Command11("restart").description("Restart a deployment's container").argument("<id>", "Deployment ID").action(
+  run2(async (id) => {
     const res = await apiRequest(`/deployments/${id}/restart`, { method: "POST" });
     report(res, `Restarted ${id}`);
   })
 );
-var reject = new Command10("reject").description("Reject a finished deployment awaiting a keep/reject decision").argument("<id>", "Deployment ID").action(
-  run(async (id) => {
+var reject = new Command11("reject").description("Reject a finished deployment awaiting a keep/reject decision").argument("<id>", "Deployment ID").action(
+  run2(async (id) => {
     const res = await apiRequest(`/deployments/${id}/reject`, { method: "POST" });
     report(res, `Rejected ${id}`);
   })
 );
-var keep = new Command10("keep").description("Keep a finished deployment awaiting a keep/reject decision").argument("<id>", "Deployment ID").action(
-  run(async (id) => {
+var keep = new Command11("keep").description("Keep a finished deployment awaiting a keep/reject decision").argument("<id>", "Deployment ID").action(
+  run2(async (id) => {
     const res = await apiRequest(`/deployments/${id}/keep`, { method: "POST" });
     report(res, `Kept ${id}`);
   })
 );
-var rm = new Command10("rm").description("Delete a deployment").argument("<id>", "Deployment ID").option("-y, --yes", "Skip the confirmation prompt").action(
-  run(async (id, opts) => {
+var rm = new Command11("rm").description("Delete a deployment").argument("<id>", "Deployment ID").option("-y, --yes", "Skip the confirmation prompt").action(
+  run2(async (id, opts) => {
     if (!opts.yes && !isJsonMode() && !await confirm(`Delete deployment ${id}?`)) {
       err("Aborted.");
       process.exit(1);
@@ -3393,8 +3739,8 @@ var rm = new Command10("rm").description("Delete a deployment").argument("<id>",
     report(res, `Deleted ${id}`);
   })
 );
-var sslStatus = new Command10("status").description("Check SSL certificate status for a domain").argument("<domain>", "Domain to probe").action(
-  run(async (domain) => {
+var sslStatus = new Command11("status").description("Check SSL certificate status for a domain").argument("<domain>", "Domain to probe").action(
+  run2(async (domain) => {
     const res = await apiRequest("/deployments/ssl/status", {
       method: "POST",
       body: JSON.stringify({ domain })
@@ -3402,8 +3748,8 @@ var sslStatus = new Command10("status").description("Check SSL certificate statu
     printJson(res);
   })
 );
-var sslRenew = new Command10("renew").description("Renew (issue) an SSL certificate for a domain").argument("<domain>", "Domain to renew").option("--www", "Also include the www subdomain").action(
-  run(async (domain, opts) => {
+var sslRenew = new Command11("renew").description("Renew (issue) an SSL certificate for a domain").argument("<domain>", "Domain to renew").option("--www", "Also include the www subdomain").action(
+  run2(async (domain, opts) => {
     const res = await apiRequest("/deployments/ssl/renew", {
       method: "POST",
       body: JSON.stringify({ domain, includeWww: opts.www === true })
@@ -3411,12 +3757,12 @@ var sslRenew = new Command10("renew").description("Renew (issue) an SSL certific
     report(res, `SSL renewal requested for ${domain}`);
   })
 );
-var ssl = new Command10("ssl").description("SSL certificate operations").addCommand(sslStatus).addCommand(sslRenew);
-var deploymentCommand = new Command10("deployment").alias("deployments").description("Manage deployments (list, inspect, redeploy, rollback, \u2026)").addCommand(list).addCommand(get).addCommand(info2).addCommand(usage).addCommand(redeploy).addCommand(rollback).addCommand(pin).addCommand(cancel).addCommand(restart).addCommand(reject).addCommand(keep).addCommand(rm).addCommand(ssl);
+var ssl = new Command11("ssl").description("SSL certificate operations").addCommand(sslStatus).addCommand(sslRenew);
+var deploymentCommand = new Command11("deployment").alias("deployments").description("Manage deployments (list, inspect, redeploy, rollback, \u2026)").addCommand(list).addCommand(get).addCommand(info2).addCommand(usage).addCommand(redeploy).addCommand(rollback).addCommand(pin).addCommand(cancel).addCommand(restart2).addCommand(reject).addCommand(keep).addCommand(rm).addCommand(ssl);
 
 // src/commands/logs.ts
-import { Command as Command11 } from "commander";
-var logsCommand = new Command11("logs").description("View or stream a deployment's logs").argument("<deploymentId>", "Deployment ID").option("-f, --follow", "Stream live logs via SSE until the deployment finishes").option("--tail <n>", "Show only the last N log lines (snapshot mode)").action(async (deploymentId, opts) => {
+import { Command as Command12 } from "commander";
+var logsCommand = new Command12("logs").description("View or stream a deployment's logs").argument("<deploymentId>", "Deployment ID").option("-f, --follow", "Stream live logs via SSE until the deployment finishes").option("--tail <n>", "Show only the last N log lines (snapshot mode)").action(async (deploymentId, opts) => {
   if (opts.follow) {
     try {
       const result = await streamDeploymentLogs(deploymentId);
@@ -3448,8 +3794,8 @@ var logsCommand = new Command11("logs").description("View or stream a deployment
 });
 
 // src/commands/project.ts
-import { Command as Command12 } from "commander";
-import chalk8 from "chalk";
+import { Command as Command13 } from "commander";
+import chalk9 from "chalk";
 import { createInterface as createInterface4 } from "readline/promises";
 import { stdin as input3, stdout as output3 } from "process";
 function action(fn) {
@@ -3480,12 +3826,12 @@ function printProject(project) {
   ];
   for (const [k, v] of fields) {
     if (v === null || v === void 0 || v === "") continue;
-    process.stdout.write(`  ${chalk8.dim(k.padEnd(12))} ${String(v)}
+    process.stdout.write(`  ${chalk9.dim(k.padEnd(12))} ${String(v)}
 `);
   }
 }
 var ENVIRONMENTS = ["production", "preview", "development"];
-var listCmd2 = new Command12("list").alias("ls").description("List projects in the active organization").action(
+var listCmd2 = new Command13("list").alias("ls").description("List projects in the active organization").action(
   action(async () => {
     const rows = [];
     for await (const p of paginate("/projects")) {
@@ -3500,7 +3846,7 @@ var listCmd2 = new Command12("list").alias("ls").description("List projects in t
     printTable(rows, ["id", "name", "slug", "repo", "source"]);
   })
 );
-var getCmd = new Command12("get").description("Show a single project").argument("<id>", "Project ID").action(
+var getCmd = new Command13("get").description("Show a single project").argument("<id>", "Project ID").action(
   action(async (id) => {
     const { data } = await apiRequest(
       `/projects/${encodeURIComponent(id)}`
@@ -3508,7 +3854,7 @@ var getCmd = new Command12("get").description("Show a single project").argument(
     printProject(data);
   })
 );
-var createCmd = new Command12("create").description("Create a project").requiredOption("--name <name>", "Project name").option("--slug <slug>", "Free-subdomain slug (slug.opsh.io)").option("--git-owner <owner>", "GitHub owner/org").option("--git-repo <repo>", "GitHub repository name").option("--git-branch <branch>", "Git branch to deploy").option("--framework <framework>", "Stack/framework id").option("--local-path <path>", "Local source path").option("--port <port>", "Container port", (v) => Number(v)).option(
+var createCmd = new Command13("create").description("Create a project").requiredOption("--name <name>", "Project name").option("--slug <slug>", "Free-subdomain slug (slug.opsh.io)").option("--git-owner <owner>", "GitHub owner/org").option("--git-repo <repo>", "GitHub repository name").option("--git-branch <branch>", "Git branch to deploy").option("--framework <framework>", "Stack/framework id").option("--local-path <path>", "Local source path").option("--port <port>", "Container port", (v) => Number(v)).option(
   "--type <type>",
   "Project type: app | docker | services | monorepo"
 ).action(
@@ -3532,12 +3878,12 @@ var createCmd = new Command12("create").description("Create a project").required
     printProject(data);
   })
 );
-var deleteCmd = new Command12("delete").alias("rm").description("Delete a project (tears down all resources)").argument("<id>", "Project ID").option("--force", "Cancel active work and delete anyway").option("--force-orphan", "Orphan resources that won't destroy, then drop the row").option("--wipe-volumes", "Also destroy persistent volumes").option("-y, --yes", "Skip the confirmation prompt").action(
+var deleteCmd = new Command13("delete").alias("rm").description("Delete a project (tears down all resources)").argument("<id>", "Project ID").option("--force", "Cancel active work and delete anyway").option("--force-orphan", "Orphan resources that won't destroy, then drop the row").option("--wipe-volumes", "Also destroy persistent volumes").option("-y, --yes", "Skip the confirmation prompt").action(
   action(async (id, opts) => {
     if (!opts.yes) {
       const rl = createInterface4({ input: input3, output: output3 });
       const answer = await rl.question(
-        chalk8.yellow(`  Delete project ${id}? This cannot be undone. `) + "(y/N) "
+        chalk9.yellow(`  Delete project ${id}? This cannot be undone. `) + "(y/N) "
       );
       rl.close();
       if (answer.trim().toLowerCase() !== "y") {
@@ -3563,7 +3909,7 @@ var deleteCmd = new Command12("delete").alias("rm").description("Delete a projec
 `);
   })
 );
-var envCmd = new Command12("env").description("Manage project environment variables");
+var envCmd = new Command13("env").description("Manage project environment variables");
 envCmd.command("get").description("List env vars (secret values are masked by the API)").argument("<id>", "Project ID").option("--environment <env>", "Filter by environment (production|preview|development)").action(
   action(async (id, opts) => {
     const qs = opts.environment ? `?environment=${encodeURIComponent(opts.environment)}` : "";
@@ -3637,7 +3983,7 @@ envCmd.command("set").description("Merge env vars: upsert KEY=VALUE pairs and/or
     );
   })
 );
-var gitCmd = new Command12("git").description("Manage git linkage and auto-deploy");
+var gitCmd = new Command13("git").description("Manage git linkage and auto-deploy");
 gitCmd.command("link").description("Link a GitHub repository to a project").argument("<id>", "Project ID").requiredOption("--owner <owner>", "GitHub owner/org").requiredOption("--repo <repo>", "Repository name").option("--branch <branch>", "Branch (defaults to the repo's default branch)").option("--installation-id <id>", "GitHub App installation id", (v) => Number(v)).action(
   action(async (id, opts) => {
     const result = await apiRequest(
@@ -3725,7 +4071,7 @@ gitCmd.command("webhook-domain").description("Set or clear the domain that recei
 `);
   })
 );
-var connectCmd = new Command12("connect").description("Connect a custom domain to a project").argument("<id>", "Project ID").argument("<domain>", "Custom domain hostname").option("--include-www", "Also connect the www. variant").action(
+var connectCmd = new Command13("connect").description("Connect a custom domain to a project").argument("<id>", "Project ID").argument("<domain>", "Custom domain hostname").option("--include-www", "Also connect the www. variant").action(
   action(async (id, domain, opts) => {
     const result = await apiRequest(
       `/projects/${encodeURIComponent(id)}/connect`,
@@ -3745,7 +4091,7 @@ var connectCmd = new Command12("connect").description("Connect a custom domain t
     printJson(result.records);
   })
 );
-var enableCmd = new Command12("enable").description("Start a stopped project").argument("<id>", "Project ID").action(
+var enableCmd = new Command13("enable").description("Start a stopped project").argument("<id>", "Project ID").action(
   action(async (id) => {
     const result = await apiRequest(
       `/projects/${encodeURIComponent(id)}/enable`,
@@ -3757,7 +4103,7 @@ var enableCmd = new Command12("enable").description("Start a stopped project").a
 `);
   })
 );
-var disableCmd = new Command12("disable").description("Stop a running project").argument("<id>", "Project ID").action(
+var disableCmd = new Command13("disable").description("Stop a running project").argument("<id>", "Project ID").action(
   action(async (id) => {
     const result = await apiRequest(
       `/projects/${encodeURIComponent(id)}/disable`,
@@ -3770,7 +4116,7 @@ var disableCmd = new Command12("disable").description("Stop a running project").
   })
 );
 var SLEEP_MODES = ["auto_sleep", "always_on"];
-var sleepModeCmd = new Command12("sleep-mode").description("Set the project sleep mode").argument("<id>", "Project ID").argument("<mode>", `One of: ${SLEEP_MODES.join(", ")}`).action(
+var sleepModeCmd = new Command13("sleep-mode").description("Set the project sleep mode").argument("<id>", "Project ID").argument("<mode>", `One of: ${SLEEP_MODES.join(", ")}`).action(
   action(async (id, mode) => {
     if (!SLEEP_MODES.includes(mode)) {
       err(`  mode must be one of: ${SLEEP_MODES.join(", ")}`);
@@ -3788,7 +4134,7 @@ var sleepModeCmd = new Command12("sleep-mode").description("Set the project slee
   })
 );
 var TRANSFER_DIRS = ["to-cloud", "to-self-hosted"];
-var transferCmd = new Command12("transfer").description("Promote a project to Openship Cloud, or bring it back (self-hosted only)").argument("<id>", "Project ID").argument("<direction>", `One of: ${TRANSFER_DIRS.join(", ")}`).action(
+var transferCmd = new Command13("transfer").description("Promote a project to Openship Cloud, or bring it back (self-hosted only)").argument("<id>", "Project ID").argument("<direction>", `One of: ${TRANSFER_DIRS.join(", ")}`).action(
   action(async (id, direction) => {
     if (!TRANSFER_DIRS.includes(direction)) {
       err(`  direction must be one of: ${TRANSFER_DIRS.join(", ")}`);
@@ -3811,7 +4157,7 @@ var transferCmd = new Command12("transfer").description("Promote a project to Op
     );
   })
 );
-var logsCmd = new Command12("logs").description("Show or stream runtime (container) logs").argument("<id>", "Project ID").option("--tail <n>", "Number of recent lines", (v) => Number(v)).option("-f, --follow", "Stream logs until interrupted").action(
+var logsCmd = new Command13("logs").description("Show or stream runtime (container) logs").argument("<id>", "Project ID").option("--tail <n>", "Number of recent lines", (v) => Number(v)).option("-f, --follow", "Stream logs until interrupted").action(
   action(async (id, opts) => {
     const tailQs = opts.tail ? `?tail=${opts.tail}` : "";
     if (!opts.follow) {
@@ -3839,7 +4185,7 @@ var logsCmd = new Command12("logs").description("Show or stream runtime (contain
     }
   })
 );
-var serverLogsCmd = new Command12("server-logs").description("Show or stream HTTP request logs (edge/OpenResty)").argument("<id>", "Project ID").option("--limit <n>", "Number of recent entries (max 200)", (v) => Number(v)).option("--domain <domain>", "Restrict to a specific domain").option("-f, --follow", "Stream request logs until interrupted").action(
+var serverLogsCmd = new Command13("server-logs").description("Show or stream HTTP request logs (edge/OpenResty)").argument("<id>", "Project ID").option("--limit <n>", "Number of recent entries (max 200)", (v) => Number(v)).option("--domain <domain>", "Restrict to a specific domain").option("-f, --follow", "Stream request logs until interrupted").action(
   action(async (id, opts) => {
     const base = `/projects/${encodeURIComponent(id)}/server-logs`;
     const domainQs = opts.domain ? `domain=${encodeURIComponent(opts.domain)}` : "";
@@ -3880,14 +4226,14 @@ function safeParse(s) {
   }
 }
 function printLogEntry(entry) {
-  const ts = entry.timestamp ? chalk8.dim(String(entry.timestamp)) : "";
+  const ts = entry.timestamp ? chalk9.dim(String(entry.timestamp)) : "";
   const level = String(entry.level ?? "info");
-  const color = level === "error" ? chalk8.red : level === "warn" ? chalk8.yellow : chalk8.dim;
+  const color = level === "error" ? chalk9.red : level === "warn" ? chalk9.yellow : chalk9.dim;
   const msg = entry.message ?? entry.data ?? "";
   process.stdout.write(`  ${ts} ${color(level.padEnd(5))} ${String(msg)}
 `);
 }
-var projectCommand = new Command12("project").alias("projects").description("Manage Openship projects");
+var projectCommand = new Command13("project").alias("projects").description("Manage Openship projects");
 projectCommand.addCommand(listCmd2);
 projectCommand.addCommand(getCmd);
 projectCommand.addCommand(createCmd);
@@ -3903,9 +4249,9 @@ projectCommand.addCommand(logsCmd);
 projectCommand.addCommand(serverLogsCmd);
 
 // src/commands/service.ts
-import { Command as Command13 } from "commander";
-import chalk9 from "chalk";
-import { spawnSync as spawnSync2 } from "child_process";
+import { Command as Command14 } from "commander";
+import chalk10 from "chalk";
+import { spawnSync as spawnSync3 } from "child_process";
 import path from "path";
 import { createInterface as createInterface5 } from "readline/promises";
 import { stdin as input4, stdout as output4 } from "process";
@@ -3917,14 +4263,14 @@ function requireAuth() {
 }
 function fail(e) {
   if (e instanceof ApiError) {
-    err(`  ${e.message}` + (e.status ? chalk9.dim(` (HTTP ${e.status})`) : ""));
+    err(`  ${e.message}` + (e.status ? chalk10.dim(` (HTTP ${e.status})`) : ""));
   } else {
     err(`  ${e instanceof Error ? e.message : String(e)}`);
   }
   process.exit(1);
 }
 function stackCommand(name) {
-  return new Command13(name).requiredOption(
+  return new Command14(name).requiredOption(
     "-p, --project <id|slug|name>",
     "Stack (project) id, slug, or name"
   );
@@ -4009,7 +4355,7 @@ var listCmd3 = stackCommand("list").description("List the services in a stack").
         image: s.image ?? "\u2014",
         enabled: s.enabled ? "yes" : "no",
         exposed: s.exposed ? "yes" : "no",
-        drift: s.drift ? chalk9.yellow("pending") : "\u2014"
+        drift: s.drift ? chalk10.yellow("pending") : "\u2014"
       })),
       ["name", "kind", "image", "enabled", "exposed", "drift"]
     );
@@ -4172,7 +4518,7 @@ function mapComposeService(name, def, baseDir) {
 var syncCmd = stackCommand("sync").description("Sync a stack's services from a docker-compose file (services not in the file are removed)").argument("<compose-file>", "Path to docker-compose.yml / compose.yaml").option("-y, --yes", "Skip the confirmation prompt").action(async (composeFile, opts) => {
   requireAuth();
   const abs = path.resolve(composeFile);
-  const proc = spawnSync2(
+  const proc = spawnSync3(
     "docker",
     ["compose", "-f", abs, "config", "--format", "json"],
     { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 }
@@ -4266,7 +4612,7 @@ var containersCmd = stackCommand("containers").description("List the stack's act
     fail(e);
   }
 });
-var driftCmd = new Command13("drift").description(
+var driftCmd = new Command14("drift").description(
   "Resolve compose drift on a service (upstream compose changed a value you edited)"
 );
 function driftActionCommand(action2) {
@@ -4294,7 +4640,7 @@ function driftActionCommand(action2) {
 }
 driftCmd.addCommand(driftActionCommand("accept"));
 driftCmd.addCommand(driftActionCommand("keep"));
-var envCmd2 = new Command13("env").description("Read and write a service's environment variables");
+var envCmd2 = new Command14("env").description("Read and write a service's environment variables");
 var envGetCmd = stackCommand("get").description("List a service's environment variables (secrets masked)").argument("<service>", "Service name or id").option("-e, --env <environment>", "Environment: production | preview | development").action(async (service, opts) => {
   requireAuth();
   try {
@@ -4377,8 +4723,8 @@ function printLogEntry2(entry) {
     process.stdout.write(JSON.stringify(entry) + "\n");
     return;
   }
-  const ts = entry.timestamp ? chalk9.dim(entry.timestamp) : "";
-  const line = entry.level === "error" ? chalk9.red(msg) : entry.level === "warn" ? chalk9.yellow(msg) : msg;
+  const ts = entry.timestamp ? chalk10.dim(entry.timestamp) : "";
+  const line = entry.level === "error" ? chalk10.red(msg) : entry.level === "warn" ? chalk10.yellow(msg) : msg;
   process.stdout.write(`${ts ? ts + " " : ""}${line}
 `);
 }
@@ -4427,7 +4773,7 @@ var execCmd = stackCommand("exec").description("Open an interactive shell in a s
   );
   process.exit(1);
 });
-var serviceCommand = new Command13("service").alias("services").description("Manage the services in a compose stack (a multi-service project)");
+var serviceCommand = new Command14("service").alias("services").description("Manage the services in a compose stack (a multi-service project)");
 serviceCommand.addCommand(listCmd3);
 serviceCommand.addCommand(getCmd2);
 serviceCommand.addCommand(createCmd2);
@@ -4443,15 +4789,15 @@ serviceCommand.addCommand(logsCmd2);
 serviceCommand.addCommand(execCmd);
 
 // src/commands/domain.ts
-import { Command as Command14 } from "commander";
-import chalk10 from "chalk";
+import { Command as Command15 } from "commander";
+import chalk11 from "chalk";
 import ora3 from "ora";
-function spin(text) {
-  return isJsonMode() ? null : ora3(text).start();
+function spin(text2) {
+  return isJsonMode() ? null : ora3(text2).start();
 }
 function fail2(e) {
   if (e instanceof ApiError) {
-    err(`  ${e.message}${e.status ? chalk10.dim(` (${e.status})`) : ""}`);
+    err(`  ${e.message}${e.status ? chalk11.dim(` (${e.status})`) : ""}`);
   } else {
     err(`  ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -4479,7 +4825,7 @@ function printRecords(result) {
     ["type", "host", "value"]
   );
 }
-var listCmd4 = new Command14("list").description("List a project's custom domains").requiredOption("-p, --project <id>", "Project ID to list domains for").action(async (opts) => {
+var listCmd4 = new Command15("list").description("List a project's custom domains").requiredOption("-p, --project <id>", "Project ID to list domains for").action(async (opts) => {
   try {
     const res = await apiRequest(
       `/domains?projectId=${encodeURIComponent(opts.project)}`
@@ -4494,7 +4840,7 @@ var listCmd4 = new Command14("list").description("List a project's custom domain
     fail2(e);
   }
 });
-var addCmd2 = new Command14("add").description("Add a custom domain to a project").argument("<hostname>", "Domain hostname (e.g. app.example.com)").requiredOption("-p, --project <id>", "Project ID to attach the domain to").option("--primary", "Mark this domain as the project's primary", false).action(async (hostname, opts) => {
+var addCmd2 = new Command15("add").description("Add a custom domain to a project").argument("<hostname>", "Domain hostname (e.g. app.example.com)").requiredOption("-p, --project <id>", "Project ID to attach the domain to").option("--primary", "Mark this domain as the project's primary", false).action(async (hostname, opts) => {
   const sp = spin(`Adding ${hostname}\u2026`);
   try {
     const res = await apiRequest("/domains", {
@@ -4513,7 +4859,7 @@ var addCmd2 = new Command14("add").description("Add a custom domain to a project
     fail2(e);
   }
 });
-var previewCmd = new Command14("preview").description("Preview the DNS records a hostname would need (no changes saved)").argument("<hostname>", "Domain hostname to preview").action(async (hostname) => {
+var previewCmd = new Command15("preview").description("Preview the DNS records a hostname would need (no changes saved)").argument("<hostname>", "Domain hostname to preview").action(async (hostname) => {
   try {
     const res = await apiRequest("/domains/preview", {
       method: "POST",
@@ -4524,7 +4870,7 @@ var previewCmd = new Command14("preview").description("Preview the DNS records a
     fail2(e);
   }
 });
-var verifyCmd = new Command14("verify").description("Run DNS verification for a domain").argument("<id>", "Domain ID").action(async (id) => {
+var verifyCmd = new Command15("verify").description("Run DNS verification for a domain").argument("<id>", "Domain ID").action(async (id) => {
   const sp = spin("Checking DNS records\u2026");
   try {
     const res = await apiRaw(`/domains/${encodeURIComponent(id)}/verify`, { method: "POST" });
@@ -4550,7 +4896,7 @@ var verifyCmd = new Command14("verify").description("Run DNS verification for a
     fail2(e);
   }
 });
-var primaryCmd = new Command14("primary").description("Make a domain the project's primary hostname").argument("<id>", "Domain ID").action(async (id) => {
+var primaryCmd = new Command15("primary").description("Make a domain the project's primary hostname").argument("<id>", "Domain ID").action(async (id) => {
   const sp = spin("Setting primary\u2026");
   try {
     const res = await apiRequest(`/domains/${encodeURIComponent(id)}/primary`, {
@@ -4563,7 +4909,7 @@ var primaryCmd = new Command14("primary").description("Make a domain the project
     fail2(e);
   }
 });
-var recordsCmd = new Command14("records").description("Show the DNS records for an existing domain").argument("<id>", "Domain ID").action(async (id) => {
+var recordsCmd = new Command15("records").description("Show the DNS records for an existing domain").argument("<id>", "Domain ID").action(async (id) => {
   try {
     const res = await apiRequest(`/domains/${encodeURIComponent(id)}/records`);
     printRecords(res.data);
@@ -4581,7 +4927,7 @@ function printSsl(data) {
   if (data.issuer) info(`  issuer:  ${data.issuer}`);
   if (data.expiresAt) info(`  expires: ${data.expiresAt}`);
 }
-var renewCmd = new Command14("renew").description("Renew the SSL certificate for a domain").argument("<id>", "Domain ID").action(async (id) => {
+var renewCmd = new Command15("renew").description("Renew the SSL certificate for a domain").argument("<id>", "Domain ID").action(async (id) => {
   const sp = spin("Renewing certificate\u2026");
   try {
     const res = await apiRequest(`/domains/${encodeURIComponent(id)}/renew`, {
@@ -4594,7 +4940,7 @@ var renewCmd = new Command14("renew").description("Renew the SSL certificate for
     fail2(e);
   }
 });
-var verifySslCmd = new Command14("verify-ssl").description("Recheck that a domain's SSL certificate is issued and valid (no reissue)").argument("<id>", "Domain ID").action(async (id) => {
+var verifySslCmd = new Command15("verify-ssl").description("Recheck that a domain's SSL certificate is issued and valid (no reissue)").argument("<id>", "Domain ID").action(async (id) => {
   const sp = spin("Checking certificate\u2026");
   try {
     const res = await apiRequest(`/domains/${encodeURIComponent(id)}/verify-ssl`, {
@@ -4609,7 +4955,7 @@ var verifySslCmd = new Command14("verify-ssl").description("Recheck that a domai
     fail2(e);
   }
 });
-var renewAllCmd = new Command14("renew-all").description("Renew SSL for every near-expiry domain in your organization").action(async () => {
+var renewAllCmd = new Command15("renew-all").description("Renew SSL for every near-expiry domain in your organization").action(async () => {
   const sp = spin("Renewing expiring certificates\u2026");
   try {
     const res = await apiRequest("/domains/renew-all", { method: "POST" });
@@ -4631,11 +4977,11 @@ var renewAllCmd = new Command14("renew-all").description("Renew SSL for every ne
     fail2(e);
   }
 });
-var domainCommand = new Command14("domain").description("Manage custom domains, DNS verification, and SSL certificates").addCommand(listCmd4).addCommand(addCmd2).addCommand(previewCmd).addCommand(verifyCmd).addCommand(primaryCmd).addCommand(recordsCmd).addCommand(renewCmd).addCommand(verifySslCmd).addCommand(renewAllCmd);
+var domainCommand = new Command15("domain").description("Manage custom domains, DNS verification, and SSL certificates").addCommand(listCmd4).addCommand(addCmd2).addCommand(previewCmd).addCommand(verifyCmd).addCommand(primaryCmd).addCommand(recordsCmd).addCommand(renewCmd).addCommand(verifySslCmd).addCommand(renewAllCmd);
 
 // src/commands/server.ts
-import { Command as Command15 } from "commander";
-import chalk11 from "chalk";
+import { Command as Command16 } from "commander";
+import chalk12 from "chalk";
 import ora4 from "ora";
 var INSTALLABLE = ["docker", "git", "openresty", "certbot", "rsync"];
 function guard(fn) {
@@ -4667,7 +5013,7 @@ function connBody(o) {
     sshArgs: o.sshArgs
   };
 }
-var server = new Command15("server").description("Manage self-hosted SSH servers");
+var server = new Command16("server").description("Manage self-hosted SSH servers");
 server.command("list").alias("ls").description("List servers in the active organization").action(
   guard(async () => {
     const servers = await apiRequest("/system/servers");
@@ -4705,31 +5051,31 @@ server.command("rm <id>").alias("remove").description("Delete a server").action(
 );
 server.command("test-connection").alias("test").description("Test an SSH connection without saving it").requiredOption("--host <host>", "SSH host / IP").option("--port <port>", "SSH port", "22").option("--user <user>", "SSH user", "root").option("--auth-method <method>", "Auth method (password|key|agent)").option("--password <password>", "SSH password").option("--key-path <path>", "Path to private key").option("--key-passphrase <passphrase>", "Private key passphrase").option("--jump-host <host>", "SSH jump / bastion host").option("--ssh-args <args>", "Extra raw ssh args").action(
   guard(async (o) => {
-    const spinner2 = isJsonMode() ? null : ora4(`Connecting to ${o.host}\u2026`).start();
+    const spinner3 = isJsonMode() ? null : ora4(`Connecting to ${o.host}\u2026`).start();
     try {
       const res = await apiRequest("/system/test-connection", {
         method: "POST",
         body: JSON.stringify(connBody(o))
       });
-      spinner2?.stop();
+      spinner3?.stop();
       if (isJsonMode()) return printJson(res);
       if (res.ok) return ok(`  ${res.message}`);
       err(`  ${res.message}`);
       process.exit(1);
     } catch (e) {
-      spinner2?.stop();
+      spinner3?.stop();
       throw e;
     }
   })
 );
 server.command("check <serverId>").description("Run component health checks against a saved server").option("-c, --component <name...>", "Limit to specific components").action(
   guard(async (serverId, o) => {
-    const spinner2 = isJsonMode() ? null : ora4("Checking components\u2026").start();
+    const spinner3 = isJsonMode() ? null : ora4("Checking components\u2026").start();
     const res = await apiRequest("/system/check", {
       method: "POST",
       body: JSON.stringify({ serverId, components: o.component })
     });
-    spinner2?.stop();
+    spinner3?.stop();
     if (isJsonMode()) return printJson(res);
     printTable(
       res.components.map((c) => ({
@@ -4766,8 +5112,8 @@ server.command("install <serverId>").description("Install components on a server
           printJson({ event: ev.event, ...payload });
         } else if (ev.event === "log") {
           const p = payload;
-          const line = `  ${chalk11.dim(`[${p.component}]`)} ${p.message ?? ""}`;
-          process.stderr.write((p.level === "error" ? chalk11.red(line) : line) + "\n");
+          const line = `  ${chalk12.dim(`[${p.component}]`)} ${p.message ?? ""}`;
+          process.stderr.write((p.level === "error" ? chalk12.red(line) : line) + "\n");
         } else if (ev.event === "progress") {
           const p = payload;
           if (p.component) info(`  ${p.component}: ${p.status}`);
@@ -4785,15 +5131,15 @@ server.command("install <serverId>").description("Install components on a server
     }
     const results = [];
     for (const component of components) {
-      const spinner2 = isJsonMode() ? null : ora4(`Installing ${component}\u2026`).start();
+      const spinner3 = isJsonMode() ? null : ora4(`Installing ${component}\u2026`).start();
       const res = await apiRequest(
         "/system/install",
         { method: "POST", body: JSON.stringify({ serverId, component }) }
       );
       results.push(res);
-      if (isJsonMode()) spinner2?.stop();
-      else if (res.success) spinner2?.succeed(`${component} installed${res.version ? ` (${res.version})` : ""}`);
-      else spinner2?.fail(`${component} failed: ${res.error ?? "unknown error"}`);
+      if (isJsonMode()) spinner3?.stop();
+      else if (res.success) spinner3?.succeed(`${component} installed${res.version ? ` (${res.version})` : ""}`);
+      else spinner3?.fail(`${component} failed: ${res.error ?? "unknown error"}`);
     }
     if (isJsonMode()) printJson(results);
   })
@@ -4885,9 +5231,9 @@ function fmtUptime(seconds) {
 var serverCommand = server;
 
 // src/commands/system.ts
-import { Command as Command16 } from "commander";
+import { Command as Command17 } from "commander";
 import ora5 from "ora";
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "fs";
 import { createInterface as createInterface6 } from "readline/promises";
 import { stdin as input5, stdout as output5 } from "process";
 async function guarded(fn) {
@@ -4908,8 +5254,8 @@ function report2(obj, human) {
   if (isJsonMode()) printJson(obj);
   else human();
 }
-function spinner(text) {
-  return isJsonMode() ? null : ora5(text).start();
+function spinner(text2) {
+  return isJsonMode() ? null : ora5(text2).start();
 }
 async function confirm2(message, yes) {
   if (yes) return true;
@@ -4933,7 +5279,7 @@ async function promptHidden(query) {
   output5.write("\n");
   return answer;
 }
-var settingsCommand = new Command16("settings").description("Read or update instance settings");
+var settingsCommand = new Command17("settings").description("Read or update instance settings");
 settingsCommand.command("get").description("Show current instance settings").action(async () => {
   await guarded(async () => {
     const s = await apiRequest("/system/settings");
@@ -4972,7 +5318,7 @@ settingsCommand.command("set").description("Update instance-level settings").opt
 `));
   });
 });
-var onboardingCommand = new Command16("onboarding").description("First-run instance setup");
+var onboardingCommand = new Command17("onboarding").description("First-run instance setup");
 onboardingCommand.command("apply").description("Configure a fresh instance (fails once already configured)").option("--ssh-host <host>", "SSH host of the target server").option("--ssh-port <n>", "SSH port (default 22)").option("--ssh-user <user>", "SSH user (default root)").option("--ssh-auth-method <method>", "SSH auth method").option("--ssh-password <password>", "SSH password").option("--ssh-key-path <path>", "SSH private key path").option("--ssh-key-passphrase <pass>", "SSH key passphrase").option("--ssh-jump-host <host>", "SSH jump host").option("--ssh-args <args>", "Extra SSH args").option("--server-name <name>", "Display name for the server").option("--auth-mode <mode>", "Initial auth mode: none | local | cloud").option("--tunnel-provider <provider>", "Tunnel provider").option("--tunnel-token <token>", "Tunnel token").option("--default-build-mode <mode>", "Default build mode").option("--default-rollback-window <n>", "Default rollback window").action(async (opts) => {
   await guarded(async () => {
     const body = {
@@ -5006,17 +5352,17 @@ onboardingCommand.command("apply").description("Configure a fresh instance (fail
     }
   });
 });
-var upgradeToAuthCommand = new Command16("upgrade-to-auth").description("Promote a zero-auth instance to email/password login").option("--name <name>", "Account display name").option("--email <email>", "Account email").option("--password <password>", "Account password (prompted if omitted)").option("--use-own-mail-server", "Warm the self-hosted mail server for auth emails").action(async (opts) => {
+var upgradeToAuthCommand = new Command17("upgrade-to-auth").description("Promote a zero-auth instance to email/password login").option("--name <name>", "Account display name").option("--email <email>", "Account email").option("--password <password>", "Account password (prompted if omitted)").option("--use-own-mail-server", "Warm the self-hosted mail server for auth emails").action(async (opts) => {
   await guarded(async () => {
     const name = opts.name;
     const email = opts.email;
-    let password = opts.password;
-    if (!password) {
+    let password2 = opts.password;
+    if (!password2) {
       if (!process.stdin.isTTY || isJsonMode()) {
         err("\n  --password is required in non-interactive mode.\n");
         process.exit(1);
       }
-      password = await promptHidden("  New password: ");
+      password2 = await promptHidden("  New password: ");
     }
     const res = await apiRequest(
       "/system/upgrade-to-auth",
@@ -5025,7 +5371,7 @@ var upgradeToAuthCommand = new Command16("upgrade-to-auth").description("Promote
         body: JSON.stringify({
           name,
           email,
-          password,
+          password: password2,
           useOwnMailServer: opts.useOwnMailServer === true
         })
       }
@@ -5035,7 +5381,7 @@ var upgradeToAuthCommand = new Command16("upgrade-to-auth").description("Promote
 `));
   });
 });
-var browseCommand = new Command16("browse").description("List directories on the instance host (defaults to home)").argument("[path]", "Directory to list").action(async (path2) => {
+var browseCommand = new Command17("browse").description("List directories on the instance host (defaults to home)").argument("[path]", "Directory to list").action(async (path2) => {
   await guarded(async () => {
     const qs = path2 ? `?path=${encodeURIComponent(path2)}` : "";
     const res = await apiRequest(`/system/browse${qs}`);
@@ -5064,7 +5410,7 @@ function buildDomain(opts) {
   err("\n  A domain is required: pass --hostname <host> or --slug <slug>.\n");
   process.exit(1);
 }
-var migrationCommand = new Command16("migration").description("Team-mode migration lifecycle");
+var migrationCommand = new Command17("migration").description("Team-mode migration lifecycle");
 migrationCommand.command("preflight").description("Read-only readiness check for the own-server migration").requiredOption("--server-id <id>", "Target server id").option("--hostname <host>", "Custom domain pointing at the server").option("--slug <slug>", "Free <slug>.opsh.io subdomain").action(async (opts) => {
   await guarded(async () => {
     const domain = buildDomain(opts);
@@ -5171,7 +5517,7 @@ migrationCommand.command("switch-back").description("Reverse migration back to s
     }
   });
 });
-var dataTransferCommand = new Command16("data-transfer").description(
+var dataTransferCommand = new Command17("data-transfer").description(
   "Whole-instance export / import (owner-only)"
 );
 dataTransferCommand.command("export").description("Export the entire instance to a JSON file").option("--passphrase <passphrase>", "Seal secrets under this passphrase").option("--out <file>", "Write the export to this file instead of stdout").action(async (opts) => {
@@ -5187,7 +5533,7 @@ dataTransferCommand.command("export").description("Export the entire instance to
       );
       spin4?.succeed("Export ready.");
       if (opts.out) {
-        writeFileSync5(opts.out, JSON.stringify(file));
+        writeFileSync6(opts.out, JSON.stringify(file));
         const tables = Object.keys(file.dump?.tables ?? {}).length;
         report2(
           { out: opts.out, tables },
@@ -5241,11 +5587,11 @@ dataTransferCommand.command("import").description("Import an instance export fil
     }
   });
 });
-var systemCommand = new Command16("system").description("Instance settings, onboarding, migration, and data transfer").addCommand(settingsCommand).addCommand(onboardingCommand).addCommand(upgradeToAuthCommand).addCommand(browseCommand).addCommand(migrationCommand).addCommand(dataTransferCommand);
+var systemCommand = new Command17("system").description("Instance settings, onboarding, migration, and data transfer").addCommand(settingsCommand).addCommand(onboardingCommand).addCommand(upgradeToAuthCommand).addCommand(browseCommand).addCommand(migrationCommand).addCommand(dataTransferCommand);
 
 // src/commands/mail.ts
-import { Command as Command17 } from "commander";
-import chalk12 from "chalk";
+import { Command as Command18 } from "commander";
+import chalk13 from "chalk";
 import ora6 from "ora";
 import { createInterface as createInterface7 } from "readline/promises";
 import { stdin as input6, stdout as output6 } from "process";
@@ -5264,8 +5610,8 @@ function guard2(fn) {
     }
   };
 }
-function spin2(text) {
-  return isJsonMode() ? null : ora6(text).start();
+function spin2(text2) {
+  return isJsonMode() ? null : ora6(text2).start();
 }
 function safeParse4(data) {
   try {
@@ -5286,7 +5632,7 @@ function printRecordsObject(records) {
   if (rows.length === 0) return info("  (no DNS records)");
   printTable(rows, ["key", "type", "host", "value"]);
 }
-var stepsCmd = new Command17("steps").description("List the mail setup steps").action(
+var stepsCmd = new Command18("steps").description("List the mail setup steps").action(
   guard2(async () => {
     const res = await apiRequest(
       "/mail/steps"
@@ -5299,7 +5645,7 @@ var stepsCmd = new Command17("steps").description("List the mail setup steps").a
     info(`  ${res.total} steps total.`);
   })
 );
-var statusCmd = new Command17("status").description("Show the setup progress for a mail server").argument("[serverId]", "Mail server ID (omit for the empty welcome shell)").action(
+var statusCmd = new Command18("status").description("Show the setup progress for a mail server").argument("[serverId]", "Mail server ID (omit for the empty welcome shell)").action(
   guard2(async (serverId) => {
     const q = serverId ? `?serverId=${encodeURIComponent(serverId)}` : "";
     const res = await apiRequest(`/mail/status${q}`);
@@ -5320,7 +5666,7 @@ var statusCmd = new Command17("status").description("Show the setup progress for
     }
   })
 );
-var serversCmd = new Command17("servers").description("List every server the mail stack is installed on").action(
+var serversCmd = new Command18("servers").description("List every server the mail stack is installed on").action(
   guard2(async () => {
     const res = await apiRequest(
       "/mail/servers"
@@ -5341,7 +5687,7 @@ var serversCmd = new Command17("servers").description("List every server the mai
     );
   })
 );
-var scanCmd = new Command17("scan").description("Probe a server for an existing mail install (read-only)").argument("<serverId>", "Server ID to scan").action(
+var scanCmd = new Command18("scan").description("Probe a server for an existing mail install (read-only)").argument("<serverId>", "Server ID to scan").action(
   guard2(async (serverId) => {
     const sp = spin2("Scanning server\u2026");
     const res = await apiRequest("/mail/scan", { method: "POST", body: JSON.stringify({ serverId }) });
@@ -5356,7 +5702,7 @@ var scanCmd = new Command17("scan").description("Probe a server for an existing
     else info("  Nothing to adopt on this server.");
   })
 );
-var adoptCmd = new Command17("adopt").description("Re-adopt an existing mail install whose orchestrator state was lost").argument("<serverId>", "Server ID to adopt").action(
+var adoptCmd = new Command18("adopt").description("Re-adopt an existing mail install whose orchestrator state was lost").argument("<serverId>", "Server ID to adopt").action(
   guard2(async (serverId) => {
     const sp = spin2("Adopting mail server\u2026");
     const res = await apiRequest(
@@ -5369,7 +5715,7 @@ var adoptCmd = new Command17("adopt").description("Re-adopt an existing mail ins
     info(`  completed: ${res.completed ? "yes" : "no"}`);
   })
 );
-var setupCmd = new Command17("setup").description("Start or resume the mail setup wizard (streams over SSE)").argument("<serverId>", "Server ID to install the mail stack on").requiredOption("-d, --domain <domain>", "Mail domain (e.g. example.com)").option("--start-step <n>", "Resume from a specific step (1-13)").option("--config <json>", "iRedMail config overrides as a JSON object").action(
+var setupCmd = new Command18("setup").description("Start or resume the mail setup wizard (streams over SSE)").argument("<serverId>", "Server ID to install the mail stack on").requiredOption("-d, --domain <domain>", "Mail domain (e.g. example.com)").option("--start-step <n>", "Resume from a specific step (1-13)").option("--config <json>", "iRedMail config overrides as a JSON object").action(
   guard2(async (serverId, opts) => {
     let config;
     if (opts.config) {
@@ -5402,7 +5748,7 @@ var setupCmd = new Command17("setup").description("Start or resume the mail setu
           break;
         case "log": {
           const line = `    ${String(p.message ?? "")}`;
-          process.stderr.write((p.level === "error" ? chalk12.red(line) : chalk12.dim(line)) + "\n");
+          process.stderr.write((p.level === "error" ? chalk13.red(line) : chalk13.dim(line)) + "\n");
           break;
         }
         case "step_done":
@@ -5438,7 +5784,7 @@ var setupCmd = new Command17("setup").description("Start or resume the mail setu
     if (failed) process.exit(1);
   })
 );
-var cancelCmd = new Command17("cancel").description("Cancel the mail setup currently running").action(
+var cancelCmd = new Command18("cancel").description("Cancel the mail setup currently running").action(
   guard2(async () => {
     const res = await apiRequest("/mail/setup/cancel", {
       method: "POST"
@@ -5448,7 +5794,7 @@ var cancelCmd = new Command17("cancel").description("Cancel the mail setup curre
   })
 );
 function ackCommand(name, path2, description, successMsg) {
-  return new Command17(name).description(description).argument("<serverId>", "Mail server ID").action(
+  return new Command18(name).description(description).argument("<serverId>", "Mail server ID").action(
     guard2(async (serverId) => {
       const res = await apiRequest(path2, {
         method: "POST",
@@ -5471,7 +5817,7 @@ var ptrAckCmd = ackCommand(
   "Acknowledge that reverse DNS (PTR) is configured",
   "PTR acknowledged. Re-run `mail setup` with --start-step to continue."
 );
-var resetCmd = new Command17("reset").description("Wipe the on-server setup state file (does NOT touch installed daemons)").argument("<serverId>", "Mail server ID").option("-y, --yes", "Skip the confirmation prompt").action(
+var resetCmd = new Command18("reset").description("Wipe the on-server setup state file (does NOT touch installed daemons)").argument("<serverId>", "Mail server ID").option("-y, --yes", "Skip the confirmation prompt").action(
   guard2(async (serverId, opts) => {
     if (!opts.yes && !isJsonMode()) {
       const rl = createInterface7({ input: input6, output: output6 });
@@ -5487,7 +5833,7 @@ var resetCmd = new Command17("reset").description("Wipe the on-server setup stat
     ok("  Setup state reset.");
   })
 );
-var forgetCmd = new Command17("forget").description("Stop managing a mail server (drops the DB row; leaves the stack + state intact)").argument("<serverId>", "Mail server ID").action(
+var forgetCmd = new Command18("forget").description("Stop managing a mail server (drops the DB row; leaves the stack + state intact)").argument("<serverId>", "Mail server ID").action(
   guard2(async (serverId) => {
     const res = await apiRequest(`/mail/servers/${encodeURIComponent(serverId)}`, {
       method: "DELETE"
@@ -5496,7 +5842,7 @@ var forgetCmd = new Command17("forget").description("Stop managing a mail server
     ok(`  Forgot mail server ${serverId} (re-adopt with \`mail scan\` + \`mail adopt\`).`);
   })
 );
-var healthCmd = new Command17("health").description("Show live status of every mail daemon").argument("<serverId>", "Mail server ID").action(
+var healthCmd = new Command18("health").description("Show live status of every mail daemon").argument("<serverId>", "Mail server ID").action(
   guard2(async (serverId) => {
     const sp = spin2("Checking mail daemons\u2026");
     const res = await apiRequest(`/mail/health/${encodeURIComponent(serverId)}`);
@@ -5513,7 +5859,7 @@ var healthCmd = new Command17("health").description("Show live status of every m
     );
   })
 );
-var logsCmd3 = new Command17("logs").description("Tail a mail component's journal (snapshot)").argument("<serverId>", "Mail server ID").argument("<component>", "Component key (postfix|dovecot|amavis|clamav|iredapd|postgresql|\u2026)").option("-n, --lines <n>", "Number of lines (max 1000)", "200").action(
+var logsCmd3 = new Command18("logs").description("Tail a mail component's journal (snapshot)").argument("<serverId>", "Mail server ID").argument("<component>", "Component key (postfix|dovecot|amavis|clamav|iredapd|postgresql|\u2026)").option("-n, --lines <n>", "Number of lines (max 1000)", "200").action(
   guard2(async (serverId, component, opts) => {
     const res = await apiRequest(
       `/mail/admin/${encodeURIComponent(serverId)}/components/${encodeURIComponent(component)}/logs?lines=${encodeURIComponent(opts.lines)}`
@@ -5523,38 +5869,38 @@ var logsCmd3 = new Command17("logs").description("Tail a mail component's journa
     for (const line of res.lines) process.stdout.write(line + "\n");
   })
 );
-var postmasterCmd = new Command17("postmaster").description("Manage the postmaster mailbox");
+var postmasterCmd = new Command18("postmaster").description("Manage the postmaster mailbox");
 postmasterCmd.addCommand(
-  new Command17("set-password").description("Rotate the postmaster password").argument("<serverId>", "Mail server ID").option("--password <password>", "New password (min 12 chars); prompted if omitted").action(
+  new Command18("set-password").description("Rotate the postmaster password").argument("<serverId>", "Mail server ID").option("--password <password>", "New password (min 12 chars); prompted if omitted").action(
     guard2(async (serverId, opts) => {
-      let password = opts.password;
-      if (!password) {
+      let password2 = opts.password;
+      if (!password2) {
         if (isJsonMode()) {
           err("  --password is required in JSON mode.");
           process.exit(1);
         }
         const rl = createInterface7({ input: input6, output: output6 });
-        password = (await rl.question("  New postmaster password (min 12 chars): ")).trim();
+        password2 = (await rl.question("  New postmaster password (min 12 chars): ")).trim();
         rl.close();
       }
-      if (!password || password.length < 12) {
+      if (!password2 || password2.length < 12) {
         err("  Password must be at least 12 characters.");
         process.exit(1);
       }
       const sp = spin2("Updating postmaster password\u2026");
       const res = await apiRequest("/mail/credentials/postmaster", {
         method: "POST",
-        body: JSON.stringify({ serverId, password })
+        body: JSON.stringify({ serverId, password: password2 })
       });
       sp?.succeed("Postmaster password updated.");
       if (isJsonMode()) printJson(res);
     })
   )
 );
-var mailCommand = new Command17("mail").description("Self-hosted mail server (iRedMail) setup and admin [self-host]").addCommand(stepsCmd).addCommand(statusCmd).addCommand(serversCmd).addCommand(scanCmd).addCommand(adoptCmd).addCommand(setupCmd).addCommand(cancelCmd).addCommand(dnsAckCmd).addCommand(ptrAckCmd).addCommand(resetCmd).addCommand(forgetCmd).addCommand(healthCmd).addCommand(logsCmd3).addCommand(postmasterCmd);
+var mailCommand = new Command18("mail").description("Self-hosted mail server (iRedMail) setup and admin [self-host]").addCommand(stepsCmd).addCommand(statusCmd).addCommand(serversCmd).addCommand(scanCmd).addCommand(adoptCmd).addCommand(setupCmd).addCommand(cancelCmd).addCommand(dnsAckCmd).addCommand(ptrAckCmd).addCommand(resetCmd).addCommand(forgetCmd).addCommand(healthCmd).addCommand(logsCmd3).addCommand(postmasterCmd);
 
 // src/commands/backup.ts
-import { Command as Command18 } from "commander";
+import { Command as Command19 } from "commander";
 import ora7 from "ora";
 import { readFileSync as readFileSync6 } from "fs";
 async function guard3(fn) {
@@ -5600,7 +5946,7 @@ function fmtBytes2(n) {
   return `${v.toFixed(i === 0 ? 0 : 1)}${units[i]}`;
 }
 async function followStream(path2, label) {
-  const spinner2 = isJsonMode() ? null : ora7(`${label}: connecting\u2026`).start();
+  const spinner3 = isJsonMode() ? null : ora7(`${label}: connecting\u2026`).start();
   let status = "unknown";
   try {
     for await (const ev of sseRequest(path2)) {
@@ -5615,31 +5961,31 @@ async function followStream(path2, label) {
       if (type === "snapshot") {
         const rec = payload.run ?? payload.restore;
         status = rec?.status ?? status;
-        if (spinner2) spinner2.text = `${label}: ${status}`;
+        if (spinner3) spinner3.text = `${label}: ${status}`;
       } else if (type === "transition") {
         status = payload.status ?? status;
         const bytes = payload.bytesTransferred ?? payload.bytesRestored;
-        if (spinner2) spinner2.text = `${label}: ${status}${bytes ? ` (${fmtBytes2(bytes)})` : ""}`;
+        if (spinner3) spinner3.text = `${label}: ${status}${bytes ? ` (${fmtBytes2(bytes)})` : ""}`;
       } else if (type === "progress") {
         const artifact = payload.currentArtifact ?? "working";
         const bytes = payload.bytesTransferred;
-        if (spinner2) spinner2.text = `${label}: ${artifact} ${fmtBytes2(bytes)}`.trimEnd();
+        if (spinner3) spinner3.text = `${label}: ${artifact} ${fmtBytes2(bytes)}`.trimEnd();
       } else if (type === "complete") {
         status = payload.status ?? status;
         const errMsg = payload.errorMessage;
-        if (status === "succeeded") spinner2?.succeed(`${label} succeeded`);
-        else spinner2?.fail(`${label} ${status}${errMsg ? `: ${errMsg}` : ""}`);
+        if (status === "succeeded") spinner3?.succeed(`${label} succeeded`);
+        else spinner3?.fail(`${label} ${status}${errMsg ? `: ${errMsg}` : ""}`);
         break;
       }
     }
   } catch (e) {
-    spinner2?.stop();
+    spinner3?.stop();
     throw e;
   }
-  spinner2?.stop();
+  spinner3?.stop();
   return status;
 }
-var policyCmd = new Command18("policy").description("Backup policies (schedules) for a project");
+var policyCmd = new Command19("policy").description("Backup policies (schedules) for a project");
 policyCmd.command("list").description("List backup policies for a project").requiredOption("--project <id>", "Project ID").action(
   (opts) => guard3(async () => {
     const { data } = await apiRequest(
@@ -5709,7 +6055,7 @@ policyCmd.command("run").description("Trigger a policy's backup now").argument("
     }
   })
 );
-var runCmd = new Command18("run").description("Backup runs (executions)");
+var runCmd = new Command19("run").description("Backup runs (executions)");
 runCmd.command("list").description("List backup runs for a project").requiredOption("--project <id>", "Project ID").option("--service <id>", "Filter to a single service").option("--limit <n>", "Max rows (default 50)").action(
   (opts) => guard3(async () => {
     const qs = new URLSearchParams();
@@ -5785,7 +6131,7 @@ runCmd.command("restore").description("Prepare a restore from a run (stages it;
     }
   })
 );
-var restoreCmd = new Command18("restore").description("Manage staged restores");
+var restoreCmd = new Command19("restore").description("Manage staged restores");
 restoreCmd.command("apply").description("Apply a staged restore (destructive)").argument("<restoreId>", "Restore ID from `backup run restore`").requiredOption("--token <token>", "Confirmation token from prepare").option("--follow", "Stream the restore to completion").action(
   (restoreId, opts) => guard3(async () => {
     await apiRequest(
@@ -5828,7 +6174,7 @@ restoreCmd.command("get").description("Show one restore (optionally stream it)")
     show(data);
   })
 );
-var destinationCmd = new Command18("destination").description("Backup destinations (storage targets)");
+var destinationCmd = new Command19("destination").description("Backup destinations (storage targets)");
 destinationCmd.command("list").description("List backup destinations").action(
   () => guard3(async () => {
     const { data } = await apiRequest("/backup-destinations");
@@ -5884,7 +6230,7 @@ destinationCmd.command("create").description("Create a backup destination").requ
 );
 destinationCmd.command("preflight").description("Verify a destination (write + read + delete a probe object)").argument("<destinationId>", "Destination ID").action(
   (destinationId) => guard3(async () => {
-    const spinner2 = isJsonMode() ? null : ora7("Running preflight\u2026").start();
+    const spinner3 = isJsonMode() ? null : ora7("Running preflight\u2026").start();
     const { data } = await apiRequest(
       `/backup-destinations/${encodeURIComponent(destinationId)}/preflight`,
       { method: "POST", body: JSON.stringify({}) }
@@ -5893,28 +6239,28 @@ destinationCmd.command("preflight").description("Verify a destination (write + r
       printJson(data);
       return;
     }
-    if (data.ok) spinner2?.succeed("Destination reachable");
+    if (data.ok) spinner3?.succeed("Destination reachable");
     else {
-      spinner2?.fail(`Preflight failed: ${data.reason ?? "unknown"}`);
+      spinner3?.fail(`Preflight failed: ${data.reason ?? "unknown"}`);
       process.exit(1);
     }
   })
 );
-var backupCommand = new Command18("backup").description("Manage backups: policies, runs, restores, destinations").addCommand(policyCmd).addCommand(runCmd).addCommand(restoreCmd).addCommand(destinationCmd);
+var backupCommand = new Command19("backup").description("Manage backups: policies, runs, restores, destinations").addCommand(policyCmd).addCommand(runCmd).addCommand(restoreCmd).addCommand(destinationCmd);
 
 // src/commands/token.ts
-import { Command as Command19 } from "commander";
-import chalk14 from "chalk";
+import { Command as Command20 } from "commander";
+import chalk15 from "chalk";
 
 // src/lib/cmd-helpers.ts
-import chalk13 from "chalk";
+import chalk14 from "chalk";
 import ora8 from "ora";
-function spin3(text) {
-  return isJsonMode() ? null : ora8(text).start();
+function spin3(text2) {
+  return isJsonMode() ? null : ora8(text2).start();
 }
 function fail3(e) {
   if (e instanceof ApiError) {
-    err(`  ${e.message}${e.status ? chalk13.dim(` (${e.status})`) : ""}`);
+    err(`  ${e.message}${e.status ? chalk14.dim(` (${e.status})`) : ""}`);
   } else {
     err(`  ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -5931,7 +6277,7 @@ function collectGrant(value, acc) {
   acc.push({ resourceType, resourceId, permissions });
   return acc;
 }
-var listCmd5 = new Command19("list").description("List your personal access tokens").action(async () => {
+var listCmd5 = new Command20("list").description("List your personal access tokens").action(async () => {
   try {
     const res = await apiRequest("/tokens");
     const rows = res.data ?? [];
@@ -5956,7 +6302,7 @@ var listCmd5 = new Command19("list").description("List your personal access toke
     fail3(e);
   }
 });
-var createCmd3 = new Command19("create").description("Mint a new personal access token (the secret is shown once)").argument("<name>", "Human-readable token name").option("--read-only", "Reject mutation methods (POST/PUT/PATCH/DELETE)", false).option("--expires <days>", "Expire after N days (1\u2013365); omit for non-expiring", (v) => parseInt(v, 10)).option(
+var createCmd3 = new Command20("create").description("Mint a new personal access token (the secret is shown once)").argument("<name>", "Human-readable token name").option("--read-only", "Reject mutation methods (POST/PUT/PATCH/DELETE)", false).option("--expires <days>", "Expire after N days (1\u2013365); omit for non-expiring", (v) => parseInt(v, 10)).option(
   "--grant <type:id:perms>",
   "Scope the token to a resource (repeatable), e.g. project:abc123:read,write",
   collectGrant,
@@ -5981,14 +6327,14 @@ var createCmd3 = new Command19("create").description("Mint a new personal access
       return;
     }
     info("  Copy this token now \u2014 it will not be shown again:");
-    process.stdout.write(chalk14.cyan(`  ${res.data.token}
+    process.stdout.write(chalk15.cyan(`  ${res.data.token}
 `));
   } catch (e) {
     sp?.fail("Create failed");
     fail3(e);
   }
 });
-var revokeCmd = new Command19("revoke").description("Revoke one of your tokens").argument("<id>", "Token ID").action(async (id) => {
+var revokeCmd = new Command20("revoke").description("Revoke one of your tokens").argument("<id>", "Token ID").action(async (id) => {
   const sp = spin3("Revoking token\u2026");
   try {
     await apiRequest(`/tokens/${encodeURIComponent(id)}`, { method: "DELETE" });
@@ -6000,11 +6346,11 @@ var revokeCmd = new Command19("revoke").description("Revoke one of your tokens")
     fail3(e);
   }
 });
-var tokenCommand = new Command19("token").description("Manage personal access tokens").addCommand(listCmd5).addCommand(createCmd3).addCommand(revokeCmd);
+var tokenCommand = new Command20("token").description("Manage personal access tokens").addCommand(listCmd5).addCommand(createCmd3).addCommand(revokeCmd);
 
 // src/commands/api.ts
-import { Command as Command20 } from "commander";
-var apiCommand = new Command20("api").description("Make an authenticated request to any Openship API route (like `gh api`)").argument("<path>", "Path under /api, e.g. /projects or /deployments/<id>").option("-X, --method <method>", "HTTP method (defaults to GET, or POST when --data is given)").option("-d, --data <json>", "Request body as a JSON string").option("-q, --query <kv...>", "Query parameter key=value (repeatable)").action(async (path2, opts) => {
+import { Command as Command21 } from "commander";
+var apiCommand = new Command21("api").description("Make an authenticated request to any Openship API route (like `gh api`)").argument("<path>", "Path under /api, e.g. /projects or /deployments/<id>").option("-X, --method <method>", "HTTP method (defaults to GET, or POST when --data is given)").option("-d, --data <json>", "Request body as a JSON string").option("-q, --query <kv...>", "Query parameter key=value (repeatable)").action(async (path2, opts) => {
   const method = (opts.method || (opts.data ? "POST" : "GET")).toUpperCase();
   let url = path2.startsWith("/") ? path2 : `/${path2}`;
   if (opts.query?.length) {
@@ -6019,10 +6365,10 @@ var apiCommand = new Command20("api").description("Make an authenticated request
   if (opts.data) init.body = opts.data;
   try {
     const res = await apiRaw(url, init);
-    const text = await res.text();
-    let body = text;
+    const text2 = await res.text();
+    let body = text2;
     try {
-      body = JSON.parse(text);
+      body = JSON.parse(text2);
     } catch {
     }
     if (typeof body === "string") {
@@ -6038,11 +6384,11 @@ var apiCommand = new Command20("api").description("Make an authenticated request
 });
 
 // src/commands/install.ts
-import { Command as Command21 } from "commander";
-import { chmodSync as chmodSync2, existsSync as existsSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
-import { spawn as spawn2, spawnSync as spawnSync3 } from "child_process";
-import { homedir as homedir4 } from "os";
-import { join as join8 } from "path";
+import { Command as Command22 } from "commander";
+import { chmodSync as chmodSync2, existsSync as existsSync9, mkdirSync as mkdirSync7, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "fs";
+import { spawn as spawn2, spawnSync as spawnSync4 } from "child_process";
+import { homedir as homedir5 } from "os";
+import { join as join9 } from "path";
 import ora9 from "ora";
 function assetForPlatform() {
   const { platform, arch } = process;
@@ -6054,33 +6400,33 @@ function assetForPlatform() {
   throw new Error(`Unsupported platform: ${platform} (${arch})`);
 }
 function installDmg(dmg) {
-  const homeApps = join8(homedir4(), "Applications");
+  const homeApps = join9(homedir5(), "Applications");
   let dest = homeApps;
   try {
-    mkdirSync6(homeApps, { recursive: true });
+    mkdirSync7(homeApps, { recursive: true });
   } catch {
     dest = "/Applications";
   }
-  const attach = spawnSync3("hdiutil", ["attach", "-nobrowse", "-readonly", "-noverify", dmg], {
+  const attach = spawnSync4("hdiutil", ["attach", "-nobrowse", "-readonly", "-noverify", dmg], {
     encoding: "utf8"
   });
   if (attach.status !== 0) throw new Error(`hdiutil attach failed: ${attach.stderr?.trim()}`);
   const mount = (attach.stdout.match(/\/Volumes\/[^\n]*/g) ?? []).pop()?.trim();
   if (!mount) throw new Error("Could not determine the mounted volume");
-  let target = join8(dest, "Openship.app");
+  let target = join9(dest, "Openship.app");
   try {
-    const appInDmg = join8(mount, "Openship.app");
-    if (!existsSync8(appInDmg)) throw new Error("Openship.app not found in the disk image");
-    spawnSync3("rm", ["-rf", target]);
-    let copy = spawnSync3("ditto", [appInDmg, target], { encoding: "utf8" });
+    const appInDmg = join9(mount, "Openship.app");
+    if (!existsSync9(appInDmg)) throw new Error("Openship.app not found in the disk image");
+    spawnSync4("rm", ["-rf", target]);
+    let copy = spawnSync4("ditto", [appInDmg, target], { encoding: "utf8" });
     if (copy.status !== 0 && dest === homeApps) {
-      target = join8("/Applications", "Openship.app");
-      spawnSync3("rm", ["-rf", target]);
-      copy = spawnSync3("ditto", [appInDmg, target], { encoding: "utf8" });
+      target = join9("/Applications", "Openship.app");
+      spawnSync4("rm", ["-rf", target]);
+      copy = spawnSync4("ditto", [appInDmg, target], { encoding: "utf8" });
     }
     if (copy.status !== 0) throw new Error(`ditto copy failed: ${copy.stderr?.trim()}`);
   } finally {
-    spawnSync3("hdiutil", ["detach", mount, "-quiet"]);
+    spawnSync4("hdiutil", ["detach", mount, "-quiet"]);
   }
   return target;
 }
@@ -6089,10 +6435,10 @@ function installAppImage(appImage) {
   return appImage;
 }
 function installZip(zip) {
-  const localAppData = process.env.LOCALAPPDATA || join8(homedir4(), "AppData", "Local");
-  const target = join8(localAppData, "Programs", "Openship");
-  mkdirSync6(target, { recursive: true });
-  const expand = spawnSync3(
+  const localAppData = process.env.LOCALAPPDATA || join9(homedir5(), "AppData", "Local");
+  const target = join9(localAppData, "Programs", "Openship");
+  mkdirSync7(target, { recursive: true });
+  const expand = spawnSync4(
     "powershell",
     [
       "-NoProfile",
@@ -6107,7 +6453,7 @@ function installZip(zip) {
 }
 function launch(kind, target) {
   if (kind === "dmg") {
-    spawnSync3("open", [target]);
+    spawnSync4("open", [target]);
     return;
   }
   if (kind === "appimage") {
@@ -6118,11 +6464,11 @@ function launch(kind, target) {
     child.unref();
     return;
   }
-  const exe = join8(target, "Openship.exe");
-  const path2 = existsSync8(exe) ? exe : target;
-  spawnSync3("cmd", ["/c", "start", "", path2]);
+  const exe = join9(target, "Openship.exe");
+  const path2 = existsSync9(exe) ? exe : target;
+  spawnSync4("cmd", ["/c", "start", "", path2]);
 }
-var installCommand = new Command21("install").description("Download and install the Openship desktop app for this OS").option("--version <tag>", "Release tag to install (e.g. v1.2.3)").option("--latest", "Install the latest release (default)").option("--force", "Re-download even if a verified copy is cached").option("--no-verify", "Skip SHA-256 verification (allowed when no sidecar exists)").option("--no-launch", "Install without launching the app").action(async (opts) => {
+var installCommand = new Command22("install").description("Download and install the Openship desktop app for this OS").option("--version <tag>", "Release tag to install (e.g. v1.2.3)").option("--latest", "Install the latest release (default)").option("--force", "Re-download even if a verified copy is cached").option("--no-verify", "Skip SHA-256 verification (allowed when no sidecar exists)").option("--no-launch", "Install without launching the app").action(async (opts) => {
   let asset;
   try {
     asset = assetForPlatform();
@@ -6130,7 +6476,7 @@ var installCommand = new Command21("install").description("Download and install
     err(e.message);
     process.exit(1);
   }
-  const spin4 = (text) => isJsonMode() ? null : ora9(text).start();
+  const spin4 = (text2) => isJsonMode() ? null : ora9(text2).start();
   let tag;
   try {
     if (opts.version) {
@@ -6145,13 +6491,13 @@ var installCommand = new Command21("install").description("Download and install
     process.exit(1);
   }
   const dir = releaseDir(tag);
-  const assetPath = join8(dir, asset.name);
+  const assetPath = join9(dir, asset.name);
   const sidecarPath = `${assetPath}.sha256`;
   const assetUrl2 = `${RELEASES}/download/${tag}/${asset.name}`;
   const sidecarUrl = `${assetUrl2}.sha256`;
   let downloaded = false;
   let sha;
-  const cachedUsable = !opts.force && existsSync8(assetPath) && (existsSync8(sidecarPath) || opts.verify === false);
+  const cachedUsable = !opts.force && existsSync9(assetPath) && (existsSync9(sidecarPath) || opts.verify === false);
   if (cachedUsable) {
     info(`  Using cached ${asset.name} (${tag}).`);
   } else {
@@ -6173,7 +6519,7 @@ var installCommand = new Command21("install").description("Download and install
     const s2 = spin4("Verifying checksum\u2026");
     try {
       let sidecarBody;
-      if (existsSync8(sidecarPath) && !downloaded) {
+      if (existsSync9(sidecarPath) && !downloaded) {
         sidecarBody = readFileSync7(sidecarPath, "utf8");
       } else {
         sidecarBody = await fetchSidecar(sidecarUrl);
@@ -6197,8 +6543,8 @@ var installCommand = new Command21("install").description("Download and install
         err(`Expected ${expected}, got ${actual}. The download may be corrupt or tampered with.`);
         process.exit(1);
       }
-      mkdirSync6(dir, { recursive: true });
-      writeFileSync6(sidecarPath, sidecarBody);
+      mkdirSync7(dir, { recursive: true });
+      writeFileSync7(sidecarPath, sidecarBody);
       s2?.succeed("Checksum verified");
     } catch (e) {
       s2?.fail("Verification failed");
@@ -6237,15 +6583,15 @@ var installCommand = new Command21("install").description("Download and install
 });
 
 // src/commands/update.ts
-import { Command as Command22 } from "commander";
-import { spawnSync as spawnSync4 } from "child_process";
+import { Command as Command23 } from "commander";
+import { spawnSync as spawnSync5 } from "child_process";
 function detectPackageManager2(override) {
   if (override === "bun" || override === "npm") return override;
-  const hasBun = spawnSync4("bun", ["--version"], { stdio: "ignore" }).status === 0;
+  const hasBun = spawnSync5("bun", ["--version"], { stdio: "ignore" }).status === 0;
   return hasBun ? "bun" : "npm";
 }
-var updateCommand = new Command22("update").description("Update the Openship CLI + bundled server to the latest release").option("--check", "Only report the current + latest version; don't install").option("--via <manager>", "Package manager to update with: bun | npm").action(async (opts) => {
-  const current = "0.1.10";
+var updateCommand = new Command23("update").description("Update the Openship CLI + bundled server to the latest release").option("--check", "Only report the current + latest version; don't install").option("--via <manager>", "Package manager to update with: bun | npm").action(async (opts) => {
+  const current = "0.2.0";
   let latest;
   try {
     latest = (await resolveLatestTag()).replace(/^v/, "");
@@ -6273,32 +6619,35 @@ var updateCommand = new Command22("update").description("Update the Openship CLI
   const ref = `openship@${latest}`;
   const argv = pm === "bun" ? ["add", "-g", ref] : ["install", "-g", ref];
   info(`Updating v${current} \u2192 v${latest} (${cliInstallCommand(pm, latest)})...`);
-  const res = spawnSync4(pm, argv, { stdio: "inherit" });
+  const res = spawnSync5(pm, argv, { stdio: "inherit" });
   if (res.status !== 0) {
     err(`Update failed (${pm} exited ${res.status ?? "with a signal"}). Reinstall manually: ${cliInstallCommand(pm, latest)}`);
     process.exitCode = 1;
     return;
   }
+  const { restarted } = restart();
   if (isJsonMode()) {
-    printJson({ updated: true, from: current, to: latest, via: pm });
+    printJson({ updated: true, from: current, to: latest, via: pm, restarted });
+  } else if (restarted) {
+    ok(`Updated to v${latest} and restarted the service \u2014 you're on the new version.`);
   } else {
     ok(`Updated to v${latest}. Restart the server to run the new version: openship up`);
   }
 });
 
 // src/commands/cache.ts
-import { Command as Command23 } from "commander";
-import { existsSync as existsSync9, readdirSync, readFileSync as readFileSync8, rmSync as rmSync3, statSync } from "fs";
-import { join as join9 } from "path";
+import { Command as Command24 } from "commander";
+import { existsSync as existsSync10, readdirSync, readFileSync as readFileSync8, rmSync as rmSync4, statSync } from "fs";
+import { join as join10 } from "path";
 function listAssets() {
-  if (!existsSync9(RELEASES_DIR)) return [];
+  if (!existsSync10(RELEASES_DIR)) return [];
   const out = [];
   for (const tag of readdirSync(RELEASES_DIR)) {
     const dir = releaseDir(tag);
     if (!statSync(dir).isDirectory()) continue;
     for (const name of readdirSync(dir)) {
       if (name.endsWith(".sha256")) continue;
-      const path2 = join9(dir, name);
+      const path2 = join10(dir, name);
       const st = statSync(path2);
       if (!st.isFile()) continue;
       out.push({
@@ -6306,17 +6655,17 @@ function listAssets() {
         name,
         path: path2,
         size: st.size,
-        hasSidecar: existsSync9(`${path2}.sha256`)
+        hasSidecar: existsSync10(`${path2}.sha256`)
       });
     }
   }
   return out;
 }
-var pathCmd = new Command23("path").description("Print the cache directory path").action(() => {
+var pathCmd = new Command24("path").description("Print the cache directory path").action(() => {
   if (isJsonMode()) printJson({ path: CACHE_DIR });
   else process.stdout.write(CACHE_DIR + "\n");
 });
-var listCmd6 = new Command23("list").alias("ls").description("List cached release assets").action(() => {
+var listCmd6 = new Command24("list").alias("ls").description("List cached release assets").action(() => {
   const assets = listAssets();
   printTable(
     assets.map((a) => ({
@@ -6328,7 +6677,7 @@ var listCmd6 = new Command23("list").alias("ls").description("List cached releas
     ["tag", "asset", "size", "sidecar"]
   );
 });
-var verifyCmd2 = new Command23("verify").description("Re-hash cached assets and compare to their .sha256 sidecar").argument("[tag]", "Only verify assets under this release tag").action(async (tag) => {
+var verifyCmd2 = new Command24("verify").description("Re-hash cached assets and compare to their .sha256 sidecar").argument("[tag]", "Only verify assets under this release tag").action(async (tag) => {
   const assets = listAssets().filter((a) => !tag || a.tag === tag);
   const results = [];
   let bad = 0;
@@ -6351,30 +6700,478 @@ var verifyCmd2 = new Command23("verify").description("Re-hash cached assets and
   }
   if (bad > 0) process.exit(1);
 });
-var cleanCmd = new Command23("clean").description("Delete cached release assets").argument("[tag]", "Only remove this release tag (default: all)").action((tag) => {
+var cleanCmd = new Command24("clean").description("Delete cached release assets").argument("[tag]", "Only remove this release tag (default: all)").action((tag) => {
   const target = tag ? releaseDir(tag) : RELEASES_DIR;
-  if (!existsSync9(target)) {
+  if (!existsSync10(target)) {
     if (isJsonMode()) printJson({ removed: false, path: target });
     else info(`  Nothing to clean (${target}).`);
     return;
   }
-  rmSync3(target, { recursive: true, force: true });
+  rmSync4(target, { recursive: true, force: true });
   if (isJsonMode()) printJson({ removed: true, path: target });
   else ok(`
   Removed ${target}
 `);
 });
-var cacheCommand = new Command23("cache").description("Manage the local download cache (list/verify/clean/path)").action(() => {
+var cacheCommand = new Command24("cache").description("Manage the local download cache (list/verify/clean/path)").action(() => {
   err("Specify a subcommand: path | list | verify | clean");
   process.exit(1);
 }).addCommand(pathCmd).addCommand(listCmd6).addCommand(verifyCmd2).addCommand(cleanCmd);
 
+// src/commands/wizard.ts
+import chalk16 from "chalk";
+import open from "open";
+import { createServer } from "http";
+import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
+import {
+  intro,
+  outro,
+  text,
+  password,
+  select,
+  confirm as confirm3,
+  spinner as spinner2,
+  note,
+  log,
+  cancel as cancel2,
+  isCancel
+} from "@clack/prompts";
+function ensure(value) {
+  if (isCancel(value)) {
+    cancel2("Setup cancelled.");
+    process.exit(0);
+  }
+  return value;
+}
+var SLUG_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
+async function internalGet(port, path2) {
+  try {
+    const res = await fetch(`http://127.0.0.1:${port}${path2}`, {
+      headers: { "X-Internal-Token": ensureInternalToken() },
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+async function internalPost(port, path2, body) {
+  try {
+    const res = await fetch(`http://127.0.0.1:${port}${path2}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "X-Internal-Token": ensureInternalToken() },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(3e4)
+    });
+    const data = await res.json().catch(() => ({}));
+    return { ok: res.ok, data };
+  } catch (err2) {
+    return { ok: false, data: { error: err2.message } };
+  }
+}
+async function bootstrapAdmin(apiPort, admin) {
+  const { ok: ok3, data } = await internalPost(apiPort, "/api/system/bootstrap-admin", admin);
+  if (ok3) return { ok: true };
+  if (data?.error === "An admin account already exists") return { ok: true, message: "already-exists" };
+  return { ok: false, message: data?.error || "failed" };
+}
+async function waitHealthy(apiPort, seconds = 90) {
+  for (let i = 0; i < seconds; i++) {
+    await new Promise((r) => setTimeout(r, 1e3));
+    try {
+      await fetch(`http://127.0.0.1:${apiPort}/api/health`, { signal: AbortSignal.timeout(2e3) });
+      return true;
+    } catch {
+    }
+  }
+  return false;
+}
+async function detectPublicIp() {
+  for (const url of ["https://api.ipify.org", "https://ifconfig.me/ip"]) {
+    try {
+      const res = await fetch(url, { signal: AbortSignal.timeout(3e3) });
+      if (!res.ok) continue;
+      const ip = (await res.text()).trim();
+      if (/^[0-9.]+$/.test(ip) || ip.includes(":")) return ip;
+    } catch {
+    }
+  }
+  return null;
+}
+var b64url = (buf) => buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+async function connectOpenshipCloud(port) {
+  const already = await internalGet(port, "/api/system/cloud-status");
+  if (already?.connected) {
+    log.success(`Already connected to Openship Cloud${already.user?.email ? ` as ${already.user.email}` : ""}.`);
+    return true;
+  }
+  const capsEnv = await internalGet(port, "/api/health/env");
+  const cloudApiUrl = capsEnv?.cloudApiUrl;
+  if (!cloudApiUrl) {
+    log.error("Couldn't discover the Openship Cloud URL \u2014 free domain unavailable. Use a custom domain instead.");
+    return false;
+  }
+  const verifier = b64url(randomBytes2(32));
+  const challenge = b64url(createHash2("sha256").update(verifier).digest());
+  const state = b64url(randomBytes2(16));
+  const codePromise = new Promise((resolve2) => {
+    const server2 = createServer((req, res2) => {
+      const u = new URL(req.url || "/", "http://127.0.0.1");
+      if (!u.pathname.startsWith("/callback")) {
+        res2.writeHead(404).end();
+        return;
+      }
+      const code2 = u.searchParams.get("code");
+      const gotState = u.searchParams.get("state");
+      res2.writeHead(200, { "Content-Type": "text/html" }).end(
+        "<html><body style='font:16px system-ui;padding:3rem;text-align:center'><h2>Openship Cloud connected</h2><p>You can close this window and return to your terminal.</p></body></html>"
+      );
+      server2.close();
+      resolve2(code2 && gotState === state ? code2 : null);
+    });
+    server2.on("error", () => resolve2(null));
+    server2.listen(0, "127.0.0.1", () => {
+      const cbPort = server2.address().port;
+      const redirect = `http://127.0.0.1:${cbPort}/callback`;
+      const handoff = `${cloudApiUrl.replace(/\/$/, "")}/api/cloud/connect-handoff?redirect=${encodeURIComponent(redirect)}&state=${state}&code_challenge=${challenge}`;
+      note(handoff, "Open this URL to authorize (opening your browser\u2026)");
+      void open(handoff).catch(() => {
+      });
+    });
+    setTimeout(() => {
+      try {
+        server2.close();
+      } catch {
+      }
+      resolve2(null);
+    }, 3e5);
+  });
+  const s = spinner2();
+  s.start("Waiting for Openship Cloud authorization in your browser");
+  const code = await codePromise;
+  if (!code) {
+    s.stop("Openship Cloud wasn't authorized.", 1);
+    return false;
+  }
+  s.message("Linking this instance to Openship Cloud");
+  const res = await internalPost(port, "/api/system/cloud-connect", { code, codeVerifier: verifier });
+  if (!res.ok) {
+    s.stop(`Couldn't link Openship Cloud: ${res.data?.error || "failed"}`, 1);
+    return false;
+  }
+  s.stop("Connected to Openship Cloud.");
+  return true;
+}
+async function promptLocalAdmin() {
+  const name = ensure(await text({ message: "Your name", validate: (v) => v?.trim() ? void 0 : "Required" })).trim();
+  const email = ensure(
+    await text({
+      message: "Email",
+      placeholder: "you@example.com",
+      validate: (v) => v?.includes("@") ? void 0 : "Enter a valid email"
+    })
+  ).trim().toLowerCase();
+  const pw = ensure(
+    await password({ message: "Password", validate: (v) => v && v.length >= 8 ? void 0 : "At least 8 characters" })
+  );
+  ensure(await password({ message: "Confirm password", validate: (v) => v === pw ? void 0 : "Passwords don't match" }));
+  return { name, email, password: pw };
+}
+async function streamProvision(port, sessionId, s) {
+  let ok3 = false;
+  try {
+    const res = await fetch(`http://127.0.0.1:${port}/api/system/self-register/stream?id=${sessionId}`, {
+      headers: { "X-Internal-Token": ensureInternalToken() },
+      signal: AbortSignal.timeout(3e5)
+    });
+    if (!res.ok || !res.body) return false;
+    const reader = res.body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = "";
+    for (; ; ) {
+      const { value, done } = await reader.read();
+      if (done) break;
+      buffer += decoder.decode(value, { stream: true });
+      let sep;
+      while ((sep = buffer.indexOf("\n\n")) >= 0) {
+        const frame = buffer.slice(0, sep);
+        buffer = buffer.slice(sep + 2);
+        const event = /event:\s*(.*)/.exec(frame)?.[1]?.trim();
+        const dataRaw = /data:\s*([\s\S]*)/.exec(frame)?.[1]?.trim();
+        if (!event) continue;
+        if (event === "log" && dataRaw) {
+          try {
+            const d = JSON.parse(dataRaw);
+            if (d.message) s.message(String(d.message).replace(/\s+/g, " ").slice(0, 68));
+          } catch {
+          }
+        } else if (event === "complete" && dataRaw) {
+          try {
+            ok3 = JSON.parse(dataRaw).status === "completed";
+          } catch {
+          }
+        } else if (event === "end") {
+          return ok3;
+        }
+      }
+    }
+  } catch {
+    return ok3;
+  }
+  return ok3;
+}
+async function runWizard() {
+  intro(`${chalk16.bgCyan(chalk16.black(" Openship "))}${chalk16.dim(" setup")}`);
+  log.message(
+    chalk16.dim(
+      "Deploy Openship on this machine \u2014 a few questions, then it installs itself\nas a service, registers as an app, and prints the URL to log in."
+    )
+  );
+  let publicUrl;
+  let behindProxy = false;
+  let managedEdge = false;
+  let domainPlan = { type: "none" };
+  const reach = ensure(
+    await select({
+      message: "How should this instance be reachable?",
+      initialValue: "private",
+      options: [
+        { value: "private", label: "Private", hint: "this machine only (localhost)" },
+        { value: "public", label: "Public", hint: "a server / VPS, reachable from other machines" }
+      ]
+    })
+  );
+  if (reach === "public") {
+    const canManage = process.platform === "linux";
+    const domainType = ensure(
+      await select({
+        message: "How do you want a domain + HTTPS?",
+        initialValue: "free",
+        options: [
+          { value: "free", label: "Free domain", hint: "name.opsh.io via Openship Cloud \u2014 HTTPS handled for you" },
+          ...canManage ? [{ value: "custom", label: "Custom domain", hint: "your domain + free Let's Encrypt on this box" }] : [],
+          { value: "byo", label: "Bring your own", hint: "your domain, behind your own reverse proxy" }
+        ]
+      })
+    );
+    if (domainType === "free") {
+      const slug = ensure(
+        await text({
+          message: "Choose your subdomain",
+          placeholder: "my-openship",
+          validate: (v) => v && SLUG_RE.test(v.trim().toLowerCase()) ? void 0 : "Lowercase letters, digits, hyphens"
+        })
+      ).trim().toLowerCase();
+      const s2 = spinner2();
+      s2.start("Detecting this server's public IP");
+      const publicHost = await detectPublicIp();
+      s2.stop(publicHost ? `Public IP: ${chalk16.bold(publicHost)}` : "Couldn't detect the public IP automatically.");
+      publicUrl = `https://${slug}.opsh.io`;
+      behindProxy = true;
+      domainPlan = { type: "free", slug, publicHost };
+    } else if (domainType === "custom") {
+      const raw = ensure(
+        await text({
+          message: "Your domain",
+          placeholder: "ops.example.com",
+          validate: (v) => v && normalizeUrl(v) ? void 0 : "Enter a valid domain"
+        })
+      );
+      publicUrl = normalizeUrl(raw).replace(/^http:/i, "https:");
+      const hostname = new URL(publicUrl).hostname;
+      managedEdge = true;
+      behindProxy = true;
+      if (typeof process.getuid === "function" && process.getuid() !== 0) {
+        log.warn("Managed HTTPS installs OpenResty + certbot \u2014 that needs root. Re-run with sudo if it can't install.");
+      }
+      const s2 = spinner2();
+      s2.start("Detecting this server's public IP");
+      const ip = await detectPublicIp();
+      s2.stop(ip ? `Public IP: ${chalk16.bold(ip)}` : "Couldn't detect the public IP automatically.");
+      note(
+        `Add a DNS ${chalk16.bold("A record")}:
+
+  ${chalk16.cyan(hostname)}  \u2192  ${chalk16.cyan(ip ?? "<this server's public IP>")}
+
+` + chalk16.dim("HTTPS is issued automatically once DNS resolves (it retries for a couple minutes)."),
+        "DNS"
+      );
+      ensure(await confirm3({ message: "A record set? (continue either way \u2014 it retries)", initialValue: true }));
+      domainPlan = { type: "custom", hostname };
+    } else {
+      const raw = ensure(
+        await text({
+          message: "Your domain (served behind your proxy)",
+          placeholder: "ops.example.com",
+          validate: (v) => v && normalizeUrl(v) ? void 0 : "Enter a valid domain"
+        })
+      );
+      publicUrl = normalizeUrl(raw);
+      behindProxy = true;
+      if (publicUrl.startsWith("http://")) {
+        log.warn("Serving over plain HTTP sends passwords in cleartext \u2014 put HTTPS in front before real use.");
+      }
+      domainPlan = { type: "byo", hostname: new URL(publicUrl).hostname };
+    }
+  }
+  const isCloudDomain = domainPlan.type === "free";
+  const admin = isCloudDomain ? null : await promptLocalAdmin();
+  const s = spinner2();
+  s.start("Installing Openship as a service");
+  let started;
+  try {
+    started = startService(
+      { publicUrl, trustProxy: behindProxy, managedEdge, acmeEmail: managedEdge ? admin?.email : void 0 },
+      { quiet: true }
+    );
+  } catch (e) {
+    s.stop("Couldn't install the service.", 1);
+    log.error(e.message);
+    log.info("Run `openship up --foreground` to run it attached and see the error.");
+    process.exit(1);
+  }
+  s.message("Waiting for Openship to come up");
+  if (!await waitHealthy(started.port)) {
+    s.stop("Openship didn't become healthy in time.", 1);
+    log.info("Check logs: `openship logs` (or `openship up --foreground`).");
+    process.exit(1);
+  }
+  if (admin) {
+    s.message("Creating your admin account");
+    const adminRes = await bootstrapAdmin(started.port, admin);
+    if (!adminRes.ok) {
+      s.stop(`Couldn't create the admin account: ${adminRes.message}`, 1);
+      process.exit(1);
+    }
+    s.stop(
+      adminRes.message === "already-exists" ? "An admin already exists \u2014 use your existing login." : `Admin account created for ${admin.email}.`
+    );
+  } else {
+    s.stop("Openship is up.");
+  }
+  let liveUrl = publicUrl ?? `http://localhost:${started.dashPort}`;
+  const port = started.port;
+  if (domainPlan.type === "free") {
+    const linked = await connectOpenshipCloud(port);
+    if (!linked) {
+      log.warn("Openship Cloud wasn't connected \u2014 set up a local admin instead. You can add the free domain later in Settings \u2192 Cloud.");
+      const fb = await promptLocalAdmin();
+      const abr = await bootstrapAdmin(port, fb);
+      if (!abr.ok) {
+        log.error(`Couldn't create the admin account: ${abr.message}`);
+        process.exit(1);
+      }
+      await internalPost(port, "/api/system/self-register", { domainType: "byo" });
+    } else {
+      const s2 = spinner2();
+      s2.start("Registering your free domain with Openship Cloud");
+      const res = await internalPost(port, "/api/system/self-register", {
+        domainType: "free",
+        slug: domainPlan.slug,
+        publicHost: domainPlan.publicHost,
+        dashPort: Number(started.dashPort)
+      });
+      if (res.ok && res.data?.url) {
+        liveUrl = res.data.url;
+        s2.stop(`Free domain live: ${res.data.url}`);
+      } else {
+        s2.stop(`Couldn't register the free domain: ${res.data?.error || "failed"}`, 1);
+      }
+    }
+  } else if (domainPlan.type === "custom") {
+    let edgeTakeover = false;
+    let edgeMigrate = false;
+    let proceedCustom = true;
+    const pf = await internalPost(port, "/api/system/self-edge/preflight", {});
+    const status = pf.ok ? pf.data?.status : void 0;
+    const importable = pf.ok && Array.isArray(pf.data?.sites) ? pf.data.sites.length : 0;
+    if (status && !status.canProceedClean && status.occupants?.length) {
+      const owner = status.occupants.map((o) => o.command ?? `port ${o.port}`).join(", ");
+      const known = status.classification === "known";
+      const choice = ensure(
+        await select({
+          message: known ? `An existing reverse proxy (${owner}) is serving ports 80/443.` : `Ports 80/443 are in use by ${owner}, which we couldn't identify.`,
+          options: [
+            ...importable > 0 ? [{
+              value: "migrate",
+              label: `Migrate ${importable} site${importable === 1 ? "" : "s"} & take over`,
+              hint: "import the existing sites into Openship, then take 80/443"
+            }] : [],
+            {
+              value: "override",
+              label: "Stop it & take over 80/443",
+              hint: known ? "the existing sites stop being served" : "may interrupt a running service"
+            },
+            { value: "cancel", label: "Cancel \u2014 leave it running" }
+          ],
+          // Per product decision: unknown owner pre-selects takeover; a known
+          // proxy defaults to cancel so the user chooses deliberately.
+          initialValue: known ? "cancel" : "override"
+        })
+      );
+      if (choice === "cancel") proceedCustom = false;
+      else if (choice === "migrate") edgeMigrate = true;
+      else edgeTakeover = true;
+    }
+    if (!proceedCustom) {
+      log.warn(
+        "Left the existing proxy on 80/443 running. Registering Openship without managed HTTPS \u2014 front it with your proxy, or re-run setup to take over."
+      );
+      await internalPost(port, "/api/system/self-register", {
+        domainType: "byo",
+        hostname: domainPlan.hostname
+      });
+      liveUrl = `https://${domainPlan.hostname}`;
+    } else {
+      const res = await internalPost(port, "/api/system/self-register", {
+        domainType: "custom",
+        hostname: domainPlan.hostname,
+        dashPort: Number(started.dashPort),
+        acmeEmail: admin?.email,
+        edgeTakeover,
+        edgeMigrate
+      });
+      if (res.ok && res.data?.sessionId) {
+        const s2 = spinner2();
+        s2.start("Issuing HTTPS certificate (OpenResty + Let's Encrypt)");
+        const done = await streamProvision(port, res.data.sessionId, s2);
+        liveUrl = res.data.url ?? liveUrl;
+        if (done) s2.stop(`HTTPS ready: ${liveUrl}`);
+        else s2.stop("HTTPS isn't ready yet \u2014 it retries on reboot; the site serves over HTTP meanwhile.", 1);
+      } else {
+        log.warn(`Couldn't start domain provisioning: ${res.data?.error || "failed"}`);
+      }
+    }
+  } else if (domainPlan.type === "byo") {
+    const res = await internalPost(port, "/api/system/self-register", {
+      domainType: "byo",
+      hostname: domainPlan.hostname
+    });
+    if (res.ok && res.data?.url) liveUrl = res.data.url;
+  } else {
+    await internalPost(port, "/api/system/self-register", { domainType: "byo" });
+  }
+  note(
+    `${chalk16.bold(liveUrl)}
+
+` + chalk16.dim(`${admin ? `Log in as ${admin.email}` : "Log in with Openship Cloud"}. Openship now appears under your Apps, and runs as a service (restarts on boot).`),
+    "Openship is live"
+  );
+  outro(
+    domainPlan.type === "byo" ? chalk16.dim("Point your reverse proxy at the dashboard port above.") : chalk16.green("Happy shipping.")
+  );
+}
+
 // src/index.ts
-var program = new Command24();
-program.name("openship").description("Openship CLI \u2014 install, run, and manage Openship from your terminal").version("0.1.10").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
+var program = new Command25();
+program.name("openship").description("Openship CLI \u2014 install, run, and manage Openship from your terminal").version("0.2.0").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
   if (thisCommand.opts().json) setJsonMode(true);
+}).action(async () => {
+  await runWizard();
 });
 program.addCommand(upCommand);
+program.addCommand(stopCommand);
 program.addCommand(installCommand);
 program.addCommand(updateCommand);
 program.addCommand(openCommand);