openship 0.1.11 → 0.2.1

package/dist/index.js

@@ -902,11 +902,13 @@ var PLANS = {
   free: {
     id: "free",
     name: "Free",
-    description: "Get started with 500 credits per month",
+    description: "Get started for free",
     price: { monthly: 0, annual: 0 },
     stripePriceId: { monthly: null, annual: null },
-    monthlyCredits: 5e5,
-    // milli-credits
+    // Paid tiers below are `null` (price + credits) until Openship Cloud pricing
+    // is finalized — the UI renders "coming soon". Self-hosted is free and never
+    // surfaces any of these numbers.
+    monthlyCredits: null,
     oblienLimits: {
       max_workspaces: 1,
       max_vcpus: 2,
@@ -914,7 +916,6 @@ var PLANS = {
       max_disk_gb: 10
     },
     features: [
-      "500 credits/mo",
       "1 workspace",
       "Community support"
     ],
@@ -925,13 +926,13 @@ var PLANS = {
     id: "pro",
     name: "Pro",
     description: "For solo builders shipping production workloads",
-    price: { monthly: 2e3, annual: 19200 },
-    // cents (20% annual discount)
+    price: { monthly: null, annual: null },
+    // coming soon
     stripePriceId: {
       monthly: process.env.STRIPE_PRICE_PRO_MONTHLY ?? "price_pro_monthly_placeholder",
       annual: process.env.STRIPE_PRICE_PRO_ANNUAL ?? "price_pro_annual_placeholder"
     },
-    monthlyCredits: 5e6,
+    monthlyCredits: null,
     oblienLimits: {
       max_workspaces: 10,
       max_vcpus: 16,
@@ -939,7 +940,6 @@ var PLANS = {
       max_disk_gb: 100
     },
     features: [
-      "5,000 credits/mo",
       "Up to 10 workspaces",
       "Email support"
     ],
@@ -950,12 +950,13 @@ var PLANS = {
     id: "team",
     name: "Team",
     description: "For teams collaborating on shared infra",
-    price: { monthly: 5e3, annual: 48e3 },
+    price: { monthly: null, annual: null },
+    // coming soon
     stripePriceId: {
       monthly: process.env.STRIPE_PRICE_TEAM_MONTHLY ?? "price_team_monthly_placeholder",
       annual: process.env.STRIPE_PRICE_TEAM_ANNUAL ?? "price_team_annual_placeholder"
     },
-    monthlyCredits: 25e6,
+    monthlyCredits: null,
     oblienLimits: {
       max_workspaces: 50,
       max_vcpus: 64,
@@ -963,7 +964,6 @@ var PLANS = {
       max_disk_gb: 500
     },
     features: [
-      "25,000 credits/mo",
       "Up to 50 workspaces",
       "Team collaboration",
       "Priority email support"
@@ -1128,8 +1128,12 @@ var localhost = (port) => `http://localhost:${port}`;
 var LOCAL_WEB_URL = localhost(DEFAULT_PORT.web);
 var LOCAL_DASHBOARD_URL = localhost(DEFAULT_PORT.dashboard);
 var LOCAL_API_URL = localhost(DEFAULT_PORT.api);
-var CLOUD_DASHBOARD_URL = "https://app.openship.io";
-var CLOUD_API_URL = "https://api.openship.io";
+var envUrl = (key) => {
+  const v = typeof process !== "undefined" ? process.env?.[key] : void 0;
+  return v && v.trim() ? v.trim() : void 0;
+};
+var CLOUD_DASHBOARD_URL = envUrl("OPENSHIP_CLOUD_DASHBOARD_URL") ?? "https://app.openship.io";
+var CLOUD_API_URL = envUrl("OPENSHIP_CLOUD_API_URL") ?? "https://api.openship.io";
 var DASHBOARD_RUNTIME_TARGETS = {
   local: {
     dashboard: LOCAL_DASHBOARD_URL,
@@ -2230,8 +2234,8 @@ var loginCommand = new Command("login").description("Authenticate with a Persona
       chalk2.bold("\n  Openship login\n") + chalk2.dim("  Create a Personal Access Token in Settings \u2192 Personal Access Tokens,\n") + chalk2.dim("  then paste it here.\n")
     );
     try {
-      const { default: open } = await import("open");
-      await open(settingsUrl);
+      const { default: open2 } = await import("open");
+      await open2(settingsUrl);
     } catch {
     }
     console.log(
@@ -2350,8 +2354,8 @@ var openCommand = new Command3("open").description("Open the Openship dashboard
     }
   }
   try {
-    const { default: open } = await import("open");
-    await open(target);
+    const { default: open2 } = await import("open");
+    await open2(target);
     console.log(chalk4.dim(`
   Opening ${target}
 `));
@@ -2474,6 +2478,17 @@ function assetName(tag) {
   return `openship-dashboard-${tag}.tar.gz`;
 }
 async function ensureDashboard(opts = {}) {
+  const override = process.env.OPENSHIP_DASHBOARD_DIR?.trim();
+  if (override) {
+    const cwd2 = join3(override, "apps", "dashboard");
+    const entry2 = join3(cwd2, "server.js");
+    if (!existsSync2(entry2)) {
+      throw new Error(
+        `OPENSHIP_DASHBOARD_DIR=${override} but ${entry2} is missing \u2014 build the dashboard standalone first (see docs).`
+      );
+    }
+    return { tag: "local", entry: entry2, cwd: cwd2 };
+  }
   const tag = opts.tag ?? await resolveLatestTag();
   const dir = join3(DASHBOARD_CACHE, tag);
   const cwd = join3(dir, "apps", "dashboard");
@@ -2534,6 +2549,10 @@ function upArgs(flags) {
   if (flags.dashboardPort) a.push("--dashboard-port", flags.dashboardPort);
   if (flags.ui === false) a.push("--no-ui");
   if (flags.uiVersion) a.push("--ui-version", flags.uiVersion);
+  if (flags.publicUrl) a.push("--public-url", flags.publicUrl);
+  if (flags.trustProxy) a.push("--trust-proxy");
+  if (flags.managedEdge) a.push("--managed-edge");
+  if (flags.acmeEmail) a.push("--acme-email", flags.acmeEmail);
   return a;
 }
 function runArgv(flags) {
@@ -2562,10 +2581,17 @@ function hasSystemd() {
 function xmlEscape(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
+function serviceEnv() {
+  const extra = {};
+  const dashDir = process.env.OPENSHIP_DASHBOARD_DIR?.trim();
+  if (dashDir) extra.OPENSHIP_DASHBOARD_DIR = dashDir;
+  return extra;
+}
 function plist(flags) {
   const argv = runArgv(flags);
   const items = argv.map((a) => `      <string>${xmlEscape(a)}</string>`).join("\n");
   const path2 = ["/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin", join4(HOME, ".bun/bin")].join(":");
+  const extraEnv = Object.entries(serviceEnv()).map(([k, v]) => `<key>${xmlEscape(k)}</key><string>${xmlEscape(v)}</string>`).join("");
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -2580,7 +2606,7 @@ ${items}
   <key>StandardOutPath</key><string>${join4(LOG_DIR, "up.log")}</string>
   <key>StandardErrorPath</key><string>${join4(LOG_DIR, "up.err.log")}</string>
   <key>EnvironmentVariables</key>
-  <dict><key>PATH</key><string>${path2}</string></dict>
+  <dict><key>PATH</key><string>${path2}</string>${extraEnv}</dict>
 </dict>
 </plist>
 `;
@@ -2588,6 +2614,8 @@ ${items}
 function systemdUnit(flags) {
   const argv = runArgv(flags);
   const execStart = argv.map((a) => /\s/.test(a) ? `"${a}"` : a).join(" ");
+  const extraEnv = Object.entries(serviceEnv()).map(([k, v]) => `Environment=${k}=${v}
+`).join("");
   return `[Unit]
 Description=Openship control plane
 After=network-online.target
@@ -2599,7 +2627,7 @@ ExecStart=${execStart}
 Restart=always
 RestartSec=2
 Environment=NODE_ENV=production
-
+${extraEnv}
 [Install]
 WantedBy=default.target
 `;
@@ -2649,6 +2677,28 @@ function installAndStart(flags) {
     "No supported service manager found (need systemd on Linux). Run `openship up --foreground` instead, or use docker compose for always-on."
   );
 }
+function restart() {
+  const kind = detectKind();
+  if (kind === "launchd") {
+    if (!existsSync3(MAC_PLIST)) return { restarted: false, detail: "no launchd agent installed" };
+    const uid = String(process.getuid?.() ?? "");
+    const r = run("launchctl", ["kickstart", "-k", `gui/${uid}/${MAC_LABEL}`]);
+    return { restarted: r.ok, detail: r.ok ? `restarted ${MAC_LABEL}` : r.out };
+  }
+  if (kind === "systemd-user" || kind === "systemd-system") {
+    const sysArgs = kind === "systemd-user" ? ["--user"] : [];
+    const unitPath = kind === "systemd-user" ? join4(HOME, ".config/systemd/user", `${SYSTEMD_NAME}.service`) : `/etc/systemd/system/${SYSTEMD_NAME}.service`;
+    if (!existsSync3(unitPath)) return { restarted: false, detail: "no systemd unit installed" };
+    const r = run("systemctl", [...sysArgs, "restart", SYSTEMD_NAME]);
+    return { restarted: r.ok, detail: r.ok ? `restarted ${SYSTEMD_NAME}` : r.out };
+  }
+  if (kind === "schtasks") {
+    run("schtasks", ["/End", "/TN", WIN_TASK]);
+    const r = run("schtasks", ["/Run", "/TN", WIN_TASK]);
+    return { restarted: r.ok, detail: r.ok ? `restarted ${WIN_TASK}` : r.out };
+  }
+  return { restarted: false, detail: "no supported service manager" };
+}
 function stop() {
   const kind = detectKind();
   if (kind === "launchd") {
@@ -2673,6 +2723,26 @@ function stop() {
 }
 
 // src/commands/up.ts
+function normalizeUrl(raw) {
+  const value = /^https?:\/\//i.test(raw) ? raw : `https://${raw}`;
+  try {
+    const u = new URL(value);
+    return `${u.protocol}//${u.host}`;
+  } catch {
+    return null;
+  }
+}
+function normalizePublicUrl(raw) {
+  const url = normalizeUrl(raw);
+  if (!url) {
+    console.error(
+      chalk5.red(`
+  Invalid --public-url: ${raw}`) + chalk5.dim("\n  Expected something like https://ops.example.com\n")
+    );
+    process.exit(1);
+  }
+  return url;
+}
 var DIST_DIR = dirname2(fileURLToPath(import.meta.url));
 var SERVER_DIR = join5(DIST_DIR, "server");
 var OS_DIR2 = join5(homedir4(), ".openship");
@@ -2684,17 +2754,42 @@ function ensureAuthSecret() {
   writeFileSync4(path2, secret, { mode: 384 });
   return secret;
 }
-var upCommand = new Command4("up").description("Start Openship as a persistent service (boot + auto-restart); --foreground to run attached").option("--port <port>", "API port to listen on", "4000").option("--data-dir <dir>", "Directory for the embedded database").option("--dashboard-port <port>", "Dashboard port", "3001").option("--no-ui", "Run the API only \u2014 don't download/serve the dashboard").option("--ui-version <tag>", "Dashboard release tag to run (default: this CLI's version)").option("-f, --foreground", "Run attached in this terminal instead of as a background service").option("--dry-run", "Print the service definition that would be installed, then exit").action(async (opts) => {
+function ensureInternalToken() {
+  const path2 = join5(OS_DIR2, "internal-token");
+  if (existsSync4(path2)) return readFileSync2(path2, "utf8").trim();
+  mkdirSync5(OS_DIR2, { recursive: true, mode: 448 });
+  const token = randomBytes(32).toString("hex");
+  writeFileSync4(path2, token, { mode: 384 });
+  return token;
+}
+var upCommand = new Command4("up").description("Start Openship as a persistent service (boot + auto-restart); --foreground to run attached").option("--port <port>", "API port to listen on", "4000").option("--data-dir <dir>", "Directory for the embedded database").option("--dashboard-port <port>", "Dashboard port", "3001").option("--no-ui", "Run the API only \u2014 don't download/serve the dashboard").option("--ui-version <tag>", "Dashboard release tag to run (default: this CLI's version)").option("-f, --foreground", "Run attached in this terminal instead of as a background service").option("--dry-run", "Print the service definition that would be installed, then exit").option(
+  "--public-url <url>",
+  "Serve remotely at this public URL (VPS): binds the dashboard to all interfaces, proxies the API same-origin, and requires login"
+).option(
+  "--trust-proxy",
+  "Trust the X-Real-IP set by a reverse proxy in front (the proxy MUST overwrite X-Real-IP with the real client IP, e.g. `proxy_set_header X-Real-IP $remote_addr`, and the app port MUST be firewalled so only the proxy can reach it; enables per-client rate limiting)"
+).option(
+  "--managed-edge",
+  "Managed edge: install OpenResty + a free Let's Encrypt cert on this box and route --public-url's domain to the dashboard (no reverse proxy needed)"
+).option("--acme-email <email>", "Contact email for Let's Encrypt certificates (managed edge)").action(async (opts) => {
   if (opts.foreground) return runForeground(opts);
   startService(opts);
 });
-function startService(opts) {
+function startService(opts, runOpts = {}) {
+  const publicUrl = opts.publicUrl ? normalizePublicUrl(opts.publicUrl) : void 0;
+  const port = String(opts.port || "4000");
+  const dashPort = String(opts.dashboardPort || "3001");
   const flags = {
     port: opts.port,
     dataDir: opts.dataDir,
     dashboardPort: opts.dashboardPort,
     ui: opts.ui,
-    uiVersion: opts.uiVersion
+    uiVersion: opts.uiVersion,
+    publicUrl,
+    trustProxy: opts.trustProxy || opts.managedEdge,
+    // managed edge = OpenResty sets XFF
+    managedEdge: opts.managedEdge,
+    acmeEmail: opts.acmeEmail
   };
   if (opts.dryRun) {
     const p = preview(flags);
@@ -2705,19 +2800,23 @@ function startService(opts) {
 
 `) + p.content + "\n"
     );
-    return;
+    return { port, dashPort, publicUrl };
   }
   try {
     const res = installAndStart(flags);
-    const port = String(opts.port || "4000");
-    const dashPort = String(opts.dashboardPort || "3001");
-    console.log(
-      chalk5.green("\n  \u2714 Openship is running as a service.\n") + chalk5.dim(`  API:       http://localhost:${port}/api
-`) + (opts.ui !== false ? chalk5.dim(`  Dashboard: http://localhost:${dashPort}
-`) : "") + chalk5.dim(`  ${res.detail}
+    if (!runOpts.quiet) {
+      const dashboardLine = publicUrl ? chalk5.dim(`  Dashboard: ${publicUrl}  (login required)
+`) : chalk5.dim(`  Dashboard: http://localhost:${dashPort}  (login required)
+`);
+      console.log(
+        chalk5.green("\n  \u2714 Openship is running as a service.\n") + (opts.ui !== false ? dashboardLine : "") + (publicUrl ? chalk5.dim("  API is proxied through the dashboard (not exposed). Point your reverse proxy / DNS at the dashboard port.\n") : chalk5.dim(`  API:       http://localhost:${port}/api
+`)) + chalk5.dim(`  ${res.detail}
 `) + chalk5.dim("  Starts on boot and auto-restarts. Stop with `openship stop`.\n")
-    );
+      );
+    }
+    return { port, dashPort, publicUrl };
   } catch (e) {
+    if (runOpts.quiet) throw e;
     console.error(
       chalk5.red(`
   Couldn't install the service: ${e.message}
@@ -2735,26 +2834,40 @@ async function runForeground(opts) {
     process.exit(1);
   }
   const port = String(opts.port || "4000");
+  const dashPort = String(opts.dashboardPort || "3001");
+  const publicUrl = opts.publicUrl ? normalizePublicUrl(opts.publicUrl) : void 0;
+  const managedEdge = Boolean(opts.managedEdge && publicUrl);
   const dataDir = opts.dataDir || join5(OS_DIR2, "data");
   mkdirSync5(dataDir, { recursive: true });
   const env = {
     ...process.env,
     PORT: port,
     NODE_ENV: "production",
-    // desktop mode → in-process job runner (no Redis) + loopback zero-auth,
-    // so a local single-user box needs no PAT over 127.0.0.1.
+    // desktop mode → in-process job runner (no Redis).
     DEPLOY_MODE: "desktop",
     OPENSHIP_TARGET: "local",
     OPENSHIP_JOB_RUNNER: "in-process",
-    OPENSHIP_ALLOW_ZERO_AUTH: "true",
     PGLITE_DATA_DIR: dataDir,
     OPENSHIP_MIGRATIONS_DIR: join5(SERVER_DIR, "migrations"),
     OPENSHIP_PGLITE_ASSETS_DIR: join5(SERVER_DIR, "pglite"),
     BETTER_AUTH_SECRET: ensureAuthSecret()
   };
+  env.OPENSHIP_REQUIRE_AUTH = "true";
+  env.INTERNAL_TOKEN = ensureInternalToken();
+  env.OPENSHIP_API_HOST = "127.0.0.1";
+  delete env.OPENSHIP_ALLOW_ZERO_AUTH;
+  if (publicUrl) {
+    env.OPENSHIP_PUBLIC_URL = publicUrl;
+  }
+  if (opts.trustProxy || managedEdge) env.TRUST_PROXY = "true";
+  if (managedEdge) {
+    env.OPENSHIP_MANAGED_EDGE = "true";
+    env.OPENSHIP_DASHBOARD_PORT = dashPort;
+    if (opts.acmeEmail) env.OPENSHIP_ACME_EMAIL = opts.acmeEmail;
+  }
   delete env.DATABASE_URL;
   delete env.POSTGRES_URL;
-  const spinner2 = ora(`Starting Openship on http://localhost:${port} \u2026`).start();
+  const spinner3 = ora(`Starting Openship on http://localhost:${port} \u2026`).start();
   const child = spawn(process.execPath, [serverEntry], { env, stdio: ["ignore", "pipe", "pipe"] });
   let buffered = "";
   const buffer = (d) => {
@@ -2764,7 +2877,7 @@ async function runForeground(opts) {
   child.stderr.on("data", buffer);
   child.on("exit", (code) => {
     if (code && code !== 0) {
-      spinner2.fail(`Openship server exited (code ${code})`);
+      spinner3.fail(`Openship server exited (code ${code})`);
       process.stderr.write(buffered.slice(-2e3));
       process.exit(code);
     }
@@ -2783,12 +2896,12 @@ async function runForeground(opts) {
     }
   }
   if (!healthy) {
-    spinner2.fail("Openship did not become healthy in time");
+    spinner3.fail("Openship did not become healthy in time");
     process.stderr.write(buffered.slice(-2e3));
     child.kill("SIGTERM");
     process.exit(1);
   }
-  spinner2.succeed(`Openship API running at http://localhost:${port}`);
+  spinner3.succeed(`Openship API running at http://localhost:${port}`);
   const children = [child];
   const stopAll = () => {
     for (const c of children) {
@@ -2806,11 +2919,10 @@ async function runForeground(opts) {
   };
   let dashboardUrl = null;
   if (opts.ui !== false) {
-    const dashPort = String(opts.dashboardPort || "3001");
     const uiSpinner = ora("Preparing the dashboard\u2026").start();
     try {
       const bundle = await ensureDashboard({
-        tag: opts.uiVersion || `v${"0.1.11"}`,
+        tag: opts.uiVersion || `v${"0.2.1"}`,
         onProgress: (received, total) => {
           if (total) {
             uiSpinner.text = `Downloading dashboard\u2026 ${Math.round(received / total * 100)}%`;
@@ -2825,12 +2937,18 @@ async function runForeground(opts) {
           NODE_ENV: "production",
           OPENSHIP_TARGET: "local",
           PORT: dashPort,
-          HOSTNAME: "127.0.0.1",
-          // The dashboard reads this (SSR) and mirrors it into the browser as
-          // window.__OPENSHIP_API_ORIGIN__ so both target our local API. It
-          // does NOT read API_INTERNAL_URL — using that leaves it defaulting
-          // to :4000 (possibly a different instance).
-          OPENSHIP_LOCAL_API_URL: `http://127.0.0.1:${port}`
+          // Reachable remotely when public; loopback-only otherwise. Under
+          // managed edge the local OpenResty fronts the dashboard, so it stays
+          // on loopback even though there's a public URL.
+          HOSTNAME: publicUrl && !managedEdge ? "0.0.0.0" : "127.0.0.1",
+          // The dashboard's same-origin proxy (NEXT_PUBLIC_API_PROXY, baked
+          // into the release build) forwards /api/proxy/* to this address, so
+          // the browser never needs to know where the API lives. Set in every
+          // mode; loopback because the dashboard runs on the same box.
+          INTERNAL_API_URL: `http://127.0.0.1:${port}`,
+          // Public URL feeds the SSR proxy-origin resolver; local mode keeps
+          // the window.__OPENSHIP_API_ORIGIN__ fallback for direct API calls.
+          ...publicUrl ? { OPENSHIP_PUBLIC_URL: publicUrl } : { OPENSHIP_LOCAL_API_URL: `http://127.0.0.1:${port}` }
         },
         stdio: ["ignore", "pipe", "pipe"]
       });
@@ -2854,7 +2972,7 @@ async function runForeground(opts) {
         }
       }
       if (dashUp) {
-        dashboardUrl = `http://localhost:${dashPort}`;
+        dashboardUrl = publicUrl ?? `http://localhost:${dashPort}`;
         uiSpinner.succeed(`Dashboard running at ${dashboardUrl}`);
         dash.stdout.off("data", onDash);
         dash.stderr.off("data", onDash);
@@ -2873,12 +2991,20 @@ async function runForeground(opts) {
       );
     }
   }
-  console.log(
-    chalk5.dim(`  API:       http://localhost:${port}/api
-`) + (dashboardUrl ? chalk5.dim(`  Dashboard: ${dashboardUrl}
+  if (publicUrl) {
+    console.log(
+      (dashboardUrl ? chalk5.dim(`  Dashboard: ${dashboardUrl}  (login required)
+`) : "") + chalk5.dim("  API is proxied through the dashboard (bound to loopback, not exposed).\n") + chalk5.dim(`  Data:      ${dataDir}
+`) + (managedEdge ? chalk5.dim("  Managed edge (OpenResty + Let's Encrypt) fronts this box \u2014 point your domain's A record at this server's IP. Stop with Ctrl-C.\n") : chalk5.dim("  Point your reverse proxy / DNS at the dashboard port. Stop with Ctrl-C.\n"))
+    );
+  } else {
+    console.log(
+      chalk5.dim(`  API:       http://localhost:${port}/api
+`) + (dashboardUrl ? chalk5.dim(`  Dashboard: ${dashboardUrl}  (login required)
 `) : "") + chalk5.dim(`  Data:      ${dataDir}
-`) + chalk5.dim("  Local access needs no token (loopback). Stop with Ctrl-C.\n")
-  );
+`) + chalk5.dim("  Log in with your admin account (run `openship` to create one). Stop with Ctrl-C.\n")
+    );
+  }
   child.stdout.off("data", buffer);
   child.stderr.off("data", buffer);
   child.stdout.on("data", (d) => process.stdout.write(d));
@@ -3402,7 +3528,7 @@ var deployCommand = new Command10("deploy").description("Trigger a deployment fo
   let deploymentId;
   let payload;
   if (!inGitRepo && !gitOnlyFlags) {
-    const spinner2 = isJsonMode() ? null : ora2("Deploying folder").start();
+    const spinner3 = isJsonMode() ? null : ora2("Deploying folder").start();
     try {
       const result2 = await deployFolder({
         cwd: process.cwd(),
@@ -3410,14 +3536,14 @@ var deployCommand = new Command10("deploy").description("Trigger a deployment fo
         projectId: opts.project || link?.projectId,
         environment: env,
         onStep: (m) => {
-          if (spinner2) spinner2.text = m;
+          if (spinner3) spinner3.text = m;
         }
       });
       deploymentId = result2.deploymentId;
       payload = { success: true, deployment_id: result2.deploymentId, project_id: result2.projectId };
-      spinner2?.succeed(deploymentId ? `Deployment queued: ${deploymentId}` : "Deployment queued");
+      spinner3?.succeed(deploymentId ? `Deployment queued: ${deploymentId}` : "Deployment queued");
     } catch (e) {
-      spinner2?.fail("Folder deploy failed");
+      spinner3?.fail("Folder deploy failed");
       err(e instanceof ApiError ? e.message : String(e));
       process.exit(1);
     }
@@ -3439,7 +3565,7 @@ var deployCommand = new Command10("deploy").description("Trigger a deployment fo
       smartRoute: opts.smartRoute || void 0,
       refresh: opts.refresh || void 0
     };
-    const spinner2 = isJsonMode() ? null : ora2("Triggering deployment").start();
+    const spinner3 = isJsonMode() ? null : ora2("Triggering deployment").start();
     let res;
     try {
       res = await apiRequest("/deployments", {
@@ -3447,13 +3573,13 @@ var deployCommand = new Command10("deploy").description("Trigger a deployment fo
         body: JSON.stringify(body)
       });
     } catch (e) {
-      spinner2?.fail("Deployment failed to start");
+      spinner3?.fail("Deployment failed to start");
       err(e instanceof ApiError ? e.message : String(e));
       process.exit(1);
     }
     deploymentId = res.data?.deployment_id;
     payload = res.data ?? res;
-    spinner2?.succeed(deploymentId ? `Deployment queued: ${deploymentId}` : "Deployment queued");
+    spinner3?.succeed(deploymentId ? `Deployment queued: ${deploymentId}` : "Deployment queued");
   }
   if (isJsonMode() && !opts.watch) {
     printJson(payload ?? {});
@@ -3585,7 +3711,7 @@ var cancel = new Command11("cancel").description("Cancel an in-progress deployme
     report(res, `Cancelled ${id}`);
   })
 );
-var restart = new Command11("restart").description("Restart a deployment's container").argument("<id>", "Deployment ID").action(
+var restart2 = new Command11("restart").description("Restart a deployment's container").argument("<id>", "Deployment ID").action(
   run2(async (id) => {
     const res = await apiRequest(`/deployments/${id}/restart`, { method: "POST" });
     report(res, `Restarted ${id}`);
@@ -3632,7 +3758,7 @@ var sslRenew = new Command11("renew").description("Renew (issue) an SSL certific
   })
 );
 var ssl = new Command11("ssl").description("SSL certificate operations").addCommand(sslStatus).addCommand(sslRenew);
-var deploymentCommand = new Command11("deployment").alias("deployments").description("Manage deployments (list, inspect, redeploy, rollback, \u2026)").addCommand(list).addCommand(get).addCommand(info2).addCommand(usage).addCommand(redeploy).addCommand(rollback).addCommand(pin).addCommand(cancel).addCommand(restart).addCommand(reject).addCommand(keep).addCommand(rm).addCommand(ssl);
+var deploymentCommand = new Command11("deployment").alias("deployments").description("Manage deployments (list, inspect, redeploy, rollback, \u2026)").addCommand(list).addCommand(get).addCommand(info2).addCommand(usage).addCommand(redeploy).addCommand(rollback).addCommand(pin).addCommand(cancel).addCommand(restart2).addCommand(reject).addCommand(keep).addCommand(rm).addCommand(ssl);
 
 // src/commands/logs.ts
 import { Command as Command12 } from "commander";
@@ -4666,8 +4792,8 @@ serviceCommand.addCommand(execCmd);
 import { Command as Command15 } from "commander";
 import chalk11 from "chalk";
 import ora3 from "ora";
-function spin(text) {
-  return isJsonMode() ? null : ora3(text).start();
+function spin(text2) {
+  return isJsonMode() ? null : ora3(text2).start();
 }
 function fail2(e) {
   if (e instanceof ApiError) {
@@ -4925,31 +5051,31 @@ server.command("rm <id>").alias("remove").description("Delete a server").action(
 );
 server.command("test-connection").alias("test").description("Test an SSH connection without saving it").requiredOption("--host <host>", "SSH host / IP").option("--port <port>", "SSH port", "22").option("--user <user>", "SSH user", "root").option("--auth-method <method>", "Auth method (password|key|agent)").option("--password <password>", "SSH password").option("--key-path <path>", "Path to private key").option("--key-passphrase <passphrase>", "Private key passphrase").option("--jump-host <host>", "SSH jump / bastion host").option("--ssh-args <args>", "Extra raw ssh args").action(
   guard(async (o) => {
-    const spinner2 = isJsonMode() ? null : ora4(`Connecting to ${o.host}\u2026`).start();
+    const spinner3 = isJsonMode() ? null : ora4(`Connecting to ${o.host}\u2026`).start();
     try {
       const res = await apiRequest("/system/test-connection", {
         method: "POST",
         body: JSON.stringify(connBody(o))
       });
-      spinner2?.stop();
+      spinner3?.stop();
       if (isJsonMode()) return printJson(res);
       if (res.ok) return ok(`  ${res.message}`);
       err(`  ${res.message}`);
       process.exit(1);
     } catch (e) {
-      spinner2?.stop();
+      spinner3?.stop();
       throw e;
     }
   })
 );
 server.command("check <serverId>").description("Run component health checks against a saved server").option("-c, --component <name...>", "Limit to specific components").action(
   guard(async (serverId, o) => {
-    const spinner2 = isJsonMode() ? null : ora4("Checking components\u2026").start();
+    const spinner3 = isJsonMode() ? null : ora4("Checking components\u2026").start();
     const res = await apiRequest("/system/check", {
       method: "POST",
       body: JSON.stringify({ serverId, components: o.component })
     });
-    spinner2?.stop();
+    spinner3?.stop();
     if (isJsonMode()) return printJson(res);
     printTable(
       res.components.map((c) => ({
@@ -5005,15 +5131,15 @@ server.command("install <serverId>").description("Install components on a server
     }
     const results = [];
     for (const component of components) {
-      const spinner2 = isJsonMode() ? null : ora4(`Installing ${component}\u2026`).start();
+      const spinner3 = isJsonMode() ? null : ora4(`Installing ${component}\u2026`).start();
       const res = await apiRequest(
         "/system/install",
         { method: "POST", body: JSON.stringify({ serverId, component }) }
       );
       results.push(res);
-      if (isJsonMode()) spinner2?.stop();
-      else if (res.success) spinner2?.succeed(`${component} installed${res.version ? ` (${res.version})` : ""}`);
-      else spinner2?.fail(`${component} failed: ${res.error ?? "unknown error"}`);
+      if (isJsonMode()) spinner3?.stop();
+      else if (res.success) spinner3?.succeed(`${component} installed${res.version ? ` (${res.version})` : ""}`);
+      else spinner3?.fail(`${component} failed: ${res.error ?? "unknown error"}`);
     }
     if (isJsonMode()) printJson(results);
   })
@@ -5128,8 +5254,8 @@ function report2(obj, human) {
   if (isJsonMode()) printJson(obj);
   else human();
 }
-function spinner(text) {
-  return isJsonMode() ? null : ora5(text).start();
+function spinner(text2) {
+  return isJsonMode() ? null : ora5(text2).start();
 }
 async function confirm2(message, yes) {
   if (yes) return true;
@@ -5230,13 +5356,13 @@ var upgradeToAuthCommand = new Command17("upgrade-to-auth").description("Promote
   await guarded(async () => {
     const name = opts.name;
     const email = opts.email;
-    let password = opts.password;
-    if (!password) {
+    let password2 = opts.password;
+    if (!password2) {
       if (!process.stdin.isTTY || isJsonMode()) {
         err("\n  --password is required in non-interactive mode.\n");
         process.exit(1);
       }
-      password = await promptHidden("  New password: ");
+      password2 = await promptHidden("  New password: ");
     }
     const res = await apiRequest(
       "/system/upgrade-to-auth",
@@ -5245,7 +5371,7 @@ var upgradeToAuthCommand = new Command17("upgrade-to-auth").description("Promote
         body: JSON.stringify({
           name,
           email,
-          password,
+          password: password2,
           useOwnMailServer: opts.useOwnMailServer === true
         })
       }
@@ -5484,8 +5610,8 @@ function guard2(fn) {
     }
   };
 }
-function spin2(text) {
-  return isJsonMode() ? null : ora6(text).start();
+function spin2(text2) {
+  return isJsonMode() ? null : ora6(text2).start();
 }
 function safeParse4(data) {
   try {
@@ -5747,24 +5873,24 @@ var postmasterCmd = new Command18("postmaster").description("Manage the postmast
 postmasterCmd.addCommand(
   new Command18("set-password").description("Rotate the postmaster password").argument("<serverId>", "Mail server ID").option("--password <password>", "New password (min 12 chars); prompted if omitted").action(
     guard2(async (serverId, opts) => {
-      let password = opts.password;
-      if (!password) {
+      let password2 = opts.password;
+      if (!password2) {
         if (isJsonMode()) {
           err("  --password is required in JSON mode.");
           process.exit(1);
         }
         const rl = createInterface7({ input: input6, output: output6 });
-        password = (await rl.question("  New postmaster password (min 12 chars): ")).trim();
+        password2 = (await rl.question("  New postmaster password (min 12 chars): ")).trim();
         rl.close();
       }
-      if (!password || password.length < 12) {
+      if (!password2 || password2.length < 12) {
         err("  Password must be at least 12 characters.");
         process.exit(1);
       }
       const sp = spin2("Updating postmaster password\u2026");
       const res = await apiRequest("/mail/credentials/postmaster", {
         method: "POST",
-        body: JSON.stringify({ serverId, password })
+        body: JSON.stringify({ serverId, password: password2 })
       });
       sp?.succeed("Postmaster password updated.");
       if (isJsonMode()) printJson(res);
@@ -5820,7 +5946,7 @@ function fmtBytes2(n) {
   return `${v.toFixed(i === 0 ? 0 : 1)}${units[i]}`;
 }
 async function followStream(path2, label) {
-  const spinner2 = isJsonMode() ? null : ora7(`${label}: connecting\u2026`).start();
+  const spinner3 = isJsonMode() ? null : ora7(`${label}: connecting\u2026`).start();
   let status = "unknown";
   try {
     for await (const ev of sseRequest(path2)) {
@@ -5835,28 +5961,28 @@ async function followStream(path2, label) {
       if (type === "snapshot") {
         const rec = payload.run ?? payload.restore;
         status = rec?.status ?? status;
-        if (spinner2) spinner2.text = `${label}: ${status}`;
+        if (spinner3) spinner3.text = `${label}: ${status}`;
       } else if (type === "transition") {
         status = payload.status ?? status;
         const bytes = payload.bytesTransferred ?? payload.bytesRestored;
-        if (spinner2) spinner2.text = `${label}: ${status}${bytes ? ` (${fmtBytes2(bytes)})` : ""}`;
+        if (spinner3) spinner3.text = `${label}: ${status}${bytes ? ` (${fmtBytes2(bytes)})` : ""}`;
       } else if (type === "progress") {
         const artifact = payload.currentArtifact ?? "working";
         const bytes = payload.bytesTransferred;
-        if (spinner2) spinner2.text = `${label}: ${artifact} ${fmtBytes2(bytes)}`.trimEnd();
+        if (spinner3) spinner3.text = `${label}: ${artifact} ${fmtBytes2(bytes)}`.trimEnd();
       } else if (type === "complete") {
         status = payload.status ?? status;
         const errMsg = payload.errorMessage;
-        if (status === "succeeded") spinner2?.succeed(`${label} succeeded`);
-        else spinner2?.fail(`${label} ${status}${errMsg ? `: ${errMsg}` : ""}`);
+        if (status === "succeeded") spinner3?.succeed(`${label} succeeded`);
+        else spinner3?.fail(`${label} ${status}${errMsg ? `: ${errMsg}` : ""}`);
         break;
       }
     }
   } catch (e) {
-    spinner2?.stop();
+    spinner3?.stop();
     throw e;
   }
-  spinner2?.stop();
+  spinner3?.stop();
   return status;
 }
 var policyCmd = new Command19("policy").description("Backup policies (schedules) for a project");
@@ -6104,7 +6230,7 @@ destinationCmd.command("create").description("Create a backup destination").requ
 );
 destinationCmd.command("preflight").description("Verify a destination (write + read + delete a probe object)").argument("<destinationId>", "Destination ID").action(
   (destinationId) => guard3(async () => {
-    const spinner2 = isJsonMode() ? null : ora7("Running preflight\u2026").start();
+    const spinner3 = isJsonMode() ? null : ora7("Running preflight\u2026").start();
     const { data } = await apiRequest(
       `/backup-destinations/${encodeURIComponent(destinationId)}/preflight`,
       { method: "POST", body: JSON.stringify({}) }
@@ -6113,9 +6239,9 @@ destinationCmd.command("preflight").description("Verify a destination (write + r
       printJson(data);
       return;
     }
-    if (data.ok) spinner2?.succeed("Destination reachable");
+    if (data.ok) spinner3?.succeed("Destination reachable");
     else {
-      spinner2?.fail(`Preflight failed: ${data.reason ?? "unknown"}`);
+      spinner3?.fail(`Preflight failed: ${data.reason ?? "unknown"}`);
       process.exit(1);
     }
   })
@@ -6129,8 +6255,8 @@ import chalk15 from "chalk";
 // src/lib/cmd-helpers.ts
 import chalk14 from "chalk";
 import ora8 from "ora";
-function spin3(text) {
-  return isJsonMode() ? null : ora8(text).start();
+function spin3(text2) {
+  return isJsonMode() ? null : ora8(text2).start();
 }
 function fail3(e) {
   if (e instanceof ApiError) {
@@ -6239,10 +6365,10 @@ var apiCommand = new Command21("api").description("Make an authenticated request
   if (opts.data) init.body = opts.data;
   try {
     const res = await apiRaw(url, init);
-    const text = await res.text();
-    let body = text;
+    const text2 = await res.text();
+    let body = text2;
     try {
-      body = JSON.parse(text);
+      body = JSON.parse(text2);
     } catch {
     }
     if (typeof body === "string") {
@@ -6350,7 +6476,7 @@ var installCommand = new Command22("install").description("Download and install
     err(e.message);
     process.exit(1);
   }
-  const spin4 = (text) => isJsonMode() ? null : ora9(text).start();
+  const spin4 = (text2) => isJsonMode() ? null : ora9(text2).start();
   let tag;
   try {
     if (opts.version) {
@@ -6465,7 +6591,7 @@ function detectPackageManager2(override) {
   return hasBun ? "bun" : "npm";
 }
 var updateCommand = new Command23("update").description("Update the Openship CLI + bundled server to the latest release").option("--check", "Only report the current + latest version; don't install").option("--via <manager>", "Package manager to update with: bun | npm").action(async (opts) => {
-  const current = "0.1.11";
+  const current = "0.2.1";
   let latest;
   try {
     latest = (await resolveLatestTag()).replace(/^v/, "");
@@ -6499,8 +6625,11 @@ var updateCommand = new Command23("update").description("Update the Openship CLI
     process.exitCode = 1;
     return;
   }
+  const { restarted } = restart();
   if (isJsonMode()) {
-    printJson({ updated: true, from: current, to: latest, via: pm });
+    printJson({ updated: true, from: current, to: latest, via: pm, restarted });
+  } else if (restarted) {
+    ok(`Updated to v${latest} and restarted the service \u2014 you're on the new version.`);
   } else {
     ok(`Updated to v${latest}. Restart the server to run the new version: openship up`);
   }
@@ -6589,10 +6718,457 @@ var cacheCommand = new Command24("cache").description("Manage the local download
   process.exit(1);
 }).addCommand(pathCmd).addCommand(listCmd6).addCommand(verifyCmd2).addCommand(cleanCmd);
 
+// src/commands/wizard.ts
+import chalk16 from "chalk";
+import open from "open";
+import { createServer } from "http";
+import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
+import {
+  intro,
+  outro,
+  text,
+  password,
+  select,
+  confirm as confirm3,
+  spinner as spinner2,
+  note,
+  log,
+  cancel as cancel2,
+  isCancel
+} from "@clack/prompts";
+function ensure(value) {
+  if (isCancel(value)) {
+    cancel2("Setup cancelled.");
+    process.exit(0);
+  }
+  return value;
+}
+var SLUG_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
+async function internalGet(port, path2) {
+  try {
+    const res = await fetch(`http://127.0.0.1:${port}${path2}`, {
+      headers: { "X-Internal-Token": ensureInternalToken() },
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+async function internalPost(port, path2, body) {
+  try {
+    const res = await fetch(`http://127.0.0.1:${port}${path2}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "X-Internal-Token": ensureInternalToken() },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(3e4)
+    });
+    const data = await res.json().catch(() => ({}));
+    return { ok: res.ok, data };
+  } catch (err2) {
+    return { ok: false, data: { error: err2.message } };
+  }
+}
+async function bootstrapAdmin(apiPort, admin) {
+  const { ok: ok3, data } = await internalPost(apiPort, "/api/system/bootstrap-admin", admin);
+  if (ok3) return { ok: true };
+  if (data?.error === "An admin account already exists") return { ok: true, message: "already-exists" };
+  return { ok: false, message: data?.error || "failed" };
+}
+async function waitHealthy(apiPort, seconds = 90) {
+  for (let i = 0; i < seconds; i++) {
+    await new Promise((r) => setTimeout(r, 1e3));
+    try {
+      await fetch(`http://127.0.0.1:${apiPort}/api/health`, { signal: AbortSignal.timeout(2e3) });
+      return true;
+    } catch {
+    }
+  }
+  return false;
+}
+async function detectPublicIp() {
+  for (const url of ["https://api.ipify.org", "https://ifconfig.me/ip"]) {
+    try {
+      const res = await fetch(url, { signal: AbortSignal.timeout(3e3) });
+      if (!res.ok) continue;
+      const ip = (await res.text()).trim();
+      if (/^[0-9.]+$/.test(ip) || ip.includes(":")) return ip;
+    } catch {
+    }
+  }
+  return null;
+}
+var b64url = (buf) => buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+async function connectOpenshipCloud(port) {
+  const already = await internalGet(port, "/api/system/cloud-status");
+  if (already?.connected) {
+    log.success(`Already connected to Openship Cloud${already.user?.email ? ` as ${already.user.email}` : ""}.`);
+    return true;
+  }
+  const capsEnv = await internalGet(port, "/api/health/env");
+  const cloudApiUrl = capsEnv?.cloudApiUrl;
+  if (!cloudApiUrl) {
+    log.error("Couldn't discover the Openship Cloud URL \u2014 free domain unavailable. Use a custom domain instead.");
+    return false;
+  }
+  const verifier = b64url(randomBytes2(32));
+  const challenge = b64url(createHash2("sha256").update(verifier).digest());
+  const state = b64url(randomBytes2(16));
+  const codePromise = new Promise((resolve2) => {
+    const server2 = createServer((req, res2) => {
+      const u = new URL(req.url || "/", "http://127.0.0.1");
+      if (!u.pathname.startsWith("/callback")) {
+        res2.writeHead(404).end();
+        return;
+      }
+      const code2 = u.searchParams.get("code");
+      const gotState = u.searchParams.get("state");
+      res2.writeHead(200, { "Content-Type": "text/html" }).end(
+        "<html><body style='font:16px system-ui;padding:3rem;text-align:center'><h2>Openship Cloud connected</h2><p>You can close this window and return to your terminal.</p></body></html>"
+      );
+      server2.close();
+      resolve2(code2 && gotState === state ? code2 : null);
+    });
+    server2.on("error", () => resolve2(null));
+    server2.listen(0, "127.0.0.1", () => {
+      const cbPort = server2.address().port;
+      const redirect = `http://127.0.0.1:${cbPort}/callback`;
+      const handoff = `${cloudApiUrl.replace(/\/$/, "")}/api/cloud/connect-handoff?redirect=${encodeURIComponent(redirect)}&state=${state}&code_challenge=${challenge}`;
+      note(handoff, "Open this URL to authorize (opening your browser\u2026)");
+      void open(handoff).catch(() => {
+      });
+    });
+    setTimeout(() => {
+      try {
+        server2.close();
+      } catch {
+      }
+      resolve2(null);
+    }, 3e5);
+  });
+  const s = spinner2();
+  s.start("Waiting for Openship Cloud authorization in your browser");
+  const code = await codePromise;
+  if (!code) {
+    s.stop("Openship Cloud wasn't authorized.", 1);
+    return false;
+  }
+  s.message("Linking this instance to Openship Cloud");
+  const res = await internalPost(port, "/api/system/cloud-connect", { code, codeVerifier: verifier });
+  if (!res.ok) {
+    s.stop(`Couldn't link Openship Cloud: ${res.data?.error || "failed"}`, 1);
+    return false;
+  }
+  s.stop("Connected to Openship Cloud.");
+  return true;
+}
+async function promptLocalAdmin() {
+  const name = ensure(await text({ message: "Your name", validate: (v) => v?.trim() ? void 0 : "Required" })).trim();
+  const email = ensure(
+    await text({
+      message: "Email",
+      placeholder: "you@example.com",
+      validate: (v) => v?.includes("@") ? void 0 : "Enter a valid email"
+    })
+  ).trim().toLowerCase();
+  const pw = ensure(
+    await password({ message: "Password", validate: (v) => v && v.length >= 8 ? void 0 : "At least 8 characters" })
+  );
+  ensure(await password({ message: "Confirm password", validate: (v) => v === pw ? void 0 : "Passwords don't match" }));
+  return { name, email, password: pw };
+}
+async function streamProvision(port, sessionId, s) {
+  let ok3 = false;
+  try {
+    const res = await fetch(`http://127.0.0.1:${port}/api/system/self-register/stream?id=${sessionId}`, {
+      headers: { "X-Internal-Token": ensureInternalToken() },
+      signal: AbortSignal.timeout(3e5)
+    });
+    if (!res.ok || !res.body) return false;
+    const reader = res.body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = "";
+    for (; ; ) {
+      const { value, done } = await reader.read();
+      if (done) break;
+      buffer += decoder.decode(value, { stream: true });
+      let sep;
+      while ((sep = buffer.indexOf("\n\n")) >= 0) {
+        const frame = buffer.slice(0, sep);
+        buffer = buffer.slice(sep + 2);
+        const event = /event:\s*(.*)/.exec(frame)?.[1]?.trim();
+        const dataRaw = /data:\s*([\s\S]*)/.exec(frame)?.[1]?.trim();
+        if (!event) continue;
+        if (event === "log" && dataRaw) {
+          try {
+            const d = JSON.parse(dataRaw);
+            if (d.message) s.message(String(d.message).replace(/\s+/g, " ").slice(0, 68));
+          } catch {
+          }
+        } else if (event === "complete" && dataRaw) {
+          try {
+            ok3 = JSON.parse(dataRaw).status === "completed";
+          } catch {
+          }
+        } else if (event === "end") {
+          return ok3;
+        }
+      }
+    }
+  } catch {
+    return ok3;
+  }
+  return ok3;
+}
+async function runWizard() {
+  intro(`${chalk16.bgCyan(chalk16.black(" Openship "))}${chalk16.dim(" setup")}`);
+  log.message(
+    chalk16.dim(
+      "Deploy Openship on this machine \u2014 a few questions, then it installs itself\nas a service, registers as an app, and prints the URL to log in."
+    )
+  );
+  let publicUrl;
+  let behindProxy = false;
+  let managedEdge = false;
+  let domainPlan = { type: "none" };
+  const reach = ensure(
+    await select({
+      message: "How should this instance be reachable?",
+      initialValue: "private",
+      options: [
+        { value: "private", label: "Private", hint: "this machine only (localhost)" },
+        { value: "public", label: "Public", hint: "a server / VPS, reachable from other machines" }
+      ]
+    })
+  );
+  if (reach === "public") {
+    const canManage = process.platform === "linux";
+    const domainType = ensure(
+      await select({
+        message: "How do you want a domain + HTTPS?",
+        initialValue: "free",
+        options: [
+          { value: "free", label: "Free domain", hint: "name.opsh.io via Openship Cloud \u2014 HTTPS handled for you" },
+          ...canManage ? [{ value: "custom", label: "Custom domain", hint: "your domain + free Let's Encrypt on this box" }] : [],
+          { value: "byo", label: "Bring your own", hint: "your domain, behind your own reverse proxy" }
+        ]
+      })
+    );
+    if (domainType === "free") {
+      const slug = ensure(
+        await text({
+          message: "Choose your subdomain",
+          placeholder: "my-openship",
+          validate: (v) => v && SLUG_RE.test(v.trim().toLowerCase()) ? void 0 : "Lowercase letters, digits, hyphens"
+        })
+      ).trim().toLowerCase();
+      const s2 = spinner2();
+      s2.start("Detecting this server's public IP");
+      const publicHost = await detectPublicIp();
+      s2.stop(publicHost ? `Public IP: ${chalk16.bold(publicHost)}` : "Couldn't detect the public IP automatically.");
+      publicUrl = `https://${slug}.opsh.io`;
+      behindProxy = true;
+      domainPlan = { type: "free", slug, publicHost };
+    } else if (domainType === "custom") {
+      const raw = ensure(
+        await text({
+          message: "Your domain",
+          placeholder: "ops.example.com",
+          validate: (v) => v && normalizeUrl(v) ? void 0 : "Enter a valid domain"
+        })
+      );
+      publicUrl = normalizeUrl(raw).replace(/^http:/i, "https:");
+      const hostname = new URL(publicUrl).hostname;
+      managedEdge = true;
+      behindProxy = true;
+      if (typeof process.getuid === "function" && process.getuid() !== 0) {
+        log.warn("Managed HTTPS installs OpenResty + certbot \u2014 that needs root. Re-run with sudo if it can't install.");
+      }
+      const s2 = spinner2();
+      s2.start("Detecting this server's public IP");
+      const ip = await detectPublicIp();
+      s2.stop(ip ? `Public IP: ${chalk16.bold(ip)}` : "Couldn't detect the public IP automatically.");
+      note(
+        `Add a DNS ${chalk16.bold("A record")}:
+
+  ${chalk16.cyan(hostname)}  \u2192  ${chalk16.cyan(ip ?? "<this server's public IP>")}
+
+` + chalk16.dim("HTTPS is issued automatically once DNS resolves (it retries for a couple minutes)."),
+        "DNS"
+      );
+      ensure(await confirm3({ message: "A record set? (continue either way \u2014 it retries)", initialValue: true }));
+      domainPlan = { type: "custom", hostname };
+    } else {
+      const raw = ensure(
+        await text({
+          message: "Your domain (served behind your proxy)",
+          placeholder: "ops.example.com",
+          validate: (v) => v && normalizeUrl(v) ? void 0 : "Enter a valid domain"
+        })
+      );
+      publicUrl = normalizeUrl(raw);
+      behindProxy = true;
+      if (publicUrl.startsWith("http://")) {
+        log.warn("Serving over plain HTTP sends passwords in cleartext \u2014 put HTTPS in front before real use.");
+      }
+      domainPlan = { type: "byo", hostname: new URL(publicUrl).hostname };
+    }
+  }
+  const isCloudDomain = domainPlan.type === "free";
+  const admin = isCloudDomain ? null : await promptLocalAdmin();
+  const s = spinner2();
+  s.start("Installing Openship as a service");
+  let started;
+  try {
+    started = startService(
+      { publicUrl, trustProxy: behindProxy, managedEdge, acmeEmail: managedEdge ? admin?.email : void 0 },
+      { quiet: true }
+    );
+  } catch (e) {
+    s.stop("Couldn't install the service.", 1);
+    log.error(e.message);
+    log.info("Run `openship up --foreground` to run it attached and see the error.");
+    process.exit(1);
+  }
+  s.message("Waiting for Openship to come up");
+  if (!await waitHealthy(started.port)) {
+    s.stop("Openship didn't become healthy in time.", 1);
+    log.info("Check logs: `openship logs` (or `openship up --foreground`).");
+    process.exit(1);
+  }
+  if (admin) {
+    s.message("Creating your admin account");
+    const adminRes = await bootstrapAdmin(started.port, admin);
+    if (!adminRes.ok) {
+      s.stop(`Couldn't create the admin account: ${adminRes.message}`, 1);
+      process.exit(1);
+    }
+    s.stop(
+      adminRes.message === "already-exists" ? "An admin already exists \u2014 use your existing login." : `Admin account created for ${admin.email}.`
+    );
+  } else {
+    s.stop("Openship is up.");
+  }
+  let liveUrl = publicUrl ?? `http://localhost:${started.dashPort}`;
+  const port = started.port;
+  if (domainPlan.type === "free") {
+    const linked = await connectOpenshipCloud(port);
+    if (!linked) {
+      log.warn("Openship Cloud wasn't connected \u2014 set up a local admin instead. You can add the free domain later in Settings \u2192 Cloud.");
+      const fb = await promptLocalAdmin();
+      const abr = await bootstrapAdmin(port, fb);
+      if (!abr.ok) {
+        log.error(`Couldn't create the admin account: ${abr.message}`);
+        process.exit(1);
+      }
+      await internalPost(port, "/api/system/self-register", { domainType: "byo" });
+    } else {
+      const s2 = spinner2();
+      s2.start("Registering your free domain with Openship Cloud");
+      const res = await internalPost(port, "/api/system/self-register", {
+        domainType: "free",
+        slug: domainPlan.slug,
+        publicHost: domainPlan.publicHost,
+        dashPort: Number(started.dashPort)
+      });
+      if (res.ok && res.data?.url) {
+        liveUrl = res.data.url;
+        s2.stop(`Free domain live: ${res.data.url}`);
+      } else {
+        s2.stop(`Couldn't register the free domain: ${res.data?.error || "failed"}`, 1);
+      }
+    }
+  } else if (domainPlan.type === "custom") {
+    let edgeTakeover = false;
+    let edgeMigrate = false;
+    let proceedCustom = true;
+    const pf = await internalPost(port, "/api/system/self-edge/preflight", {});
+    const status = pf.ok ? pf.data?.status : void 0;
+    const importable = pf.ok && Array.isArray(pf.data?.sites) ? pf.data.sites.length : 0;
+    if (status && !status.canProceedClean && status.occupants?.length) {
+      const owner = status.occupants.map((o) => o.command ?? `port ${o.port}`).join(", ");
+      const known = status.classification === "known";
+      const choice = ensure(
+        await select({
+          message: known ? `An existing reverse proxy (${owner}) is serving ports 80/443.` : `Ports 80/443 are in use by ${owner}, which we couldn't identify.`,
+          options: [
+            ...importable > 0 ? [{
+              value: "migrate",
+              label: `Migrate ${importable} site${importable === 1 ? "" : "s"} & take over`,
+              hint: "import the existing sites into Openship, then take 80/443"
+            }] : [],
+            {
+              value: "override",
+              label: "Stop it & take over 80/443",
+              hint: known ? "the existing sites stop being served" : "may interrupt a running service"
+            },
+            { value: "cancel", label: "Cancel \u2014 leave it running" }
+          ],
+          // Per product decision: unknown owner pre-selects takeover; a known
+          // proxy defaults to cancel so the user chooses deliberately.
+          initialValue: known ? "cancel" : "override"
+        })
+      );
+      if (choice === "cancel") proceedCustom = false;
+      else if (choice === "migrate") edgeMigrate = true;
+      else edgeTakeover = true;
+    }
+    if (!proceedCustom) {
+      log.warn(
+        "Left the existing proxy on 80/443 running. Registering Openship without managed HTTPS \u2014 front it with your proxy, or re-run setup to take over."
+      );
+      await internalPost(port, "/api/system/self-register", {
+        domainType: "byo",
+        hostname: domainPlan.hostname
+      });
+      liveUrl = `https://${domainPlan.hostname}`;
+    } else {
+      const res = await internalPost(port, "/api/system/self-register", {
+        domainType: "custom",
+        hostname: domainPlan.hostname,
+        dashPort: Number(started.dashPort),
+        acmeEmail: admin?.email,
+        edgeTakeover,
+        edgeMigrate
+      });
+      if (res.ok && res.data?.sessionId) {
+        const s2 = spinner2();
+        s2.start("Issuing HTTPS certificate (OpenResty + Let's Encrypt)");
+        const done = await streamProvision(port, res.data.sessionId, s2);
+        liveUrl = res.data.url ?? liveUrl;
+        if (done) s2.stop(`HTTPS ready: ${liveUrl}`);
+        else s2.stop("HTTPS isn't ready yet \u2014 it retries on reboot; the site serves over HTTP meanwhile.", 1);
+      } else {
+        log.warn(`Couldn't start domain provisioning: ${res.data?.error || "failed"}`);
+      }
+    }
+  } else if (domainPlan.type === "byo") {
+    const res = await internalPost(port, "/api/system/self-register", {
+      domainType: "byo",
+      hostname: domainPlan.hostname
+    });
+    if (res.ok && res.data?.url) liveUrl = res.data.url;
+  } else {
+    await internalPost(port, "/api/system/self-register", { domainType: "byo" });
+  }
+  note(
+    `${chalk16.bold(liveUrl)}
+
+` + chalk16.dim(`${admin ? `Log in as ${admin.email}` : "Log in with Openship Cloud"}. Openship now appears under your Apps, and runs as a service (restarts on boot).`),
+    "Openship is live"
+  );
+  outro(
+    domainPlan.type === "byo" ? chalk16.dim("Point your reverse proxy at the dashboard port above.") : chalk16.green("Happy shipping.")
+  );
+}
+
 // src/index.ts
 var program = new Command25();
-program.name("openship").description("Openship CLI \u2014 install, run, and manage Openship from your terminal").version("0.1.11").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
+program.name("openship").description("Openship CLI \u2014 install, run, and manage Openship from your terminal").version("0.2.1").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
   if (thisCommand.opts().json) setJsonMode(true);
+}).action(async () => {
+  await runWizard();
 });
 program.addCommand(upCommand);
 program.addCommand(stopCommand);