openship 0.2.2 → 0.3.0

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command26 } from "commander";
+import { Command as Command27 } from "commander";
 
 // src/lib/output.ts
 import chalk from "chalk";
@@ -1216,7 +1216,13 @@ function findClosingBracket(body, start) {
     const ch = body[i];
     const prev = body[i - 1];
     if (inDouble) {
-      if (ch === '"' && prev !== "\\") inDouble = false;
+      if (ch === '"') {
+        let backslashRun = 0;
+        for (let j = i - 1; j >= 0 && body[j] === "\\"; j--) {
+          backslashRun++;
+        }
+        if (backslashRun % 2 === 0) inDouble = false;
+      }
       continue;
     }
     if (inSingle) {
@@ -1807,6 +1813,425 @@ var LANGUAGE_MANIFEST_FILES = Array.from(
   new Set(LANGUAGE_DETECTORS.flatMap((d) => d.manifestFiles.map((f) => f.toLowerCase())))
 );
 
+// ../../packages/core/src/openship-config/schema.ts
+var OPENSHIP_RUNTIMES = ["bare", "docker"];
+var OPENSHIP_PRODUCTION_MODES = [
+  "host",
+  "static",
+  "standalone"
+];
+var OPENSHIP_DOMAIN_TYPES = ["free", "custom"];
+var OPENSHIP_RESTARTS = [
+  "no",
+  "always",
+  "on-failure",
+  "unless-stopped"
+];
+var OPENSHIP_RESOURCE_TIERS = [
+  "micro",
+  "low",
+  "medium",
+  "high"
+];
+
+// ../../packages/core/src/openship-config/parse.ts
+var TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
+  "$schema",
+  "framework",
+  "packageManager",
+  "rootDirectory",
+  "installCommand",
+  "buildCommand",
+  "startCommand",
+  "outputDirectory",
+  "buildImage",
+  "productionPaths",
+  "runtime",
+  "productionMode",
+  "port",
+  "env",
+  "domains",
+  "routes",
+  "resources",
+  "services",
+  "monorepo"
+]);
+var Ctx = class {
+  errors = [];
+  warnings = [];
+  err(path2, msg) {
+    this.errors.push(`${path2}: ${msg}`);
+  }
+  isObj(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+  }
+  str(v, path2) {
+    if (v === void 0) return void 0;
+    if (typeof v !== "string") {
+      this.err(path2, "must be a string");
+      return void 0;
+    }
+    return v;
+  }
+  bool(v, path2) {
+    if (v === void 0) return void 0;
+    if (typeof v !== "boolean") {
+      this.err(path2, "must be a boolean");
+      return void 0;
+    }
+    return v;
+  }
+  int(v, path2, min, max) {
+    if (v === void 0) return void 0;
+    const n = typeof v === "string" ? Number(v) : v;
+    if (typeof n !== "number" || !Number.isFinite(n)) {
+      this.err(path2, "must be a number");
+      return void 0;
+    }
+    if (n < min || n > max) {
+      this.err(path2, `must be between ${min} and ${max}`);
+      return void 0;
+    }
+    return n;
+  }
+  strArray(v, path2) {
+    if (v === void 0) return void 0;
+    if (!Array.isArray(v)) {
+      this.err(path2, "must be an array of strings");
+      return void 0;
+    }
+    const out = [];
+    v.forEach((item, i) => {
+      if (typeof item !== "string") this.err(`${path2}[${i}]`, "must be a string");
+      else out.push(item);
+    });
+    return out;
+  }
+  enumOf(v, path2, allowed) {
+    if (v === void 0) return void 0;
+    if (typeof v !== "string" || !allowed.includes(v)) {
+      this.err(path2, `must be one of: ${allowed.join(", ")}`);
+      return void 0;
+    }
+    return v;
+  }
+};
+function parseEnv(ctx, v, path2) {
+  if (v === void 0) return void 0;
+  if (!ctx.isObj(v)) {
+    ctx.err(path2, "must be an object of environment variables");
+    return void 0;
+  }
+  const out = {};
+  for (const [key, val] of Object.entries(v)) {
+    if (typeof val === "string") {
+      out[key] = val;
+    } else if (ctx.isObj(val)) {
+      if (val.value === void 0) ctx.err(`${path2}.${key}.value`, "is required");
+      const value = ctx.str(val.value, `${path2}.${key}.value`);
+      const secret = ctx.bool(val.secret, `${path2}.${key}.secret`);
+      if (value !== void 0) out[key] = { value, ...secret !== void 0 ? { secret } : {} };
+    } else {
+      ctx.err(`${path2}.${key}`, 'must be a string or { "value", "secret" }');
+    }
+  }
+  return out;
+}
+function parseDomains(ctx, v, path2) {
+  if (v === void 0) return void 0;
+  if (!Array.isArray(v)) {
+    ctx.err(path2, "must be an array of hostnames or domain objects");
+    return void 0;
+  }
+  const out = [];
+  v.forEach((item, i) => {
+    const p = `${path2}[${i}]`;
+    if (typeof item === "string") {
+      out.push({ domain: item });
+    } else if (ctx.isObj(item)) {
+      const domain = ctx.str(item.domain, `${p}.domain`);
+      if (!domain) {
+        ctx.err(p, "requires a `domain`");
+        return;
+      }
+      out.push({
+        domain,
+        port: ctx.int(item.port, `${p}.port`, 1, 65535),
+        targetPath: ctx.str(item.targetPath, `${p}.targetPath`),
+        type: ctx.enumOf(item.type, `${p}.type`, OPENSHIP_DOMAIN_TYPES)
+      });
+    } else {
+      ctx.err(p, "must be a hostname string or a domain object");
+    }
+  });
+  return out;
+}
+function parseRoutes(ctx, v, path2) {
+  if (v === void 0) return void 0;
+  if (!ctx.isObj(v)) {
+    ctx.err(path2, "must be an object");
+    return void 0;
+  }
+  const routes = {};
+  const rule = (item, p) => {
+    if (!ctx.isObj(item)) {
+      ctx.err(p, "must be an object with `source` and `destination`");
+      return null;
+    }
+    const source = ctx.str(item.source, `${p}.source`);
+    const destination = ctx.str(item.destination, `${p}.destination`);
+    return source && destination ? { source, destination } : null;
+  };
+  if (Array.isArray(v.rewrites)) {
+    routes.rewrites = v.rewrites.map((r, i) => rule(r, `${path2}.rewrites[${i}]`)).filter(Boolean);
+  } else if (v.rewrites !== void 0) ctx.err(`${path2}.rewrites`, "must be an array");
+  if (Array.isArray(v.redirects)) {
+    routes.redirects = v.redirects.map((r, i) => {
+      const base = rule(r, `${path2}.redirects[${i}]`);
+      if (!base) return null;
+      const o = r;
+      return {
+        ...base,
+        permanent: ctx.bool(o.permanent, `${path2}.redirects[${i}].permanent`),
+        statusCode: ctx.int(o.statusCode, `${path2}.redirects[${i}].statusCode`, 300, 399)
+      };
+    }).filter(Boolean);
+  } else if (v.redirects !== void 0) ctx.err(`${path2}.redirects`, "must be an array");
+  if (Array.isArray(v.headers)) {
+    routes.headers = v.headers.map((h, i) => {
+      const p = `${path2}.headers[${i}]`;
+      if (!ctx.isObj(h)) {
+        ctx.err(p, "must be an object");
+        return null;
+      }
+      const source = ctx.str(h.source, `${p}.source`);
+      const list2 = Array.isArray(h.headers) ? h.headers.map((kv, j) => {
+        const key = ctx.str(kv?.key, `${p}.headers[${j}].key`);
+        const value = ctx.str(kv?.value, `${p}.headers[${j}].value`);
+        return key && value !== void 0 ? { key, value } : null;
+      }).filter(Boolean) : [];
+      return source ? { source, headers: list2 } : null;
+    }).filter(Boolean);
+  } else if (v.headers !== void 0) ctx.err(`${path2}.headers`, "must be an array");
+  const cleanUrls = ctx.bool(v.cleanUrls, `${path2}.cleanUrls`);
+  const trailingSlash = ctx.bool(v.trailingSlash, `${path2}.trailingSlash`);
+  if (cleanUrls !== void 0) routes.cleanUrls = cleanUrls;
+  if (trailingSlash !== void 0) routes.trailingSlash = trailingSlash;
+  return routes;
+}
+function parseResources(ctx, v, path2) {
+  if (v === void 0) return void 0;
+  if (!ctx.isObj(v)) {
+    ctx.err(path2, "must be an object");
+    return void 0;
+  }
+  const r = {
+    tier: ctx.enumOf(v.tier, `${path2}.tier`, OPENSHIP_RESOURCE_TIERS),
+    cpuCores: ctx.int(v.cpuCores, `${path2}.cpuCores`, 0.25, 4),
+    memoryMb: ctx.int(v.memoryMb, `${path2}.memoryMb`, 128, 8192),
+    diskMb: ctx.int(v.diskMb, `${path2}.diskMb`, 64, 204800)
+  };
+  return r;
+}
+function parseHealthcheck(ctx, v, path2) {
+  if (v === void 0) return void 0;
+  if (!ctx.isObj(v)) {
+    ctx.err(path2, "must be an object");
+    return void 0;
+  }
+  const test = typeof v.test === "string" ? v.test : Array.isArray(v.test) ? ctx.strArray(v.test, `${path2}.test`) : v.test !== void 0 ? (ctx.err(`${path2}.test`, "must be a string or array of strings"), void 0) : void 0;
+  return {
+    test,
+    interval: ctx.str(v.interval, `${path2}.interval`),
+    timeout: ctx.str(v.timeout, `${path2}.timeout`),
+    retries: ctx.int(v.retries, `${path2}.retries`, 0, 100),
+    startPeriod: ctx.str(v.startPeriod, `${path2}.startPeriod`),
+    disable: ctx.bool(v.disable, `${path2}.disable`)
+  };
+}
+function parseServices(ctx, v, path2) {
+  if (v === void 0) return void 0;
+  if (!Array.isArray(v)) {
+    ctx.err(path2, "must be an array of service objects");
+    return void 0;
+  }
+  const out = [];
+  v.forEach((item, i) => {
+    const p = `${path2}[${i}]`;
+    if (!ctx.isObj(item)) {
+      ctx.err(p, "must be an object");
+      return;
+    }
+    const name = ctx.str(item.name, `${p}.name`);
+    if (!name) {
+      ctx.err(p, "requires a `name`");
+      return;
+    }
+    out.push({
+      name,
+      image: ctx.str(item.image, `${p}.image`),
+      build: ctx.str(item.build, `${p}.build`),
+      dockerfile: ctx.str(item.dockerfile, `${p}.dockerfile`),
+      ports: ctx.strArray(item.ports, `${p}.ports`),
+      volumes: ctx.strArray(item.volumes, `${p}.volumes`),
+      dependsOn: ctx.strArray(item.dependsOn, `${p}.dependsOn`),
+      env: parseEnv(ctx, item.env, `${p}.env`),
+      command: ctx.str(item.command, `${p}.command`),
+      restart: ctx.enumOf(item.restart, `${p}.restart`, OPENSHIP_RESTARTS),
+      exposed: ctx.bool(item.exposed, `${p}.exposed`),
+      exposedPort: ctx.str(item.exposedPort, `${p}.exposedPort`),
+      domain: ctx.str(item.domain, `${p}.domain`),
+      healthcheck: parseHealthcheck(ctx, item.healthcheck, `${p}.healthcheck`)
+    });
+  });
+  return out;
+}
+function parseMonorepo(ctx, v, path2) {
+  if (v === void 0) return void 0;
+  if (!ctx.isObj(v)) {
+    ctx.err(path2, "must be an object");
+    return void 0;
+  }
+  const mono = {};
+  if (v.workspace !== void 0) {
+    if (!ctx.isObj(v.workspace)) ctx.err(`${path2}.workspace`, "must be an object");
+    else {
+      const pm = ctx.str(v.workspace.packageManager, `${path2}.workspace.packageManager`);
+      if (pm) {
+        mono.workspace = {
+          packageManager: pm,
+          prepareCommand: ctx.str(v.workspace.prepareCommand, `${path2}.workspace.prepareCommand`)
+        };
+      } else {
+        ctx.err(`${path2}.workspace`, "requires a `packageManager`");
+      }
+    }
+  }
+  if (v.sharedPaths !== void 0) {
+    ctx.warnings.push(`${path2}.sharedPaths is not applied yet (ignored)`);
+  }
+  if (v.apps !== void 0) {
+    if (!Array.isArray(v.apps)) ctx.err(`${path2}.apps`, "must be an array");
+    else {
+      const apps = [];
+      v.apps.forEach((a, i) => {
+        const p = `${path2}.apps[${i}]`;
+        if (!ctx.isObj(a)) {
+          ctx.err(p, "must be an object");
+          return;
+        }
+        const name = ctx.str(a.name, `${p}.name`);
+        const rootDirectory = ctx.str(a.rootDirectory, `${p}.rootDirectory`);
+        if (!name || !rootDirectory) {
+          ctx.err(p, "requires `name` and `rootDirectory`");
+          return;
+        }
+        apps.push({
+          name,
+          rootDirectory,
+          framework: ctx.enumOf(a.framework, `${p}.framework`, STACK_IDS),
+          packageManager: parsePackageManager(ctx, a.packageManager, `${p}.packageManager`),
+          installCommand: ctx.str(a.installCommand, `${p}.installCommand`),
+          buildCommand: ctx.str(a.buildCommand, `${p}.buildCommand`),
+          startCommand: ctx.str(a.startCommand, `${p}.startCommand`),
+          outputDirectory: ctx.str(a.outputDirectory, `${p}.outputDirectory`),
+          buildImage: ctx.str(a.buildImage, `${p}.buildImage`),
+          port: ctx.int(a.port, `${p}.port`, 1, 65535)
+        });
+      });
+      mono.apps = apps;
+    }
+  }
+  return mono;
+}
+function parsePackageManager(ctx, v, path2) {
+  const s = ctx.str(v, path2);
+  if (s === void 0) return void 0;
+  if (!ALL_PACKAGE_MANAGERS.includes(s)) {
+    ctx.err(path2, `must be one of: ${ALL_PACKAGE_MANAGERS.join(", ")}`);
+    return void 0;
+  }
+  return s;
+}
+function parseOpenshipConfig(raw) {
+  const ctx = new Ctx();
+  if (!ctx.isObj(raw)) {
+    return { config: null, errors: ["openship.json must be a JSON object"], warnings: [] };
+  }
+  for (const key of Object.keys(raw)) {
+    if (!TOP_LEVEL_KEYS.has(key)) ctx.warnings.push(`Unknown field "${key}" (ignored)`);
+  }
+  const config = {
+    framework: ctx.enumOf(raw.framework, "framework", STACK_IDS),
+    packageManager: parsePackageManager(ctx, raw.packageManager, "packageManager"),
+    rootDirectory: ctx.str(raw.rootDirectory, "rootDirectory"),
+    installCommand: ctx.str(raw.installCommand, "installCommand"),
+    buildCommand: ctx.str(raw.buildCommand, "buildCommand"),
+    startCommand: ctx.str(raw.startCommand, "startCommand"),
+    outputDirectory: ctx.str(raw.outputDirectory, "outputDirectory"),
+    buildImage: ctx.str(raw.buildImage, "buildImage"),
+    productionPaths: ctx.strArray(raw.productionPaths, "productionPaths"),
+    runtime: ctx.enumOf(raw.runtime, "runtime", OPENSHIP_RUNTIMES),
+    productionMode: ctx.enumOf(raw.productionMode, "productionMode", OPENSHIP_PRODUCTION_MODES),
+    port: ctx.int(raw.port, "port", 1, 65535),
+    env: parseEnv(ctx, raw.env, "env"),
+    domains: parseDomains(ctx, raw.domains, "domains"),
+    routes: parseRoutes(ctx, raw.routes, "routes"),
+    resources: parseResources(ctx, raw.resources, "resources"),
+    services: parseServices(ctx, raw.services, "services"),
+    monorepo: parseMonorepo(ctx, raw.monorepo, "monorepo")
+  };
+  for (const k of Object.keys(config)) {
+    if (config[k] === void 0) delete config[k];
+  }
+  return { config, errors: ctx.errors, warnings: ctx.warnings };
+}
+function parseOpenshipConfigJson(text2) {
+  let raw;
+  try {
+    raw = JSON.parse(text2);
+  } catch (err2) {
+    return {
+      config: null,
+      errors: [`invalid JSON: ${err2 instanceof Error ? err2.message : String(err2)}`],
+      warnings: []
+    };
+  }
+  return parseOpenshipConfig(raw);
+}
+
+// ../../packages/core/src/metadata/openship.ts
+var openshipMetadataParser = {
+  source: "openship",
+  files: ["openship.json"],
+  parse(fileContents) {
+    const raw = fileContents["openship.json"];
+    if (!raw) return null;
+    const { config } = parseOpenshipConfigJson(raw);
+    if (!config) return null;
+    const metadata = { source: "openship" };
+    if (config.installCommand) metadata.installCommand = config.installCommand;
+    if (config.buildCommand) metadata.buildCommand = config.buildCommand;
+    if (config.outputDirectory) metadata.outputDirectory = config.outputDirectory;
+    if (config.startCommand) metadata.startCommand = config.startCommand;
+    if (config.framework) metadata.framework = config.framework;
+    if (config.routes) metadata.routing = config.routes;
+    const hasSignal = config.installCommand || config.buildCommand || config.outputDirectory || config.startCommand || config.framework || config.routes;
+    return hasSignal ? metadata : null;
+  }
+};
+
+// ../../packages/core/src/metadata/text.ts
+function stripBom2(content) {
+  return content.charCodeAt(0) === 65279 ? content.slice(1) : content;
+}
+function trimmed(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+}
+function splitLines(raw) {
+  return stripBom2(raw).split(/\r?\n/);
+}
+
 // ../../packages/core/src/metadata/vercel.ts
 var VERCEL_FRAMEWORK_TO_STACK = {
   nextjs: "nextjs",
@@ -1821,9 +2246,6 @@ var VERCEL_FRAMEWORK_TO_STACK = {
   angular: "angular",
   "create-react-app": "cra"
 };
-function trimmed(value) {
-  return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
-}
 function isConditional(entry) {
   return "has" in entry || "missing" in entry;
 }
@@ -1942,10 +2364,152 @@ var vercelMetadataParser = {
   }
 };
 
-// ../../packages/core/src/metadata/render.ts
-function stripBom2(content) {
-  return content.charCodeAt(0) === 65279 ? content.slice(1) : content;
+// ../../packages/core/src/metadata/railway.ts
+function tomlScalar(rest) {
+  const s = rest.trim();
+  const quote = s[0];
+  if (quote === '"' || quote === "'") {
+    let out = "";
+    for (let i = 1; i < s.length; i++) {
+      const ch = s[i];
+      if (quote === '"' && ch === "\\" && i + 1 < s.length) {
+        const next = s[++i];
+        switch (next) {
+          case "t":
+            out += "	";
+            break;
+          case "n":
+            out += "\n";
+            break;
+          case "r":
+            out += "\r";
+            break;
+          case "b":
+            out += "\b";
+            break;
+          case "f":
+            out += "\f";
+            break;
+          case '"':
+            out += '"';
+            break;
+          case "\\":
+            out += "\\";
+            break;
+          case "/":
+            out += "/";
+            break;
+          case "u":
+          case "U": {
+            const width = next === "u" ? 4 : 8;
+            const hex = s.slice(i + 1, i + 1 + width);
+            if (hex.length === width && /^[0-9a-fA-F]+$/.test(hex)) {
+              out += String.fromCodePoint(parseInt(hex, 16));
+              i += width;
+            } else {
+              out += next;
+            }
+            break;
+          }
+          default:
+            out += next;
+        }
+        continue;
+      }
+      if (ch === quote) return out;
+      out += ch;
+    }
+    return void 0;
+  }
+  const bare = s.split("#")[0].trim();
+  return bare.length > 0 ? bare : void 0;
 }
+function parseRailwayToml(raw) {
+  const cfg = {};
+  let section = "";
+  const lines = splitLines(raw);
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const header = line.match(/^\s*\[([^\]]+)\]\s*(?:#.*)?$/);
+    if (header) {
+      section = header[1].trim().toLowerCase();
+      continue;
+    }
+    const kv = line.match(/^\s*([A-Za-z_][A-Za-z0-9_.-]*)\s*=\s*(.+)$/);
+    if (!kv) continue;
+    const [, rawKey, rest] = kv;
+    const dot = rawKey.lastIndexOf(".");
+    const table = dot >= 0 ? rawKey.slice(0, dot).toLowerCase() : section;
+    const field = dot >= 0 ? rawKey.slice(dot + 1) : rawKey;
+    let value;
+    const triple = rest.match(/^("""|''')/);
+    if (triple) {
+      const delim = triple[1];
+      const afterOpen = rest.slice(3);
+      const close = afterOpen.indexOf(delim);
+      if (close >= 0) {
+        value = afterOpen.slice(0, close).trim() || void 0;
+      } else {
+        while (++i < lines.length && !lines[i].includes(delim)) {
+        }
+        value = void 0;
+      }
+    } else {
+      value = tomlScalar(rest);
+    }
+    if (!value) continue;
+    if (table === "build") {
+      if (field === "buildCommand") cfg.buildCommand ??= value;
+      else if (field === "builder") cfg.builder ??= value;
+    } else if (table === "deploy") {
+      if (field === "startCommand") cfg.startCommand ??= value;
+    }
+  }
+  return cfg;
+}
+function parseRailwayJson(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null) return null;
+  const obj = parsed;
+  const build = obj.build ?? {};
+  const deploy = obj.deploy ?? {};
+  return {
+    builder: trimmed(build.builder),
+    buildCommand: trimmed(build.buildCommand),
+    startCommand: trimmed(deploy.startCommand)
+  };
+}
+function toMetadata(cfg) {
+  const buildCommand = trimmed(cfg.buildCommand);
+  const startCommand = trimmed(cfg.startCommand);
+  const framework = cfg.builder?.toUpperCase() === "DOCKERFILE" ? "docker" : void 0;
+  if (!buildCommand && !startCommand && !framework) return null;
+  const metadata = { source: "railway" };
+  if (buildCommand) metadata.buildCommand = buildCommand;
+  if (startCommand) metadata.startCommand = startCommand;
+  if (framework) metadata.framework = framework;
+  if (extractCdTargets(buildCommand).length > 0) metadata.nonLocal = true;
+  return metadata;
+}
+var railwayMetadataParser = {
+  source: "railway",
+  files: ["railway.toml", "railway.json"],
+  parse(fileContents) {
+    const tomlRaw = fileContents["railway.toml"];
+    const jsonRaw = fileContents["railway.json"];
+    const fromToml = tomlRaw ? toMetadata(parseRailwayToml(tomlRaw)) : null;
+    if (fromToml) return fromToml;
+    const jsonCfg = jsonRaw ? parseRailwayJson(jsonRaw) : null;
+    return jsonCfg ? toMetadata(jsonCfg) : null;
+  }
+};
+
+// ../../packages/core/src/metadata/render.ts
 function unquote(value) {
   const trimmed2 = value.trim();
   const m = trimmed2.match(/^(['"])(.*)\1$/);
@@ -1957,7 +2521,7 @@ var renderMetadataParser = {
   parse(fileContents) {
     const raw = fileContents["render.yaml"];
     if (!raw) return null;
-    const lines = stripBom2(raw).split("\n");
+    const lines = splitLines(raw);
     let startCommand;
     let buildCommand;
     const env = {};
@@ -1991,7 +2555,9 @@ var renderMetadataParser = {
 
 // ../../packages/core/src/metadata/index.ts
 var METADATA_PARSERS = [
+  openshipMetadataParser,
   vercelMetadataParser,
+  railwayMetadataParser,
   renderMetadataParser
 ];
 var METADATA_FILES = new Set(
@@ -2378,11 +2944,11 @@ var openCommand = new Command3("open").description("Open the Openship dashboard
 import { Command as Command4 } from "commander";
 import chalk5 from "chalk";
 import ora from "ora";
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 import { randomBytes } from "crypto";
-import { createWriteStream as createWriteStream2, existsSync as existsSync5, mkdirSync as mkdirSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
-import { homedir as homedir5 } from "os";
-import { dirname as dirname2, join as join6 } from "path";
+import { createWriteStream as createWriteStream2, existsSync as existsSync6, mkdirSync as mkdirSync7, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
+import { homedir as homedir6 } from "os";
+import { dirname as dirname2, join as join7 } from "path";
 import { fileURLToPath } from "url";
 
 // src/lib/dashboard.ts
@@ -2432,8 +2998,8 @@ async function downloadToFile(url, dest, onProgress) {
   } finally {
     file.end();
   }
-  await new Promise((resolve2, reject2) => {
-    file.on("finish", () => resolve2());
+  await new Promise((resolve3, reject2) => {
+    file.on("finish", () => resolve3());
     file.on("error", reject2);
   });
   return { sha256: hash.digest("hex"), size: received };
@@ -2838,10 +3404,10 @@ function readInstanceUrl() {
 var DEFAULT_API = 4e3;
 var DEFAULT_DASHBOARD = 3001;
 function isPortFree(port) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const srv = createServer();
-    srv.once("error", () => resolve2(false));
-    srv.listen(port, "127.0.0.1", () => srv.close(() => resolve2(true)));
+    srv.once("error", () => resolve3(false));
+    srv.listen(port, "127.0.0.1", () => srv.close(() => resolve3(true)));
   });
 }
 async function waitPortFree(port, opts = {}) {
@@ -2855,13 +3421,13 @@ async function waitPortFree(port, opts = {}) {
   }
 }
 function getFreePort() {
-  return new Promise((resolve2, reject2) => {
+  return new Promise((resolve3, reject2) => {
     const srv = createServer();
     srv.once("error", reject2);
     srv.listen(0, "127.0.0.1", () => {
       const addr = srv.address();
       const port = addr && typeof addr === "object" ? addr.port : 0;
-      srv.close(() => port ? resolve2(port) : reject2(new Error("no free port")));
+      srv.close(() => port ? resolve3(port) : reject2(new Error("no free port")));
     });
   });
 }
@@ -2902,6 +3468,101 @@ async function resolvePorts(prefs) {
   };
 }
 
+// src/lib/from-source.ts
+import { spawn, spawnSync as spawnSync3 } from "child_process";
+import { existsSync as existsSync5, mkdirSync as mkdirSync6 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join6, resolve as resolve2 } from "path";
+var OS_DIR3 = join6(homedir5(), ".openship");
+var DEFAULT_REPO = "https://github.com/oblien/openship.git";
+function has(cmd) {
+  try {
+    return spawnSync3(cmd, ["--version"], { stdio: "ignore" }).status === 0;
+  } catch {
+    return false;
+  }
+}
+function run2(cmd, args, cwd, env) {
+  return new Promise((res, rej) => {
+    const child = spawn(cmd, args, {
+      cwd,
+      stdio: "inherit",
+      env: env ? { ...process.env, ...env } : process.env
+    });
+    child.on("error", rej);
+    child.on(
+      "exit",
+      (code) => code === 0 ? res() : rej(new Error(`\`${cmd} ${args.join(" ")}\` (cwd=${cwd}) exited ${code ?? "?"}`))
+    );
+  });
+}
+function shortSha(cwd) {
+  const r = spawnSync3("git", ["rev-parse", "--short", "HEAD"], { cwd, encoding: "utf8" });
+  return r.status === 0 ? (r.stdout ?? "").trim() || "unknown" : "unknown";
+}
+function isMonorepo(dir) {
+  return existsSync5(join6(dir, "package.json")) && existsSync5(join6(dir, "apps/api/package.json")) && existsSync5(join6(dir, "apps/dashboard/package.json"));
+}
+async function prepareFromSource(opts) {
+  if (!has("bun")) {
+    throw new Error(
+      "`bun` is required to build from source but wasn't found on PATH \u2014 install it: https://bun.sh"
+    );
+  }
+  let sourceDir;
+  let ref;
+  if (opts.source) {
+    sourceDir = resolve2(opts.source);
+    if (!isMonorepo(sourceDir)) {
+      throw new Error(
+        `--source ${sourceDir} doesn't look like an Openship checkout (missing package.json / apps/api / apps/dashboard).`
+      );
+    }
+    ref = "local";
+  } else {
+    if (!has("git")) {
+      throw new Error("`git` is required to clone the source but wasn't found on PATH.");
+    }
+    ref = (opts.ref || "main").trim();
+    const repoUrl = opts.repo || DEFAULT_REPO;
+    sourceDir = join6(OS_DIR3, "src");
+    mkdirSync6(OS_DIR3, { recursive: true });
+    if (!existsSync5(join6(sourceDir, ".git"))) {
+      console.log(`  Cloning ${repoUrl} \u2192 ${sourceDir}`);
+      await run2("git", ["clone", repoUrl, sourceDir], OS_DIR3);
+    }
+    console.log(`  Fetching + checking out ${ref}`);
+    await run2("git", ["fetch", "origin", ref, "--tags"], sourceDir);
+    await run2("git", ["checkout", ref], sourceDir);
+    await run2("git", ["pull", "--ff-only", "origin", ref], sourceDir).catch(() => {
+      console.log("  (pinned ref \u2014 not fast-forwarding)");
+    });
+  }
+  const sha = shortSha(sourceDir);
+  console.log(`  Source: ${sourceDir} @ ${ref} (${sha})`);
+  console.log("  Installing workspace dependencies (bun install)\u2026");
+  await run2("bun", ["install"], sourceDir);
+  const distDir = join6(OS_DIR3, "from-source-dist");
+  console.log("  Building release dist (compiles the dashboard \u2014 needs RAM/CPU)\u2026");
+  await run2(
+    "bun",
+    ["run", join6(sourceDir, "apps/api/scripts/build-release.ts")],
+    sourceDir,
+    { DIST_DIR: distDir, NODE_ENV: "production", CLOUD_MODE: "false", OPENSHIP_TARGET: "local" }
+  );
+  console.log("  Installing runtime dependencies in the dist\u2026");
+  await run2("bun", ["install", "--production", "--frozen-lockfile"], distDir);
+  const apiDir = join6(distDir, "api");
+  const dashboardDir = join6(distDir, "dashboard");
+  if (!existsSync5(join6(apiDir, "src/index.ts"))) {
+    throw new Error(`Build produced no API at ${apiDir}/src/index.ts \u2014 build-release layout drift?`);
+  }
+  if (!existsSync5(join6(dashboardDir, "apps/dashboard/server.js"))) {
+    throw new Error(`Build produced no dashboard at ${dashboardDir}/apps/dashboard/server.js.`);
+  }
+  return { apiDir, dashboardDir, ref, sha, sourceDir };
+}
+
 // src/commands/up.ts
 function normalizeUrl(raw) {
   const value = /^https?:\/\//i.test(raw) ? raw : `https://${raw}`;
@@ -2924,20 +3585,20 @@ function normalizePublicUrl(raw) {
   return url;
 }
 var DIST_DIR = dirname2(fileURLToPath(import.meta.url));
-var SERVER_DIR = join6(DIST_DIR, "server");
-var OS_DIR3 = join6(homedir5(), ".openship");
+var SERVER_DIR = join7(DIST_DIR, "server");
+var OS_DIR4 = join7(homedir6(), ".openship");
 function ensureAuthSecret() {
-  const path2 = join6(OS_DIR3, "auth-secret");
-  if (existsSync5(path2)) return readFileSync4(path2, "utf8").trim();
-  mkdirSync6(OS_DIR3, { recursive: true, mode: 448 });
+  const path2 = join7(OS_DIR4, "auth-secret");
+  if (existsSync6(path2)) return readFileSync4(path2, "utf8").trim();
+  mkdirSync7(OS_DIR4, { recursive: true, mode: 448 });
   const secret = randomBytes(32).toString("hex");
   writeFileSync5(path2, secret, { mode: 384 });
   return secret;
 }
 function ensureInternalToken() {
-  const path2 = join6(OS_DIR3, "internal-token");
-  if (existsSync5(path2)) return readFileSync4(path2, "utf8").trim();
-  mkdirSync6(OS_DIR3, { recursive: true, mode: 448 });
+  const path2 = join7(OS_DIR4, "internal-token");
+  if (existsSync6(path2)) return readFileSync4(path2, "utf8").trim();
+  mkdirSync7(OS_DIR4, { recursive: true, mode: 448 });
   const token = randomBytes(32).toString("hex");
   writeFileSync5(path2, token, { mode: 384 });
   return token;
@@ -2951,10 +3612,32 @@ var upCommand = new Command4("up").description("Start Openship as a persistent s
 ).option(
   "--managed-edge",
   "Managed edge: install OpenResty + a free Let's Encrypt cert on this box and route --public-url's domain to the dashboard (no reverse proxy needed)"
-).option("--acme-email <email>", "Contact email for Let's Encrypt certificates (managed edge)").action(async (opts) => {
+).option("--acme-email <email>", "Contact email for Let's Encrypt certificates (managed edge)").option("--from-source", "Preview: build + run Openship from source (a branch) instead of a published release \u2014 runs attached").option("--ref <branch>", "Git branch/tag/sha to build with --from-source (default: main)").option("--source <path>", "Build from an existing local Openship checkout instead of cloning").option("--repo <url>", "Git remote to clone for --from-source (default: oblien/openship)").action(async (opts) => {
+  if (opts.fromSource || opts.source) return runFromSource(opts);
   if (opts.foreground) return runForeground(opts);
   await startService(opts);
 });
+async function runFromSource(opts) {
+  console.log(chalk5.cyan("\n  Building Openship from source (preview mode)\u2026"));
+  console.log(
+    chalk5.dim("  Unverified dev build \u2014 for previewing a branch, not production self-hosting.\n")
+  );
+  let src;
+  try {
+    src = await prepareFromSource({ ref: opts.ref, source: opts.source, repo: opts.repo });
+  } catch (e) {
+    console.error(
+      chalk5.red(`
+  Build from source failed: ${e.message}
+`) + chalk5.dim("  Small boxes can OOM on the dashboard build \u2014 build on a bigger machine and pass --source, or use a published release.\n")
+    );
+    process.exit(1);
+  }
+  console.log(chalk5.green(`
+  Built ${src.ref} (${src.sha}). Starting\u2026
+`));
+  await runForeground(opts, src);
+}
 async function startService(opts, runOpts = {}) {
   const publicUrl = opts.publicUrl ? normalizePublicUrl(opts.publicUrl) : void 0;
   if (opts.dryRun) {
@@ -3029,13 +3712,23 @@ async function startService(opts, runOpts = {}) {
     process.exit(1);
   }
 }
-async function runForeground(opts) {
-  const serverEntry = join6(SERVER_DIR, "index.js");
-  if (!existsSync5(serverEntry)) {
-    console.error(
-      chalk5.red("\n  Bundled server not found in this install.") + chalk5.dim("\n  Reinstall with `openship update` (or `npm i -g openship`).\n")
-    );
-    process.exit(1);
+async function runForeground(opts, source) {
+  let apiCmd = process.execPath;
+  let apiArgs;
+  let apiCwd;
+  if (source) {
+    apiCmd = "bun";
+    apiArgs = ["run", "src/index.ts"];
+    apiCwd = source.apiDir;
+  } else {
+    const serverEntry = join7(SERVER_DIR, "index.js");
+    if (!existsSync6(serverEntry)) {
+      console.error(
+        chalk5.red("\n  Bundled server not found in this install.") + chalk5.dim("\n  Reinstall with `openship update` (or `npm i -g openship`).\n")
+      );
+      process.exit(1);
+    }
+    apiArgs = [serverEntry];
   }
   const resolved = await resolvePorts({
     api: opts.port ? Number(opts.port) : void 0,
@@ -3045,11 +3738,11 @@ async function runForeground(opts) {
   const dashPort = String(resolved.dashboard);
   const publicUrl = opts.publicUrl ? normalizePublicUrl(opts.publicUrl) : void 0;
   const managedEdge = Boolean(opts.managedEdge && publicUrl);
-  const dataDir = opts.dataDir || join6(OS_DIR3, "data");
-  mkdirSync6(dataDir, { recursive: true });
-  const logDir = join6(OS_DIR3, "logs");
-  mkdirSync6(logDir, { recursive: true });
-  const instanceLogPath = join6(logDir, "instance.log");
+  const dataDir = opts.dataDir || join7(OS_DIR4, "data");
+  mkdirSync7(dataDir, { recursive: true });
+  const logDir = join7(OS_DIR4, "logs");
+  mkdirSync7(logDir, { recursive: true });
+  const instanceLogPath = join7(logDir, "instance.log");
   const instanceLog = createWriteStream2(instanceLogPath, { flags: "w" });
   const env = {
     ...process.env,
@@ -3060,10 +3753,12 @@ async function runForeground(opts) {
     OPENSHIP_TARGET: "local",
     OPENSHIP_JOB_RUNNER: "in-process",
     PGLITE_DATA_DIR: dataDir,
-    OPENSHIP_MIGRATIONS_DIR: join6(SERVER_DIR, "migrations"),
-    OPENSHIP_PGLITE_ASSETS_DIR: join6(SERVER_DIR, "pglite"),
     BETTER_AUTH_SECRET: ensureAuthSecret()
   };
+  if (!source) {
+    env.OPENSHIP_MIGRATIONS_DIR = join7(SERVER_DIR, "migrations");
+    env.OPENSHIP_PGLITE_ASSETS_DIR = join7(SERVER_DIR, "pglite");
+  }
   env.OPENSHIP_REQUIRE_AUTH = "true";
   env.INTERNAL_TOKEN = ensureInternalToken();
   env.OPENSHIP_API_HOST = "127.0.0.1";
@@ -3082,7 +3777,8 @@ async function runForeground(opts) {
   delete env.DATABASE_URL;
   delete env.POSTGRES_URL;
   const spinner3 = ora(`Starting Openship on http://localhost:${port} \u2026`).start();
-  const child = spawn(process.execPath, [serverEntry], {
+  const child = spawn2(apiCmd, apiArgs, {
+    cwd: apiCwd,
     env,
     stdio: ["ignore", "pipe", "pipe"],
     detached: process.platform !== "win32"
@@ -3146,10 +3842,11 @@ async function runForeground(opts) {
   };
   let dashboardUrl = null;
   if (opts.ui !== false) {
+    if (source) process.env.OPENSHIP_DASHBOARD_DIR = source.dashboardDir;
     const uiSpinner = ora("Preparing the dashboard\u2026").start();
     try {
       const bundle = await ensureDashboard({
-        tag: opts.uiVersion || `v${"0.2.2"}`,
+        tag: source ? "local" : opts.uiVersion || `v${"0.3.0"}`,
         onProgress: (received, total) => {
           if (total) {
             uiSpinner.text = `Downloading dashboard\u2026 ${Math.round(received / total * 100)}%`;
@@ -3157,7 +3854,7 @@ async function runForeground(opts) {
         }
       });
       uiSpinner.text = "Starting the dashboard\u2026";
-      const dash = spawn(process.execPath, [bundle.entry], {
+      const dash = spawn2(process.execPath, [bundle.entry], {
         cwd: bundle.cwd,
         detached: process.platform !== "win32",
         env: {
@@ -3271,15 +3968,15 @@ var stopCommand = new Command5("stop").description("Stop the Openship service (s
 
 // src/commands/init.ts
 import { Command as Command6 } from "commander";
-import { existsSync as existsSync6, mkdirSync as mkdirSync7, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync8, writeFileSync as writeFileSync6 } from "fs";
 import { createInterface as createInterface2 } from "readline/promises";
 import { stdin as input2, stdout as output2 } from "process";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 var initCommand = new Command6("init").description("Link the current directory to an Openship project (.openship/project.json)").option("--project <id>", "Project id to link (skips the picker)").option("--environment <name>", "Default deploy environment", "production").option("--dir <path>", "Directory to initialize", process.cwd()).option("--force", "Overwrite an existing project link").option("-y, --yes", "Non-interactive: fail instead of prompting").action(async (opts) => {
   const root = opts.dir || process.cwd();
-  const linkDir = join7(root, ".openship");
-  const linkPath = join7(linkDir, "project.json");
-  if (existsSync6(linkPath) && !opts.force) {
+  const linkDir = join8(root, ".openship");
+  const linkPath = join8(linkDir, "project.json");
+  if (existsSync7(linkPath) && !opts.force) {
     err(`Already linked (${linkPath}). Re-run with --force to overwrite.`);
     process.exit(1);
   }
@@ -3332,7 +4029,7 @@ var initCommand = new Command6("init").description("Link the current directory t
     context: getActiveContext(),
     defaults: { environment: opts.environment || "production" }
   };
-  mkdirSync7(linkDir, { recursive: true });
+  mkdirSync8(linkDir, { recursive: true });
   writeFileSync6(linkPath, JSON.stringify(link, null, 2) + "\n");
   if (isJsonMode()) {
     printJson({ path: linkPath, link });
@@ -3343,8 +4040,86 @@ var initCommand = new Command6("init").description("Link the current directory t
 `);
 });
 
-// src/commands/context.ts
+// src/commands/config.ts
 import { Command as Command7 } from "commander";
+import { existsSync as existsSync8, readFileSync as readFileSync5, writeFileSync as writeFileSync7 } from "fs";
+import { join as join9 } from "path";
+var SCHEMA_URL = "https://openship.io/openship.schema.json";
+var CONFIG_FILE = "openship.json";
+function detectHints(dir) {
+  const hints = {};
+  const lock = [
+    ["pnpm-lock.yaml", "pnpm"],
+    ["yarn.lock", "yarn"],
+    ["bun.lockb", "bun"],
+    ["package-lock.json", "npm"]
+  ];
+  for (const [file, pm] of lock) {
+    if (existsSync8(join9(dir, file))) {
+      hints.packageManager = pm;
+      break;
+    }
+  }
+  const pkgPath = join9(dir, "package.json");
+  if (existsSync8(pkgPath)) {
+    try {
+      const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
+      const runner = hints.packageManager ?? "npm";
+      const exec = runner === "npm" ? "npm run" : runner;
+      if (pkg.scripts?.build) hints.buildCommand = `${exec} build`;
+      if (pkg.scripts?.start) hints.startCommand = `${exec} start`;
+    } catch {
+    }
+  }
+  return hints;
+}
+var initCmd = new Command7("init").description("Scaffold an openship.json in the current directory").option("--dir <path>", "Directory to write into", process.cwd()).option("--force", "Overwrite an existing openship.json").action((opts) => {
+  const dir = opts.dir || process.cwd();
+  const path2 = join9(dir, CONFIG_FILE);
+  if (existsSync8(path2) && !opts.force) {
+    err(`${CONFIG_FILE} already exists. Re-run with --force to overwrite.`);
+    process.exit(1);
+  }
+  const hints = detectHints(dir);
+  const scaffold = { $schema: SCHEMA_URL, ...hints };
+  const text2 = JSON.stringify(scaffold, null, 2) + "\n";
+  writeFileSync7(path2, text2);
+  if (isJsonMode()) {
+    printJson({ path: path2, config: scaffold });
+    return;
+  }
+  ok(`
+  Wrote ${CONFIG_FILE} \u2192 ${path2}`);
+  info("  Edit it to declare framework, env, domains, resources, services\u2026 then `openship config validate`.\n");
+});
+var validateCmd = new Command7("validate").description("Validate an openship.json against the deploy schema").argument("[file]", "Path to the config file", CONFIG_FILE).action((file) => {
+  const path2 = file === CONFIG_FILE ? join9(process.cwd(), CONFIG_FILE) : file;
+  if (!existsSync8(path2)) {
+    if (isJsonMode()) printJson({ valid: false, errors: [`${path2} not found`], warnings: [] });
+    else err(`Not found: ${path2}`);
+    process.exit(1);
+  }
+  const { config, errors, warnings } = parseOpenshipConfigJson(readFileSync5(path2, "utf8"));
+  const valid = errors.length === 0 && config !== null;
+  if (isJsonMode()) {
+    printJson({ valid, errors, warnings });
+    process.exit(valid ? 0 : 1);
+  }
+  for (const w of warnings) info(`  \u26A0 ${w}`);
+  if (!valid) {
+    err(`
+  ${errors.length} error${errors.length === 1 ? "" : "s"} in ${CONFIG_FILE}:`);
+    for (const e of errors) err(`    \u2022 ${e}`);
+    process.exit(1);
+  }
+  ok(`
+  ${CONFIG_FILE} is valid${warnings.length ? ` (${warnings.length} warning${warnings.length === 1 ? "" : "s"})` : ""}.
+`);
+});
+var configCommand = new Command7("config").description("Author and validate openship.json (declarative deploy config)").addCommand(initCmd).addCommand(validateCmd);
+
+// src/commands/context.ts
+import { Command as Command8 } from "commander";
 function renderContexts() {
   const rows = listContexts().map((c) => ({
     current: c.current ? "*" : "",
@@ -3355,8 +4130,8 @@ function renderContexts() {
   }));
   printTable(rows, ["current", "name", "apiUrl", "dashboardUrl", "auth"]);
 }
-var listCmd = new Command7("list").alias("ls").description("List configured contexts").action(renderContexts);
-var useCmd = new Command7("use").description("Switch the active context").argument("<name>", "Context name").action((name) => {
+var listCmd = new Command8("list").alias("ls").description("List configured contexts").action(renderContexts);
+var useCmd = new Command8("use").description("Switch the active context").argument("<name>", "Context name").action((name) => {
   try {
     setActiveContext(name);
     ok(`
@@ -3367,7 +4142,7 @@ var useCmd = new Command7("use").description("Switch the active context").argume
     process.exit(1);
   }
 });
-var addCmd = new Command7("add").description("Create or update a context's endpoints/token").argument("<name>", "Context name").option("--api-url <url>", "API base URL").option("--dashboard-url <url>", "Dashboard base URL").option("--token <token>", "Personal Access Token to store").option("--use", "Switch to this context after adding").action((name, opts) => {
+var addCmd = new Command8("add").description("Create or update a context's endpoints/token").argument("<name>", "Context name").option("--api-url <url>", "API base URL").option("--dashboard-url <url>", "Dashboard base URL").option("--token <token>", "Personal Access Token to store").option("--use", "Switch to this context after adding").action((name, opts) => {
   addContext(name, {
     apiUrl: opts.apiUrl,
     dashboardUrl: opts.dashboardUrl,
@@ -3378,7 +4153,7 @@ var addCmd = new Command7("add").description("Create or update a context's endpo
   Saved context "${name}"${opts.use ? " (now active)" : ""}.
 `);
 });
-var rmCmd = new Command7("rm").alias("remove").description("Remove a context (cannot remove the active one)").argument("<name>", "Context name").action((name) => {
+var rmCmd = new Command8("rm").alias("remove").description("Remove a context (cannot remove the active one)").argument("<name>", "Context name").action((name) => {
   try {
     removeContext(name);
     ok(`
@@ -3389,25 +4164,25 @@ var rmCmd = new Command7("rm").alias("remove").description("Remove a context (ca
     process.exit(1);
   }
 });
-var contextCommand = new Command7("context").alias("ctx").description("Manage connection contexts (list/use/add/rm)").action(() => {
+var contextCommand = new Command8("context").alias("ctx").description("Manage connection contexts (list/use/add/rm)").action(() => {
   ok(`  Active context: ${getActiveContext()}`);
   renderContexts();
 }).addCommand(listCmd).addCommand(useCmd).addCommand(addCmd).addCommand(rmCmd);
 
 // src/commands/status.ts
-import { Command as Command8 } from "commander";
+import { Command as Command9 } from "commander";
 import chalk7 from "chalk";
-import { readFileSync as readFileSync5 } from "fs";
-import { homedir as homedir6 } from "os";
-import { join as join8 } from "path";
+import { readFileSync as readFileSync6 } from "fs";
+import { homedir as homedir7 } from "os";
+import { join as join10 } from "path";
 function readPorts() {
   try {
-    return JSON.parse(readFileSync5(join8(homedir6(), ".openship", "ports.json"), "utf8"));
+    return JSON.parse(readFileSync6(join10(homedir7(), ".openship", "ports.json"), "utf8"));
   } catch {
     return {};
   }
 }
-var statusCommand = new Command8("status").description("Show the local Openship service (installed/running, ports) and the active context's API health").action(async () => {
+var statusCommand = new Command9("status").description("Show the local Openship service (installed/running, ports) and the active context's API health").action(async () => {
   const context = getActiveContext();
   const apiUrl = getApiUrl2();
   const svc = serviceStatus();
@@ -3442,8 +4217,8 @@ var statusCommand = new Command8("status").description("Show the local Openship
 });
 
 // src/commands/doctor.ts
-import { Command as Command9 } from "commander";
-import { existsSync as existsSync7 } from "fs";
+import { Command as Command10 } from "commander";
+import { existsSync as existsSync9 } from "fs";
 import { execFileSync } from "child_process";
 import chalk8 from "chalk";
 function bunVersion() {
@@ -3455,9 +4230,9 @@ function bunVersion() {
     return null;
   }
 }
-var doctorCommand = new Command9("doctor").description("Diagnose the CLI setup (config, active context, runtime)").action(async () => {
+var doctorCommand = new Command10("doctor").description("Diagnose the CLI setup (config, active context, runtime)").action(async () => {
   const checks = [];
-  const hasConfig = existsSync7(CONFIG_PATH);
+  const hasConfig = existsSync9(CONFIG_PATH);
   checks.push({
     name: "config",
     status: hasConfig ? "pass" : "warn",
@@ -3505,20 +4280,20 @@ var doctorCommand = new Command9("doctor").description("Diagnose the CLI setup (
 });
 
 // src/commands/deploy.ts
-import { Command as Command10 } from "commander";
+import { Command as Command11 } from "commander";
 import { execFileSync as execFileSync3 } from "child_process";
 import ora2 from "ora";
 
 // src/lib/project-link.ts
-import { readFileSync as readFileSync6, existsSync as existsSync8 } from "fs";
-import { join as join9, dirname as dirname3, parse } from "path";
-var LINK_REL = join9(".openship", "project.json");
+import { readFileSync as readFileSync7, existsSync as existsSync10 } from "fs";
+import { join as join11, dirname as dirname3, parse } from "path";
+var LINK_REL = join11(".openship", "project.json");
 function findProjectLinkPath(from = process.cwd()) {
   let dir = from;
   const root = parse(dir).root;
   for (; ; ) {
-    const candidate = join9(dir, LINK_REL);
-    if (existsSync8(candidate)) return candidate;
+    const candidate = join11(dir, LINK_REL);
+    if (existsSync10(candidate)) return candidate;
     if (dir === root) return null;
     dir = dirname3(dir);
   }
@@ -3527,7 +4302,7 @@ function readProjectLink(from) {
   const path2 = findProjectLinkPath(from);
   if (!path2) return null;
   try {
-    return JSON.parse(readFileSync6(path2, "utf8"));
+    return JSON.parse(readFileSync7(path2, "utf8"));
   } catch {
     return null;
   }
@@ -3535,21 +4310,21 @@ function readProjectLink(from) {
 
 // src/lib/folder-deploy.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { readFileSync as readFileSync7, existsSync as existsSync9, rmSync as rmSync3 } from "fs";
+import { readFileSync as readFileSync8, existsSync as existsSync11, rmSync as rmSync3 } from "fs";
 import { tmpdir } from "os";
-import { join as join10, basename } from "path";
+import { join as join12, basename } from "path";
 function detectPackageManager(dir) {
-  if (existsSync9(join10(dir, "bun.lockb")) || existsSync9(join10(dir, "bun.lock"))) return "bun";
-  if (existsSync9(join10(dir, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync9(join10(dir, "yarn.lock"))) return "yarn";
-  if (existsSync9(join10(dir, "package.json"))) return "npm";
+  if (existsSync11(join12(dir, "bun.lockb")) || existsSync11(join12(dir, "bun.lock"))) return "bun";
+  if (existsSync11(join12(dir, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync11(join12(dir, "yarn.lock"))) return "yarn";
+  if (existsSync11(join12(dir, "package.json"))) return "npm";
   return void 0;
 }
 function detectStack(dir) {
-  if (existsSync9(join10(dir, "go.mod"))) return "go";
-  if (existsSync9(join10(dir, "Cargo.toml"))) return "rust";
-  if (existsSync9(join10(dir, "requirements.txt")) || existsSync9(join10(dir, "pyproject.toml"))) return "python";
-  if (existsSync9(join10(dir, "package.json"))) return "node";
+  if (existsSync11(join12(dir, "go.mod"))) return "go";
+  if (existsSync11(join12(dir, "Cargo.toml"))) return "rust";
+  if (existsSync11(join12(dir, "requirements.txt")) || existsSync11(join12(dir, "pyproject.toml"))) return "python";
+  if (existsSync11(join12(dir, "package.json"))) return "node";
   return void 0;
 }
 async function deployFolder(opts) {
@@ -3566,7 +4341,7 @@ async function deployFolder(opts) {
     throw new Error(session.error || "Failed to open upload session");
   }
   step("Packaging folder");
-  const tarball = join10(tmpdir(), `openship-upload-${session.sessionId}.tar.gz`);
+  const tarball = join12(tmpdir(), `openship-upload-${session.sessionId}.tar.gz`);
   execFileSync2(
     "tar",
     [
@@ -3585,7 +4360,7 @@ async function deployFolder(opts) {
   );
   step("Uploading source");
   try {
-    const body = readFileSync7(tarball);
+    const body = readFileSync8(tarball);
     const up = session.upload;
     const method = up.method || "POST";
     const res = /^https?:\/\//i.test(up.url) ? await fetch(up.url, { method, headers: up.headers, body }) : await apiRaw(`/${up.url.replace(/^\/+/, "")}`, { method, headers: up.headers, body });
@@ -3766,7 +4541,7 @@ function git(args) {
     return void 0;
   }
 }
-var deployCommand = new Command10("deploy").description("Trigger a deployment for the current project").option("--project <id>", "Project ID (defaults to the linked project in .openship/project.json)").option("--branch <name>", "Git branch to deploy (defaults to the current branch)").option("--commit <sha>", "Specific commit SHA (defaults to the latest commit on the branch)").option("--env <environment>", "Target environment: production | preview", "production").option("--force-all", "Rebuild every enabled service (skip smart per-service routing)").option("--service-ids <ids>", "Comma-separated service IDs to deploy (smart routing)").option("--smart-route", "Rebuild only services changed since the active deploy").option("--refresh", "Re-apply current env to the active deploy (no git pull, no rebuild)").option("--name <name>", "Project name for a folder (non-git) deploy (defaults to the directory name)").option("--watch", "Stream the deployment logs until it finishes").action(async (opts) => {
+var deployCommand = new Command11("deploy").description("Trigger a deployment for the current project").option("--project <id>", "Project ID (defaults to the linked project in .openship/project.json)").option("--branch <name>", "Git branch to deploy (defaults to the current branch)").option("--commit <sha>", "Specific commit SHA (defaults to the latest commit on the branch)").option("--env <environment>", "Target environment: production | preview", "production").option("--force-all", "Rebuild every enabled service (skip smart per-service routing)").option("--service-ids <ids>", "Comma-separated service IDs to deploy (smart routing)").option("--smart-route", "Rebuild only services changed since the active deploy").option("--refresh", "Re-apply current env to the active deploy (no git pull, no rebuild)").option("--name <name>", "Project name for a folder (non-git) deploy (defaults to the directory name)").option("--watch", "Stream the deployment logs until it finishes").action(async (opts) => {
   const link = readProjectLink();
   const env = opts.env;
   if (env !== "production" && env !== "preview") {
@@ -3848,9 +4623,9 @@ var deployCommand = new Command10("deploy").description("Trigger a deployment fo
 });
 
 // src/commands/deployment.ts
-import { Command as Command11 } from "commander";
+import { Command as Command12 } from "commander";
 import { createInterface as createInterface3 } from "readline";
-function run2(fn) {
+function run3(fn) {
   return async (...args) => {
     try {
       await fn(...args);
@@ -3864,18 +4639,18 @@ function report(res, message) {
   if (isJsonMode()) printJson(res);
   else ok(message);
 }
-function shortSha(v) {
+function shortSha2(v) {
   return typeof v === "string" ? v.slice(0, 7) : "";
 }
 async function confirm(question) {
   if (!process.stdin.isTTY) return true;
   const rl = createInterface3({ input: process.stdin, output: process.stderr });
-  const answer = await new Promise((resolve2) => rl.question(`${question} [y/N] `, resolve2));
+  const answer = await new Promise((resolve3) => rl.question(`${question} [y/N] `, resolve3));
   rl.close();
   return /^y(es)?$/i.test(answer.trim());
 }
-var list = new Command11("list").description("List deployments (org-wide, or scoped to a project)").option("--project <id>", "Scope to a project (defaults to the linked project)").option("--env <environment>", "Filter by environment: production | preview").option("--limit <n>", "Max rows to fetch", "50").action(
-  run2(async (opts) => {
+var list = new Command12("list").description("List deployments (org-wide, or scoped to a project)").option("--project <id>", "Scope to a project (defaults to the linked project)").option("--env <environment>", "Filter by environment: production | preview").option("--limit <n>", "Max rows to fetch", "50").action(
+  run3(async (opts) => {
     const projectId = opts.project || readProjectLink()?.projectId;
     const params = new URLSearchParams();
     if (projectId) params.set("projectId", projectId);
@@ -3890,15 +4665,15 @@ var list = new Command11("list").description("List deployments (org-wide, or sco
       status: d.status,
       env: d.environment,
       branch: d.branch,
-      commit: shortSha(d.commitSha),
+      commit: shortSha2(d.commitSha),
       active: d.isActive ? "*" : "",
       created: d.createdAt
     }));
     printTable(rows, ["id", "status", "env", "branch", "commit", "active", "created"]);
   })
 );
-var get = new Command11("get").description("Show a single deployment").argument("<id>", "Deployment ID").action(
-  run2(async (id) => {
+var get = new Command12("get").description("Show a single deployment").argument("<id>", "Deployment ID").action(
+  run3(async (id) => {
     const res = await apiRequest(`/deployments/${id}`);
     const d = res.data ?? {};
     if (isJsonMode()) return printJson(d);
@@ -3918,20 +4693,20 @@ var get = new Command11("get").description("Show a single deployment").argument(
     );
   })
 );
-var info2 = new Command11("info").description("Show container info for a deployment").argument("<id>", "Deployment ID").action(
-  run2(async (id) => {
+var info2 = new Command12("info").description("Show container info for a deployment").argument("<id>", "Deployment ID").action(
+  run3(async (id) => {
     const res = await apiRequest(`/deployments/${id}/info`);
     printJson(res.data ?? res);
   })
 );
-var usage = new Command11("usage").description("Show container resource usage for a deployment").argument("<id>", "Deployment ID").action(
-  run2(async (id) => {
+var usage = new Command12("usage").description("Show container resource usage for a deployment").argument("<id>", "Deployment ID").action(
+  run3(async (id) => {
     const res = await apiRequest(`/deployments/${id}/usage`);
     printJson(res.data ?? res);
   })
 );
-var redeploy = new Command11("redeploy").description("Redeploy from an existing deployment").argument("<id>", "Deployment ID").option("--use-existing-commit", "Rebuild the same commit instead of the latest on the branch").action(
-  run2(async (id, opts) => {
+var redeploy = new Command12("redeploy").description("Redeploy from an existing deployment").argument("<id>", "Deployment ID").option("--use-existing-commit", "Rebuild the same commit instead of the latest on the branch").action(
+  run3(async (id, opts) => {
     const res = await apiRequest(`/deployments/${id}/redeploy`, {
       method: "POST",
       body: JSON.stringify({ useExistingCommit: opts.useExistingCommit === true })
@@ -3939,14 +4714,14 @@ var redeploy = new Command11("redeploy").description("Redeploy from an existing
     report(res, `Redeploy triggered for ${id}`);
   })
 );
-var rollback = new Command11("rollback").description("Roll back to a previous deployment").argument("<id>", "Deployment ID to roll back to").action(
-  run2(async (id) => {
+var rollback = new Command12("rollback").description("Roll back to a previous deployment").argument("<id>", "Deployment ID to roll back to").action(
+  run3(async (id) => {
     const res = await apiRequest(`/deployments/${id}/rollback`, { method: "POST" });
     report(res, `Rolled back to ${id}`);
   })
 );
-var pin = new Command11("pin").description("Pin (or unpin) a deployment's rollback artifact").argument("<id>", "Deployment ID").option("--off", "Unpin instead of pin").action(
-  run2(async (id, opts) => {
+var pin = new Command12("pin").description("Pin (or unpin) a deployment's rollback artifact").argument("<id>", "Deployment ID").option("--off", "Unpin instead of pin").action(
+  run3(async (id, opts) => {
     const pinned = !opts.off;
     const res = await apiRequest(`/deployments/${id}/pin`, {
       method: "POST",
@@ -3955,32 +4730,32 @@ var pin = new Command11("pin").description("Pin (or unpin) a deployment's rollba
     report(res, `${pinned ? "Pinned" : "Unpinned"} ${id}`);
   })
 );
-var cancel = new Command11("cancel").description("Cancel an in-progress deployment").argument("<id>", "Deployment ID").action(
-  run2(async (id) => {
+var cancel = new Command12("cancel").description("Cancel an in-progress deployment").argument("<id>", "Deployment ID").action(
+  run3(async (id) => {
     const res = await apiRequest(`/deployments/${id}/cancel`, { method: "POST" });
     report(res, `Cancelled ${id}`);
   })
 );
-var restart2 = new Command11("restart").description("Restart a deployment's container").argument("<id>", "Deployment ID").action(
-  run2(async (id) => {
+var restart2 = new Command12("restart").description("Restart a deployment's container").argument("<id>", "Deployment ID").action(
+  run3(async (id) => {
     const res = await apiRequest(`/deployments/${id}/restart`, { method: "POST" });
     report(res, `Restarted ${id}`);
   })
 );
-var reject = new Command11("reject").description("Reject a finished deployment awaiting a keep/reject decision").argument("<id>", "Deployment ID").action(
-  run2(async (id) => {
+var reject = new Command12("reject").description("Reject a finished deployment awaiting a keep/reject decision").argument("<id>", "Deployment ID").action(
+  run3(async (id) => {
     const res = await apiRequest(`/deployments/${id}/reject`, { method: "POST" });
     report(res, `Rejected ${id}`);
   })
 );
-var keep = new Command11("keep").description("Keep a finished deployment awaiting a keep/reject decision").argument("<id>", "Deployment ID").action(
-  run2(async (id) => {
+var keep = new Command12("keep").description("Keep a finished deployment awaiting a keep/reject decision").argument("<id>", "Deployment ID").action(
+  run3(async (id) => {
     const res = await apiRequest(`/deployments/${id}/keep`, { method: "POST" });
     report(res, `Kept ${id}`);
   })
 );
-var rm = new Command11("rm").description("Delete a deployment").argument("<id>", "Deployment ID").option("-y, --yes", "Skip the confirmation prompt").action(
-  run2(async (id, opts) => {
+var rm = new Command12("rm").description("Delete a deployment").argument("<id>", "Deployment ID").option("-y, --yes", "Skip the confirmation prompt").action(
+  run3(async (id, opts) => {
     if (!opts.yes && !isJsonMode() && !await confirm(`Delete deployment ${id}?`)) {
       err("Aborted.");
       process.exit(1);
@@ -3989,8 +4764,8 @@ var rm = new Command11("rm").description("Delete a deployment").argument("<id>",
     report(res, `Deleted ${id}`);
   })
 );
-var sslStatus = new Command11("status").description("Check SSL certificate status for a domain").argument("<domain>", "Domain to probe").action(
-  run2(async (domain) => {
+var sslStatus = new Command12("status").description("Check SSL certificate status for a domain").argument("<domain>", "Domain to probe").action(
+  run3(async (domain) => {
     const res = await apiRequest("/deployments/ssl/status", {
       method: "POST",
       body: JSON.stringify({ domain })
@@ -3998,8 +4773,8 @@ var sslStatus = new Command11("status").description("Check SSL certificate statu
     printJson(res);
   })
 );
-var sslRenew = new Command11("renew").description("Renew (issue) an SSL certificate for a domain").argument("<domain>", "Domain to renew").option("--www", "Also include the www subdomain").action(
-  run2(async (domain, opts) => {
+var sslRenew = new Command12("renew").description("Renew (issue) an SSL certificate for a domain").argument("<domain>", "Domain to renew").option("--www", "Also include the www subdomain").action(
+  run3(async (domain, opts) => {
     const res = await apiRequest("/deployments/ssl/renew", {
       method: "POST",
       body: JSON.stringify({ domain, includeWww: opts.www === true })
@@ -4007,12 +4782,12 @@ var sslRenew = new Command11("renew").description("Renew (issue) an SSL certific
     report(res, `SSL renewal requested for ${domain}`);
   })
 );
-var ssl = new Command11("ssl").description("SSL certificate operations").addCommand(sslStatus).addCommand(sslRenew);
-var deploymentCommand = new Command11("deployment").alias("deployments").description("Manage deployments (list, inspect, redeploy, rollback, \u2026)").addCommand(list).addCommand(get).addCommand(info2).addCommand(usage).addCommand(redeploy).addCommand(rollback).addCommand(pin).addCommand(cancel).addCommand(restart2).addCommand(reject).addCommand(keep).addCommand(rm).addCommand(ssl);
+var ssl = new Command12("ssl").description("SSL certificate operations").addCommand(sslStatus).addCommand(sslRenew);
+var deploymentCommand = new Command12("deployment").alias("deployments").description("Manage deployments (list, inspect, redeploy, rollback, \u2026)").addCommand(list).addCommand(get).addCommand(info2).addCommand(usage).addCommand(redeploy).addCommand(rollback).addCommand(pin).addCommand(cancel).addCommand(restart2).addCommand(reject).addCommand(keep).addCommand(rm).addCommand(ssl);
 
 // src/commands/logs.ts
-import { Command as Command12 } from "commander";
-var logsCommand = new Command12("logs").description("View or stream a deployment's logs").argument("<deploymentId>", "Deployment ID").option("-f, --follow", "Stream live logs via SSE until the deployment finishes").option("--tail <n>", "Show only the last N log lines (snapshot mode)").action(async (deploymentId, opts) => {
+import { Command as Command13 } from "commander";
+var logsCommand = new Command13("logs").description("View or stream a deployment's logs").argument("<deploymentId>", "Deployment ID").option("-f, --follow", "Stream live logs via SSE until the deployment finishes").option("--tail <n>", "Show only the last N log lines (snapshot mode)").action(async (deploymentId, opts) => {
   if (opts.follow) {
     try {
       const result = await streamDeploymentLogs(deploymentId);
@@ -4044,7 +4819,7 @@ var logsCommand = new Command12("logs").description("View or stream a deployment
 });
 
 // src/commands/project.ts
-import { Command as Command13 } from "commander";
+import { Command as Command14 } from "commander";
 import chalk9 from "chalk";
 import { createInterface as createInterface4 } from "readline/promises";
 import { stdin as input3, stdout as output3 } from "process";
@@ -4081,7 +4856,7 @@ function printProject(project) {
   }
 }
 var ENVIRONMENTS = ["production", "preview", "development"];
-var listCmd2 = new Command13("list").alias("ls").description("List projects in the active organization").action(
+var listCmd2 = new Command14("list").alias("ls").description("List projects in the active organization").action(
   action(async () => {
     const rows = [];
     for await (const p of paginate("/projects")) {
@@ -4096,7 +4871,7 @@ var listCmd2 = new Command13("list").alias("ls").description("List projects in t
     printTable(rows, ["id", "name", "slug", "repo", "source"]);
   })
 );
-var getCmd = new Command13("get").description("Show a single project").argument("<id>", "Project ID").action(
+var getCmd = new Command14("get").description("Show a single project").argument("<id>", "Project ID").action(
   action(async (id) => {
     const { data } = await apiRequest(
       `/projects/${encodeURIComponent(id)}`
@@ -4104,7 +4879,7 @@ var getCmd = new Command13("get").description("Show a single project").argument(
     printProject(data);
   })
 );
-var createCmd = new Command13("create").description("Create a project").requiredOption("--name <name>", "Project name").option("--slug <slug>", "Free-subdomain slug (slug.opsh.io)").option("--git-owner <owner>", "GitHub owner/org").option("--git-repo <repo>", "GitHub repository name").option("--git-branch <branch>", "Git branch to deploy").option("--framework <framework>", "Stack/framework id").option("--local-path <path>", "Local source path").option("--port <port>", "Container port", (v) => Number(v)).option(
+var createCmd = new Command14("create").description("Create a project").requiredOption("--name <name>", "Project name").option("--slug <slug>", "Free-subdomain slug (slug.opsh.io)").option("--git-owner <owner>", "GitHub owner/org").option("--git-repo <repo>", "GitHub repository name").option("--git-branch <branch>", "Git branch to deploy").option("--framework <framework>", "Stack/framework id").option("--local-path <path>", "Local source path").option("--port <port>", "Container port", (v) => Number(v)).option(
   "--type <type>",
   "Project type: app | docker | services | monorepo"
 ).action(
@@ -4128,7 +4903,7 @@ var createCmd = new Command13("create").description("Create a project").required
     printProject(data);
   })
 );
-var deleteCmd = new Command13("delete").alias("rm").description("Delete a project (tears down all resources)").argument("<id>", "Project ID").option("--force", "Cancel active work and delete anyway").option("--force-orphan", "Orphan resources that won't destroy, then drop the row").option("--wipe-volumes", "Also destroy persistent volumes").option("-y, --yes", "Skip the confirmation prompt").action(
+var deleteCmd = new Command14("delete").alias("rm").description("Delete a project (tears down all resources)").argument("<id>", "Project ID").option("--force", "Cancel active work and delete anyway").option("--force-orphan", "Orphan resources that won't destroy, then drop the row").option("--wipe-volumes", "Also destroy persistent volumes").option("-y, --yes", "Skip the confirmation prompt").action(
   action(async (id, opts) => {
     if (!opts.yes) {
       const rl = createInterface4({ input: input3, output: output3 });
@@ -4159,7 +4934,7 @@ var deleteCmd = new Command13("delete").alias("rm").description("Delete a projec
 `);
   })
 );
-var envCmd = new Command13("env").description("Manage project environment variables");
+var envCmd = new Command14("env").description("Manage project environment variables");
 envCmd.command("get").description("List env vars (secret values are masked by the API)").argument("<id>", "Project ID").option("--environment <env>", "Filter by environment (production|preview|development)").action(
   action(async (id, opts) => {
     const qs = opts.environment ? `?environment=${encodeURIComponent(opts.environment)}` : "";
@@ -4233,7 +5008,7 @@ envCmd.command("set").description("Merge env vars: upsert KEY=VALUE pairs and/or
     );
   })
 );
-var gitCmd = new Command13("git").description("Manage git linkage and auto-deploy");
+var gitCmd = new Command14("git").description("Manage git linkage and auto-deploy");
 gitCmd.command("link").description("Link a GitHub repository to a project").argument("<id>", "Project ID").requiredOption("--owner <owner>", "GitHub owner/org").requiredOption("--repo <repo>", "Repository name").option("--branch <branch>", "Branch (defaults to the repo's default branch)").option("--installation-id <id>", "GitHub App installation id", (v) => Number(v)).action(
   action(async (id, opts) => {
     const result = await apiRequest(
@@ -4321,7 +5096,7 @@ gitCmd.command("webhook-domain").description("Set or clear the domain that recei
 `);
   })
 );
-var connectCmd = new Command13("connect").description("Connect a custom domain to a project").argument("<id>", "Project ID").argument("<domain>", "Custom domain hostname").option("--include-www", "Also connect the www. variant").action(
+var connectCmd = new Command14("connect").description("Connect a custom domain to a project").argument("<id>", "Project ID").argument("<domain>", "Custom domain hostname").option("--include-www", "Also connect the www. variant").action(
   action(async (id, domain, opts) => {
     const result = await apiRequest(
       `/projects/${encodeURIComponent(id)}/connect`,
@@ -4341,7 +5116,7 @@ var connectCmd = new Command13("connect").description("Connect a custom domain t
     printJson(result.records);
   })
 );
-var enableCmd = new Command13("enable").description("Start a stopped project").argument("<id>", "Project ID").action(
+var enableCmd = new Command14("enable").description("Start a stopped project").argument("<id>", "Project ID").action(
   action(async (id) => {
     const result = await apiRequest(
       `/projects/${encodeURIComponent(id)}/enable`,
@@ -4353,7 +5128,7 @@ var enableCmd = new Command13("enable").description("Start a stopped project").a
 `);
   })
 );
-var disableCmd = new Command13("disable").description("Stop a running project").argument("<id>", "Project ID").action(
+var disableCmd = new Command14("disable").description("Stop a running project").argument("<id>", "Project ID").action(
   action(async (id) => {
     const result = await apiRequest(
       `/projects/${encodeURIComponent(id)}/disable`,
@@ -4366,7 +5141,7 @@ var disableCmd = new Command13("disable").description("Stop a running project").
   })
 );
 var SLEEP_MODES = ["auto_sleep", "always_on"];
-var sleepModeCmd = new Command13("sleep-mode").description("Set the project sleep mode").argument("<id>", "Project ID").argument("<mode>", `One of: ${SLEEP_MODES.join(", ")}`).action(
+var sleepModeCmd = new Command14("sleep-mode").description("Set the project sleep mode").argument("<id>", "Project ID").argument("<mode>", `One of: ${SLEEP_MODES.join(", ")}`).action(
   action(async (id, mode) => {
     if (!SLEEP_MODES.includes(mode)) {
       err(`  mode must be one of: ${SLEEP_MODES.join(", ")}`);
@@ -4384,7 +5159,7 @@ var sleepModeCmd = new Command13("sleep-mode").description("Set the project slee
   })
 );
 var TRANSFER_DIRS = ["to-cloud", "to-self-hosted"];
-var transferCmd = new Command13("transfer").description("Promote a project to Openship Cloud, or bring it back (self-hosted only)").argument("<id>", "Project ID").argument("<direction>", `One of: ${TRANSFER_DIRS.join(", ")}`).action(
+var transferCmd = new Command14("transfer").description("Promote a project to Openship Cloud, or bring it back (self-hosted only)").argument("<id>", "Project ID").argument("<direction>", `One of: ${TRANSFER_DIRS.join(", ")}`).action(
   action(async (id, direction) => {
     if (!TRANSFER_DIRS.includes(direction)) {
       err(`  direction must be one of: ${TRANSFER_DIRS.join(", ")}`);
@@ -4407,7 +5182,7 @@ var transferCmd = new Command13("transfer").description("Promote a project to Op
     );
   })
 );
-var logsCmd = new Command13("logs").description("Show or stream runtime (container) logs").argument("<id>", "Project ID").option("--tail <n>", "Number of recent lines", (v) => Number(v)).option("-f, --follow", "Stream logs until interrupted").action(
+var logsCmd = new Command14("logs").description("Show or stream runtime (container) logs").argument("<id>", "Project ID").option("--tail <n>", "Number of recent lines", (v) => Number(v)).option("-f, --follow", "Stream logs until interrupted").action(
   action(async (id, opts) => {
     const tailQs = opts.tail ? `?tail=${opts.tail}` : "";
     if (!opts.follow) {
@@ -4435,7 +5210,7 @@ var logsCmd = new Command13("logs").description("Show or stream runtime (contain
     }
   })
 );
-var serverLogsCmd = new Command13("server-logs").description("Show or stream HTTP request logs (edge/OpenResty)").argument("<id>", "Project ID").option("--limit <n>", "Number of recent entries (max 200)", (v) => Number(v)).option("--domain <domain>", "Restrict to a specific domain").option("-f, --follow", "Stream request logs until interrupted").action(
+var serverLogsCmd = new Command14("server-logs").description("Show or stream HTTP request logs (edge/OpenResty)").argument("<id>", "Project ID").option("--limit <n>", "Number of recent entries (max 200)", (v) => Number(v)).option("--domain <domain>", "Restrict to a specific domain").option("-f, --follow", "Stream request logs until interrupted").action(
   action(async (id, opts) => {
     const base = `/projects/${encodeURIComponent(id)}/server-logs`;
     const domainQs = opts.domain ? `domain=${encodeURIComponent(opts.domain)}` : "";
@@ -4483,7 +5258,7 @@ function printLogEntry(entry) {
   process.stdout.write(`  ${ts} ${color(level.padEnd(5))} ${String(msg)}
 `);
 }
-var projectCommand = new Command13("project").alias("projects").description("Manage Openship projects");
+var projectCommand = new Command14("project").alias("projects").description("Manage Openship projects");
 projectCommand.addCommand(listCmd2);
 projectCommand.addCommand(getCmd);
 projectCommand.addCommand(createCmd);
@@ -4499,9 +5274,9 @@ projectCommand.addCommand(logsCmd);
 projectCommand.addCommand(serverLogsCmd);
 
 // src/commands/service.ts
-import { Command as Command14 } from "commander";
+import { Command as Command15 } from "commander";
 import chalk10 from "chalk";
-import { spawnSync as spawnSync3 } from "child_process";
+import { spawnSync as spawnSync4 } from "child_process";
 import path from "path";
 import { createInterface as createInterface5 } from "readline/promises";
 import { stdin as input4, stdout as output4 } from "process";
@@ -4520,7 +5295,7 @@ function fail(e) {
   process.exit(1);
 }
 function stackCommand(name) {
-  return new Command14(name).requiredOption(
+  return new Command15(name).requiredOption(
     "-p, --project <id|slug|name>",
     "Stack (project) id, slug, or name"
   );
@@ -4768,7 +5543,7 @@ function mapComposeService(name, def, baseDir) {
 var syncCmd = stackCommand("sync").description("Sync a stack's services from a docker-compose file (services not in the file are removed)").argument("<compose-file>", "Path to docker-compose.yml / compose.yaml").option("-y, --yes", "Skip the confirmation prompt").action(async (composeFile, opts) => {
   requireAuth();
   const abs = path.resolve(composeFile);
-  const proc = spawnSync3(
+  const proc = spawnSync4(
     "docker",
     ["compose", "-f", abs, "config", "--format", "json"],
     { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 }
@@ -4862,7 +5637,7 @@ var containersCmd = stackCommand("containers").description("List the stack's act
     fail(e);
   }
 });
-var driftCmd = new Command14("drift").description(
+var driftCmd = new Command15("drift").description(
   "Resolve compose drift on a service (upstream compose changed a value you edited)"
 );
 function driftActionCommand(action2) {
@@ -4890,7 +5665,7 @@ function driftActionCommand(action2) {
 }
 driftCmd.addCommand(driftActionCommand("accept"));
 driftCmd.addCommand(driftActionCommand("keep"));
-var envCmd2 = new Command14("env").description("Read and write a service's environment variables");
+var envCmd2 = new Command15("env").description("Read and write a service's environment variables");
 var envGetCmd = stackCommand("get").description("List a service's environment variables (secrets masked)").argument("<service>", "Service name or id").option("-e, --env <environment>", "Environment: production | preview | development").action(async (service, opts) => {
   requireAuth();
   try {
@@ -5023,7 +5798,7 @@ var execCmd = stackCommand("exec").description("Open an interactive shell in a s
   );
   process.exit(1);
 });
-var serviceCommand = new Command14("service").alias("services").description("Manage the services in a compose stack (a multi-service project)");
+var serviceCommand = new Command15("service").alias("services").description("Manage the services in a compose stack (a multi-service project)");
 serviceCommand.addCommand(listCmd3);
 serviceCommand.addCommand(getCmd2);
 serviceCommand.addCommand(createCmd2);
@@ -5039,7 +5814,7 @@ serviceCommand.addCommand(logsCmd2);
 serviceCommand.addCommand(execCmd);
 
 // src/commands/domain.ts
-import { Command as Command15 } from "commander";
+import { Command as Command16 } from "commander";
 import chalk11 from "chalk";
 import ora3 from "ora";
 function spin(text2) {
@@ -5075,7 +5850,7 @@ function printRecords(result) {
     ["type", "host", "value"]
   );
 }
-var listCmd4 = new Command15("list").description("List a project's custom domains").requiredOption("-p, --project <id>", "Project ID to list domains for").action(async (opts) => {
+var listCmd4 = new Command16("list").description("List a project's custom domains").requiredOption("-p, --project <id>", "Project ID to list domains for").action(async (opts) => {
   try {
     const res = await apiRequest(
       `/domains?projectId=${encodeURIComponent(opts.project)}`
@@ -5090,7 +5865,7 @@ var listCmd4 = new Command15("list").description("List a project's custom domain
     fail2(e);
   }
 });
-var addCmd2 = new Command15("add").description("Add a custom domain to a project").argument("<hostname>", "Domain hostname (e.g. app.example.com)").requiredOption("-p, --project <id>", "Project ID to attach the domain to").option("--primary", "Mark this domain as the project's primary", false).action(async (hostname, opts) => {
+var addCmd2 = new Command16("add").description("Add a custom domain to a project").argument("<hostname>", "Domain hostname (e.g. app.example.com)").requiredOption("-p, --project <id>", "Project ID to attach the domain to").option("--primary", "Mark this domain as the project's primary", false).action(async (hostname, opts) => {
   const sp = spin(`Adding ${hostname}\u2026`);
   try {
     const res = await apiRequest("/domains", {
@@ -5109,7 +5884,7 @@ var addCmd2 = new Command15("add").description("Add a custom domain to a project
     fail2(e);
   }
 });
-var previewCmd = new Command15("preview").description("Preview the DNS records a hostname would need (no changes saved)").argument("<hostname>", "Domain hostname to preview").action(async (hostname) => {
+var previewCmd = new Command16("preview").description("Preview the DNS records a hostname would need (no changes saved)").argument("<hostname>", "Domain hostname to preview").action(async (hostname) => {
   try {
     const res = await apiRequest("/domains/preview", {
       method: "POST",
@@ -5120,7 +5895,7 @@ var previewCmd = new Command15("preview").description("Preview the DNS records a
     fail2(e);
   }
 });
-var verifyCmd = new Command15("verify").description("Run DNS verification for a domain").argument("<id>", "Domain ID").action(async (id) => {
+var verifyCmd = new Command16("verify").description("Run DNS verification for a domain").argument("<id>", "Domain ID").action(async (id) => {
   const sp = spin("Checking DNS records\u2026");
   try {
     const res = await apiRaw(`/domains/${encodeURIComponent(id)}/verify`, { method: "POST" });
@@ -5146,7 +5921,7 @@ var verifyCmd = new Command15("verify").description("Run DNS verification for a
     fail2(e);
   }
 });
-var primaryCmd = new Command15("primary").description("Make a domain the project's primary hostname").argument("<id>", "Domain ID").action(async (id) => {
+var primaryCmd = new Command16("primary").description("Make a domain the project's primary hostname").argument("<id>", "Domain ID").action(async (id) => {
   const sp = spin("Setting primary\u2026");
   try {
     const res = await apiRequest(`/domains/${encodeURIComponent(id)}/primary`, {
@@ -5159,7 +5934,7 @@ var primaryCmd = new Command15("primary").description("Make a domain the project
     fail2(e);
   }
 });
-var recordsCmd = new Command15("records").description("Show the DNS records for an existing domain").argument("<id>", "Domain ID").action(async (id) => {
+var recordsCmd = new Command16("records").description("Show the DNS records for an existing domain").argument("<id>", "Domain ID").action(async (id) => {
   try {
     const res = await apiRequest(`/domains/${encodeURIComponent(id)}/records`);
     printRecords(res.data);
@@ -5177,7 +5952,7 @@ function printSsl(data) {
   if (data.issuer) info(`  issuer:  ${data.issuer}`);
   if (data.expiresAt) info(`  expires: ${data.expiresAt}`);
 }
-var renewCmd = new Command15("renew").description("Renew the SSL certificate for a domain").argument("<id>", "Domain ID").action(async (id) => {
+var renewCmd = new Command16("renew").description("Renew the SSL certificate for a domain").argument("<id>", "Domain ID").action(async (id) => {
   const sp = spin("Renewing certificate\u2026");
   try {
     const res = await apiRequest(`/domains/${encodeURIComponent(id)}/renew`, {
@@ -5190,7 +5965,7 @@ var renewCmd = new Command15("renew").description("Renew the SSL certificate for
     fail2(e);
   }
 });
-var verifySslCmd = new Command15("verify-ssl").description("Recheck that a domain's SSL certificate is issued and valid (no reissue)").argument("<id>", "Domain ID").action(async (id) => {
+var verifySslCmd = new Command16("verify-ssl").description("Recheck that a domain's SSL certificate is issued and valid (no reissue)").argument("<id>", "Domain ID").action(async (id) => {
   const sp = spin("Checking certificate\u2026");
   try {
     const res = await apiRequest(`/domains/${encodeURIComponent(id)}/verify-ssl`, {
@@ -5205,7 +5980,7 @@ var verifySslCmd = new Command15("verify-ssl").description("Recheck that a domai
     fail2(e);
   }
 });
-var renewAllCmd = new Command15("renew-all").description("Renew SSL for every near-expiry domain in your organization").action(async () => {
+var renewAllCmd = new Command16("renew-all").description("Renew SSL for every near-expiry domain in your organization").action(async () => {
   const sp = spin("Renewing expiring certificates\u2026");
   try {
     const res = await apiRequest("/domains/renew-all", { method: "POST" });
@@ -5227,10 +6002,10 @@ var renewAllCmd = new Command15("renew-all").description("Renew SSL for every ne
     fail2(e);
   }
 });
-var domainCommand = new Command15("domain").description("Manage custom domains, DNS verification, and SSL certificates").addCommand(listCmd4).addCommand(addCmd2).addCommand(previewCmd).addCommand(verifyCmd).addCommand(primaryCmd).addCommand(recordsCmd).addCommand(renewCmd).addCommand(verifySslCmd).addCommand(renewAllCmd);
+var domainCommand = new Command16("domain").description("Manage custom domains, DNS verification, and SSL certificates").addCommand(listCmd4).addCommand(addCmd2).addCommand(previewCmd).addCommand(verifyCmd).addCommand(primaryCmd).addCommand(recordsCmd).addCommand(renewCmd).addCommand(verifySslCmd).addCommand(renewAllCmd);
 
 // src/commands/server.ts
-import { Command as Command16 } from "commander";
+import { Command as Command17 } from "commander";
 import chalk12 from "chalk";
 import ora4 from "ora";
 var INSTALLABLE = ["docker", "git", "openresty", "certbot", "rsync"];
@@ -5263,7 +6038,7 @@ function connBody(o) {
     sshArgs: o.sshArgs
   };
 }
-var server = new Command16("server").description("Manage self-hosted SSH servers");
+var server = new Command17("server").description("Manage self-hosted SSH servers");
 server.command("list").alias("ls").description("List servers in the active organization").action(
   guard(async () => {
     const servers = await apiRequest("/system/servers");
@@ -5525,9 +6300,9 @@ function fmtUptime(seconds) {
 var serverCommand = server;
 
 // src/commands/system.ts
-import { Command as Command17 } from "commander";
+import { Command as Command18 } from "commander";
 import ora5 from "ora";
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync7 } from "fs";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync8 } from "fs";
 import { createInterface as createInterface6 } from "readline/promises";
 import { stdin as input5, stdout as output5 } from "process";
 async function guarded(fn) {
@@ -5573,7 +6348,7 @@ async function promptHidden(query) {
   output5.write("\n");
   return answer;
 }
-var settingsCommand = new Command17("settings").description("Read or update instance settings");
+var settingsCommand = new Command18("settings").description("Read or update instance settings");
 settingsCommand.command("get").description("Show current instance settings").action(async () => {
   await guarded(async () => {
     const s = await apiRequest("/system/settings");
@@ -5612,7 +6387,7 @@ settingsCommand.command("set").description("Update instance-level settings").opt
 `));
   });
 });
-var onboardingCommand = new Command17("onboarding").description("First-run instance setup");
+var onboardingCommand = new Command18("onboarding").description("First-run instance setup");
 onboardingCommand.command("apply").description("Configure a fresh instance (fails once already configured)").option("--ssh-host <host>", "SSH host of the target server").option("--ssh-port <n>", "SSH port (default 22)").option("--ssh-user <user>", "SSH user (default root)").option("--ssh-auth-method <method>", "SSH auth method").option("--ssh-password <password>", "SSH password").option("--ssh-key-path <path>", "SSH private key path").option("--ssh-key-passphrase <pass>", "SSH key passphrase").option("--ssh-jump-host <host>", "SSH jump host").option("--ssh-args <args>", "Extra SSH args").option("--server-name <name>", "Display name for the server").option("--auth-mode <mode>", "Initial auth mode: none | local | cloud").option("--tunnel-provider <provider>", "Tunnel provider").option("--tunnel-token <token>", "Tunnel token").option("--default-build-mode <mode>", "Default build mode").option("--default-rollback-window <n>", "Default rollback window").action(async (opts) => {
   await guarded(async () => {
     const body = {
@@ -5646,7 +6421,7 @@ onboardingCommand.command("apply").description("Configure a fresh instance (fail
     }
   });
 });
-var upgradeToAuthCommand = new Command17("upgrade-to-auth").description("Promote a zero-auth instance to email/password login").option("--name <name>", "Account display name").option("--email <email>", "Account email").option("--password <password>", "Account password (prompted if omitted)").option("--use-own-mail-server", "Warm the self-hosted mail server for auth emails").action(async (opts) => {
+var upgradeToAuthCommand = new Command18("upgrade-to-auth").description("Promote a zero-auth instance to email/password login").option("--name <name>", "Account display name").option("--email <email>", "Account email").option("--password <password>", "Account password (prompted if omitted)").option("--use-own-mail-server", "Warm the self-hosted mail server for auth emails").action(async (opts) => {
   await guarded(async () => {
     const name = opts.name;
     const email = opts.email;
@@ -5675,7 +6450,7 @@ var upgradeToAuthCommand = new Command17("upgrade-to-auth").description("Promote
 `));
   });
 });
-var browseCommand = new Command17("browse").description("List directories on the instance host (defaults to home)").argument("[path]", "Directory to list").action(async (path2) => {
+var browseCommand = new Command18("browse").description("List directories on the instance host (defaults to home)").argument("[path]", "Directory to list").action(async (path2) => {
   await guarded(async () => {
     const qs = path2 ? `?path=${encodeURIComponent(path2)}` : "";
     const res = await apiRequest(`/system/browse${qs}`);
@@ -5704,7 +6479,7 @@ function buildDomain(opts) {
   err("\n  A domain is required: pass --hostname <host> or --slug <slug>.\n");
   process.exit(1);
 }
-var migrationCommand = new Command17("migration").description("Team-mode migration lifecycle");
+var migrationCommand = new Command18("migration").description("Team-mode migration lifecycle");
 migrationCommand.command("preflight").description("Read-only readiness check for the own-server migration").requiredOption("--server-id <id>", "Target server id").option("--hostname <host>", "Custom domain pointing at the server").option("--slug <slug>", "Free <slug>.opsh.io subdomain").action(async (opts) => {
   await guarded(async () => {
     const domain = buildDomain(opts);
@@ -5811,7 +6586,7 @@ migrationCommand.command("switch-back").description("Reverse migration back to s
     }
   });
 });
-var dataTransferCommand = new Command17("data-transfer").description(
+var dataTransferCommand = new Command18("data-transfer").description(
   "Whole-instance export / import (owner-only)"
 );
 dataTransferCommand.command("export").description("Export the entire instance to a JSON file").option("--passphrase <passphrase>", "Seal secrets under this passphrase").option("--out <file>", "Write the export to this file instead of stdout").action(async (opts) => {
@@ -5827,7 +6602,7 @@ dataTransferCommand.command("export").description("Export the entire instance to
       );
       spin4?.succeed("Export ready.");
       if (opts.out) {
-        writeFileSync7(opts.out, JSON.stringify(file));
+        writeFileSync8(opts.out, JSON.stringify(file));
         const tables = Object.keys(file.dump?.tables ?? {}).length;
         report2(
           { out: opts.out, tables },
@@ -5853,7 +6628,7 @@ dataTransferCommand.command("import").description("Import an instance export fil
     }
     let file;
     try {
-      file = JSON.parse(readFileSync8(opts.file, "utf8"));
+      file = JSON.parse(readFileSync9(opts.file, "utf8"));
     } catch {
       err(`
   Could not read or parse ${opts.file}.
@@ -5881,10 +6656,10 @@ dataTransferCommand.command("import").description("Import an instance export fil
     }
   });
 });
-var systemCommand = new Command17("system").description("Instance settings, onboarding, migration, and data transfer").addCommand(settingsCommand).addCommand(onboardingCommand).addCommand(upgradeToAuthCommand).addCommand(browseCommand).addCommand(migrationCommand).addCommand(dataTransferCommand);
+var systemCommand = new Command18("system").description("Instance settings, onboarding, migration, and data transfer").addCommand(settingsCommand).addCommand(onboardingCommand).addCommand(upgradeToAuthCommand).addCommand(browseCommand).addCommand(migrationCommand).addCommand(dataTransferCommand);
 
 // src/commands/mail.ts
-import { Command as Command18 } from "commander";
+import { Command as Command19 } from "commander";
 import chalk13 from "chalk";
 import ora6 from "ora";
 import { createInterface as createInterface7 } from "readline/promises";
@@ -5926,7 +6701,7 @@ function printRecordsObject(records) {
   if (rows.length === 0) return info("  (no DNS records)");
   printTable(rows, ["key", "type", "host", "value"]);
 }
-var stepsCmd = new Command18("steps").description("List the mail setup steps").action(
+var stepsCmd = new Command19("steps").description("List the mail setup steps").action(
   guard2(async () => {
     const res = await apiRequest(
       "/mail/steps"
@@ -5939,7 +6714,7 @@ var stepsCmd = new Command18("steps").description("List the mail setup steps").a
     info(`  ${res.total} steps total.`);
   })
 );
-var statusCmd = new Command18("status").description("Show the setup progress for a mail server").argument("[serverId]", "Mail server ID (omit for the empty welcome shell)").action(
+var statusCmd = new Command19("status").description("Show the setup progress for a mail server").argument("[serverId]", "Mail server ID (omit for the empty welcome shell)").action(
   guard2(async (serverId) => {
     const q = serverId ? `?serverId=${encodeURIComponent(serverId)}` : "";
     const res = await apiRequest(`/mail/status${q}`);
@@ -5960,7 +6735,7 @@ var statusCmd = new Command18("status").description("Show the setup progress for
     }
   })
 );
-var serversCmd = new Command18("servers").description("List every server the mail stack is installed on").action(
+var serversCmd = new Command19("servers").description("List every server the mail stack is installed on").action(
   guard2(async () => {
     const res = await apiRequest(
       "/mail/servers"
@@ -5981,7 +6756,7 @@ var serversCmd = new Command18("servers").description("List every server the mai
     );
   })
 );
-var scanCmd = new Command18("scan").description("Probe a server for an existing mail install (read-only)").argument("<serverId>", "Server ID to scan").action(
+var scanCmd = new Command19("scan").description("Probe a server for an existing mail install (read-only)").argument("<serverId>", "Server ID to scan").action(
   guard2(async (serverId) => {
     const sp = spin2("Scanning server\u2026");
     const res = await apiRequest("/mail/scan", { method: "POST", body: JSON.stringify({ serverId }) });
@@ -5996,7 +6771,7 @@ var scanCmd = new Command18("scan").description("Probe a server for an existing
     else info("  Nothing to adopt on this server.");
   })
 );
-var adoptCmd = new Command18("adopt").description("Re-adopt an existing mail install whose orchestrator state was lost").argument("<serverId>", "Server ID to adopt").action(
+var adoptCmd = new Command19("adopt").description("Re-adopt an existing mail install whose orchestrator state was lost").argument("<serverId>", "Server ID to adopt").action(
   guard2(async (serverId) => {
     const sp = spin2("Adopting mail server\u2026");
     const res = await apiRequest(
@@ -6009,7 +6784,7 @@ var adoptCmd = new Command18("adopt").description("Re-adopt an existing mail ins
     info(`  completed: ${res.completed ? "yes" : "no"}`);
   })
 );
-var setupCmd = new Command18("setup").description("Start or resume the mail setup wizard (streams over SSE)").argument("<serverId>", "Server ID to install the mail stack on").requiredOption("-d, --domain <domain>", "Mail domain (e.g. example.com)").option("--start-step <n>", "Resume from a specific step (1-13)").option("--config <json>", "iRedMail config overrides as a JSON object").action(
+var setupCmd = new Command19("setup").description("Start or resume the mail setup wizard (streams over SSE)").argument("<serverId>", "Server ID to install the mail stack on").requiredOption("-d, --domain <domain>", "Mail domain (e.g. example.com)").option("--start-step <n>", "Resume from a specific step (1-13)").option("--config <json>", "iRedMail config overrides as a JSON object").action(
   guard2(async (serverId, opts) => {
     let config;
     if (opts.config) {
@@ -6078,7 +6853,7 @@ var setupCmd = new Command18("setup").description("Start or resume the mail setu
     if (failed) process.exit(1);
   })
 );
-var cancelCmd = new Command18("cancel").description("Cancel the mail setup currently running").action(
+var cancelCmd = new Command19("cancel").description("Cancel the mail setup currently running").action(
   guard2(async () => {
     const res = await apiRequest("/mail/setup/cancel", {
       method: "POST"
@@ -6088,7 +6863,7 @@ var cancelCmd = new Command18("cancel").description("Cancel the mail setup curre
   })
 );
 function ackCommand(name, path2, description, successMsg) {
-  return new Command18(name).description(description).argument("<serverId>", "Mail server ID").action(
+  return new Command19(name).description(description).argument("<serverId>", "Mail server ID").action(
     guard2(async (serverId) => {
       const res = await apiRequest(path2, {
         method: "POST",
@@ -6111,7 +6886,7 @@ var ptrAckCmd = ackCommand(
   "Acknowledge that reverse DNS (PTR) is configured",
   "PTR acknowledged. Re-run `mail setup` with --start-step to continue."
 );
-var resetCmd = new Command18("reset").description("Wipe the on-server setup state file (does NOT touch installed daemons)").argument("<serverId>", "Mail server ID").option("-y, --yes", "Skip the confirmation prompt").action(
+var resetCmd = new Command19("reset").description("Wipe the on-server setup state file (does NOT touch installed daemons)").argument("<serverId>", "Mail server ID").option("-y, --yes", "Skip the confirmation prompt").action(
   guard2(async (serverId, opts) => {
     if (!opts.yes && !isJsonMode()) {
       const rl = createInterface7({ input: input6, output: output6 });
@@ -6127,7 +6902,7 @@ var resetCmd = new Command18("reset").description("Wipe the on-server setup stat
     ok("  Setup state reset.");
   })
 );
-var forgetCmd = new Command18("forget").description("Stop managing a mail server (drops the DB row; leaves the stack + state intact)").argument("<serverId>", "Mail server ID").action(
+var forgetCmd = new Command19("forget").description("Stop managing a mail server (drops the DB row; leaves the stack + state intact)").argument("<serverId>", "Mail server ID").action(
   guard2(async (serverId) => {
     const res = await apiRequest(`/mail/servers/${encodeURIComponent(serverId)}`, {
       method: "DELETE"
@@ -6136,7 +6911,7 @@ var forgetCmd = new Command18("forget").description("Stop managing a mail server
     ok(`  Forgot mail server ${serverId} (re-adopt with \`mail scan\` + \`mail adopt\`).`);
   })
 );
-var healthCmd = new Command18("health").description("Show live status of every mail daemon").argument("<serverId>", "Mail server ID").action(
+var healthCmd = new Command19("health").description("Show live status of every mail daemon").argument("<serverId>", "Mail server ID").action(
   guard2(async (serverId) => {
     const sp = spin2("Checking mail daemons\u2026");
     const res = await apiRequest(`/mail/health/${encodeURIComponent(serverId)}`);
@@ -6153,7 +6928,7 @@ var healthCmd = new Command18("health").description("Show live status of every m
     );
   })
 );
-var logsCmd3 = new Command18("logs").description("Tail a mail component's journal (snapshot)").argument("<serverId>", "Mail server ID").argument("<component>", "Component key (postfix|dovecot|amavis|clamav|iredapd|postgresql|\u2026)").option("-n, --lines <n>", "Number of lines (max 1000)", "200").action(
+var logsCmd3 = new Command19("logs").description("Tail a mail component's journal (snapshot)").argument("<serverId>", "Mail server ID").argument("<component>", "Component key (postfix|dovecot|amavis|clamav|iredapd|postgresql|\u2026)").option("-n, --lines <n>", "Number of lines (max 1000)", "200").action(
   guard2(async (serverId, component, opts) => {
     const res = await apiRequest(
       `/mail/admin/${encodeURIComponent(serverId)}/components/${encodeURIComponent(component)}/logs?lines=${encodeURIComponent(opts.lines)}`
@@ -6163,9 +6938,9 @@ var logsCmd3 = new Command18("logs").description("Tail a mail component's journa
     for (const line of res.lines) process.stdout.write(line + "\n");
   })
 );
-var postmasterCmd = new Command18("postmaster").description("Manage the postmaster mailbox");
+var postmasterCmd = new Command19("postmaster").description("Manage the postmaster mailbox");
 postmasterCmd.addCommand(
-  new Command18("set-password").description("Rotate the postmaster password").argument("<serverId>", "Mail server ID").option("--password <password>", "New password (min 12 chars); prompted if omitted").action(
+  new Command19("set-password").description("Rotate the postmaster password").argument("<serverId>", "Mail server ID").option("--password <password>", "New password (min 12 chars); prompted if omitted").action(
     guard2(async (serverId, opts) => {
       let password2 = opts.password;
       if (!password2) {
@@ -6191,12 +6966,12 @@ postmasterCmd.addCommand(
     })
   )
 );
-var mailCommand = new Command18("mail").description("Self-hosted mail server (iRedMail) setup and admin [self-host]").addCommand(stepsCmd).addCommand(statusCmd).addCommand(serversCmd).addCommand(scanCmd).addCommand(adoptCmd).addCommand(setupCmd).addCommand(cancelCmd).addCommand(dnsAckCmd).addCommand(ptrAckCmd).addCommand(resetCmd).addCommand(forgetCmd).addCommand(healthCmd).addCommand(logsCmd3).addCommand(postmasterCmd);
+var mailCommand = new Command19("mail").description("Self-hosted mail server (iRedMail) setup and admin [self-host]").addCommand(stepsCmd).addCommand(statusCmd).addCommand(serversCmd).addCommand(scanCmd).addCommand(adoptCmd).addCommand(setupCmd).addCommand(cancelCmd).addCommand(dnsAckCmd).addCommand(ptrAckCmd).addCommand(resetCmd).addCommand(forgetCmd).addCommand(healthCmd).addCommand(logsCmd3).addCommand(postmasterCmd);
 
 // src/commands/backup.ts
-import { Command as Command19 } from "commander";
+import { Command as Command20 } from "commander";
 import ora7 from "ora";
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 async function guard3(fn) {
   try {
     await fn();
@@ -6279,7 +7054,7 @@ async function followStream(path2, label) {
   spinner3?.stop();
   return status;
 }
-var policyCmd = new Command19("policy").description("Backup policies (schedules) for a project");
+var policyCmd = new Command20("policy").description("Backup policies (schedules) for a project");
 policyCmd.command("list").description("List backup policies for a project").requiredOption("--project <id>", "Project ID").action(
   (opts) => guard3(async () => {
     const { data } = await apiRequest(
@@ -6349,7 +7124,7 @@ policyCmd.command("run").description("Trigger a policy's backup now").argument("
     }
   })
 );
-var runCmd = new Command19("run").description("Backup runs (executions)");
+var runCmd = new Command20("run").description("Backup runs (executions)");
 runCmd.command("list").description("List backup runs for a project").requiredOption("--project <id>", "Project ID").option("--service <id>", "Filter to a single service").option("--limit <n>", "Max rows (default 50)").action(
   (opts) => guard3(async () => {
     const qs = new URLSearchParams();
@@ -6425,7 +7200,7 @@ runCmd.command("restore").description("Prepare a restore from a run (stages it;
     }
   })
 );
-var restoreCmd = new Command19("restore").description("Manage staged restores");
+var restoreCmd = new Command20("restore").description("Manage staged restores");
 restoreCmd.command("apply").description("Apply a staged restore (destructive)").argument("<restoreId>", "Restore ID from `backup run restore`").requiredOption("--token <token>", "Confirmation token from prepare").option("--follow", "Stream the restore to completion").action(
   (restoreId, opts) => guard3(async () => {
     await apiRequest(
@@ -6468,7 +7243,7 @@ restoreCmd.command("get").description("Show one restore (optionally stream it)")
     show(data);
   })
 );
-var destinationCmd = new Command19("destination").description("Backup destinations (storage targets)");
+var destinationCmd = new Command20("destination").description("Backup destinations (storage targets)");
 destinationCmd.command("list").description("List backup destinations").action(
   () => guard3(async () => {
     const { data } = await apiRequest("/backup-destinations");
@@ -6489,7 +7264,7 @@ destinationCmd.command("create").description("Create a backup destination").requ
     let sftpPrivateKey = opts.sftpPrivateKey;
     if (opts.sftpPrivateKeyFile) {
       try {
-        sftpPrivateKey = readFileSync9(opts.sftpPrivateKeyFile, "utf8");
+        sftpPrivateKey = readFileSync10(opts.sftpPrivateKeyFile, "utf8");
       } catch {
         throw new Error(`Cannot read key file: ${opts.sftpPrivateKeyFile}`);
       }
@@ -6540,10 +7315,10 @@ destinationCmd.command("preflight").description("Verify a destination (write + r
     }
   })
 );
-var backupCommand = new Command19("backup").description("Manage backups: policies, runs, restores, destinations").addCommand(policyCmd).addCommand(runCmd).addCommand(restoreCmd).addCommand(destinationCmd);
+var backupCommand = new Command20("backup").description("Manage backups: policies, runs, restores, destinations").addCommand(policyCmd).addCommand(runCmd).addCommand(restoreCmd).addCommand(destinationCmd);
 
 // src/commands/token.ts
-import { Command as Command20 } from "commander";
+import { Command as Command21 } from "commander";
 import chalk15 from "chalk";
 
 // src/lib/cmd-helpers.ts
@@ -6571,7 +7346,7 @@ function collectGrant(value, acc) {
   acc.push({ resourceType, resourceId, permissions });
   return acc;
 }
-var listCmd5 = new Command20("list").description("List your personal access tokens").action(async () => {
+var listCmd5 = new Command21("list").description("List your personal access tokens").action(async () => {
   try {
     const res = await apiRequest("/tokens");
     const rows = res.data ?? [];
@@ -6596,7 +7371,7 @@ var listCmd5 = new Command20("list").description("List your personal access toke
     fail3(e);
   }
 });
-var createCmd3 = new Command20("create").description("Mint a new personal access token (the secret is shown once)").argument("<name>", "Human-readable token name").option("--read-only", "Reject mutation methods (POST/PUT/PATCH/DELETE)", false).option("--expires <days>", "Expire after N days (1\u2013365); omit for non-expiring", (v) => parseInt(v, 10)).option(
+var createCmd3 = new Command21("create").description("Mint a new personal access token (the secret is shown once)").argument("<name>", "Human-readable token name").option("--read-only", "Reject mutation methods (POST/PUT/PATCH/DELETE)", false).option("--expires <days>", "Expire after N days (1\u2013365); omit for non-expiring", (v) => parseInt(v, 10)).option(
   "--grant <type:id:perms>",
   "Scope the token to a resource (repeatable), e.g. project:abc123:read,write",
   collectGrant,
@@ -6628,7 +7403,7 @@ var createCmd3 = new Command20("create").description("Mint a new personal access
     fail3(e);
   }
 });
-var revokeCmd = new Command20("revoke").description("Revoke one of your tokens").argument("<id>", "Token ID").action(async (id) => {
+var revokeCmd = new Command21("revoke").description("Revoke one of your tokens").argument("<id>", "Token ID").action(async (id) => {
   const sp = spin3("Revoking token\u2026");
   try {
     await apiRequest(`/tokens/${encodeURIComponent(id)}`, { method: "DELETE" });
@@ -6640,11 +7415,11 @@ var revokeCmd = new Command20("revoke").description("Revoke one of your tokens")
     fail3(e);
   }
 });
-var tokenCommand = new Command20("token").description("Manage personal access tokens").addCommand(listCmd5).addCommand(createCmd3).addCommand(revokeCmd);
+var tokenCommand = new Command21("token").description("Manage personal access tokens").addCommand(listCmd5).addCommand(createCmd3).addCommand(revokeCmd);
 
 // src/commands/api.ts
-import { Command as Command21 } from "commander";
-var apiCommand = new Command21("api").description("Make an authenticated request to any Openship API route (like `gh api`)").argument("<path>", "Path under /api, e.g. /projects or /deployments/<id>").option("-X, --method <method>", "HTTP method (defaults to GET, or POST when --data is given)").option("-d, --data <json>", "Request body as a JSON string").option("-q, --query <kv...>", "Query parameter key=value (repeatable)").action(async (path2, opts) => {
+import { Command as Command22 } from "commander";
+var apiCommand = new Command22("api").description("Make an authenticated request to any Openship API route (like `gh api`)").argument("<path>", "Path under /api, e.g. /projects or /deployments/<id>").option("-X, --method <method>", "HTTP method (defaults to GET, or POST when --data is given)").option("-d, --data <json>", "Request body as a JSON string").option("-q, --query <kv...>", "Query parameter key=value (repeatable)").action(async (path2, opts) => {
   const method = (opts.method || (opts.data ? "POST" : "GET")).toUpperCase();
   let url = path2.startsWith("/") ? path2 : `/${path2}`;
   if (opts.query?.length) {
@@ -6678,20 +7453,20 @@ var apiCommand = new Command21("api").description("Make an authenticated request
 });
 
 // src/commands/reset-admin.ts
-import { Command as Command22 } from "commander";
+import { Command as Command23 } from "commander";
 import chalk16 from "chalk";
 import { intro, outro, password as passwordPrompt, isCancel, cancel as cancel2, log } from "@clack/prompts";
-import { readFileSync as readFileSync10 } from "fs";
-import { homedir as homedir7 } from "os";
-import { join as join11 } from "path";
+import { readFileSync as readFileSync11 } from "fs";
+import { homedir as homedir8 } from "os";
+import { join as join13 } from "path";
 function resolvedApiPort() {
   try {
-    return JSON.parse(readFileSync10(join11(homedir7(), ".openship", "ports.json"), "utf8")).api;
+    return JSON.parse(readFileSync11(join13(homedir8(), ".openship", "ports.json"), "utf8")).api;
   } catch {
     return void 0;
   }
 }
-var resetAdminCommand = new Command22("reset-admin-password").description("Reset the local admin login on THIS machine (no sign-in required)").option("--port <port>", "API port of the running service (default: the resolved port from ~/.openship/ports.json, else 4000)").option("--email <email>", "Also set the admin email").option("--name <name>", "Also set the admin display name").option("--password <password>", "New password (prompted if omitted)").action(async (opts) => {
+var resetAdminCommand = new Command23("reset-admin-password").description("Reset the local admin login on THIS machine (no sign-in required)").option("--port <port>", "API port of the running service (default: the resolved port from ~/.openship/ports.json, else 4000)").option("--email <email>", "Also set the admin email").option("--name <name>", "Also set the admin display name").option("--password <password>", "New password (prompted if omitted)").action(async (opts) => {
   intro(chalk16.cyan("Reset Openship admin password"));
   let pw = opts.password;
   if (!pw) {
@@ -6739,11 +7514,11 @@ var resetAdminCommand = new Command22("reset-admin-password").description("Reset
 });
 
 // src/commands/install.ts
-import { Command as Command23 } from "commander";
-import { chmodSync as chmodSync2, existsSync as existsSync10, mkdirSync as mkdirSync8, readFileSync as readFileSync11, writeFileSync as writeFileSync8 } from "fs";
-import { spawn as spawn2, spawnSync as spawnSync4 } from "child_process";
-import { homedir as homedir8 } from "os";
-import { join as join12 } from "path";
+import { Command as Command24 } from "commander";
+import { chmodSync as chmodSync2, existsSync as existsSync12, mkdirSync as mkdirSync9, readFileSync as readFileSync12, writeFileSync as writeFileSync9 } from "fs";
+import { spawn as spawn3, spawnSync as spawnSync5 } from "child_process";
+import { homedir as homedir9 } from "os";
+import { join as join14 } from "path";
 import ora9 from "ora";
 function assetForPlatform() {
   const { platform, arch } = process;
@@ -6751,37 +7526,39 @@ function assetForPlatform() {
     return { name: arch === "arm64" ? "Openship-arm64.dmg" : "Openship-x64.dmg", kind: "dmg" };
   }
   if (platform === "win32") return { name: "Openship-win32-x64.zip", kind: "zip" };
-  if (platform === "linux") return { name: "Openship.AppImage", kind: "appimage" };
+  if (platform === "linux") {
+    return { name: arch === "arm64" ? "Openship-arm64.AppImage" : "Openship.AppImage", kind: "appimage" };
+  }
   throw new Error(`Unsupported platform: ${platform} (${arch})`);
 }
 function installDmg(dmg) {
-  const homeApps = join12(homedir8(), "Applications");
+  const homeApps = join14(homedir9(), "Applications");
   let dest = homeApps;
   try {
-    mkdirSync8(homeApps, { recursive: true });
+    mkdirSync9(homeApps, { recursive: true });
   } catch {
     dest = "/Applications";
   }
-  const attach = spawnSync4("hdiutil", ["attach", "-nobrowse", "-readonly", "-noverify", dmg], {
+  const attach = spawnSync5("hdiutil", ["attach", "-nobrowse", "-readonly", "-noverify", dmg], {
     encoding: "utf8"
   });
   if (attach.status !== 0) throw new Error(`hdiutil attach failed: ${attach.stderr?.trim()}`);
   const mount = (attach.stdout.match(/\/Volumes\/[^\n]*/g) ?? []).pop()?.trim();
   if (!mount) throw new Error("Could not determine the mounted volume");
-  let target = join12(dest, "Openship.app");
+  let target = join14(dest, "Openship.app");
   try {
-    const appInDmg = join12(mount, "Openship.app");
-    if (!existsSync10(appInDmg)) throw new Error("Openship.app not found in the disk image");
-    spawnSync4("rm", ["-rf", target]);
-    let copy = spawnSync4("ditto", [appInDmg, target], { encoding: "utf8" });
+    const appInDmg = join14(mount, "Openship.app");
+    if (!existsSync12(appInDmg)) throw new Error("Openship.app not found in the disk image");
+    spawnSync5("rm", ["-rf", target]);
+    let copy = spawnSync5("ditto", [appInDmg, target], { encoding: "utf8" });
     if (copy.status !== 0 && dest === homeApps) {
-      target = join12("/Applications", "Openship.app");
-      spawnSync4("rm", ["-rf", target]);
-      copy = spawnSync4("ditto", [appInDmg, target], { encoding: "utf8" });
+      target = join14("/Applications", "Openship.app");
+      spawnSync5("rm", ["-rf", target]);
+      copy = spawnSync5("ditto", [appInDmg, target], { encoding: "utf8" });
     }
     if (copy.status !== 0) throw new Error(`ditto copy failed: ${copy.stderr?.trim()}`);
   } finally {
-    spawnSync4("hdiutil", ["detach", mount, "-quiet"]);
+    spawnSync5("hdiutil", ["detach", mount, "-quiet"]);
   }
   return target;
 }
@@ -6790,10 +7567,10 @@ function installAppImage(appImage) {
   return appImage;
 }
 function installZip(zip) {
-  const localAppData = process.env.LOCALAPPDATA || join12(homedir8(), "AppData", "Local");
-  const target = join12(localAppData, "Programs", "Openship");
-  mkdirSync8(target, { recursive: true });
-  const expand = spawnSync4(
+  const localAppData = process.env.LOCALAPPDATA || join14(homedir9(), "AppData", "Local");
+  const target = join14(localAppData, "Programs", "Openship");
+  mkdirSync9(target, { recursive: true });
+  const expand = spawnSync5(
     "powershell",
     [
       "-NoProfile",
@@ -6808,22 +7585,22 @@ function installZip(zip) {
 }
 function launch(kind, target) {
   if (kind === "dmg") {
-    spawnSync4("open", [target]);
+    spawnSync5("open", [target]);
     return;
   }
   if (kind === "appimage") {
-    const child = spawn2(target, [], { detached: true, stdio: "ignore" });
+    const child = spawn3(target, [], { detached: true, stdio: "ignore" });
     child.on("error", () => {
-      spawn2(target, ["--appimage-extract-and-run"], { detached: true, stdio: "ignore" }).unref();
+      spawn3(target, ["--appimage-extract-and-run"], { detached: true, stdio: "ignore" }).unref();
     });
     child.unref();
     return;
   }
-  const exe = join12(target, "Openship.exe");
-  const path2 = existsSync10(exe) ? exe : target;
-  spawnSync4("cmd", ["/c", "start", "", path2]);
+  const exe = join14(target, "Openship.exe");
+  const path2 = existsSync12(exe) ? exe : target;
+  spawnSync5("cmd", ["/c", "start", "", path2]);
 }
-var installCommand = new Command23("install").description("Download and install the Openship desktop app for this OS").option("--version <tag>", "Release tag to install (e.g. v1.2.3)").option("--latest", "Install the latest release (default)").option("--force", "Re-download even if a verified copy is cached").option("--no-verify", "Skip SHA-256 verification (allowed when no sidecar exists)").option("--no-launch", "Install without launching the app").action(async (opts) => {
+var installCommand = new Command24("install").description("Download and install the Openship desktop app for this OS").option("--version <tag>", "Release tag to install (e.g. v1.2.3)").option("--latest", "Install the latest release (default)").option("--force", "Re-download even if a verified copy is cached").option("--no-verify", "Skip SHA-256 verification (allowed when no sidecar exists)").option("--no-launch", "Install without launching the app").action(async (opts) => {
   let asset;
   try {
     asset = assetForPlatform();
@@ -6846,13 +7623,13 @@ var installCommand = new Command23("install").description("Download and install
     process.exit(1);
   }
   const dir = releaseDir(tag);
-  const assetPath = join12(dir, asset.name);
+  const assetPath = join14(dir, asset.name);
   const sidecarPath = `${assetPath}.sha256`;
   const assetUrl2 = `${RELEASES}/download/${tag}/${asset.name}`;
   const sidecarUrl = `${assetUrl2}.sha256`;
   let downloaded = false;
   let sha;
-  const cachedUsable = !opts.force && existsSync10(assetPath) && (existsSync10(sidecarPath) || opts.verify === false);
+  const cachedUsable = !opts.force && existsSync12(assetPath) && (existsSync12(sidecarPath) || opts.verify === false);
   if (cachedUsable) {
     info(`  Using cached ${asset.name} (${tag}).`);
   } else {
@@ -6874,8 +7651,8 @@ var installCommand = new Command23("install").description("Download and install
     const s2 = spin4("Verifying checksum\u2026");
     try {
       let sidecarBody;
-      if (existsSync10(sidecarPath) && !downloaded) {
-        sidecarBody = readFileSync11(sidecarPath, "utf8");
+      if (existsSync12(sidecarPath) && !downloaded) {
+        sidecarBody = readFileSync12(sidecarPath, "utf8");
       } else {
         sidecarBody = await fetchSidecar(sidecarUrl);
       }
@@ -6898,8 +7675,8 @@ var installCommand = new Command23("install").description("Download and install
         err(`Expected ${expected}, got ${actual}. The download may be corrupt or tampered with.`);
         process.exit(1);
       }
-      mkdirSync8(dir, { recursive: true });
-      writeFileSync8(sidecarPath, sidecarBody);
+      mkdirSync9(dir, { recursive: true });
+      writeFileSync9(sidecarPath, sidecarBody);
       s2?.succeed("Checksum verified");
     } catch (e) {
       s2?.fail("Verification failed");
@@ -6938,15 +7715,15 @@ var installCommand = new Command23("install").description("Download and install
 });
 
 // src/commands/update.ts
-import { Command as Command24 } from "commander";
-import { spawnSync as spawnSync5 } from "child_process";
+import { Command as Command25 } from "commander";
+import { spawnSync as spawnSync6 } from "child_process";
 function detectPackageManager2(override) {
   if (override === "bun" || override === "npm") return override;
-  const hasBun = spawnSync5("bun", ["--version"], { stdio: "ignore" }).status === 0;
+  const hasBun = spawnSync6("bun", ["--version"], { stdio: "ignore" }).status === 0;
   return hasBun ? "bun" : "npm";
 }
-var updateCommand = new Command24("update").description("Update the Openship CLI + bundled server to the latest release").option("--check", "Only report the current + latest version; don't install").option("--via <manager>", "Package manager to update with: bun | npm").action(async (opts) => {
-  const current = "0.2.2";
+var updateCommand = new Command25("update").description("Update the Openship CLI + bundled server to the latest release").option("--check", "Only report the current + latest version; don't install").option("--via <manager>", "Package manager to update with: bun | npm").action(async (opts) => {
+  const current = "0.3.0";
   let latest;
   try {
     latest = (await resolveLatestTag()).replace(/^v/, "");
@@ -6974,7 +7751,7 @@ var updateCommand = new Command24("update").description("Update the Openship CLI
   const ref = `openship@${latest}`;
   const argv = pm === "bun" ? ["add", "-g", ref] : ["install", "-g", ref];
   info(`Updating v${current} \u2192 v${latest} (${cliInstallCommand(pm, latest)})...`);
-  const res = spawnSync5(pm, argv, { stdio: "inherit" });
+  const res = spawnSync6(pm, argv, { stdio: "inherit", shell: process.platform === "win32" });
   if (res.status !== 0) {
     err(`Update failed (${pm} exited ${res.status ?? "with a signal"}). Reinstall manually: ${cliInstallCommand(pm, latest)}`);
     process.exitCode = 1;
@@ -6991,18 +7768,18 @@ var updateCommand = new Command24("update").description("Update the Openship CLI
 });
 
 // src/commands/cache.ts
-import { Command as Command25 } from "commander";
-import { existsSync as existsSync11, readdirSync, readFileSync as readFileSync12, rmSync as rmSync4, statSync } from "fs";
-import { join as join13 } from "path";
+import { Command as Command26 } from "commander";
+import { existsSync as existsSync13, readdirSync, readFileSync as readFileSync13, rmSync as rmSync4, statSync } from "fs";
+import { join as join15 } from "path";
 function listAssets() {
-  if (!existsSync11(RELEASES_DIR)) return [];
+  if (!existsSync13(RELEASES_DIR)) return [];
   const out = [];
   for (const tag of readdirSync(RELEASES_DIR)) {
     const dir = releaseDir(tag);
     if (!statSync(dir).isDirectory()) continue;
     for (const name of readdirSync(dir)) {
       if (name.endsWith(".sha256")) continue;
-      const path2 = join13(dir, name);
+      const path2 = join15(dir, name);
       const st = statSync(path2);
       if (!st.isFile()) continue;
       out.push({
@@ -7010,17 +7787,17 @@ function listAssets() {
         name,
         path: path2,
         size: st.size,
-        hasSidecar: existsSync11(`${path2}.sha256`)
+        hasSidecar: existsSync13(`${path2}.sha256`)
       });
     }
   }
   return out;
 }
-var pathCmd = new Command25("path").description("Print the cache directory path").action(() => {
+var pathCmd = new Command26("path").description("Print the cache directory path").action(() => {
   if (isJsonMode()) printJson({ path: CACHE_DIR });
   else process.stdout.write(CACHE_DIR + "\n");
 });
-var listCmd6 = new Command25("list").alias("ls").description("List cached release assets").action(() => {
+var listCmd6 = new Command26("list").alias("ls").description("List cached release assets").action(() => {
   const assets = listAssets();
   printTable(
     assets.map((a) => ({
@@ -7032,7 +7809,7 @@ var listCmd6 = new Command25("list").alias("ls").description("List cached releas
     ["tag", "asset", "size", "sidecar"]
   );
 });
-var verifyCmd2 = new Command25("verify").description("Re-hash cached assets and compare to their .sha256 sidecar").argument("[tag]", "Only verify assets under this release tag").action(async (tag) => {
+var verifyCmd2 = new Command26("verify").description("Re-hash cached assets and compare to their .sha256 sidecar").argument("[tag]", "Only verify assets under this release tag").action(async (tag) => {
   const assets = listAssets().filter((a) => !tag || a.tag === tag);
   const results = [];
   let bad = 0;
@@ -7041,7 +7818,7 @@ var verifyCmd2 = new Command25("verify").description("Re-hash cached assets and
       results.push({ tag: a.tag, asset: a.name, result: "no-sidecar" });
       continue;
     }
-    const expected = parseSha256(readFileSync12(`${a.path}.sha256`, "utf8"));
+    const expected = parseSha256(readFileSync13(`${a.path}.sha256`, "utf8"));
     const actual = await hashFile(a.path);
     const okMatch = expected !== null && expected === actual;
     if (!okMatch) bad += 1;
@@ -7055,9 +7832,9 @@ var verifyCmd2 = new Command25("verify").description("Re-hash cached assets and
   }
   if (bad > 0) process.exit(1);
 });
-var cleanCmd = new Command25("clean").description("Delete cached release assets").argument("[tag]", "Only remove this release tag (default: all)").action((tag) => {
+var cleanCmd = new Command26("clean").description("Delete cached release assets").argument("[tag]", "Only remove this release tag (default: all)").action((tag) => {
   const target = tag ? releaseDir(tag) : RELEASES_DIR;
-  if (!existsSync11(target)) {
+  if (!existsSync13(target)) {
     if (isJsonMode()) printJson({ removed: false, path: target });
     else info(`  Nothing to clean (${target}).`);
     return;
@@ -7068,7 +7845,7 @@ var cleanCmd = new Command25("clean").description("Delete cached release assets"
   Removed ${target}
 `);
 });
-var cacheCommand = new Command25("cache").description("Manage the local download cache (list/verify/clean/path)").action(() => {
+var cacheCommand = new Command26("cache").description("Manage the local download cache (list/verify/clean/path)").action(() => {
   err("Specify a subcommand: path | list | verify | clean");
   process.exit(1);
 }).addCommand(pathCmd).addCommand(listCmd6).addCommand(verifyCmd2).addCommand(cleanCmd);
@@ -7076,11 +7853,10 @@ var cacheCommand = new Command25("cache").description("Manage the local download
 // src/commands/wizard.ts
 import chalk17 from "chalk";
 import open from "open";
-import { createServer as createServer2 } from "http";
 import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
-import { existsSync as existsSync12, readFileSync as readFileSync13 } from "fs";
-import { homedir as homedir9 } from "os";
-import { join as join14 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync14 } from "fs";
+import { homedir as homedir10 } from "os";
+import { join as join16 } from "path";
 import {
   intro as intro2,
   outro as outro2,
@@ -7135,10 +7911,10 @@ async function bootstrapAdmin(apiPort, admin) {
 }
 function lastServiceError() {
   for (const name of ["up.err.log", "up.log"]) {
-    const p = join14(homedir9(), ".openship", "logs", name);
-    if (!existsSync12(p)) continue;
+    const p = join16(homedir10(), ".openship", "logs", name);
+    if (!existsSync14(p)) continue;
     try {
-      const lines = readFileSync13(p, "utf8").trim().split("\n");
+      const lines = readFileSync14(p, "utf8").trim().split("\n");
       const hit = [...lines].reverse().find((l) => /error|locked|EADDRINUSE|throw|cannot/i.test(l));
       if (hit) return hit.trim().slice(0, 200);
     } catch {
@@ -7198,58 +7974,46 @@ async function connectOpenshipCloud(port) {
   }
   const verifier = b64url(randomBytes2(32));
   const challenge = b64url(createHash2("sha256").update(verifier).digest());
-  const state = b64url(randomBytes2(16));
-  const codePromise = new Promise((resolve2) => {
-    const page = (ok3) => {
-      const icon = ok3 ? '<path d="M20 6 9 17l-5-5"/>' : '<path d="M18 6 6 18M6 6l12 12"/>';
-      const title = ok3 ? "Connected to Openship Cloud" : "Connection didn\u2019t complete";
-      const msg = ok3 ? "Your instance is now linked to your Openship Cloud account." : "Something went wrong. Return to your terminal and run the connect step again.";
-      return `<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Openship</title><style>:root{color-scheme:dark}*{box-sizing:border-box}body{margin:0;min-height:100vh;display:grid;place-items:center;background:#09090b;color:#e7e7ea;font:15px/1.55 -apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif}.card{width:min(92vw,420px);padding:40px 36px;text-align:center}.badge{margin:0 auto 20px;display:grid;place-items:center}svg{width:40px;height:40px}h1{margin:0 0 8px;font-size:19px;font-weight:600;letter-spacing:-.2px}p{margin:0;color:#9a9aa2;font-size:14px}.hint{margin-top:22px;font-size:12.5px;color:#6a6a72}</style></head><body><div class="card"><div class="badge"><svg viewBox="0 0 24 24" fill="none" stroke="#e7e7ea" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round">${icon}</svg></div><h1>${title}</h1><p>${msg}</p><div class="hint">You can close this tab and return to your terminal.</div></div><script>setTimeout(function(){try{window.close()}catch(e){}},1200)</script></body></html>`;
-    };
-    const server2 = createServer2((req, res2) => {
-      const u = new URL(req.url || "/", "http://127.0.0.1");
-      if (!u.pathname.startsWith("/callback")) {
-        res2.writeHead(404).end();
-        return;
-      }
-      const code2 = u.searchParams.get("code");
-      const gotState = u.searchParams.get("state");
-      const ok3 = !!(code2 && gotState === state);
-      res2.writeHead(200, { "Content-Type": "text/html; charset=utf-8" }).end(page(ok3));
-      server2.close();
-      resolve2(ok3 ? code2 : null);
-    });
-    server2.on("error", () => resolve2(null));
-    server2.listen(0, "127.0.0.1", () => {
-      const cbPort = server2.address().port;
-      const redirect = `http://127.0.0.1:${cbPort}/callback`;
-      const handoff = `${cloudApiUrl.replace(/\/$/, "")}/api/cloud/connect-handoff?redirect=${encodeURIComponent(redirect)}&state=${state}&code_challenge=${challenge}`;
-      note(handoff, "Open this URL to authorize (opening your browser\u2026)");
-      void open(handoff).catch(() => {
-      });
-    });
-    setTimeout(() => {
-      try {
-        server2.close();
-      } catch {
-      }
-      resolve2(null);
-    }, 3e5);
+  const state = b64url(randomBytes2(24));
+  const apiBase = cloudApiUrl.replace(/\/$/, "");
+  const handoff = `${apiBase}/api/cloud/connect-handoff?redirect=${encodeURIComponent(apiBase)}&state=${encodeURIComponent(state)}&code_challenge=${challenge}&mode=device`;
+  const overSsh = !!(process.env.SSH_CONNECTION || process.env.SSH_TTY || process.env.SSH_CLIENT);
+  note(handoff, "Open this URL in your browser to authorize (then click Authorize)");
+  if (!overSsh) void open(handoff).catch(() => {
   });
   const s = spinner2();
-  s.start("Waiting for Openship Cloud authorization in your browser");
-  const code = await codePromise;
+  s.start("Waiting for you to authorize in the browser");
+  let code = null;
+  const deadline = Date.now() + 3e5;
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, 2500));
+    try {
+      const res2 = await fetch(
+        `${apiBase}/api/cloud/connect-poll?state=${encodeURIComponent(state)}`,
+        { signal: AbortSignal.timeout(5e3) }
+      );
+      if (!res2.ok) continue;
+      const data = await res2.json();
+      if (data.status === "ready" && data.code) {
+        code = data.code;
+        break;
+      }
+    } catch {
+    }
+  }
   if (!code) {
-    s.stop("Openship Cloud wasn't authorized.", 1);
+    s.stop("Openship Cloud wasn't authorized in time \u2014 re-run the connect step to try again.", 1);
     return null;
   }
-  s.message("Linking this instance to Openship Cloud");
+  s.stop("Authorized.");
+  const linking = spinner2();
+  linking.start("Linking this instance to Openship Cloud");
   const res = await internalPost(port, "/api/system/cloud-connect", { code, codeVerifier: verifier });
   if (!res.ok) {
-    s.stop(`Couldn't link Openship Cloud: ${res.data?.error || "failed"}`, 1);
+    linking.stop(`Couldn't link Openship Cloud: ${res.data?.error || "failed"}`, 1);
     return null;
   }
-  s.stop(`Connected to Openship Cloud${res.data?.email ? ` as ${res.data.email}` : ""}.`);
+  linking.stop(`Connected to Openship Cloud${res.data?.email ? ` as ${res.data.email}` : ""}.`);
   return { email: res.data?.email ?? null };
 }
 async function promptLocalAdmin() {
@@ -7269,12 +8033,13 @@ async function promptLocalAdmin() {
 }
 async function streamProvision(port, sessionId, s) {
   let ok3 = false;
+  let detail;
   try {
     const res = await fetch(`http://127.0.0.1:${port}/api/system/self-register/stream?id=${sessionId}`, {
       headers: { "X-Internal-Token": ensureInternalToken() },
       signal: AbortSignal.timeout(3e5)
     });
-    if (!res.ok || !res.body) return false;
+    if (!res.ok || !res.body) return { ok: false };
     const reader = res.body.getReader();
     const decoder = new TextDecoder();
     let buffer = "";
@@ -7292,23 +8057,29 @@ async function streamProvision(port, sessionId, s) {
         if (event === "log" && dataRaw) {
           try {
             const d = JSON.parse(dataRaw);
-            if (d.message) s.message(String(d.message).replace(/\s+/g, " ").slice(0, 68));
+            if (d.message) {
+              const msg = String(d.message).replace(/\s+/g, " ");
+              s.message(msg.slice(0, 68));
+              if (d.level === "warn" || d.level === "error") detail = msg;
+            }
           } catch {
           }
         } else if (event === "complete" && dataRaw) {
           try {
-            ok3 = JSON.parse(dataRaw).status === "completed";
+            const d = JSON.parse(dataRaw);
+            ok3 = d.status === "completed";
+            if (!ok3 && typeof d.error === "string") detail = d.error;
           } catch {
           }
         } else if (event === "end") {
-          return ok3;
+          return { ok: ok3, detail };
         }
       }
     }
   } catch {
-    return ok3;
+    return { ok: ok3, detail };
   }
-  return ok3;
+  return { ok: ok3, detail };
 }
 async function runWizard() {
   intro2(`${chalk17.bgCyan(chalk17.black(" Openship "))}${chalk17.dim(" setup")}`);
@@ -7513,7 +8284,7 @@ async function runWizard() {
     domainPlan = { type: "byo", hostname };
     break planning;
   }
-  const uiTag = `v${"0.2.2"}`;
+  const uiTag = `v${"0.3.0"}`;
   const dl = spinner2();
   dl.start("Pulling the Openship dist from GitHub");
   try {
@@ -7632,6 +8403,20 @@ async function runWizard() {
     if (status && !status.canProceedClean && status.occupants?.length) {
       const owner = status.occupants.map((o) => o.command ?? `port ${o.port}`).join(", ");
       const known = status.classification === "known";
+      const sites = pf.ok && Array.isArray(pf.data?.sites) ? pf.data.sites : [];
+      if (sites.length > 0) {
+        const lines = sites.map((st) => {
+          const host = (st.serverNames ?? []).join(", ") || "(no server_name)";
+          const dest = st.target?.kind === "static" ? `static: ${st.target?.root ?? ""}` : st.target?.url ?? "";
+          return `${chalk17.bold(host)} \u2192 ${chalk17.dim(dest)}${st.ssl ? chalk17.green(" [TLS]") : ""}`;
+        });
+        note(lines.join("\n"), `Detected ${sites.length} site${sites.length === 1 ? "" : "s"} on ${owner}`);
+      }
+      const warns = pf.ok && Array.isArray(pf.data?.warnings) ? pf.data.warnings : [];
+      if (warns.length > 0) {
+        log2.warn(`${warns.length} config item${warns.length === 1 ? "" : "s"} won't migrate automatically:`);
+        for (const w of warns.slice(0, 8)) log2.message(chalk17.dim(`\u2022 ${w}`));
+      }
       const choice = ensure(
         await select({
           message: known ? `An existing reverse proxy (${owner}) is serving ports 80/443.` : `Ports 80/443 are in use by ${owner}, which we couldn't identify.`,
@@ -7678,10 +8463,13 @@ async function runWizard() {
       if (res.ok && res.data?.sessionId) {
         const s2 = spinner2();
         s2.start("Issuing HTTPS certificate (OpenResty + Let's Encrypt)");
-        const done = await streamProvision(port, res.data.sessionId, s2);
+        const { ok: done, detail } = await streamProvision(port, res.data.sessionId, s2);
         liveUrl = res.data.url ?? liveUrl;
         if (done) s2.stop(`HTTPS ready: ${liveUrl}`);
-        else s2.stop("HTTPS isn't ready yet \u2014 it retries on reboot; the site serves over HTTP meanwhile.", 1);
+        else {
+          s2.stop("HTTPS isn't ready yet \u2014 it retries on reboot; the site serves over HTTP meanwhile.", 1);
+          if (detail) log2.warn(detail);
+        }
       } else {
         log2.warn(`Couldn't start domain provisioning: ${res.data?.error || "failed"}`);
       }
@@ -7714,9 +8502,9 @@ ${pad("Login")}${admin.email} ${chalk17.dim("(email + password you set)")}
   );
 }
 function storedPorts() {
-  const p = join14(homedir9(), ".openship", "ports.json");
+  const p = join16(homedir10(), ".openship", "ports.json");
   try {
-    return existsSync12(p) ? JSON.parse(readFileSync13(p, "utf8")) : {};
+    return existsSync14(p) ? JSON.parse(readFileSync14(p, "utf8")) : {};
   } catch {
     return {};
   }
@@ -7788,8 +8576,8 @@ ${chalk17.dim("Dashboard".padEnd(11))}${dashUrl}
 }
 
 // src/index.ts
-var program = new Command26();
-program.name("openship").description("Openship CLI \u2014 install, run, and manage Openship from your terminal").version("0.2.2").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
+var program = new Command27();
+program.name("openship").description("Openship CLI \u2014 install, run, and manage Openship from your terminal").version("0.3.0").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
   if (thisCommand.opts().json) setJsonMode(true);
 }).action(async () => {
   if (serviceStatus().installed) await runControl();
@@ -7803,6 +8591,7 @@ program.addCommand(openCommand);
 program.addCommand(loginCommand);
 program.addCommand(logoutCommand);
 program.addCommand(initCommand);
+program.addCommand(configCommand);
 program.addCommand(contextCommand);
 program.addCommand(statusCommand);
 program.addCommand(doctorCommand);