openship 0.2.3 → 0.4.0

package/dist/chunk-46YJFP4S.js

@@ -0,0 +1,1771 @@
+import {
+  describeProcess,
+  probeListeningPort,
+  resolveEnvironment
+} from "./chunk-3U4SPZD5.js";
+import {
+  formatDuration,
+  isRemoteConnectionError,
+  systemDebug
+} from "./chunk-4LEL3H2Z.js";
+import {
+  sq
+} from "./chunk-4CQWT2WL.js";
+import {
+  OPENRESTY_LUA_DIR,
+  buildReloadCommand,
+  deployLuaScripts,
+  detectOpenRestyPaths,
+  ensureOpenRestyConfig
+} from "./chunk-E6W2JMMU.js";
+import {
+  AppError,
+  compareSemver,
+  safeErrorMessage
+} from "./chunk-JZLNHGLW.js";
+
+// ../../packages/adapters/src/system/catalog.ts
+function dockerInstallPlan(profile) {
+  if (profile.os !== "linux") {
+    return {
+      supported: false,
+      unsupportedReason: "Docker installation is only supported on Linux servers"
+    };
+  }
+  return {
+    supported: true,
+    installCommand: "curl -fsSL https://get.docker.com | sh",
+    startCommand: profile.serviceManager === "systemd" ? "systemctl enable docker && systemctl start docker" : void 0,
+    verifyCommand: "docker --version"
+  };
+}
+function gitInstallPlan(profile) {
+  const commands = {
+    apt: "apt-get update -qq && apt-get install -y -qq git",
+    dnf: "dnf install -y git",
+    yum: "yum install -y git",
+    apk: "apk add --no-cache git",
+    brew: "brew install git"
+  };
+  const installCommand = commands[profile.packageManager];
+  if (!installCommand) {
+    return {
+      supported: false,
+      unsupportedReason: "No supported package manager found for Git installation"
+    };
+  }
+  return {
+    supported: true,
+    installCommand,
+    verifyCommand: "git --version"
+  };
+}
+function rsyncInstallPlan(profile) {
+  const commands = {
+    apt: "apt-get update -qq && apt-get install -y -qq rsync",
+    dnf: "dnf install -y rsync",
+    yum: "yum install -y rsync",
+    apk: "apk add --no-cache rsync",
+    brew: "brew install rsync"
+  };
+  const installCommand = commands[profile.packageManager];
+  if (!installCommand) {
+    return {
+      supported: false,
+      unsupportedReason: "No supported package manager found for rsync installation"
+    };
+  }
+  return {
+    supported: true,
+    installCommand,
+    verifyCommand: "rsync --version | head -n 1"
+  };
+}
+var OPENRESTY_APT_SOURCES = [
+  // ARM64: openresty.org publishes aarch64 debs under a SEPARATE path
+  // (openresty.org/package/arm64/<repo>); the default path is amd64-only, so on
+  // aarch64 `apt-get install openresty` finds no candidate and `set -e` aborts
+  // the whole setup (issue #109). Switch the base URL by arch and tag the deb
+  // line with `arch=` so apt fetches the right index. `dpkg --print-architecture`
+  // returns exactly amd64/arm64 (matches OpenResty's path + arch qualifier).
+  'OR_ARCH="$(dpkg --print-architecture 2>/dev/null || echo amd64)"',
+  'if [ "$OR_ARCH" = arm64 ]; then OR_BASE="http://openresty.org/package/arm64/$REPO"; else OR_BASE="http://openresty.org/package/$REPO"; fi',
+  // `|| REPO_CODENAME=""` so a failed substitution (no lsb_release AND no
+  // /etc/os-release, e.g. a stripped container) doesn't trip `set -e` before
+  // the empty-var fallback below can pick a default.
+  'REPO_CODENAME="$(lsb_release -sc 2>/dev/null || { . /etc/os-release 2>/dev/null && echo "$VERSION_CODENAME"; })" || REPO_CODENAME=""',
+  'if [ "$REPO" = debian ]; then OR_FALLBACKS="bookworm bullseye"; else OR_FALLBACKS="noble jammy focal"; fi',
+  'OR_CODENAME=""',
+  "for c in $REPO_CODENAME $OR_FALLBACKS; do",
+  '  if wget -q --spider --tries=2 --timeout=15 "$OR_BASE/dists/$c/Release"; then OR_CODENAME="$c"; break; fi',
+  "done",
+  'if [ -z "$OR_CODENAME" ]; then case "$REPO" in debian) OR_CODENAME=bookworm ;; *) OR_CODENAME=noble ;; esac; fi',
+  '[ "$OR_CODENAME" = "$REPO_CODENAME" ] || echo "[openresty] apt repo has no codename $REPO_CODENAME; using nearest supported LTS $OR_CODENAME" >&2',
+  'echo "deb [arch=$OR_ARCH signed-by=/usr/share/keyrings/openresty.gpg] $OR_BASE $OR_CODENAME main" > /etc/apt/sources.list.d/openresty.list'
+];
+function openrestyInstallPlan(profile) {
+  if (profile.os !== "linux") {
+    return {
+      supported: false,
+      unsupportedReason: "OpenResty installation is only supported on Linux servers"
+    };
+  }
+  let installCommand;
+  if (profile.packageManager === "apt") {
+    const distro = profile.distro === "debian" ? "debian" : "ubuntu";
+    installCommand = [
+      "set -e",
+      // Heal a stale/bad openresty.list left by a prior run (e.g. the #86
+      // 'resolute' pin) BEFORE the first apt-get update reads it — otherwise
+      // set -e aborts here and the repo never gets rewritten.
+      "rm -f /etc/apt/sources.list.d/openresty.list",
+      "apt-get update -qq && apt-get install -y -qq wget gnupg2 lsb-release",
+      "wget -qO /tmp/openresty-pubkey.gpg https://openresty.org/package/pubkey.gpg",
+      "gpg --yes --dearmor -o /usr/share/keyrings/openresty.gpg /tmp/openresty-pubkey.gpg",
+      `REPO=${distro}`,
+      ...OPENRESTY_APT_SOURCES,
+      "apt-get update -qq && apt-get install -y -qq openresty"
+    ].join("\n");
+  } else if (profile.packageManager === "dnf") {
+    const distro = profile.distro === "fedora" ? "fedora" : "centos";
+    installCommand = `wget -qO /etc/yum.repos.d/openresty.repo https://openresty.org/package/${distro}/openresty.repo && dnf install -y openresty`;
+  } else if (profile.packageManager === "yum") {
+    installCommand = "wget -qO /etc/yum.repos.d/openresty.repo https://openresty.org/package/centos/openresty.repo && yum install -y openresty";
+  } else if (profile.packageManager === "apk") {
+    installCommand = [
+      "apk add --no-cache wget",
+      "wget -qO /etc/apk/keys/admin@openresty.com-5ea678a6.rsa.pub https://openresty.org/package/alpine/admin@openresty.com-5ea678a6.rsa.pub",
+      `. /etc/os-release && echo "https://openresty.org/package/alpine/v$( echo $VERSION_ID | cut -d. -f1,2 )/main" >> /etc/apk/repositories`,
+      "apk update && apk add openresty"
+    ].join(" && ");
+  } else {
+    installCommand = [
+      "set -e",
+      "if command -v apt-get >/dev/null 2>&1; then",
+      "  rm -f /etc/apt/sources.list.d/openresty.list",
+      "  apt-get update -qq && apt-get install -y -qq wget gnupg2 lsb-release",
+      "  wget -qO /tmp/openresty-pubkey.gpg https://openresty.org/package/pubkey.gpg",
+      "  gpg --yes --dearmor -o /usr/share/keyrings/openresty.gpg /tmp/openresty-pubkey.gpg",
+      '  DISTRO=$(. /etc/os-release 2>/dev/null && echo "$ID" || echo "ubuntu")',
+      '  case "$DISTRO" in debian) REPO=debian ;; *) REPO=ubuntu ;; esac',
+      ...OPENRESTY_APT_SOURCES.map((l) => "  " + l),
+      "  apt-get update -qq && apt-get install -y -qq openresty",
+      "elif command -v dnf >/dev/null 2>&1; then",
+      "  wget -qO /etc/yum.repos.d/openresty.repo https://openresty.org/package/centos/openresty.repo && dnf install -y openresty",
+      "elif command -v yum >/dev/null 2>&1; then",
+      "  wget -qO /etc/yum.repos.d/openresty.repo https://openresty.org/package/centos/openresty.repo && yum install -y openresty",
+      "elif command -v apk >/dev/null 2>&1; then",
+      "  apk add --no-cache wget \\",
+      "  && wget -qO /etc/apk/keys/admin@openresty.com-5ea678a6.rsa.pub https://openresty.org/package/alpine/admin@openresty.com-5ea678a6.rsa.pub \\",
+      '  && . /etc/os-release && echo "https://openresty.org/package/alpine/v$(echo $VERSION_ID | cut -d. -f1,2)/main" >> /etc/apk/repositories \\',
+      "  && apk update && apk add openresty",
+      "else",
+      '  echo "No supported package manager found (tried apt-get, dnf, yum, apk)" >&2 && exit 1',
+      "fi"
+    ].join("\n");
+  }
+  return {
+    supported: true,
+    installCommand,
+    startCommand: profile.serviceManager === "systemd" ? "systemctl enable openresty && systemctl start openresty" : void 0,
+    verifyCommand: "openresty -v 2>&1"
+  };
+}
+function certbotInstallPlan(profile) {
+  const commands = {
+    apt: "apt-get update -qq && apt-get install -y -qq certbot",
+    dnf: "dnf install -y certbot",
+    yum: "yum install -y certbot",
+    apk: "apk add --no-cache certbot"
+  };
+  const installCommand = commands[profile.packageManager];
+  if (!installCommand) {
+    return {
+      supported: false,
+      unsupportedReason: "Certbot installation is only supported on Linux with apt, dnf, or yum"
+    };
+  }
+  return {
+    supported: true,
+    installCommand,
+    verifyCommand: "certbot --version 2>/dev/null"
+  };
+}
+var systemCatalog = {
+  checks: {
+    docker: {
+      versionCommand: "docker --version",
+      daemonCommand: "docker info --format '{{.ServerVersion}}'",
+      parseVersion: (output) => output.match(/Docker version ([^\s,]+)/)?.[1] ?? output,
+      missingMessage: "Docker is not installed",
+      notRunningMessage: "Docker is installed but the daemon is not running"
+    },
+    openresty: {
+      versionCommand: "openresty -v 2>&1 || /usr/local/openresty/bin/openresty -v 2>&1",
+      runningCommands: [
+        "pgrep -f 'nginx.*openresty' || pgrep -f '/usr/local/openresty'"
+      ],
+      parseVersion: (output) => output.match(/openresty\/(\S+)/)?.[1] ?? output.match(/nginx\/(\S+)/)?.[1] ?? output,
+      missingMessage: "OpenResty is not installed",
+      notRunningMessage: "OpenResty is installed but not running"
+    },
+    certbot: {
+      versionCommand: "certbot --version 2>/dev/null",
+      parseVersion: (output) => output.match(/certbot\s+(\S+)/)?.[1] ?? output,
+      missingMessage: "Certbot is not installed"
+    },
+    git: {
+      versionCommand: "git --version",
+      parseVersion: (output) => output.match(/git version (\S+)/)?.[1] ?? output,
+      missingMessage: "Git is not installed"
+    },
+    rsync: {
+      versionCommand: "rsync --version | head -n 1",
+      parseVersion: (output) => output.match(/rsync\s+version\s+(\S+)/i)?.[1] ?? output,
+      missingMessage: "rsync is not installed"
+    }
+  },
+  installs: {
+    docker: dockerInstallPlan,
+    git: gitInstallPlan,
+    rsync: rsyncInstallPlan,
+    openresty: openrestyInstallPlan,
+    certbot: certbotInstallPlan
+  }
+};
+
+// ../../packages/adapters/src/system/available-version.ts
+var PACKAGE_NAMES = {
+  git: "git",
+  rsync: "rsync",
+  openresty: "openresty",
+  certbot: "certbot",
+  docker: null
+};
+function normalizePkgVersion(raw) {
+  let v = raw.trim();
+  const colon = v.lastIndexOf(":");
+  if (colon !== -1) v = v.slice(colon + 1);
+  const dash = v.indexOf("-");
+  if (dash !== -1) v = v.slice(0, dash);
+  return v.trim();
+}
+async function tryExec(executor, cmd) {
+  try {
+    return await executor.exec(cmd);
+  } catch {
+    return null;
+  }
+}
+async function probeCandidate(executor, pm, pkg) {
+  const q = `'${pkg.replace(/'/g, "'\\''")}'`;
+  if (pm === "apt") {
+    const out = await tryExec(executor, `apt-cache policy ${q} 2>/dev/null`);
+    return out?.match(/Candidate:\s*(\S+)/)?.[1]?.trim() ?? null;
+  }
+  if (pm === "dnf" || pm === "yum") {
+    const out = await tryExec(
+      executor,
+      `${pm} -q --cacheonly list available ${q} 2>/dev/null | tail -n1`
+    );
+    return out?.trim().split(/\s+/)[1]?.trim() ?? null;
+  }
+  if (pm === "apk") {
+    const out = await tryExec(executor, `apk policy ${q} 2>/dev/null`);
+    const versions = [...out?.matchAll(/^\s+([\w.+~-]+):\s*$/gm) ?? []].map((m) => m[1]);
+    return versions.length ? versions[versions.length - 1] : null;
+  }
+  return null;
+}
+async function enrichAvailableVersions(executor, profile, statuses) {
+  const targets = statuses.filter(
+    (s) => s.installed && s.version && PACKAGE_NAMES[s.name]
+  );
+  await Promise.all(
+    targets.map(async (s) => {
+      try {
+        const pkg = PACKAGE_NAMES[s.name];
+        const candidate = await probeCandidate(executor, profile.packageManager, pkg);
+        if (!candidate) return;
+        const avail = normalizePkgVersion(candidate);
+        const installed = normalizePkgVersion(s.version);
+        if (avail && compareSemver(avail, installed) > 0) {
+          s.availableVersion = avail;
+          s.updateAvailable = true;
+        }
+      } catch {
+      }
+    })
+  );
+}
+
+// ../../packages/adapters/src/system/components.ts
+var SYSTEM_COMPONENTS = [
+  {
+    name: "docker",
+    label: "Docker",
+    description: "Container runtime for deployments",
+    installable: true,
+    category: "core"
+  },
+  {
+    name: "git",
+    label: "Git",
+    description: "Version control for source code",
+    installable: true,
+    category: "core"
+  },
+  {
+    name: "openresty",
+    label: "OpenResty",
+    description: "Reverse proxy with Lua scripting for routing and traffic control",
+    installable: true,
+    category: "infrastructure"
+  },
+  {
+    name: "certbot",
+    label: "Certbot",
+    description: "Let's Encrypt certificate provisioning",
+    installable: true,
+    category: "infrastructure"
+  },
+  {
+    name: "rsync",
+    label: "rsync",
+    description: "Fast directory sync for remote local-build transfers",
+    installable: true,
+    category: "infrastructure"
+  }
+];
+var SYSTEM_COMPONENTS_BY_NAME = new Map(
+  SYSTEM_COMPONENTS.map((component) => [component.name, component])
+);
+function getSystemComponentDefinition(name) {
+  return SYSTEM_COMPONENTS_BY_NAME.get(name) ?? {
+    name,
+    label: name,
+    description: `${name} component`,
+    installable: false,
+    category: "infrastructure"
+  };
+}
+
+// ../../packages/adapters/src/system/checks.ts
+async function tryExec2(executor, command) {
+  const startedAt = Date.now();
+  systemDebug("checks", `exec:start ${command}`);
+  try {
+    const result = await executor.exec(command, { timeout: 1e4 });
+    systemDebug(
+      "checks",
+      `exec:ok ${command} (${formatDuration(startedAt)})`
+    );
+    return result;
+  } catch (err) {
+    if (isRemoteConnectionError(err)) {
+      systemDebug(
+        "checks",
+        `exec:abort ${command} (${formatDuration(startedAt)}) ${safeErrorMessage(err)}`
+      );
+      throw err;
+    }
+    const msg = safeErrorMessage(err);
+    systemDebug(
+      "checks",
+      `exec:fail ${command} (${formatDuration(startedAt)}) ${msg}`
+    );
+    return null;
+  }
+}
+function healthy(name, version, running) {
+  const component = getSystemComponentDefinition(name);
+  return {
+    name,
+    label: component.label,
+    description: component.description,
+    installable: component.installable,
+    installed: true,
+    version,
+    running,
+    healthy: running !== void 0 ? running : true,
+    message: running ? `${name} ${version} - running` : `${name} ${version} - installed`
+  };
+}
+function unhealthy(name, message, opts) {
+  const component = getSystemComponentDefinition(name);
+  return {
+    name,
+    label: component.label,
+    description: component.description,
+    installable: component.installable,
+    installed: !!opts?.version,
+    version: opts?.version,
+    running: opts?.running,
+    healthy: false,
+    message
+  };
+}
+async function checkDocker(executor) {
+  const startedAt = Date.now();
+  const recipe = systemCatalog.checks.docker;
+  const version = await tryExec2(executor, recipe.versionCommand);
+  if (!version) {
+    systemDebug("checks", `docker:missing (${formatDuration(startedAt)})`);
+    return unhealthy("docker", recipe.missingMessage);
+  }
+  const parsed = recipe.parseVersion(version);
+  const info = await tryExec2(executor, recipe.daemonCommand);
+  if (!info) {
+    systemDebug("checks", `docker:not-running (${formatDuration(startedAt)})`);
+    return unhealthy("docker", recipe.notRunningMessage, {
+      version: parsed,
+      running: false
+    });
+  }
+  systemDebug("checks", `docker:healthy (${formatDuration(startedAt)})`);
+  return healthy("docker", parsed, true);
+}
+async function checkGit(executor) {
+  const startedAt = Date.now();
+  const recipe = systemCatalog.checks.git;
+  const version = await tryExec2(executor, recipe.versionCommand);
+  if (!version) {
+    systemDebug("checks", `git:missing (${formatDuration(startedAt)})`);
+    return unhealthy("git", recipe.missingMessage);
+  }
+  const parsed = recipe.parseVersion(version);
+  systemDebug("checks", `git:healthy (${formatDuration(startedAt)})`);
+  return healthy("git", parsed);
+}
+async function checkRsync(executor) {
+  const startedAt = Date.now();
+  const recipe = systemCatalog.checks.rsync;
+  const version = await tryExec2(executor, recipe.versionCommand);
+  if (!version) {
+    systemDebug("checks", `rsync:missing (${formatDuration(startedAt)})`);
+    return unhealthy("rsync", recipe.missingMessage);
+  }
+  const parsed = recipe.parseVersion(version);
+  systemDebug("checks", `rsync:healthy (${formatDuration(startedAt)})`);
+  return healthy("rsync", parsed);
+}
+async function checkOpenResty(executor) {
+  const startedAt = Date.now();
+  const recipe = systemCatalog.checks.openresty;
+  const version = await tryExec2(executor, recipe.versionCommand);
+  if (!version) {
+    systemDebug("checks", `openresty:missing (${formatDuration(startedAt)})`);
+    return unhealthy("openresty", recipe.missingMessage);
+  }
+  const parsed = recipe.parseVersion(version);
+  const runningChecks = await Promise.all(
+    recipe.runningCommands.map((command) => tryExec2(executor, command))
+  );
+  const running = runningChecks.some(Boolean);
+  if (!running) {
+    systemDebug("checks", `openresty:not-running (${formatDuration(startedAt)})`);
+    return unhealthy("openresty", recipe.notRunningMessage, {
+      version: parsed,
+      running: false
+    });
+  }
+  const hasLua = await tryExec2(
+    executor,
+    `test -f ${OPENRESTY_LUA_DIR}/site_logger.lua && test -f ${OPENRESTY_LUA_DIR}/pipe_stream.lua && echo ok`
+  );
+  if (!hasLua) {
+    systemDebug("checks", `openresty:missing-lua (${formatDuration(startedAt)})`);
+    return unhealthy(
+      "openresty",
+      "OpenResty is running but analytics scripts are not deployed - reinstall to fix",
+      { version: parsed, running: true }
+    );
+  }
+  systemDebug("checks", `openresty:healthy (${formatDuration(startedAt)})`);
+  return healthy("openresty", parsed, true);
+}
+async function checkCertbot(executor) {
+  const startedAt = Date.now();
+  const recipe = systemCatalog.checks.certbot;
+  const version = await tryExec2(executor, recipe.versionCommand);
+  if (!version) {
+    systemDebug("checks", `certbot:missing (${formatDuration(startedAt)})`);
+    return unhealthy("certbot", recipe.missingMessage);
+  }
+  const parsed = recipe.parseVersion(version);
+  systemDebug("checks", `certbot:healthy (${formatDuration(startedAt)})`);
+  return healthy("certbot", parsed);
+}
+var COMPONENT_CHECKS = {
+  docker: checkDocker,
+  openresty: checkOpenResty,
+  certbot: checkCertbot,
+  git: checkGit,
+  rsync: checkRsync
+};
+async function mapWithConcurrency(items, limit, fn) {
+  const results = new Array(items.length);
+  let cursor = 0;
+  const worker = async () => {
+    while (cursor < items.length) {
+      const index = cursor++;
+      results[index] = await fn(items[index]);
+    }
+  };
+  await Promise.all(
+    Array.from({ length: Math.min(limit, items.length) }, worker)
+  );
+  return results;
+}
+var CHECK_CONCURRENCY = 4;
+async function checkAll(executor) {
+  const startedAt = Date.now();
+  const entries = SYSTEM_COMPONENTS.map((component) => [component.name, COMPONENT_CHECKS[component.name]]).filter((entry) => Boolean(entry[1]));
+  systemDebug(
+    "checks",
+    `checkAll:start [${entries.map(([name]) => name).join(", ")}]`
+  );
+  const results = await mapWithConcurrency(
+    entries,
+    CHECK_CONCURRENCY,
+    ([, fn]) => fn(executor)
+  );
+  await enrichAvailable(executor, results);
+  systemDebug("checks", `checkAll:done (${formatDuration(startedAt)})`);
+  return results;
+}
+async function enrichAvailable(executor, results) {
+  try {
+    const profile = await resolveEnvironment(executor);
+    await enrichAvailableVersions(executor, profile, results);
+  } catch {
+  }
+}
+async function checkComponents(executor, names) {
+  const startedAt = Date.now();
+  const fns = names.map((name) => COMPONENT_CHECKS[name]).filter((fn) => Boolean(fn));
+  systemDebug("checks", `checkComponents:start [${names.join(", ")}]`);
+  const results = await mapWithConcurrency(
+    fns,
+    CHECK_CONCURRENCY,
+    (fn) => fn(executor)
+  );
+  await enrichAvailable(executor, results);
+  systemDebug(
+    "checks",
+    `checkComponents:done [${names.join(", ")}] (${formatDuration(startedAt)})`
+  );
+  return results;
+}
+
+// ../../packages/adapters/src/system/elevated-executor.ts
+var INSTALL_ENV = "DEBIAN_FRONTEND=noninteractive DPKG_FORCE=confnew";
+function elevateCommand(command) {
+  return `sudo -n sh -c ${sq(`export ${INSTALL_ENV}; ${command}`)}`;
+}
+function dirOf(path) {
+  const idx = path.lastIndexOf("/");
+  if (idx < 0) return ".";
+  return idx === 0 ? "/" : path.slice(0, idx);
+}
+function elevatedExecutor(inner) {
+  const writeFileElevated = async (path, content) => {
+    const tmp = `/tmp/.openship-elev-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
+    await inner.writeFile(tmp, content);
+    await inner.exec(
+      elevateCommand(`mkdir -p ${sq(dirOf(path))} && mv -f ${sq(tmp)} ${sq(path)}`)
+    );
+  };
+  const overrides = {
+    exec: (command, opts) => inner.exec(elevateCommand(command), opts),
+    streamExec: (command, onLog) => inner.streamExec(elevateCommand(command), onLog),
+    writeFile: writeFileElevated,
+    mkdir: async (path) => {
+      await inner.exec(elevateCommand(`mkdir -p ${sq(path)}`));
+    },
+    rm: async (path) => {
+      await inner.exec(elevateCommand(`rm -rf ${sq(path)}`));
+    }
+  };
+  return new Proxy(inner, {
+    get(target, prop) {
+      if (Object.prototype.hasOwnProperty.call(overrides, prop)) {
+        return overrides[prop];
+      }
+      const value = Reflect.get(target, prop, target);
+      return typeof value === "function" ? value.bind(target) : value;
+    }
+  });
+}
+
+// ../../packages/adapters/src/system/proxy/detect.ts
+var EDGE_PORTS = [80, 443];
+var EdgeConflictError = class extends AppError {
+  constructor(status) {
+    super(
+      `Ports ${status.occupants.map((o) => o.port).join("/") || "80/443"} are in use by another service (${status.classification}). Accept a migrate or takeover to continue.`,
+      409,
+      "EDGE_CONFLICT"
+    );
+    this.status = status;
+    this.name = "EdgeConflictError";
+  }
+};
+var EdgeMigrateRequested = class extends Error {
+  constructor(status, sites, warnings = []) {
+    super("Edge migration requested by user");
+    this.status = status;
+    this.sites = sites;
+    this.warnings = warnings;
+    this.name = "EdgeMigrateRequested";
+  }
+};
+async function tryExec3(executor, command) {
+  try {
+    return await executor.exec(command);
+  } catch {
+    return null;
+  }
+}
+function classifyProxy(text) {
+  if (!text) return void 0;
+  const t = text.toLowerCase();
+  if (t.includes("openresty")) return "openresty";
+  if (/(^|[\s/:])nginx/.test(t)) return "nginx";
+  if (/(^|[\s/:])caddy/.test(t)) return "caddy";
+  if (/(apache2|httpd)/.test(t)) return "apache";
+  if (/(^|[\s/:])traefik/.test(t)) return "traefik";
+  if (/(^|[\s/:])haproxy/.test(t)) return "haproxy";
+  return void 0;
+}
+function sq2(value) {
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function isOurEdgeContainer(name, image) {
+  return /openship-edge/i.test(`${name ?? ""} ${image ?? ""}`);
+}
+async function ourEdgeContainerRunning(executor) {
+  const byName = await tryExec3(
+    executor,
+    `docker ps --filter name=openship-edge --format '{{.Names}}' 2>/dev/null | head -1`
+  );
+  if (byName && byName.trim()) return true;
+  const all = await tryExec3(executor, `docker ps --format '{{.Names}}	{{.Image}}' 2>/dev/null`);
+  if (!all) return false;
+  return all.split("\n").map((line) => line.trim()).filter(Boolean).some((line) => {
+    const [name, image] = line.split("	");
+    return isOurEdgeContainer(name, image);
+  });
+}
+async function ourLuaOnHost(executor) {
+  const lua = await tryExec3(
+    executor,
+    `test -f ${OPENRESTY_LUA_DIR}/site_logger.lua && echo ok`
+  );
+  return Boolean(lua && lua.includes("ok"));
+}
+async function detectDockerOnPort(executor, port) {
+  const out = await tryExec3(
+    executor,
+    `docker ps --filter publish=${port} --format '{{.Names}}	{{.Image}}' 2>/dev/null | head -1`
+  );
+  const line = out?.trim();
+  if (!line) return null;
+  const [name, image] = line.split("	");
+  if (!name) return null;
+  return { name, image: image ?? "" };
+}
+async function listenerIsOurOpenResty(executor, listener) {
+  if (!listener) return false;
+  if (/openresty/i.test(`${listener.rawCommand ?? ""} ${listener.command ?? ""}`)) return true;
+  if (listener.pid) {
+    const exe = await tryExec3(executor, `readlink -f /proc/${listener.pid}/exe 2>/dev/null || true`);
+    if (exe && /openresty/i.test(exe)) return true;
+  }
+  return false;
+}
+var WORKER_RE = /\b(?:nginx|openresty)\s*:\s*worker process/i;
+var MASTER_RE = /\b(?:nginx|openresty)\s*:\s*master process/i;
+async function resolveProxyMaster(executor, listener) {
+  if (!listener?.pid) return listener;
+  if (!WORKER_RE.test(`${listener.rawCommand ?? ""} ${listener.command ?? ""}`)) return listener;
+  const ppidRaw = await tryExec3(
+    executor,
+    `awk '/^PPid:/{print $2}' /proc/${listener.pid}/status 2>/dev/null || true`
+  );
+  const ppid = Number.parseInt((ppidRaw ?? "").trim(), 10);
+  if (!Number.isInteger(ppid) || ppid <= 1) return listener;
+  const master = await describeProcess(executor, ppid);
+  if (!master || !MASTER_RE.test(`${master.rawCommand ?? ""} ${master.command ?? ""}`)) {
+    return listener;
+  }
+  return master;
+}
+async function probeEdgePort(executor, port, ours) {
+  const listener = await resolveProxyMaster(executor, await probeListeningPort(executor, port));
+  const docker = await detectDockerOnPort(executor, port);
+  if (!listener && !docker) return null;
+  const proxy = classifyProxy(
+    [
+      docker?.image,
+      docker?.name,
+      listener?.rawCommand,
+      listener?.command,
+      listener?.systemdUnit
+    ].filter(Boolean).join(" ")
+  );
+  const foreignDockerProxy = Boolean(docker) && !isOurEdgeContainer(docker?.name, docker?.image);
+  const managedByOpenship = isOurEdgeContainer(docker?.name, docker?.image) || ours.containerRunning && !foreignDockerProxy || !docker && ours.luaOnHost && await listenerIsOurOpenResty(executor, listener);
+  return {
+    port,
+    pid: listener?.pid ?? void 0,
+    command: docker ? `docker container ${docker.name} (${docker.image})` : listener?.command,
+    rawCommand: listener?.rawCommand,
+    systemdUnit: listener?.systemdUnit,
+    systemdDescription: listener?.systemdDescription,
+    isDocker: Boolean(docker),
+    containerName: docker?.name,
+    proxy,
+    managedByOpenship
+  };
+}
+async function probeEdge(executor) {
+  const containerRunning = await ourEdgeContainerRunning(executor);
+  const luaOnHost = await ourLuaOnHost(executor);
+  const all = [];
+  for (const port of EDGE_PORTS) {
+    const occ = await probeEdgePort(executor, port, { containerRunning, luaOnHost });
+    if (occ) all.push(occ);
+  }
+  const foreign = all.filter((o) => !o.managedByOpenship);
+  let classification;
+  if (all.length === 0) classification = "free";
+  else if (foreign.length === 0) classification = "ours";
+  else if (foreign.every((o) => o.proxy && o.proxy !== "openresty")) classification = "known";
+  else classification = "unknown";
+  return {
+    classification,
+    occupants: foreign,
+    canProceedClean: classification === "free" || classification === "ours"
+  };
+}
+function stopTargetsForStatus(status) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const o of status.occupants) {
+    const identity = o.systemdUnit ?? o.containerName ?? (o.pid ? `pid:${o.pid}` : `port:${o.port}`);
+    if (seen.has(identity)) continue;
+    seen.add(identity);
+    out.push({
+      port: o.port,
+      unit: o.systemdUnit,
+      pid: o.pid,
+      container: o.containerName,
+      // Prefer the proxy kind over the raw cmdline — `nginx (PID 123)` reads
+      // better in "Stopping …" than `nginx: master process /usr/sbin/nginx …`.
+      label: o.proxy && o.pid ? `${o.proxy} (PID ${o.pid})` : o.command
+    });
+  }
+  return out;
+}
+async function freeEdgeTargets(executor, targets, onLog) {
+  for (const t of targets) {
+    const where = t.port ? ` (port ${t.port})` : "";
+    if (t.container) {
+      onLog(`Stopping container ${t.container}${where}...`, "warn");
+      await tryExec3(executor, `docker update --restart=no ${sq2(t.container)} 2>/dev/null || true`);
+      await tryExec3(executor, `docker stop ${sq2(t.container)} 2>/dev/null || true`);
+    } else if (t.unit) {
+      onLog(`Stopping & disabling service ${t.unit}${where}...`, "warn");
+      await tryExec3(
+        executor,
+        `systemctl disable --now ${sq2(t.unit)} 2>/dev/null || systemctl stop ${sq2(t.unit)} 2>/dev/null || true; systemctl reset-failed ${sq2(t.unit)} 2>/dev/null || true`
+      );
+    } else if (t.pid) {
+      onLog(`Stopping ${t.label ?? `process ${t.pid}`}${where}...`, "warn");
+      await tryExec3(executor, `kill ${t.pid} 2>/dev/null || true`);
+      await new Promise((r) => setTimeout(r, 800));
+      await tryExec3(executor, `kill -9 ${t.pid} 2>/dev/null || true`);
+    }
+  }
+  await new Promise((r) => setTimeout(r, 1e3));
+}
+
+// ../../packages/adapters/src/system/proxy/import/parse-utils.ts
+async function tryExec4(executor, command) {
+  try {
+    return await executor.exec(command);
+  } catch {
+    return null;
+  }
+}
+function stripComments(text) {
+  return text.replace(/#.*$/gm, "");
+}
+function extractBlocks(text, keyword) {
+  const blocks = [];
+  const re = new RegExp(`(?:^|[\\s;}])${keyword}\\b[^{;]*\\{`, "g");
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    const openIdx = m.index + m[0].length - 1;
+    let depth = 1;
+    let i = openIdx + 1;
+    for (; i < text.length && depth > 0; i++) {
+      if (text[i] === "{") depth++;
+      else if (text[i] === "}") depth--;
+    }
+    if (depth === 0) {
+      blocks.push(text.slice(openIdx + 1, i - 1));
+      re.lastIndex = i;
+    } else {
+      break;
+    }
+  }
+  return blocks;
+}
+function sq3(value) {
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+
+// ../../packages/adapters/src/system/proxy/import/nginx.ts
+async function loadNginxConfig(executor) {
+  const dumped = await tryExec4(executor, "nginx -T 2>/dev/null");
+  if (dumped && /server\s*\{/.test(dumped)) return dumped;
+  const cat = await tryExec4(
+    executor,
+    "cat /etc/nginx/nginx.conf /etc/nginx/sites-enabled/* /etc/nginx/conf.d/*.conf 2>/dev/null"
+  );
+  return cat ?? "";
+}
+function firstDirective(body, name) {
+  const m = body.match(new RegExp(`(?:^|[;{\\s])${name}\\s+([^;]+);`));
+  return m?.[1]?.trim();
+}
+function parseUpstreams(config) {
+  const map = /* @__PURE__ */ new Map();
+  const re = /(?:^|[\s;}])upstream\s+(\S+)\s*\{([^}]*)\}/g;
+  let m;
+  while ((m = re.exec(config)) !== null) {
+    const name = m[1];
+    const server = m[2].match(/(?:^|[\s;{])server\s+([^;\s]+)/);
+    if (name && server?.[1]) map.set(name, server[1].trim());
+  }
+  return map;
+}
+function resolveProxyTarget(proxyPass, upstreams) {
+  const raw = proxyPass.replace(/;$/, "").trim();
+  if (raw.includes("$")) return { reason: `proxy_pass "${raw}" uses an nginx variable` };
+  if (/\/\/unix:/i.test(raw)) return { reason: `proxy_pass "${raw}" targets a unix socket` };
+  const m = raw.match(/^(https?:\/\/)([^/]+)(\/.*)?$/i);
+  if (!m) return { reason: `unrecognized proxy_pass "${raw}"` };
+  const scheme = m[1];
+  const authority = m[2];
+  const host = authority.replace(/:\d+$/, "");
+  if (upstreams.has(host)) return { url: `${scheme}${upstreams.get(host)}` };
+  const isIp = /^\d{1,3}(\.\d{1,3}){3}$/.test(host);
+  if (isIp || host === "localhost" || host.includes(".")) return { url: raw };
+  return { reason: `proxy_pass host "${host}" is an undeclared upstream \u2014 not migratable` };
+}
+function extractLocationProxies(serverBody) {
+  const out = [];
+  const re = /(?:^|[\s;}])location\s+([^{]+?)\s*\{/g;
+  let m;
+  while ((m = re.exec(serverBody)) !== null) {
+    const path = m[1].trim();
+    const openIdx = m.index + m[0].length - 1;
+    let depth = 1;
+    let i = openIdx + 1;
+    for (; i < serverBody.length && depth > 0; i++) {
+      if (serverBody[i] === "{") depth++;
+      else if (serverBody[i] === "}") depth--;
+    }
+    if (depth !== 0) break;
+    const locBody = serverBody.slice(openIdx + 1, i - 1);
+    re.lastIndex = i;
+    const pp = firstDirective(locBody, "proxy_pass");
+    if (pp) out.push({ path, proxyPass: pp });
+  }
+  return out;
+}
+function isHttpsUpgradeForSelf(body, names) {
+  const targets = [
+    ...body.matchAll(/(?:^|[\s;{])return\s+30[1-8]\s+([^;]+);/g),
+    ...body.matchAll(/(?:^|[\s;{])rewrite\s+\S+\s+([^;]+?)\s+permanent\s*;/g)
+  ].map((m) => m[1].trim());
+  if (targets.length === 0) return false;
+  return targets.every((raw) => {
+    if (!/^https:\/\//i.test(raw)) return false;
+    const authority = raw.replace(/^https:\/\//i, "").split(/[/\s]/)[0] ?? "";
+    const host = (authority.match(/^(\$[a-z_]+|[^$:]+)/i)?.[1] ?? "").replace(/:\d+$/, "");
+    if (host === "$host" || host === "$server_name" || host === "$http_host") return true;
+    return names.includes(host);
+  });
+}
+function parseServer(body, source, upstreams) {
+  const warnings = [];
+  const names = firstDirective(body, "server_name")?.split(/\s+/).filter((n) => n && n !== "_" && !n.startsWith("~")) ?? [];
+  const listens = [...body.matchAll(/(?:^|[;{\s])listen\s+([^;]+);/g)].map((m) => m[1]);
+  const ssl = listens.some((l) => /\bssl\b/.test(l) || /\b443\b/.test(l));
+  const root = firstDirective(body, "root");
+  const certPath = firstDirective(body, "ssl_certificate");
+  const keyPath = firstDirective(body, "ssl_certificate_key");
+  if (names.length === 0) return { warnings: [] };
+  const rawTargets = extractLocationProxies(body);
+  if (rawTargets.length === 0) {
+    const serverLevel = firstDirective(body, "proxy_pass");
+    if (serverLevel) rawTargets.push({ path: "/", proxyPass: serverLevel });
+  }
+  const resolved = [];
+  for (const t of rawTargets) {
+    const r = resolveProxyTarget(t.proxyPass, upstreams);
+    if ("reason" in r) warnings.push(`nginx: ${names[0]} ${t.path} \u2014 ${r.reason} (skipped)`);
+    else resolved.push({ path: t.path, url: r.url });
+  }
+  let target;
+  let routes;
+  if (resolved.length > 0) {
+    const primary = resolved.find((r) => r.path === "/") ?? resolved[0];
+    target = { kind: "proxy", url: primary.url };
+    routes = resolved;
+  } else if (root) {
+    target = { kind: "static", root: root.replace(/;$/, "") };
+  } else if (isHttpsUpgradeForSelf(body, names)) {
+    return { warnings: [] };
+  } else {
+    warnings.push(`nginx: ${names[0]} has neither proxy_pass nor root \u2014 skipped (${source})`);
+    return { warnings };
+  }
+  const site = { serverNames: names, ssl, target, source };
+  if (routes) site.routes = routes;
+  if (certPath && keyPath) site.tls = { certPath, keyPath };
+  return { site, warnings };
+}
+function parseNginxConfig(raw) {
+  const warnings = [];
+  const sites = [];
+  if (!raw.trim()) {
+    return { proxy: "nginx", sites, warnings: ["nginx: no readable configuration found"] };
+  }
+  const config = stripComments(raw);
+  const upstreams = parseUpstreams(config);
+  const blocks = extractBlocks(config, "server");
+  if (blocks.length === 0) {
+    warnings.push("nginx: no server blocks found");
+  }
+  for (const body of blocks) {
+    const { site, warnings: blockWarnings } = parseServer(body, "nginx", upstreams);
+    warnings.push(...blockWarnings);
+    if (site) sites.push(site);
+  }
+  return { proxy: "nginx", sites, warnings };
+}
+async function scanNginx(executor) {
+  return parseNginxConfig(await loadNginxConfig(executor));
+}
+
+// ../../packages/adapters/src/system/proxy/import/caddy.ts
+var CADDYFILE_PATHS = ["/etc/caddy/Caddyfile", "/etc/Caddyfile"];
+async function loadCaddyJson(executor) {
+  for (const p of CADDYFILE_PATHS) {
+    const out = await tryExec4(executor, `caddy adapt --adapter caddyfile --config ${p} 2>/dev/null`);
+    if (out && out.trim().startsWith("{")) return out;
+  }
+  return null;
+}
+function flattenHandlers(handlers, out = []) {
+  for (const h of handlers ?? []) {
+    if (h.handler === "subroute") {
+      for (const r of h.routes ?? []) flattenHandlers(r.handle, out);
+    } else {
+      out.push(h);
+    }
+  }
+  return out;
+}
+function targetFromRoute(route) {
+  const flat = flattenHandlers(route.handle);
+  const dial = flat.find((h) => h.handler === "reverse_proxy")?.upstreams?.find((u) => u.dial)?.dial;
+  if (dial) return { kind: "proxy", url: /^https?:\/\//.test(dial) ? dial : `http://${dial}` };
+  const root = flat.find((h) => h.handler === "vars" && typeof h.root === "string")?.root;
+  if (root && flat.some((h) => h.handler === "file_server")) return { kind: "static", root };
+  return null;
+}
+function parseCaddyJson(raw) {
+  let cfg;
+  try {
+    cfg = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  const servers = cfg.apps?.http?.servers;
+  if (!servers) return null;
+  const sites = [];
+  for (const srv of Object.values(servers)) {
+    const ssl = (srv.listen ?? []).some((l) => l.endsWith(":443"));
+    for (const route of srv.routes ?? []) {
+      const hosts = (route.match ?? []).flatMap((m) => m.host ?? []).filter((h) => h && h !== "*");
+      if (hosts.length === 0) continue;
+      const target = targetFromRoute(route);
+      if (!target) continue;
+      sites.push({ serverNames: hosts, ssl, target, source: "caddy (adapt)" });
+    }
+  }
+  return { sites, warnings: [] };
+}
+async function loadCaddyfile(executor) {
+  for (const p of CADDYFILE_PATHS) {
+    const out = await tryExec4(executor, `cat ${p} 2>/dev/null`);
+    if (out && out.trim()) return out;
+  }
+  return "";
+}
+function caddyBlocks(text) {
+  const out = [];
+  let i = 0;
+  let headerStart = 0;
+  while (i < text.length) {
+    if (text[i] === "{") {
+      const header = text.slice(headerStart, i).trim();
+      let depth = 1;
+      let j = i + 1;
+      for (; j < text.length && depth > 0; j++) {
+        if (text[j] === "{") depth++;
+        else if (text[j] === "}") depth--;
+      }
+      if (depth !== 0) break;
+      out.push({ header, body: text.slice(i + 1, j - 1) });
+      i = j;
+      headerStart = j;
+    } else {
+      i++;
+    }
+  }
+  return out;
+}
+function parseAddresses(header) {
+  return header.split(/[\s,]+/).filter(Boolean).map((addr) => {
+    const httpScheme = /^http:\/\//i.test(addr);
+    const host = addr.replace(/^https?:\/\//i, "").replace(/:\d+$/, "");
+    const isPort80 = /:80$/.test(addr);
+    return { host, ssl: !httpScheme && !isPort80 };
+  }).filter((a) => a.host && !a.host.startsWith(":") && a.host !== "*");
+}
+async function scanCaddy(executor) {
+  const json = await loadCaddyJson(executor);
+  if (json) {
+    const parsed = parseCaddyJson(json);
+    if (parsed && parsed.sites.length > 0) {
+      return { proxy: "caddy", sites: parsed.sites, warnings: parsed.warnings };
+    }
+  }
+  return scanCaddyText(executor);
+}
+async function scanCaddyText(executor) {
+  const raw = await loadCaddyfile(executor);
+  const warnings = [];
+  const sites = [];
+  if (!raw.trim()) {
+    return { proxy: "caddy", sites, warnings: ["caddy: no readable Caddyfile found"] };
+  }
+  const text = stripComments(raw);
+  let blocks = caddyBlocks(text);
+  if (blocks.length === 0) {
+    const lines = text.split("\n").map((l) => l.trim()).filter(Boolean);
+    if (lines.length > 0) {
+      blocks = [{ header: lines[0], body: lines.slice(1).join("\n") }];
+    } else {
+      warnings.push("caddy: config present but no parseable site blocks");
+    }
+  }
+  for (const { header, body } of blocks) {
+    if (!header) continue;
+    const addrs = parseAddresses(header);
+    if (addrs.length === 0) {
+      warnings.push(`caddy: skipped a block with no usable address (${header.slice(0, 40)})`);
+      continue;
+    }
+    const proxyMatch = body.match(/(?:^|\s)reverse_proxy\s+([^\n{]+)/);
+    const rootMatch = body.match(/(?:^|\s)root\s+\*?\s*([^\n\s]+)/);
+    const tlsMatch = body.match(/(?:^|\s)tls\s+(\S+)\s+(\S+)/);
+    let target;
+    if (proxyMatch) {
+      const upstream = proxyMatch[1].trim().split(/\s+/)[0];
+      target = { kind: "proxy", url: /^https?:\/\//.test(upstream) ? upstream : `http://${upstream}` };
+    } else if (rootMatch) {
+      target = { kind: "static", root: rootMatch[1] };
+    } else {
+      warnings.push(`caddy: ${addrs[0].host} has no reverse_proxy or root \u2014 skipped`);
+      continue;
+    }
+    const site = {
+      serverNames: addrs.map((a) => a.host),
+      ssl: addrs.some((a) => a.ssl),
+      target,
+      source: "caddy"
+    };
+    if (tlsMatch && tlsMatch[1].includes("/")) {
+      site.tls = { certPath: tlsMatch[1], keyPath: tlsMatch[2] };
+    }
+    sites.push(site);
+  }
+  return { proxy: "caddy", sites, warnings };
+}
+
+// ../../packages/adapters/src/system/proxy/import/apache.ts
+async function vhostFilesFromDump(executor) {
+  const dump = await tryExec4(
+    executor,
+    "apachectl -S 2>/dev/null || apache2ctl -S 2>/dev/null || httpd -S 2>/dev/null"
+  );
+  if (!dump) return [];
+  const files = /* @__PURE__ */ new Set();
+  for (const m of dump.matchAll(/\(([^()]+?):\d+\)/g)) {
+    const f = m[1].trim();
+    if (f.startsWith("/")) files.add(f);
+  }
+  return [...files];
+}
+async function loadApacheConfig(executor) {
+  const files = await vhostFilesFromDump(executor);
+  if (files.length > 0) {
+    const cat2 = await tryExec4(executor, `cat ${files.map(sq3).join(" ")} 2>/dev/null`);
+    if (cat2 && cat2.trim()) return cat2;
+  }
+  const cat = await tryExec4(
+    executor,
+    "cat /etc/apache2/sites-enabled/*.conf /etc/apache2/apache2.conf /etc/httpd/conf.d/*.conf /etc/httpd/conf/httpd.conf 2>/dev/null"
+  );
+  return cat ?? "";
+}
+function directive(body, name) {
+  const m = body.match(new RegExp(`(?:^|\\n)\\s*${name}\\s+([^\\n]+)`, "i"));
+  return m?.[1]?.trim();
+}
+function directiveAll(body, name) {
+  return [...body.matchAll(new RegExp(`(?:^|\\n)\\s*${name}\\s+([^\\n]+)`, "gi"))].map(
+    (m) => m[1].trim()
+  );
+}
+function parseVhost(body, portHint) {
+  const serverName = directive(body, "ServerName")?.split(/\s+/)[0];
+  const aliases = directiveAll(body, "ServerAlias").flatMap((line) => line.split(/\s+/));
+  const names = [serverName, ...aliases].filter((n) => Boolean(n));
+  if (names.length === 0) {
+    return { warning: "apache: skipped a VirtualHost with no ServerName" };
+  }
+  const routes = [...body.matchAll(/(?:^|\n)\s*ProxyPass\s+(\S+)\s+(\S+)/gi)].map((m) => ({ path: m[1], url: m[2] })).filter((p) => p.url && p.url !== "!");
+  const docRoot = directive(body, "DocumentRoot")?.replace(/^["']|["']$/g, "");
+  const certPath = directive(body, "SSLCertificateFile");
+  const keyPath = directive(body, "SSLCertificateKeyFile");
+  const ssl = /:443/.test(portHint) || /SSLEngine\s+on/i.test(body) || Boolean(certPath);
+  let target;
+  if (routes.length > 0) {
+    const primary = routes.find((r) => r.path === "/") ?? routes[0];
+    target = { kind: "proxy", url: primary.url };
+  } else if (docRoot) {
+    target = { kind: "static", root: docRoot };
+  } else {
+    return { warning: `apache: ${names[0]} has neither ProxyPass nor DocumentRoot \u2014 skipped` };
+  }
+  const site = { serverNames: names, ssl, target, source: "apache" };
+  if (routes.length > 0) site.routes = routes;
+  if (certPath && keyPath) site.tls = { certPath, keyPath };
+  return site;
+}
+function vhostBlocks(text) {
+  const out = [];
+  const re = /<VirtualHost([^>]*)>([\s\S]*?)<\/VirtualHost>/gi;
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    out.push({ args: m[1].trim(), body: m[2] });
+  }
+  return out;
+}
+async function scanApache(executor) {
+  const raw = await loadApacheConfig(executor);
+  const warnings = [];
+  const sites = [];
+  if (!raw.trim()) {
+    return { proxy: "apache", sites, warnings: ["apache: no readable configuration found"] };
+  }
+  const text = stripComments(raw);
+  const blocks = vhostBlocks(text);
+  if (blocks.length === 0) warnings.push("apache: no <VirtualHost> blocks found");
+  for (const { args, body } of blocks) {
+    const parsed = parseVhost(body, args);
+    if ("warning" in parsed) warnings.push(parsed.warning);
+    else sites.push(parsed);
+  }
+  return { proxy: "apache", sites, warnings };
+}
+
+// ../../packages/adapters/src/system/proxy/import/traefik.ts
+function extractHosts(rule) {
+  const hosts = [];
+  for (const call of rule.matchAll(/\bHost\(([^)]*)\)/gi)) {
+    for (const m of call[1].matchAll(/[`'"]([^`'"]+)[`'"]/g)) {
+      const h = m[1].trim();
+      if (h) hosts.push(h);
+    }
+  }
+  return hosts;
+}
+function extraMatchers(rule) {
+  const found = /* @__PURE__ */ new Set();
+  for (const m of rule.matchAll(
+    /\b(PathPrefix|PathRegexp|Path|HeadersRegexp|Headers|Method|Query|ClientIP|HostRegexp)\b/gi
+  )) {
+    found.add(m[1]);
+  }
+  return [...found];
+}
+function parseTraefikLabels(containers) {
+  const sites = [];
+  const warnings = [];
+  for (const c of containers) {
+    if (c.labels["traefik.enable"] === "false") continue;
+    const routers = /* @__PURE__ */ new Map();
+    const servicePorts = /* @__PURE__ */ new Map();
+    for (const [key, val] of Object.entries(c.labels)) {
+      const r = key.match(/^traefik\.http\.routers\.([^.]+)\.(.+)$/);
+      if (r) {
+        const bag = routers.get(r[1]) ?? {};
+        bag[r[2]] = val;
+        routers.set(r[1], bag);
+        continue;
+      }
+      const s = key.match(/^traefik\.http\.services\.([^.]+)\.loadbalancer\.server\.port$/);
+      if (s) servicePorts.set(s[1], val);
+    }
+    for (const [rname, props] of routers) {
+      const rule = props.rule;
+      if (!rule) continue;
+      const hosts = extractHosts(rule);
+      if (hosts.length === 0) {
+        warnings.push(
+          /HostRegexp/i.test(rule) ? `traefik: router "${rname}" uses HostRegexp (${rule}) \u2014 regex hosts aren't migratable` : `traefik: router "${rname}" has no Host() rule (${rule}) \u2014 skipped`
+        );
+        continue;
+      }
+      if (!c.ip) {
+        warnings.push(
+          `traefik: ${hosts.join(", ")} \u2014 couldn't resolve container ${c.name}'s IP; re-add the upstream manually`
+        );
+        continue;
+      }
+      const svc = props.service;
+      const rawPort = (svc && servicePorts.get(svc)) ?? (servicePorts.size === 1 ? [...servicePorts.values()][0] : void 0) ?? "80";
+      const port = /^\d{1,5}$/.test(String(rawPort)) ? String(rawPort) : "80";
+      const url = `http://${c.ip}:${port}`;
+      const extras = extraMatchers(rule);
+      if (extras.length > 0) {
+        warnings.push(
+          `traefik: ${hosts.join(", ")} also matches ${extras.join(", ")} \u2014 only the Host() part is migrated; re-add path/header rules manually`
+        );
+      }
+      if (props.middlewares) {
+        warnings.push(`traefik: ${hosts.join(", ")} uses middleware(s) "${props.middlewares}" \u2014 not migrated`);
+      }
+      const ssl = Object.keys(props).some((p) => p === "tls" || p.startsWith("tls."));
+      sites.push({
+        serverNames: hosts,
+        ssl,
+        target: { kind: "proxy", url },
+        source: `traefik container ${c.name}`
+      });
+    }
+  }
+  return { proxy: "traefik", sites, warnings };
+}
+async function scanTraefik(executor) {
+  const out = await tryExec4(
+    executor,
+    "docker ps -q 2>/dev/null | xargs -r docker inspect --format '{{.Name}}	{{json .Config.Labels}}	{{range .NetworkSettings.Networks}}{{.IPAddress}} {{end}}' 2>/dev/null"
+  );
+  if (!out) {
+    return { proxy: "traefik", sites: [], warnings: ["traefik: couldn't read container labels via docker inspect"] };
+  }
+  const containers = [];
+  for (const line of out.split("\n")) {
+    const [rawName, rawLabels, rawIps] = line.split("	");
+    if (!rawName || !rawLabels) continue;
+    let labels;
+    try {
+      labels = JSON.parse(rawLabels) ?? {};
+    } catch {
+      continue;
+    }
+    if (!Object.keys(labels).some((k) => k.startsWith("traefik."))) continue;
+    const ip = (rawIps ?? "").trim().split(/\s+/)[0] || void 0;
+    containers.push({ name: rawName.replace(/^\//, ""), labels, ip });
+  }
+  return parseTraefikLabels(containers);
+}
+
+// ../../packages/adapters/src/system/proxy/import/index.ts
+var INSTALLED_MARKERS = [
+  { proxy: "nginx", paths: ["/etc/nginx/nginx.conf"] },
+  { proxy: "caddy", paths: ["/etc/caddy/Caddyfile"] },
+  { proxy: "apache", paths: ["/etc/apache2/apache2.conf", "/etc/httpd/conf/httpd.conf"] }
+];
+async function detectInstalledProxy(executor) {
+  const probe = INSTALLED_MARKERS.map(({ proxy, paths }) => {
+    const test = paths.map((p) => `[ -f '${p}' ]`).join(" || ");
+    return `{ ${test}; } && echo ${proxy}`;
+  }).join("; ");
+  let out = "";
+  try {
+    out = await executor.exec(`{ ${probe}; } 2>/dev/null; true`, { timeout: 1e4 });
+  } catch {
+    return null;
+  }
+  const found = new Set(
+    out.split("\n").map((l) => l.trim()).filter(Boolean)
+  );
+  return INSTALLED_MARKERS.find((m) => found.has(m.proxy))?.proxy ?? null;
+}
+async function scanImportableSites(executor, proxy) {
+  switch (proxy) {
+    case "nginx":
+      return scanNginx(executor);
+    case "caddy":
+      return scanCaddy(executor);
+    case "apache":
+      return scanApache(executor);
+    case "traefik":
+      return scanTraefik(executor);
+    default:
+      return {
+        proxy,
+        sites: [],
+        warnings: [`${proxy}: config import not supported \u2014 takeover only`]
+      };
+  }
+}
+function canImportProxy(proxy) {
+  return proxy === "nginx" || proxy === "caddy" || proxy === "apache" || proxy === "traefik";
+}
+
+// ../../packages/adapters/src/system/proxy/takeover-journal.ts
+var JOURNAL_DIR = "/var/lib/openship";
+var JOURNAL_PATH = `${JOURNAL_DIR}/edge-takeover.json`;
+function log(message, level = "info") {
+  return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
+}
+async function tryExec5(executor, cmd) {
+  try {
+    return await executor.exec(cmd);
+  } catch {
+    return null;
+  }
+}
+async function buildJournal(executor, status) {
+  const units = /* @__PURE__ */ new Map();
+  const containers = /* @__PURE__ */ new Map();
+  const processes = /* @__PURE__ */ new Map();
+  for (const o of status.occupants) {
+    if (o.containerName && !containers.has(o.containerName)) {
+      const r = await tryExec5(
+        executor,
+        `docker inspect -f '{{.HostConfig.RestartPolicy.Name}}' ${sq2(o.containerName)} 2>/dev/null`
+      );
+      containers.set(o.containerName, { name: o.containerName, restart: r?.trim() || "no" });
+    } else if (o.systemdUnit && !units.has(o.systemdUnit)) {
+      const en = await tryExec5(executor, `systemctl is-enabled ${sq2(o.systemdUnit)} 2>/dev/null`);
+      units.set(o.systemdUnit, { unit: o.systemdUnit, wasEnabled: en?.trim() === "enabled" });
+    } else if (!o.containerName && !o.systemdUnit && o.pid && !processes.has(o.pid)) {
+      processes.set(o.pid, { pid: o.pid, command: o.rawCommand });
+    }
+  }
+  return {
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    units: [...units.values()],
+    containers: [...containers.values()],
+    processes: [...processes.values()]
+  };
+}
+async function writeJournal(executor, journal) {
+  try {
+    await executor.mkdir(JOURNAL_DIR);
+    await executor.writeFile(JOURNAL_PATH, JSON.stringify(journal, null, 2));
+  } catch {
+  }
+}
+async function clearJournal(executor) {
+  await tryExec5(executor, `rm -f ${JOURNAL_PATH}`);
+}
+async function readJournal(executor) {
+  const raw = await tryExec5(executor, `cat ${JOURNAL_PATH} 2>/dev/null`);
+  if (!raw?.trim()) return null;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    await clearJournal(executor);
+    return null;
+  }
+}
+async function rollback(executor, journal, onLog) {
+  onLog(log("Rolling back \u2014 restoring the previous proxy...", "warn"));
+  await tryExec5(
+    executor,
+    "systemctl disable --now openresty 2>/dev/null || systemctl stop openresty 2>/dev/null || true; systemctl reset-failed openresty 2>/dev/null || true"
+  );
+  for (const u of journal.units) {
+    await tryExec5(
+      executor,
+      u.wasEnabled ? `systemctl enable --now ${sq2(u.unit)} 2>/dev/null || true` : `systemctl start ${sq2(u.unit)} 2>/dev/null || true`
+    );
+  }
+  for (const c of journal.containers) {
+    await tryExec5(executor, `docker update --restart=${sq2(c.restart)} ${sq2(c.name)} 2>/dev/null || true`);
+    await tryExec5(executor, `docker start ${sq2(c.name)} 2>/dev/null || true`);
+  }
+  for (const p of journal.processes ?? []) {
+    if (p.command) {
+      await tryExec5(
+        executor,
+        `setsid -f sh -c ${sq2(p.command)} 2>/dev/null || (nohup sh -c ${sq2(p.command)} >/dev/null 2>&1 &) || true`
+      );
+    } else {
+      onLog(log(`Could not restore process ${p.pid} \u2014 no command captured.`, "warn"));
+    }
+  }
+}
+async function beginEdgeTakeover(executor, status, onLog) {
+  await writeJournal(executor, await buildJournal(executor, status));
+  await freeEdgeTargets(executor, stopTargetsForStatus(status), (m, l) => onLog(log(m, l)));
+}
+async function rollbackEdgeTakeover(executor, onLog) {
+  const journal = await readJournal(executor);
+  if (!journal || journal.completed) return false;
+  await rollback(executor, journal, onLog);
+  await clearJournal(executor);
+  return true;
+}
+async function completeEdgeTakeover(executor) {
+  const journal = await readJournal(executor);
+  if (journal) {
+    journal.completed = true;
+    await writeJournal(executor, journal);
+  }
+  await clearJournal(executor);
+}
+async function recoverInterruptedTakeover(executor, onLog, isEdgeHealthy) {
+  const journal = await readJournal(executor);
+  if (!journal) return;
+  if (journal.completed) {
+    await clearJournal(executor);
+    return;
+  }
+  if (isEdgeHealthy && await isEdgeHealthy()) {
+    onLog(log("Found an unfinished edge takeover, but our edge is serving \u2014 keeping it.", "warn"));
+    await clearJournal(executor);
+    return;
+  }
+  onLog(log("Found an interrupted edge takeover \u2014 restoring the previous proxy.", "warn"));
+  await rollback(executor, journal, onLog);
+  await clearJournal(executor);
+}
+
+// ../../packages/adapters/src/system/proxy/index.ts
+async function importSites(executor, status) {
+  const proxy = status.occupants.find((o) => o.proxy)?.proxy;
+  if (!proxy) return { proxy: "nginx", sites: [], warnings: [] };
+  if (canImportProxy(proxy)) return scanImportableSites(executor, proxy);
+  return { proxy, sites: [], warnings: [`${proxy}: config import not supported \u2014 takeover only`] };
+}
+async function foreignProxyOnEdge(executor) {
+  const status = await probeEdge(executor);
+  const blocked = !status.canProceedClean && status.occupants.length > 0;
+  return { status, blocked, owner: describeEdgeOwner(status.occupants) };
+}
+function describeEdgeOwner(occupants) {
+  const labels = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const o of occupants) {
+    const identity = o.systemdUnit ?? o.containerName ?? (o.pid ? `pid:${o.pid}` : o.command ?? `port:${o.port}`);
+    if (seen.has(identity)) continue;
+    seen.add(identity);
+    labels.push(
+      o.systemdUnit ?? (o.containerName ? `docker container ${o.containerName}` : void 0) ?? (o.proxy && o.pid ? `${o.proxy} (PID ${o.pid})` : void 0) ?? o.proxy ?? o.command ?? `port ${o.port}`
+    );
+  }
+  return labels.join(", ");
+}
+
+// ../../packages/adapters/src/system/proxy/consent.ts
+function log2(message, level = "info") {
+  return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
+}
+async function ensureEdgeClear(executor, config, onLog) {
+  const status = await probeEdge(executor);
+  if (status.canProceedClean) return { tookOver: false };
+  const takeover = async () => {
+    onLog(log2(
+      `Taking over ports from ${status.occupants.map((o) => o.command ?? o.port).join(", ")}...`,
+      "warn"
+    ));
+    const configured = config?.edgePolicy?.stopTargets ?? [];
+    const targets = configured.length ? configured : stopTargetsForStatus(status);
+    await freeEdgeTargets(executor, targets, (m, l) => onLog(log2(m, l)));
+  };
+  if (config?.edgePolicy?.mode === "takeover") {
+    await takeover();
+    return { tookOver: true };
+  }
+  if (config?.promptUser) {
+    const known = status.classification === "known";
+    const owner = status.occupants.map((o) => o.command ?? `port ${o.port}`).join(", ");
+    const scan = await importSites(executor, status);
+    const migratable = scan.sites.length > 0;
+    const message = migratable ? `Openship runs its own load balancer (OpenResty) on ports 80 and 443, but ${owner} is already serving them (${scan.sites.length} site${scan.sites.length === 1 ? "" : "s"}). Migrate those sites into Openship and take over, just stop it and take over, or cancel?` : known ? `Openship runs its own load balancer (OpenResty) on ports 80 and 443, but ${owner} is already serving them. Stop it and take over, or cancel and leave it running?` : `Openship runs its own load balancer (OpenResty) on ports 80 and 443, but ${owner} is already using them and we can't identify it. Stop it and take over, or cancel and leave it running?`;
+    const details = {
+      edge: status,
+      sites: scan.sites,
+      warnings: scan.warnings
+    };
+    const action = await config.promptUser({
+      promptId: "edge_conflict",
+      title: known ? "Existing reverse proxy detected" : "Ports 80/443 are in use",
+      message,
+      actions: [
+        ...migratable ? [{ id: "migrate", label: `Migrate ${scan.sites.length} site(s) & take over`, variant: "primary" }] : [],
+        { id: "override", label: "Stop it & take over", variant: "danger" },
+        { id: "cancel", label: "Cancel", variant: "secondary" }
+      ],
+      details
+    });
+    if (action === "migrate") {
+      throw new EdgeMigrateRequested(status, scan.sites, scan.warnings);
+    }
+    if (action === "override") {
+      await takeover();
+      return { tookOver: true };
+    }
+    throw new EdgeConflictError(status);
+  }
+  throw new EdgeConflictError(status);
+}
+
+// ../../packages/adapters/src/system/installer.ts
+function log3(message, level = "info") {
+  return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
+}
+function describeEnvironment(profile) {
+  return `Detected environment: os=${profile.os}, arch=${profile.arch}, distro=${profile.distro ?? "n/a"}, packageManager=${profile.packageManager}, serviceManager=${profile.serviceManager}`;
+}
+async function execSafe(executor, cmd) {
+  try {
+    await executor.exec(cmd);
+  } catch {
+  }
+}
+async function ensureAptReady(executor, onLog) {
+  const broken = await executor.exec("dpkg --audit 2>&1 | head -1").catch(() => "");
+  if (!broken) return;
+  onLog(log3("Fixing interrupted package state..."));
+  await execSafe(executor, "fuser -k /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock /var/cache/apt/archives/lock 2>/dev/null || true");
+  await execSafe(executor, "rm -f /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock /var/cache/apt/archives/lock 2>/dev/null || true");
+  await executor.streamExec("dpkg --configure -a 2>&1", onLog);
+}
+async function prepareExecutor(executor, component) {
+  const profile = await resolveEnvironment(executor);
+  if (profile.isRoot) return { ok: true, executor, profile };
+  if (profile.canSudo) return { ok: true, executor: elevatedExecutor(executor), profile };
+  return {
+    ok: false,
+    result: {
+      component,
+      success: false,
+      error: `Installing ${component} needs root. Connect this server as root, or as a user with passwordless sudo.`
+    }
+  };
+}
+async function installDocker(executor, onLog) {
+  const prep = await prepareExecutor(executor, "docker");
+  if (!prep.ok) return prep.result;
+  executor = prep.executor;
+  const profile = prep.profile;
+  const plan = systemCatalog.installs.docker(profile);
+  if (!plan.supported || !plan.installCommand || !plan.verifyCommand) {
+    return { component: "docker", success: false, error: plan.unsupportedReason ?? "Docker install not supported" };
+  }
+  onLog(log3("Installing Docker Engine..."));
+  try {
+    const { code } = await executor.streamExec(plan.installCommand, onLog);
+    if (code !== 0) return { component: "docker", success: false, error: "Docker install failed" };
+    if (plan.startCommand) {
+      onLog(log3("Starting Docker service..."));
+      await executor.streamExec(plan.startCommand, onLog);
+    }
+    const version = await executor.exec(plan.verifyCommand);
+    const parsed = systemCatalog.checks.docker.parseVersion(version);
+    onLog(log3(`Docker ${parsed} installed`));
+    return { component: "docker", success: true, version: parsed };
+  } catch (err) {
+    const msg = safeErrorMessage(err);
+    onLog(log3(`Docker installation failed: ${msg}`, "error"));
+    return { component: "docker", success: false, error: msg };
+  }
+}
+async function installGit(executor, onLog, opts) {
+  const prep = await prepareExecutor(executor, "git");
+  if (!prep.ok) return prep.result;
+  executor = prep.executor;
+  const profile = prep.profile;
+  const plan = systemCatalog.installs.git(profile);
+  if (!plan.supported || !plan.installCommand || !plan.verifyCommand) {
+    return { component: "git", success: false, error: plan.unsupportedReason ?? "Git install not supported" };
+  }
+  onLog(log3(opts?.label ? `Installing Git in ${opts.label}...` : "Installing Git..."));
+  try {
+    const { code } = await executor.streamExec(plan.installCommand, onLog);
+    if (code !== 0) return { component: "git", success: false, error: "Git installation failed" };
+    const version = await executor.exec(plan.verifyCommand);
+    const parsed = systemCatalog.checks.git.parseVersion(version);
+    onLog(log3(opts?.label ? `Git ${parsed} installed in ${opts.label}` : `Git ${parsed} installed`));
+    return { component: "git", success: true, version: parsed };
+  } catch (err) {
+    const msg = safeErrorMessage(err);
+    onLog(log3(`Git installation failed: ${msg}`, "error"));
+    return { component: "git", success: false, error: msg };
+  }
+}
+async function installRsync(executor, onLog) {
+  const prep = await prepareExecutor(executor, "rsync");
+  if (!prep.ok) return prep.result;
+  executor = prep.executor;
+  const profile = prep.profile;
+  const plan = systemCatalog.installs.rsync(profile);
+  if (!plan.supported || !plan.installCommand || !plan.verifyCommand) {
+    return { component: "rsync", success: false, error: plan.unsupportedReason ?? "rsync install not supported" };
+  }
+  onLog(log3("Installing rsync..."));
+  try {
+    const { code } = await executor.streamExec(plan.installCommand, onLog);
+    if (code !== 0) return { component: "rsync", success: false, error: "rsync installation failed" };
+    const version = await executor.exec(plan.verifyCommand);
+    const parsed = systemCatalog.checks.rsync.parseVersion(version);
+    onLog(log3(`rsync ${parsed} installed`));
+    return { component: "rsync", success: true, version: parsed };
+  } catch (err) {
+    const msg = safeErrorMessage(err);
+    onLog(log3(`rsync installation failed: ${msg}`, "error"));
+    return { component: "rsync", success: false, error: msg };
+  }
+}
+async function installCertbot(executor, onLog) {
+  const prep = await prepareExecutor(executor, "certbot");
+  if (!prep.ok) return prep.result;
+  executor = prep.executor;
+  const profile = prep.profile;
+  const plan = systemCatalog.installs.certbot(profile);
+  if (!plan.supported || !plan.installCommand || !plan.verifyCommand) {
+    return { component: "certbot", success: false, error: plan.unsupportedReason ?? "Certbot install not supported" };
+  }
+  onLog(log3("Installing certbot..."));
+  try {
+    const { code } = await executor.streamExec(plan.installCommand, onLog);
+    if (code !== 0) return { component: "certbot", success: false, error: "Certbot installation failed" };
+    const version = await executor.exec(plan.verifyCommand);
+    const parsed = systemCatalog.checks.certbot.parseVersion(version);
+    onLog(log3(`Certbot ${parsed} installed`));
+    return { component: "certbot", success: true, version: parsed };
+  } catch (err) {
+    const msg = safeErrorMessage(err);
+    onLog(log3(`Certbot installation failed: ${msg}`, "error"));
+    return { component: "certbot", success: false, error: msg };
+  }
+}
+async function installOpenResty(executor, onLog, config) {
+  const prep = await prepareExecutor(executor, "openresty");
+  if (!prep.ok) return prep.result;
+  executor = prep.executor;
+  const profile = prep.profile;
+  onLog(log3(describeEnvironment(profile)));
+  const plan = systemCatalog.installs.openresty(profile);
+  if (!plan.supported || !plan.installCommand || !plan.verifyCommand) {
+    return { component: "openresty", success: false, error: plan.unsupportedReason ?? "OpenResty install not supported" };
+  }
+  onLog(log3("Installing OpenResty..."));
+  try {
+    const { tookOver } = await ensureEdgeClear(executor, config, onLog);
+    const hasIt = await executor.exec("command -v openresty >/dev/null 2>&1 && echo y || echo n").then((r) => r.trim() === "y");
+    if (hasIt && await ourLuaOnHost(executor)) {
+      onLog(log3("Stopping existing OpenResty..."));
+      await execSafe(executor, "systemctl stop openresty 2>/dev/null || true");
+      await execSafe(executor, "pkill -f '[o]penresty' 2>/dev/null || true");
+    }
+    if (profile.packageManager === "apt") {
+      await ensureAptReady(executor, onLog);
+    }
+    const { code } = await executor.streamExec(plan.installCommand, onLog);
+    if (code !== 0) return { component: "openresty", success: false, error: "OpenResty installation failed" };
+    await execSafe(executor, "systemctl stop openresty 2>/dev/null || true");
+    await execSafe(executor, "pkill -f '[o]penresty' 2>/dev/null || true");
+    await execSafe(executor, "systemctl reset-failed openresty 2>/dev/null || true");
+    const paths = await detectOpenRestyPaths(executor);
+    await ensureOpenRestyConfig(executor, paths);
+    onLog(log3("Validating config..."));
+    const { code: testCode } = await executor.streamExec(`${paths.bin} -t 2>&1`, onLog);
+    if (testCode !== 0) {
+      return { component: "openresty", success: false, error: "OpenResty config invalid - see logs above" };
+    }
+    if (plan.startCommand) {
+      onLog(log3("Starting OpenResty..."));
+      let start = await executor.streamExec(plan.startCommand, onLog);
+      if (start.code !== 0 && tookOver) {
+        onLog(log3("Start failed - reclaiming authorized ports...", "warn"));
+        const targets = config?.edgePolicy?.stopTargets?.length ? config.edgePolicy.stopTargets : stopTargetsForStatus(await probeEdge(executor));
+        await freeEdgeTargets(executor, targets, (m, l) => onLog(log3(m, l)));
+        await execSafe(executor, "systemctl reset-failed openresty 2>/dev/null || true");
+        start = await executor.streamExec(plan.startCommand, onLog);
+      }
+      if (start.code !== 0) {
+        const journal = await executor.exec(
+          "journalctl -xeu openresty.service --no-pager -n 30 2>/dev/null || echo '(unavailable)'"
+        ).catch(() => "(could not read journal)");
+        onLog(log3(`Service journal:
+${journal}`, "error"));
+        return { component: "openresty", success: false, error: "OpenResty installed but failed to start" };
+      }
+    }
+    await executor.exec(buildReloadCommand(paths));
+    onLog(log3("Deploying analytics scripts..."));
+    await deployLuaScripts(executor, paths);
+    const version = await executor.exec(plan.verifyCommand);
+    const parsed = systemCatalog.checks.openresty.parseVersion(version);
+    onLog(log3(`OpenResty ${parsed} installed`));
+    return { component: "openresty", success: true, version: parsed };
+  } catch (err) {
+    if (err instanceof EdgeMigrateRequested) throw err;
+    const msg = safeErrorMessage(err);
+    onLog(log3(`OpenResty installation failed: ${msg}`, "error"));
+    return { component: "openresty", success: false, error: msg };
+  }
+}
+var COMPONENT_INSTALLERS = {
+  docker: (exec, log4) => installDocker(exec, log4),
+  openresty: (exec, log4, config) => installOpenResty(exec, log4, config),
+  certbot: (exec, log4) => installCertbot(exec, log4),
+  git: (exec, log4) => installGit(exec, log4),
+  rsync: (exec, log4) => installRsync(exec, log4)
+};
+
+export {
+  systemCatalog,
+  checkGit,
+  checkAll,
+  checkComponents,
+  ourEdgeContainerRunning,
+  detectInstalledProxy,
+  scanImportableSites,
+  beginEdgeTakeover,
+  rollbackEdgeTakeover,
+  completeEdgeTakeover,
+  recoverInterruptedTakeover,
+  importSites,
+  foreignProxyOnEdge,
+  installGit,
+  COMPONENT_INSTALLERS
+};