openship 0.4.4 → 0.4.6

package/dist/index.js

@@ -1,4 +1,7 @@
-#!/usr/bin/env node
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v bun || command -v node)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
 import {
   IS_ALT_HOME,
   OS_DIR,
@@ -6,6 +9,9 @@ import {
   composeInternalToken,
   composeIsViableDefault,
   composePs,
+  composeRestart,
+  composeRunning,
+  composeStart,
   composeUninstall,
   composeUp,
   composeUpdate,
@@ -19,47 +25,54 @@ import {
   remoteSha,
   shortSha,
   sourceBuildDir
-} from "./chunk-YHXCHW7Q.js";
-import "./chunk-QKFRZNKN.js";
-import "./chunk-XIFRMKYT.js";
-import "./chunk-5ZCKQ2MI.js";
-import "./chunk-LBFH7THC.js";
-import "./chunk-Y37KHU7L.js";
-import "./chunk-4FABQGQP.js";
-import "./chunk-S6DSRLNE.js";
-import "./chunk-TEYJYSMT.js";
-import "./chunk-BUBSSKO6.js";
-import "./chunk-JR2OCMJA.js";
-import "./chunk-OJE6YWPQ.js";
-import "./chunk-5N7VUGL6.js";
-import "./chunk-6ERIMTBC.js";
-import "./chunk-KD7VO4LG.js";
-import "./chunk-ZKJOFWBJ.js";
-import "./chunk-WJPCBU7Z.js";
+} from "./chunk-3JQTL4R4.js";
+import "./chunk-FRNAR33O.js";
+import "./chunk-EI575GHN.js";
+import "./chunk-6APIPIJY.js";
+import "./chunk-IXCHURVK.js";
+import "./chunk-OWED2GRM.js";
+import "./chunk-VWPEKOH6.js";
+import "./chunk-W73X43R7.js";
+import "./chunk-TGIINPVM.js";
+import "./chunk-5FNIWBFI.js";
+import "./chunk-AVIB7CT7.js";
+import "./chunk-5MZ624VX.js";
+import "./chunk-Q2CIRAOK.js";
+import "./chunk-C5OHTYEF.js";
 import {
   beginEdgeTakeover,
+  collectProxyCerts,
   completeEdgeTakeover,
   detectInstalledProxy,
+  edgeProxy,
+  edgeProxyFor,
   foreignProxyOnEdge,
   importSites,
-  ourEdgeContainerRunning,
   recoverInterruptedTakeover,
   rollbackEdgeTakeover,
   scanImportableSites
-} from "./chunk-46YJFP4S.js";
-import "./chunk-HFYDYK4D.js";
-import "./chunk-NB2VEIWG.js";
-import "./chunk-3U4SPZD5.js";
-import "./chunk-YL67EWYZ.js";
-import "./chunk-E77LJWJK.js";
+} from "./chunk-SQ77DZOI.js";
+import "./chunk-O6ZZF52V.js";
+import "./chunk-JYGD5WSN.js";
+import "./chunk-2ZLR7ULL.js";
+import "./chunk-V6AN6XLZ.js";
+import "./chunk-VDMQJHPI.js";
+import "./chunk-MZ2WEHHY.js";
+import "./chunk-L2VOGB2X.js";
+import "./chunk-4Z5QO7N6.js";
+import "./chunk-4TJC4JZQ.js";
+import "./chunk-OXWDY22G.js";
+import "./chunk-RPHRPFEH.js";
 import {
   LocalExecutor
-} from "./chunk-U2DPZSXA.js";
-import "./chunk-4MG3BVHE.js";
-import "./chunk-4LEL3H2Z.js";
-import "./chunk-JUJBBF5U.js";
-import "./chunk-4CQWT2WL.js";
-import "./chunk-E6W2JMMU.js";
+} from "./chunk-TYVME3XD.js";
+import "./chunk-FXTBHTWY.js";
+import "./chunk-FPRHYBY2.js";
+import {
+  ourEdgeContainerRunning
+} from "./chunk-FQGJZ2HS.js";
+import "./chunk-ILFETZOM.js";
+import "./chunk-VFINNTUL.js";
 import {
   CLOUD_DASHBOARD_URL,
   LOCAL_API_URL,
@@ -68,9 +81,8 @@ import {
   isValidEmail,
   parseOpenshipConfigJson,
   resolveCliUpdatePlan
-} from "./chunk-JZLNHGLW.js";
-import "./chunk-XVSAUO2I.js";
-import "./chunk-4VNS5WPM.js";
+} from "./chunk-6APULWSU.js";
+import "./chunk-KI2EY3WB.js";
 
 // src/index.ts
 import { Command as Command28 } from "commander";
@@ -472,7 +484,7 @@ import chalk6 from "chalk";
 import ora from "ora";
 import { spawn } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
-import { createWriteStream as createWriteStream2, existsSync as existsSync7, mkdirSync as mkdirSync8, readFileSync as readFileSync6, writeFileSync as writeFileSync7 } from "fs";
+import { createWriteStream as createWriteStream2, existsSync as existsSync7, mkdirSync as mkdirSync8, readFileSync as readFileSync5, writeFileSync as writeFileSync7 } from "fs";
 import { dirname as dirname2, join as join8 } from "path";
 import { fileURLToPath } from "url";
 
@@ -998,20 +1010,10 @@ async function resolvePorts(prefs) {
 
 // src/lib/edge-preflight.ts
 import { spawnSync as spawnSync3 } from "child_process";
-import { existsSync as existsSync5, mkdirSync as mkdirSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync6, writeFileSync as writeFileSync5 } from "fs";
 import { join as join6 } from "path";
 import chalk5 from "chalk";
 import { isCancel, log, note, select } from "@clack/prompts";
-function isSafePath(p) {
-  return /^\/[A-Za-z0-9._/-]+$/.test(p);
-}
-function readCertFile(p) {
-  try {
-    return readFileSync4(p, "utf8");
-  } catch {
-    return null;
-  }
-}
 async function planAndApplyHostEdge(opts, overrides = {}) {
   const deps = { ...defaultDeps(), ...overrides };
   if (deps.platform !== "linux") return { proceed: true };
@@ -1029,7 +1031,7 @@ async function planAndApplyHostEdge(opts, overrides = {}) {
   const { sites, warnings } = await deps.importSites(executor, status);
   const action2 = await resolveAction(opts.edge, { status, owner, sites, warnings }, deps);
   if (action2 === "cancel") return { proceed: false };
-  const certPems = action2 === "migrate" ? collectCertPems(sites, deps.readCert) : void 0;
+  const certPems = action2 === "migrate" ? await deps.collectCerts(executor, sites, { status }) : void 0;
   await deps.beginEdgeTakeover(
     executor,
     status,
@@ -1106,7 +1108,12 @@ async function offerStoppedProxyImport(executor, deps) {
   if (!await deps.confirmStoppedImport({ proxy, count: sites.length })) {
     return { proceed: true };
   }
-  return { proceed: true, action: "migrate", sites, certPems: collectCertPems(sites, readCertFile) };
+  return {
+    proceed: true,
+    action: "migrate",
+    sites,
+    certPems: await deps.collectCerts(executor, sites, { proxy })
+  };
 }
 async function completeHostEdge() {
   if (process.platform !== "linux") return;
@@ -1130,17 +1137,57 @@ async function resolveAction(flag, ctx, deps) {
     importable: ctx.sites.length
   });
 }
-function collectCertPems(sites, readCert) {
-  const out = {};
-  for (const s of sites) {
-    if (!s.ssl || !s.tls) continue;
-    const { certPath, keyPath } = s.tls;
-    if (!isSafePath(certPath) || !isSafePath(keyPath)) continue;
-    const certPem = readCert(certPath);
-    const keyPem = readCert(keyPath);
-    if (certPem && keyPem) out[certPath] = { certPem, keyPem };
+async function collectCertsFromProxy(executor, sites, source) {
+  const api = source.proxy ? edgeProxyFor(executor, source.proxy) : await edgeProxy(executor, source.status ? { status: source.status } : {});
+  if (!api) return {};
+  const { certPems, warnings } = await collectProxyCerts(api, sites);
+  for (const w of warnings) console.log(chalk5.yellow(`  ${w}`));
+  return certPems;
+}
+function renderEdgeConflict(info3) {
+  const { owner, sites, warnings } = info3;
+  if (sites.length > 0) {
+    const lines = sites.map((st) => {
+      const host = (st.serverNames ?? []).join(", ") || "(no server_name)";
+      const dest = st.target.kind === "static" ? `static: ${st.target.root}` : st.target.url;
+      return `${chalk5.bold(host)} \u2192 ${chalk5.dim(dest)}${st.ssl ? chalk5.green(" [TLS]") : ""}`;
+    });
+    note(lines.join("\n"), `Detected ${sites.length} site${sites.length === 1 ? "" : "s"} on ${owner}`);
+  }
+  if (warnings.length > 0) {
+    log.warn(`${warnings.length} config item${warnings.length === 1 ? "" : "s"} won't migrate automatically:`);
+    for (const w of warnings.slice(0, 8)) log.message(chalk5.dim(`\u2022 ${w}`));
   }
-  return out;
+}
+async function confirmEdgeAction(info3) {
+  const { owner, known, importable } = info3;
+  const choice = await select({
+    message: known ? `An existing reverse proxy (${owner}) is serving ports 80/443.` : `Ports 80/443 are in use by ${owner}, which we couldn't identify.`,
+    options: [
+      ...importable > 0 ? [
+        {
+          value: "migrate",
+          label: `Migrate ${importable} site${importable === 1 ? "" : "s"} & take over`,
+          hint: "import the existing sites into Openship's edge, then take 80/443"
+        }
+      ] : [],
+      {
+        value: "takeover",
+        label: "Stop it & take over 80/443",
+        hint: known ? "the existing sites stop being served" : "may interrupt a running service"
+      },
+      { value: "cancel", label: "Cancel \u2014 leave it running" }
+    ],
+    // Default to MIGRATE whenever there are sites we can import: it's the only
+    // option that both gets Openship onto 80/443 and keeps the operator's
+    // existing sites served, so it's the choice they almost always want and
+    // the one that loses nothing on a reflexive Enter.
+    // With nothing importable there's no safe default: a known proxy falls
+    // back to cancel (blind Enter would stop sites that are being served),
+    // and an unidentified port holder to takeover.
+    initialValue: importable > 0 ? "migrate" : known ? "cancel" : "takeover"
+  });
+  return isCancel(choice) ? "cancel" : choice;
 }
 function defaultDeps() {
   return {
@@ -1170,61 +1217,20 @@ function defaultDeps() {
       });
       return !isCancel(take) && take === "import";
     },
-    readCert: readCertFile,
-    render: ({ owner, sites, warnings }) => {
-      if (sites.length > 0) {
-        const lines = sites.map((st) => {
-          const host = (st.serverNames ?? []).join(", ") || "(no server_name)";
-          const dest = st.target.kind === "static" ? `static: ${st.target.root}` : st.target.url;
-          return `${chalk5.bold(host)} \u2192 ${chalk5.dim(dest)}${st.ssl ? chalk5.green(" [TLS]") : ""}`;
-        });
-        note(lines.join("\n"), `Detected ${sites.length} site${sites.length === 1 ? "" : "s"} on ${owner}`);
-      }
-      if (warnings.length > 0) {
-        log.warn(`${warnings.length} config item${warnings.length === 1 ? "" : "s"} won't migrate automatically:`);
-        for (const w of warnings.slice(0, 8)) log.message(chalk5.dim(`\u2022 ${w}`));
-      }
-    },
-    confirm: async ({ owner, known, importable }) => {
-      const choice = await select({
-        message: known ? `An existing reverse proxy (${owner}) is serving ports 80/443.` : `Ports 80/443 are in use by ${owner}, which we couldn't identify.`,
-        options: [
-          ...importable > 0 ? [
-            {
-              value: "migrate",
-              label: `Migrate ${importable} site${importable === 1 ? "" : "s"} & take over`,
-              hint: "import the existing sites into Openship's edge, then take 80/443"
-            }
-          ] : [],
-          {
-            value: "takeover",
-            label: "Stop it & take over 80/443",
-            hint: known ? "the existing sites stop being served" : "may interrupt a running service"
-          },
-          { value: "cancel", label: "Cancel \u2014 leave it running" }
-        ],
-        // Default to MIGRATE whenever there are sites we can import: it's the only
-        // option that both gets Openship onto 80/443 and keeps the operator's
-        // existing sites served, so it's the choice they almost always want and
-        // the one that loses nothing on a reflexive Enter.
-        // With nothing importable there's no safe default: a known proxy falls
-        // back to cancel (blind Enter would stop sites that are being served),
-        // and an unidentified port holder to takeover.
-        initialValue: importable > 0 ? "migrate" : known ? "cancel" : "takeover"
-      });
-      return isCancel(choice) ? "cancel" : choice;
-    },
+    collectCerts: collectCertsFromProxy,
+    render: renderEdgeConflict,
+    confirm: confirmEdgeAction,
     warn: (message) => console.log(chalk5.yellow(`  ${message}`))
   };
 }
 
 // src/lib/loopback-api.ts
-import { existsSync as existsSync6, readFileSync as readFileSync5, mkdirSync as mkdirSync7, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync4, mkdirSync as mkdirSync7, writeFileSync as writeFileSync6 } from "fs";
 import { randomBytes } from "crypto";
 import { join as join7 } from "path";
 function ensureInternalToken() {
   const path2 = join7(OS_DIR, "internal-token");
-  if (existsSync6(path2)) return readFileSync5(path2, "utf8").trim();
+  if (existsSync6(path2)) return readFileSync4(path2, "utf8").trim();
   mkdirSync7(OS_DIR, { recursive: true, mode: 448 });
   const token = randomBytes(32).toString("hex");
   writeFileSync6(path2, token, { mode: 384 });
@@ -1484,26 +1490,31 @@ async function headlessProvision(opts) {
       warnings.push(`Custom domain provisioning returned: ${res.data?.error || "failed"}`);
     }
   } else {
+    const freeBody = (s) => ({
+      domainType: "free",
+      slug: s,
+      publicHost: d.publicHost,
+      dashPort,
+      localEdge: d.localEdge,
+      edgeTakeover: d.edgeTakeover,
+      edgeMigrate: d.edgeMigrate
+    });
     let slug = d.slug;
-    let res = await internalPost(
-      port,
-      "/api/system/self-register",
-      { domainType: "free", slug, publicHost: d.publicHost, dashPort },
-      token
-    );
+    let res = await internalPost(port, "/api/system/self-register", freeBody(slug), token);
     for (let attempt = 0; !res.ok && isSlugTaken(res.data) && opts.onSlugTaken && attempt < 5; attempt++) {
       const next = await opts.onSlugTaken(slug);
       if (!next) break;
       slug = next;
-      res = await internalPost(
-        port,
-        "/api/system/self-register",
-        { domainType: "free", slug, publicHost: d.publicHost, dashPort },
-        token
-      );
+      res = await internalPost(port, "/api/system/self-register", freeBody(slug), token);
     }
     domainRegistered = res.ok;
     liveUrl = res.data?.url;
+    if (res.ok && res.data?.sessionId) {
+      const edge = await drainProvisionStream(port, String(res.data.sessionId), token, (m) => log6(`  ${m}`));
+      if (!edge.completed && edge.detail) {
+        warnings.push(`Local edge not fully ready: ${edge.detail} \u2014 it retries on next boot.`);
+      }
+    }
     if (!res.ok) {
       warnings.push(
         isSlugTaken(res.data) ? `Free domain not created: "${slug}.opsh.io" is already taken. Re-run and choose a different subdomain, or add one later in Settings \u2192 Domains.` : `Free .opsh.io domain not registered: ${res.data?.error || "failed"}. A free domain needs the box connected to Openship Cloud \u2014 connect it in Settings \u2192 Cloud, or use --domain-kind byo/custom.`
@@ -1524,6 +1535,12 @@ function normalizeUrl(raw) {
     return null;
   }
 }
+function effectivePublicUrl(flag) {
+  if (flag) return normalizePublicUrl(flag);
+  const saved = readInstanceUrl();
+  if (!saved || /^https?:\/\/(localhost|127\.|\[?::1\]?)([:/]|$)/i.test(saved)) return void 0;
+  return normalizePublicUrl(saved);
+}
 function normalizePublicUrl(raw) {
   const url = normalizeUrl(raw);
   if (!url) {
@@ -1539,7 +1556,7 @@ var DIST_DIR = dirname2(fileURLToPath(import.meta.url));
 var SERVER_DIR = join8(DIST_DIR, "server");
 function ensureAuthSecret() {
   const path2 = join8(OS_DIR, "auth-secret");
-  if (existsSync7(path2)) return readFileSync6(path2, "utf8").trim();
+  if (existsSync7(path2)) return readFileSync5(path2, "utf8").trim();
   mkdirSync8(OS_DIR, { recursive: true, mode: 448 });
   const secret = randomBytes2(32).toString("hex");
   writeFileSync7(path2, secret, { mode: 384 });
@@ -1681,7 +1698,7 @@ async function runCompose(opts) {
     );
     process.exit(1);
   }
-  const publicUrl = opts.publicUrl ? normalizePublicUrl(opts.publicUrl) : void 0;
+  const publicUrl = effectivePublicUrl(opts.publicUrl);
   const fromSource = sourceBuildDir();
   const spinner5 = ora(
     fromSource ? `Building Openship from ${fromSource} and starting the stack\u2026` : "Starting Openship via Docker Compose\u2026"
@@ -1691,8 +1708,10 @@ async function runCompose(opts) {
     dashboardPort: opts.dashboardPort,
     publicUrl,
     trustProxy: opts.trustProxy,
-    // commander maps `--no-host-control` to hostControl === false.
-    noHostControl: opts.hostControl === false
+    // commander maps `--no-host-control` to hostControl === false. `undefined` when
+    // the flag is absent, so a plain re-run keeps the install's original choice
+    // instead of silently re-granting host control (see resolveEnvConfig).
+    noHostControl: opts.hostControl === false ? true : void 0
   });
   if (!res.ok) {
     spinner5.fail("docker compose failed to start the stack");
@@ -1740,7 +1759,7 @@ async function runFromSource(opts) {
   await runForeground(opts, src);
 }
 async function startService(opts, runOpts = {}) {
-  const publicUrl = opts.publicUrl ? normalizePublicUrl(opts.publicUrl) : void 0;
+  const publicUrl = effectivePublicUrl(opts.publicUrl);
   if (opts.dryRun) {
     const p = preview({
       port: opts.port,
@@ -1839,7 +1858,7 @@ async function runForeground(opts, source) {
   });
   const port = String(resolved.api);
   const dashPort = String(resolved.dashboard);
-  const publicUrl = opts.publicUrl ? normalizePublicUrl(opts.publicUrl) : void 0;
+  const publicUrl = effectivePublicUrl(opts.publicUrl);
   const managedEdge = Boolean(opts.managedEdge && publicUrl);
   const dataDir = opts.dataDir || join8(OS_DIR, "data");
   mkdirSync8(dataDir, { recursive: true });
@@ -1861,9 +1880,12 @@ async function runForeground(opts, source) {
   if (!source) {
     env.OPENSHIP_MIGRATIONS_DIR = join8(SERVER_DIR, "migrations");
     env.OPENSHIP_PGLITE_ASSETS_DIR = join8(SERVER_DIR, "pglite");
+    const engineDir = join8(SERVER_DIR, "engine");
+    if (existsSync7(engineDir)) env.MAIL_SERVER_ENGINE_DIR = engineDir;
   }
   env.OPENSHIP_REQUIRE_AUTH = "true";
   env.INTERNAL_TOKEN = ensureInternalToken();
+  if (!env.OPENSHIP_AUTH_MODE) env.OPENSHIP_AUTH_MODE = "local";
   env.OPENSHIP_API_HOST = "127.0.0.1";
   env.OPENSHIP_DASHBOARD_PORT = dashPort;
   env.OPENSHIP_INSTANCE_LOG = instanceLogPath;
@@ -1951,7 +1973,7 @@ async function runForeground(opts, source) {
     const uiSpinner = ora("Preparing the dashboard\u2026").start();
     try {
       const bundle = await ensureDashboard({
-        tag: source ? "local" : opts.uiVersion || `v${"0.4.4"}`,
+        tag: source ? "local" : opts.uiVersion || `v${"0.4.6"}`,
         onProgress: (received, total) => {
           if (total) {
             uiSpinner.text = `Downloading dashboard\u2026 ${Math.round(received / total * 100)}%`;
@@ -2220,7 +2242,7 @@ var initCommand = new Command7("init").description("Link the current directory t
 
 // src/commands/config.ts
 import { Command as Command8 } from "commander";
-import { existsSync as existsSync10, readFileSync as readFileSync7, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync6, writeFileSync as writeFileSync9 } from "fs";
 import { join as join10 } from "path";
 var SCHEMA_URL = "https://openship.io/openship.schema.json";
 var CONFIG_FILE = "openship.json";
@@ -2241,7 +2263,7 @@ function detectHints(dir) {
   const pkgPath = join10(dir, "package.json");
   if (existsSync10(pkgPath)) {
     try {
-      const pkg = JSON.parse(readFileSync7(pkgPath, "utf8"));
+      const pkg = JSON.parse(readFileSync6(pkgPath, "utf8"));
       const runner = hints.packageManager ?? "npm";
       const exec = runner === "npm" ? "npm run" : runner;
       if (pkg.scripts?.build) hints.buildCommand = `${exec} build`;
@@ -2277,7 +2299,7 @@ var validateCmd = new Command8("validate").description("Validate an openship.jso
     else err(`Not found: ${path2}`);
     process.exit(1);
   }
-  const { config, errors, warnings } = parseOpenshipConfigJson(readFileSync7(path2, "utf8"));
+  const { config, errors, warnings } = parseOpenshipConfigJson(readFileSync6(path2, "utf8"));
   const valid = errors.length === 0 && config !== null;
   if (isJsonMode()) {
     printJson({ valid, errors, warnings });
@@ -2350,11 +2372,11 @@ var contextCommand = new Command9("context").alias("ctx").description("Manage co
 // src/commands/status.ts
 import { Command as Command10 } from "commander";
 import chalk9 from "chalk";
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync7 } from "fs";
 import { join as join11 } from "path";
 function readPorts() {
   try {
-    return JSON.parse(readFileSync8(join11(OS_DIR, "ports.json"), "utf8"));
+    return JSON.parse(readFileSync7(join11(OS_DIR, "ports.json"), "utf8"));
   } catch {
     return {};
   }
@@ -2418,7 +2440,7 @@ import { intro, outro, note as note2, select as select3, log as log3, spinner as
 
 // src/lib/repair.ts
 import { spawnSync as spawnSync4 } from "child_process";
-import { existsSync as existsSync12, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync8 } from "fs";
 import { join as join13 } from "path";
 import chalk10 from "chalk";
 import { spinner, log as log2, select as select2, isCancel as isCancel3, cancel } from "@clack/prompts";
@@ -2532,7 +2554,7 @@ function ensure(value) {
 function storedPorts() {
   try {
     const p = join13(OS_DIR, "ports.json");
-    return existsSync12(p) ? JSON.parse(readFileSync9(p, "utf8")) : {};
+    return existsSync12(p) ? JSON.parse(readFileSync8(p, "utf8")) : {};
   } catch {
     return {};
   }
@@ -2584,7 +2606,7 @@ function lastServiceError() {
     const p = join13(LOG_DIR2, name);
     if (!existsSync12(p)) continue;
     try {
-      const lines = readFileSync9(p, "utf8").trim().split("\n");
+      const lines = readFileSync8(p, "utf8").trim().split("\n");
       const hit = [...lines].reverse().find((l) => /error|locked|aborted|malformed|corrupt|throw|cannot|EADDRINUSE/i.test(l));
       if (hit) return hit.trim().slice(0, 240);
     } catch {
@@ -3011,7 +3033,7 @@ import { execFileSync as execFileSync4 } from "child_process";
 import ora2 from "ora";
 
 // src/lib/project-link.ts
-import { readFileSync as readFileSync10, existsSync as existsSync14 } from "fs";
+import { readFileSync as readFileSync9, existsSync as existsSync14 } from "fs";
 import { join as join14, dirname as dirname3, parse } from "path";
 var LINK_REL = join14(".openship", "project.json");
 function findProjectLinkPath(from = process.cwd()) {
@@ -3028,7 +3050,7 @@ function readProjectLink(from) {
   const path2 = findProjectLinkPath(from);
   if (!path2) return null;
   try {
-    return JSON.parse(readFileSync10(path2, "utf8"));
+    return JSON.parse(readFileSync9(path2, "utf8"));
   } catch {
     return null;
   }
@@ -3036,7 +3058,7 @@ function readProjectLink(from) {
 
 // src/lib/folder-deploy.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import { readFileSync as readFileSync11, existsSync as existsSync15, rmSync as rmSync4 } from "fs";
+import { readFileSync as readFileSync10, existsSync as existsSync15, rmSync as rmSync4 } from "fs";
 import { tmpdir } from "os";
 import { join as join15, basename } from "path";
 function detectPackageManager(dir) {
@@ -3086,7 +3108,7 @@ async function deployFolder(opts) {
   );
   step("Uploading source");
   try {
-    const body = readFileSync11(tarball);
+    const body = readFileSync10(tarball);
     const up = session.upload;
     const method = up.method || "POST";
     const res = /^https?:\/\//i.test(up.url) ? await fetch(up.url, { method, headers: up.headers, body }) : await apiRaw(`/${up.url.replace(/^\/+/, "")}`, { method, headers: up.headers, body });
@@ -4798,7 +4820,7 @@ var domainCommand = new Command17("domain").description("Manage custom domains,
 import { Command as Command18 } from "commander";
 import chalk15 from "chalk";
 import ora4 from "ora";
-var INSTALLABLE = ["docker", "git", "openresty", "certbot", "rsync"];
+var INSTALLABLE = ["docker", "git", "edge", "rsync"];
 function guard(fn) {
   return async (...args) => {
     if (!getToken()) {
@@ -5092,7 +5114,7 @@ var serverCommand = server;
 // src/commands/system.ts
 import { Command as Command19 } from "commander";
 import ora5 from "ora";
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync10 } from "fs";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync10 } from "fs";
 import { createInterface as createInterface6 } from "readline/promises";
 import { stdin as input5, stdout as output5 } from "process";
 async function guarded(fn) {
@@ -5418,7 +5440,7 @@ dataTransferCommand.command("import").description("Import an instance export fil
     }
     let file;
     try {
-      file = JSON.parse(readFileSync12(opts.file, "utf8"));
+      file = JSON.parse(readFileSync11(opts.file, "utf8"));
     } catch {
       err(`
   Could not read or parse ${opts.file}.
@@ -5769,7 +5791,7 @@ var mailCommand = new Command20("mail").description("Self-hosted mail server (iR
 // src/commands/backup.ts
 import { Command as Command21 } from "commander";
 import ora7 from "ora";
-import { readFileSync as readFileSync13 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 async function guard3(fn) {
   try {
     await fn();
@@ -6062,7 +6084,7 @@ destinationCmd.command("create").description("Create a backup destination").requ
     let sftpPrivateKey = opts.sftpPrivateKey;
     if (opts.sftpPrivateKeyFile) {
       try {
-        sftpPrivateKey = readFileSync13(opts.sftpPrivateKeyFile, "utf8");
+        sftpPrivateKey = readFileSync12(opts.sftpPrivateKeyFile, "utf8");
       } catch {
         throw new Error(`Cannot read key file: ${opts.sftpPrivateKeyFile}`);
       }
@@ -6254,11 +6276,11 @@ var apiCommand = new Command23("api").description("Make an authenticated request
 import { Command as Command24 } from "commander";
 import chalk19 from "chalk";
 import { intro as intro2, outro as outro2, password as passwordPrompt, isCancel as isCancel4, cancel as cancel3, log as log4 } from "@clack/prompts";
-import { readFileSync as readFileSync14 } from "fs";
+import { readFileSync as readFileSync13 } from "fs";
 import { join as join16 } from "path";
 function resolvedApiPort() {
   try {
-    return JSON.parse(readFileSync14(join16(OS_DIR, "ports.json"), "utf8")).api;
+    return JSON.parse(readFileSync13(join16(OS_DIR, "ports.json"), "utf8")).api;
   } catch {
     return void 0;
   }
@@ -6312,7 +6334,7 @@ var resetAdminCommand = new Command24("reset-admin-password").description("Reset
 
 // src/commands/install.ts
 import { Command as Command25 } from "commander";
-import { chmodSync as chmodSync2, existsSync as existsSync16, mkdirSync as mkdirSync11, readFileSync as readFileSync15, writeFileSync as writeFileSync11 } from "fs";
+import { chmodSync as chmodSync2, existsSync as existsSync16, mkdirSync as mkdirSync11, readFileSync as readFileSync14, writeFileSync as writeFileSync11 } from "fs";
 import { spawn as spawn2, spawnSync as spawnSync6 } from "child_process";
 import { homedir as homedir3 } from "os";
 import { join as join17 } from "path";
@@ -6449,7 +6471,7 @@ var installCommand = new Command25("install").description("Download and install
     try {
       let sidecarBody;
       if (existsSync16(sidecarPath) && !downloaded) {
-        sidecarBody = readFileSync15(sidecarPath, "utf8");
+        sidecarBody = readFileSync14(sidecarPath, "utf8");
       } else {
         sidecarBody = await fetchSidecar(sidecarUrl);
       }
@@ -6560,7 +6582,7 @@ function detectPackageManager2(override) {
 var updateCommand = new Command26("update").description("Update the Openship CLI + bundled server to the latest release").option("--check", "Only report the current + latest version; don't install").option("--via <manager>", "Package manager to update with: bun | npm").option("--rebuild", "From-source installs: rebuild even if already at the remote tip").action(async (opts) => {
   const source = readSourceInstall();
   if (source) return runSourceUpdate(source, opts);
-  const current = "0.4.4";
+  const current = "0.4.6";
   let latest;
   try {
     latest = (await resolveLatestTag()).replace(/^v/, "");
@@ -6595,13 +6617,13 @@ var updateCommand = new Command26("update").description("Update the Openship CLI
     return;
   }
   if (readInstallMethod() === "compose") {
-    const pulled = composeUpdate(latest);
+    const applied = composeUpdate(latest);
     if (isJsonMode()) {
-      printJson({ updated: true, from: current, to: latest, via: pm, method: "compose", pulled });
-    } else if (pulled) {
-      ok(`Updated to v${latest} and pulled the new images \u2014 the compose stack is on the new version.`);
+      printJson({ updated: true, from: current, to: latest, via: pm, method: "compose", applied });
+    } else if (applied) {
+      ok(`Updated to v${latest} \u2014 compose stack regenerated, images pulled, services recreated.`);
     } else {
-      err(`Updated the CLI to v${latest}, but \`docker compose pull\` failed. Run \`openship up\` to retry.`);
+      err(`Updated the CLI to v${latest}, but bringing the compose stack up failed. Re-run \`openship update\`, or \`openship up\` to retry.`);
       process.exitCode = 1;
     }
     return;
@@ -6618,7 +6640,7 @@ var updateCommand = new Command26("update").description("Update the Openship CLI
 
 // src/commands/cache.ts
 import { Command as Command27 } from "commander";
-import { existsSync as existsSync17, readdirSync as readdirSync2, readFileSync as readFileSync16, rmSync as rmSync5, statSync as statSync2 } from "fs";
+import { existsSync as existsSync17, readdirSync as readdirSync2, readFileSync as readFileSync15, rmSync as rmSync5, statSync as statSync2 } from "fs";
 import { join as join18 } from "path";
 function listAssets() {
   if (!existsSync17(RELEASES_DIR)) return [];
@@ -6667,7 +6689,7 @@ var verifyCmd2 = new Command27("verify").description("Re-hash cached assets and
       results.push({ tag: a.tag, asset: a.name, result: "no-sidecar" });
       continue;
     }
-    const expected = parseSha256(readFileSync16(`${a.path}.sha256`, "utf8"));
+    const expected = parseSha256(readFileSync15(`${a.path}.sha256`, "utf8"));
     const actual = await hashFile(a.path);
     const okMatch = expected !== null && expected === actual;
     if (!okMatch) bad += 1;
@@ -6703,7 +6725,7 @@ var cacheCommand = new Command27("cache").description("Manage the local download
 import chalk20 from "chalk";
 import open2 from "open";
 import { createHash as createHash2, randomBytes as randomBytes3 } from "crypto";
-import { existsSync as existsSync18, mkdirSync as mkdirSync12, readFileSync as readFileSync17, rmSync as rmSync6, writeFileSync as writeFileSync12 } from "fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync12, readFileSync as readFileSync16, rmSync as rmSync6, writeFileSync as writeFileSync12 } from "fs";
 import { join as join19 } from "path";
 import {
   intro as intro3,
@@ -6891,6 +6913,21 @@ ${pad("Login")}${opts.adminEmail} ${chalk20.dim("(email + password you set)")}
   );
   outro3(opts.byo ? chalk20.dim("Point your reverse proxy at the dashboard port above.") : chalk20.green("Happy shipping."));
 }
+async function promptLocalEdgeTakeover(port) {
+  const pf = await internalPost(port, "/api/system/self-edge/preflight", {});
+  const status = pf.ok ? pf.data?.status : void 0;
+  if (!status || status.canProceedClean || !status.occupants?.length) {
+    return { proceed: true, edgeMigrate: false, edgeTakeover: false };
+  }
+  const owner = status.occupants.map((o) => o.command ?? `port ${o.port}`).join(", ");
+  const known = status.classification === "known";
+  const sites = pf.ok && Array.isArray(pf.data?.sites) ? pf.data.sites : [];
+  const warnings = pf.ok && Array.isArray(pf.data?.warnings) ? pf.data.warnings : [];
+  renderEdgeConflict({ owner, sites, warnings });
+  const action2 = await confirmEdgeAction({ owner, known, importable: sites.length });
+  if (action2 === "cancel") return { proceed: false, edgeMigrate: false, edgeTakeover: false };
+  return { proceed: true, edgeMigrate: action2 === "migrate", edgeTakeover: action2 === "takeover" };
+}
 async function runWizard() {
   const resuming = isSetupInProgress();
   intro3(`${chalk20.bgCyan(chalk20.black(" Openship "))}${chalk20.dim(" setup")}`);
@@ -7112,7 +7149,7 @@ async function runWizard() {
       }
     }
   }
-  const uiTag = `v${"0.4.4"}`;
+  const uiTag = `v${"0.4.6"}`;
   if (method === "bare") {
     const dl = spinner4();
     dl.start("Pulling the Openship dist from GitHub");
@@ -7180,7 +7217,7 @@ async function runWizard() {
     const up = composeUp({
       publicUrl,
       trustProxy: behindProxy,
-      version: "0.4.4",
+      version: "0.4.6",
       noHostControl: !allowHostControl
     });
     if (!up.ok) {
@@ -7317,93 +7354,49 @@ async function runWizard() {
       await internalPost(port, "/api/system/self-register", { domainType: "byo" });
     } else {
       cloudEmail = cloud.email;
-      let regSlug = domainPlan.slug;
-      while (true) {
-        const s2 = spinner4();
-        s2.start(`Registering ${chalk20.bold(`${regSlug}.opsh.io`)} with Openship Cloud`);
-        const res = await internalPost(port, "/api/system/self-register", {
-          domainType: "free",
-          slug: regSlug,
-          publicHost: domainPlan.publicHost,
-          dashPort: Number(started.dashPort)
-        });
-        if (res.ok && res.data?.url) {
-          liveUrl = res.data.url;
-          s2.stop(`Free domain live: ${res.data.url}`);
-          break;
-        }
-        s2.stop(`Couldn't register ${regSlug}.opsh.io: ${res.data?.error || "failed"}`, 1);
-        const next = ensure2(
-          await select4({
-            message: "Try a different subdomain?",
-            options: [
-              { value: "retry", label: "Pick another subdomain" },
-              { value: "skip", label: "Skip for now", hint: "log in on this server; add a domain later in Settings \u2192 Cloud" }
-            ]
-          })
+      const edge = await promptLocalEdgeTakeover(port);
+      if (!edge.proceed) {
+        log5.warn(
+          "Left the existing proxy on 80/443 running \u2014 a free domain forwards to :80 here, so it won't serve until Openship owns that port. Re-run setup and choose migrate / take over."
         );
-        if (next === "skip") break;
-        regSlug = ensure2(
-          await text({
-            message: "Choose your subdomain",
-            placeholder: "my-openship",
-            initialValue: regSlug,
-            validate: (v) => v && SLUG_RE2.test(v.trim().toLowerCase()) ? void 0 : "Lowercase letters, digits, hyphens"
-          })
-        ).trim().toLowerCase();
       }
+      const result = await headlessProvision({
+        port,
+        dashPort: started.dashPort,
+        token: provisionToken,
+        method: "bare",
+        inputs: {
+          admin,
+          domain: {
+            kind: "free",
+            slug: domainPlan.slug,
+            publicHost: domainPlan.publicHost,
+            // Bare needs a local :80 edge for Cloud to forward to; skip only when
+            // the operator declined the takeover (their proxy keeps 80/443).
+            localEdge: edge.proceed,
+            edgeTakeover: edge.edgeTakeover,
+            edgeMigrate: edge.edgeMigrate
+          }
+        },
+        onLog: (msg) => log5.message(chalk20.dim(msg)),
+        onSlugTaken: async (taken) => {
+          log5.warn(`"${taken}.opsh.io" is already taken.`);
+          const next = await text({
+            message: "Choose a different subdomain (or leave empty to skip the free domain)",
+            placeholder: "my-openship",
+            validate: (v) => !v || SLUG_RE2.test(v.trim().toLowerCase()) ? void 0 : "Lowercase letters, digits, hyphens"
+          });
+          return isCancel5(next) || !next.trim() ? null : next.trim().toLowerCase();
+        }
+      });
+      if (result.liveUrl) liveUrl = result.liveUrl;
+      for (const w of result.warnings) log5.warn(w);
     }
   } else if (domainPlan.type === "custom") {
-    let edgeTakeover = false;
-    let edgeMigrate = false;
-    let proceedCustom = true;
-    const pf = await internalPost(port, "/api/system/self-edge/preflight", {});
-    const status = pf.ok ? pf.data?.status : void 0;
-    const importable = pf.ok && Array.isArray(pf.data?.sites) ? pf.data.sites.length : 0;
-    if (status && !status.canProceedClean && status.occupants?.length) {
-      const owner = status.occupants.map((o) => o.command ?? `port ${o.port}`).join(", ");
-      const known = status.classification === "known";
-      const sites = pf.ok && Array.isArray(pf.data?.sites) ? pf.data.sites : [];
-      if (sites.length > 0) {
-        const lines = sites.map((st) => {
-          const host = (st.serverNames ?? []).join(", ") || "(no server_name)";
-          const dest = st.target?.kind === "static" ? `static: ${st.target?.root ?? ""}` : st.target?.url ?? "";
-          return `${chalk20.bold(host)} \u2192 ${chalk20.dim(dest)}${st.ssl ? chalk20.green(" [TLS]") : ""}`;
-        });
-        note3(lines.join("\n"), `Detected ${sites.length} site${sites.length === 1 ? "" : "s"} on ${owner}`);
-      }
-      const warns = pf.ok && Array.isArray(pf.data?.warnings) ? pf.data.warnings : [];
-      if (warns.length > 0) {
-        log5.warn(`${warns.length} config item${warns.length === 1 ? "" : "s"} won't migrate automatically:`);
-        for (const w of warns.slice(0, 8)) log5.message(chalk20.dim(`\u2022 ${w}`));
-      }
-      const choice = ensure2(
-        await select4({
-          message: known ? `An existing reverse proxy (${owner}) is serving ports 80/443.` : `Ports 80/443 are in use by ${owner}, which we couldn't identify.`,
-          options: [
-            ...importable > 0 ? [{
-              value: "migrate",
-              label: `Migrate ${importable} site${importable === 1 ? "" : "s"} & take over`,
-              hint: "import the existing sites into Openship, then take 80/443"
-            }] : [],
-            {
-              value: "override",
-              label: "Stop it & take over 80/443",
-              hint: known ? "the existing sites stop being served" : "may interrupt a running service"
-            },
-            { value: "cancel", label: "Cancel \u2014 leave it running" }
-          ],
-          // Same default as the `up` preflight (edge-preflight.ts): migrate when
-          // there are importable sites — it takes 80/443 without dropping any of
-          // them. Otherwise a known proxy defaults to cancel (Enter must not stop
-          // sites that are being served) and an unidentified holder to takeover.
-          initialValue: importable > 0 ? "migrate" : known ? "cancel" : "override"
-        })
-      );
-      if (choice === "cancel") proceedCustom = false;
-      else if (choice === "migrate") edgeMigrate = true;
-      else edgeTakeover = true;
-    }
+    const edge = await promptLocalEdgeTakeover(port);
+    const proceedCustom = edge.proceed;
+    const edgeTakeover = edge.edgeTakeover;
+    const edgeMigrate = edge.edgeMigrate;
     if (!proceedCustom) {
       log5.warn(
         "Left the existing proxy on 80/443 running. Registering Openship without managed HTTPS \u2014 front it with your proxy, or re-run setup to take over."
@@ -7458,13 +7451,16 @@ async function runWizard() {
 function storedPorts2() {
   const p = join19(OS_DIR, "ports.json");
   try {
-    return existsSync18(p) ? JSON.parse(readFileSync17(p, "utf8")) : {};
+    return existsSync18(p) ? JSON.parse(readFileSync16(p, "utf8")) : {};
   } catch {
     return {};
   }
 }
 async function runControl() {
   const svc = serviceStatus();
+  const isCompose = readInstallMethod() === "compose";
+  const running = isCompose ? composeRunning() : svc.running;
+  const managerLabel = isCompose ? "docker compose" : svc.kind === "unsupported" ? "none" : svc.kind;
   const ports = storedPorts2();
   const apiPort2 = String(ports.api ?? 4e3);
   const dashUrl = `http://localhost:${ports.dashboard ?? 3001}`;
@@ -7473,10 +7469,10 @@ async function runControl() {
   intro3(`${chalk20.bgCyan(chalk20.black(" Openship "))}${chalk20.dim(" control")}`);
   note3(
     `${chalk20.dim("URL".padEnd(11))}${chalk20.bold(primaryUrl)}
-${chalk20.dim("Service".padEnd(11))}${svc.running ? chalk20.green("running") : chalk20.yellow("stopped")}
+${chalk20.dim("Service".padEnd(11))}${running ? chalk20.green("running") : chalk20.yellow("stopped")}
 ${chalk20.dim("Dashboard".padEnd(11))}${dashUrl}
 ` + (ports.api ? `${chalk20.dim("API".padEnd(11))}http://localhost:${ports.api}
-` : "") + `${chalk20.dim("Manager".padEnd(11))}${svc.kind === "unsupported" ? "none" : svc.kind}`,
+` : "") + `${chalk20.dim("Manager".padEnd(11))}${managerLabel}`,
     "Openship is already set up"
   );
   const corrupted = looksCorrupted();
@@ -7489,7 +7485,7 @@ ${chalk20.dim("Dashboard".padEnd(11))}${dashUrl}
       options: [
         ...corrupted ? [{ value: "repair", label: "Repair database", hint: "backup \u2192 heal \u2192 verify" }] : [],
         { value: "open", label: "Open the dashboard" },
-        svc.running ? { value: "restart", label: "Restart the service" } : { value: "start", label: "Start the service" },
+        running ? { value: "restart", label: "Restart the service" } : { value: "start", label: "Start the service" },
         { value: "stop", label: "Stop the service", hint: "won't restart on boot" },
         ...corrupted ? [] : [{ value: "repair", label: "Repair database", hint: "backup \u2192 heal a corrupt DB" }],
         { value: "reset", label: "Reset admin password", hint: "sets a local email + password login" },
@@ -7509,15 +7505,31 @@ ${chalk20.dim("Dashboard".padEnd(11))}${dashUrl}
       });
       outro3(chalk20.dim(`Opening ${primaryUrl}`));
       return;
-    case "start":
+    case "start": {
+      if (isCompose) {
+        const ok3 = composeStart();
+        outro3(ok3 ? chalk20.green("Started.") : chalk20.yellow("Couldn't start the stack \u2014 run `openship up` to see the error."));
+        return;
+      }
       await startService({});
       return;
+    }
     case "restart": {
+      if (isCompose) {
+        const ok3 = composeRestart();
+        outro3(ok3 ? chalk20.green("Restarted.") : chalk20.yellow("Couldn't restart the stack."));
+        return;
+      }
       const r = restart();
       outro3(r.restarted ? chalk20.green("Restarted.") : chalk20.yellow(r.detail));
       return;
     }
     case "stop": {
+      if (isCompose) {
+        const ok3 = composeDown();
+        outro3(ok3 ? chalk20.green("Stopped. Won't restart on boot.") : chalk20.yellow("Couldn't stop the stack."));
+        return;
+      }
       const r = stop();
       outro3(chalk20.green(`Stopped. ${chalk20.dim(r.detail)}`));
       return;
@@ -7542,10 +7554,11 @@ ${chalk20.dim("Dashboard".padEnd(11))}${dashUrl}
 
 // src/index.ts
 var program = new Command28();
-program.name("openship").description("Openship CLI \u2014 install, run, and manage Openship from your terminal").version("0.4.4").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
+program.name("openship").description("Openship CLI \u2014 install, run, and manage Openship from your terminal").version("0.4.6").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
   if (thisCommand.opts().json) setJsonMode(true);
 }).action(async () => {
-  if (serviceStatus().installed && !isSetupInProgress()) await runControl();
+  const installed = serviceStatus().installed || readInstallMethod() === "compose";
+  if (installed && !isSetupInProgress()) await runControl();
   else await runWizard();
 });
 program.addCommand(upCommand);