openship 0.4.4 → 0.4.6

package/dist/{chunk-YHXCHW7Q.js → chunk-3JQTL4R4.js}

@@ -1,9 +1,18 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v bun || command -v node)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  ENV_KEY,
+  ENV_SECRET,
+  fromEnv
+} from "./chunk-FRNAR33O.js";
 import {
   SignatureV4MultiRegion,
   XmlNode,
   XmlShapeDeserializer,
   XmlText
-} from "./chunk-QKFRZNKN.js";
+} from "./chunk-6APIPIJY.js";
 import {
   AwsSdkSigV4ASigner,
   AwsSdkSigV4Signer,
@@ -19,27 +28,10 @@ import {
   resolveAwsSdkSigV4AConfig,
   resolveAwsSdkSigV4Config,
   streamCollector
-} from "./chunk-5ZCKQ2MI.js";
+} from "./chunk-IXCHURVK.js";
 import {
   NodeHttpHandler
-} from "./chunk-LBFH7THC.js";
-import {
-  AwsCrc32,
-  __awaiter,
-  __generator,
-  __values,
-  convertToBuffer,
-  eventStreamSerdeProvider2 as eventStreamSerdeProvider,
-  isEmptyData,
-  numToUint8,
-  resolveEventStreamSerdeConfig,
-  uint32ArrayFrom
-} from "./chunk-BUBSSKO6.js";
-import {
-  ENV_KEY,
-  ENV_SECRET,
-  fromEnv
-} from "./chunk-JR2OCMJA.js";
+} from "./chunk-OWED2GRM.js";
 import {
   BinaryDecisionDiagram,
   Client,
@@ -75,7 +67,7 @@ import {
   resolveRetryConfig,
   resolveUserAgentConfig,
   setFeature
-} from "./chunk-OJE6YWPQ.js";
+} from "./chunk-VWPEKOH6.js";
 import {
   CredentialsProviderError,
   ENV_PROFILE,
@@ -106,7 +98,25 @@ import {
   resolveHttpHandlerRuntimeConfig,
   resolveRegionConfig,
   toEndpointV1
-} from "./chunk-5N7VUGL6.js";
+} from "./chunk-W73X43R7.js";
+import {
+  CloudRuntime
+} from "./chunk-5FNIWBFI.js";
+import {
+  systemCatalog
+} from "./chunk-SQ77DZOI.js";
+import {
+  AwsCrc32,
+  __awaiter,
+  __generator,
+  __values,
+  convertToBuffer,
+  eventStreamSerdeProvider2 as eventStreamSerdeProvider,
+  isEmptyData,
+  numToUint8,
+  resolveEventStreamSerdeConfig,
+  uint32ArrayFrom
+} from "./chunk-O6ZZF52V.js";
 import {
   Hash,
   NumericValue,
@@ -124,24 +134,26 @@ import {
   toBase64,
   toUint8Array,
   toUtf8
-} from "./chunk-6ERIMTBC.js";
+} from "./chunk-JYGD5WSN.js";
 import {
   DockerRuntime,
   isHostPathSource,
   scopedVolumeName
-} from "./chunk-KD7VO4LG.js";
+} from "./chunk-2ZLR7ULL.js";
 import {
   BareRuntime
-} from "./chunk-ZKJOFWBJ.js";
+} from "./chunk-VDMQJHPI.js";
 import {
-  CloudRuntime
-} from "./chunk-WJPCBU7Z.js";
+  invalidateEdgeContainer
+} from "./chunk-FQGJZ2HS.js";
 import {
-  systemCatalog
-} from "./chunk-46YJFP4S.js";
+  EDGE_CONTAINER_MOUNTS,
+  EDGE_HOST_STATE_DIR
+} from "./chunk-VFINNTUL.js";
 import {
+  DEFAULT_IMAGE_REGISTRY,
   safeErrorMessage
-} from "./chunk-JZLNHGLW.js";
+} from "./chunk-6APULWSU.js";
 
 // src/lib/edge-import.ts
 import chalk from "chalk";
@@ -150,8 +162,8 @@ import ora from "ora";
 // src/lib/compose.ts
 import { spawnSync as spawnSync3 } from "child_process";
 import { randomBytes as randomBytes5 } from "crypto";
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
-import { homedir as homedir2 } from "os";
+import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { homedir as homedir2, userInfo } from "os";
 import { join as join6 } from "path";
 
 // ../../packages/adapters/src/runtime/image-transfer.ts
@@ -10965,10 +10977,10 @@ var package_default = {
 // ../../node_modules/@aws-sdk/credential-provider-node/dist-es/remoteProvider.js
 var ENV_IMDS_DISABLED = "AWS_EC2_METADATA_DISABLED";
 var remoteProvider = async (init) => {
-  const { ENV_CMDS_FULL_URI, ENV_CMDS_RELATIVE_URI, fromContainerMetadata, fromInstanceMetadata } = await import("./dist-es-XQCOTGC7.js");
+  const { ENV_CMDS_FULL_URI, ENV_CMDS_RELATIVE_URI, fromContainerMetadata, fromInstanceMetadata } = await import("./dist-es-VNKHQVIB.js");
   if (process.env[ENV_CMDS_RELATIVE_URI] || process.env[ENV_CMDS_FULL_URI]) {
     init.logger?.debug("@aws-sdk/credential-provider-node - remoteProvider::fromHttp/fromContainerMetadata");
-    const { fromHttp } = await import("./dist-es-KE56MWYO.js");
+    const { fromHttp } = await import("./dist-es-5DY7K32L.js");
     return chain(fromHttp(init), fromContainerMetadata(init));
   }
   if (process.env[ENV_IMDS_DISABLED] && process.env[ENV_IMDS_DISABLED] !== "false") {
@@ -11080,22 +11092,22 @@ var defaultProvider = (init = {}) => memoizeChain([
     if (!ssoStartUrl && !ssoAccountId && !ssoRegion && !ssoRoleName && !ssoSession) {
       throw new CredentialsProviderError("Skipping SSO provider in default chain (inputs do not include SSO fields).", { logger: init.logger });
     }
-    const { fromSSO } = await import("./dist-es-WZCR7DHQ.js");
+    const { fromSSO } = await import("./dist-es-WV4AMOII.js");
     return fromSSO(init)(awsIdentityProperties);
   },
   async (awsIdentityProperties) => {
     init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromIni");
-    const { fromIni } = await import("./dist-es-NRZIQY5B.js");
+    const { fromIni } = await import("./dist-es-RYHIPOTN.js");
     return fromIni(init)(awsIdentityProperties);
   },
   async (awsIdentityProperties) => {
     init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromProcess");
-    const { fromProcess } = await import("./dist-es-GTAMF674.js");
+    const { fromProcess } = await import("./dist-es-OSNJBLXB.js");
     return fromProcess(init)(awsIdentityProperties);
   },
   async (awsIdentityProperties) => {
     init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromTokenFile");
-    const { fromTokenFile } = await import("./dist-es-ZW3HFQUM.js");
+    const { fromTokenFile } = await import("./dist-es-X3B5QYKB.js");
     return fromTokenFile(init)(awsIdentityProperties);
   },
   async () => {
@@ -12816,6 +12828,11 @@ async function rebuildFromSource(info) {
 }
 
 // src/lib/compose.ts
+var EDGE_SITES_HOST_DIR = `${EDGE_HOST_STATE_DIR}/sites-enabled`;
+var EDGE_ACME_HOST_DIR = `${EDGE_HOST_STATE_DIR}/acme`;
+function edgeVolumeYaml(indent) {
+  return EDGE_CONTAINER_MOUNTS.map((m2) => `${indent}- ${m2.host}:${m2.container}:z`).join("\n");
+}
 var COMPOSE_DIR = join6(OS_DIR, "compose");
 var INSTALL_METHOD_FILE = join6(OS_DIR, "install-method");
 var COMPOSE_FILE = join6(COMPOSE_DIR, "docker-compose.yml");
@@ -12826,6 +12843,7 @@ var BUILT_SERVICES = [
   { service: "dashboard", dockerfile: "apps/dashboard/Dockerfile" },
   { service: "edge", dockerfile: "apps/edge/Dockerfile" }
 ];
+var ENV_CONSUMING_SERVICES = ["api", "dashboard", "edge"];
 function readInstallMethod() {
   try {
     const v2 = readFileSync2(INSTALL_METHOD_FILE, "utf8").trim();
@@ -12905,11 +12923,12 @@ services:
     ports: ["\${OPENSHIP_BIND_ADDR:-0.0.0.0}:\${API_PORT:-4000}:\${API_PORT:-4000}"]
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-      - openship_sites:/usr/local/openresty/nginx/conf/sites-enabled
-      - openship_certs:/etc/letsencrypt
-      - openship_acme:/var/www/acme
-      # Static sites' extracted doc-roots \u2014 API writes, edge serves (shared).
-      - openship_static:/opt/openship/static
+      # Routing state shared with the edge, as HOST BIND MOUNTS (generated from
+      # EDGE_CONTAINER_MOUNTS): the vhost tree, /etc/letsencrypt, the ACME webroot
+      # and the static doc-roots the API writes and the edge serves. Named volumes
+      # hid all of it from every host-side reader (migrate's proxy scan, cert carry,
+      # cert reuse, mail cert symlinks), each of which then silently saw "nothing".
+${edgeVolumeYaml("      ")}
       # Host-op SSH key (createHostExecutor \u2192 host.docker.internal). /dev/null
       # when the host channel isn't provisioned \u2192 OPENSHIP_HOST_SSH_HOST stays
       # unset and the API falls back to LocalExecutor.
@@ -12958,18 +12977,11 @@ services:
     restart: unless-stopped
     network_mode: host
     volumes:
-      - openship_sites:/usr/local/openresty/nginx/conf/sites-enabled
-      - openship_certs:/etc/letsencrypt
-      - openship_acme:/var/www/acme
-      - openship_static:/opt/openship/static
+${edgeVolumeYaml("      ")}
 
 volumes:
   postgres_data:
   redis_data:
-  openship_sites:
-  openship_certs:
-  openship_acme:
-  openship_static:
 `;
 function keepSecret(existing, key) {
   return existing[key] || randomBytes5(32).toString("hex");
@@ -12985,6 +12997,15 @@ function readEnvFile() {
   }
   return out;
 }
+var HOST_KEY_COMMENT = "openship-host-executor";
+var HOST_KEY_FROM = "172.16.0.0/12,192.168.0.0/16,10.0.0.0/8,127.0.0.1";
+function hostKeyAuthLine(pub) {
+  return `from="${HOST_KEY_FROM}",restrict,pty ${pub}`;
+}
+function rewriteHostAuthorizedKeys(existing, pub) {
+  const kept = existing.split("\n").filter((line) => line.trim() && !line.includes(HOST_KEY_COMMENT));
+  return [...kept, hostKeyAuthLine(pub)].join("\n") + "\n";
+}
 function provisionHostSshChannel() {
   if (process.platform !== "linux") return null;
   try {
@@ -12994,23 +13015,28 @@ function provisionHostSshChannel() {
     if (!existsSync3(keyPath)) {
       const g2 = spawnSync3(
         "ssh-keygen",
-        ["-t", "ed25519", "-N", "", "-q", "-f", keyPath, "-C", "openship-host-executor"],
+        ["-t", "ed25519", "-N", "", "-q", "-f", keyPath, "-C", HOST_KEY_COMMENT],
         { stdio: "ignore" }
       );
       if (g2.status !== 0) return null;
     }
     const pub = readFileSync2(`${keyPath}.pub`, "utf8").trim();
     if (!pub) return null;
+    const user = (() => {
+      try {
+        return userInfo().username;
+      } catch {
+        return process.env.USER || process.env.LOGNAME || "root";
+      }
+    })();
     const userSshDir = join6(homedir2(), ".ssh");
     mkdirSync2(userSshDir, { recursive: true, mode: 448 });
     const authKeys = join6(userSshDir, "authorized_keys");
     const existing = existsSync3(authKeys) ? readFileSync2(authKeys, "utf8") : "";
-    if (!existing.includes(pub)) {
-      const sep = existing && !existing.endsWith("\n") ? "\n" : "";
-      writeFileSync(authKeys, `${existing}${sep}${pub}
-`, { mode: 384 });
-    }
-    return { user: process.env.USER || process.env.LOGNAME || "root", keyPath };
+    const next = rewriteHostAuthorizedKeys(existing, pub);
+    if (next !== existing) writeFileSync(authKeys, next, { mode: 384 });
+    chmodSync(authKeys, 384);
+    return { user, keyPath };
   } catch {
     return null;
   }
@@ -13042,7 +13068,7 @@ function orphanedStackContainers(project) {
 function reconcileDbPassword(user, password) {
   if (!password) return;
   if (compose(["up", "-d", "--wait", "postgres"], { quiet: true }) !== 0) return;
-  const r2 = spawnSync3(
+  const attempt = (asRole) => spawnSync3(
     "docker",
     [
       "compose",
@@ -13053,7 +13079,7 @@ function reconcileDbPassword(user, password) {
       "postgres",
       "psql",
       "-U",
-      user,
+      asRole,
       "-d",
       "postgres",
       "-v",
@@ -13069,15 +13095,31 @@ function reconcileDbPassword(user, password) {
     {
       cwd: COMPOSE_DIR,
       encoding: "utf8",
-      input: `ALTER USER "${user}" WITH PASSWORD '${password}';
+      // Create the role if the volume predates it, else just realign it. Both
+      // branches leave exactly the credentials this `.env` will present.
+      input: `DO $$ BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${user}') THEN
+    ALTER ROLE "${user}" WITH LOGIN PASSWORD '${password}';
+  ELSE
+    CREATE ROLE "${user}" WITH LOGIN SUPERUSER PASSWORD '${password}';
+  END IF;
+END $$;
 `
     }
   );
+  let r2 = attempt(user);
+  if (r2.status !== 0) r2 = attempt("postgres");
   if (r2.status !== 0) {
     console.log(
-      `  Note: couldn't reconcile the database password (${(r2.stderr ?? "").trim() || "psql failed"}).
-  If the api reports "password authentication failed", the data volume predates this install \u2014
-  either restore the old .env or remove the volume to start fresh.`
+      `
+  ! Could not realign the database password (${(r2.stderr ?? "").trim() || "psql failed"}).
+    The api will fail with "password authentication failed for user "${user}"" because the
+    existing data volume was initialized with a different password.
+
+    Fix it one of two ways:
+      \u2022 restore the .env that created the volume, or
+      \u2022 start fresh (DESTROYS DB DATA):  openship uninstall  then  openship up
+`
     );
   }
 }
@@ -13090,6 +13132,48 @@ function removeOrphanedStack(project) {
   );
   spawnSync3("docker", ["rm", "-f", ...orphans.map((o2) => o2.name)], { stdio: "ignore" });
 }
+function migrateLegacyEdgeVolumes(project) {
+  const pairs = [
+    { volume: `${project}_openship_sites`, host: EDGE_SITES_HOST_DIR },
+    { volume: `${project}_openship_certs`, host: "/etc/letsencrypt" },
+    { volume: `${project}_openship_acme`, host: EDGE_ACME_HOST_DIR },
+    { volume: `${project}_openship_static`, host: "/opt/openship/static" }
+  ];
+  const ls = spawnSync3("docker", ["volume", "ls", "--format", "{{.Name}}"], { encoding: "utf8" });
+  if (ls.status !== 0 || !ls.stdout) return;
+  const existing = new Set(ls.stdout.split("\n").map((l2) => l2.trim()).filter(Boolean));
+  for (const { volume, host } of pairs) {
+    if (!existing.has(volume)) continue;
+    mkdirSync2(host, { recursive: true });
+    const alreadyThere = spawnSync3("sh", ["-c", `ls -A ${JSON.stringify(host)} 2>/dev/null | head -1`], {
+      encoding: "utf8"
+    });
+    if (alreadyThere.stdout?.trim()) continue;
+    console.log(`  Moving edge state from volume ${volume} onto ${host}...`);
+    const copy = spawnSync3(
+      "docker",
+      [
+        "run",
+        "--rm",
+        "-v",
+        `${volume}:/from:ro`,
+        "-v",
+        `${host}:/to`,
+        "alpine:3",
+        "sh",
+        "-c",
+        "cp -a /from/. /to/ 2>/dev/null || true"
+      ],
+      { stdio: "inherit" }
+    );
+    if (copy.status !== 0) {
+      console.log(
+        `  Could not copy ${volume} \u2014 the stack will start with an empty ${host}.
+  Recover manually with: docker run --rm -v ${volume}:/from -v ${host}:/to alpine cp -a /from/. /to/`
+      );
+    }
+  }
+}
 function warnOrphanedVolumes(project) {
   const r2 = spawnSync3("docker", ["volume", "ls", "--format", "{{.Name}}"], { encoding: "utf8" });
   if (r2.status !== 0 || !r2.stdout) return;
@@ -13099,11 +13183,40 @@ function warnOrphanedVolumes(project) {
   if (others.size === 0) return;
   console.log(
     `  Note: volumes from a previous install (project "${[...others].join(", ")}") are still on disk
-  and are NOT mounted by this stack \u2014 its database and certificates start fresh.
+  and are NOT mounted by this stack \u2014 its database starts fresh. (Certificates and
+  vhosts now live on the host, so those carry over.)
   Remove them with \`docker volume ls | grep _openship_\` once you're sure they aren't needed.`
   );
 }
-function renderEnv(opts, host) {
+function keepConfig(prev, key, explicit) {
+  const set = explicit?.trim();
+  if (set) return set;
+  const carried = prev[key]?.trim();
+  return carried || void 0;
+}
+function resolveEnvConfig(prev, opts) {
+  const publicUrl = keepConfig(prev, "OPENSHIP_PUBLIC_URL", opts.publicUrl);
+  return {
+    apiPort: keepConfig(prev, "API_PORT", opts.apiPort) ?? "4000",
+    dashPort: keepConfig(prev, "DASHBOARD_PORT", opts.dashboardPort) ?? "3001",
+    ...publicUrl ? { publicUrl } : {},
+    // A public URL always implies a proxy in front; otherwise keep whatever the
+    // install was configured with.
+    trustProxy: Boolean(opts.trustProxy) || Boolean(publicUrl) || prev.TRUST_PROXY === "true",
+    ...keepConfig(prev, "OPENSHIP_EXTRA_TRUSTED_ORIGINS", opts.extraTrustedOrigins) ? {
+      extraTrustedOrigins: keepConfig(
+        prev,
+        "OPENSHIP_EXTRA_TRUSTED_ORIGINS",
+        opts.extraTrustedOrigins
+      )
+    } : {},
+    registry: keepConfig(prev, "OPENSHIP_IMAGE_REGISTRY", opts.registry) ?? DEFAULT_IMAGE_REGISTRY,
+    // Tri-state: the flag is absent on a plain re-run, so fall back to what the
+    // install chose rather than silently re-granting host control.
+    hostControl: opts.noHostControl === void 0 ? prev.OPENSHIP_HOST_CONTROL !== "false" : !opts.noHostControl
+  };
+}
+function renderEnv(opts, host, cfg) {
   const prev = readEnvFile();
   const lines = [
     "# Managed by `openship up`. Secrets are generated once and preserved.",
@@ -13114,17 +13227,20 @@ function renderEnv(opts, host) {
     "OPENSHIP_REQUIRE_AUTH=true",
     // Read by createHostExecutor (throws when false) and by the servers list
     // (hides the local row). Written explicitly so the policy is visible in .env.
-    `OPENSHIP_HOST_CONTROL=${opts.noHostControl ? "false" : "true"}`,
-    `OPENSHIP_IMAGE_REGISTRY=${opts.registry || "ghcr.io/oblien"}`,
-    `OPENSHIP_VERSION=${opts.version || (true ? "0.4.4" : "latest")}`,
+    `OPENSHIP_HOST_CONTROL=${cfg.hostControl ? "true" : "false"}`,
+    `OPENSHIP_IMAGE_REGISTRY=${cfg.registry}`,
+    `OPENSHIP_VERSION=${opts.version || (true ? "0.4.6" : "latest")}`,
     `POSTGRES_PASSWORD=${keepSecret(prev, "POSTGRES_PASSWORD")}`,
     `BETTER_AUTH_SECRET=${keepSecret(prev, "BETTER_AUTH_SECRET")}`,
-    `INTERNAL_TOKEN=${keepSecret(prev, "INTERNAL_TOKEN")}`
+    `INTERNAL_TOKEN=${keepSecret(prev, "INTERNAL_TOKEN")}`,
+    `API_PORT=${cfg.apiPort}`,
+    `DASHBOARD_PORT=${cfg.dashPort}`
   ];
-  if (opts.apiPort) lines.push(`API_PORT=${opts.apiPort}`);
-  if (opts.dashboardPort) lines.push(`DASHBOARD_PORT=${opts.dashboardPort}`);
-  if (opts.publicUrl) lines.push(`OPENSHIP_PUBLIC_URL=${opts.publicUrl}`);
-  if (opts.trustProxy || opts.publicUrl) lines.push("TRUST_PROXY=true");
+  if (cfg.publicUrl) lines.push(`OPENSHIP_PUBLIC_URL=${cfg.publicUrl}`);
+  if (cfg.extraTrustedOrigins) {
+    lines.push(`OPENSHIP_EXTRA_TRUSTED_ORIGINS=${cfg.extraTrustedOrigins}`);
+  }
+  if (cfg.trustProxy) lines.push("TRUST_PROXY=true");
   if (host) {
     lines.push(
       "OPENSHIP_HOST_SSH_HOST=host.docker.internal",
@@ -13156,13 +13272,20 @@ ${services}`;
 }
 function materialize(opts) {
   mkdirSync2(COMPOSE_DIR, { recursive: true, mode: 448 });
-  const regeneratedSecrets = !readEnvFile().POSTGRES_PASSWORD;
-  const host = opts.noHostControl ? null : provisionHostSshChannel();
+  const prev = readEnvFile();
+  const cfg = resolveEnvConfig(prev, opts);
+  const host = cfg.hostControl ? provisionHostSshChannel() : null;
+  let before = "";
+  try {
+    before = readFileSync2(ENV_FILE, "utf8");
+  } catch {
+  }
+  const rendered = renderEnv(opts, host, cfg);
   writeFileSync(COMPOSE_FILE, COMPOSE_YAML);
-  writeFileSync(ENV_FILE, renderEnv(opts, host), { mode: 384 });
+  writeFileSync(ENV_FILE, rendered, { mode: 384 });
   const buildDir = opts.build === false ? null : sourceBuildDir();
   if (buildDir) writeFileSync(BUILD_FILE, renderBuildOverride(buildDir));
-  return { buildDir, regeneratedSecrets };
+  return { buildDir, cfg, envChanged: before !== "" && rendered !== before };
 }
 function dbVolumeExists(project) {
   const r2 = spawnSync3("docker", ["volume", "inspect", `${project}_postgres_data`], {
@@ -13180,15 +13303,19 @@ function compose(args, opts) {
   return r2.status ?? 1;
 }
 function composeUp(opts) {
-  const { buildDir, regeneratedSecrets } = materialize(opts);
-  const apiPort = opts.apiPort || "4000";
-  const dashPort = opts.dashboardPort || "3001";
+  const { buildDir, cfg, envChanged } = materialize(opts);
+  const apiPort = cfg.apiPort;
+  const dashPort = cfg.dashPort;
+  const up = (extra = {}) => compose(
+    envChanged ? ["up", "-d", "--force-recreate", ...ENV_CONSUMING_SERVICES] : ["up", "-d"],
+    extra
+  );
   const env = readEnvFile();
   const project = env.COMPOSE_PROJECT_NAME || "openship";
   removeOrphanedStack(project);
+  migrateLegacyEdgeVolumes(project);
   warnOrphanedVolumes(project);
-  if (regeneratedSecrets && dbVolumeExists(project)) {
-    console.log("  Existing database volume with regenerated credentials \u2014 realigning the password...");
+  if (dbVolumeExists(project)) {
     reconcileDbPassword(env.POSTGRES_USER || "openship", env.POSTGRES_PASSWORD ?? "");
   }
   if (buildDir) {
@@ -13198,17 +13325,22 @@ function composeUp(opts) {
     if (compose(["build"], { withBuildOverride: true }) !== 0) {
       return { ok: false, apiPort, dashPort };
     }
-    if (compose(["up", "-d"], { withBuildOverride: true }) !== 0) {
+    if (up({ withBuildOverride: true }) !== 0) {
       return { ok: false, apiPort, dashPort };
     }
+    onEdgeContainerChanged();
     writeInstallMethod("compose");
     return { ok: true, apiPort, dashPort };
   }
   if (compose(["pull"]) !== 0) return { ok: false, apiPort, dashPort };
-  if (compose(["up", "-d"]) !== 0) return { ok: false, apiPort, dashPort };
+  if (up() !== 0) return { ok: false, apiPort, dashPort };
+  onEdgeContainerChanged();
   writeInstallMethod("compose");
   return { ok: true, apiPort, dashPort };
 }
+function onEdgeContainerChanged() {
+  invalidateEdgeContainer();
+}
 function composeDown() {
   if (!existsSync3(COMPOSE_FILE)) return false;
   return compose(["down"]) === 0;
@@ -13218,7 +13350,7 @@ function composeUninstall(opts = {}) {
   const ok = existsSync3(COMPOSE_FILE) ? compose(["down", "-v", "--remove-orphans"]) === 0 : false;
   if (opts.removeImages) {
     const env = readEnvFile();
-    const registry = env.OPENSHIP_IMAGE_REGISTRY || "ghcr.io/oblien";
+    const registry = env.OPENSHIP_IMAGE_REGISTRY || DEFAULT_IMAGE_REGISTRY;
     const version = env.OPENSHIP_VERSION || "latest";
     for (const { service } of BUILT_SERVICES) {
       const ref = `${registry}/openship-${service}:${version}`;
@@ -13231,23 +13363,25 @@ function composeUninstall(opts = {}) {
 }
 function composeUpdate(version) {
   if (!existsSync3(COMPOSE_FILE)) return false;
-  if (version) {
-    const env = readEnvFile();
-    env.OPENSHIP_VERSION = version;
-    writeFileSync(
-      ENV_FILE,
-      Object.entries(env).map(([k2, v2]) => `${k2}=${v2}`).join("\n") + "\n",
-      { mode: 384 }
-    );
-  }
-  if (sourceBuildDir()) {
-    return compose(["build"], { withBuildOverride: true }) === 0 && compose(["up", "-d"], { withBuildOverride: true }) === 0;
-  }
-  return compose(["pull"]) === 0 && compose(["up", "-d"]) === 0;
+  return composeUp(version ? { version } : {}).ok;
 }
 function composePs() {
   return compose(["ps"]);
 }
+function composeRunning() {
+  const r2 = spawnSync3(
+    "docker",
+    ["compose", "-f", COMPOSE_FILE, "ps", "--status", "running", "-q"],
+    { cwd: COMPOSE_DIR, encoding: "utf8" }
+  );
+  return r2.status === 0 && r2.stdout.trim().length > 0;
+}
+function composeStart() {
+  return compose(["up", "-d"], { quiet: true }) === 0;
+}
+function composeRestart() {
+  return compose(["restart"], { quiet: true }) === 0;
+}
 function composeInternalToken() {
   return readEnvFile().INTERNAL_TOKEN ?? null;
 }
@@ -13348,6 +13482,9 @@ export {
   composeUninstall,
   composeUpdate,
   composePs,
+  composeRunning,
+  composeStart,
+  composeRestart,
   composeInternalToken,
   waitForApiHealth,
   importMigratedSites

package/dist/{chunk-E77LJWJK.js → chunk-4TJC4JZQ.js}

@@ -1,6 +1,7 @@
-import {
-  LocalExecutor
-} from "./chunk-U2DPZSXA.js";
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v bun || command -v node)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
 import {
   connectSshClient,
   getTarCreateEnv,
@@ -8,22 +9,25 @@ import {
   openSshUnixSocket,
   prepareSourceTarArgs,
   reconcileKnownHosts
-} from "./chunk-4MG3BVHE.js";
+} from "./chunk-OXWDY22G.js";
 import {
   SshDisconnectedError
-} from "./chunk-4LEL3H2Z.js";
+} from "./chunk-RPHRPFEH.js";
+import {
+  LocalExecutor
+} from "./chunk-TYVME3XD.js";
 import {
   emitBufferedLines,
   flushBufferedLines,
   hasLocalCommand,
   logEntry,
   sq
-} from "./chunk-4CQWT2WL.js";
+} from "./chunk-FPRHYBY2.js";
 import {
   TRANSFER_EXCLUDES,
   formatBytes,
   safeErrorMessage
-} from "./chunk-JZLNHGLW.js";
+} from "./chunk-6APULWSU.js";
 
 // ../../packages/adapters/src/system/executor.ts
 import { readFileSync } from "fs";
@@ -490,6 +494,9 @@ var SshExecutor = class _SshExecutor {
       });
     });
   }
+  async rename(from, to) {
+    await this.exec(`mv ${sq(from)} ${sq(to)}`);
+  }
   async readFile(path) {
     return this.withChannelRetry(async () => {
       const sftp = await this.sftp();
@@ -1218,6 +1225,9 @@ var SystemSshExecutor = class _SystemSshExecutor {
       throw new Error(res.stderr.trim() || `Failed to write ${path} (exit ${res.code})`);
     }
   }
+  async rename(from, to) {
+    await this.exec(`mv ${sq(from)} ${sq(to)}`);
+  }
   async readFile(path) {
     const res = await this.runSsh(`cat ${sq(path)}`);
     if (res.code !== 0) {
@@ -1487,12 +1497,13 @@ var SystemSshExecutor = class _SystemSshExecutor {
 };
 
 // ../../packages/adapters/src/system/executor.ts
+var localExecutor = new LocalExecutor();
 function createExecutor(ssh) {
   if (ssh) {
     if (ssh.useSystemSsh) return new SystemSshExecutor(ssh);
     return new SshExecutor(ssh);
   }
-  return new LocalExecutor();
+  return localExecutor;
 }
 function hostControlDisabled() {
   return process.env.OPENSHIP_HOST_CONTROL?.trim().toLowerCase() === "false";
@@ -1504,7 +1515,7 @@ function createHostExecutor() {
     );
   }
   const host = process.env.OPENSHIP_HOST_SSH_HOST?.trim();
-  if (!host) return new LocalExecutor();
+  if (!host) return localExecutor;
   const keyPath = process.env.OPENSHIP_HOST_SSH_KEY?.trim();
   const portRaw = Number(process.env.OPENSHIP_HOST_SSH_PORT || "22");
   const port = Number.isInteger(portRaw) && portRaw > 0 && portRaw < 65536 ? portRaw : 22;