openship 0.4.5 → 0.4.7

package/dist/{chunk-E3ZPCNPU.js → chunk-IMBD5PZ5.js}

@@ -1,11 +1,18 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v bun || command -v node)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
+import {
+  ENV_KEY,
+  ENV_SECRET,
+  fromEnv
+} from "./chunk-FRNAR33O.js";
 import {
   SignatureV4MultiRegion,
   XmlNode,
   XmlShapeDeserializer,
   XmlText
-} from "./chunk-TDFK6ISF.js";
+} from "./chunk-6APIPIJY.js";
 import {
   AwsSdkSigV4ASigner,
   AwsSdkSigV4Signer,
@@ -21,27 +28,10 @@ import {
   resolveAwsSdkSigV4AConfig,
   resolveAwsSdkSigV4Config,
   streamCollector
-} from "./chunk-PARRPUXN.js";
+} from "./chunk-IXCHURVK.js";
 import {
   NodeHttpHandler
-} from "./chunk-VLPJLXXB.js";
-import {
-  AwsCrc32,
-  __awaiter,
-  __generator,
-  __values,
-  convertToBuffer,
-  eventStreamSerdeProvider2 as eventStreamSerdeProvider,
-  isEmptyData,
-  numToUint8,
-  resolveEventStreamSerdeConfig,
-  uint32ArrayFrom
-} from "./chunk-SJBR527P.js";
-import {
-  ENV_KEY,
-  ENV_SECRET,
-  fromEnv
-} from "./chunk-FZJX6XP7.js";
+} from "./chunk-OWED2GRM.js";
 import {
   BinaryDecisionDiagram,
   Client,
@@ -77,7 +67,7 @@ import {
   resolveRetryConfig,
   resolveUserAgentConfig,
   setFeature
-} from "./chunk-65KKUJBR.js";
+} from "./chunk-VWPEKOH6.js";
 import {
   CredentialsProviderError,
   ENV_PROFILE,
@@ -108,7 +98,25 @@ import {
   resolveHttpHandlerRuntimeConfig,
   resolveRegionConfig,
   toEndpointV1
-} from "./chunk-GHXGCANU.js";
+} from "./chunk-W73X43R7.js";
+import {
+  CloudRuntime
+} from "./chunk-XFCDYZUQ.js";
+import {
+  systemCatalog
+} from "./chunk-UXWAVM4C.js";
+import {
+  AwsCrc32,
+  __awaiter,
+  __generator,
+  __values,
+  convertToBuffer,
+  eventStreamSerdeProvider2 as eventStreamSerdeProvider,
+  isEmptyData,
+  numToUint8,
+  resolveEventStreamSerdeConfig,
+  uint32ArrayFrom
+} from "./chunk-O6ZZF52V.js";
 import {
   Hash,
   NumericValue,
@@ -126,36 +134,36 @@ import {
   toBase64,
   toUint8Array,
   toUtf8
-} from "./chunk-YJAS5RQX.js";
+} from "./chunk-JYGD5WSN.js";
 import {
   DockerRuntime,
   isHostPathSource,
   scopedVolumeName
-} from "./chunk-R74UB4X4.js";
+} from "./chunk-SJIFLLX4.js";
 import {
   BareRuntime
-} from "./chunk-3YCMJRDZ.js";
+} from "./chunk-VDMQJHPI.js";
 import {
-  CloudRuntime
-} from "./chunk-7EYFCKZX.js";
+  LocalExecutor
+} from "./chunk-TYVME3XD.js";
 import {
-  systemCatalog
-} from "./chunk-UMYQALBH.js";
+  EDGE_CONTAINER_NAME,
+  edgeCrashReason,
+  invalidateEdgeContainer
+} from "./chunk-R5BHFFAV.js";
+import {
+  EDGE_CONTAINER_MOUNTS,
+  EDGE_HOST_STATE_DIR
+} from "./chunk-VFINNTUL.js";
 import {
+  DEFAULT_IMAGE_REGISTRY,
   safeErrorMessage
-} from "./chunk-3LCRNQ2C.js";
+} from "./chunk-6APULWSU.js";
 
 // src/lib/edge-import.ts
 import chalk from "chalk";
 import ora from "ora";
 
-// src/lib/compose.ts
-import { spawnSync as spawnSync3 } from "child_process";
-import { randomBytes as randomBytes5 } from "crypto";
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join6 } from "path";
-
 // ../../packages/adapters/src/runtime/image-transfer.ts
 import { Transform } from "stream";
 
@@ -10967,10 +10975,10 @@ var package_default = {
 // ../../node_modules/@aws-sdk/credential-provider-node/dist-es/remoteProvider.js
 var ENV_IMDS_DISABLED = "AWS_EC2_METADATA_DISABLED";
 var remoteProvider = async (init) => {
-  const { ENV_CMDS_FULL_URI, ENV_CMDS_RELATIVE_URI, fromContainerMetadata, fromInstanceMetadata } = await import("./dist-es-33Z3Y6VE.js");
+  const { ENV_CMDS_FULL_URI, ENV_CMDS_RELATIVE_URI, fromContainerMetadata, fromInstanceMetadata } = await import("./dist-es-VNKHQVIB.js");
   if (process.env[ENV_CMDS_RELATIVE_URI] || process.env[ENV_CMDS_FULL_URI]) {
     init.logger?.debug("@aws-sdk/credential-provider-node - remoteProvider::fromHttp/fromContainerMetadata");
-    const { fromHttp } = await import("./dist-es-DCR6UJMP.js");
+    const { fromHttp } = await import("./dist-es-5DY7K32L.js");
     return chain(fromHttp(init), fromContainerMetadata(init));
   }
   if (process.env[ENV_IMDS_DISABLED] && process.env[ENV_IMDS_DISABLED] !== "false") {
@@ -11082,22 +11090,22 @@ var defaultProvider = (init = {}) => memoizeChain([
     if (!ssoStartUrl && !ssoAccountId && !ssoRegion && !ssoRoleName && !ssoSession) {
       throw new CredentialsProviderError("Skipping SSO provider in default chain (inputs do not include SSO fields).", { logger: init.logger });
     }
-    const { fromSSO } = await import("./dist-es-D6QQVWRZ.js");
+    const { fromSSO } = await import("./dist-es-WV4AMOII.js");
     return fromSSO(init)(awsIdentityProperties);
   },
   async (awsIdentityProperties) => {
     init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromIni");
-    const { fromIni } = await import("./dist-es-6RSPR56Q.js");
+    const { fromIni } = await import("./dist-es-RYHIPOTN.js");
     return fromIni(init)(awsIdentityProperties);
   },
   async (awsIdentityProperties) => {
     init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromProcess");
-    const { fromProcess } = await import("./dist-es-7EZIM4JU.js");
+    const { fromProcess } = await import("./dist-es-OSNJBLXB.js");
     return fromProcess(init)(awsIdentityProperties);
   },
   async (awsIdentityProperties) => {
     init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromTokenFile");
-    const { fromTokenFile } = await import("./dist-es-GMEQINIE.js");
+    const { fromTokenFile } = await import("./dist-es-X3B5QYKB.js");
     return fromTokenFile(init)(awsIdentityProperties);
   },
   async () => {
@@ -12658,6 +12666,13 @@ var SftpDestinationImpl = class {
 registerDestination("sftp", (row) => new SftpDestinationImpl(row));
 registerDestination("openship_server", (row) => new SftpDestinationImpl(row));
 
+// src/lib/compose.ts
+import { spawnSync as spawnSync3 } from "child_process";
+import { randomBytes as randomBytes5 } from "crypto";
+import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { homedir as homedir2, userInfo } from "os";
+import { join as join6 } from "path";
+
 // src/lib/paths.ts
 import { homedir } from "os";
 import { join as join3, resolve as resolve2 } from "path";
@@ -12818,6 +12833,11 @@ async function rebuildFromSource(info) {
 }
 
 // src/lib/compose.ts
+var EDGE_SITES_HOST_DIR = `${EDGE_HOST_STATE_DIR}/sites-enabled`;
+var EDGE_ACME_HOST_DIR = `${EDGE_HOST_STATE_DIR}/acme`;
+function edgeVolumeYaml(indent) {
+  return EDGE_CONTAINER_MOUNTS.map((m2) => `${indent}- ${m2.host}:${m2.container}:z`).join("\n");
+}
 var COMPOSE_DIR = join6(OS_DIR, "compose");
 var INSTALL_METHOD_FILE = join6(OS_DIR, "install-method");
 var COMPOSE_FILE = join6(COMPOSE_DIR, "docker-compose.yml");
@@ -12828,6 +12848,7 @@ var BUILT_SERVICES = [
   { service: "dashboard", dockerfile: "apps/dashboard/Dockerfile" },
   { service: "edge", dockerfile: "apps/edge/Dockerfile" }
 ];
+var ENV_CONSUMING_SERVICES = ["api", "dashboard", "edge"];
 function readInstallMethod() {
   try {
     const v2 = readFileSync2(INSTALL_METHOD_FILE, "utf8").trim();
@@ -12907,11 +12928,12 @@ services:
     ports: ["\${OPENSHIP_BIND_ADDR:-0.0.0.0}:\${API_PORT:-4000}:\${API_PORT:-4000}"]
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-      - openship_sites:/usr/local/openresty/nginx/conf/sites-enabled
-      - openship_certs:/etc/letsencrypt
-      - openship_acme:/var/www/acme
-      # Static sites' extracted doc-roots \u2014 API writes, edge serves (shared).
-      - openship_static:/opt/openship/static
+      # Routing state shared with the edge, as HOST BIND MOUNTS (generated from
+      # EDGE_CONTAINER_MOUNTS): the vhost tree, /etc/letsencrypt, the ACME webroot
+      # and the static doc-roots the API writes and the edge serves. Named volumes
+      # hid all of it from every host-side reader (migrate's proxy scan, cert carry,
+      # cert reuse, mail cert symlinks), each of which then silently saw "nothing".
+${edgeVolumeYaml("      ")}
       # Host-op SSH key (createHostExecutor \u2192 host.docker.internal). /dev/null
       # when the host channel isn't provisioned \u2192 OPENSHIP_HOST_SSH_HOST stays
       # unset and the API falls back to LocalExecutor.
@@ -12960,18 +12982,11 @@ services:
     restart: unless-stopped
     network_mode: host
     volumes:
-      - openship_sites:/usr/local/openresty/nginx/conf/sites-enabled
-      - openship_certs:/etc/letsencrypt
-      - openship_acme:/var/www/acme
-      - openship_static:/opt/openship/static
+${edgeVolumeYaml("      ")}
 
 volumes:
   postgres_data:
   redis_data:
-  openship_sites:
-  openship_certs:
-  openship_acme:
-  openship_static:
 `;
 function keepSecret(existing, key) {
   return existing[key] || randomBytes5(32).toString("hex");
@@ -12987,6 +13002,15 @@ function readEnvFile() {
   }
   return out;
 }
+var HOST_KEY_COMMENT = "openship-host-executor";
+var HOST_KEY_FROM = "172.16.0.0/12,192.168.0.0/16,10.0.0.0/8,127.0.0.1";
+function hostKeyAuthLine(pub) {
+  return `from="${HOST_KEY_FROM}",restrict,pty ${pub}`;
+}
+function rewriteHostAuthorizedKeys(existing, pub) {
+  const kept = existing.split("\n").filter((line) => line.trim() && !line.includes(HOST_KEY_COMMENT));
+  return [...kept, hostKeyAuthLine(pub)].join("\n") + "\n";
+}
 function provisionHostSshChannel() {
   if (process.platform !== "linux") return null;
   try {
@@ -12996,23 +13020,28 @@ function provisionHostSshChannel() {
     if (!existsSync3(keyPath)) {
       const g2 = spawnSync3(
         "ssh-keygen",
-        ["-t", "ed25519", "-N", "", "-q", "-f", keyPath, "-C", "openship-host-executor"],
+        ["-t", "ed25519", "-N", "", "-q", "-f", keyPath, "-C", HOST_KEY_COMMENT],
         { stdio: "ignore" }
       );
       if (g2.status !== 0) return null;
     }
     const pub = readFileSync2(`${keyPath}.pub`, "utf8").trim();
     if (!pub) return null;
+    const user = (() => {
+      try {
+        return userInfo().username;
+      } catch {
+        return process.env.USER || process.env.LOGNAME || "root";
+      }
+    })();
     const userSshDir = join6(homedir2(), ".ssh");
     mkdirSync2(userSshDir, { recursive: true, mode: 448 });
     const authKeys = join6(userSshDir, "authorized_keys");
     const existing = existsSync3(authKeys) ? readFileSync2(authKeys, "utf8") : "";
-    if (!existing.includes(pub)) {
-      const sep = existing && !existing.endsWith("\n") ? "\n" : "";
-      writeFileSync(authKeys, `${existing}${sep}${pub}
-`, { mode: 384 });
-    }
-    return { user: process.env.USER || process.env.LOGNAME || "root", keyPath };
+    const next = rewriteHostAuthorizedKeys(existing, pub);
+    if (next !== existing) writeFileSync(authKeys, next, { mode: 384 });
+    chmodSync(authKeys, 384);
+    return { user, keyPath };
   } catch {
     return null;
   }
@@ -13044,7 +13073,7 @@ function orphanedStackContainers(project) {
 function reconcileDbPassword(user, password) {
   if (!password) return;
   if (compose(["up", "-d", "--wait", "postgres"], { quiet: true }) !== 0) return;
-  const r2 = spawnSync3(
+  const attempt = (asRole) => spawnSync3(
     "docker",
     [
       "compose",
@@ -13055,7 +13084,7 @@ function reconcileDbPassword(user, password) {
       "postgres",
       "psql",
       "-U",
-      user,
+      asRole,
       "-d",
       "postgres",
       "-v",
@@ -13071,15 +13100,31 @@ function reconcileDbPassword(user, password) {
     {
       cwd: COMPOSE_DIR,
       encoding: "utf8",
-      input: `ALTER USER "${user}" WITH PASSWORD '${password}';
+      // Create the role if the volume predates it, else just realign it. Both
+      // branches leave exactly the credentials this `.env` will present.
+      input: `DO $$ BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${user}') THEN
+    ALTER ROLE "${user}" WITH LOGIN PASSWORD '${password}';
+  ELSE
+    CREATE ROLE "${user}" WITH LOGIN SUPERUSER PASSWORD '${password}';
+  END IF;
+END $$;
 `
     }
   );
+  let r2 = attempt(user);
+  if (r2.status !== 0) r2 = attempt("postgres");
   if (r2.status !== 0) {
     console.log(
-      `  Note: couldn't reconcile the database password (${(r2.stderr ?? "").trim() || "psql failed"}).
-  If the api reports "password authentication failed", the data volume predates this install \u2014
-  either restore the old .env or remove the volume to start fresh.`
+      `
+  ! Could not realign the database password (${(r2.stderr ?? "").trim() || "psql failed"}).
+    The api will fail with "password authentication failed for user "${user}"" because the
+    existing data volume was initialized with a different password.
+
+    Fix it one of two ways:
+      \u2022 restore the .env that created the volume, or
+      \u2022 start fresh (DESTROYS DB DATA):  openship uninstall  then  openship up
+`
     );
   }
 }
@@ -13092,6 +13137,48 @@ function removeOrphanedStack(project) {
   );
   spawnSync3("docker", ["rm", "-f", ...orphans.map((o2) => o2.name)], { stdio: "ignore" });
 }
+function migrateLegacyEdgeVolumes(project) {
+  const pairs = [
+    { volume: `${project}_openship_sites`, host: EDGE_SITES_HOST_DIR },
+    { volume: `${project}_openship_certs`, host: "/etc/letsencrypt" },
+    { volume: `${project}_openship_acme`, host: EDGE_ACME_HOST_DIR },
+    { volume: `${project}_openship_static`, host: "/opt/openship/static" }
+  ];
+  const ls = spawnSync3("docker", ["volume", "ls", "--format", "{{.Name}}"], { encoding: "utf8" });
+  if (ls.status !== 0 || !ls.stdout) return;
+  const existing = new Set(ls.stdout.split("\n").map((l2) => l2.trim()).filter(Boolean));
+  for (const { volume, host } of pairs) {
+    if (!existing.has(volume)) continue;
+    mkdirSync2(host, { recursive: true });
+    const alreadyThere = spawnSync3("sh", ["-c", `ls -A ${JSON.stringify(host)} 2>/dev/null | head -1`], {
+      encoding: "utf8"
+    });
+    if (alreadyThere.stdout?.trim()) continue;
+    console.log(`  Moving edge state from volume ${volume} onto ${host}...`);
+    const copy = spawnSync3(
+      "docker",
+      [
+        "run",
+        "--rm",
+        "-v",
+        `${volume}:/from:ro`,
+        "-v",
+        `${host}:/to`,
+        "alpine:3",
+        "sh",
+        "-c",
+        "cp -a /from/. /to/ 2>/dev/null || true"
+      ],
+      { stdio: "inherit" }
+    );
+    if (copy.status !== 0) {
+      console.log(
+        `  Could not copy ${volume} \u2014 the stack will start with an empty ${host}.
+  Recover manually with: docker run --rm -v ${volume}:/from -v ${host}:/to alpine cp -a /from/. /to/`
+      );
+    }
+  }
+}
 function warnOrphanedVolumes(project) {
   const r2 = spawnSync3("docker", ["volume", "ls", "--format", "{{.Name}}"], { encoding: "utf8" });
   if (r2.status !== 0 || !r2.stdout) return;
@@ -13101,11 +13188,40 @@ function warnOrphanedVolumes(project) {
   if (others.size === 0) return;
   console.log(
     `  Note: volumes from a previous install (project "${[...others].join(", ")}") are still on disk
-  and are NOT mounted by this stack \u2014 its database and certificates start fresh.
+  and are NOT mounted by this stack \u2014 its database starts fresh. (Certificates and
+  vhosts now live on the host, so those carry over.)
   Remove them with \`docker volume ls | grep _openship_\` once you're sure they aren't needed.`
   );
 }
-function renderEnv(opts, host) {
+function keepConfig(prev, key, explicit) {
+  const set = explicit?.trim();
+  if (set) return set;
+  const carried = prev[key]?.trim();
+  return carried || void 0;
+}
+function resolveEnvConfig(prev, opts) {
+  const publicUrl = keepConfig(prev, "OPENSHIP_PUBLIC_URL", opts.publicUrl);
+  return {
+    apiPort: keepConfig(prev, "API_PORT", opts.apiPort) ?? "4000",
+    dashPort: keepConfig(prev, "DASHBOARD_PORT", opts.dashboardPort) ?? "3001",
+    ...publicUrl ? { publicUrl } : {},
+    // A public URL always implies a proxy in front; otherwise keep whatever the
+    // install was configured with.
+    trustProxy: Boolean(opts.trustProxy) || Boolean(publicUrl) || prev.TRUST_PROXY === "true",
+    ...keepConfig(prev, "OPENSHIP_EXTRA_TRUSTED_ORIGINS", opts.extraTrustedOrigins) ? {
+      extraTrustedOrigins: keepConfig(
+        prev,
+        "OPENSHIP_EXTRA_TRUSTED_ORIGINS",
+        opts.extraTrustedOrigins
+      )
+    } : {},
+    registry: keepConfig(prev, "OPENSHIP_IMAGE_REGISTRY", opts.registry) ?? DEFAULT_IMAGE_REGISTRY,
+    // Tri-state: the flag is absent on a plain re-run, so fall back to what the
+    // install chose rather than silently re-granting host control.
+    hostControl: opts.noHostControl === void 0 ? prev.OPENSHIP_HOST_CONTROL !== "false" : !opts.noHostControl
+  };
+}
+function renderEnv(opts, host, cfg) {
   const prev = readEnvFile();
   const lines = [
     "# Managed by `openship up`. Secrets are generated once and preserved.",
@@ -13116,17 +13232,20 @@ function renderEnv(opts, host) {
     "OPENSHIP_REQUIRE_AUTH=true",
     // Read by createHostExecutor (throws when false) and by the servers list
     // (hides the local row). Written explicitly so the policy is visible in .env.
-    `OPENSHIP_HOST_CONTROL=${opts.noHostControl ? "false" : "true"}`,
-    `OPENSHIP_IMAGE_REGISTRY=${opts.registry || "ghcr.io/oblien"}`,
-    `OPENSHIP_VERSION=${opts.version || (true ? "0.4.5" : "latest")}`,
+    `OPENSHIP_HOST_CONTROL=${cfg.hostControl ? "true" : "false"}`,
+    `OPENSHIP_IMAGE_REGISTRY=${cfg.registry}`,
+    `OPENSHIP_VERSION=${opts.version || (true ? "0.4.7" : "latest")}`,
     `POSTGRES_PASSWORD=${keepSecret(prev, "POSTGRES_PASSWORD")}`,
     `BETTER_AUTH_SECRET=${keepSecret(prev, "BETTER_AUTH_SECRET")}`,
-    `INTERNAL_TOKEN=${keepSecret(prev, "INTERNAL_TOKEN")}`
+    `INTERNAL_TOKEN=${keepSecret(prev, "INTERNAL_TOKEN")}`,
+    `API_PORT=${cfg.apiPort}`,
+    `DASHBOARD_PORT=${cfg.dashPort}`
   ];
-  if (opts.apiPort) lines.push(`API_PORT=${opts.apiPort}`);
-  if (opts.dashboardPort) lines.push(`DASHBOARD_PORT=${opts.dashboardPort}`);
-  if (opts.publicUrl) lines.push(`OPENSHIP_PUBLIC_URL=${opts.publicUrl}`);
-  if (opts.trustProxy || opts.publicUrl) lines.push("TRUST_PROXY=true");
+  if (cfg.publicUrl) lines.push(`OPENSHIP_PUBLIC_URL=${cfg.publicUrl}`);
+  if (cfg.extraTrustedOrigins) {
+    lines.push(`OPENSHIP_EXTRA_TRUSTED_ORIGINS=${cfg.extraTrustedOrigins}`);
+  }
+  if (cfg.trustProxy) lines.push("TRUST_PROXY=true");
   if (host) {
     lines.push(
       "OPENSHIP_HOST_SSH_HOST=host.docker.internal",
@@ -13158,13 +13277,20 @@ ${services}`;
 }
 function materialize(opts) {
   mkdirSync2(COMPOSE_DIR, { recursive: true, mode: 448 });
-  const regeneratedSecrets = !readEnvFile().POSTGRES_PASSWORD;
-  const host = opts.noHostControl ? null : provisionHostSshChannel();
+  const prev = readEnvFile();
+  const cfg = resolveEnvConfig(prev, opts);
+  const host = cfg.hostControl ? provisionHostSshChannel() : null;
+  let before = "";
+  try {
+    before = readFileSync2(ENV_FILE, "utf8");
+  } catch {
+  }
+  const rendered = renderEnv(opts, host, cfg);
   writeFileSync(COMPOSE_FILE, COMPOSE_YAML);
-  writeFileSync(ENV_FILE, renderEnv(opts, host), { mode: 384 });
+  writeFileSync(ENV_FILE, rendered, { mode: 384 });
   const buildDir = opts.build === false ? null : sourceBuildDir();
   if (buildDir) writeFileSync(BUILD_FILE, renderBuildOverride(buildDir));
-  return { buildDir, regeneratedSecrets };
+  return { buildDir, cfg, envChanged: before !== "" && rendered !== before };
 }
 function dbVolumeExists(project) {
   const r2 = spawnSync3("docker", ["volume", "inspect", `${project}_postgres_data`], {
@@ -13182,15 +13308,19 @@ function compose(args, opts) {
   return r2.status ?? 1;
 }
 function composeUp(opts) {
-  const { buildDir, regeneratedSecrets } = materialize(opts);
-  const apiPort = opts.apiPort || "4000";
-  const dashPort = opts.dashboardPort || "3001";
+  const { buildDir, cfg, envChanged } = materialize(opts);
+  const apiPort = cfg.apiPort;
+  const dashPort = cfg.dashPort;
+  const up = (extra = {}) => compose(
+    envChanged ? ["up", "-d", "--force-recreate", ...ENV_CONSUMING_SERVICES] : ["up", "-d"],
+    extra
+  );
   const env = readEnvFile();
   const project = env.COMPOSE_PROJECT_NAME || "openship";
   removeOrphanedStack(project);
+  migrateLegacyEdgeVolumes(project);
   warnOrphanedVolumes(project);
-  if (regeneratedSecrets && dbVolumeExists(project)) {
-    console.log("  Existing database volume with regenerated credentials \u2014 realigning the password...");
+  if (dbVolumeExists(project)) {
     reconcileDbPassword(env.POSTGRES_USER || "openship", env.POSTGRES_PASSWORD ?? "");
   }
   if (buildDir) {
@@ -13200,17 +13330,22 @@ function composeUp(opts) {
     if (compose(["build"], { withBuildOverride: true }) !== 0) {
       return { ok: false, apiPort, dashPort };
     }
-    if (compose(["up", "-d"], { withBuildOverride: true }) !== 0) {
+    if (up({ withBuildOverride: true }) !== 0) {
       return { ok: false, apiPort, dashPort };
     }
+    onEdgeContainerChanged();
     writeInstallMethod("compose");
     return { ok: true, apiPort, dashPort };
   }
   if (compose(["pull"]) !== 0) return { ok: false, apiPort, dashPort };
-  if (compose(["up", "-d"]) !== 0) return { ok: false, apiPort, dashPort };
+  if (up() !== 0) return { ok: false, apiPort, dashPort };
+  onEdgeContainerChanged();
   writeInstallMethod("compose");
   return { ok: true, apiPort, dashPort };
 }
+function onEdgeContainerChanged() {
+  invalidateEdgeContainer();
+}
 function composeDown() {
   if (!existsSync3(COMPOSE_FILE)) return false;
   return compose(["down"]) === 0;
@@ -13220,7 +13355,7 @@ function composeUninstall(opts = {}) {
   const ok = existsSync3(COMPOSE_FILE) ? compose(["down", "-v", "--remove-orphans"]) === 0 : false;
   if (opts.removeImages) {
     const env = readEnvFile();
-    const registry = env.OPENSHIP_IMAGE_REGISTRY || "ghcr.io/oblien";
+    const registry = env.OPENSHIP_IMAGE_REGISTRY || DEFAULT_IMAGE_REGISTRY;
     const version = env.OPENSHIP_VERSION || "latest";
     for (const { service } of BUILT_SERVICES) {
       const ref = `${registry}/openship-${service}:${version}`;
@@ -13233,23 +13368,25 @@ function composeUninstall(opts = {}) {
 }
 function composeUpdate(version) {
   if (!existsSync3(COMPOSE_FILE)) return false;
-  if (version) {
-    const env = readEnvFile();
-    env.OPENSHIP_VERSION = version;
-    writeFileSync(
-      ENV_FILE,
-      Object.entries(env).map(([k2, v2]) => `${k2}=${v2}`).join("\n") + "\n",
-      { mode: 384 }
-    );
-  }
-  if (sourceBuildDir()) {
-    return compose(["build"], { withBuildOverride: true }) === 0 && compose(["up", "-d"], { withBuildOverride: true }) === 0;
-  }
-  return compose(["pull"]) === 0 && compose(["up", "-d"]) === 0;
+  return composeUp(version ? { version } : {}).ok;
 }
 function composePs() {
   return compose(["ps"]);
 }
+function composeRunning() {
+  const r2 = spawnSync3(
+    "docker",
+    ["compose", "-f", COMPOSE_FILE, "ps", "--status", "running", "-q"],
+    { cwd: COMPOSE_DIR, encoding: "utf8" }
+  );
+  return r2.status === 0 && r2.stdout.trim().length > 0;
+}
+function composeStart() {
+  return compose(["up", "-d"], { quiet: true }) === 0;
+}
+function composeRestart() {
+  return compose(["restart"], { quiet: true }) === 0;
+}
 function composeInternalToken() {
   return readEnvFile().INTERNAL_TOKEN ?? null;
 }
@@ -13303,11 +13440,17 @@ async function importMigratedSites(apiPort, sites, certPems) {
         `Migrated NONE of the ${sites.length} site${sites.length === 1 ? "" : "s"} \u2014 Openship holds :80/:443 and ${sites.length === 1 ? "that hostname is" : "those hostnames are"} NOT being served.`
       );
       for (const w2 of warnings.slice(0, 8)) console.log(chalk.red(`    \u2022 ${w2}`));
+      const edgeLog = await edgeCrashReason(new LocalExecutor());
+      if (edgeLog) {
+        console.log(chalk.red(`
+  The edge container is not running. Its log says:`));
+        console.log(chalk.red(`    ${edgeLog}`));
+      }
       console.log(
         chalk.yellow(
           `
   Retry the import with \`openship up\` once the cause above is fixed, or put your
-  previous proxy back:  docker stop openship-edge && sudo systemctl enable --now nginx
+  previous proxy back:  docker stop ${EDGE_CONTAINER_NAME} && sudo systemctl enable --now nginx
 `
         )
       );
@@ -13350,6 +13493,9 @@ export {
   composeUninstall,
   composeUpdate,
   composePs,
+  composeRunning,
+  composeStart,
+  composeRestart,
   composeInternalToken,
   waitForApiHealth,
   importMigratedSites

package/dist/{chunk-VJTXRCTT.js → chunk-IPYPMI3S.js}

@@ -1,10 +1,12 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v bun || command -v node)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   COMPONENT_INSTALLERS,
   checkAll,
   checkComponents
-} from "./chunk-UMYQALBH.js";
+} from "./chunk-UXWAVM4C.js";
 
 // ../../packages/adapters/src/system/state.ts
 var DEFAULT_STATE_PATH = "/etc/openship/setup-state.json";
@@ -41,18 +43,20 @@ function resolveRules(mode) {
     return [
       { feature: "build", requires: ["git", "docker"], message: "Build requires Git and Docker" },
       { feature: "deploy", requires: ["docker"], message: "Deploy requires Docker" },
-      { feature: "routing", requires: ["openresty"], message: "Routing requires OpenResty" },
-      { feature: "ssl", requires: ["openresty", "certbot"], message: "SSL requires OpenResty and certbot" }
+      { feature: "routing", requires: ["edge"], message: "Routing requires the edge" },
+      { feature: "ssl", requires: ["edge"], message: "SSL requires the edge" }
     ];
   }
   return [
     { feature: "build", requires: ["git"], message: "Build requires Git" },
-    { feature: "routing", requires: ["openresty"], message: "Routing requires OpenResty" },
-    { feature: "ssl", requires: ["openresty", "certbot"], message: "SSL requires OpenResty and certbot" }
+    // Even in bare RUNTIME mode (apps run as host processes) the edge itself is a
+    // container — its installer needs Docker and says so.
+    { feature: "routing", requires: ["edge"], message: "Routing requires the edge" },
+    { feature: "ssl", requires: ["edge"], message: "SSL requires the edge" }
   ];
 }
 function resolveRequired(mode) {
-  return mode === "docker" ? ["docker", "git", "openresty", "certbot"] : ["git", "openresty", "certbot"];
+  return mode === "docker" ? ["docker", "git", "edge"] : ["git", "edge"];
 }
 var SystemManager = class {
   mode;