openship 0.4.5 → 0.4.7

package/dist/{chunk-UMYQALBH.js → chunk-UXWAVM4C.js}

@@ -1,1472 +1,1746 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v bun || command -v node)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
-  describeProcess,
-  probeListeningPort,
   resolveEnvironment
-} from "./chunk-YVXF6GGR.js";
+} from "./chunk-L2VOGB2X.js";
 import {
   formatDuration,
   isRemoteConnectionError,
   systemDebug
-} from "./chunk-JYAGTMSJ.js";
+} from "./chunk-RPHRPFEH.js";
+import {
+  containerCommand,
+  edgeContainerExecutor,
+  isSafeCertPath,
+  readDeclaredPair,
+  readMaybeInContainer,
+  validateCertFor
+} from "./chunk-FXTBHTWY.js";
 import {
   sq
-} from "./chunk-Z6EKX6CX.js";
+} from "./chunk-FPRHYBY2.js";
+import {
+  EDGE_CONTAINER_NAME,
+  EdgeConflictError,
+  EdgeMigrateRequested,
+  edgeFailureReason,
+  freeEdgeTargets,
+  invalidateEdgeContainer,
+  ourLuaOnHost,
+  probeEdge,
+  resolveOurEdgeContainer,
+  sq as sq2,
+  stopTargetsForStatus
+} from "./chunk-R5BHFFAV.js";
 import {
-  OPENRESTY_LUA_DIR,
-  buildReloadCommand,
-  deployLuaScripts,
-  detectOpenRestyPaths,
-  ensureOpenRestyConfig
-} from "./chunk-RZPDJC2J.js";
+  waitForPortListening
+} from "./chunk-ILFETZOM.js";
 import {
-  AppError,
+  EDGE_CONTAINER_MOUNTS,
+  EDGE_HOST_PATHS,
+  OPENRESTY_DEFAULT_PATHS,
+  detectOpenRestyPaths
+} from "./chunk-VFINNTUL.js";
+import {
+  buildEdgeImageRef,
   compareSemver,
   safeErrorMessage
-} from "./chunk-3LCRNQ2C.js";
+} from "./chunk-6APULWSU.js";
 
-// ../../packages/adapters/src/system/catalog.ts
-function dockerInstallPlan(profile) {
-  if (profile.os !== "linux") {
-    return {
-      supported: false,
-      unsupportedReason: "Docker installation is only supported on Linux servers"
-    };
+// ../../packages/adapters/src/system/proxy/import/parse-utils.ts
+async function tryExec(executor, command) {
+  try {
+    return await executor.exec(command);
+  } catch {
+    return null;
   }
-  return {
-    supported: true,
-    installCommand: "curl -fsSL https://get.docker.com | sh",
-    startCommand: profile.serviceManager === "systemd" ? "systemctl enable docker && systemctl start docker" : void 0,
-    verifyCommand: "docker --version"
-  };
 }
-function gitInstallPlan(profile) {
-  const commands = {
-    apt: "apt-get update -qq && apt-get install -y -qq git",
-    dnf: "dnf install -y git",
-    yum: "yum install -y git",
-    apk: "apk add --no-cache git",
-    brew: "brew install git"
-  };
-  const installCommand = commands[profile.packageManager];
-  if (!installCommand) {
-    return {
-      supported: false,
-      unsupportedReason: "No supported package manager found for Git installation"
-    };
-  }
-  return {
-    supported: true,
-    installCommand,
-    verifyCommand: "git --version"
-  };
+function stripComments(text) {
+  return text.replace(/#.*$/gm, "");
 }
-function rsyncInstallPlan(profile) {
-  const commands = {
-    apt: "apt-get update -qq && apt-get install -y -qq rsync",
-    dnf: "dnf install -y rsync",
-    yum: "yum install -y rsync",
-    apk: "apk add --no-cache rsync",
-    brew: "brew install rsync"
-  };
-  const installCommand = commands[profile.packageManager];
-  if (!installCommand) {
-    return {
-      supported: false,
-      unsupportedReason: "No supported package manager found for rsync installation"
-    };
+function extractBlocks(text, keyword) {
+  const blocks = [];
+  const re = new RegExp(`(?:^|[\\s;}])${keyword}\\b[^{;]*\\{`, "g");
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    const openIdx = m.index + m[0].length - 1;
+    let depth = 1;
+    let i = openIdx + 1;
+    for (; i < text.length && depth > 0; i++) {
+      if (text[i] === "{") depth++;
+      else if (text[i] === "}") depth--;
+    }
+    if (depth === 0) {
+      blocks.push(text.slice(openIdx + 1, i - 1));
+      re.lastIndex = i;
+    } else {
+      break;
+    }
   }
-  return {
-    supported: true,
-    installCommand,
-    verifyCommand: "rsync --version | head -n 1"
-  };
+  return blocks;
 }
-var OPENRESTY_APT_SOURCES = [
-  // ARM64: openresty.org publishes aarch64 debs under a SEPARATE path
-  // (openresty.org/package/arm64/<repo>); the default path is amd64-only, so on
-  // aarch64 `apt-get install openresty` finds no candidate and `set -e` aborts
-  // the whole setup (issue #109). Switch the base URL by arch and tag the deb
-  // line with `arch=` so apt fetches the right index. `dpkg --print-architecture`
-  // returns exactly amd64/arm64 (matches OpenResty's path + arch qualifier).
-  'OR_ARCH="$(dpkg --print-architecture 2>/dev/null || echo amd64)"',
-  'if [ "$OR_ARCH" = arm64 ]; then OR_BASE="http://openresty.org/package/arm64/$REPO"; else OR_BASE="http://openresty.org/package/$REPO"; fi',
-  // `|| REPO_CODENAME=""` so a failed substitution (no lsb_release AND no
-  // /etc/os-release, e.g. a stripped container) doesn't trip `set -e` before
-  // the empty-var fallback below can pick a default.
-  'REPO_CODENAME="$(lsb_release -sc 2>/dev/null || { . /etc/os-release 2>/dev/null && echo "$VERSION_CODENAME"; })" || REPO_CODENAME=""',
-  'if [ "$REPO" = debian ]; then OR_FALLBACKS="bookworm bullseye"; else OR_FALLBACKS="noble jammy focal"; fi',
-  'OR_CODENAME=""',
-  "for c in $REPO_CODENAME $OR_FALLBACKS; do",
-  '  if wget -q --spider --tries=2 --timeout=15 "$OR_BASE/dists/$c/Release"; then OR_CODENAME="$c"; break; fi',
-  "done",
-  'if [ -z "$OR_CODENAME" ]; then case "$REPO" in debian) OR_CODENAME=bookworm ;; *) OR_CODENAME=noble ;; esac; fi',
-  '[ "$OR_CODENAME" = "$REPO_CODENAME" ] || echo "[openresty] apt repo has no codename $REPO_CODENAME; using nearest supported LTS $OR_CODENAME" >&2',
-  'echo "deb [arch=$OR_ARCH signed-by=/usr/share/keyrings/openresty.gpg] $OR_BASE $OR_CODENAME main" > /etc/apt/sources.list.d/openresty.list'
-];
-function openrestyInstallPlan(profile) {
-  if (profile.os !== "linux") {
-    return {
-      supported: false,
-      unsupportedReason: "OpenResty installation is only supported on Linux servers"
-    };
-  }
-  let installCommand;
-  if (profile.packageManager === "apt") {
-    const distro = profile.distro === "debian" ? "debian" : "ubuntu";
-    installCommand = [
-      "set -e",
-      // Heal a stale/bad openresty.list left by a prior run (e.g. the #86
-      // 'resolute' pin) BEFORE the first apt-get update reads it — otherwise
-      // set -e aborts here and the repo never gets rewritten.
-      "rm -f /etc/apt/sources.list.d/openresty.list",
-      "apt-get update -qq && apt-get install -y -qq wget gnupg2 lsb-release",
-      "wget -qO /tmp/openresty-pubkey.gpg https://openresty.org/package/pubkey.gpg",
-      "gpg --yes --dearmor -o /usr/share/keyrings/openresty.gpg /tmp/openresty-pubkey.gpg",
-      `REPO=${distro}`,
-      ...OPENRESTY_APT_SOURCES,
-      "apt-get update -qq && apt-get install -y -qq openresty"
-    ].join("\n");
-  } else if (profile.packageManager === "dnf") {
-    const distro = profile.distro === "fedora" ? "fedora" : "centos";
-    installCommand = `wget -qO /etc/yum.repos.d/openresty.repo https://openresty.org/package/${distro}/openresty.repo && dnf install -y openresty`;
-  } else if (profile.packageManager === "yum") {
-    installCommand = "wget -qO /etc/yum.repos.d/openresty.repo https://openresty.org/package/centos/openresty.repo && yum install -y openresty";
-  } else if (profile.packageManager === "apk") {
-    installCommand = [
-      "apk add --no-cache wget",
-      "wget -qO /etc/apk/keys/admin@openresty.com-5ea678a6.rsa.pub https://openresty.org/package/alpine/admin@openresty.com-5ea678a6.rsa.pub",
-      `. /etc/os-release && echo "https://openresty.org/package/alpine/v$( echo $VERSION_ID | cut -d. -f1,2 )/main" >> /etc/apk/repositories`,
-      "apk update && apk add openresty"
-    ].join(" && ");
-  } else {
-    installCommand = [
-      "set -e",
-      "if command -v apt-get >/dev/null 2>&1; then",
-      "  rm -f /etc/apt/sources.list.d/openresty.list",
-      "  apt-get update -qq && apt-get install -y -qq wget gnupg2 lsb-release",
-      "  wget -qO /tmp/openresty-pubkey.gpg https://openresty.org/package/pubkey.gpg",
-      "  gpg --yes --dearmor -o /usr/share/keyrings/openresty.gpg /tmp/openresty-pubkey.gpg",
-      '  DISTRO=$(. /etc/os-release 2>/dev/null && echo "$ID" || echo "ubuntu")',
-      '  case "$DISTRO" in debian) REPO=debian ;; *) REPO=ubuntu ;; esac',
-      ...OPENRESTY_APT_SOURCES.map((l) => "  " + l),
-      "  apt-get update -qq && apt-get install -y -qq openresty",
-      "elif command -v dnf >/dev/null 2>&1; then",
-      "  wget -qO /etc/yum.repos.d/openresty.repo https://openresty.org/package/centos/openresty.repo && dnf install -y openresty",
-      "elif command -v yum >/dev/null 2>&1; then",
-      "  wget -qO /etc/yum.repos.d/openresty.repo https://openresty.org/package/centos/openresty.repo && yum install -y openresty",
-      "elif command -v apk >/dev/null 2>&1; then",
-      "  apk add --no-cache wget \\",
-      "  && wget -qO /etc/apk/keys/admin@openresty.com-5ea678a6.rsa.pub https://openresty.org/package/alpine/admin@openresty.com-5ea678a6.rsa.pub \\",
-      '  && . /etc/os-release && echo "https://openresty.org/package/alpine/v$(echo $VERSION_ID | cut -d. -f1,2)/main" >> /etc/apk/repositories \\',
-      "  && apk update && apk add openresty",
-      "else",
-      '  echo "No supported package manager found (tried apt-get, dnf, yum, apk)" >&2 && exit 1',
-      "fi"
-    ].join("\n");
+function sq3(value) {
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+
+// ../../packages/adapters/src/system/proxy/import/nginx.ts
+async function loadNginxConfig(executor) {
+  const dumped = await tryExec(executor, "nginx -T 2>/dev/null");
+  if (dumped && /server\s*\{/.test(dumped)) return dumped;
+  const cat = await tryExec(
+    executor,
+    "cat /etc/nginx/nginx.conf /etc/nginx/sites-enabled/* /etc/nginx/conf.d/*.conf 2>/dev/null"
+  );
+  return cat ?? "";
+}
+function firstDirective(body, name) {
+  const m = body.match(new RegExp(`(?:^|[;{\\s])${name}\\s+([^;]+);`));
+  return m?.[1]?.trim();
+}
+function parseUpstreams(config) {
+  const map = /* @__PURE__ */ new Map();
+  const re = /(?:^|[\s;}])upstream\s+(\S+)\s*\{([^}]*)\}/g;
+  let m;
+  while ((m = re.exec(config)) !== null) {
+    const name = m[1];
+    const server = m[2].match(/(?:^|[\s;{])server\s+([^;\s]+)/);
+    if (name && server?.[1]) map.set(name, server[1].trim());
   }
-  return {
-    supported: true,
-    installCommand,
-    startCommand: profile.serviceManager === "systemd" ? "systemctl enable openresty && systemctl start openresty" : void 0,
-    verifyCommand: "openresty -v 2>&1"
-  };
+  return map;
 }
-function certbotInstallPlan(profile) {
-  const commands = {
-    apt: "apt-get update -qq && apt-get install -y -qq certbot",
-    dnf: "dnf install -y certbot",
-    yum: "yum install -y certbot",
-    apk: "apk add --no-cache certbot"
-  };
-  const installCommand = commands[profile.packageManager];
-  if (!installCommand) {
-    return {
-      supported: false,
-      unsupportedReason: "Certbot installation is only supported on Linux with apt, dnf, or yum"
-    };
+function resolveProxyTarget(proxyPass, upstreams) {
+  const raw = proxyPass.replace(/;$/, "").trim();
+  if (raw.includes("$")) return { reason: `proxy_pass "${raw}" uses an nginx variable` };
+  if (/\/\/unix:/i.test(raw)) return { reason: `proxy_pass "${raw}" targets a unix socket` };
+  const m = raw.match(/^(https?:\/\/)([^/]+)(\/.*)?$/i);
+  if (!m) return { reason: `unrecognized proxy_pass "${raw}"` };
+  const scheme = m[1];
+  const authority = m[2];
+  const host = authority.replace(/:\d+$/, "");
+  if (upstreams.has(host)) return { url: `${scheme}${upstreams.get(host)}` };
+  const isIp = /^\d{1,3}(\.\d{1,3}){3}$/.test(host);
+  if (isIp || host === "localhost" || host.includes(".")) return { url: raw };
+  return { reason: `proxy_pass host "${host}" is an undeclared upstream \u2014 not migratable` };
+}
+function extractLocationProxies(serverBody) {
+  const out = [];
+  const re = /(?:^|[\s;}])location\s+([^{]+?)\s*\{/g;
+  let m;
+  while ((m = re.exec(serverBody)) !== null) {
+    const path = m[1].trim();
+    const openIdx = m.index + m[0].length - 1;
+    let depth = 1;
+    let i = openIdx + 1;
+    for (; i < serverBody.length && depth > 0; i++) {
+      if (serverBody[i] === "{") depth++;
+      else if (serverBody[i] === "}") depth--;
+    }
+    if (depth !== 0) break;
+    const locBody = serverBody.slice(openIdx + 1, i - 1);
+    re.lastIndex = i;
+    const pp = firstDirective(locBody, "proxy_pass");
+    if (pp) out.push({ path, proxyPass: pp });
   }
-  return {
-    supported: true,
-    installCommand,
-    verifyCommand: "certbot --version 2>/dev/null"
-  };
+  return out;
 }
-var systemCatalog = {
-  checks: {
-    docker: {
-      versionCommand: "docker --version",
-      daemonCommand: "docker info --format '{{.ServerVersion}}'",
-      parseVersion: (output) => output.match(/Docker version ([^\s,]+)/)?.[1] ?? output,
-      missingMessage: "Docker is not installed",
-      notRunningMessage: "Docker is installed but the daemon is not running"
-    },
-    openresty: {
-      versionCommand: "openresty -v 2>&1 || /usr/local/openresty/bin/openresty -v 2>&1",
-      runningCommands: [
-        "pgrep -f 'nginx.*openresty' || pgrep -f '/usr/local/openresty'"
-      ],
-      parseVersion: (output) => output.match(/openresty\/(\S+)/)?.[1] ?? output.match(/nginx\/(\S+)/)?.[1] ?? output,
-      missingMessage: "OpenResty is not installed",
-      notRunningMessage: "OpenResty is installed but not running"
-    },
-    certbot: {
-      versionCommand: "certbot --version 2>/dev/null",
-      parseVersion: (output) => output.match(/certbot\s+(\S+)/)?.[1] ?? output,
-      missingMessage: "Certbot is not installed"
-    },
-    git: {
-      versionCommand: "git --version",
-      parseVersion: (output) => output.match(/git version (\S+)/)?.[1] ?? output,
-      missingMessage: "Git is not installed"
-    },
-    rsync: {
-      versionCommand: "rsync --version | head -n 1",
-      parseVersion: (output) => output.match(/rsync\s+version\s+(\S+)/i)?.[1] ?? output,
-      missingMessage: "rsync is not installed"
-    }
-  },
-  installs: {
-    docker: dockerInstallPlan,
-    git: gitInstallPlan,
-    rsync: rsyncInstallPlan,
-    openresty: openrestyInstallPlan,
-    certbot: certbotInstallPlan
-  }
-};
-
-// ../../packages/adapters/src/system/available-version.ts
-var PACKAGE_NAMES = {
-  git: "git",
-  rsync: "rsync",
-  openresty: "openresty",
-  certbot: "certbot",
-  docker: null
-};
-function normalizePkgVersion(raw) {
-  let v = raw.trim();
-  const colon = v.lastIndexOf(":");
-  if (colon !== -1) v = v.slice(colon + 1);
-  const dash = v.indexOf("-");
-  if (dash !== -1) v = v.slice(0, dash);
-  return v.trim();
+function isHttpsUpgradeForSelf(body, names) {
+  const targets = [
+    ...body.matchAll(/(?:^|[\s;{])return\s+30[1-8]\s+([^;]+);/g),
+    ...body.matchAll(/(?:^|[\s;{])rewrite\s+\S+\s+([^;]+?)\s+permanent\s*;/g)
+  ].map((m) => m[1].trim());
+  if (targets.length === 0) return false;
+  return targets.every((raw) => {
+    if (!/^https:\/\//i.test(raw)) return false;
+    const authority = raw.replace(/^https:\/\//i, "").split(/[/\s]/)[0] ?? "";
+    const host = (authority.match(/^(\$[a-z_]+|[^$:]+)/i)?.[1] ?? "").replace(/:\d+$/, "");
+    if (host === "$host" || host === "$server_name" || host === "$http_host") return true;
+    return names.includes(host);
+  });
 }
-async function tryExec(executor, cmd) {
-  try {
-    return await executor.exec(cmd);
-  } catch {
-    return null;
+function parseServer(body, source, upstreams) {
+  const warnings = [];
+  const names = firstDirective(body, "server_name")?.split(/\s+/).filter((n) => n && n !== "_" && !n.startsWith("~")) ?? [];
+  const listens = [...body.matchAll(/(?:^|[;{\s])listen\s+([^;]+);/g)].map((m) => m[1]);
+  const ssl = listens.some((l) => /\bssl\b/.test(l) || /\b443\b/.test(l));
+  const root = firstDirective(body, "root");
+  const certPath = firstDirective(body, "ssl_certificate");
+  const keyPath = firstDirective(body, "ssl_certificate_key");
+  if (names.length === 0) return { warnings: [] };
+  const rawTargets = extractLocationProxies(body);
+  if (rawTargets.length === 0) {
+    const serverLevel = firstDirective(body, "proxy_pass");
+    if (serverLevel) rawTargets.push({ path: "/", proxyPass: serverLevel });
+  }
+  const resolved = [];
+  for (const t of rawTargets) {
+    const r = resolveProxyTarget(t.proxyPass, upstreams);
+    if ("reason" in r) warnings.push(`nginx: ${names[0]} ${t.path} \u2014 ${r.reason} (skipped)`);
+    else resolved.push({ path: t.path, url: r.url });
+  }
+  let target;
+  let routes;
+  if (resolved.length > 0) {
+    const primary = resolved.find((r) => r.path === "/") ?? resolved[0];
+    target = { kind: "proxy", url: primary.url };
+    routes = resolved;
+  } else if (root) {
+    target = { kind: "static", root: root.replace(/;$/, "") };
+  } else if (isHttpsUpgradeForSelf(body, names)) {
+    return { warnings: [] };
+  } else {
+    warnings.push(`nginx: ${names[0]} has neither proxy_pass nor root \u2014 skipped (${source})`);
+    return { warnings };
   }
+  const site = { serverNames: names, ssl, target, source };
+  if (routes) site.routes = routes;
+  if (certPath && keyPath) site.tls = { certPath, keyPath };
+  return { site, warnings };
 }
-async function probeCandidate(executor, pm, pkg) {
-  const q = `'${pkg.replace(/'/g, "'\\''")}'`;
-  if (pm === "apt") {
-    const out = await tryExec(executor, `apt-cache policy ${q} 2>/dev/null`);
-    return out?.match(/Candidate:\s*(\S+)/)?.[1]?.trim() ?? null;
+function parseNginxConfig(raw) {
+  const warnings = [];
+  const sites = [];
+  if (!raw.trim()) {
+    return { proxy: "nginx", sites, warnings: ["nginx: no readable configuration found"] };
   }
-  if (pm === "dnf" || pm === "yum") {
-    const out = await tryExec(
-      executor,
-      `${pm} -q --cacheonly list available ${q} 2>/dev/null | tail -n1`
-    );
-    return out?.trim().split(/\s+/)[1]?.trim() ?? null;
+  const config = stripComments(raw);
+  const upstreams = parseUpstreams(config);
+  const blocks = extractBlocks(config, "server");
+  if (blocks.length === 0) {
+    warnings.push("nginx: no server blocks found");
   }
-  if (pm === "apk") {
-    const out = await tryExec(executor, `apk policy ${q} 2>/dev/null`);
-    const versions = [...out?.matchAll(/^\s+([\w.+~-]+):\s*$/gm) ?? []].map((m) => m[1]);
-    return versions.length ? versions[versions.length - 1] : null;
+  for (const body of blocks) {
+    const { site, warnings: blockWarnings } = parseServer(body, "nginx", upstreams);
+    warnings.push(...blockWarnings);
+    if (site) sites.push(site);
   }
-  return null;
+  return { proxy: "nginx", sites, warnings };
 }
-async function enrichAvailableVersions(executor, profile, statuses) {
-  const targets = statuses.filter(
-    (s) => s.installed && s.version && PACKAGE_NAMES[s.name]
-  );
-  await Promise.all(
-    targets.map(async (s) => {
-      try {
-        const pkg = PACKAGE_NAMES[s.name];
-        const candidate = await probeCandidate(executor, profile.packageManager, pkg);
-        if (!candidate) return;
-        const avail = normalizePkgVersion(candidate);
-        const installed = normalizePkgVersion(s.version);
-        if (avail && compareSemver(avail, installed) > 0) {
-          s.availableVersion = avail;
-          s.updateAvailable = true;
-        }
-      } catch {
-      }
-    })
-  );
+async function scanNginx(executor) {
+  return parseNginxConfig(await loadNginxConfig(executor));
 }
-
-// ../../packages/adapters/src/system/components.ts
-var SYSTEM_COMPONENTS = [
-  {
-    name: "docker",
-    label: "Docker",
-    description: "Container runtime for deployments",
-    installable: true,
-    category: "core"
-  },
-  {
-    name: "git",
-    label: "Git",
-    description: "Version control for source code",
-    installable: true,
-    category: "core"
-  },
-  {
-    name: "openresty",
-    label: "OpenResty",
-    description: "Reverse proxy with Lua scripting for routing and traffic control",
-    installable: true,
-    category: "infrastructure"
-  },
-  {
-    name: "certbot",
-    label: "Certbot",
-    description: "Let's Encrypt certificate provisioning",
-    installable: true,
-    category: "infrastructure"
-  },
-  {
-    name: "rsync",
-    label: "rsync",
-    description: "Fast directory sync for remote local-build transfers",
-    installable: true,
-    category: "infrastructure"
-  }
+var OUR_EDGE_SITE_GLOBS = [
+  `${EDGE_HOST_PATHS.sitesDir}/*.conf`,
+  `${OPENRESTY_DEFAULT_PATHS.sitesDir}/*.conf`,
+  "/etc/openresty/sites-enabled/*.conf"
 ];
-var SYSTEM_COMPONENTS_BY_NAME = new Map(
-  SYSTEM_COMPONENTS.map((component) => [component.name, component])
-);
-function getSystemComponentDefinition(name) {
-  return SYSTEM_COMPONENTS_BY_NAME.get(name) ?? {
-    name,
-    label: name,
-    description: `${name} component`,
-    installable: false,
-    category: "infrastructure"
-  };
+async function scanOpenshipEdge(executor) {
+  const cat = `cat ${OUR_EDGE_SITE_GLOBS.join(" ")} 2>/dev/null`;
+  const raw = await tryExec(executor, cat);
+  if (raw?.trim()) return parseNginxConfig(raw);
+  const container = await resolveOurEdgeContainer(executor);
+  if (!container) return parseNginxConfig("");
+  const fromContainer = await tryExec(executor, containerCommand(container, cat));
+  return parseNginxConfig(fromContainer ?? "");
 }
 
-// ../../packages/adapters/src/system/checks.ts
-async function tryExec2(executor, command) {
-  const startedAt = Date.now();
-  systemDebug("checks", `exec:start ${command}`);
-  try {
-    const result = await executor.exec(command, { timeout: 1e4 });
-    systemDebug(
-      "checks",
-      `exec:ok ${command} (${formatDuration(startedAt)})`
-    );
-    return result;
-  } catch (err) {
-    if (isRemoteConnectionError(err)) {
-      systemDebug(
-        "checks",
-        `exec:abort ${command} (${formatDuration(startedAt)}) ${safeErrorMessage(err)}`
-      );
-      throw err;
+// ../../packages/adapters/src/system/proxy/import/caddy.ts
+var CADDYFILE_PATHS = ["/etc/caddy/Caddyfile", "/etc/Caddyfile"];
+async function loadCaddyJson(executor) {
+  for (const p of CADDYFILE_PATHS) {
+    const out = await tryExec(executor, `caddy adapt --adapter caddyfile --config ${p} 2>/dev/null`);
+    if (out && out.trim().startsWith("{")) return out;
+  }
+  return null;
+}
+function flattenHandlers(handlers, out = []) {
+  for (const h of handlers ?? []) {
+    if (h.handler === "subroute") {
+      for (const r of h.routes ?? []) flattenHandlers(r.handle, out);
+    } else {
+      out.push(h);
     }
-    const msg = safeErrorMessage(err);
-    systemDebug(
-      "checks",
-      `exec:fail ${command} (${formatDuration(startedAt)}) ${msg}`
-    );
-    return null;
   }
+  return out;
 }
-function healthy(name, version, running) {
-  const component = getSystemComponentDefinition(name);
-  return {
-    name,
-    label: component.label,
-    description: component.description,
-    installable: component.installable,
-    installed: true,
-    version,
-    running,
-    healthy: running !== void 0 ? running : true,
-    message: running ? `${name} ${version} - running` : `${name} ${version} - installed`
-  };
+function targetFromRoute(route) {
+  const flat = flattenHandlers(route.handle);
+  const dial = flat.find((h) => h.handler === "reverse_proxy")?.upstreams?.find((u) => u.dial)?.dial;
+  if (dial) return { kind: "proxy", url: /^https?:\/\//.test(dial) ? dial : `http://${dial}` };
+  const root = flat.find((h) => h.handler === "vars" && typeof h.root === "string")?.root;
+  if (root && flat.some((h) => h.handler === "file_server")) return { kind: "static", root };
+  return null;
 }
-function unhealthy(name, message, opts) {
-  const component = getSystemComponentDefinition(name);
-  return {
-    name,
-    label: component.label,
-    description: component.description,
-    installable: component.installable,
-    installed: !!opts?.version,
-    version: opts?.version,
-    running: opts?.running,
-    healthy: false,
-    message
-  };
-}
-async function checkDocker(executor) {
-  const startedAt = Date.now();
-  const recipe = systemCatalog.checks.docker;
-  const version = await tryExec2(executor, recipe.versionCommand);
-  if (!version) {
-    systemDebug("checks", `docker:missing (${formatDuration(startedAt)})`);
-    return unhealthy("docker", recipe.missingMessage);
+function parseCaddyJson(raw) {
+  let cfg;
+  try {
+    cfg = JSON.parse(raw);
+  } catch {
+    return null;
   }
-  const parsed = recipe.parseVersion(version);
-  const info = await tryExec2(executor, recipe.daemonCommand);
-  if (!info) {
-    systemDebug("checks", `docker:not-running (${formatDuration(startedAt)})`);
-    return unhealthy("docker", recipe.notRunningMessage, {
-      version: parsed,
-      running: false
-    });
+  const servers = cfg.apps?.http?.servers;
+  if (!servers) return null;
+  const sites = [];
+  for (const srv of Object.values(servers)) {
+    const ssl = (srv.listen ?? []).some((l) => l.endsWith(":443"));
+    for (const route of srv.routes ?? []) {
+      const hosts = (route.match ?? []).flatMap((m) => m.host ?? []).filter((h) => h && h !== "*");
+      if (hosts.length === 0) continue;
+      const target = targetFromRoute(route);
+      if (!target) continue;
+      sites.push({ serverNames: hosts, ssl, target, source: "caddy (adapt)" });
+    }
   }
-  systemDebug("checks", `docker:healthy (${formatDuration(startedAt)})`);
-  return healthy("docker", parsed, true);
+  return { sites, warnings: [] };
 }
-async function checkGit(executor) {
-  const startedAt = Date.now();
-  const recipe = systemCatalog.checks.git;
-  const version = await tryExec2(executor, recipe.versionCommand);
-  if (!version) {
-    systemDebug("checks", `git:missing (${formatDuration(startedAt)})`);
-    return unhealthy("git", recipe.missingMessage);
+async function loadCaddyfile(executor) {
+  for (const p of CADDYFILE_PATHS) {
+    const out = await tryExec(executor, `cat ${p} 2>/dev/null`);
+    if (out && out.trim()) return out;
   }
-  const parsed = recipe.parseVersion(version);
-  systemDebug("checks", `git:healthy (${formatDuration(startedAt)})`);
-  return healthy("git", parsed);
+  return "";
 }
-async function checkRsync(executor) {
-  const startedAt = Date.now();
-  const recipe = systemCatalog.checks.rsync;
-  const version = await tryExec2(executor, recipe.versionCommand);
-  if (!version) {
-    systemDebug("checks", `rsync:missing (${formatDuration(startedAt)})`);
-    return unhealthy("rsync", recipe.missingMessage);
+function caddyBlocks(text) {
+  const out = [];
+  let i = 0;
+  let headerStart = 0;
+  while (i < text.length) {
+    if (text[i] === "{") {
+      const header = text.slice(headerStart, i).trim();
+      let depth = 1;
+      let j = i + 1;
+      for (; j < text.length && depth > 0; j++) {
+        if (text[j] === "{") depth++;
+        else if (text[j] === "}") depth--;
+      }
+      if (depth !== 0) break;
+      out.push({ header, body: text.slice(i + 1, j - 1) });
+      i = j;
+      headerStart = j;
+    } else {
+      i++;
+    }
   }
-  const parsed = recipe.parseVersion(version);
-  systemDebug("checks", `rsync:healthy (${formatDuration(startedAt)})`);
-  return healthy("rsync", parsed);
+  return out;
 }
-async function checkOpenResty(executor) {
-  const startedAt = Date.now();
-  const recipe = systemCatalog.checks.openresty;
-  const version = await tryExec2(executor, recipe.versionCommand);
-  if (!version) {
-    systemDebug("checks", `openresty:missing (${formatDuration(startedAt)})`);
-    return unhealthy("openresty", recipe.missingMessage);
+function parseAddresses(header) {
+  return header.split(/[\s,]+/).filter(Boolean).map((addr) => {
+    const httpScheme = /^http:\/\//i.test(addr);
+    const host = addr.replace(/^https?:\/\//i, "").replace(/:\d+$/, "");
+    const isPort80 = /:80$/.test(addr);
+    return { host, ssl: !httpScheme && !isPort80 };
+  }).filter((a) => a.host && !a.host.startsWith(":") && a.host !== "*");
+}
+async function scanCaddy(executor) {
+  const json = await loadCaddyJson(executor);
+  if (json) {
+    const parsed = parseCaddyJson(json);
+    if (parsed && parsed.sites.length > 0) {
+      return { proxy: "caddy", sites: parsed.sites, warnings: parsed.warnings };
+    }
   }
-  const parsed = recipe.parseVersion(version);
-  const runningChecks = await Promise.all(
-    recipe.runningCommands.map((command) => tryExec2(executor, command))
-  );
-  const running = runningChecks.some(Boolean);
-  if (!running) {
-    systemDebug("checks", `openresty:not-running (${formatDuration(startedAt)})`);
-    return unhealthy("openresty", recipe.notRunningMessage, {
-      version: parsed,
-      running: false
-    });
+  return scanCaddyText(executor);
+}
+async function scanCaddyText(executor) {
+  const raw = await loadCaddyfile(executor);
+  const warnings = [];
+  const sites = [];
+  if (!raw.trim()) {
+    return { proxy: "caddy", sites, warnings: ["caddy: no readable Caddyfile found"] };
+  }
+  const text = stripComments(raw);
+  let blocks = caddyBlocks(text);
+  if (blocks.length === 0) {
+    const lines = text.split("\n").map((l) => l.trim()).filter(Boolean);
+    if (lines.length > 0) {
+      blocks = [{ header: lines[0], body: lines.slice(1).join("\n") }];
+    } else {
+      warnings.push("caddy: config present but no parseable site blocks");
+    }
+  }
+  for (const { header, body } of blocks) {
+    if (!header) continue;
+    const addrs = parseAddresses(header);
+    if (addrs.length === 0) {
+      warnings.push(`caddy: skipped a block with no usable address (${header.slice(0, 40)})`);
+      continue;
+    }
+    const proxyMatch = body.match(/(?:^|\s)reverse_proxy\s+([^\n{]+)/);
+    const rootMatch = body.match(/(?:^|\s)root\s+\*?\s*([^\n\s]+)/);
+    const tlsMatch = body.match(/(?:^|\s)tls\s+(\S+)\s+(\S+)/);
+    let target;
+    if (proxyMatch) {
+      const upstream = proxyMatch[1].trim().split(/\s+/)[0];
+      target = { kind: "proxy", url: /^https?:\/\//.test(upstream) ? upstream : `http://${upstream}` };
+    } else if (rootMatch) {
+      target = { kind: "static", root: rootMatch[1] };
+    } else {
+      warnings.push(`caddy: ${addrs[0].host} has no reverse_proxy or root \u2014 skipped`);
+      continue;
+    }
+    const site = {
+      serverNames: addrs.map((a) => a.host),
+      ssl: addrs.some((a) => a.ssl),
+      target,
+      source: "caddy"
+    };
+    if (tlsMatch && tlsMatch[1].includes("/")) {
+      site.tls = { certPath: tlsMatch[1], keyPath: tlsMatch[2] };
+    }
+    sites.push(site);
   }
-  const hasLua = await tryExec2(
+  return { proxy: "caddy", sites, warnings };
+}
+
+// ../../packages/adapters/src/system/proxy/import/apache.ts
+async function vhostFilesFromDump(executor) {
+  const dump = await tryExec(
     executor,
-    `test -f ${OPENRESTY_LUA_DIR}/site_logger.lua && test -f ${OPENRESTY_LUA_DIR}/pipe_stream.lua && echo ok`
+    "apachectl -S 2>/dev/null || apache2ctl -S 2>/dev/null || httpd -S 2>/dev/null"
   );
-  if (!hasLua) {
-    systemDebug("checks", `openresty:missing-lua (${formatDuration(startedAt)})`);
-    return unhealthy(
-      "openresty",
-      "OpenResty is running but analytics scripts are not deployed - reinstall to fix",
-      { version: parsed, running: true }
-    );
+  if (!dump) return [];
+  const files = /* @__PURE__ */ new Set();
+  for (const m of dump.matchAll(/\(([^()]+?):\d+\)/g)) {
+    const f = m[1].trim();
+    if (f.startsWith("/")) files.add(f);
   }
-  systemDebug("checks", `openresty:healthy (${formatDuration(startedAt)})`);
-  return healthy("openresty", parsed, true);
+  return [...files];
 }
-async function checkCertbot(executor) {
-  const startedAt = Date.now();
-  const recipe = systemCatalog.checks.certbot;
-  const version = await tryExec2(executor, recipe.versionCommand);
-  if (!version) {
-    systemDebug("checks", `certbot:missing (${formatDuration(startedAt)})`);
-    return unhealthy("certbot", recipe.missingMessage);
+async function loadApacheConfig(executor) {
+  const files = await vhostFilesFromDump(executor);
+  if (files.length > 0) {
+    const cat2 = await tryExec(executor, `cat ${files.map(sq3).join(" ")} 2>/dev/null`);
+    if (cat2 && cat2.trim()) return cat2;
   }
-  const parsed = recipe.parseVersion(version);
-  systemDebug("checks", `certbot:healthy (${formatDuration(startedAt)})`);
-  return healthy("certbot", parsed);
-}
-var COMPONENT_CHECKS = {
-  docker: checkDocker,
-  openresty: checkOpenResty,
-  certbot: checkCertbot,
-  git: checkGit,
-  rsync: checkRsync
-};
-async function mapWithConcurrency(items, limit, fn) {
-  const results = new Array(items.length);
-  let cursor = 0;
-  const worker = async () => {
-    while (cursor < items.length) {
-      const index = cursor++;
-      results[index] = await fn(items[index]);
-    }
-  };
-  await Promise.all(
-    Array.from({ length: Math.min(limit, items.length) }, worker)
+  const cat = await tryExec(
+    executor,
+    "cat /etc/apache2/sites-enabled/*.conf /etc/apache2/apache2.conf /etc/httpd/conf.d/*.conf /etc/httpd/conf/httpd.conf 2>/dev/null"
   );
-  return results;
+  return cat ?? "";
 }
-var CHECK_CONCURRENCY = 4;
-async function checkAll(executor) {
-  const startedAt = Date.now();
-  const entries = SYSTEM_COMPONENTS.map((component) => [component.name, COMPONENT_CHECKS[component.name]]).filter((entry) => Boolean(entry[1]));
-  systemDebug(
-    "checks",
-    `checkAll:start [${entries.map(([name]) => name).join(", ")}]`
-  );
-  const results = await mapWithConcurrency(
-    entries,
-    CHECK_CONCURRENCY,
-    ([, fn]) => fn(executor)
+function directive(body, name) {
+  const m = body.match(new RegExp(`(?:^|\\n)\\s*${name}\\s+([^\\n]+)`, "i"));
+  return m?.[1]?.trim();
+}
+function directiveAll(body, name) {
+  return [...body.matchAll(new RegExp(`(?:^|\\n)\\s*${name}\\s+([^\\n]+)`, "gi"))].map(
+    (m) => m[1].trim()
   );
-  await enrichAvailable(executor, results);
-  systemDebug("checks", `checkAll:done (${formatDuration(startedAt)})`);
-  return results;
 }
-async function enrichAvailable(executor, results) {
-  try {
-    const profile = await resolveEnvironment(executor);
-    await enrichAvailableVersions(executor, profile, results);
-  } catch {
+function parseVhost(body, portHint) {
+  const serverName = directive(body, "ServerName")?.split(/\s+/)[0];
+  const aliases = directiveAll(body, "ServerAlias").flatMap((line) => line.split(/\s+/));
+  const names = [serverName, ...aliases].filter((n) => Boolean(n));
+  if (names.length === 0) {
+    return { warning: "apache: skipped a VirtualHost with no ServerName" };
+  }
+  const routes = [...body.matchAll(/(?:^|\n)\s*ProxyPass\s+(\S+)\s+(\S+)/gi)].map((m) => ({ path: m[1], url: m[2] })).filter((p) => p.url && p.url !== "!");
+  const docRoot = directive(body, "DocumentRoot")?.replace(/^["']|["']$/g, "");
+  const certPath = directive(body, "SSLCertificateFile");
+  const keyPath = directive(body, "SSLCertificateKeyFile");
+  const ssl = /:443/.test(portHint) || /SSLEngine\s+on/i.test(body) || Boolean(certPath);
+  let target;
+  if (routes.length > 0) {
+    const primary = routes.find((r) => r.path === "/") ?? routes[0];
+    target = { kind: "proxy", url: primary.url };
+  } else if (docRoot) {
+    target = { kind: "static", root: docRoot };
+  } else {
+    return { warning: `apache: ${names[0]} has neither ProxyPass nor DocumentRoot \u2014 skipped` };
   }
+  const site = { serverNames: names, ssl, target, source: "apache" };
+  if (routes.length > 0) site.routes = routes;
+  if (certPath && keyPath) site.tls = { certPath, keyPath };
+  return site;
 }
-async function checkComponents(executor, names) {
-  const startedAt = Date.now();
-  const fns = names.map((name) => COMPONENT_CHECKS[name]).filter((fn) => Boolean(fn));
-  systemDebug("checks", `checkComponents:start [${names.join(", ")}]`);
-  const results = await mapWithConcurrency(
-    fns,
-    CHECK_CONCURRENCY,
-    (fn) => fn(executor)
-  );
-  await enrichAvailable(executor, results);
-  systemDebug(
-    "checks",
-    `checkComponents:done [${names.join(", ")}] (${formatDuration(startedAt)})`
-  );
-  return results;
+function vhostBlocks(text) {
+  const out = [];
+  const re = /<VirtualHost([^>]*)>([\s\S]*?)<\/VirtualHost>/gi;
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    out.push({ args: m[1].trim(), body: m[2] });
+  }
+  return out;
+}
+async function scanApache(executor) {
+  const raw = await loadApacheConfig(executor);
+  const warnings = [];
+  const sites = [];
+  if (!raw.trim()) {
+    return { proxy: "apache", sites, warnings: ["apache: no readable configuration found"] };
+  }
+  const text = stripComments(raw);
+  const blocks = vhostBlocks(text);
+  if (blocks.length === 0) warnings.push("apache: no <VirtualHost> blocks found");
+  for (const { args, body } of blocks) {
+    const parsed = parseVhost(body, args);
+    if ("warning" in parsed) warnings.push(parsed.warning);
+    else sites.push(parsed);
+  }
+  return { proxy: "apache", sites, warnings };
 }
 
-// ../../packages/adapters/src/system/elevated-executor.ts
-var INSTALL_ENV = "DEBIAN_FRONTEND=noninteractive DPKG_FORCE=confnew";
-function elevateCommand(command) {
-  return `sudo -n sh -c ${sq(`export ${INSTALL_ENV}; ${command}`)}`;
+// ../../packages/adapters/src/system/proxy/import/traefik.ts
+function extractHosts(rule) {
+  const hosts = [];
+  for (const call of rule.matchAll(/\bHost\(([^)]*)\)/gi)) {
+    for (const m of call[1].matchAll(/[`'"]([^`'"]+)[`'"]/g)) {
+      const h = m[1].trim();
+      if (h) hosts.push(h);
+    }
+  }
+  return hosts;
 }
-function dirOf(path) {
-  const idx = path.lastIndexOf("/");
-  if (idx < 0) return ".";
-  return idx === 0 ? "/" : path.slice(0, idx);
+function extraMatchers(rule) {
+  const found = /* @__PURE__ */ new Set();
+  for (const m of rule.matchAll(
+    /\b(PathPrefix|PathRegexp|Path|HeadersRegexp|Headers|Method|Query|ClientIP|HostRegexp)\b/gi
+  )) {
+    found.add(m[1]);
+  }
+  return [...found];
 }
-function elevatedExecutor(inner) {
-  const writeFileElevated = async (path, content) => {
-    const tmp = `/tmp/.openship-elev-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
-    await inner.writeFile(tmp, content);
-    await inner.exec(
-      elevateCommand(`mkdir -p ${sq(dirOf(path))} && mv -f ${sq(tmp)} ${sq(path)}`)
-    );
-  };
-  const overrides = {
-    exec: (command, opts) => inner.exec(elevateCommand(command), opts),
-    streamExec: (command, onLog) => inner.streamExec(elevateCommand(command), onLog),
-    writeFile: writeFileElevated,
-    mkdir: async (path) => {
-      await inner.exec(elevateCommand(`mkdir -p ${sq(path)}`));
-    },
-    rm: async (path) => {
-      await inner.exec(elevateCommand(`rm -rf ${sq(path)}`));
+function parseTraefikLabels(containers) {
+  const sites = [];
+  const warnings = [];
+  for (const c of containers) {
+    if (c.labels["traefik.enable"] === "false") continue;
+    const routers = /* @__PURE__ */ new Map();
+    const servicePorts = /* @__PURE__ */ new Map();
+    for (const [key, val] of Object.entries(c.labels)) {
+      const r = key.match(/^traefik\.http\.routers\.([^.]+)\.(.+)$/);
+      if (r) {
+        const bag = routers.get(r[1]) ?? {};
+        bag[r[2]] = val;
+        routers.set(r[1], bag);
+        continue;
+      }
+      const s = key.match(/^traefik\.http\.services\.([^.]+)\.loadbalancer\.server\.port$/);
+      if (s) servicePorts.set(s[1], val);
     }
-  };
-  return new Proxy(inner, {
-    get(target, prop) {
-      if (Object.prototype.hasOwnProperty.call(overrides, prop)) {
-        return overrides[prop];
+    for (const [rname, props] of routers) {
+      const rule = props.rule;
+      if (!rule) continue;
+      const hosts = extractHosts(rule);
+      if (hosts.length === 0) {
+        warnings.push(
+          /HostRegexp/i.test(rule) ? `traefik: router "${rname}" uses HostRegexp (${rule}) \u2014 regex hosts aren't migratable` : `traefik: router "${rname}" has no Host() rule (${rule}) \u2014 skipped`
+        );
+        continue;
       }
-      const value = Reflect.get(target, prop, target);
-      return typeof value === "function" ? value.bind(target) : value;
+      if (!c.ip) {
+        warnings.push(
+          `traefik: ${hosts.join(", ")} \u2014 couldn't resolve container ${c.name}'s IP; re-add the upstream manually`
+        );
+        continue;
+      }
+      const svc = props.service;
+      const rawPort = (svc && servicePorts.get(svc)) ?? (servicePorts.size === 1 ? [...servicePorts.values()][0] : void 0) ?? "80";
+      const port = /^\d{1,5}$/.test(String(rawPort)) ? String(rawPort) : "80";
+      const url = `http://${c.ip}:${port}`;
+      const extras = extraMatchers(rule);
+      if (extras.length > 0) {
+        warnings.push(
+          `traefik: ${hosts.join(", ")} also matches ${extras.join(", ")} \u2014 only the Host() part is migrated; re-add path/header rules manually`
+        );
+      }
+      if (props.middlewares) {
+        warnings.push(`traefik: ${hosts.join(", ")} uses middleware(s) "${props.middlewares}" \u2014 not migrated`);
+      }
+      const ssl = Object.keys(props).some((p) => p === "tls" || p.startsWith("tls."));
+      sites.push({
+        serverNames: hosts,
+        ssl,
+        target: { kind: "proxy", url },
+        source: `traefik container ${c.name}`
+      });
     }
-  });
+  }
+  return { proxy: "traefik", sites, warnings };
 }
-
-// ../../packages/adapters/src/system/proxy/detect.ts
-var EDGE_PORTS = [80, 443];
-var EdgeConflictError = class extends AppError {
-  constructor(status) {
-    super(
-      `Ports ${status.occupants.map((o) => o.port).join("/") || "80/443"} are in use by another service (${status.classification}). Accept a migrate or takeover to continue.`,
-      409,
-      "EDGE_CONFLICT"
-    );
-    this.status = status;
-    this.name = "EdgeConflictError";
+async function scanTraefik(executor) {
+  const out = await tryExec(
+    executor,
+    "docker ps -q 2>/dev/null | xargs -r docker inspect --format '{{.Name}}	{{json .Config.Labels}}	{{range .NetworkSettings.Networks}}{{.IPAddress}} {{end}}' 2>/dev/null"
+  );
+  if (!out) {
+    return { proxy: "traefik", sites: [], warnings: ["traefik: couldn't read container labels via docker inspect"] };
   }
-};
-var EdgeMigrateRequested = class extends Error {
-  constructor(status, sites, warnings = []) {
-    super("Edge migration requested by user");
-    this.status = status;
-    this.sites = sites;
-    this.warnings = warnings;
-    this.name = "EdgeMigrateRequested";
+  const containers = [];
+  for (const line of out.split("\n")) {
+    const [rawName, rawLabels, rawIps] = line.split("	");
+    if (!rawName || !rawLabels) continue;
+    let labels;
+    try {
+      labels = JSON.parse(rawLabels) ?? {};
+    } catch {
+      continue;
+    }
+    if (!Object.keys(labels).some((k) => k.startsWith("traefik."))) continue;
+    const ip = (rawIps ?? "").trim().split(/\s+/)[0] || void 0;
+    containers.push({ name: rawName.replace(/^\//, ""), labels, ip });
   }
-};
-async function tryExec3(executor, command) {
+  return parseTraefikLabels(containers);
+}
+
+// ../../packages/adapters/src/system/proxy/import/index.ts
+var INSTALLED_MARKERS = [
+  { proxy: "nginx", paths: ["/etc/nginx/nginx.conf"] },
+  { proxy: "caddy", paths: ["/etc/caddy/Caddyfile"] },
+  { proxy: "apache", paths: ["/etc/apache2/apache2.conf", "/etc/httpd/conf/httpd.conf"] },
+  {
+    proxy: "openresty",
+    paths: ["/usr/local/openresty/nginx/conf/nginx.conf", "/etc/openresty/nginx.conf"]
+  }
+];
+async function detectInstalledProxy(executor) {
+  const probe = INSTALLED_MARKERS.map(({ proxy, paths }) => {
+    const test = paths.map((p) => `[ -f '${p}' ]`).join(" || ");
+    return `{ ${test}; } && echo ${proxy}`;
+  }).join("; ");
+  let out = "";
   try {
-    return await executor.exec(command);
+    out = await executor.exec(`{ ${probe}; } 2>/dev/null; true`, { timeout: 1e4 });
   } catch {
     return null;
   }
-}
-function classifyProxy(text) {
-  if (!text) return void 0;
-  const t = text.toLowerCase();
-  if (t.includes("openresty")) return "openresty";
-  if (/(^|[\s/:])nginx/.test(t)) return "nginx";
-  if (/(^|[\s/:])caddy/.test(t)) return "caddy";
-  if (/(apache2|httpd)/.test(t)) return "apache";
-  if (/(^|[\s/:])traefik/.test(t)) return "traefik";
-  if (/(^|[\s/:])haproxy/.test(t)) return "haproxy";
-  return void 0;
-}
-function sq2(value) {
-  return `'${value.replace(/'/g, "'\\''")}'`;
-}
-function isOurEdgeContainer(name, image) {
-  return /openship-edge/i.test(`${name ?? ""} ${image ?? ""}`);
-}
-async function ourEdgeContainerRunning(executor) {
-  const byName = await tryExec3(
-    executor,
-    `docker ps --filter name=openship-edge --format '{{.Names}}' 2>/dev/null | head -1`
-  );
-  if (byName && byName.trim()) return true;
-  const all = await tryExec3(executor, `docker ps --format '{{.Names}}	{{.Image}}' 2>/dev/null`);
-  if (!all) return false;
-  return all.split("\n").map((line) => line.trim()).filter(Boolean).some((line) => {
-    const [name, image] = line.split("	");
-    return isOurEdgeContainer(name, image);
-  });
-}
-async function ourLuaOnHost(executor) {
-  const lua = await tryExec3(
-    executor,
-    `test -f ${OPENRESTY_LUA_DIR}/site_logger.lua && echo ok`
+  const found = new Set(
+    out.split("\n").map((l) => l.trim()).filter(Boolean)
   );
-  return Boolean(lua && lua.includes("ok"));
+  return INSTALLED_MARKERS.find((m) => found.has(m.proxy))?.proxy ?? null;
 }
-async function detectDockerOnPort(executor, port) {
-  const out = await tryExec3(
-    executor,
-    `docker ps --filter publish=${port} --format '{{.Names}}	{{.Image}}' 2>/dev/null | head -1`
-  );
-  const line = out?.trim();
-  if (!line) return null;
-  const [name, image] = line.split("	");
-  if (!name) return null;
-  return { name, image: image ?? "" };
-}
-async function listenerIsOurOpenResty(executor, listener) {
-  if (!listener) return false;
-  if (/openresty/i.test(`${listener.rawCommand ?? ""} ${listener.command ?? ""}`)) return true;
-  if (listener.pid) {
-    const exe = await tryExec3(executor, `readlink -f /proc/${listener.pid}/exe 2>/dev/null || true`);
-    if (exe && /openresty/i.test(exe)) return true;
-  }
-  return false;
-}
-var WORKER_RE = /\b(?:nginx|openresty)\s*:\s*worker process/i;
-var MASTER_RE = /\b(?:nginx|openresty)\s*:\s*master process/i;
-async function resolveProxyMaster(executor, listener) {
-  if (!listener?.pid) return listener;
-  if (!WORKER_RE.test(`${listener.rawCommand ?? ""} ${listener.command ?? ""}`)) return listener;
-  const ppidRaw = await tryExec3(
-    executor,
-    `awk '/^PPid:/{print $2}' /proc/${listener.pid}/status 2>/dev/null || true`
-  );
-  const ppid = Number.parseInt((ppidRaw ?? "").trim(), 10);
-  if (!Number.isInteger(ppid) || ppid <= 1) return listener;
-  const master = await describeProcess(executor, ppid);
-  if (!master || !MASTER_RE.test(`${master.rawCommand ?? ""} ${master.command ?? ""}`)) {
-    return listener;
-  }
-  return master;
-}
-async function probeEdgePort(executor, port, ours) {
-  const listener = await resolveProxyMaster(executor, await probeListeningPort(executor, port));
-  const docker = await detectDockerOnPort(executor, port);
-  if (!listener && !docker) return null;
-  const proxy = classifyProxy(
-    [
-      docker?.image,
-      docker?.name,
-      listener?.rawCommand,
-      listener?.command,
-      listener?.systemdUnit
-    ].filter(Boolean).join(" ")
-  );
-  const foreignDockerProxy = Boolean(docker) && !isOurEdgeContainer(docker?.name, docker?.image);
-  const managedByOpenship = isOurEdgeContainer(docker?.name, docker?.image) || ours.containerRunning && !foreignDockerProxy || !docker && ours.luaOnHost && await listenerIsOurOpenResty(executor, listener);
-  return {
-    port,
-    pid: listener?.pid ?? void 0,
-    command: docker ? `docker container ${docker.name} (${docker.image})` : listener?.command,
-    rawCommand: listener?.rawCommand,
-    systemdUnit: listener?.systemdUnit,
-    systemdDescription: listener?.systemdDescription,
-    isDocker: Boolean(docker),
-    containerName: docker?.name,
-    proxy,
-    managedByOpenship
-  };
+async function scanImportableSites(executor, proxy) {
+  switch (proxy) {
+    case "nginx":
+      return scanNginx(executor);
+    case "caddy":
+      return scanCaddy(executor);
+    case "apache":
+      return scanApache(executor);
+    case "traefik":
+      return scanTraefik(executor);
+    case "openresty":
+      return scanOpenshipEdge(executor);
+    default:
+      return {
+        proxy,
+        sites: [],
+        warnings: [`${proxy}: config import not supported \u2014 takeover only`]
+      };
+  }
 }
-async function probeEdge(executor) {
-  const containerRunning = await ourEdgeContainerRunning(executor);
-  const luaOnHost = await ourLuaOnHost(executor);
-  const all = [];
-  for (const port of EDGE_PORTS) {
-    const occ = await probeEdgePort(executor, port, { containerRunning, luaOnHost });
-    if (occ) all.push(occ);
-  }
-  const foreign = all.filter((o) => !o.managedByOpenship);
-  let classification;
-  if (all.length === 0) classification = "free";
-  else if (foreign.length === 0) classification = "ours";
-  else if (foreign.every((o) => o.proxy && o.proxy !== "openresty")) classification = "known";
-  else classification = "unknown";
-  return {
-    classification,
-    occupants: foreign,
-    canProceedClean: classification === "free" || classification === "ours"
-  };
+function canImportProxy(proxy) {
+  return proxy === "nginx" || proxy === "caddy" || proxy === "apache" || proxy === "traefik" || proxy === "openresty";
 }
-function stopTargetsForStatus(status) {
-  const out = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const o of status.occupants) {
-    const identity = o.systemdUnit ?? o.containerName ?? (o.pid ? `pid:${o.pid}` : `port:${o.port}`);
-    if (seen.has(identity)) continue;
-    seen.add(identity);
-    out.push({
-      port: o.port,
-      unit: o.systemdUnit,
-      pid: o.pid,
-      container: o.containerName,
-      // Prefer the proxy kind over the raw cmdline — `nginx (PID 123)` reads
-      // better in "Stopping …" than `nginx: master process /usr/sbin/nginx …`.
-      label: o.proxy && o.pid ? `${o.proxy} (PID ${o.pid})` : o.command
-    });
+
+// ../../packages/adapters/src/system/proxy/import/caddy-certs.ts
+var CADDY_DATA_ROOTS = [
+  "/var/lib/caddy/.local/share/caddy",
+  "/root/.local/share/caddy",
+  "/home/caddy/.local/share/caddy",
+  "/data/caddy"
+];
+function candidateNames(host) {
+  const names = [host];
+  const dot = host.indexOf(".");
+  if (dot > 0) names.push(`wildcard_${host.slice(dot)}`);
+  return names;
+}
+async function findPairIn(exec, root, host, container) {
+  for (const name of candidateNames(host)) {
+    const glob = `${root}/certificates/*/${name}/${name}.crt`;
+    let certPath = firstCrt(await tryExec(exec, `ls -1 ${glob} 2>/dev/null`));
+    if (!certPath && container) {
+      certPath = firstCrt(
+        await tryExec(exec, containerCommand(container, `ls -1 ${glob} 2>/dev/null`))
+      );
+    }
+    if (certPath) return { certPath, keyPath: certPath.replace(/\.crt$/, ".key") };
   }
-  return out;
+  return null;
 }
-async function freeEdgeTargets(executor, targets, onLog) {
-  for (const t of targets) {
-    const where = t.port ? ` (port ${t.port})` : "";
-    if (t.container) {
-      onLog(`Stopping container ${t.container}${where}...`, "warn");
-      await tryExec3(executor, `docker update --restart=no ${sq2(t.container)} 2>/dev/null || true`);
-      await tryExec3(executor, `docker stop ${sq2(t.container)} 2>/dev/null || true`);
-    } else if (t.unit) {
-      onLog(`Stopping & disabling service ${t.unit}${where}...`, "warn");
-      await tryExec3(
-        executor,
-        `systemctl disable --now ${sq2(t.unit)} 2>/dev/null || systemctl stop ${sq2(t.unit)} 2>/dev/null || true; systemctl reset-failed ${sq2(t.unit)} 2>/dev/null || true`
-      );
-    } else if (t.pid) {
-      onLog(`Stopping ${t.label ?? `process ${t.pid}`}${where}...`, "warn");
-      await tryExec3(executor, `kill ${t.pid} 2>/dev/null || true`);
-      await new Promise((r) => setTimeout(r, 800));
-      await tryExec3(executor, `kill -9 ${t.pid} 2>/dev/null || true`);
+function firstCrt(listing) {
+  return (listing ?? "").split("\n").map((l) => l.trim()).find((l) => l.endsWith(".crt"));
+}
+async function caddyStoreCert(exec, host, container) {
+  for (const root of CADDY_DATA_ROOTS) {
+    const pair = await findPairIn(exec, root, host, container);
+    if (!pair) continue;
+    const certPem = await readMaybeInContainer(exec, pair.certPath, container);
+    const keyPem = await readMaybeInContainer(exec, pair.keyPath, container);
+    if (certPem.trim() && keyPem.trim()) {
+      return { certPem, keyPem, source: `caddy store ${pair.certPath}` };
     }
   }
-  await new Promise((r) => setTimeout(r, 1e3));
+  return null;
 }
 
-// ../../packages/adapters/src/system/proxy/import/parse-utils.ts
-async function tryExec4(executor, command) {
+// ../../packages/adapters/src/system/proxy/import/traefik-certs.ts
+var DEFAULT_ACME_PATHS = ["/acme.json", "/etc/traefik/acme.json", "/data/acme.json", "/letsencrypt/acme.json"];
+var TRAEFIK_STATIC_CONFIGS = [
+  "/etc/traefik/traefik.yml",
+  "/etc/traefik/traefik.yaml",
+  "/etc/traefik/traefik.toml"
+];
+function prop(obj, name) {
+  const hit = Object.keys(obj).find((k) => k.toLowerCase() === name.toLowerCase());
+  return hit === void 0 ? void 0 : obj[hit];
+}
+async function candidateStoragePaths(exec, container) {
+  const found = [];
+  const collect = (text) => {
+    for (const m of (text ?? "").matchAll(/acme\.storage[=:\s]+["']?(\/[^\s"',}]+)/gi)) {
+      if (isSafeCertPath(m[1])) found.push(m[1]);
+    }
+    for (const m of (text ?? "").matchAll(/(?:^|\s)storage:\s*["']?(\/[^\s"',}]+\.json)/gi)) {
+      if (isSafeCertPath(m[1])) found.push(m[1]);
+    }
+  };
+  if (container) {
+    collect(
+      await tryExec(
+        exec,
+        `docker inspect ${sq2(container)} --format '{{json .Config.Cmd}} {{json .Args}} {{json .Config.Env}}' 2>/dev/null`
+      )
+    );
+    for (const cfg of TRAEFIK_STATIC_CONFIGS) {
+      collect(await readMaybeInContainer(exec, cfg, container));
+    }
+  }
+  return [.../* @__PURE__ */ new Set([...found, ...DEFAULT_ACME_PATHS])];
+}
+async function loadAcmeJson(exec, container) {
+  for (const path of await candidateStoragePaths(exec, container)) {
+    const raw = await readMaybeInContainer(exec, path, container);
+    if (raw.trim().startsWith("{")) return { raw, path };
+  }
+  return null;
+}
+function certFromAcmeJson(raw, host) {
+  let parsed;
   try {
-    return await executor.exec(command);
+    parsed = JSON.parse(raw);
   } catch {
     return null;
   }
+  const target = host.toLowerCase();
+  const matches = (name) => {
+    const n = (name ?? "").toLowerCase();
+    if (!n) return false;
+    if (n === target) return true;
+    if (!n.startsWith("*.")) return false;
+    const suffix = n.slice(1);
+    return target.endsWith(suffix) && !target.slice(0, -suffix.length).includes(".");
+  };
+  for (const [resolver, value] of Object.entries(parsed)) {
+    if (!value || typeof value !== "object") continue;
+    const certs = prop(value, "certificates");
+    if (!Array.isArray(certs)) continue;
+    for (const entry of certs) {
+      const domain = entry && prop(entry, "domain");
+      const names = [domain?.main, ...domain?.sans ?? []];
+      if (!names.some(matches)) continue;
+      const certB64 = prop(entry, "certificate");
+      const keyB64 = prop(entry, "key");
+      if (typeof certB64 !== "string" || typeof keyB64 !== "string") continue;
+      const certPem = Buffer.from(certB64, "base64").toString("utf-8");
+      const keyPem = Buffer.from(keyB64, "base64").toString("utf-8");
+      if (!certPem.includes("-----BEGIN") || !keyPem.includes("-----BEGIN")) continue;
+      return { certPem, keyPem, resolver };
+    }
+  }
+  return null;
 }
-function stripComments(text) {
-  return text.replace(/#.*$/gm, "");
+async function traefikAcmeCert(exec, host, container) {
+  const loaded = await loadAcmeJson(exec, container);
+  if (!loaded) return null;
+  const hit = certFromAcmeJson(loaded.raw, host);
+  if (!hit) return null;
+  return {
+    certPem: hit.certPem,
+    keyPem: hit.keyPem,
+    source: `traefik ${loaded.path} (resolver ${hit.resolver})`
+  };
 }
-function extractBlocks(text, keyword) {
-  const blocks = [];
-  const re = new RegExp(`(?:^|[\\s;}])${keyword}\\b[^{;]*\\{`, "g");
-  let m;
-  while ((m = re.exec(text)) !== null) {
-    const openIdx = m.index + m[0].length - 1;
-    let depth = 1;
-    let i = openIdx + 1;
-    for (; i < text.length && depth > 0; i++) {
-      if (text[i] === "{") depth++;
-      else if (text[i] === "}") depth--;
-    }
-    if (depth === 0) {
-      blocks.push(text.slice(openIdx + 1, i - 1));
-      re.lastIndex = i;
-    } else {
-      break;
+async function traefikDeclaredCertPaths(exec, container) {
+  const pairs = [];
+  for (const cfg of TRAEFIK_STATIC_CONFIGS) {
+    const text = await readMaybeInContainer(exec, cfg, container);
+    if (!text.trim()) continue;
+    const certFiles = [...text.matchAll(/certFile:\s*["']?(\/[^\s"',}]+)/gi)].map((m) => m[1]);
+    const keyFiles = [...text.matchAll(/keyFile:\s*["']?(\/[^\s"',}]+)/gi)].map((m) => m[1]);
+    for (let i = 0; i < Math.min(certFiles.length, keyFiles.length); i++) {
+      if (isSafeCertPath(certFiles[i]) && isSafeCertPath(keyFiles[i])) {
+        pairs.push({ certPath: certFiles[i], keyPath: keyFiles[i] });
+      }
     }
   }
-  return blocks;
-}
-function sq3(value) {
-  return `'${value.replace(/'/g, "'\\''")}'`;
+  return pairs;
 }
 
-// ../../packages/adapters/src/system/proxy/import/nginx.ts
-async function loadNginxConfig(executor) {
-  const dumped = await tryExec4(executor, "nginx -T 2>/dev/null");
-  if (dumped && /server\s*\{/.test(dumped)) return dumped;
-  const cat = await tryExec4(
-    executor,
-    "cat /etc/nginx/nginx.conf /etc/nginx/sites-enabled/* /etc/nginx/conf.d/*.conf 2>/dev/null"
-  );
-  return cat ?? "";
-}
-function firstDirective(body, name) {
-  const m = body.match(new RegExp(`(?:^|[;{\\s])${name}\\s+([^;]+);`));
-  return m?.[1]?.trim();
-}
-function parseUpstreams(config) {
-  const map = /* @__PURE__ */ new Map();
-  const re = /(?:^|[\s;}])upstream\s+(\S+)\s*\{([^}]*)\}/g;
-  let m;
-  while ((m = re.exec(config)) !== null) {
-    const name = m[1];
-    const server = m[2].match(/(?:^|[\s;{])server\s+([^;\s]+)/);
-    if (name && server?.[1]) map.set(name, server[1].trim());
-  }
-  return map;
-}
-function resolveProxyTarget(proxyPass, upstreams) {
-  const raw = proxyPass.replace(/;$/, "").trim();
-  if (raw.includes("$")) return { reason: `proxy_pass "${raw}" uses an nginx variable` };
-  if (/\/\/unix:/i.test(raw)) return { reason: `proxy_pass "${raw}" targets a unix socket` };
-  const m = raw.match(/^(https?:\/\/)([^/]+)(\/.*)?$/i);
-  if (!m) return { reason: `unrecognized proxy_pass "${raw}"` };
-  const scheme = m[1];
-  const authority = m[2];
-  const host = authority.replace(/:\d+$/, "");
-  if (upstreams.has(host)) return { url: `${scheme}${upstreams.get(host)}` };
-  const isIp = /^\d{1,3}(\.\d{1,3}){3}$/.test(host);
-  if (isIp || host === "localhost" || host.includes(".")) return { url: raw };
-  return { reason: `proxy_pass host "${host}" is an undeclared upstream \u2014 not migratable` };
-}
-function extractLocationProxies(serverBody) {
-  const out = [];
-  const re = /(?:^|[\s;}])location\s+([^{]+?)\s*\{/g;
-  let m;
-  while ((m = re.exec(serverBody)) !== null) {
-    const path = m[1].trim();
-    const openIdx = m.index + m[0].length - 1;
-    let depth = 1;
-    let i = openIdx + 1;
-    for (; i < serverBody.length && depth > 0; i++) {
-      if (serverBody[i] === "{") depth++;
-      else if (serverBody[i] === "}") depth--;
+// ../../packages/adapters/src/system/proxy/api.ts
+function buildProxyRouteIndex(sites) {
+  const byPort = /* @__PURE__ */ new Map();
+  for (const site of sites) {
+    const upstreams = site.routes ?? (site.target.kind === "proxy" ? [{ path: "/", url: site.target.url }] : []);
+    for (const up of upstreams) {
+      let port;
+      try {
+        port = Number(new URL(up.url).port);
+      } catch {
+        continue;
+      }
+      if (!Number.isFinite(port) || port <= 0) continue;
+      const list = byPort.get(port) ?? [];
+      const existing = list.find((r) => r.path === up.path);
+      if (existing) {
+        existing.domains = [.../* @__PURE__ */ new Set([...existing.domains, ...site.serverNames])];
+        if (site.ssl) {
+          existing.ssl.enabled = true;
+          if (!existing.ssl.certPath && site.tls) {
+            existing.ssl.certPath = site.tls.certPath;
+            existing.ssl.keyPath = site.tls.keyPath;
+          }
+        }
+      } else {
+        list.push({
+          port,
+          path: up.path,
+          domains: [...site.serverNames],
+          ssl: site.ssl ? { enabled: true, certPath: site.tls?.certPath, keyPath: site.tls?.keyPath } : { enabled: false },
+          source: site.source
+        });
+      }
+      byPort.set(port, list);
     }
-    if (depth !== 0) break;
-    const locBody = serverBody.slice(openIdx + 1, i - 1);
-    re.lastIndex = i;
-    const pp = firstDirective(locBody, "proxy_pass");
-    if (pp) out.push({ path, proxyPass: pp });
-  }
-  return out;
-}
-function isHttpsUpgradeForSelf(body, names) {
-  const targets = [
-    ...body.matchAll(/(?:^|[\s;{])return\s+30[1-8]\s+([^;]+);/g),
-    ...body.matchAll(/(?:^|[\s;{])rewrite\s+\S+\s+([^;]+?)\s+permanent\s*;/g)
-  ].map((m) => m[1].trim());
-  if (targets.length === 0) return false;
-  return targets.every((raw) => {
-    if (!/^https:\/\//i.test(raw)) return false;
-    const authority = raw.replace(/^https:\/\//i, "").split(/[/\s]/)[0] ?? "";
-    const host = (authority.match(/^(\$[a-z_]+|[^$:]+)/i)?.[1] ?? "").replace(/:\d+$/, "");
-    if (host === "$host" || host === "$server_name" || host === "$http_host") return true;
-    return names.includes(host);
-  });
-}
-function parseServer(body, source, upstreams) {
-  const warnings = [];
-  const names = firstDirective(body, "server_name")?.split(/\s+/).filter((n) => n && n !== "_" && !n.startsWith("~")) ?? [];
-  const listens = [...body.matchAll(/(?:^|[;{\s])listen\s+([^;]+);/g)].map((m) => m[1]);
-  const ssl = listens.some((l) => /\bssl\b/.test(l) || /\b443\b/.test(l));
-  const root = firstDirective(body, "root");
-  const certPath = firstDirective(body, "ssl_certificate");
-  const keyPath = firstDirective(body, "ssl_certificate_key");
-  if (names.length === 0) return { warnings: [] };
-  const rawTargets = extractLocationProxies(body);
-  if (rawTargets.length === 0) {
-    const serverLevel = firstDirective(body, "proxy_pass");
-    if (serverLevel) rawTargets.push({ path: "/", proxyPass: serverLevel });
-  }
-  const resolved = [];
-  for (const t of rawTargets) {
-    const r = resolveProxyTarget(t.proxyPass, upstreams);
-    if ("reason" in r) warnings.push(`nginx: ${names[0]} ${t.path} \u2014 ${r.reason} (skipped)`);
-    else resolved.push({ path: t.path, url: r.url });
-  }
-  let target;
-  let routes;
-  if (resolved.length > 0) {
-    const primary = resolved.find((r) => r.path === "/") ?? resolved[0];
-    target = { kind: "proxy", url: primary.url };
-    routes = resolved;
-  } else if (root) {
-    target = { kind: "static", root: root.replace(/;$/, "") };
-  } else if (isHttpsUpgradeForSelf(body, names)) {
-    return { warnings: [] };
-  } else {
-    warnings.push(`nginx: ${names[0]} has neither proxy_pass nor root \u2014 skipped (${source})`);
-    return { warnings };
   }
-  const site = { serverNames: names, ssl, target, source };
-  if (routes) site.routes = routes;
-  if (certPath && keyPath) site.tls = { certPath, keyPath };
-  return { site, warnings };
-}
-function parseNginxConfig(raw) {
+  return byPort;
+}
+async function declaredCert(ctx) {
+  const tls = ctx.site?.tls;
+  if (!tls) return null;
+  const pems = await readDeclaredPair(ctx.exec, tls.certPath, tls.keyPath, ctx.container);
+  return pems ? { ...pems, source: tls.certPath } : null;
+}
+var CERT_SOURCES = {
+  nginx: [declaredCert],
+  openresty: [declaredCert],
+  apache: [declaredCert],
+  caddy: [declaredCert, (c) => caddyStoreCert(c.exec, c.host, c.container)],
+  traefik: [
+    (c) => traefikAcmeCert(c.exec, c.host, c.container),
+    // File provider: paths aren't bound to a hostname (traefik picks by SNI), so
+    // hand every declared pair to the validator and let coverage decide.
+    async (c) => {
+      for (const pair of await traefikDeclaredCertPaths(c.exec, c.container)) {
+        const pems = await readDeclaredPair(c.exec, pair.certPath, pair.keyPath, c.container);
+        if (!pems) continue;
+        if (validateCertFor(c.host, pems, pair.certPath).cert) {
+          return { ...pems, source: pair.certPath };
+        }
+      }
+      return null;
+    }
+  ],
+  // Takeover-only: no importable config, so no cert to find either.
+  haproxy: []
+};
+async function edgeProxy(exec, opts = {}) {
+  const status = opts.status ?? await probeEdge(exec).catch(() => null);
+  if (!status) return null;
+  let kind = null;
+  let ours = false;
+  if (status.classification === "ours") {
+    kind = "openresty";
+    ours = true;
+  } else if (status.classification === "known") {
+    const found = status.occupants.find((o) => o.proxy)?.proxy;
+    kind = found && canImportProxy(found) ? found : null;
+  }
+  if (!kind) kind = await detectInstalledProxy(exec).catch(() => null);
+  if (!kind) return null;
+  const container = status.occupants.find((o) => o.proxy === kind)?.containerName ?? null;
+  return makeApi(exec, kind, ours, container);
+}
+function edgeProxyFor(exec, kind, opts = {}) {
+  return makeApi(exec, kind, opts.ours ?? kind === "openresty", opts.container ?? null);
+}
+async function collectProxyCerts(api, sites) {
+  const certPems = {};
   const warnings = [];
-  const sites = [];
-  if (!raw.trim()) {
-    return { proxy: "nginx", sites, warnings: ["nginx: no readable configuration found"] };
-  }
-  const config = stripComments(raw);
-  const upstreams = parseUpstreams(config);
-  const blocks = extractBlocks(config, "server");
-  if (blocks.length === 0) {
-    warnings.push("nginx: no server blocks found");
-  }
-  for (const body of blocks) {
-    const { site, warnings: blockWarnings } = parseServer(body, "nginx", upstreams);
-    warnings.push(...blockWarnings);
-    if (site) sites.push(site);
+  const hosts = [...new Set(sites.filter((s) => s.ssl).flatMap((s) => s.serverNames))];
+  for (const host of hosts) {
+    const candidate = await api.certCandidateFor(host).catch(() => null);
+    if (candidate?.cert) {
+      certPems[host] = { certPem: candidate.cert.certPem, keyPem: candidate.cert.keyPem };
+    } else if (candidate?.reason) {
+      warnings.push(`${host}: no reusable certificate \u2014 ${candidate.reason}`);
+    }
   }
-  return { proxy: "nginx", sites, warnings };
-}
-async function scanNginx(executor) {
-  return parseNginxConfig(await loadNginxConfig(executor));
+  return { certPems, warnings };
+}
+function makeApi(exec, kind, ours, container) {
+  let scan = null;
+  const listSites = () => {
+    scan ??= (ours ? scanOpenshipEdge(exec) : scanImportableSites(exec, kind)).catch(() => ({
+      proxy: kind,
+      sites: [],
+      warnings: [`${kind}: config scan failed`]
+    }));
+    return scan;
+  };
+  const siteFor = async (host) => {
+    const target = host.toLowerCase();
+    const { sites } = await listSites();
+    return sites.find((s) => s.serverNames.some((n) => n.toLowerCase() === target)) ?? // A wildcard vhost (`*.example.com`) serves the host without naming it.
+    sites.find(
+      (s) => s.serverNames.some((n) => {
+        const name = n.toLowerCase();
+        if (!name.startsWith("*.")) return false;
+        const suffix = name.slice(1);
+        return target.endsWith(suffix) && !target.slice(0, -suffix.length).includes(".");
+      })
+    ) ?? null;
+  };
+  const certCandidateFor = async (host) => {
+    const site = await siteFor(host);
+    const ctx = { exec, host, site, container };
+    let lastReason = null;
+    for (const source of CERT_SOURCES[kind] ?? []) {
+      const raw = await source(ctx).catch(() => null);
+      if (!raw) continue;
+      const candidate = validateCertFor(host, raw, raw.source);
+      if (candidate.cert) return candidate;
+      lastReason = candidate.reason;
+    }
+    return { cert: null, reason: lastReason ?? `${kind}: no certificate found for ${host}` };
+  };
+  return {
+    kind,
+    ours,
+    container,
+    listSites,
+    sitesByPort: async () => buildProxyRouteIndex((await listSites()).sites),
+    siteFor,
+    certFor: async (host) => (await certCandidateFor(host)).cert,
+    certCandidateFor
+  };
 }
 
-// ../../packages/adapters/src/system/proxy/import/caddy.ts
-var CADDYFILE_PATHS = ["/etc/caddy/Caddyfile", "/etc/Caddyfile"];
-async function loadCaddyJson(executor) {
-  for (const p of CADDYFILE_PATHS) {
-    const out = await tryExec4(executor, `caddy adapt --adapter caddyfile --config ${p} 2>/dev/null`);
-    if (out && out.trim().startsWith("{")) return out;
+// ../../packages/adapters/src/system/proxy/takeover-journal.ts
+var JOURNAL_DIR = "/var/lib/openship";
+var JOURNAL_PATH = `${JOURNAL_DIR}/edge-takeover.json`;
+function log(message, level = "info") {
+  return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
+}
+async function tryExec2(executor, cmd) {
+  try {
+    return await executor.exec(cmd);
+  } catch {
+    return null;
   }
-  return null;
 }
-function flattenHandlers(handlers, out = []) {
-  for (const h of handlers ?? []) {
-    if (h.handler === "subroute") {
-      for (const r of h.routes ?? []) flattenHandlers(r.handle, out);
-    } else {
-      out.push(h);
+async function buildJournal(executor, status) {
+  const units = /* @__PURE__ */ new Map();
+  const containers = /* @__PURE__ */ new Map();
+  const processes = /* @__PURE__ */ new Map();
+  for (const o of status.occupants) {
+    if (o.containerName && !containers.has(o.containerName)) {
+      const r = await tryExec2(
+        executor,
+        `docker inspect -f '{{.HostConfig.RestartPolicy.Name}}' ${sq2(o.containerName)} 2>/dev/null`
+      );
+      containers.set(o.containerName, { name: o.containerName, restart: r?.trim() || "no" });
+    } else if (o.systemdUnit && !units.has(o.systemdUnit)) {
+      const en = await tryExec2(executor, `systemctl is-enabled ${sq2(o.systemdUnit)} 2>/dev/null`);
+      units.set(o.systemdUnit, { unit: o.systemdUnit, wasEnabled: en?.trim() === "enabled" });
+    } else if (!o.containerName && !o.systemdUnit && o.pid && !processes.has(o.pid)) {
+      processes.set(o.pid, { pid: o.pid, command: o.rawCommand });
     }
   }
-  return out;
+  return {
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    units: [...units.values()],
+    containers: [...containers.values()],
+    processes: [...processes.values()]
+  };
 }
-function targetFromRoute(route) {
-  const flat = flattenHandlers(route.handle);
-  const dial = flat.find((h) => h.handler === "reverse_proxy")?.upstreams?.find((u) => u.dial)?.dial;
-  if (dial) return { kind: "proxy", url: /^https?:\/\//.test(dial) ? dial : `http://${dial}` };
-  const root = flat.find((h) => h.handler === "vars" && typeof h.root === "string")?.root;
-  if (root && flat.some((h) => h.handler === "file_server")) return { kind: "static", root };
-  return null;
+async function writeJournal(executor, journal) {
+  try {
+    await executor.mkdir(JOURNAL_DIR);
+    await executor.writeFile(JOURNAL_PATH, JSON.stringify(journal, null, 2));
+  } catch {
+  }
 }
-function parseCaddyJson(raw) {
-  let cfg;
+async function clearJournal(executor) {
+  await tryExec2(executor, `rm -f ${JOURNAL_PATH}`);
+}
+async function readJournal(executor) {
+  const raw = await tryExec2(executor, `cat ${JOURNAL_PATH} 2>/dev/null`);
+  if (!raw?.trim()) return null;
   try {
-    cfg = JSON.parse(raw);
+    return JSON.parse(raw);
   } catch {
+    await clearJournal(executor);
     return null;
   }
-  const servers = cfg.apps?.http?.servers;
-  if (!servers) return null;
-  const sites = [];
-  for (const srv of Object.values(servers)) {
-    const ssl = (srv.listen ?? []).some((l) => l.endsWith(":443"));
-    for (const route of srv.routes ?? []) {
-      const hosts = (route.match ?? []).flatMap((m) => m.host ?? []).filter((h) => h && h !== "*");
-      if (hosts.length === 0) continue;
-      const target = targetFromRoute(route);
-      if (!target) continue;
-      sites.push({ serverNames: hosts, ssl, target, source: "caddy (adapt)" });
-    }
-  }
-  return { sites, warnings: [] };
 }
-async function loadCaddyfile(executor) {
-  for (const p of CADDYFILE_PATHS) {
-    const out = await tryExec4(executor, `cat ${p} 2>/dev/null`);
-    if (out && out.trim()) return out;
+async function rollback(executor, journal, onLog) {
+  onLog(log("Rolling back \u2014 restoring the previous proxy...", "warn"));
+  await tryExec2(executor, `docker update --restart=no ${sq2(EDGE_CONTAINER_NAME)} 2>/dev/null || true`);
+  await tryExec2(executor, `docker stop ${sq2(EDGE_CONTAINER_NAME)} 2>/dev/null || true`);
+  await tryExec2(
+    executor,
+    "systemctl disable --now openresty 2>/dev/null || systemctl stop openresty 2>/dev/null || true; systemctl reset-failed openresty 2>/dev/null || true"
+  );
+  for (const u of journal.units) {
+    await tryExec2(
+      executor,
+      u.wasEnabled ? `systemctl enable --now ${sq2(u.unit)} 2>/dev/null || true` : `systemctl start ${sq2(u.unit)} 2>/dev/null || true`
+    );
   }
-  return "";
-}
-function caddyBlocks(text) {
-  const out = [];
-  let i = 0;
-  let headerStart = 0;
-  while (i < text.length) {
-    if (text[i] === "{") {
-      const header = text.slice(headerStart, i).trim();
-      let depth = 1;
-      let j = i + 1;
-      for (; j < text.length && depth > 0; j++) {
-        if (text[j] === "{") depth++;
-        else if (text[j] === "}") depth--;
-      }
-      if (depth !== 0) break;
-      out.push({ header, body: text.slice(i + 1, j - 1) });
-      i = j;
-      headerStart = j;
-    } else {
-      i++;
-    }
-  }
-  return out;
-}
-function parseAddresses(header) {
-  return header.split(/[\s,]+/).filter(Boolean).map((addr) => {
-    const httpScheme = /^http:\/\//i.test(addr);
-    const host = addr.replace(/^https?:\/\//i, "").replace(/:\d+$/, "");
-    const isPort80 = /:80$/.test(addr);
-    return { host, ssl: !httpScheme && !isPort80 };
-  }).filter((a) => a.host && !a.host.startsWith(":") && a.host !== "*");
-}
-async function scanCaddy(executor) {
-  const json = await loadCaddyJson(executor);
-  if (json) {
-    const parsed = parseCaddyJson(json);
-    if (parsed && parsed.sites.length > 0) {
-      return { proxy: "caddy", sites: parsed.sites, warnings: parsed.warnings };
-    }
-  }
-  return scanCaddyText(executor);
-}
-async function scanCaddyText(executor) {
-  const raw = await loadCaddyfile(executor);
-  const warnings = [];
-  const sites = [];
-  if (!raw.trim()) {
-    return { proxy: "caddy", sites, warnings: ["caddy: no readable Caddyfile found"] };
-  }
-  const text = stripComments(raw);
-  let blocks = caddyBlocks(text);
-  if (blocks.length === 0) {
-    const lines = text.split("\n").map((l) => l.trim()).filter(Boolean);
-    if (lines.length > 0) {
-      blocks = [{ header: lines[0], body: lines.slice(1).join("\n") }];
-    } else {
-      warnings.push("caddy: config present but no parseable site blocks");
-    }
+  for (const c of journal.containers) {
+    await tryExec2(executor, `docker update --restart=${sq2(c.restart)} ${sq2(c.name)} 2>/dev/null || true`);
+    await tryExec2(executor, `docker start ${sq2(c.name)} 2>/dev/null || true`);
   }
-  for (const { header, body } of blocks) {
-    if (!header) continue;
-    const addrs = parseAddresses(header);
-    if (addrs.length === 0) {
-      warnings.push(`caddy: skipped a block with no usable address (${header.slice(0, 40)})`);
-      continue;
-    }
-    const proxyMatch = body.match(/(?:^|\s)reverse_proxy\s+([^\n{]+)/);
-    const rootMatch = body.match(/(?:^|\s)root\s+\*?\s*([^\n\s]+)/);
-    const tlsMatch = body.match(/(?:^|\s)tls\s+(\S+)\s+(\S+)/);
-    let target;
-    if (proxyMatch) {
-      const upstream = proxyMatch[1].trim().split(/\s+/)[0];
-      target = { kind: "proxy", url: /^https?:\/\//.test(upstream) ? upstream : `http://${upstream}` };
-    } else if (rootMatch) {
-      target = { kind: "static", root: rootMatch[1] };
+  for (const p of journal.processes ?? []) {
+    if (p.command) {
+      await tryExec2(
+        executor,
+        `setsid -f sh -c ${sq2(p.command)} 2>/dev/null || (nohup sh -c ${sq2(p.command)} >/dev/null 2>&1 &) || true`
+      );
     } else {
-      warnings.push(`caddy: ${addrs[0].host} has no reverse_proxy or root \u2014 skipped`);
-      continue;
-    }
-    const site = {
-      serverNames: addrs.map((a) => a.host),
-      ssl: addrs.some((a) => a.ssl),
-      target,
-      source: "caddy"
-    };
-    if (tlsMatch && tlsMatch[1].includes("/")) {
-      site.tls = { certPath: tlsMatch[1], keyPath: tlsMatch[2] };
+      onLog(log(`Could not restore process ${p.pid} \u2014 no command captured.`, "warn"));
     }
-    sites.push(site);
   }
-  return { proxy: "caddy", sites, warnings };
-}
-
-// ../../packages/adapters/src/system/proxy/import/apache.ts
-async function vhostFilesFromDump(executor) {
-  const dump = await tryExec4(
-    executor,
-    "apachectl -S 2>/dev/null || apache2ctl -S 2>/dev/null || httpd -S 2>/dev/null"
-  );
-  if (!dump) return [];
-  const files = /* @__PURE__ */ new Set();
-  for (const m of dump.matchAll(/\(([^()]+?):\d+\)/g)) {
-    const f = m[1].trim();
-    if (f.startsWith("/")) files.add(f);
+  const restored = await portIsServed(executor, 80);
+  if (!restored) {
+    onLog(
+      log(
+        "Nothing is listening on :80 after the restore \u2014 the box is NOT serving. Start your proxy by hand (e.g. `systemctl start nginx`, or `docker start <name>`).",
+        "error"
+      )
+    );
   }
-  return [...files];
+  return restored;
 }
-async function loadApacheConfig(executor) {
-  const files = await vhostFilesFromDump(executor);
-  if (files.length > 0) {
-    const cat2 = await tryExec4(executor, `cat ${files.map(sq3).join(" ")} 2>/dev/null`);
-    if (cat2 && cat2.trim()) return cat2;
-  }
-  const cat = await tryExec4(
+async function portIsServed(executor, port) {
+  const hex = port.toString(16).toUpperCase().padStart(4, "0");
+  const out = await tryExec2(
     executor,
-    "cat /etc/apache2/sites-enabled/*.conf /etc/apache2/apache2.conf /etc/httpd/conf.d/*.conf /etc/httpd/conf/httpd.conf 2>/dev/null"
+    `(command -v ss >/dev/null 2>&1 && ss -ltn 2>/dev/null | grep -qE ':${port}[[:space:]]' && echo yes) || (grep -qiE '^[[:space:]]*[0-9]+:[[:space:]]*[0-9A-F]{8}:${hex}[[:space:]]+[0-9A-F]{8}:0000[[:space:]]+0A' /proc/net/tcp 2>/dev/null && echo yes) || true`
   );
-  return cat ?? "";
-}
-function directive(body, name) {
-  const m = body.match(new RegExp(`(?:^|\\n)\\s*${name}\\s+([^\\n]+)`, "i"));
-  return m?.[1]?.trim();
+  return (out ?? "").includes("yes");
 }
-function directiveAll(body, name) {
-  return [...body.matchAll(new RegExp(`(?:^|\\n)\\s*${name}\\s+([^\\n]+)`, "gi"))].map(
-    (m) => m[1].trim()
-  );
+async function beginEdgeTakeover(executor, status, onLog) {
+  await writeJournal(executor, await buildJournal(executor, status));
+  await freeEdgeTargets(executor, stopTargetsForStatus(status), (m, l) => onLog(log(m, l)));
 }
-function parseVhost(body, portHint) {
-  const serverName = directive(body, "ServerName")?.split(/\s+/)[0];
-  const aliases = directiveAll(body, "ServerAlias").flatMap((line) => line.split(/\s+/));
-  const names = [serverName, ...aliases].filter((n) => Boolean(n));
-  if (names.length === 0) {
-    return { warning: "apache: skipped a VirtualHost with no ServerName" };
-  }
-  const routes = [...body.matchAll(/(?:^|\n)\s*ProxyPass\s+(\S+)\s+(\S+)/gi)].map((m) => ({ path: m[1], url: m[2] })).filter((p) => p.url && p.url !== "!");
-  const docRoot = directive(body, "DocumentRoot")?.replace(/^["']|["']$/g, "");
-  const certPath = directive(body, "SSLCertificateFile");
-  const keyPath = directive(body, "SSLCertificateKeyFile");
-  const ssl = /:443/.test(portHint) || /SSLEngine\s+on/i.test(body) || Boolean(certPath);
-  let target;
-  if (routes.length > 0) {
-    const primary = routes.find((r) => r.path === "/") ?? routes[0];
-    target = { kind: "proxy", url: primary.url };
-  } else if (docRoot) {
-    target = { kind: "static", root: docRoot };
-  } else {
-    return { warning: `apache: ${names[0]} has neither ProxyPass nor DocumentRoot \u2014 skipped` };
-  }
-  const site = { serverNames: names, ssl, target, source: "apache" };
-  if (routes.length > 0) site.routes = routes;
-  if (certPath && keyPath) site.tls = { certPath, keyPath };
-  return site;
+async function rollbackEdgeTakeover(executor, onLog) {
+  const journal = await readJournal(executor);
+  if (!journal || journal.completed) return false;
+  const restored = await rollback(executor, journal, onLog);
+  await clearJournal(executor);
+  return restored;
 }
-function vhostBlocks(text) {
-  const out = [];
-  const re = /<VirtualHost([^>]*)>([\s\S]*?)<\/VirtualHost>/gi;
-  let m;
-  while ((m = re.exec(text)) !== null) {
-    out.push({ args: m[1].trim(), body: m[2] });
+async function completeEdgeTakeover(executor) {
+  const journal = await readJournal(executor);
+  if (journal) {
+    journal.completed = true;
+    await writeJournal(executor, journal);
   }
-  return out;
+  await clearJournal(executor);
 }
-async function scanApache(executor) {
-  const raw = await loadApacheConfig(executor);
-  const warnings = [];
-  const sites = [];
-  if (!raw.trim()) {
-    return { proxy: "apache", sites, warnings: ["apache: no readable configuration found"] };
+async function recoverInterruptedTakeover(executor, onLog, isEdgeHealthy) {
+  const journal = await readJournal(executor);
+  if (!journal) return;
+  if (journal.completed) {
+    await clearJournal(executor);
+    return;
   }
-  const text = stripComments(raw);
-  const blocks = vhostBlocks(text);
-  if (blocks.length === 0) warnings.push("apache: no <VirtualHost> blocks found");
-  for (const { args, body } of blocks) {
-    const parsed = parseVhost(body, args);
-    if ("warning" in parsed) warnings.push(parsed.warning);
-    else sites.push(parsed);
+  if (isEdgeHealthy && await isEdgeHealthy()) {
+    onLog(log("Found an unfinished edge takeover, but our edge is serving \u2014 keeping it.", "warn"));
+    await clearJournal(executor);
+    return;
   }
-  return { proxy: "apache", sites, warnings };
+  onLog(log("Found an interrupted edge takeover \u2014 restoring the previous proxy.", "warn"));
+  await rollback(executor, journal, onLog);
+  await clearJournal(executor);
 }
 
-// ../../packages/adapters/src/system/proxy/import/traefik.ts
-function extractHosts(rule) {
-  const hosts = [];
-  for (const call of rule.matchAll(/\bHost\(([^)]*)\)/gi)) {
-    for (const m of call[1].matchAll(/[`'"]([^`'"]+)[`'"]/g)) {
-      const h = m[1].trim();
-      if (h) hosts.push(h);
-    }
+// ../../packages/adapters/src/system/catalog.ts
+function dockerInstallPlan(profile) {
+  if (profile.os !== "linux") {
+    return {
+      supported: false,
+      unsupportedReason: "Docker installation is only supported on Linux servers"
+    };
   }
-  return hosts;
+  return {
+    supported: true,
+    installCommand: "curl -fsSL https://get.docker.com | sh",
+    startCommand: profile.serviceManager === "systemd" ? "systemctl enable docker && systemctl start docker" : void 0,
+    verifyCommand: "docker --version"
+  };
 }
-function extraMatchers(rule) {
-  const found = /* @__PURE__ */ new Set();
-  for (const m of rule.matchAll(
-    /\b(PathPrefix|PathRegexp|Path|HeadersRegexp|Headers|Method|Query|ClientIP|HostRegexp)\b/gi
-  )) {
-    found.add(m[1]);
+function gitInstallPlan(profile) {
+  const commands = {
+    apt: "apt-get update -qq && apt-get install -y -qq git",
+    dnf: "dnf install -y git",
+    yum: "yum install -y git",
+    apk: "apk add --no-cache git",
+    brew: "brew install git"
+  };
+  const installCommand = commands[profile.packageManager];
+  if (!installCommand) {
+    return {
+      supported: false,
+      unsupportedReason: "No supported package manager found for Git installation"
+    };
   }
-  return [...found];
+  return {
+    supported: true,
+    installCommand,
+    verifyCommand: "git --version"
+  };
 }
-function parseTraefikLabels(containers) {
-  const sites = [];
-  const warnings = [];
-  for (const c of containers) {
-    if (c.labels["traefik.enable"] === "false") continue;
-    const routers = /* @__PURE__ */ new Map();
-    const servicePorts = /* @__PURE__ */ new Map();
-    for (const [key, val] of Object.entries(c.labels)) {
-      const r = key.match(/^traefik\.http\.routers\.([^.]+)\.(.+)$/);
-      if (r) {
-        const bag = routers.get(r[1]) ?? {};
-        bag[r[2]] = val;
-        routers.set(r[1], bag);
-        continue;
-      }
-      const s = key.match(/^traefik\.http\.services\.([^.]+)\.loadbalancer\.server\.port$/);
-      if (s) servicePorts.set(s[1], val);
+function rsyncInstallPlan(profile) {
+  const commands = {
+    apt: "apt-get update -qq && apt-get install -y -qq rsync",
+    dnf: "dnf install -y rsync",
+    yum: "yum install -y rsync",
+    apk: "apk add --no-cache rsync",
+    brew: "brew install rsync"
+  };
+  const installCommand = commands[profile.packageManager];
+  if (!installCommand) {
+    return {
+      supported: false,
+      unsupportedReason: "No supported package manager found for rsync installation"
+    };
+  }
+  return {
+    supported: true,
+    installCommand,
+    verifyCommand: "rsync --version | head -n 1"
+  };
+}
+var OPENRESTY_APT_SOURCES = [
+  // ARM64: openresty.org publishes aarch64 debs under a SEPARATE path
+  // (openresty.org/package/arm64/<repo>); the default path is amd64-only, so on
+  // aarch64 `apt-get install openresty` finds no candidate and `set -e` aborts
+  // the whole setup (issue #109). Switch the base URL by arch and tag the deb
+  // line with `arch=` so apt fetches the right index. `dpkg --print-architecture`
+  // returns exactly amd64/arm64 (matches OpenResty's path + arch qualifier).
+  'OR_ARCH="$(dpkg --print-architecture 2>/dev/null || echo amd64)"',
+  'if [ "$OR_ARCH" = arm64 ]; then OR_BASE="http://openresty.org/package/arm64/$REPO"; else OR_BASE="http://openresty.org/package/$REPO"; fi',
+  // `|| REPO_CODENAME=""` so a failed substitution (no lsb_release AND no
+  // /etc/os-release, e.g. a stripped container) doesn't trip `set -e` before
+  // the empty-var fallback below can pick a default.
+  'REPO_CODENAME="$(lsb_release -sc 2>/dev/null || { . /etc/os-release 2>/dev/null && echo "$VERSION_CODENAME"; })" || REPO_CODENAME=""',
+  'if [ "$REPO" = debian ]; then OR_FALLBACKS="bookworm bullseye"; else OR_FALLBACKS="noble jammy focal"; fi',
+  'OR_CODENAME=""',
+  "for c in $REPO_CODENAME $OR_FALLBACKS; do",
+  '  if wget -q --spider --tries=2 --timeout=15 "$OR_BASE/dists/$c/Release"; then OR_CODENAME="$c"; break; fi',
+  "done",
+  'if [ -z "$OR_CODENAME" ]; then case "$REPO" in debian) OR_CODENAME=bookworm ;; *) OR_CODENAME=noble ;; esac; fi',
+  '[ "$OR_CODENAME" = "$REPO_CODENAME" ] || echo "[openresty] apt repo has no codename $REPO_CODENAME; using nearest supported LTS $OR_CODENAME" >&2',
+  'echo "deb [arch=$OR_ARCH signed-by=/usr/share/keyrings/openresty.gpg] $OR_BASE $OR_CODENAME main" > /etc/apt/sources.list.d/openresty.list'
+];
+function openrestyInstallPlan(profile) {
+  if (profile.os !== "linux") {
+    return {
+      supported: false,
+      unsupportedReason: "OpenResty installation is only supported on Linux servers"
+    };
+  }
+  let installCommand;
+  if (profile.packageManager === "apt") {
+    const distro = profile.distro === "debian" ? "debian" : "ubuntu";
+    installCommand = [
+      "set -e",
+      // Heal a stale/bad openresty.list left by a prior run (e.g. the #86
+      // 'resolute' pin) BEFORE the first apt-get update reads it — otherwise
+      // set -e aborts here and the repo never gets rewritten.
+      "rm -f /etc/apt/sources.list.d/openresty.list",
+      "apt-get update -qq && apt-get install -y -qq wget gnupg2 lsb-release",
+      "wget -qO /tmp/openresty-pubkey.gpg https://openresty.org/package/pubkey.gpg",
+      "gpg --yes --dearmor -o /usr/share/keyrings/openresty.gpg /tmp/openresty-pubkey.gpg",
+      `REPO=${distro}`,
+      ...OPENRESTY_APT_SOURCES,
+      "apt-get update -qq && apt-get install -y -qq openresty"
+    ].join("\n");
+  } else if (profile.packageManager === "dnf") {
+    const distro = profile.distro === "fedora" ? "fedora" : "centos";
+    installCommand = `wget -qO /etc/yum.repos.d/openresty.repo https://openresty.org/package/${distro}/openresty.repo && dnf install -y openresty`;
+  } else if (profile.packageManager === "yum") {
+    installCommand = "wget -qO /etc/yum.repos.d/openresty.repo https://openresty.org/package/centos/openresty.repo && yum install -y openresty";
+  } else if (profile.packageManager === "apk") {
+    installCommand = [
+      "apk add --no-cache wget",
+      "wget -qO /etc/apk/keys/admin@openresty.com-5ea678a6.rsa.pub https://openresty.org/package/alpine/admin@openresty.com-5ea678a6.rsa.pub",
+      `. /etc/os-release && echo "https://openresty.org/package/alpine/v$( echo $VERSION_ID | cut -d. -f1,2 )/main" >> /etc/apk/repositories`,
+      "apk update && apk add openresty"
+    ].join(" && ");
+  } else {
+    installCommand = [
+      "set -e",
+      "if command -v apt-get >/dev/null 2>&1; then",
+      "  rm -f /etc/apt/sources.list.d/openresty.list",
+      "  apt-get update -qq && apt-get install -y -qq wget gnupg2 lsb-release",
+      "  wget -qO /tmp/openresty-pubkey.gpg https://openresty.org/package/pubkey.gpg",
+      "  gpg --yes --dearmor -o /usr/share/keyrings/openresty.gpg /tmp/openresty-pubkey.gpg",
+      '  DISTRO=$(. /etc/os-release 2>/dev/null && echo "$ID" || echo "ubuntu")',
+      '  case "$DISTRO" in debian) REPO=debian ;; *) REPO=ubuntu ;; esac',
+      ...OPENRESTY_APT_SOURCES.map((l) => "  " + l),
+      "  apt-get update -qq && apt-get install -y -qq openresty",
+      "elif command -v dnf >/dev/null 2>&1; then",
+      "  wget -qO /etc/yum.repos.d/openresty.repo https://openresty.org/package/centos/openresty.repo && dnf install -y openresty",
+      "elif command -v yum >/dev/null 2>&1; then",
+      "  wget -qO /etc/yum.repos.d/openresty.repo https://openresty.org/package/centos/openresty.repo && yum install -y openresty",
+      "elif command -v apk >/dev/null 2>&1; then",
+      "  apk add --no-cache wget \\",
+      "  && wget -qO /etc/apk/keys/admin@openresty.com-5ea678a6.rsa.pub https://openresty.org/package/alpine/admin@openresty.com-5ea678a6.rsa.pub \\",
+      '  && . /etc/os-release && echo "https://openresty.org/package/alpine/v$(echo $VERSION_ID | cut -d. -f1,2)/main" >> /etc/apk/repositories \\',
+      "  && apk update && apk add openresty",
+      "else",
+      '  echo "No supported package manager found (tried apt-get, dnf, yum, apk)" >&2 && exit 1',
+      "fi"
+    ].join("\n");
+  }
+  return {
+    supported: true,
+    installCommand,
+    startCommand: profile.serviceManager === "systemd" ? "systemctl enable openresty && systemctl start openresty" : void 0,
+    verifyCommand: "openresty -v 2>&1"
+  };
+}
+function certbotInstallPlan(profile) {
+  const commands = {
+    apt: "apt-get update -qq && apt-get install -y -qq certbot",
+    dnf: "dnf install -y certbot",
+    yum: "yum install -y certbot",
+    apk: "apk add --no-cache certbot"
+  };
+  const installCommand = commands[profile.packageManager];
+  if (!installCommand) {
+    return {
+      supported: false,
+      unsupportedReason: "Certbot installation is only supported on Linux with apt, dnf, or yum"
+    };
+  }
+  return {
+    supported: true,
+    installCommand,
+    verifyCommand: "certbot --version 2>/dev/null"
+  };
+}
+var systemCatalog = {
+  checks: {
+    docker: {
+      versionCommand: "docker --version",
+      daemonCommand: "docker info --format '{{.ServerVersion}}'",
+      parseVersion: (output) => output.match(/Docker version ([^\s,]+)/)?.[1] ?? output,
+      missingMessage: "Docker is not installed",
+      notRunningMessage: "Docker is installed but the daemon is not running"
+    },
+    openresty: {
+      versionCommand: "openresty -v 2>&1 || /usr/local/openresty/bin/openresty -v 2>&1",
+      runningCommands: [
+        "pgrep -f 'nginx.*openresty' || pgrep -f '/usr/local/openresty'"
+      ],
+      parseVersion: (output) => output.match(/openresty\/(\S+)/)?.[1] ?? output.match(/nginx\/(\S+)/)?.[1] ?? output,
+      missingMessage: "OpenResty is not installed",
+      notRunningMessage: "OpenResty is installed but not running"
+    },
+    certbot: {
+      versionCommand: "certbot --version 2>/dev/null",
+      parseVersion: (output) => output.match(/certbot\s+(\S+)/)?.[1] ?? output,
+      missingMessage: "Certbot is not installed"
+    },
+    git: {
+      versionCommand: "git --version",
+      parseVersion: (output) => output.match(/git version (\S+)/)?.[1] ?? output,
+      missingMessage: "Git is not installed"
+    },
+    rsync: {
+      versionCommand: "rsync --version | head -n 1",
+      parseVersion: (output) => output.match(/rsync\s+version\s+(\S+)/i)?.[1] ?? output,
+      missingMessage: "rsync is not installed"
     }
-    for (const [rname, props] of routers) {
-      const rule = props.rule;
-      if (!rule) continue;
-      const hosts = extractHosts(rule);
-      if (hosts.length === 0) {
-        warnings.push(
-          /HostRegexp/i.test(rule) ? `traefik: router "${rname}" uses HostRegexp (${rule}) \u2014 regex hosts aren't migratable` : `traefik: router "${rname}" has no Host() rule (${rule}) \u2014 skipped`
-        );
-        continue;
-      }
-      if (!c.ip) {
-        warnings.push(
-          `traefik: ${hosts.join(", ")} \u2014 couldn't resolve container ${c.name}'s IP; re-add the upstream manually`
-        );
-        continue;
-      }
-      const svc = props.service;
-      const rawPort = (svc && servicePorts.get(svc)) ?? (servicePorts.size === 1 ? [...servicePorts.values()][0] : void 0) ?? "80";
-      const port = /^\d{1,5}$/.test(String(rawPort)) ? String(rawPort) : "80";
-      const url = `http://${c.ip}:${port}`;
-      const extras = extraMatchers(rule);
-      if (extras.length > 0) {
-        warnings.push(
-          `traefik: ${hosts.join(", ")} also matches ${extras.join(", ")} \u2014 only the Host() part is migrated; re-add path/header rules manually`
-        );
-      }
-      if (props.middlewares) {
-        warnings.push(`traefik: ${hosts.join(", ")} uses middleware(s) "${props.middlewares}" \u2014 not migrated`);
+  },
+  installs: {
+    docker: dockerInstallPlan,
+    git: gitInstallPlan,
+    rsync: rsyncInstallPlan,
+    openresty: openrestyInstallPlan,
+    certbot: certbotInstallPlan
+  }
+};
+
+// ../../packages/adapters/src/system/elevated-executor.ts
+var INSTALL_ENV = "DEBIAN_FRONTEND=noninteractive DPKG_FORCE=confnew";
+function elevateCommand(command) {
+  return `sudo -n sh -c ${sq(`export ${INSTALL_ENV}; ${command}`)}`;
+}
+function dirOf(path) {
+  const idx = path.lastIndexOf("/");
+  if (idx < 0) return ".";
+  return idx === 0 ? "/" : path.slice(0, idx);
+}
+function elevatedExecutor(inner) {
+  const writeFileElevated = async (path, content) => {
+    const tmp = `/tmp/.openship-elev-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
+    await inner.writeFile(tmp, content);
+    await inner.exec(
+      elevateCommand(`mkdir -p ${sq(dirOf(path))} && mv -f ${sq(tmp)} ${sq(path)}`)
+    );
+  };
+  const overrides = {
+    exec: (command, opts) => inner.exec(elevateCommand(command), opts),
+    streamExec: (command, onLog) => inner.streamExec(elevateCommand(command), onLog),
+    writeFile: writeFileElevated,
+    // Elevated for the same reason as writeFile: the vhost/conf dirs are root-owned,
+    // and the Proxy would otherwise forward this to the inner executor unelevated —
+    // EACCES immediately after an elevated write succeeded.
+    rename: async (from, to) => {
+      await inner.exec(elevateCommand(`mv -f ${sq(from)} ${sq(to)}`));
+    },
+    mkdir: async (path) => {
+      await inner.exec(elevateCommand(`mkdir -p ${sq(path)}`));
+    },
+    rm: async (path) => {
+      await inner.exec(elevateCommand(`rm -rf ${sq(path)}`));
+    }
+  };
+  return new Proxy(inner, {
+    get(target, prop2) {
+      if (Object.prototype.hasOwnProperty.call(overrides, prop2)) {
+        return overrides[prop2];
       }
-      const ssl = Object.keys(props).some((p) => p === "tls" || p.startsWith("tls."));
-      sites.push({
-        serverNames: hosts,
-        ssl,
-        target: { kind: "proxy", url },
-        source: `traefik container ${c.name}`
-      });
+      const value = Reflect.get(target, prop2, target);
+      return typeof value === "function" ? value.bind(target) : value;
     }
+  });
+}
+
+// ../../packages/adapters/src/system/installer.ts
+function log2(message, level = "info") {
+  return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
+}
+async function prepareExecutor(executor, component) {
+  const profile = await resolveEnvironment(executor);
+  if (profile.isRoot) return { ok: true, executor, profile };
+  if (profile.canSudo) return { ok: true, executor: elevatedExecutor(executor), profile };
+  return {
+    ok: false,
+    result: {
+      component,
+      success: false,
+      error: `Installing ${component} needs root. Connect this server as root, or as a user with passwordless sudo.`
+    }
+  };
+}
+async function installDocker(executor, onLog) {
+  const prep = await prepareExecutor(executor, "docker");
+  if (!prep.ok) return prep.result;
+  executor = prep.executor;
+  const profile = prep.profile;
+  const plan = systemCatalog.installs.docker(profile);
+  if (!plan.supported || !plan.installCommand || !plan.verifyCommand) {
+    return { component: "docker", success: false, error: plan.unsupportedReason ?? "Docker install not supported" };
+  }
+  onLog(log2("Installing Docker Engine..."));
+  try {
+    const { code } = await executor.streamExec(plan.installCommand, onLog);
+    if (code !== 0) return { component: "docker", success: false, error: "Docker install failed" };
+    if (plan.startCommand) {
+      onLog(log2("Starting Docker service..."));
+      await executor.streamExec(plan.startCommand, onLog);
+    }
+    const version = await executor.exec(plan.verifyCommand);
+    const parsed = systemCatalog.checks.docker.parseVersion(version);
+    onLog(log2(`Docker ${parsed} installed`));
+    return { component: "docker", success: true, version: parsed };
+  } catch (err) {
+    const msg = safeErrorMessage(err);
+    onLog(log2(`Docker installation failed: ${msg}`, "error"));
+    return { component: "docker", success: false, error: msg };
+  }
+}
+async function installGit(executor, onLog, opts) {
+  const prep = await prepareExecutor(executor, "git");
+  if (!prep.ok) return prep.result;
+  executor = prep.executor;
+  const profile = prep.profile;
+  const plan = systemCatalog.installs.git(profile);
+  if (!plan.supported || !plan.installCommand || !plan.verifyCommand) {
+    return { component: "git", success: false, error: plan.unsupportedReason ?? "Git install not supported" };
+  }
+  onLog(log2(opts?.label ? `Installing Git in ${opts.label}...` : "Installing Git..."));
+  try {
+    const { code } = await executor.streamExec(plan.installCommand, onLog);
+    if (code !== 0) return { component: "git", success: false, error: "Git installation failed" };
+    const version = await executor.exec(plan.verifyCommand);
+    const parsed = systemCatalog.checks.git.parseVersion(version);
+    onLog(log2(opts?.label ? `Git ${parsed} installed in ${opts.label}` : `Git ${parsed} installed`));
+    return { component: "git", success: true, version: parsed };
+  } catch (err) {
+    const msg = safeErrorMessage(err);
+    onLog(log2(`Git installation failed: ${msg}`, "error"));
+    return { component: "git", success: false, error: msg };
+  }
+}
+async function installRsync(executor, onLog) {
+  const prep = await prepareExecutor(executor, "rsync");
+  if (!prep.ok) return prep.result;
+  executor = prep.executor;
+  const profile = prep.profile;
+  const plan = systemCatalog.installs.rsync(profile);
+  if (!plan.supported || !plan.installCommand || !plan.verifyCommand) {
+    return { component: "rsync", success: false, error: plan.unsupportedReason ?? "rsync install not supported" };
+  }
+  onLog(log2("Installing rsync..."));
+  try {
+    const { code } = await executor.streamExec(plan.installCommand, onLog);
+    if (code !== 0) return { component: "rsync", success: false, error: "rsync installation failed" };
+    const version = await executor.exec(plan.verifyCommand);
+    const parsed = systemCatalog.checks.rsync.parseVersion(version);
+    onLog(log2(`rsync ${parsed} installed`));
+    return { component: "rsync", success: true, version: parsed };
+  } catch (err) {
+    const msg = safeErrorMessage(err);
+    onLog(log2(`rsync installation failed: ${msg}`, "error"));
+    return { component: "rsync", success: false, error: msg };
   }
-  return { proxy: "traefik", sites, warnings };
 }
-async function scanTraefik(executor) {
-  const out = await tryExec4(
-    executor,
-    "docker ps -q 2>/dev/null | xargs -r docker inspect --format '{{.Name}}	{{json .Config.Labels}}	{{range .NetworkSettings.Networks}}{{.IPAddress}} {{end}}' 2>/dev/null"
-  );
-  if (!out) {
-    return { proxy: "traefik", sites: [], warnings: ["traefik: couldn't read container labels via docker inspect"] };
+async function installContainerEdge(executor, onLog, config) {
+  const prep = await prepareExecutor(executor, "edge");
+  if (!prep.ok) return prep.result;
+  executor = prep.executor;
+  if (!await dockerAvailable(executor)) {
+    const error = "The edge is a container image and needs Docker on this server. Install the Docker component first, then install the edge.";
+    onLog(log2(error, "error"));
+    return { component: "edge", success: false, error };
   }
-  const containers = [];
-  for (const line of out.split("\n")) {
-    const [rawName, rawLabels, rawIps] = line.split("	");
-    if (!rawName || !rawLabels) continue;
-    let labels;
-    try {
-      labels = JSON.parse(rawLabels) ?? {};
-    } catch {
-      continue;
+  try {
+    const result = await ensureContainerEdge(executor, {
+      onLog,
+      config,
+      image: config?.edgeImage
+    });
+    if (result.converted) {
+      onLog(log2("Edge moved from host OpenResty to the container edge", "warn"));
     }
-    if (!Object.keys(labels).some((k) => k.startsWith("traefik."))) continue;
-    const ip = (rawIps ?? "").trim().split(/\s+/)[0] || void 0;
-    containers.push({ name: rawName.replace(/^\//, ""), labels, ip });
+    const version = await executor.exec(containerCommand(result.container, "openresty -v 2>&1")).catch(() => "");
+    return {
+      component: "edge",
+      success: true,
+      version: version ? systemCatalog.checks.openresty.parseVersion(version) : void 0
+    };
+  } catch (err) {
+    if (err instanceof EdgeMigrateRequested) throw err;
+    const msg = safeErrorMessage(err);
+    onLog(log2(`Edge setup failed: ${msg}`, "error"));
+    return { component: "edge", success: false, error: msg };
   }
-  return parseTraefikLabels(containers);
 }
+var COMPONENT_INSTALLERS = {
+  docker: (exec, log5) => installDocker(exec, log5),
+  // The edge is ONE component and it is a container image. `installOpenResty` /
+  // `installCertbot` are NOT reachable from here — they remain only for the mail
+  // server's own proxy (mail.service.ts) and for converting a legacy host edge.
+  edge: (exec, log5, config) => installContainerEdge(exec, log5, config),
+  git: (exec, log5) => installGit(exec, log5),
+  rsync: (exec, log5) => installRsync(exec, log5)
+};
 
-// ../../packages/adapters/src/system/proxy/import/index.ts
-var INSTALLED_MARKERS = [
-  { proxy: "nginx", paths: ["/etc/nginx/nginx.conf"] },
-  { proxy: "caddy", paths: ["/etc/caddy/Caddyfile"] },
-  { proxy: "apache", paths: ["/etc/apache2/apache2.conf", "/etc/httpd/conf/httpd.conf"] }
-];
-async function detectInstalledProxy(executor) {
-  const probe = INSTALLED_MARKERS.map(({ proxy, paths }) => {
-    const test = paths.map((p) => `[ -f '${p}' ]`).join(" || ");
-    return `{ ${test}; } && echo ${proxy}`;
-  }).join("; ");
-  let out = "";
+// ../../packages/adapters/src/system/available-version.ts
+var PACKAGE_NAMES = {
+  git: "git",
+  rsync: "rsync",
+  // The edge is an IMAGE, not a repo package — its "newer version available" comes
+  // from the registry (see the update scanner's imageDigest), never from apt.
+  edge: null,
+  docker: null
+};
+function normalizePkgVersion(raw) {
+  let v = raw.trim();
+  const colon = v.lastIndexOf(":");
+  if (colon !== -1) v = v.slice(colon + 1);
+  const dash = v.indexOf("-");
+  if (dash !== -1) v = v.slice(0, dash);
+  return v.trim();
+}
+async function tryExec3(executor, cmd) {
   try {
-    out = await executor.exec(`{ ${probe}; } 2>/dev/null; true`, { timeout: 1e4 });
+    return await executor.exec(cmd);
   } catch {
     return null;
   }
-  const found = new Set(
-    out.split("\n").map((l) => l.trim()).filter(Boolean)
-  );
-  return INSTALLED_MARKERS.find((m) => found.has(m.proxy))?.proxy ?? null;
 }
-async function scanImportableSites(executor, proxy) {
-  switch (proxy) {
-    case "nginx":
-      return scanNginx(executor);
-    case "caddy":
-      return scanCaddy(executor);
-    case "apache":
-      return scanApache(executor);
-    case "traefik":
-      return scanTraefik(executor);
-    default:
-      return {
-        proxy,
-        sites: [],
-        warnings: [`${proxy}: config import not supported \u2014 takeover only`]
-      };
+async function probeCandidate(executor, pm, pkg) {
+  const q = `'${pkg.replace(/'/g, "'\\''")}'`;
+  if (pm === "apt") {
+    const out = await tryExec3(executor, `apt-cache policy ${q} 2>/dev/null`);
+    return out?.match(/Candidate:\s*(\S+)/)?.[1]?.trim() ?? null;
+  }
+  if (pm === "dnf" || pm === "yum") {
+    const out = await tryExec3(
+      executor,
+      `${pm} -q --cacheonly list available ${q} 2>/dev/null | tail -n1`
+    );
+    return out?.trim().split(/\s+/)[1]?.trim() ?? null;
   }
+  if (pm === "apk") {
+    const out = await tryExec3(executor, `apk policy ${q} 2>/dev/null`);
+    const versions = [...out?.matchAll(/^\s+([\w.+~-]+):\s*$/gm) ?? []].map((m) => m[1]);
+    return versions.length ? versions[versions.length - 1] : null;
+  }
+  return null;
 }
-function canImportProxy(proxy) {
-  return proxy === "nginx" || proxy === "caddy" || proxy === "apache" || proxy === "traefik";
+async function enrichAvailableVersions(executor, profile, statuses) {
+  const targets = statuses.filter(
+    (s) => s.installed && s.version && PACKAGE_NAMES[s.name]
+  );
+  await Promise.all(
+    targets.map(async (s) => {
+      try {
+        const pkg = PACKAGE_NAMES[s.name];
+        const candidate = await probeCandidate(executor, profile.packageManager, pkg);
+        if (!candidate) return;
+        const avail = normalizePkgVersion(candidate);
+        const installed = normalizePkgVersion(s.version);
+        if (avail && compareSemver(avail, installed) > 0) {
+          s.availableVersion = avail;
+          s.updateAvailable = true;
+        }
+      } catch {
+      }
+    })
+  );
 }
 
-// ../../packages/adapters/src/system/proxy/takeover-journal.ts
-var JOURNAL_DIR = "/var/lib/openship";
-var JOURNAL_PATH = `${JOURNAL_DIR}/edge-takeover.json`;
-function log(message, level = "info") {
-  return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
-}
-async function tryExec5(executor, cmd) {
-  try {
-    return await executor.exec(cmd);
-  } catch {
-    return null;
+// ../../packages/adapters/src/system/components.ts
+var SYSTEM_COMPONENTS = [
+  {
+    name: "docker",
+    label: "Docker",
+    description: "Container runtime for deployments",
+    installable: true,
+    category: "core"
+  },
+  {
+    name: "git",
+    label: "Git",
+    description: "Version control for source code",
+    installable: true,
+    category: "core"
+  },
+  {
+    // ONE component for the edge, because it is ONE artifact: the openship-edge
+    // image. OpenResty, its Lua, and certbot all ship inside it — they were three
+    // rows in this list for a thing that is installed, checked, and removed as a
+    // unit, and neither "openresty" nor "certbot" was independently installable
+    // on a converted box.
+    name: "edge",
+    label: "Edge",
+    description: "Routing + TLS \u2014 the openship-edge container (OpenResty, Lua, certbot)",
+    installable: true,
+    category: "infrastructure"
+  },
+  {
+    name: "rsync",
+    label: "rsync",
+    description: "Fast directory sync for remote local-build transfers",
+    installable: true,
+    category: "infrastructure"
   }
+];
+var SYSTEM_COMPONENTS_BY_NAME = new Map(
+  SYSTEM_COMPONENTS.map((component) => [component.name, component])
+);
+function getSystemComponentDefinition(name) {
+  return SYSTEM_COMPONENTS_BY_NAME.get(name) ?? {
+    name,
+    label: name,
+    description: `${name} component`,
+    installable: false,
+    category: "infrastructure"
+  };
 }
-async function buildJournal(executor, status) {
-  const units = /* @__PURE__ */ new Map();
-  const containers = /* @__PURE__ */ new Map();
-  const processes = /* @__PURE__ */ new Map();
-  for (const o of status.occupants) {
-    if (o.containerName && !containers.has(o.containerName)) {
-      const r = await tryExec5(
-        executor,
-        `docker inspect -f '{{.HostConfig.RestartPolicy.Name}}' ${sq2(o.containerName)} 2>/dev/null`
+
+// ../../packages/adapters/src/system/checks.ts
+async function tryExec4(executor, command) {
+  const startedAt = Date.now();
+  systemDebug("checks", `exec:start ${command}`);
+  try {
+    const result = await executor.exec(command, { timeout: 1e4 });
+    systemDebug(
+      "checks",
+      `exec:ok ${command} (${formatDuration(startedAt)})`
+    );
+    return result;
+  } catch (err) {
+    if (isRemoteConnectionError(err)) {
+      systemDebug(
+        "checks",
+        `exec:abort ${command} (${formatDuration(startedAt)}) ${safeErrorMessage(err)}`
       );
-      containers.set(o.containerName, { name: o.containerName, restart: r?.trim() || "no" });
-    } else if (o.systemdUnit && !units.has(o.systemdUnit)) {
-      const en = await tryExec5(executor, `systemctl is-enabled ${sq2(o.systemdUnit)} 2>/dev/null`);
-      units.set(o.systemdUnit, { unit: o.systemdUnit, wasEnabled: en?.trim() === "enabled" });
-    } else if (!o.containerName && !o.systemdUnit && o.pid && !processes.has(o.pid)) {
-      processes.set(o.pid, { pid: o.pid, command: o.rawCommand });
+      throw err;
     }
+    const msg = safeErrorMessage(err);
+    systemDebug(
+      "checks",
+      `exec:fail ${command} (${formatDuration(startedAt)}) ${msg}`
+    );
+    return null;
   }
+}
+function healthy(name, version, running) {
+  const component = getSystemComponentDefinition(name);
   return {
-    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    units: [...units.values()],
-    containers: [...containers.values()],
-    processes: [...processes.values()]
+    name,
+    label: component.label,
+    description: component.description,
+    installable: component.installable,
+    installed: true,
+    version,
+    running,
+    healthy: running !== void 0 ? running : true,
+    message: running ? `${name} ${version} - running` : `${name} ${version} - installed`
   };
 }
-async function writeJournal(executor, journal) {
-  try {
-    await executor.mkdir(JOURNAL_DIR);
-    await executor.writeFile(JOURNAL_PATH, JSON.stringify(journal, null, 2));
-  } catch {
+function unhealthy(name, message, opts) {
+  const component = getSystemComponentDefinition(name);
+  return {
+    name,
+    label: component.label,
+    description: component.description,
+    installable: component.installable,
+    installed: !!opts?.version,
+    version: opts?.version,
+    running: opts?.running,
+    healthy: false,
+    message
+  };
+}
+async function checkDocker(executor) {
+  const startedAt = Date.now();
+  const recipe = systemCatalog.checks.docker;
+  const version = await tryExec4(executor, recipe.versionCommand);
+  if (!version) {
+    systemDebug("checks", `docker:missing (${formatDuration(startedAt)})`);
+    return unhealthy("docker", recipe.missingMessage);
+  }
+  const parsed = recipe.parseVersion(version);
+  const info = await tryExec4(executor, recipe.daemonCommand);
+  if (!info) {
+    systemDebug("checks", `docker:not-running (${formatDuration(startedAt)})`);
+    return unhealthy("docker", recipe.notRunningMessage, {
+      version: parsed,
+      running: false
+    });
+  }
+  systemDebug("checks", `docker:healthy (${formatDuration(startedAt)})`);
+  return healthy("docker", parsed, true);
+}
+async function checkGit(executor) {
+  const startedAt = Date.now();
+  const recipe = systemCatalog.checks.git;
+  const version = await tryExec4(executor, recipe.versionCommand);
+  if (!version) {
+    systemDebug("checks", `git:missing (${formatDuration(startedAt)})`);
+    return unhealthy("git", recipe.missingMessage);
   }
+  const parsed = recipe.parseVersion(version);
+  systemDebug("checks", `git:healthy (${formatDuration(startedAt)})`);
+  return healthy("git", parsed);
 }
-async function clearJournal(executor) {
-  await tryExec5(executor, `rm -f ${JOURNAL_PATH}`);
-}
-async function readJournal(executor) {
-  const raw = await tryExec5(executor, `cat ${JOURNAL_PATH} 2>/dev/null`);
-  if (!raw?.trim()) return null;
-  try {
-    return JSON.parse(raw);
-  } catch {
-    await clearJournal(executor);
-    return null;
+async function checkRsync(executor) {
+  const startedAt = Date.now();
+  const recipe = systemCatalog.checks.rsync;
+  const version = await tryExec4(executor, recipe.versionCommand);
+  if (!version) {
+    systemDebug("checks", `rsync:missing (${formatDuration(startedAt)})`);
+    return unhealthy("rsync", recipe.missingMessage);
   }
+  const parsed = recipe.parseVersion(version);
+  systemDebug("checks", `rsync:healthy (${formatDuration(startedAt)})`);
+  return healthy("rsync", parsed);
 }
-async function rollback(executor, journal, onLog) {
-  onLog(log("Rolling back \u2014 restoring the previous proxy...", "warn"));
-  await tryExec5(
-    executor,
-    "systemctl disable --now openresty 2>/dev/null || systemctl stop openresty 2>/dev/null || true; systemctl reset-failed openresty 2>/dev/null || true"
-  );
-  for (const u of journal.units) {
-    await tryExec5(
-      executor,
-      u.wasEnabled ? `systemctl enable --now ${sq2(u.unit)} 2>/dev/null || true` : `systemctl start ${sq2(u.unit)} 2>/dev/null || true`
+async function checkEdge(executor) {
+  const startedAt = Date.now();
+  const container = await resolveOurEdgeContainer(executor);
+  if (!container) {
+    systemDebug("checks", `edge:missing (${formatDuration(startedAt)})`);
+    return unhealthy(
+      "edge",
+      "No edge on this server. The edge is the openship-edge container \u2014 install it (requires Docker)."
     );
   }
-  for (const c of journal.containers) {
-    await tryExec5(executor, `docker update --restart=${sq2(c.restart)} ${sq2(c.name)} 2>/dev/null || true`);
-    await tryExec5(executor, `docker start ${sq2(c.name)} 2>/dev/null || true`);
-  }
-  for (const p of journal.processes ?? []) {
-    if (p.command) {
-      await tryExec5(
-        executor,
-        `setsid -f sh -c ${sq2(p.command)} 2>/dev/null || (nohup sh -c ${sq2(p.command)} >/dev/null 2>&1 &) || true`
-      );
-    } else {
-      onLog(log(`Could not restore process ${p.pid} \u2014 no command captured.`, "warn"));
-    }
+  const version = await tryExec4(executor, containerCommand(container, "openresty -v 2>&1"));
+  if (!version) {
+    systemDebug("checks", `edge:container-unresponsive (${formatDuration(startedAt)})`);
+    return unhealthy(
+      "edge",
+      `The edge container ${container} is running but not responding \u2014 check \`docker logs ${container}\``,
+      { running: false }
+    );
   }
+  systemDebug("checks", `edge:healthy (${formatDuration(startedAt)})`);
+  return healthy("edge", systemCatalog.checks.openresty.parseVersion(version), true);
 }
-async function beginEdgeTakeover(executor, status, onLog) {
-  await writeJournal(executor, await buildJournal(executor, status));
-  await freeEdgeTargets(executor, stopTargetsForStatus(status), (m, l) => onLog(log(m, l)));
+var COMPONENT_CHECKS = {
+  docker: checkDocker,
+  edge: checkEdge,
+  git: checkGit,
+  rsync: checkRsync
+};
+async function mapWithConcurrency(items, limit, fn) {
+  const results = new Array(items.length);
+  let cursor = 0;
+  const worker = async () => {
+    while (cursor < items.length) {
+      const index = cursor++;
+      results[index] = await fn(items[index]);
+    }
+  };
+  await Promise.all(
+    Array.from({ length: Math.min(limit, items.length) }, worker)
+  );
+  return results;
 }
-async function rollbackEdgeTakeover(executor, onLog) {
-  const journal = await readJournal(executor);
-  if (!journal || journal.completed) return false;
-  await rollback(executor, journal, onLog);
-  await clearJournal(executor);
-  return true;
+var CHECK_CONCURRENCY = 4;
+async function checkAll(executor) {
+  const startedAt = Date.now();
+  const entries = SYSTEM_COMPONENTS.map((component) => [component.name, COMPONENT_CHECKS[component.name]]).filter((entry) => Boolean(entry[1]));
+  systemDebug(
+    "checks",
+    `checkAll:start [${entries.map(([name]) => name).join(", ")}]`
+  );
+  const results = await mapWithConcurrency(
+    entries,
+    CHECK_CONCURRENCY,
+    ([, fn]) => fn(executor)
+  );
+  await enrichAvailable(executor, results);
+  systemDebug("checks", `checkAll:done (${formatDuration(startedAt)})`);
+  return results;
 }
-async function completeEdgeTakeover(executor) {
-  const journal = await readJournal(executor);
-  if (journal) {
-    journal.completed = true;
-    await writeJournal(executor, journal);
+async function enrichAvailable(executor, results) {
+  try {
+    const profile = await resolveEnvironment(executor);
+    await enrichAvailableVersions(executor, profile, results);
+  } catch {
   }
-  await clearJournal(executor);
 }
-async function recoverInterruptedTakeover(executor, onLog, isEdgeHealthy) {
-  const journal = await readJournal(executor);
-  if (!journal) return;
-  if (journal.completed) {
-    await clearJournal(executor);
-    return;
-  }
-  if (isEdgeHealthy && await isEdgeHealthy()) {
-    onLog(log("Found an unfinished edge takeover, but our edge is serving \u2014 keeping it.", "warn"));
-    await clearJournal(executor);
-    return;
-  }
-  onLog(log("Found an interrupted edge takeover \u2014 restoring the previous proxy.", "warn"));
-  await rollback(executor, journal, onLog);
-  await clearJournal(executor);
+async function checkComponents(executor, names) {
+  const startedAt = Date.now();
+  const fns = names.map((name) => COMPONENT_CHECKS[name]).filter((fn) => Boolean(fn));
+  systemDebug("checks", `checkComponents:start [${names.join(", ")}]`);
+  const results = await mapWithConcurrency(
+    fns,
+    CHECK_CONCURRENCY,
+    (fn) => fn(executor)
+  );
+  await enrichAvailable(executor, results);
+  systemDebug(
+    "checks",
+    `checkComponents:done [${names.join(", ")}] (${formatDuration(startedAt)})`
+  );
+  return results;
 }
 
 // ../../packages/adapters/src/system/proxy/index.ts
@@ -1496,20 +1770,20 @@ function describeEdgeOwner(occupants) {
 }
 
 // ../../packages/adapters/src/system/proxy/consent.ts
-function log2(message, level = "info") {
+function log3(message, level = "info") {
   return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
 }
 async function ensureEdgeClear(executor, config, onLog) {
   const status = await probeEdge(executor);
   if (status.canProceedClean) return { tookOver: false };
   const takeover = async () => {
-    onLog(log2(
+    onLog(log3(
       `Taking over ports from ${status.occupants.map((o) => o.command ?? o.port).join(", ")}...`,
       "warn"
     ));
     const configured = config?.edgePolicy?.stopTargets ?? [];
     const targets = configured.length ? configured : stopTargetsForStatus(status);
-    await freeEdgeTargets(executor, targets, (m, l) => onLog(log2(m, l)));
+    await freeEdgeTargets(executor, targets, (m, l) => onLog(log3(m, l)));
   };
   if (config?.edgePolicy?.mode === "takeover") {
     await takeover();
@@ -1549,223 +1823,253 @@ async function ensureEdgeClear(executor, config, onLog) {
   throw new EdgeConflictError(status);
 }
 
-// ../../packages/adapters/src/system/installer.ts
-function log3(message, level = "info") {
+// ../../packages/adapters/src/system/proxy/ensure-container-edge.ts
+function log4(message, level = "info") {
   return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
 }
-function describeEnvironment(profile) {
-  return `Detected environment: os=${profile.os}, arch=${profile.arch}, distro=${profile.distro ?? "n/a"}, packageManager=${profile.packageManager}, serviceManager=${profile.serviceManager}`;
-}
-async function execSafe(executor, cmd) {
-  try {
-    await executor.exec(cmd);
-  } catch {
-  }
+var injectedDefaultImage;
+function setDefaultEdgeImage(image) {
+  injectedDefaultImage = image?.trim() || void 0;
+}
+function resolveEdgeImage(explicit) {
+  return buildEdgeImageRef({ explicit, injectedDefault: injectedDefaultImage });
+}
+async function dockerAvailable(executor) {
+  return executor.exec("docker version --format '{{.Server.Version}}' 2>/dev/null").then((v) => Boolean(v.trim())).catch(() => false);
+}
+async function runningImage(executor, container) {
+  const out = await executor.exec(`docker inspect -f '{{.Config.Image}}' ${sq(container)} 2>/dev/null`).catch(() => "");
+  return out.trim() || null;
+}
+async function containerEdgeProvider(executor, container, opts) {
+  const { NginxProvider: Provider } = await import("./nginx-XWJAOGS4.js");
+  return new Provider({
+    ...opts,
+    // Vhosts go to the BIND-MOUNTED HOST dir (so every host-side reader — the
+    // migrate proxy scan, cert reuse, the mail cert symlinks — keeps working),
+    // while reload/certbot run inside the container.
+    paths: EDGE_HOST_PATHS,
+    executor: edgeContainerExecutor(executor, container),
+    // MUST be pinned: re-detection answers from inside the container and would
+    // repoint sitesDir at a host dir the edge never reads.
+    pinPaths: true
+  });
 }
-async function ensureAptReady(executor, onLog) {
-  const broken = await executor.exec("dpkg --audit 2>&1 | head -1").catch(() => "");
-  if (!broken) return;
-  onLog(log3("Fixing interrupted package state..."));
-  await execSafe(executor, "fuser -k /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock /var/cache/apt/archives/lock 2>/dev/null || true");
-  await execSafe(executor, "rm -f /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock /var/cache/apt/archives/lock 2>/dev/null || true");
-  await executor.streamExec("dpkg --configure -a 2>&1", onLog);
+async function localContainerEdgeProvider(container, opts) {
+  const { DockerEdgeExecutor } = await import("./docker-edge-executor-VHW3JPJS.js");
+  const { NginxProvider: Provider } = await import("./nginx-XWJAOGS4.js");
+  return new Provider({
+    ...opts,
+    paths: OPENRESTY_DEFAULT_PATHS,
+    executor: new DockerEdgeExecutor({ containerName: container }),
+    // nginx.conf + the Lua are BAKED into the image — nothing to detect, install
+    // or patch, and detection would answer from inside the container anyway.
+    pinPaths: true
+  });
 }
-async function prepareExecutor(executor, component) {
-  const profile = await resolveEnvironment(executor);
-  if (profile.isRoot) return { ok: true, executor, profile };
-  if (profile.canSudo) return { ok: true, executor: elevatedExecutor(executor), profile };
-  return {
-    ok: false,
-    result: {
-      component,
-      success: false,
-      error: `Installing ${component} needs root. Connect this server as root, or as a user with passwordless sudo.`
-    }
+function buildEdgeRunCommand(container, image) {
+  const mounts = EDGE_CONTAINER_MOUNTS.map(
+    // `:z` relabels for SELinux-enforcing hosts; a no-op elsewhere.
+    (m) => `-v ${sq(`${m.host}:${m.container}:z`)}`
+  ).join(" ");
+  return [
+    "docker run -d",
+    `--name ${sq(container)}`,
+    "--network host",
+    "--restart unless-stopped",
+    mounts,
+    sq(image)
+  ].join(" ");
+}
+async function swapEdgeImage(executor, container, from, to, opts) {
+  const { onLog } = opts;
+  onLog(log4(`Updating the edge: ${from} \u2192 ${to}`));
+  const pull = await executor.streamExec(`docker pull ${sq(to)}`, onLog);
+  if (pull.code !== 0) {
+    onLog(log4(`Could not pull ${to} \u2014 the edge stays on ${from}.`, "warn"));
+    return { swapped: false, edgeDown: false };
+  }
+  const start = async (image) => {
+    await executor.exec(`docker rm -f ${sq(container)} 2>/dev/null || true`).catch(() => {
+    });
+    const run = await executor.streamExec(
+      buildEdgeRunCommand(container, image),
+      onLog
+    );
+    invalidateEdgeContainer(executor);
+    if (run.code !== 0) return false;
+    const listening = await waitForPortListening(executor, 80, {
+      timeoutMs: opts.verifyTimeoutMs ?? 3e4
+    });
+    return !(listening.checked && !listening.listening);
   };
-}
-async function installDocker(executor, onLog) {
-  const prep = await prepareExecutor(executor, "docker");
-  if (!prep.ok) return prep.result;
-  executor = prep.executor;
-  const profile = prep.profile;
-  const plan = systemCatalog.installs.docker(profile);
-  if (!plan.supported || !plan.installCommand || !plan.verifyCommand) {
-    return { component: "docker", success: false, error: plan.unsupportedReason ?? "Docker install not supported" };
+  if (await start(to)) {
+    onLog(log4(`Edge updated to ${to}`));
+    return { swapped: true, edgeDown: false };
   }
-  onLog(log3("Installing Docker Engine..."));
-  try {
-    const { code } = await executor.streamExec(plan.installCommand, onLog);
-    if (code !== 0) return { component: "docker", success: false, error: "Docker install failed" };
-    if (plan.startCommand) {
-      onLog(log3("Starting Docker service..."));
-      await executor.streamExec(plan.startCommand, onLog);
-    }
-    const version = await executor.exec(plan.verifyCommand);
-    const parsed = systemCatalog.checks.docker.parseVersion(version);
-    onLog(log3(`Docker ${parsed} installed`));
-    return { component: "docker", success: true, version: parsed };
-  } catch (err) {
-    const msg = safeErrorMessage(err);
-    onLog(log3(`Docker installation failed: ${msg}`, "error"));
-    return { component: "docker", success: false, error: msg };
+  onLog(log4(`Edge ${to} failed to come up \u2014 rolling back to ${from}...`, "error"));
+  if (await start(from)) {
+    return { swapped: false, edgeDown: false };
   }
+  onLog(log4(`Rollback to ${from} ALSO failed \u2014 the edge is down on this server.`, "error"));
+  return { swapped: false, edgeDown: true };
 }
-async function installGit(executor, onLog, opts) {
-  const prep = await prepareExecutor(executor, "git");
-  if (!prep.ok) return prep.result;
-  executor = prep.executor;
-  const profile = prep.profile;
-  const plan = systemCatalog.installs.git(profile);
-  if (!plan.supported || !plan.installCommand || !plan.verifyCommand) {
-    return { component: "git", success: false, error: plan.unsupportedReason ?? "Git install not supported" };
-  }
-  onLog(log3(opts?.label ? `Installing Git in ${opts.label}...` : "Installing Git..."));
-  try {
-    const { code } = await executor.streamExec(plan.installCommand, onLog);
-    if (code !== 0) return { component: "git", success: false, error: "Git installation failed" };
-    const version = await executor.exec(plan.verifyCommand);
-    const parsed = systemCatalog.checks.git.parseVersion(version);
-    onLog(log3(opts?.label ? `Git ${parsed} installed in ${opts.label}` : `Git ${parsed} installed`));
-    return { component: "git", success: true, version: parsed };
-  } catch (err) {
-    const msg = safeErrorMessage(err);
-    onLog(log3(`Git installation failed: ${msg}`, "error"));
-    return { component: "git", success: false, error: msg };
-  }
+async function listDir(executor, dir) {
+  const out = await executor.exec(`ls -1 ${sq(dir)} 2>/dev/null || true`).catch(() => "");
+  return new Set(
+    out.split("\n").map((l) => l.trim()).filter(Boolean)
+  );
 }
-async function installRsync(executor, onLog) {
-  const prep = await prepareExecutor(executor, "rsync");
-  if (!prep.ok) return prep.result;
-  executor = prep.executor;
-  const profile = prep.profile;
-  const plan = systemCatalog.installs.rsync(profile);
-  if (!plan.supported || !plan.installCommand || !plan.verifyCommand) {
-    return { component: "rsync", success: false, error: plan.unsupportedReason ?? "rsync install not supported" };
-  }
-  onLog(log3("Installing rsync..."));
-  try {
-    const { code } = await executor.streamExec(plan.installCommand, onLog);
-    if (code !== 0) return { component: "rsync", success: false, error: "rsync installation failed" };
-    const version = await executor.exec(plan.verifyCommand);
-    const parsed = systemCatalog.checks.rsync.parseVersion(version);
-    onLog(log3(`rsync ${parsed} installed`));
-    return { component: "rsync", success: true, version: parsed };
-  } catch (err) {
-    const msg = safeErrorMessage(err);
-    onLog(log3(`rsync installation failed: ${msg}`, "error"));
-    return { component: "rsync", success: false, error: msg };
+async function sanitizeCarriedVhosts(executor, sitesDir, onLog) {
+  const script = [
+    `for f in ${sq(sitesDir)}/*.conf; do`,
+    `  [ -f "$f" ] || continue;`,
+    // A real server_name is anything that isn't the `_` wildcard.
+    `  if ! grep -qE '^[[:space:]]*server_name[[:space:]]+[^_;[:space:]]' "$f"; then`,
+    `    echo "dropped-catchall $f"; rm -f "$f"; continue;`,
+    `  fi;`,
+    `  if grep -qE '[[:space:]]default_server' "$f"; then`,
+    `    sed -i -E 's/([[:space:]]listen[^;]*)[[:space:]]+default_server/\\1/g' "$f" && echo "unset-default $f";`,
+    `  fi;`,
+    `done`
+  ].join(" ");
+  const out = await executor.exec(script).catch(() => "");
+  for (const line of out.split("\n").map((l) => l.trim()).filter(Boolean)) {
+    const [action, file] = [line.slice(0, line.indexOf(" ")), line.slice(line.indexOf(" ") + 1)];
+    if (action === "dropped-catchall") {
+      onLog(log4(`Dropped the bare edge's catch-all ${file} \u2014 the edge image provides it.`, "warn"));
+    } else if (action === "unset-default") {
+      onLog(log4(`Removed default_server from ${file} \u2014 the edge image owns it.`, "warn"));
+    }
   }
 }
-async function installCertbot(executor, onLog) {
-  const prep = await prepareExecutor(executor, "certbot");
-  if (!prep.ok) return prep.result;
-  executor = prep.executor;
-  const profile = prep.profile;
-  const plan = systemCatalog.installs.certbot(profile);
-  if (!plan.supported || !plan.installCommand || !plan.verifyCommand) {
-    return { component: "certbot", success: false, error: plan.unsupportedReason ?? "Certbot install not supported" };
+async function ensureContainerEdge(executor, opts) {
+  const { onLog } = opts;
+  const container = opts.container?.trim() || EDGE_CONTAINER_NAME;
+  const image = resolveEdgeImage(opts.image);
+  const existing = await resolveOurEdgeContainer(executor, { fresh: true });
+  if (existing) {
+    const current = await runningImage(executor, existing);
+    if (current && current !== image) {
+      const swap = await swapEdgeImage(executor, existing, current, image, opts);
+      return {
+        container: existing,
+        image,
+        converted: false,
+        updated: swap.swapped,
+        edgeDown: swap.edgeDown
+      };
+    }
+    return { container: existing, image, converted: false };
   }
-  onLog(log3("Installing certbot..."));
-  try {
-    const { code } = await executor.streamExec(plan.installCommand, onLog);
-    if (code !== 0) return { component: "certbot", success: false, error: "Certbot installation failed" };
-    const version = await executor.exec(plan.verifyCommand);
-    const parsed = systemCatalog.checks.certbot.parseVersion(version);
-    onLog(log3(`Certbot ${parsed} installed`));
-    return { component: "certbot", success: true, version: parsed };
-  } catch (err) {
-    const msg = safeErrorMessage(err);
-    onLog(log3(`Certbot installation failed: ${msg}`, "error"));
-    return { component: "certbot", success: false, error: msg };
+  await ensureEdgeClear(executor, opts.config, onLog);
+  if (!await dockerAvailable(executor)) {
+    throw new Error(
+      "Docker isn't available on this server, and the edge now runs as a container. Install the Docker component first, then set up the edge."
+    );
   }
-}
-async function installOpenResty(executor, onLog, config) {
-  const prep = await prepareExecutor(executor, "openresty");
-  if (!prep.ok) return prep.result;
-  executor = prep.executor;
-  const profile = prep.profile;
-  onLog(log3(describeEnvironment(profile)));
-  const plan = systemCatalog.installs.openresty(profile);
-  if (!plan.supported || !plan.installCommand || !plan.verifyCommand) {
-    return { component: "openresty", success: false, error: plan.unsupportedReason ?? "OpenResty install not supported" };
+  const bareWasOurs = await ourLuaOnHost(executor);
+  onLog(log4(`Pulling edge image ${image}...`));
+  const pull = await executor.streamExec(`docker pull ${sq(image)}`, onLog);
+  if (pull.code !== 0) {
+    throw new Error(
+      `Could not pull the edge image ${image} \u2014 the box is unchanged and still serving. Check the server's network access to the registry, then retry.`
+    );
   }
-  onLog(log3("Installing OpenResty..."));
-  try {
-    const { tookOver } = await ensureEdgeClear(executor, config, onLog);
-    const hasIt = await executor.exec("command -v openresty >/dev/null 2>&1 && echo y || echo n").then((r) => r.trim() === "y");
-    if (hasIt && await ourLuaOnHost(executor)) {
-      onLog(log3("Stopping existing OpenResty..."));
-      await execSafe(executor, "systemctl stop openresty 2>/dev/null || true");
-      await execSafe(executor, "pkill -f '[o]penresty' 2>/dev/null || true");
+  for (const mount of EDGE_CONTAINER_MOUNTS) {
+    await executor.exec(`mkdir -p ${sq(mount.host)}`).catch(() => {
+    });
+  }
+  const sitesTarget = EDGE_HOST_PATHS.sitesDir;
+  let beforeCarry = null;
+  if (bareWasOurs) {
+    const barePaths = await detectOpenRestyPaths(executor).catch(() => OPENRESTY_DEFAULT_PATHS);
+    if (barePaths.sitesDir !== sitesTarget && await executor.exists(barePaths.sitesDir)) {
+      onLog(log4(`Carrying vhosts from ${barePaths.sitesDir}...`));
+      beforeCarry = await listDir(executor, sitesTarget);
+      await executor.exec(`cp -a ${sq(`${barePaths.sitesDir}/.`)} ${sq(`${sitesTarget}/`)} 2>/dev/null || true`).catch(() => {
+      });
+      await sanitizeCarriedVhosts(executor, sitesTarget, onLog);
     }
-    if (profile.packageManager === "apt") {
-      await ensureAptReady(executor, onLog);
+  }
+  const restoreBare = async () => {
+    if (!bareWasOurs) return;
+    if (beforeCarry) {
+      const now = await listDir(executor, sitesTarget);
+      const added = [...now].filter((name) => !beforeCarry.has(name));
+      if (added.length > 0) {
+        await executor.exec(`rm -f ${added.map((n) => sq(`${sitesTarget}/${n}`)).join(" ")}`).catch(() => {
+        });
+        onLog(log4(`Removed ${added.length} carried vhost(s) so the next edge start is clean.`, "warn"));
+      }
     }
-    const { code } = await executor.streamExec(plan.installCommand, onLog);
-    if (code !== 0) return { component: "openresty", success: false, error: "OpenResty installation failed" };
-    await execSafe(executor, "systemctl stop openresty 2>/dev/null || true");
-    await execSafe(executor, "pkill -f '[o]penresty' 2>/dev/null || true");
-    await execSafe(executor, "systemctl reset-failed openresty 2>/dev/null || true");
-    const paths = await detectOpenRestyPaths(executor);
-    await ensureOpenRestyConfig(executor, paths);
-    onLog(log3("Validating config..."));
-    const { code: testCode } = await executor.streamExec(`${paths.bin} -t 2>&1`, onLog);
-    if (testCode !== 0) {
-      return { component: "openresty", success: false, error: "OpenResty config invalid - see logs above" };
+    onLog(log4("Restoring the host OpenResty edge...", "warn"));
+    await executor.exec("systemctl enable --now openresty 2>/dev/null || true").catch(() => {
+    });
+  };
+  try {
+    if (bareWasOurs) {
+      onLog(log4("Stopping the host OpenResty edge..."));
+      await executor.exec("systemctl disable --now openresty 2>/dev/null || true").catch(() => {
+      });
+      await executor.exec("systemctl reset-failed openresty 2>/dev/null || true").catch(() => {
+      });
     }
-    if (plan.startCommand) {
-      onLog(log3("Starting OpenResty..."));
-      let start = await executor.streamExec(plan.startCommand, onLog);
-      if (start.code !== 0 && tookOver) {
-        onLog(log3("Start failed - reclaiming authorized ports...", "warn"));
-        const targets = config?.edgePolicy?.stopTargets?.length ? config.edgePolicy.stopTargets : stopTargetsForStatus(await probeEdge(executor));
-        await freeEdgeTargets(executor, targets, (m, l) => onLog(log3(m, l)));
-        await execSafe(executor, "systemctl reset-failed openresty 2>/dev/null || true");
-        start = await executor.streamExec(plan.startCommand, onLog);
-      }
-      if (start.code !== 0) {
-        const journal = await executor.exec(
-          "journalctl -xeu openresty.service --no-pager -n 30 2>/dev/null || echo '(unavailable)'"
-        ).catch(() => "(could not read journal)");
-        onLog(log3(`Service journal:
-${journal}`, "error"));
-        return { component: "openresty", success: false, error: "OpenResty installed but failed to start" };
-      }
+    await executor.exec(`docker rm -f ${sq(container)} 2>/dev/null || true`).catch(() => {
+    });
+    onLog(log4("Starting the edge container..."));
+    const run = await executor.streamExec(
+      buildEdgeRunCommand(container, image),
+      onLog
+    );
+    invalidateEdgeContainer(executor);
+    if (run.code !== 0) throw new Error("the edge container failed to start");
+    await executor.exec(containerCommand(container, "openresty -t"));
+    const listening = await waitForPortListening(executor, 80, {
+      timeoutMs: opts.verifyTimeoutMs ?? 3e4
+    });
+    if (listening.checked && !listening.listening) {
+      throw new Error("the edge container started but nothing is listening on :80");
     }
-    await executor.exec(buildReloadCommand(paths));
-    onLog(log3("Deploying analytics scripts..."));
-    await deployLuaScripts(executor, paths);
-    const version = await executor.exec(plan.verifyCommand);
-    const parsed = systemCatalog.checks.openresty.parseVersion(version);
-    onLog(log3(`OpenResty ${parsed} installed`));
-    return { component: "openresty", success: true, version: parsed };
+    const version = await executor.exec(containerCommand(container, "openresty -v 2>&1")).catch(() => "");
+    onLog(log4(`Edge container running${version.trim() ? ` (${version.trim()})` : ""}`));
+    return { container, image, converted: bareWasOurs };
   } catch (err) {
-    if (err instanceof EdgeMigrateRequested) throw err;
     const msg = safeErrorMessage(err);
-    onLog(log3(`OpenResty installation failed: ${msg}`, "error"));
-    return { component: "openresty", success: false, error: msg };
+    onLog(log4(`Edge container setup failed: ${msg}`, "error"));
+    const logs = await executor.exec(`docker logs --tail 40 ${sq(container)} 2>&1 || true`).catch(() => "");
+    if (logs.trim()) onLog(log4(`Edge container logs:
+${logs}`, "error"));
+    await executor.exec(`docker rm -f ${sq(container)} 2>/dev/null || true`).catch(() => {
+    });
+    invalidateEdgeContainer(executor);
+    await restoreBare();
+    const reason = edgeFailureReason(logs);
+    throw new Error(`Edge container setup failed: ${reason ? `${reason} (${msg})` : msg}`);
   }
 }
-var COMPONENT_INSTALLERS = {
-  docker: (exec, log4) => installDocker(exec, log4),
-  openresty: (exec, log4, config) => installOpenResty(exec, log4, config),
-  certbot: (exec, log4) => installCertbot(exec, log4),
-  git: (exec, log4) => installGit(exec, log4),
-  rsync: (exec, log4) => installRsync(exec, log4)
-};
 
 export {
   systemCatalog,
   checkGit,
   checkAll,
   checkComponents,
-  ourEdgeContainerRunning,
   detectInstalledProxy,
   scanImportableSites,
+  edgeProxy,
+  edgeProxyFor,
+  collectProxyCerts,
   beginEdgeTakeover,
   rollbackEdgeTakeover,
   completeEdgeTakeover,
   recoverInterruptedTakeover,
+  setDefaultEdgeImage,
+  resolveEdgeImage,
+  dockerAvailable,
+  containerEdgeProvider,
+  localContainerEdgeProvider,
+  buildEdgeRunCommand,
+  ensureContainerEdge,
   importSites,
   foreignProxyOnEdge,
   installGit,