openship 0.4.8 → 0.6.0

package/dist/{chunk-BBHX7T4R.js → chunk-VE2YOK4I.js}

@@ -1,18 +1,18 @@
 #!/usr/bin/env sh
-":" //# ; exec "$(command -v bun || command -v node)" "$0" "$@"
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   ENV_KEY,
   ENV_SECRET,
   fromEnv
-} from "./chunk-FRNAR33O.js";
+} from "./chunk-XZYFZ6A5.js";
 import {
   SignatureV4MultiRegion,
   XmlNode,
   XmlShapeDeserializer,
   XmlText
-} from "./chunk-6APIPIJY.js";
+} from "./chunk-QWHBRY2K.js";
 import {
   AwsSdkSigV4ASigner,
   AwsSdkSigV4Signer,
@@ -28,10 +28,10 @@ import {
   resolveAwsSdkSigV4AConfig,
   resolveAwsSdkSigV4Config,
   streamCollector
-} from "./chunk-IXCHURVK.js";
+} from "./chunk-DOD2BXHQ.js";
 import {
   NodeHttpHandler
-} from "./chunk-OWED2GRM.js";
+} from "./chunk-42WQABXM.js";
 import {
   BinaryDecisionDiagram,
   Client,
@@ -67,7 +67,7 @@ import {
   resolveRetryConfig,
   resolveUserAgentConfig,
   setFeature
-} from "./chunk-VWPEKOH6.js";
+} from "./chunk-DRK3MEDS.js";
 import {
   CredentialsProviderError,
   ENV_PROFILE,
@@ -98,13 +98,13 @@ import {
   resolveHttpHandlerRuntimeConfig,
   resolveRegionConfig,
   toEndpointV1
-} from "./chunk-W73X43R7.js";
+} from "./chunk-3NQQXMDR.js";
 import {
   CloudRuntime
-} from "./chunk-5NYUCONN.js";
+} from "./chunk-PSZSKEPA.js";
 import {
   systemCatalog
-} from "./chunk-SLTYVHU7.js";
+} from "./chunk-GUQ3QCJ7.js";
 import {
   AwsCrc32,
   __awaiter,
@@ -116,7 +116,7 @@ import {
   numToUint8,
   resolveEventStreamSerdeConfig,
   uint32ArrayFrom
-} from "./chunk-O6ZZF52V.js";
+} from "./chunk-ONKEYSMY.js";
 import {
   Hash,
   NumericValue,
@@ -134,32 +134,39 @@ import {
   toBase64,
   toUint8Array,
   toUtf8
-} from "./chunk-JYGD5WSN.js";
+} from "./chunk-ZWLDLTJP.js";
 import {
   DockerRuntime,
+  daemonConnectionFrom,
   isHostPathSource,
-  scopedVolumeName
-} from "./chunk-SJIFLLX4.js";
+  resolveExecExitCode,
+  scopedVolumeName,
+  startAttachStream,
+  startExecStream
+} from "./chunk-3FYIXVX5.js";
 import {
   BareRuntime
-} from "./chunk-VDMQJHPI.js";
+} from "./chunk-IXM5245F.js";
 import {
   LocalExecutor
-} from "./chunk-TYVME3XD.js";
+} from "./chunk-6FH4AXVY.js";
 import {
   EDGE_CONTAINER_NAME,
   edgeCrashReason,
   invalidateEdgeContainer,
   sanitizeEdgeVhosts
-} from "./chunk-2D3I5G6P.js";
+} from "./chunk-VZ2ZHPS2.js";
 import {
   EDGE_CONTAINER_MOUNTS,
-  EDGE_HOST_STATE_DIR
-} from "./chunk-VFINNTUL.js";
+  EDGE_HOST_STATE_DIR,
+  OPENRESTY_DEFAULT_PATHS
+} from "./chunk-OGY63DGD.js";
 import {
   DEFAULT_IMAGE_REGISTRY,
-  safeErrorMessage
-} from "./chunk-6APULWSU.js";
+  isAwsS3Endpoint,
+  safeErrorMessage,
+  withTimeout
+} from "./chunk-OTLSJYAC.js";
 
 // src/lib/edge-import.ts
 import chalk from "chalk";
@@ -168,8 +175,42 @@ import ora from "ora";
 // ../../packages/adapters/src/runtime/image-transfer.ts
 import { Transform } from "stream";
 
-// ../../packages/adapters/src/runtime/route-registration.ts
-import { posix as pathPosix } from "path";
+// ../../packages/adapters/src/infra/edge-baked-conf.ts
+var LOGS_DIR = OPENRESTY_DEFAULT_PATHS.pidPath.replace(/\/[^/]+$/, "");
+
+// ../../packages/adapters/src/infra/mail-container.ts
+var MAIL_HOST_STATE_DIR = "/var/lib/openship/mail";
+var MAIL_CONTAINER_MOUNTS = [
+  { host: `${MAIL_HOST_STATE_DIR}/vmail`, container: "/var/vmail" },
+  // The Postfix queue. A recreate on an ephemeral layer would drop in-flight and
+  // deferred mail without this — keep it on the host.
+  { host: `${MAIL_HOST_STATE_DIR}/spool`, container: "/var/spool/postfix" },
+  // DKIM private keys. NEVER baked, never regenerated on pull — a fresh selector
+  // breaks DMARC until DNS repropagates.
+  { host: `${MAIL_HOST_STATE_DIR}/dkim`, container: "/var/lib/dkim" },
+  // Mutable daemon config the admin layer edits (sasl_passwd, relayhost maps,
+  // amavis 50-user). Seeded from baked defaults on first boot.
+  { host: `${MAIL_HOST_STATE_DIR}/config/postfix`, container: "/etc/postfix", seed: true },
+  { host: `${MAIL_HOST_STATE_DIR}/config/dovecot`, container: "/etc/dovecot", seed: true },
+  { host: `${MAIL_HOST_STATE_DIR}/config/amavis`, container: "/etc/amavis/conf.d", seed: true },
+  // ClamAV signatures — bind-mounted so a pull doesn't force a multi-hundred-MB
+  // freshclam re-download and delay readiness.
+  { host: `${MAIL_HOST_STATE_DIR}/clamav`, container: "/var/lib/clamav" },
+  { host: "/etc/letsencrypt", container: "/etc/letsencrypt", readonly: true }
+];
+var MAIL_DB_HOST_DATA_DIR = `${MAIL_HOST_STATE_DIR}/pgdata`;
+var MAIL_DB_CONTAINER_DATA_DIR = "/var/lib/postgresql/data";
+var MAIL_DB_PGDATA = `${MAIL_DB_CONTAINER_DATA_DIR}/pgdata`;
+var MAIL_HOST_PATHS = {
+  saslPasswd: `${MAIL_HOST_STATE_DIR}/config/postfix/sasl_passwd`,
+  senderRelayhost: `${MAIL_HOST_STATE_DIR}/config/postfix/sender_relayhost`,
+  amavisUserConf: `${MAIL_HOST_STATE_DIR}/config/amavis/50-user`
+};
+
+// ../../packages/adapters/src/system/mail/ensure-container-mail.ts
+var MAIL_DB_IMAGE = process.env.OPENSHIP_MAIL_DB_IMAGE?.trim() || "postgres:16-alpine";
+var ENGINE_ENV_FILE = `${MAIL_HOST_STATE_DIR}/engine.env`;
+var DB_ENV_FILE = `${MAIL_HOST_STATE_DIR}/db.env`;
 
 // ../../packages/adapters/src/system/modules/verify.ts
 import { createHash, createPublicKey, verify as cryptoVerify } from "crypto";
@@ -243,6 +284,25 @@ function decryptCredential(stored) {
 import { createHash as createHash3 } from "crypto";
 import { Transform as Transform2 } from "stream";
 
+// ../../packages/adapters/src/backup/common/source-match.ts
+function matchBackupSource(sources, targetSourceId) {
+  const wanted = targetSourceId.trim();
+  if (!wanted) return null;
+  const exact = sources.find((s2) => s2.id === wanted);
+  if (exact) return exact;
+  const byPhysical = sources.filter((s2) => s2.source === wanted);
+  if (byPhysical.length === 1) return byPhysical[0];
+  if (byPhysical.length > 1) return null;
+  const stripped = wanted.replace(/-\d+$/, "");
+  if (stripped !== wanted) {
+    const byStripped = sources.filter(
+      (s2) => s2.id === stripped || s2.source === stripped
+    );
+    if (byStripped.length === 1) return byStripped[0];
+  }
+  return null;
+}
+
 // ../../packages/adapters/src/backup/volume-transfer.ts
 import { Transform as Transform3 } from "stream";
 
@@ -485,8 +545,7 @@ var CustomCommandProducerImpl = class {
   kind = "custom_command";
   // No detect — explicit selection only.
   async *produce(service, executor, opts) {
-    const cfg = opts;
-    const produceCommand = cfg.produceCommand ?? opts.command;
+    const produceCommand = opts.produceCommand ?? opts.command;
     if (!produceCommand) {
       throw new Error("custom_command producer requires `produceCommand` in policy payload config");
     }
@@ -496,12 +555,15 @@ var CustomCommandProducerImpl = class {
       produceCommand
     ]);
     yield {
-      name: cfg.artifactName ?? "custom-backup.bin",
+      name: opts.artifactName ?? "custom-backup.bin",
       stream: stdout,
       payloadKind: "custom_command",
       metadata: {
         produceCommand,
-        restoreCommand: cfg.restoreCommand ?? null
+        // The ONLY record of how to put this artifact back. Nothing downstream
+        // can reconstruct it, which is why losing it here made every captured
+        // run unrestorable.
+        restoreCommand: opts.restoreCommand ?? null
       }
     };
     const exit = await awaitExit;
@@ -515,7 +577,7 @@ var CustomCommandProducerImpl = class {
     const restoreCommand = artifact.metadata.restoreCommand ?? null;
     if (!restoreCommand) {
       throw new Error(
-        "Backup has no restoreCommand recorded \u2014 restore is not possible for this artifact"
+        "Backup has no restoreCommand recorded \u2014 restore is not possible for this artifact. Re-run the backup policy to capture a restorable one."
       );
     }
     const body = await artifact.open();
@@ -582,7 +644,8 @@ var VolumeCopyProducerImpl = class {
     const stream = await artifact.open();
     await executor.receiveStream(service, volumeId, stream, {
       compression: artifact.metadata.compression ?? "zstd",
-      clearTarget: opts.clearTarget ?? true
+      clearTarget: opts.clearTarget ?? true,
+      signal: opts.signal
     });
   }
 };
@@ -595,6 +658,58 @@ registerProducer(VolumeCopyProducer);
 // ../../packages/adapters/src/backup/executors/docker.ts
 import { PassThrough } from "stream";
 var HELPER_IMAGE = "alpine:3";
+var DEFAULT_HELPER_IDLE_MS = 10 * 60 * 1e3;
+var DEFAULT_HELPER_TIMEOUT_MS = 6 * 60 * 60 * 1e3;
+var EXIT_POLL_INTERVAL_MS = 2e3;
+function createIdleWatchdog(ms, message) {
+  let timer;
+  let done = false;
+  let fire = () => {
+  };
+  const promise = new Promise((_resolve, reject) => {
+    fire = reject;
+  });
+  const arm = () => {
+    timer = setTimeout(() => {
+      done = true;
+      fire(new Error(message));
+    }, ms);
+    timer.unref?.();
+  };
+  arm();
+  return {
+    touch: () => {
+      if (done) return;
+      if (timer) clearTimeout(timer);
+      arm();
+    },
+    promise,
+    dispose: () => {
+      done = true;
+      if (timer) clearTimeout(timer);
+    }
+  };
+}
+function createAbortWatch(signal, message) {
+  let fire = () => {
+  };
+  const promise = new Promise((_resolve, reject) => {
+    fire = reject;
+  });
+  const onAbort = () => fire(new Error(message));
+  if (signal.aborted) onAbort();
+  else signal.addEventListener("abort", onAbort, { once: true });
+  return {
+    promise,
+    dispose: () => signal.removeEventListener("abort", onAbort)
+  };
+}
+function destroyQuietly(stream) {
+  try {
+    stream?.destroy?.();
+  } catch {
+  }
+}
 function shellEscape4(s2) {
   return `'${s2.replace(/'/g, "'\\''")}'`;
 }
@@ -668,12 +783,12 @@ var DockerBackupExecutor = class {
       WorkingDir: opts?.cwd,
       Env: opts?.env ? Object.entries(opts.env).map(([k2, v2]) => `${k2}=${v2}`) : void 0
     });
-    const stream = await exec.start({ hijack: true, stdin: false });
+    const stream = await exec.start({ stdin: false });
     return this.attachDemuxed(this.dockerode, exec.id, stream, opts?.timeoutMs);
   }
   async streamPath(service, sourceId, opts) {
     const sources = await this.listSources(service);
-    const source = sources.find((s2) => s2.id === sourceId);
+    const source = matchBackupSource(sources, sourceId);
     if (!source) {
       throw new Error(`Backup source "${sourceId}" not found on service ${service.name}`);
     }
@@ -691,31 +806,52 @@ var DockerBackupExecutor = class {
     await this.ensureImage(helperImage);
     const hostConfig = {
       Binds: [`${source.source}:/mnt:ro`],
-      AutoRemove: true
+      // OFF, for the reason demuxContainerStream already documents but this line
+      // used to contradict: AutoRemove lets the daemon reap the helper before
+      // container.wait() answers and before the attach stream has drained, which
+      // is a 404 on the exit status or a truncated tar. demuxContainerStream
+      // removes it once the archive is fully demuxed.
+      AutoRemove: false,
+      // The archive streams over `attach()` below — the daemon's default
+      // json-file driver would ALSO write every byte of it to
+      // /var/lib/docker/containers as a log. That's a second copy of the whole
+      // backup, and worse than a copy: json-file escapes binary, so a 4.6 GB
+      // volume ballooned to a 12 GB log file here. Backups then spike the
+      // host's disk by more than the data they read and only release it when
+      // the helper exits. Nothing ever reads these logs.
+      LogConfig: { Type: "none", Config: {} }
     };
-    const helper = await this.dockerode.createContainer({
-      Image: helperImage,
-      Cmd: ["sh", "-c", compression === "zstd" ? `apk add --no-cache zstd >/dev/null 2>&1; ${tarCmd}` : tarCmd],
-      HostConfig: hostConfig,
-      AttachStdout: true,
-      AttachStderr: true,
-      Tty: false,
-      // zstd isn't in alpine:3 and is apk-installed at runtime, which needs
-      // egress; gzip/none use busybox built-ins and stay network-isolated.
-      NetworkDisabled: compression !== "zstd"
-    });
-    const stream = await helper.attach({
-      stream: true,
-      stdout: true,
-      stderr: true
-    });
-    await helper.start();
-    const timeoutMs = opts ? opts.timeoutMs : void 0;
-    return this.demuxContainerStream(helper, stream, timeoutMs ?? 60 * 60 * 1e3);
+    return this.handOffHelper(
+      {
+        Image: helperImage,
+        Cmd: ["sh", "-c", compression === "zstd" ? `apk add --no-cache zstd >/dev/null 2>&1; ${tarCmd}` : tarCmd],
+        HostConfig: hostConfig,
+        AttachStdout: true,
+        AttachStderr: true,
+        Tty: false,
+        // zstd isn't in alpine:3 and is apk-installed at runtime, which needs
+        // egress; gzip/none use busybox built-ins and stay network-isolated.
+        NetworkDisabled: compression !== "zstd"
+      },
+      async (helper) => {
+        const stream = await helper.attach({
+          stream: true,
+          stdout: true,
+          stderr: true
+        });
+        await helper.start();
+        return this.demuxContainerStream(helper, stream, {
+          idleTimeoutMs: opts?.idleTimeoutMs ?? DEFAULT_HELPER_IDLE_MS,
+          timeoutMs: opts?.timeoutMs ?? DEFAULT_HELPER_TIMEOUT_MS,
+          label: `Backup of "${sourceId}" on service ${service.name}`
+        });
+      }
+    );
   }
   async receiveStream(service, targetSourceId, body, opts) {
+    opts?.signal?.throwIfAborted();
     const sources = await this.listSources(service);
-    const source = sources.find((s2) => s2.id === targetSourceId);
+    const source = matchBackupSource(sources, targetSourceId);
     if (!source) {
       throw new Error(`Restore target "${targetSourceId}" not found on service ${service.name}`);
     }
@@ -727,49 +863,188 @@ var DockerBackupExecutor = class {
     await this.ensureImage(helperImage);
     const clearCmd = opts?.clearTarget ? `find /mnt -mindepth 1 -delete 2>/dev/null || true; ` : "";
     const untarCmd = compression === "zstd" ? `${clearCmd}zstd -d -c | tar -x -C /mnt` : `${clearCmd}tar -x${compressionFlag(compression)}f - -C /mnt`;
-    const helper = await this.dockerode.createContainer({
-      Image: helperImage,
-      Cmd: [
-        "sh",
-        "-c",
-        compression === "zstd" ? `apk add --no-cache zstd >/dev/null 2>&1; ${untarCmd}` : untarCmd
-      ],
-      HostConfig: { Binds: [`${source.source}:/mnt`], AutoRemove: true },
-      AttachStdin: true,
-      AttachStdout: true,
-      AttachStderr: true,
-      OpenStdin: true,
-      StdinOnce: true,
-      Tty: false,
-      // zstd isn't in alpine:3 and is apk-installed at runtime, which needs
-      // egress; gzip/none use busybox built-ins and stay network-isolated.
-      NetworkDisabled: compression !== "zstd"
-    });
-    const stream = await helper.attach({
-      stream: true,
-      hijack: true,
-      stdin: true,
-      stdout: true,
-      stderr: true
-    });
-    await helper.start();
-    let bytesWritten = 0;
-    body.on("data", (chunk) => {
-      bytesWritten += chunk.byteLength;
-    });
-    const errChunks = [];
-    stream.on("data", (c2) => {
-      if (errChunks.length < 32) errChunks.push(c2);
-    });
-    body.pipe(stream);
-    const waitResult = await helper.wait();
-    if (waitResult.StatusCode !== 0) {
-      const detail = Buffer.concat(errChunks).toString("utf8").replace(/[^\x20-\x7e\n]+/g, " ").trim().slice(-500);
-      throw new Error(
-        `Restore helper exited with code ${waitResult.StatusCode}${detail ? `: ${detail}` : ""}`
+    return this.withHelper(
+      {
+        Image: helperImage,
+        Cmd: [
+          "sh",
+          "-c",
+          compression === "zstd" ? `apk add --no-cache zstd >/dev/null 2>&1; ${untarCmd}` : untarCmd
+        ],
+        // AutoRemove is OFF deliberately, and this is the fix for the `404 no such
+        // container` in #434: with it on, the daemon could reap the helper before
+        // /containers/{id}/wait answered, and the exit status was then unknowable.
+        // withHelper reaps instead — which also plugs a leak AutoRemove never
+        // covered, since it only fires for a container that actually started.
+        HostConfig: { Binds: [`${source.source}:/mnt`], AutoRemove: false },
+        AttachStdin: true,
+        AttachStdout: true,
+        AttachStderr: true,
+        OpenStdin: true,
+        StdinOnce: true,
+        Tty: false,
+        // zstd isn't in alpine:3 and is apk-installed at runtime, which needs
+        // egress; gzip/none use busybox built-ins and stay network-isolated.
+        NetworkDisabled: compression !== "zstd"
+      },
+      async (helper) => {
+        let stream;
+        const idleMs = opts?.idleTimeoutMs ?? DEFAULT_HELPER_IDLE_MS;
+        const watchdog = createIdleWatchdog(
+          idleMs,
+          `Restore of "${targetSourceId}" on service ${service.name} moved no data for ${Math.round(idleMs / 1e3)}s and was abandoned. The extract helper has been removed; the target may hold partial data.`
+        );
+        const abortWatch = opts?.signal ? createAbortWatch(
+          opts.signal,
+          `Restore of "${targetSourceId}" on service ${service.name} was cancelled mid-extract. The target holds partial data.`
+        ) : void 0;
+        try {
+          stream = await startAttachStream(daemonConnectionFrom(this.dockerode), helper.id, {
+            stdin: true,
+            stdout: true,
+            stderr: true
+          });
+          await helper.start();
+          let bytesWritten = 0;
+          let bodyEnded = false;
+          body.on("data", (chunk) => {
+            bytesWritten += chunk.byteLength;
+            watchdog.touch();
+          });
+          const errChunks = [];
+          stream.on("data", (c2) => {
+            watchdog.touch();
+            if (errChunks.length < 32) errChunks.push(c2);
+          });
+          body.on("end", () => {
+            bodyEnded = true;
+            watchdog.touch();
+          });
+          body.pipe(stream);
+          const waitResult = await this.awaitHelperExit(helper, watchdog, () => bodyEnded, {
+            timeoutMs: opts?.timeoutMs ?? DEFAULT_HELPER_TIMEOUT_MS,
+            label: `Restore of "${targetSourceId}" on service ${service.name}`,
+            note: "The target may hold partial data.",
+            cancelled: abortWatch?.promise
+          });
+          if (waitResult.StatusCode !== 0) {
+            const detail = Buffer.concat(errChunks).toString("utf8").replace(/[^\x20-\x7e\n]+/g, " ").trim().slice(-500);
+            throw new Error(
+              `Restore helper exited with code ${waitResult.StatusCode}${detail ? `: ${detail}` : ""}`
+            );
+          }
+          return { bytesWritten };
+        } finally {
+          watchdog.dispose();
+          abortWatch?.dispose();
+          destroyQuietly(stream);
+          destroyQuietly(body);
+        }
+      }
+    );
+  }
+  /**
+   * Create a helper, run `fn`, reap the helper however `fn` ends.
+   *
+   * Every helper here is disposable and every one of them must be removed by us:
+   * `AutoRemove` is off on purpose (it races /wait, and it only ever fires for a
+   * container that actually started, so a throw between create and start leaked
+   * one permanently — the leak behind #434). Four call sites each had their own
+   * correct copy of that reap, which is exactly how one of them came to be the
+   * one that didn't.
+   *
+   * NOT for helpers whose output outlives the call: streamPath hands its
+   * container to demuxContainerStream, which must reap only after the archive
+   * has drained. `handOffHelper` covers that shape.
+   */
+  async withHelper(spec, fn) {
+    const helper = await this.dockerode.createContainer(spec);
+    try {
+      return await fn(helper);
+    } finally {
+      await helper.remove({ force: true }).catch(() => {
+      });
+    }
+  }
+  /**
+   * Create a helper whose lifetime outlives this call: reap it only if `setup`
+   * throws, then hand ownership to whatever `setup` returned. Without this, a
+   * failure between createContainer and the hand-off leaks the container
+   * forever — nothing downstream knows it exists yet.
+   */
+  async handOffHelper(spec, setup) {
+    const helper = await this.dockerode.createContainer(spec);
+    try {
+      return await setup(helper);
+    } catch (err) {
+      await helper.remove({ force: true }).catch(() => {
+      });
+      throw err;
+    }
+  }
+  /**
+   * Wait for a helper to exit without trusting any single signal.
+   *
+   * `helper.wait()` alone is what hung in #434: /containers/{id}/wait is a
+   * long-poll with no timeout on either the modem or our transport, so a lost
+   * response is indistinguishable from a running container — forever. Three
+   * backstops race it:
+   *
+   *   1. An exit poll that asks the daemon directly. This is what turns the
+   *      common hang into a few seconds. It's the same "don't trust the attach
+   *      stream's terminal signal" reasoning already documented in
+   *      demuxContainerStream; receiveStream was the path without a backstop.
+   *   2. The caller's idle watchdog (fed by real traffic, not by this function).
+   *   3. An absolute ceiling, so even a helper that somehow keeps trickling
+   *      bytes cannot run unbounded.
+   *
+   * The poll only starts once the body has been fully written: before that a
+   * not-yet-running helper is normal, and inspecting on a loop would be noise.
+   * It is gated on the body rather than on the attach stream closing because
+   * over an SSH-tunneled attach that close is not reliably delivered — the very
+   * reason this backstop has to exist.
+   */
+  async awaitHelperExit(helper, watchdog, bodyEnded, opts) {
+    let polling = true;
+    const pollExit = async () => {
+      while (polling) {
+        await new Promise((r2) => {
+          const t8 = setTimeout(r2, EXIT_POLL_INTERVAL_MS);
+          t8.unref?.();
+        });
+        if (!polling || !bodyEnded()) continue;
+        let state;
+        try {
+          state = (await helper.inspect()).State ?? {};
+        } catch (err) {
+          if (err?.statusCode === 404) {
+            throw new Error(
+              `${opts.label}: the helper disappeared before its exit status could be read.${opts.note ? ` ${opts.note}` : ""}`
+            );
+          }
+          continue;
+        }
+        if (state.Running === false && state.Status !== "created" && typeof state.ExitCode === "number") {
+          return { StatusCode: state.ExitCode };
+        }
+      }
+      return new Promise(() => {
+      });
+    };
+    try {
+      return await withTimeout(
+        Promise.race([
+          helper.wait(),
+          pollExit(),
+          watchdog.promise,
+          ...opts.cancelled ? [opts.cancelled] : []
+        ]),
+        opts.timeoutMs,
+        `${opts.label} exceeded its ${Math.round(opts.timeoutMs / 1e3)}s ceiling and was abandoned.${opts.note ? ` ${opts.note}` : ""}`
       );
+    } finally {
+      polling = false;
     }
-    return { bytesWritten };
   }
   /**
    * SAME-DAEMON volume→volume copy in ONE helper container that mounts both
@@ -783,8 +1058,8 @@ var DockerBackupExecutor = class {
    * network-isolated; source is mounted read-only.
    */
   async copyVolumeLocal(srcService, srcSourceId, dstService, dstSourceId, opts) {
-    const src = (await this.listSources(srcService)).find((s2) => s2.id === srcSourceId);
-    const dst = (await this.listSources(dstService)).find((s2) => s2.id === dstSourceId);
+    const src = matchBackupSource(await this.listSources(srcService), srcSourceId);
+    const dst = matchBackupSource(await this.listSources(dstService), dstSourceId);
     if (!src) throw new Error(`Copy source "${srcSourceId}" not found on ${srcService.name}`);
     if (!dst) throw new Error(`Copy target "${dstSourceId}" not found on ${dstService.name}`);
     if (src.type === "tmpfs" || dst.type === "tmpfs") {
@@ -793,31 +1068,30 @@ var DockerBackupExecutor = class {
     await this.ensureImage(HELPER_IMAGE);
     const clearCmd = opts?.clearTarget ? "find /to -mindepth 1 -delete 2>/dev/null || true; " : "";
     const copyCmd = `${clearCmd}{ tar -C /from -cf - . ; echo $? > /tmp/src.rc ; } | tar -C /to -xf - ; rc=$? ; [ "$(cat /tmp/src.rc 2>/dev/null)" = 0 ] && [ "$rc" = 0 ] && du -sk /to 2>/dev/null | cut -f1`;
-    const helper = await this.dockerode.createContainer({
-      Image: HELPER_IMAGE,
-      Cmd: ["sh", "-c", copyCmd],
-      HostConfig: {
-        Binds: [`${src.source}:/from:ro`, `${dst.source}:/to`]
+    return this.withHelper(
+      {
+        Image: HELPER_IMAGE,
+        Cmd: ["sh", "-c", copyCmd],
+        HostConfig: {
+          Binds: [`${src.source}:/from:ro`, `${dst.source}:/to`]
+        },
+        Tty: true,
+        // merged raw stdout so the trailing `du` number reads cleanly
+        NetworkDisabled: true
       },
-      Tty: true,
-      // merged raw stdout so the trailing `du` number reads cleanly
-      NetworkDisabled: true
-    });
-    try {
-      await helper.start();
-      const res = await helper.wait();
-      const out = await helper.logs({ follow: false, stdout: true, stderr: true }).then((b2) => b2.toString().trim()).catch(() => "");
-      if (res.StatusCode !== 0) {
-        throw new Error(
-          `Local volume copy failed (${srcSourceId}\u2192${dstSourceId}): ${out.slice(0, 500) || `exit ${res.StatusCode}`}`
-        );
+      async (helper) => {
+        await helper.start();
+        const res = await helper.wait();
+        const out = await helper.logs({ follow: false, stdout: true, stderr: true }).then((b2) => b2.toString().trim()).catch(() => "");
+        if (res.StatusCode !== 0) {
+          throw new Error(
+            `Local volume copy failed (${srcSourceId}\u2192${dstSourceId}): ${out.slice(0, 500) || `exit ${res.StatusCode}`}`
+          );
+        }
+        const kb = parseInt(out.split(/\s+/).pop() || "0", 10);
+        return { bytesWritten: Number.isFinite(kb) ? kb * 1024 : 0 };
       }
-      const kb = parseInt(out.split(/\s+/).pop() || "0", 10);
-      return { bytesWritten: Number.isFinite(kb) ? kb * 1024 : 0 };
-    } finally {
-      await helper.remove({ force: true }).catch(() => {
-      });
-    }
+    );
   }
   /**
    * Does the named volume behind `sourceId` already exist on this daemon, and
@@ -827,7 +1101,7 @@ var DockerBackupExecutor = class {
    * so we err on the side of NOT clobbering.
    */
   async probeVolume(service, sourceId) {
-    const source = (await this.listSources(service)).find((s2) => s2.id === sourceId);
+    const source = matchBackupSource(await this.listSources(service), sourceId);
     if (!source || source.type !== "volume" || !source.source) {
       return { exists: false, empty: true };
     }
@@ -837,26 +1111,25 @@ var DockerBackupExecutor = class {
       return { exists: false, empty: true };
     }
     await this.ensureImage(HELPER_IMAGE);
-    const helper = await this.dockerode.createContainer({
-      Image: HELPER_IMAGE,
-      Cmd: [
-        "sh",
-        "-c",
-        'if [ -z "$(ls -A /probe 2>/dev/null)" ]; then echo VOLEMPTY; else echo VOLDATA; fi'
-      ],
-      HostConfig: { Binds: [`${source.source}:/probe:ro`] },
-      Tty: true,
-      NetworkDisabled: true
-    });
-    try {
-      await helper.start();
-      await helper.wait();
-      const out = await helper.logs({ follow: false, stdout: true, stderr: true }).then((b2) => b2.toString()).catch(() => "");
-      return { exists: true, empty: out.includes("VOLEMPTY") };
-    } finally {
-      await helper.remove({ force: true }).catch(() => {
-      });
-    }
+    return this.withHelper(
+      {
+        Image: HELPER_IMAGE,
+        Cmd: [
+          "sh",
+          "-c",
+          'if [ -z "$(ls -A /probe 2>/dev/null)" ]; then echo VOLEMPTY; else echo VOLDATA; fi'
+        ],
+        HostConfig: { Binds: [`${source.source}:/probe:ro`] },
+        Tty: true,
+        NetworkDisabled: true
+      },
+      async (helper) => {
+        await helper.start();
+        await helper.wait();
+        const out = await helper.logs({ follow: false, stdout: true, stderr: true }).then((b2) => b2.toString()).catch(() => "");
+        return { exists: true, empty: out.includes("VOLEMPTY") };
+      }
+    );
   }
   async pipeIntoCommand(service, cmd, body, opts) {
     if (!service.containerId) {
@@ -874,7 +1147,10 @@ var DockerBackupExecutor = class {
       WorkingDir: opts?.cwd,
       Env: opts?.env ? Object.entries(opts.env).map(([k2, v2]) => `${k2}=${v2}`) : void 0
     });
-    const stream = await exec.start({ hijack: true, stdin: true });
+    const stream = await startExecStream(daemonConnectionFrom(this.dockerode), exec.id, {
+      tty: false,
+      stdin: true
+    });
     const stderrChunks = [];
     const { PassThrough: PassThrough3 } = await import("stream");
     const stdoutSink = new PassThrough3();
@@ -906,9 +1182,8 @@ var DockerBackupExecutor = class {
       stream.on("end", async () => {
         if (timer) clearTimeout(timer);
         try {
-          const info = await this.dockerode.getExec(exec.id).inspect();
           resolve4({
-            code: info.ExitCode ?? 0,
+            code: await resolveExecExitCode(exec, exec.id),
             stderr: Buffer.concat(stderrChunks).toString("utf8").slice(0, 16 * 1024)
           });
         } catch (err) {
@@ -971,9 +1246,8 @@ var DockerBackupExecutor = class {
       stream.on("end", async () => {
         if (timer) clearTimeout(timer);
         try {
-          const info = await docker.getExec(execId).inspect();
           resolve4({
-            code: info.ExitCode ?? 0,
+            code: await resolveExecExitCode(docker.getExec(execId), execId),
             stderr: Buffer.concat(stderrChunks).toString("utf8").slice(0, 16 * 1024)
           });
         } catch (err) {
@@ -987,7 +1261,7 @@ var DockerBackupExecutor = class {
     });
     return { stdout, awaitExit };
   }
-  demuxContainerStream(container, stream, timeoutMs) {
+  demuxContainerStream(container, stream, opts) {
     const stdout = new PassThrough();
     const stderrChunks = [];
     const stderrSink = new PassThrough();
@@ -995,29 +1269,49 @@ var DockerBackupExecutor = class {
       if (stderrChunks.length < 16) stderrChunks.push(chunk);
     });
     container.modem.demuxStream(stream, stdout, stderrSink);
+    let sinksEnded = false;
+    let exited = false;
+    const reapIfDone = () => {
+      if (!sinksEnded || !exited) return;
+      void container.remove({ force: true }).catch(() => {
+      });
+    };
     const endSinks = () => {
       stdout.end();
       stderrSink.end();
+      sinksEnded = true;
+      reapIfDone();
     };
     stream.on("end", endSinks);
     stream.on("close", endSinks);
-    const awaitExit = new Promise((resolve4, reject) => {
-      const timer = timeoutMs ? setTimeout(() => {
-        stdout.destroy(new Error(`helper container timed out after ${timeoutMs}ms`));
-        reject(new Error(`helper container timed out after ${timeoutMs}ms`));
-      }, timeoutMs) : null;
-      container.wait().then((res) => {
-        if (timer) clearTimeout(timer);
+    const watchdog = createIdleWatchdog(
+      opts.idleTimeoutMs,
+      `${opts.label} produced no data for ${Math.round(opts.idleTimeoutMs / 1e3)}s and was abandoned. Nothing was written; the archive is incomplete and was not kept.`
+    );
+    stream.on("data", () => watchdog.touch());
+    const awaitExit = (async () => {
+      try {
+        const res = await this.awaitHelperExit(container, watchdog, () => sinksEnded, {
+          timeoutMs: opts.timeoutMs,
+          label: opts.label,
+          note: "Nothing was written; the archive is incomplete and was not kept."
+        });
+        exited = true;
         setTimeout(endSinks, 3e3);
-        resolve4({
+        reapIfDone();
+        return {
           code: res.StatusCode,
           stderr: Buffer.concat(stderrChunks).toString("utf8").slice(0, 16 * 1024)
+        };
+      } catch (err) {
+        stdout.destroy(err);
+        void container.remove({ force: true }).catch(() => {
         });
-      }).catch((err) => {
-        if (timer) clearTimeout(timer);
-        reject(err);
-      });
-    });
+        throw err;
+      } finally {
+        watchdog.dispose();
+      }
+    })();
     return { stdout, awaitExit };
   }
 };
@@ -1259,7 +1553,7 @@ var BareBackupExecutor = class {
     ]);
     const path = sourceId;
     const tarCmd = compression === "zstd" ? `tar -c -C ${shellEscape6(path)} ${excludeArgs.join(" ")} . | zstd -c -3` : compression === "gzip" ? `tar -cz -C ${shellEscape6(path)} ${excludeArgs.join(" ")} .` : `tar -c -C ${shellEscape6(path)} ${excludeArgs.join(" ")} .`;
-    return this.execStream(service, ["sh", "-c", tarCmd]);
+    return this.execStream(service, ["sh", "-c", tarCmd], { timeoutMs: opts?.timeoutMs });
   }
   async receiveStream(service, targetSourceId, body, opts) {
     const compression = opts?.compression ?? "zstd";
@@ -1370,7 +1664,7 @@ var LocalDestinationImpl = class {
       return { ok: false, reason: message };
     }
   }
-  async put(key, body, _opts) {
+  async put(key, body, opts) {
     const targetPath = this.resolveKey(key);
     await fs2.mkdir(dirname(targetPath), { recursive: true });
     const tmpPath = `${targetPath}.tmp-${randomBytes3(4).toString("hex")}`;
@@ -1383,15 +1677,23 @@ var LocalDestinationImpl = class {
         cb(null, chunk);
       }
     });
+    let digest;
     try {
       await pipelineP(body, counterAndHasher, createWriteStream2(tmpPath));
+      digest = hash.digest("hex");
+      const expected = opts.sha256?.trim().replace(/^sha256:/i, "").toLowerCase();
+      if (expected && expected !== digest) {
+        throw new Error(
+          `sha256 mismatch writing ${key}: caller declared ${expected}, bytes hashed to ${digest}`
+        );
+      }
       await fs2.rename(tmpPath, targetPath);
     } catch (err) {
       await fs2.unlink(tmpPath).catch(() => {
       });
       throw err;
     }
-    return { bytesWritten, etag: hash.digest("hex") };
+    return { bytesWritten, etag: digest };
   }
   async get(key) {
     const path = this.resolveKey(key);
@@ -10976,10 +11278,10 @@ var package_default = {
 // ../../node_modules/@aws-sdk/credential-provider-node/dist-es/remoteProvider.js
 var ENV_IMDS_DISABLED = "AWS_EC2_METADATA_DISABLED";
 var remoteProvider = async (init) => {
-  const { ENV_CMDS_FULL_URI, ENV_CMDS_RELATIVE_URI, fromContainerMetadata, fromInstanceMetadata } = await import("./dist-es-VNKHQVIB.js");
+  const { ENV_CMDS_FULL_URI, ENV_CMDS_RELATIVE_URI, fromContainerMetadata, fromInstanceMetadata } = await import("./dist-es-IOH6G4GM.js");
   if (process.env[ENV_CMDS_RELATIVE_URI] || process.env[ENV_CMDS_FULL_URI]) {
     init.logger?.debug("@aws-sdk/credential-provider-node - remoteProvider::fromHttp/fromContainerMetadata");
-    const { fromHttp } = await import("./dist-es-5DY7K32L.js");
+    const { fromHttp } = await import("./dist-es-UYDDOVZ3.js");
     return chain(fromHttp(init), fromContainerMetadata(init));
   }
   if (process.env[ENV_IMDS_DISABLED] && process.env[ENV_IMDS_DISABLED] !== "false") {
@@ -11091,22 +11393,22 @@ var defaultProvider = (init = {}) => memoizeChain([
     if (!ssoStartUrl && !ssoAccountId && !ssoRegion && !ssoRoleName && !ssoSession) {
       throw new CredentialsProviderError("Skipping SSO provider in default chain (inputs do not include SSO fields).", { logger: init.logger });
     }
-    const { fromSSO } = await import("./dist-es-WV4AMOII.js");
+    const { fromSSO } = await import("./dist-es-XUOR4NQN.js");
     return fromSSO(init)(awsIdentityProperties);
   },
   async (awsIdentityProperties) => {
     init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromIni");
-    const { fromIni } = await import("./dist-es-RYHIPOTN.js");
+    const { fromIni } = await import("./dist-es-JGBPABJI.js");
     return fromIni(init)(awsIdentityProperties);
   },
   async (awsIdentityProperties) => {
     init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromProcess");
-    const { fromProcess } = await import("./dist-es-OSNJBLXB.js");
+    const { fromProcess } = await import("./dist-es-CCVZEFRZ.js");
     return fromProcess(init)(awsIdentityProperties);
   },
   async (awsIdentityProperties) => {
     init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromTokenFile");
-    const { fromTokenFile } = await import("./dist-es-X3B5QYKB.js");
+    const { fromTokenFile } = await import("./dist-es-2YRDXMUU.js");
     return fromTokenFile(init)(awsIdentityProperties);
   },
   async () => {
@@ -12191,7 +12493,7 @@ var S3DestinationImpl = class {
     if (!accessKeyId || !secretAccessKey) {
       throw new Error(`S3Destination "${row.name}" missing access credentials`);
     }
-    const isAws = !row.endpoint || row.endpoint.includes(".amazonaws.com") || row.endpoint === "https://s3.amazonaws.com";
+    const isAws = isAwsS3Endpoint(row.endpoint);
     this.client = new S3Client({
       endpoint: row.endpoint ?? void 0,
       region: row.region ?? "auto",
@@ -12668,11 +12970,11 @@ registerDestination("sftp", (row) => new SftpDestinationImpl(row));
 registerDestination("openship_server", (row) => new SftpDestinationImpl(row));
 
 // src/lib/compose.ts
-import { spawnSync as spawnSync3 } from "child_process";
+import { spawn as spawn2, spawnSync as spawnSync3 } from "child_process";
 import { randomBytes as randomBytes5 } from "crypto";
-import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { chmodSync, existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
 import { homedir as homedir2, userInfo } from "os";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 
 // src/lib/paths.ts
 import { homedir } from "os";
@@ -12681,17 +12983,193 @@ var DEFAULT_HOME = join3(homedir(), ".openship");
 var override = process.env.OPENSHIP_HOME?.trim();
 var OS_DIR = override ? resolve2(override) : DEFAULT_HOME;
 var IS_ALT_HOME = OS_DIR !== DEFAULT_HOME;
+var DATA_DIR = join3(OS_DIR, "data");
+var LOG_DIR = join3(OS_DIR, "logs");
+var AUTH_SECRET_FILE = join3(OS_DIR, "auth-secret");
+var INTERNAL_TOKEN_FILE = join3(OS_DIR, "internal-token");
+
+// src/lib/ports.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { join as join4 } from "path";
+
+// ../../packages/core/src/ports.ts
+import { createServer } from "net";
+var DEFAULT_API_PORT = 4e3;
+var DEFAULT_DASHBOARD_PORT = 3001;
+var LOOPBACK = "127.0.0.1";
+var SCAN_SPAN = 20;
+var MAX_PORT = 65535;
+function isPortFree(port, host = LOOPBACK) {
+  return new Promise((resolve4) => {
+    const srv = createServer();
+    srv.once("error", () => resolve4(false));
+    srv.listen(port, host, () => srv.close(() => resolve4(true)));
+  });
+}
+async function waitPortFree(port, opts = {}) {
+  const timeoutMs = opts.timeoutMs ?? 6e3;
+  const intervalMs = opts.intervalMs ?? 250;
+  const host = opts.host ?? LOOPBACK;
+  const deadline = Date.now() + timeoutMs;
+  for (; ; ) {
+    if (await isPortFree(port, host)) return true;
+    if (Date.now() >= deadline) return false;
+    await new Promise((r2) => setTimeout(r2, intervalMs));
+  }
+}
+function getFreePort(host = LOOPBACK) {
+  return new Promise((resolve4, reject) => {
+    const srv = createServer();
+    srv.once("error", reject);
+    srv.listen(0, host, () => {
+      const addr = srv.address();
+      const port = addr && typeof addr === "object" ? addr.port : 0;
+      srv.close(() => port ? resolve4(port) : reject(new Error("no free port")));
+    });
+  });
+}
+async function findPortNear(from, opts = {}) {
+  const host = opts.host ?? LOOPBACK;
+  const span = opts.span ?? SCAN_SPAN;
+  const skip = opts.skip ?? (() => false);
+  for (let port2 = from; port2 <= Math.min(from + span, MAX_PORT); port2++) {
+    if (!skip(port2) && await isPortFree(port2, host)) return port2;
+  }
+  let port = await getFreePort(host);
+  for (let tries = 0; tries < 10 && skip(port); tries++) port = await getFreePort(host);
+  return port;
+}
+async function resolvePortPair(prefs = {}) {
+  const host = prefs.bindAddr?.trim() || LOOPBACK;
+  const ours = new Set(prefs.reclaimable ?? []);
+  const prefFor = (kind) => prefs[kind] ?? prefs.previous?.[kind] ?? prefs.stored?.[kind] ?? prefs.defaults?.[kind];
+  const remembered = (kind, pref) => prefs[kind] === void 0 && (prefs.previous?.[kind] === pref || prefs.stored?.[kind] === pref);
+  const availableForPref = async (port) => ours.has(port) || await isPortFree(port, host);
+  const apiPref = prefFor("api");
+  const dashPref = prefFor("dashboard");
+  let api;
+  if (apiPref === void 0) api = await getFreePort(host);
+  else if (await availableForPref(apiPref)) api = apiPref;
+  else if (remembered("api", apiPref) && await waitPortFree(apiPref, { host })) api = apiPref;
+  else {
+    api = await findPortNear(apiPref + 1, {
+      host,
+      skip: (p2) => ours.has(p2) || p2 === dashPref
+    });
+  }
+  const skipForDash = (p2) => ours.has(p2) || p2 === api;
+  let dashboard;
+  if (dashPref === void 0) {
+    dashboard = await getFreePort(host);
+    for (let tries = 0; tries < 10 && dashboard === api; tries++) {
+      dashboard = await getFreePort(host);
+    }
+  } else if (dashPref !== api && await availableForPref(dashPref)) {
+    dashboard = dashPref;
+  } else if (dashPref !== api && remembered("dashboard", dashPref) && await waitPortFree(dashPref, { host })) {
+    dashboard = dashPref;
+  } else {
+    dashboard = await findPortNear(dashPref + 1, { host, skip: skipForDash });
+  }
+  return {
+    api,
+    dashboard,
+    switched: {
+      api: apiPref !== void 0 && api !== apiPref,
+      dashboard: dashPref !== void 0 && dashboard !== dashPref
+    },
+    preferred: { api: apiPref ?? api, dashboard: dashPref ?? dashboard }
+  };
+}
+
+// src/lib/ports.ts
+var PORTS_FILE = join4(OS_DIR, "ports.json");
+var INSTANCE_FILE = join4(OS_DIR, "instance.json");
+function saveInstanceUrl(publicUrl) {
+  try {
+    if (!existsSync(OS_DIR)) mkdirSync(OS_DIR, { recursive: true, mode: 448 });
+    writeFileSync(INSTANCE_FILE, JSON.stringify({ publicUrl: publicUrl ?? null }));
+  } catch {
+  }
+}
+function readInstanceUrl() {
+  try {
+    return JSON.parse(readFileSync(INSTANCE_FILE, "utf8")).publicUrl ?? null;
+  } catch {
+    return null;
+  }
+}
+function readStoredPorts() {
+  try {
+    return JSON.parse(readFileSync(PORTS_FILE, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+function storedApiPort() {
+  return readStoredPorts().api ?? DEFAULT_API_PORT;
+}
+function storedDashboardPort() {
+  return readStoredPorts().dashboard ?? DEFAULT_DASHBOARD_PORT;
+}
+function saveStoredPorts(api, dashboard) {
+  try {
+    if (!existsSync(OS_DIR)) mkdirSync(OS_DIR, { recursive: true, mode: 448 });
+    writeFileSync(PORTS_FILE, JSON.stringify({ api, dashboard }));
+  } catch {
+  }
+}
+function portMoveNotice(resolved, trustedOriginUrls = []) {
+  if (!resolved.switched.api && !resolved.switched.dashboard) return [];
+  const lines = [
+    `A preferred port was busy \u2014 using API ${resolved.api}, dashboard ${resolved.dashboard}.`
+  ];
+  const stale = [...new Set(stalePortOrigins(resolved.preferred.dashboard, trustedOriginUrls))];
+  if (stale.length) {
+    lines.push(
+      `Heads up: ${stale.join(", ")} still names port ${resolved.preferred.dashboard}, so logins`,
+      `from that origin will be rejected. Point it at :${resolved.dashboard} (or free port`,
+      `${resolved.preferred.dashboard} and re-run to move back).`
+    );
+  }
+  return lines;
+}
+function stalePortOrigins(movedFrom, urls) {
+  const stale = [];
+  for (const raw of urls) {
+    for (const candidate of (raw ?? "").split(",")) {
+      const value = candidate.trim();
+      if (!value) continue;
+      try {
+        if (new URL(value).port === String(movedFrom)) stale.push(value);
+      } catch {
+      }
+    }
+  }
+  return stale;
+}
+async function resolvePorts(prefs, opts = {}) {
+  const resolved = await resolvePortPair({
+    ...prefs,
+    stored: readStoredPorts(),
+    defaults: { api: DEFAULT_API_PORT, dashboard: DEFAULT_DASHBOARD_PORT }
+  });
+  if (opts.persist !== false) saveStoredPorts(resolved.api, resolved.dashboard);
+  return resolved;
+}
 
 // src/lib/source-install.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync2, readFileSync } from "fs";
-import { join as join5 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+import { join as join6 } from "path";
 
 // src/lib/from-source.ts
 import { spawn, spawnSync } from "child_process";
-import { existsSync, mkdirSync } from "fs";
-import { join as join4, resolve as resolve3 } from "path";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
+import { join as join5, resolve as resolve3 } from "path";
 var DEFAULT_REPO = "https://github.com/oblien/openship.git";
+var SOURCE_CHECKOUT_DIR = join5(OS_DIR, "src");
+var SOURCE_DIST_DIR = join5(OS_DIR, "from-source-dist");
 function has(cmd) {
   try {
     return spawnSync(cmd, ["--version"], { stdio: "ignore" }).status === 0;
@@ -12720,7 +13198,7 @@ function shortSha(cwd) {
   return r2.status === 0 ? (r2.stdout ?? "").trim() || "unknown" : "unknown";
 }
 function isMonorepo(dir) {
-  return existsSync(join4(dir, "package.json")) && existsSync(join4(dir, "apps/api/package.json")) && existsSync(join4(dir, "apps/dashboard/package.json"));
+  return existsSync2(join5(dir, "package.json")) && existsSync2(join5(dir, "apps/api/package.json")) && existsSync2(join5(dir, "apps/dashboard/package.json"));
 }
 async function prepareFromSource(opts) {
   if (!has("bun")) {
@@ -12744,9 +13222,9 @@ async function prepareFromSource(opts) {
     }
     ref = (opts.ref || "main").trim();
     const repoUrl = opts.repo || DEFAULT_REPO;
-    sourceDir = join4(OS_DIR, "src");
-    mkdirSync(OS_DIR, { recursive: true });
-    if (!existsSync(join4(sourceDir, ".git"))) {
+    sourceDir = SOURCE_CHECKOUT_DIR;
+    mkdirSync2(OS_DIR, { recursive: true });
+    if (!existsSync2(join5(sourceDir, ".git"))) {
       console.log(`  Cloning ${repoUrl} \u2192 ${sourceDir}`);
       await run("git", ["clone", repoUrl, sourceDir], OS_DIR);
     }
@@ -12761,29 +13239,29 @@ async function prepareFromSource(opts) {
   console.log(`  Source: ${sourceDir} @ ${ref} (${sha})`);
   console.log("  Installing workspace dependencies (bun install)\u2026");
   await run("bun", ["install"], sourceDir);
-  const distDir = join4(OS_DIR, "from-source-dist");
+  const distDir = SOURCE_DIST_DIR;
   console.log("  Building release dist (compiles the dashboard \u2014 needs RAM/CPU)\u2026");
   await run(
     "bun",
-    ["run", join4(sourceDir, "apps/api/scripts/build-release.ts")],
+    ["run", join5(sourceDir, "apps/api/scripts/build-release.ts")],
     sourceDir,
     { DIST_DIR: distDir, NODE_ENV: "production", CLOUD_MODE: "false", OPENSHIP_TARGET: "local" }
   );
   console.log("  Installing runtime dependencies in the dist\u2026");
   await run("bun", ["install", "--production", "--frozen-lockfile"], distDir);
-  const apiDir = join4(distDir, "api");
-  const dashboardDir = join4(distDir, "dashboard");
-  if (!existsSync(join4(apiDir, "src/index.ts"))) {
+  const apiDir = join5(distDir, "api");
+  const dashboardDir = join5(distDir, "dashboard");
+  if (!existsSync2(join5(apiDir, "src/index.ts"))) {
     throw new Error(`Build produced no API at ${apiDir}/src/index.ts \u2014 build-release layout drift?`);
   }
-  if (!existsSync(join4(dashboardDir, "apps/dashboard/server.js"))) {
+  if (!existsSync2(join5(dashboardDir, "apps/dashboard/server.js"))) {
     throw new Error(`Build produced no dashboard at ${dashboardDir}/apps/dashboard/server.js.`);
   }
   return { apiDir, dashboardDir, ref, sha, sourceDir };
 }
 
 // src/lib/source-install.ts
-var MARKER = join5(OS_DIR, "source-install.json");
+var MARKER = join6(OS_DIR, "source-install.json");
 function parseSourceInstall(raw) {
   try {
     const obj = JSON.parse(raw);
@@ -12794,9 +13272,9 @@ function parseSourceInstall(raw) {
   }
 }
 function readSourceInstall() {
-  if (!existsSync2(MARKER)) return null;
+  if (!existsSync3(MARKER)) return null;
   try {
-    return parseSourceInstall(readFileSync(MARKER, "utf8"));
+    return parseSourceInstall(readFileSync2(MARKER, "utf8"));
   } catch {
     return null;
   }
@@ -12817,7 +13295,7 @@ async function rebuildFromSource(info) {
   if (!has("git")) {
     throw new Error("`git` is required to update the source checkout but wasn't found on PATH.");
   }
-  if (!existsSync2(join5(info.dir, ".git"))) {
+  if (!existsSync3(join6(info.dir, ".git"))) {
     throw new Error(
       `Source checkout ${info.dir} is missing (no .git) \u2014 reinstall from source with scripts/install-source.sh.`
     );
@@ -12826,7 +13304,7 @@ async function rebuildFromSource(info) {
   await run("git", ["checkout", info.ref], info.dir);
   await run("git", ["pull", "--ff-only", "origin", info.ref], info.dir).catch(() => {
   });
-  const cliDir = join5(info.dir, "apps/cli");
+  const cliDir = join6(info.dir, "apps/cli");
   await run("bun", ["install"], info.dir);
   await run("bun", ["run", "build"], cliDir);
   await run("bun", ["run", "build/stage-dashboard.ts"], cliDir);
@@ -12839,11 +13317,11 @@ var EDGE_ACME_HOST_DIR = `${EDGE_HOST_STATE_DIR}/acme`;
 function edgeVolumeYaml(indent) {
   return EDGE_CONTAINER_MOUNTS.map((m2) => `${indent}- ${m2.host}:${m2.container}:z`).join("\n");
 }
-var COMPOSE_DIR = join6(OS_DIR, "compose");
-var INSTALL_METHOD_FILE = join6(OS_DIR, "install-method");
-var COMPOSE_FILE = join6(COMPOSE_DIR, "docker-compose.yml");
-var BUILD_FILE = join6(COMPOSE_DIR, "docker-compose.build.yml");
-var ENV_FILE = join6(COMPOSE_DIR, ".env");
+var COMPOSE_DIR = join7(OS_DIR, "compose");
+var INSTALL_METHOD_FILE = join7(OS_DIR, "install-method");
+var COMPOSE_FILE = join7(COMPOSE_DIR, "docker-compose.yml");
+var BUILD_FILE = join7(COMPOSE_DIR, "docker-compose.build.yml");
+var ENV_FILE = join7(COMPOSE_DIR, ".env");
 var BUILT_SERVICES = [
   { service: "api", dockerfile: "apps/api/Dockerfile" },
   { service: "dashboard", dockerfile: "apps/dashboard/Dockerfile" },
@@ -12852,24 +13330,45 @@ var BUILT_SERVICES = [
 var ENV_CONSUMING_SERVICES = ["api", "dashboard", "edge"];
 function readInstallMethod() {
   try {
-    const v2 = readFileSync2(INSTALL_METHOD_FILE, "utf8").trim();
+    const v2 = readFileSync3(INSTALL_METHOD_FILE, "utf8").trim();
     return v2 === "compose" || v2 === "bare" ? v2 : null;
   } catch {
     return null;
   }
 }
 function writeInstallMethod(method) {
-  mkdirSync2(OS_DIR, { recursive: true, mode: 448 });
-  writeFileSync(INSTALL_METHOD_FILE, method, { mode: 384 });
+  mkdirSync3(OS_DIR, { recursive: true, mode: 448 });
+  writeFileSync2(INSTALL_METHOD_FILE, method, { mode: 384 });
 }
-function hasDockerCompose() {
-  const docker = spawnSync3("docker", ["version"], { stdio: "ignore" });
-  if (docker.status !== 0) return false;
-  const compose2 = spawnSync3("docker", ["compose", "version"], { stdio: "ignore" });
-  return compose2.status === 0;
+function dockerState() {
+  const ok = (args) => spawnSync3("docker", args, { stdio: "ignore" }).status === 0;
+  if (!ok(["--version"])) return { binary: false, plugin: false, daemon: false };
+  return { binary: true, plugin: ok(["compose", "version"]), daemon: ok(["version"]) };
 }
-function composeIsViableDefault() {
-  return process.platform === "linux" && hasDockerCompose();
+function dockerGap(state = dockerState()) {
+  if (!state.binary) {
+    return { summary: "Docker isn't installed", installable: true };
+  }
+  if (!state.plugin) {
+    return {
+      summary: "Docker is installed but the Compose plugin (`docker compose`) is missing",
+      installable: true
+    };
+  }
+  if (!state.daemon) {
+    const asRoot = typeof process.getuid === "function" && process.getuid() === 0;
+    return {
+      summary: "Docker is installed but its daemon isn't reachable",
+      // Reinstalling changes nothing: a group change only applies to NEW logins,
+      // and a stopped daemon needs starting, not installing.
+      installable: false,
+      hint: asRoot ? "Start it with: systemctl start docker" : `Add your user to the docker group: sudo usermod -aG docker ${userInfo().username} \u2014 then log out and back in (or run: newgrp docker). If the daemon is stopped: sudo systemctl start docker`
+    };
+  }
+  return null;
+}
+function hasDockerCompose() {
+  return dockerGap() === null;
 }
 function hasCmd(cmd) {
   return spawnSync3(cmd, ["--version"], { stdio: "ignore" }).status === 0;
@@ -12877,22 +13376,67 @@ function hasCmd(cmd) {
 function shQuote(s2) {
   return `'${s2.replace(/'/g, `'\\''`)}'`;
 }
-async function ensureDocker() {
-  if (hasDockerCompose()) return true;
-  if (process.platform !== "linux") return false;
+function dockerInstallPreview(state = dockerState()) {
+  const gap = dockerGap(state);
+  if (!gap) return { state, gap: null, wouldInstall: false };
+  if (process.platform !== "linux" || !gap.installable) return { state, gap, wouldInstall: false };
   const plan = systemCatalog.installs.docker({
     os: "linux",
     serviceManager: "systemd"
   });
-  if (!plan.supported || !plan.installCommand) return false;
+  if (!plan.supported || !plan.installCommand) return { state, gap, wouldInstall: false };
+  return {
+    state,
+    gap,
+    wouldInstall: true,
+    installCommand: plan.installCommand,
+    ...plan.startCommand ? { startCommand: plan.startCommand } : {}
+  };
+}
+async function ensureDocker(opts = {}) {
+  const notice = opts.onNotice ?? ((line) => process.stderr.write(`  ${line}
+`));
+  const { state, gap, wouldInstall, installCommand, startCommand } = dockerInstallPreview();
+  if (!gap) return true;
+  if (process.platform !== "linux") return false;
+  if (!gap.installable) {
+    notice(gap.summary + ".");
+    if (gap.hint) notice(gap.hint);
+    return false;
+  }
+  if (!wouldInstall || !installCommand) return false;
   const asRoot = typeof process.getuid === "function" && process.getuid() === 0;
   const sudo = !asRoot && hasCmd("sudo") ? "sudo " : "";
-  const sh = (script) => spawnSync3("sh", ["-c", sudo ? `${sudo}sh -c ${shQuote(script)}` : script], {
-    stdio: "inherit"
-  }).status ?? 1;
-  if (sh(plan.installCommand) !== 0) return false;
-  if (plan.startCommand) sh(plan.startCommand);
-  return hasDockerCompose();
+  notice("This can take 2-5 minutes on a small VPS (~150 MB of packages) and stays quiet while apt works.");
+  if (state.binary) {
+    notice("Docker's installer will warn that docker already exists and pause ~20s before continuing \u2014 that's expected.");
+  }
+  const sh = (script) => new Promise((resolve4) => {
+    const child = spawn2("sh", ["-c", sudo ? `${sudo}sh -c ${shQuote(script)}` : script], {
+      stdio: "inherit"
+    });
+    const started = Date.now();
+    const tick = setInterval(() => {
+      const s2 = Math.round((Date.now() - started) / 1e3);
+      notice(`still installing Docker \u2014 ${Math.floor(s2 / 60)}m${String(s2 % 60).padStart(2, "0")}s elapsed\u2026`);
+    }, 3e4);
+    const done = (code) => {
+      clearInterval(tick);
+      resolve4(code);
+    };
+    child.on("error", () => done(1));
+    child.on("close", (code) => done(code ?? 1));
+  });
+  if (await sh(installCommand) !== 0) return false;
+  if (startCommand) await sh(startCommand);
+  const after = dockerGap();
+  if (!after) {
+    notice("Docker ready.");
+    return true;
+  }
+  notice(after.summary + ".");
+  if (after.hint) notice(after.hint);
+  return false;
 }
 var COMPOSE_YAML = `# Managed by \`openship up\` \u2014 do not edit; re-run \`openship up\` to regenerate.
 services:
@@ -12900,6 +13444,12 @@ services:
     image: postgres:16-alpine
     restart: unless-stopped
     environment:
+      # Keep the data dir in a subdirectory of the volume so a fresh install never
+      # runs initdb against a bare mount root (which fails on quirky host
+      # filesystems with EPERM \u2014 #350). OPENSHIP_PGDATA is decided ONCE at install
+      # by the CLI (fresh \u2192 subdir, pre-existing volume \u2192 root) and preserved in
+      # .env, so this never moves an existing database.
+      PGDATA: \${OPENSHIP_PGDATA:-/var/lib/postgresql/data/pgdata}
       POSTGRES_USER: \${POSTGRES_USER:-openship}
       POSTGRES_PASSWORD: \${POSTGRES_PASSWORD:?missing from .env \u2014 re-run openship up to regenerate it}
       POSTGRES_DB: \${POSTGRES_DB:-openship}
@@ -12926,7 +13476,10 @@ services:
   api:
     image: \${OPENSHIP_IMAGE_REGISTRY:-ghcr.io/oblien}/openship-api:\${OPENSHIP_VERSION:-latest}
     restart: unless-stopped
-    ports: ["\${OPENSHIP_BIND_ADDR:-0.0.0.0}:\${API_PORT:-4000}:\${API_PORT:-4000}"]
+    # Loopback by default \u2014 the host-net edge reaches it over loopback, so nothing
+    # sits on a public interface. OPENSHIP_BIND_ADDR opts into a public/LAN interface
+    # (set by \`openship up\` when a public URL is configured for off-box access).
+    ports: ["\${OPENSHIP_BIND_ADDR:-127.0.0.1}:\${API_PORT:-4000}:\${API_PORT:-4000}"]
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       # Routing state shared with the edge, as HOST BIND MOUNTS (generated from
@@ -12961,7 +13514,8 @@ ${edgeVolumeYaml("      ")}
   dashboard:
     image: \${OPENSHIP_IMAGE_REGISTRY:-ghcr.io/oblien}/openship-dashboard:\${OPENSHIP_VERSION:-latest}
     restart: unless-stopped
-    ports: ["\${OPENSHIP_BIND_ADDR:-0.0.0.0}:\${DASHBOARD_PORT:-3001}:\${DASHBOARD_PORT:-3001}"]
+    # Loopback by default (see api note); OPENSHIP_BIND_ADDR opts into a public interface.
+    ports: ["\${OPENSHIP_BIND_ADDR:-127.0.0.1}:\${DASHBOARD_PORT:-3001}:\${DASHBOARD_PORT:-3001}"]
     env_file: [.env]
     environment:
       NODE_ENV: production
@@ -12995,7 +13549,7 @@ function keepSecret(existing, key) {
 function readEnvFile() {
   const out = {};
   try {
-    for (const line of readFileSync2(ENV_FILE, "utf8").split("\n")) {
+    for (const line of readFileSync3(ENV_FILE, "utf8").split("\n")) {
       const m2 = line.match(/^([A-Z0-9_]+)=(.*)$/);
       if (m2) out[m2[1]] = m2[2];
     }
@@ -13012,13 +13566,23 @@ function rewriteHostAuthorizedKeys(existing, pub) {
   const kept = existing.split("\n").filter((line) => line.trim() && !line.includes(HOST_KEY_COMMENT));
   return [...kept, hostKeyAuthLine(pub)].join("\n") + "\n";
 }
-function provisionHostSshChannel() {
-  if (process.platform !== "linux") return null;
+function plannedHostChannel(hostControl) {
+  if (!hostControl || process.platform !== "linux") return null;
+  let user;
+  try {
+    user = userInfo().username;
+  } catch {
+    user = process.env.USER || process.env.LOGNAME || "root";
+  }
+  return { user, keyPath: join7(COMPOSE_DIR, "host-ssh", "id_ed25519") };
+}
+function provisionHostSshChannel(hostControl) {
+  const target = plannedHostChannel(hostControl);
+  if (!target) return null;
+  const { user, keyPath } = target;
   try {
-    const sshDir = join6(COMPOSE_DIR, "host-ssh");
-    mkdirSync2(sshDir, { recursive: true, mode: 448 });
-    const keyPath = join6(sshDir, "id_ed25519");
-    if (!existsSync3(keyPath)) {
+    mkdirSync3(join7(COMPOSE_DIR, "host-ssh"), { recursive: true, mode: 448 });
+    if (!existsSync4(keyPath)) {
       const g2 = spawnSync3(
         "ssh-keygen",
         ["-t", "ed25519", "-N", "", "-q", "-f", keyPath, "-C", HOST_KEY_COMMENT],
@@ -13026,21 +13590,14 @@ function provisionHostSshChannel() {
       );
       if (g2.status !== 0) return null;
     }
-    const pub = readFileSync2(`${keyPath}.pub`, "utf8").trim();
+    const pub = readFileSync3(`${keyPath}.pub`, "utf8").trim();
     if (!pub) return null;
-    const user = (() => {
-      try {
-        return userInfo().username;
-      } catch {
-        return process.env.USER || process.env.LOGNAME || "root";
-      }
-    })();
-    const userSshDir = join6(homedir2(), ".ssh");
-    mkdirSync2(userSshDir, { recursive: true, mode: 448 });
-    const authKeys = join6(userSshDir, "authorized_keys");
-    const existing = existsSync3(authKeys) ? readFileSync2(authKeys, "utf8") : "";
+    const userSshDir = join7(homedir2(), ".ssh");
+    mkdirSync3(userSshDir, { recursive: true, mode: 448 });
+    const authKeys = join7(userSshDir, "authorized_keys");
+    const existing = existsSync4(authKeys) ? readFileSync3(authKeys, "utf8") : "";
     const next = rewriteHostAuthorizedKeys(existing, pub);
-    if (next !== existing) writeFileSync(authKeys, next, { mode: 384 });
+    if (next !== existing) writeFileSync2(authKeys, next, { mode: 384 });
     chmodSync(authKeys, 384);
     return { user, keyPath };
   } catch {
@@ -13051,6 +13608,11 @@ function composeProjectName(prev) {
   if (prev.COMPOSE_PROJECT_NAME) return prev.COMPOSE_PROJECT_NAME;
   return Object.keys(prev).length > 0 ? "compose" : "openship";
 }
+var PGDATA_ROOT = "/var/lib/postgresql/data";
+function resolvePgData(prev) {
+  if (prev.OPENSHIP_PGDATA) return prev.OPENSHIP_PGDATA;
+  return dbVolumeExists(composeProjectName(prev)) ? PGDATA_ROOT : `${PGDATA_ROOT}/pgdata`;
+}
 function orphanedStackContainers(project) {
   const r2 = spawnSync3(
     "docker",
@@ -13150,7 +13712,7 @@ function migrateLegacyEdgeVolumes(project) {
   const existing = new Set(ls.stdout.split("\n").map((l2) => l2.trim()).filter(Boolean));
   for (const { volume, host } of pairs) {
     if (!existing.has(volume)) continue;
-    mkdirSync2(host, { recursive: true });
+    mkdirSync3(host, { recursive: true });
     const alreadyThere = spawnSync3("sh", ["-c", `ls -A ${JSON.stringify(host)} 2>/dev/null | head -1`], {
       encoding: "utf8"
     });
@@ -13200,11 +13762,30 @@ function keepConfig(prev, key, explicit) {
   const carried = prev[key]?.trim();
   return carried || void 0;
 }
+var ACME_ENV_KEYS = [
+  "OPENSHIP_ACME_EMAIL",
+  "OPENSHIP_ACME_DIRECTORY_URL",
+  "OPENSHIP_ACME_EAB_KID",
+  "OPENSHIP_ACME_EAB_HMAC_KEY",
+  "OPENSHIP_ACME_KEY_TYPE",
+  "OPENSHIP_ACME_CA_BUNDLE",
+  "OPENSHIP_ACME_TOS_AGREED"
+];
+function renderAcmeEnv(prev) {
+  return ACME_ENV_KEYS.flatMap((key) => {
+    const value = process.env[key]?.trim() || prev[key]?.trim();
+    if (!value) return [];
+    if (/[\r\n]/.test(value)) throw new Error(`${key} must be a single-line value`);
+    return [`${key}=${value}`];
+  });
+}
 function resolveEnvConfig(prev, opts) {
   const publicUrl = keepConfig(prev, "OPENSHIP_PUBLIC_URL", opts.publicUrl);
+  const bindAddr = keepConfig(prev, "OPENSHIP_BIND_ADDR") ?? (publicUrl ? "0.0.0.0" : void 0);
   return {
-    apiPort: keepConfig(prev, "API_PORT", opts.apiPort) ?? "4000",
-    dashPort: keepConfig(prev, "DASHBOARD_PORT", opts.dashboardPort) ?? "3001",
+    apiPort: keepConfig(prev, "API_PORT", opts.apiPort) ?? String(DEFAULT_API_PORT),
+    dashPort: keepConfig(prev, "DASHBOARD_PORT", opts.dashboardPort) ?? String(DEFAULT_DASHBOARD_PORT),
+    ...bindAddr ? { bindAddr } : {},
     ...publicUrl ? { publicUrl } : {},
     // A public URL always implies a proxy in front; otherwise keep whatever the
     // install was configured with.
@@ -13222,6 +13803,50 @@ function resolveEnvConfig(prev, opts) {
     hostControl: opts.noHostControl === void 0 ? prev.OPENSHIP_HOST_CONTROL !== "false" : !opts.noHostControl
   };
 }
+function toPort(value) {
+  const n2 = Number(value);
+  return Number.isInteger(n2) && n2 > 0 && n2 <= 65535 ? n2 : void 0;
+}
+function composeEnvPorts() {
+  const env = readEnvFile();
+  return { api: toPort(env.API_PORT), dashboard: toPort(env.DASHBOARD_PORT) };
+}
+function composeBindAddr() {
+  return readEnvFile().OPENSHIP_BIND_ADDR?.trim() || "127.0.0.1";
+}
+function composeTrustedOriginUrls() {
+  const env = readEnvFile();
+  return [env.OPENSHIP_PUBLIC_URL, env.OPENSHIP_EXTRA_TRUSTED_ORIGINS].filter(
+    (v2) => !!v2?.trim()
+  );
+}
+function composeHeldPorts() {
+  const r2 = spawnSync3(
+    "docker",
+    ["ps", "--format", '{{.Label "com.docker.compose.project.config_files"}}	{{.Ports}}'],
+    { encoding: "utf8" }
+  );
+  if (r2.status !== 0 || !r2.stdout) return [];
+  const ports = /* @__PURE__ */ new Set();
+  for (const line of r2.stdout.split("\n")) {
+    const [configFiles = "", published = ""] = line.split("	");
+    if (!configFiles.split(",").some((f2) => f2.trim() === COMPOSE_FILE)) continue;
+    for (const m2 of published.matchAll(/:(\d+)->/g)) ports.add(Number(m2[1]));
+  }
+  return [...ports];
+}
+async function resolveComposePorts(prefs, opts = {}) {
+  return resolvePorts(
+    {
+      api: toPort(prefs.api),
+      dashboard: toPort(prefs.dashboard),
+      previous: composeEnvPorts(),
+      bindAddr: composeBindAddr(),
+      reclaimable: composeHeldPorts()
+    },
+    opts
+  );
+}
 function renderEnv(opts, host, cfg) {
   const prev = readEnvFile();
   const lines = [
@@ -13235,13 +13860,24 @@ function renderEnv(opts, host, cfg) {
     // (hides the local row). Written explicitly so the policy is visible in .env.
     `OPENSHIP_HOST_CONTROL=${cfg.hostControl ? "true" : "false"}`,
     `OPENSHIP_IMAGE_REGISTRY=${cfg.registry}`,
-    `OPENSHIP_VERSION=${opts.version || (true ? "0.4.8" : "latest")}`,
+    `OPENSHIP_VERSION=${opts.version || (true ? "0.6.0" : "latest")}`,
     `POSTGRES_PASSWORD=${keepSecret(prev, "POSTGRES_PASSWORD")}`,
+    // Pinned once (see resolvePgData): fresh install → subdir, existing volume → root.
+    `OPENSHIP_PGDATA=${resolvePgData(prev)}`,
     `BETTER_AUTH_SECRET=${keepSecret(prev, "BETTER_AUTH_SECRET")}`,
     `INTERNAL_TOKEN=${keepSecret(prev, "INTERNAL_TOKEN")}`,
     `API_PORT=${cfg.apiPort}`,
-    `DASHBOARD_PORT=${cfg.dashPort}`
+    `DASHBOARD_PORT=${cfg.dashPort}`,
+    // The api's OWN view of the dashboard port: the self-app boot reconcile points
+    // the operator's domain at the dashboard through this (self-deploy.ts), and it
+    // silently defaults to 3001 when unset. Ports are dynamic now, so leaving it
+    // out publishes a domain routed to a port nothing is listening on.
+    `OPENSHIP_DASHBOARD_PORT=${cfg.dashPort}`,
+    // Alternate CA/EAB values are operator configuration (including one secret),
+    // so a routine `openship up`/upgrade must not silently discard them.
+    ...renderAcmeEnv(prev)
   ];
+  if (cfg.bindAddr) lines.push(`OPENSHIP_BIND_ADDR=${cfg.bindAddr}`);
   if (cfg.publicUrl) lines.push(`OPENSHIP_PUBLIC_URL=${cfg.publicUrl}`);
   if (cfg.extraTrustedOrigins) {
     lines.push(`OPENSHIP_EXTRA_TRUSTED_ORIGINS=${cfg.extraTrustedOrigins}`);
@@ -13261,7 +13897,7 @@ function renderEnv(opts, host, cfg) {
 function sourceBuildDir() {
   const marker = readSourceInstall();
   if (!marker?.dir) return null;
-  const hasAll = BUILT_SERVICES.every((s2) => existsSync3(join6(marker.dir, s2.dockerfile)));
+  const hasAll = BUILT_SERVICES.every((s2) => existsSync4(join7(marker.dir, s2.dockerfile)));
   return hasAll ? marker.dir : null;
 }
 function renderBuildOverride(repoDir) {
@@ -13277,22 +13913,56 @@ services:
 ${services}`;
 }
 function materialize(opts) {
-  mkdirSync2(COMPOSE_DIR, { recursive: true, mode: 448 });
+  mkdirSync3(COMPOSE_DIR, { recursive: true, mode: 448 });
   const prev = readEnvFile();
   const cfg = resolveEnvConfig(prev, opts);
-  const host = cfg.hostControl ? provisionHostSshChannel() : null;
+  const host = provisionHostSshChannel(cfg.hostControl);
   let before = "";
   try {
-    before = readFileSync2(ENV_FILE, "utf8");
+    before = readFileSync3(ENV_FILE, "utf8");
   } catch {
   }
   const rendered = renderEnv(opts, host, cfg);
-  writeFileSync(COMPOSE_FILE, COMPOSE_YAML);
-  writeFileSync(ENV_FILE, rendered, { mode: 384 });
+  writeFileSync2(COMPOSE_FILE, COMPOSE_YAML);
+  writeFileSync2(ENV_FILE, rendered, { mode: 384 });
   const buildDir = opts.build === false ? null : sourceBuildDir();
-  if (buildDir) writeFileSync(BUILD_FILE, renderBuildOverride(buildDir));
+  if (buildDir) writeFileSync2(BUILD_FILE, renderBuildOverride(buildDir));
   return { buildDir, cfg, envChanged: before !== "" && rendered !== before };
 }
+var SECRET_ENV_KEY = /(PASSWORD|SECRET|TOKEN|HMAC_KEY)$/;
+function composePlan(opts) {
+  const prev = readEnvFile();
+  const cfg = resolveEnvConfig(prev, opts);
+  const buildDir = opts.build === false ? null : sourceBuildDir();
+  const hostChannel = plannedHostChannel(cfg.hostControl);
+  const settings = [];
+  const newSecrets = [];
+  for (const line of renderEnv(opts, hostChannel, cfg).split("\n")) {
+    const at2 = line.indexOf("=");
+    if (at2 < 1 || line.startsWith("#")) continue;
+    const key = line.slice(0, at2);
+    if (!SECRET_ENV_KEY.test(key)) {
+      settings.push({ key, value: line.slice(at2 + 1) });
+      continue;
+    }
+    const minted = !prev[key];
+    if (minted) newSecrets.push(key);
+    settings.push({ key, value: minted ? "<generated on this run>" : "<preserved>" });
+  }
+  return {
+    composeFile: COMPOSE_FILE,
+    envFile: ENV_FILE,
+    installMethodFile: INSTALL_METHOD_FILE,
+    ...buildDir ? { buildFile: BUILD_FILE } : {},
+    yaml: COMPOSE_YAML,
+    settings,
+    newSecrets,
+    existing: Object.keys(prev).length > 0,
+    mountDirs: EDGE_CONTAINER_MOUNTS.map((m2) => m2.host),
+    buildDir,
+    hostChannel
+  };
+}
 function dbVolumeExists(project) {
   const r2 = spawnSync3("docker", ["volume", "inspect", `${project}_postgres_data`], {
     stdio: "ignore"
@@ -13315,6 +13985,23 @@ function composePrefetch(opts) {
   }
   return compose(["pull"]) === 0;
 }
+function ensureEdgeMountDirs() {
+  const failed = [];
+  for (const { host } of EDGE_CONTAINER_MOUNTS) {
+    try {
+      mkdirSync3(host, { recursive: true });
+    } catch (err) {
+      if (err.code !== "EEXIST") failed.push(host);
+    }
+  }
+  return failed;
+}
+function isRootlessDocker() {
+  const r2 = spawnSync3("docker", ["info", "-f", "{{println .SecurityOptions}}"], {
+    encoding: "utf8"
+  });
+  return r2.status === 0 && /rootless/i.test(r2.stdout ?? "");
+}
 async function composeUp(opts) {
   const { buildDir, cfg, envChanged } = materialize(opts);
   const apiPort = cfg.apiPort;
@@ -13328,6 +14015,21 @@ async function composeUp(opts) {
   removeOrphanedStack(project);
   migrateLegacyEdgeVolumes(project);
   warnOrphanedVolumes(project);
+  const unmakeableMounts = ensureEdgeMountDirs();
+  if (unmakeableMounts.length && isRootlessDocker()) {
+    const dirs = unmakeableMounts.join(" ");
+    console.error(
+      `
+  Rootless Docker can't create the edge's host directories under root-owned paths:
+    ${unmakeableMounts.join("\n    ")}
+
+  Create them once (owned by your user), then re-run \`openship up --compose\`:
+    sudo mkdir -p ${dirs}
+    sudo chown -R "$(id -un)" ${dirs}
+`
+    );
+    return { ok: false, apiPort, dashPort };
+  }
   if (dbVolumeExists(project)) {
     reconcileDbPassword(env.POSTGRES_USER || "openship", env.POSTGRES_PASSWORD ?? "");
   }
@@ -13365,12 +14067,12 @@ function onEdgeContainerChanged() {
   invalidateEdgeContainer();
 }
 function composeDown() {
-  if (!existsSync3(COMPOSE_FILE)) return false;
+  if (!existsSync4(COMPOSE_FILE)) return false;
   return compose(["down"]) === 0;
 }
 function composeUninstall(opts = {}) {
   const removedImages = [];
-  const ok = existsSync3(COMPOSE_FILE) ? compose(["down", "-v", "--remove-orphans"]) === 0 : false;
+  const ok = existsSync4(COMPOSE_FILE) ? compose(["down", "-v", "--remove-orphans"]) === 0 : false;
   if (opts.removeImages) {
     const env = readEnvFile();
     const registry = env.OPENSHIP_IMAGE_REGISTRY || DEFAULT_IMAGE_REGISTRY;
@@ -13385,7 +14087,7 @@ function composeUninstall(opts = {}) {
   return { ok, removedImages };
 }
 async function composeUpdate(version) {
-  if (!existsSync3(COMPOSE_FILE)) return false;
+  if (!existsSync4(COMPOSE_FILE)) return false;
   return (await composeUp(version ? { version } : {})).ok;
 }
 function composePs() {
@@ -13421,7 +14123,16 @@ async function waitForApiHealth(port, tries) {
   }
   return false;
 }
-async function importMigratedSites(apiPort, sites, certPems) {
+async function waitForEdgeRunning(tries) {
+  const exec = new LocalExecutor();
+  for (let i2 = 0; i2 < tries; i2++) {
+    const out = await exec.exec(`docker inspect -f '{{.State.Running}}' ${EDGE_CONTAINER_NAME}`).catch(() => "");
+    if (out.trim() === "true") return true;
+    await new Promise((r2) => setTimeout(r2, 1e3));
+  }
+  return false;
+}
+async function importMigratedSites(apiPort, sites, certPems, staticRootOverrides) {
   const token = composeInternalToken();
   if (!token) {
     const error = "couldn't read the stack's internal token";
@@ -13437,11 +14148,16 @@ async function importMigratedSites(apiPort, sites, certPems) {
     spinner.warn(`${error} \u2014 migrated sites not imported. Re-run \`openship up\` to retry.`);
     return { ok: false, registered: [], error };
   }
+  if (!await waitForEdgeRunning(60)) {
+    const error = `the ${EDGE_CONTAINER_NAME} container isn't running yet`;
+    spinner.warn(`${error} \u2014 migrated sites not imported. Re-run \`openship up\` to retry.`);
+    return { ok: false, registered: [], error };
+  }
   try {
     const r2 = await fetch(`http://127.0.0.1:${apiPort}/api/system/edge/import-sites`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Internal-Token": token },
-      body: JSON.stringify({ sites, certPems }),
+      body: JSON.stringify({ sites, certPems, staticRootOverrides }),
       signal: AbortSignal.timeout(12e4)
     });
     const data = await r2.json().catch(() => ({}));
@@ -13496,16 +14212,36 @@ async function importMigratedSites(apiPort, sites, certPems) {
 export {
   OS_DIR,
   IS_ALT_HOME,
+  DATA_DIR,
+  LOG_DIR,
+  AUTH_SECRET_FILE,
+  INTERNAL_TOKEN_FILE,
+  PORTS_FILE,
+  saveInstanceUrl,
+  readInstanceUrl,
+  readStoredPorts,
+  storedApiPort,
+  storedDashboardPort,
+  portMoveNotice,
+  resolvePorts,
+  DEFAULT_REPO,
+  SOURCE_CHECKOUT_DIR,
+  SOURCE_DIST_DIR,
+  has,
   shortSha,
   prepareFromSource,
   readSourceInstall,
   remoteSha,
   rebuildFromSource,
   readInstallMethod,
+  dockerGap,
   hasDockerCompose,
-  composeIsViableDefault,
+  dockerInstallPreview,
   ensureDocker,
+  composeTrustedOriginUrls,
+  resolveComposePorts,
   sourceBuildDir,
+  composePlan,
   composePrefetch,
   composeUp,
   composeDown,
@@ -13517,5 +14253,6 @@ export {
   composeRestart,
   composeInternalToken,
   waitForApiHealth,
+  waitForEdgeRunning,
   importMigratedSites
 };