openship 0.4.8 → 0.6.0

package/dist/index.js

@@ -1,49 +1,70 @@
 #!/usr/bin/env sh
-":" //# ; exec "$(command -v bun || command -v node)" "$0" "$@"
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
+  AUTH_SECRET_FILE,
+  DATA_DIR,
+  DEFAULT_REPO,
+  INTERNAL_TOKEN_FILE,
   IS_ALT_HOME,
+  LOG_DIR,
   OS_DIR,
+  PORTS_FILE,
+  SOURCE_CHECKOUT_DIR,
+  SOURCE_DIST_DIR,
   composeDown,
   composeInternalToken,
-  composeIsViableDefault,
+  composePlan,
   composePrefetch,
   composePs,
   composeRestart,
   composeRunning,
   composeStart,
+  composeTrustedOriginUrls,
   composeUninstall,
   composeUp,
   composeUpdate,
+  dockerGap,
+  dockerInstallPreview,
   ensureDocker,
+  has,
   hasDockerCompose,
   importMigratedSites,
+  portMoveNotice,
   prepareFromSource,
   readInstallMethod,
+  readInstanceUrl,
   readSourceInstall,
+  readStoredPorts,
   rebuildFromSource,
   remoteSha,
+  resolveComposePorts,
+  resolvePorts,
+  saveInstanceUrl,
   shortSha,
-  sourceBuildDir
-} from "./chunk-BBHX7T4R.js";
-import "./chunk-FRNAR33O.js";
-import "./chunk-EI575GHN.js";
-import "./chunk-6APIPIJY.js";
-import "./chunk-IXCHURVK.js";
-import "./chunk-OWED2GRM.js";
-import "./chunk-VWPEKOH6.js";
-import "./chunk-W73X43R7.js";
-import "./chunk-TGIINPVM.js";
-import "./chunk-5NYUCONN.js";
-import "./chunk-AVIB7CT7.js";
-import "./chunk-5MZ624VX.js";
-import "./chunk-Q2CIRAOK.js";
-import "./chunk-GKHUSZCD.js";
+  sourceBuildDir,
+  storedApiPort,
+  storedDashboardPort
+} from "./chunk-VE2YOK4I.js";
+import "./chunk-XZYFZ6A5.js";
+import "./chunk-PDW4L3NV.js";
+import "./chunk-QWHBRY2K.js";
+import "./chunk-DOD2BXHQ.js";
+import "./chunk-42WQABXM.js";
+import "./chunk-DRK3MEDS.js";
+import "./chunk-3NQQXMDR.js";
+import "./chunk-TWJCLD4W.js";
+import "./chunk-PSZSKEPA.js";
+import "./chunk-WNWQBB7F.js";
+import "./chunk-2GWYYHOR.js";
+import "./chunk-RXQBD4ZY.js";
+import "./chunk-EP2TNALB.js";
 import {
   beginEdgeTakeover,
   collectProxyCerts,
   completeEdgeTakeover,
+  copyStaticRootIntoEdge,
   detectInstalledProxy,
   edgeProxy,
   edgeProxyFor,
@@ -51,41 +72,45 @@ import {
   importSites,
   recoverInterruptedTakeover,
   rollbackEdgeTakeover,
-  scanImportableSites
-} from "./chunk-SLTYVHU7.js";
-import "./chunk-O6ZZF52V.js";
-import "./chunk-JYGD5WSN.js";
-import "./chunk-SJIFLLX4.js";
-import "./chunk-V6AN6XLZ.js";
-import "./chunk-VDMQJHPI.js";
-import "./chunk-MZ2WEHHY.js";
-import "./chunk-L2VOGB2X.js";
-import "./chunk-4Z5QO7N6.js";
-import "./chunk-XPPZ7B2J.js";
-import "./chunk-OXWDY22G.js";
-import "./chunk-RPHRPFEH.js";
+  scanImportableSites,
+  unreachableStaticRoots
+} from "./chunk-GUQ3QCJ7.js";
+import "./chunk-ONKEYSMY.js";
+import "./chunk-ZWLDLTJP.js";
+import "./chunk-3FYIXVX5.js";
+import "./chunk-EMXI4UCU.js";
+import "./chunk-IXM5245F.js";
+import "./chunk-JIMUYEKN.js";
+import "./chunk-IW2UKBVF.js";
+import "./chunk-VDDMADOF.js";
+import "./chunk-B3CE2OMR.js";
+import "./chunk-6ODUBKUB.js";
+import "./chunk-ZCFVHA25.js";
 import {
   LocalExecutor
-} from "./chunk-TYVME3XD.js";
-import "./chunk-FXTBHTWY.js";
-import "./chunk-FPRHYBY2.js";
+} from "./chunk-6FH4AXVY.js";
+import "./chunk-QEH4QUBX.js";
+import "./chunk-I3DPMTSF.js";
 import {
   edgeCrashReason,
   edgeIsBroken,
   ourEdgeContainerRunning
-} from "./chunk-2D3I5G6P.js";
-import "./chunk-ILFETZOM.js";
-import "./chunk-VFINNTUL.js";
+} from "./chunk-VZ2ZHPS2.js";
+import "./chunk-3LDWWY7U.js";
+import "./chunk-OGY63DGD.js";
+import "./chunk-ZFJXPCQP.js";
 import {
   CLOUD_DASHBOARD_URL,
   LOCAL_API_URL,
   LOCAL_DASHBOARD_URL,
+  buildMailImageRef,
   cliInstallCommand,
+  commandToArgv,
   isValidEmail,
   parseOpenshipConfigJson,
   resolveCliUpdatePlan
-} from "./chunk-6APULWSU.js";
-import "./chunk-KI2EY3WB.js";
+} from "./chunk-OTLSJYAC.js";
+import "./chunk-PXKCZB2I.js";
 
 // src/index.ts
 import { Command as Command28 } from "commander";
@@ -243,6 +268,7 @@ function getDashboardUrl(name) {
 }
 
 // src/lib/api-client.ts
+var USER_AGENT = `openship-cli/${true ? "0.6.0" : "dev"}`;
 function getApiUrl2() {
   return `${getApiUrl()}/api`;
 }
@@ -259,6 +285,7 @@ var ApiError = class extends Error {
 function buildHeaders(extra) {
   const headers = new Headers(extra);
   if (!headers.has("Content-Type")) headers.set("Content-Type", "application/json");
+  if (!headers.has("User-Agent")) headers.set("User-Agent", USER_AGENT);
   const token = getToken();
   if (token && !headers.has("Authorization")) headers.set("Authorization", `Bearer ${token}`);
   return headers;
@@ -483,7 +510,7 @@ var openCommand = new Command3("open").description("Open the Openship dashboard
 
 // src/commands/up.ts
 import { Command as Command4 } from "commander";
-import chalk6 from "chalk";
+import chalk7 from "chalk";
 import ora from "ora";
 import { spawn } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
@@ -537,8 +564,8 @@ async function downloadToFile(url, dest, onProgress) {
   } finally {
     file.end();
   }
-  await new Promise((resolve2, reject2) => {
-    file.on("finish", () => resolve2());
+  await new Promise((resolve3, reject2) => {
+    file.on("finish", () => resolve3());
     file.on("error", reject2);
   });
   return { sha256: hash.digest("hex"), size: received };
@@ -658,16 +685,54 @@ async function fetchBundle(tag, onProgress) {
 
 // src/lib/service.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync3, mkdirSync as mkdirSync4, writeFileSync as writeFileSync3, rmSync as rmSync2, readFileSync as readFileSync2 } from "fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync5, writeFileSync as writeFileSync4, rmSync as rmSync2 } from "fs";
 import { homedir } from "os";
-import { join as join4, resolve } from "path";
+import { join as join5, resolve } from "path";
+
+// src/lib/cli-install.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "fs";
+import { join as join4 } from "path";
+var MARKER = join4(OS_DIR, "cli-install.json");
+function parseCliInstall(raw) {
+  try {
+    const obj = JSON.parse(raw);
+    if (!obj || obj.method !== "tarball" || typeof obj.tag !== "string" || !obj.tag) return null;
+    return {
+      method: "tarball",
+      tag: obj.tag,
+      launcher: typeof obj.launcher === "string" ? obj.launcher : join4(OS_DIR, "bin", "openship"),
+      runtime: obj.runtime === "vendored" ? "vendored" : "system"
+    };
+  } catch {
+    return null;
+  }
+}
+function readCliInstall() {
+  if (!existsSync3(MARKER)) return null;
+  try {
+    return parseCliInstall(readFileSync2(MARKER, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writeCliInstall(info3) {
+  mkdirSync4(OS_DIR, { recursive: true });
+  writeFileSync3(MARKER, `${JSON.stringify(info3, null, 2)}
+`);
+}
+
+// src/lib/service.ts
 var HOME = homedir();
-var LOG_DIR = join4(OS_DIR, "logs");
+var OPENSHIP_BIN = join5(OS_DIR, "bin");
 var MAC_LABEL = IS_ALT_HOME ? "io.openship-dev.up" : "io.openship.up";
-var MAC_PLIST = join4(HOME, "Library", "LaunchAgents", `${MAC_LABEL}.plist`);
+var MAC_PLIST = join5(HOME, "Library", "LaunchAgents", `${MAC_LABEL}.plist`);
 var SYSTEMD_NAME = IS_ALT_HOME ? "openship-dev" : "openship";
 var WIN_TASK = IS_ALT_HOME ? "OpenshipDev" : "Openship";
 function selfInvocation() {
+  const cli = readCliInstall();
+  if (cli?.method === "tarball" && existsSync4(cli.launcher)) {
+    return { runtime: cli.launcher, args: [] };
+  }
   const runtime = process.execPath;
   const entry = resolve(process.argv[1] ?? "");
   return { runtime, args: [entry] };
@@ -736,7 +801,8 @@ function serviceEnv() {
 function plist(flags) {
   const argv = runArgv(flags);
   const items = argv.map((a) => `      <string>${xmlEscape(a)}</string>`).join("\n");
-  const path2 = ["/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin", join4(HOME, ".bun/bin")].join(":");
+  const runtimeBin = readCliInstall()?.method === "tarball" ? OPENSHIP_BIN : join5(HOME, ".bun/bin");
+  const path2 = ["/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin", runtimeBin].join(":");
   const extraEnv = Object.entries(serviceEnv()).map(([k, v]) => `<key>${xmlEscape(k)}</key><string>${xmlEscape(v)}</string>`).join("");
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -749,8 +815,8 @@ ${items}
   </array>
   <key>RunAtLoad</key><true/>
   <key>KeepAlive</key><true/>
-  <key>StandardOutPath</key><string>${join4(LOG_DIR, "up.log")}</string>
-  <key>StandardErrorPath</key><string>${join4(LOG_DIR, "up.err.log")}</string>
+  <key>StandardOutPath</key><string>${join5(LOG_DIR, "up.log")}</string>
+  <key>StandardErrorPath</key><string>${join5(LOG_DIR, "up.err.log")}</string>
   <key>EnvironmentVariables</key>
   <dict><key>PATH</key><string>${path2}</string>${extraEnv}</dict>
 </dict>
@@ -762,6 +828,8 @@ function systemdUnit(flags) {
   const execStart = argv.map((a) => /\s/.test(a) ? `"${a}"` : a).join(" ");
   const extraEnv = Object.entries(serviceEnv()).map(([k, v]) => `Environment=${k}=${v}
 `).join("");
+  const pathEnv = readCliInstall()?.method === "tarball" ? `Environment=PATH=${["/usr/local/sbin", "/usr/local/bin", "/usr/sbin", "/usr/bin", "/sbin", "/bin", OPENSHIP_BIN].join(":")}
+` : "";
   return `[Unit]
 Description=Openship control plane
 After=network-online.target
@@ -773,26 +841,40 @@ ExecStart=${execStart}
 Restart=always
 RestartSec=2
 Environment=NODE_ENV=production
-${extraEnv}
+${pathEnv}${extraEnv}
 [Install]
 WantedBy=default.target
 `;
 }
+function installStepFor(kind) {
+  switch (kind) {
+    case "launchd":
+      return "launchctl bootstrap  (starts it now and at login)";
+    case "systemd-user":
+      return "systemctl --user enable --now + loginctl enable-linger  (starts it now, on boot, without a login session)";
+    case "systemd-system":
+      return "systemctl enable --now  (starts it now and on boot)";
+    case "schtasks":
+      return "schtasks /Create /SC ONLOGON  (starts it at logon)";
+    default:
+      return "nothing \u2014 no supported service manager on this box (needs systemd on Linux); `up --foreground` or `up --compose` instead";
+  }
+}
 function preview(flags) {
   const kind = detectKind();
   if (kind === "launchd") return { kind, path: MAC_PLIST, content: plist(flags) };
-  if (kind === "systemd-user") return { kind, path: join4(HOME, ".config/systemd/user", `${SYSTEMD_NAME}.service`), content: systemdUnit(flags) };
+  if (kind === "systemd-user") return { kind, path: join5(HOME, ".config/systemd/user", `${SYSTEMD_NAME}.service`), content: systemdUnit(flags) };
   if (kind === "systemd-system") return { kind, path: `/etc/systemd/system/${SYSTEMD_NAME}.service`, content: systemdUnit(flags) };
   if (kind === "schtasks") return { kind, path: WIN_TASK, content: runArgv(flags).join(" ") };
   return { kind, path: "", content: "" };
 }
 function installAndStart(flags) {
-  mkdirSync4(LOG_DIR, { recursive: true });
+  mkdirSync5(LOG_DIR, { recursive: true });
   const kind = detectKind();
   if (kind === "launchd") {
-    mkdirSync4(join4(HOME, "Library", "LaunchAgents"), { recursive: true });
+    mkdirSync5(join5(HOME, "Library", "LaunchAgents"), { recursive: true });
     run("launchctl", ["bootout", `gui/${process.getuid?.() ?? ""}/${MAC_LABEL}`]);
-    writeFileSync3(MAC_PLIST, plist(flags));
+    writeFileSync4(MAC_PLIST, plist(flags));
     const uid = String(process.getuid?.() ?? "");
     let r = run("launchctl", ["bootstrap", `gui/${uid}`, MAC_PLIST]);
     if (!r.ok) r = run("launchctl", ["load", "-w", MAC_PLIST]);
@@ -801,9 +883,9 @@ function installAndStart(flags) {
   }
   if (kind === "systemd-user" || kind === "systemd-system") {
     const sysArgs = kind === "systemd-user" ? ["--user"] : [];
-    const unitPath = kind === "systemd-user" ? join4(HOME, ".config/systemd/user", `${SYSTEMD_NAME}.service`) : `/etc/systemd/system/${SYSTEMD_NAME}.service`;
-    mkdirSync4(unitPath.slice(0, unitPath.lastIndexOf("/")), { recursive: true });
-    writeFileSync3(unitPath, systemdUnit(flags));
+    const unitPath = kind === "systemd-user" ? join5(HOME, ".config/systemd/user", `${SYSTEMD_NAME}.service`) : `/etc/systemd/system/${SYSTEMD_NAME}.service`;
+    mkdirSync5(unitPath.slice(0, unitPath.lastIndexOf("/")), { recursive: true });
+    writeFileSync4(unitPath, systemdUnit(flags));
     run("systemctl", [...sysArgs, "daemon-reload"]);
     const r = run("systemctl", [...sysArgs, "enable", "--now", SYSTEMD_NAME]);
     if (!r.ok) throw new Error(`systemctl enable failed: ${r.out}`);
@@ -826,7 +908,7 @@ function installAndStart(flags) {
 function restart() {
   const kind = detectKind();
   if (kind === "launchd") {
-    if (!existsSync3(MAC_PLIST)) return { restarted: false, detail: "no launchd agent installed" };
+    if (!existsSync4(MAC_PLIST)) return { restarted: false, detail: "no launchd agent installed" };
     const uid = String(process.getuid?.() ?? "");
     const r = run("launchctl", ["kickstart", "-k", `gui/${uid}/${MAC_LABEL}`]);
     if (!r.ok) return { restarted: false, detail: r.out || "launchctl kickstart failed" };
@@ -842,8 +924,8 @@ function restart() {
   }
   if (kind === "systemd-user" || kind === "systemd-system") {
     const sysArgs = kind === "systemd-user" ? ["--user"] : [];
-    const unitPath = kind === "systemd-user" ? join4(HOME, ".config/systemd/user", `${SYSTEMD_NAME}.service`) : `/etc/systemd/system/${SYSTEMD_NAME}.service`;
-    if (!existsSync3(unitPath)) return { restarted: false, detail: "no systemd unit installed" };
+    const unitPath = kind === "systemd-user" ? join5(HOME, ".config/systemd/user", `${SYSTEMD_NAME}.service`) : `/etc/systemd/system/${SYSTEMD_NAME}.service`;
+    if (!existsSync4(unitPath)) return { restarted: false, detail: "no systemd unit installed" };
     const r = run("systemctl", [...sysArgs, "restart", SYSTEMD_NAME]);
     return { restarted: r.ok, detail: r.ok ? `restarted ${SYSTEMD_NAME}` : r.out };
   }
@@ -857,14 +939,14 @@ function restart() {
 function serviceStatus() {
   const kind = detectKind();
   if (kind === "launchd") {
-    return { kind, installed: existsSync3(MAC_PLIST), running: launchdPid() != null };
+    return { kind, installed: existsSync4(MAC_PLIST), running: launchdPid() != null };
   }
   if (kind === "systemd-user" || kind === "systemd-system") {
     const sysArgs = kind === "systemd-user" ? ["--user"] : [];
-    const unitPath = kind === "systemd-user" ? join4(HOME, ".config/systemd/user", `${SYSTEMD_NAME}.service`) : `/etc/systemd/system/${SYSTEMD_NAME}.service`;
+    const unitPath = kind === "systemd-user" ? join5(HOME, ".config/systemd/user", `${SYSTEMD_NAME}.service`) : `/etc/systemd/system/${SYSTEMD_NAME}.service`;
     return {
       kind,
-      installed: existsSync3(unitPath),
+      installed: existsSync4(unitPath),
       running: run("systemctl", [...sysArgs, "is-active", SYSTEMD_NAME]).out.trim() === "active"
     };
   }
@@ -876,14 +958,9 @@ function serviceStatus() {
 }
 function sweepOrphanPorts() {
   if (process.platform === "win32") return;
-  let ports = [];
-  try {
-    const raw = readFileSync2(join4(HOME, ".openship", "ports.json"), "utf8");
-    const p = JSON.parse(raw);
-    ports = [p.api, p.dashboard].filter((n) => typeof n === "number");
-  } catch {
-    return;
-  }
+  const stored = readStoredPorts();
+  const ports = [stored.api, stored.dashboard].filter((n) => typeof n === "number");
+  if (ports.length === 0) return;
   const self = process.pid;
   for (const port of ports) {
     const q = run("lsof", ["-ti", `tcp:${port}`]);
@@ -904,13 +981,13 @@ function stop() {
   let result;
   if (kind === "launchd") {
     run("launchctl", ["bootout", `gui/${process.getuid?.() ?? ""}/${MAC_LABEL}`]);
-    if (existsSync3(MAC_PLIST)) rmSync2(MAC_PLIST, { force: true });
+    if (existsSync4(MAC_PLIST)) rmSync2(MAC_PLIST, { force: true });
     result = { kind, detail: `launchd agent ${MAC_LABEL} stopped + removed` };
   } else if (kind === "systemd-user" || kind === "systemd-system") {
     const sysArgs = kind === "systemd-user" ? ["--user"] : [];
     run("systemctl", [...sysArgs, "disable", "--now", SYSTEMD_NAME]);
-    const unitPath = kind === "systemd-user" ? join4(HOME, ".config/systemd/user", `${SYSTEMD_NAME}.service`) : `/etc/systemd/system/${SYSTEMD_NAME}.service`;
-    if (existsSync3(unitPath)) rmSync2(unitPath, { force: true });
+    const unitPath = kind === "systemd-user" ? join5(HOME, ".config/systemd/user", `${SYSTEMD_NAME}.service`) : `/etc/systemd/system/${SYSTEMD_NAME}.service`;
+    if (existsSync4(unitPath)) rmSync2(unitPath, { force: true });
     run("systemctl", [...sysArgs, "daemon-reload"]);
     result = { kind, detail: `systemd unit ${SYSTEMD_NAME} stopped + disabled` };
   } else if (kind === "schtasks") {
@@ -924,92 +1001,10 @@ function stop() {
   return result;
 }
 
-// src/lib/ports.ts
-import { createServer } from "net";
-import { existsSync as existsSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
-import { join as join5 } from "path";
-var PORTS_FILE = join5(OS_DIR, "ports.json");
-var INSTANCE_FILE = join5(OS_DIR, "instance.json");
-function saveInstanceUrl(publicUrl) {
-  try {
-    if (!existsSync4(OS_DIR)) mkdirSync5(OS_DIR, { recursive: true, mode: 448 });
-    writeFileSync4(INSTANCE_FILE, JSON.stringify({ publicUrl: publicUrl ?? null }));
-  } catch {
-  }
-}
-function readInstanceUrl() {
-  try {
-    return JSON.parse(readFileSync3(INSTANCE_FILE, "utf8")).publicUrl ?? null;
-  } catch {
-    return null;
-  }
-}
-var DEFAULT_API = 4e3;
-var DEFAULT_DASHBOARD = 3001;
-function isPortFree(port) {
-  return new Promise((resolve2) => {
-    const srv = createServer();
-    srv.once("error", () => resolve2(false));
-    srv.listen(port, "127.0.0.1", () => srv.close(() => resolve2(true)));
-  });
-}
-async function waitPortFree(port, opts = {}) {
-  const timeoutMs = opts.timeoutMs ?? 6e3;
-  const intervalMs = opts.intervalMs ?? 250;
-  const deadline = Date.now() + timeoutMs;
-  for (; ; ) {
-    if (await isPortFree(port)) return true;
-    if (Date.now() >= deadline) return false;
-    await new Promise((r) => setTimeout(r, intervalMs));
-  }
-}
-function getFreePort() {
-  return new Promise((resolve2, reject2) => {
-    const srv = createServer();
-    srv.once("error", reject2);
-    srv.listen(0, "127.0.0.1", () => {
-      const addr = srv.address();
-      const port = addr && typeof addr === "object" ? addr.port : 0;
-      srv.close(() => port ? resolve2(port) : reject2(new Error("no free port")));
-    });
-  });
-}
-function loadStoredPorts() {
-  try {
-    return JSON.parse(readFileSync3(PORTS_FILE, "utf-8"));
-  } catch {
-    return {};
-  }
-}
-function saveStoredPorts(api, dashboard) {
-  try {
-    if (!existsSync4(OS_DIR)) mkdirSync5(OS_DIR, { recursive: true, mode: 448 });
-    writeFileSync4(PORTS_FILE, JSON.stringify({ api, dashboard }));
-  } catch {
-  }
-}
-async function resolvePorts(prefs) {
-  const stored = loadStoredPorts();
-  const apiPref = prefs.api ?? stored.api ?? DEFAULT_API;
-  const dashPref = prefs.dashboard ?? stored.dashboard ?? DEFAULT_DASHBOARD;
-  const apiRemembered = prefs.api === void 0 && stored.api === apiPref;
-  const dashRemembered = prefs.dashboard === void 0 && stored.dashboard === dashPref;
-  let api;
-  if (await isPortFree(apiPref)) api = apiPref;
-  else if (apiRemembered && await waitPortFree(apiPref)) api = apiPref;
-  else api = await getFreePort();
-  let dashboard;
-  if (dashPref !== api && await isPortFree(dashPref)) dashboard = dashPref;
-  else if (dashPref !== api && dashRemembered && await waitPortFree(dashPref)) dashboard = dashPref;
-  else dashboard = await getFreePort();
-  if (dashboard === api) dashboard = await getFreePort();
-  saveStoredPorts(api, dashboard);
-  return {
-    api,
-    dashboard,
-    switched: { api: api !== apiPref, dashboard: dashboard !== dashPref }
-  };
-}
+// src/lib/up-plan.ts
+import { homedir as homedir2 } from "os";
+import { join as join7 } from "path";
+import chalk6 from "chalk";
 
 // src/lib/edge-preflight.ts
 import { spawnSync as spawnSync3 } from "child_process";
@@ -1035,12 +1030,39 @@ async function planAndApplyHostEdge(opts, overrides = {}) {
   const action2 = await resolveAction(opts.edge, { status, owner, sites, warnings }, deps);
   if (action2 === "cancel") return { proceed: false };
   const certPems = action2 === "migrate" ? await deps.collectCerts(executor, sites, { status }) : void 0;
-  await deps.beginEdgeTakeover(
+  const staticRootOverrides = action2 === "migrate" ? await remediateUnreachableStaticRoots({
+    unreachable: unreachableStaticRoots(sites, { containerEdge: true }),
+    executor,
+    interactive: deps.interactive
+  }) : void 0;
+  const freed = await deps.beginEdgeTakeover(
     executor,
     status,
     (m, l) => deps.warn(l === "info" ? m : chalk5.yellow(m))
   );
-  return action2 === "migrate" ? { proceed: true, action: action2, sites, certPems } : { proceed: true, action: action2 };
+  if (!freed.freed) {
+    const plural = freed.stillBound.length > 1;
+    const restored = await deps.rollbackHostEdge();
+    return {
+      proceed: false,
+      blockedBy: `port${plural ? "s" : ""} ${freed.stillBound.join(" and ")} ${plural ? "are" : "is"} still in use after stopping ${owner}` + (restored ? " (the previous proxy has been restored)" : "")
+    };
+  }
+  return action2 === "migrate" ? { proceed: true, action: action2, sites, certPems, staticRootOverrides } : { proceed: true, action: action2 };
+}
+async function previewHostEdge(overrides = {}) {
+  const deps = { ...defaultDeps(), ...overrides };
+  const empty = { owner: null, blocked: false, sites: [], warnings: [] };
+  if (deps.platform !== "linux") return empty;
+  try {
+    const executor = deps.makeExecutor();
+    const { status, blocked, owner } = await deps.foreignProxyOnEdge(executor);
+    if (!blocked) return { ...empty, owner: owner || null };
+    const { sites, warnings } = await deps.importSites(executor, status);
+    return { owner: owner || null, blocked: true, sites, warnings };
+  } catch {
+    return empty;
+  }
 }
 async function rollbackHostEdge() {
   if (process.platform !== "linux") return false;
@@ -1192,6 +1214,51 @@ async function confirmEdgeAction(info3) {
   });
   return isCancel(choice) ? "cancel" : choice;
 }
+async function remediateUnreachableStaticRoots(opts) {
+  const { unreachable } = opts;
+  if (unreachable.length === 0) return void 0;
+  note(
+    unreachable.map((u) => `${chalk5.bold(u.host)} \u2192 ${chalk5.dim(u.root)}`).join("\n"),
+    `${unreachable.length} static site${unreachable.length === 1 ? "" : "s"} rooted outside the edge`
+  );
+  log.warn("Their files live outside the edge container's mounts, so they'd return 500 after cutover.");
+  let copy = true;
+  if (opts.interactive) {
+    const choice = await select({
+      message: "Copy these sites' files into the edge so they keep serving?",
+      options: [
+        {
+          value: "copy",
+          label: `Copy ${unreachable.length === 1 ? "it" : "all"} into the edge`,
+          hint: "snapshot the files under /opt/openship/static (recommended)"
+        },
+        {
+          value: "leave",
+          label: "Leave as-is",
+          hint: "they stop serving until you mount their directory yourself"
+        }
+      ],
+      initialValue: "copy"
+    });
+    copy = !isCancel(choice) && choice === "copy";
+  } else {
+    log.info("Non-interactive: copying unreachable static roots into the edge.");
+  }
+  if (!copy) return void 0;
+  const overrides = {};
+  for (const u of unreachable) {
+    try {
+      const newRoot = await copyStaticRootIntoEdge(opts.executor, { root: u.root, host: u.host });
+      overrides[u.host] = newRoot;
+      log.success(`Copied ${u.host} \u2192 ${newRoot}`);
+    } catch (err2) {
+      log.warn(
+        `Couldn't copy ${u.host} (${u.root}) \u2014 it will migrate as-is: ${err2 instanceof Error ? err2.message : String(err2)}`
+      );
+    }
+  }
+  return Object.keys(overrides).length > 0 ? overrides : void 0;
+}
 function defaultDeps() {
   return {
     platform: process.platform,
@@ -1200,6 +1267,7 @@ function defaultDeps() {
     foreignProxyOnEdge,
     importSites,
     beginEdgeTakeover: (executor, status, onLog) => beginEdgeTakeover(executor, status, (entry) => onLog(entry.message, entry.level)),
+    rollbackHostEdge,
     recoverInterruptedTakeover: (executor, onLog, isEdgeHealthy) => recoverInterruptedTakeover(
       executor,
       (entry) => onLog(entry.message, entry.level),
@@ -1227,12 +1295,205 @@ function defaultDeps() {
   };
 }
 
+// src/lib/up-plan.ts
+function planMethod(opts, dockerUsable) {
+  if (opts.bare) return { method: "bare", reason: "--bare was passed" };
+  if (opts.compose) return { method: "compose", reason: "--compose was passed" };
+  if (process.platform !== "linux") {
+    return {
+      method: "bare",
+      reason: `the compose edge needs host networking, which Docker Desktop on ${process.platform} doesn't provide`
+    };
+  }
+  return dockerUsable ? { method: "compose", reason: "the default on Linux when Docker is usable" } : { method: "bare", reason: "Docker isn't usable here, so `up` falls back to the process service" };
+}
+async function planUp(opts) {
+  const mode = opts.fromSource || opts.source ? "from-source" : opts.foreground ? "foreground" : "service";
+  const attached = mode !== "service";
+  const docker = dockerInstallPreview();
+  const dockerUsable = docker.gap === null || docker.wouldInstall;
+  const { method, reason } = attached ? { method: "bare", reason: `--${mode === "foreground" ? "foreground" : "from-source"} runs attached (no service, no compose)` } : planMethod(opts, dockerUsable);
+  const plan = {
+    mode,
+    method,
+    methodReason: reason,
+    docker,
+    ports: method === "compose" ? await resolveComposePorts({ api: opts.port, dashboard: opts.dashboardPort }, { persist: false }) : await resolvePorts(
+      {
+        api: opts.port ? Number(opts.port) : void 0,
+        dashboard: opts.dashboardPort ? Number(opts.dashboardPort) : void 0
+      },
+      { persist: false }
+    ),
+    ...opts.publicUrl ? { publicUrl: opts.publicUrl } : {},
+    writes: [],
+    runs: []
+  };
+  if (mode === "from-source") {
+    plan.fromSource = {
+      ref: opts.source ? "local" : (opts.ref || "main").trim(),
+      ...opts.source ? { sourceDir: opts.source } : { repo: opts.repo || DEFAULT_REPO }
+    };
+  }
+  if (method === "compose") {
+    const stack = composePlan({
+      apiPort: String(plan.ports.api),
+      dashboardPort: String(plan.ports.dashboard),
+      ...opts.publicUrl ? { publicUrl: opts.publicUrl } : {},
+      ...opts.trustProxy ? { trustProxy: true } : {},
+      ...opts.hostControl === false ? { noHostControl: true } : {}
+    });
+    plan.compose = stack;
+    if (process.platform === "linux") plan.edge = await previewHostEdge();
+    plan.writes.push(
+      stack.composeFile,
+      `${stack.envFile}${stack.newSecrets.length ? `  (generates ${stack.newSecrets.join(", ")})` : ""}`,
+      ...stack.buildFile ? [stack.buildFile] : [],
+      ...stack.hostChannel ? [
+        stack.hostChannel.keyPath,
+        `${join7(homedir2(), ".ssh/authorized_keys")}  (authorizes that key for ${stack.hostChannel.user}'s host ops; --no-host-control skips it)`
+      ] : [],
+      ...stack.mountDirs.map((d) => `${d}/  (edge routing state + certs)`),
+      stack.installMethodFile
+    );
+    plan.runs.push(
+      stack.buildDir ? `docker compose pull postgres redis && docker compose build  (from ${stack.buildDir})` : `docker compose pull  (postgres, redis, api, dashboard, edge \u2014 several hundred MB)`,
+      `docker compose up -d  (the edge container binds host :80 and :443)`
+    );
+  } else {
+    plan.writes.push(PORTS_FILE, `${LOG_DIR}/`);
+    if (mode === "service") {
+      const svc = preview({
+        port: opts.port,
+        dataDir: opts.dataDir,
+        dashboardPort: opts.dashboardPort,
+        ui: opts.ui,
+        uiVersion: opts.uiVersion,
+        publicUrl: opts.publicUrl,
+        trustProxy: opts.trustProxy || opts.managedEdge,
+        host: opts.host,
+        managedEdge: opts.managedEdge,
+        acmeEmail: opts.acmeEmail
+      });
+      plan.service = svc;
+      if (svc.path) plan.writes.push(svc.path);
+      plan.runs.push(installStepFor(svc.kind));
+    }
+    plan.writes.push(
+      AUTH_SECRET_FILE,
+      INTERNAL_TOKEN_FILE,
+      `${opts.dataDir || DATA_DIR}/  (embedded Postgres)`
+    );
+    if (opts.ui !== false) {
+      plan.runs.push(`download the dashboard bundle \u2192 ${DASHBOARD_CACHE}  (--no-ui skips it)`);
+    }
+    if (mode === "from-source") {
+      const src = plan.fromSource;
+      plan.runs.unshift(
+        ...src.sourceDir ? [`build the checkout at ${src.sourceDir}`] : [`git clone/fetch ${src.repo} @ ${src.ref} \u2192 ${SOURCE_CHECKOUT_DIR}`],
+        `bun install + build the release dist \u2192 ${SOURCE_DIST_DIR}  (compiles the dashboard)`
+      );
+    }
+    if (opts.managedEdge) {
+      plan.runs.push(
+        "install OpenResty + issue a Let's Encrypt certificate on this box (--managed-edge)"
+      );
+    }
+    if (attached) {
+      plan.runs.push("run the API + dashboard attached to this terminal until Ctrl-C");
+    }
+  }
+  return plan;
+}
+function renderUpPlan(plan) {
+  const L = [];
+  const head = (s) => L.push("", chalk6.bold(`  ${s}`));
+  const item = (s) => L.push(chalk6.dim(`    ${s}`));
+  L.push(
+    "",
+    chalk6.cyan("  Dry run \u2014 nothing on this machine has been changed."),
+    chalk6.dim(`  ${methodLabel(plan)} \xB7 ${plan.methodReason}`)
+  );
+  head("Docker");
+  const { docker } = plan;
+  if (!docker.gap) {
+    item("already installed and usable \u2014 nothing to install.");
+  } else if (docker.wouldInstall) {
+    item(chalk6.yellow(`${docker.gap.summary}. A real run WOULD install it:`));
+    item(`  ${docker.installCommand}`);
+    item("~150 MB of packages, and it enables the docker service on this box.");
+    if (plan.method === "compose") item("`openship up --bare` installs without Docker (embedded database).");
+  } else {
+    item(`${docker.gap.summary} \u2014 a real run would NOT install it.`);
+    if (docker.gap.hint) item(docker.gap.hint);
+  }
+  head("Ports");
+  item(
+    `API ${plan.ports.api} \xB7 dashboard ${plan.ports.dashboard}` + (plan.ports.switched.api || plan.ports.switched.dashboard ? `  (preferred ${plan.ports.preferred.api}/${plan.ports.preferred.dashboard} \u2014 busy right now)` : "")
+  );
+  if (plan.publicUrl) item(`public URL: ${plan.publicUrl}`);
+  if (plan.compose) {
+    head("Compose stack");
+    item(plan.compose.existing ? "re-runs an existing install (secrets preserved)" : "fresh install");
+    for (const { key, value } of plan.compose.settings) item(`${key}=${value}`);
+  }
+  if (plan.edge) {
+    head("Ports 80/443");
+    if (!plan.edge.blocked) {
+      item("free (or already Openship's edge) \u2014 the edge container binds them.");
+    } else {
+      item(chalk6.yellow(`held by ${plan.edge.owner}.`));
+      item(
+        plan.edge.sites.length ? `A real run would ask before touching it: migrate its ${plan.edge.sites.length} site(s) into Openship's edge, take over (its sites stop serving), or cancel.` : "A real run would ask before stopping it (--edge=migrate|takeover|cancel)."
+      );
+      for (const site of plan.edge.sites.slice(0, 8)) {
+        item(`  \u2022 ${site.serverNames.join(", ") || "(no server_name)"}${site.ssl ? " [TLS]" : ""}`);
+      }
+      if (plan.edge.sites.length > 8) item(`  \u2022 \u2026and ${plan.edge.sites.length - 8} more`);
+    }
+  }
+  head("Would write");
+  for (const w of plan.writes) item(w);
+  if (plan.runs.length) {
+    head("Would run");
+    for (const r of plan.runs) item(r);
+  }
+  if (plan.service) {
+    head(`${plan.service.kind} definition (${plan.service.path})`);
+    L.push(plan.service.content.replace(/\n$/, ""));
+  }
+  if (plan.compose) {
+    head(`docker-compose.yml (${plan.compose.composeFile})`);
+    L.push(plan.compose.yaml.replace(/\n$/, ""));
+  }
+  L.push("", chalk6.dim("  Re-run without --dry-run to apply this."), "");
+  return L.join("\n");
+}
+function methodLabel(plan) {
+  if (plan.mode === "from-source") return "Build from source and run attached";
+  if (plan.mode === "foreground") return "Run attached in this terminal";
+  return plan.method === "compose" ? "Install the Docker Compose stack" : `Install the ${serviceWord(plan.service?.kind)} service`;
+}
+function serviceWord(kind) {
+  switch (kind) {
+    case "launchd":
+      return "launchd";
+    case "systemd-user":
+      return "systemd (--user)";
+    case "systemd-system":
+      return "systemd (system)";
+    case "schtasks":
+      return "Scheduled Task";
+    default:
+      return "process";
+  }
+}
+
 // src/lib/loopback-api.ts
 import { existsSync as existsSync6, readFileSync as readFileSync4, mkdirSync as mkdirSync7, writeFileSync as writeFileSync6 } from "fs";
 import { randomBytes } from "crypto";
-import { join as join7 } from "path";
 function ensureInternalToken() {
-  const path2 = join7(OS_DIR, "internal-token");
+  const path2 = INTERNAL_TOKEN_FILE;
   if (existsSync6(path2)) return readFileSync4(path2, "utf8").trim();
   mkdirSync7(OS_DIR, { recursive: true, mode: 448 });
   const token = randomBytes(32).toString("hex");
@@ -1265,17 +1526,17 @@ async function internalPost(port, path2, body, token) {
     return { ok: false, data: { error: err2.message } };
   }
 }
-async function bootstrapAdmin(apiPort2, admin, token) {
-  const { ok: ok3, data } = await internalPost(apiPort2, "/api/system/bootstrap-admin", admin, token);
+async function bootstrapAdmin(apiPort, admin, token) {
+  const { ok: ok3, data } = await internalPost(apiPort, "/api/system/bootstrap-admin", admin, token);
   if (ok3) return { ok: true };
   if (data?.error === "An admin account already exists") return { ok: true, message: "already-exists" };
   return { ok: false, message: data?.error || "failed" };
 }
-async function waitHealthy(apiPort2, seconds = 90) {
+async function waitHealthy(apiPort, seconds = 90) {
   for (let i = 0; i < seconds; i++) {
     await new Promise((r) => setTimeout(r, 1e3));
     try {
-      await fetch(`http://127.0.0.1:${apiPort2}/api/health`, { signal: AbortSignal.timeout(2e3) });
+      await fetch(`http://127.0.0.1:${apiPort}/api/health`, { signal: AbortSignal.timeout(2e3) });
       return true;
     } catch {
     }
@@ -1500,7 +1761,8 @@ async function headlessProvision(opts) {
       dashPort,
       localEdge: d.localEdge,
       edgeTakeover: d.edgeTakeover,
-      edgeMigrate: d.edgeMigrate
+      edgeMigrate: d.edgeMigrate,
+      ...d.staticRootOverrides ? { staticRootOverrides: d.staticRootOverrides } : {}
     });
     let slug = d.slug;
     let res = await internalPost(port, "/api/system/self-register", freeBody(slug), token);
@@ -1548,8 +1810,8 @@ function normalizePublicUrl(raw) {
   const url = normalizeUrl(raw);
   if (!url) {
     console.error(
-      chalk6.red(`
-  Invalid --public-url: ${raw}`) + chalk6.dim("\n  Expected something like https://ops.example.com\n")
+      chalk7.red(`
+  Invalid --public-url: ${raw}`) + chalk7.dim("\n  Expected something like https://ops.example.com\n")
     );
     process.exit(1);
   }
@@ -1558,14 +1820,17 @@ function normalizePublicUrl(raw) {
 var DIST_DIR = dirname2(fileURLToPath(import.meta.url));
 var SERVER_DIR = join8(DIST_DIR, "server");
 function ensureAuthSecret() {
-  const path2 = join8(OS_DIR, "auth-secret");
+  const path2 = AUTH_SECRET_FILE;
   if (existsSync7(path2)) return readFileSync5(path2, "utf8").trim();
   mkdirSync8(OS_DIR, { recursive: true, mode: 448 });
   const secret = randomBytes2(32).toString("hex");
   writeFileSync7(path2, secret, { mode: 384 });
   return secret;
 }
-var upCommand = new Command4("up").description("Start Openship as a persistent service (boot + auto-restart); --foreground to run attached").option("--port <port>", "API port to listen on", "4000").option("--data-dir <dir>", "Directory for the embedded database").option("--dashboard-port <port>", "Dashboard port", "3001").option("--no-ui", "Run the API only \u2014 don't download/serve the dashboard").option("--ui-version <tag>", "Dashboard release tag to run (default: this CLI's version)").option("-f, --foreground", "Run attached in this terminal instead of as a background service").option("--dry-run", "Print the service definition that would be installed, then exit").option(
+var upCommand = new Command4("up").description("Start Openship as a persistent service (boot + auto-restart); --foreground to run attached").option("--port <port>", "API port to listen on (default: 4000, or the next free port if it's taken)").option("--data-dir <dir>", "Directory for the embedded database").option("--dashboard-port <port>", "Dashboard port (default: 3001, or the next free port if it's taken)").option("--no-ui", "Run the API only \u2014 don't download/serve the dashboard").option("--ui-version <tag>", "Dashboard release tag to run (default: this CLI's version)").option("-f, --foreground", "Run attached in this terminal instead of as a background service").option(
+  "--dry-run",
+  "Preview only: print what `up` would install (method, ports, files, commands, the service definition / compose file) and exit WITHOUT changing this machine"
+).option(
   "--public-url <url>",
   "Serve remotely at this public URL (VPS): binds the dashboard to all interfaces, proxies the API same-origin, and requires login"
 ).option(
@@ -1581,34 +1846,31 @@ var upCommand = new Command4("up").description("Start Openship as a persistent s
   "--no-host-control",
   "Harden: don't give the control plane a channel to this machine's OS. No host SSH key is generated or mounted, host operations refuse, and this box stops being offered as a deploy target. Recommended when this box only manages REMOTE servers \u2014 it loses :80/:443 takeover, the host terminal and host port scans. The Docker socket is still mounted (deployments need it), so this is defense in depth, not isolation."
 ).option("--edge <action>", "Compose mode: how to handle an existing proxy on :80/:443 \u2014 'migrate' (import its sites into Openship's edge), 'takeover' (stop it; its sites stop serving), or 'cancel'. Default: prompt when interactive, else cancel.").option("--non-interactive", "Headless install: after the service starts, create the admin + register the domain from the flags below (no prompts). Alias: --yes.").option("--yes", "Alias for --non-interactive.").option("--admin-name <name>", "Admin display name (headless install)").option("--admin-email <email>", "Admin email \u2014 required for a headless install").option("--admin-password <password>", "Admin password (min 8). Prefer the OPENSHIP_ADMIN_PASSWORD env var to keep it out of shell history.").option("--domain-kind <kind>", "Headless install domain: byo | custom | free | none (default: byo if --public-url set, else none)").option("--hostname <host>", "Domain/hostname for --domain-kind byo|custom (or derived from --public-url)").option("--slug <slug>", "Free .opsh.io subdomain for --domain-kind free (box must already be Cloud-connected)").action(async (opts) => {
+  if (opts.dryRun) {
+    console.log(renderUpPlan(await planUp({ ...opts, publicUrl: effectivePublicUrl(opts.publicUrl) })));
+    return;
+  }
   if (opts.fromSource || opts.source) return runFromSource(opts);
   if (opts.foreground) return runForeground(opts);
   const headless = !!(opts.nonInteractive || opts.yes);
-  let method;
-  if (opts.bare) {
-    method = "bare";
-  } else if (opts.compose) {
-    if (!await ensureDocker()) {
-      console.error(
-        chalk6.red("\n  --compose needs Docker + docker compose, and they couldn't be installed automatically.") + chalk6.dim(
-          "\n  Install Docker (https://docs.docker.com/engine/install/) and re-run, or use --bare.\n"
-        )
-      );
-      process.exit(1);
-    }
-    method = "compose";
-  } else if (process.platform === "linux") {
-    method = await ensureDocker() ? "compose" : "bare";
-  } else {
-    method = composeIsViableDefault() ? "compose" : "bare";
+  const needsDocker = !opts.bare && (Boolean(opts.compose) || process.platform === "linux");
+  const dockerUsable = needsDocker ? await ensureDocker() : false;
+  const { method } = planMethod(opts, dockerUsable);
+  if (method === "compose" && !dockerUsable) {
+    console.error(
+      chalk7.red("\n  --compose needs Docker + docker compose, and they couldn't be installed automatically.") + chalk7.dim(
+        "\n  Install Docker (https://docs.docker.com/engine/install/) and re-run, or use --bare.\n"
+      )
+    );
+    process.exit(1);
   }
   if (method === "compose") {
     const started2 = await runCompose(opts);
-    if (headless && !opts.dryRun) {
+    if (headless) {
       const token = composeInternalToken();
       if (!token) {
         console.warn(
-          chalk6.yellow(
+          chalk7.yellow(
             "\n  Couldn't read the stack's internal token (compose/.env) \u2014 create the admin from the dashboard.\n"
           )
         );
@@ -1623,7 +1885,7 @@ var upCommand = new Command4("up").description("Start Openship as a persistent s
     return;
   }
   const started = await startService(opts);
-  if (headless && !opts.dryRun) await runHeadlessProvision(opts, started, { method: "bare" });
+  if (headless) await runHeadlessProvision(opts, started, { method: "bare" });
 });
 async function runHeadlessProvision(opts, started, extra) {
   let inputs;
@@ -1641,7 +1903,7 @@ async function runHeadlessProvision(opts, started, extra) {
     });
   } catch (err2) {
     if (err2 instanceof HeadlessInputError) {
-      console.error(chalk6.red(`
+      console.error(chalk7.red(`
   ${err2.message}
 `));
       process.exit(1);
@@ -1655,13 +1917,13 @@ async function runHeadlessProvision(opts, started, extra) {
       inputs,
       token: extra?.token,
       method: extra?.method,
-      onLog: (m) => console.log(chalk6.dim(`  ${m}`))
+      onLog: (m) => console.log(chalk7.dim(`  ${m}`))
     });
-    console.log(chalk6.green(`
+    console.log(chalk7.green(`
   \u2713 Openship provisioned${result.liveUrl ? `: ${result.liveUrl}` : "."}`));
-    for (const w of result.warnings) console.warn(chalk6.yellow(`  \u26A0 ${w}`));
+    for (const w of result.warnings) console.warn(chalk7.yellow(`  \u26A0 ${w}`));
   } catch (err2) {
-    console.error(chalk6.red(`
+    console.error(chalk7.red(`
   Headless provisioning failed: ${err2.message}
 `));
     process.exit(1);
@@ -1671,26 +1933,33 @@ async function runCompose(opts) {
   const headless = !!(opts.nonInteractive || opts.yes);
   if (!hasDockerCompose()) {
     console.error(
-      chalk6.red("\n  Docker + `docker compose` are required for the Compose install.\n") + chalk6.dim("  Install Docker, or run `openship up --bare` for the process mode.\n")
+      chalk7.red("\n  Docker + `docker compose` are required for the Compose install.\n") + chalk7.dim("  Install Docker, or run `openship up --bare` for the process mode.\n")
     );
     process.exit(1);
   }
   if (opts.edge && !EDGE_ACTIONS.includes(opts.edge)) {
     console.error(
-      chalk6.red(`
-  Invalid --edge value: ${opts.edge}`) + chalk6.dim(`
+      chalk7.red(`
+  Invalid --edge value: ${opts.edge}`) + chalk7.dim(`
   Expected one of: ${EDGE_ACTIONS.join(", ")}
 `)
     );
     process.exit(1);
   }
   const publicUrl = effectivePublicUrl(opts.publicUrl);
+  const ports = await resolveComposePorts({ api: opts.port, dashboard: opts.dashboardPort });
+  const apiPort = String(ports.api);
+  const dashboardPort = String(ports.dashboard);
+  const portNotice = portMoveNotice(ports, [...composeTrustedOriginUrls(), publicUrl]);
+  if (portNotice.length) {
+    console.log("\n" + portNotice.map((l) => chalk7.yellow(`  ${l}`)).join("\n"));
+  }
   const prefetch = ora(
     sourceBuildDir() ? "Building images before touching :80/:443\u2026" : "Pulling images before touching :80/:443\u2026"
   ).start();
   const fetched = composePrefetch({
-    apiPort: opts.port,
-    dashboardPort: opts.dashboardPort,
+    apiPort,
+    dashboardPort,
     publicUrl,
     trustProxy: opts.trustProxy,
     noHostControl: opts.hostControl === false ? true : void 0
@@ -1698,7 +1967,7 @@ async function runCompose(opts) {
   if (!fetched) {
     prefetch.fail("Couldn't fetch the stack's images \u2014 nothing was changed on this box.");
     console.error(
-      chalk6.dim("\n  Your current proxy is untouched and still serving. Fix the pull/build error above and re-run.\n")
+      chalk7.dim("\n  Your current proxy is untouched and still serving. Fix the pull/build error above and re-run.\n")
     );
     process.exit(1);
   }
@@ -1708,15 +1977,17 @@ async function runCompose(opts) {
     edgePlan = await planAndApplyHostEdge({ edge: opts.edge });
   } catch (e) {
     console.error(
-      chalk6.red(`
+      chalk7.red(`
   Edge preflight failed: ${e.message}
-`) + chalk6.dim("  Re-run, or pass --edge=cancel to skip taking over :80/:443.\n")
+`) + chalk7.dim("  Re-run, or pass --edge=cancel to skip taking over :80/:443.\n")
     );
     process.exit(1);
   }
   if (!edgePlan.proceed) {
     console.log(
-      chalk6.yellow("\n  Left the existing proxy on :80/:443 running \u2014 not starting the stack.\n") + chalk6.dim("  Re-run and choose migrate / take-over (or pass --edge=migrate|takeover) when ready.\n")
+      edgePlan.blockedBy ? chalk7.red(`
+  Can't take over the edge: ${edgePlan.blockedBy}.
+`) + chalk7.dim("  Find what else is bound to those ports (`ss -ltnp | grep -E ':80|:443'`), then re-run.\n") : chalk7.yellow("\n  Left the existing proxy on :80/:443 running \u2014 not starting the stack.\n") + chalk7.dim("  Re-run and choose migrate / take-over (or pass --edge=migrate|takeover) when ready.\n")
     );
     process.exit(1);
   }
@@ -1727,8 +1998,8 @@ async function runCompose(opts) {
   const res = await composeUp({
     // Prefetched above, before the preflight stopped anything.
     alreadyFetched: true,
-    apiPort: opts.port,
-    dashboardPort: opts.dashboardPort,
+    apiPort,
+    dashboardPort,
     publicUrl,
     trustProxy: opts.trustProxy,
     // commander maps `--no-host-control` to hostControl === false. `undefined` when
@@ -1740,7 +2011,7 @@ async function runCompose(opts) {
     spinner5.fail("docker compose failed to start the stack");
     const restored = edgePlan.action ? await rollbackHostEdge() : false;
     console.error(
-      chalk6.dim("\n  Check `docker compose -f ~/.openship/compose/docker-compose.yml logs`.\n") + (restored ? chalk6.yellow("  Restored the previous proxy on :80/:443 \u2014 your sites are serving again.\n") : chalk6.dim("  If ports 80/443 are held by another proxy, re-run \u2014 the preflight will offer to migrate or take over.\n"))
+      chalk7.dim("\n  Check `docker compose -f ~/.openship/compose/docker-compose.yml logs`.\n") + (restored ? chalk7.yellow("  Restored the previous proxy on :80/:443 \u2014 your sites are serving again.\n") : chalk7.dim("  If ports 80/443 are held by another proxy, re-run \u2014 the preflight will offer to migrate or take over.\n"))
     );
     process.exit(1);
   }
@@ -1748,16 +2019,16 @@ async function runCompose(opts) {
   if (edgePlan.action && await edgeIsBroken(new LocalExecutor())) {
     const reason = await edgeCrashReason(new LocalExecutor());
     console.error(
-      chalk6.red(`
+      chalk7.red(`
   Openship's edge container is not running${reason ? ` \u2014 ${reason}` : "."}`)
     );
     const restored = await rollbackHostEdge();
     console.error(
-      restored ? chalk6.yellow(
+      restored ? chalk7.yellow(
         `  Your previous proxy has been restarted \u2014 the box is serving again, on it.
   Nothing was migrated. Fix the cause above, then re-run \`openship up\`.
 `
-      ) : chalk6.red(
+      ) : chalk7.red(
         `  AND your previous proxy could NOT be restarted automatically \u2014 the box is
   serving nothing right now. Start it by hand:
     docker stop openship-edge && sudo systemctl enable --now nginx
@@ -1768,68 +2039,47 @@ async function runCompose(opts) {
   }
   let importedOk = true;
   if (edgePlan.action === "migrate" && edgePlan.sites?.length) {
-    const outcome = await importMigratedSites(res.apiPort, edgePlan.sites, edgePlan.certPems);
+    const outcome = await importMigratedSites(
+      res.apiPort,
+      edgePlan.sites,
+      edgePlan.certPems,
+      edgePlan.staticRootOverrides
+    );
     importedOk = outcome.registered.length > 0;
     if (importedOk) markStoppedProxyImported();
   }
   if (edgePlan.action && importedOk) await completeHostEdge();
   const dashboardUrl = publicUrl ?? `http://localhost:${res.dashPort}`;
   console.log(
-    chalk6.dim(`  Dashboard: ${dashboardUrl}  (login required)
-`) + chalk6.dim("  Images:    api + dashboard + edge (OpenResty on :80/:443)\n") + chalk6.dim("  Manage:    openship stop \xB7 openship update \xB7 openship status\n") + // In headless mode the admin is bootstrapped below — don't tell the user to do it by hand.
-    (headless ? "" : chalk6.dim("  Create an admin: open the dashboard and register the first account.\n"))
+    chalk7.dim(`  Dashboard: ${dashboardUrl}  (login required)
+`) + chalk7.dim("  Images:    api + dashboard + edge (OpenResty on :80/:443)\n") + chalk7.dim("  Manage:    openship stop \xB7 openship update \xB7 openship status\n") + // In headless mode the admin is bootstrapped below — don't tell the user to do it by hand.
+    (headless ? "" : chalk7.dim("  Create an admin: open the dashboard and register the first account.\n"))
   );
   return { apiPort: res.apiPort, dashPort: res.dashPort };
 }
 async function runFromSource(opts) {
-  console.log(chalk6.cyan("\n  Building Openship from source (preview mode)\u2026"));
+  console.log(chalk7.cyan("\n  Building Openship from source (preview mode)\u2026"));
   console.log(
-    chalk6.dim("  Unverified dev build \u2014 for previewing a branch, not production self-hosting.\n")
+    chalk7.dim("  Unverified dev build \u2014 for previewing a branch, not production self-hosting.\n")
   );
   let src;
   try {
     src = await prepareFromSource({ ref: opts.ref, source: opts.source, repo: opts.repo });
   } catch (e) {
     console.error(
-      chalk6.red(`
+      chalk7.red(`
   Build from source failed: ${e.message}
-`) + chalk6.dim("  Small boxes can OOM on the dashboard build \u2014 build on a bigger machine and pass --source, or use a published release.\n")
+`) + chalk7.dim("  Small boxes can OOM on the dashboard build \u2014 build on a bigger machine and pass --source, or use a published release.\n")
     );
     process.exit(1);
   }
-  console.log(chalk6.green(`
+  console.log(chalk7.green(`
   Built ${src.ref} (${src.sha}). Starting\u2026
 `));
   await runForeground(opts, src);
 }
 async function startService(opts, runOpts = {}) {
   const publicUrl = effectivePublicUrl(opts.publicUrl);
-  if (opts.dryRun) {
-    const p = preview({
-      port: opts.port,
-      dataDir: opts.dataDir,
-      dashboardPort: opts.dashboardPort,
-      ui: opts.ui,
-      uiVersion: opts.uiVersion,
-      publicUrl,
-      trustProxy: opts.trustProxy || opts.managedEdge,
-      host: opts.host,
-      managedEdge: opts.managedEdge,
-      acmeEmail: opts.acmeEmail
-    });
-    console.log(
-      chalk6.dim(`
-  service manager: ${p.kind}
-  path: ${p.path}
-
-`) + p.content + "\n"
-    );
-    return {
-      port: String(opts.port || "4000"),
-      dashPort: String(opts.dashboardPort || "3001"),
-      publicUrl
-    };
-  }
   const resolved = await resolvePorts({
     api: opts.port ? Number(opts.port) : void 0,
     dashboard: opts.dashboardPort ? Number(opts.dashboardPort) : void 0
@@ -1852,28 +2102,26 @@ async function startService(opts, runOpts = {}) {
   try {
     const res = installAndStart(flags);
     if (!runOpts.quiet) {
-      if (resolved.switched.api || resolved.switched.dashboard) {
-        console.log(
-          chalk6.yellow(`
-  A preferred port was busy \u2014 using API ${port}, dashboard ${dashPort}.`)
-        );
+      const portNotice = portMoveNotice(resolved, [publicUrl]);
+      if (portNotice.length) {
+        console.log("\n" + portNotice.map((l) => chalk7.yellow(`  ${l}`)).join("\n"));
       }
-      const dashboardLine = publicUrl ? chalk6.dim(`  Dashboard: ${publicUrl}  (login required)
-`) : chalk6.dim(`  Dashboard: http://localhost:${dashPort}  (login required)
+      const dashboardLine = publicUrl ? chalk7.dim(`  Dashboard: ${publicUrl}  (login required)
+`) : chalk7.dim(`  Dashboard: http://localhost:${dashPort}  (login required)
 `);
       console.log(
-        chalk6.green("\n  \u2714 Openship is running as a service.\n") + (opts.ui !== false ? dashboardLine : "") + (publicUrl ? chalk6.dim("  API is proxied through the dashboard (not exposed). Point your reverse proxy / DNS at the dashboard port.\n") : chalk6.dim(`  API:       http://localhost:${port}/api
-`)) + chalk6.dim(`  ${res.detail}
-`) + chalk6.dim("  Starts on boot and auto-restarts. Stop with `openship stop`.\n")
+        chalk7.green("\n  \u2714 Openship is running as a service.\n") + (opts.ui !== false ? dashboardLine : "") + (publicUrl ? chalk7.dim("  API is proxied through the dashboard (not exposed). Point your reverse proxy / DNS at the dashboard port.\n") : chalk7.dim(`  API:       http://localhost:${port}/api
+`)) + chalk7.dim(`  ${res.detail}
+`) + chalk7.dim("  Starts on boot and auto-restarts. Stop with `openship stop`.\n")
       );
     }
     return { port, dashPort, publicUrl };
   } catch (e) {
     if (runOpts.quiet) throw e;
     console.error(
-      chalk6.red(`
+      chalk7.red(`
   Couldn't install the service: ${e.message}
-`) + chalk6.dim("  Run `openship up --foreground` to run it attached instead.\n")
+`) + chalk7.dim("  Run `openship up --foreground` to run it attached instead.\n")
     );
     process.exit(1);
   }
@@ -1890,7 +2138,7 @@ async function runForeground(opts, source) {
     const serverEntry = join8(SERVER_DIR, "index.js");
     if (!existsSync7(serverEntry)) {
       console.error(
-        chalk6.red("\n  Bundled server not found in this install.") + chalk6.dim("\n  Reinstall with `openship update` (or `npm i -g openship`).\n")
+        chalk7.red("\n  Bundled server not found in this install.") + chalk7.dim("\n  Reinstall with `openship update` (or `npm i -g openship`).\n")
       );
       process.exit(1);
     }
@@ -1904,18 +2152,31 @@ async function runForeground(opts, source) {
   const dashPort = String(resolved.dashboard);
   const publicUrl = effectivePublicUrl(opts.publicUrl);
   const managedEdge = Boolean(opts.managedEdge && publicUrl);
-  const dataDir = opts.dataDir || join8(OS_DIR, "data");
+  const dataDir = opts.dataDir || DATA_DIR;
   mkdirSync8(dataDir, { recursive: true });
-  const logDir = join8(OS_DIR, "logs");
-  mkdirSync8(logDir, { recursive: true });
-  const instanceLogPath = join8(logDir, "instance.log");
+  mkdirSync8(LOG_DIR, { recursive: true });
+  const instanceLogPath = join8(LOG_DIR, "instance.log");
   const instanceLog = createWriteStream2(instanceLogPath, { flags: "w" });
   const env = {
     ...process.env,
     PORT: port,
     NODE_ENV: "production",
-    // desktop mode → in-process job runner (no Redis).
-    DEPLOY_MODE: "desktop",
+    // BARE, not "desktop". This box is a server-host: openship runs ON it and it
+    // is itself a deploy target. Claiming "desktop" (once done here just to get
+    // the in-process job runner) made the API report `isServerHost: false`
+    // (health.routes.ts), so `registerSelfServerReconcile` — gated on
+    // modes:["selfhosted"] — never ran, "This Server" was never registered, and
+    // the deploy wizard offered Openship Cloud as the only target on a box the
+    // operator had just installed on purpose.
+    //
+    // It also mislabelled the security posture: DEPLOY_MODE=desktop relaxes the
+    // zero-auth gate and makes INTERNAL_TOKEN optional. "desktop" belongs to
+    // Electron alone (apps/desktop/src/main/services.ts:361) — the only launcher
+    // that is genuinely a single-user loopback app.
+    //
+    // The job runner is unaffected: it picks BullMQ vs in-process by REDIS
+    // REACHABILITY (app.ts:238), and OPENSHIP_JOB_RUNNER below already pins it.
+    DEPLOY_MODE: "bare",
     OPENSHIP_TARGET: "local",
     OPENSHIP_JOB_RUNNER: "in-process",
     PGLITE_DATA_DIR: dataDir,
@@ -2017,7 +2278,7 @@ async function runForeground(opts, source) {
     const uiSpinner = ora("Preparing the dashboard\u2026").start();
     try {
       const bundle = await ensureDashboard({
-        tag: source ? "local" : opts.uiVersion || `v${"0.4.8"}`,
+        tag: source ? "local" : opts.uiVersion || `v${"0.6.0"}`,
         onProgress: (received, total) => {
           if (total) {
             uiSpinner.text = `Downloading dashboard\u2026 ${Math.round(received / total * 100)}%`;
@@ -2092,7 +2353,7 @@ async function runForeground(opts, source) {
     } catch (e) {
       uiSpinner.warn(`Dashboard unavailable: ${e.message}`);
       console.log(
-        chalk6.dim(
+        chalk7.dim(
           "  The API is still running. Retry `openship up`, pass --no-ui, or use `openship install` for the desktop app.\n"
         )
       );
@@ -2100,16 +2361,16 @@ async function runForeground(opts, source) {
   }
   if (publicUrl) {
     console.log(
-      (dashboardUrl ? chalk6.dim(`  Dashboard: ${dashboardUrl}  (login required)
-`) : "") + chalk6.dim("  API is proxied through the dashboard (bound to loopback, not exposed).\n") + chalk6.dim(`  Data:      ${dataDir}
-`) + (managedEdge ? chalk6.dim("  Managed edge (OpenResty + Let's Encrypt) fronts this box \u2014 point your domain's A record at this server's IP. Stop with Ctrl-C.\n") : chalk6.dim("  Point your reverse proxy / DNS at the dashboard port. Stop with Ctrl-C.\n"))
+      (dashboardUrl ? chalk7.dim(`  Dashboard: ${dashboardUrl}  (login required)
+`) : "") + chalk7.dim("  API is proxied through the dashboard (bound to loopback, not exposed).\n") + chalk7.dim(`  Data:      ${dataDir}
+`) + (managedEdge ? chalk7.dim("  Managed edge (OpenResty + Let's Encrypt) fronts this box \u2014 point your domain's A record at this server's IP. Stop with Ctrl-C.\n") : chalk7.dim("  Point your reverse proxy / DNS at the dashboard port. Stop with Ctrl-C.\n"))
     );
   } else {
     console.log(
-      chalk6.dim(`  API:       http://localhost:${port}/api
-`) + (dashboardUrl ? chalk6.dim(`  Dashboard: ${dashboardUrl}  (login required)
-`) : "") + chalk6.dim(`  Data:      ${dataDir}
-`) + chalk6.dim("  Log in with your admin account (run `openship` to create one). Stop with Ctrl-C.\n")
+      chalk7.dim(`  API:       http://localhost:${port}/api
+`) + (dashboardUrl ? chalk7.dim(`  Dashboard: ${dashboardUrl}  (login required)
+`) : "") + chalk7.dim(`  Data:      ${dataDir}
+`) + chalk7.dim("  Log in with your admin account (run `openship` to create one). Stop with Ctrl-C.\n")
     );
   }
   child.stdout.off("data", buffer);
@@ -2123,20 +2384,20 @@ async function runForeground(opts, source) {
 
 // src/commands/stop.ts
 import { Command as Command5 } from "commander";
-import chalk7 from "chalk";
+import chalk8 from "chalk";
 var stopCommand = new Command5("stop").description("Stop Openship (started by `openship up`) \u2014 it won't restart or return on reboot").action(() => {
   if (readInstallMethod() === "compose") {
     const ok3 = composeDown();
-    if (ok3) console.log(chalk7.green("\n  \u2714 Openship stopped (docker compose down).\n"));
-    else console.error(chalk7.red("\n  docker compose down failed (or no stack found).\n"));
+    if (ok3) console.log(chalk8.green("\n  \u2714 Openship stopped (docker compose down).\n"));
+    else console.error(chalk8.red("\n  docker compose down failed (or no stack found).\n"));
     process.exit(ok3 ? 0 : 1);
   }
   try {
     const res = stop();
-    console.log(chalk7.green("\n  \u2714 Openship stopped.\n") + chalk7.dim(`  ${res.detail}
+    console.log(chalk8.green("\n  \u2714 Openship stopped.\n") + chalk8.dim(`  ${res.detail}
 `));
   } catch (e) {
-    console.error(chalk7.red(`
+    console.error(chalk8.red(`
   Couldn't stop the service: ${e.message}
 `));
     process.exit(1);
@@ -2145,7 +2406,7 @@ var stopCommand = new Command5("stop").description("Stop Openship (started by `o
 
 // src/commands/uninstall.ts
 import { Command as Command6 } from "commander";
-import chalk8 from "chalk";
+import chalk9 from "chalk";
 import { confirm, isCancel as isCancel2 } from "@clack/prompts";
 import { existsSync as existsSync8, rmSync as rmSync3 } from "fs";
 var uninstallCommand = new Command6("uninstall").description(
@@ -2161,52 +2422,52 @@ var uninstallCommand = new Command6("uninstall").description(
       !opts.keepImages && method === "compose" ? "  \u2022 delete the Openship container images" : null,
       "  \u2022 leave your DEPLOYED apps and their data untouched"
     ].filter(Boolean);
-    console.log(chalk8.yellow("\n  This will:\n") + lines.join("\n") + "\n");
+    console.log(chalk9.yellow("\n  This will:\n") + lines.join("\n") + "\n");
     const go = await confirm({
       message: destructive ? "Permanently remove Openship and its data?" : "Remove Openship (keeping data)?",
       initialValue: false
     });
     if (isCancel2(go) || !go) {
-      console.log(chalk8.dim("\n  Cancelled \u2014 nothing was changed.\n"));
+      console.log(chalk9.dim("\n  Cancelled \u2014 nothing was changed.\n"));
       return;
     }
   }
   const restored = await rollbackHostEdge().catch(() => false);
-  if (restored) console.log(chalk8.green("  Restored the proxy that was running before Openship."));
+  if (restored) console.log(chalk9.green("  Restored the proxy that was running before Openship."));
   if (method === "compose") {
     const { ok: ok3, removedImages } = composeUninstall({ removeImages: !opts.keepImages });
     if (!ok3) {
       console.log(
-        chalk8.yellow("  No compose stack found (or `down` failed) \u2014 continuing with local cleanup.")
+        chalk9.yellow("  No compose stack found (or `down` failed) \u2014 continuing with local cleanup.")
       );
     } else {
       console.log(
-        chalk8.green(`  Stack removed${destructive ? " (including its volumes)" : ""}.`)
+        chalk9.green(`  Stack removed${destructive ? " (including its volumes)" : ""}.`)
       );
     }
-    for (const ref of removedImages) console.log(chalk8.dim(`  removed image ${ref}`));
+    for (const ref of removedImages) console.log(chalk9.dim(`  removed image ${ref}`));
   } else {
     try {
       const res = stop();
-      console.log(chalk8.green(`  Service removed \u2014 ${res.detail}`));
+      console.log(chalk9.green(`  Service removed \u2014 ${res.detail}`));
     } catch (err2) {
-      console.log(chalk8.yellow(`  Couldn't remove the service: ${err2.message}`));
+      console.log(chalk9.yellow(`  Couldn't remove the service: ${err2.message}`));
     }
   }
   if (destructive && existsSync8(OS_DIR)) {
     try {
       rmSync3(OS_DIR, { recursive: true, force: true });
-      console.log(chalk8.green(`  Removed ${OS_DIR}`));
+      console.log(chalk9.green(`  Removed ${OS_DIR}`));
     } catch (err2) {
-      console.log(chalk8.yellow(`  Couldn't remove ${OS_DIR}: ${err2.message}`));
+      console.log(chalk9.yellow(`  Couldn't remove ${OS_DIR}: ${err2.message}`));
     }
   }
   console.log(
-    chalk8.green("\n  \u2714 Openship uninstalled.\n") + // A takeover that SUCCEEDED cleared its journal, so we have no record of
+    chalk9.green("\n  \u2714 Openship uninstalled.\n") + // A takeover that SUCCEEDED cleared its journal, so we have no record of
     // what to restart — say so rather than leaving :80/:443 quietly dark.
-    (restored ? "" : chalk8.dim(
+    (restored ? "" : chalk9.dim(
       "  If Openship took over :80/:443 from another proxy, re-enable it:\n    sudo systemctl enable --now nginx   (or caddy / apache2)\n"
-    )) + chalk8.dim("  Deployed apps are still running \u2014 `docker ps` to review them.\n")
+    )) + chalk9.dim("  Deployed apps are still running \u2014 `docker ps` to review them.\n")
   );
 });
 
@@ -2415,36 +2676,27 @@ var contextCommand = new Command9("context").alias("ctx").description("Manage co
 
 // src/commands/status.ts
 import { Command as Command10 } from "commander";
-import chalk9 from "chalk";
-import { readFileSync as readFileSync7 } from "fs";
-import { join as join11 } from "path";
-function readPorts() {
-  try {
-    return JSON.parse(readFileSync7(join11(OS_DIR, "ports.json"), "utf8"));
-  } catch {
-    return {};
-  }
-}
+import chalk10 from "chalk";
 var statusCommand = new Command10("status").description("Show the local Openship service (installed/running, ports) and the active context's API health").action(async () => {
   const context = getActiveContext();
   const apiUrl = getApiUrl2();
   if (readInstallMethod() === "compose" && !isJsonMode()) {
-    console.log(chalk9.bold("\n  Openship status (Docker Compose)\n"));
+    console.log(chalk10.bold("\n  Openship status (Docker Compose)\n"));
     composePs();
     try {
       const h = await apiRequest("/health", { signal: AbortSignal.timeout(8e3) });
-      console.log(chalk9.dim(`
-  API: ${apiUrl} \u2014 `) + chalk9.green(h.status ?? "ok") + "\n");
+      console.log(chalk10.dim(`
+  API: ${apiUrl} \u2014 `) + chalk10.green(h.status ?? "ok") + "\n");
     } catch (e) {
       const msg = e instanceof ApiError ? e.message : e.message;
-      console.log(chalk9.dim(`
-  API: ${apiUrl} \u2014 `) + chalk9.red("not reachable") + chalk9.dim(`  ${msg}
+      console.log(chalk10.dim(`
+  API: ${apiUrl} \u2014 `) + chalk10.red("not reachable") + chalk10.dim(`  ${msg}
 `));
     }
     return;
   }
   const svc = serviceStatus();
-  const ports = readPorts();
+  const ports = readStoredPorts();
   let health = null;
   let envInfo = null;
   let reachable = true;
@@ -2460,15 +2712,15 @@ var statusCommand = new Command10("status").description("Show the local Openship
     printJson({ context, apiUrl, service: svc, ports, reachable, health, env: envInfo });
     process.exit(reachable ? 0 : 1);
   }
-  const row2 = (label, value) => `  ${chalk9.dim(label.padEnd(14))}${value ?? chalk9.dim("-")}
+  const row2 = (label, value) => `  ${chalk10.dim(label.padEnd(14))}${value ?? chalk10.dim("-")}
 `;
-  const serviceState = svc.running ? chalk9.green("running") : svc.installed ? chalk9.yellow("installed \xB7 stopped") : chalk9.dim("not installed");
-  let out = chalk9.bold("\n  Openship status\n\n") + row2("Service", serviceState) + row2("Manager", svc.kind === "unsupported" ? chalk9.dim("none") : svc.kind) + (ports.api ? row2("API port", ports.api) : "") + (ports.dashboard ? row2("Dashboard port", ports.dashboard) : "") + row2("Context", context) + row2("API", apiUrl);
+  const serviceState = svc.running ? chalk10.green("running") : svc.installed ? chalk10.yellow("installed \xB7 stopped") : chalk10.dim("not installed");
+  let out = chalk10.bold("\n  Openship status\n\n") + row2("Service", serviceState) + row2("Manager", svc.kind === "unsupported" ? chalk10.dim("none") : svc.kind) + (ports.api ? row2("API port", ports.api) : "") + (ports.dashboard ? row2("Dashboard port", ports.dashboard) : "") + row2("Context", context) + row2("API", apiUrl);
   if (reachable && health && envInfo) {
-    out += row2("Health", chalk9.green(health.status ?? "ok")) + row2("Mode", envInfo.selfHosted ? "self-hosted" : "cloud") + row2("Deploy", envInfo.deployMode) + row2("Auth", envInfo.authMode) + row2("Team", envInfo.teamMode) + (envInfo.hostDomain ? row2("Host domain", envInfo.hostDomain) : "") + (envInfo.machineName ? row2("Machine", envInfo.machineName) : "");
+    out += row2("Health", chalk10.green(health.status ?? "ok")) + row2("Mode", envInfo.selfHosted ? "self-hosted" : "cloud") + row2("Deploy", envInfo.deployMode) + row2("Auth", envInfo.authMode) + row2("Team", envInfo.teamMode) + (envInfo.hostDomain ? row2("Host domain", envInfo.hostDomain) : "") + (envInfo.machineName ? row2("Machine", envInfo.machineName) : "");
   } else {
-    out += row2("Health", chalk9.red("not reachable")) + chalk9.dim(`  ${unreachableMsg}
-`) + chalk9.dim(svc.running ? "  (service is up \u2014 it may still be starting)\n" : "  Start it with `openship up`.\n");
+    out += row2("Health", chalk10.red("not reachable")) + chalk10.dim(`  ${unreachableMsg}
+`) + chalk10.dim(svc.running ? "  (service is up \u2014 it may still be starting)\n" : "  Start it with `openship up`.\n");
   }
   process.stdout.write(out + "\n");
   if (!reachable) process.exit(1);
@@ -2478,15 +2730,15 @@ var statusCommand = new Command10("status").description("Show the local Openship
 import { Command as Command11 } from "commander";
 import { existsSync as existsSync13 } from "fs";
 import { execFileSync as execFileSync2 } from "child_process";
-import chalk11 from "chalk";
+import chalk12 from "chalk";
 import open from "open";
 import { intro, outro, note as note2, select as select3, log as log3, spinner as spinner2, confirm as confirm3 } from "@clack/prompts";
 
 // src/lib/repair.ts
 import { spawnSync as spawnSync4 } from "child_process";
-import { existsSync as existsSync12, readFileSync as readFileSync8 } from "fs";
-import { join as join13 } from "path";
-import chalk10 from "chalk";
+import { existsSync as existsSync12, readFileSync as readFileSync7 } from "fs";
+import { join as join12 } from "path";
+import chalk11 from "chalk";
 import { spinner, log as log2, select as select2, isCancel as isCancel3, cancel } from "@clack/prompts";
 
 // src/lib/heal.ts
@@ -2499,15 +2751,15 @@ import {
   copyFileSync,
   renameSync
 } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join12 } from "path";
+import { homedir as homedir3 } from "os";
+import { join as join11 } from "path";
 import { execFileSync } from "child_process";
 function resolveDataDir() {
   const fromEnv = process.env.PGLITE_DATA_DIR?.trim();
   if (fromEnv) {
-    return fromEnv.startsWith("~") ? join12(homedir2(), fromEnv.slice(1).replace(/^[/\\]/, "")) : fromEnv;
+    return fromEnv.startsWith("~") ? join11(homedir3(), fromEnv.slice(1).replace(/^[/\\]/, "")) : fromEnv;
   }
-  return join12(OS_DIR, "data");
+  return DATA_DIR;
 }
 function dataDirExists(dataDir = resolveDataDir()) {
   return existsSync11(dataDir);
@@ -2518,8 +2770,8 @@ function stamp() {
 function copyDirRecursive(src, dest) {
   if (!existsSync11(dest)) mkdirSync10(dest, { recursive: true });
   for (const entry of readdirSync(src)) {
-    const s = join12(src, entry);
-    const d = join12(dest, entry);
+    const s = join11(src, entry);
+    const d = join11(dest, entry);
     if (statSync(s).isDirectory()) copyDirRecursive(s, d);
     else copyFileSync(s, d);
   }
@@ -2531,17 +2783,17 @@ function backupDataDir(dataDir = resolveDataDir()) {
 }
 function healDataDir(dataDir = resolveDataDir()) {
   const result = { removedPostmasterPid: false, trimmedWalSegment: null };
-  const pidPath = join12(dataDir, "postmaster.pid");
+  const pidPath = join11(dataDir, "postmaster.pid");
   if (existsSync11(pidPath)) {
     unlinkSync(pidPath);
     result.removedPostmasterPid = true;
   }
-  const walDir = join12(dataDir, "pg_wal");
+  const walDir = join11(dataDir, "pg_wal");
   if (existsSync11(walDir)) {
-    const segments = readdirSync(walDir).filter((name) => /^[0-9A-F]{24}$/.test(name)).map((name) => ({ name, mtime: statSync(join12(walDir, name)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
+    const segments = readdirSync(walDir).filter((name) => /^[0-9A-F]{24}$/.test(name)).map((name) => ({ name, mtime: statSync(join11(walDir, name)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
     if (segments.length > 0) {
       const newest = segments[0];
-      unlinkSync(join12(walDir, newest.name));
+      unlinkSync(join11(walDir, newest.name));
       result.trimmedWalSegment = newest.name;
     }
   }
@@ -2587,7 +2839,6 @@ function deepHeal(dataDir = resolveDataDir()) {
 }
 
 // src/lib/repair.ts
-var LOG_DIR2 = join13(OS_DIR, "logs");
 function ensure(value) {
   if (isCancel3(value)) {
     cancel("Cancelled.");
@@ -2595,23 +2846,9 @@ function ensure(value) {
   }
   return value;
 }
-function storedPorts() {
-  try {
-    const p = join13(OS_DIR, "ports.json");
-    return existsSync12(p) ? JSON.parse(readFileSync8(p, "utf8")) : {};
-  } catch {
-    return {};
-  }
-}
-function apiPort() {
-  return storedPorts().api ?? 4e3;
-}
-function dashboardPort() {
-  return storedPorts().dashboard ?? 3001;
-}
 async function internalGet2(path2, timeoutMs = 8e3) {
   try {
-    const res = await fetch(`http://127.0.0.1:${apiPort()}${path2}`, {
+    const res = await fetch(`http://127.0.0.1:${storedApiPort()}${path2}`, {
       headers: { "X-Internal-Token": ensureInternalToken() },
       signal: AbortSignal.timeout(timeoutMs)
     });
@@ -2623,7 +2860,7 @@ async function internalGet2(path2, timeoutMs = 8e3) {
 }
 async function apiReachable() {
   try {
-    const res = await fetch(`http://127.0.0.1:${apiPort()}/api/health`, {
+    const res = await fetch(`http://127.0.0.1:${storedApiPort()}/api/health`, {
       signal: AbortSignal.timeout(2500)
     });
     return res.ok;
@@ -2647,10 +2884,10 @@ async function waitApiDown(seconds = 20) {
 }
 function lastServiceError() {
   for (const name of ["up.err.log", "up.log", "instance.log"]) {
-    const p = join13(LOG_DIR2, name);
+    const p = join12(LOG_DIR, name);
     if (!existsSync12(p)) continue;
     try {
-      const lines = readFileSync8(p, "utf8").trim().split("\n");
+      const lines = readFileSync7(p, "utf8").trim().split("\n");
       const hit = [...lines].reverse().find((l) => /error|locked|aborted|malformed|corrupt|throw|cannot|EADDRINUSE/i.test(l));
       if (hit) return hit.trim().slice(0, 240);
     } catch {
@@ -2708,11 +2945,11 @@ async function componentChecks(apiUp) {
   checks.push({
     name: "API",
     state: apiUp ? "pass" : "fail",
-    detail: apiUp ? `reachable on :${apiPort()}` : `not answering on :${apiPort()}`
+    detail: apiUp ? `reachable on :${storedApiPort()}` : `not answering on :${storedApiPort()}`
   });
   let dashUp = false;
   try {
-    const res = await fetch(`http://127.0.0.1:${dashboardPort()}/`, {
+    const res = await fetch(`http://127.0.0.1:${storedDashboardPort()}/`, {
       redirect: "manual",
       signal: AbortSignal.timeout(2500)
     });
@@ -2722,7 +2959,7 @@ async function componentChecks(apiUp) {
   checks.push({
     name: "Dashboard",
     state: dashUp ? "pass" : "warn",
-    detail: dashUp ? `serving on :${dashboardPort()}` : `not serving on :${dashboardPort()}`
+    detail: dashUp ? `serving on :${storedDashboardPort()}` : `not serving on :${storedDashboardPort()}`
   });
   const edge = dockerNameRunning("openship-edge");
   checks.push(
@@ -2765,7 +3002,7 @@ async function runRepair() {
   bk.start("Backing up the database");
   try {
     backupDir = backupDataDir();
-    bk.stop(`Backup saved \u2192 ${chalk10.dim(backupDir)}`);
+    bk.stop(`Backup saved \u2192 ${chalk11.dim(backupDir)}`);
   } catch (err2) {
     bk.stop("Backup failed \u2014 aborting to protect your data.", 1);
     await bringUp();
@@ -2781,7 +3018,7 @@ async function runRepair() {
   up.start("Restarting and verifying");
   let healthy = await bringUp();
   let verified = healthy && !!(await internalGet2("/api/system/health"))?.db?.ok;
-  up.stop(verified ? chalk10.green("Database is healthy again.") : "Still not healthy after the light repair.", verified ? 0 : 1);
+  up.stop(verified ? chalk11.green("Database is healthy again.") : "Still not healthy after the light repair.", verified ? 0 : 1);
   if (verified) {
     return { healed: true, backupDir, detail: "In-place repair succeeded \u2014 your data is intact." };
   }
@@ -2829,7 +3066,7 @@ async function runRepair() {
     const f = spinner();
     f.start("Starting a fresh database");
     const aside = freshStart();
-    f.stop(`Corrupt data parked \u2192 ${chalk10.dim(aside)}`);
+    f.stop(`Corrupt data parked \u2192 ${chalk11.dim(aside)}`);
     const ok3 = await bringUp();
     return {
       healed: ok3,
@@ -2842,9 +3079,9 @@ async function runRepair() {
 
 // src/commands/doctor.ts
 var GLYPH = {
-  pass: chalk11.green("\u2713"),
-  warn: chalk11.yellow("!"),
-  fail: chalk11.red("\u2717")
+  pass: chalk12.green("\u2713"),
+  warn: chalk12.yellow("!"),
+  fail: chalk12.red("\u2717")
 };
 function isLocalContext() {
   return /localhost|127\.0\.0\.1|\[::1\]/i.test(getApiUrl());
@@ -2880,7 +3117,7 @@ function servicesSummary(s) {
   };
 }
 function row(name, c) {
-  return `${GLYPH[c.state]} ${chalk11.bold(name.padEnd(10))} ${chalk11.dim(c.detail)}`;
+  return `${GLYPH[c.state]} ${chalk12.bold(name.padEnd(10))} ${chalk12.dim(c.detail)}`;
 }
 function statusPanel(s) {
   const lines = [
@@ -2892,10 +3129,10 @@ function statusPanel(s) {
   if (s.services.length > 0) {
     for (const svc of s.services.slice(0, 8)) {
       const g = svc.state === "running" ? GLYPH.pass : svc.state === "failed" ? GLYPH.fail : GLYPH.warn;
-      lines.push(chalk11.dim(`   ${g} ${svc.name} \u2014 ${svc.state}`));
+      lines.push(chalk12.dim(`   ${g} ${svc.name} \u2014 ${svc.state}`));
     }
   }
-  if (s.corrupted && s.lastError) lines.push("", chalk11.red(`Last error: ${s.lastError}`));
+  if (s.corrupted && s.lastError) lines.push("", chalk12.red(`Last error: ${s.lastError}`));
   return lines.join("\n");
 }
 function bunVersion() {
@@ -2929,8 +3166,8 @@ async function remotePreflight() {
   if (isJsonMode()) {
     printJson({ context, apiUrl, reachable, checks });
   } else {
-    process.stdout.write(chalk11.bold("\n  Openship doctor\n\n"));
-    for (const c of checks) process.stdout.write(`  ${GLYPH[c.status]} ${chalk11.bold(c.name.padEnd(8))} ${c.detail}
+    process.stdout.write(chalk12.bold("\n  Openship doctor\n\n"));
+    for (const c of checks) process.stdout.write(`  ${GLYPH[c.status]} ${chalk12.bold(c.name.padEnd(8))} ${c.detail}
 `);
     process.stdout.write("\n");
   }
@@ -2954,16 +3191,16 @@ async function reportOnce() {
       lastError: s.lastError
     });
   } else {
-    process.stdout.write(chalk11.bold("\n  Openship doctor\n\n"));
-    process.stdout.write(`  ${GLYPH[svc.state]} ${chalk11.bold("Service".padEnd(10))} ${svc.detail}
+    process.stdout.write(chalk12.bold("\n  Openship doctor\n\n"));
+    process.stdout.write(`  ${GLYPH[svc.state]} ${chalk12.bold("Service".padEnd(10))} ${svc.detail}
 `);
-    process.stdout.write(`  ${GLYPH[db.state]} ${chalk11.bold("Database".padEnd(10))} ${db.detail}
+    process.stdout.write(`  ${GLYPH[db.state]} ${chalk12.bold("Database".padEnd(10))} ${db.detail}
 `);
-    for (const c of s.components) process.stdout.write(`  ${GLYPH[c.state]} ${chalk11.bold(c.name.padEnd(10))} ${c.detail}
+    for (const c of s.components) process.stdout.write(`  ${GLYPH[c.state]} ${chalk12.bold(c.name.padEnd(10))} ${c.detail}
 `);
-    process.stdout.write(`  ${GLYPH[services.state]} ${chalk11.bold("Services".padEnd(10))} ${services.detail}
+    process.stdout.write(`  ${GLYPH[services.state]} ${chalk12.bold("Services".padEnd(10))} ${services.detail}
 `);
-    if (s.corrupted) process.stdout.write(chalk11.yellow(`
+    if (s.corrupted) process.stdout.write(chalk12.yellow(`
   Database looks corrupted \u2014 run \`openship doctor\` (interactive) or \`openship doctor --fix\`.
 `));
     process.stdout.write("\n");
@@ -2975,11 +3212,11 @@ async function autoFix() {
   const out = (m) => process.stdout.write(`  ${m}
 `);
   if (!dataDirExists()) {
-    out(chalk11.dim(`No embedded database at ${resolveDataDir()} \u2014 nothing to repair.`));
+    out(chalk12.dim(`No embedded database at ${resolveDataDir()} \u2014 nothing to repair.`));
     return;
   }
   if ((await internalGet2("/api/system/health"))?.db?.ok) {
-    out(chalk11.green("Database is healthy \u2014 nothing to fix."));
+    out(chalk12.green("Database is healthy \u2014 nothing to fix."));
     return;
   }
   out("Stopping the service\u2026");
@@ -2994,17 +3231,17 @@ async function autoFix() {
   const healthy = await waitApiHealthy(60);
   const verified = healthy && !!(await internalGet2("/api/system/health"))?.db?.ok;
   if (verified) {
-    out(chalk11.green("Database is healthy again. Your data is intact."));
+    out(chalk12.green("Database is healthy again. Your data is intact."));
   } else {
-    out(chalk11.red(`Still not healthy. Backup preserved at ${backup}. Run \`openship doctor\` for guided recovery.`));
+    out(chalk12.red(`Still not healthy. Backup preserved at ${backup}. Run \`openship doctor\` for guided recovery.`));
     process.exit(1);
   }
 }
 async function interactiveDoctor() {
-  intro(`${chalk11.bgCyan(chalk11.black(" Openship "))}${chalk11.dim(" doctor")}`);
+  intro(`${chalk12.bgCyan(chalk12.black(" Openship "))}${chalk12.dim(" doctor")}`);
   for (; ; ) {
     const s = await gatherStatus();
-    note2(statusPanel(s), s.corrupted ? chalk11.red("Database looks corrupted") : "Health");
+    note2(statusPanel(s), s.corrupted ? chalk12.red("Database looks corrupted") : "Health");
     const options = [];
     if (s.corrupted || !s.apiUp && dataDirExists() || s.health?.db && !s.health.db.ok) {
       options.push({ value: "repair", label: "Repair database", hint: "backup \u2192 heal \u2192 verify" });
@@ -3018,7 +3255,7 @@ async function interactiveDoctor() {
       await select3({ message: "What would you like to do?", options, initialValue: options[0]?.value })
     );
     if (action2 === "quit") {
-      outro(chalk11.dim("Bye."));
+      outro(chalk12.dim("Bye."));
       return;
     }
     if (action2 === "recheck") continue;
@@ -3037,20 +3274,20 @@ async function interactiveDoctor() {
       sp.start("Restarting");
       const r = restart();
       const up = r.restarted ? await waitApiHealthy(45) : false;
-      sp.stop(r.restarted && up ? chalk11.green("Restarted and healthy.") : chalk11.yellow(r.detail), r.restarted && up ? 0 : 1);
+      sp.stop(r.restarted && up ? chalk12.green("Restarted and healthy.") : chalk12.yellow(r.detail), r.restarted && up ? 0 : 1);
       continue;
     }
     if (action2 === "logs") {
       const err2 = lastServiceError();
-      note2(err2 ? chalk11.red(err2) : chalk11.dim("No recent errors in the service logs."), "Recent errors");
+      note2(err2 ? chalk12.red(err2) : chalk12.dim("No recent errors in the service logs."), "Recent errors");
       continue;
     }
     if (action2 === "open") {
       const url = readInstanceUrl();
-      const target = url && !/^https?:\/\/localhost/i.test(url) ? url : `http://localhost:${dashboardPort()}`;
+      const target = url && !/^https?:\/\/localhost/i.test(url) ? url : `http://localhost:${storedDashboardPort()}`;
       await open(target).catch(() => {
       });
-      log3.message(chalk11.dim(`Opening ${target}`));
+      log3.message(chalk12.dim(`Opening ${target}`));
       continue;
     }
   }
@@ -3077,14 +3314,14 @@ import { execFileSync as execFileSync4 } from "child_process";
 import ora2 from "ora";
 
 // src/lib/project-link.ts
-import { readFileSync as readFileSync9, existsSync as existsSync14 } from "fs";
-import { join as join14, dirname as dirname3, parse } from "path";
-var LINK_REL = join14(".openship", "project.json");
+import { readFileSync as readFileSync8, existsSync as existsSync14 } from "fs";
+import { join as join13, dirname as dirname3, parse } from "path";
+var LINK_REL = join13(".openship", "project.json");
 function findProjectLinkPath(from = process.cwd()) {
   let dir = from;
   const root = parse(dir).root;
   for (; ; ) {
-    const candidate = join14(dir, LINK_REL);
+    const candidate = join13(dir, LINK_REL);
     if (existsSync14(candidate)) return candidate;
     if (dir === root) return null;
     dir = dirname3(dir);
@@ -3094,7 +3331,7 @@ function readProjectLink(from) {
   const path2 = findProjectLinkPath(from);
   if (!path2) return null;
   try {
-    return JSON.parse(readFileSync9(path2, "utf8"));
+    return JSON.parse(readFileSync8(path2, "utf8"));
   } catch {
     return null;
   }
@@ -3102,21 +3339,21 @@ function readProjectLink(from) {
 
 // src/lib/folder-deploy.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import { readFileSync as readFileSync10, existsSync as existsSync15, rmSync as rmSync4 } from "fs";
+import { readFileSync as readFileSync9, existsSync as existsSync15, rmSync as rmSync4 } from "fs";
 import { tmpdir } from "os";
-import { join as join15, basename } from "path";
+import { join as join14, basename } from "path";
 function detectPackageManager(dir) {
-  if (existsSync15(join15(dir, "bun.lockb")) || existsSync15(join15(dir, "bun.lock"))) return "bun";
-  if (existsSync15(join15(dir, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync15(join15(dir, "yarn.lock"))) return "yarn";
-  if (existsSync15(join15(dir, "package.json"))) return "npm";
+  if (existsSync15(join14(dir, "bun.lockb")) || existsSync15(join14(dir, "bun.lock"))) return "bun";
+  if (existsSync15(join14(dir, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync15(join14(dir, "yarn.lock"))) return "yarn";
+  if (existsSync15(join14(dir, "package.json"))) return "npm";
   return void 0;
 }
 function detectStack(dir) {
-  if (existsSync15(join15(dir, "go.mod"))) return "go";
-  if (existsSync15(join15(dir, "Cargo.toml"))) return "rust";
-  if (existsSync15(join15(dir, "requirements.txt")) || existsSync15(join15(dir, "pyproject.toml"))) return "python";
-  if (existsSync15(join15(dir, "package.json"))) return "node";
+  if (existsSync15(join14(dir, "go.mod"))) return "go";
+  if (existsSync15(join14(dir, "Cargo.toml"))) return "rust";
+  if (existsSync15(join14(dir, "requirements.txt")) || existsSync15(join14(dir, "pyproject.toml"))) return "python";
+  if (existsSync15(join14(dir, "package.json"))) return "node";
   return void 0;
 }
 async function deployFolder(opts) {
@@ -3133,7 +3370,7 @@ async function deployFolder(opts) {
     throw new Error(session.error || "Failed to open upload session");
   }
   step("Packaging folder");
-  const tarball = join15(tmpdir(), `openship-upload-${session.sessionId}.tar.gz`);
+  const tarball = join14(tmpdir(), `openship-upload-${session.sessionId}.tar.gz`);
   execFileSync3(
     "tar",
     [
@@ -3152,7 +3389,7 @@ async function deployFolder(opts) {
   );
   step("Uploading source");
   try {
-    const body = readFileSync10(tarball);
+    const body = readFileSync9(tarball);
     const up = session.upload;
     const method = up.method || "POST";
     const res = /^https?:\/\//i.test(up.url) ? await fetch(up.url, { method, headers: up.headers, body }) : await apiRaw(`/${up.url.replace(/^\/+/, "")}`, { method, headers: up.headers, body });
@@ -3478,7 +3715,7 @@ function shortSha2(v) {
 async function confirm4(question) {
   if (!process.stdin.isTTY) return true;
   const rl = createInterface3({ input: process.stdin, output: process.stderr });
-  const answer = await new Promise((resolve2) => rl.question(`${question} [y/N] `, resolve2));
+  const answer = await new Promise((resolve3) => rl.question(`${question} [y/N] `, resolve3));
   rl.close();
   return /^y(es)?$/i.test(answer.trim());
 }
@@ -3606,12 +3843,19 @@ var sslStatus = new Command13("status").description("Check SSL certificate statu
     printJson(res);
   })
 );
-var sslRenew = new Command13("renew").description("Renew (issue) an SSL certificate for a domain").argument("<domain>", "Domain to renew").option("--www", "Also include the www subdomain").action(
+var sslRenew = new Command13("renew").description("Renew (issue) an SSL certificate for a domain").argument("<domain>", "Domain to renew").option("--www", "Also renew the www subdomain (separately \u2014 its own certificate)").action(
   run2(async (domain, opts) => {
     const res = await apiRequest("/deployments/ssl/renew", {
       method: "POST",
       body: JSON.stringify({ domain, includeWww: opts.www === true })
     });
+    if (!isJsonMode() && res.results && res.results.length > 1) {
+      for (const r of res.results) {
+        if (r.success) ok(`${r.domain}: ${r.status}`);
+        else err(`${r.domain}: ${r.message ?? r.status}`);
+      }
+      return;
+    }
     report(res, `SSL renewal requested for ${domain}`);
   })
 );
@@ -3676,7 +3920,7 @@ var logsCommand = new Command14("logs").description("View or stream a deployment
 
 // src/commands/project.ts
 import { Command as Command15 } from "commander";
-import chalk12 from "chalk";
+import chalk13 from "chalk";
 import { createInterface as createInterface4 } from "readline/promises";
 import { stdin as input3, stdout as output3 } from "process";
 function action(fn) {
@@ -3707,7 +3951,7 @@ function printProject(project) {
   ];
   for (const [k, v] of fields) {
     if (v === null || v === void 0 || v === "") continue;
-    process.stdout.write(`  ${chalk12.dim(k.padEnd(12))} ${String(v)}
+    process.stdout.write(`  ${chalk13.dim(k.padEnd(12))} ${String(v)}
 `);
   }
 }
@@ -3764,7 +4008,7 @@ var deleteCmd = new Command15("delete").alias("rm").description("Delete a projec
     if (!opts.yes) {
       const rl = createInterface4({ input: input3, output: output3 });
       const answer = await rl.question(
-        chalk12.yellow(`  Delete project ${id}? This cannot be undone. `) + "(y/N) "
+        chalk13.yellow(`  Delete project ${id}? This cannot be undone. `) + "(y/N) "
       );
       rl.close();
       if (answer.trim().toLowerCase() !== "y") {
@@ -4107,9 +4351,9 @@ function safeParse(s) {
   }
 }
 function printLogEntry(entry) {
-  const ts = entry.timestamp ? chalk12.dim(String(entry.timestamp)) : "";
+  const ts = entry.timestamp ? chalk13.dim(String(entry.timestamp)) : "";
   const level = String(entry.level ?? "info");
-  const color = level === "error" ? chalk12.red : level === "warn" ? chalk12.yellow : chalk12.dim;
+  const color = level === "error" ? chalk13.red : level === "warn" ? chalk13.yellow : chalk13.dim;
   const msg = entry.message ?? entry.data ?? "";
   process.stdout.write(`  ${ts} ${color(level.padEnd(5))} ${String(msg)}
 `);
@@ -4131,7 +4375,7 @@ projectCommand.addCommand(serverLogsCmd);
 
 // src/commands/service.ts
 import { Command as Command16 } from "commander";
-import chalk13 from "chalk";
+import chalk14 from "chalk";
 import { spawnSync as spawnSync5 } from "child_process";
 import path from "path";
 import { createInterface as createInterface5 } from "readline/promises";
@@ -4144,7 +4388,7 @@ function requireAuth() {
 }
 function fail(e) {
   if (e instanceof ApiError) {
-    err(`  ${e.message}` + (e.status ? chalk13.dim(` (HTTP ${e.status})`) : ""));
+    err(`  ${e.message}` + (e.status ? chalk14.dim(` (HTTP ${e.status})`) : ""));
   } else {
     err(`  ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -4236,7 +4480,7 @@ var listCmd3 = stackCommand("list").description("List the services in a stack").
         image: s.image ?? "\u2014",
         enabled: s.enabled ? "yes" : "no",
         exposed: s.exposed ? "yes" : "no",
-        drift: s.drift ? chalk13.yellow("pending") : "\u2014"
+        drift: s.drift ? chalk14.yellow("pending") : "\u2014"
       })),
       ["name", "kind", "image", "enabled", "exposed", "drift"]
     );
@@ -4391,8 +4635,10 @@ function mapComposeService(name, def, baseDir) {
   const volumes = mapVolumes(d.volumes);
   if (volumes.length) svc.volumes = volumes;
   const command = d.command;
-  if (typeof command === "string") svc.command = command;
-  else if (Array.isArray(command)) svc.command = command.map(String).join(" ");
+  if (command != null) {
+    svc.commandArgv = commandToArgv(command);
+    svc.command = typeof command === "string" ? command : command.map(String).join(" ");
+  }
   if (typeof d.restart === "string") svc.restart = d.restart;
   return svc;
 }
@@ -4604,8 +4850,8 @@ function printLogEntry2(entry) {
     process.stdout.write(JSON.stringify(entry) + "\n");
     return;
   }
-  const ts = entry.timestamp ? chalk13.dim(entry.timestamp) : "";
-  const line = entry.level === "error" ? chalk13.red(msg) : entry.level === "warn" ? chalk13.yellow(msg) : msg;
+  const ts = entry.timestamp ? chalk14.dim(entry.timestamp) : "";
+  const line = entry.level === "error" ? chalk14.red(msg) : entry.level === "warn" ? chalk14.yellow(msg) : msg;
   process.stdout.write(`${ts ? ts + " " : ""}${line}
 `);
 }
@@ -4671,14 +4917,14 @@ serviceCommand.addCommand(execCmd);
 
 // src/commands/domain.ts
 import { Command as Command17 } from "commander";
-import chalk14 from "chalk";
+import chalk15 from "chalk";
 import ora3 from "ora";
 function spin(text2) {
   return isJsonMode() ? null : ora3(text2).start();
 }
 function fail2(e) {
   if (e instanceof ApiError) {
-    err(`  ${e.message}${e.status ? chalk14.dim(` (${e.status})`) : ""}`);
+    err(`  ${e.message}${e.status ? chalk15.dim(` (${e.status})`) : ""}`);
   } else {
     err(`  ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -4862,7 +5108,7 @@ var domainCommand = new Command17("domain").description("Manage custom domains,
 
 // src/commands/server.ts
 import { Command as Command18 } from "commander";
-import chalk15 from "chalk";
+import chalk16 from "chalk";
 import ora4 from "ora";
 var INSTALLABLE = ["docker", "git", "edge", "rsync"];
 function guard(fn) {
@@ -5037,8 +5283,8 @@ server.command("install <serverId>").description("Install components on a server
           printJson({ event: ev.event, ...payload });
         } else if (ev.event === "log") {
           const p = payload;
-          const line = `  ${chalk15.dim(`[${p.component}]`)} ${p.message ?? ""}`;
-          process.stderr.write((p.level === "error" ? chalk15.red(line) : line) + "\n");
+          const line = `  ${chalk16.dim(`[${p.component}]`)} ${p.message ?? ""}`;
+          process.stderr.write((p.level === "error" ? chalk16.red(line) : line) + "\n");
         } else if (ev.event === "progress") {
           const p = payload;
           if (p.component) info(`  ${p.component}: ${p.status}`);
@@ -5158,7 +5404,7 @@ var serverCommand = server;
 // src/commands/system.ts
 import { Command as Command19 } from "commander";
 import ora5 from "ora";
-import { readFileSync as readFileSync11, writeFileSync as writeFileSync10 } from "fs";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync10 } from "fs";
 import { createInterface as createInterface6 } from "readline/promises";
 import { stdin as input5, stdout as output5 } from "process";
 async function guarded(fn) {
@@ -5484,7 +5730,7 @@ dataTransferCommand.command("import").description("Import an instance export fil
     }
     let file;
     try {
-      file = JSON.parse(readFileSync11(opts.file, "utf8"));
+      file = JSON.parse(readFileSync10(opts.file, "utf8"));
     } catch {
       err(`
   Could not read or parse ${opts.file}.
@@ -5524,8 +5770,11 @@ var systemCommand = new Command19("system").description("Instance settings, onbo
 
 // src/commands/mail.ts
 import { Command as Command20 } from "commander";
-import chalk16 from "chalk";
+import chalk17 from "chalk";
 import ora6 from "ora";
+import { spawnSync as spawnSync6 } from "child_process";
+import { existsSync as existsSync16, readFileSync as readFileSync11 } from "fs";
+import { join as join15, resolve as resolve2 } from "path";
 import { createInterface as createInterface7 } from "readline/promises";
 import { stdin as input6, stdout as output6 } from "process";
 function guard2(fn) {
@@ -5681,7 +5930,7 @@ var setupCmd = new Command20("setup").description("Start or resume the mail setu
           break;
         case "log": {
           const line = `    ${String(p.message ?? "")}`;
-          process.stderr.write((p.level === "error" ? chalk16.red(line) : chalk16.dim(line)) + "\n");
+          process.stderr.write((p.level === "error" ? chalk17.red(line) : chalk17.dim(line)) + "\n");
           break;
         }
         case "step_done":
@@ -5830,7 +6079,61 @@ postmasterCmd.addCommand(
     })
   )
 );
-var mailCommand = new Command20("mail").description("Self-hosted mail server (iRedMail) setup and admin [self-host]").addCommand(stepsCmd).addCommand(statusCmd).addCommand(serversCmd).addCommand(scanCmd).addCommand(adoptCmd).addCommand(setupCmd).addCommand(cancelCmd).addCommand(dnsAckCmd).addCommand(ptrAckCmd).addCommand(resetCmd).addCommand(forgetCmd).addCommand(healthCmd).addCommand(logsCmd3).addCommand(postmasterCmd);
+var DOCKERFILE_REL = join15("apps", "email", "Dockerfile");
+function resolveBuildContext(explicit) {
+  if (explicit?.trim()) return resolve2(explicit.trim());
+  const marker = readSourceInstall();
+  if (marker?.dir && existsSync16(join15(marker.dir, DOCKERFILE_REL))) return marker.dir;
+  const cwd = process.cwd();
+  if (existsSync16(join15(cwd, DOCKERFILE_REL))) return cwd;
+  return null;
+}
+function defaultMailRef(context) {
+  let fallbackTag;
+  try {
+    const pkg = JSON.parse(readFileSync11(join15(context, "apps", "api", "package.json"), "utf8"));
+    if (typeof pkg.version === "string") fallbackTag = pkg.version;
+  } catch {
+  }
+  return buildMailImageRef({ fallbackTag });
+}
+var buildCmd = new Command20("build").description("Build the openship-mail engine image locally from a source checkout [dev]").option("--context <dir>", "Repo root containing apps/email/Dockerfile (default: checkout or cwd)").option("--tag <ref>", "Image ref to tag (default: the pinned openship-mail ref)").action(async (opts) => {
+  try {
+    if (!has("docker")) {
+      err("Docker isn't on PATH \u2014 install Docker, then retry.");
+      process.exit(1);
+    }
+    const context = resolveBuildContext(opts.context);
+    if (!context) {
+      err(
+        "No source checkout to build from. Run from the repo root, or pass --context <path>."
+      );
+      process.exit(1);
+    }
+    const dockerfile = join15(context, DOCKERFILE_REL);
+    if (!existsSync16(dockerfile)) {
+      err(`No apps/email/Dockerfile under ${context} \u2014 is that the repo root?`);
+      process.exit(1);
+    }
+    const ref = opts.tag?.trim() || defaultMailRef(context);
+    info(`  Building ${ref}`);
+    info(`    context:    ${context}`);
+    info(`    dockerfile: ${dockerfile}`);
+    const res = spawnSync6("docker", ["build", "-t", ref, "-f", dockerfile, context], {
+      stdio: [isJsonMode() ? "ignore" : "inherit", isJsonMode() ? "ignore" : "inherit", "inherit"]
+    });
+    if (res.status !== 0) {
+      err(`docker build failed (exit ${res.status ?? "signal"}).`);
+      process.exit(1);
+    }
+    if (isJsonMode()) printJson({ ok: true, image: ref, context });
+    else ok(`  Built ${ref}. Run \`mail setup\` (or redeploy) and it's used without a registry pull.`);
+  } catch (e) {
+    err(e instanceof Error ? e.message : String(e));
+    process.exit(1);
+  }
+});
+var mailCommand = new Command20("mail").description("Self-hosted mail server (iRedMail) setup and admin [self-host]").addCommand(stepsCmd).addCommand(statusCmd).addCommand(serversCmd).addCommand(scanCmd).addCommand(adoptCmd).addCommand(setupCmd).addCommand(cancelCmd).addCommand(dnsAckCmd).addCommand(ptrAckCmd).addCommand(resetCmd).addCommand(forgetCmd).addCommand(healthCmd).addCommand(logsCmd3).addCommand(postmasterCmd).addCommand(buildCmd);
 
 // src/commands/backup.ts
 import { Command as Command21 } from "commander";
@@ -6082,13 +6385,34 @@ restoreCmd.command("apply").description("Apply a staged restore (destructive)").
 );
 restoreCmd.command("cancel").description("Cancel a staged or in-flight restore").argument("<restoreId>", "Restore ID").action(
   (restoreId) => guard3(async () => {
-    await apiRequest(
-      `/backup-restores/${encodeURIComponent(restoreId)}/cancel`,
-      { method: "POST", body: JSON.stringify({}) }
-    );
-    ok(`
-  Restore cancelled: ${restoreId}
+    const { data } = await apiRequest(`/backup-restores/${encodeURIComponent(restoreId)}/cancel`, {
+      method: "POST",
+      body: JSON.stringify({})
+    });
+    if (data.status === "cancelled") {
+      ok(`
+  Restore cancelled: ${restoreId}${data.forced ? " (forced)" : ""}
 `);
+    } else if (data.accepted) {
+      info(
+        `
+  Cancellation requested: ${restoreId} (status=${data.status}).
+  Follow it with: openship backup restore get ${restoreId} --follow
+`
+      );
+    } else {
+      info(`
+  Restore ${restoreId} already finished (status=${data.status}) \u2014 nothing to cancel.
+`);
+    }
+    if (data.destructive) {
+      err(
+        `  The restore had already begun writing its target, so that target now holds
+  PARTIAL data. Re-run this restore (or a newer one) to completion before
+  starting the service.
+`
+      );
+    }
   })
 );
 restoreCmd.command("get").description("Show one restore (optionally stream it)").argument("<restoreId>", "Restore ID").option("--follow", "Stream progress to completion").action(
@@ -6183,17 +6507,17 @@ var backupCommand = new Command21("backup").description("Manage backups: policie
 
 // src/commands/token.ts
 import { Command as Command22 } from "commander";
-import chalk18 from "chalk";
+import chalk19 from "chalk";
 
 // src/lib/cmd-helpers.ts
-import chalk17 from "chalk";
+import chalk18 from "chalk";
 import ora8 from "ora";
 function spin3(text2) {
   return isJsonMode() ? null : ora8(text2).start();
 }
 function fail3(e) {
   if (e instanceof ApiError) {
-    err(`  ${e.message}${e.status ? chalk17.dim(` (${e.status})`) : ""}`);
+    err(`  ${e.message}${e.status ? chalk18.dim(` (${e.status})`) : ""}`);
   } else {
     err(`  ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -6240,13 +6564,28 @@ var createCmd3 = new Command22("create").description("Mint a new personal access
   "Scope the token to a resource (repeatable), e.g. project:abc123:read,write",
   collectGrant,
   []
+).option(
+  "--full-access",
+  "Mint an UNSCOPED token with your own full access (required when no --grant is given)",
+  false
 ).action(async (name, opts) => {
   const grants = opts.grant ?? [];
+  if (grants.length === 0 && !opts.fullAccess) {
+    fail3(
+      new Error(
+        "Refusing to mint an unscoped token by default. Pass --grant <type:id:perms> to scope it, or --full-access to deliberately create one with your own full access."
+      )
+    );
+  }
+  if (grants.length > 0 && opts.fullAccess) {
+    fail3(new Error("--grant and --full-access are mutually exclusive: pick one."));
+  }
   const body = {
     name,
     readOnly: opts.readOnly || void 0,
     expiresInDays: Number.isFinite(opts.expires) ? opts.expires : void 0,
-    grants: grants.length > 0 ? grants : void 0
+    grants: grants.length > 0 ? grants : void 0,
+    fullAccess: grants.length === 0 ? true : void 0
   };
   const sp = spin3(`Creating token "${name}"\u2026`);
   try {
@@ -6260,7 +6599,7 @@ var createCmd3 = new Command22("create").description("Mint a new personal access
       return;
     }
     info("  Copy this token now \u2014 it will not be shown again:");
-    process.stdout.write(chalk18.cyan(`  ${res.data.token}
+    process.stdout.write(chalk19.cyan(`  ${res.data.token}
 `));
   } catch (e) {
     sp?.fail("Create failed");
@@ -6318,19 +6657,10 @@ var apiCommand = new Command23("api").description("Make an authenticated request
 
 // src/commands/reset-admin.ts
 import { Command as Command24 } from "commander";
-import chalk19 from "chalk";
+import chalk20 from "chalk";
 import { intro as intro2, outro as outro2, password as passwordPrompt, isCancel as isCancel4, cancel as cancel3, log as log4 } from "@clack/prompts";
-import { readFileSync as readFileSync13 } from "fs";
-import { join as join16 } from "path";
-function resolvedApiPort() {
-  try {
-    return JSON.parse(readFileSync13(join16(OS_DIR, "ports.json"), "utf8")).api;
-  } catch {
-    return void 0;
-  }
-}
-var resetAdminCommand = new Command24("reset-admin-password").description("Reset the local admin login on THIS machine (no sign-in required)").option("--port <port>", "API port of the running service (default: the resolved port from ~/.openship/ports.json, else 4000)").option("--email <email>", "Also set the admin email").option("--name <name>", "Also set the admin display name").option("--password <password>", "New password (prompted if omitted)").action(async (opts) => {
-  intro2(chalk19.cyan("Reset Openship admin password"));
+var resetAdminCommand = new Command24("reset-admin-password").description("Reset the local admin login on THIS machine (no sign-in required)").option("--port <port>", "API port of the running service (default: the port this install resolved to, else 4000)").option("--email <email>", "Also set the admin email").option("--name <name>", "Also set the admin display name").option("--password <password>", "New password (prompted if omitted)").action(async (opts) => {
+  intro2(chalk20.cyan("Reset Openship admin password"));
   let pw = opts.password;
   if (!pw) {
     if (!process.stdin.isTTY) {
@@ -6355,7 +6685,7 @@ var resetAdminCommand = new Command24("reset-admin-password").description("Reset
     }
     pw = entered;
   }
-  const port = String(opts.port || resolvedApiPort() || 4e3);
+  const port = String(opts.port || storedApiPort());
   let res;
   try {
     res = await fetch(`http://127.0.0.1:${port}/api/system/reset-admin-password`, {
@@ -6373,15 +6703,15 @@ var resetAdminCommand = new Command24("reset-admin-password").description("Reset
     log4.error(`Reset failed: ${data.error || res.statusText}`);
     process.exit(1);
   }
-  outro2(chalk19.green(`Password reset. Log in as ${data.email} with your new password.`));
+  outro2(chalk20.green(`Password reset. Log in as ${data.email} with your new password.`));
 });
 
 // src/commands/install.ts
 import { Command as Command25 } from "commander";
-import { chmodSync as chmodSync2, existsSync as existsSync16, mkdirSync as mkdirSync11, readFileSync as readFileSync14, writeFileSync as writeFileSync11 } from "fs";
-import { spawn as spawn2, spawnSync as spawnSync6 } from "child_process";
-import { homedir as homedir3 } from "os";
-import { join as join17 } from "path";
+import { chmodSync as chmodSync2, existsSync as existsSync17, mkdirSync as mkdirSync11, readFileSync as readFileSync13, writeFileSync as writeFileSync11 } from "fs";
+import { spawn as spawn2, spawnSync as spawnSync7 } from "child_process";
+import { homedir as homedir4 } from "os";
+import { join as join16 } from "path";
 import ora9 from "ora";
 function assetForPlatform() {
   const { platform, arch } = process;
@@ -6395,33 +6725,33 @@ function assetForPlatform() {
   throw new Error(`Unsupported platform: ${platform} (${arch})`);
 }
 function installDmg(dmg) {
-  const homeApps = join17(homedir3(), "Applications");
+  const homeApps = join16(homedir4(), "Applications");
   let dest = homeApps;
   try {
     mkdirSync11(homeApps, { recursive: true });
   } catch {
     dest = "/Applications";
   }
-  const attach = spawnSync6("hdiutil", ["attach", "-nobrowse", "-readonly", "-noverify", dmg], {
+  const attach = spawnSync7("hdiutil", ["attach", "-nobrowse", "-readonly", "-noverify", dmg], {
     encoding: "utf8"
   });
   if (attach.status !== 0) throw new Error(`hdiutil attach failed: ${attach.stderr?.trim()}`);
   const mount = (attach.stdout.match(/\/Volumes\/[^\n]*/g) ?? []).pop()?.trim();
   if (!mount) throw new Error("Could not determine the mounted volume");
-  let target = join17(dest, "Openship.app");
+  let target = join16(dest, "Openship.app");
   try {
-    const appInDmg = join17(mount, "Openship.app");
-    if (!existsSync16(appInDmg)) throw new Error("Openship.app not found in the disk image");
-    spawnSync6("rm", ["-rf", target]);
-    let copy = spawnSync6("ditto", [appInDmg, target], { encoding: "utf8" });
+    const appInDmg = join16(mount, "Openship.app");
+    if (!existsSync17(appInDmg)) throw new Error("Openship.app not found in the disk image");
+    spawnSync7("rm", ["-rf", target]);
+    let copy = spawnSync7("ditto", [appInDmg, target], { encoding: "utf8" });
     if (copy.status !== 0 && dest === homeApps) {
-      target = join17("/Applications", "Openship.app");
-      spawnSync6("rm", ["-rf", target]);
-      copy = spawnSync6("ditto", [appInDmg, target], { encoding: "utf8" });
+      target = join16("/Applications", "Openship.app");
+      spawnSync7("rm", ["-rf", target]);
+      copy = spawnSync7("ditto", [appInDmg, target], { encoding: "utf8" });
     }
     if (copy.status !== 0) throw new Error(`ditto copy failed: ${copy.stderr?.trim()}`);
   } finally {
-    spawnSync6("hdiutil", ["detach", mount, "-quiet"]);
+    spawnSync7("hdiutil", ["detach", mount, "-quiet"]);
   }
   return target;
 }
@@ -6430,10 +6760,10 @@ function installAppImage(appImage) {
   return appImage;
 }
 function installZip(zip) {
-  const localAppData = process.env.LOCALAPPDATA || join17(homedir3(), "AppData", "Local");
-  const target = join17(localAppData, "Programs", "Openship");
+  const localAppData = process.env.LOCALAPPDATA || join16(homedir4(), "AppData", "Local");
+  const target = join16(localAppData, "Programs", "Openship");
   mkdirSync11(target, { recursive: true });
-  const expand = spawnSync6(
+  const expand = spawnSync7(
     "powershell",
     [
       "-NoProfile",
@@ -6448,7 +6778,7 @@ function installZip(zip) {
 }
 function launch(kind, target) {
   if (kind === "dmg") {
-    spawnSync6("open", [target]);
+    spawnSync7("open", [target]);
     return;
   }
   if (kind === "appimage") {
@@ -6459,9 +6789,9 @@ function launch(kind, target) {
     child.unref();
     return;
   }
-  const exe = join17(target, "Openship.exe");
-  const path2 = existsSync16(exe) ? exe : target;
-  spawnSync6("cmd", ["/c", "start", "", path2]);
+  const exe = join16(target, "Openship.exe");
+  const path2 = existsSync17(exe) ? exe : target;
+  spawnSync7("cmd", ["/c", "start", "", path2]);
 }
 var installCommand = new Command25("install").description("Download and install the Openship desktop app for this OS").option("--version <tag>", "Release tag to install (e.g. v1.2.3)").option("--latest", "Install the latest release (default)").option("--force", "Re-download even if a verified copy is cached").option("--no-verify", "Skip SHA-256 verification (allowed when no sidecar exists)").option("--no-launch", "Install without launching the app").action(async (opts) => {
   let asset;
@@ -6486,13 +6816,13 @@ var installCommand = new Command25("install").description("Download and install
     process.exit(1);
   }
   const dir = releaseDir(tag);
-  const assetPath = join17(dir, asset.name);
+  const assetPath = join16(dir, asset.name);
   const sidecarPath = `${assetPath}.sha256`;
   const assetUrl2 = `${RELEASES}/download/${tag}/${asset.name}`;
   const sidecarUrl = `${assetUrl2}.sha256`;
   let downloaded = false;
   let sha;
-  const cachedUsable = !opts.force && existsSync16(assetPath) && (existsSync16(sidecarPath) || opts.verify === false);
+  const cachedUsable = !opts.force && existsSync17(assetPath) && (existsSync17(sidecarPath) || opts.verify === false);
   if (cachedUsable) {
     info(`  Using cached ${asset.name} (${tag}).`);
   } else {
@@ -6514,8 +6844,8 @@ var installCommand = new Command25("install").description("Download and install
     const s2 = spin4("Verifying checksum\u2026");
     try {
       let sidecarBody;
-      if (existsSync16(sidecarPath) && !downloaded) {
-        sidecarBody = readFileSync14(sidecarPath, "utf8");
+      if (existsSync17(sidecarPath) && !downloaded) {
+        sidecarBody = readFileSync13(sidecarPath, "utf8");
       } else {
         sidecarBody = await fetchSidecar(sidecarUrl);
       }
@@ -6579,7 +6909,222 @@ var installCommand = new Command25("install").description("Download and install
 
 // src/commands/update.ts
 import { Command as Command26 } from "commander";
-import { spawnSync as spawnSync7 } from "child_process";
+import { spawnSync as spawnSync10 } from "child_process";
+
+// src/lib/cli-payload.ts
+import { spawnSync as spawnSync8 } from "child_process";
+import {
+  existsSync as existsSync18,
+  lstatSync,
+  mkdirSync as mkdirSync12,
+  readdirSync as readdirSync2,
+  rmSync as rmSync5,
+  symlinkSync,
+  writeFileSync as writeFileSync12
+} from "fs";
+import { join as join17 } from "path";
+var CLI_DIR = join17(OS_DIR, "cli");
+var CLI_CURRENT = join17(CLI_DIR, "current");
+var KEEP = 2;
+function assetName2(tag) {
+  return `openship-cli-${tag}.tar.gz`;
+}
+function repoint(link, targetTag) {
+  try {
+    if (lstatSync(link)) rmSync5(link, { recursive: true, force: true });
+  } catch {
+  }
+  symlinkSync(targetTag, link, process.platform === "win32" ? "junction" : void 0);
+}
+function prune(activeTag) {
+  let entries;
+  try {
+    entries = readdirSync2(CLI_DIR);
+  } catch {
+    return;
+  }
+  const tags = entries.filter((e) => e !== "current" && existsSync18(join17(CLI_DIR, e, ".extracted")));
+  const ranked = tags.map((t) => ({ t, m: safeMtime(join17(CLI_DIR, t)) })).sort((a, b) => b.m - a.m).map((x) => x.t);
+  const keep2 = /* @__PURE__ */ new Set([activeTag, ...ranked.slice(0, KEEP)]);
+  for (const t of tags) {
+    if (!keep2.has(t)) rmSync5(join17(CLI_DIR, t), { recursive: true, force: true });
+  }
+}
+function safeMtime(p) {
+  try {
+    return lstatSync(p).mtimeMs;
+  } catch {
+    return 0;
+  }
+}
+async function ensureCliPayload(tag, onProgress) {
+  const resolved = tag ?? await resolveLatestTag();
+  const dir = join17(CLI_DIR, resolved);
+  const entry = join17(dir, "dist", "index.js");
+  const marker = join17(dir, ".extracted");
+  if (existsSync18(marker) && existsSync18(entry)) {
+    repoint(CLI_CURRENT, resolved);
+    prune(resolved);
+    return { tag: resolved, dir, entry };
+  }
+  rmSync5(dir, { recursive: true, force: true });
+  mkdirSync12(dir, { recursive: true });
+  const name = assetName2(resolved);
+  const override = process.env.OPENSHIP_CLI_ASSET_URL?.trim();
+  const url = override || assetUrl(resolved, name);
+  const tarball = join17(dir, name);
+  const { sha256 } = await downloadToFile(url, tarball, onProgress);
+  const expected = override ? parseSha256(await fetchSidecar(`${url}.sha256`) ?? "") : await expectedSha256(resolved, name);
+  if (!expected) {
+    rmSync5(dir, { recursive: true, force: true });
+    throw new Error(`No .sha256 sidecar for ${name}; refusing to install an unverified CLI payload.`);
+  }
+  if (expected !== sha256) {
+    rmSync5(dir, { recursive: true, force: true });
+    throw new Error(`CLI payload checksum mismatch (expected ${expected}, got ${sha256}).`);
+  }
+  const untar = spawnSync8("tar", ["-xzf", tarball, "-C", dir], { stdio: "inherit" });
+  if (untar.status !== 0) {
+    rmSync5(dir, { recursive: true, force: true });
+    throw new Error("Failed to extract the CLI payload (is `tar` available?).");
+  }
+  rmSync5(tarball, { force: true });
+  if (!existsSync18(entry)) {
+    rmSync5(dir, { recursive: true, force: true });
+    throw new Error(`CLI payload extracted but ${entry} is missing (unexpected layout).`);
+  }
+  writeFileSync12(marker, `${resolved}
+`);
+  repoint(CLI_CURRENT, resolved);
+  prune(resolved);
+  return { tag: resolved, dir, entry };
+}
+
+// src/lib/node-runtime.ts
+import { execFileSync as execFileSync5, spawnSync as spawnSync9 } from "child_process";
+import { chmodSync as chmodSync3, existsSync as existsSync19, lstatSync as lstatSync2, mkdirSync as mkdirSync13, rmSync as rmSync6, symlinkSync as symlinkSync2, writeFileSync as writeFileSync13 } from "fs";
+import { join as join18 } from "path";
+var NODE_MAJOR = 22;
+var NODE_DIST = "https://nodejs.org/dist";
+var RUNTIME_DIR = join18(OS_DIR, "runtime");
+var RUNTIME_CURRENT = join18(RUNTIME_DIR, "current");
+var BIN_DIR = join18(OS_DIR, "bin");
+var LAUNCHER_PATH = join18(BIN_DIR, "openship");
+var LAUNCHER_SH = `#!/bin/sh
+# Openship CLI launcher \u2014 runs the tarball-installed CLI under Node.
+# Managed by scripts/install.sh and \`openship update\`; manual edits are overwritten.
+SELF="$0"
+while [ -L "$SELF" ]; do
+  _t="$(readlink "$SELF")"
+  case "$_t" in /*) SELF="$_t" ;; *) SELF="$(dirname "$SELF")/$_t" ;; esac
+done
+BIN_DIR="$(cd "$(dirname "$SELF")" && pwd)"
+HOME_DIR="$(dirname "$BIN_DIR")"
+CLI="$HOME_DIR/cli/current/dist/index.js"
+VENDORED_NODE="$HOME_DIR/runtime/current/bin/node"
+# Prefer a system node >= ${NODE_MAJOR}; fall back to the vendored runtime.
+if command -v node >/dev/null 2>&1 && node -e 'process.exit(+process.versions.node.split(".")[0]>=${NODE_MAJOR}?0:1)' 2>/dev/null; then
+  exec node "$CLI" "$@"
+elif [ -x "$VENDORED_NODE" ]; then
+  exec "$VENDORED_NODE" "$CLI" "$@"
+else
+  echo "openship: no Node >= ${NODE_MAJOR} found (system or vendored). Reinstall: curl -fsSL https://get.openship.io | sh" >&2
+  exit 127
+fi
+`;
+function nodeDistOs() {
+  if (process.platform === "darwin") return "darwin";
+  if (process.platform === "linux") return "linux";
+  throw new Error(`Unsupported platform for vendored Node: ${process.platform}`);
+}
+function nodeDistArch() {
+  if (process.arch === "x64") return "x64";
+  if (process.arch === "arm64") return "arm64";
+  throw new Error(`Unsupported arch for vendored Node: ${process.arch}`);
+}
+function majorOf(bin) {
+  try {
+    const out = execFileSync5(bin, ["-e", "process.stdout.write(process.versions.node)"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    const m = Number(out.trim().split(".")[0]);
+    return Number.isInteger(m) ? m : null;
+  } catch {
+    return null;
+  }
+}
+function writeLauncher() {
+  mkdirSync13(BIN_DIR, { recursive: true });
+  writeFileSync13(LAUNCHER_PATH, LAUNCHER_SH);
+  chmodSync3(LAUNCHER_PATH, 493);
+  return LAUNCHER_PATH;
+}
+function repoint2(link, target) {
+  try {
+    if (lstatSync2(link)) rmSync6(link, { recursive: true, force: true });
+  } catch {
+  }
+  symlinkSync2(target, link);
+}
+async function resolveLatestNode() {
+  const res = await fetch(`${NODE_DIST}/index.json`, {
+    headers: { "User-Agent": "openship-cli" },
+    signal: AbortSignal.timeout(15e3)
+  });
+  if (!res.ok) throw new Error(`Node dist index lookup failed: HTTP ${res.status}`);
+  const rows = await res.json();
+  const prefix = `v${NODE_MAJOR}.`;
+  const row2 = rows.find((r) => r.version.startsWith(prefix) && r.lts) ?? rows.find((r) => r.version.startsWith(prefix));
+  if (!row2) throw new Error(`No Node ${NODE_MAJOR}.x release found on nodejs.org`);
+  return row2.version;
+}
+async function fetchVendoredNode(onLog) {
+  const ver = await resolveLatestNode();
+  const os = nodeDistOs();
+  const arch = nodeDistArch();
+  const name = `node-${ver}-${os}-${arch}.tar.gz`;
+  mkdirSync13(RUNTIME_DIR, { recursive: true });
+  const tarball = join18(RUNTIME_DIR, name);
+  onLog?.(`Fetching Node ${ver} (${os}-${arch}) from nodejs.org\u2026`);
+  const { sha256 } = await downloadToFile(`${NODE_DIST}/${ver}/${name}`, tarball);
+  const shaRes = await fetch(`${NODE_DIST}/${ver}/SHASUMS256.txt`, {
+    headers: { "User-Agent": "openship-cli" },
+    signal: AbortSignal.timeout(15e3)
+  });
+  if (!shaRes.ok) {
+    rmSync6(tarball, { force: true });
+    throw new Error(`Node checksum list fetch failed: HTTP ${shaRes.status}`);
+  }
+  const expected = (await shaRes.text()).split("\n").map((l) => l.trim()).find((l) => l.endsWith(` ${name}`) || l.endsWith(`  ${name}`))?.split(/\s+/)[0]?.toLowerCase();
+  if (!expected) {
+    rmSync6(tarball, { force: true });
+    throw new Error(`No checksum for ${name} in SHASUMS256.txt`);
+  }
+  if (expected !== sha256) {
+    rmSync6(tarball, { force: true });
+    throw new Error(`Node download checksum mismatch (expected ${expected}, got ${sha256}).`);
+  }
+  const unpacked = join18(RUNTIME_DIR, `node-${ver}-${os}-${arch}`);
+  rmSync6(unpacked, { recursive: true, force: true });
+  const untar = spawnSync9("tar", ["-xzf", tarball, "-C", RUNTIME_DIR], { stdio: "inherit" });
+  if (untar.status !== 0) throw new Error("Failed to extract the Node runtime (is `tar` available?).");
+  rmSync6(tarball, { force: true });
+  const nodeBin = join18(unpacked, "bin", "node");
+  if (!existsSync19(nodeBin)) throw new Error(`Node unpacked but ${nodeBin} is missing (unexpected layout).`);
+  repoint2(RUNTIME_CURRENT, unpacked);
+  return nodeBin;
+}
+async function ensureNodeRuntime(onLog) {
+  if ((majorOf("node") ?? 0) >= NODE_MAJOR) return { node: "node", source: "system" };
+  const existing = join18(RUNTIME_CURRENT, "bin", "node");
+  if (existsSync19(existing) && (majorOf(existing) ?? 0) >= NODE_MAJOR) {
+    return { node: existing, source: "vendored" };
+  }
+  return { node: await fetchVendoredNode(onLog), source: "vendored" };
+}
+
+// src/commands/update.ts
 async function runSourceUpdate(source, opts) {
   const current = shortSha(source.dir);
   const remote = remoteSha(source.repo, source.ref);
@@ -6618,15 +7163,81 @@ async function runSourceUpdate(source, opts) {
     ok(`Rebuilt from source (${source.ref} @ ${sha}). Restart to run it: openship up`);
   }
 }
+var REINSTALL_HINT = "curl -fsSL https://get.openship.io | sh";
+async function runTarballUpdate(install, opts) {
+  const current = "0.6.0";
+  let latest;
+  try {
+    latest = (await resolveLatestTag()).replace(/^v/, "");
+  } catch {
+    err(`Could not reach GitHub to check for updates. Try again, or reinstall: ${REINSTALL_HINT}`);
+    process.exitCode = 1;
+    return;
+  }
+  const plan = resolveCliUpdatePlan(current, latest);
+  if (opts.check) {
+    if (isJsonMode()) {
+      printJson({ current, latest, updateAvailable: plan.action === "install", method: "tarball" });
+    } else if (plan.action === "install") {
+      info(`Update available: v${current} \u2192 v${latest}. Run \`openship update\`.`);
+    } else {
+      ok(`Up to date (v${current}).`);
+    }
+    return;
+  }
+  if (plan.action === "up-to-date") {
+    ok(`Already on the latest version (v${current}).`);
+    return;
+  }
+  const tag = `v${latest}`;
+  info(`Updating v${current} \u2192 v${latest} (verified payload)\u2026`);
+  let runtime = install.runtime;
+  try {
+    runtime = (await ensureNodeRuntime((m) => info(m))).source;
+  } catch (e) {
+    info(`Keeping the current Node runtime (couldn't refresh it: ${e.message}).`);
+  }
+  try {
+    await ensureCliPayload(tag);
+    if (process.platform !== "win32") writeLauncher();
+  } catch (e) {
+    err(`Update failed: ${e.message} Reinstall: ${REINSTALL_HINT}`);
+    process.exitCode = 1;
+    return;
+  }
+  writeCliInstall({ ...install, tag, runtime });
+  if (readInstallMethod() === "compose") {
+    const applied = await composeUpdate(latest);
+    if (isJsonMode()) {
+      printJson({ updated: true, from: current, to: latest, method: "compose", applied });
+    } else if (applied) {
+      ok(`Updated to v${latest} \u2014 compose stack regenerated, images pulled, services recreated.`);
+    } else {
+      err(`Updated the CLI to v${latest}, but bringing the compose stack up failed. Re-run \`openship update\`, or \`openship up\` to retry.`);
+      process.exitCode = 1;
+    }
+    return;
+  }
+  const { restarted } = restart();
+  if (isJsonMode()) {
+    printJson({ updated: true, from: current, to: latest, method: "tarball", restarted });
+  } else if (restarted) {
+    ok(`Updated to v${latest} and restarted the service \u2014 you're on the new version.`);
+  } else {
+    ok(`Updated to v${latest}. Restart the server to run the new version: openship up`);
+  }
+}
 function detectPackageManager2(override) {
   if (override === "bun" || override === "npm") return override;
-  const hasBun = spawnSync7("bun", ["--version"], { stdio: "ignore" }).status === 0;
+  const hasBun = spawnSync10("bun", ["--version"], { stdio: "ignore" }).status === 0;
   return hasBun ? "bun" : "npm";
 }
 var updateCommand = new Command26("update").description("Update the Openship CLI + bundled server to the latest release").option("--check", "Only report the current + latest version; don't install").option("--via <manager>", "Package manager to update with: bun | npm").option("--rebuild", "From-source installs: rebuild even if already at the remote tip").action(async (opts) => {
   const source = readSourceInstall();
   if (source) return runSourceUpdate(source, opts);
-  const current = "0.4.8";
+  const cliInstall = readCliInstall();
+  if (cliInstall?.method === "tarball") return runTarballUpdate(cliInstall, opts);
+  const current = "0.6.0";
   let latest;
   try {
     latest = (await resolveLatestTag()).replace(/^v/, "");
@@ -6654,7 +7265,7 @@ var updateCommand = new Command26("update").description("Update the Openship CLI
   const ref = `openship@${latest}`;
   const argv = pm === "bun" ? ["add", "-g", ref] : ["install", "-g", ref];
   info(`Updating v${current} \u2192 v${latest} (${cliInstallCommand(pm, latest)})...`);
-  const res = spawnSync7(pm, argv, { stdio: "inherit", shell: process.platform === "win32" });
+  const res = spawnSync10(pm, argv, { stdio: "inherit", shell: process.platform === "win32" });
   if (res.status !== 0) {
     err(`Update failed (${pm} exited ${res.status ?? "with a signal"}). Reinstall manually: ${cliInstallCommand(pm, latest)}`);
     process.exitCode = 1;
@@ -6684,17 +7295,17 @@ var updateCommand = new Command26("update").description("Update the Openship CLI
 
 // src/commands/cache.ts
 import { Command as Command27 } from "commander";
-import { existsSync as existsSync17, readdirSync as readdirSync2, readFileSync as readFileSync15, rmSync as rmSync5, statSync as statSync2 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync20, readdirSync as readdirSync3, readFileSync as readFileSync14, rmSync as rmSync7, statSync as statSync2 } from "fs";
+import { join as join19 } from "path";
 function listAssets() {
-  if (!existsSync17(RELEASES_DIR)) return [];
+  if (!existsSync20(RELEASES_DIR)) return [];
   const out = [];
-  for (const tag of readdirSync2(RELEASES_DIR)) {
+  for (const tag of readdirSync3(RELEASES_DIR)) {
     const dir = releaseDir(tag);
     if (!statSync2(dir).isDirectory()) continue;
-    for (const name of readdirSync2(dir)) {
+    for (const name of readdirSync3(dir)) {
       if (name.endsWith(".sha256")) continue;
-      const path2 = join18(dir, name);
+      const path2 = join19(dir, name);
       const st = statSync2(path2);
       if (!st.isFile()) continue;
       out.push({
@@ -6702,7 +7313,7 @@ function listAssets() {
         name,
         path: path2,
         size: st.size,
-        hasSidecar: existsSync17(`${path2}.sha256`)
+        hasSidecar: existsSync20(`${path2}.sha256`)
       });
     }
   }
@@ -6733,7 +7344,7 @@ var verifyCmd2 = new Command27("verify").description("Re-hash cached assets and
       results.push({ tag: a.tag, asset: a.name, result: "no-sidecar" });
       continue;
     }
-    const expected = parseSha256(readFileSync15(`${a.path}.sha256`, "utf8"));
+    const expected = parseSha256(readFileSync14(`${a.path}.sha256`, "utf8"));
     const actual = await hashFile(a.path);
     const okMatch = expected !== null && expected === actual;
     if (!okMatch) bad += 1;
@@ -6749,12 +7360,12 @@ var verifyCmd2 = new Command27("verify").description("Re-hash cached assets and
 });
 var cleanCmd = new Command27("clean").description("Delete cached release assets").argument("[tag]", "Only remove this release tag (default: all)").action((tag) => {
   const target = tag ? releaseDir(tag) : RELEASES_DIR;
-  if (!existsSync17(target)) {
+  if (!existsSync20(target)) {
     if (isJsonMode()) printJson({ removed: false, path: target });
     else info(`  Nothing to clean (${target}).`);
     return;
   }
-  rmSync5(target, { recursive: true, force: true });
+  rmSync7(target, { recursive: true, force: true });
   if (isJsonMode()) printJson({ removed: true, path: target });
   else ok(`
   Removed ${target}
@@ -6766,11 +7377,11 @@ var cacheCommand = new Command27("cache").description("Manage the local download
 }).addCommand(pathCmd).addCommand(listCmd6).addCommand(verifyCmd2).addCommand(cleanCmd);
 
 // src/commands/wizard.ts
-import chalk20 from "chalk";
+import chalk21 from "chalk";
 import open2 from "open";
 import { createHash as createHash2, randomBytes as randomBytes3 } from "crypto";
-import { existsSync as existsSync18, mkdirSync as mkdirSync12, readFileSync as readFileSync16, rmSync as rmSync6, writeFileSync as writeFileSync12 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync21, mkdirSync as mkdirSync14, rmSync as rmSync8, writeFileSync as writeFileSync14 } from "fs";
+import { join as join20 } from "path";
 import {
   intro as intro3,
   outro as outro3,
@@ -6811,7 +7422,7 @@ async function connectOpenshipCloud(port, token) {
   const handoff = `${apiBase}/api/cloud/connect-handoff?state=${encodeURIComponent(state)}&code_challenge=${challenge}&mode=device`;
   const overSsh = !!(process.env.SSH_CONNECTION || process.env.SSH_TTY || process.env.SSH_CLIENT);
   log5.step("Open this URL in your browser to authorize, then click Authorize:");
-  console.log("\n" + chalk20.cyan.underline(handoff) + "\n");
+  console.log("\n" + chalk21.cyan.underline(handoff) + "\n");
   if (!overSsh) void open2(handoff).catch(() => {
   });
   const s = spinner4();
@@ -6916,16 +7527,16 @@ async function streamProvision(port, sessionId, s) {
   }
   return { ok: ok3, detail };
 }
-var SETUP_LOCK = join19(OS_DIR, "setup-in-progress");
+var SETUP_LOCK = join20(OS_DIR, "setup-in-progress");
 function isSetupInProgress() {
-  return existsSync18(SETUP_LOCK);
+  return existsSync21(SETUP_LOCK);
 }
 function markSetupStarted() {
-  mkdirSync12(OS_DIR, { recursive: true });
-  writeFileSync12(SETUP_LOCK, "1");
+  mkdirSync14(OS_DIR, { recursive: true });
+  writeFileSync14(SETUP_LOCK, "1");
 }
 function markSetupDone() {
-  rmSync6(SETUP_LOCK, { force: true });
+  rmSync8(SETUP_LOCK, { force: true });
 }
 function wizardInputs(admin, plan) {
   switch (plan.type) {
@@ -6942,20 +7553,20 @@ function wizardInputs(admin, plan) {
 function finishSetup(opts) {
   saveInstanceUrl(opts.liveUrl);
   markSetupDone();
-  const pad = (label) => chalk20.dim(label.padEnd(11));
-  log5.success(chalk20.bold("Openship is live"));
+  const pad = (label) => chalk21.dim(label.padEnd(11));
+  log5.success(chalk21.bold("Openship is live"));
   log5.message(
-    `${pad("URL")}${chalk20.bold(opts.liveUrl)}
+    `${pad("URL")}${chalk21.bold(opts.liveUrl)}
 ${pad("Dashboard")}http://localhost:${opts.dashPort}
 ${pad("API")}http://localhost:${opts.apiPort}
-${pad("Login")}${opts.adminEmail} ${chalk20.dim("(email + password you set)")}
-` + (opts.cloudEmail ? `${pad("Cloud")}${chalk20.dim("connected as ")}${opts.cloudEmail}${chalk20.dim(" \u2014 free domain + mail only")}
-` : "") + `${pad("Status")}${chalk20.green("running")} ${chalk20.dim(opts.method === "compose" ? "\xB7 Docker Compose stack (restarts on boot)" : "\xB7 service (restarts on boot)")}`
+${pad("Login")}${opts.adminEmail} ${chalk21.dim("(email + password you set)")}
+` + (opts.cloudEmail ? `${pad("Cloud")}${chalk21.dim("connected as ")}${opts.cloudEmail}${chalk21.dim(" \u2014 free domain + mail only")}
+` : "") + `${pad("Status")}${chalk21.green("running")} ${chalk21.dim(opts.method === "compose" ? "\xB7 Docker Compose stack (restarts on boot)" : "\xB7 service (restarts on boot)")}`
   );
   log5.message(
-    chalk20.dim("Sign in with the email + password you just set. Openship appears under your Apps.\n") + chalk20.dim("Change the domain, Openship Cloud, team, and everything else anytime in Settings.\n") + chalk20.dim(`Locked out? Run ${chalk20.reset("openship reset-admin-password")}${chalk20.dim(" on this machine \u2014 resets your login without signing in.")}`)
+    chalk21.dim("Sign in with the email + password you just set. Openship appears under your Apps.\n") + chalk21.dim("Change the domain, Openship Cloud, team, and everything else anytime in Settings.\n") + chalk21.dim(`Locked out? Run ${chalk21.reset("openship reset-admin-password")}${chalk21.dim(" on this machine \u2014 resets your login without signing in.")}`)
   );
-  outro3(opts.byo ? chalk20.dim("Point your reverse proxy at the dashboard port above.") : chalk20.green("Happy shipping."));
+  outro3(opts.byo ? chalk21.dim("Point your reverse proxy at the dashboard port above.") : chalk21.green("Happy shipping."));
 }
 async function promptLocalEdgeTakeover(port) {
   const pf = await internalPost(port, "/api/system/self-edge/preflight", {});
@@ -6970,22 +7581,36 @@ async function promptLocalEdgeTakeover(port) {
   renderEdgeConflict({ owner, sites, warnings });
   const action2 = await confirmEdgeAction({ owner, known, importable: sites.length });
   if (action2 === "cancel") return { proceed: false, edgeMigrate: false, edgeTakeover: false };
-  return { proceed: true, edgeMigrate: action2 === "migrate", edgeTakeover: action2 === "takeover" };
+  let staticRootOverrides;
+  if (action2 === "migrate") {
+    const unreachable = pf.ok && Array.isArray(pf.data?.unreachableStaticRoots) ? pf.data.unreachableStaticRoots : [];
+    staticRootOverrides = await remediateUnreachableStaticRoots({
+      unreachable,
+      executor: new LocalExecutor(),
+      interactive: Boolean(process.stdin.isTTY && process.stdout.isTTY)
+    });
+  }
+  return {
+    proceed: true,
+    edgeMigrate: action2 === "migrate",
+    edgeTakeover: action2 === "takeover",
+    ...staticRootOverrides ? { staticRootOverrides } : {}
+  };
 }
 async function runWizard() {
   const resuming = isSetupInProgress();
-  intro3(`${chalk20.bgCyan(chalk20.black(" Openship "))}${chalk20.dim(" setup")}`);
+  intro3(`${chalk21.bgCyan(chalk21.black(" Openship "))}${chalk21.dim(" setup")}`);
   if (resuming) {
     log5.warn(
       "Your last setup didn't finish \u2014 picking it back up. Re-enter your details to complete it (or run `openship up` to just keep the server running)."
     );
   }
   log5.message(
-    chalk20.dim(
+    chalk21.dim(
       "Deploy Openship on this machine \u2014 a few questions, then it installs itself\nas a service, registers as an app, and prints the URL to log in."
     )
   );
-  log5.message(chalk20.dim("First, your instance login (email + password) \u2014 this is how you sign in. Domain and Openship Cloud come next and never replace it."));
+  log5.message(chalk21.dim("First, your instance login (email + password) \u2014 this is how you sign in. Domain and Openship Cloud come next and never replace it."));
   const admin = await promptLocalAdmin();
   let cloudEmail = null;
   let publicUrl;
@@ -7004,7 +7629,7 @@ async function runWizard() {
     sp.start("Detecting this server's public IP");
     const detected = await detectPublicIp();
     if (detected) {
-      sp.stop(`Public IP: ${chalk20.bold(detected)}`);
+      sp.stop(`Public IP: ${chalk21.bold(detected)}`);
       publicHost = detected;
       return detected;
     }
@@ -7019,7 +7644,7 @@ async function runWizard() {
     return publicHost;
   }
   let stage = "reach";
-  log5.message(chalk20.dim("These are just starting choices \u2014 domain, Cloud, team, and the rest are all editable later in Settings."));
+  log5.message(chalk21.dim("These are just starting choices \u2014 domain, Cloud, team, and the rest are all editable later in Settings."));
   planning: while (true) {
     if (stage === "reach") {
       const reach = ensure2(
@@ -7075,11 +7700,11 @@ async function runWizard() {
       ).trim().toLowerCase();
       const host = await resolvePublicHost();
       note3(
-        `${chalk20.cyan(`https://${slug}.opsh.io`)}
+        `${chalk21.cyan(`https://${slug}.opsh.io`)}
 
-  ${chalk20.dim("served via")}  Openship Cloud edge  ${chalk20.dim("\u2192")}  ${chalk20.cyan(host)}
+  ${chalk21.dim("served via")}  Openship Cloud edge  ${chalk21.dim("\u2192")}  ${chalk21.cyan(host)}
 
-` + chalk20.dim("Openship Cloud terminates HTTPS and forwards to this server."),
+` + chalk21.dim("Openship Cloud terminates HTTPS and forwards to this server."),
         "Confirm free domain"
       );
       const go2 = ensure2(
@@ -7117,11 +7742,11 @@ async function runWizard() {
       }
       const host = await resolvePublicHost();
       note3(
-        `Add a DNS ${chalk20.bold("A record")}:
+        `Add a DNS ${chalk21.bold("A record")}:
 
-  ${chalk20.cyan(hostname2)}  \u2192  ${chalk20.cyan(host)}
+  ${chalk21.cyan(hostname2)}  \u2192  ${chalk21.cyan(host)}
 
-` + chalk20.dim("HTTPS is issued automatically once DNS resolves (it retries for a couple minutes)."),
+` + chalk21.dim("HTTPS is issued automatically once DNS resolves (it retries for a couple minutes)."),
         "DNS"
       );
       const go2 = ensure2(
@@ -7158,9 +7783,9 @@ async function runWizard() {
       log5.warn("Serving over plain HTTP sends passwords in cleartext \u2014 put HTTPS in front before real use.");
     }
     note3(
-      `${chalk20.cyan(url)}
+      `${chalk21.cyan(url)}
 
-` + chalk20.dim("Point your reverse proxy at the dashboard port shown at the end."),
+` + chalk21.dim("Point your reverse proxy at the dashboard port shown at the end."),
       "Confirm"
     );
     const go = ensure2(
@@ -7183,17 +7808,22 @@ async function runWizard() {
   }
   let method = "bare";
   if (process.platform === "linux") {
-    if (hasDockerCompose()) {
+    const gap = dockerGap();
+    if (!gap) {
       method = "compose";
+    } else if (!gap.installable) {
+      log5.warn(`${gap.summary} \u2014 using the bare process service instead.`);
+      if (gap.hint) log5.info(gap.hint);
+      method = "bare";
     } else {
-      log5.step("Docker isn't installed \u2014 installing it now (get.docker.com)\u2026");
-      method = await ensureDocker() ? "compose" : "bare";
+      log5.step(`${gap.summary} \u2014 installing via get.docker.com\u2026`);
+      method = await ensureDocker({ onNotice: (line) => log5.info(line) }) ? "compose" : "bare";
       if (method === "bare") {
         log5.warn("Couldn't install Docker automatically \u2014 falling back to the bare process service.");
       }
     }
   }
-  const uiTag = `v${"0.4.8"}`;
+  const uiTag = `v${"0.6.0"}`;
   if (method === "bare") {
     const dl = spinner4();
     dl.start("Pulling the Openship dist from GitHub");
@@ -7218,6 +7848,7 @@ async function runWizard() {
   let edgeAction;
   let migratedSites;
   let migratedCertPems;
+  let migratedStaticRootOverrides;
   let allowHostControl = true;
   if (method === "compose") {
     allowHostControl = ensure2(
@@ -7240,20 +7871,27 @@ async function runWizard() {
     ) === "allow";
     if (!allowHostControl) {
       log5.message(
-        chalk20.dim(
+        chalk21.dim(
           "  No host key will be created or mounted, and this box won't be offered as a deploy target.\n  The Docker socket stays mounted (deployments need it), so this is defense in depth, not isolation."
         )
       );
     }
   }
   if (method === "compose") {
+    const ports = await resolveComposePorts({});
+    const apiPort = String(ports.api);
+    const dashboardPort = String(ports.dashboard);
+    const moved = portMoveNotice(ports, composeTrustedOriginUrls());
+    if (moved.length) log5.info(moved.join("\n"));
     log5.step(
       sourceBuildDir() ? "Building the Openship images before touching :80/:443 (first run takes a few minutes)\u2026" : "Pulling images before touching :80/:443\u2026"
     );
     if (!composePrefetch({
+      apiPort,
+      dashboardPort,
       publicUrl,
       trustProxy: behindProxy,
-      version: "0.4.8",
+      version: "0.6.0",
       noHostControl: !allowHostControl
     })) {
       cancel4("Couldn't fetch the Openship images \u2014 nothing on this box was changed.");
@@ -7261,19 +7899,24 @@ async function runWizard() {
     }
     const edgePlan = await planAndApplyHostEdge({});
     if (!edgePlan.proceed) {
-      cancel4("Left the existing proxy on 80/443 running \u2014 re-run and choose migrate/takeover when ready.");
-      process.exit(0);
+      cancel4(
+        edgePlan.blockedBy ? `Can't take over the edge: ${edgePlan.blockedBy}. Nothing was started.` : "Left the existing proxy on 80/443 running \u2014 re-run and choose migrate/takeover when ready."
+      );
+      process.exit(edgePlan.blockedBy ? 1 : 0);
     }
     edgeAction = edgePlan.action;
     migratedSites = edgePlan.sites;
     migratedCertPems = edgePlan.certPems;
+    migratedStaticRootOverrides = edgePlan.staticRootOverrides;
     log5.step("Starting the Docker Compose stack\u2026");
     const up = await composeUp({
       // Prefetched above, before the preflight stopped anything.
       alreadyFetched: true,
+      apiPort,
+      dashboardPort,
       publicUrl,
       trustProxy: behindProxy,
-      version: "0.4.8",
+      version: "0.6.0",
       noHostControl: !allowHostControl
     });
     if (!up.ok) {
@@ -7322,7 +7965,12 @@ async function runWizard() {
     await waitDashboard(started.dashPort);
     s.stop("Deployed.");
     if (edgeAction === "migrate" && migratedSites?.length) {
-      const imported = await importMigratedSites(started.port, migratedSites, migratedCertPems);
+      const imported = await importMigratedSites(
+        started.port,
+        migratedSites,
+        migratedCertPems,
+        migratedStaticRootOverrides
+      );
       if (!imported.ok) {
         log5.warn(
           `Your ${migratedSites.length} existing site${migratedSites.length === 1 ? "" : "s"} aren't served yet \u2014 re-run \`openship up\` to retry the import.`
@@ -7345,7 +7993,7 @@ async function runWizard() {
       inputs: wizardInputs(admin, domainPlan),
       token: provisionToken,
       method: "compose",
-      onLog: (msg) => log5.message(chalk20.dim(msg)),
+      onLog: (msg) => log5.message(chalk21.dim(msg)),
       // .opsh.io is a SHARED zone, and Cloud only connects after the stack is up —
       // so a taken subdomain can't be detected at prompt time. Recover here, where
       // we still have a TTY, instead of ending the run with no domain.
@@ -7431,10 +8079,11 @@ async function runWizard() {
             // the operator declined the takeover (their proxy keeps 80/443).
             localEdge: edge.proceed,
             edgeTakeover: edge.edgeTakeover,
-            edgeMigrate: edge.edgeMigrate
+            edgeMigrate: edge.edgeMigrate,
+            ...edge.staticRootOverrides ? { staticRootOverrides: edge.staticRootOverrides } : {}
           }
         },
-        onLog: (msg) => log5.message(chalk20.dim(msg)),
+        onLog: (msg) => log5.message(chalk21.dim(msg)),
         onSlugTaken: async (taken) => {
           log5.warn(`"${taken}.opsh.io" is already taken.`);
           const next = await text({
@@ -7469,7 +8118,8 @@ async function runWizard() {
         dashPort: Number(started.dashPort),
         acmeEmail: admin?.email,
         edgeTakeover,
-        edgeMigrate
+        edgeMigrate,
+        ...edge.staticRootOverrides ? { staticRootOverrides: edge.staticRootOverrides } : {}
       });
       if (res.ok && res.data?.sessionId) {
         const s2 = spinner4();
@@ -7504,36 +8154,28 @@ async function runWizard() {
     byo: domainPlan.type === "byo"
   });
 }
-function storedPorts2() {
-  const p = join19(OS_DIR, "ports.json");
-  try {
-    return existsSync18(p) ? JSON.parse(readFileSync16(p, "utf8")) : {};
-  } catch {
-    return {};
-  }
-}
 async function runControl() {
   const svc = serviceStatus();
   const isCompose = readInstallMethod() === "compose";
   const running = isCompose ? composeRunning() : svc.running;
   const managerLabel = isCompose ? "docker compose" : svc.kind === "unsupported" ? "none" : svc.kind;
-  const ports = storedPorts2();
-  const apiPort2 = String(ports.api ?? 4e3);
-  const dashUrl = `http://localhost:${ports.dashboard ?? 3001}`;
+  const ports = readStoredPorts();
+  const apiPort = String(storedApiPort());
+  const dashUrl = `http://localhost:${storedDashboardPort()}`;
   const publicUrl = readInstanceUrl();
   const primaryUrl = publicUrl && !/^https?:\/\/localhost/i.test(publicUrl) ? publicUrl : dashUrl;
-  intro3(`${chalk20.bgCyan(chalk20.black(" Openship "))}${chalk20.dim(" control")}`);
+  intro3(`${chalk21.bgCyan(chalk21.black(" Openship "))}${chalk21.dim(" control")}`);
   note3(
-    `${chalk20.dim("URL".padEnd(11))}${chalk20.bold(primaryUrl)}
-${chalk20.dim("Service".padEnd(11))}${running ? chalk20.green("running") : chalk20.yellow("stopped")}
-${chalk20.dim("Dashboard".padEnd(11))}${dashUrl}
-` + (ports.api ? `${chalk20.dim("API".padEnd(11))}http://localhost:${ports.api}
-` : "") + `${chalk20.dim("Manager".padEnd(11))}${managerLabel}`,
+    `${chalk21.dim("URL".padEnd(11))}${chalk21.bold(primaryUrl)}
+${chalk21.dim("Service".padEnd(11))}${running ? chalk21.green("running") : chalk21.yellow("stopped")}
+${chalk21.dim("Dashboard".padEnd(11))}${dashUrl}
+` + (ports.api ? `${chalk21.dim("API".padEnd(11))}http://localhost:${ports.api}
+` : "") + `${chalk21.dim("Manager".padEnd(11))}${managerLabel}`,
     "Openship is already set up"
   );
   const corrupted = looksCorrupted();
   if (corrupted) {
-    note3(chalk20.red("The service is installed but keeps failing to start \u2014 the database looks corrupted."), "Needs repair");
+    note3(chalk21.red("The service is installed but keeps failing to start \u2014 the database looks corrupted."), "Needs repair");
   }
   const action2 = ensure2(
     await select4({
@@ -7553,18 +8195,18 @@ ${chalk20.dim("Dashboard".padEnd(11))}${dashUrl}
   switch (action2) {
     case "repair": {
       const res = await runRepair();
-      outro3(res.healed ? chalk20.green(res.detail) : chalk20.yellow(res.detail));
+      outro3(res.healed ? chalk21.green(res.detail) : chalk21.yellow(res.detail));
       return;
     }
     case "open":
       await open2(primaryUrl).catch(() => {
       });
-      outro3(chalk20.dim(`Opening ${primaryUrl}`));
+      outro3(chalk21.dim(`Opening ${primaryUrl}`));
       return;
     case "start": {
       if (isCompose) {
         const ok3 = composeStart();
-        outro3(ok3 ? chalk20.green("Started.") : chalk20.yellow("Couldn't start the stack \u2014 run `openship up` to see the error."));
+        outro3(ok3 ? chalk21.green("Started.") : chalk21.yellow("Couldn't start the stack \u2014 run `openship up` to see the error."));
         return;
       }
       await startService({});
@@ -7573,30 +8215,30 @@ ${chalk20.dim("Dashboard".padEnd(11))}${dashUrl}
     case "restart": {
       if (isCompose) {
         const ok3 = composeRestart();
-        outro3(ok3 ? chalk20.green("Restarted.") : chalk20.yellow("Couldn't restart the stack."));
+        outro3(ok3 ? chalk21.green("Restarted.") : chalk21.yellow("Couldn't restart the stack."));
         return;
       }
       const r = restart();
-      outro3(r.restarted ? chalk20.green("Restarted.") : chalk20.yellow(r.detail));
+      outro3(r.restarted ? chalk21.green("Restarted.") : chalk21.yellow(r.detail));
       return;
     }
     case "stop": {
       if (isCompose) {
         const ok3 = composeDown();
-        outro3(ok3 ? chalk20.green("Stopped. Won't restart on boot.") : chalk20.yellow("Couldn't stop the stack."));
+        outro3(ok3 ? chalk21.green("Stopped. Won't restart on boot.") : chalk21.yellow("Couldn't stop the stack."));
         return;
       }
       const r = stop();
-      outro3(chalk20.green(`Stopped. ${chalk20.dim(r.detail)}`));
+      outro3(chalk21.green(`Stopped. ${chalk21.dim(r.detail)}`));
       return;
     }
     case "reset": {
       const pw = ensure2(
         await password({ message: "New admin password", validate: (v) => v && v.length >= 8 ? void 0 : "At least 8 characters" })
       );
-      const rr = await internalPost(apiPort2, "/api/system/reset-admin-password", { password: pw });
+      const rr = await internalPost(apiPort, "/api/system/reset-admin-password", { password: pw });
       outro3(
-        rr.ok ? chalk20.green(`Password reset. Sign in at ${dashUrl} with your email + new password.`) : chalk20.red(`Couldn't reset: ${rr.data?.error || "failed"}`)
+        rr.ok ? chalk21.green(`Password reset. Sign in at ${dashUrl} with your email + new password.`) : chalk21.red(`Couldn't reset: ${rr.data?.error || "failed"}`)
       );
       return;
     }
@@ -7604,13 +8246,19 @@ ${chalk20.dim("Dashboard".padEnd(11))}${dashUrl}
       await runWizard();
       return;
     default:
-      outro3(chalk20.dim("Nothing changed."));
+      outro3(chalk21.dim("Nothing changed."));
   }
 }
 
+// src/commands/completion.ts
+import tab from "@bomb.sh/tab/commander";
+function attachCompletion(program2) {
+  tab(program2, { completionCommandName: "completion" });
+}
+
 // src/index.ts
 var program = new Command28();
-program.name("openship").description("Openship CLI \u2014 install, run, and manage Openship from your terminal").version("0.4.8").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
+program.name("openship").description("Openship CLI \u2014 install, run, and manage Openship from your terminal").version("0.6.0").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
   if (thisCommand.opts().json) setJsonMode(true);
 }).action(async () => {
   const installed = serviceStatus().installed || readInstallMethod() === "compose";
@@ -7644,4 +8292,5 @@ program.addCommand(tokenCommand);
 program.addCommand(apiCommand);
 program.addCommand(resetAdminCommand);
 installCommand.addCommand(cacheCommand);
+attachCompletion(program);
 program.parse();