openship 0.4.8 → 0.6.0

package/dist/{chunk-SLTYVHU7.js → chunk-GUQ3QCJ7.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env sh
-":" //# ; exec "$(command -v bun || command -v node)" "$0" "$@"
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   resolveEnvironment
-} from "./chunk-L2VOGB2X.js";
+} from "./chunk-IW2UKBVF.js";
 import {
   formatDuration,
   isRemoteConnectionError,
   systemDebug
-} from "./chunk-RPHRPFEH.js";
+} from "./chunk-ZCFVHA25.js";
 import {
   containerCommand,
   edgeContainerExecutor,
@@ -17,41 +17,250 @@ import {
   readDeclaredPair,
   readMaybeInContainer,
   validateCertFor
-} from "./chunk-FXTBHTWY.js";
-import {
-  sq
-} from "./chunk-FPRHYBY2.js";
+} from "./chunk-QEH4QUBX.js";
 import {
   EDGE_CONTAINER_NAME,
   EdgeConflictError,
   EdgeMigrateRequested,
+  edgeCrashReason,
   edgeFailureReason,
+  edgeIsBroken,
   freeEdgeTargets,
   invalidateEdgeContainer,
-  ourLuaOnHost,
   probeEdge,
   resolveOurEdgeContainer,
   sanitizeEdgeVhosts,
   sq as sq2,
   stopTargetsForStatus
-} from "./chunk-2D3I5G6P.js";
+} from "./chunk-VZ2ZHPS2.js";
 import {
   waitForPortListening
-} from "./chunk-ILFETZOM.js";
+} from "./chunk-3LDWWY7U.js";
 import {
+  EDGE_CHALLENGE_HOST_DIR,
   EDGE_CONTAINER_MOUNTS,
   EDGE_HOST_PATHS,
-  OPENRESTY_DEFAULT_PATHS,
-  detectOpenRestyPaths
-} from "./chunk-VFINNTUL.js";
+  OPENRESTY_DEFAULT_PATHS
+} from "./chunk-OGY63DGD.js";
 import {
+  sq
+} from "./chunk-ZFJXPCQP.js";
+import {
+  AppError,
+  PROXY_DIRECTIVES,
   buildEdgeImageRef,
   compareSemver,
-  safeErrorMessage
-} from "./chunk-6APULWSU.js";
+  parseProxyValue,
+  safeErrorMessage,
+  sanitizeProxySettings
+} from "./chunk-OTLSJYAC.js";
+
+// ../../packages/adapters/src/system/managed-image.ts
+import { posix } from "path";
+function log(message, level = "info") {
+  return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
+}
+function titleCase(label) {
+  return label.charAt(0).toUpperCase() + label.slice(1);
+}
+var fromSourceManaged = { edge: false, mail: false };
+function managedImagesAreFromSource(kind) {
+  return fromSourceManaged[kind];
+}
+function fromSourceImageMissingMessage(label, image) {
+  return `The from-source ${label} image ${image} isn't on this server \u2014 the control-plane build or transfer didn't complete (see the log above). It's an unpublished dev tag, so there's nothing to pull; fix the build and retry.`;
+}
+async function dockerAvailable(executor) {
+  return executor.exec("docker version --format '{{.Server.Version}}' 2>/dev/null").then((v) => Boolean(v.trim())).catch(() => false);
+}
+async function containerState(executor, container) {
+  const out = await executor.exec(`docker inspect -f '{{.State.Running}}	{{.Config.Image}}' ${sq(container)} 2>/dev/null`).catch(() => "");
+  const line = out.split("\n").map((l) => l.trim()).find(Boolean);
+  if (!line) return null;
+  const [running, image] = line.split("	");
+  return { running: running?.trim() === "true", image: image?.trim() || null };
+}
+async function containerImageRef(executor, container) {
+  return (await containerState(executor, container))?.image ?? null;
+}
+async function imageExistsLocally(executor, ref) {
+  const out = await executor.exec(`docker image inspect -f '{{.Id}}' ${sq(ref)} 2>/dev/null`).catch(() => "");
+  return Boolean(out.trim());
+}
+async function swapManagedImage(executor, opts) {
+  const { kind, from, to, label, onLog, start } = opts;
+  const Label = titleCase(label);
+  onLog(log(`Updating the ${label}: ${from} \u2192 ${to}`));
+  if (!await imageExistsLocally(executor, to)) {
+    if (managedImagesAreFromSource(kind)) {
+      onLog(log(fromSourceImageMissingMessage(label, to), "warn"));
+      return { swapped: false, down: false };
+    }
+    const pull = await executor.streamExec(`docker pull ${sq(to)}`, onLog);
+    if (pull.code !== 0) {
+      onLog(log(`Could not pull ${to} \u2014 the ${label} stays on ${from}.`, "warn"));
+      return { swapped: false, down: false };
+    }
+  }
+  if (await start(to)) {
+    onLog(log(`${Label} updated to ${to}`));
+    return { swapped: true, down: false };
+  }
+  onLog(log(`${Label} ${to} failed to come up \u2014 rolling back to ${from}...`, "error"));
+  if (await start(from)) {
+    return { swapped: false, down: false };
+  }
+  onLog(log(`Rollback to ${from} ALSO failed \u2014 the ${label} is down on this server.`, "error"));
+  return { swapped: false, down: true };
+}
+
+// ../../packages/adapters/src/system/proxy/takeover-journal.ts
+var JOURNAL_DIR = "/var/lib/openship";
+var JOURNAL_PATH = `${JOURNAL_DIR}/edge-takeover.json`;
+function log2(message, level = "info") {
+  return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
+}
+async function tryExec(executor, cmd) {
+  try {
+    return await executor.exec(cmd);
+  } catch {
+    return null;
+  }
+}
+async function buildJournal(executor, status) {
+  const units = /* @__PURE__ */ new Map();
+  const containers = /* @__PURE__ */ new Map();
+  const processes = /* @__PURE__ */ new Map();
+  for (const o of status.occupants) {
+    if (o.containerName && !containers.has(o.containerName)) {
+      const r = await tryExec(
+        executor,
+        `docker inspect -f '{{.HostConfig.RestartPolicy.Name}}' ${sq2(o.containerName)} 2>/dev/null`
+      );
+      containers.set(o.containerName, { name: o.containerName, restart: r?.trim() || "no" });
+    } else if (o.systemdUnit && !units.has(o.systemdUnit)) {
+      const en = await tryExec(executor, `systemctl is-enabled ${sq2(o.systemdUnit)} 2>/dev/null`);
+      units.set(o.systemdUnit, { unit: o.systemdUnit, wasEnabled: en?.trim() === "enabled" });
+    } else if (!o.containerName && !o.systemdUnit && o.pid && !processes.has(o.pid)) {
+      processes.set(o.pid, { pid: o.pid, command: o.rawCommand });
+    }
+  }
+  return {
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    units: [...units.values()],
+    containers: [...containers.values()],
+    processes: [...processes.values()]
+  };
+}
+async function writeJournal(executor, journal) {
+  try {
+    await executor.mkdir(JOURNAL_DIR);
+    await executor.writeFile(JOURNAL_PATH, JSON.stringify(journal, null, 2));
+  } catch {
+  }
+}
+async function clearJournal(executor) {
+  await tryExec(executor, `rm -f ${JOURNAL_PATH}`);
+}
+async function readJournal(executor) {
+  const raw = await tryExec(executor, `cat ${JOURNAL_PATH} 2>/dev/null`);
+  if (!raw?.trim()) return null;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    await clearJournal(executor);
+    return null;
+  }
+}
+async function rollback(executor, journal, onLog) {
+  onLog(log2("Rolling back \u2014 restoring the previous proxy...", "warn"));
+  await tryExec(executor, `docker update --restart=no ${sq2(EDGE_CONTAINER_NAME)} 2>/dev/null || true`);
+  await tryExec(executor, `docker stop ${sq2(EDGE_CONTAINER_NAME)} 2>/dev/null || true`);
+  await tryExec(
+    executor,
+    "systemctl disable --now openresty 2>/dev/null || systemctl stop openresty 2>/dev/null || true; systemctl reset-failed openresty 2>/dev/null || true"
+  );
+  for (const u of journal.units) {
+    await tryExec(
+      executor,
+      u.wasEnabled ? `systemctl enable --now ${sq2(u.unit)} 2>/dev/null || true` : `systemctl start ${sq2(u.unit)} 2>/dev/null || true`
+    );
+  }
+  for (const c of journal.containers) {
+    await tryExec(executor, `docker update --restart=${sq2(c.restart)} ${sq2(c.name)} 2>/dev/null || true`);
+    await tryExec(executor, `docker start ${sq2(c.name)} 2>/dev/null || true`);
+  }
+  for (const p of journal.processes ?? []) {
+    if (p.command) {
+      await tryExec(
+        executor,
+        `setsid -f sh -c ${sq2(p.command)} 2>/dev/null || (nohup sh -c ${sq2(p.command)} >/dev/null 2>&1 &) || true`
+      );
+    } else {
+      onLog(log2(`Could not restore process ${p.pid} \u2014 no command captured.`, "warn"));
+    }
+  }
+  const restored = await portIsServed(executor, 80);
+  if (!restored) {
+    onLog(
+      log2(
+        "Nothing is listening on :80 after the restore \u2014 the box is NOT serving. Start your proxy by hand (e.g. `systemctl start nginx`, or `docker start <name>`).",
+        "error"
+      )
+    );
+  }
+  return restored;
+}
+async function portIsServed(executor, port) {
+  const hex = port.toString(16).toUpperCase().padStart(4, "0");
+  const out = await tryExec(
+    executor,
+    `(command -v ss >/dev/null 2>&1 && ss -ltn 2>/dev/null | grep -qE ':${port}[[:space:]]' && echo yes) || (grep -qiE '^[[:space:]]*[0-9]+:[[:space:]]*[0-9A-F]{8}:${hex}[[:space:]]+[0-9A-F]{8}:0000[[:space:]]+0A' /proc/net/tcp 2>/dev/null && echo yes) || true`
+  );
+  return (out ?? "").includes("yes");
+}
+async function beginEdgeTakeover(executor, status, onLog, targets) {
+  await writeJournal(executor, await buildJournal(executor, status));
+  return freeEdgeTargets(
+    executor,
+    targets?.length ? targets : stopTargetsForStatus(status),
+    (m, l) => onLog(log2(m, l))
+  );
+}
+async function rollbackEdgeTakeover(executor, onLog) {
+  const journal = await readJournal(executor);
+  if (!journal || journal.completed) return false;
+  const restored = await rollback(executor, journal, onLog);
+  await clearJournal(executor);
+  return restored;
+}
+async function completeEdgeTakeover(executor) {
+  const journal = await readJournal(executor);
+  if (journal) {
+    journal.completed = true;
+    await writeJournal(executor, journal);
+  }
+  await clearJournal(executor);
+}
+async function recoverInterruptedTakeover(executor, onLog, isEdgeHealthy) {
+  const journal = await readJournal(executor);
+  if (!journal) return;
+  if (journal.completed) {
+    await clearJournal(executor);
+    return;
+  }
+  if (isEdgeHealthy && await isEdgeHealthy()) {
+    onLog(log2("Found an unfinished edge takeover, but our edge is serving \u2014 keeping it.", "warn"));
+    await clearJournal(executor);
+    return;
+  }
+  onLog(log2("Found an interrupted edge takeover \u2014 restoring the previous proxy.", "warn"));
+  await rollback(executor, journal, onLog);
+  await clearJournal(executor);
+}
 
 // ../../packages/adapters/src/system/proxy/import/parse-utils.ts
-async function tryExec(executor, command) {
+async function tryExec2(executor, command) {
   try {
     return await executor.exec(command);
   } catch {
@@ -59,7 +268,21 @@ async function tryExec(executor, command) {
   }
 }
 function stripComments(text) {
-  return text.replace(/#.*$/gm, "");
+  return text.split("\n").map((line) => {
+    let quote;
+    for (let i = 0; i < line.length; i++) {
+      const ch = line[i];
+      if (quote) {
+        if (ch === "\\") i++;
+        else if (ch === quote) quote = void 0;
+      } else if (ch === '"' || ch === "'") {
+        quote = ch;
+      } else if (ch === "#") {
+        return line.slice(0, i);
+      }
+    }
+    return line;
+  }).join("\n");
 }
 function extractBlocks(text, keyword) {
   const blocks = [];
@@ -82,15 +305,40 @@ function extractBlocks(text, keyword) {
   }
   return blocks;
 }
+function collapseByHost(items, hostsOf, score) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const item of items) {
+    const key = [...hostsOf(item)].sort().join(" ");
+    const bag = groups.get(key);
+    if (bag) bag.push(item);
+    else groups.set(key, [item]);
+  }
+  const kept = [];
+  const dropped = [];
+  for (const bag of groups.values()) {
+    let winner = bag[0];
+    for (const cand of bag) if (score(cand) > score(winner)) winner = cand;
+    kept.push(winner);
+    for (const loser of bag) if (loser !== winner) dropped.push(loser);
+  }
+  return { kept, dropped };
+}
 function sq3(value) {
   return `'${value.replace(/'/g, "'\\''")}'`;
 }
 
 // ../../packages/adapters/src/system/proxy/import/nginx.ts
+async function dumpResolvedConfig(executor, bins) {
+  for (const bin of bins) {
+    const dumped = await tryExec2(executor, `${bin} -T 2>/dev/null`);
+    if (dumped && /server\s*\{/.test(dumped)) return dumped;
+  }
+  return null;
+}
 async function loadNginxConfig(executor) {
-  const dumped = await tryExec(executor, "nginx -T 2>/dev/null");
-  if (dumped && /server\s*\{/.test(dumped)) return dumped;
-  const cat = await tryExec(
+  const dumped = await dumpResolvedConfig(executor, ["nginx", "openresty"]);
+  if (dumped) return dumped;
+  const cat = await tryExec2(
     executor,
     "cat /etc/nginx/nginx.conf /etc/nginx/sites-enabled/* /etc/nginx/conf.d/*.conf 2>/dev/null"
   );
@@ -122,10 +370,13 @@ function resolveProxyTarget(proxyPass, upstreams) {
   const host = authority.replace(/:\d+$/, "");
   if (upstreams.has(host)) return { url: `${scheme}${upstreams.get(host)}` };
   const isIp = /^\d{1,3}(\.\d{1,3}){3}$/.test(host);
-  if (isIp || host === "localhost" || host.includes(".")) return { url: raw };
+  if (host === "localhost" || host === "ip6-localhost") {
+    return { url: raw.replace(/^(https?:\/\/)[^/:]+/i, "$1127.0.0.1") };
+  }
+  if (isIp || host.includes(".")) return { url: raw };
   return { reason: `proxy_pass host "${host}" is an undeclared upstream \u2014 not migratable` };
 }
-function extractLocationProxies(serverBody) {
+function locationBlocks(serverBody) {
   const out = [];
   const re = /(?:^|[\s;}])location\s+([^{]+?)\s*\{/g;
   let m;
@@ -139,13 +390,26 @@ function extractLocationProxies(serverBody) {
       else if (serverBody[i] === "}") depth--;
     }
     if (depth !== 0) break;
-    const locBody = serverBody.slice(openIdx + 1, i - 1);
+    out.push({ path, body: serverBody.slice(openIdx + 1, i - 1) });
     re.lastIndex = i;
-    const pp = firstDirective(locBody, "proxy_pass");
-    if (pp) out.push({ path, proxyPass: pp });
   }
   return out;
 }
+function extractLocationProxies(serverBody) {
+  const out = [];
+  for (const loc of locationBlocks(serverBody)) {
+    const pp = firstDirective(loc.body, "proxy_pass");
+    if (pp) out.push({ path: loc.path, proxyPass: pp });
+  }
+  return out;
+}
+function withoutQuotedValues(body) {
+  return body.replace(/'[^'\n]*'/g, "''").replace(/"[^"\n]*"/g, '""');
+}
+var SERVING_DIRECTIVE_RE = /(?:^|[;{}\s])(?:proxy_pass|root|alias|fastcgi_pass|uwsgi_pass|scgi_pass|grpc_pass)\s/;
+function servesNothing(locationBody) {
+  return !SERVING_DIRECTIVE_RE.test(withoutQuotedValues(locationBody));
+}
 function isHttpsUpgradeForSelf(body, names) {
   const targets = [
     ...body.matchAll(/(?:^|[\s;{])return\s+30[1-8]\s+([^;]+);/g),
@@ -160,6 +424,32 @@ function isHttpsUpgradeForSelf(body, names) {
     return names.includes(host);
   });
 }
+var CHALLENGE_LOCATION_RE = /\.well-known\/(acme-challenge|oblien-proxy-challenge)/i;
+function isAcmeWebrootOnly(body) {
+  const locations = locationBlocks(body);
+  if (locations.length === 0) {
+    const root = firstDirective(body, "root") ?? "";
+    return /letsencrypt|acme|certbot/i.test(root);
+  }
+  if (!locations.some((l) => CHALLENGE_LOCATION_RE.test(l.path))) return false;
+  return locations.every((l) => CHALLENGE_LOCATION_RE.test(l.path) || servesNothing(l.body));
+}
+function parseProxyDirectives(body) {
+  const raw = {};
+  const candidate = {};
+  for (const spec of PROXY_DIRECTIVES) {
+    const found = firstDirective(body, spec.directive);
+    if (found === void 0) continue;
+    raw[spec.key] = found;
+    const parsed = parseProxyValue(spec, found);
+    if (parsed !== void 0) candidate[spec.key] = parsed;
+  }
+  const settings = sanitizeProxySettings(candidate);
+  return {
+    ...settings ? { settings } : {},
+    ...Object.keys(raw).length > 0 ? { raw } : {}
+  };
+}
 function parseServer(body, source, upstreams) {
   const warnings = [];
   const names = firstDirective(body, "server_name")?.split(/\s+/).filter((n) => n && n !== "_" && !n.startsWith("~")) ?? [];
@@ -186,10 +476,12 @@ function parseServer(body, source, upstreams) {
     const primary = resolved.find((r) => r.path === "/") ?? resolved[0];
     target = { kind: "proxy", url: primary.url };
     routes = resolved;
-  } else if (root) {
-    target = { kind: "static", root: root.replace(/;$/, "") };
   } else if (isHttpsUpgradeForSelf(body, names)) {
     return { warnings: [] };
+  } else if (root && !isAcmeWebrootOnly(body)) {
+    target = { kind: "static", root: root.replace(/;$/, "") };
+  } else if (root) {
+    return { warnings: [] };
   } else {
     warnings.push(`nginx: ${names[0]} has neither proxy_pass nor root \u2014 skipped (${source})`);
     return { warnings };
@@ -197,6 +489,9 @@ function parseServer(body, source, upstreams) {
   const site = { serverNames: names, ssl, target, source };
   if (routes) site.routes = routes;
   if (certPath && keyPath) site.tls = { certPath, keyPath };
+  const tunables = parseProxyDirectives(body);
+  if (tunables.settings) site.proxy = tunables.settings;
+  if (tunables.raw) site.proxyRaw = tunables.raw;
   return { site, warnings };
 }
 function parseNginxConfig(raw) {
@@ -216,7 +511,12 @@ function parseNginxConfig(raw) {
     warnings.push(...blockWarnings);
     if (site) sites.push(site);
   }
-  return { proxy: "nginx", sites, warnings };
+  const { kept } = collapseByHost(
+    sites,
+    (s) => s.serverNames,
+    (s) => (s.ssl ? 2 : 0) + (s.target.kind === "proxy" ? 1 : 0)
+  );
+  return { proxy: "nginx", sites: kept, warnings };
 }
 async function scanNginx(executor) {
   return parseNginxConfig(await loadNginxConfig(executor));
@@ -226,42 +526,90 @@ var OUR_EDGE_SITE_GLOBS = [
   `${OPENRESTY_DEFAULT_PATHS.sitesDir}/*.conf`,
   "/etc/openresty/sites-enabled/*.conf"
 ];
+async function scanForeignOpenResty(executor) {
+  const dump = await dumpResolvedConfig(executor, ["openresty"]);
+  if (dump) return parseNginxConfig(dump);
+  return scanOpenshipEdge(executor);
+}
 async function scanOpenshipEdge(executor) {
   const cat = `cat ${OUR_EDGE_SITE_GLOBS.join(" ")} 2>/dev/null`;
-  const raw = await tryExec(executor, cat);
+  const raw = await tryExec2(executor, cat);
   if (raw?.trim()) return parseNginxConfig(raw);
   const container = await resolveOurEdgeContainer(executor);
   if (!container) return parseNginxConfig("");
-  const fromContainer = await tryExec(executor, containerCommand(container, cat));
+  const fromContainer = await tryExec2(executor, containerCommand(container, cat));
   return parseNginxConfig(fromContainer ?? "");
 }
 
 // ../../packages/adapters/src/system/proxy/import/caddy.ts
 var CADDYFILE_PATHS = ["/etc/caddy/Caddyfile", "/etc/Caddyfile"];
+async function loadCaddyAdminConfig(executor) {
+  const endpoint = "http://localhost:2019/config/";
+  const out = await tryExec2(executor, `curl -fsS ${endpoint} 2>/dev/null`) || await tryExec2(executor, `wget -qO- ${endpoint} 2>/dev/null`);
+  return out && out.trim().startsWith("{") ? out : null;
+}
 async function loadCaddyJson(executor) {
   for (const p of CADDYFILE_PATHS) {
-    const out = await tryExec(executor, `caddy adapt --adapter caddyfile --config ${p} 2>/dev/null`);
+    const out = await tryExec2(executor, `caddy adapt --adapter caddyfile --config ${p} 2>/dev/null`);
     if (out && out.trim().startsWith("{")) return out;
   }
   return null;
 }
-function flattenHandlers(handlers, out = []) {
+function flattenHandlers(handlers, scoped = false, out = []) {
   for (const h of handlers ?? []) {
     if (h.handler === "subroute") {
-      for (const r of h.routes ?? []) flattenHandlers(r.handle, out);
+      for (const r of h.routes ?? []) {
+        flattenHandlers(r.handle, scoped || (r.match?.length ?? 0) > 0, out);
+      }
     } else {
-      out.push(h);
+      out.push({ h, scoped });
     }
   }
   return out;
 }
+var UNMIGRATABLE_HANDLERS = {
+  php_fastcgi: "a PHP-FPM site (php_fastcgi)",
+  fastcgi: "a FastCGI backend",
+  static_response: "a static inline response (respond)",
+  templates: "Caddy templates",
+  encode: "",
+  headers: "",
+  authentication: "Caddy authentication",
+  rewrite: "",
+  acme_server: "an embedded ACME server"
+};
 function targetFromRoute(route) {
   const flat = flattenHandlers(route.handle);
-  const dial = flat.find((h) => h.handler === "reverse_proxy")?.upstreams?.find((u) => u.dial)?.dial;
-  if (dial) return { kind: "proxy", url: /^https?:\/\//.test(dial) ? dial : `http://${dial}` };
-  const root = flat.find((h) => h.handler === "vars" && typeof h.root === "string")?.root;
-  if (root && flat.some((h) => h.handler === "file_server")) return { kind: "static", root };
-  return null;
+  const proxies = flat.filter((f) => f.h.handler === "reverse_proxy");
+  const chosen = proxies.find((f) => !f.scoped) ?? proxies[0];
+  const proxy = chosen?.h;
+  if (proxy?.transport?.protocol === "fastcgi") {
+    return { note: "serves a PHP-FPM/FastCGI site (php_fastcgi) \u2014 not an HTTP upstream" };
+  }
+  const pathScopedOnly = Boolean(chosen?.scoped);
+  const hasScopedSibling = proxies.some((f) => f.scoped);
+  const dials = (proxy?.upstreams ?? []).map((u) => u.dial).filter((d) => Boolean(d));
+  if (dials.length > 0) {
+    const dial = dials[0];
+    if (/^unix\//i.test(dial)) {
+      return { note: `proxies to the unix socket "${dial}", which needs a manual upstream` };
+    }
+    return {
+      target: { kind: "proxy", url: /^https?:\/\//.test(dial) ? dial : `http://${dial}` },
+      extraUpstreams: dials.length - 1,
+      pathScopedOnly,
+      hasScopedSibling
+    };
+  }
+  const root = flat.find((f) => f.h.handler === "vars" && typeof f.h.root === "string")?.h.root;
+  if (root && flat.some((f) => f.h.handler === "file_server")) {
+    return { target: { kind: "static", root } };
+  }
+  for (const { h } of flat) {
+    const label = h.handler ? UNMIGRATABLE_HANDLERS[h.handler] : void 0;
+    if (label) return { note: `serves ${label}` };
+  }
+  return {};
 }
 function parseCaddyJson(raw) {
   let cfg;
@@ -273,21 +621,51 @@ function parseCaddyJson(raw) {
   const servers = cfg.apps?.http?.servers;
   if (!servers) return null;
   const sites = [];
+  const warnings = [];
   for (const srv of Object.values(servers)) {
     const ssl = (srv.listen ?? []).some((l) => l.endsWith(":443"));
     for (const route of srv.routes ?? []) {
       const hosts = (route.match ?? []).flatMap((m) => m.host ?? []).filter((h) => h && h !== "*");
       if (hosts.length === 0) continue;
-      const target = targetFromRoute(route);
-      if (!target) continue;
-      sites.push({ serverNames: hosts, ssl, target, source: "caddy (adapt)" });
+      const outcome = targetFromRoute(route);
+      if (outcome.note) {
+        warnings.push(`caddy: ${hosts.join(", ")} ${outcome.note} \u2014 re-add it manually`);
+        continue;
+      }
+      if (!outcome.target) continue;
+      if (outcome.extraUpstreams) {
+        warnings.push(
+          `caddy: ${hosts.join(", ")} load-balances across ${outcome.extraUpstreams + 1} upstreams \u2014 only the first is migrated`
+        );
+      }
+      if (outcome.hasScopedSibling || (route.match ?? []).some((m) => m.path?.length)) {
+        warnings.push(
+          `caddy: ${hosts.join(", ")} routes some paths to other upstreams \u2014 only the catch-all is migrated; re-add path rules manually`
+        );
+      }
+      if (outcome.pathScopedOnly) {
+        warnings.push(
+          `caddy: ${hosts.join(", ")} has no catch-all upstream \u2014 used its path-scoped one; verify the target`
+        );
+      }
+      sites.push({ serverNames: hosts, ssl, target: outcome.target, source: "caddy (adapt)" });
     }
   }
-  return { sites, warnings: [] };
+  const { kept, dropped } = collapseByHost(
+    sites,
+    (s) => s.serverNames,
+    (s) => s.ssl ? 1 : 0
+  );
+  for (const d of dropped) {
+    warnings.push(
+      `caddy: ${d.serverNames.join(", ")} had a second (non-TLS) block \u2014 kept the TLS one`
+    );
+  }
+  return { sites: kept, warnings };
 }
 async function loadCaddyfile(executor) {
   for (const p of CADDYFILE_PATHS) {
-    const out = await tryExec(executor, `cat ${p} 2>/dev/null`);
+    const out = await tryExec2(executor, `cat ${p} 2>/dev/null`);
     if (out && out.trim()) return out;
   }
   return "";
@@ -324,10 +702,11 @@ function parseAddresses(header) {
   }).filter((a) => a.host && !a.host.startsWith(":") && a.host !== "*");
 }
 async function scanCaddy(executor) {
-  const json = await loadCaddyJson(executor);
-  if (json) {
+  for (const load of [loadCaddyAdminConfig, loadCaddyJson]) {
+    const json = await load(executor);
+    if (!json) continue;
     const parsed = parseCaddyJson(json);
-    if (parsed && parsed.sites.length > 0) {
+    if (parsed && (parsed.sites.length > 0 || parsed.warnings.length > 0)) {
       return { proxy: "caddy", sites: parsed.sites, warnings: parsed.warnings };
     }
   }
@@ -357,19 +736,44 @@ async function scanCaddyText(executor) {
       warnings.push(`caddy: skipped a block with no usable address (${header.slice(0, 40)})`);
       continue;
     }
-    const proxyMatch = body.match(/(?:^|\s)reverse_proxy\s+([^\n{]+)/);
+    const inlineProxy = body.match(/(?:^|\s)reverse_proxy\s+([^\n{]+)/);
+    const blockProxy = body.match(/(?:^|\s)reverse_proxy\s*\{([\s\S]*?)\}/);
+    const blockTo = blockProxy?.[1].match(/(?:^|\n)\s*to\s+([^\n]+)/);
     const rootMatch = body.match(/(?:^|\s)root\s+\*?\s*([^\n\s]+)/);
     const tlsMatch = body.match(/(?:^|\s)tls\s+(\S+)\s+(\S+)/);
+    const upstreams = (inlineProxy?.[1] ?? blockTo?.[1] ?? "").trim().split(/\s+/).filter(Boolean);
+    const host = addrs[0].host;
     let target;
-    if (proxyMatch) {
-      const upstream = proxyMatch[1].trim().split(/\s+/)[0];
+    if (upstreams.length > 0) {
+      const upstream = upstreams[0];
+      if (/^unix\//i.test(upstream)) {
+        warnings.push(
+          `caddy: ${host} proxies to the unix socket "${upstream}" \u2014 needs a manual upstream, skipped`
+        );
+        continue;
+      }
+      if (upstreams.length > 1) {
+        warnings.push(
+          `caddy: ${host} load-balances across ${upstreams.length} upstreams \u2014 only the first is migrated`
+        );
+      }
       target = { kind: "proxy", url: /^https?:\/\//.test(upstream) ? upstream : `http://${upstream}` };
+    } else if (/(?:^|\s)php_fastcgi\s/.test(body)) {
+      warnings.push(
+        `caddy: ${host} serves a PHP-FPM site (php_fastcgi) \u2014 not migratable as a static root; re-add it manually`
+      );
+      continue;
     } else if (rootMatch) {
       target = { kind: "static", root: rootMatch[1] };
     } else {
-      warnings.push(`caddy: ${addrs[0].host} has no reverse_proxy or root \u2014 skipped`);
+      warnings.push(`caddy: ${host} has no reverse_proxy or root \u2014 skipped`);
       continue;
     }
+    if (/(?:^|\s)(handle_path|handle)\s+\//.test(body)) {
+      warnings.push(
+        `caddy: ${host} routes by path (handle/handle_path) \u2014 only one upstream is migrated; re-add path rules manually`
+      );
+    }
     const site = {
       serverNames: addrs.map((a) => a.host),
       ssl: addrs.some((a) => a.ssl),
@@ -381,12 +785,22 @@ async function scanCaddyText(executor) {
     }
     sites.push(site);
   }
-  return { proxy: "caddy", sites, warnings };
+  const { kept, dropped } = collapseByHost(
+    sites,
+    (s) => s.serverNames,
+    (s) => s.ssl ? 1 : 0
+  );
+  for (const d of dropped) {
+    warnings.push(
+      `caddy: ${d.serverNames.join(", ")} had a second (non-TLS) block \u2014 kept the TLS one`
+    );
+  }
+  return { proxy: "caddy", sites: kept, warnings };
 }
 
 // ../../packages/adapters/src/system/proxy/import/apache.ts
 async function vhostFilesFromDump(executor) {
-  const dump = await tryExec(
+  const dump = await tryExec2(
     executor,
     "apachectl -S 2>/dev/null || apache2ctl -S 2>/dev/null || httpd -S 2>/dev/null"
   );
@@ -401,42 +815,107 @@ async function vhostFilesFromDump(executor) {
 async function loadApacheConfig(executor) {
   const files = await vhostFilesFromDump(executor);
   if (files.length > 0) {
-    const cat2 = await tryExec(executor, `cat ${files.map(sq3).join(" ")} 2>/dev/null`);
+    const cat2 = await tryExec2(executor, `cat ${files.map(sq3).join(" ")} 2>/dev/null`);
     if (cat2 && cat2.trim()) return cat2;
   }
-  const cat = await tryExec(
+  const cat = await tryExec2(
     executor,
     "cat /etc/apache2/sites-enabled/*.conf /etc/apache2/apache2.conf /etc/httpd/conf.d/*.conf /etc/httpd/conf/httpd.conf 2>/dev/null"
   );
   return cat ?? "";
 }
+function unquote(value) {
+  return value.replace(/^["']|["']$/g, "");
+}
 function directive(body, name) {
   const m = body.match(new RegExp(`(?:^|\\n)\\s*${name}\\s+([^\\n]+)`, "i"));
-  return m?.[1]?.trim();
+  const value = m?.[1]?.trim();
+  return value === void 0 ? void 0 : unquote(value);
 }
 function directiveAll(body, name) {
   return [...body.matchAll(new RegExp(`(?:^|\\n)\\s*${name}\\s+([^\\n]+)`, "gi"))].map(
     (m) => m[1].trim()
   );
 }
+function isHttpsRedirectOnly(body) {
+  const hasProxy = /(?:^|\n)\s*ProxyPass\s+\S+\s+(?!!)\S/i.test(body);
+  if (hasProxy) return false;
+  const redirects = [
+    ...body.matchAll(/(?:^|\n)\s*Redirect(?:Permanent|Match)?\s+(?:\d{3}\s+|permanent\s+|temp\s+)?\S*\s*(\S+)/gi),
+    ...body.matchAll(/(?:^|\n)\s*RewriteRule\s+\S+\s+(\S+)\s*\[[^\]]*R=?3\d\d[^\]]*\]/gi)
+  ].map((m) => m[1]);
+  return redirects.length > 0 && redirects.some((t) => /^https:\/\//i.test(t));
+}
+function hostOnly(name) {
+  return unquote(name.trim()).replace(/^https?:\/\//i, "").replace(/:\d+$/, "");
+}
+function proxyRoutes(body) {
+  const routes = [];
+  const scopes = [];
+  let regexScoped = false;
+  for (const line of body.split("\n")) {
+    const open = line.match(/^\s*<Location(Match)?\s+([^>]*)>/i);
+    if (open) {
+      const regex = Boolean(open[1]);
+      const arg = unquote(open[2].trim());
+      scopes.push({ path: !regex && arg.startsWith("/") ? arg : null, regex });
+      continue;
+    }
+    if (/^\s*<\/Location(?:Match)?\s*>/i.test(line)) {
+      scopes.pop();
+      continue;
+    }
+    const m = line.match(/^\s*ProxyPass\s+(\S+)(?:\s+(\S+))?/i);
+    if (!m) continue;
+    const first = unquote(m[1]);
+    if (first.startsWith("/")) {
+      routes.push({ path: first, url: m[2] ? unquote(m[2]) : "" });
+      continue;
+    }
+    const scope = scopes[scopes.length - 1];
+    if (scope?.path) routes.push({ path: scope.path, url: first });
+    else if (scope?.regex) regexScoped = true;
+  }
+  return { routes, regexScoped };
+}
 function parseVhost(body, portHint) {
   const serverName = directive(body, "ServerName")?.split(/\s+/)[0];
   const aliases = directiveAll(body, "ServerAlias").flatMap((line) => line.split(/\s+/));
-  const names = [serverName, ...aliases].filter((n) => Boolean(n));
+  const names = [serverName, ...aliases].filter((n) => Boolean(n)).map(hostOnly).filter(Boolean);
   if (names.length === 0) {
     return { warning: "apache: skipped a VirtualHost with no ServerName" };
   }
-  const routes = [...body.matchAll(/(?:^|\n)\s*ProxyPass\s+(\S+)\s+(\S+)/gi)].map((m) => ({ path: m[1], url: m[2] })).filter((p) => p.url && p.url !== "!");
-  const docRoot = directive(body, "DocumentRoot")?.replace(/^["']|["']$/g, "");
+  if (isHttpsRedirectOnly(body)) return null;
+  const proxy = proxyRoutes(body);
+  const routes = proxy.routes.filter((p) => p.url && p.url !== "!");
+  const docRoot = directive(body, "DocumentRoot");
+  const fcgiMatch = /(?:^|\n)\s*ProxyPassMatch\s+[^\n]*(fcgi:|php-fpm|php\d*-fpm|\.sock)/i.test(body);
   const certPath = directive(body, "SSLCertificateFile");
   const keyPath = directive(body, "SSLCertificateKeyFile");
   const ssl = /:443/.test(portHint) || /SSLEngine\s+on/i.test(body) || Boolean(certPath);
   let target;
   if (routes.length > 0) {
     const primary = routes.find((r) => r.path === "/") ?? routes[0];
+    if (/^balancer:\/\//i.test(primary.url)) {
+      return {
+        warning: `apache: ${names[0]} proxies to an mod_proxy_balancer cluster (${primary.url}) \u2014 re-add its members manually`
+      };
+    }
     target = { kind: "proxy", url: primary.url };
+  } else if (fcgiMatch) {
+    return {
+      warning: `apache: ${names[0]} is a PHP-FPM site (ProxyPassMatch \u2192 FastCGI) \u2014 not migratable as a static root; re-add it manually`
+    };
   } else if (docRoot) {
     target = { kind: "static", root: docRoot };
+  } else if (/(?:^|\n)\s*ProxyPassMatch\s/i.test(body)) {
+    return {
+      warning: `apache: ${names[0]} uses ProxyPassMatch (regex proxying) \u2014 re-add it manually`
+    };
+  } else if (proxy.regexScoped) {
+    return {
+      warning: `apache: ${names[0]} proxies from inside a <LocationMatch> (regex proxying) \u2014 re-add it manually`
+    };
   } else {
     return { warning: `apache: ${names[0]} has neither ProxyPass nor DocumentRoot \u2014 skipped` };
   }
@@ -445,6 +924,11 @@ function parseVhost(body, portHint) {
   if (certPath && keyPath) site.tls = { certPath, keyPath };
   return site;
 }
+function redirectVhostNames(body) {
+  const serverName = directive(body, "ServerName")?.split(/\s+/)[0];
+  const aliases = directiveAll(body, "ServerAlias").flatMap((l) => l.split(/\s+/));
+  return [serverName, ...aliases].filter((n) => Boolean(n)).map(hostOnly).filter(Boolean);
+}
 function vhostBlocks(text) {
   const out = [];
   const re = /<VirtualHost([^>]*)>([\s\S]*?)<\/VirtualHost>/gi;
@@ -464,15 +948,44 @@ async function scanApache(executor) {
   const text = stripComments(raw);
   const blocks = vhostBlocks(text);
   if (blocks.length === 0) warnings.push("apache: no <VirtualHost> blocks found");
+  const redirectOnlyHosts = [];
   for (const { args, body } of blocks) {
     const parsed = parseVhost(body, args);
+    if (parsed === null) {
+      redirectOnlyHosts.push(redirectVhostNames(body));
+      continue;
+    }
     if ("warning" in parsed) warnings.push(parsed.warning);
     else sites.push(parsed);
   }
-  return { proxy: "apache", sites, warnings };
+  const served = new Set(sites.flatMap((s) => s.serverNames));
+  for (const names of redirectOnlyHosts) {
+    const orphaned = names.filter((n) => !served.has(n));
+    if (orphaned.length > 0) {
+      warnings.push(
+        `apache: ${orphaned.join(", ")} only redirected to HTTPS and has no TLS VirtualHost here \u2014 nothing to serve it after migration`
+      );
+    }
+  }
+  const { kept, dropped } = collapseByHost(
+    sites,
+    (s) => s.serverNames,
+    (s) => (s.ssl ? 2 : 0) + (s.target.kind === "proxy" ? 1 : 0)
+  );
+  for (const d of dropped) {
+    warnings.push(
+      `apache: ${d.serverNames.join(", ")} had a second VirtualHost (${d.ssl ? "TLS" : "plain HTTP"}, ${d.target.kind}) \u2014 kept the TLS/proxy one`
+    );
+  }
+  return { proxy: "apache", sites: kept, warnings };
 }
 
 // ../../packages/adapters/src/system/proxy/import/traefik.ts
+function lowerKeys(labels) {
+  const out = {};
+  for (const [k, v] of Object.entries(labels)) out[k.toLowerCase()] = v;
+  return out;
+}
 function extractHosts(rule) {
   const hosts = [];
   for (const call of rule.matchAll(/\bHost\(([^)]*)\)/gi)) {
@@ -481,7 +994,7 @@ function extractHosts(rule) {
       if (h) hosts.push(h);
     }
   }
-  return hosts;
+  return [...new Set(hosts)];
 }
 function extraMatchers(rule) {
   const found = /* @__PURE__ */ new Set();
@@ -492,23 +1005,59 @@ function extraMatchers(rule) {
   }
   return [...found];
 }
+function collectDefinitions(containers) {
+  const services = /* @__PURE__ */ new Map();
+  const redirectMiddlewares = /* @__PURE__ */ new Set();
+  const streamRouters = [];
+  let fileProvider = false;
+  let exposedByDefault = true;
+  for (const c of containers) {
+    const labels = lowerKeys(c.labels);
+    for (const [k, v] of Object.entries(labels)) {
+      let m = k.match(/^traefik\.http\.services\.([^.]+)\.loadbalancer\.server\.(port|scheme)$/);
+      if (m) {
+        const def = services.get(m[1]) ?? {};
+        if (m[2] === "port") def.port = v;
+        else def.scheme = v;
+        services.set(m[1], def);
+        continue;
+      }
+      m = k.match(/^traefik\.http\.middlewares\.([^.]+)\.redirectscheme\./);
+      if (m) {
+        redirectMiddlewares.add(m[1]);
+        continue;
+      }
+      m = k.match(/^traefik\.(tcp|udp)\.routers\.([^.]+)\.rule$/);
+      if (m) streamRouters.push(`${m[1]} router "${m[2]}"`);
+    }
+    const cmd = c.cmd ?? "";
+    if (/--?providers\.file/i.test(cmd)) fileProvider = true;
+    if (/--?providers\.docker\.exposedbydefault[= ]?false/i.test(cmd)) exposedByDefault = false;
+  }
+  return { services, redirectMiddlewares, streamRouters, fileProvider, exposedByDefault };
+}
+function resolveIp(c, labels) {
+  const wanted = labels["traefik.docker.network"];
+  if (wanted && c.networks?.[wanted]) return c.networks[wanted];
+  if (c.ip) return c.ip;
+  const first = Object.values(c.networks ?? {}).find(Boolean);
+  return first || void 0;
+}
 function parseTraefikLabels(containers) {
-  const sites = [];
   const warnings = [];
+  const defs = collectDefinitions(containers);
+  const candidates = [];
   for (const c of containers) {
-    if (c.labels["traefik.enable"] === "false") continue;
+    const labels = lowerKeys(c.labels);
+    if (labels["traefik.enable"] === "false") continue;
+    if (!defs.exposedByDefault && labels["traefik.enable"] !== "true") continue;
     const routers = /* @__PURE__ */ new Map();
-    const servicePorts = /* @__PURE__ */ new Map();
-    for (const [key, val] of Object.entries(c.labels)) {
+    for (const [key, val] of Object.entries(labels)) {
       const r = key.match(/^traefik\.http\.routers\.([^.]+)\.(.+)$/);
-      if (r) {
-        const bag = routers.get(r[1]) ?? {};
-        bag[r[2]] = val;
-        routers.set(r[1], bag);
-        continue;
-      }
-      const s = key.match(/^traefik\.http\.services\.([^.]+)\.loadbalancer\.server\.port$/);
-      if (s) servicePorts.set(s[1], val);
+      if (!r) continue;
+      const bag = routers.get(r[1]) ?? {};
+      bag[r[2]] = val;
+      routers.set(r[1], bag);
     }
     for (const [rname, props] of routers) {
       const rule = props.rule;
@@ -520,47 +1069,92 @@ function parseTraefikLabels(containers) {
         );
         continue;
       }
-      if (!c.ip) {
+      const ip = resolveIp(c, labels);
+      if (!ip) {
         warnings.push(
           `traefik: ${hosts.join(", ")} \u2014 couldn't resolve container ${c.name}'s IP; re-add the upstream manually`
         );
-        continue;
-      }
-      const svc = props.service;
-      const rawPort = (svc && servicePorts.get(svc)) ?? (servicePorts.size === 1 ? [...servicePorts.values()][0] : void 0) ?? "80";
-      const port = /^\d{1,5}$/.test(String(rawPort)) ? String(rawPort) : "80";
-      const url = `http://${c.ip}:${port}`;
-      const extras = extraMatchers(rule);
-      if (extras.length > 0) {
-        warnings.push(
-          `traefik: ${hosts.join(", ")} also matches ${extras.join(", ")} \u2014 only the Host() part is migrated; re-add path/header rules manually`
-        );
-      }
-      if (props.middlewares) {
-        warnings.push(`traefik: ${hosts.join(", ")} uses middleware(s) "${props.middlewares}" \u2014 not migrated`);
+        continue;
       }
-      const ssl = Object.keys(props).some((p) => p === "tls" || p.startsWith("tls."));
-      sites.push({
-        serverNames: hosts,
-        ssl,
-        target: { kind: "proxy", url },
-        source: `traefik container ${c.name}`
+      const svc = props.service?.replace(/@.*$/, "");
+      const def = (svc ? defs.services.get(svc) : void 0) ?? (defs.services.size === 1 ? [...defs.services.values()][0] : void 0);
+      const onlyExposed = c.exposedPorts?.length === 1 ? c.exposedPorts[0].split("/")[0] : void 0;
+      const rawPort = def?.port ?? onlyExposed;
+      const port = /^\d{1,5}$/.test(String(rawPort)) ? String(rawPort) : "80";
+      const scheme = def?.scheme?.toLowerCase() === "https" ? "https" : "http";
+      const middlewares = (props.middlewares ?? "").split(",").map((m) => m.trim().replace(/@.*$/, "")).filter(Boolean);
+      candidates.push({
+        hosts,
+        ssl: Object.keys(props).some((p) => p === "tls" || p.startsWith("tls.")),
+        url: `${scheme}://${ip}:${port}`,
+        container: c.name,
+        router: rname,
+        rule,
+        middlewares,
+        redirectOnly: middlewares.length > 0 && middlewares.every((m) => defs.redirectMiddlewares.has(m)),
+        portGuessed: rawPort === void 0
       });
     }
   }
-  return { proxy: "traefik", sites, warnings };
+  const { kept: sites, dropped } = collapseByHost(
+    candidates,
+    (c) => c.hosts,
+    (c) => c.redirectOnly ? 0 : c.ssl ? 2 : 1
+  );
+  for (const cand of sites) {
+    const extras = extraMatchers(cand.rule);
+    if (extras.length > 0) {
+      warnings.push(
+        `traefik: ${cand.hosts.join(", ")} also matches ${extras.join(", ")} \u2014 only the Host() part is migrated; re-add path/header rules manually`
+      );
+    }
+    const carried = cand.middlewares.filter((m) => !defs.redirectMiddlewares.has(m));
+    if (carried.length > 0) {
+      warnings.push(
+        `traefik: ${cand.hosts.join(", ")} uses middleware(s) "${carried.join(", ")}" \u2014 not migrated`
+      );
+    }
+    if (cand.portGuessed) {
+      warnings.push(
+        `traefik: ${cand.hosts.join(", ")} \u2014 no service port label and no single exposed port on ${cand.container}; assumed :80, check the upstream`
+      );
+    }
+  }
+  for (const d of dropped) {
+    warnings.push(
+      `traefik: ${d.hosts.join(", ")} router "${d.router}" is an http\u2192https redirect \u2014 Openship's edge does that itself (nothing to migrate)`
+    );
+  }
+  for (const s of defs.streamRouters) {
+    warnings.push(`traefik: ${s} can't migrate \u2014 Openship's edge routes HTTP(S), not raw TCP/UDP`);
+  }
+  if (defs.fileProvider) {
+    warnings.push(
+      "traefik: a file provider is configured \u2014 routes defined in its YAML/TOML files are NOT read here, only container labels. Re-add those domains manually."
+    );
+  }
+  return {
+    proxy: "traefik",
+    sites: sites.map((cand) => ({
+      serverNames: cand.hosts,
+      ssl: cand.ssl,
+      target: { kind: "proxy", url: cand.url },
+      source: `traefik container ${cand.container}`
+    })),
+    warnings
+  };
 }
 async function scanTraefik(executor) {
-  const out = await tryExec(
+  const out = await tryExec2(
     executor,
-    "docker ps -q 2>/dev/null | xargs -r docker inspect --format '{{.Name}}	{{json .Config.Labels}}	{{range .NetworkSettings.Networks}}{{.IPAddress}} {{end}}' 2>/dev/null"
+    `docker ps -q 2>/dev/null | xargs -r docker inspect --format '{{.Name}}	{{json .Config.Labels}}	{{range $n, $v := .NetworkSettings.Networks}}{{$n}}={{$v.IPAddress}} {{end}}	{{range $p, $v := .Config.ExposedPorts}}{{$p}} {{end}}	{{if .Config.Cmd}}{{join .Config.Cmd " "}}{{end}}' 2>/dev/null`
   );
   if (!out) {
     return { proxy: "traefik", sites: [], warnings: ["traefik: couldn't read container labels via docker inspect"] };
   }
   const containers = [];
   for (const line of out.split("\n")) {
-    const [rawName, rawLabels, rawIps] = line.split("	");
+    const [rawName, rawLabels, rawNets, rawPorts, rawCmd] = line.split("	");
     if (!rawName || !rawLabels) continue;
     let labels;
     try {
@@ -568,9 +1162,30 @@ async function scanTraefik(executor) {
     } catch {
       continue;
     }
-    if (!Object.keys(labels).some((k) => k.startsWith("traefik."))) continue;
-    const ip = (rawIps ?? "").trim().split(/\s+/)[0] || void 0;
-    containers.push({ name: rawName.replace(/^\//, ""), labels, ip });
+    const networks = {};
+    let bareIp;
+    for (const pair of (rawNets ?? "").trim().split(/\s+/)) {
+      if (!pair) continue;
+      const eq = pair.indexOf("=");
+      if (eq > 0) {
+        const ip = pair.slice(eq + 1);
+        if (ip) networks[pair.slice(0, eq)] = ip;
+      } else if (!bareIp) {
+        bareIp = pair;
+      }
+    }
+    const exposedPorts = (rawPorts ?? "").trim().split(/\s+/).filter(Boolean);
+    const hasTraefikLabels = Object.keys(labels).some((k) => k.toLowerCase().startsWith("traefik."));
+    const looksLikeTraefik = /traefik/i.test(rawCmd ?? "") || /--?providers\./i.test(rawCmd ?? "");
+    if (!hasTraefikLabels && !looksLikeTraefik) continue;
+    containers.push({
+      name: rawName.replace(/^\//, ""),
+      labels,
+      ip: Object.values(networks)[0] ?? bareIp,
+      networks,
+      exposedPorts,
+      cmd: rawCmd ?? void 0
+    });
   }
   return parseTraefikLabels(containers);
 }
@@ -612,7 +1227,7 @@ async function scanImportableSites(executor, proxy) {
     case "traefik":
       return scanTraefik(executor);
     case "openresty":
-      return scanOpenshipEdge(executor);
+      return scanForeignOpenResty(executor);
     default:
       return {
         proxy,
@@ -624,6 +1239,27 @@ async function scanImportableSites(executor, proxy) {
 function canImportProxy(proxy) {
   return proxy === "nginx" || proxy === "caddy" || proxy === "apache" || proxy === "traefik" || proxy === "openresty";
 }
+function unreachableStaticRoots(sites, opts) {
+  if (!opts.containerEdge) return [];
+  const visible = EDGE_CONTAINER_MOUNTS.map((m) => m.host.replace(/\/+$/, ""));
+  const out = [];
+  for (const site of sites) {
+    if (site.target.kind !== "static") continue;
+    const root = site.target.root.replace(/\/+$/, "");
+    const reachable = visible.some((v) => root === v || root.startsWith(`${v}/`));
+    if (!reachable) out.push({ host: site.serverNames[0] ?? root, root: site.target.root });
+  }
+  return out;
+}
+var EDGE_STATIC_MOUNT = EDGE_CONTAINER_MOUNTS.find((m) => m.host === "/opt/openship/static")?.host ?? "/opt/openship/static";
+async function copyStaticRootIntoEdge(executor, opts) {
+  const slug = opts.host.replace(/[^a-zA-Z0-9._-]/g, "-").replace(/^-+|-+$/g, "").toLowerCase() || "site";
+  const src = opts.root.replace(/\/+$/, "");
+  const dest = `${EDGE_STATIC_MOUNT}/_adopted/${slug}`;
+  await executor.exec(`mkdir -p ${sq2(dest)}`);
+  await executor.exec(`cp -a ${sq2(`${src}/.`)} ${sq2(`${dest}/`)}`);
+  return dest;
+}
 
 // ../../packages/adapters/src/system/proxy/import/caddy-certs.ts
 var CADDY_DATA_ROOTS = [
@@ -641,10 +1277,10 @@ function candidateNames(host) {
 async function findPairIn(exec, root, host, container) {
   for (const name of candidateNames(host)) {
     const glob = `${root}/certificates/*/${name}/${name}.crt`;
-    let certPath = firstCrt(await tryExec(exec, `ls -1 ${glob} 2>/dev/null`));
+    let certPath = firstCrt(await tryExec2(exec, `ls -1 ${glob} 2>/dev/null`));
     if (!certPath && container) {
       certPath = firstCrt(
-        await tryExec(exec, containerCommand(container, `ls -1 ${glob} 2>/dev/null`))
+        await tryExec2(exec, containerCommand(container, `ls -1 ${glob} 2>/dev/null`))
       );
     }
     if (certPath) return { certPath, keyPath: certPath.replace(/\.crt$/, ".key") };
@@ -690,7 +1326,7 @@ async function candidateStoragePaths(exec, container) {
   };
   if (container) {
     collect(
-      await tryExec(
+      await tryExec2(
         exec,
         `docker inspect ${sq2(container)} --format '{{json .Config.Cmd}} {{json .Args}} {{json .Config.Env}}' 2>/dev/null`
       )
@@ -794,11 +1430,13 @@ function buildProxyRouteIndex(sites) {
             existing.ssl.keyPath = site.tls.keyPath;
           }
         }
+        if (site.proxy && (site.ssl || !existing.proxy)) existing.proxy = site.proxy;
       } else {
         list.push({
           port,
           path: up.path,
           domains: [...site.serverNames],
+          ...site.proxy ? { proxy: site.proxy } : {},
           ssl: site.ssl ? { enabled: true, certPath: site.tls?.certPath, keyPath: site.tls?.keyPath } : { enabled: false },
           source: site.source
         });
@@ -855,7 +1493,7 @@ async function edgeProxy(exec, opts = {}) {
   return makeApi(exec, kind, ours, container);
 }
 function edgeProxyFor(exec, kind, opts = {}) {
-  return makeApi(exec, kind, opts.ours ?? kind === "openresty", opts.container ?? null);
+  return makeApi(exec, kind, opts.ours ?? false, opts.container ?? null);
 }
 async function collectProxyCerts(api, sites) {
   const certPems = {};
@@ -919,147 +1557,6 @@ function makeApi(exec, kind, ours, container) {
   };
 }
 
-// ../../packages/adapters/src/system/proxy/takeover-journal.ts
-var JOURNAL_DIR = "/var/lib/openship";
-var JOURNAL_PATH = `${JOURNAL_DIR}/edge-takeover.json`;
-function log(message, level = "info") {
-  return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
-}
-async function tryExec2(executor, cmd) {
-  try {
-    return await executor.exec(cmd);
-  } catch {
-    return null;
-  }
-}
-async function buildJournal(executor, status) {
-  const units = /* @__PURE__ */ new Map();
-  const containers = /* @__PURE__ */ new Map();
-  const processes = /* @__PURE__ */ new Map();
-  for (const o of status.occupants) {
-    if (o.containerName && !containers.has(o.containerName)) {
-      const r = await tryExec2(
-        executor,
-        `docker inspect -f '{{.HostConfig.RestartPolicy.Name}}' ${sq2(o.containerName)} 2>/dev/null`
-      );
-      containers.set(o.containerName, { name: o.containerName, restart: r?.trim() || "no" });
-    } else if (o.systemdUnit && !units.has(o.systemdUnit)) {
-      const en = await tryExec2(executor, `systemctl is-enabled ${sq2(o.systemdUnit)} 2>/dev/null`);
-      units.set(o.systemdUnit, { unit: o.systemdUnit, wasEnabled: en?.trim() === "enabled" });
-    } else if (!o.containerName && !o.systemdUnit && o.pid && !processes.has(o.pid)) {
-      processes.set(o.pid, { pid: o.pid, command: o.rawCommand });
-    }
-  }
-  return {
-    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    units: [...units.values()],
-    containers: [...containers.values()],
-    processes: [...processes.values()]
-  };
-}
-async function writeJournal(executor, journal) {
-  try {
-    await executor.mkdir(JOURNAL_DIR);
-    await executor.writeFile(JOURNAL_PATH, JSON.stringify(journal, null, 2));
-  } catch {
-  }
-}
-async function clearJournal(executor) {
-  await tryExec2(executor, `rm -f ${JOURNAL_PATH}`);
-}
-async function readJournal(executor) {
-  const raw = await tryExec2(executor, `cat ${JOURNAL_PATH} 2>/dev/null`);
-  if (!raw?.trim()) return null;
-  try {
-    return JSON.parse(raw);
-  } catch {
-    await clearJournal(executor);
-    return null;
-  }
-}
-async function rollback(executor, journal, onLog) {
-  onLog(log("Rolling back \u2014 restoring the previous proxy...", "warn"));
-  await tryExec2(executor, `docker update --restart=no ${sq2(EDGE_CONTAINER_NAME)} 2>/dev/null || true`);
-  await tryExec2(executor, `docker stop ${sq2(EDGE_CONTAINER_NAME)} 2>/dev/null || true`);
-  await tryExec2(
-    executor,
-    "systemctl disable --now openresty 2>/dev/null || systemctl stop openresty 2>/dev/null || true; systemctl reset-failed openresty 2>/dev/null || true"
-  );
-  for (const u of journal.units) {
-    await tryExec2(
-      executor,
-      u.wasEnabled ? `systemctl enable --now ${sq2(u.unit)} 2>/dev/null || true` : `systemctl start ${sq2(u.unit)} 2>/dev/null || true`
-    );
-  }
-  for (const c of journal.containers) {
-    await tryExec2(executor, `docker update --restart=${sq2(c.restart)} ${sq2(c.name)} 2>/dev/null || true`);
-    await tryExec2(executor, `docker start ${sq2(c.name)} 2>/dev/null || true`);
-  }
-  for (const p of journal.processes ?? []) {
-    if (p.command) {
-      await tryExec2(
-        executor,
-        `setsid -f sh -c ${sq2(p.command)} 2>/dev/null || (nohup sh -c ${sq2(p.command)} >/dev/null 2>&1 &) || true`
-      );
-    } else {
-      onLog(log(`Could not restore process ${p.pid} \u2014 no command captured.`, "warn"));
-    }
-  }
-  const restored = await portIsServed(executor, 80);
-  if (!restored) {
-    onLog(
-      log(
-        "Nothing is listening on :80 after the restore \u2014 the box is NOT serving. Start your proxy by hand (e.g. `systemctl start nginx`, or `docker start <name>`).",
-        "error"
-      )
-    );
-  }
-  return restored;
-}
-async function portIsServed(executor, port) {
-  const hex = port.toString(16).toUpperCase().padStart(4, "0");
-  const out = await tryExec2(
-    executor,
-    `(command -v ss >/dev/null 2>&1 && ss -ltn 2>/dev/null | grep -qE ':${port}[[:space:]]' && echo yes) || (grep -qiE '^[[:space:]]*[0-9]+:[[:space:]]*[0-9A-F]{8}:${hex}[[:space:]]+[0-9A-F]{8}:0000[[:space:]]+0A' /proc/net/tcp 2>/dev/null && echo yes) || true`
-  );
-  return (out ?? "").includes("yes");
-}
-async function beginEdgeTakeover(executor, status, onLog) {
-  await writeJournal(executor, await buildJournal(executor, status));
-  await freeEdgeTargets(executor, stopTargetsForStatus(status), (m, l) => onLog(log(m, l)));
-}
-async function rollbackEdgeTakeover(executor, onLog) {
-  const journal = await readJournal(executor);
-  if (!journal || journal.completed) return false;
-  const restored = await rollback(executor, journal, onLog);
-  await clearJournal(executor);
-  return restored;
-}
-async function completeEdgeTakeover(executor) {
-  const journal = await readJournal(executor);
-  if (journal) {
-    journal.completed = true;
-    await writeJournal(executor, journal);
-  }
-  await clearJournal(executor);
-}
-async function recoverInterruptedTakeover(executor, onLog, isEdgeHealthy) {
-  const journal = await readJournal(executor);
-  if (!journal) return;
-  if (journal.completed) {
-    await clearJournal(executor);
-    return;
-  }
-  if (isEdgeHealthy && await isEdgeHealthy()) {
-    onLog(log("Found an unfinished edge takeover, but our edge is serving \u2014 keeping it.", "warn"));
-    await clearJournal(executor);
-    return;
-  }
-  onLog(log("Found an interrupted edge takeover \u2014 restoring the previous proxy.", "warn"));
-  await rollback(executor, journal, onLog);
-  await clearJournal(executor);
-}
-
 // ../../packages/adapters/src/system/catalog.ts
 function dockerInstallPlan(profile) {
   if (profile.os !== "linux") {
@@ -1117,120 +1614,15 @@ function rsyncInstallPlan(profile) {
     verifyCommand: "rsync --version | head -n 1"
   };
 }
-var OPENRESTY_APT_SOURCES = [
-  // ARM64: openresty.org publishes aarch64 debs under a SEPARATE path
-  // (openresty.org/package/arm64/<repo>); the default path is amd64-only, so on
-  // aarch64 `apt-get install openresty` finds no candidate and `set -e` aborts
-  // the whole setup (issue #109). Switch the base URL by arch and tag the deb
-  // line with `arch=` so apt fetches the right index. `dpkg --print-architecture`
-  // returns exactly amd64/arm64 (matches OpenResty's path + arch qualifier).
-  'OR_ARCH="$(dpkg --print-architecture 2>/dev/null || echo amd64)"',
-  'if [ "$OR_ARCH" = arm64 ]; then OR_BASE="http://openresty.org/package/arm64/$REPO"; else OR_BASE="http://openresty.org/package/$REPO"; fi',
-  // `|| REPO_CODENAME=""` so a failed substitution (no lsb_release AND no
-  // /etc/os-release, e.g. a stripped container) doesn't trip `set -e` before
-  // the empty-var fallback below can pick a default.
-  'REPO_CODENAME="$(lsb_release -sc 2>/dev/null || { . /etc/os-release 2>/dev/null && echo "$VERSION_CODENAME"; })" || REPO_CODENAME=""',
-  'if [ "$REPO" = debian ]; then OR_FALLBACKS="bookworm bullseye"; else OR_FALLBACKS="noble jammy focal"; fi',
-  'OR_CODENAME=""',
-  "for c in $REPO_CODENAME $OR_FALLBACKS; do",
-  '  if wget -q --spider --tries=2 --timeout=15 "$OR_BASE/dists/$c/Release"; then OR_CODENAME="$c"; break; fi',
-  "done",
-  'if [ -z "$OR_CODENAME" ]; then case "$REPO" in debian) OR_CODENAME=bookworm ;; *) OR_CODENAME=noble ;; esac; fi',
-  '[ "$OR_CODENAME" = "$REPO_CODENAME" ] || echo "[openresty] apt repo has no codename $REPO_CODENAME; using nearest supported LTS $OR_CODENAME" >&2',
-  'echo "deb [arch=$OR_ARCH signed-by=/usr/share/keyrings/openresty.gpg] $OR_BASE $OR_CODENAME main" > /etc/apt/sources.list.d/openresty.list'
-];
-function openrestyInstallPlan(profile) {
-  if (profile.os !== "linux") {
-    return {
-      supported: false,
-      unsupportedReason: "OpenResty installation is only supported on Linux servers"
-    };
-  }
-  let installCommand;
-  if (profile.packageManager === "apt") {
-    const distro = profile.distro === "debian" ? "debian" : "ubuntu";
-    installCommand = [
-      "set -e",
-      // Heal a stale/bad openresty.list left by a prior run (e.g. the #86
-      // 'resolute' pin) BEFORE the first apt-get update reads it — otherwise
-      // set -e aborts here and the repo never gets rewritten.
-      "rm -f /etc/apt/sources.list.d/openresty.list",
-      "apt-get update -qq && apt-get install -y -qq wget gnupg2 lsb-release",
-      "wget -qO /tmp/openresty-pubkey.gpg https://openresty.org/package/pubkey.gpg",
-      "gpg --yes --dearmor -o /usr/share/keyrings/openresty.gpg /tmp/openresty-pubkey.gpg",
-      `REPO=${distro}`,
-      ...OPENRESTY_APT_SOURCES,
-      "apt-get update -qq && apt-get install -y -qq openresty"
-    ].join("\n");
-  } else if (profile.packageManager === "dnf") {
-    const distro = profile.distro === "fedora" ? "fedora" : "centos";
-    installCommand = `wget -qO /etc/yum.repos.d/openresty.repo https://openresty.org/package/${distro}/openresty.repo && dnf install -y openresty`;
-  } else if (profile.packageManager === "yum") {
-    installCommand = "wget -qO /etc/yum.repos.d/openresty.repo https://openresty.org/package/centos/openresty.repo && yum install -y openresty";
-  } else if (profile.packageManager === "apk") {
-    installCommand = [
-      "apk add --no-cache wget",
-      "wget -qO /etc/apk/keys/admin@openresty.com-5ea678a6.rsa.pub https://openresty.org/package/alpine/admin@openresty.com-5ea678a6.rsa.pub",
-      `. /etc/os-release && echo "https://openresty.org/package/alpine/v$( echo $VERSION_ID | cut -d. -f1,2 )/main" >> /etc/apk/repositories`,
-      "apk update && apk add openresty"
-    ].join(" && ");
-  } else {
-    installCommand = [
-      "set -e",
-      "if command -v apt-get >/dev/null 2>&1; then",
-      "  rm -f /etc/apt/sources.list.d/openresty.list",
-      "  apt-get update -qq && apt-get install -y -qq wget gnupg2 lsb-release",
-      "  wget -qO /tmp/openresty-pubkey.gpg https://openresty.org/package/pubkey.gpg",
-      "  gpg --yes --dearmor -o /usr/share/keyrings/openresty.gpg /tmp/openresty-pubkey.gpg",
-      '  DISTRO=$(. /etc/os-release 2>/dev/null && echo "$ID" || echo "ubuntu")',
-      '  case "$DISTRO" in debian) REPO=debian ;; *) REPO=ubuntu ;; esac',
-      ...OPENRESTY_APT_SOURCES.map((l) => "  " + l),
-      "  apt-get update -qq && apt-get install -y -qq openresty",
-      "elif command -v dnf >/dev/null 2>&1; then",
-      "  wget -qO /etc/yum.repos.d/openresty.repo https://openresty.org/package/centos/openresty.repo && dnf install -y openresty",
-      "elif command -v yum >/dev/null 2>&1; then",
-      "  wget -qO /etc/yum.repos.d/openresty.repo https://openresty.org/package/centos/openresty.repo && yum install -y openresty",
-      "elif command -v apk >/dev/null 2>&1; then",
-      "  apk add --no-cache wget \\",
-      "  && wget -qO /etc/apk/keys/admin@openresty.com-5ea678a6.rsa.pub https://openresty.org/package/alpine/admin@openresty.com-5ea678a6.rsa.pub \\",
-      '  && . /etc/os-release && echo "https://openresty.org/package/alpine/v$(echo $VERSION_ID | cut -d. -f1,2)/main" >> /etc/apk/repositories \\',
-      "  && apk update && apk add openresty",
-      "else",
-      '  echo "No supported package manager found (tried apt-get, dnf, yum, apk)" >&2 && exit 1',
-      "fi"
-    ].join("\n");
-  }
-  return {
-    supported: true,
-    installCommand,
-    startCommand: profile.serviceManager === "systemd" ? "systemctl enable openresty && systemctl start openresty" : void 0,
-    verifyCommand: "openresty -v 2>&1"
-  };
-}
-function certbotInstallPlan(profile) {
-  const commands = {
-    apt: "apt-get update -qq && apt-get install -y -qq certbot",
-    dnf: "dnf install -y certbot",
-    yum: "yum install -y certbot",
-    apk: "apk add --no-cache certbot"
-  };
-  const installCommand = commands[profile.packageManager];
-  if (!installCommand) {
-    return {
-      supported: false,
-      unsupportedReason: "Certbot installation is only supported on Linux with apt, dnf, or yum"
-    };
-  }
-  return {
-    supported: true,
-    installCommand,
-    verifyCommand: "certbot --version 2>/dev/null"
-  };
-}
 var systemCatalog = {
   checks: {
     docker: {
       versionCommand: "docker --version",
+      // A POSITIVE signal, not a bare exit code: only a daemon that answered can
+      // name its version. `docker info >/dev/null && echo ok` prints ok on ANY
+      // exit-0, so a daemon answering nothing would read as healthy — trading #408's
+      // false negative for a false positive. Leave stderr alone too; `checkDocker`
+      // puts the failure text in the component message.
       daemonCommand: "docker info --format '{{.ServerVersion}}'",
       parseVersion: (output) => output.match(/Docker version ([^\s,]+)/)?.[1] ?? output,
       missingMessage: "Docker is not installed",
@@ -1261,12 +1653,15 @@ var systemCatalog = {
       missingMessage: "rsync is not installed"
     }
   },
+  // No `openresty` / `certbot` plans: nothing apt-installs an edge any more. Both
+  // shipped inside the `openship-edge` image, and their host-package plans (with the
+  // openresty.org apt-repo codename probing that came with them) went with the
+  // installers. `checks.openresty` stays — it parses the version out of the
+  // CONTAINER. See installer.ts `installContainerEdge`.
   installs: {
     docker: dockerInstallPlan,
     git: gitInstallPlan,
-    rsync: rsyncInstallPlan,
-    openresty: openrestyInstallPlan,
-    certbot: certbotInstallPlan
+    rsync: rsyncInstallPlan
   }
 };
 
@@ -1290,7 +1685,7 @@ function elevatedExecutor(inner) {
   };
   const overrides = {
     exec: (command, opts) => inner.exec(elevateCommand(command), opts),
-    streamExec: (command, onLog) => inner.streamExec(elevateCommand(command), onLog),
+    streamExec: (command, onLog, opts) => inner.streamExec(elevateCommand(command), onLog, opts),
     writeFile: writeFileElevated,
     // Elevated for the same reason as writeFile: the vhost/conf dirs are root-owned,
     // and the Proxy would otherwise forward this to the inner executor unelevated —
@@ -1317,7 +1712,7 @@ function elevatedExecutor(inner) {
 }
 
 // ../../packages/adapters/src/system/installer.ts
-function log2(message, level = "info") {
+function log3(message, level = "info") {
   return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
 }
 async function prepareExecutor(executor, component) {
@@ -1342,21 +1737,21 @@ async function installDocker(executor, onLog) {
   if (!plan.supported || !plan.installCommand || !plan.verifyCommand) {
     return { component: "docker", success: false, error: plan.unsupportedReason ?? "Docker install not supported" };
   }
-  onLog(log2("Installing Docker Engine..."));
+  onLog(log3("Installing Docker Engine..."));
   try {
     const { code } = await executor.streamExec(plan.installCommand, onLog);
     if (code !== 0) return { component: "docker", success: false, error: "Docker install failed" };
     if (plan.startCommand) {
-      onLog(log2("Starting Docker service..."));
+      onLog(log3("Starting Docker service..."));
       await executor.streamExec(plan.startCommand, onLog);
     }
     const version = await executor.exec(plan.verifyCommand);
     const parsed = systemCatalog.checks.docker.parseVersion(version);
-    onLog(log2(`Docker ${parsed} installed`));
+    onLog(log3(`Docker ${parsed} installed`));
     return { component: "docker", success: true, version: parsed };
   } catch (err) {
     const msg = safeErrorMessage(err);
-    onLog(log2(`Docker installation failed: ${msg}`, "error"));
+    onLog(log3(`Docker installation failed: ${msg}`, "error"));
     return { component: "docker", success: false, error: msg };
   }
 }
@@ -1369,17 +1764,17 @@ async function installGit(executor, onLog, opts) {
   if (!plan.supported || !plan.installCommand || !plan.verifyCommand) {
     return { component: "git", success: false, error: plan.unsupportedReason ?? "Git install not supported" };
   }
-  onLog(log2(opts?.label ? `Installing Git in ${opts.label}...` : "Installing Git..."));
+  onLog(log3(opts?.label ? `Installing Git in ${opts.label}...` : "Installing Git..."));
   try {
     const { code } = await executor.streamExec(plan.installCommand, onLog);
     if (code !== 0) return { component: "git", success: false, error: "Git installation failed" };
     const version = await executor.exec(plan.verifyCommand);
     const parsed = systemCatalog.checks.git.parseVersion(version);
-    onLog(log2(opts?.label ? `Git ${parsed} installed in ${opts.label}` : `Git ${parsed} installed`));
+    onLog(log3(opts?.label ? `Git ${parsed} installed in ${opts.label}` : `Git ${parsed} installed`));
     return { component: "git", success: true, version: parsed };
   } catch (err) {
     const msg = safeErrorMessage(err);
-    onLog(log2(`Git installation failed: ${msg}`, "error"));
+    onLog(log3(`Git installation failed: ${msg}`, "error"));
     return { component: "git", success: false, error: msg };
   }
 }
@@ -1392,17 +1787,17 @@ async function installRsync(executor, onLog) {
   if (!plan.supported || !plan.installCommand || !plan.verifyCommand) {
     return { component: "rsync", success: false, error: plan.unsupportedReason ?? "rsync install not supported" };
   }
-  onLog(log2("Installing rsync..."));
+  onLog(log3("Installing rsync..."));
   try {
     const { code } = await executor.streamExec(plan.installCommand, onLog);
     if (code !== 0) return { component: "rsync", success: false, error: "rsync installation failed" };
     const version = await executor.exec(plan.verifyCommand);
     const parsed = systemCatalog.checks.rsync.parseVersion(version);
-    onLog(log2(`rsync ${parsed} installed`));
+    onLog(log3(`rsync ${parsed} installed`));
     return { component: "rsync", success: true, version: parsed };
   } catch (err) {
     const msg = safeErrorMessage(err);
-    onLog(log2(`rsync installation failed: ${msg}`, "error"));
+    onLog(log3(`rsync installation failed: ${msg}`, "error"));
     return { component: "rsync", success: false, error: msg };
   }
 }
@@ -1412,7 +1807,7 @@ async function installContainerEdge(executor, onLog, config) {
   executor = prep.executor;
   if (!await dockerAvailable(executor)) {
     const error = "The edge is a container image and needs Docker on this server. Install the Docker component first, then install the edge.";
-    onLog(log2(error, "error"));
+    onLog(log3(error, "error"));
     return { component: "edge", success: false, error };
   }
   try {
@@ -1422,7 +1817,7 @@ async function installContainerEdge(executor, onLog, config) {
       image: config?.edgeImage
     });
     if (result.converted) {
-      onLog(log2("Edge moved from host OpenResty to the container edge", "warn"));
+      onLog(log3("Edge moved from host OpenResty to the container edge", "warn"));
     }
     const version = await executor.exec(containerCommand(result.container, "openresty -v 2>&1")).catch(() => "");
     return {
@@ -1433,18 +1828,17 @@ async function installContainerEdge(executor, onLog, config) {
   } catch (err) {
     if (err instanceof EdgeMigrateRequested) throw err;
     const msg = safeErrorMessage(err);
-    onLog(log2(`Edge setup failed: ${msg}`, "error"));
+    onLog(log3(`Edge setup failed: ${msg}`, "error"));
     return { component: "edge", success: false, error: msg };
   }
 }
 var COMPONENT_INSTALLERS = {
-  docker: (exec, log5) => installDocker(exec, log5),
-  // The edge is ONE component and it is a container image. `installOpenResty` /
-  // `installCertbot` are NOT reachable from here — they remain only for the mail
-  // server's own proxy (mail.service.ts) and for converting a legacy host edge.
-  edge: (exec, log5, config) => installContainerEdge(exec, log5, config),
-  git: (exec, log5) => installGit(exec, log5),
-  rsync: (exec, log5) => installRsync(exec, log5)
+  docker: (exec, log6) => installDocker(exec, log6),
+  // The edge is ONE component and it is a container image — there is no
+  // host-OpenResty or host-certbot installer to reach for any more.
+  edge: (exec, log6, config) => installContainerEdge(exec, log6, config),
+  git: (exec, log6) => installGit(exec, log6),
+  rsync: (exec, log6) => installRsync(exec, log6)
 };
 
 // ../../packages/adapters/src/system/available-version.ts
@@ -1572,7 +1966,7 @@ async function tryExec4(executor, command) {
       "checks",
       `exec:ok ${command} (${formatDuration(startedAt)})`
     );
-    return result;
+    return { output: result.trim(), error: null };
   } catch (err) {
     if (isRemoteConnectionError(err)) {
       systemDebug(
@@ -1586,9 +1980,15 @@ async function tryExec4(executor, command) {
       "checks",
       `exec:fail ${command} (${formatDuration(startedAt)}) ${msg}`
     );
-    return null;
+    return { output: "", error: msg || `\`${command}\` failed` };
   }
 }
+function withReason(message, error) {
+  if (!error) return message;
+  const first = error.split("\n").map((line) => line.trim()).find(Boolean);
+  if (!first) return message;
+  return `${message} \u2014 ${first.length > 200 ? `${first.slice(0, 199)}\u2026` : first}`;
+}
 function healthy(name, version, running) {
   const component = getSystemComponentDefinition(name);
   return {
@@ -1621,15 +2021,18 @@ async function checkDocker(executor) {
   const startedAt = Date.now();
   const recipe = systemCatalog.checks.docker;
   const version = await tryExec4(executor, recipe.versionCommand);
-  if (!version) {
+  if (!version.output) {
     systemDebug("checks", `docker:missing (${formatDuration(startedAt)})`);
-    return unhealthy("docker", recipe.missingMessage);
+    return unhealthy("docker", withReason(recipe.missingMessage, version.error));
   }
-  const parsed = recipe.parseVersion(version);
+  const parsed = recipe.parseVersion(version.output);
   const info = await tryExec4(executor, recipe.daemonCommand);
-  if (!info) {
-    systemDebug("checks", `docker:not-running (${formatDuration(startedAt)})`);
-    return unhealthy("docker", recipe.notRunningMessage, {
+  if (!info.output) {
+    systemDebug(
+      "checks",
+      `docker:not-running (${formatDuration(startedAt)}) ${info.error ?? "probe exited 0 with no server version"}`
+    );
+    return unhealthy("docker", withReason(recipe.notRunningMessage, info.error), {
       version: parsed,
       running: false
     });
@@ -1641,11 +2044,11 @@ async function checkGit(executor) {
   const startedAt = Date.now();
   const recipe = systemCatalog.checks.git;
   const version = await tryExec4(executor, recipe.versionCommand);
-  if (!version) {
+  if (!version.output) {
     systemDebug("checks", `git:missing (${formatDuration(startedAt)})`);
-    return unhealthy("git", recipe.missingMessage);
+    return unhealthy("git", withReason(recipe.missingMessage, version.error));
   }
-  const parsed = recipe.parseVersion(version);
+  const parsed = recipe.parseVersion(version.output);
   systemDebug("checks", `git:healthy (${formatDuration(startedAt)})`);
   return healthy("git", parsed);
 }
@@ -1653,11 +2056,11 @@ async function checkRsync(executor) {
   const startedAt = Date.now();
   const recipe = systemCatalog.checks.rsync;
   const version = await tryExec4(executor, recipe.versionCommand);
-  if (!version) {
+  if (!version.output) {
     systemDebug("checks", `rsync:missing (${formatDuration(startedAt)})`);
-    return unhealthy("rsync", recipe.missingMessage);
+    return unhealthy("rsync", withReason(recipe.missingMessage, version.error));
   }
-  const parsed = recipe.parseVersion(version);
+  const parsed = recipe.parseVersion(version.output);
   systemDebug("checks", `rsync:healthy (${formatDuration(startedAt)})`);
   return healthy("rsync", parsed);
 }
@@ -1671,17 +2074,29 @@ async function checkEdge(executor) {
       "No edge on this server. The edge is the openship-edge container \u2014 install it (requires Docker)."
     );
   }
+  const verdict = await verifyEdgeServing(executor, container);
+  if (!verdict.serving) {
+    systemDebug("checks", `edge:not-serving (${formatDuration(startedAt)})`);
+    return unhealthy(
+      "edge",
+      `The edge container ${container} is not serving \u2014 ${verdict.reason ?? "it is not listening on :80"}`,
+      { running: false }
+    );
+  }
   const version = await tryExec4(executor, containerCommand(container, "openresty -v 2>&1"));
-  if (!version) {
+  if (!version.output) {
     systemDebug("checks", `edge:container-unresponsive (${formatDuration(startedAt)})`);
     return unhealthy(
       "edge",
-      `The edge container ${container} is running but not responding \u2014 check \`docker logs ${container}\``,
+      withReason(
+        `The edge container ${container} is serving on :80 but not answering \u2014 check \`docker logs ${container}\``,
+        version.error
+      ),
       { running: false }
     );
   }
   systemDebug("checks", `edge:healthy (${formatDuration(startedAt)})`);
-  return healthy("edge", systemCatalog.checks.openresty.parseVersion(version), true);
+  return healthy("edge", systemCatalog.checks.openresty.parseVersion(version.output), true);
 }
 var COMPONENT_CHECKS = {
   docker: checkDocker,
@@ -1771,24 +2186,36 @@ function describeEdgeOwner(occupants) {
 }
 
 // ../../packages/adapters/src/system/proxy/consent.ts
-function log3(message, level = "info") {
+function log4(message, level = "info") {
   return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
 }
 async function ensureEdgeClear(executor, config, onLog) {
   const status = await probeEdge(executor);
-  if (status.canProceedClean) return { tookOver: false };
+  if (status.canProceedClean) return { tookOver: false, status };
   const takeover = async () => {
-    onLog(log3(
+    onLog(log4(
       `Taking over ports from ${status.occupants.map((o) => o.command ?? o.port).join(", ")}...`,
       "warn"
     ));
-    const configured = config?.edgePolicy?.stopTargets ?? [];
-    const targets = configured.length ? configured : stopTargetsForStatus(status);
-    await freeEdgeTargets(executor, targets, (m, l) => onLog(log3(m, l)));
+    const freed = await beginEdgeTakeover(
+      executor,
+      status,
+      onLog,
+      config?.edgePolicy?.stopTargets ?? []
+    );
+    if (!freed.freed) {
+      await rollbackEdgeTakeover(executor, onLog);
+      const plural = freed.stillBound.length > 1;
+      throw new AppError(
+        `Stopped the existing proxy, but port${plural ? "s" : ""} ${freed.stillBound.join(" and ")} ${plural ? "are" : "is"} still in use, so the edge can't bind. Nothing was installed and the previous proxy has been restored \u2014 find what else is holding the port and retry.`,
+        409,
+        "EDGE_PORTS_STILL_BOUND"
+      );
+    }
   };
   if (config?.edgePolicy?.mode === "takeover") {
     await takeover();
-    return { tookOver: true };
+    return { tookOver: true, status };
   }
   if (config?.promptUser) {
     const known = status.classification === "known";
@@ -1817,7 +2244,7 @@ async function ensureEdgeClear(executor, config, onLog) {
     }
     if (action === "override") {
       await takeover();
-      return { tookOver: true };
+      return { tookOver: true, status };
     }
     throw new EdgeConflictError(status);
   }
@@ -1825,7 +2252,7 @@ async function ensureEdgeClear(executor, config, onLog) {
 }
 
 // ../../packages/adapters/src/system/proxy/ensure-container-edge.ts
-function log4(message, level = "info") {
+function log5(message, level = "info") {
   return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
 }
 var injectedDefaultImage;
@@ -1835,15 +2262,8 @@ function setDefaultEdgeImage(image) {
 function resolveEdgeImage(explicit) {
   return buildEdgeImageRef({ explicit, injectedDefault: injectedDefaultImage });
 }
-async function dockerAvailable(executor) {
-  return executor.exec("docker version --format '{{.Server.Version}}' 2>/dev/null").then((v) => Boolean(v.trim())).catch(() => false);
-}
-async function runningImage(executor, container) {
-  const out = await executor.exec(`docker inspect -f '{{.Config.Image}}' ${sq(container)} 2>/dev/null`).catch(() => "");
-  return out.trim() || null;
-}
 async function containerEdgeProvider(executor, container, opts) {
-  const { NginxProvider: Provider } = await import("./nginx-3L4SIBJA.js");
+  const { NginxProvider: Provider } = await import("./nginx-AXGNWRKZ.js");
   return new Provider({
     ...opts,
     // Vhosts go to the BIND-MOUNTED HOST dir (so every host-side reader — the
@@ -1851,21 +2271,33 @@ async function containerEdgeProvider(executor, container, opts) {
     // while reload/certbot run inside the container.
     paths: EDGE_HOST_PATHS,
     executor: edgeContainerExecutor(executor, container),
+    // Challenge tokens go to the HOST side of the ACME mount, for the same reason
+    // vhosts do. This is the ONE mount whose two sides differ
+    // (/var/lib/openship/edge/acme → /var/www/acme), so the write path and the
+    // vhost's `root` are genuinely different strings — `root` stays the container
+    // path. Overridden here and nowhere else, next to the `paths` override it
+    // mirrors, so the two cannot drift.
+    challengeDir: EDGE_CHALLENGE_HOST_DIR,
     // MUST be pinned: re-detection answers from inside the container and would
     // repoint sitesDir at a host dir the edge never reads.
-    pinPaths: true
+    pinPaths: true,
+    // Reload runs INSIDE the container, where the master is pid 1 — so a failed
+    // reload must never fall back to killing it (#292).
+    containerEdge: true
   });
 }
 async function localContainerEdgeProvider(container, opts) {
-  const { DockerEdgeExecutor } = await import("./docker-edge-executor-VHW3JPJS.js");
-  const { NginxProvider: Provider } = await import("./nginx-3L4SIBJA.js");
+  const { DockerEdgeExecutor } = await import("./docker-edge-executor-62N64MGS.js");
+  const { NginxProvider: Provider } = await import("./nginx-AXGNWRKZ.js");
   return new Provider({
     ...opts,
     paths: OPENRESTY_DEFAULT_PATHS,
     executor: new DockerEdgeExecutor({ containerName: container }),
     // nginx.conf + the Lua are BAKED into the image — nothing to detect, install
     // or patch, and detection would answer from inside the container anyway.
-    pinPaths: true
+    pinPaths: true,
+    // `docker exec`s into the edge, so the master is pid 1 there too (#292).
+    containerEdge: true
   });
 }
 async function startEdgeContainer(executor, container, image, onLog) {
@@ -1894,37 +2326,39 @@ function buildEdgeRunCommand(container, image) {
     sq(image)
   ].join(" ");
 }
-async function swapEdgeImage(executor, container, from, to, opts) {
+function makeEdgeStart(executor, container, opts) {
   const { onLog } = opts;
-  onLog(log4(`Updating the edge: ${from} \u2192 ${to}`));
-  const pull = await executor.streamExec(`docker pull ${sq(to)}`, onLog);
-  if (pull.code !== 0) {
-    onLog(log4(`Could not pull ${to} \u2014 the edge stays on ${from}.`, "warn"));
-    return { swapped: false, edgeDown: false };
-  }
-  const start = async (image) => {
+  return async (image) => {
     if (!await startEdgeContainer(executor, container, image, onLog)) return false;
-    const listening = await waitForPortListening(executor, 80, {
+    const verdict = await verifyEdgeServing(executor, container, {
       timeoutMs: opts.verifyTimeoutMs ?? 3e4
     });
-    return !(listening.checked && !listening.listening);
+    if (!verdict.serving && verdict.reason) onLog(log5(`Edge ${image}: ${verdict.reason}`, "warn"));
+    return verdict.serving;
   };
-  if (await start(to)) {
-    onLog(log4(`Edge updated to ${to}`));
-    return { swapped: true, edgeDown: false };
+}
+async function verifyEdgeServing(executor, container, opts = {}) {
+  if (await edgeIsBroken(executor, container)) {
+    const reason = await edgeCrashReason(executor, container);
+    return { serving: false, reason: reason ?? "the edge container is not running" };
   }
-  onLog(log4(`Edge ${to} failed to come up \u2014 rolling back to ${from}...`, "error"));
-  if (await start(from)) {
-    return { swapped: false, edgeDown: false };
+  if (opts.configTest) {
+    try {
+      await executor.exec(containerCommand(container, "openresty -t 2>&1"));
+    } catch (err) {
+      const out = safeErrorMessage(err);
+      return { serving: false, reason: edgeFailureReason(out) ?? out };
+    }
   }
-  onLog(log4(`Rollback to ${from} ALSO failed \u2014 the edge is down on this server.`, "error"));
-  return { swapped: false, edgeDown: true };
-}
-async function listDir(executor, dir) {
-  const out = await executor.exec(`ls -1 ${sq(dir)} 2>/dev/null || true`).catch(() => "");
-  return new Set(
-    out.split("\n").map((l) => l.trim()).filter(Boolean)
-  );
+  const listening = await waitForPortListening(executor, 80, { timeoutMs: opts.timeoutMs ?? 0 });
+  if (listening.checked && !listening.listening) {
+    const reason = await edgeCrashReason(executor, container);
+    return {
+      serving: false,
+      reason: reason ?? "the edge container is up but nothing is listening on :80"
+    };
+  }
+  return { serving: true };
 }
 async function ensureContainerEdge(executor, opts) {
   const { onLog } = opts;
@@ -1932,123 +2366,112 @@ async function ensureContainerEdge(executor, opts) {
   const image = resolveEdgeImage(opts.image);
   const existing = await resolveOurEdgeContainer(executor, { fresh: true });
   if (existing) {
-    const current = await runningImage(executor, existing);
-    if (current && current !== image) {
-      const swap = await swapEdgeImage(executor, existing, current, image, opts);
-      return {
-        container: existing,
-        image,
-        converted: false,
-        updated: swap.swapped,
-        edgeDown: swap.edgeDown
-      };
+    const verdict = await verifyEdgeServing(executor, existing);
+    if (!verdict.serving) {
+      onLog(log5(`The edge container exists but isn't serving: ${verdict.reason}`, "warn"));
+      onLog(log5("Recreating it...", "warn"));
+    } else {
+      const current = await containerImageRef(executor, existing);
+      const stale = current != null && current !== image;
+      if (stale) {
+        const start = makeEdgeStart(executor, existing, opts);
+        const swap = await swapManagedImage(executor, {
+          kind: "edge",
+          from: current ?? image,
+          to: image,
+          label: "edge",
+          onLog,
+          start
+        });
+        return {
+          container: existing,
+          image,
+          converted: false,
+          updated: swap.swapped,
+          edgeDown: swap.down
+        };
+      }
+      return { container: existing, image, converted: false };
     }
-    return { container: existing, image, converted: false };
   }
-  await ensureEdgeClear(executor, opts.config, onLog);
   if (!await dockerAvailable(executor)) {
     throw new Error(
       "Docker isn't available on this server, and the edge now runs as a container. Install the Docker component first, then set up the edge."
     );
   }
-  const bareWasOurs = await ourLuaOnHost(executor);
-  onLog(log4(`Pulling edge image ${image}...`));
-  const pull = await executor.streamExec(`docker pull ${sq(image)}`, onLog);
-  if (pull.code !== 0) {
-    throw new Error(
-      `Could not pull the edge image ${image} \u2014 the box is unchanged and still serving. Check the server's network access to the registry, then retry.`
-    );
+  if (!await imageExistsLocally(executor, image)) {
+    if (managedImagesAreFromSource("edge")) {
+      throw new Error(fromSourceImageMissingMessage("edge", image));
+    }
+    onLog(log5(`Pulling edge image ${image}...`));
+    const pull = await executor.streamExec(`docker pull ${sq(image)}`, onLog);
+    if (pull.code !== 0) {
+      throw new Error(
+        `Could not pull the edge image ${image} \u2014 the box is unchanged and still serving. Check the server's network access to the registry, then retry.`
+      );
+    }
   }
   for (const mount of EDGE_CONTAINER_MOUNTS) {
     await executor.exec(`mkdir -p ${sq(mount.host)}`).catch(() => {
     });
   }
-  const sitesTarget = EDGE_HOST_PATHS.sitesDir;
-  let beforeCarry = null;
-  if (bareWasOurs) {
-    const barePaths = await detectOpenRestyPaths(executor).catch(() => OPENRESTY_DEFAULT_PATHS);
-    if (barePaths.sitesDir !== sitesTarget && await executor.exists(barePaths.sitesDir)) {
-      onLog(log4(`Carrying vhosts from ${barePaths.sitesDir}...`));
-      beforeCarry = await listDir(executor, sitesTarget);
-      await executor.exec(`cp -a ${sq(`${barePaths.sitesDir}/.`)} ${sq(`${sitesTarget}/`)} 2>/dev/null || true`).catch(() => {
-      });
-    }
-  }
-  const restoreBare = async () => {
-    if (!bareWasOurs) return;
-    if (beforeCarry) {
-      const now = await listDir(executor, sitesTarget);
-      const added = [...now].filter((name) => !beforeCarry.has(name));
-      if (added.length > 0) {
-        await executor.exec(`rm -f ${added.map((n) => sq(`${sitesTarget}/${n}`)).join(" ")}`).catch(() => {
-        });
-        onLog(log4(`Removed ${added.length} carried vhost(s) so the next edge start is clean.`, "warn"));
-      }
-    }
-    onLog(log4("Restoring the host OpenResty edge...", "warn"));
-    await executor.exec("systemctl enable --now openresty 2>/dev/null || true").catch(() => {
-    });
-  };
+  const clear = await ensureEdgeClear(executor, opts.config, onLog);
   try {
-    if (bareWasOurs) {
-      onLog(log4("Stopping the host OpenResty edge..."));
-      await executor.exec("systemctl disable --now openresty 2>/dev/null || true").catch(() => {
-      });
-      await executor.exec("systemctl reset-failed openresty 2>/dev/null || true").catch(() => {
-      });
-    }
-    onLog(log4("Starting the edge container..."));
+    onLog(log5("Starting the edge container..."));
     if (!await startEdgeContainer(executor, container, image, onLog)) {
       throw new Error("the edge container failed to start");
     }
-    await executor.exec(containerCommand(container, "openresty -t"));
-    const listening = await waitForPortListening(executor, 80, {
+    const verdict = await verifyEdgeServing(executor, container, {
+      configTest: true,
       timeoutMs: opts.verifyTimeoutMs ?? 3e4
     });
-    if (listening.checked && !listening.listening) {
-      throw new Error("the edge container started but nothing is listening on :80");
+    if (!verdict.serving) {
+      throw new Error(verdict.reason ?? "the edge container started but isn't serving");
     }
+    if (clear.tookOver) await completeEdgeTakeover(executor);
     const version = await executor.exec(containerCommand(container, "openresty -v 2>&1")).catch(() => "");
-    onLog(log4(`Edge container running${version.trim() ? ` (${version.trim()})` : ""}`));
-    return { container, image, converted: bareWasOurs };
+    onLog(log5(`Edge container running${version.trim() ? ` (${version.trim()})` : ""}`));
+    return { container, image, converted: clear.tookOver };
   } catch (err) {
     const msg = safeErrorMessage(err);
-    onLog(log4(`Edge container setup failed: ${msg}`, "error"));
+    onLog(log5(`Edge container setup failed: ${msg}`, "error"));
     const logs = await executor.exec(`docker logs --tail 40 ${sq(container)} 2>&1 || true`).catch(() => "");
-    if (logs.trim()) onLog(log4(`Edge container logs:
+    if (logs.trim()) onLog(log5(`Edge container logs:
 ${logs}`, "error"));
     await executor.exec(`docker rm -f ${sq(container)} 2>/dev/null || true`).catch(() => {
     });
     invalidateEdgeContainer(executor);
-    await restoreBare();
+    if (clear.tookOver) await rollbackEdgeTakeover(executor, onLog);
     const reason = edgeFailureReason(logs);
     throw new Error(`Edge container setup failed: ${reason ? `${reason} (${msg})` : msg}`);
   }
 }
 
 export {
-  systemCatalog,
-  checkGit,
-  checkAll,
-  checkComponents,
+  beginEdgeTakeover,
+  rollbackEdgeTakeover,
+  completeEdgeTakeover,
+  recoverInterruptedTakeover,
   detectInstalledProxy,
   scanImportableSites,
+  unreachableStaticRoots,
+  copyStaticRootIntoEdge,
   edgeProxy,
   edgeProxyFor,
   collectProxyCerts,
-  beginEdgeTakeover,
-  rollbackEdgeTakeover,
-  completeEdgeTakeover,
-  recoverInterruptedTakeover,
+  systemCatalog,
+  installGit,
+  COMPONENT_INSTALLERS,
+  importSites,
+  foreignProxyOnEdge,
   setDefaultEdgeImage,
   resolveEdgeImage,
-  dockerAvailable,
   containerEdgeProvider,
   localContainerEdgeProvider,
   buildEdgeRunCommand,
+  verifyEdgeServing,
   ensureContainerEdge,
-  importSites,
-  foreignProxyOnEdge,
-  installGit,
-  COMPONENT_INSTALLERS
+  checkGit,
+  checkAll,
+  checkComponents
 };