openship 0.5.0 → 0.6.0

package/dist/{chunk-NXFIRK2Z.js → chunk-GUQ3QCJ7.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env sh
-":" //# ; exec "$(command -v bun || command -v node)" "$0" "$@"
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   resolveEnvironment
-} from "./chunk-KZOBYJUW.js";
+} from "./chunk-IW2UKBVF.js";
 import {
   formatDuration,
   isRemoteConnectionError,
   systemDebug
-} from "./chunk-RPHRPFEH.js";
+} from "./chunk-ZCFVHA25.js";
 import {
   containerCommand,
   edgeContainerExecutor,
@@ -17,41 +17,250 @@ import {
   readDeclaredPair,
   readMaybeInContainer,
   validateCertFor
-} from "./chunk-RB35YN3J.js";
-import {
-  sq
-} from "./chunk-FPRHYBY2.js";
+} from "./chunk-QEH4QUBX.js";
 import {
   EDGE_CONTAINER_NAME,
   EdgeConflictError,
   EdgeMigrateRequested,
+  edgeCrashReason,
   edgeFailureReason,
+  edgeIsBroken,
   freeEdgeTargets,
   invalidateEdgeContainer,
-  ourLuaOnHost,
   probeEdge,
   resolveOurEdgeContainer,
   sanitizeEdgeVhosts,
   sq as sq2,
   stopTargetsForStatus
-} from "./chunk-6PIYRG5I.js";
+} from "./chunk-VZ2ZHPS2.js";
 import {
   waitForPortListening
-} from "./chunk-ILFETZOM.js";
+} from "./chunk-3LDWWY7U.js";
 import {
+  EDGE_CHALLENGE_HOST_DIR,
   EDGE_CONTAINER_MOUNTS,
   EDGE_HOST_PATHS,
-  OPENRESTY_DEFAULT_PATHS,
-  detectOpenRestyPaths
-} from "./chunk-EAAGSQXN.js";
+  OPENRESTY_DEFAULT_PATHS
+} from "./chunk-OGY63DGD.js";
+import {
+  sq
+} from "./chunk-ZFJXPCQP.js";
 import {
+  AppError,
+  PROXY_DIRECTIVES,
   buildEdgeImageRef,
   compareSemver,
-  safeErrorMessage
-} from "./chunk-UMQP7SYT.js";
+  parseProxyValue,
+  safeErrorMessage,
+  sanitizeProxySettings
+} from "./chunk-OTLSJYAC.js";
+
+// ../../packages/adapters/src/system/managed-image.ts
+import { posix } from "path";
+function log(message, level = "info") {
+  return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
+}
+function titleCase(label) {
+  return label.charAt(0).toUpperCase() + label.slice(1);
+}
+var fromSourceManaged = { edge: false, mail: false };
+function managedImagesAreFromSource(kind) {
+  return fromSourceManaged[kind];
+}
+function fromSourceImageMissingMessage(label, image) {
+  return `The from-source ${label} image ${image} isn't on this server \u2014 the control-plane build or transfer didn't complete (see the log above). It's an unpublished dev tag, so there's nothing to pull; fix the build and retry.`;
+}
+async function dockerAvailable(executor) {
+  return executor.exec("docker version --format '{{.Server.Version}}' 2>/dev/null").then((v) => Boolean(v.trim())).catch(() => false);
+}
+async function containerState(executor, container) {
+  const out = await executor.exec(`docker inspect -f '{{.State.Running}}	{{.Config.Image}}' ${sq(container)} 2>/dev/null`).catch(() => "");
+  const line = out.split("\n").map((l) => l.trim()).find(Boolean);
+  if (!line) return null;
+  const [running, image] = line.split("	");
+  return { running: running?.trim() === "true", image: image?.trim() || null };
+}
+async function containerImageRef(executor, container) {
+  return (await containerState(executor, container))?.image ?? null;
+}
+async function imageExistsLocally(executor, ref) {
+  const out = await executor.exec(`docker image inspect -f '{{.Id}}' ${sq(ref)} 2>/dev/null`).catch(() => "");
+  return Boolean(out.trim());
+}
+async function swapManagedImage(executor, opts) {
+  const { kind, from, to, label, onLog, start } = opts;
+  const Label = titleCase(label);
+  onLog(log(`Updating the ${label}: ${from} \u2192 ${to}`));
+  if (!await imageExistsLocally(executor, to)) {
+    if (managedImagesAreFromSource(kind)) {
+      onLog(log(fromSourceImageMissingMessage(label, to), "warn"));
+      return { swapped: false, down: false };
+    }
+    const pull = await executor.streamExec(`docker pull ${sq(to)}`, onLog);
+    if (pull.code !== 0) {
+      onLog(log(`Could not pull ${to} \u2014 the ${label} stays on ${from}.`, "warn"));
+      return { swapped: false, down: false };
+    }
+  }
+  if (await start(to)) {
+    onLog(log(`${Label} updated to ${to}`));
+    return { swapped: true, down: false };
+  }
+  onLog(log(`${Label} ${to} failed to come up \u2014 rolling back to ${from}...`, "error"));
+  if (await start(from)) {
+    return { swapped: false, down: false };
+  }
+  onLog(log(`Rollback to ${from} ALSO failed \u2014 the ${label} is down on this server.`, "error"));
+  return { swapped: false, down: true };
+}
+
+// ../../packages/adapters/src/system/proxy/takeover-journal.ts
+var JOURNAL_DIR = "/var/lib/openship";
+var JOURNAL_PATH = `${JOURNAL_DIR}/edge-takeover.json`;
+function log2(message, level = "info") {
+  return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
+}
+async function tryExec(executor, cmd) {
+  try {
+    return await executor.exec(cmd);
+  } catch {
+    return null;
+  }
+}
+async function buildJournal(executor, status) {
+  const units = /* @__PURE__ */ new Map();
+  const containers = /* @__PURE__ */ new Map();
+  const processes = /* @__PURE__ */ new Map();
+  for (const o of status.occupants) {
+    if (o.containerName && !containers.has(o.containerName)) {
+      const r = await tryExec(
+        executor,
+        `docker inspect -f '{{.HostConfig.RestartPolicy.Name}}' ${sq2(o.containerName)} 2>/dev/null`
+      );
+      containers.set(o.containerName, { name: o.containerName, restart: r?.trim() || "no" });
+    } else if (o.systemdUnit && !units.has(o.systemdUnit)) {
+      const en = await tryExec(executor, `systemctl is-enabled ${sq2(o.systemdUnit)} 2>/dev/null`);
+      units.set(o.systemdUnit, { unit: o.systemdUnit, wasEnabled: en?.trim() === "enabled" });
+    } else if (!o.containerName && !o.systemdUnit && o.pid && !processes.has(o.pid)) {
+      processes.set(o.pid, { pid: o.pid, command: o.rawCommand });
+    }
+  }
+  return {
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    units: [...units.values()],
+    containers: [...containers.values()],
+    processes: [...processes.values()]
+  };
+}
+async function writeJournal(executor, journal) {
+  try {
+    await executor.mkdir(JOURNAL_DIR);
+    await executor.writeFile(JOURNAL_PATH, JSON.stringify(journal, null, 2));
+  } catch {
+  }
+}
+async function clearJournal(executor) {
+  await tryExec(executor, `rm -f ${JOURNAL_PATH}`);
+}
+async function readJournal(executor) {
+  const raw = await tryExec(executor, `cat ${JOURNAL_PATH} 2>/dev/null`);
+  if (!raw?.trim()) return null;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    await clearJournal(executor);
+    return null;
+  }
+}
+async function rollback(executor, journal, onLog) {
+  onLog(log2("Rolling back \u2014 restoring the previous proxy...", "warn"));
+  await tryExec(executor, `docker update --restart=no ${sq2(EDGE_CONTAINER_NAME)} 2>/dev/null || true`);
+  await tryExec(executor, `docker stop ${sq2(EDGE_CONTAINER_NAME)} 2>/dev/null || true`);
+  await tryExec(
+    executor,
+    "systemctl disable --now openresty 2>/dev/null || systemctl stop openresty 2>/dev/null || true; systemctl reset-failed openresty 2>/dev/null || true"
+  );
+  for (const u of journal.units) {
+    await tryExec(
+      executor,
+      u.wasEnabled ? `systemctl enable --now ${sq2(u.unit)} 2>/dev/null || true` : `systemctl start ${sq2(u.unit)} 2>/dev/null || true`
+    );
+  }
+  for (const c of journal.containers) {
+    await tryExec(executor, `docker update --restart=${sq2(c.restart)} ${sq2(c.name)} 2>/dev/null || true`);
+    await tryExec(executor, `docker start ${sq2(c.name)} 2>/dev/null || true`);
+  }
+  for (const p of journal.processes ?? []) {
+    if (p.command) {
+      await tryExec(
+        executor,
+        `setsid -f sh -c ${sq2(p.command)} 2>/dev/null || (nohup sh -c ${sq2(p.command)} >/dev/null 2>&1 &) || true`
+      );
+    } else {
+      onLog(log2(`Could not restore process ${p.pid} \u2014 no command captured.`, "warn"));
+    }
+  }
+  const restored = await portIsServed(executor, 80);
+  if (!restored) {
+    onLog(
+      log2(
+        "Nothing is listening on :80 after the restore \u2014 the box is NOT serving. Start your proxy by hand (e.g. `systemctl start nginx`, or `docker start <name>`).",
+        "error"
+      )
+    );
+  }
+  return restored;
+}
+async function portIsServed(executor, port) {
+  const hex = port.toString(16).toUpperCase().padStart(4, "0");
+  const out = await tryExec(
+    executor,
+    `(command -v ss >/dev/null 2>&1 && ss -ltn 2>/dev/null | grep -qE ':${port}[[:space:]]' && echo yes) || (grep -qiE '^[[:space:]]*[0-9]+:[[:space:]]*[0-9A-F]{8}:${hex}[[:space:]]+[0-9A-F]{8}:0000[[:space:]]+0A' /proc/net/tcp 2>/dev/null && echo yes) || true`
+  );
+  return (out ?? "").includes("yes");
+}
+async function beginEdgeTakeover(executor, status, onLog, targets) {
+  await writeJournal(executor, await buildJournal(executor, status));
+  return freeEdgeTargets(
+    executor,
+    targets?.length ? targets : stopTargetsForStatus(status),
+    (m, l) => onLog(log2(m, l))
+  );
+}
+async function rollbackEdgeTakeover(executor, onLog) {
+  const journal = await readJournal(executor);
+  if (!journal || journal.completed) return false;
+  const restored = await rollback(executor, journal, onLog);
+  await clearJournal(executor);
+  return restored;
+}
+async function completeEdgeTakeover(executor) {
+  const journal = await readJournal(executor);
+  if (journal) {
+    journal.completed = true;
+    await writeJournal(executor, journal);
+  }
+  await clearJournal(executor);
+}
+async function recoverInterruptedTakeover(executor, onLog, isEdgeHealthy) {
+  const journal = await readJournal(executor);
+  if (!journal) return;
+  if (journal.completed) {
+    await clearJournal(executor);
+    return;
+  }
+  if (isEdgeHealthy && await isEdgeHealthy()) {
+    onLog(log2("Found an unfinished edge takeover, but our edge is serving \u2014 keeping it.", "warn"));
+    await clearJournal(executor);
+    return;
+  }
+  onLog(log2("Found an interrupted edge takeover \u2014 restoring the previous proxy.", "warn"));
+  await rollback(executor, journal, onLog);
+  await clearJournal(executor);
+}
 
 // ../../packages/adapters/src/system/proxy/import/parse-utils.ts
-async function tryExec(executor, command) {
+async function tryExec2(executor, command) {
   try {
     return await executor.exec(command);
   } catch {
@@ -59,7 +268,21 @@ async function tryExec(executor, command) {
   }
 }
 function stripComments(text) {
-  return text.replace(/#.*$/gm, "");
+  return text.split("\n").map((line) => {
+    let quote;
+    for (let i = 0; i < line.length; i++) {
+      const ch = line[i];
+      if (quote) {
+        if (ch === "\\") i++;
+        else if (ch === quote) quote = void 0;
+      } else if (ch === '"' || ch === "'") {
+        quote = ch;
+      } else if (ch === "#") {
+        return line.slice(0, i);
+      }
+    }
+    return line;
+  }).join("\n");
 }
 function extractBlocks(text, keyword) {
   const blocks = [];
@@ -105,10 +328,17 @@ function sq3(value) {
 }
 
 // ../../packages/adapters/src/system/proxy/import/nginx.ts
+async function dumpResolvedConfig(executor, bins) {
+  for (const bin of bins) {
+    const dumped = await tryExec2(executor, `${bin} -T 2>/dev/null`);
+    if (dumped && /server\s*\{/.test(dumped)) return dumped;
+  }
+  return null;
+}
 async function loadNginxConfig(executor) {
-  const dumped = await tryExec(executor, "nginx -T 2>/dev/null");
-  if (dumped && /server\s*\{/.test(dumped)) return dumped;
-  const cat = await tryExec(
+  const dumped = await dumpResolvedConfig(executor, ["nginx", "openresty"]);
+  if (dumped) return dumped;
+  const cat = await tryExec2(
     executor,
     "cat /etc/nginx/nginx.conf /etc/nginx/sites-enabled/* /etc/nginx/conf.d/*.conf 2>/dev/null"
   );
@@ -146,7 +376,7 @@ function resolveProxyTarget(proxyPass, upstreams) {
   if (isIp || host.includes(".")) return { url: raw };
   return { reason: `proxy_pass host "${host}" is an undeclared upstream \u2014 not migratable` };
 }
-function extractLocationProxies(serverBody) {
+function locationBlocks(serverBody) {
   const out = [];
   const re = /(?:^|[\s;}])location\s+([^{]+?)\s*\{/g;
   let m;
@@ -160,13 +390,26 @@ function extractLocationProxies(serverBody) {
       else if (serverBody[i] === "}") depth--;
     }
     if (depth !== 0) break;
-    const locBody = serverBody.slice(openIdx + 1, i - 1);
+    out.push({ path, body: serverBody.slice(openIdx + 1, i - 1) });
     re.lastIndex = i;
-    const pp = firstDirective(locBody, "proxy_pass");
-    if (pp) out.push({ path, proxyPass: pp });
   }
   return out;
 }
+function extractLocationProxies(serverBody) {
+  const out = [];
+  for (const loc of locationBlocks(serverBody)) {
+    const pp = firstDirective(loc.body, "proxy_pass");
+    if (pp) out.push({ path: loc.path, proxyPass: pp });
+  }
+  return out;
+}
+function withoutQuotedValues(body) {
+  return body.replace(/'[^'\n]*'/g, "''").replace(/"[^"\n]*"/g, '""');
+}
+var SERVING_DIRECTIVE_RE = /(?:^|[;{}\s])(?:proxy_pass|root|alias|fastcgi_pass|uwsgi_pass|scgi_pass|grpc_pass)\s/;
+function servesNothing(locationBody) {
+  return !SERVING_DIRECTIVE_RE.test(withoutQuotedValues(locationBody));
+}
 function isHttpsUpgradeForSelf(body, names) {
   const targets = [
     ...body.matchAll(/(?:^|[\s;{])return\s+30[1-8]\s+([^;]+);/g),
@@ -181,15 +424,31 @@ function isHttpsUpgradeForSelf(body, names) {
     return names.includes(host);
   });
 }
+var CHALLENGE_LOCATION_RE = /\.well-known\/(acme-challenge|oblien-proxy-challenge)/i;
 function isAcmeWebrootOnly(body) {
-  const paths = [...body.matchAll(/(?:^|[\s;}])location\s+([^{]+?)\s*\{/g)].map(
-    (m) => m[1].trim()
-  );
-  if (paths.length === 0) {
+  const locations = locationBlocks(body);
+  if (locations.length === 0) {
     const root = firstDirective(body, "root") ?? "";
     return /letsencrypt|acme|certbot/i.test(root);
   }
-  return paths.every((p) => /\.well-known\/acme-challenge/i.test(p));
+  if (!locations.some((l) => CHALLENGE_LOCATION_RE.test(l.path))) return false;
+  return locations.every((l) => CHALLENGE_LOCATION_RE.test(l.path) || servesNothing(l.body));
+}
+function parseProxyDirectives(body) {
+  const raw = {};
+  const candidate = {};
+  for (const spec of PROXY_DIRECTIVES) {
+    const found = firstDirective(body, spec.directive);
+    if (found === void 0) continue;
+    raw[spec.key] = found;
+    const parsed = parseProxyValue(spec, found);
+    if (parsed !== void 0) candidate[spec.key] = parsed;
+  }
+  const settings = sanitizeProxySettings(candidate);
+  return {
+    ...settings ? { settings } : {},
+    ...Object.keys(raw).length > 0 ? { raw } : {}
+  };
 }
 function parseServer(body, source, upstreams) {
   const warnings = [];
@@ -230,6 +489,9 @@ function parseServer(body, source, upstreams) {
   const site = { serverNames: names, ssl, target, source };
   if (routes) site.routes = routes;
   if (certPath && keyPath) site.tls = { certPath, keyPath };
+  const tunables = parseProxyDirectives(body);
+  if (tunables.settings) site.proxy = tunables.settings;
+  if (tunables.raw) site.proxyRaw = tunables.raw;
   return { site, warnings };
 }
 function parseNginxConfig(raw) {
@@ -264,21 +526,31 @@ var OUR_EDGE_SITE_GLOBS = [
   `${OPENRESTY_DEFAULT_PATHS.sitesDir}/*.conf`,
   "/etc/openresty/sites-enabled/*.conf"
 ];
+async function scanForeignOpenResty(executor) {
+  const dump = await dumpResolvedConfig(executor, ["openresty"]);
+  if (dump) return parseNginxConfig(dump);
+  return scanOpenshipEdge(executor);
+}
 async function scanOpenshipEdge(executor) {
   const cat = `cat ${OUR_EDGE_SITE_GLOBS.join(" ")} 2>/dev/null`;
-  const raw = await tryExec(executor, cat);
+  const raw = await tryExec2(executor, cat);
   if (raw?.trim()) return parseNginxConfig(raw);
   const container = await resolveOurEdgeContainer(executor);
   if (!container) return parseNginxConfig("");
-  const fromContainer = await tryExec(executor, containerCommand(container, cat));
+  const fromContainer = await tryExec2(executor, containerCommand(container, cat));
   return parseNginxConfig(fromContainer ?? "");
 }
 
 // ../../packages/adapters/src/system/proxy/import/caddy.ts
 var CADDYFILE_PATHS = ["/etc/caddy/Caddyfile", "/etc/Caddyfile"];
+async function loadCaddyAdminConfig(executor) {
+  const endpoint = "http://localhost:2019/config/";
+  const out = await tryExec2(executor, `curl -fsS ${endpoint} 2>/dev/null`) || await tryExec2(executor, `wget -qO- ${endpoint} 2>/dev/null`);
+  return out && out.trim().startsWith("{") ? out : null;
+}
 async function loadCaddyJson(executor) {
   for (const p of CADDYFILE_PATHS) {
-    const out = await tryExec(executor, `caddy adapt --adapter caddyfile --config ${p} 2>/dev/null`);
+    const out = await tryExec2(executor, `caddy adapt --adapter caddyfile --config ${p} 2>/dev/null`);
     if (out && out.trim().startsWith("{")) return out;
   }
   return null;
@@ -393,7 +665,7 @@ function parseCaddyJson(raw) {
 }
 async function loadCaddyfile(executor) {
   for (const p of CADDYFILE_PATHS) {
-    const out = await tryExec(executor, `cat ${p} 2>/dev/null`);
+    const out = await tryExec2(executor, `cat ${p} 2>/dev/null`);
     if (out && out.trim()) return out;
   }
   return "";
@@ -430,8 +702,9 @@ function parseAddresses(header) {
   }).filter((a) => a.host && !a.host.startsWith(":") && a.host !== "*");
 }
 async function scanCaddy(executor) {
-  const json = await loadCaddyJson(executor);
-  if (json) {
+  for (const load of [loadCaddyAdminConfig, loadCaddyJson]) {
+    const json = await load(executor);
+    if (!json) continue;
     const parsed = parseCaddyJson(json);
     if (parsed && (parsed.sites.length > 0 || parsed.warnings.length > 0)) {
       return { proxy: "caddy", sites: parsed.sites, warnings: parsed.warnings };
@@ -527,7 +800,7 @@ async function scanCaddyText(executor) {
 
 // ../../packages/adapters/src/system/proxy/import/apache.ts
 async function vhostFilesFromDump(executor) {
-  const dump = await tryExec(
+  const dump = await tryExec2(
     executor,
     "apachectl -S 2>/dev/null || apache2ctl -S 2>/dev/null || httpd -S 2>/dev/null"
   );
@@ -542,18 +815,22 @@ async function vhostFilesFromDump(executor) {
 async function loadApacheConfig(executor) {
   const files = await vhostFilesFromDump(executor);
   if (files.length > 0) {
-    const cat2 = await tryExec(executor, `cat ${files.map(sq3).join(" ")} 2>/dev/null`);
+    const cat2 = await tryExec2(executor, `cat ${files.map(sq3).join(" ")} 2>/dev/null`);
     if (cat2 && cat2.trim()) return cat2;
   }
-  const cat = await tryExec(
+  const cat = await tryExec2(
     executor,
     "cat /etc/apache2/sites-enabled/*.conf /etc/apache2/apache2.conf /etc/httpd/conf.d/*.conf /etc/httpd/conf/httpd.conf 2>/dev/null"
   );
   return cat ?? "";
 }
+function unquote(value) {
+  return value.replace(/^["']|["']$/g, "");
+}
 function directive(body, name) {
   const m = body.match(new RegExp(`(?:^|\\n)\\s*${name}\\s+([^\\n]+)`, "i"));
-  return m?.[1]?.trim();
+  const value = m?.[1]?.trim();
+  return value === void 0 ? void 0 : unquote(value);
 }
 function directiveAll(body, name) {
   return [...body.matchAll(new RegExp(`(?:^|\\n)\\s*${name}\\s+([^\\n]+)`, "gi"))].map(
@@ -570,7 +847,36 @@ function isHttpsRedirectOnly(body) {
   return redirects.length > 0 && redirects.some((t) => /^https:\/\//i.test(t));
 }
 function hostOnly(name) {
-  return name.trim().replace(/^https?:\/\//i, "").replace(/:\d+$/, "");
+  return unquote(name.trim()).replace(/^https?:\/\//i, "").replace(/:\d+$/, "");
+}
+function proxyRoutes(body) {
+  const routes = [];
+  const scopes = [];
+  let regexScoped = false;
+  for (const line of body.split("\n")) {
+    const open = line.match(/^\s*<Location(Match)?\s+([^>]*)>/i);
+    if (open) {
+      const regex = Boolean(open[1]);
+      const arg = unquote(open[2].trim());
+      scopes.push({ path: !regex && arg.startsWith("/") ? arg : null, regex });
+      continue;
+    }
+    if (/^\s*<\/Location(?:Match)?\s*>/i.test(line)) {
+      scopes.pop();
+      continue;
+    }
+    const m = line.match(/^\s*ProxyPass\s+(\S+)(?:\s+(\S+))?/i);
+    if (!m) continue;
+    const first = unquote(m[1]);
+    if (first.startsWith("/")) {
+      routes.push({ path: first, url: m[2] ? unquote(m[2]) : "" });
+      continue;
+    }
+    const scope = scopes[scopes.length - 1];
+    if (scope?.path) routes.push({ path: scope.path, url: first });
+    else if (scope?.regex) regexScoped = true;
+  }
+  return { routes, regexScoped };
 }
 function parseVhost(body, portHint) {
   const serverName = directive(body, "ServerName")?.split(/\s+/)[0];
@@ -580,8 +886,9 @@ function parseVhost(body, portHint) {
     return { warning: "apache: skipped a VirtualHost with no ServerName" };
   }
   if (isHttpsRedirectOnly(body)) return null;
-  const routes = [...body.matchAll(/(?:^|\n)\s*ProxyPass\s+(\S+)\s+(\S+)/gi)].map((m) => ({ path: m[1], url: m[2] })).filter((p) => p.url && p.url !== "!");
-  const docRoot = directive(body, "DocumentRoot")?.replace(/^["']|["']$/g, "");
+  const proxy = proxyRoutes(body);
+  const routes = proxy.routes.filter((p) => p.url && p.url !== "!");
+  const docRoot = directive(body, "DocumentRoot");
   const fcgiMatch = /(?:^|\n)\s*ProxyPassMatch\s+[^\n]*(fcgi:|php-fpm|php\d*-fpm|\.sock)/i.test(body);
   const certPath = directive(body, "SSLCertificateFile");
   const keyPath = directive(body, "SSLCertificateKeyFile");
@@ -605,6 +912,10 @@ function parseVhost(body, portHint) {
     return {
       warning: `apache: ${names[0]} uses ProxyPassMatch (regex proxying) \u2014 re-add it manually`
     };
+  } else if (proxy.regexScoped) {
+    return {
+      warning: `apache: ${names[0]} proxies from inside a <LocationMatch> (regex proxying) \u2014 re-add it manually`
+    };
   } else {
     return { warning: `apache: ${names[0]} has neither ProxyPass nor DocumentRoot \u2014 skipped` };
   }
@@ -834,7 +1145,7 @@ function parseTraefikLabels(containers) {
   };
 }
 async function scanTraefik(executor) {
-  const out = await tryExec(
+  const out = await tryExec2(
     executor,
     `docker ps -q 2>/dev/null | xargs -r docker inspect --format '{{.Name}}	{{json .Config.Labels}}	{{range $n, $v := .NetworkSettings.Networks}}{{$n}}={{$v.IPAddress}} {{end}}	{{range $p, $v := .Config.ExposedPorts}}{{$p}} {{end}}	{{if .Config.Cmd}}{{join .Config.Cmd " "}}{{end}}' 2>/dev/null`
   );
@@ -916,7 +1227,7 @@ async function scanImportableSites(executor, proxy) {
     case "traefik":
       return scanTraefik(executor);
     case "openresty":
-      return scanOpenshipEdge(executor);
+      return scanForeignOpenResty(executor);
     default:
       return {
         proxy,
@@ -928,6 +1239,27 @@ async function scanImportableSites(executor, proxy) {
 function canImportProxy(proxy) {
   return proxy === "nginx" || proxy === "caddy" || proxy === "apache" || proxy === "traefik" || proxy === "openresty";
 }
+function unreachableStaticRoots(sites, opts) {
+  if (!opts.containerEdge) return [];
+  const visible = EDGE_CONTAINER_MOUNTS.map((m) => m.host.replace(/\/+$/, ""));
+  const out = [];
+  for (const site of sites) {
+    if (site.target.kind !== "static") continue;
+    const root = site.target.root.replace(/\/+$/, "");
+    const reachable = visible.some((v) => root === v || root.startsWith(`${v}/`));
+    if (!reachable) out.push({ host: site.serverNames[0] ?? root, root: site.target.root });
+  }
+  return out;
+}
+var EDGE_STATIC_MOUNT = EDGE_CONTAINER_MOUNTS.find((m) => m.host === "/opt/openship/static")?.host ?? "/opt/openship/static";
+async function copyStaticRootIntoEdge(executor, opts) {
+  const slug = opts.host.replace(/[^a-zA-Z0-9._-]/g, "-").replace(/^-+|-+$/g, "").toLowerCase() || "site";
+  const src = opts.root.replace(/\/+$/, "");
+  const dest = `${EDGE_STATIC_MOUNT}/_adopted/${slug}`;
+  await executor.exec(`mkdir -p ${sq2(dest)}`);
+  await executor.exec(`cp -a ${sq2(`${src}/.`)} ${sq2(`${dest}/`)}`);
+  return dest;
+}
 
 // ../../packages/adapters/src/system/proxy/import/caddy-certs.ts
 var CADDY_DATA_ROOTS = [
@@ -945,10 +1277,10 @@ function candidateNames(host) {
 async function findPairIn(exec, root, host, container) {
   for (const name of candidateNames(host)) {
     const glob = `${root}/certificates/*/${name}/${name}.crt`;
-    let certPath = firstCrt(await tryExec(exec, `ls -1 ${glob} 2>/dev/null`));
+    let certPath = firstCrt(await tryExec2(exec, `ls -1 ${glob} 2>/dev/null`));
     if (!certPath && container) {
       certPath = firstCrt(
-        await tryExec(exec, containerCommand(container, `ls -1 ${glob} 2>/dev/null`))
+        await tryExec2(exec, containerCommand(container, `ls -1 ${glob} 2>/dev/null`))
       );
     }
     if (certPath) return { certPath, keyPath: certPath.replace(/\.crt$/, ".key") };
@@ -994,7 +1326,7 @@ async function candidateStoragePaths(exec, container) {
   };
   if (container) {
     collect(
-      await tryExec(
+      await tryExec2(
         exec,
         `docker inspect ${sq2(container)} --format '{{json .Config.Cmd}} {{json .Args}} {{json .Config.Env}}' 2>/dev/null`
       )
@@ -1098,11 +1430,13 @@ function buildProxyRouteIndex(sites) {
             existing.ssl.keyPath = site.tls.keyPath;
           }
         }
+        if (site.proxy && (site.ssl || !existing.proxy)) existing.proxy = site.proxy;
       } else {
         list.push({
           port,
           path: up.path,
           domains: [...site.serverNames],
+          ...site.proxy ? { proxy: site.proxy } : {},
           ssl: site.ssl ? { enabled: true, certPath: site.tls?.certPath, keyPath: site.tls?.keyPath } : { enabled: false },
           source: site.source
         });
@@ -1159,7 +1493,7 @@ async function edgeProxy(exec, opts = {}) {
   return makeApi(exec, kind, ours, container);
 }
 function edgeProxyFor(exec, kind, opts = {}) {
-  return makeApi(exec, kind, opts.ours ?? kind === "openresty", opts.container ?? null);
+  return makeApi(exec, kind, opts.ours ?? false, opts.container ?? null);
 }
 async function collectProxyCerts(api, sites) {
   const certPems = {};
@@ -1223,147 +1557,6 @@ function makeApi(exec, kind, ours, container) {
   };
 }
 
-// ../../packages/adapters/src/system/proxy/takeover-journal.ts
-var JOURNAL_DIR = "/var/lib/openship";
-var JOURNAL_PATH = `${JOURNAL_DIR}/edge-takeover.json`;
-function log(message, level = "info") {
-  return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
-}
-async function tryExec2(executor, cmd) {
-  try {
-    return await executor.exec(cmd);
-  } catch {
-    return null;
-  }
-}
-async function buildJournal(executor, status) {
-  const units = /* @__PURE__ */ new Map();
-  const containers = /* @__PURE__ */ new Map();
-  const processes = /* @__PURE__ */ new Map();
-  for (const o of status.occupants) {
-    if (o.containerName && !containers.has(o.containerName)) {
-      const r = await tryExec2(
-        executor,
-        `docker inspect -f '{{.HostConfig.RestartPolicy.Name}}' ${sq2(o.containerName)} 2>/dev/null`
-      );
-      containers.set(o.containerName, { name: o.containerName, restart: r?.trim() || "no" });
-    } else if (o.systemdUnit && !units.has(o.systemdUnit)) {
-      const en = await tryExec2(executor, `systemctl is-enabled ${sq2(o.systemdUnit)} 2>/dev/null`);
-      units.set(o.systemdUnit, { unit: o.systemdUnit, wasEnabled: en?.trim() === "enabled" });
-    } else if (!o.containerName && !o.systemdUnit && o.pid && !processes.has(o.pid)) {
-      processes.set(o.pid, { pid: o.pid, command: o.rawCommand });
-    }
-  }
-  return {
-    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    units: [...units.values()],
-    containers: [...containers.values()],
-    processes: [...processes.values()]
-  };
-}
-async function writeJournal(executor, journal) {
-  try {
-    await executor.mkdir(JOURNAL_DIR);
-    await executor.writeFile(JOURNAL_PATH, JSON.stringify(journal, null, 2));
-  } catch {
-  }
-}
-async function clearJournal(executor) {
-  await tryExec2(executor, `rm -f ${JOURNAL_PATH}`);
-}
-async function readJournal(executor) {
-  const raw = await tryExec2(executor, `cat ${JOURNAL_PATH} 2>/dev/null`);
-  if (!raw?.trim()) return null;
-  try {
-    return JSON.parse(raw);
-  } catch {
-    await clearJournal(executor);
-    return null;
-  }
-}
-async function rollback(executor, journal, onLog) {
-  onLog(log("Rolling back \u2014 restoring the previous proxy...", "warn"));
-  await tryExec2(executor, `docker update --restart=no ${sq2(EDGE_CONTAINER_NAME)} 2>/dev/null || true`);
-  await tryExec2(executor, `docker stop ${sq2(EDGE_CONTAINER_NAME)} 2>/dev/null || true`);
-  await tryExec2(
-    executor,
-    "systemctl disable --now openresty 2>/dev/null || systemctl stop openresty 2>/dev/null || true; systemctl reset-failed openresty 2>/dev/null || true"
-  );
-  for (const u of journal.units) {
-    await tryExec2(
-      executor,
-      u.wasEnabled ? `systemctl enable --now ${sq2(u.unit)} 2>/dev/null || true` : `systemctl start ${sq2(u.unit)} 2>/dev/null || true`
-    );
-  }
-  for (const c of journal.containers) {
-    await tryExec2(executor, `docker update --restart=${sq2(c.restart)} ${sq2(c.name)} 2>/dev/null || true`);
-    await tryExec2(executor, `docker start ${sq2(c.name)} 2>/dev/null || true`);
-  }
-  for (const p of journal.processes ?? []) {
-    if (p.command) {
-      await tryExec2(
-        executor,
-        `setsid -f sh -c ${sq2(p.command)} 2>/dev/null || (nohup sh -c ${sq2(p.command)} >/dev/null 2>&1 &) || true`
-      );
-    } else {
-      onLog(log(`Could not restore process ${p.pid} \u2014 no command captured.`, "warn"));
-    }
-  }
-  const restored = await portIsServed(executor, 80);
-  if (!restored) {
-    onLog(
-      log(
-        "Nothing is listening on :80 after the restore \u2014 the box is NOT serving. Start your proxy by hand (e.g. `systemctl start nginx`, or `docker start <name>`).",
-        "error"
-      )
-    );
-  }
-  return restored;
-}
-async function portIsServed(executor, port) {
-  const hex = port.toString(16).toUpperCase().padStart(4, "0");
-  const out = await tryExec2(
-    executor,
-    `(command -v ss >/dev/null 2>&1 && ss -ltn 2>/dev/null | grep -qE ':${port}[[:space:]]' && echo yes) || (grep -qiE '^[[:space:]]*[0-9]+:[[:space:]]*[0-9A-F]{8}:${hex}[[:space:]]+[0-9A-F]{8}:0000[[:space:]]+0A' /proc/net/tcp 2>/dev/null && echo yes) || true`
-  );
-  return (out ?? "").includes("yes");
-}
-async function beginEdgeTakeover(executor, status, onLog) {
-  await writeJournal(executor, await buildJournal(executor, status));
-  await freeEdgeTargets(executor, stopTargetsForStatus(status), (m, l) => onLog(log(m, l)));
-}
-async function rollbackEdgeTakeover(executor, onLog) {
-  const journal = await readJournal(executor);
-  if (!journal || journal.completed) return false;
-  const restored = await rollback(executor, journal, onLog);
-  await clearJournal(executor);
-  return restored;
-}
-async function completeEdgeTakeover(executor) {
-  const journal = await readJournal(executor);
-  if (journal) {
-    journal.completed = true;
-    await writeJournal(executor, journal);
-  }
-  await clearJournal(executor);
-}
-async function recoverInterruptedTakeover(executor, onLog, isEdgeHealthy) {
-  const journal = await readJournal(executor);
-  if (!journal) return;
-  if (journal.completed) {
-    await clearJournal(executor);
-    return;
-  }
-  if (isEdgeHealthy && await isEdgeHealthy()) {
-    onLog(log("Found an unfinished edge takeover, but our edge is serving \u2014 keeping it.", "warn"));
-    await clearJournal(executor);
-    return;
-  }
-  onLog(log("Found an interrupted edge takeover \u2014 restoring the previous proxy.", "warn"));
-  await rollback(executor, journal, onLog);
-  await clearJournal(executor);
-}
-
 // ../../packages/adapters/src/system/catalog.ts
 function dockerInstallPlan(profile) {
   if (profile.os !== "linux") {
@@ -1421,120 +1614,15 @@ function rsyncInstallPlan(profile) {
     verifyCommand: "rsync --version | head -n 1"
   };
 }
-var OPENRESTY_APT_SOURCES = [
-  // ARM64: openresty.org publishes aarch64 debs under a SEPARATE path
-  // (openresty.org/package/arm64/<repo>); the default path is amd64-only, so on
-  // aarch64 `apt-get install openresty` finds no candidate and `set -e` aborts
-  // the whole setup (issue #109). Switch the base URL by arch and tag the deb
-  // line with `arch=` so apt fetches the right index. `dpkg --print-architecture`
-  // returns exactly amd64/arm64 (matches OpenResty's path + arch qualifier).
-  'OR_ARCH="$(dpkg --print-architecture 2>/dev/null || echo amd64)"',
-  'if [ "$OR_ARCH" = arm64 ]; then OR_BASE="http://openresty.org/package/arm64/$REPO"; else OR_BASE="http://openresty.org/package/$REPO"; fi',
-  // `|| REPO_CODENAME=""` so a failed substitution (no lsb_release AND no
-  // /etc/os-release, e.g. a stripped container) doesn't trip `set -e` before
-  // the empty-var fallback below can pick a default.
-  'REPO_CODENAME="$(lsb_release -sc 2>/dev/null || { . /etc/os-release 2>/dev/null && echo "$VERSION_CODENAME"; })" || REPO_CODENAME=""',
-  'if [ "$REPO" = debian ]; then OR_FALLBACKS="bookworm bullseye"; else OR_FALLBACKS="noble jammy focal"; fi',
-  'OR_CODENAME=""',
-  "for c in $REPO_CODENAME $OR_FALLBACKS; do",
-  '  if wget -q --spider --tries=2 --timeout=15 "$OR_BASE/dists/$c/Release"; then OR_CODENAME="$c"; break; fi',
-  "done",
-  'if [ -z "$OR_CODENAME" ]; then case "$REPO" in debian) OR_CODENAME=bookworm ;; *) OR_CODENAME=noble ;; esac; fi',
-  '[ "$OR_CODENAME" = "$REPO_CODENAME" ] || echo "[openresty] apt repo has no codename $REPO_CODENAME; using nearest supported LTS $OR_CODENAME" >&2',
-  'echo "deb [arch=$OR_ARCH signed-by=/usr/share/keyrings/openresty.gpg] $OR_BASE $OR_CODENAME main" > /etc/apt/sources.list.d/openresty.list'
-];
-function openrestyInstallPlan(profile) {
-  if (profile.os !== "linux") {
-    return {
-      supported: false,
-      unsupportedReason: "OpenResty installation is only supported on Linux servers"
-    };
-  }
-  let installCommand;
-  if (profile.packageManager === "apt") {
-    const distro = profile.distro === "debian" ? "debian" : "ubuntu";
-    installCommand = [
-      "set -e",
-      // Heal a stale/bad openresty.list left by a prior run (e.g. the #86
-      // 'resolute' pin) BEFORE the first apt-get update reads it — otherwise
-      // set -e aborts here and the repo never gets rewritten.
-      "rm -f /etc/apt/sources.list.d/openresty.list",
-      "apt-get update -qq && apt-get install -y -qq wget gnupg2 lsb-release",
-      "wget -qO /tmp/openresty-pubkey.gpg https://openresty.org/package/pubkey.gpg",
-      "gpg --yes --dearmor -o /usr/share/keyrings/openresty.gpg /tmp/openresty-pubkey.gpg",
-      `REPO=${distro}`,
-      ...OPENRESTY_APT_SOURCES,
-      "apt-get update -qq && apt-get install -y -qq openresty"
-    ].join("\n");
-  } else if (profile.packageManager === "dnf") {
-    const distro = profile.distro === "fedora" ? "fedora" : "centos";
-    installCommand = `wget -qO /etc/yum.repos.d/openresty.repo https://openresty.org/package/${distro}/openresty.repo && dnf install -y openresty`;
-  } else if (profile.packageManager === "yum") {
-    installCommand = "wget -qO /etc/yum.repos.d/openresty.repo https://openresty.org/package/centos/openresty.repo && yum install -y openresty";
-  } else if (profile.packageManager === "apk") {
-    installCommand = [
-      "apk add --no-cache wget",
-      "wget -qO /etc/apk/keys/admin@openresty.com-5ea678a6.rsa.pub https://openresty.org/package/alpine/admin@openresty.com-5ea678a6.rsa.pub",
-      `. /etc/os-release && echo "https://openresty.org/package/alpine/v$( echo $VERSION_ID | cut -d. -f1,2 )/main" >> /etc/apk/repositories`,
-      "apk update && apk add openresty"
-    ].join(" && ");
-  } else {
-    installCommand = [
-      "set -e",
-      "if command -v apt-get >/dev/null 2>&1; then",
-      "  rm -f /etc/apt/sources.list.d/openresty.list",
-      "  apt-get update -qq && apt-get install -y -qq wget gnupg2 lsb-release",
-      "  wget -qO /tmp/openresty-pubkey.gpg https://openresty.org/package/pubkey.gpg",
-      "  gpg --yes --dearmor -o /usr/share/keyrings/openresty.gpg /tmp/openresty-pubkey.gpg",
-      '  DISTRO=$(. /etc/os-release 2>/dev/null && echo "$ID" || echo "ubuntu")',
-      '  case "$DISTRO" in debian) REPO=debian ;; *) REPO=ubuntu ;; esac',
-      ...OPENRESTY_APT_SOURCES.map((l) => "  " + l),
-      "  apt-get update -qq && apt-get install -y -qq openresty",
-      "elif command -v dnf >/dev/null 2>&1; then",
-      "  wget -qO /etc/yum.repos.d/openresty.repo https://openresty.org/package/centos/openresty.repo && dnf install -y openresty",
-      "elif command -v yum >/dev/null 2>&1; then",
-      "  wget -qO /etc/yum.repos.d/openresty.repo https://openresty.org/package/centos/openresty.repo && yum install -y openresty",
-      "elif command -v apk >/dev/null 2>&1; then",
-      "  apk add --no-cache wget \\",
-      "  && wget -qO /etc/apk/keys/admin@openresty.com-5ea678a6.rsa.pub https://openresty.org/package/alpine/admin@openresty.com-5ea678a6.rsa.pub \\",
-      '  && . /etc/os-release && echo "https://openresty.org/package/alpine/v$(echo $VERSION_ID | cut -d. -f1,2)/main" >> /etc/apk/repositories \\',
-      "  && apk update && apk add openresty",
-      "else",
-      '  echo "No supported package manager found (tried apt-get, dnf, yum, apk)" >&2 && exit 1',
-      "fi"
-    ].join("\n");
-  }
-  return {
-    supported: true,
-    installCommand,
-    startCommand: profile.serviceManager === "systemd" ? "systemctl enable openresty && systemctl start openresty" : void 0,
-    verifyCommand: "openresty -v 2>&1"
-  };
-}
-function certbotInstallPlan(profile) {
-  const commands = {
-    apt: "apt-get update -qq && apt-get install -y -qq certbot",
-    dnf: "dnf install -y certbot",
-    yum: "yum install -y certbot",
-    apk: "apk add --no-cache certbot"
-  };
-  const installCommand = commands[profile.packageManager];
-  if (!installCommand) {
-    return {
-      supported: false,
-      unsupportedReason: "Certbot installation is only supported on Linux with apt, dnf, or yum"
-    };
-  }
-  return {
-    supported: true,
-    installCommand,
-    verifyCommand: "certbot --version 2>/dev/null"
-  };
-}
 var systemCatalog = {
   checks: {
     docker: {
       versionCommand: "docker --version",
+      // A POSITIVE signal, not a bare exit code: only a daemon that answered can
+      // name its version. `docker info >/dev/null && echo ok` prints ok on ANY
+      // exit-0, so a daemon answering nothing would read as healthy — trading #408's
+      // false negative for a false positive. Leave stderr alone too; `checkDocker`
+      // puts the failure text in the component message.
       daemonCommand: "docker info --format '{{.ServerVersion}}'",
       parseVersion: (output) => output.match(/Docker version ([^\s,]+)/)?.[1] ?? output,
       missingMessage: "Docker is not installed",
@@ -1565,12 +1653,15 @@ var systemCatalog = {
       missingMessage: "rsync is not installed"
     }
   },
+  // No `openresty` / `certbot` plans: nothing apt-installs an edge any more. Both
+  // shipped inside the `openship-edge` image, and their host-package plans (with the
+  // openresty.org apt-repo codename probing that came with them) went with the
+  // installers. `checks.openresty` stays — it parses the version out of the
+  // CONTAINER. See installer.ts `installContainerEdge`.
   installs: {
     docker: dockerInstallPlan,
     git: gitInstallPlan,
-    rsync: rsyncInstallPlan,
-    openresty: openrestyInstallPlan,
-    certbot: certbotInstallPlan
+    rsync: rsyncInstallPlan
   }
 };
 
@@ -1594,7 +1685,7 @@ function elevatedExecutor(inner) {
   };
   const overrides = {
     exec: (command, opts) => inner.exec(elevateCommand(command), opts),
-    streamExec: (command, onLog) => inner.streamExec(elevateCommand(command), onLog),
+    streamExec: (command, onLog, opts) => inner.streamExec(elevateCommand(command), onLog, opts),
     writeFile: writeFileElevated,
     // Elevated for the same reason as writeFile: the vhost/conf dirs are root-owned,
     // and the Proxy would otherwise forward this to the inner executor unelevated —
@@ -1621,7 +1712,7 @@ function elevatedExecutor(inner) {
 }
 
 // ../../packages/adapters/src/system/installer.ts
-function log2(message, level = "info") {
+function log3(message, level = "info") {
   return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
 }
 async function prepareExecutor(executor, component) {
@@ -1646,21 +1737,21 @@ async function installDocker(executor, onLog) {
   if (!plan.supported || !plan.installCommand || !plan.verifyCommand) {
     return { component: "docker", success: false, error: plan.unsupportedReason ?? "Docker install not supported" };
   }
-  onLog(log2("Installing Docker Engine..."));
+  onLog(log3("Installing Docker Engine..."));
   try {
     const { code } = await executor.streamExec(plan.installCommand, onLog);
     if (code !== 0) return { component: "docker", success: false, error: "Docker install failed" };
     if (plan.startCommand) {
-      onLog(log2("Starting Docker service..."));
+      onLog(log3("Starting Docker service..."));
       await executor.streamExec(plan.startCommand, onLog);
     }
     const version = await executor.exec(plan.verifyCommand);
     const parsed = systemCatalog.checks.docker.parseVersion(version);
-    onLog(log2(`Docker ${parsed} installed`));
+    onLog(log3(`Docker ${parsed} installed`));
     return { component: "docker", success: true, version: parsed };
   } catch (err) {
     const msg = safeErrorMessage(err);
-    onLog(log2(`Docker installation failed: ${msg}`, "error"));
+    onLog(log3(`Docker installation failed: ${msg}`, "error"));
     return { component: "docker", success: false, error: msg };
   }
 }
@@ -1673,17 +1764,17 @@ async function installGit(executor, onLog, opts) {
   if (!plan.supported || !plan.installCommand || !plan.verifyCommand) {
     return { component: "git", success: false, error: plan.unsupportedReason ?? "Git install not supported" };
   }
-  onLog(log2(opts?.label ? `Installing Git in ${opts.label}...` : "Installing Git..."));
+  onLog(log3(opts?.label ? `Installing Git in ${opts.label}...` : "Installing Git..."));
   try {
     const { code } = await executor.streamExec(plan.installCommand, onLog);
     if (code !== 0) return { component: "git", success: false, error: "Git installation failed" };
     const version = await executor.exec(plan.verifyCommand);
     const parsed = systemCatalog.checks.git.parseVersion(version);
-    onLog(log2(opts?.label ? `Git ${parsed} installed in ${opts.label}` : `Git ${parsed} installed`));
+    onLog(log3(opts?.label ? `Git ${parsed} installed in ${opts.label}` : `Git ${parsed} installed`));
     return { component: "git", success: true, version: parsed };
   } catch (err) {
     const msg = safeErrorMessage(err);
-    onLog(log2(`Git installation failed: ${msg}`, "error"));
+    onLog(log3(`Git installation failed: ${msg}`, "error"));
     return { component: "git", success: false, error: msg };
   }
 }
@@ -1696,17 +1787,17 @@ async function installRsync(executor, onLog) {
   if (!plan.supported || !plan.installCommand || !plan.verifyCommand) {
     return { component: "rsync", success: false, error: plan.unsupportedReason ?? "rsync install not supported" };
   }
-  onLog(log2("Installing rsync..."));
+  onLog(log3("Installing rsync..."));
   try {
     const { code } = await executor.streamExec(plan.installCommand, onLog);
     if (code !== 0) return { component: "rsync", success: false, error: "rsync installation failed" };
     const version = await executor.exec(plan.verifyCommand);
     const parsed = systemCatalog.checks.rsync.parseVersion(version);
-    onLog(log2(`rsync ${parsed} installed`));
+    onLog(log3(`rsync ${parsed} installed`));
     return { component: "rsync", success: true, version: parsed };
   } catch (err) {
     const msg = safeErrorMessage(err);
-    onLog(log2(`rsync installation failed: ${msg}`, "error"));
+    onLog(log3(`rsync installation failed: ${msg}`, "error"));
     return { component: "rsync", success: false, error: msg };
   }
 }
@@ -1716,7 +1807,7 @@ async function installContainerEdge(executor, onLog, config) {
   executor = prep.executor;
   if (!await dockerAvailable(executor)) {
     const error = "The edge is a container image and needs Docker on this server. Install the Docker component first, then install the edge.";
-    onLog(log2(error, "error"));
+    onLog(log3(error, "error"));
     return { component: "edge", success: false, error };
   }
   try {
@@ -1726,7 +1817,7 @@ async function installContainerEdge(executor, onLog, config) {
       image: config?.edgeImage
     });
     if (result.converted) {
-      onLog(log2("Edge moved from host OpenResty to the container edge", "warn"));
+      onLog(log3("Edge moved from host OpenResty to the container edge", "warn"));
     }
     const version = await executor.exec(containerCommand(result.container, "openresty -v 2>&1")).catch(() => "");
     return {
@@ -1737,18 +1828,17 @@ async function installContainerEdge(executor, onLog, config) {
   } catch (err) {
     if (err instanceof EdgeMigrateRequested) throw err;
     const msg = safeErrorMessage(err);
-    onLog(log2(`Edge setup failed: ${msg}`, "error"));
+    onLog(log3(`Edge setup failed: ${msg}`, "error"));
     return { component: "edge", success: false, error: msg };
   }
 }
 var COMPONENT_INSTALLERS = {
-  docker: (exec, log5) => installDocker(exec, log5),
-  // The edge is ONE component and it is a container image. `installOpenResty` /
-  // `installCertbot` are NOT reachable from here — they remain only for the mail
-  // server's own proxy (mail.service.ts) and for converting a legacy host edge.
-  edge: (exec, log5, config) => installContainerEdge(exec, log5, config),
-  git: (exec, log5) => installGit(exec, log5),
-  rsync: (exec, log5) => installRsync(exec, log5)
+  docker: (exec, log6) => installDocker(exec, log6),
+  // The edge is ONE component and it is a container image — there is no
+  // host-OpenResty or host-certbot installer to reach for any more.
+  edge: (exec, log6, config) => installContainerEdge(exec, log6, config),
+  git: (exec, log6) => installGit(exec, log6),
+  rsync: (exec, log6) => installRsync(exec, log6)
 };
 
 // ../../packages/adapters/src/system/available-version.ts
@@ -1876,7 +1966,7 @@ async function tryExec4(executor, command) {
       "checks",
       `exec:ok ${command} (${formatDuration(startedAt)})`
     );
-    return result;
+    return { output: result.trim(), error: null };
   } catch (err) {
     if (isRemoteConnectionError(err)) {
       systemDebug(
@@ -1890,9 +1980,15 @@ async function tryExec4(executor, command) {
       "checks",
       `exec:fail ${command} (${formatDuration(startedAt)}) ${msg}`
     );
-    return null;
+    return { output: "", error: msg || `\`${command}\` failed` };
   }
 }
+function withReason(message, error) {
+  if (!error) return message;
+  const first = error.split("\n").map((line) => line.trim()).find(Boolean);
+  if (!first) return message;
+  return `${message} \u2014 ${first.length > 200 ? `${first.slice(0, 199)}\u2026` : first}`;
+}
 function healthy(name, version, running) {
   const component = getSystemComponentDefinition(name);
   return {
@@ -1925,15 +2021,18 @@ async function checkDocker(executor) {
   const startedAt = Date.now();
   const recipe = systemCatalog.checks.docker;
   const version = await tryExec4(executor, recipe.versionCommand);
-  if (!version) {
+  if (!version.output) {
     systemDebug("checks", `docker:missing (${formatDuration(startedAt)})`);
-    return unhealthy("docker", recipe.missingMessage);
+    return unhealthy("docker", withReason(recipe.missingMessage, version.error));
   }
-  const parsed = recipe.parseVersion(version);
+  const parsed = recipe.parseVersion(version.output);
   const info = await tryExec4(executor, recipe.daemonCommand);
-  if (!info) {
-    systemDebug("checks", `docker:not-running (${formatDuration(startedAt)})`);
-    return unhealthy("docker", recipe.notRunningMessage, {
+  if (!info.output) {
+    systemDebug(
+      "checks",
+      `docker:not-running (${formatDuration(startedAt)}) ${info.error ?? "probe exited 0 with no server version"}`
+    );
+    return unhealthy("docker", withReason(recipe.notRunningMessage, info.error), {
       version: parsed,
       running: false
     });
@@ -1945,11 +2044,11 @@ async function checkGit(executor) {
   const startedAt = Date.now();
   const recipe = systemCatalog.checks.git;
   const version = await tryExec4(executor, recipe.versionCommand);
-  if (!version) {
+  if (!version.output) {
     systemDebug("checks", `git:missing (${formatDuration(startedAt)})`);
-    return unhealthy("git", recipe.missingMessage);
+    return unhealthy("git", withReason(recipe.missingMessage, version.error));
   }
-  const parsed = recipe.parseVersion(version);
+  const parsed = recipe.parseVersion(version.output);
   systemDebug("checks", `git:healthy (${formatDuration(startedAt)})`);
   return healthy("git", parsed);
 }
@@ -1957,11 +2056,11 @@ async function checkRsync(executor) {
   const startedAt = Date.now();
   const recipe = systemCatalog.checks.rsync;
   const version = await tryExec4(executor, recipe.versionCommand);
-  if (!version) {
+  if (!version.output) {
     systemDebug("checks", `rsync:missing (${formatDuration(startedAt)})`);
-    return unhealthy("rsync", recipe.missingMessage);
+    return unhealthy("rsync", withReason(recipe.missingMessage, version.error));
   }
-  const parsed = recipe.parseVersion(version);
+  const parsed = recipe.parseVersion(version.output);
   systemDebug("checks", `rsync:healthy (${formatDuration(startedAt)})`);
   return healthy("rsync", parsed);
 }
@@ -1975,17 +2074,29 @@ async function checkEdge(executor) {
       "No edge on this server. The edge is the openship-edge container \u2014 install it (requires Docker)."
     );
   }
+  const verdict = await verifyEdgeServing(executor, container);
+  if (!verdict.serving) {
+    systemDebug("checks", `edge:not-serving (${formatDuration(startedAt)})`);
+    return unhealthy(
+      "edge",
+      `The edge container ${container} is not serving \u2014 ${verdict.reason ?? "it is not listening on :80"}`,
+      { running: false }
+    );
+  }
   const version = await tryExec4(executor, containerCommand(container, "openresty -v 2>&1"));
-  if (!version) {
+  if (!version.output) {
     systemDebug("checks", `edge:container-unresponsive (${formatDuration(startedAt)})`);
     return unhealthy(
       "edge",
-      `The edge container ${container} is running but not responding \u2014 check \`docker logs ${container}\``,
+      withReason(
+        `The edge container ${container} is serving on :80 but not answering \u2014 check \`docker logs ${container}\``,
+        version.error
+      ),
       { running: false }
     );
   }
   systemDebug("checks", `edge:healthy (${formatDuration(startedAt)})`);
-  return healthy("edge", systemCatalog.checks.openresty.parseVersion(version), true);
+  return healthy("edge", systemCatalog.checks.openresty.parseVersion(version.output), true);
 }
 var COMPONENT_CHECKS = {
   docker: checkDocker,
@@ -2075,24 +2186,36 @@ function describeEdgeOwner(occupants) {
 }
 
 // ../../packages/adapters/src/system/proxy/consent.ts
-function log3(message, level = "info") {
+function log4(message, level = "info") {
   return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
 }
 async function ensureEdgeClear(executor, config, onLog) {
   const status = await probeEdge(executor);
-  if (status.canProceedClean) return { tookOver: false };
+  if (status.canProceedClean) return { tookOver: false, status };
   const takeover = async () => {
-    onLog(log3(
+    onLog(log4(
       `Taking over ports from ${status.occupants.map((o) => o.command ?? o.port).join(", ")}...`,
       "warn"
     ));
-    const configured = config?.edgePolicy?.stopTargets ?? [];
-    const targets = configured.length ? configured : stopTargetsForStatus(status);
-    await freeEdgeTargets(executor, targets, (m, l) => onLog(log3(m, l)));
+    const freed = await beginEdgeTakeover(
+      executor,
+      status,
+      onLog,
+      config?.edgePolicy?.stopTargets ?? []
+    );
+    if (!freed.freed) {
+      await rollbackEdgeTakeover(executor, onLog);
+      const plural = freed.stillBound.length > 1;
+      throw new AppError(
+        `Stopped the existing proxy, but port${plural ? "s" : ""} ${freed.stillBound.join(" and ")} ${plural ? "are" : "is"} still in use, so the edge can't bind. Nothing was installed and the previous proxy has been restored \u2014 find what else is holding the port and retry.`,
+        409,
+        "EDGE_PORTS_STILL_BOUND"
+      );
+    }
   };
   if (config?.edgePolicy?.mode === "takeover") {
     await takeover();
-    return { tookOver: true };
+    return { tookOver: true, status };
   }
   if (config?.promptUser) {
     const known = status.classification === "known";
@@ -2121,7 +2244,7 @@ async function ensureEdgeClear(executor, config, onLog) {
     }
     if (action === "override") {
       await takeover();
-      return { tookOver: true };
+      return { tookOver: true, status };
     }
     throw new EdgeConflictError(status);
   }
@@ -2129,7 +2252,7 @@ async function ensureEdgeClear(executor, config, onLog) {
 }
 
 // ../../packages/adapters/src/system/proxy/ensure-container-edge.ts
-function log4(message, level = "info") {
+function log5(message, level = "info") {
   return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level };
 }
 var injectedDefaultImage;
@@ -2139,15 +2262,8 @@ function setDefaultEdgeImage(image) {
 function resolveEdgeImage(explicit) {
   return buildEdgeImageRef({ explicit, injectedDefault: injectedDefaultImage });
 }
-async function dockerAvailable(executor) {
-  return executor.exec("docker version --format '{{.Server.Version}}' 2>/dev/null").then((v) => Boolean(v.trim())).catch(() => false);
-}
-async function runningImage(executor, container) {
-  const out = await executor.exec(`docker inspect -f '{{.Config.Image}}' ${sq(container)} 2>/dev/null`).catch(() => "");
-  return out.trim() || null;
-}
 async function containerEdgeProvider(executor, container, opts) {
-  const { NginxProvider: Provider } = await import("./nginx-QE4DOM5J.js");
+  const { NginxProvider: Provider } = await import("./nginx-AXGNWRKZ.js");
   return new Provider({
     ...opts,
     // Vhosts go to the BIND-MOUNTED HOST dir (so every host-side reader — the
@@ -2155,6 +2271,13 @@ async function containerEdgeProvider(executor, container, opts) {
     // while reload/certbot run inside the container.
     paths: EDGE_HOST_PATHS,
     executor: edgeContainerExecutor(executor, container),
+    // Challenge tokens go to the HOST side of the ACME mount, for the same reason
+    // vhosts do. This is the ONE mount whose two sides differ
+    // (/var/lib/openship/edge/acme → /var/www/acme), so the write path and the
+    // vhost's `root` are genuinely different strings — `root` stays the container
+    // path. Overridden here and nowhere else, next to the `paths` override it
+    // mirrors, so the two cannot drift.
+    challengeDir: EDGE_CHALLENGE_HOST_DIR,
     // MUST be pinned: re-detection answers from inside the container and would
     // repoint sitesDir at a host dir the edge never reads.
     pinPaths: true,
@@ -2164,8 +2287,8 @@ async function containerEdgeProvider(executor, container, opts) {
   });
 }
 async function localContainerEdgeProvider(container, opts) {
-  const { DockerEdgeExecutor } = await import("./docker-edge-executor-5I4M5QT7.js");
-  const { NginxProvider: Provider } = await import("./nginx-QE4DOM5J.js");
+  const { DockerEdgeExecutor } = await import("./docker-edge-executor-62N64MGS.js");
+  const { NginxProvider: Provider } = await import("./nginx-AXGNWRKZ.js");
   return new Provider({
     ...opts,
     paths: OPENRESTY_DEFAULT_PATHS,
@@ -2203,37 +2326,39 @@ function buildEdgeRunCommand(container, image) {
     sq(image)
   ].join(" ");
 }
-async function swapEdgeImage(executor, container, from, to, opts) {
+function makeEdgeStart(executor, container, opts) {
   const { onLog } = opts;
-  onLog(log4(`Updating the edge: ${from} \u2192 ${to}`));
-  const pull = await executor.streamExec(`docker pull ${sq(to)}`, onLog);
-  if (pull.code !== 0) {
-    onLog(log4(`Could not pull ${to} \u2014 the edge stays on ${from}.`, "warn"));
-    return { swapped: false, edgeDown: false };
-  }
-  const start = async (image) => {
+  return async (image) => {
     if (!await startEdgeContainer(executor, container, image, onLog)) return false;
-    const listening = await waitForPortListening(executor, 80, {
+    const verdict = await verifyEdgeServing(executor, container, {
       timeoutMs: opts.verifyTimeoutMs ?? 3e4
     });
-    return !(listening.checked && !listening.listening);
+    if (!verdict.serving && verdict.reason) onLog(log5(`Edge ${image}: ${verdict.reason}`, "warn"));
+    return verdict.serving;
   };
-  if (await start(to)) {
-    onLog(log4(`Edge updated to ${to}`));
-    return { swapped: true, edgeDown: false };
+}
+async function verifyEdgeServing(executor, container, opts = {}) {
+  if (await edgeIsBroken(executor, container)) {
+    const reason = await edgeCrashReason(executor, container);
+    return { serving: false, reason: reason ?? "the edge container is not running" };
   }
-  onLog(log4(`Edge ${to} failed to come up \u2014 rolling back to ${from}...`, "error"));
-  if (await start(from)) {
-    return { swapped: false, edgeDown: false };
+  if (opts.configTest) {
+    try {
+      await executor.exec(containerCommand(container, "openresty -t 2>&1"));
+    } catch (err) {
+      const out = safeErrorMessage(err);
+      return { serving: false, reason: edgeFailureReason(out) ?? out };
+    }
   }
-  onLog(log4(`Rollback to ${from} ALSO failed \u2014 the edge is down on this server.`, "error"));
-  return { swapped: false, edgeDown: true };
-}
-async function listDir(executor, dir) {
-  const out = await executor.exec(`ls -1 ${sq(dir)} 2>/dev/null || true`).catch(() => "");
-  return new Set(
-    out.split("\n").map((l) => l.trim()).filter(Boolean)
-  );
+  const listening = await waitForPortListening(executor, 80, { timeoutMs: opts.timeoutMs ?? 0 });
+  if (listening.checked && !listening.listening) {
+    const reason = await edgeCrashReason(executor, container);
+    return {
+      serving: false,
+      reason: reason ?? "the edge container is up but nothing is listening on :80"
+    };
+  }
+  return { serving: true };
 }
 async function ensureContainerEdge(executor, opts) {
   const { onLog } = opts;
@@ -2241,123 +2366,112 @@ async function ensureContainerEdge(executor, opts) {
   const image = resolveEdgeImage(opts.image);
   const existing = await resolveOurEdgeContainer(executor, { fresh: true });
   if (existing) {
-    const current = await runningImage(executor, existing);
-    if (current && current !== image) {
-      const swap = await swapEdgeImage(executor, existing, current, image, opts);
-      return {
-        container: existing,
-        image,
-        converted: false,
-        updated: swap.swapped,
-        edgeDown: swap.edgeDown
-      };
+    const verdict = await verifyEdgeServing(executor, existing);
+    if (!verdict.serving) {
+      onLog(log5(`The edge container exists but isn't serving: ${verdict.reason}`, "warn"));
+      onLog(log5("Recreating it...", "warn"));
+    } else {
+      const current = await containerImageRef(executor, existing);
+      const stale = current != null && current !== image;
+      if (stale) {
+        const start = makeEdgeStart(executor, existing, opts);
+        const swap = await swapManagedImage(executor, {
+          kind: "edge",
+          from: current ?? image,
+          to: image,
+          label: "edge",
+          onLog,
+          start
+        });
+        return {
+          container: existing,
+          image,
+          converted: false,
+          updated: swap.swapped,
+          edgeDown: swap.down
+        };
+      }
+      return { container: existing, image, converted: false };
     }
-    return { container: existing, image, converted: false };
   }
-  await ensureEdgeClear(executor, opts.config, onLog);
   if (!await dockerAvailable(executor)) {
     throw new Error(
       "Docker isn't available on this server, and the edge now runs as a container. Install the Docker component first, then set up the edge."
     );
   }
-  const bareWasOurs = await ourLuaOnHost(executor);
-  onLog(log4(`Pulling edge image ${image}...`));
-  const pull = await executor.streamExec(`docker pull ${sq(image)}`, onLog);
-  if (pull.code !== 0) {
-    throw new Error(
-      `Could not pull the edge image ${image} \u2014 the box is unchanged and still serving. Check the server's network access to the registry, then retry.`
-    );
+  if (!await imageExistsLocally(executor, image)) {
+    if (managedImagesAreFromSource("edge")) {
+      throw new Error(fromSourceImageMissingMessage("edge", image));
+    }
+    onLog(log5(`Pulling edge image ${image}...`));
+    const pull = await executor.streamExec(`docker pull ${sq(image)}`, onLog);
+    if (pull.code !== 0) {
+      throw new Error(
+        `Could not pull the edge image ${image} \u2014 the box is unchanged and still serving. Check the server's network access to the registry, then retry.`
+      );
+    }
   }
   for (const mount of EDGE_CONTAINER_MOUNTS) {
     await executor.exec(`mkdir -p ${sq(mount.host)}`).catch(() => {
     });
   }
-  const sitesTarget = EDGE_HOST_PATHS.sitesDir;
-  let beforeCarry = null;
-  if (bareWasOurs) {
-    const barePaths = await detectOpenRestyPaths(executor).catch(() => OPENRESTY_DEFAULT_PATHS);
-    if (barePaths.sitesDir !== sitesTarget && await executor.exists(barePaths.sitesDir)) {
-      onLog(log4(`Carrying vhosts from ${barePaths.sitesDir}...`));
-      beforeCarry = await listDir(executor, sitesTarget);
-      await executor.exec(`cp -a ${sq(`${barePaths.sitesDir}/.`)} ${sq(`${sitesTarget}/`)} 2>/dev/null || true`).catch(() => {
-      });
-    }
-  }
-  const restoreBare = async () => {
-    if (!bareWasOurs) return;
-    if (beforeCarry) {
-      const now = await listDir(executor, sitesTarget);
-      const added = [...now].filter((name) => !beforeCarry.has(name));
-      if (added.length > 0) {
-        await executor.exec(`rm -f ${added.map((n) => sq(`${sitesTarget}/${n}`)).join(" ")}`).catch(() => {
-        });
-        onLog(log4(`Removed ${added.length} carried vhost(s) so the next edge start is clean.`, "warn"));
-      }
-    }
-    onLog(log4("Restoring the host OpenResty edge...", "warn"));
-    await executor.exec("systemctl enable --now openresty 2>/dev/null || true").catch(() => {
-    });
-  };
+  const clear = await ensureEdgeClear(executor, opts.config, onLog);
   try {
-    if (bareWasOurs) {
-      onLog(log4("Stopping the host OpenResty edge..."));
-      await executor.exec("systemctl disable --now openresty 2>/dev/null || true").catch(() => {
-      });
-      await executor.exec("systemctl reset-failed openresty 2>/dev/null || true").catch(() => {
-      });
-    }
-    onLog(log4("Starting the edge container..."));
+    onLog(log5("Starting the edge container..."));
     if (!await startEdgeContainer(executor, container, image, onLog)) {
       throw new Error("the edge container failed to start");
     }
-    await executor.exec(containerCommand(container, "openresty -t"));
-    const listening = await waitForPortListening(executor, 80, {
+    const verdict = await verifyEdgeServing(executor, container, {
+      configTest: true,
       timeoutMs: opts.verifyTimeoutMs ?? 3e4
     });
-    if (listening.checked && !listening.listening) {
-      throw new Error("the edge container started but nothing is listening on :80");
+    if (!verdict.serving) {
+      throw new Error(verdict.reason ?? "the edge container started but isn't serving");
     }
+    if (clear.tookOver) await completeEdgeTakeover(executor);
     const version = await executor.exec(containerCommand(container, "openresty -v 2>&1")).catch(() => "");
-    onLog(log4(`Edge container running${version.trim() ? ` (${version.trim()})` : ""}`));
-    return { container, image, converted: bareWasOurs };
+    onLog(log5(`Edge container running${version.trim() ? ` (${version.trim()})` : ""}`));
+    return { container, image, converted: clear.tookOver };
   } catch (err) {
     const msg = safeErrorMessage(err);
-    onLog(log4(`Edge container setup failed: ${msg}`, "error"));
+    onLog(log5(`Edge container setup failed: ${msg}`, "error"));
     const logs = await executor.exec(`docker logs --tail 40 ${sq(container)} 2>&1 || true`).catch(() => "");
-    if (logs.trim()) onLog(log4(`Edge container logs:
+    if (logs.trim()) onLog(log5(`Edge container logs:
 ${logs}`, "error"));
     await executor.exec(`docker rm -f ${sq(container)} 2>/dev/null || true`).catch(() => {
     });
     invalidateEdgeContainer(executor);
-    await restoreBare();
+    if (clear.tookOver) await rollbackEdgeTakeover(executor, onLog);
     const reason = edgeFailureReason(logs);
     throw new Error(`Edge container setup failed: ${reason ? `${reason} (${msg})` : msg}`);
   }
 }
 
 export {
-  systemCatalog,
-  checkGit,
-  checkAll,
-  checkComponents,
+  beginEdgeTakeover,
+  rollbackEdgeTakeover,
+  completeEdgeTakeover,
+  recoverInterruptedTakeover,
   detectInstalledProxy,
   scanImportableSites,
+  unreachableStaticRoots,
+  copyStaticRootIntoEdge,
   edgeProxy,
   edgeProxyFor,
   collectProxyCerts,
-  beginEdgeTakeover,
-  rollbackEdgeTakeover,
-  completeEdgeTakeover,
-  recoverInterruptedTakeover,
+  systemCatalog,
+  installGit,
+  COMPONENT_INSTALLERS,
+  importSites,
+  foreignProxyOnEdge,
   setDefaultEdgeImage,
   resolveEdgeImage,
-  dockerAvailable,
   containerEdgeProvider,
   localContainerEdgeProvider,
   buildEdgeRunCommand,
+  verifyEdgeServing,
   ensureContainerEdge,
-  importSites,
-  foreignProxyOnEdge,
-  installGit,
-  COMPONENT_INSTALLERS
+  checkGit,
+  checkAll,
+  checkComponents
 };