openship 0.5.0 → 0.6.1

package/dist/{chunk-BS2AXYZX.js → chunk-2NZSUXOB.js}

@@ -1,18 +1,18 @@
 #!/usr/bin/env sh
-":" //# ; exec "$(command -v bun || command -v node)" "$0" "$@"
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   ENV_KEY,
   ENV_SECRET,
   fromEnv
-} from "./chunk-FRNAR33O.js";
+} from "./chunk-XZYFZ6A5.js";
 import {
   SignatureV4MultiRegion,
   XmlNode,
   XmlShapeDeserializer,
   XmlText
-} from "./chunk-6APIPIJY.js";
+} from "./chunk-QWHBRY2K.js";
 import {
   AwsSdkSigV4ASigner,
   AwsSdkSigV4Signer,
@@ -28,10 +28,10 @@ import {
   resolveAwsSdkSigV4AConfig,
   resolveAwsSdkSigV4Config,
   streamCollector
-} from "./chunk-IXCHURVK.js";
+} from "./chunk-DOD2BXHQ.js";
 import {
   NodeHttpHandler
-} from "./chunk-OWED2GRM.js";
+} from "./chunk-42WQABXM.js";
 import {
   BinaryDecisionDiagram,
   Client,
@@ -67,7 +67,7 @@ import {
   resolveRetryConfig,
   resolveUserAgentConfig,
   setFeature
-} from "./chunk-VWPEKOH6.js";
+} from "./chunk-DRK3MEDS.js";
 import {
   CredentialsProviderError,
   ENV_PROFILE,
@@ -98,13 +98,13 @@ import {
   resolveHttpHandlerRuntimeConfig,
   resolveRegionConfig,
   toEndpointV1
-} from "./chunk-W73X43R7.js";
+} from "./chunk-3NQQXMDR.js";
 import {
   CloudRuntime
-} from "./chunk-JLKKYUZA.js";
+} from "./chunk-RRJJGVKE.js";
 import {
   systemCatalog
-} from "./chunk-NXFIRK2Z.js";
+} from "./chunk-IOT5ZX23.js";
 import {
   AwsCrc32,
   __awaiter,
@@ -116,7 +116,7 @@ import {
   numToUint8,
   resolveEventStreamSerdeConfig,
   uint32ArrayFrom
-} from "./chunk-O6ZZF52V.js";
+} from "./chunk-ONKEYSMY.js";
 import {
   Hash,
   NumericValue,
@@ -134,33 +134,39 @@ import {
   toBase64,
   toUint8Array,
   toUtf8
-} from "./chunk-JYGD5WSN.js";
+} from "./chunk-ZWLDLTJP.js";
 import {
   DockerRuntime,
+  daemonConnectionFrom,
   isHostPathSource,
-  scopedVolumeName
-} from "./chunk-CUJXGK7R.js";
+  resolveExecExitCode,
+  scopedVolumeName,
+  startAttachStream,
+  startExecStream
+} from "./chunk-3FYIXVX5.js";
 import {
   BareRuntime
-} from "./chunk-YWMODKWL.js";
+} from "./chunk-IXM5245F.js";
 import {
   LocalExecutor
-} from "./chunk-TYVME3XD.js";
+} from "./chunk-6FH4AXVY.js";
 import {
   EDGE_CONTAINER_NAME,
   edgeCrashReason,
   invalidateEdgeContainer,
   sanitizeEdgeVhosts
-} from "./chunk-6PIYRG5I.js";
+} from "./chunk-VZ2ZHPS2.js";
 import {
   EDGE_CONTAINER_MOUNTS,
-  EDGE_HOST_STATE_DIR
-} from "./chunk-EAAGSQXN.js";
+  EDGE_HOST_STATE_DIR,
+  OPENRESTY_DEFAULT_PATHS
+} from "./chunk-YIPMDGG6.js";
 import {
   DEFAULT_IMAGE_REGISTRY,
   isAwsS3Endpoint,
-  safeErrorMessage
-} from "./chunk-UMQP7SYT.js";
+  safeErrorMessage,
+  withTimeout
+} from "./chunk-OTLSJYAC.js";
 
 // src/lib/edge-import.ts
 import chalk from "chalk";
@@ -169,8 +175,42 @@ import ora from "ora";
 // ../../packages/adapters/src/runtime/image-transfer.ts
 import { Transform } from "stream";
 
-// ../../packages/adapters/src/runtime/route-registration.ts
-import { posix as pathPosix } from "path";
+// ../../packages/adapters/src/infra/edge-baked-conf.ts
+var LOGS_DIR = OPENRESTY_DEFAULT_PATHS.pidPath.replace(/\/[^/]+$/, "");
+
+// ../../packages/adapters/src/infra/mail-container.ts
+var MAIL_HOST_STATE_DIR = "/var/lib/openship/mail";
+var MAIL_CONTAINER_MOUNTS = [
+  { host: `${MAIL_HOST_STATE_DIR}/vmail`, container: "/var/vmail" },
+  // The Postfix queue. A recreate on an ephemeral layer would drop in-flight and
+  // deferred mail without this — keep it on the host.
+  { host: `${MAIL_HOST_STATE_DIR}/spool`, container: "/var/spool/postfix" },
+  // DKIM private keys. NEVER baked, never regenerated on pull — a fresh selector
+  // breaks DMARC until DNS repropagates.
+  { host: `${MAIL_HOST_STATE_DIR}/dkim`, container: "/var/lib/dkim" },
+  // Mutable daemon config the admin layer edits (sasl_passwd, relayhost maps,
+  // amavis 50-user). Seeded from baked defaults on first boot.
+  { host: `${MAIL_HOST_STATE_DIR}/config/postfix`, container: "/etc/postfix", seed: true },
+  { host: `${MAIL_HOST_STATE_DIR}/config/dovecot`, container: "/etc/dovecot", seed: true },
+  { host: `${MAIL_HOST_STATE_DIR}/config/amavis`, container: "/etc/amavis/conf.d", seed: true },
+  // ClamAV signatures — bind-mounted so a pull doesn't force a multi-hundred-MB
+  // freshclam re-download and delay readiness.
+  { host: `${MAIL_HOST_STATE_DIR}/clamav`, container: "/var/lib/clamav" },
+  { host: "/etc/letsencrypt", container: "/etc/letsencrypt", readonly: true }
+];
+var MAIL_DB_HOST_DATA_DIR = `${MAIL_HOST_STATE_DIR}/pgdata`;
+var MAIL_DB_CONTAINER_DATA_DIR = "/var/lib/postgresql/data";
+var MAIL_DB_PGDATA = `${MAIL_DB_CONTAINER_DATA_DIR}/pgdata`;
+var MAIL_HOST_PATHS = {
+  saslPasswd: `${MAIL_HOST_STATE_DIR}/config/postfix/sasl_passwd`,
+  senderRelayhost: `${MAIL_HOST_STATE_DIR}/config/postfix/sender_relayhost`,
+  amavisUserConf: `${MAIL_HOST_STATE_DIR}/config/amavis/50-user`
+};
+
+// ../../packages/adapters/src/system/mail/ensure-container-mail.ts
+var MAIL_DB_IMAGE = process.env.OPENSHIP_MAIL_DB_IMAGE?.trim() || "postgres:16-alpine";
+var ENGINE_ENV_FILE = `${MAIL_HOST_STATE_DIR}/engine.env`;
+var DB_ENV_FILE = `${MAIL_HOST_STATE_DIR}/db.env`;
 
 // ../../packages/adapters/src/system/modules/verify.ts
 import { createHash, createPublicKey, verify as cryptoVerify } from "crypto";
@@ -244,6 +284,25 @@ function decryptCredential(stored) {
 import { createHash as createHash3 } from "crypto";
 import { Transform as Transform2 } from "stream";
 
+// ../../packages/adapters/src/backup/common/source-match.ts
+function matchBackupSource(sources, targetSourceId) {
+  const wanted = targetSourceId.trim();
+  if (!wanted) return null;
+  const exact = sources.find((s2) => s2.id === wanted);
+  if (exact) return exact;
+  const byPhysical = sources.filter((s2) => s2.source === wanted);
+  if (byPhysical.length === 1) return byPhysical[0];
+  if (byPhysical.length > 1) return null;
+  const stripped = wanted.replace(/-\d+$/, "");
+  if (stripped !== wanted) {
+    const byStripped = sources.filter(
+      (s2) => s2.id === stripped || s2.source === stripped
+    );
+    if (byStripped.length === 1) return byStripped[0];
+  }
+  return null;
+}
+
 // ../../packages/adapters/src/backup/volume-transfer.ts
 import { Transform as Transform3 } from "stream";
 
@@ -486,8 +545,7 @@ var CustomCommandProducerImpl = class {
   kind = "custom_command";
   // No detect — explicit selection only.
   async *produce(service, executor, opts) {
-    const cfg = opts;
-    const produceCommand = cfg.produceCommand ?? opts.command;
+    const produceCommand = opts.produceCommand ?? opts.command;
     if (!produceCommand) {
       throw new Error("custom_command producer requires `produceCommand` in policy payload config");
     }
@@ -497,12 +555,15 @@ var CustomCommandProducerImpl = class {
       produceCommand
     ]);
     yield {
-      name: cfg.artifactName ?? "custom-backup.bin",
+      name: opts.artifactName ?? "custom-backup.bin",
       stream: stdout,
       payloadKind: "custom_command",
       metadata: {
         produceCommand,
-        restoreCommand: cfg.restoreCommand ?? null
+        // The ONLY record of how to put this artifact back. Nothing downstream
+        // can reconstruct it, which is why losing it here made every captured
+        // run unrestorable.
+        restoreCommand: opts.restoreCommand ?? null
       }
     };
     const exit = await awaitExit;
@@ -516,7 +577,7 @@ var CustomCommandProducerImpl = class {
     const restoreCommand = artifact.metadata.restoreCommand ?? null;
     if (!restoreCommand) {
       throw new Error(
-        "Backup has no restoreCommand recorded \u2014 restore is not possible for this artifact"
+        "Backup has no restoreCommand recorded \u2014 restore is not possible for this artifact. Re-run the backup policy to capture a restorable one."
       );
     }
     const body = await artifact.open();
@@ -583,7 +644,8 @@ var VolumeCopyProducerImpl = class {
     const stream = await artifact.open();
     await executor.receiveStream(service, volumeId, stream, {
       compression: artifact.metadata.compression ?? "zstd",
-      clearTarget: opts.clearTarget ?? true
+      clearTarget: opts.clearTarget ?? true,
+      signal: opts.signal
     });
   }
 };
@@ -596,6 +658,58 @@ registerProducer(VolumeCopyProducer);
 // ../../packages/adapters/src/backup/executors/docker.ts
 import { PassThrough } from "stream";
 var HELPER_IMAGE = "alpine:3";
+var DEFAULT_HELPER_IDLE_MS = 10 * 60 * 1e3;
+var DEFAULT_HELPER_TIMEOUT_MS = 6 * 60 * 60 * 1e3;
+var EXIT_POLL_INTERVAL_MS = 2e3;
+function createIdleWatchdog(ms, message) {
+  let timer;
+  let done = false;
+  let fire = () => {
+  };
+  const promise = new Promise((_resolve, reject) => {
+    fire = reject;
+  });
+  const arm = () => {
+    timer = setTimeout(() => {
+      done = true;
+      fire(new Error(message));
+    }, ms);
+    timer.unref?.();
+  };
+  arm();
+  return {
+    touch: () => {
+      if (done) return;
+      if (timer) clearTimeout(timer);
+      arm();
+    },
+    promise,
+    dispose: () => {
+      done = true;
+      if (timer) clearTimeout(timer);
+    }
+  };
+}
+function createAbortWatch(signal, message) {
+  let fire = () => {
+  };
+  const promise = new Promise((_resolve, reject) => {
+    fire = reject;
+  });
+  const onAbort = () => fire(new Error(message));
+  if (signal.aborted) onAbort();
+  else signal.addEventListener("abort", onAbort, { once: true });
+  return {
+    promise,
+    dispose: () => signal.removeEventListener("abort", onAbort)
+  };
+}
+function destroyQuietly(stream) {
+  try {
+    stream?.destroy?.();
+  } catch {
+  }
+}
 function shellEscape4(s2) {
   return `'${s2.replace(/'/g, "'\\''")}'`;
 }
@@ -669,12 +783,12 @@ var DockerBackupExecutor = class {
       WorkingDir: opts?.cwd,
       Env: opts?.env ? Object.entries(opts.env).map(([k2, v2]) => `${k2}=${v2}`) : void 0
     });
-    const stream = await exec.start({ hijack: true, stdin: false });
+    const stream = await exec.start({ stdin: false });
     return this.attachDemuxed(this.dockerode, exec.id, stream, opts?.timeoutMs);
   }
   async streamPath(service, sourceId, opts) {
     const sources = await this.listSources(service);
-    const source = sources.find((s2) => s2.id === sourceId);
+    const source = matchBackupSource(sources, sourceId);
     if (!source) {
       throw new Error(`Backup source "${sourceId}" not found on service ${service.name}`);
     }
@@ -692,7 +806,12 @@ var DockerBackupExecutor = class {
     await this.ensureImage(helperImage);
     const hostConfig = {
       Binds: [`${source.source}:/mnt:ro`],
-      AutoRemove: true,
+      // OFF, for the reason demuxContainerStream already documents but this line
+      // used to contradict: AutoRemove lets the daemon reap the helper before
+      // container.wait() answers and before the attach stream has drained, which
+      // is a 404 on the exit status or a truncated tar. demuxContainerStream
+      // removes it once the archive is fully demuxed.
+      AutoRemove: false,
       // The archive streams over `attach()` below — the daemon's default
       // json-file driver would ALSO write every byte of it to
       // /var/lib/docker/containers as a log. That's a second copy of the whole
@@ -702,29 +821,37 @@ var DockerBackupExecutor = class {
       // the helper exits. Nothing ever reads these logs.
       LogConfig: { Type: "none", Config: {} }
     };
-    const helper = await this.dockerode.createContainer({
-      Image: helperImage,
-      Cmd: ["sh", "-c", compression === "zstd" ? `apk add --no-cache zstd >/dev/null 2>&1; ${tarCmd}` : tarCmd],
-      HostConfig: hostConfig,
-      AttachStdout: true,
-      AttachStderr: true,
-      Tty: false,
-      // zstd isn't in alpine:3 and is apk-installed at runtime, which needs
-      // egress; gzip/none use busybox built-ins and stay network-isolated.
-      NetworkDisabled: compression !== "zstd"
-    });
-    const stream = await helper.attach({
-      stream: true,
-      stdout: true,
-      stderr: true
-    });
-    await helper.start();
-    const timeoutMs = opts ? opts.timeoutMs : void 0;
-    return this.demuxContainerStream(helper, stream, timeoutMs ?? 60 * 60 * 1e3);
+    return this.handOffHelper(
+      {
+        Image: helperImage,
+        Cmd: ["sh", "-c", compression === "zstd" ? `apk add --no-cache zstd >/dev/null 2>&1; ${tarCmd}` : tarCmd],
+        HostConfig: hostConfig,
+        AttachStdout: true,
+        AttachStderr: true,
+        Tty: false,
+        // zstd isn't in alpine:3 and is apk-installed at runtime, which needs
+        // egress; gzip/none use busybox built-ins and stay network-isolated.
+        NetworkDisabled: compression !== "zstd"
+      },
+      async (helper) => {
+        const stream = await helper.attach({
+          stream: true,
+          stdout: true,
+          stderr: true
+        });
+        await helper.start();
+        return this.demuxContainerStream(helper, stream, {
+          idleTimeoutMs: opts?.idleTimeoutMs ?? DEFAULT_HELPER_IDLE_MS,
+          timeoutMs: opts?.timeoutMs ?? DEFAULT_HELPER_TIMEOUT_MS,
+          label: `Backup of "${sourceId}" on service ${service.name}`
+        });
+      }
+    );
   }
   async receiveStream(service, targetSourceId, body, opts) {
+    opts?.signal?.throwIfAborted();
     const sources = await this.listSources(service);
-    const source = sources.find((s2) => s2.id === targetSourceId);
+    const source = matchBackupSource(sources, targetSourceId);
     if (!source) {
       throw new Error(`Restore target "${targetSourceId}" not found on service ${service.name}`);
     }
@@ -736,49 +863,188 @@ var DockerBackupExecutor = class {
     await this.ensureImage(helperImage);
     const clearCmd = opts?.clearTarget ? `find /mnt -mindepth 1 -delete 2>/dev/null || true; ` : "";
     const untarCmd = compression === "zstd" ? `${clearCmd}zstd -d -c | tar -x -C /mnt` : `${clearCmd}tar -x${compressionFlag(compression)}f - -C /mnt`;
-    const helper = await this.dockerode.createContainer({
-      Image: helperImage,
-      Cmd: [
-        "sh",
-        "-c",
-        compression === "zstd" ? `apk add --no-cache zstd >/dev/null 2>&1; ${untarCmd}` : untarCmd
-      ],
-      HostConfig: { Binds: [`${source.source}:/mnt`], AutoRemove: true },
-      AttachStdin: true,
-      AttachStdout: true,
-      AttachStderr: true,
-      OpenStdin: true,
-      StdinOnce: true,
-      Tty: false,
-      // zstd isn't in alpine:3 and is apk-installed at runtime, which needs
-      // egress; gzip/none use busybox built-ins and stay network-isolated.
-      NetworkDisabled: compression !== "zstd"
-    });
-    const stream = await helper.attach({
-      stream: true,
-      hijack: true,
-      stdin: true,
-      stdout: true,
-      stderr: true
-    });
-    await helper.start();
-    let bytesWritten = 0;
-    body.on("data", (chunk) => {
-      bytesWritten += chunk.byteLength;
-    });
-    const errChunks = [];
-    stream.on("data", (c2) => {
-      if (errChunks.length < 32) errChunks.push(c2);
-    });
-    body.pipe(stream);
-    const waitResult = await helper.wait();
-    if (waitResult.StatusCode !== 0) {
-      const detail = Buffer.concat(errChunks).toString("utf8").replace(/[^\x20-\x7e\n]+/g, " ").trim().slice(-500);
-      throw new Error(
-        `Restore helper exited with code ${waitResult.StatusCode}${detail ? `: ${detail}` : ""}`
+    return this.withHelper(
+      {
+        Image: helperImage,
+        Cmd: [
+          "sh",
+          "-c",
+          compression === "zstd" ? `apk add --no-cache zstd >/dev/null 2>&1; ${untarCmd}` : untarCmd
+        ],
+        // AutoRemove is OFF deliberately, and this is the fix for the `404 no such
+        // container` in #434: with it on, the daemon could reap the helper before
+        // /containers/{id}/wait answered, and the exit status was then unknowable.
+        // withHelper reaps instead — which also plugs a leak AutoRemove never
+        // covered, since it only fires for a container that actually started.
+        HostConfig: { Binds: [`${source.source}:/mnt`], AutoRemove: false },
+        AttachStdin: true,
+        AttachStdout: true,
+        AttachStderr: true,
+        OpenStdin: true,
+        StdinOnce: true,
+        Tty: false,
+        // zstd isn't in alpine:3 and is apk-installed at runtime, which needs
+        // egress; gzip/none use busybox built-ins and stay network-isolated.
+        NetworkDisabled: compression !== "zstd"
+      },
+      async (helper) => {
+        let stream;
+        const idleMs = opts?.idleTimeoutMs ?? DEFAULT_HELPER_IDLE_MS;
+        const watchdog = createIdleWatchdog(
+          idleMs,
+          `Restore of "${targetSourceId}" on service ${service.name} moved no data for ${Math.round(idleMs / 1e3)}s and was abandoned. The extract helper has been removed; the target may hold partial data.`
+        );
+        const abortWatch = opts?.signal ? createAbortWatch(
+          opts.signal,
+          `Restore of "${targetSourceId}" on service ${service.name} was cancelled mid-extract. The target holds partial data.`
+        ) : void 0;
+        try {
+          stream = await startAttachStream(daemonConnectionFrom(this.dockerode), helper.id, {
+            stdin: true,
+            stdout: true,
+            stderr: true
+          });
+          await helper.start();
+          let bytesWritten = 0;
+          let bodyEnded = false;
+          body.on("data", (chunk) => {
+            bytesWritten += chunk.byteLength;
+            watchdog.touch();
+          });
+          const errChunks = [];
+          stream.on("data", (c2) => {
+            watchdog.touch();
+            if (errChunks.length < 32) errChunks.push(c2);
+          });
+          body.on("end", () => {
+            bodyEnded = true;
+            watchdog.touch();
+          });
+          body.pipe(stream);
+          const waitResult = await this.awaitHelperExit(helper, watchdog, () => bodyEnded, {
+            timeoutMs: opts?.timeoutMs ?? DEFAULT_HELPER_TIMEOUT_MS,
+            label: `Restore of "${targetSourceId}" on service ${service.name}`,
+            note: "The target may hold partial data.",
+            cancelled: abortWatch?.promise
+          });
+          if (waitResult.StatusCode !== 0) {
+            const detail = Buffer.concat(errChunks).toString("utf8").replace(/[^\x20-\x7e\n]+/g, " ").trim().slice(-500);
+            throw new Error(
+              `Restore helper exited with code ${waitResult.StatusCode}${detail ? `: ${detail}` : ""}`
+            );
+          }
+          return { bytesWritten };
+        } finally {
+          watchdog.dispose();
+          abortWatch?.dispose();
+          destroyQuietly(stream);
+          destroyQuietly(body);
+        }
+      }
+    );
+  }
+  /**
+   * Create a helper, run `fn`, reap the helper however `fn` ends.
+   *
+   * Every helper here is disposable and every one of them must be removed by us:
+   * `AutoRemove` is off on purpose (it races /wait, and it only ever fires for a
+   * container that actually started, so a throw between create and start leaked
+   * one permanently — the leak behind #434). Four call sites each had their own
+   * correct copy of that reap, which is exactly how one of them came to be the
+   * one that didn't.
+   *
+   * NOT for helpers whose output outlives the call: streamPath hands its
+   * container to demuxContainerStream, which must reap only after the archive
+   * has drained. `handOffHelper` covers that shape.
+   */
+  async withHelper(spec, fn) {
+    const helper = await this.dockerode.createContainer(spec);
+    try {
+      return await fn(helper);
+    } finally {
+      await helper.remove({ force: true }).catch(() => {
+      });
+    }
+  }
+  /**
+   * Create a helper whose lifetime outlives this call: reap it only if `setup`
+   * throws, then hand ownership to whatever `setup` returned. Without this, a
+   * failure between createContainer and the hand-off leaks the container
+   * forever — nothing downstream knows it exists yet.
+   */
+  async handOffHelper(spec, setup) {
+    const helper = await this.dockerode.createContainer(spec);
+    try {
+      return await setup(helper);
+    } catch (err) {
+      await helper.remove({ force: true }).catch(() => {
+      });
+      throw err;
+    }
+  }
+  /**
+   * Wait for a helper to exit without trusting any single signal.
+   *
+   * `helper.wait()` alone is what hung in #434: /containers/{id}/wait is a
+   * long-poll with no timeout on either the modem or our transport, so a lost
+   * response is indistinguishable from a running container — forever. Three
+   * backstops race it:
+   *
+   *   1. An exit poll that asks the daemon directly. This is what turns the
+   *      common hang into a few seconds. It's the same "don't trust the attach
+   *      stream's terminal signal" reasoning already documented in
+   *      demuxContainerStream; receiveStream was the path without a backstop.
+   *   2. The caller's idle watchdog (fed by real traffic, not by this function).
+   *   3. An absolute ceiling, so even a helper that somehow keeps trickling
+   *      bytes cannot run unbounded.
+   *
+   * The poll only starts once the body has been fully written: before that a
+   * not-yet-running helper is normal, and inspecting on a loop would be noise.
+   * It is gated on the body rather than on the attach stream closing because
+   * over an SSH-tunneled attach that close is not reliably delivered — the very
+   * reason this backstop has to exist.
+   */
+  async awaitHelperExit(helper, watchdog, bodyEnded, opts) {
+    let polling = true;
+    const pollExit = async () => {
+      while (polling) {
+        await new Promise((r2) => {
+          const t8 = setTimeout(r2, EXIT_POLL_INTERVAL_MS);
+          t8.unref?.();
+        });
+        if (!polling || !bodyEnded()) continue;
+        let state;
+        try {
+          state = (await helper.inspect()).State ?? {};
+        } catch (err) {
+          if (err?.statusCode === 404) {
+            throw new Error(
+              `${opts.label}: the helper disappeared before its exit status could be read.${opts.note ? ` ${opts.note}` : ""}`
+            );
+          }
+          continue;
+        }
+        if (state.Running === false && state.Status !== "created" && typeof state.ExitCode === "number") {
+          return { StatusCode: state.ExitCode };
+        }
+      }
+      return new Promise(() => {
+      });
+    };
+    try {
+      return await withTimeout(
+        Promise.race([
+          helper.wait(),
+          pollExit(),
+          watchdog.promise,
+          ...opts.cancelled ? [opts.cancelled] : []
+        ]),
+        opts.timeoutMs,
+        `${opts.label} exceeded its ${Math.round(opts.timeoutMs / 1e3)}s ceiling and was abandoned.${opts.note ? ` ${opts.note}` : ""}`
       );
+    } finally {
+      polling = false;
     }
-    return { bytesWritten };
   }
   /**
    * SAME-DAEMON volume→volume copy in ONE helper container that mounts both
@@ -792,8 +1058,8 @@ var DockerBackupExecutor = class {
    * network-isolated; source is mounted read-only.
    */
   async copyVolumeLocal(srcService, srcSourceId, dstService, dstSourceId, opts) {
-    const src = (await this.listSources(srcService)).find((s2) => s2.id === srcSourceId);
-    const dst = (await this.listSources(dstService)).find((s2) => s2.id === dstSourceId);
+    const src = matchBackupSource(await this.listSources(srcService), srcSourceId);
+    const dst = matchBackupSource(await this.listSources(dstService), dstSourceId);
     if (!src) throw new Error(`Copy source "${srcSourceId}" not found on ${srcService.name}`);
     if (!dst) throw new Error(`Copy target "${dstSourceId}" not found on ${dstService.name}`);
     if (src.type === "tmpfs" || dst.type === "tmpfs") {
@@ -802,31 +1068,30 @@ var DockerBackupExecutor = class {
     await this.ensureImage(HELPER_IMAGE);
     const clearCmd = opts?.clearTarget ? "find /to -mindepth 1 -delete 2>/dev/null || true; " : "";
     const copyCmd = `${clearCmd}{ tar -C /from -cf - . ; echo $? > /tmp/src.rc ; } | tar -C /to -xf - ; rc=$? ; [ "$(cat /tmp/src.rc 2>/dev/null)" = 0 ] && [ "$rc" = 0 ] && du -sk /to 2>/dev/null | cut -f1`;
-    const helper = await this.dockerode.createContainer({
-      Image: HELPER_IMAGE,
-      Cmd: ["sh", "-c", copyCmd],
-      HostConfig: {
-        Binds: [`${src.source}:/from:ro`, `${dst.source}:/to`]
+    return this.withHelper(
+      {
+        Image: HELPER_IMAGE,
+        Cmd: ["sh", "-c", copyCmd],
+        HostConfig: {
+          Binds: [`${src.source}:/from:ro`, `${dst.source}:/to`]
+        },
+        Tty: true,
+        // merged raw stdout so the trailing `du` number reads cleanly
+        NetworkDisabled: true
       },
-      Tty: true,
-      // merged raw stdout so the trailing `du` number reads cleanly
-      NetworkDisabled: true
-    });
-    try {
-      await helper.start();
-      const res = await helper.wait();
-      const out = await helper.logs({ follow: false, stdout: true, stderr: true }).then((b2) => b2.toString().trim()).catch(() => "");
-      if (res.StatusCode !== 0) {
-        throw new Error(
-          `Local volume copy failed (${srcSourceId}\u2192${dstSourceId}): ${out.slice(0, 500) || `exit ${res.StatusCode}`}`
-        );
+      async (helper) => {
+        await helper.start();
+        const res = await helper.wait();
+        const out = await helper.logs({ follow: false, stdout: true, stderr: true }).then((b2) => b2.toString().trim()).catch(() => "");
+        if (res.StatusCode !== 0) {
+          throw new Error(
+            `Local volume copy failed (${srcSourceId}\u2192${dstSourceId}): ${out.slice(0, 500) || `exit ${res.StatusCode}`}`
+          );
+        }
+        const kb = parseInt(out.split(/\s+/).pop() || "0", 10);
+        return { bytesWritten: Number.isFinite(kb) ? kb * 1024 : 0 };
       }
-      const kb = parseInt(out.split(/\s+/).pop() || "0", 10);
-      return { bytesWritten: Number.isFinite(kb) ? kb * 1024 : 0 };
-    } finally {
-      await helper.remove({ force: true }).catch(() => {
-      });
-    }
+    );
   }
   /**
    * Does the named volume behind `sourceId` already exist on this daemon, and
@@ -836,7 +1101,7 @@ var DockerBackupExecutor = class {
    * so we err on the side of NOT clobbering.
    */
   async probeVolume(service, sourceId) {
-    const source = (await this.listSources(service)).find((s2) => s2.id === sourceId);
+    const source = matchBackupSource(await this.listSources(service), sourceId);
     if (!source || source.type !== "volume" || !source.source) {
       return { exists: false, empty: true };
     }
@@ -846,26 +1111,25 @@ var DockerBackupExecutor = class {
       return { exists: false, empty: true };
     }
     await this.ensureImage(HELPER_IMAGE);
-    const helper = await this.dockerode.createContainer({
-      Image: HELPER_IMAGE,
-      Cmd: [
-        "sh",
-        "-c",
-        'if [ -z "$(ls -A /probe 2>/dev/null)" ]; then echo VOLEMPTY; else echo VOLDATA; fi'
-      ],
-      HostConfig: { Binds: [`${source.source}:/probe:ro`] },
-      Tty: true,
-      NetworkDisabled: true
-    });
-    try {
-      await helper.start();
-      await helper.wait();
-      const out = await helper.logs({ follow: false, stdout: true, stderr: true }).then((b2) => b2.toString()).catch(() => "");
-      return { exists: true, empty: out.includes("VOLEMPTY") };
-    } finally {
-      await helper.remove({ force: true }).catch(() => {
-      });
-    }
+    return this.withHelper(
+      {
+        Image: HELPER_IMAGE,
+        Cmd: [
+          "sh",
+          "-c",
+          'if [ -z "$(ls -A /probe 2>/dev/null)" ]; then echo VOLEMPTY; else echo VOLDATA; fi'
+        ],
+        HostConfig: { Binds: [`${source.source}:/probe:ro`] },
+        Tty: true,
+        NetworkDisabled: true
+      },
+      async (helper) => {
+        await helper.start();
+        await helper.wait();
+        const out = await helper.logs({ follow: false, stdout: true, stderr: true }).then((b2) => b2.toString()).catch(() => "");
+        return { exists: true, empty: out.includes("VOLEMPTY") };
+      }
+    );
   }
   async pipeIntoCommand(service, cmd, body, opts) {
     if (!service.containerId) {
@@ -883,7 +1147,10 @@ var DockerBackupExecutor = class {
       WorkingDir: opts?.cwd,
       Env: opts?.env ? Object.entries(opts.env).map(([k2, v2]) => `${k2}=${v2}`) : void 0
     });
-    const stream = await exec.start({ hijack: true, stdin: true });
+    const stream = await startExecStream(daemonConnectionFrom(this.dockerode), exec.id, {
+      tty: false,
+      stdin: true
+    });
     const stderrChunks = [];
     const { PassThrough: PassThrough3 } = await import("stream");
     const stdoutSink = new PassThrough3();
@@ -915,9 +1182,8 @@ var DockerBackupExecutor = class {
       stream.on("end", async () => {
         if (timer) clearTimeout(timer);
         try {
-          const info = await this.dockerode.getExec(exec.id).inspect();
           resolve4({
-            code: info.ExitCode ?? 0,
+            code: await resolveExecExitCode(exec, exec.id),
             stderr: Buffer.concat(stderrChunks).toString("utf8").slice(0, 16 * 1024)
           });
         } catch (err) {
@@ -980,9 +1246,8 @@ var DockerBackupExecutor = class {
       stream.on("end", async () => {
         if (timer) clearTimeout(timer);
         try {
-          const info = await docker.getExec(execId).inspect();
           resolve4({
-            code: info.ExitCode ?? 0,
+            code: await resolveExecExitCode(docker.getExec(execId), execId),
             stderr: Buffer.concat(stderrChunks).toString("utf8").slice(0, 16 * 1024)
           });
         } catch (err) {
@@ -996,7 +1261,7 @@ var DockerBackupExecutor = class {
     });
     return { stdout, awaitExit };
   }
-  demuxContainerStream(container, stream, timeoutMs) {
+  demuxContainerStream(container, stream, opts) {
     const stdout = new PassThrough();
     const stderrChunks = [];
     const stderrSink = new PassThrough();
@@ -1004,29 +1269,49 @@ var DockerBackupExecutor = class {
       if (stderrChunks.length < 16) stderrChunks.push(chunk);
     });
     container.modem.demuxStream(stream, stdout, stderrSink);
+    let sinksEnded = false;
+    let exited = false;
+    const reapIfDone = () => {
+      if (!sinksEnded || !exited) return;
+      void container.remove({ force: true }).catch(() => {
+      });
+    };
     const endSinks = () => {
       stdout.end();
       stderrSink.end();
+      sinksEnded = true;
+      reapIfDone();
     };
     stream.on("end", endSinks);
     stream.on("close", endSinks);
-    const awaitExit = new Promise((resolve4, reject) => {
-      const timer = timeoutMs ? setTimeout(() => {
-        stdout.destroy(new Error(`helper container timed out after ${timeoutMs}ms`));
-        reject(new Error(`helper container timed out after ${timeoutMs}ms`));
-      }, timeoutMs) : null;
-      container.wait().then((res) => {
-        if (timer) clearTimeout(timer);
+    const watchdog = createIdleWatchdog(
+      opts.idleTimeoutMs,
+      `${opts.label} produced no data for ${Math.round(opts.idleTimeoutMs / 1e3)}s and was abandoned. Nothing was written; the archive is incomplete and was not kept.`
+    );
+    stream.on("data", () => watchdog.touch());
+    const awaitExit = (async () => {
+      try {
+        const res = await this.awaitHelperExit(container, watchdog, () => sinksEnded, {
+          timeoutMs: opts.timeoutMs,
+          label: opts.label,
+          note: "Nothing was written; the archive is incomplete and was not kept."
+        });
+        exited = true;
         setTimeout(endSinks, 3e3);
-        resolve4({
+        reapIfDone();
+        return {
           code: res.StatusCode,
           stderr: Buffer.concat(stderrChunks).toString("utf8").slice(0, 16 * 1024)
+        };
+      } catch (err) {
+        stdout.destroy(err);
+        void container.remove({ force: true }).catch(() => {
         });
-      }).catch((err) => {
-        if (timer) clearTimeout(timer);
-        reject(err);
-      });
-    });
+        throw err;
+      } finally {
+        watchdog.dispose();
+      }
+    })();
     return { stdout, awaitExit };
   }
 };
@@ -1268,7 +1553,7 @@ var BareBackupExecutor = class {
     ]);
     const path = sourceId;
     const tarCmd = compression === "zstd" ? `tar -c -C ${shellEscape6(path)} ${excludeArgs.join(" ")} . | zstd -c -3` : compression === "gzip" ? `tar -cz -C ${shellEscape6(path)} ${excludeArgs.join(" ")} .` : `tar -c -C ${shellEscape6(path)} ${excludeArgs.join(" ")} .`;
-    return this.execStream(service, ["sh", "-c", tarCmd]);
+    return this.execStream(service, ["sh", "-c", tarCmd], { timeoutMs: opts?.timeoutMs });
   }
   async receiveStream(service, targetSourceId, body, opts) {
     const compression = opts?.compression ?? "zstd";
@@ -1379,7 +1664,7 @@ var LocalDestinationImpl = class {
       return { ok: false, reason: message };
     }
   }
-  async put(key, body, _opts) {
+  async put(key, body, opts) {
     const targetPath = this.resolveKey(key);
     await fs2.mkdir(dirname(targetPath), { recursive: true });
     const tmpPath = `${targetPath}.tmp-${randomBytes3(4).toString("hex")}`;
@@ -1392,15 +1677,23 @@ var LocalDestinationImpl = class {
         cb(null, chunk);
       }
     });
+    let digest;
     try {
       await pipelineP(body, counterAndHasher, createWriteStream2(tmpPath));
+      digest = hash.digest("hex");
+      const expected = opts.sha256?.trim().replace(/^sha256:/i, "").toLowerCase();
+      if (expected && expected !== digest) {
+        throw new Error(
+          `sha256 mismatch writing ${key}: caller declared ${expected}, bytes hashed to ${digest}`
+        );
+      }
       await fs2.rename(tmpPath, targetPath);
     } catch (err) {
       await fs2.unlink(tmpPath).catch(() => {
       });
       throw err;
     }
-    return { bytesWritten, etag: hash.digest("hex") };
+    return { bytesWritten, etag: digest };
   }
   async get(key) {
     const path = this.resolveKey(key);
@@ -10985,10 +11278,10 @@ var package_default = {
 // ../../node_modules/@aws-sdk/credential-provider-node/dist-es/remoteProvider.js
 var ENV_IMDS_DISABLED = "AWS_EC2_METADATA_DISABLED";
 var remoteProvider = async (init) => {
-  const { ENV_CMDS_FULL_URI, ENV_CMDS_RELATIVE_URI, fromContainerMetadata, fromInstanceMetadata } = await import("./dist-es-VNKHQVIB.js");
+  const { ENV_CMDS_FULL_URI, ENV_CMDS_RELATIVE_URI, fromContainerMetadata, fromInstanceMetadata } = await import("./dist-es-IOH6G4GM.js");
   if (process.env[ENV_CMDS_RELATIVE_URI] || process.env[ENV_CMDS_FULL_URI]) {
     init.logger?.debug("@aws-sdk/credential-provider-node - remoteProvider::fromHttp/fromContainerMetadata");
-    const { fromHttp } = await import("./dist-es-5DY7K32L.js");
+    const { fromHttp } = await import("./dist-es-UYDDOVZ3.js");
     return chain(fromHttp(init), fromContainerMetadata(init));
   }
   if (process.env[ENV_IMDS_DISABLED] && process.env[ENV_IMDS_DISABLED] !== "false") {
@@ -11100,22 +11393,22 @@ var defaultProvider = (init = {}) => memoizeChain([
     if (!ssoStartUrl && !ssoAccountId && !ssoRegion && !ssoRoleName && !ssoSession) {
       throw new CredentialsProviderError("Skipping SSO provider in default chain (inputs do not include SSO fields).", { logger: init.logger });
     }
-    const { fromSSO } = await import("./dist-es-WV4AMOII.js");
+    const { fromSSO } = await import("./dist-es-XUOR4NQN.js");
     return fromSSO(init)(awsIdentityProperties);
   },
   async (awsIdentityProperties) => {
     init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromIni");
-    const { fromIni } = await import("./dist-es-RYHIPOTN.js");
+    const { fromIni } = await import("./dist-es-JGBPABJI.js");
     return fromIni(init)(awsIdentityProperties);
   },
   async (awsIdentityProperties) => {
     init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromProcess");
-    const { fromProcess } = await import("./dist-es-OSNJBLXB.js");
+    const { fromProcess } = await import("./dist-es-CCVZEFRZ.js");
     return fromProcess(init)(awsIdentityProperties);
   },
   async (awsIdentityProperties) => {
     init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromTokenFile");
-    const { fromTokenFile } = await import("./dist-es-X3B5QYKB.js");
+    const { fromTokenFile } = await import("./dist-es-2YRDXMUU.js");
     return fromTokenFile(init)(awsIdentityProperties);
   },
   async () => {
@@ -12690,6 +12983,10 @@ var DEFAULT_HOME = join3(homedir(), ".openship");
 var override = process.env.OPENSHIP_HOME?.trim();
 var OS_DIR = override ? resolve2(override) : DEFAULT_HOME;
 var IS_ALT_HOME = OS_DIR !== DEFAULT_HOME;
+var DATA_DIR = join3(OS_DIR, "data");
+var LOG_DIR = join3(OS_DIR, "logs");
+var AUTH_SECRET_FILE = join3(OS_DIR, "auth-secret");
+var INTERNAL_TOKEN_FILE = join3(OS_DIR, "internal-token");
 
 // src/lib/ports.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
@@ -12851,13 +13148,13 @@ function stalePortOrigins(movedFrom, urls) {
   }
   return stale;
 }
-async function resolvePorts(prefs) {
+async function resolvePorts(prefs, opts = {}) {
   const resolved = await resolvePortPair({
     ...prefs,
     stored: readStoredPorts(),
     defaults: { api: DEFAULT_API_PORT, dashboard: DEFAULT_DASHBOARD_PORT }
   });
-  saveStoredPorts(resolved.api, resolved.dashboard);
+  if (opts.persist !== false) saveStoredPorts(resolved.api, resolved.dashboard);
   return resolved;
 }
 
@@ -12871,6 +13168,8 @@ import { spawn, spawnSync } from "child_process";
 import { existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
 import { join as join5, resolve as resolve3 } from "path";
 var DEFAULT_REPO = "https://github.com/oblien/openship.git";
+var SOURCE_CHECKOUT_DIR = join5(OS_DIR, "src");
+var SOURCE_DIST_DIR = join5(OS_DIR, "from-source-dist");
 function has(cmd) {
   try {
     return spawnSync(cmd, ["--version"], { stdio: "ignore" }).status === 0;
@@ -12923,7 +13222,7 @@ async function prepareFromSource(opts) {
     }
     ref = (opts.ref || "main").trim();
     const repoUrl = opts.repo || DEFAULT_REPO;
-    sourceDir = join5(OS_DIR, "src");
+    sourceDir = SOURCE_CHECKOUT_DIR;
     mkdirSync2(OS_DIR, { recursive: true });
     if (!existsSync2(join5(sourceDir, ".git"))) {
       console.log(`  Cloning ${repoUrl} \u2192 ${sourceDir}`);
@@ -12940,7 +13239,7 @@ async function prepareFromSource(opts) {
   console.log(`  Source: ${sourceDir} @ ${ref} (${sha})`);
   console.log("  Installing workspace dependencies (bun install)\u2026");
   await run("bun", ["install"], sourceDir);
-  const distDir = join5(OS_DIR, "from-source-dist");
+  const distDir = SOURCE_DIST_DIR;
   console.log("  Building release dist (compiles the dashboard \u2014 needs RAM/CPU)\u2026");
   await run(
     "bun",
@@ -13071,20 +13370,33 @@ function dockerGap(state = dockerState()) {
 function hasDockerCompose() {
   return dockerGap() === null;
 }
-function composeIsViableDefault() {
-  return process.platform === "linux" && hasDockerCompose();
-}
 function hasCmd(cmd) {
   return spawnSync3(cmd, ["--version"], { stdio: "ignore" }).status === 0;
 }
 function shQuote(s2) {
   return `'${s2.replace(/'/g, `'\\''`)}'`;
 }
+function dockerInstallPreview(state = dockerState()) {
+  const gap = dockerGap(state);
+  if (!gap) return { state, gap: null, wouldInstall: false };
+  if (process.platform !== "linux" || !gap.installable) return { state, gap, wouldInstall: false };
+  const plan = systemCatalog.installs.docker({
+    os: "linux",
+    serviceManager: "systemd"
+  });
+  if (!plan.supported || !plan.installCommand) return { state, gap, wouldInstall: false };
+  return {
+    state,
+    gap,
+    wouldInstall: true,
+    installCommand: plan.installCommand,
+    ...plan.startCommand ? { startCommand: plan.startCommand } : {}
+  };
+}
 async function ensureDocker(opts = {}) {
   const notice = opts.onNotice ?? ((line) => process.stderr.write(`  ${line}
 `));
-  const state = dockerState();
-  const gap = dockerGap(state);
+  const { state, gap, wouldInstall, installCommand, startCommand } = dockerInstallPreview();
   if (!gap) return true;
   if (process.platform !== "linux") return false;
   if (!gap.installable) {
@@ -13092,11 +13404,7 @@ async function ensureDocker(opts = {}) {
     if (gap.hint) notice(gap.hint);
     return false;
   }
-  const plan = systemCatalog.installs.docker({
-    os: "linux",
-    serviceManager: "systemd"
-  });
-  if (!plan.supported || !plan.installCommand) return false;
+  if (!wouldInstall || !installCommand) return false;
   const asRoot = typeof process.getuid === "function" && process.getuid() === 0;
   const sudo = !asRoot && hasCmd("sudo") ? "sudo " : "";
   notice("This can take 2-5 minutes on a small VPS (~150 MB of packages) and stays quiet while apt works.");
@@ -13119,8 +13427,8 @@ async function ensureDocker(opts = {}) {
     child.on("error", () => done(1));
     child.on("close", (code) => done(code ?? 1));
   });
-  if (await sh(plan.installCommand) !== 0) return false;
-  if (plan.startCommand) await sh(plan.startCommand);
+  if (await sh(installCommand) !== 0) return false;
+  if (startCommand) await sh(startCommand);
   const after = dockerGap();
   if (!after) {
     notice("Docker ready.");
@@ -13168,7 +13476,10 @@ services:
   api:
     image: \${OPENSHIP_IMAGE_REGISTRY:-ghcr.io/oblien}/openship-api:\${OPENSHIP_VERSION:-latest}
     restart: unless-stopped
-    ports: ["\${OPENSHIP_BIND_ADDR:-0.0.0.0}:\${API_PORT:-4000}:\${API_PORT:-4000}"]
+    # Loopback by default \u2014 the host-net edge reaches it over loopback, so nothing
+    # sits on a public interface. OPENSHIP_BIND_ADDR opts into a public/LAN interface
+    # (set by \`openship up\` when a public URL is configured for off-box access).
+    ports: ["\${OPENSHIP_BIND_ADDR:-127.0.0.1}:\${API_PORT:-4000}:\${API_PORT:-4000}"]
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       # Routing state shared with the edge, as HOST BIND MOUNTS (generated from
@@ -13203,7 +13514,8 @@ ${edgeVolumeYaml("      ")}
   dashboard:
     image: \${OPENSHIP_IMAGE_REGISTRY:-ghcr.io/oblien}/openship-dashboard:\${OPENSHIP_VERSION:-latest}
     restart: unless-stopped
-    ports: ["\${OPENSHIP_BIND_ADDR:-0.0.0.0}:\${DASHBOARD_PORT:-3001}:\${DASHBOARD_PORT:-3001}"]
+    # Loopback by default (see api note); OPENSHIP_BIND_ADDR opts into a public interface.
+    ports: ["\${OPENSHIP_BIND_ADDR:-127.0.0.1}:\${DASHBOARD_PORT:-3001}:\${DASHBOARD_PORT:-3001}"]
     env_file: [.env]
     environment:
       NODE_ENV: production
@@ -13254,12 +13566,22 @@ function rewriteHostAuthorizedKeys(existing, pub) {
   const kept = existing.split("\n").filter((line) => line.trim() && !line.includes(HOST_KEY_COMMENT));
   return [...kept, hostKeyAuthLine(pub)].join("\n") + "\n";
 }
-function provisionHostSshChannel() {
-  if (process.platform !== "linux") return null;
+function plannedHostChannel(hostControl) {
+  if (!hostControl || process.platform !== "linux") return null;
+  let user;
+  try {
+    user = userInfo().username;
+  } catch {
+    user = process.env.USER || process.env.LOGNAME || "root";
+  }
+  return { user, keyPath: join7(COMPOSE_DIR, "host-ssh", "id_ed25519") };
+}
+function provisionHostSshChannel(hostControl) {
+  const target = plannedHostChannel(hostControl);
+  if (!target) return null;
+  const { user, keyPath } = target;
   try {
-    const sshDir = join7(COMPOSE_DIR, "host-ssh");
-    mkdirSync3(sshDir, { recursive: true, mode: 448 });
-    const keyPath = join7(sshDir, "id_ed25519");
+    mkdirSync3(join7(COMPOSE_DIR, "host-ssh"), { recursive: true, mode: 448 });
     if (!existsSync4(keyPath)) {
       const g2 = spawnSync3(
         "ssh-keygen",
@@ -13270,13 +13592,6 @@ function provisionHostSshChannel() {
     }
     const pub = readFileSync3(`${keyPath}.pub`, "utf8").trim();
     if (!pub) return null;
-    const user = (() => {
-      try {
-        return userInfo().username;
-      } catch {
-        return process.env.USER || process.env.LOGNAME || "root";
-      }
-    })();
     const userSshDir = join7(homedir2(), ".ssh");
     mkdirSync3(userSshDir, { recursive: true, mode: 448 });
     const authKeys = join7(userSshDir, "authorized_keys");
@@ -13385,6 +13700,25 @@ function removeOrphanedStack(project) {
   );
   spawnSync3("docker", ["rm", "-f", ...orphans.map((o2) => o2.name)], { stdio: "ignore" });
 }
+var EDGE_SWEEP_FORMAT = '{{.Names}}	{{.Label "com.docker.compose.project"}}	{{.Label "com.docker.compose.project.config_files"}}';
+function edgeNameNeedsReclaim(psStdout, project) {
+  const row = psStdout.split("\n").map((l2) => l2.trim()).find((l2) => l2.split("	")[0] === "openship-edge");
+  if (!row) return false;
+  const [, proj = "", configFiles = ""] = row.split("	");
+  const ours = proj === project && configFiles.split(",").some((f2) => f2.trim() === COMPOSE_FILE);
+  return !ours;
+}
+function reconcileEdgeContainerName(project) {
+  const r2 = spawnSync3("docker", ["ps", "-a", "--format", EDGE_SWEEP_FORMAT], {
+    encoding: "utf8"
+  });
+  if (r2.status !== 0 || !r2.stdout) return;
+  if (!edgeNameNeedsReclaim(r2.stdout, project)) return;
+  console.log(
+    "  Replacing an unmanaged `openship-edge` container so compose can own it (config is on the host, so no routes are lost)."
+  );
+  spawnSync3("docker", ["rm", "-f", "openship-edge"], { stdio: "ignore" });
+}
 function migrateLegacyEdgeVolumes(project) {
   const pairs = [
     { volume: `${project}_openship_sites`, host: EDGE_SITES_HOST_DIR },
@@ -13447,9 +13781,26 @@ function keepConfig(prev, key, explicit) {
   const carried = prev[key]?.trim();
   return carried || void 0;
 }
+var ACME_ENV_KEYS = [
+  "OPENSHIP_ACME_EMAIL",
+  "OPENSHIP_ACME_DIRECTORY_URL",
+  "OPENSHIP_ACME_EAB_KID",
+  "OPENSHIP_ACME_EAB_HMAC_KEY",
+  "OPENSHIP_ACME_KEY_TYPE",
+  "OPENSHIP_ACME_CA_BUNDLE",
+  "OPENSHIP_ACME_TOS_AGREED"
+];
+function renderAcmeEnv(prev) {
+  return ACME_ENV_KEYS.flatMap((key) => {
+    const value = process.env[key]?.trim() || prev[key]?.trim();
+    if (!value) return [];
+    if (/[\r\n]/.test(value)) throw new Error(`${key} must be a single-line value`);
+    return [`${key}=${value}`];
+  });
+}
 function resolveEnvConfig(prev, opts) {
   const publicUrl = keepConfig(prev, "OPENSHIP_PUBLIC_URL", opts.publicUrl);
-  const bindAddr = keepConfig(prev, "OPENSHIP_BIND_ADDR");
+  const bindAddr = keepConfig(prev, "OPENSHIP_BIND_ADDR") ?? (publicUrl ? "0.0.0.0" : void 0);
   return {
     apiPort: keepConfig(prev, "API_PORT", opts.apiPort) ?? String(DEFAULT_API_PORT),
     dashPort: keepConfig(prev, "DASHBOARD_PORT", opts.dashboardPort) ?? String(DEFAULT_DASHBOARD_PORT),
@@ -13480,7 +13831,7 @@ function composeEnvPorts() {
   return { api: toPort(env.API_PORT), dashboard: toPort(env.DASHBOARD_PORT) };
 }
 function composeBindAddr() {
-  return readEnvFile().OPENSHIP_BIND_ADDR?.trim() || "0.0.0.0";
+  return readEnvFile().OPENSHIP_BIND_ADDR?.trim() || "127.0.0.1";
 }
 function composeTrustedOriginUrls() {
   const env = readEnvFile();
@@ -13503,14 +13854,17 @@ function composeHeldPorts() {
   }
   return [...ports];
 }
-async function resolveComposePorts(prefs) {
-  return resolvePorts({
-    api: toPort(prefs.api),
-    dashboard: toPort(prefs.dashboard),
-    previous: composeEnvPorts(),
-    bindAddr: composeBindAddr(),
-    reclaimable: composeHeldPorts()
-  });
+async function resolveComposePorts(prefs, opts = {}) {
+  return resolvePorts(
+    {
+      api: toPort(prefs.api),
+      dashboard: toPort(prefs.dashboard),
+      previous: composeEnvPorts(),
+      bindAddr: composeBindAddr(),
+      reclaimable: composeHeldPorts()
+    },
+    opts
+  );
 }
 function renderEnv(opts, host, cfg) {
   const prev = readEnvFile();
@@ -13525,7 +13879,7 @@ function renderEnv(opts, host, cfg) {
     // (hides the local row). Written explicitly so the policy is visible in .env.
     `OPENSHIP_HOST_CONTROL=${cfg.hostControl ? "true" : "false"}`,
     `OPENSHIP_IMAGE_REGISTRY=${cfg.registry}`,
-    `OPENSHIP_VERSION=${opts.version || (true ? "0.5.0" : "latest")}`,
+    `OPENSHIP_VERSION=${opts.version || (true ? "0.6.1" : "latest")}`,
     `POSTGRES_PASSWORD=${keepSecret(prev, "POSTGRES_PASSWORD")}`,
     // Pinned once (see resolvePgData): fresh install → subdir, existing volume → root.
     `OPENSHIP_PGDATA=${resolvePgData(prev)}`,
@@ -13537,7 +13891,10 @@ function renderEnv(opts, host, cfg) {
     // the operator's domain at the dashboard through this (self-deploy.ts), and it
     // silently defaults to 3001 when unset. Ports are dynamic now, so leaving it
     // out publishes a domain routed to a port nothing is listening on.
-    `OPENSHIP_DASHBOARD_PORT=${cfg.dashPort}`
+    `OPENSHIP_DASHBOARD_PORT=${cfg.dashPort}`,
+    // Alternate CA/EAB values are operator configuration (including one secret),
+    // so a routine `openship up`/upgrade must not silently discard them.
+    ...renderAcmeEnv(prev)
   ];
   if (cfg.bindAddr) lines.push(`OPENSHIP_BIND_ADDR=${cfg.bindAddr}`);
   if (cfg.publicUrl) lines.push(`OPENSHIP_PUBLIC_URL=${cfg.publicUrl}`);
@@ -13578,7 +13935,7 @@ function materialize(opts) {
   mkdirSync3(COMPOSE_DIR, { recursive: true, mode: 448 });
   const prev = readEnvFile();
   const cfg = resolveEnvConfig(prev, opts);
-  const host = cfg.hostControl ? provisionHostSshChannel() : null;
+  const host = provisionHostSshChannel(cfg.hostControl);
   let before = "";
   try {
     before = readFileSync3(ENV_FILE, "utf8");
@@ -13591,6 +13948,40 @@ function materialize(opts) {
   if (buildDir) writeFileSync2(BUILD_FILE, renderBuildOverride(buildDir));
   return { buildDir, cfg, envChanged: before !== "" && rendered !== before };
 }
+var SECRET_ENV_KEY = /(PASSWORD|SECRET|TOKEN|HMAC_KEY)$/;
+function composePlan(opts) {
+  const prev = readEnvFile();
+  const cfg = resolveEnvConfig(prev, opts);
+  const buildDir = opts.build === false ? null : sourceBuildDir();
+  const hostChannel = plannedHostChannel(cfg.hostControl);
+  const settings = [];
+  const newSecrets = [];
+  for (const line of renderEnv(opts, hostChannel, cfg).split("\n")) {
+    const at2 = line.indexOf("=");
+    if (at2 < 1 || line.startsWith("#")) continue;
+    const key = line.slice(0, at2);
+    if (!SECRET_ENV_KEY.test(key)) {
+      settings.push({ key, value: line.slice(at2 + 1) });
+      continue;
+    }
+    const minted = !prev[key];
+    if (minted) newSecrets.push(key);
+    settings.push({ key, value: minted ? "<generated on this run>" : "<preserved>" });
+  }
+  return {
+    composeFile: COMPOSE_FILE,
+    envFile: ENV_FILE,
+    installMethodFile: INSTALL_METHOD_FILE,
+    ...buildDir ? { buildFile: BUILD_FILE } : {},
+    yaml: COMPOSE_YAML,
+    settings,
+    newSecrets,
+    existing: Object.keys(prev).length > 0,
+    mountDirs: EDGE_CONTAINER_MOUNTS.map((m2) => m2.host),
+    buildDir,
+    hostChannel
+  };
+}
 function dbVolumeExists(project) {
   const r2 = spawnSync3("docker", ["volume", "inspect", `${project}_postgres_data`], {
     stdio: "ignore"
@@ -13613,6 +14004,23 @@ function composePrefetch(opts) {
   }
   return compose(["pull"]) === 0;
 }
+function ensureEdgeMountDirs() {
+  const failed = [];
+  for (const { host } of EDGE_CONTAINER_MOUNTS) {
+    try {
+      mkdirSync3(host, { recursive: true });
+    } catch (err) {
+      if (err.code !== "EEXIST") failed.push(host);
+    }
+  }
+  return failed;
+}
+function isRootlessDocker() {
+  const r2 = spawnSync3("docker", ["info", "-f", "{{println .SecurityOptions}}"], {
+    encoding: "utf8"
+  });
+  return r2.status === 0 && /rootless/i.test(r2.stdout ?? "");
+}
 async function composeUp(opts) {
   const { buildDir, cfg, envChanged } = materialize(opts);
   const apiPort = cfg.apiPort;
@@ -13624,8 +14032,24 @@ async function composeUp(opts) {
   const env = readEnvFile();
   const project = env.COMPOSE_PROJECT_NAME || "openship";
   removeOrphanedStack(project);
+  reconcileEdgeContainerName(project);
   migrateLegacyEdgeVolumes(project);
   warnOrphanedVolumes(project);
+  const unmakeableMounts = ensureEdgeMountDirs();
+  if (unmakeableMounts.length && isRootlessDocker()) {
+    const dirs = unmakeableMounts.join(" ");
+    console.error(
+      `
+  Rootless Docker can't create the edge's host directories under root-owned paths:
+    ${unmakeableMounts.join("\n    ")}
+
+  Create them once (owned by your user), then re-run \`openship up --compose\`:
+    sudo mkdir -p ${dirs}
+    sudo chown -R "$(id -un)" ${dirs}
+`
+    );
+    return { ok: false, apiPort, dashPort };
+  }
   if (dbVolumeExists(project)) {
     reconcileDbPassword(env.POSTGRES_USER || "openship", env.POSTGRES_PASSWORD ?? "");
   }
@@ -13698,6 +14122,7 @@ function composeRunning() {
   return r2.status === 0 && r2.stdout.trim().length > 0;
 }
 function composeStart() {
+  reconcileEdgeContainerName(readEnvFile().COMPOSE_PROJECT_NAME || "openship");
   return compose(["up", "-d"], { quiet: true }) === 0;
 }
 function composeRestart() {
@@ -13728,7 +14153,7 @@ async function waitForEdgeRunning(tries) {
   }
   return false;
 }
-async function importMigratedSites(apiPort, sites, certPems) {
+async function importMigratedSites(apiPort, sites, certPems, staticRootOverrides) {
   const token = composeInternalToken();
   if (!token) {
     const error = "couldn't read the stack's internal token";
@@ -13753,7 +14178,7 @@ async function importMigratedSites(apiPort, sites, certPems) {
     const r2 = await fetch(`http://127.0.0.1:${apiPort}/api/system/edge/import-sites`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Internal-Token": token },
-      body: JSON.stringify({ sites, certPems }),
+      body: JSON.stringify({ sites, certPems, staticRootOverrides }),
       signal: AbortSignal.timeout(12e4)
     });
     const data = await r2.json().catch(() => ({}));
@@ -13808,8 +14233,11 @@ async function importMigratedSites(apiPort, sites, certPems) {
 export {
   OS_DIR,
   IS_ALT_HOME,
-  DEFAULT_API_PORT,
-  DEFAULT_DASHBOARD_PORT,
+  DATA_DIR,
+  LOG_DIR,
+  AUTH_SECRET_FILE,
+  INTERNAL_TOKEN_FILE,
+  PORTS_FILE,
   saveInstanceUrl,
   readInstanceUrl,
   readStoredPorts,
@@ -13817,6 +14245,10 @@ export {
   storedDashboardPort,
   portMoveNotice,
   resolvePorts,
+  DEFAULT_REPO,
+  SOURCE_CHECKOUT_DIR,
+  SOURCE_DIST_DIR,
+  has,
   shortSha,
   prepareFromSource,
   readSourceInstall,
@@ -13825,11 +14257,12 @@ export {
   readInstallMethod,
   dockerGap,
   hasDockerCompose,
-  composeIsViableDefault,
+  dockerInstallPreview,
   ensureDocker,
   composeTrustedOriginUrls,
   resolveComposePorts,
   sourceBuildDir,
+  composePlan,
   composePrefetch,
   composeUp,
   composeDown,