openship 0.6.0 → 0.6.5

package/dist/{chunk-VE2YOK4I.js → chunk-QLX7NBEA.js}

@@ -2,17 +2,32 @@
 ":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
-import {
-  ENV_KEY,
-  ENV_SECRET,
-  fromEnv
-} from "./chunk-XZYFZ6A5.js";
 import {
   SignatureV4MultiRegion,
   XmlNode,
   XmlShapeDeserializer,
   XmlText
 } from "./chunk-QWHBRY2K.js";
+import {
+  OS_DIR
+} from "./chunk-ELGRMZOW.js";
+import {
+  AwsCrc32,
+  __awaiter,
+  __generator,
+  __values,
+  convertToBuffer,
+  eventStreamSerdeProvider2 as eventStreamSerdeProvider,
+  isEmptyData,
+  numToUint8,
+  resolveEventStreamSerdeConfig,
+  uint32ArrayFrom
+} from "./chunk-ONKEYSMY.js";
+import {
+  ENV_KEY,
+  ENV_SECRET,
+  fromEnv
+} from "./chunk-XZYFZ6A5.js";
 import {
   AwsSdkSigV4ASigner,
   AwsSdkSigV4Signer,
@@ -99,24 +114,6 @@ import {
   resolveRegionConfig,
   toEndpointV1
 } from "./chunk-3NQQXMDR.js";
-import {
-  CloudRuntime
-} from "./chunk-PSZSKEPA.js";
-import {
-  systemCatalog
-} from "./chunk-GUQ3QCJ7.js";
-import {
-  AwsCrc32,
-  __awaiter,
-  __generator,
-  __values,
-  convertToBuffer,
-  eventStreamSerdeProvider2 as eventStreamSerdeProvider,
-  isEmptyData,
-  numToUint8,
-  resolveEventStreamSerdeConfig,
-  uint32ArrayFrom
-} from "./chunk-ONKEYSMY.js";
 import {
   Hash,
   NumericValue,
@@ -136,41 +133,232 @@ import {
   toUtf8
 } from "./chunk-ZWLDLTJP.js";
 import {
+  CloudRuntime
+} from "./chunk-3ZAGC5NT.js";
+import {
+  systemCatalog
+} from "./chunk-7334NSJL.js";
+import {
+  DEFAULT_DOCKER_SOCKET_PATH,
   DockerRuntime,
   daemonConnectionFrom,
   isHostPathSource,
   resolveExecExitCode,
+  resolveLocalDockerSocketPath,
   scopedVolumeName,
   startAttachStream,
   startExecStream
-} from "./chunk-3FYIXVX5.js";
+} from "./chunk-VDESJSG6.js";
 import {
   BareRuntime
-} from "./chunk-IXM5245F.js";
+} from "./chunk-GRTXMUHA.js";
+import {
+  createExecutor
+} from "./chunk-VHMOQL5Y.js";
 import {
   LocalExecutor
 } from "./chunk-6FH4AXVY.js";
 import {
-  EDGE_CONTAINER_NAME,
-  edgeCrashReason,
   invalidateEdgeContainer,
   sanitizeEdgeVhosts
-} from "./chunk-VZ2ZHPS2.js";
+} from "./chunk-WE7BXW6L.js";
 import {
   EDGE_CONTAINER_MOUNTS,
   EDGE_HOST_STATE_DIR,
   OPENRESTY_DEFAULT_PATHS
-} from "./chunk-OGY63DGD.js";
+} from "./chunk-PZRRL5PC.js";
+import {
+  envOps
+} from "./chunk-EZPPTWJQ.js";
+import {
+  ENVIRONMENT_PROBE_SCRIPT,
+  ENVIRONMENT_PROBE_TIMEOUT_MS,
+  cacheEnvironment,
+  parseEnvironmentProbe,
+  profileIsFresh
+} from "./chunk-WFRXYWK2.js";
 import {
   DEFAULT_IMAGE_REGISTRY,
+  FAMILY_BY_DISTRO,
+  HOST_CHANNEL_BLOCKED,
+  HOST_CHANNEL_RECHECK,
+  HOST_CHANNEL_UNAFFECTED,
+  explainHostChannelCause,
   isAwsS3Endpoint,
   safeErrorMessage,
-  withTimeout
-} from "./chunk-OTLSJYAC.js";
+  withTimeout,
+  wrapText
+} from "./chunk-LEYSL46B.js";
+
+// src/lib/ports.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { join } from "path";
+
+// ../../packages/core/src/ports.ts
+import { createServer } from "net";
+var DEFAULT_API_PORT = 4e3;
+var DEFAULT_DASHBOARD_PORT = 3001;
+var LOOPBACK = "127.0.0.1";
+var SCAN_SPAN = 20;
+var MAX_PORT = 65535;
+function isPortFree(port, host = LOOPBACK) {
+  return new Promise((resolve3) => {
+    const srv = createServer();
+    srv.once("error", () => resolve3(false));
+    srv.listen(port, host, () => srv.close(() => resolve3(true)));
+  });
+}
+async function waitPortFree(port, opts = {}) {
+  const timeoutMs = opts.timeoutMs ?? 6e3;
+  const intervalMs = opts.intervalMs ?? 250;
+  const host = opts.host ?? LOOPBACK;
+  const deadline = Date.now() + timeoutMs;
+  for (; ; ) {
+    if (await isPortFree(port, host)) return true;
+    if (Date.now() >= deadline) return false;
+    await new Promise((r2) => setTimeout(r2, intervalMs));
+  }
+}
+function getFreePort(host = LOOPBACK) {
+  return new Promise((resolve3, reject) => {
+    const srv = createServer();
+    srv.once("error", reject);
+    srv.listen(0, host, () => {
+      const addr = srv.address();
+      const port = addr && typeof addr === "object" ? addr.port : 0;
+      srv.close(() => port ? resolve3(port) : reject(new Error("no free port")));
+    });
+  });
+}
+async function findPortNear(from, opts = {}) {
+  const host = opts.host ?? LOOPBACK;
+  const span = opts.span ?? SCAN_SPAN;
+  const skip = opts.skip ?? (() => false);
+  for (let port2 = from; port2 <= Math.min(from + span, MAX_PORT); port2++) {
+    if (!skip(port2) && await isPortFree(port2, host)) return port2;
+  }
+  let port = await getFreePort(host);
+  for (let tries = 0; tries < 10 && skip(port); tries++) port = await getFreePort(host);
+  return port;
+}
+async function resolvePortPair(prefs = {}) {
+  const host = prefs.bindAddr?.trim() || LOOPBACK;
+  const ours = new Set(prefs.reclaimable ?? []);
+  const prefFor = (kind) => prefs[kind] ?? prefs.previous?.[kind] ?? prefs.stored?.[kind] ?? prefs.defaults?.[kind];
+  const remembered = (kind, pref) => prefs[kind] === void 0 && (prefs.previous?.[kind] === pref || prefs.stored?.[kind] === pref);
+  const availableForPref = async (port) => ours.has(port) || await isPortFree(port, host);
+  const apiPref = prefFor("api");
+  const dashPref = prefFor("dashboard");
+  let api;
+  if (apiPref === void 0) api = await getFreePort(host);
+  else if (await availableForPref(apiPref)) api = apiPref;
+  else if (remembered("api", apiPref) && await waitPortFree(apiPref, { host })) api = apiPref;
+  else {
+    api = await findPortNear(apiPref + 1, {
+      host,
+      skip: (p2) => ours.has(p2) || p2 === dashPref
+    });
+  }
+  const skipForDash = (p2) => ours.has(p2) || p2 === api;
+  let dashboard;
+  if (dashPref === void 0) {
+    dashboard = await getFreePort(host);
+    for (let tries = 0; tries < 10 && dashboard === api; tries++) {
+      dashboard = await getFreePort(host);
+    }
+  } else if (dashPref !== api && await availableForPref(dashPref)) {
+    dashboard = dashPref;
+  } else if (dashPref !== api && remembered("dashboard", dashPref) && await waitPortFree(dashPref, { host })) {
+    dashboard = dashPref;
+  } else {
+    dashboard = await findPortNear(dashPref + 1, { host, skip: skipForDash });
+  }
+  return {
+    api,
+    dashboard,
+    switched: {
+      api: apiPref !== void 0 && api !== apiPref,
+      dashboard: dashPref !== void 0 && dashboard !== dashPref
+    },
+    preferred: { api: apiPref ?? api, dashboard: dashPref ?? dashboard }
+  };
+}
 
-// src/lib/edge-import.ts
-import chalk from "chalk";
-import ora from "ora";
+// src/lib/ports.ts
+var PORTS_FILE = join(OS_DIR, "ports.json");
+var INSTANCE_FILE = join(OS_DIR, "instance.json");
+function saveInstanceUrl(publicUrl) {
+  try {
+    if (!existsSync(OS_DIR)) mkdirSync(OS_DIR, { recursive: true, mode: 448 });
+    writeFileSync(INSTANCE_FILE, JSON.stringify({ publicUrl: publicUrl ?? null }));
+  } catch {
+  }
+}
+function readInstanceUrl() {
+  try {
+    return JSON.parse(readFileSync(INSTANCE_FILE, "utf8")).publicUrl ?? null;
+  } catch {
+    return null;
+  }
+}
+function readStoredPorts() {
+  try {
+    return JSON.parse(readFileSync(PORTS_FILE, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+function storedApiPort() {
+  return readStoredPorts().api ?? DEFAULT_API_PORT;
+}
+function storedDashboardPort() {
+  return readStoredPorts().dashboard ?? DEFAULT_DASHBOARD_PORT;
+}
+function saveStoredPorts(api, dashboard) {
+  try {
+    if (!existsSync(OS_DIR)) mkdirSync(OS_DIR, { recursive: true, mode: 448 });
+    writeFileSync(PORTS_FILE, JSON.stringify({ api, dashboard }));
+  } catch {
+  }
+}
+function portMoveNotice(resolved, trustedOriginUrls = []) {
+  if (!resolved.switched.api && !resolved.switched.dashboard) return [];
+  const lines = [
+    `A preferred port was busy \u2014 using API ${resolved.api}, dashboard ${resolved.dashboard}.`
+  ];
+  const stale = [...new Set(stalePortOrigins(resolved.preferred.dashboard, trustedOriginUrls))];
+  if (stale.length) {
+    lines.push(
+      `Heads up: ${stale.join(", ")} still names port ${resolved.preferred.dashboard}, so logins`,
+      `from that origin will be rejected. Point it at :${resolved.dashboard} (or free port`,
+      `${resolved.preferred.dashboard} and re-run to move back).`
+    );
+  }
+  return lines;
+}
+function stalePortOrigins(movedFrom, urls) {
+  const stale = [];
+  for (const raw of urls) {
+    for (const candidate of (raw ?? "").split(",")) {
+      const value = candidate.trim();
+      if (!value) continue;
+      try {
+        if (new URL(value).port === String(movedFrom)) stale.push(value);
+      } catch {
+      }
+    }
+  }
+  return stale;
+}
+async function resolvePorts(prefs, opts = {}) {
+  const resolved = await resolvePortPair({
+    ...prefs,
+    stored: readStoredPorts(),
+    defaults: { api: DEFAULT_API_PORT, dashboard: DEFAULT_DASHBOARD_PORT }
+  });
+  if (opts.persist !== false) saveStoredPorts(resolved.api, resolved.dashboard);
+  return resolved;
+}
 
 // ../../packages/adapters/src/runtime/image-transfer.ts
 import { Transform } from "stream";
@@ -204,6 +392,11 @@ var MAIL_DB_PGDATA = `${MAIL_DB_CONTAINER_DATA_DIR}/pgdata`;
 var MAIL_HOST_PATHS = {
   saslPasswd: `${MAIL_HOST_STATE_DIR}/config/postfix/sasl_passwd`,
   senderRelayhost: `${MAIL_HOST_STATE_DIR}/config/postfix/sender_relayhost`,
+  // Per-nexthop TLS policy. Only split ("selected"-scope) relaying writes it: the
+  // relay hop must be `encrypt` so SASL credentials never cross a plaintext
+  // connection, while direct-to-MX delivery for the un-relayed domains stays
+  // opportunistic. A GLOBAL smtp_tls_security_level can't express both.
+  relayTlsPolicy: `${MAIL_HOST_STATE_DIR}/config/postfix/openship_tls_policy`,
   amavisUserConf: `${MAIL_HOST_STATE_DIR}/config/amavis/50-user`
 };
 
@@ -212,6 +405,63 @@ var MAIL_DB_IMAGE = process.env.OPENSHIP_MAIL_DB_IMAGE?.trim() || "postgres:16-a
 var ENGINE_ENV_FILE = `${MAIL_HOST_STATE_DIR}/engine.env`;
 var DB_ENV_FILE = `${MAIL_HOST_STATE_DIR}/db.env`;
 
+// ../../packages/adapters/src/system/environment-local.ts
+import { spawnSync } from "child_process";
+var cached = null;
+function unmeasurable(reason) {
+  return {
+    ...parseEnvironmentProbe({ text: "", failed: true, unanswered: true }),
+    unsupportedReason: reason
+  };
+}
+function probeLocalHost() {
+  if (process.platform === "win32") {
+    return unmeasurable(
+      "Openship cannot provision this machine: it runs Windows, and Openship's host provisioning is POSIX-only. Deploying to a remote Linux server from here works."
+    );
+  }
+  const result = spawnSync("sh", ["-c", ENVIRONMENT_PROBE_SCRIPT], {
+    encoding: "utf8",
+    timeout: ENVIRONMENT_PROBE_TIMEOUT_MS,
+    // `sh -c` and not the login shell: `wrapLocalBuildCommand`'s `-lc` exists so user
+    // builds see a normal profile, but a host probe wants the plain POSIX behaviour the
+    // remote path gets, without a dotfile's `echo` in the middle of the output.
+    windowsHide: true
+  });
+  if (result.error) {
+    return unmeasurable(
+      `Openship could not run a shell on this machine to detect it: ${safeErrorMessage(result.error)}`
+    );
+  }
+  if (result.signal || typeof result.status !== "number") {
+    return unmeasurable(
+      `Openship could not measure this machine: the detection probe was killed${result.signal ? ` by ${result.signal}` : ""} before it finished.`
+    );
+  }
+  const stdout = result.stdout ?? "";
+  return parseEnvironmentProbe({
+    // The script always exits 0, so a non-zero status means something ran instead of it
+    // — the same signal the SSH path uses, and stderr is what said so.
+    text: stdout.trim() ? stdout : result.stderr ?? "",
+    failed: result.status !== 0,
+    // Every way of not answering is refused above, so the shell exited on its own and
+    // whatever it said is this machine's.
+    unanswered: false
+  });
+}
+function resolveLocalEnvironmentSync() {
+  if (cached && profileIsFresh(cached.measuredAt)) return cached.profile;
+  const profile = probeLocalHost();
+  cached = { measuredAt: Date.now(), profile };
+  cacheEnvironment(createExecutor(), profile);
+  return profile;
+}
+
+// ../../packages/adapters/src/system/modules/types.ts
+var TARGETABLE_FAMILIES = new Set(
+  Object.values(FAMILY_BY_DISTRO)
+);
+
 // ../../packages/adapters/src/system/modules/verify.ts
 import { createHash, createPublicKey, verify as cryptoVerify } from "crypto";
 
@@ -219,10 +469,6 @@ import { createHash, createPublicKey, verify as cryptoVerify } from "crypto";
 var CATALOG_BASE_URL = process.env.OPENSHIP_MODULE_CATALOG_BASE_URL?.trim() || "https://raw.githubusercontent.com/openship/native-modules";
 var CATALOG_REF = process.env.OPENSHIP_MODULE_CATALOG_REF?.trim() || "main";
 
-// ../../packages/adapters/src/system/reachability.ts
-import { connect } from "net";
-import { request } from "http";
-
 // ../../packages/adapters/src/backup/registry.ts
 var executorFactories = /* @__PURE__ */ new Map();
 function registerExecutor(runtimeName, factory) {
@@ -747,12 +993,14 @@ var DockerBackupExecutor = class {
       try {
         const data = await this.dockerode.getContainer(service.containerId).inspect();
         const mounts = data.Mounts ?? [];
-        return mounts.filter((m2) => m2.Type === "volume" || m2.Type === "bind").map((m2, i2) => ({
-          id: m2.Name ?? m2.Source ?? `mount-${i2}`,
-          target: m2.Destination ?? "",
-          source: m2.Name ?? m2.Source ?? "",
-          type: m2.Type ?? "volume"
-        }));
+        return mounts.filter((m2) => m2.Type === "volume" || m2.Type === "bind").map(
+          (m2, i2) => ({
+            id: m2.Name ?? m2.Source ?? `mount-${i2}`,
+            target: m2.Destination ?? "",
+            source: m2.Name ?? m2.Source ?? "",
+            type: m2.Type ?? "volume"
+          })
+        );
       } catch {
       }
     }
@@ -784,7 +1032,9 @@ var DockerBackupExecutor = class {
       Env: opts?.env ? Object.entries(opts.env).map(([k2, v2]) => `${k2}=${v2}`) : void 0
     });
     const stream = await exec.start({ stdin: false });
-    return this.attachDemuxed(this.dockerode, exec.id, stream, opts?.timeoutMs);
+    return this.attachDemuxed(this.dockerode, exec.id, stream, opts, {
+      label: `exec in service ${service.name}`
+    });
   }
   async streamPath(service, sourceId, opts) {
     const sources = await this.listSources(service);
@@ -796,10 +1046,7 @@ var DockerBackupExecutor = class {
       throw new Error(`Backup source "${sourceId}" is tmpfs \u2014 not backupable`);
     }
     const compression = opts?.compression ?? "zstd";
-    const excludeArgs = (opts?.exclude ?? []).flatMap((p2) => [
-      "--exclude",
-      shellEscape4(p2)
-    ]);
+    const excludeArgs = (opts?.exclude ?? []).flatMap((p2) => ["--exclude", shellEscape4(p2)]);
     const tarFlags = compressionFlag(compression);
     const tarCmd = compression === "zstd" ? `tar -c${tarFlags} -C /mnt ${excludeArgs.join(" ")} . | zstd -c -3` : `tar -c${tarFlags} -C /mnt ${excludeArgs.join(" ")} .`;
     const helperImage = compression === "zstd" ? "alpine:3" : HELPER_IMAGE;
@@ -824,7 +1071,11 @@ var DockerBackupExecutor = class {
     return this.handOffHelper(
       {
         Image: helperImage,
-        Cmd: ["sh", "-c", compression === "zstd" ? `apk add --no-cache zstd >/dev/null 2>&1; ${tarCmd}` : tarCmd],
+        Cmd: [
+          "sh",
+          "-c",
+          compression === "zstd" ? `apk add --no-cache zstd >/dev/null 2>&1; ${tarCmd}` : tarCmd
+        ],
         HostConfig: hostConfig,
         AttachStdout: true,
         AttachStderr: true,
@@ -1170,7 +1421,7 @@ var DockerBackupExecutor = class {
       } catch {
       }
     }, opts.timeoutMs) : null;
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve3, reject) => {
       body.on("error", (err) => {
         if (timer) clearTimeout(timer);
         try {
@@ -1182,7 +1433,7 @@ var DockerBackupExecutor = class {
       stream.on("end", async () => {
         if (timer) clearTimeout(timer);
         try {
-          resolve4({
+          resolve3({
             code: await resolveExecExitCode(exec, exec.id),
             stderr: Buffer.concat(stderrChunks).toString("utf8").slice(0, 16 * 1024)
           });
@@ -1230,7 +1481,10 @@ var DockerBackupExecutor = class {
   }
   /** dockerode `exec.start` returns a multiplexed stream — stdout +
    *  stderr interleaved with frame headers. demux into clean streams. */
-  attachDemuxed(docker, execId, stream, timeoutMs) {
+  attachDemuxed(docker, execId, stream, opts, meta) {
+    const label = meta?.label ?? "exec";
+    const idleMs = opts?.idleTimeoutMs ?? DEFAULT_HELPER_IDLE_MS;
+    const timeoutMs = opts?.timeoutMs ?? DEFAULT_HELPER_TIMEOUT_MS;
     const stdout = new PassThrough();
     const stderrChunks = [];
     const stderrSink = new PassThrough();
@@ -1238,34 +1492,54 @@ var DockerBackupExecutor = class {
       if (stderrChunks.length < 16) stderrChunks.push(chunk);
     });
     docker.modem.demuxStream(stream, stdout, stderrSink);
-    const awaitExit = new Promise((resolve4, reject) => {
-      const timer = timeoutMs ? setTimeout(() => {
-        stdout.destroy(new Error(`exec timed out after ${timeoutMs}ms`));
-        reject(new Error(`exec timed out after ${timeoutMs}ms`));
-      }, timeoutMs) : null;
-      stream.on("end", async () => {
-        if (timer) clearTimeout(timer);
-        try {
-          resolve4({
-            code: await resolveExecExitCode(docker.getExec(execId), execId),
-            stderr: Buffer.concat(stderrChunks).toString("utf8").slice(0, 16 * 1024)
-          });
-        } catch (err) {
-          reject(err);
-        }
-      });
-      stream.on("error", (err) => {
-        if (timer) clearTimeout(timer);
-        reject(err);
-      });
-    });
-    return { stdout, awaitExit };
-  }
-  demuxContainerStream(container, stream, opts) {
-    const stdout = new PassThrough();
-    const stderrChunks = [];
-    const stderrSink = new PassThrough();
-    stderrSink.on("data", (chunk) => {
+    let sinksEnded = false;
+    const endSinks = () => {
+      if (sinksEnded) return;
+      sinksEnded = true;
+      stdout.end();
+      stderrSink.end();
+    };
+    stream.on("end", endSinks);
+    stream.on("close", endSinks);
+    const watchdog = createIdleWatchdog(
+      idleMs,
+      `${label} produced no data for ${Math.round(idleMs / 1e3)}s and was abandoned.`
+    );
+    stream.on("data", () => watchdog.touch());
+    const awaitExit = (async () => {
+      const onEnd = new Promise((resolve3, reject) => {
+        stream.on("end", async () => {
+          try {
+            resolve3({
+              code: await resolveExecExitCode(docker.getExec(execId), execId),
+              stderr: Buffer.concat(stderrChunks).toString("utf8").slice(0, 16 * 1024)
+            });
+          } catch (err) {
+            reject(err);
+          }
+        });
+        stream.on("error", (err) => reject(err));
+      });
+      try {
+        return await withTimeout(
+          Promise.race([onEnd, watchdog.promise]),
+          timeoutMs,
+          `${label} exceeded its ${Math.round(timeoutMs / 1e3)}s ceiling and was abandoned.`
+        );
+      } catch (err) {
+        stdout.destroy(err);
+        throw err;
+      } finally {
+        watchdog.dispose();
+      }
+    })();
+    return { stdout, awaitExit };
+  }
+  demuxContainerStream(container, stream, opts) {
+    const stdout = new PassThrough();
+    const stderrChunks = [];
+    const stderrSink = new PassThrough();
+    stderrSink.on("data", (chunk) => {
       if (stderrChunks.length < 16) stderrChunks.push(chunk);
     });
     container.modem.demuxStream(stream, stdout, stderrSink);
@@ -1359,7 +1633,7 @@ var CloudBackupExecutor = class {
     const stdout = new Readable2({ read() {
     } });
     let stderrBuf = "";
-    const awaitExit = new Promise((resolve4, reject) => {
+    const awaitExit = new Promise((resolve3, reject) => {
       const timer = opts?.timeoutMs ? setTimeout(() => {
         stdout.destroy(new Error(`exec timed out after ${opts.timeoutMs}ms`));
         reject(new Error(`exec timed out after ${opts.timeoutMs}ms`));
@@ -1392,7 +1666,7 @@ var CloudBackupExecutor = class {
           }
           stdout.push(null);
           if (timer) clearTimeout(timer);
-          resolve4({ code: exitCode, stderr: stderrBuf });
+          resolve3({ code: exitCode, stderr: stderrBuf });
         } catch (err) {
           if (timer) clearTimeout(timer);
           stdout.destroy(err);
@@ -1501,7 +1775,7 @@ import { pipeline } from "stream/promises";
 import { createWriteStream, promises as fs } from "fs";
 import { randomBytes as randomBytes2 } from "crypto";
 import { tmpdir } from "os";
-import { join } from "path";
+import { join as join2 } from "path";
 var BareBackupExecutor = class {
   constructor(runtime) {
     this.runtime = runtime;
@@ -1575,8 +1849,8 @@ var BareBackupExecutor = class {
   async pipeIntoCommand(service, cmd, body, opts) {
     const exec = this.executor();
     const id = randomBytes2(6).toString("hex");
-    const localDir = join(tmpdir(), `openship-bare-restore-${id}`);
-    const localFile = join(localDir, "artifact.bin");
+    const localDir = join2(tmpdir(), `openship-bare-restore-${id}`);
+    const localFile = join2(localDir, "artifact.bin");
     const remoteDir = `/tmp/openship-bare-restore-${id}`;
     const remoteFile = `${remoteDir}/artifact.bin`;
     await fs.mkdir(localDir, { recursive: true });
@@ -1625,7 +1899,7 @@ registerExecutor("bare", (runtime) => {
 // ../../packages/adapters/src/backup/destinations/local.ts
 import { createHash as createHash4, randomBytes as randomBytes3 } from "crypto";
 import { createReadStream, createWriteStream as createWriteStream2, promises as fs2 } from "fs";
-import { dirname, join as join2, normalize, posix, resolve } from "path";
+import { dirname, join as join3, normalize, posix, resolve } from "path";
 import { pipeline as pipeline2 } from "stream";
 import { promisify } from "util";
 var pipelineP = promisify(pipeline2);
@@ -1648,13 +1922,13 @@ var LocalDestinationImpl = class {
     if (normalized.startsWith("..") || normalized.includes(`${normalize("../")}`)) {
       throw new Error(`Invalid key (traversal): ${key}`);
     }
-    return join2(this.root, normalized);
+    return join3(this.root, normalized);
   }
   async preflight() {
     try {
       await fs2.mkdir(this.root, { recursive: true });
       const probeKey = `.openship-probe-${randomBytes3(6).toString("hex")}`;
-      const probePath = join2(this.root, probeKey);
+      const probePath = join3(this.root, probeKey);
       await fs2.writeFile(probePath, "ok");
       await fs2.readFile(probePath);
       await fs2.unlink(probePath);
@@ -1728,7 +2002,7 @@ var LocalDestinationImpl = class {
       for (const dirent of dirents) {
         if (entries.length >= limit) return;
         const childRel = posix.join(relBase, dirent.name);
-        const childAbs = join2(dir, dirent.name);
+        const childAbs = join3(dir, dirent.name);
         if (dirent.isDirectory()) {
           await walk(childAbs, childRel);
         } else if (dirent.isFile()) {
@@ -2370,8 +2644,8 @@ var flexibleChecksumsMiddleware = (config, middlewareConfig) => (next, context)
   if (hasHeaderWithPrefix("x-amz-checksum-", args.request.headers)) {
     return next(args);
   }
-  const { request: request2, input } = args;
-  const { body: requestBody, headers } = request2;
+  const { request, input } = args;
+  const { body: requestBody, headers } = request;
   const { base64Encoder, streamHasher } = config;
   const { requestChecksumRequired, requestAlgorithmMember } = middlewareConfig;
   const requestChecksumCalculation = await config.requestChecksumCalculation();
@@ -2442,7 +2716,7 @@ var flexibleChecksumsMiddleware = (config, middlewareConfig) => (next, context)
     const result = await next({
       ...args,
       request: {
-        ...request2,
+        ...request,
         headers: updatedHeaders,
         body: updatedBody
       }
@@ -2638,9 +2912,9 @@ var CONTENT_LENGTH_HEADER = "content-length";
 var DECODED_CONTENT_LENGTH_HEADER = "x-amz-decoded-content-length";
 function checkContentLengthHeader() {
   return (next, context) => async (args) => {
-    const { request: request2 } = args;
-    if (HttpRequest.isInstance(request2)) {
-      if (!(CONTENT_LENGTH_HEADER in request2.headers) && !(DECODED_CONTENT_LENGTH_HEADER in request2.headers)) {
+    const { request } = args;
+    if (HttpRequest.isInstance(request)) {
+      if (!(CONTENT_LENGTH_HEADER in request.headers) && !(DECODED_CONTENT_LENGTH_HEADER in request.headers)) {
         const message = `Are you using a Stream of unknown length as the Body of a PutObject request? Consider using Upload instead from @aws-sdk/lib-storage.`;
         if (typeof context?.logger?.warn === "function" && !(context.logger instanceof NoOpLogger)) {
           context.logger.warn(message);
@@ -2956,8 +3230,8 @@ var getS3ExpressPlugin = (options) => ({
 });
 
 // ../../node_modules/@aws-sdk/middleware-sdk-s3/dist-es/submodules/s3/middleware-s3-express/functions/signS3Express.js
-var signS3Express = async (s3ExpressIdentity, signingOptions, request2, sigV4MultiRegionSigner) => {
-  const signedRequest = await sigV4MultiRegionSigner.signWithCredentials(request2, s3ExpressIdentity, {});
+var signS3Express = async (s3ExpressIdentity, signingOptions, request, sigV4MultiRegionSigner) => {
+  const signedRequest = await sigV4MultiRegionSigner.signWithCredentials(request, s3ExpressIdentity, {});
   if (signedRequest.headers["X-Amz-Security-Token"] || signedRequest.headers["x-amz-security-token"]) {
     throw new Error("X-Amz-Security-Token must not be set for s3-express requests.");
   }
@@ -2980,15 +3254,15 @@ var s3ExpressHttpSigningMiddleware = (config) => (next, context) => async (args)
     throw new Error(`No HttpAuthScheme was selected: unable to sign request`);
   }
   const { httpAuthOption: { signingProperties = {} }, identity, signer } = scheme;
-  let request2;
+  let request;
   if (context.s3ExpressIdentity) {
-    request2 = await signS3Express(context.s3ExpressIdentity, signingProperties, args.request, await config.signer());
+    request = await signS3Express(context.s3ExpressIdentity, signingProperties, args.request, await config.signer());
   } else {
-    request2 = await signer.sign(args.request, identity, signingProperties);
+    request = await signer.sign(args.request, identity, signingProperties);
   }
   const output = await next({
     ...args,
-    request: request2
+    request
   }).catch((signer.errorHandler || defaultErrorHandler)(signingProperties));
   (signer.successHandler || defaultSuccessHandler)(output.response, signingProperties);
   return output;
@@ -3060,9 +3334,9 @@ var getThrow200ExceptionsPlugin = (config) => ({
 var validate = (str) => typeof str === "string" && str.indexOf("arn:") === 0 && str.split(":").length >= 6;
 
 // ../../node_modules/@aws-sdk/core/dist-es/submodules/util/util-format-url/format-url.js
-function formatUrl(request2) {
-  const { port, query } = request2;
-  let { protocol, path, hostname } = request2;
+function formatUrl(request) {
+  const { port, query } = request;
+  let { protocol, path, hostname } = request;
   if (protocol && protocol.slice(-1) !== ":") {
     protocol += ":";
   }
@@ -3077,14 +3351,14 @@ function formatUrl(request2) {
     queryString = `?${queryString}`;
   }
   let auth = "";
-  if (request2.username != null || request2.password != null) {
-    const username = request2.username ?? "";
-    const password = request2.password ?? "";
+  if (request.username != null || request.password != null) {
+    const username = request.username ?? "";
+    const password = request.password ?? "";
     auth = `${username}:${password}@`;
   }
   let fragment = "";
-  if (request2.fragment) {
-    fragment = `#${request2.fragment}`;
+  if (request.fragment) {
+    fragment = `#${request.fragment}`;
   }
   return `${protocol}//${auth}${hostname}${path}${queryString}${fragment}`;
 }
@@ -3477,18 +3751,18 @@ var AwsRestXmlProtocol = class extends HttpBindingProtocol {
     return "aws.protocols#restXml";
   }
   async serializeRequest(operationSchema, input, context) {
-    const request2 = await super.serializeRequest(operationSchema, input, context);
+    const request = await super.serializeRequest(operationSchema, input, context);
     const inputSchema = NormalizedSchema.of(operationSchema.input);
-    if (!request2.headers["content-type"]) {
+    if (!request.headers["content-type"]) {
       const contentType = this.mixin.resolveRestContentType(this.getDefaultContentType(), inputSchema);
       if (contentType) {
-        request2.headers["content-type"] = contentType;
+        request.headers["content-type"] = contentType;
       }
     }
-    if (typeof request2.body === "string" && request2.headers["content-type"] === this.getDefaultContentType() && !request2.body.startsWith("<?xml ") && !this.hasUnstructuredPayloadBinding(inputSchema)) {
-      request2.body = '<?xml version="1.0" encoding="UTF-8"?>' + request2.body;
+    if (typeof request.body === "string" && request.headers["content-type"] === this.getDefaultContentType() && !request.body.startsWith("<?xml ") && !this.hasUnstructuredPayloadBinding(inputSchema)) {
+      request.body = '<?xml version="1.0" encoding="UTF-8"?>' + request.body;
     }
-    return request2;
+    return request;
   }
   async deserializeResponse(operationSchema, context, response) {
     return super.deserializeResponse(operationSchema, context, response);
@@ -3541,7 +3815,7 @@ var AwsRestXmlProtocol = class extends HttpBindingProtocol {
 // ../../node_modules/@aws-sdk/middleware-sdk-s3/dist-es/submodules/s3/protocol/S3RestXmlProtocol.js
 var S3RestXmlProtocol = class extends AwsRestXmlProtocol {
   async serializeRequest(operationSchema, input, context) {
-    const request2 = await super.serializeRequest(operationSchema, input, context);
+    const request = await super.serializeRequest(operationSchema, input, context);
     const ns = NormalizedSchema.of(operationSchema.input);
     const staticStructureSchema = ns.getSchema();
     let bucketMemberIndex = 0;
@@ -3559,7 +3833,7 @@ var S3RestXmlProtocol = class extends AwsRestXmlProtocol {
         }
       }
     }
-    return request2;
+    return request;
   }
 };
 
@@ -3575,12 +3849,12 @@ var NODE_USE_ARN_REGION_CONFIG_OPTIONS = {
 // ../../node_modules/@aws-sdk/middleware-sdk-s3/dist-es/submodules/s3/middleware-expect-continue/middleware-expect-continue.js
 function addExpectContinueMiddleware(options) {
   return (next) => async (args) => {
-    const { request: request2 } = args;
-    if (options.expectContinueHeader !== false && HttpRequest.isInstance(request2) && request2.body && options.runtime === "node" && options.requestHandler?.constructor?.name !== "FetchHttpHandler") {
+    const { request } = args;
+    if (options.expectContinueHeader !== false && HttpRequest.isInstance(request) && request.body && options.runtime === "node" && options.requestHandler?.constructor?.name !== "FetchHttpHandler") {
       let sendHeader = true;
       if (typeof options.expectContinueHeader === "number") {
         try {
-          const bodyLength = Number(request2.headers?.["content-length"]) ?? options.bodyLengthChecker?.(request2.body) ?? Infinity;
+          const bodyLength = Number(request.headers?.["content-length"]) ?? options.bodyLengthChecker?.(request.body) ?? Infinity;
           sendHeader = bodyLength >= options.expectContinueHeader;
         } catch (e2) {
         }
@@ -3588,12 +3862,12 @@ function addExpectContinueMiddleware(options) {
         sendHeader = !!options.expectContinueHeader;
       }
       if (sendHeader) {
-        request2.headers.Expect = "100-continue";
+        request.headers.Expect = "100-continue";
       }
     }
     return next({
       ...args,
-      request: request2
+      request
     });
   };
 }
@@ -11398,7 +11672,7 @@ var defaultProvider = (init = {}) => memoizeChain([
   },
   async (awsIdentityProperties) => {
     init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromIni");
-    const { fromIni } = await import("./dist-es-JGBPABJI.js");
+    const { fromIni } = await import("./dist-es-ZP5QDSJ3.js");
     return fromIni(init)(awsIdentityProperties);
   },
   async (awsIdentityProperties) => {
@@ -11450,14 +11724,14 @@ var readableStreamHasher = (hashCtor, readableStream) => {
   const hash = new hashCtor();
   const hashCalculator = new HashCalculator(hash);
   readableStream.pipe(hashCalculator);
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve3, reject) => {
     readableStream.on("error", (err) => {
       hashCalculator.end();
       reject(err);
     });
     hashCalculator.on("error", reject);
     hashCalculator.on("finish", () => {
-      hash.digest().then(resolve4).catch(reject);
+      hash.digest().then(resolve3).catch(reject);
     });
   });
 };
@@ -11890,8 +12164,8 @@ var BYTE_LENGTH_SOURCE;
   BYTE_LENGTH_SOURCE2["START_END_DIFF"] = "the numeric difference between Body.start and Body.end";
   BYTE_LENGTH_SOURCE2["LSTAT"] = "the size of the file given by Body.path on disk as reported by lstatSync";
 })(BYTE_LENGTH_SOURCE || (BYTE_LENGTH_SOURCE = {}));
-var byteLengthSource = (input, override2) => {
-  if (override2 != null) {
+var byteLengthSource = (input, override) => {
+  if (override != null) {
     return BYTE_LENGTH_SOURCE.CONTENT_LENGTH;
   }
   if (input == null) {
@@ -12187,8 +12461,8 @@ var Upload = class _Upload extends EventEmitter {
       const requestHandler = this.client.config.requestHandler;
       const eventEmitter = requestHandler instanceof EventEmitter ? requestHandler : null;
       let lastSeenBytes = 0;
-      const uploadEventListener = (event, request2) => {
-        const requestPartSize = Number(request2.query["partNumber"]) || -1;
+      const uploadEventListener = (event, request) => {
+        const requestPartSize = Number(request.query["partNumber"]) || -1;
         if (requestPartSize !== dataPart.partNumber) {
           return;
         }
@@ -12313,7 +12587,7 @@ to input.params.ContentLength in bytes.
     }
   }
   async __abortTimeout(abortSignal) {
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve3, reject) => {
       abortSignal.onabort = () => {
         const abortError = new Error("Upload aborted.");
         abortError.name = "AbortError";
@@ -12426,13 +12700,13 @@ var getSignedUrl = async (client, command, options = {}) => {
     s3Presigner = new S3RequestPresigner(client.config);
   }
   const presignInterceptMiddleware = (next, context) => async (args) => {
-    const { request: request2 } = args;
-    if (!HttpRequest.isInstance(request2)) {
+    const { request } = args;
+    if (!HttpRequest.isInstance(request)) {
       throw new Error("Request to be presigned is not an valid HTTP request.");
     }
-    delete request2.headers["amz-sdk-invocation-id"];
-    delete request2.headers["amz-sdk-request"];
-    delete request2.headers["x-amz-user-agent"];
+    delete request.headers["amz-sdk-invocation-id"];
+    delete request.headers["amz-sdk-request"];
+    delete request.headers["x-amz-user-agent"];
     let presigned2;
     const presignerOptions = {
       ...options,
@@ -12440,9 +12714,9 @@ var getSignedUrl = async (client, command, options = {}) => {
       signingService: options.signingService ?? context["signing_service"]
     };
     if (context.s3ExpressIdentity) {
-      presigned2 = await s3Presigner.presignWithCredentials(request2, context.s3ExpressIdentity, presignerOptions);
+      presigned2 = await s3Presigner.presignWithCredentials(request, context.s3ExpressIdentity, presignerOptions);
     } else {
-      presigned2 = await s3Presigner.presign(request2, presignerOptions);
+      presigned2 = await s3Presigner.presign(request, presignerOptions);
     }
     return {
       response: {},
@@ -12680,6 +12954,8 @@ var CAPS3 = /* @__PURE__ */ new Set([
   "streamingPut",
   "streamingGet"
 ]);
+var UPLOAD_STALL_TIMEOUT_MS = 10 * 60 * 1e3;
+var UPLOAD_STALL_PROBE_MS = 30 * 1e3;
 var SftpDestinationImpl = class {
   kind;
   capabilities = CAPS3;
@@ -12727,7 +13003,7 @@ var SftpDestinationImpl = class {
   // ── Connection helper ────────────────────────────────────────────────
   async withSftp(fn) {
     const client = new Client2();
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve3, reject) => {
       const cleanup = () => {
         try {
           client.end();
@@ -12744,7 +13020,7 @@ var SftpDestinationImpl = class {
           fn(sftp).then(
             (val) => {
               cleanup();
-              resolve4(val);
+              resolve3(val);
             },
             (e2) => {
               cleanup();
@@ -12764,12 +13040,12 @@ var SftpDestinationImpl = class {
     let current = dir.startsWith("/") ? "" : ".";
     for (const part of parts) {
       current = current === "" ? `/${part}` : posix2.join(current, part);
-      await new Promise((resolve4, reject) => {
+      await new Promise((resolve3, reject) => {
         sftp.mkdir(current, (err) => {
-          if (!err) return resolve4();
+          if (!err) return resolve3();
           sftp.stat(current, (statErr, stats) => {
             if (statErr) return reject(err);
-            if (stats.isDirectory()) return resolve4();
+            if (stats.isDirectory()) return resolve3();
             reject(new Error(`${current} exists but is not a directory`));
           });
         });
@@ -12783,14 +13059,14 @@ var SftpDestinationImpl = class {
       await this.withSftp(async (sftp) => {
         await this.ensureDir(sftp, this.rootPath);
         const probePath = posix2.join(this.rootPath, probeName);
-        await new Promise((resolve4, reject) => {
+        await new Promise((resolve3, reject) => {
           const ws = sftp.createWriteStream(probePath);
           ws.on("error", reject);
-          ws.on("close", () => resolve4());
+          ws.on("close", () => resolve3());
           ws.end("ok");
         });
         await new Promise(
-          (resolve4, reject) => sftp.unlink(probePath, (err) => err ? reject(err) : resolve4())
+          (resolve3, reject) => sftp.unlink(probePath, (err) => err ? reject(err) : resolve3())
         );
       });
       return { ok: true };
@@ -12807,27 +13083,49 @@ var SftpDestinationImpl = class {
     let bytesWritten = 0;
     await this.withSftp(async (sftp) => {
       await this.ensureDir(sftp, posix2.dirname(target));
-      await new Promise((resolve4, reject) => {
+      await new Promise((resolve3, reject) => {
         const ws = sftp.createWriteStream(tmp);
-        ws.on("error", reject);
-        ws.on("close", () => resolve4());
+        let lastProgressAt = Date.now();
+        let settled = false;
+        let watchdog;
+        const finish = (err) => {
+          if (settled) return;
+          settled = true;
+          if (watchdog) clearInterval(watchdog);
+          if (err) {
+            ws.destroy();
+            body.destroy();
+            reject(err);
+          } else {
+            resolve3();
+          }
+        };
+        watchdog = setInterval(() => {
+          if (settled || Date.now() - lastProgressAt <= UPLOAD_STALL_TIMEOUT_MS) return;
+          finish(
+            new Error(
+              `SFTP upload stalled: no write progress for ${UPLOAD_STALL_TIMEOUT_MS / 1e3}s (wrote ${bytesWritten} bytes so far). Retry; if it recurs, check both ends \u2014 whether the source is still producing bytes, and the destination's SFTP subsystem.`
+            )
+          );
+        }, UPLOAD_STALL_PROBE_MS);
+        watchdog.unref?.();
+        ws.on("error", (err) => finish(err));
+        ws.on("close", () => finish());
         body.on("data", (chunk) => {
           bytesWritten += chunk.byteLength;
+          lastProgressAt = Date.now();
         });
-        body.on("error", (err) => {
-          ws.destroy();
-          reject(err);
-        });
+        body.on("error", (err) => finish(err));
         body.pipe(ws);
       });
-      await new Promise((resolve4, reject) => {
+      await new Promise((resolve3, reject) => {
         sftp.rename(tmp, target, (err) => {
-          if (!err) return resolve4();
+          if (!err) return resolve3();
           sftp.unlink(target, () => {
             sftp.rename(
               tmp,
               target,
-              (err2) => err2 ? reject(err2) : resolve4()
+              (err2) => err2 ? reject(err2) : resolve3()
             );
           });
         });
@@ -12874,14 +13172,14 @@ var SftpDestinationImpl = class {
     const target = this.fullPath(key);
     try {
       return await this.withSftp(
-        (sftp) => new Promise((resolve4, reject) => {
+        (sftp) => new Promise((resolve3, reject) => {
           sftp.stat(target, (err, stats) => {
             if (err) {
               const code = err.code;
-              if (code === 2) return resolve4(null);
+              if (code === 2) return resolve3(null);
               return reject(err);
             }
-            resolve4({
+            resolve3({
               sizeBytes: stats.size,
               uploadedAt: new Date(stats.mtime * 1e3)
             });
@@ -12898,14 +13196,14 @@ var SftpDestinationImpl = class {
     const entries = [];
     await this.withSftp(async (sftp) => {
       const walk = async (dir, relBase) => {
-        const dirents = await new Promise((resolve4, reject) => {
+        const dirents = await new Promise((resolve3, reject) => {
           sftp.readdir(dir, (err, list) => {
             if (err) {
               const code = err.code;
-              if (code === 2) return resolve4([]);
+              if (code === 2) return resolve3([]);
               return reject(err);
             }
-            resolve4(list);
+            resolve3(list);
           });
         });
         for (const dirent of dirents) {
@@ -12931,10 +13229,10 @@ var SftpDestinationImpl = class {
     const target = this.fullPath(key);
     await this.withSftp(
       (sftp) => new Promise(
-        (resolve4, reject) => sftp.unlink(target, (err) => {
-          if (!err) return resolve4();
+        (resolve3, reject) => sftp.unlink(target, (err) => {
+          if (!err) return resolve3();
           const code = err.code;
-          if (code === 2) return resolve4();
+          if (code === 2) return resolve3();
           reject(err);
         })
       )
@@ -12946,11 +13244,11 @@ var SftpDestinationImpl = class {
     const failed = [];
     await this.withSftp(async (sftp) => {
       for (const key of keys) {
-        await new Promise((resolve4) => {
+        await new Promise((resolve3) => {
           sftp.unlink(this.fullPath(key), (err) => {
             if (!err) {
               deleted.push(key);
-              return resolve4();
+              return resolve3();
             }
             const code = err.code;
             if (code === 2) {
@@ -12958,7 +13256,7 @@ var SftpDestinationImpl = class {
             } else {
               failed.push({ key, error: err.message });
             }
-            resolve4();
+            resolve3();
           });
         });
       }
@@ -12969,210 +13267,29 @@ var SftpDestinationImpl = class {
 registerDestination("sftp", (row) => new SftpDestinationImpl(row));
 registerDestination("openship_server", (row) => new SftpDestinationImpl(row));
 
-// src/lib/compose.ts
-import { spawn as spawn2, spawnSync as spawnSync3 } from "child_process";
-import { randomBytes as randomBytes5 } from "crypto";
-import { chmodSync, existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
-import { homedir as homedir2, userInfo } from "os";
-import { join as join7 } from "path";
-
-// src/lib/paths.ts
-import { homedir } from "os";
-import { join as join3, resolve as resolve2 } from "path";
-var DEFAULT_HOME = join3(homedir(), ".openship");
-var override = process.env.OPENSHIP_HOME?.trim();
-var OS_DIR = override ? resolve2(override) : DEFAULT_HOME;
-var IS_ALT_HOME = OS_DIR !== DEFAULT_HOME;
-var DATA_DIR = join3(OS_DIR, "data");
-var LOG_DIR = join3(OS_DIR, "logs");
-var AUTH_SECRET_FILE = join3(OS_DIR, "auth-secret");
-var INTERNAL_TOKEN_FILE = join3(OS_DIR, "internal-token");
-
-// src/lib/ports.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { join as join4 } from "path";
-
-// ../../packages/core/src/ports.ts
-import { createServer } from "net";
-var DEFAULT_API_PORT = 4e3;
-var DEFAULT_DASHBOARD_PORT = 3001;
-var LOOPBACK = "127.0.0.1";
-var SCAN_SPAN = 20;
-var MAX_PORT = 65535;
-function isPortFree(port, host = LOOPBACK) {
-  return new Promise((resolve4) => {
-    const srv = createServer();
-    srv.once("error", () => resolve4(false));
-    srv.listen(port, host, () => srv.close(() => resolve4(true)));
-  });
+// src/lib/this-host.ts
+function thisHost() {
+  return envOps(resolveLocalEnvironmentSync());
 }
-async function waitPortFree(port, opts = {}) {
-  const timeoutMs = opts.timeoutMs ?? 6e3;
-  const intervalMs = opts.intervalMs ?? 250;
-  const host = opts.host ?? LOOPBACK;
-  const deadline = Date.now() + timeoutMs;
-  for (; ; ) {
-    if (await isPortFree(port, host)) return true;
-    if (Date.now() >= deadline) return false;
-    await new Promise((r2) => setTimeout(r2, intervalMs));
-  }
+function pasteable(op) {
+  if (!op.supported) return null;
+  const sudo = thisHost().profile.isRoot ? "" : "sudo ";
+  return op.value.map((step) => `${sudo}${step}`).join(" && ");
 }
-function getFreePort(host = LOOPBACK) {
-  return new Promise((resolve4, reject) => {
-    const srv = createServer();
-    srv.once("error", reject);
-    srv.listen(0, host, () => {
-      const addr = srv.address();
-      const port = addr && typeof addr === "object" ? addr.port : 0;
-      srv.close(() => port ? resolve4(port) : reject(new Error("no free port")));
-    });
-  });
+function startUnitHint(unit) {
+  return pasteable(thisHost().serviceEnableStart(unit));
 }
-async function findPortNear(from, opts = {}) {
-  const host = opts.host ?? LOOPBACK;
-  const span = opts.span ?? SCAN_SPAN;
-  const skip = opts.skip ?? (() => false);
-  for (let port2 = from; port2 <= Math.min(from + span, MAX_PORT); port2++) {
-    if (!skip(port2) && await isPortFree(port2, host)) return port2;
-  }
-  let port = await getFreePort(host);
-  for (let tries = 0; tries < 10 && skip(port); tries++) port = await getFreePort(host);
-  return port;
-}
-async function resolvePortPair(prefs = {}) {
-  const host = prefs.bindAddr?.trim() || LOOPBACK;
-  const ours = new Set(prefs.reclaimable ?? []);
-  const prefFor = (kind) => prefs[kind] ?? prefs.previous?.[kind] ?? prefs.stored?.[kind] ?? prefs.defaults?.[kind];
-  const remembered = (kind, pref) => prefs[kind] === void 0 && (prefs.previous?.[kind] === pref || prefs.stored?.[kind] === pref);
-  const availableForPref = async (port) => ours.has(port) || await isPortFree(port, host);
-  const apiPref = prefFor("api");
-  const dashPref = prefFor("dashboard");
-  let api;
-  if (apiPref === void 0) api = await getFreePort(host);
-  else if (await availableForPref(apiPref)) api = apiPref;
-  else if (remembered("api", apiPref) && await waitPortFree(apiPref, { host })) api = apiPref;
-  else {
-    api = await findPortNear(apiPref + 1, {
-      host,
-      skip: (p2) => ours.has(p2) || p2 === dashPref
-    });
-  }
-  const skipForDash = (p2) => ours.has(p2) || p2 === api;
-  let dashboard;
-  if (dashPref === void 0) {
-    dashboard = await getFreePort(host);
-    for (let tries = 0; tries < 10 && dashboard === api; tries++) {
-      dashboard = await getFreePort(host);
-    }
-  } else if (dashPref !== api && await availableForPref(dashPref)) {
-    dashboard = dashPref;
-  } else if (dashPref !== api && remembered("dashboard", dashPref) && await waitPortFree(dashPref, { host })) {
-    dashboard = dashPref;
-  } else {
-    dashboard = await findPortNear(dashPref + 1, { host, skip: skipForDash });
-  }
-  return {
-    api,
-    dashboard,
-    switched: {
-      api: apiPref !== void 0 && api !== apiPref,
-      dashboard: dashPref !== void 0 && dashboard !== dashPref
-    },
-    preferred: { api: apiPref ?? api, dashboard: dashPref ?? dashboard }
-  };
-}
-
-// src/lib/ports.ts
-var PORTS_FILE = join4(OS_DIR, "ports.json");
-var INSTANCE_FILE = join4(OS_DIR, "instance.json");
-function saveInstanceUrl(publicUrl) {
-  try {
-    if (!existsSync(OS_DIR)) mkdirSync(OS_DIR, { recursive: true, mode: 448 });
-    writeFileSync(INSTANCE_FILE, JSON.stringify({ publicUrl: publicUrl ?? null }));
-  } catch {
-  }
-}
-function readInstanceUrl() {
-  try {
-    return JSON.parse(readFileSync(INSTANCE_FILE, "utf8")).publicUrl ?? null;
-  } catch {
-    return null;
-  }
-}
-function readStoredPorts() {
-  try {
-    return JSON.parse(readFileSync(PORTS_FILE, "utf-8"));
-  } catch {
-    return {};
-  }
-}
-function storedApiPort() {
-  return readStoredPorts().api ?? DEFAULT_API_PORT;
-}
-function storedDashboardPort() {
-  return readStoredPorts().dashboard ?? DEFAULT_DASHBOARD_PORT;
-}
-function saveStoredPorts(api, dashboard) {
-  try {
-    if (!existsSync(OS_DIR)) mkdirSync(OS_DIR, { recursive: true, mode: 448 });
-    writeFileSync(PORTS_FILE, JSON.stringify({ api, dashboard }));
-  } catch {
-  }
-}
-function portMoveNotice(resolved, trustedOriginUrls = []) {
-  if (!resolved.switched.api && !resolved.switched.dashboard) return [];
-  const lines = [
-    `A preferred port was busy \u2014 using API ${resolved.api}, dashboard ${resolved.dashboard}.`
-  ];
-  const stale = [...new Set(stalePortOrigins(resolved.preferred.dashboard, trustedOriginUrls))];
-  if (stale.length) {
-    lines.push(
-      `Heads up: ${stale.join(", ")} still names port ${resolved.preferred.dashboard}, so logins`,
-      `from that origin will be rejected. Point it at :${resolved.dashboard} (or free port`,
-      `${resolved.preferred.dashboard} and re-run to move back).`
-    );
-  }
-  return lines;
-}
-function stalePortOrigins(movedFrom, urls) {
-  const stale = [];
-  for (const raw of urls) {
-    for (const candidate of (raw ?? "").split(",")) {
-      const value = candidate.trim();
-      if (!value) continue;
-      try {
-        if (new URL(value).port === String(movedFrom)) stale.push(value);
-      } catch {
-      }
-    }
-  }
-  return stale;
-}
-async function resolvePorts(prefs, opts = {}) {
-  const resolved = await resolvePortPair({
-    ...prefs,
-    stored: readStoredPorts(),
-    defaults: { api: DEFAULT_API_PORT, dashboard: DEFAULT_DASHBOARD_PORT }
-  });
-  if (opts.persist !== false) saveStoredPorts(resolved.api, resolved.dashboard);
-  return resolved;
-}
-
-// src/lib/source-install.ts
-import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
-import { join as join6 } from "path";
 
 // src/lib/from-source.ts
-import { spawn, spawnSync } from "child_process";
+import { spawn, spawnSync as spawnSync2 } from "child_process";
 import { existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
-import { join as join5, resolve as resolve3 } from "path";
+import { join as join4, resolve as resolve2 } from "path";
 var DEFAULT_REPO = "https://github.com/oblien/openship.git";
-var SOURCE_CHECKOUT_DIR = join5(OS_DIR, "src");
-var SOURCE_DIST_DIR = join5(OS_DIR, "from-source-dist");
+var SOURCE_CHECKOUT_DIR = join4(OS_DIR, "src");
+var SOURCE_DIST_DIR = join4(OS_DIR, "from-source-dist");
 function has(cmd) {
   try {
-    return spawnSync(cmd, ["--version"], { stdio: "ignore" }).status === 0;
+    return spawnSync2(cmd, ["--version"], { stdio: "ignore" }).status === 0;
   } catch {
     return false;
   }
@@ -13194,11 +13311,11 @@ function run(cmd, args, cwd, env) {
   });
 }
 function shortSha(cwd) {
-  const r2 = spawnSync("git", ["rev-parse", "--short", "HEAD"], { cwd, encoding: "utf8" });
+  const r2 = spawnSync2("git", ["rev-parse", "--short", "HEAD"], { cwd, encoding: "utf8" });
   return r2.status === 0 ? (r2.stdout ?? "").trim() || "unknown" : "unknown";
 }
 function isMonorepo(dir) {
-  return existsSync2(join5(dir, "package.json")) && existsSync2(join5(dir, "apps/api/package.json")) && existsSync2(join5(dir, "apps/dashboard/package.json"));
+  return existsSync2(join4(dir, "package.json")) && existsSync2(join4(dir, "apps/api/package.json")) && existsSync2(join4(dir, "apps/dashboard/package.json"));
 }
 async function prepareFromSource(opts) {
   if (!has("bun")) {
@@ -13209,7 +13326,7 @@ async function prepareFromSource(opts) {
   let sourceDir;
   let ref;
   if (opts.source) {
-    sourceDir = resolve3(opts.source);
+    sourceDir = resolve2(opts.source);
     if (!isMonorepo(sourceDir)) {
       throw new Error(
         `--source ${sourceDir} doesn't look like an Openship checkout (missing package.json / apps/api / apps/dashboard).`
@@ -13224,7 +13341,7 @@ async function prepareFromSource(opts) {
     const repoUrl = opts.repo || DEFAULT_REPO;
     sourceDir = SOURCE_CHECKOUT_DIR;
     mkdirSync2(OS_DIR, { recursive: true });
-    if (!existsSync2(join5(sourceDir, ".git"))) {
+    if (!existsSync2(join4(sourceDir, ".git"))) {
       console.log(`  Cloning ${repoUrl} \u2192 ${sourceDir}`);
       await run("git", ["clone", repoUrl, sourceDir], OS_DIR);
     }
@@ -13243,25 +13360,43 @@ async function prepareFromSource(opts) {
   console.log("  Building release dist (compiles the dashboard \u2014 needs RAM/CPU)\u2026");
   await run(
     "bun",
-    ["run", join5(sourceDir, "apps/api/scripts/build-release.ts")],
+    ["run", join4(sourceDir, "apps/api/scripts/build-release.ts")],
     sourceDir,
     { DIST_DIR: distDir, NODE_ENV: "production", CLOUD_MODE: "false", OPENSHIP_TARGET: "local" }
   );
   console.log("  Installing runtime dependencies in the dist\u2026");
   await run("bun", ["install", "--production", "--frozen-lockfile"], distDir);
-  const apiDir = join5(distDir, "api");
-  const dashboardDir = join5(distDir, "dashboard");
-  if (!existsSync2(join5(apiDir, "src/index.ts"))) {
+  const apiDir = join4(distDir, "api");
+  const dashboardDir = join4(distDir, "dashboard");
+  if (!existsSync2(join4(apiDir, "src/index.ts"))) {
     throw new Error(`Build produced no API at ${apiDir}/src/index.ts \u2014 build-release layout drift?`);
   }
-  if (!existsSync2(join5(dashboardDir, "apps/dashboard/server.js"))) {
+  if (!existsSync2(join4(dashboardDir, "apps/dashboard/server.js"))) {
     throw new Error(`Build produced no dashboard at ${dashboardDir}/apps/dashboard/server.js.`);
   }
   return { apiDir, dashboardDir, ref, sha, sourceDir };
 }
 
+// src/lib/compose.ts
+import { spawn as spawn2, spawnSync as spawnSync4 } from "child_process";
+import { randomBytes as randomBytes5 } from "crypto";
+import {
+  chmodSync,
+  existsSync as existsSync4,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync3,
+  renameSync,
+  rmSync,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { homedir, userInfo } from "os";
+import { dirname as dirname2, join as join6 } from "path";
+
 // src/lib/source-install.ts
-var MARKER = join6(OS_DIR, "source-install.json");
+import { spawnSync as spawnSync3 } from "child_process";
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+import { join as join5 } from "path";
+var MARKER = join5(OS_DIR, "source-install.json");
 function parseSourceInstall(raw) {
   try {
     const obj = JSON.parse(raw);
@@ -13284,7 +13419,7 @@ function parseRemoteSha(stdout) {
   return sha && /^[0-9a-f]{7,40}$/i.test(sha) ? sha.slice(0, 7) : null;
 }
 function remoteSha(repo, ref) {
-  const r2 = spawnSync2("git", ["ls-remote", repo, ref], { encoding: "utf8" });
+  const r2 = spawnSync3("git", ["ls-remote", repo, ref], { encoding: "utf8" });
   if (r2.status !== 0 || !r2.stdout) return null;
   return parseRemoteSha(r2.stdout);
 }
@@ -13295,7 +13430,7 @@ async function rebuildFromSource(info) {
   if (!has("git")) {
     throw new Error("`git` is required to update the source checkout but wasn't found on PATH.");
   }
-  if (!existsSync3(join6(info.dir, ".git"))) {
+  if (!existsSync3(join5(info.dir, ".git"))) {
     throw new Error(
       `Source checkout ${info.dir} is missing (no .git) \u2014 reinstall from source with scripts/install-source.sh.`
     );
@@ -13304,7 +13439,7 @@ async function rebuildFromSource(info) {
   await run("git", ["checkout", info.ref], info.dir);
   await run("git", ["pull", "--ff-only", "origin", info.ref], info.dir).catch(() => {
   });
-  const cliDir = join6(info.dir, "apps/cli");
+  const cliDir = join5(info.dir, "apps/cli");
   await run("bun", ["install"], info.dir);
   await run("bun", ["run", "build"], cliDir);
   await run("bun", ["run", "build/stage-dashboard.ts"], cliDir);
@@ -13317,11 +13452,13 @@ var EDGE_ACME_HOST_DIR = `${EDGE_HOST_STATE_DIR}/acme`;
 function edgeVolumeYaml(indent) {
   return EDGE_CONTAINER_MOUNTS.map((m2) => `${indent}- ${m2.host}:${m2.container}:z`).join("\n");
 }
-var COMPOSE_DIR = join7(OS_DIR, "compose");
-var INSTALL_METHOD_FILE = join7(OS_DIR, "install-method");
-var COMPOSE_FILE = join7(COMPOSE_DIR, "docker-compose.yml");
-var BUILD_FILE = join7(COMPOSE_DIR, "docker-compose.build.yml");
-var ENV_FILE = join7(COMPOSE_DIR, ".env");
+var COMPOSE_DIR = join6(OS_DIR, "compose");
+var INSTALL_METHOD_FILE = join6(OS_DIR, "install-method");
+var COMPOSE_FILE = join6(COMPOSE_DIR, "docker-compose.yml");
+var BUILD_FILE = join6(COMPOSE_DIR, "docker-compose.build.yml");
+var ENV_FILE = join6(COMPOSE_DIR, ".env");
+var ENV_BACKUP_FILE = join6(COMPOSE_DIR, ".env.bak");
+var ENV_TMP_FILE = join6(COMPOSE_DIR, ".env.tmp");
 var BUILT_SERVICES = [
   { service: "api", dockerfile: "apps/api/Dockerfile" },
   { service: "dashboard", dockerfile: "apps/dashboard/Dockerfile" },
@@ -13341,7 +13478,7 @@ function writeInstallMethod(method) {
   writeFileSync2(INSTALL_METHOD_FILE, method, { mode: 384 });
 }
 function dockerState() {
-  const ok = (args) => spawnSync3("docker", args, { stdio: "ignore" }).status === 0;
+  const ok = (args) => spawnSync4("docker", args, { stdio: "ignore" }).status === 0;
   if (!ok(["--version"])) return { binary: false, plugin: false, daemon: false };
   return { binary: true, plugin: ok(["compose", "version"]), daemon: ok(["version"]) };
 }
@@ -13356,13 +13493,13 @@ function dockerGap(state = dockerState()) {
     };
   }
   if (!state.daemon) {
-    const asRoot = typeof process.getuid === "function" && process.getuid() === 0;
+    const start = pasteable(thisHost().dockerStart());
     return {
       summary: "Docker is installed but its daemon isn't reachable",
       // Reinstalling changes nothing: a group change only applies to NEW logins,
       // and a stopped daemon needs starting, not installing.
       installable: false,
-      hint: asRoot ? "Start it with: systemctl start docker" : `Add your user to the docker group: sudo usermod -aG docker ${userInfo().username} \u2014 then log out and back in (or run: newgrp docker). If the daemon is stopped: sudo systemctl start docker`
+      hint: thisHost().profile.isRoot ? start ? `Start it with: ${start}` : "Start the Docker daemon \u2014 this host has no service manager Openship recognizes." : `Add your user to the docker group: sudo usermod -aG docker ${userInfo().username} \u2014 then log out and back in (or run: newgrp docker). If the daemon is stopped: ${start ?? "start it the way this host starts services"}`
     };
   }
   return null;
@@ -13371,7 +13508,7 @@ function hasDockerCompose() {
   return dockerGap() === null;
 }
 function hasCmd(cmd) {
-  return spawnSync3(cmd, ["--version"], { stdio: "ignore" }).status === 0;
+  return spawnSync4(cmd, ["--version"], { stdio: "ignore" }).status === 0;
 }
 function shQuote(s2) {
   return `'${s2.replace(/'/g, `'\\''`)}'`;
@@ -13380,23 +13517,22 @@ function dockerInstallPreview(state = dockerState()) {
   const gap = dockerGap(state);
   if (!gap) return { state, gap: null, wouldInstall: false };
   if (process.platform !== "linux" || !gap.installable) return { state, gap, wouldInstall: false };
-  const plan = systemCatalog.installs.docker({
-    os: "linux",
-    serviceManager: "systemd"
-  });
-  if (!plan.supported || !plan.installCommand) return { state, gap, wouldInstall: false };
+  const plan = systemCatalog.installs.docker(resolveLocalEnvironmentSync());
+  if (!plan.supported) return { state, gap, wouldInstall: false, unsupportedReason: plan.reason };
+  const start = plan.value.service;
   return {
     state,
     gap,
     wouldInstall: true,
-    installCommand: plan.installCommand,
-    ...plan.startCommand ? { startCommand: plan.startCommand } : {}
+    installCommand: plan.value.installCommand,
+    ...start?.supported ? { startCommand: start.value } : {},
+    ...start && !start.supported ? { startBlockedReason: start.reason } : {}
   };
 }
 async function ensureDocker(opts = {}) {
   const notice = opts.onNotice ?? ((line) => process.stderr.write(`  ${line}
 `));
-  const { state, gap, wouldInstall, installCommand, startCommand } = dockerInstallPreview();
+  const { state, gap, wouldInstall, installCommand, startCommand, unsupportedReason, startBlockedReason } = dockerInstallPreview();
   if (!gap) return true;
   if (process.platform !== "linux") return false;
   if (!gap.installable) {
@@ -13404,14 +13540,17 @@ async function ensureDocker(opts = {}) {
     if (gap.hint) notice(gap.hint);
     return false;
   }
-  if (!wouldInstall || !installCommand) return false;
+  if (!wouldInstall || !installCommand) {
+    if (unsupportedReason) notice(unsupportedReason);
+    return false;
+  }
   const asRoot = typeof process.getuid === "function" && process.getuid() === 0;
   const sudo = !asRoot && hasCmd("sudo") ? "sudo " : "";
   notice("This can take 2-5 minutes on a small VPS (~150 MB of packages) and stays quiet while apt works.");
   if (state.binary) {
     notice("Docker's installer will warn that docker already exists and pause ~20s before continuing \u2014 that's expected.");
   }
-  const sh = (script) => new Promise((resolve4) => {
+  const sh = (script) => new Promise((resolve3) => {
     const child = spawn2("sh", ["-c", sudo ? `${sudo}sh -c ${shQuote(script)}` : script], {
       stdio: "inherit"
     });
@@ -13422,13 +13561,14 @@ async function ensureDocker(opts = {}) {
     }, 3e4);
     const done = (code) => {
       clearInterval(tick);
-      resolve4(code);
+      resolve3(code);
     };
     child.on("error", () => done(1));
     child.on("close", (code) => done(code ?? 1));
   });
   if (await sh(installCommand) !== 0) return false;
   if (startCommand) await sh(startCommand);
+  else if (startBlockedReason) notice(startBlockedReason);
   const after = dockerGap();
   if (!after) {
     notice("Docker ready.");
@@ -13481,7 +13621,14 @@ services:
     # (set by \`openship up\` when a public URL is configured for off-box access).
     ports: ["\${OPENSHIP_BIND_ADDR:-127.0.0.1}:\${API_PORT:-4000}:\${API_PORT:-4000}"]
     volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
+      # The daemon socket, at the path the api's own default expects INSIDE the
+      # container. The HOST side is a variable because it MOVES: a rootless daemon
+      # keeps its socket under the invoking user's runtime dir, and Docker creates a
+      # missing bind source as an empty DIRECTORY instead of failing \u2014 so the rootful
+      # path there brings the stack up and then fails every container operation in
+      # the transport, naming neither the path nor the cause (#482). \`openship up\`
+      # writes OPENSHIP_DOCKER_SOCKET when the detected path isn't this default.
+      - \${OPENSHIP_DOCKER_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock
       # Routing state shared with the edge, as HOST BIND MOUNTS (generated from
       # EDGE_CONTAINER_MOUNTS): the vhost tree, /etc/letsencrypt, the ACME webroot
       # and the static doc-roots the API writes and the edge serves. Named volumes
@@ -13490,9 +13637,16 @@ services:
 ${edgeVolumeYaml("      ")}
       # Host-op SSH key (createHostExecutor \u2192 host.docker.internal). /dev/null
       # when the host channel isn't provisioned \u2192 OPENSHIP_HOST_SSH_HOST stays
-      # unset and the API falls back to LocalExecutor.
+      # unset, and host operations REFUSE (they'd otherwise run against this
+      # container's filesystem, #509) while ordinary deploys keep working over
+      # the socket below.
       - \${OPENSHIP_HOST_KEY_PATH:-/dev/null}:/run/secrets/openship_host_key:ro
-    extra_hosts: ["host.docker.internal:host-gateway"]
+    # \`host-gateway\` is resolved by the daemon and is right on a stock rootful
+    # install. It is NOT universally right: under rootless Docker it lands in
+    # RootlessKit's namespace rather than the host's, so the host's sshd isn't
+    # there (#482). OPENSHIP_HOST_GATEWAY re-points the alias (e.g. at the box's
+    # LAN address) without patching this file, which \`openship up\` rewrites.
+    extra_hosts: ["host.docker.internal:\${OPENSHIP_HOST_GATEWAY:-host-gateway}"]
     env_file: [.env]
     environment:
       NODE_ENV: production
@@ -13546,97 +13700,437 @@ volumes:
 function keepSecret(existing, key) {
   return existing[key] || randomBytes5(32).toString("hex");
 }
+var GENERATED_SECRET_KEYS = ["POSTGRES_PASSWORD", "BETTER_AUTH_SECRET", "INTERNAL_TOKEN"];
+function survivingDbVolume(prev) {
+  const candidates = /* @__PURE__ */ new Set([prev.COMPOSE_PROJECT_NAME, "openship", "compose"]);
+  for (const project of candidates) {
+    if (project && dbVolumeExists(project)) return `${project}_postgres_data`;
+  }
+  return null;
+}
+function secretRotationRisk(prev) {
+  const keys = GENERATED_SECRET_KEYS.filter((k2) => !prev[k2]);
+  if (keys.length === 0) return null;
+  const volume = survivingDbVolume(prev);
+  return volume ? { volume, keys: [...keys] } : null;
+}
+function composeSecretRotationRisk(opts = {}) {
+  if (opts.resetSecrets) return null;
+  return secretRotationRisk(readEnvFile());
+}
+function renderSecretRotationRefusal(rotation, opts = {}) {
+  return `
+  ${opts.dryRun ? "A real run would REFUSE here" : "Refusing to continue"}: this would regenerate secrets your existing install already has.
+
+    missing from ${ENV_FILE}:  ${rotation.keys.join(", ")}
+    but this install's data is still here:  ${rotation.volume}
+
+  A new POSTGRES_PASSWORD cannot match that volume \u2014 Postgres only applies the password
+  when it first creates the data directory \u2014 and a new BETTER_AUTH_SECRET cannot decrypt
+  the environment variables already stored in the database. Nothing has been written yet.
+
+` + secretRecoveryAdvice(rotation);
+}
+function secretRecoveryAdvice(rotation) {
+  const adopted = adoptedStack(projectOfDbVolume(rotation.volume));
+  if (adopted) {
+    return `  This stack was not created by \`openship up\`: it is already running under the compose
+  project name we pin, so this run would ADOPT it.
+
+    project:      ${adopted.project}
+    started from: ${adopted.configFiles || "an unlabelled `docker run`"}
+    not from:     ${COMPOSE_FILE}
+
+  So there is no \`.env\` of ours to restore and no backup of one \u2014 the real values are in
+  the api container's own environment. Copy them out of it, then re-run:
+
+    echo 'COMPOSE_PROJECT_NAME=${adopted.project}' >> ${ENV_FILE}
+    docker inspect ${adopted.apiContainer} --format '{{range .Config.Env}}{{println .}}{{end}}' \\
+      | grep -E '^(${rotation.keys.join("|")})=' >> ${ENV_FILE}
+
+  COMPOSE_PROJECT_NAME matters as much as the secrets do: it is the volume prefix, so
+  without it this stack comes up on empty volumes beside the data above.
+
+  Only if that container is gone and the values exist nowhere else \u2014 this DESTROYS them,
+  leaving every environment variable stored in the database permanently unreadable:
+    openship up --reset-secrets
+`;
+  }
+  return `  Put the original values back and re-run:
+` + (existsSync4(ENV_BACKUP_FILE) ? `    cp ${ENV_BACKUP_FILE} ${ENV_FILE}     # the .env a previous \`openship up\` replaced
+` : `    restore ${ENV_FILE} from a backup, or copy the keys above out of one
+`) + `  If the file is there but this user can't read it, re-run as the user that owns it
+  (or as root) rather than letting the secrets be regenerated.
+
+  To reset instead \u2014 the database password gets realigned, but every stored environment
+  variable becomes permanently unreadable:
+    openship up --reset-secrets
+`;
+}
+function projectOfDbVolume(volume) {
+  return volume.replace(/_postgres_data$/, "");
+}
 function readEnvFile() {
   const out = {};
+  let text;
   try {
-    for (const line of readFileSync3(ENV_FILE, "utf8").split("\n")) {
-      const m2 = line.match(/^([A-Z0-9_]+)=(.*)$/);
-      if (m2) out[m2[1]] = m2[2];
+    text = readFileSync3(ENV_FILE, "utf8");
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      console.log(
+        `  ! Could not read ${ENV_FILE}: ${err.message}
+    Its contents are being treated as absent. If this install already exists, fix the permissions and re-run rather than letting secrets be regenerated.`
+      );
     }
-  } catch {
+    return out;
+  }
+  for (const line of text.split("\n")) {
+    const m2 = line.match(/^([A-Z0-9_]+)=(.*)$/);
+    if (m2) out[m2[1]] = m2[2];
   }
   return out;
 }
+var HOST_CHANNEL_DEFAULT_HOST = "host.docker.internal";
+var HOST_CHANNEL_DEFAULT_PORT = 22;
 var HOST_KEY_COMMENT = "openship-host-executor";
 var HOST_KEY_FROM = "172.16.0.0/12,192.168.0.0/16,10.0.0.0/8,127.0.0.1";
 function hostKeyAuthLine(pub) {
   return `from="${HOST_KEY_FROM}",restrict,pty ${pub}`;
 }
 function rewriteHostAuthorizedKeys(existing, pub) {
-  const kept = existing.split("\n").filter((line) => line.trim() && !line.includes(HOST_KEY_COMMENT));
-  return [...kept, hostKeyAuthLine(pub)].join("\n") + "\n";
+  return [...keptForeignKeys(existing), hostKeyAuthLine(pub)].join("\n") + "\n";
+}
+function keptForeignKeys(existing) {
+  return existing.split("\n").filter((line) => line.trim() && !line.includes(HOST_KEY_COMMENT));
+}
+function stripHostAuthorizedKeys(existing) {
+  const kept = keptForeignKeys(existing);
+  return kept.length ? kept.join("\n") + "\n" : "";
+}
+var ROOT_AUTHORIZED_KEYS = "/root/.ssh/authorized_keys";
+function chooseHostChannelUser(input) {
+  if (input.invokerUid === 0) {
+    return { user: "root", authKeysPath: ROOT_AUTHORIZED_KEYS, viaSudo: false, rootUnavailable: false };
+  }
+  if (input.hasPasswordlessSudo) {
+    return { user: "root", authKeysPath: ROOT_AUTHORIZED_KEYS, viaSudo: true, rootUnavailable: false };
+  }
+  return {
+    user: input.invokerName,
+    authKeysPath: join6(input.invokerHome, ".ssh", "authorized_keys"),
+    viaSudo: false,
+    rootUnavailable: true
+  };
+}
+function hasPasswordlessSudo() {
+  try {
+    return spawnSync4("sudo", ["-n", "true"], { stdio: "ignore" }).status === 0;
+  } catch {
+    return false;
+  }
 }
 function plannedHostChannel(hostControl) {
   if (!hostControl || process.platform !== "linux") return null;
-  let user;
+  let invoker;
   try {
-    user = userInfo().username;
+    const info = userInfo();
+    invoker = { uid: info.uid, username: info.username, home: info.homedir };
+  } catch {
+    invoker = { uid: -1, username: process.env.USER || process.env.LOGNAME || "root", home: homedir() };
+  }
+  const decision = chooseHostChannelUser({
+    invokerUid: invoker.uid,
+    invokerName: invoker.username,
+    invokerHome: invoker.home,
+    // Only probe sudo when it could change the outcome — a root invoker never needs it.
+    hasPasswordlessSudo: invoker.uid !== 0 && hasPasswordlessSudo()
+  });
+  return { ...decision, keyPath: join6(COMPOSE_DIR, "host-ssh", "id_ed25519") };
+}
+function authorizeKeyAt(authKeysPath, pub) {
+  mkdirSync3(dirname2(authKeysPath), { recursive: true, mode: 448 });
+  const existing = existsSync4(authKeysPath) ? readFileSync3(authKeysPath, "utf8") : "";
+  const next = rewriteHostAuthorizedKeys(existing, pub);
+  if (next !== existing) writeFileSync2(authKeysPath, next, { mode: 384 });
+  chmodSync(authKeysPath, 384);
+}
+function authorizeRootKeyViaSudo(pub) {
+  const mk = spawnSync4("sudo", ["-n", "sh", "-c", "mkdir -p /root/.ssh && chmod 700 /root/.ssh"], {
+    stdio: "ignore"
+  });
+  if (mk.status !== 0) return false;
+  const read = spawnSync4(
+    "sudo",
+    ["-n", "sh", "-c", `cat ${ROOT_AUTHORIZED_KEYS} 2>/dev/null || true`],
+    { encoding: "utf8" }
+  );
+  if (read.status !== 0) return false;
+  const next = rewriteHostAuthorizedKeys(read.stdout ?? "", pub);
+  const write = spawnSync4("sudo", ["-n", "tee", ROOT_AUTHORIZED_KEYS], {
+    input: next,
+    stdio: ["pipe", "ignore", "ignore"]
+  });
+  if (write.status !== 0) return false;
+  return spawnSync4("sudo", ["-n", "chmod", "600", ROOT_AUTHORIZED_KEYS], { stdio: "ignore" }).status === 0;
+}
+function revokeKeyAt(authKeysPath) {
+  try {
+    if (!existsSync4(authKeysPath)) return true;
+    const existing = readFileSync3(authKeysPath, "utf8");
+    if (!existing.includes(HOST_KEY_COMMENT)) return true;
+    writeFileSync2(authKeysPath, stripHostAuthorizedKeys(existing), { mode: 384 });
+    chmodSync(authKeysPath, 384);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function revokeRootKeyViaSudo() {
+  const read = spawnSync4(
+    "sudo",
+    ["-n", "sh", "-c", `cat ${ROOT_AUTHORIZED_KEYS} 2>/dev/null || true`],
+    { encoding: "utf8" }
+  );
+  if (read.status !== 0) return false;
+  const existing = read.stdout ?? "";
+  if (!existing.includes(HOST_KEY_COMMENT)) return true;
+  const write = spawnSync4("sudo", ["-n", "tee", ROOT_AUTHORIZED_KEYS], {
+    input: stripHostAuthorizedKeys(existing),
+    stdio: ["pipe", "ignore", "ignore"]
+  });
+  return write.status === 0;
+}
+function retireHostSshChannel(prev) {
+  const keyDir = join6(COMPOSE_DIR, "host-ssh");
+  if (!existsSync4(keyDir) && !prev.OPENSHIP_HOST_SSH_HOST) return;
+  const invokerKeys = join6(homedir(), ".ssh", "authorized_keys");
+  const asRoot = (prev.OPENSHIP_HOST_SSH_USER?.trim() || "root") === "root";
+  const weAreRoot = typeof process.getuid === "function" && process.getuid() === 0;
+  const revoked = asRoot ? weAreRoot ? revokeKeyAt(ROOT_AUTHORIZED_KEYS) : hasPasswordlessSudo() && revokeRootKeyViaSudo() : revokeKeyAt(invokerKeys);
+  const alsoInvoker = asRoot ? revokeKeyAt(invokerKeys) : true;
+  try {
+    rmSync(keyDir, { recursive: true, force: true });
   } catch {
-    user = process.env.USER || process.env.LOGNAME || "root";
   }
-  return { user, keyPath: join7(COMPOSE_DIR, "host-ssh", "id_ed25519") };
+  const stuck = asRoot ? ROOT_AUTHORIZED_KEYS : invokerKeys;
+  console.log(
+    revoked && alsoInvoker ? "  Host control off: dropped OPENSHIP_HOST_SSH_* from .env, deleted the host key and\n  revoked its authorized_keys line." : `  Host control off: dropped OPENSHIP_HOST_SSH_* from .env and deleted the host key (it
+  can no longer be used). Removing its line needs root \u2014 run:
+  sudo sed -i '/${HOST_KEY_COMMENT}/d' ${stuck}`
+  );
 }
-function provisionHostSshChannel(hostControl) {
-  const target = plannedHostChannel(hostControl);
-  if (!target) return null;
-  const { user, keyPath } = target;
+function provisionHostSshChannel(cfg) {
+  const target = plannedHostChannel(cfg.hostControl);
+  if (!target) return { channel: null };
+  const { user, keyPath, authKeysPath, viaSudo, rootUnavailable } = target;
+  const provisioned = (channel) => {
+    const port = toPort(cfg.hostSshPort) ?? HOST_CHANNEL_DEFAULT_PORT;
+    return probeHostSshd(port) === "absent" ? { channel, issue: { code: "no-sshd", detail: `port ${port}` } } : { channel };
+  };
   try {
-    mkdirSync3(join7(COMPOSE_DIR, "host-ssh"), { recursive: true, mode: 448 });
+    mkdirSync3(join6(COMPOSE_DIR, "host-ssh"), { recursive: true, mode: 448 });
     if (!existsSync4(keyPath)) {
-      const g2 = spawnSync3(
+      const g2 = spawnSync4(
         "ssh-keygen",
         ["-t", "ed25519", "-N", "", "-q", "-f", keyPath, "-C", HOST_KEY_COMMENT],
-        { stdio: "ignore" }
+        // stderr is captured rather than discarded: it is the only account of why the
+        // channel is missing, and the caller prints it.
+        { encoding: "utf8", stdio: ["ignore", "ignore", "pipe"] }
       );
-      if (g2.status !== 0) return null;
+      if (g2.status !== 0) return { channel: null, issue: { code: "keygen", detail: keygenWhy(g2) } };
     }
     const pub = readFileSync3(`${keyPath}.pub`, "utf8").trim();
-    if (!pub) return null;
-    const userSshDir = join7(homedir2(), ".ssh");
-    mkdirSync3(userSshDir, { recursive: true, mode: 448 });
-    const authKeys = join7(userSshDir, "authorized_keys");
-    const existing = existsSync4(authKeys) ? readFileSync3(authKeys, "utf8") : "";
-    const next = rewriteHostAuthorizedKeys(existing, pub);
-    if (next !== existing) writeFileSync2(authKeys, next, { mode: 384 });
-    chmodSync(authKeys, 384);
-    return { user, keyPath };
-  } catch {
-    return null;
+    if (!pub) return { channel: null, issue: { code: "empty-key" } };
+    if (rootUnavailable) {
+      console.warn(
+        "  \u26A0 Host control needs root, but this user isn't root and passwordless sudo isn't\n    available. Mail and edge host operations will fail. Re-run `openship up` as root\n    (or enable passwordless sudo) to fix. Continuing with a limited host channel."
+      );
+      authorizeKeyAt(authKeysPath, pub);
+      return provisioned({ user, keyPath });
+    }
+    if (viaSudo) {
+      if (!authorizeRootKeyViaSudo(pub)) {
+        console.warn(
+          "  \u26A0 Could not authorize the host key for root via sudo \u2014 falling back to the\n    current user. Root host operations (mail/edge) may fail."
+        );
+        const invoker = userInfo().username;
+        authorizeKeyAt(join6(homedir(), ".ssh", "authorized_keys"), pub);
+        return provisioned({ user: invoker, keyPath });
+      }
+      revokeKeyAt(join6(homedir(), ".ssh", "authorized_keys"));
+      return provisioned({ user, keyPath });
+    }
+    authorizeKeyAt(authKeysPath, pub);
+    return provisioned({ user, keyPath });
+  } catch (err) {
+    return { channel: null, issue: { code: "error", detail: err?.message } };
   }
 }
+function keygenWhy(r2) {
+  if (r2.error?.code === "ENOENT") {
+    return "ssh-keygen is not installed \u2014 the openssh-client package provides it";
+  }
+  const stderr = (r2.stderr ?? "").trim().split("\n").pop();
+  return stderr || r2.error?.message || `ssh-keygen exited ${r2.status ?? "abnormally"}`;
+}
+function probeHostSshd(port) {
+  for (const [cmd, args] of [
+    ["ss", ["-H", "-ltn"]],
+    ["netstat", ["-ltn"]]
+  ]) {
+    const r2 = spawnSync4(cmd, [...args], { encoding: "utf8" });
+    if (r2.status !== 0 || !r2.stdout) continue;
+    return listensOnPort(r2.stdout, port) ? "listening" : "absent";
+  }
+  return "unknown";
+}
+function listensOnPort(listing, port) {
+  return listing.split("\n").filter((line) => /\bLISTEN\b/.test(line)).some(
+    (line) => line.trim().split(/\s+/).some((token) => token.endsWith(`:${port}`))
+  );
+}
+function carriedHostChannel(prev) {
+  const keyPath = prev.OPENSHIP_HOST_KEY_PATH?.trim();
+  if (!prev.OPENSHIP_HOST_SSH_HOST?.trim() || !keyPath || !existsSync4(keyPath)) return null;
+  return { user: prev.OPENSHIP_HOST_SSH_USER?.trim() || "root", keyPath };
+}
+var HOST_ISSUE_INDENT = "    ";
+function hostIssueNote(text) {
+  return wrapText(text, 80).map((l2) => `${HOST_ISSUE_INDENT}${l2}
+`).join("");
+}
+function renderHostChannelIssue(issue, ctx) {
+  const detail = issue.detail ? ` (${issue.detail})` : "";
+  const headline = issue.code === "no-sshd" ? `  \u26A0 Host control is provisioned, but nothing on this host is listening for SSH${detail}.` : `  \u26A0 Host control could NOT be provisioned on this box.`;
+  let cause;
+  switch (issue.code) {
+    case "keygen":
+      cause = `The channel's key could not be generated${detail}.`;
+      break;
+    case "empty-key":
+      cause = "The channel's key was generated but its public half read back empty.";
+      break;
+    case "no-sshd":
+      cause = `The api container now has a key and an address, and will be refused the first time it dials ${ctx.target}:
+` + explainHostChannelCause("refused", {
+        target: ctx.target,
+        // Measured here rather than left to core's default, which is Debian's `ssh` —
+        // a unit name that does not exist on the RHEL family, so the remedy printed on
+        // an Amazon Linux box was a command that silently does nothing.
+        sshdEnableHint: thisHost().sshdEnableHint()
+      }).body;
+      break;
+    case "error":
+      cause = `Setting up the channel's key failed${detail}.`;
+      break;
+  }
+  const continuity = issue.code === "no-sshd" ? "" : ctx.kept ? hostIssueNote(
+    "Kept the host channel this install already had in `.env` rather than dropping it: its key is still authorized, so the api container keeps the access it had instead of losing it to this failure."
+  ) : hostIssueNote(
+    "OPENSHIP_HOST_SSH_HOST is therefore unset, and host operations refuse rather than run against the api container's own filesystem."
+  );
+  return `${headline}
+` + hostIssueNote(cause) + continuity + hostIssueNote(HOST_CHANNEL_UNAFFECTED) + `${HOST_ISSUE_INDENT}Unavailable until the channel works:
+` + HOST_CHANNEL_BLOCKED.map((l2) => `${HOST_ISSUE_INDENT}  \xB7 ${l2}
+`).join("") + hostIssueNote(HOST_CHANNEL_RECHECK);
+}
 function composeProjectName(prev) {
   if (prev.COMPOSE_PROJECT_NAME) return prev.COMPOSE_PROJECT_NAME;
   return Object.keys(prev).length > 0 ? "compose" : "openship";
 }
 var PGDATA_ROOT = "/var/lib/postgresql/data";
-function resolvePgData(prev) {
-  if (prev.OPENSHIP_PGDATA) return prev.OPENSHIP_PGDATA;
-  return dbVolumeExists(composeProjectName(prev)) ? PGDATA_ROOT : `${PGDATA_ROOT}/pgdata`;
-}
-function orphanedStackContainers(project) {
-  const r2 = spawnSync3(
+function probePgDataDir(volume) {
+  const r2 = spawnSync4(
     "docker",
     [
-      "ps",
-      "-a",
-      "--format",
-      '{{.Names}}	{{.Label "com.docker.compose.project"}}	{{.Label "com.docker.compose.project.config_files"}}'
+      "run",
+      "--rm",
+      "-v",
+      `${volume}:/from:ro`,
+      "alpine:3",
+      "sh",
+      "-c",
+      `if [ -f /from/PG_VERSION ]; then echo root; elif [ -f /from/pgdata/PG_VERSION ]; then echo sub; elif [ -z "$(ls -A /from 2>/dev/null | grep -v '^lost+found$')" ]; then echo empty; else echo foreign; fi`
     ],
     { encoding: "utf8" }
   );
-  if (r2.status !== 0 || !r2.stdout) return [];
-  return r2.stdout.split("\n").map((line) => line.trim()).filter(Boolean).map((line) => {
-    const [name, proj, configFiles] = line.split("	");
-    return { name: name ?? "", project: proj ?? "", configFiles: configFiles ?? "" };
-  }).filter(
-    (c2) => c2.name && c2.project && c2.project !== project && // config_files is a comma-separated list (base + build override).
-    c2.configFiles.split(",").some((f2) => f2.trim() === COMPOSE_FILE)
-  ).map(({ name, project: proj }) => ({ name, project: proj }));
+  if (r2.status !== 0) return "unknown";
+  const out = `${r2.stdout ?? ""}`.trim();
+  return out === "root" || out === "sub" || out === "empty" || out === "foreign" ? out : "unknown";
+}
+function resolvePgData(prev) {
+  const SUB = `${PGDATA_ROOT}/pgdata`;
+  if (prev.OPENSHIP_PGDATA) return prev.OPENSHIP_PGDATA;
+  const volume = survivingDbVolume(prev);
+  if (!volume) return SUB;
+  return probePgDataDir(volume) === "root" ? PGDATA_ROOT : SUB;
+}
+function pgDataDetectionRisk(prev) {
+  if (prev.OPENSHIP_PGDATA) return null;
+  const volume = survivingDbVolume(prev);
+  if (!volume) return null;
+  return probePgDataDir(volume) === "foreign" ? { volume } : null;
+}
+function composePgDataRisk(_opts = {}) {
+  return pgDataDetectionRisk(readEnvFile());
+}
+function renderPgDataRefusal(risk, opts = {}) {
+  const SUB = `${PGDATA_ROOT}/pgdata`;
+  return `
+  ${opts.dryRun ? "A real run would REFUSE here" : "Refusing to continue"}: this install's data volume holds data, but not a Postgres cluster we recognize.
+
+    volume:  ${risk.volume}
+    checked: ${PGDATA_ROOT}/PG_VERSION and ${SUB}/PG_VERSION \u2014 neither present
+
+  Guessing where the cluster lives is how a wrong path makes Postgres run initdb over
+  your existing data and orphan it, so nothing has been written. If you know the layout,
+  pin it and re-run:
+
+    echo 'OPENSHIP_PGDATA=${SUB}' >> ${ENV_FILE}     # or ${PGDATA_ROOT} if the cluster is at the root
+`;
+}
+var PS_SWEEP_FORMAT = '{{.Names}}	{{.Label "com.docker.compose.project"}}	{{.Label "com.docker.compose.project.config_files"}}	{{.Label "com.docker.compose.service"}}';
+function parsePsSweep(stdout) {
+  return stdout.split("\n").map((line) => line.trim()).filter(Boolean).map((line) => {
+    const [name, project, configFiles, service] = line.split("	");
+    return {
+      name: name ?? "",
+      project: project ?? "",
+      configFiles: configFiles ?? "",
+      service: service ?? ""
+    };
+  });
+}
+function psSweepRaw() {
+  const r2 = spawnSync4("docker", ["ps", "-a", "--format", PS_SWEEP_FORMAT], { encoding: "utf8" });
+  return r2.status === 0 && r2.stdout ? r2.stdout : null;
+}
+function psSweep() {
+  return parsePsSweep(psSweepRaw() ?? "");
+}
+function fromOurComposeFile(row) {
+  return row.configFiles.split(",").some((f2) => f2.trim() === COMPOSE_FILE);
+}
+function orphanedStackContainers(project) {
+  return psSweep().filter((c2) => c2.name && c2.project && c2.project !== project && fromOurComposeFile(c2)).map(({ name, project: proj }) => ({ name, project: proj }));
+}
+function adoptedStackOrigin(psStdout, project) {
+  const rows = parsePsSweep(psStdout).filter((c2) => c2.name && c2.project === project);
+  if (rows.length === 0 || rows.some(fromOurComposeFile)) return null;
+  return {
+    project,
+    configFiles: rows.map((c2) => c2.configFiles).find(Boolean) ?? "",
+    apiContainer: rows.find((c2) => c2.service === "api")?.name || `${project}-api-1`
+  };
+}
+function adoptedStack(project) {
+  const sweep = psSweepRaw();
+  return sweep ? adoptedStackOrigin(sweep, project) : null;
 }
 function reconcileDbPassword(user, password) {
   if (!password) return;
   if (compose(["up", "-d", "--wait", "postgres"], { quiet: true }) !== 0) return;
-  const attempt = (asRole) => spawnSync3(
+  const attempt = (asRole) => spawnSync4(
     "docker",
     [
       "compose",
@@ -13698,7 +14192,21 @@ function removeOrphanedStack(project) {
   console.log(
     `  Removing ${orphans.length} container(s) from a previous stack (project "${projects}") \u2014 they would hold the ports this stack needs. Volumes are kept.`
   );
-  spawnSync3("docker", ["rm", "-f", ...orphans.map((o2) => o2.name)], { stdio: "ignore" });
+  spawnSync4("docker", ["rm", "-f", ...orphans.map((o2) => o2.name)], { stdio: "ignore" });
+}
+function edgeNameNeedsReclaim(psStdout, project) {
+  const row = parsePsSweep(psStdout).find((c2) => c2.name === "openship-edge");
+  if (!row) return false;
+  return !(row.project === project && fromOurComposeFile(row));
+}
+function reconcileEdgeContainerName(project) {
+  const sweep = psSweepRaw();
+  if (!sweep) return;
+  if (!edgeNameNeedsReclaim(sweep, project)) return;
+  console.log(
+    "  Replacing an unmanaged `openship-edge` container so compose can own it (config is on the host, so no routes are lost)."
+  );
+  spawnSync4("docker", ["rm", "-f", "openship-edge"], { stdio: "ignore" });
 }
 function migrateLegacyEdgeVolumes(project) {
   const pairs = [
@@ -13707,18 +14215,18 @@ function migrateLegacyEdgeVolumes(project) {
     { volume: `${project}_openship_acme`, host: EDGE_ACME_HOST_DIR },
     { volume: `${project}_openship_static`, host: "/opt/openship/static" }
   ];
-  const ls = spawnSync3("docker", ["volume", "ls", "--format", "{{.Name}}"], { encoding: "utf8" });
+  const ls = spawnSync4("docker", ["volume", "ls", "--format", "{{.Name}}"], { encoding: "utf8" });
   if (ls.status !== 0 || !ls.stdout) return;
   const existing = new Set(ls.stdout.split("\n").map((l2) => l2.trim()).filter(Boolean));
   for (const { volume, host } of pairs) {
     if (!existing.has(volume)) continue;
     mkdirSync3(host, { recursive: true });
-    const alreadyThere = spawnSync3("sh", ["-c", `ls -A ${JSON.stringify(host)} 2>/dev/null | head -1`], {
+    const alreadyThere = spawnSync4("sh", ["-c", `ls -A ${JSON.stringify(host)} 2>/dev/null | head -1`], {
       encoding: "utf8"
     });
     if (alreadyThere.stdout?.trim()) continue;
     console.log(`  Moving edge state from volume ${volume} onto ${host}...`);
-    const copy = spawnSync3(
+    const copy = spawnSync4(
       "docker",
       [
         "run",
@@ -13743,7 +14251,7 @@ function migrateLegacyEdgeVolumes(project) {
   }
 }
 function warnOrphanedVolumes(project) {
-  const r2 = spawnSync3("docker", ["volume", "ls", "--format", "{{.Name}}"], { encoding: "utf8" });
+  const r2 = spawnSync4("docker", ["volume", "ls", "--format", "{{.Name}}"], { encoding: "utf8" });
   if (r2.status !== 0 || !r2.stdout) return;
   const others = new Set(
     r2.stdout.split("\n").map((l2) => l2.trim()).filter((l2) => l2.endsWith("_openship_sites")).map((l2) => l2.slice(0, -"_openship_sites".length)).filter((p2) => p2 && p2 !== project)
@@ -13771,6 +14279,52 @@ var ACME_ENV_KEYS = [
   "OPENSHIP_ACME_CA_BUNDLE",
   "OPENSHIP_ACME_TOS_AGREED"
 ];
+function hostGatewayEnv(prev) {
+  const value = process.env.OPENSHIP_HOST_GATEWAY?.trim() || prev.OPENSHIP_HOST_GATEWAY?.trim();
+  return value ? [`OPENSHIP_HOST_GATEWAY=${value}`] : [];
+}
+function rootlessSocketCandidates() {
+  const runtimeDir = process.env.XDG_RUNTIME_DIR?.trim();
+  const sudoUid = process.env.SUDO_UID?.trim();
+  let uid;
+  try {
+    uid = userInfo().uid;
+  } catch {
+  }
+  return [
+    ...runtimeDir ? [join6(runtimeDir, "docker.sock")] : [],
+    ...sudoUid ? [`/run/user/${sudoUid}/docker.sock`] : [],
+    ...uid !== void 0 ? [`/run/user/${uid}/docker.sock`] : []
+  ];
+}
+function detectDockerSocketPath() {
+  const fromClient = resolveLocalDockerSocketPath(void 0, process.env);
+  if (fromClient !== DEFAULT_DOCKER_SOCKET_PATH) return fromClient;
+  if (existsSync4(DEFAULT_DOCKER_SOCKET_PATH)) return DEFAULT_DOCKER_SOCKET_PATH;
+  return rootlessSocketCandidates().find((p2) => existsSync4(p2)) ?? DEFAULT_DOCKER_SOCKET_PATH;
+}
+function resolveDockerSocket(prev) {
+  const pinned = process.env.OPENSHIP_DOCKER_SOCKET?.trim() || prev.OPENSHIP_DOCKER_SOCKET?.trim();
+  return pinned ? { path: pinned, pinned: true } : { path: detectDockerSocketPath(), pinned: false };
+}
+function dockerSocketEnv(prev) {
+  const { path, pinned } = resolveDockerSocket(prev);
+  return pinned || path !== DEFAULT_DOCKER_SOCKET_PATH ? [`OPENSHIP_DOCKER_SOCKET=${path}`] : [];
+}
+function warnMissingDockerSocket(path) {
+  console.warn(
+    `
+  ! The Docker socket this install mounts into the api isn't there:
+      ${path}
+    Docker will create that path as an empty DIRECTORY, so the stack will come up
+    and then fail every container operation with a transport error naming neither
+    this path nor the cause (#482). Point it at the real socket:
+      docker context inspect --format '{{.Endpoints.docker.Host}}'
+      OPENSHIP_DOCKER_SOCKET=/run/user/$(id -u)/docker.sock openship up --compose
+    (a rootless daemon keeps its socket under the daemon user's runtime dir).
+`
+  );
+}
 function renderAcmeEnv(prev) {
   return ACME_ENV_KEYS.flatMap((key) => {
     const value = process.env[key]?.trim() || prev[key]?.trim();
@@ -13800,7 +14354,19 @@ function resolveEnvConfig(prev, opts) {
     registry: keepConfig(prev, "OPENSHIP_IMAGE_REGISTRY", opts.registry) ?? DEFAULT_IMAGE_REGISTRY,
     // Tri-state: the flag is absent on a plain re-run, so fall back to what the
     // install chose rather than silently re-granting host control.
-    hostControl: opts.noHostControl === void 0 ? prev.OPENSHIP_HOST_CONTROL !== "false" : !opts.noHostControl
+    hostControl: opts.noHostControl === void 0 ? prev.OPENSHIP_HOST_CONTROL !== "false" : !opts.noHostControl,
+    // Sticky too: `--mail` is only the install-time default, so a plain re-run
+    // (or `openship update`) must not hand a mail box back the platform shell.
+    // Turning it OFF is the dashboard's job — Settings → Instance stores the mode
+    // in the database, which wins over this env var either way.
+    productMode: opts.mail || keepConfig(prev, "OPENSHIP_PRODUCT") === "mail" ? "mail" : "platform",
+    // Sticky like every other operator choice here. These were literals in
+    // `renderEnv`, so a box where `host.docker.internal:22` is simply not the
+    // right address — rootless Docker, sshd on another port — had nowhere to say
+    // so, and every `openship up` overwrote a hand-edited `.env` back to the
+    // value that didn't work (#490/#482).
+    hostSshHost: keepConfig(prev, "OPENSHIP_HOST_SSH_HOST", opts.hostSshHost) ?? HOST_CHANNEL_DEFAULT_HOST,
+    hostSshPort: keepConfig(prev, "OPENSHIP_HOST_SSH_PORT", opts.hostSshPort) ?? String(HOST_CHANNEL_DEFAULT_PORT)
   };
 }
 function toPort(value) {
@@ -13814,6 +14380,20 @@ function composeEnvPorts() {
 function composeBindAddr() {
   return readEnvFile().OPENSHIP_BIND_ADDR?.trim() || "127.0.0.1";
 }
+function composeHostChannel() {
+  const env = readEnvFile();
+  const host = env.OPENSHIP_HOST_SSH_HOST?.trim();
+  if (!host) return null;
+  return {
+    host,
+    port: toPort(env.OPENSHIP_HOST_SSH_PORT) ?? 22,
+    user: env.OPENSHIP_HOST_SSH_USER?.trim() || "root"
+  };
+}
+function composeHostChannelExpected() {
+  if (!existsSync4(COMPOSE_FILE)) return false;
+  return readEnvFile().OPENSHIP_HOST_CONTROL !== "false";
+}
 function composeTrustedOriginUrls() {
   const env = readEnvFile();
   return [env.OPENSHIP_PUBLIC_URL, env.OPENSHIP_EXTRA_TRUSTED_ORIGINS].filter(
@@ -13821,7 +14401,7 @@ function composeTrustedOriginUrls() {
   );
 }
 function composeHeldPorts() {
-  const r2 = spawnSync3(
+  const r2 = spawnSync4(
     "docker",
     ["ps", "--format", '{{.Label "com.docker.compose.project.config_files"}}	{{.Ports}}'],
     { encoding: "utf8" }
@@ -13847,8 +14427,24 @@ async function resolveComposePorts(prefs, opts = {}) {
     opts
   );
 }
-function renderEnv(opts, host, cfg) {
-  const prev = readEnvFile();
+var OMITTABLE_MANAGED_KEYS = /* @__PURE__ */ new Set([
+  "OPENSHIP_HOST_SSH_HOST",
+  "OPENSHIP_HOST_SSH_USER",
+  "OPENSHIP_HOST_SSH_PORT",
+  "OPENSHIP_HOST_SSH_KEY",
+  "OPENSHIP_HOST_KEY_PATH",
+  "OPENSHIP_HOST_GATEWAY",
+  "TRUST_PROXY"
+]);
+var envKeyOf = (line) => line.match(/^([A-Z0-9_]+)=/)?.[1];
+function operatorEnvPassthrough(managed, prev) {
+  return Object.entries(prev).filter(([key]) => !managed.has(key) && !OMITTABLE_MANAGED_KEYS.has(key)).map(([key, value]) => `${key}=${value}`);
+}
+var PRESERVED_ENV_HEADER = "# Preserved from your existing .env \u2014 set by you, not by `openship up` (#485).";
+function resolveImageVersion(opts) {
+  return opts.version?.trim() || process.env.OPENSHIP_VERSION?.trim() || (true ? "0.6.5" : "latest");
+}
+function managedEnvLines(opts, host, cfg, prev) {
   const lines = [
     "# Managed by `openship up`. Secrets are generated once and preserved.",
     // Do NOT edit on a live install — it is the volume prefix (see composeProjectName).
@@ -13859,8 +14455,17 @@ function renderEnv(opts, host, cfg) {
     // Read by createHostExecutor (throws when false) and by the servers list
     // (hides the local row). Written explicitly so the policy is visible in .env.
     `OPENSHIP_HOST_CONTROL=${cfg.hostControl ? "true" : "false"}`,
+    // The host side of the api's docker socket mount, when it isn't the rootful
+    // default. Unlike the host channel above this is NOT optional plumbing — every
+    // deploy goes through it — so it is resolved on every run, host control or not.
+    ...dockerSocketEnv(prev),
+    // Which shell the dashboard defaults to. Emitted on EVERY run, including the
+    // "platform" default: that keeps the key permanently in the managed set, so
+    // the #485 passthrough can never mistake it for operator config (which would
+    // pin it and make the Settings → Instance toggle look broken after an `up`).
+    `OPENSHIP_PRODUCT=${cfg.productMode}`,
     `OPENSHIP_IMAGE_REGISTRY=${cfg.registry}`,
-    `OPENSHIP_VERSION=${opts.version || (true ? "0.6.0" : "latest")}`,
+    `OPENSHIP_VERSION=${resolveImageVersion(opts)}`,
     `POSTGRES_PASSWORD=${keepSecret(prev, "POSTGRES_PASSWORD")}`,
     // Pinned once (see resolvePgData): fresh install → subdir, existing volume → root.
     `OPENSHIP_PGDATA=${resolvePgData(prev)}`,
@@ -13885,19 +14490,33 @@ function renderEnv(opts, host, cfg) {
   if (cfg.trustProxy) lines.push("TRUST_PROXY=true");
   if (host) {
     lines.push(
-      "OPENSHIP_HOST_SSH_HOST=host.docker.internal",
+      `OPENSHIP_HOST_SSH_HOST=${cfg.hostSshHost}`,
       `OPENSHIP_HOST_SSH_USER=${host.user}`,
-      "OPENSHIP_HOST_SSH_PORT=22",
+      `OPENSHIP_HOST_SSH_PORT=${cfg.hostSshPort}`,
       "OPENSHIP_HOST_SSH_KEY=/run/secrets/openship_host_key",
-      `OPENSHIP_HOST_KEY_PATH=${host.keyPath}`
+      `OPENSHIP_HOST_KEY_PATH=${host.keyPath}`,
+      ...hostGatewayEnv(prev)
     );
   }
-  return lines.join("\n") + "\n";
+  return lines;
+}
+function renderEnvAndCarried(opts, host, cfg, prev) {
+  const lines = managedEnvLines(opts, host, cfg, prev);
+  const managed = new Set(lines.map(envKeyOf).filter((k2) => !!k2));
+  const preserved = operatorEnvPassthrough(managed, prev);
+  const body = preserved.length ? [...lines, "", PRESERVED_ENV_HEADER, ...preserved] : lines;
+  return {
+    text: body.join("\n") + "\n",
+    carried: preserved.map((line) => line.slice(0, line.indexOf("=")))
+  };
+}
+function renderEnv(opts, host, cfg) {
+  return renderEnvAndCarried(opts, host, cfg, readEnvFile()).text;
 }
 function sourceBuildDir() {
   const marker = readSourceInstall();
   if (!marker?.dir) return null;
-  const hasAll = BUILT_SERVICES.every((s2) => existsSync4(join7(marker.dir, s2.dockerfile)));
+  const hasAll = BUILT_SERVICES.every((s2) => existsSync4(join6(marker.dir, s2.dockerfile)));
   return hasAll ? marker.dir : null;
 }
 function renderBuildOverride(repoDir) {
@@ -13916,19 +14535,48 @@ function materialize(opts) {
   mkdirSync3(COMPOSE_DIR, { recursive: true, mode: 448 });
   const prev = readEnvFile();
   const cfg = resolveEnvConfig(prev, opts);
-  const host = provisionHostSshChannel(cfg.hostControl);
+  const provision = provisionHostSshChannel(cfg);
+  let host = provision.channel;
+  let kept = false;
+  if (!host && provision.issue) {
+    const previousChannel = carriedHostChannel(prev);
+    if (previousChannel) {
+      host = previousChannel;
+      kept = true;
+    }
+  }
+  if (!cfg.hostControl) retireHostSshChannel(prev);
+  if (provision.issue && !opts.alreadyFetched) {
+    console.warn(
+      renderHostChannelIssue(provision.issue, {
+        target: `${cfg.hostSshHost}:${cfg.hostSshPort}`,
+        kept
+      })
+    );
+  }
+  const socket = resolveDockerSocket(prev);
+  if (!opts.alreadyFetched && !existsSync4(socket.path)) warnMissingDockerSocket(socket.path);
   let before = "";
   try {
     before = readFileSync3(ENV_FILE, "utf8");
   } catch {
   }
-  const rendered = renderEnv(opts, host, cfg);
+  const { text: rendered, carried } = renderEnvAndCarried(opts, host, cfg, prev);
   writeFileSync2(COMPOSE_FILE, COMPOSE_YAML);
-  writeFileSync2(ENV_FILE, rendered, { mode: 384 });
+  writeEnvFile(rendered, before);
+  if (carried.length) {
+    console.log(`  Kept ${carried.length} operator-set .env variable(s): ${carried.join(", ")}`);
+  }
   const buildDir = opts.build === false ? null : sourceBuildDir();
   if (buildDir) writeFileSync2(BUILD_FILE, renderBuildOverride(buildDir));
   return { buildDir, cfg, envChanged: before !== "" && rendered !== before };
 }
+function writeEnvFile(rendered, before) {
+  if (rendered === before) return;
+  if (before) writeFileSync2(ENV_BACKUP_FILE, before, { mode: 384 });
+  writeFileSync2(ENV_TMP_FILE, rendered, { mode: 384 });
+  renameSync(ENV_TMP_FILE, ENV_FILE);
+}
 var SECRET_ENV_KEY = /(PASSWORD|SECRET|TOKEN|HMAC_KEY)$/;
 function composePlan(opts) {
   const prev = readEnvFile();
@@ -13941,13 +14589,14 @@ function composePlan(opts) {
     const at2 = line.indexOf("=");
     if (at2 < 1 || line.startsWith("#")) continue;
     const key = line.slice(0, at2);
+    const value = line.slice(at2 + 1);
     if (!SECRET_ENV_KEY.test(key)) {
-      settings.push({ key, value: line.slice(at2 + 1) });
+      settings.push({ key, value });
       continue;
     }
-    const minted = !prev[key];
-    if (minted) newSecrets.push(key);
-    settings.push({ key, value: minted ? "<generated on this run>" : "<preserved>" });
+    const preserved = !!prev[key] && prev[key] === value;
+    if (!preserved) newSecrets.push(key);
+    settings.push({ key, value: preserved ? "<preserved>" : "<generated on this run>" });
   }
   return {
     composeFile: COMPOSE_FILE,
@@ -13957,6 +14606,8 @@ function composePlan(opts) {
     yaml: COMPOSE_YAML,
     settings,
     newSecrets,
+    secretRotation: opts.resetSecrets ? null : secretRotationRisk(prev),
+    pgDataRisk: pgDataDetectionRisk(prev),
     existing: Object.keys(prev).length > 0,
     mountDirs: EDGE_CONTAINER_MOUNTS.map((m2) => m2.host),
     buildDir,
@@ -13964,7 +14615,7 @@ function composePlan(opts) {
   };
 }
 function dbVolumeExists(project) {
-  const r2 = spawnSync3("docker", ["volume", "inspect", `${project}_postgres_data`], {
+  const r2 = spawnSync4("docker", ["volume", "inspect", `${project}_postgres_data`], {
     stdio: "ignore"
   });
   return r2.status === 0;
@@ -13972,18 +14623,69 @@ function dbVolumeExists(project) {
 function compose(args, opts) {
   const files = ["-f", COMPOSE_FILE];
   if (opts?.withBuildOverride) files.push("-f", BUILD_FILE);
-  const r2 = spawnSync3("docker", ["compose", ...files, ...args], {
+  const r2 = spawnSync4("docker", ["compose", ...files, ...args], {
     cwd: COMPOSE_DIR,
     stdio: opts?.quiet ? "ignore" : "inherit"
   });
   return r2.status ?? 1;
 }
+function missingPinnedImages(registry, version) {
+  const missing = [];
+  for (const { service } of BUILT_SERVICES) {
+    const ref = `${registry}/openship-${service}:${version}`;
+    const r2 = spawnSync4("docker", ["manifest", "inspect", ref], { encoding: "utf8" });
+    if (r2.status === 0) continue;
+    const stderr = `${r2.stderr ?? ""}`.toLowerCase();
+    if (/manifest unknown|no such manifest|manifest for .+ not found/.test(stderr)) {
+      missing.push(ref);
+      continue;
+    }
+    return null;
+  }
+  return missing;
+}
+function pinnedImagesReady(opts) {
+  if (sourceBuildDir()) return true;
+  const prev = readEnvFile();
+  const version = resolveImageVersion(opts);
+  const missing = missingPinnedImages(resolveEnvConfig(prev, opts).registry, version);
+  if (!missing || missing.length === 0) return true;
+  const prevVersion = prev.OPENSHIP_VERSION?.trim();
+  const out = [
+    "",
+    `  The pinned image tag \`${version}\` isn't in the registry yet:`,
+    ...missing.map((ref) => `    ${ref}`),
+    "",
+    "  The CLI reached npm before its container images finished publishing \u2014 a",
+    "  release-ordering race (#486). Nothing on this box was changed.",
+    "",
+    "  Any one of these gets you moving:",
+    "    \u2022 Wait a few minutes and re-run \u2014 the images usually land right after a release.",
+    "    \u2022 Pin a tag that exists:",
+    "        openship up --compose --image-version <tag>",
+    "        OPENSHIP_VERSION=<tag> openship up --compose"
+  ];
+  if (prevVersion && prevVersion !== version) {
+    out.push(`    \u2022 Your current install runs \`${prevVersion}\`, a tag known good on this box.`);
+  }
+  out.push("");
+  console.error(out.join("\n"));
+  return false;
+}
 function composePrefetch(opts) {
-  const { buildDir } = materialize(opts);
+  const rotation = composeSecretRotationRisk(opts);
+  if (rotation) {
+    console.error(renderSecretRotationRefusal(rotation));
+    return { ok: false, envChanged: false };
+  }
+  const { buildDir, envChanged } = materialize(opts);
   if (buildDir) {
-    return compose(["pull", "postgres", "redis"], { withBuildOverride: true }) === 0 && compose(["build"], { withBuildOverride: true }) === 0;
+    return {
+      ok: compose(["pull", "postgres", "redis"], { withBuildOverride: true }) === 0 && compose(["build"], { withBuildOverride: true }) === 0,
+      envChanged
+    };
   }
-  return compose(["pull"]) === 0;
+  return { ok: compose(["pull"]) === 0, envChanged };
 }
 function ensureEdgeMountDirs() {
   const failed = [];
@@ -13997,15 +14699,32 @@ function ensureEdgeMountDirs() {
   return failed;
 }
 function isRootlessDocker() {
-  const r2 = spawnSync3("docker", ["info", "-f", "{{println .SecurityOptions}}"], {
+  const r2 = spawnSync4("docker", ["info", "-f", "{{println .SecurityOptions}}"], {
     encoding: "utf8"
   });
   return r2.status === 0 && /rootless/i.test(r2.stdout ?? "");
 }
 async function composeUp(opts) {
-  const { buildDir, cfg, envChanged } = materialize(opts);
+  if (!opts.alreadyFetched && !pinnedImagesReady(opts)) {
+    const pre = resolveEnvConfig(readEnvFile(), opts);
+    return { ok: false, apiPort: pre.apiPort, dashPort: pre.dashPort };
+  }
+  const rotation = composeSecretRotationRisk(opts);
+  if (rotation) {
+    const pre = resolveEnvConfig(readEnvFile(), opts);
+    console.error(renderSecretRotationRefusal(rotation));
+    return { ok: false, refused: true, apiPort: pre.apiPort, dashPort: pre.dashPort };
+  }
+  const pgData = composePgDataRisk(opts);
+  if (pgData) {
+    const pre = resolveEnvConfig(readEnvFile(), opts);
+    console.error(renderPgDataRefusal(pgData));
+    return { ok: false, refused: true, apiPort: pre.apiPort, dashPort: pre.dashPort };
+  }
+  const { buildDir, cfg, envChanged: rendered } = materialize(opts);
   const apiPort = cfg.apiPort;
   const dashPort = cfg.dashPort;
+  const envChanged = opts.envChanged ?? rendered;
   const up = (extra = {}) => compose(
     envChanged ? ["up", "-d", "--force-recreate", ...ENV_CONSUMING_SERVICES] : ["up", "-d"],
     extra
@@ -14013,6 +14732,7 @@ async function composeUp(opts) {
   const env = readEnvFile();
   const project = env.COMPOSE_PROJECT_NAME || "openship";
   removeOrphanedStack(project);
+  reconcileEdgeContainerName(project);
   migrateLegacyEdgeVolumes(project);
   warnOrphanedVolumes(project);
   const unmakeableMounts = ensureEdgeMountDirs();
@@ -14079,7 +14799,7 @@ function composeUninstall(opts = {}) {
     const version = env.OPENSHIP_VERSION || "latest";
     for (const { service } of BUILT_SERVICES) {
       const ref = `${registry}/openship-${service}:${version}`;
-      if (spawnSync3("docker", ["image", "rm", "-f", ref], { stdio: "ignore" }).status === 0) {
+      if (spawnSync4("docker", ["image", "rm", "-f", ref], { stdio: "ignore" }).status === 0) {
         removedImages.push(ref);
       }
     }
@@ -14087,14 +14807,15 @@ function composeUninstall(opts = {}) {
   return { ok, removedImages };
 }
 async function composeUpdate(version) {
-  if (!existsSync4(COMPOSE_FILE)) return false;
-  return (await composeUp(version ? { version } : {})).ok;
+  if (!existsSync4(COMPOSE_FILE)) return { applied: false, refused: false };
+  const r2 = await composeUp(version ? { version } : {});
+  return { applied: r2.ok, refused: !!r2.refused };
 }
 function composePs() {
   return compose(["ps"]);
 }
 function composeRunning() {
-  const r2 = spawnSync3(
+  const r2 = spawnSync4(
     "docker",
     ["compose", "-f", COMPOSE_FILE, "ps", "--status", "running", "-q"],
     { cwd: COMPOSE_DIR, encoding: "utf8" }
@@ -14102,6 +14823,7 @@ function composeRunning() {
   return r2.status === 0 && r2.stdout.trim().length > 0;
 }
 function composeStart() {
+  reconcileEdgeContainerName(readEnvFile().COMPOSE_PROJECT_NAME || "openship");
   return compose(["up", "-d"], { quiet: true }) === 0;
 }
 function composeRestart() {
@@ -14110,112 +14832,14 @@ function composeRestart() {
 function composeInternalToken() {
   return readEnvFile().INTERNAL_TOKEN ?? null;
 }
-
-// src/lib/edge-import.ts
-async function waitForApiHealth(port, tries) {
-  for (let i2 = 0; i2 < tries; i2++) {
-    try {
-      const r2 = await fetch(`http://127.0.0.1:${port}/api/health`, { signal: AbortSignal.timeout(2e3) });
-      if (r2.ok) return true;
-    } catch {
-    }
-    await new Promise((r2) => setTimeout(r2, 1e3));
-  }
-  return false;
-}
-async function waitForEdgeRunning(tries) {
-  const exec = new LocalExecutor();
-  for (let i2 = 0; i2 < tries; i2++) {
-    const out = await exec.exec(`docker inspect -f '{{.State.Running}}' ${EDGE_CONTAINER_NAME}`).catch(() => "");
-    if (out.trim() === "true") return true;
-    await new Promise((r2) => setTimeout(r2, 1e3));
-  }
-  return false;
-}
-async function importMigratedSites(apiPort, sites, certPems, staticRootOverrides) {
-  const token = composeInternalToken();
-  if (!token) {
-    const error = "couldn't read the stack's internal token";
-    console.log(chalk.yellow(`  Skipping site import \u2014 ${error}. Re-run to retry.
-`));
-    return { ok: false, registered: [], error };
-  }
-  const spinner = ora(
-    `Importing ${sites.length} migrated site${sites.length === 1 ? "" : "s"} into the edge\u2026`
-  ).start();
-  if (!await waitForApiHealth(apiPort, 60)) {
-    const error = "API didn't become healthy in time";
-    spinner.warn(`${error} \u2014 migrated sites not imported. Re-run \`openship up\` to retry.`);
-    return { ok: false, registered: [], error };
-  }
-  if (!await waitForEdgeRunning(60)) {
-    const error = `the ${EDGE_CONTAINER_NAME} container isn't running yet`;
-    spinner.warn(`${error} \u2014 migrated sites not imported. Re-run \`openship up\` to retry.`);
-    return { ok: false, registered: [], error };
-  }
-  try {
-    const r2 = await fetch(`http://127.0.0.1:${apiPort}/api/system/edge/import-sites`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json", "X-Internal-Token": token },
-      body: JSON.stringify({ sites, certPems, staticRootOverrides }),
-      signal: AbortSignal.timeout(12e4)
-    });
-    const data = await r2.json().catch(() => ({}));
-    if (!r2.ok) {
-      const error = data.error ?? `HTTP ${r2.status}`;
-      spinner.warn(`Site import failed: ${error}. Re-run to retry.`);
-      return { ok: false, registered: [], error };
-    }
-    const registered = data.registered ?? [];
-    const warnings = data.warnings ?? [];
-    const missed = sites.length - registered.length;
-    if (sites.length > 0 && registered.length === 0) {
-      spinner.fail(
-        `Migrated NONE of the ${sites.length} site${sites.length === 1 ? "" : "s"} \u2014 Openship holds :80/:443 and ${sites.length === 1 ? "that hostname is" : "those hostnames are"} NOT being served.`
-      );
-      for (const w2 of warnings.slice(0, 8)) console.log(chalk.red(`    \u2022 ${w2}`));
-      const edgeLog = await edgeCrashReason(new LocalExecutor());
-      if (edgeLog) {
-        console.log(chalk.red(`
-  The edge container is not running. Its log says:`));
-        console.log(chalk.red(`    ${edgeLog}`));
-      }
-      console.log(
-        chalk.yellow(
-          `
-  Retry the import with \`openship up\` once the cause above is fixed, or put your
-  previous proxy back:  docker stop ${EDGE_CONTAINER_NAME} && sudo systemctl enable --now nginx
-`
-        )
-      );
-      return { ok: false, registered, error: warnings[0] ?? "no sites were registered" };
-    }
-    if (missed > 0) {
-      spinner.warn(
-        `Migrated ${registered.length}/${sites.length} sites \u2014 ${missed} not served (see below).`
-      );
-      for (const w2 of warnings.slice(0, 8)) console.log(chalk.yellow(`    \u2022 ${w2}`));
-      return { ok: false, registered, error: `${missed} site(s) not registered` };
-    }
-    spinner.succeed(
-      `Migrated ${registered.length} site${registered.length === 1 ? "" : "s"} into Openship's edge.`
-    );
-    for (const w2 of warnings.slice(0, 8)) console.log(chalk.dim(`    \u2022 ${w2}`));
-    return { ok: true, registered };
-  } catch (e2) {
-    const error = e2.message;
-    spinner.warn(`Site import failed: ${error}. Re-run to retry.`);
-    return { ok: false, registered: [], error };
-  }
-}
+var composePaths = {
+  dir: COMPOSE_DIR,
+  file: COMPOSE_FILE,
+  env: ENV_FILE,
+  envBackup: ENV_BACKUP_FILE
+};
 
 export {
-  OS_DIR,
-  IS_ALT_HOME,
-  DATA_DIR,
-  LOG_DIR,
-  AUTH_SECRET_FILE,
-  INTERNAL_TOKEN_FILE,
   PORTS_FILE,
   saveInstanceUrl,
   readInstanceUrl,
@@ -14224,6 +14848,8 @@ export {
   storedDashboardPort,
   portMoveNotice,
   resolvePorts,
+  thisHost,
+  startUnitHint,
   DEFAULT_REPO,
   SOURCE_CHECKOUT_DIR,
   SOURCE_DIST_DIR,
@@ -14234,14 +14860,20 @@ export {
   remoteSha,
   rebuildFromSource,
   readInstallMethod,
-  dockerGap,
   hasDockerCompose,
   dockerInstallPreview,
   ensureDocker,
+  composeSecretRotationRisk,
+  renderSecretRotationRefusal,
+  composePgDataRisk,
+  renderPgDataRefusal,
+  composeHostChannel,
+  composeHostChannelExpected,
   composeTrustedOriginUrls,
   resolveComposePorts,
   sourceBuildDir,
   composePlan,
+  pinnedImagesReady,
   composePrefetch,
   composeUp,
   composeDown,
@@ -14252,7 +14884,5 @@ export {
   composeStart,
   composeRestart,
   composeInternalToken,
-  waitForApiHealth,
-  waitForEdgeRunning,
-  importMigratedSites
+  composePaths
 };