openship 0.6.0 → 0.6.5

package/dist/server/lua/geo_country.lua

@@ -14,9 +14,10 @@
 --                 image from apps/api/assets/geoip, so no runtime download)
 --
 -- Falls back gracefully - if the library or database is missing,
--- get_country_code() returns nil.  Both site_logger.lua and pipe_log.lua
--- wrap this module in pcall(require, ...) so a missing DB never crashes
--- the request pipeline. mgmt_api `GET /status` reports whether geo actually
+-- get_country_code() returns nil.  site_logger.lua wraps this module in
+-- pcall(require, ...) so a missing DB never crashes the request pipeline
+-- (the country it resolves flows into the ring buffer, and from there to
+-- both /logs/recent and the live SSE stream). mgmt_api `GET /status` reports whether geo actually
 -- resolved, so a silently-dark edge is visible instead of just yielding an
 -- empty country map.
 

package/dist/server/lua/pipe_stream.lua

@@ -2,6 +2,14 @@
 -- content_by_lua: SSE endpoint for real-time request log streaming.
 -- GET /logs/stream?domain=example.com
 -- Internal only - 127.0.0.1:9145
+--
+-- Reads the SAME ring buffer site_logger.lua writes (rlog:{domain}:seq +
+-- rlog:{domain}:{slot}), by a PER-CONNECTION cursor. Nothing is consumed: N
+-- concurrent watchers each walk the ring independently and none steals another's
+-- frames. This is what replaced the old single-subscriber log_pipe:q queue —
+-- a containerized edge tails this over `docker exec curl`, and a curl that
+-- outlives its client (the daemon buffers its stdout, so no EPIPE) can no longer
+-- drain the queue out from under the next reader.
 
 local sh = ngx.shared.request_data
 if not sh then
@@ -20,12 +28,10 @@ end
 domain = domain:lower()
 if domain:sub(1, 4) == "www." then domain = domain:sub(5) end
 
-local SUB_KEY   = "log_pipe:sub:" .. domain
-local QUEUE_KEY = "log_pipe:q:"   .. domain
-
--- Clear stale queue entries, mark subscriber active
-sh:delete(QUEUE_KEY)
-sh:set(SUB_KEY, true, 30)
+-- MUST match site_logger.lua's RING — same slot arithmetic on both ends.
+local RING    = 1000
+local SEQ_KEY = "rlog:" .. domain .. ":seq"
+local slot_key = function(seq) return "rlog:" .. domain .. ":" .. (seq % RING) end
 
 ngx.header["Content-Type"]      = "text/event-stream"
 ngx.header["Cache-Control"]     = "no-cache, no-store"
@@ -36,55 +42,62 @@ ngx.header["X-Accel-Buffering"] = "no"
 -- Without this, ngx.flush on an empty buffer sends chunked-EOF (0\r\n\r\n)
 -- and terminates the response immediately.
 ngx.print(": connected\n\n")
-if not ngx.flush(true) then
-    sh:delete(SUB_KEY)
-    return
-end
+if not ngx.flush(true) then return end
 
-local started  = ngx.now()
-local last_hb  = started
-local last_ref = started
+-- Start at the current head: stream only requests that arrive AFTER connect.
+-- History up to this point is served separately by /logs/recent, and the client
+-- dedups the two by the deterministic `{host}:{seq}` id, so a row seen by both
+-- collapses to one.
+local cursor  = tonumber(sh:get(SEQ_KEY)) or 0
+local started = ngx.now()
+local last_hb = started
 
 while true do
-    -- Max 1 hour per connection
-    if ngx.now() - started > 3600 then
-        sh:delete(SUB_KEY)
-        return
-    end
+    -- Max 1 hour per connection.
+    if ngx.now() - started > 3600 then return end
+
+    local head = tonumber(sh:get(SEQ_KEY)) or 0
+
+    -- If we've fallen more than a full ring behind, the oldest unread slots have
+    -- already been overwritten. Jump to the oldest slot still holding its own
+    -- entry (head-RING maps to head's slot, so head-RING+1 is the oldest live one)
+    -- and skip the lost range — same bound the old 2000-entry queue had.
+    if cursor < head - RING then cursor = head - RING end
 
-    -- Drain up to 100 queued entries per cycle
     local sent = 0
-    while sent < 100 do
-        local entry = sh:rpop(QUEUE_KEY)
-        if not entry then break end
-        ngx.print("event: request\ndata: ", entry, "\n\n")
-        sent = sent + 1
+    while cursor < head and sent < 100 do
+        local next_seq = cursor + 1
+        local entry = sh:get(slot_key(next_seq))
+        if entry then
+            ngx.print("event: request\ndata: ", entry, "\n\n")
+            sent = sent + 1
+            cursor = next_seq
+        elseif next_seq < head then
+            -- A later seq already exists, so this can't be the incr(seq)→set(slot)
+            -- write window: the slot is genuinely lost (expired or wrapped). Skip it.
+            cursor = next_seq
+        else
+            -- next_seq == head: the newest entry's slot may not be written yet
+            -- (the microsecond window between incr(seq) and set(slot)). Retry it
+            -- next cycle without advancing.
+            break
+        end
     end
 
     if sent > 0 then
-        if not ngx.flush(true) then
-            sh:delete(SUB_KEY)
-            return
-        end
+        if not ngx.flush(true) then return end
     end
 
     local now = ngx.now()
 
-    -- Heartbeat every 15s
+    -- Heartbeat every 15s. Its flush is also how a dead client is detected: once
+    -- the reader (a `docker exec curl`) goes away and its socket closes, this
+    -- flush fails and the connection tears down here.
     if now - last_hb > 15 then
         ngx.print(": ping\n\n")
-        if not ngx.flush(true) then
-            sh:delete(SUB_KEY)
-            return
-        end
+        if not ngx.flush(true) then return end
         last_hb = now
     end
 
-    -- Refresh subscriber TTL every 10s
-    if now - last_ref > 10 then
-        sh:set(SUB_KEY, true, 30)
-        last_ref = now
-    end
-
     ngx.sleep(0.05)
 end

package/dist/server/lua/site_logger.lua

@@ -27,8 +27,10 @@
 -- Shared dict key schema (request_data zone):
 --   rlog:{domain}:seq               monotonic write pointer
 --   rlog:{domain}:{slot}            JSON entry (ring buf)       (TTL 1h)
---   log_pipe:sub:{domain}           live subscriber flag        (TTL 30s)
---   log_pipe:q:{domain}             live log queue entries
+--
+-- The ring is ALSO the live source: pipe_stream.lua's SSE endpoint reads these
+-- slots by a per-connection cursor, so there is no separate live queue or
+-- subscriber flag — every watcher sees the full stream and steals from none.
 --
 -- NOTE on `:u` — it counts non-static REQUESTS, not people. It was surfaced as
 -- "unique IPs" all the way to the dashboard, which it never was. Real distinct
@@ -43,10 +45,6 @@ if not geo_ok then
     ngx.log(ngx.WARN, "[site_logger] geo_country module not available. GeoIP disabled.")
 end
 
--- SAFE LOAD: Pipe module (per-worker, cached by require)
-local pipe_ok, pipe_log = pcall(require, "openship.pipe_log")
-if not pipe_ok then pipe_log = nil end
-
 local analytics    = ngx.shared.analytics
 local request_data = ngx.shared.request_data
 -- Per-host edge config, pushed by the API (see mgmt_api's /analytics/config).
@@ -194,11 +192,12 @@ local status  = ngx.var.status         or "0"
 
 -- Client country, resolved ONCE per request.
 --
--- Hoisted out of the geo block because THREE consumers need it — the daily/per-minute
--- rollups, the raw ring buffer behind /logs/recent, and the live SSE pipe. It used to be
--- looked up inside the rollup and again inside pipe_log, so the ring buffer had no
--- country at all: a request-log list showed flags on rows that arrived live and none on
--- rows backfilled from /logs/recent, for the same traffic.
+-- Hoisted out of the geo block because both the daily/per-minute rollups and the raw
+-- ring buffer need it. The ring is the single source for the request log — /logs/recent
+-- reads it directly and the live SSE stream (pipe_stream.lua) reads the same slots by
+-- cursor — so resolving the country here means every row carries its flag no matter
+-- which path delivered it. An earlier split (looked up in the rollup, again in a
+-- separate live pipe) left the ring with no country at all.
 --
 -- pcall'd because a corrupt or partially-written mmdb makes the lookup raise, and an
 -- error here would abort every counter below it (see the section header).
@@ -356,10 +355,20 @@ pcall(function()
     bump_indexed(gpfx .. "s:" .. status, D48H, gpfx .. "sn", gpfx .. "si:", status)
 end)
 
--- ── 4. Raw request ring buffer ──────────────────────────────────────────────
+-- ── 4. Raw request ring buffer (also the live SSE source) ────────────────────
+--
+-- `seq` is claimed BEFORE encoding so the stored JSON can carry a deterministic
+-- id (`{host}:{seq}`). That id is the dedup key everywhere downstream: /logs/recent
+-- returns these entries verbatim, and pipe_stream.lua streams the same slots live,
+-- so the same request reaches the client with one stable id instead of a fresh
+-- random one per source. `incr` with init 0 never returns nil here; guard anyway
+-- so a shdict hiccup can't index a nil into the slot key.
 
 pcall(function()
+    local seq = request_data:incr("rlog:" .. host .. ":seq", 1, 0)
+    if not seq then return end
     local ok_j, j = pcall(cjson.encode, {
+        id     = host .. ":" .. seq,
         ip     = ip,
         -- nil is simply omitted by cjson, so a box with no GeoIP writes the same shape
         -- minus this key rather than a null the reader has to special-case.
@@ -374,17 +383,6 @@ pcall(function()
         rt     = rt,
     })
     if ok_j and j then
-        local seq  = request_data:incr("rlog:" .. host .. ":seq", 1, 0)
-        local slot = seq % RING
-        request_data:set("rlog:" .. host .. ":" .. slot, j, D1H)
+        request_data:set("rlog:" .. host .. ":" .. (seq % RING), j, D1H)
     end
 end)
-
--- ── 5. Live-log pipe (only when a subscriber is watching) ───────────────────
--- Fire via timer to avoid blocking the log phase
-
-if pipe_log and pipe_log.pipe_request_log
-   and request_data:get("log_pipe:sub:" .. host) then
-    ngx.timer.at(0, pipe_log.pipe_request_log,
-                 host, ip, ts, ua, uri, req_len, bytes, rt, method, status, cc)
-end

package/dist/server/migrations/0098_instance_product_mode.sql

@@ -0,0 +1,12 @@
+-- Openship Mail: which product this instance presents itself as.
+--
+-- Nullable with NO default, deliberately. The instance_settings row exists on
+-- every instance, so a NOT NULL DEFAULT 'platform' would write a concrete value
+-- everywhere and permanently shadow the OPENSHIP_PRODUCT env var — the resolver
+-- reads `settings.product_mode ?? env.OPENSHIP_PRODUCT`, so "unset" has to stay
+-- representable. NULL means "no instance override".
+--
+-- Presentation scope only: this hides nav entries and rebrands the shell. It is
+-- not an authorization boundary and no route reads it — webmail deploys through
+-- the ordinary project pipeline, so the platform endpoints stay live in mail mode.
+ALTER TABLE "instance_settings" ADD COLUMN IF NOT EXISTS "product_mode" text;

package/dist/server/migrations/0099_mail_webmail_project.sql

@@ -0,0 +1,24 @@
+-- The webmail project serving a mail server, as a stored FK.
+--
+-- Webmail is now an ordinary catalog app (packages/core/src/apps/catalog/webmail.json)
+-- installed through the SAME generic installer as every other app, so its slug is
+-- derived from the project NAME the operator typed. The link therefore cannot be a
+-- naming convention any more: the old lookup parsed `webmail-<serverId>` back out of
+-- the slug, which the generic installer never produces — and which, while it existed,
+-- mislinked any project a user happened to name "Webmail Prod" (slug `webmail-prod`,
+-- read back as mail server "prod").
+--
+-- Nullable: most servers have no webmail, and an operator may run one outside
+-- openship. ON DELETE SET NULL so deleting the webmail project clears the link and
+-- /emails falls back to the install CTA rather than pointing at a row that is gone.
+--
+-- No backfill. A pre-existing webmail project still carries the retired
+-- `mail-webmail` template id and the `webmail-<serverId>` slug; the mail status
+-- resolver keeps that legacy slug lookup as a fallback for exactly those rows, and
+-- stamps this column the first time it resolves one.
+ALTER TABLE "mail_servers" ADD COLUMN IF NOT EXISTS "webmail_project_id" text;--> statement-breakpoint
+
+DO $$ BEGIN
+  ALTER TABLE "mail_servers" ADD CONSTRAINT "mail_servers_webmail_project_id_project_id_fk"
+    FOREIGN KEY ("webmail_project_id") REFERENCES "public"."project"("id") ON DELETE set null ON UPDATE no action;
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;

package/dist/server/migrations/0100_server_ssh_private_key.sql

@@ -0,0 +1,11 @@
+-- Pasted / uploaded SSH private-key material, stored encrypted at rest (enc1:).
+--
+-- Nullable with no default. The existing `ssh_key_path` points at a key file on
+-- the API host — useless on a remote / VPS instance where the operator's key
+-- lives on their own machine. This column holds the key bytes themselves so the
+-- dashboard can paste or upload a key from any browser; buildSshConfig() prefers
+-- it (decrypted) over reading `ssh_key_path` off disk.
+--
+-- Write-only: never serialized back to the client, and listed in
+-- ENCRYPTED_COLUMNS so it is stripped from any cross-host dump/restore.
+ALTER TABLE "servers" ADD COLUMN IF NOT EXISTS "ssh_private_key" text;

package/dist/server/migrations/0101_mail_resume_step.sql

@@ -0,0 +1,12 @@
+-- The setup step an incomplete mail install is paused at, mirrored from the
+-- on-host state file's `resumeStep` whenever the wizard halts (a failed step,
+-- or a DNS/PTR hold). NULL once the install completes or before it ever halts.
+--
+-- Lets the /emails server list surface WHERE an incomplete install stopped
+-- ("Stopped · step 6: Retrieve DKIM Keys") without the per-server SSH probe
+-- this table exists to avoid — only the step id is stored; the human label is
+-- derived from it against MAIL_SETUP_STEPS.
+--
+-- Nullable, no default, no backfill: a pre-existing incomplete install gets its
+-- step stamped the next time the wizard halts (or cleared on completion).
+ALTER TABLE "mail_servers" ADD COLUMN IF NOT EXISTS "resume_step" integer;

package/dist/server/migrations/0102_project_workload_axes.sql

@@ -0,0 +1,19 @@
+-- Deployment-class axes — deconflate the legacy `has_server` / `has_build`
+-- booleans, which each mixed two independent concerns (issue #538). See
+-- @repo/core deployment-class.ts.
+--
+-- All three are EXPLICIT OVERRIDES: NULL means "derive from the legacy flags +
+-- framework + source", so every pre-existing project keeps classifying exactly
+-- as before and no backfill is needed. `has_server` / `has_build` are kept and
+-- written in sync, never dropped — rollback snapshots and every legacy reader
+-- still depend on them.
+--
+--   source_kind    text  "git" | "image" | "upload"      (git needs a clone)
+--   build_kind     text  "dockerfile" | "buildpack" | "static" | "prebuilt"
+--   workload_type  text  "web" | "worker" | "static"     (worker = portless
+--                        long-running container: no port, no route)
+ALTER TABLE "project" ADD COLUMN IF NOT EXISTS "source_kind" text;
+--> statement-breakpoint
+ALTER TABLE "project" ADD COLUMN IF NOT EXISTS "build_kind" text;
+--> statement-breakpoint
+ALTER TABLE "project" ADD COLUMN IF NOT EXISTS "workload_type" text;

package/dist/server/migrations/0103_dns_credential.sql

@@ -0,0 +1,41 @@
+-- DNS provider credentials — the token that lets Openship write a domain's records.
+--
+-- Adding a custom domain has always ended the same way: Openship computes the exact
+-- A/CNAME + `_openship-challenge` TXT records and then asks the operator to go paste
+-- them somewhere else. Every minute between "added" and "pasted" is a domain that
+-- doesn't resolve, can't pass ACME, and looks broken. With a scoped provider token we
+-- write those records ourselves and the domain verifies on its own.
+--
+-- The token is the sensitive part: Zone:Read + DNS:Edit can rewrite every record in
+-- every zone it can see, so it is stored ONLY as an `enc1:` AES-256-GCM envelope
+-- (`encryptSecretField`) and is never returned by the API — not in full, not as a
+-- prefix. `status` exists so a token that gets revoked upstream becomes visible in the
+-- UI instead of silently turning auto-provisioning off forever.
+CREATE TABLE IF NOT EXISTS "dns_credential" (
+  "id" text PRIMARY KEY NOT NULL,
+  "organization_id" text NOT NULL REFERENCES "organization"("id") ON DELETE CASCADE,
+  -- Provider name ("cloudflare"). Text, not an enum: adding a provider should be a
+  -- registry entry, not a migration.
+  "provider" text NOT NULL,
+  -- Operator-facing label, e.g. "Cloudflare production".
+  "name" text NOT NULL,
+  "api_token_enc" text NOT NULL,
+  -- active | invalid. Flipped to 'invalid' by the provisioning path when the provider
+  -- answers 401/403, which is the only moment we learn a stored token stopped working.
+  "status" text NOT NULL DEFAULT 'active',
+  "last_verified_at" timestamp,
+  "created_at" timestamp NOT NULL DEFAULT now(),
+  "updated_at" timestamp NOT NULL DEFAULT now()
+);
+--> statement-breakpoint
+-- Zone resolution runs on EVERY domain add and remove and asks one question: "this
+-- org's active credentials". Leading org column means the plain org-wide listing rides
+-- the same index as a prefix, so this is the only one the table needs.
+CREATE INDEX IF NOT EXISTS "idx_dns_credential_org_status"
+  ON "dns_credential" ("organization_id", "status");
+--> statement-breakpoint
+-- One label per provider per org. A second "Cloudflare production" is a double-submit,
+-- and two credentials that resolve the same zone makes "which token wrote this record"
+-- unanswerable at cleanup time.
+CREATE UNIQUE INDEX IF NOT EXISTS "uq_dns_credential_org_provider_name"
+  ON "dns_credential" ("organization_id", "provider", "name");

package/dist/server/migrations/0104_instance_host_control.sql

@@ -0,0 +1,15 @@
+-- Runtime host-control toggle (#527): may OpenShip deploy to the machine it runs on?
+--
+-- Nullable with NO default, deliberately — the same contract as product_mode
+-- (0098). The instance_settings row exists on every instance, so a NOT NULL
+-- DEFAULT would write a concrete value everywhere and permanently shadow the
+-- OPENSHIP_HOST_CONTROL env var (written by `openship up --no-host-control`).
+-- The resolver reads `settings.host_control_enabled ?? env`, so "unset" has to
+-- stay representable. NULL means "no instance override, use env".
+--
+-- Unlike product_mode this DOES gate privileged behavior (host-root deploys via
+-- the container->host SSH channel + mounted docker socket), so the WRITE path is
+-- gated to the box-owning org's owner. The precedence still lets the DB override
+-- env: the operator's need is to re-enable from Settings what --no-host-control
+-- turned off.
+ALTER TABLE "instance_settings" ADD COLUMN IF NOT EXISTS "host_control_enabled" boolean;

package/dist/server/migrations/meta/_journal.json

@@ -687,6 +687,55 @@
       "when": 1787350907325,
       "tag": "0097_update_status_upstream_only",
       "breakpoints": true
+    },
+    {
+      "idx": 98,
+      "version": "7",
+      "when": 1787437307325,
+      "tag": "0098_instance_product_mode",
+      "breakpoints": true
+    },
+    {
+      "idx": 99,
+      "version": "7",
+      "when": 1787523707325,
+      "tag": "0099_mail_webmail_project",
+      "breakpoints": true
+    },
+    {
+      "idx": 100,
+      "version": "7",
+      "when": 1787610107325,
+      "tag": "0100_server_ssh_private_key",
+      "breakpoints": true
+    },
+    {
+      "idx": 101,
+      "version": "7",
+      "when": 1787696507325,
+      "tag": "0101_mail_resume_step",
+      "breakpoints": true
+    },
+    {
+      "idx": 102,
+      "version": "7",
+      "when": 1787782907325,
+      "tag": "0102_project_workload_axes",
+      "breakpoints": true
+    },
+    {
+      "idx": 103,
+      "version": "7",
+      "when": 1787869307325,
+      "tag": "0103_dns_credential",
+      "breakpoints": true
+    },
+    {
+      "idx": 104,
+      "version": "7",
+      "when": 1787955707325,
+      "tag": "0104_instance_host_control",
+      "breakpoints": true
     }
   ]
 }

package/dist/{setup-FA4PW4NU.js → setup-WUUZURHS.js}

@@ -4,17 +4,18 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   SystemManager
-} from "./chunk-EP2TNALB.js";
-import "./chunk-GUQ3QCJ7.js";
-import "./chunk-IW2UKBVF.js";
-import "./chunk-ZCFVHA25.js";
-import "./chunk-QEH4QUBX.js";
+} from "./chunk-XVOBL7BC.js";
+import "./chunk-7334NSJL.js";
+import "./chunk-VLQ3UIVO.js";
 import "./chunk-I3DPMTSF.js";
-import "./chunk-VZ2ZHPS2.js";
-import "./chunk-3LDWWY7U.js";
-import "./chunk-OGY63DGD.js";
+import "./chunk-RFWJE7ZN.js";
+import "./chunk-WE7BXW6L.js";
+import "./chunk-A7EWM2KA.js";
+import "./chunk-PZRRL5PC.js";
+import "./chunk-EZPPTWJQ.js";
+import "./chunk-WFRXYWK2.js";
 import "./chunk-ZFJXPCQP.js";
-import "./chunk-OTLSJYAC.js";
+import "./chunk-LEYSL46B.js";
 import "./chunk-PXKCZB2I.js";
 export {
   SystemManager

package/dist/up-XEO3SR6Z.js

@@ -0,0 +1,58 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  ensureInternalToken,
+  normalizeUrl,
+  runHeadlessProvision,
+  startService,
+  upCommand
+} from "./chunk-7S4USQYF.js";
+import "./chunk-6HOA5JT7.js";
+import "./chunk-HPXP6LXZ.js";
+import "./chunk-XRNRT37W.js";
+import "./chunk-QLX7NBEA.js";
+import "./chunk-QWHBRY2K.js";
+import "./chunk-ELGRMZOW.js";
+import "./chunk-ONKEYSMY.js";
+import "./chunk-XZYFZ6A5.js";
+import "./chunk-PDW4L3NV.js";
+import "./chunk-DOD2BXHQ.js";
+import "./chunk-42WQABXM.js";
+import "./chunk-DRK3MEDS.js";
+import "./chunk-3NQQXMDR.js";
+import "./chunk-ZWLDLTJP.js";
+import "./chunk-6JELW75A.js";
+import "./chunk-3ZAGC5NT.js";
+import "./chunk-WNWQBB7F.js";
+import "./chunk-2GWYYHOR.js";
+import "./chunk-RXQBD4ZY.js";
+import "./chunk-XVOBL7BC.js";
+import "./chunk-7334NSJL.js";
+import "./chunk-VLQ3UIVO.js";
+import "./chunk-I3DPMTSF.js";
+import "./chunk-VDESJSG6.js";
+import "./chunk-LFCSC4IU.js";
+import "./chunk-GRTXMUHA.js";
+import "./chunk-MSZUCNPV.js";
+import "./chunk-TM2IQPYU.js";
+import "./chunk-VHMOQL5Y.js";
+import "./chunk-5OUWIPOB.js";
+import "./chunk-6FH4AXVY.js";
+import "./chunk-RFWJE7ZN.js";
+import "./chunk-WE7BXW6L.js";
+import "./chunk-A7EWM2KA.js";
+import "./chunk-PZRRL5PC.js";
+import "./chunk-EZPPTWJQ.js";
+import "./chunk-WFRXYWK2.js";
+import "./chunk-ZFJXPCQP.js";
+import "./chunk-LEYSL46B.js";
+import "./chunk-PXKCZB2I.js";
+export {
+  ensureInternalToken,
+  normalizeUrl,
+  runHeadlessProvision,
+  startService,
+  upCommand
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openship",
-  "version": "0.6.0",
+  "version": "0.6.5",
   "description": "Openship CLI - deploy, manage, and open your Openship platform from the terminal",
   "license": "Apache-2.0",
   "repository": {
@@ -20,6 +20,9 @@
   "bin": {
     "openship": "./dist/node-entry.js"
   },
+  "engines": {
+    "node": ">=22"
+  },
   "files": [
     "dist",
     "README.md"
@@ -42,7 +45,6 @@
     "commander": "^14.0.3",
     "dockerode": "^4.0.9",
     "open": "^10.2.0",
-    "openship": "^0.5.0",
     "ora": "^9.3.0",
     "ssh2": "^1.17.0"
   },