openship 0.6.0 → 0.6.5

package/dist/chunk-7S4USQYF.js

@@ -0,0 +1,1753 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  importMigratedSites
+} from "./chunk-6HOA5JT7.js";
+import {
+  completeHostEdge,
+  markStoppedProxyImported,
+  planAndApplyHostEdge,
+  previewHostEdge,
+  rollbackHostEdge
+} from "./chunk-HPXP6LXZ.js";
+import {
+  verifyHostChannel
+} from "./chunk-XRNRT37W.js";
+import {
+  DEFAULT_REPO,
+  PORTS_FILE,
+  SOURCE_CHECKOUT_DIR,
+  SOURCE_DIST_DIR,
+  composeInternalToken,
+  composePgDataRisk,
+  composePlan,
+  composePrefetch,
+  composeSecretRotationRisk,
+  composeTrustedOriginUrls,
+  composeUp,
+  dockerInstallPreview,
+  ensureDocker,
+  hasDockerCompose,
+  pinnedImagesReady,
+  portMoveNotice,
+  prepareFromSource,
+  readInstanceUrl,
+  readStoredPorts,
+  renderPgDataRefusal,
+  renderSecretRotationRefusal,
+  resolveComposePorts,
+  resolvePorts,
+  sourceBuildDir,
+  startUnitHint,
+  thisHost
+} from "./chunk-QLX7NBEA.js";
+import {
+  AUTH_SECRET_FILE,
+  DATA_DIR,
+  INTERNAL_TOKEN_FILE,
+  IS_ALT_HOME,
+  LOG_DIR,
+  OS_DIR
+} from "./chunk-ELGRMZOW.js";
+import {
+  LocalExecutor
+} from "./chunk-6FH4AXVY.js";
+import {
+  EDGE_CONTAINER_NAME,
+  edgeCrashReason,
+  edgeIsBroken
+} from "./chunk-WE7BXW6L.js";
+import {
+  isValidEmail
+} from "./chunk-LEYSL46B.js";
+
+// src/commands/up.ts
+import { Command } from "commander";
+import chalk2 from "chalk";
+import ora from "ora";
+import { spawn } from "child_process";
+import { randomBytes as randomBytes2 } from "crypto";
+import { createWriteStream as createWriteStream2, existsSync as existsSync5, mkdirSync as mkdirSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname2, join as join5 } from "path";
+import { fileURLToPath } from "url";
+
+// src/lib/dashboard.ts
+import { spawnSync } from "child_process";
+import { existsSync, mkdirSync as mkdirSync2, rmSync, writeFileSync } from "fs";
+import { join as join2 } from "path";
+
+// src/lib/cache.ts
+import { createHash } from "crypto";
+import { createReadStream, createWriteStream, mkdirSync } from "fs";
+import { dirname, join } from "path";
+var CACHE_DIR = join(OS_DIR, "cache");
+var RELEASES_DIR = join(CACHE_DIR, "releases");
+function releaseDir(tag) {
+  return join(RELEASES_DIR, tag);
+}
+function parseSha256(content) {
+  const token = content.trim().split(/\s+/)[0]?.toLowerCase();
+  return token && /^[0-9a-f]{64}$/.test(token) ? token : null;
+}
+async function hashFile(path) {
+  const hash = createHash("sha256");
+  for await (const chunk of createReadStream(path)) hash.update(chunk);
+  return hash.digest("hex");
+}
+async function downloadToFile(url, dest, onProgress) {
+  const res = await fetch(url, { headers: { "User-Agent": "openship-cli" } });
+  if (!res.ok || !res.body) throw new Error(`HTTP ${res.status} for ${url}`);
+  mkdirSync(dirname(dest), { recursive: true });
+  const total = Number(res.headers.get("content-length")) || 0;
+  const hash = createHash("sha256");
+  const file = createWriteStream(dest);
+  const reader = res.body.getReader();
+  let received = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      hash.update(value);
+      if (!file.write(Buffer.from(value))) {
+        await new Promise((r) => file.once("drain", r));
+      }
+      received += value.length;
+      onProgress?.(received, total);
+    }
+  } finally {
+    file.end();
+  }
+  await new Promise((resolve2, reject) => {
+    file.on("finish", () => resolve2());
+    file.on("error", reject);
+  });
+  return { sha256: hash.digest("hex"), size: received };
+}
+function formatBytes(n) {
+  if (n < 1024) return `${n} B`;
+  const units = ["KB", "MB", "GB"];
+  let v = n / 1024;
+  let i = 0;
+  while (v >= 1024 && i < units.length - 1) {
+    v /= 1024;
+    i += 1;
+  }
+  return `${v.toFixed(1)} ${units[i]}`;
+}
+
+// src/lib/github-releases.ts
+var REPO = "oblien/openship";
+var RELEASES = `https://github.com/${REPO}/releases`;
+var LATEST_API = `https://api.github.com/repos/${REPO}/releases/latest`;
+async function resolveLatestTag() {
+  const res = await fetch(LATEST_API, {
+    headers: { Accept: "application/vnd.github+json", "User-Agent": "openship-cli" },
+    signal: AbortSignal.timeout(1e4)
+  });
+  if (!res.ok) throw new Error(`GitHub latest-release lookup failed: HTTP ${res.status}`);
+  const data = await res.json();
+  if (!data.tag_name) throw new Error("Latest release has no tag_name");
+  return data.tag_name;
+}
+function assetUrl(tag, name) {
+  return `${RELEASES}/download/${tag}/${name}`;
+}
+async function fetchSidecar(url) {
+  const res = await fetch(url, {
+    headers: { "User-Agent": "openship-cli" },
+    signal: AbortSignal.timeout(15e3)
+  });
+  if (res.status === 404) return null;
+  if (!res.ok) throw new Error(`Sidecar fetch failed: HTTP ${res.status}`);
+  return res.text();
+}
+async function expectedSha256(tag, name) {
+  const body = await fetchSidecar(`${assetUrl(tag, name)}.sha256`);
+  return body ? parseSha256(body) : null;
+}
+
+// src/lib/dashboard.ts
+var DASHBOARD_CACHE = join2(CACHE_DIR, "dashboard");
+function assetName(tag) {
+  return `openship-dashboard-${tag}.tar.gz`;
+}
+function resolveDashboardEntry(cwd) {
+  const wrapped = join2(cwd, "standalone-server.mjs");
+  return existsSync(wrapped) ? wrapped : join2(cwd, "server.js");
+}
+async function ensureDashboard(opts = {}) {
+  const override = process.env.OPENSHIP_DASHBOARD_DIR?.trim();
+  if (override) {
+    const cwd = join2(override, "apps", "dashboard");
+    const serverJs = join2(cwd, "server.js");
+    if (!existsSync(serverJs)) {
+      throw new Error(
+        `OPENSHIP_DASHBOARD_DIR=${override} but ${serverJs} is missing \u2014 build the dashboard standalone first (see docs).`
+      );
+    }
+    return { tag: "local", entry: resolveDashboardEntry(cwd), cwd };
+  }
+  const requested = opts.tag ?? await resolveLatestTag();
+  try {
+    return await fetchBundle(requested, opts.onProgress);
+  } catch (err) {
+    if (opts.tag && /\b404\b/.test(err?.message ?? "")) {
+      const latest = await resolveLatestTag();
+      if (latest && latest !== requested) {
+        return await fetchBundle(latest, opts.onProgress);
+      }
+    }
+    throw err;
+  }
+}
+async function fetchBundle(tag, onProgress) {
+  const dir = join2(DASHBOARD_CACHE, tag);
+  const cwd = join2(dir, "apps", "dashboard");
+  const serverJs = join2(cwd, "server.js");
+  const marker = join2(dir, ".extracted");
+  if (existsSync(marker) && existsSync(serverJs)) {
+    return { tag, entry: resolveDashboardEntry(cwd), cwd };
+  }
+  rmSync(dir, { recursive: true, force: true });
+  mkdirSync2(dir, { recursive: true });
+  const name = assetName(tag);
+  const tarball = join2(dir, name);
+  const { sha256 } = await downloadToFile(assetUrl(tag, name), tarball, onProgress);
+  const expected = await expectedSha256(tag, name);
+  if (!expected) {
+    throw new Error(
+      `No .sha256 sidecar for ${name}; refusing to run an unverified dashboard bundle.`
+    );
+  }
+  if (expected !== sha256) {
+    rmSync(dir, { recursive: true, force: true });
+    throw new Error(`Dashboard bundle checksum mismatch (expected ${expected}, got ${sha256}).`);
+  }
+  const untar = spawnSync("tar", ["-xzf", tarball, "-C", dir], { stdio: "inherit" });
+  if (untar.status !== 0) {
+    throw new Error("Failed to extract the dashboard bundle (is `tar` available?).");
+  }
+  rmSync(tarball, { force: true });
+  if (!existsSync(serverJs)) {
+    throw new Error(`Dashboard bundle extracted but ${serverJs} is missing (unexpected layout).`);
+  }
+  writeFileSync(marker, `${tag}
+`);
+  return { tag, entry: resolveDashboardEntry(cwd), cwd };
+}
+
+// src/lib/service.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { existsSync as existsSync3, mkdirSync as mkdirSync4, writeFileSync as writeFileSync3, rmSync as rmSync2 } from "fs";
+import { homedir } from "os";
+import { join as join4, resolve } from "path";
+
+// src/lib/cli-install.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync, writeFileSync as writeFileSync2 } from "fs";
+import { join as join3 } from "path";
+var MARKER = join3(OS_DIR, "cli-install.json");
+function parseCliInstall(raw) {
+  try {
+    const obj = JSON.parse(raw);
+    if (!obj || obj.method !== "tarball" || typeof obj.tag !== "string" || !obj.tag) return null;
+    return {
+      method: "tarball",
+      tag: obj.tag,
+      launcher: typeof obj.launcher === "string" ? obj.launcher : join3(OS_DIR, "bin", "openship"),
+      runtime: obj.runtime === "vendored" ? "vendored" : "system"
+    };
+  } catch {
+    return null;
+  }
+}
+function readCliInstall() {
+  if (!existsSync2(MARKER)) return null;
+  try {
+    return parseCliInstall(readFileSync(MARKER, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writeCliInstall(info) {
+  mkdirSync3(OS_DIR, { recursive: true });
+  writeFileSync2(MARKER, `${JSON.stringify(info, null, 2)}
+`);
+}
+
+// src/lib/service.ts
+var HOME = homedir();
+var OPENSHIP_BIN = join4(OS_DIR, "bin");
+var MAC_LABEL = IS_ALT_HOME ? "io.openship-dev.up" : "io.openship.up";
+var MAC_PLIST = join4(HOME, "Library", "LaunchAgents", `${MAC_LABEL}.plist`);
+var SYSTEMD_NAME = IS_ALT_HOME ? "openship-dev" : "openship";
+var WIN_TASK = IS_ALT_HOME ? "OpenshipDev" : "Openship";
+function selfInvocation() {
+  const cli = readCliInstall();
+  if (cli?.method === "tarball" && existsSync3(cli.launcher)) {
+    return { runtime: cli.launcher, args: [] };
+  }
+  const runtime = process.execPath;
+  const entry = resolve(process.argv[1] ?? "");
+  return { runtime, args: [entry] };
+}
+function upArgs(flags) {
+  const a = ["up", "--foreground"];
+  if (flags.port) a.push("--port", flags.port);
+  if (flags.dataDir) a.push("--data-dir", flags.dataDir);
+  if (flags.dashboardPort) a.push("--dashboard-port", flags.dashboardPort);
+  if (flags.ui === false) a.push("--no-ui");
+  if (flags.uiVersion) a.push("--ui-version", flags.uiVersion);
+  if (flags.publicUrl) a.push("--public-url", flags.publicUrl);
+  if (flags.trustProxy) a.push("--trust-proxy");
+  if (flags.host) a.push("--host", flags.host);
+  if (flags.managedEdge) a.push("--managed-edge");
+  if (flags.acmeEmail) a.push("--acme-email", flags.acmeEmail);
+  if (flags.mail) a.push("--mail");
+  return a;
+}
+function runArgv(flags) {
+  const { runtime, args } = selfInvocation();
+  return [runtime, ...args, ...upArgs(flags)];
+}
+function run(cmd, args) {
+  const r = spawnSync2(cmd, args, { encoding: "utf8" });
+  return { ok: r.status === 0, out: `${r.stdout ?? ""}${r.stderr ?? ""}`.trim() };
+}
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function launchdPid() {
+  const r = run("launchctl", ["list", MAC_LABEL]);
+  if (!r.ok) return null;
+  const m = r.out.match(/"PID"\s*=\s*(\d+)/);
+  return m ? Number(m[1]) : null;
+}
+function launchdLastExit() {
+  const m = run("launchctl", ["list", MAC_LABEL]).out.match(/"LastExitStatus"\s*=\s*(-?\d+)/);
+  return m ? Number(m[1]) : null;
+}
+function isRoot() {
+  return typeof process.getuid === "function" && process.getuid() === 0;
+}
+function detectKind() {
+  if (process.platform === "darwin") return "launchd";
+  if (process.platform === "linux") {
+    if (thisHost().profile.serviceManager !== "systemd") return "unsupported";
+    return isRoot() ? "systemd-system" : "systemd-user";
+  }
+  if (process.platform === "win32") return "schtasks";
+  return "unsupported";
+}
+function xmlEscape(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function serviceEnv() {
+  const extra = {};
+  const dashDir = process.env.OPENSHIP_DASHBOARD_DIR?.trim();
+  if (dashDir) extra.OPENSHIP_DASHBOARD_DIR = dashDir;
+  const home = process.env.OPENSHIP_HOME?.trim();
+  if (home) extra.OPENSHIP_HOME = home;
+  return extra;
+}
+function plist(flags) {
+  const argv = runArgv(flags);
+  const items = argv.map((a) => `      <string>${xmlEscape(a)}</string>`).join("\n");
+  const runtimeBin = readCliInstall()?.method === "tarball" ? OPENSHIP_BIN : join4(HOME, ".bun/bin");
+  const path = ["/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin", runtimeBin].join(":");
+  const extraEnv = Object.entries(serviceEnv()).map(([k, v]) => `<key>${xmlEscape(k)}</key><string>${xmlEscape(v)}</string>`).join("");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key><string>${MAC_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+${items}
+  </array>
+  <key>RunAtLoad</key><true/>
+  <key>KeepAlive</key><true/>
+  <key>StandardOutPath</key><string>${join4(LOG_DIR, "up.log")}</string>
+  <key>StandardErrorPath</key><string>${join4(LOG_DIR, "up.err.log")}</string>
+  <key>EnvironmentVariables</key>
+  <dict><key>PATH</key><string>${path}</string>${extraEnv}</dict>
+</dict>
+</plist>
+`;
+}
+function systemdUnit(flags) {
+  const argv = runArgv(flags);
+  const execStart = argv.map((a) => /\s/.test(a) ? `"${a}"` : a).join(" ");
+  const extraEnv = Object.entries(serviceEnv()).map(([k, v]) => `Environment=${k}=${v}
+`).join("");
+  const pathEnv = readCliInstall()?.method === "tarball" ? `Environment=PATH=${["/usr/local/sbin", "/usr/local/bin", "/usr/sbin", "/usr/bin", "/sbin", "/bin", OPENSHIP_BIN].join(":")}
+` : "";
+  return `[Unit]
+Description=Openship control plane
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=${execStart}
+Restart=always
+RestartSec=2
+Environment=NODE_ENV=production
+${pathEnv}${extraEnv}
+[Install]
+WantedBy=default.target
+`;
+}
+function installStepFor(kind) {
+  switch (kind) {
+    case "launchd":
+      return "launchctl bootstrap  (starts it now and at login)";
+    case "systemd-user":
+      return "systemctl --user enable --now + loginctl enable-linger  (starts it now, on boot, without a login session)";
+    case "systemd-system":
+      return "systemctl enable --now  (starts it now and on boot)";
+    case "schtasks":
+      return "schtasks /Create /SC ONLOGON  (starts it at logon)";
+    default:
+      return "nothing \u2014 no supported service manager on this box (needs systemd on Linux); `up --foreground` or `up --compose` instead";
+  }
+}
+function preview(flags) {
+  const kind = detectKind();
+  if (kind === "launchd") return { kind, path: MAC_PLIST, content: plist(flags) };
+  if (kind === "systemd-user") return { kind, path: join4(HOME, ".config/systemd/user", `${SYSTEMD_NAME}.service`), content: systemdUnit(flags) };
+  if (kind === "systemd-system") return { kind, path: `/etc/systemd/system/${SYSTEMD_NAME}.service`, content: systemdUnit(flags) };
+  if (kind === "schtasks") return { kind, path: WIN_TASK, content: runArgv(flags).join(" ") };
+  return { kind, path: "", content: "" };
+}
+function installAndStart(flags) {
+  mkdirSync4(LOG_DIR, { recursive: true });
+  const kind = detectKind();
+  if (kind === "launchd") {
+    mkdirSync4(join4(HOME, "Library", "LaunchAgents"), { recursive: true });
+    run("launchctl", ["bootout", `gui/${process.getuid?.() ?? ""}/${MAC_LABEL}`]);
+    writeFileSync3(MAC_PLIST, plist(flags));
+    const uid = String(process.getuid?.() ?? "");
+    let r = run("launchctl", ["bootstrap", `gui/${uid}`, MAC_PLIST]);
+    if (!r.ok) r = run("launchctl", ["load", "-w", MAC_PLIST]);
+    if (!r.ok) throw new Error(`launchctl failed to load the agent: ${r.out}`);
+    return { kind, detail: `launchd agent ${MAC_LABEL} (logs: ${LOG_DIR})` };
+  }
+  if (kind === "systemd-user" || kind === "systemd-system") {
+    const sysArgs = kind === "systemd-user" ? ["--user"] : [];
+    const unitPath = kind === "systemd-user" ? join4(HOME, ".config/systemd/user", `${SYSTEMD_NAME}.service`) : `/etc/systemd/system/${SYSTEMD_NAME}.service`;
+    mkdirSync4(unitPath.slice(0, unitPath.lastIndexOf("/")), { recursive: true });
+    writeFileSync3(unitPath, systemdUnit(flags));
+    run("systemctl", [...sysArgs, "daemon-reload"]);
+    const r = run("systemctl", [...sysArgs, "enable", "--now", SYSTEMD_NAME]);
+    if (!r.ok) throw new Error(`systemctl enable failed: ${r.out}`);
+    if (kind === "systemd-user") {
+      run("loginctl", ["enable-linger", process.env.USER ?? ""]);
+    }
+    return { kind, detail: `systemd unit ${SYSTEMD_NAME} (${kind === "systemd-user" ? "--user" : "system"})` };
+  }
+  if (kind === "schtasks") {
+    const tr = runArgv(flags).map((a) => `\\"${a}\\"`).join(" ");
+    const r = run("schtasks", ["/Create", "/TN", WIN_TASK, "/SC", "ONLOGON", "/RL", "HIGHEST", "/TR", tr, "/F"]);
+    if (!r.ok) throw new Error(`schtasks create failed: ${r.out}`);
+    run("schtasks", ["/Run", "/TN", WIN_TASK]);
+    return { kind, detail: `Scheduled Task ${WIN_TASK} (best-effort; runs at logon)` };
+  }
+  throw new Error(
+    "No supported service manager found (need systemd on Linux). Run `openship up --foreground` instead, or use docker compose for always-on."
+  );
+}
+function restart() {
+  const kind = detectKind();
+  if (kind === "launchd") {
+    if (!existsSync3(MAC_PLIST)) return { restarted: false, detail: "no launchd agent installed" };
+    const uid = String(process.getuid?.() ?? "");
+    const r = run("launchctl", ["kickstart", "-k", `gui/${uid}/${MAC_LABEL}`]);
+    if (!r.ok) return { restarted: false, detail: r.out || "launchctl kickstart failed" };
+    for (let i = 0; i < 6; i++) {
+      sleepSync(500);
+      if (launchdPid() != null) return { restarted: true, detail: `restarted ${MAC_LABEL}` };
+    }
+    const exit = launchdLastExit();
+    return {
+      restarted: false,
+      detail: `${MAC_LABEL} was killed but didn't stay up${exit != null ? ` (last exit ${exit})` : ""} \u2014 check logs in ${LOG_DIR}`
+    };
+  }
+  if (kind === "systemd-user" || kind === "systemd-system") {
+    const sysArgs = kind === "systemd-user" ? ["--user"] : [];
+    const unitPath = kind === "systemd-user" ? join4(HOME, ".config/systemd/user", `${SYSTEMD_NAME}.service`) : `/etc/systemd/system/${SYSTEMD_NAME}.service`;
+    if (!existsSync3(unitPath)) return { restarted: false, detail: "no systemd unit installed" };
+    const r = run("systemctl", [...sysArgs, "restart", SYSTEMD_NAME]);
+    return { restarted: r.ok, detail: r.ok ? `restarted ${SYSTEMD_NAME}` : r.out };
+  }
+  if (kind === "schtasks") {
+    run("schtasks", ["/End", "/TN", WIN_TASK]);
+    const r = run("schtasks", ["/Run", "/TN", WIN_TASK]);
+    return { restarted: r.ok, detail: r.ok ? `restarted ${WIN_TASK}` : r.out };
+  }
+  return { restarted: false, detail: "no supported service manager" };
+}
+function serviceStatus() {
+  const kind = detectKind();
+  if (kind === "launchd") {
+    return { kind, installed: existsSync3(MAC_PLIST), running: launchdPid() != null };
+  }
+  if (kind === "systemd-user" || kind === "systemd-system") {
+    const sysArgs = kind === "systemd-user" ? ["--user"] : [];
+    const unitPath = kind === "systemd-user" ? join4(HOME, ".config/systemd/user", `${SYSTEMD_NAME}.service`) : `/etc/systemd/system/${SYSTEMD_NAME}.service`;
+    return {
+      kind,
+      installed: existsSync3(unitPath),
+      running: run("systemctl", [...sysArgs, "is-active", SYSTEMD_NAME]).out.trim() === "active"
+    };
+  }
+  if (kind === "schtasks") {
+    const q = run("schtasks", ["/Query", "/TN", WIN_TASK]);
+    return { kind, installed: q.ok, running: q.ok && /Running/i.test(q.out) };
+  }
+  return { kind, installed: false, running: false };
+}
+function sweepOrphanPorts() {
+  if (process.platform === "win32") return;
+  const stored = readStoredPorts();
+  const ports = [stored.api, stored.dashboard].filter((n) => typeof n === "number");
+  if (ports.length === 0) return;
+  const self = process.pid;
+  for (const port of ports) {
+    const q = run("lsof", ["-ti", `tcp:${port}`]);
+    if (!q.ok) continue;
+    for (const token of q.out.split(/\s+/).filter(Boolean)) {
+      const pid = Number(token);
+      if (Number.isInteger(pid) && pid > 1 && pid !== self) {
+        try {
+          process.kill(pid, "SIGKILL");
+        } catch {
+        }
+      }
+    }
+  }
+}
+function stop() {
+  const kind = detectKind();
+  let result;
+  if (kind === "launchd") {
+    run("launchctl", ["bootout", `gui/${process.getuid?.() ?? ""}/${MAC_LABEL}`]);
+    if (existsSync3(MAC_PLIST)) rmSync2(MAC_PLIST, { force: true });
+    result = { kind, detail: `launchd agent ${MAC_LABEL} stopped + removed` };
+  } else if (kind === "systemd-user" || kind === "systemd-system") {
+    const sysArgs = kind === "systemd-user" ? ["--user"] : [];
+    run("systemctl", [...sysArgs, "disable", "--now", SYSTEMD_NAME]);
+    const unitPath = kind === "systemd-user" ? join4(HOME, ".config/systemd/user", `${SYSTEMD_NAME}.service`) : `/etc/systemd/system/${SYSTEMD_NAME}.service`;
+    if (existsSync3(unitPath)) rmSync2(unitPath, { force: true });
+    run("systemctl", [...sysArgs, "daemon-reload"]);
+    result = { kind, detail: `systemd unit ${SYSTEMD_NAME} stopped + disabled` };
+  } else if (kind === "schtasks") {
+    run("schtasks", ["/End", "/TN", WIN_TASK]);
+    run("schtasks", ["/Delete", "/TN", WIN_TASK, "/F"]);
+    result = { kind, detail: `Scheduled Task ${WIN_TASK} stopped + removed` };
+  } else {
+    result = { kind, detail: "no supported service manager \u2014 nothing to stop" };
+  }
+  sweepOrphanPorts();
+  return result;
+}
+
+// src/lib/up-plan.ts
+import chalk from "chalk";
+function planMethod(opts, dockerUsable) {
+  if (opts.bare) return { method: "bare", reason: "--bare was passed" };
+  if (opts.compose) return { method: "compose", reason: "--compose was passed" };
+  if (process.platform !== "linux") {
+    return {
+      method: "bare",
+      reason: `the compose edge needs host networking, which Docker Desktop on ${process.platform} doesn't provide`
+    };
+  }
+  return dockerUsable ? { method: "compose", reason: "the default on Linux when Docker is usable" } : { method: "bare", reason: "Docker isn't usable here, so `up` falls back to the process service" };
+}
+async function planUp(opts) {
+  const mode = opts.fromSource || opts.source ? "from-source" : opts.foreground ? "foreground" : "service";
+  const attached = mode !== "service";
+  const docker = dockerInstallPreview();
+  const dockerUsable = docker.gap === null || docker.wouldInstall;
+  const { method, reason } = attached ? { method: "bare", reason: `--${mode === "foreground" ? "foreground" : "from-source"} runs attached (no service, no compose)` } : planMethod(opts, dockerUsable);
+  const plan = {
+    mode,
+    method,
+    methodReason: reason,
+    docker,
+    ports: method === "compose" ? await resolveComposePorts({ api: opts.port, dashboard: opts.dashboardPort }, { persist: false }) : await resolvePorts(
+      {
+        api: opts.port ? Number(opts.port) : void 0,
+        dashboard: opts.dashboardPort ? Number(opts.dashboardPort) : void 0
+      },
+      { persist: false }
+    ),
+    ...opts.publicUrl ? { publicUrl: opts.publicUrl } : {},
+    writes: [],
+    runs: []
+  };
+  if (mode === "from-source") {
+    plan.fromSource = {
+      ref: opts.source ? "local" : (opts.ref || "main").trim(),
+      ...opts.source ? { sourceDir: opts.source } : { repo: opts.repo || DEFAULT_REPO }
+    };
+  }
+  if (method === "compose") {
+    const stack = composePlan({
+      apiPort: String(plan.ports.api),
+      dashboardPort: String(plan.ports.dashboard),
+      ...opts.publicUrl ? { publicUrl: opts.publicUrl } : {},
+      ...opts.trustProxy ? { trustProxy: true } : {},
+      ...opts.hostControl === false ? { noHostControl: true } : {},
+      ...opts.hostSshHost ? { hostSshHost: opts.hostSshHost } : {},
+      ...opts.hostSshPort ? { hostSshPort: opts.hostSshPort } : {},
+      ...opts.resetSecrets ? { resetSecrets: true } : {},
+      ...opts.mail ? { mail: true } : {}
+    });
+    plan.compose = stack;
+    if (process.platform === "linux") plan.edge = await previewHostEdge();
+    plan.writes.push(
+      stack.composeFile,
+      `${stack.envFile}${stack.newSecrets.length ? `  (generates ${stack.newSecrets.join(", ")})` : ""}`,
+      ...stack.buildFile ? [stack.buildFile] : [],
+      ...stack.hostChannel ? [
+        stack.hostChannel.keyPath,
+        `${stack.hostChannel.authKeysPath}${stack.hostChannel.viaSudo ? "  (via sudo)" : ""}  (authorizes that key for ${stack.hostChannel.user}'s host ops; --no-host-control skips it)`,
+        ...stack.hostChannel.rootUnavailable ? [
+          "\u26A0 host control needs root \u2014 this user isn't root and passwordless sudo isn't available, so mail/edge host ops will fail (re-run as root to fix)"
+        ] : []
+      ] : [],
+      ...stack.mountDirs.map((d) => `${d}/  (edge routing state + certs)`),
+      stack.installMethodFile
+    );
+    plan.runs.push(
+      stack.buildDir ? `docker compose pull postgres redis && docker compose build  (from ${stack.buildDir})` : `docker compose pull  (postgres, redis, api, dashboard, edge \u2014 several hundred MB)`,
+      `docker compose up -d  (the edge container binds host :80 and :443)`
+    );
+  } else {
+    plan.writes.push(PORTS_FILE, `${LOG_DIR}/`);
+    if (mode === "service") {
+      const svc = preview({
+        port: opts.port,
+        dataDir: opts.dataDir,
+        dashboardPort: opts.dashboardPort,
+        ui: opts.ui,
+        uiVersion: opts.uiVersion,
+        publicUrl: opts.publicUrl,
+        trustProxy: opts.trustProxy || opts.managedEdge,
+        host: opts.host,
+        managedEdge: opts.managedEdge,
+        acmeEmail: opts.acmeEmail,
+        mail: opts.mail
+      });
+      plan.service = svc;
+      if (svc.path) plan.writes.push(svc.path);
+      plan.runs.push(installStepFor(svc.kind));
+    }
+    plan.writes.push(
+      AUTH_SECRET_FILE,
+      INTERNAL_TOKEN_FILE,
+      `${opts.dataDir || DATA_DIR}/  (embedded Postgres)`
+    );
+    if (opts.ui !== false) {
+      plan.runs.push(`download the dashboard bundle \u2192 ${DASHBOARD_CACHE}  (--no-ui skips it)`);
+    }
+    if (mode === "from-source") {
+      const src = plan.fromSource;
+      plan.runs.unshift(
+        ...src.sourceDir ? [`build the checkout at ${src.sourceDir}`] : [`git clone/fetch ${src.repo} @ ${src.ref} \u2192 ${SOURCE_CHECKOUT_DIR}`],
+        `bun install + build the release dist \u2192 ${SOURCE_DIST_DIR}  (compiles the dashboard)`
+      );
+    }
+    if (opts.managedEdge) {
+      plan.runs.push(
+        "install OpenResty + issue a Let's Encrypt certificate on this box (--managed-edge)"
+      );
+    }
+    if (attached) {
+      plan.runs.push("run the API + dashboard attached to this terminal until Ctrl-C");
+    }
+  }
+  return plan;
+}
+function renderUpPlan(plan) {
+  const L = [];
+  const head = (s) => L.push("", chalk.bold(`  ${s}`));
+  const item = (s) => L.push(chalk.dim(`    ${s}`));
+  L.push(
+    "",
+    chalk.cyan("  Dry run \u2014 nothing on this machine has been changed."),
+    chalk.dim(`  ${methodLabel(plan)} \xB7 ${plan.methodReason}`)
+  );
+  head("Docker");
+  const { docker } = plan;
+  if (!docker.gap) {
+    item("already installed and usable \u2014 nothing to install.");
+  } else if (docker.wouldInstall) {
+    item(chalk.yellow(`${docker.gap.summary}. A real run WOULD install it:`));
+    item(`  ${docker.installCommand}`);
+    item("~150 MB of packages, and it enables the docker service on this box.");
+    if (plan.method === "compose") item("`openship up --bare` installs without Docker (embedded database).");
+  } else {
+    item(`${docker.gap.summary} \u2014 a real run would NOT install it.`);
+    if (docker.gap.hint) item(docker.gap.hint);
+  }
+  head("Ports");
+  item(
+    `API ${plan.ports.api} \xB7 dashboard ${plan.ports.dashboard}` + (plan.ports.switched.api || plan.ports.switched.dashboard ? `  (preferred ${plan.ports.preferred.api}/${plan.ports.preferred.dashboard} \u2014 busy right now)` : "")
+  );
+  if (plan.publicUrl) item(`public URL: ${plan.publicUrl}`);
+  if (plan.compose) {
+    head("Compose stack");
+    const { existing, newSecrets, secretRotation, pgDataRisk } = plan.compose;
+    item(
+      !existing ? "fresh install" : newSecrets.length === 0 ? "re-runs an existing install (secrets preserved)" : chalk.yellow(
+        `re-runs an existing install, but its .env no longer holds ${newSecrets.join(", ")} \u2014 a real run would GENERATE ${newSecrets.length > 1 ? "those" : "that"}, not preserve ${newSecrets.length > 1 ? "them" : "it"}.`
+      )
+    );
+    for (const { key, value } of plan.compose.settings) item(`${key}=${value}`);
+    if (secretRotation) {
+      L.push(chalk.yellow(renderSecretRotationRefusal(secretRotation, { dryRun: true })));
+    }
+    if (pgDataRisk) {
+      L.push(chalk.yellow(renderPgDataRefusal(pgDataRisk, { dryRun: true })));
+    }
+  }
+  if (plan.edge) {
+    head("Ports 80/443");
+    if (!plan.edge.blocked) {
+      item("free (or already Openship's edge) \u2014 the edge container binds them.");
+    } else {
+      item(chalk.yellow(`held by ${plan.edge.owner}.`));
+      item(
+        plan.edge.sites.length ? `A real run would ask before touching it: migrate its ${plan.edge.sites.length} site(s) into Openship's edge, take over (its sites stop serving), or cancel.` : "A real run would ask before stopping it (--edge=migrate|takeover|cancel)."
+      );
+      for (const site of plan.edge.sites.slice(0, 8)) {
+        item(`  \u2022 ${site.serverNames.join(", ") || "(no server_name)"}${site.ssl ? " [TLS]" : ""}`);
+      }
+      if (plan.edge.sites.length > 8) item(`  \u2022 \u2026and ${plan.edge.sites.length - 8} more`);
+    }
+  }
+  head("Would write");
+  for (const w of plan.writes) item(w);
+  if (plan.runs.length) {
+    head("Would run");
+    for (const r of plan.runs) item(r);
+  }
+  if (plan.service) {
+    head(`${plan.service.kind} definition (${plan.service.path})`);
+    L.push(plan.service.content.replace(/\n$/, ""));
+  }
+  if (plan.compose) {
+    head(`docker-compose.yml (${plan.compose.composeFile})`);
+    L.push(plan.compose.yaml.replace(/\n$/, ""));
+  }
+  L.push("", chalk.dim("  Re-run without --dry-run to apply this."), "");
+  return L.join("\n");
+}
+function methodLabel(plan) {
+  if (plan.mode === "from-source") return "Build from source and run attached";
+  if (plan.mode === "foreground") return "Run attached in this terminal";
+  return plan.method === "compose" ? "Install the Docker Compose stack" : `Install the ${serviceWord(plan.service?.kind)} service`;
+}
+function serviceWord(kind) {
+  switch (kind) {
+    case "launchd":
+      return "launchd";
+    case "systemd-user":
+      return "systemd (--user)";
+    case "systemd-system":
+      return "systemd (system)";
+    case "schtasks":
+      return "Scheduled Task";
+    default:
+      return "process";
+  }
+}
+
+// src/lib/loopback-api.ts
+import { existsSync as existsSync4, readFileSync as readFileSync3, mkdirSync as mkdirSync5, writeFileSync as writeFileSync4 } from "fs";
+import { randomBytes } from "crypto";
+function ensureInternalToken() {
+  const path = INTERNAL_TOKEN_FILE;
+  if (existsSync4(path)) return readFileSync3(path, "utf8").trim();
+  mkdirSync5(OS_DIR, { recursive: true, mode: 448 });
+  const token = randomBytes(32).toString("hex");
+  writeFileSync4(path, token, { mode: 384 });
+  return token;
+}
+async function internalGet(port, path, token) {
+  try {
+    const res = await fetch(`http://127.0.0.1:${port}${path}`, {
+      headers: { "X-Internal-Token": token ?? ensureInternalToken() },
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+async function internalPost(port, path, body, token) {
+  try {
+    const res = await fetch(`http://127.0.0.1:${port}${path}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "X-Internal-Token": token ?? ensureInternalToken() },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(3e4)
+    });
+    const data = await res.json().catch(() => ({}));
+    return { ok: res.ok, data };
+  } catch (err) {
+    return { ok: false, data: { error: err.message } };
+  }
+}
+async function bootstrapAdmin(apiPort, admin, token) {
+  const { ok, data } = await internalPost(apiPort, "/api/system/bootstrap-admin", admin, token);
+  if (ok) return { ok: true };
+  if (data?.error === "An admin account already exists") return { ok: true, message: "already-exists" };
+  return { ok: false, message: data?.error || "failed" };
+}
+async function waitHealthy(apiPort, seconds = 90) {
+  for (let i = 0; i < seconds; i++) {
+    await new Promise((r) => setTimeout(r, 1e3));
+    try {
+      await fetch(`http://127.0.0.1:${apiPort}/api/health`, { signal: AbortSignal.timeout(2e3) });
+      return true;
+    } catch {
+    }
+  }
+  return false;
+}
+async function waitDashboard(dashPort, seconds = 45) {
+  for (let i = 0; i < seconds; i++) {
+    await new Promise((r) => setTimeout(r, 1e3));
+    try {
+      const res = await fetch(`http://127.0.0.1:${dashPort}/`, {
+        redirect: "manual",
+        signal: AbortSignal.timeout(2e3)
+      });
+      if (res.status > 0) return true;
+    } catch {
+    }
+  }
+  return false;
+}
+async function detectPublicIp() {
+  for (const url of ["https://api.ipify.org", "https://ifconfig.me/ip"]) {
+    try {
+      const res = await fetch(url, { signal: AbortSignal.timeout(3e3) });
+      if (!res.ok) continue;
+      const ip = (await res.text()).trim();
+      if (/^[0-9.]+$/.test(ip) || ip.includes(":")) return ip;
+    } catch {
+    }
+  }
+  return null;
+}
+
+// src/lib/instance-provision.ts
+var HeadlessInputError = class extends Error {
+  code = "HEADLESS_INPUT";
+  constructor(message) {
+    super(message);
+    this.name = "HeadlessInputError";
+  }
+};
+var SLUG_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
+function hostOf(value) {
+  const raw = value?.trim();
+  if (!raw) return void 0;
+  try {
+    if (raw.includes("://")) return new URL(raw).hostname || void 0;
+  } catch {
+  }
+  return raw.replace(/^\/+/, "").split("/")[0]?.split(":")[0] || void 0;
+}
+function resolveInstallInputs(flags) {
+  const email = flags.adminEmail?.trim();
+  const password = flags.adminPassword ?? process.env.OPENSHIP_ADMIN_PASSWORD;
+  const name = flags.adminName?.trim() || (email ? email.split("@")[0] : "");
+  if (!email || !isValidEmail(email)) {
+    throw new HeadlessInputError("Missing/invalid --admin-email for a non-interactive install.");
+  }
+  if (!password || password.length < 8) {
+    throw new HeadlessInputError(
+      "Missing --admin-password (or OPENSHIP_ADMIN_PASSWORD env), min 8 chars, for a non-interactive install."
+    );
+  }
+  const admin = { name: name || "Admin", email, password };
+  const kindRaw = flags.domainKind?.trim().toLowerCase() || (flags.publicUrl ? "byo" : "none");
+  const hostname = flags.hostname?.trim() || hostOf(flags.publicUrl);
+  switch (kindRaw) {
+    case "none":
+      return { admin, domain: { kind: "none" } };
+    case "byo":
+      return { admin, domain: { kind: "byo", hostname } };
+    case "custom": {
+      if (!hostname) throw new HeadlessInputError("--domain-kind custom requires --hostname (or --public-url).");
+      const edge = flags.edge?.trim().toLowerCase() || "cancel";
+      if (!["migrate", "takeover", "cancel"].includes(edge)) {
+        throw new HeadlessInputError(`Invalid --edge "${flags.edge}" (expected migrate | takeover | cancel).`);
+      }
+      const acmeEmail = flags.acmeEmail?.trim() || email;
+      if (!isValidEmail(acmeEmail)) {
+        throw new HeadlessInputError(`Invalid --acme-email "${acmeEmail}" \u2014 Let's Encrypt rejects a malformed contact.`);
+      }
+      return { admin, domain: { kind: "custom", hostname, acmeEmail, edge } };
+    }
+    case "free": {
+      const slug = (flags.slug?.trim() || (hostname ? hostname.split(".")[0] : "")).toLowerCase();
+      if (!slug || !SLUG_RE.test(slug)) {
+        throw new HeadlessInputError("--domain-kind free requires a valid --slug (lowercase letters, digits, hyphens).");
+      }
+      return { admin, domain: { kind: "free", slug, publicHost: hostOf(flags.publicUrl) } };
+    }
+    default:
+      throw new HeadlessInputError(`Invalid --domain-kind "${flags.domainKind}" (expected byo | custom | free | none).`);
+  }
+}
+async function bootstrapOrReset(port, admin, token) {
+  const boot = await bootstrapAdmin(port, admin, token);
+  if (boot.ok && boot.message !== "already-exists") return { ok: true };
+  if (boot.ok && boot.message === "already-exists") {
+    const rr = await internalPost(
+      port,
+      "/api/system/reset-admin-password",
+      { password: admin.password, email: admin.email, name: admin.name },
+      token
+    );
+    return rr.ok ? { ok: true, message: "reset-existing" } : { ok: false, message: rr.data?.error || "reset failed" };
+  }
+  return { ok: false, message: boot.message || "bootstrap failed" };
+}
+async function drainProvisionStream(port, sessionId, token, onLog) {
+  let detail;
+  try {
+    const res = await fetch(`http://127.0.0.1:${port}/api/system/self-register/stream?id=${sessionId}`, {
+      headers: { "X-Internal-Token": token ?? ensureInternalToken() },
+      signal: AbortSignal.timeout(18e4)
+    });
+    if (!res.body) return { completed: false };
+    const reader = res.body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = "";
+    for (; ; ) {
+      const { value, done } = await reader.read();
+      if (done) break;
+      buffer += decoder.decode(value, { stream: true });
+      let sep;
+      while ((sep = buffer.indexOf("\n\n")) >= 0) {
+        const frame = buffer.slice(0, sep);
+        buffer = buffer.slice(sep + 2);
+        const event = /event:\s*(.*)/.exec(frame)?.[1]?.trim();
+        const dataRaw = /data:\s*([\s\S]*)/.exec(frame)?.[1]?.trim();
+        if (!event || !dataRaw) continue;
+        try {
+          const d = JSON.parse(dataRaw);
+          if (event === "log" && d.message) {
+            const msg = String(d.message).replace(/\s+/g, " ");
+            onLog?.(msg);
+            if (d.level === "warn" || d.level === "error") detail = msg;
+          } else if (event === "complete") {
+            return { completed: d.status === "completed", detail };
+          } else if (event === "end") {
+            return { completed: true, detail };
+          }
+        } catch {
+        }
+      }
+    }
+  } catch {
+  }
+  return { completed: false, detail };
+}
+function isSlugTaken(data) {
+  const body = data;
+  if (body?.code === "slug_taken") return true;
+  return /already taken|slug_taken/i.test(body?.error ?? "");
+}
+async function headlessProvision(opts) {
+  const { port, inputs, token } = opts;
+  const log = opts.onLog ?? (() => {
+  });
+  const warnings = [];
+  log("Waiting for the API to become healthy\u2026");
+  if (!await waitHealthy(port)) {
+    throw new HeadlessInputError("The API did not become healthy in time \u2014 check `openship logs`.");
+  }
+  log("Creating the admin account\u2026");
+  const admin = await bootstrapOrReset(port, inputs.admin, token);
+  if (!admin.ok) throw new HeadlessInputError(`Could not create the admin account: ${admin.message}`);
+  const dashPort = opts.dashPort ? Number(opts.dashPort) : void 0;
+  const d = inputs.domain;
+  let liveUrl;
+  let domainRegistered = false;
+  log(`Registering domain (${d.kind})\u2026`);
+  if (d.kind === "none") {
+    await internalPost(port, "/api/system/self-register", { domainType: "byo" }, token);
+    domainRegistered = true;
+  } else if (d.kind === "byo") {
+    const res = await internalPost(
+      port,
+      "/api/system/self-register",
+      { domainType: "byo", ...d.hostname ? { hostname: d.hostname } : {} },
+      token
+    );
+    domainRegistered = res.ok;
+    liveUrl = res.data?.url ?? (d.hostname ? `https://${d.hostname}` : void 0);
+    if (!res.ok) warnings.push(`Domain registration returned: ${res.data?.error || "failed"}`);
+  } else if (d.kind === "custom") {
+    const res = await internalPost(
+      port,
+      "/api/system/self-register",
+      {
+        domainType: "custom",
+        hostname: d.hostname,
+        dashPort,
+        acmeEmail: d.acmeEmail,
+        edgeTakeover: d.edge === "takeover",
+        edgeMigrate: d.edge === "migrate"
+      },
+      token
+    );
+    domainRegistered = res.ok;
+    liveUrl = res.data?.url ?? `https://${d.hostname}`;
+    if (res.ok && res.data?.sessionId) {
+      log("Issuing HTTPS certificate (Let's Encrypt) \u2014 best-effort\u2026");
+      const cert = await drainProvisionStream(
+        port,
+        String(res.data.sessionId),
+        token,
+        (m) => log(`  ${m}`)
+      );
+      if (!cert.completed) {
+        warnings.push(
+          cert.detail ? `HTTPS certificate not issued yet: ${cert.detail}` : "HTTPS certificate not issued yet \u2014 it retries in the background and on the next boot."
+        );
+      }
+    } else if (!res.ok) {
+      warnings.push(`Custom domain provisioning returned: ${res.data?.error || "failed"}`);
+    }
+  } else {
+    const freeBody = (s) => ({
+      domainType: "free",
+      slug: s,
+      publicHost: d.publicHost,
+      dashPort,
+      localEdge: d.localEdge,
+      edgeTakeover: d.edgeTakeover,
+      edgeMigrate: d.edgeMigrate,
+      ...d.staticRootOverrides ? { staticRootOverrides: d.staticRootOverrides } : {}
+    });
+    let slug = d.slug;
+    let res = await internalPost(port, "/api/system/self-register", freeBody(slug), token);
+    for (let attempt = 0; !res.ok && isSlugTaken(res.data) && opts.onSlugTaken && attempt < 5; attempt++) {
+      const next = await opts.onSlugTaken(slug);
+      if (!next) break;
+      slug = next;
+      res = await internalPost(port, "/api/system/self-register", freeBody(slug), token);
+    }
+    domainRegistered = res.ok;
+    liveUrl = res.data?.url;
+    if (res.ok && res.data?.sessionId) {
+      const edge = await drainProvisionStream(port, String(res.data.sessionId), token, (m) => log(`  ${m}`));
+      if (!edge.completed && edge.detail) {
+        warnings.push(`Local edge not fully ready: ${edge.detail} \u2014 it retries on next boot.`);
+      }
+    }
+    if (!res.ok) {
+      warnings.push(
+        isSlugTaken(res.data) ? `Free domain not created: "${slug}.opsh.io" is already taken. Re-run and choose a different subdomain, or add one later in Settings \u2192 Domains.` : `Free .opsh.io domain not registered: ${res.data?.error || "failed"}. A free domain needs the box connected to Openship Cloud \u2014 connect it in Settings \u2192 Cloud, or use --domain-kind byo/custom.`
+      );
+    }
+  }
+  return { adminReady: true, domainRegistered, liveUrl, warnings };
+}
+
+// src/commands/up.ts
+var EDGE_ACTIONS = ["migrate", "takeover", "cancel"];
+function normalizeUrl(raw) {
+  const value = /^https?:\/\//i.test(raw) ? raw : `https://${raw}`;
+  try {
+    const u = new URL(value);
+    return `${u.protocol}//${u.host}`;
+  } catch {
+    return null;
+  }
+}
+function effectivePublicUrl(flag) {
+  if (flag) return normalizePublicUrl(flag);
+  const saved = readInstanceUrl();
+  if (!saved || /^https?:\/\/(localhost|127\.|\[?::1\]?)([:/]|$)/i.test(saved)) return void 0;
+  return normalizePublicUrl(saved);
+}
+function normalizePublicUrl(raw) {
+  const url = normalizeUrl(raw);
+  if (!url) {
+    console.error(
+      chalk2.red(`
+  Invalid --public-url: ${raw}`) + chalk2.dim("\n  Expected something like https://ops.example.com\n")
+    );
+    process.exit(1);
+  }
+  return url;
+}
+var DIST_DIR = dirname2(fileURLToPath(import.meta.url));
+var SERVER_DIR = join5(DIST_DIR, "server");
+function ensureAuthSecret() {
+  const path = AUTH_SECRET_FILE;
+  if (existsSync5(path)) return readFileSync4(path, "utf8").trim();
+  mkdirSync6(OS_DIR, { recursive: true, mode: 448 });
+  const secret = randomBytes2(32).toString("hex");
+  writeFileSync5(path, secret, { mode: 384 });
+  return secret;
+}
+var upCommand = new Command("up").description("Start Openship as a persistent service (boot + auto-restart); --foreground to run attached").option("--port <port>", "API port to listen on (default: 4000, or the next free port if it's taken)").option("--data-dir <dir>", "Directory for the embedded database").option("--dashboard-port <port>", "Dashboard port (default: 3001, or the next free port if it's taken)").option("--no-ui", "Run the API only \u2014 don't download/serve the dashboard").option("--ui-version <tag>", "Dashboard release tag to run (default: this CLI's version)").option(
+  "--image-version <tag>",
+  "Compose mode: image tag to pull for api/dashboard/edge (default: this CLI's version, or the OPENSHIP_VERSION env var). Use a known-good tag if a release's images aren't in the registry yet."
+).option("-f, --foreground", "Run attached in this terminal instead of as a background service").option(
+  "--dry-run",
+  "Preview only: print what `up` would install (method, ports, files, commands, the service definition / compose file) and exit WITHOUT changing this machine"
+).option(
+  "--public-url <url>",
+  "Serve remotely at this public URL (VPS): binds the dashboard to all interfaces, proxies the API same-origin, and requires login"
+).option(
+  "--trust-proxy",
+  "Trust the X-Real-IP set by a reverse proxy in front (the proxy MUST overwrite X-Real-IP with the real client IP, e.g. `proxy_set_header X-Real-IP $remote_addr`, and the app port MUST be firewalled so only the proxy can reach it; enables per-client rate limiting)"
+).option(
+  "--host <addr>",
+  "Bind the dashboard to this interface so an upstream reverse proxy (or another LAN host) can reach it \u2014 e.g. 0.0.0.0 or a LAN IP like 192.168.1.50. Default 127.0.0.1. The API stays on loopback (the dashboard proxies to it). A concrete IP auto-trusts that browser origin for login; for 0.0.0.0 or a domain also pass --public-url (or set OPENSHIP_EXTRA_TRUSTED_ORIGINS) so login isn't rejected."
+).option(
+  "--managed-edge",
+  "Managed edge: install OpenResty + a free Let's Encrypt cert on this box and route --public-url's domain to the dashboard (no reverse proxy needed)"
+).option("--acme-email <email>", "Contact email for Let's Encrypt certificates (managed edge)").option("--from-source", "Preview: build + run Openship from source (a branch) instead of a published release \u2014 runs attached").option("--ref <branch>", "Git branch/tag/sha to build with --from-source (default: main)").option("--source <path>", "Build from an existing local Openship checkout instead of cloning").option("--repo <url>", "Git remote to clone for --from-source (default: oblien/openship)").option("--compose", "Install via Docker Compose using the published images (postgres + redis + api + dashboard + edge on :80/:443). Default when Docker is available on Linux.").option("--bare", "Install as the bare process service (embedded DB, no Docker) instead of Compose").option(
+  "--mail",
+  "Install as Openship Mail: the dashboard opens on the mail control plane (mail servers, domains, mailboxes) instead of the full platform. Same install, same binary \u2014 a default shell, not a restriction. Anyone can switch back under Settings \u2192 General, and an admin can change the box-wide default under Settings \u2192 Instance."
+).option(
+  "--no-host-control",
+  "Harden: don't give the control plane a channel to this machine's OS. No host SSH key is generated or mounted, host operations refuse, and this box stops being offered as a deploy target. Recommended when this box only manages REMOTE servers \u2014 it loses :80/:443 takeover, the host terminal and host port scans. The Docker socket is still mounted (deployments need it), so this is defense in depth, not isolation."
+).option(
+  "--host-ssh-host <addr>",
+  "Compose mode: address the api container dials for host operations (default host.docker.internal, mapped to the docker host-gateway). Set this to the box's own LAN/bridge address when host-gateway doesn't reach the host \u2014 notably under rootless Docker. Preserved across re-runs."
+).option(
+  "--host-ssh-port <port>",
+  "Compose mode: port the host's sshd listens on for host operations (default 22). Preserved across re-runs."
+).option(
+  "--open-host-firewall",
+  "Compose mode: if the api container can't reach this machine's SSH port, add the host firewall rule that allows it (scoped to the container subnet, ufw/firewalld only). Without this the blocked channel is reported and left alone. Not implied by --yes."
+).option("--edge <action>", "Compose mode: how to handle an existing proxy on :80/:443 \u2014 'migrate' (import its sites into Openship's edge), 'takeover' (stop it; its sites stop serving), or 'cancel'. Default: prompt when interactive, else cancel.").option(
+  "--reset-secrets",
+  "Compose mode: generate new secrets even though this install's data volume still exists. `up` normally refuses, because the database keeps the password it was created with and every stored environment variable was encrypted with the old BETTER_AUTH_SECRET \u2014 the password gets realigned, those variables do not. Use only when the original .env is genuinely gone."
+).option("--non-interactive", "Headless install: after the service starts, create the admin + register the domain from the flags below (no prompts). Alias: --yes.").option("--yes", "Alias for --non-interactive.").option("--admin-name <name>", "Admin display name (headless install)").option("--admin-email <email>", "Admin email \u2014 required for a headless install").option("--admin-password <password>", "Admin password (min 8). Prefer the OPENSHIP_ADMIN_PASSWORD env var to keep it out of shell history.").option("--domain-kind <kind>", "Headless install domain: byo | custom | free | none (default: byo if --public-url set, else none)").option("--hostname <host>", "Domain/hostname for --domain-kind byo|custom (or derived from --public-url)").option("--slug <slug>", "Free .opsh.io subdomain for --domain-kind free (box must already be Cloud-connected)").action(async (opts) => {
+  if (opts.dryRun) {
+    console.log(renderUpPlan(await planUp({ ...opts, publicUrl: effectivePublicUrl(opts.publicUrl) })));
+    return;
+  }
+  if (opts.fromSource || opts.source) return runFromSource(opts);
+  if (opts.foreground) return runForeground(opts);
+  const headless = !!(opts.nonInteractive || opts.yes);
+  const needsDocker = !opts.bare && (Boolean(opts.compose) || process.platform === "linux");
+  const dockerUsable = needsDocker ? await ensureDocker() : false;
+  const { method } = planMethod(opts, dockerUsable);
+  if (method === "compose" && !dockerUsable) {
+    console.error(
+      chalk2.red("\n  --compose needs Docker + docker compose, and they couldn't be installed automatically.") + chalk2.dim(
+        "\n  Install Docker (https://docs.docker.com/engine/install/) and re-run, or use --bare.\n"
+      )
+    );
+    process.exit(1);
+  }
+  if (method === "compose") {
+    const started2 = await runCompose(opts);
+    if (headless) {
+      const token = composeInternalToken();
+      if (!token) {
+        console.warn(
+          chalk2.yellow(
+            "\n  Couldn't read the stack's internal token (compose/.env) \u2014 create the admin from the dashboard.\n"
+          )
+        );
+      } else {
+        await runHeadlessProvision(
+          opts,
+          { port: started2.apiPort, dashPort: started2.dashPort },
+          { token, method: "compose" }
+        );
+      }
+    }
+    return;
+  }
+  const started = await startService(opts);
+  if (headless) await runHeadlessProvision(opts, started, { method: "bare" });
+});
+async function runHeadlessProvision(opts, started, extra) {
+  let inputs;
+  try {
+    inputs = resolveInstallInputs({
+      adminName: opts.adminName,
+      adminEmail: opts.adminEmail,
+      adminPassword: opts.adminPassword,
+      domainKind: opts.domainKind,
+      hostname: opts.hostname,
+      slug: opts.slug,
+      publicUrl: opts.publicUrl,
+      acmeEmail: opts.acmeEmail,
+      edge: opts.edge
+    });
+  } catch (err) {
+    if (err instanceof HeadlessInputError) {
+      console.error(chalk2.red(`
+  ${err.message}
+`));
+      process.exit(1);
+    }
+    throw err;
+  }
+  try {
+    const result = await headlessProvision({
+      port: started.port,
+      dashPort: started.dashPort,
+      inputs,
+      token: extra?.token,
+      method: extra?.method,
+      onLog: (m) => console.log(chalk2.dim(`  ${m}`))
+    });
+    console.log(chalk2.green(`
+  \u2713 Openship provisioned${result.liveUrl ? `: ${result.liveUrl}` : "."}`));
+    for (const w of result.warnings) console.warn(chalk2.yellow(`  \u26A0 ${w}`));
+  } catch (err) {
+    console.error(chalk2.red(`
+  Headless provisioning failed: ${err.message}
+`));
+    process.exit(1);
+  }
+}
+async function runCompose(opts) {
+  const headless = !!(opts.nonInteractive || opts.yes);
+  if (!hasDockerCompose()) {
+    console.error(
+      chalk2.red("\n  Docker + `docker compose` are required for the Compose install.\n") + chalk2.dim("  Install Docker, or run `openship up --bare` for the process mode.\n")
+    );
+    process.exit(1);
+  }
+  if (opts.edge && !EDGE_ACTIONS.includes(opts.edge)) {
+    console.error(
+      chalk2.red(`
+  Invalid --edge value: ${opts.edge}`) + chalk2.dim(`
+  Expected one of: ${EDGE_ACTIONS.join(", ")}
+`)
+    );
+    process.exit(1);
+  }
+  const publicUrl = effectivePublicUrl(opts.publicUrl);
+  const ports = await resolveComposePorts({ api: opts.port, dashboard: opts.dashboardPort });
+  const apiPort = String(ports.api);
+  const dashboardPort = String(ports.dashboard);
+  const portNotice = portMoveNotice(ports, [...composeTrustedOriginUrls(), publicUrl]);
+  if (portNotice.length) {
+    console.log("\n" + portNotice.map((l) => chalk2.yellow(`  ${l}`)).join("\n"));
+  }
+  if (!pinnedImagesReady({ version: opts.imageVersion })) process.exit(1);
+  const rotation = composeSecretRotationRisk({ resetSecrets: opts.resetSecrets });
+  if (rotation) {
+    console.error(chalk2.yellow(renderSecretRotationRefusal(rotation)));
+    process.exit(1);
+  }
+  const pgData = composePgDataRisk({ resetSecrets: opts.resetSecrets });
+  if (pgData) {
+    console.error(chalk2.yellow(renderPgDataRefusal(pgData)));
+    process.exit(1);
+  }
+  const prefetch = ora(
+    sourceBuildDir() ? "Building images before touching :80/:443\u2026" : "Pulling images before touching :80/:443\u2026"
+  ).start();
+  const fetched = composePrefetch({
+    apiPort,
+    dashboardPort,
+    publicUrl,
+    version: opts.imageVersion,
+    trustProxy: opts.trustProxy,
+    noHostControl: opts.hostControl === false ? true : void 0,
+    // The prefetch writes the same `.env` `composeUp` will, so every knob has to be
+    // given to BOTH. A knob passed only to `composeUp` would change `.env` after the
+    // recreate decision was already taken here (see ComposePrefetchResult.envChanged),
+    // so the containers would keep an environment the file no longer shows.
+    hostSshHost: opts.hostSshHost,
+    hostSshPort: opts.hostSshPort,
+    resetSecrets: opts.resetSecrets,
+    mail: opts.mail
+  });
+  if (!fetched.ok) {
+    prefetch.fail("Couldn't fetch the stack's images \u2014 nothing was changed on this box.");
+    console.error(
+      chalk2.dim("\n  Your current proxy is untouched and still serving. Fix the pull/build error above and re-run.\n")
+    );
+    process.exit(1);
+  }
+  prefetch.succeed("Images ready \u2014 nothing on :80/:443 has changed yet.");
+  let edgePlan;
+  try {
+    edgePlan = await planAndApplyHostEdge({ edge: opts.edge });
+  } catch (e) {
+    console.error(
+      chalk2.red(`
+  Edge preflight failed: ${e.message}
+`) + chalk2.dim("  Re-run, or pass --edge=cancel to skip taking over :80/:443.\n")
+    );
+    process.exit(1);
+  }
+  if (!edgePlan.proceed) {
+    console.log(
+      edgePlan.blockedBy ? chalk2.red(`
+  Can't take over the edge: ${edgePlan.blockedBy}.
+`) + chalk2.dim("  Find what else is bound to those ports (`ss -ltnp | grep -E ':80|:443'`), then re-run.\n") : chalk2.yellow("\n  Left the existing proxy on :80/:443 running \u2014 not starting the stack.\n") + chalk2.dim("  Re-run and choose migrate / take-over (or pass --edge=migrate|takeover) when ready.\n")
+    );
+    process.exit(1);
+  }
+  const fromSource = sourceBuildDir();
+  const spinner = ora(
+    fromSource ? `Building Openship from ${fromSource} and starting the stack\u2026` : "Starting Openship via Docker Compose\u2026"
+  ).start();
+  const res = await composeUp({
+    // Prefetched above, before the preflight stopped anything.
+    alreadyFetched: true,
+    // ...which also means the prefetch's materialize is the only one that could still
+    // see what the running containers were created with. Passing its verdict is what
+    // makes a changed `.env` reach them (see ComposePrefetchResult.envChanged).
+    envChanged: fetched.envChanged,
+    apiPort,
+    dashboardPort,
+    publicUrl,
+    version: opts.imageVersion,
+    trustProxy: opts.trustProxy,
+    // commander maps `--no-host-control` to hostControl === false. `undefined` when
+    // the flag is absent, so a plain re-run keeps the install's original choice
+    // instead of silently re-granting host control (see resolveEnvConfig).
+    noHostControl: opts.hostControl === false ? true : void 0,
+    // Absent on a plain re-run, so `keepConfig` carries whatever the install was
+    // configured with rather than resetting it to host.docker.internal:22.
+    hostSshHost: opts.hostSshHost,
+    hostSshPort: opts.hostSshPort,
+    resetSecrets: opts.resetSecrets,
+    // Absent on a re-run keeps the install's mode (resolveEnvConfig), so this
+    // never flips a mail box back to the platform shell.
+    mail: opts.mail
+  });
+  if (!res.ok) {
+    spinner.fail("docker compose failed to start the stack");
+    const restored = edgePlan.action ? await rollbackHostEdge() : false;
+    console.error(
+      chalk2.dim("\n  Check `docker compose -f ~/.openship/compose/docker-compose.yml logs`.\n") + (restored ? chalk2.yellow("  Restored the previous proxy on :80/:443 \u2014 your sites are serving again.\n") : chalk2.dim("  If ports 80/443 are held by another proxy, re-run \u2014 the preflight will offer to migrate or take over.\n"))
+    );
+    process.exit(1);
+  }
+  spinner.succeed("Openship is running via Docker Compose.");
+  if (edgePlan.action && await edgeIsBroken(new LocalExecutor())) {
+    const reason = await edgeCrashReason(new LocalExecutor());
+    console.error(
+      chalk2.red(`
+  Openship's edge container is not running${reason ? ` \u2014 ${reason}` : "."}`)
+    );
+    const restored = await rollbackHostEdge();
+    const back = startUnitHint("nginx");
+    console.error(
+      restored ? chalk2.yellow(
+        `  Your previous proxy has been restarted \u2014 the box is serving again, on it.
+  Nothing was migrated. Fix the cause above, then re-run \`openship up\`.
+`
+      ) : chalk2.red(
+        `  AND your previous proxy could NOT be restarted automatically \u2014 the box is
+  serving nothing right now. Start it by hand:
+` + (back ? `    docker stop ${EDGE_CONTAINER_NAME} && ${back}
+` : `    stop ${EDGE_CONTAINER_NAME} and start your proxy the way this host starts services
+`)
+      )
+    );
+    process.exit(1);
+  }
+  let importedOk = true;
+  if (edgePlan.action === "migrate" && edgePlan.sites?.length) {
+    const outcome = await importMigratedSites(
+      res.apiPort,
+      edgePlan.sites,
+      edgePlan.certPems,
+      edgePlan.staticRootOverrides
+    );
+    importedOk = outcome.registered.length > 0;
+    if (importedOk) markStoppedProxyImported();
+  }
+  if (edgePlan.action && importedOk) await completeHostEdge();
+  await verifyHostChannel({ openFirewall: opts.openHostFirewall }).catch(() => {
+  });
+  const dashboardUrl = publicUrl ?? `http://localhost:${res.dashPort}`;
+  console.log(
+    chalk2.dim(`  Dashboard: ${dashboardUrl}  (login required)
+`) + chalk2.dim("  Images:    api + dashboard + edge (OpenResty on :80/:443)\n") + chalk2.dim("  Manage:    openship stop \xB7 openship update \xB7 openship status\n") + // In headless mode the admin is bootstrapped below — don't tell the user to do it by hand.
+    (headless ? "" : chalk2.dim("  Create an admin: open the dashboard and register the first account.\n"))
+  );
+  return { apiPort: res.apiPort, dashPort: res.dashPort };
+}
+async function runFromSource(opts) {
+  console.log(chalk2.cyan("\n  Building Openship from source (preview mode)\u2026"));
+  console.log(
+    chalk2.dim("  Unverified dev build \u2014 for previewing a branch, not production self-hosting.\n")
+  );
+  let src;
+  try {
+    src = await prepareFromSource({ ref: opts.ref, source: opts.source, repo: opts.repo });
+  } catch (e) {
+    console.error(
+      chalk2.red(`
+  Build from source failed: ${e.message}
+`) + chalk2.dim("  Small boxes can OOM on the dashboard build \u2014 build on a bigger machine and pass --source, or use a published release.\n")
+    );
+    process.exit(1);
+  }
+  console.log(chalk2.green(`
+  Built ${src.ref} (${src.sha}). Starting\u2026
+`));
+  await runForeground(opts, src);
+}
+async function startService(opts, runOpts = {}) {
+  const publicUrl = effectivePublicUrl(opts.publicUrl);
+  const resolved = await resolvePorts({
+    api: opts.port ? Number(opts.port) : void 0,
+    dashboard: opts.dashboardPort ? Number(opts.dashboardPort) : void 0
+  });
+  const port = String(resolved.api);
+  const dashPort = String(resolved.dashboard);
+  const flags = {
+    port,
+    dataDir: opts.dataDir,
+    dashboardPort: dashPort,
+    ui: opts.ui,
+    uiVersion: opts.uiVersion,
+    publicUrl,
+    trustProxy: opts.trustProxy || opts.managedEdge,
+    // managed edge = OpenResty sets XFF
+    host: opts.host,
+    managedEdge: opts.managedEdge,
+    acmeEmail: opts.acmeEmail,
+    mail: opts.mail
+  };
+  try {
+    const res = installAndStart(flags);
+    if (!runOpts.quiet) {
+      const portNotice = portMoveNotice(resolved, [publicUrl]);
+      if (portNotice.length) {
+        console.log("\n" + portNotice.map((l) => chalk2.yellow(`  ${l}`)).join("\n"));
+      }
+      const dashboardLine = publicUrl ? chalk2.dim(`  Dashboard: ${publicUrl}  (login required)
+`) : chalk2.dim(`  Dashboard: http://localhost:${dashPort}  (login required)
+`);
+      console.log(
+        chalk2.green("\n  \u2714 Openship is running as a service.\n") + (opts.ui !== false ? dashboardLine : "") + (publicUrl ? chalk2.dim("  API is proxied through the dashboard (not exposed). Point your reverse proxy / DNS at the dashboard port.\n") : chalk2.dim(`  API:       http://localhost:${port}/api
+`)) + chalk2.dim(`  ${res.detail}
+`) + chalk2.dim("  Starts on boot and auto-restarts. Stop with `openship stop`.\n")
+      );
+    }
+    return { port, dashPort, publicUrl };
+  } catch (e) {
+    if (runOpts.quiet) throw e;
+    console.error(
+      chalk2.red(`
+  Couldn't install the service: ${e.message}
+`) + chalk2.dim("  Run `openship up --foreground` to run it attached instead.\n")
+    );
+    process.exit(1);
+  }
+}
+async function runForeground(opts, source) {
+  let apiCmd = process.execPath;
+  let apiArgs;
+  let apiCwd;
+  if (source) {
+    apiCmd = "bun";
+    apiArgs = ["run", "src/index.ts"];
+    apiCwd = source.apiDir;
+  } else {
+    const serverEntry = join5(SERVER_DIR, "index.js");
+    if (!existsSync5(serverEntry)) {
+      console.error(
+        chalk2.red("\n  Bundled server not found in this install.") + chalk2.dim("\n  Reinstall with `openship update` (or `npm i -g openship`).\n")
+      );
+      process.exit(1);
+    }
+    apiArgs = [serverEntry];
+  }
+  const resolved = await resolvePorts({
+    api: opts.port ? Number(opts.port) : void 0,
+    dashboard: opts.dashboardPort ? Number(opts.dashboardPort) : void 0
+  });
+  const port = String(resolved.api);
+  const dashPort = String(resolved.dashboard);
+  const publicUrl = effectivePublicUrl(opts.publicUrl);
+  const managedEdge = Boolean(opts.managedEdge && publicUrl);
+  const dataDir = opts.dataDir || DATA_DIR;
+  mkdirSync6(dataDir, { recursive: true });
+  mkdirSync6(LOG_DIR, { recursive: true });
+  const instanceLogPath = join5(LOG_DIR, "instance.log");
+  const instanceLog = createWriteStream2(instanceLogPath, { flags: "w" });
+  const env = {
+    ...process.env,
+    PORT: port,
+    NODE_ENV: "production",
+    // BARE, not "desktop". This box is a server-host: openship runs ON it and it
+    // is itself a deploy target. Claiming "desktop" (once done here just to get
+    // the in-process job runner) made the API report `isServerHost: false`
+    // (health.routes.ts), so `registerSelfServerReconcile` — gated on
+    // modes:["selfhosted"] — never ran, "This Server" was never registered, and
+    // the deploy wizard offered Openship Cloud as the only target on a box the
+    // operator had just installed on purpose.
+    //
+    // It also mislabelled the security posture: DEPLOY_MODE=desktop relaxes the
+    // zero-auth gate and makes INTERNAL_TOKEN optional. "desktop" belongs to
+    // Electron alone (apps/desktop/src/main/services.ts:361) — the only launcher
+    // that is genuinely a single-user loopback app.
+    //
+    // The job runner is unaffected: it picks BullMQ vs in-process by REDIS
+    // REACHABILITY (app.ts:238), and OPENSHIP_JOB_RUNNER below already pins it.
+    DEPLOY_MODE: "bare",
+    OPENSHIP_TARGET: "local",
+    OPENSHIP_JOB_RUNNER: "in-process",
+    PGLITE_DATA_DIR: dataDir,
+    BETTER_AUTH_SECRET: ensureAuthSecret()
+  };
+  if (!source) {
+    env.OPENSHIP_MIGRATIONS_DIR = join5(SERVER_DIR, "migrations");
+    env.OPENSHIP_PGLITE_ASSETS_DIR = join5(SERVER_DIR, "pglite");
+    const engineDir = join5(SERVER_DIR, "engine");
+    if (existsSync5(engineDir)) env.MAIL_SERVER_ENGINE_DIR = engineDir;
+  }
+  env.OPENSHIP_REQUIRE_AUTH = "true";
+  env.INTERNAL_TOKEN = ensureInternalToken();
+  if (opts.mail) env.OPENSHIP_PRODUCT = "mail";
+  if (!env.OPENSHIP_AUTH_MODE) env.OPENSHIP_AUTH_MODE = "local";
+  env.OPENSHIP_API_HOST = "127.0.0.1";
+  env.OPENSHIP_DASHBOARD_PORT = dashPort;
+  env.OPENSHIP_INSTANCE_LOG = instanceLogPath;
+  delete env.OPENSHIP_ALLOW_ZERO_AUTH;
+  if (publicUrl) {
+    env.OPENSHIP_PUBLIC_URL = publicUrl;
+  } else if (opts.host && !/^(0\.0\.0\.0|127\.|::1?$|localhost$)/i.test(opts.host.trim())) {
+    env.OPENSHIP_EXTRA_TRUSTED_ORIGINS = `http://${opts.host.trim()}:${dashPort}`;
+  }
+  if (opts.trustProxy || managedEdge) env.TRUST_PROXY = "true";
+  if (managedEdge) {
+    env.OPENSHIP_MANAGED_EDGE = "true";
+    env.OPENSHIP_DASHBOARD_PORT = dashPort;
+    if (opts.acmeEmail) env.OPENSHIP_ACME_EMAIL = opts.acmeEmail;
+  }
+  delete env.DATABASE_URL;
+  delete env.POSTGRES_URL;
+  const spinner = ora(`Starting Openship on http://localhost:${port} \u2026`).start();
+  const child = spawn(apiCmd, apiArgs, {
+    cwd: apiCwd,
+    env,
+    stdio: ["ignore", "pipe", "pipe"],
+    detached: process.platform !== "win32"
+  });
+  child.stdout.on("data", (d) => instanceLog.write(d));
+  child.stderr.on("data", (d) => instanceLog.write(d));
+  let buffered = "";
+  const buffer = (d) => {
+    buffered += d.toString();
+  };
+  child.stdout.on("data", buffer);
+  child.stderr.on("data", buffer);
+  child.on("exit", (code) => {
+    if (code && code !== 0) {
+      spinner.fail(`Openship server exited (code ${code})`);
+      process.stderr.write(buffered.slice(-2e3));
+      process.exit(code);
+    }
+  });
+  const healthUrl = `http://127.0.0.1:${port}/api/health`;
+  let healthy = false;
+  for (let i = 0; i < 60 && child.exitCode === null; i++) {
+    await new Promise((r) => setTimeout(r, 1e3));
+    try {
+      const res = await fetch(healthUrl, { signal: AbortSignal.timeout(2e3) });
+      if (res.ok) {
+        healthy = true;
+        break;
+      }
+    } catch {
+    }
+  }
+  if (!healthy) {
+    spinner.fail("Openship did not become healthy in time");
+    process.stderr.write(buffered.slice(-2e3));
+    child.kill("SIGTERM");
+    process.exit(1);
+  }
+  spinner.succeed(`Openship API running at http://localhost:${port}`);
+  const children = [child];
+  const killTree = (c, sig) => {
+    try {
+      if (c.pid && process.platform !== "win32") process.kill(-c.pid, sig);
+      else c.kill(sig);
+    } catch {
+    }
+  };
+  let stopping = false;
+  const stopAll = (exitCode = 0) => {
+    if (stopping) return;
+    stopping = true;
+    try {
+      instanceLog.end();
+    } catch {
+    }
+    for (const c of children) killTree(c, "SIGTERM");
+    setTimeout(() => {
+      for (const c of children) killTree(c, "SIGKILL");
+      process.exit(exitCode);
+    }, 1500);
+  };
+  let dashboardUrl = null;
+  if (opts.ui !== false) {
+    if (source) process.env.OPENSHIP_DASHBOARD_DIR = source.dashboardDir;
+    const uiSpinner = ora("Preparing the dashboard\u2026").start();
+    try {
+      const bundle = await ensureDashboard({
+        tag: source ? "local" : opts.uiVersion || `v${"0.6.5"}`,
+        onProgress: (received, total) => {
+          if (total) {
+            uiSpinner.text = `Downloading dashboard\u2026 ${Math.round(received / total * 100)}%`;
+          }
+        }
+      });
+      uiSpinner.text = "Starting the dashboard\u2026";
+      const dash = spawn(process.execPath, [bundle.entry], {
+        cwd: bundle.cwd,
+        detached: process.platform !== "win32",
+        env: {
+          ...process.env,
+          NODE_ENV: "production",
+          OPENSHIP_TARGET: "local",
+          PORT: dashPort,
+          // Reachable remotely when public; loopback-only otherwise. Under
+          // managed edge the local OpenResty fronts the dashboard, so it stays
+          // on loopback even though there's a public URL.
+          HOSTNAME: opts.host?.trim() || (publicUrl && !managedEdge ? "0.0.0.0" : "127.0.0.1"),
+          // The dashboard's same-origin proxy (NEXT_PUBLIC_API_PROXY, baked
+          // into the release build) forwards /api/proxy/* to this address, so
+          // the browser never needs to know where the API lives. Set in every
+          // mode; loopback because the dashboard runs on the same box.
+          INTERNAL_API_URL: `http://127.0.0.1:${port}`,
+          // ALWAYS tell the dashboard the real loopback API origin. The API port
+          // is dynamic, so a browser opened on THIS box must learn it via
+          // window.__OPENSHIP_API_ORIGIN__ (layout.tsx) — otherwise it falls back
+          // to the static default :4000 and every call 404s. Use `localhost` (NOT
+          // 127.0.0.1) to MATCH the host the dashboard is opened on — a host-only
+          // SameSite session cookie set on 127.0.0.1 is never sent to localhost
+          // (they're different sites to a browser), which is the login-reload loop.
+          // Older dashboards use this origin verbatim; newer ones align it anyway.
+          // `localhost` still reaches the 127.0.0.1-bound API. In proxy mode this
+          // is just a fallback (sameOriginProxyOrigin wins for remote browsers).
+          OPENSHIP_LOCAL_API_URL: `http://localhost:${port}`,
+          ...publicUrl ? { OPENSHIP_PUBLIC_URL: publicUrl } : {}
+        },
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      children.push(dash);
+      dash.stdout.on("data", (d) => instanceLog.write(d));
+      dash.stderr.on("data", (d) => instanceLog.write(d));
+      let dashBuf = "";
+      const onDash = (d) => {
+        dashBuf += d.toString();
+      };
+      dash.stdout.on("data", onDash);
+      dash.stderr.on("data", onDash);
+      let dashUp = false;
+      for (let i = 0; i < 45 && dash.exitCode === null; i++) {
+        await new Promise((r) => setTimeout(r, 1e3));
+        try {
+          const res = await fetch(`http://127.0.0.1:${dashPort}`, { signal: AbortSignal.timeout(2e3) });
+          if (res.status < 500) {
+            dashUp = true;
+            break;
+          }
+        } catch {
+        }
+      }
+      if (dashUp) {
+        dashboardUrl = publicUrl ?? `http://localhost:${dashPort}`;
+        uiSpinner.succeed(`Dashboard running at ${dashboardUrl}`);
+        dash.stdout.off("data", onDash);
+        dash.stderr.off("data", onDash);
+        dash.stdout.on("data", (d) => process.stdout.write(d));
+        dash.stderr.on("data", (d) => process.stderr.write(d));
+      } else {
+        uiSpinner.warn("Dashboard didn't come up in time \u2014 continuing with the API only.");
+        process.stderr.write(dashBuf.slice(-1e3));
+      }
+    } catch (e) {
+      uiSpinner.warn(`Dashboard unavailable: ${e.message}`);
+      console.log(
+        chalk2.dim(
+          "  The API is still running. Retry `openship up`, pass --no-ui, or use `openship install` for the desktop app.\n"
+        )
+      );
+    }
+  }
+  if (publicUrl) {
+    console.log(
+      (dashboardUrl ? chalk2.dim(`  Dashboard: ${dashboardUrl}  (login required)
+`) : "") + chalk2.dim("  API is proxied through the dashboard (bound to loopback, not exposed).\n") + chalk2.dim(`  Data:      ${dataDir}
+`) + (managedEdge ? chalk2.dim("  Managed edge (OpenResty + Let's Encrypt) fronts this box \u2014 point your domain's A record at this server's IP. Stop with Ctrl-C.\n") : chalk2.dim("  Point your reverse proxy / DNS at the dashboard port. Stop with Ctrl-C.\n"))
+    );
+  } else {
+    console.log(
+      chalk2.dim(`  API:       http://localhost:${port}/api
+`) + (dashboardUrl ? chalk2.dim(`  Dashboard: ${dashboardUrl}  (login required)
+`) : "") + chalk2.dim(`  Data:      ${dataDir}
+`) + chalk2.dim("  Log in with your admin account (run `openship` to create one). Stop with Ctrl-C.\n")
+    );
+  }
+  child.stdout.off("data", buffer);
+  child.stderr.off("data", buffer);
+  child.stdout.on("data", (d) => process.stdout.write(d));
+  child.stderr.on("data", (d) => process.stderr.write(d));
+  process.on("SIGINT", () => stopAll(0));
+  process.on("SIGTERM", () => stopAll(0));
+  child.on("exit", (code) => stopAll(code ?? 0));
+}
+
+export {
+  CACHE_DIR,
+  RELEASES_DIR,
+  releaseDir,
+  parseSha256,
+  hashFile,
+  downloadToFile,
+  formatBytes,
+  RELEASES,
+  resolveLatestTag,
+  assetUrl,
+  fetchSidecar,
+  expectedSha256,
+  ensureDashboard,
+  readCliInstall,
+  writeCliInstall,
+  selfInvocation,
+  restart,
+  serviceStatus,
+  stop,
+  ensureInternalToken,
+  internalGet,
+  internalPost,
+  bootstrapAdmin,
+  waitHealthy,
+  waitDashboard,
+  detectPublicIp,
+  headlessProvision,
+  normalizeUrl,
+  upCommand,
+  runHeadlessProvision,
+  startService
+};