openship 0.6.1 → 0.6.6

package/dist/{chunk-2NZSUXOB.js → chunk-5DMWSTOM.js}

@@ -2,17 +2,32 @@
 ":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
-import {
-  ENV_KEY,
-  ENV_SECRET,
-  fromEnv
-} from "./chunk-XZYFZ6A5.js";
 import {
   SignatureV4MultiRegion,
   XmlNode,
   XmlShapeDeserializer,
   XmlText
 } from "./chunk-QWHBRY2K.js";
+import {
+  OS_DIR
+} from "./chunk-ELGRMZOW.js";
+import {
+  AwsCrc32,
+  __awaiter,
+  __generator,
+  __values,
+  convertToBuffer,
+  eventStreamSerdeProvider2 as eventStreamSerdeProvider,
+  isEmptyData,
+  numToUint8,
+  resolveEventStreamSerdeConfig,
+  uint32ArrayFrom
+} from "./chunk-ONKEYSMY.js";
+import {
+  ENV_KEY,
+  ENV_SECRET,
+  fromEnv
+} from "./chunk-XZYFZ6A5.js";
 import {
   AwsSdkSigV4ASigner,
   AwsSdkSigV4Signer,
@@ -99,24 +114,6 @@ import {
   resolveRegionConfig,
   toEndpointV1
 } from "./chunk-3NQQXMDR.js";
-import {
-  CloudRuntime
-} from "./chunk-RRJJGVKE.js";
-import {
-  systemCatalog
-} from "./chunk-IOT5ZX23.js";
-import {
-  AwsCrc32,
-  __awaiter,
-  __generator,
-  __values,
-  convertToBuffer,
-  eventStreamSerdeProvider2 as eventStreamSerdeProvider,
-  isEmptyData,
-  numToUint8,
-  resolveEventStreamSerdeConfig,
-  uint32ArrayFrom
-} from "./chunk-ONKEYSMY.js";
 import {
   Hash,
   NumericValue,
@@ -135,6 +132,12 @@ import {
   toUint8Array,
   toUtf8
 } from "./chunk-ZWLDLTJP.js";
+import {
+  CloudRuntime
+} from "./chunk-OBPKYXQL.js";
+import {
+  OPENRESTY_DEFAULT_PATHS
+} from "./chunk-RSR7PFIQ.js";
 import {
   DockerRuntime,
   daemonConnectionFrom,
@@ -143,34 +146,29 @@ import {
   scopedVolumeName,
   startAttachStream,
   startExecStream
-} from "./chunk-3FYIXVX5.js";
+} from "./chunk-77QDF6UD.js";
 import {
   BareRuntime
-} from "./chunk-IXM5245F.js";
+} from "./chunk-LFE5KQ7Y.js";
 import {
-  LocalExecutor
-} from "./chunk-6FH4AXVY.js";
+  createExecutor
+} from "./chunk-MLYSEZQB.js";
 import {
-  EDGE_CONTAINER_NAME,
-  edgeCrashReason,
-  invalidateEdgeContainer,
-  sanitizeEdgeVhosts
-} from "./chunk-VZ2ZHPS2.js";
+  envOps
+} from "./chunk-YMMQRE5J.js";
 import {
-  EDGE_CONTAINER_MOUNTS,
-  EDGE_HOST_STATE_DIR,
-  OPENRESTY_DEFAULT_PATHS
-} from "./chunk-YIPMDGG6.js";
+  ENVIRONMENT_PROBE_SCRIPT,
+  ENVIRONMENT_PROBE_TIMEOUT_MS,
+  cacheEnvironment,
+  parseEnvironmentProbe,
+  profileIsFresh
+} from "./chunk-UVNMQM7W.js";
 import {
-  DEFAULT_IMAGE_REGISTRY,
+  FAMILY_BY_DISTRO,
   isAwsS3Endpoint,
   safeErrorMessage,
   withTimeout
-} from "./chunk-OTLSJYAC.js";
-
-// src/lib/edge-import.ts
-import chalk from "chalk";
-import ora from "ora";
+} from "./chunk-UJ6JZM65.js";
 
 // ../../packages/adapters/src/runtime/image-transfer.ts
 import { Transform } from "stream";
@@ -194,8 +192,10 @@ var MAIL_CONTAINER_MOUNTS = [
   { host: `${MAIL_HOST_STATE_DIR}/config/dovecot`, container: "/etc/dovecot", seed: true },
   { host: `${MAIL_HOST_STATE_DIR}/config/amavis`, container: "/etc/amavis/conf.d", seed: true },
   // ClamAV signatures — bind-mounted so a pull doesn't force a multi-hundred-MB
-  // freshclam re-download and delay readiness.
-  { host: `${MAIL_HOST_STATE_DIR}/clamav`, container: "/var/lib/clamav" },
+  // freshclam re-download and delay readiness. `seed: true` because that same mount
+  // HIDES the database baked into the image: with nothing copying it across, clamd
+  // finds an empty database directory and exits (issue #565).
+  { host: `${MAIL_HOST_STATE_DIR}/clamav`, container: "/var/lib/clamav", seed: true },
   { host: "/etc/letsencrypt", container: "/etc/letsencrypt", readonly: true }
 ];
 var MAIL_DB_HOST_DATA_DIR = `${MAIL_HOST_STATE_DIR}/pgdata`;
@@ -204,6 +204,11 @@ var MAIL_DB_PGDATA = `${MAIL_DB_CONTAINER_DATA_DIR}/pgdata`;
 var MAIL_HOST_PATHS = {
   saslPasswd: `${MAIL_HOST_STATE_DIR}/config/postfix/sasl_passwd`,
   senderRelayhost: `${MAIL_HOST_STATE_DIR}/config/postfix/sender_relayhost`,
+  // Per-nexthop TLS policy. Only split ("selected"-scope) relaying writes it: the
+  // relay hop must be `encrypt` so SASL credentials never cross a plaintext
+  // connection, while direct-to-MX delivery for the un-relayed domains stays
+  // opportunistic. A GLOBAL smtp_tls_security_level can't express both.
+  relayTlsPolicy: `${MAIL_HOST_STATE_DIR}/config/postfix/openship_tls_policy`,
   amavisUserConf: `${MAIL_HOST_STATE_DIR}/config/amavis/50-user`
 };
 
@@ -212,6 +217,63 @@ var MAIL_DB_IMAGE = process.env.OPENSHIP_MAIL_DB_IMAGE?.trim() || "postgres:16-a
 var ENGINE_ENV_FILE = `${MAIL_HOST_STATE_DIR}/engine.env`;
 var DB_ENV_FILE = `${MAIL_HOST_STATE_DIR}/db.env`;
 
+// ../../packages/adapters/src/system/environment-local.ts
+import { spawnSync } from "child_process";
+var cached = null;
+function unmeasurable(reason) {
+  return {
+    ...parseEnvironmentProbe({ text: "", failed: true, unanswered: true }),
+    unsupportedReason: reason
+  };
+}
+function probeLocalHost() {
+  if (process.platform === "win32") {
+    return unmeasurable(
+      "Openship cannot provision this machine: it runs Windows, and Openship's host provisioning is POSIX-only. Deploying to a remote Linux server from here works."
+    );
+  }
+  const result = spawnSync("sh", ["-c", ENVIRONMENT_PROBE_SCRIPT], {
+    encoding: "utf8",
+    timeout: ENVIRONMENT_PROBE_TIMEOUT_MS,
+    // `sh -c` and not the login shell: `wrapLocalBuildCommand`'s `-lc` exists so user
+    // builds see a normal profile, but a host probe wants the plain POSIX behaviour the
+    // remote path gets, without a dotfile's `echo` in the middle of the output.
+    windowsHide: true
+  });
+  if (result.error) {
+    return unmeasurable(
+      `Openship could not run a shell on this machine to detect it: ${safeErrorMessage(result.error)}`
+    );
+  }
+  if (result.signal || typeof result.status !== "number") {
+    return unmeasurable(
+      `Openship could not measure this machine: the detection probe was killed${result.signal ? ` by ${result.signal}` : ""} before it finished.`
+    );
+  }
+  const stdout = result.stdout ?? "";
+  return parseEnvironmentProbe({
+    // The script always exits 0, so a non-zero status means something ran instead of it
+    // — the same signal the SSH path uses, and stderr is what said so.
+    text: stdout.trim() ? stdout : result.stderr ?? "",
+    failed: result.status !== 0,
+    // Every way of not answering is refused above, so the shell exited on its own and
+    // whatever it said is this machine's.
+    unanswered: false
+  });
+}
+function resolveLocalEnvironmentSync() {
+  if (cached && profileIsFresh(cached.measuredAt)) return cached.profile;
+  const profile = probeLocalHost();
+  cached = { measuredAt: Date.now(), profile };
+  cacheEnvironment(createExecutor(), profile);
+  return profile;
+}
+
+// ../../packages/adapters/src/system/modules/types.ts
+var TARGETABLE_FAMILIES = new Set(
+  Object.values(FAMILY_BY_DISTRO)
+);
+
 // ../../packages/adapters/src/system/modules/verify.ts
 import { createHash, createPublicKey, verify as cryptoVerify } from "crypto";
 
@@ -219,10 +281,6 @@ import { createHash, createPublicKey, verify as cryptoVerify } from "crypto";
 var CATALOG_BASE_URL = process.env.OPENSHIP_MODULE_CATALOG_BASE_URL?.trim() || "https://raw.githubusercontent.com/openship/native-modules";
 var CATALOG_REF = process.env.OPENSHIP_MODULE_CATALOG_REF?.trim() || "main";
 
-// ../../packages/adapters/src/system/reachability.ts
-import { connect } from "net";
-import { request } from "http";
-
 // ../../packages/adapters/src/backup/registry.ts
 var executorFactories = /* @__PURE__ */ new Map();
 function registerExecutor(runtimeName, factory) {
@@ -747,12 +805,14 @@ var DockerBackupExecutor = class {
       try {
         const data = await this.dockerode.getContainer(service.containerId).inspect();
         const mounts = data.Mounts ?? [];
-        return mounts.filter((m2) => m2.Type === "volume" || m2.Type === "bind").map((m2, i2) => ({
-          id: m2.Name ?? m2.Source ?? `mount-${i2}`,
-          target: m2.Destination ?? "",
-          source: m2.Name ?? m2.Source ?? "",
-          type: m2.Type ?? "volume"
-        }));
+        return mounts.filter((m2) => m2.Type === "volume" || m2.Type === "bind").map(
+          (m2, i2) => ({
+            id: m2.Name ?? m2.Source ?? `mount-${i2}`,
+            target: m2.Destination ?? "",
+            source: m2.Name ?? m2.Source ?? "",
+            type: m2.Type ?? "volume"
+          })
+        );
       } catch {
       }
     }
@@ -784,7 +844,9 @@ var DockerBackupExecutor = class {
       Env: opts?.env ? Object.entries(opts.env).map(([k2, v2]) => `${k2}=${v2}`) : void 0
     });
     const stream = await exec.start({ stdin: false });
-    return this.attachDemuxed(this.dockerode, exec.id, stream, opts?.timeoutMs);
+    return this.attachDemuxed(this.dockerode, exec.id, stream, opts, {
+      label: `exec in service ${service.name}`
+    });
   }
   async streamPath(service, sourceId, opts) {
     const sources = await this.listSources(service);
@@ -796,10 +858,7 @@ var DockerBackupExecutor = class {
       throw new Error(`Backup source "${sourceId}" is tmpfs \u2014 not backupable`);
     }
     const compression = opts?.compression ?? "zstd";
-    const excludeArgs = (opts?.exclude ?? []).flatMap((p2) => [
-      "--exclude",
-      shellEscape4(p2)
-    ]);
+    const excludeArgs = (opts?.exclude ?? []).flatMap((p2) => ["--exclude", shellEscape4(p2)]);
     const tarFlags = compressionFlag(compression);
     const tarCmd = compression === "zstd" ? `tar -c${tarFlags} -C /mnt ${excludeArgs.join(" ")} . | zstd -c -3` : `tar -c${tarFlags} -C /mnt ${excludeArgs.join(" ")} .`;
     const helperImage = compression === "zstd" ? "alpine:3" : HELPER_IMAGE;
@@ -824,7 +883,11 @@ var DockerBackupExecutor = class {
     return this.handOffHelper(
       {
         Image: helperImage,
-        Cmd: ["sh", "-c", compression === "zstd" ? `apk add --no-cache zstd >/dev/null 2>&1; ${tarCmd}` : tarCmd],
+        Cmd: [
+          "sh",
+          "-c",
+          compression === "zstd" ? `apk add --no-cache zstd >/dev/null 2>&1; ${tarCmd}` : tarCmd
+        ],
         HostConfig: hostConfig,
         AttachStdout: true,
         AttachStderr: true,
@@ -1170,7 +1233,7 @@ var DockerBackupExecutor = class {
       } catch {
       }
     }, opts.timeoutMs) : null;
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve2, reject) => {
       body.on("error", (err) => {
         if (timer) clearTimeout(timer);
         try {
@@ -1182,7 +1245,7 @@ var DockerBackupExecutor = class {
       stream.on("end", async () => {
         if (timer) clearTimeout(timer);
         try {
-          resolve4({
+          resolve2({
             code: await resolveExecExitCode(exec, exec.id),
             stderr: Buffer.concat(stderrChunks).toString("utf8").slice(0, 16 * 1024)
           });
@@ -1230,7 +1293,10 @@ var DockerBackupExecutor = class {
   }
   /** dockerode `exec.start` returns a multiplexed stream — stdout +
    *  stderr interleaved with frame headers. demux into clean streams. */
-  attachDemuxed(docker, execId, stream, timeoutMs) {
+  attachDemuxed(docker, execId, stream, opts, meta) {
+    const label = meta?.label ?? "exec";
+    const idleMs = opts?.idleTimeoutMs ?? DEFAULT_HELPER_IDLE_MS;
+    const timeoutMs = opts?.timeoutMs ?? DEFAULT_HELPER_TIMEOUT_MS;
     const stdout = new PassThrough();
     const stderrChunks = [];
     const stderrSink = new PassThrough();
@@ -1238,27 +1304,47 @@ var DockerBackupExecutor = class {
       if (stderrChunks.length < 16) stderrChunks.push(chunk);
     });
     docker.modem.demuxStream(stream, stdout, stderrSink);
-    const awaitExit = new Promise((resolve4, reject) => {
-      const timer = timeoutMs ? setTimeout(() => {
-        stdout.destroy(new Error(`exec timed out after ${timeoutMs}ms`));
-        reject(new Error(`exec timed out after ${timeoutMs}ms`));
-      }, timeoutMs) : null;
-      stream.on("end", async () => {
-        if (timer) clearTimeout(timer);
-        try {
-          resolve4({
-            code: await resolveExecExitCode(docker.getExec(execId), execId),
-            stderr: Buffer.concat(stderrChunks).toString("utf8").slice(0, 16 * 1024)
-          });
-        } catch (err) {
-          reject(err);
-        }
-      });
-      stream.on("error", (err) => {
-        if (timer) clearTimeout(timer);
-        reject(err);
+    let sinksEnded = false;
+    const endSinks = () => {
+      if (sinksEnded) return;
+      sinksEnded = true;
+      stdout.end();
+      stderrSink.end();
+    };
+    stream.on("end", endSinks);
+    stream.on("close", endSinks);
+    const watchdog = createIdleWatchdog(
+      idleMs,
+      `${label} produced no data for ${Math.round(idleMs / 1e3)}s and was abandoned.`
+    );
+    stream.on("data", () => watchdog.touch());
+    const awaitExit = (async () => {
+      const onEnd = new Promise((resolve2, reject) => {
+        stream.on("end", async () => {
+          try {
+            resolve2({
+              code: await resolveExecExitCode(docker.getExec(execId), execId),
+              stderr: Buffer.concat(stderrChunks).toString("utf8").slice(0, 16 * 1024)
+            });
+          } catch (err) {
+            reject(err);
+          }
+        });
+        stream.on("error", (err) => reject(err));
       });
-    });
+      try {
+        return await withTimeout(
+          Promise.race([onEnd, watchdog.promise]),
+          timeoutMs,
+          `${label} exceeded its ${Math.round(timeoutMs / 1e3)}s ceiling and was abandoned.`
+        );
+      } catch (err) {
+        stdout.destroy(err);
+        throw err;
+      } finally {
+        watchdog.dispose();
+      }
+    })();
     return { stdout, awaitExit };
   }
   demuxContainerStream(container, stream, opts) {
@@ -1359,7 +1445,7 @@ var CloudBackupExecutor = class {
     const stdout = new Readable2({ read() {
     } });
     let stderrBuf = "";
-    const awaitExit = new Promise((resolve4, reject) => {
+    const awaitExit = new Promise((resolve2, reject) => {
       const timer = opts?.timeoutMs ? setTimeout(() => {
         stdout.destroy(new Error(`exec timed out after ${opts.timeoutMs}ms`));
         reject(new Error(`exec timed out after ${opts.timeoutMs}ms`));
@@ -1392,7 +1478,7 @@ var CloudBackupExecutor = class {
           }
           stdout.push(null);
           if (timer) clearTimeout(timer);
-          resolve4({ code: exitCode, stderr: stderrBuf });
+          resolve2({ code: exitCode, stderr: stderrBuf });
         } catch (err) {
           if (timer) clearTimeout(timer);
           stdout.destroy(err);
@@ -2370,8 +2456,8 @@ var flexibleChecksumsMiddleware = (config, middlewareConfig) => (next, context)
   if (hasHeaderWithPrefix("x-amz-checksum-", args.request.headers)) {
     return next(args);
   }
-  const { request: request2, input } = args;
-  const { body: requestBody, headers } = request2;
+  const { request, input } = args;
+  const { body: requestBody, headers } = request;
   const { base64Encoder, streamHasher } = config;
   const { requestChecksumRequired, requestAlgorithmMember } = middlewareConfig;
   const requestChecksumCalculation = await config.requestChecksumCalculation();
@@ -2442,7 +2528,7 @@ var flexibleChecksumsMiddleware = (config, middlewareConfig) => (next, context)
     const result = await next({
       ...args,
       request: {
-        ...request2,
+        ...request,
         headers: updatedHeaders,
         body: updatedBody
       }
@@ -2638,9 +2724,9 @@ var CONTENT_LENGTH_HEADER = "content-length";
 var DECODED_CONTENT_LENGTH_HEADER = "x-amz-decoded-content-length";
 function checkContentLengthHeader() {
   return (next, context) => async (args) => {
-    const { request: request2 } = args;
-    if (HttpRequest.isInstance(request2)) {
-      if (!(CONTENT_LENGTH_HEADER in request2.headers) && !(DECODED_CONTENT_LENGTH_HEADER in request2.headers)) {
+    const { request } = args;
+    if (HttpRequest.isInstance(request)) {
+      if (!(CONTENT_LENGTH_HEADER in request.headers) && !(DECODED_CONTENT_LENGTH_HEADER in request.headers)) {
         const message = `Are you using a Stream of unknown length as the Body of a PutObject request? Consider using Upload instead from @aws-sdk/lib-storage.`;
         if (typeof context?.logger?.warn === "function" && !(context.logger instanceof NoOpLogger)) {
           context.logger.warn(message);
@@ -2956,8 +3042,8 @@ var getS3ExpressPlugin = (options) => ({
 });
 
 // ../../node_modules/@aws-sdk/middleware-sdk-s3/dist-es/submodules/s3/middleware-s3-express/functions/signS3Express.js
-var signS3Express = async (s3ExpressIdentity, signingOptions, request2, sigV4MultiRegionSigner) => {
-  const signedRequest = await sigV4MultiRegionSigner.signWithCredentials(request2, s3ExpressIdentity, {});
+var signS3Express = async (s3ExpressIdentity, signingOptions, request, sigV4MultiRegionSigner) => {
+  const signedRequest = await sigV4MultiRegionSigner.signWithCredentials(request, s3ExpressIdentity, {});
   if (signedRequest.headers["X-Amz-Security-Token"] || signedRequest.headers["x-amz-security-token"]) {
     throw new Error("X-Amz-Security-Token must not be set for s3-express requests.");
   }
@@ -2980,15 +3066,15 @@ var s3ExpressHttpSigningMiddleware = (config) => (next, context) => async (args)
     throw new Error(`No HttpAuthScheme was selected: unable to sign request`);
   }
   const { httpAuthOption: { signingProperties = {} }, identity, signer } = scheme;
-  let request2;
+  let request;
   if (context.s3ExpressIdentity) {
-    request2 = await signS3Express(context.s3ExpressIdentity, signingProperties, args.request, await config.signer());
+    request = await signS3Express(context.s3ExpressIdentity, signingProperties, args.request, await config.signer());
   } else {
-    request2 = await signer.sign(args.request, identity, signingProperties);
+    request = await signer.sign(args.request, identity, signingProperties);
   }
   const output = await next({
     ...args,
-    request: request2
+    request
   }).catch((signer.errorHandler || defaultErrorHandler)(signingProperties));
   (signer.successHandler || defaultSuccessHandler)(output.response, signingProperties);
   return output;
@@ -3060,9 +3146,9 @@ var getThrow200ExceptionsPlugin = (config) => ({
 var validate = (str) => typeof str === "string" && str.indexOf("arn:") === 0 && str.split(":").length >= 6;
 
 // ../../node_modules/@aws-sdk/core/dist-es/submodules/util/util-format-url/format-url.js
-function formatUrl(request2) {
-  const { port, query } = request2;
-  let { protocol, path, hostname } = request2;
+function formatUrl(request) {
+  const { port, query } = request;
+  let { protocol, path, hostname } = request;
   if (protocol && protocol.slice(-1) !== ":") {
     protocol += ":";
   }
@@ -3077,14 +3163,14 @@ function formatUrl(request2) {
     queryString = `?${queryString}`;
   }
   let auth = "";
-  if (request2.username != null || request2.password != null) {
-    const username = request2.username ?? "";
-    const password = request2.password ?? "";
+  if (request.username != null || request.password != null) {
+    const username = request.username ?? "";
+    const password = request.password ?? "";
     auth = `${username}:${password}@`;
   }
   let fragment = "";
-  if (request2.fragment) {
-    fragment = `#${request2.fragment}`;
+  if (request.fragment) {
+    fragment = `#${request.fragment}`;
   }
   return `${protocol}//${auth}${hostname}${path}${queryString}${fragment}`;
 }
@@ -3477,18 +3563,18 @@ var AwsRestXmlProtocol = class extends HttpBindingProtocol {
     return "aws.protocols#restXml";
   }
   async serializeRequest(operationSchema, input, context) {
-    const request2 = await super.serializeRequest(operationSchema, input, context);
+    const request = await super.serializeRequest(operationSchema, input, context);
     const inputSchema = NormalizedSchema.of(operationSchema.input);
-    if (!request2.headers["content-type"]) {
+    if (!request.headers["content-type"]) {
       const contentType = this.mixin.resolveRestContentType(this.getDefaultContentType(), inputSchema);
       if (contentType) {
-        request2.headers["content-type"] = contentType;
+        request.headers["content-type"] = contentType;
       }
     }
-    if (typeof request2.body === "string" && request2.headers["content-type"] === this.getDefaultContentType() && !request2.body.startsWith("<?xml ") && !this.hasUnstructuredPayloadBinding(inputSchema)) {
-      request2.body = '<?xml version="1.0" encoding="UTF-8"?>' + request2.body;
+    if (typeof request.body === "string" && request.headers["content-type"] === this.getDefaultContentType() && !request.body.startsWith("<?xml ") && !this.hasUnstructuredPayloadBinding(inputSchema)) {
+      request.body = '<?xml version="1.0" encoding="UTF-8"?>' + request.body;
     }
-    return request2;
+    return request;
   }
   async deserializeResponse(operationSchema, context, response) {
     return super.deserializeResponse(operationSchema, context, response);
@@ -3541,7 +3627,7 @@ var AwsRestXmlProtocol = class extends HttpBindingProtocol {
 // ../../node_modules/@aws-sdk/middleware-sdk-s3/dist-es/submodules/s3/protocol/S3RestXmlProtocol.js
 var S3RestXmlProtocol = class extends AwsRestXmlProtocol {
   async serializeRequest(operationSchema, input, context) {
-    const request2 = await super.serializeRequest(operationSchema, input, context);
+    const request = await super.serializeRequest(operationSchema, input, context);
     const ns = NormalizedSchema.of(operationSchema.input);
     const staticStructureSchema = ns.getSchema();
     let bucketMemberIndex = 0;
@@ -3559,7 +3645,7 @@ var S3RestXmlProtocol = class extends AwsRestXmlProtocol {
         }
       }
     }
-    return request2;
+    return request;
   }
 };
 
@@ -3575,12 +3661,12 @@ var NODE_USE_ARN_REGION_CONFIG_OPTIONS = {
 // ../../node_modules/@aws-sdk/middleware-sdk-s3/dist-es/submodules/s3/middleware-expect-continue/middleware-expect-continue.js
 function addExpectContinueMiddleware(options) {
   return (next) => async (args) => {
-    const { request: request2 } = args;
-    if (options.expectContinueHeader !== false && HttpRequest.isInstance(request2) && request2.body && options.runtime === "node" && options.requestHandler?.constructor?.name !== "FetchHttpHandler") {
+    const { request } = args;
+    if (options.expectContinueHeader !== false && HttpRequest.isInstance(request) && request.body && options.runtime === "node" && options.requestHandler?.constructor?.name !== "FetchHttpHandler") {
       let sendHeader = true;
       if (typeof options.expectContinueHeader === "number") {
         try {
-          const bodyLength = Number(request2.headers?.["content-length"]) ?? options.bodyLengthChecker?.(request2.body) ?? Infinity;
+          const bodyLength = Number(request.headers?.["content-length"]) ?? options.bodyLengthChecker?.(request.body) ?? Infinity;
           sendHeader = bodyLength >= options.expectContinueHeader;
         } catch (e2) {
         }
@@ -3588,12 +3674,12 @@ function addExpectContinueMiddleware(options) {
         sendHeader = !!options.expectContinueHeader;
       }
       if (sendHeader) {
-        request2.headers.Expect = "100-continue";
+        request.headers.Expect = "100-continue";
       }
     }
     return next({
       ...args,
-      request: request2
+      request
     });
   };
 }
@@ -11398,7 +11484,7 @@ var defaultProvider = (init = {}) => memoizeChain([
   },
   async (awsIdentityProperties) => {
     init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromIni");
-    const { fromIni } = await import("./dist-es-JGBPABJI.js");
+    const { fromIni } = await import("./dist-es-AXFRS7PS.js");
     return fromIni(init)(awsIdentityProperties);
   },
   async (awsIdentityProperties) => {
@@ -11450,14 +11536,14 @@ var readableStreamHasher = (hashCtor, readableStream) => {
   const hash = new hashCtor();
   const hashCalculator = new HashCalculator(hash);
   readableStream.pipe(hashCalculator);
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve2, reject) => {
     readableStream.on("error", (err) => {
       hashCalculator.end();
       reject(err);
     });
     hashCalculator.on("error", reject);
     hashCalculator.on("finish", () => {
-      hash.digest().then(resolve4).catch(reject);
+      hash.digest().then(resolve2).catch(reject);
     });
   });
 };
@@ -11890,8 +11976,8 @@ var BYTE_LENGTH_SOURCE;
   BYTE_LENGTH_SOURCE2["START_END_DIFF"] = "the numeric difference between Body.start and Body.end";
   BYTE_LENGTH_SOURCE2["LSTAT"] = "the size of the file given by Body.path on disk as reported by lstatSync";
 })(BYTE_LENGTH_SOURCE || (BYTE_LENGTH_SOURCE = {}));
-var byteLengthSource = (input, override2) => {
-  if (override2 != null) {
+var byteLengthSource = (input, override) => {
+  if (override != null) {
     return BYTE_LENGTH_SOURCE.CONTENT_LENGTH;
   }
   if (input == null) {
@@ -12187,8 +12273,8 @@ var Upload = class _Upload extends EventEmitter {
       const requestHandler = this.client.config.requestHandler;
       const eventEmitter = requestHandler instanceof EventEmitter ? requestHandler : null;
       let lastSeenBytes = 0;
-      const uploadEventListener = (event, request2) => {
-        const requestPartSize = Number(request2.query["partNumber"]) || -1;
+      const uploadEventListener = (event, request) => {
+        const requestPartSize = Number(request.query["partNumber"]) || -1;
         if (requestPartSize !== dataPart.partNumber) {
           return;
         }
@@ -12313,7 +12399,7 @@ to input.params.ContentLength in bytes.
     }
   }
   async __abortTimeout(abortSignal) {
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve2, reject) => {
       abortSignal.onabort = () => {
         const abortError = new Error("Upload aborted.");
         abortError.name = "AbortError";
@@ -12426,13 +12512,13 @@ var getSignedUrl = async (client, command, options = {}) => {
     s3Presigner = new S3RequestPresigner(client.config);
   }
   const presignInterceptMiddleware = (next, context) => async (args) => {
-    const { request: request2 } = args;
-    if (!HttpRequest.isInstance(request2)) {
+    const { request } = args;
+    if (!HttpRequest.isInstance(request)) {
       throw new Error("Request to be presigned is not an valid HTTP request.");
     }
-    delete request2.headers["amz-sdk-invocation-id"];
-    delete request2.headers["amz-sdk-request"];
-    delete request2.headers["x-amz-user-agent"];
+    delete request.headers["amz-sdk-invocation-id"];
+    delete request.headers["amz-sdk-request"];
+    delete request.headers["x-amz-user-agent"];
     let presigned2;
     const presignerOptions = {
       ...options,
@@ -12440,9 +12526,9 @@ var getSignedUrl = async (client, command, options = {}) => {
       signingService: options.signingService ?? context["signing_service"]
     };
     if (context.s3ExpressIdentity) {
-      presigned2 = await s3Presigner.presignWithCredentials(request2, context.s3ExpressIdentity, presignerOptions);
+      presigned2 = await s3Presigner.presignWithCredentials(request, context.s3ExpressIdentity, presignerOptions);
     } else {
-      presigned2 = await s3Presigner.presign(request2, presignerOptions);
+      presigned2 = await s3Presigner.presign(request, presignerOptions);
     }
     return {
       response: {},
@@ -12680,6 +12766,8 @@ var CAPS3 = /* @__PURE__ */ new Set([
   "streamingPut",
   "streamingGet"
 ]);
+var UPLOAD_STALL_TIMEOUT_MS = 10 * 60 * 1e3;
+var UPLOAD_STALL_PROBE_MS = 30 * 1e3;
 var SftpDestinationImpl = class {
   kind;
   capabilities = CAPS3;
@@ -12727,7 +12815,7 @@ var SftpDestinationImpl = class {
   // ── Connection helper ────────────────────────────────────────────────
   async withSftp(fn) {
     const client = new Client2();
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve2, reject) => {
       const cleanup = () => {
         try {
           client.end();
@@ -12744,7 +12832,7 @@ var SftpDestinationImpl = class {
           fn(sftp).then(
             (val) => {
               cleanup();
-              resolve4(val);
+              resolve2(val);
             },
             (e2) => {
               cleanup();
@@ -12764,12 +12852,12 @@ var SftpDestinationImpl = class {
     let current = dir.startsWith("/") ? "" : ".";
     for (const part of parts) {
       current = current === "" ? `/${part}` : posix2.join(current, part);
-      await new Promise((resolve4, reject) => {
+      await new Promise((resolve2, reject) => {
         sftp.mkdir(current, (err) => {
-          if (!err) return resolve4();
+          if (!err) return resolve2();
           sftp.stat(current, (statErr, stats) => {
             if (statErr) return reject(err);
-            if (stats.isDirectory()) return resolve4();
+            if (stats.isDirectory()) return resolve2();
             reject(new Error(`${current} exists but is not a directory`));
           });
         });
@@ -12783,14 +12871,14 @@ var SftpDestinationImpl = class {
       await this.withSftp(async (sftp) => {
         await this.ensureDir(sftp, this.rootPath);
         const probePath = posix2.join(this.rootPath, probeName);
-        await new Promise((resolve4, reject) => {
+        await new Promise((resolve2, reject) => {
           const ws = sftp.createWriteStream(probePath);
           ws.on("error", reject);
-          ws.on("close", () => resolve4());
+          ws.on("close", () => resolve2());
           ws.end("ok");
         });
         await new Promise(
-          (resolve4, reject) => sftp.unlink(probePath, (err) => err ? reject(err) : resolve4())
+          (resolve2, reject) => sftp.unlink(probePath, (err) => err ? reject(err) : resolve2())
         );
       });
       return { ok: true };
@@ -12807,27 +12895,49 @@ var SftpDestinationImpl = class {
     let bytesWritten = 0;
     await this.withSftp(async (sftp) => {
       await this.ensureDir(sftp, posix2.dirname(target));
-      await new Promise((resolve4, reject) => {
+      await new Promise((resolve2, reject) => {
         const ws = sftp.createWriteStream(tmp);
-        ws.on("error", reject);
-        ws.on("close", () => resolve4());
+        let lastProgressAt = Date.now();
+        let settled = false;
+        let watchdog;
+        const finish = (err) => {
+          if (settled) return;
+          settled = true;
+          if (watchdog) clearInterval(watchdog);
+          if (err) {
+            ws.destroy();
+            body.destroy();
+            reject(err);
+          } else {
+            resolve2();
+          }
+        };
+        watchdog = setInterval(() => {
+          if (settled || Date.now() - lastProgressAt <= UPLOAD_STALL_TIMEOUT_MS) return;
+          finish(
+            new Error(
+              `SFTP upload stalled: no write progress for ${UPLOAD_STALL_TIMEOUT_MS / 1e3}s (wrote ${bytesWritten} bytes so far). Retry; if it recurs, check both ends \u2014 whether the source is still producing bytes, and the destination's SFTP subsystem.`
+            )
+          );
+        }, UPLOAD_STALL_PROBE_MS);
+        watchdog.unref?.();
+        ws.on("error", (err) => finish(err));
+        ws.on("close", () => finish());
         body.on("data", (chunk) => {
           bytesWritten += chunk.byteLength;
+          lastProgressAt = Date.now();
         });
-        body.on("error", (err) => {
-          ws.destroy();
-          reject(err);
-        });
+        body.on("error", (err) => finish(err));
         body.pipe(ws);
       });
-      await new Promise((resolve4, reject) => {
+      await new Promise((resolve2, reject) => {
         sftp.rename(tmp, target, (err) => {
-          if (!err) return resolve4();
+          if (!err) return resolve2();
           sftp.unlink(target, () => {
             sftp.rename(
               tmp,
               target,
-              (err2) => err2 ? reject(err2) : resolve4()
+              (err2) => err2 ? reject(err2) : resolve2()
             );
           });
         });
@@ -12874,14 +12984,14 @@ var SftpDestinationImpl = class {
     const target = this.fullPath(key);
     try {
       return await this.withSftp(
-        (sftp) => new Promise((resolve4, reject) => {
+        (sftp) => new Promise((resolve2, reject) => {
           sftp.stat(target, (err, stats) => {
             if (err) {
               const code = err.code;
-              if (code === 2) return resolve4(null);
+              if (code === 2) return resolve2(null);
               return reject(err);
             }
-            resolve4({
+            resolve2({
               sizeBytes: stats.size,
               uploadedAt: new Date(stats.mtime * 1e3)
             });
@@ -12898,14 +13008,14 @@ var SftpDestinationImpl = class {
     const entries = [];
     await this.withSftp(async (sftp) => {
       const walk = async (dir, relBase) => {
-        const dirents = await new Promise((resolve4, reject) => {
+        const dirents = await new Promise((resolve2, reject) => {
           sftp.readdir(dir, (err, list) => {
             if (err) {
               const code = err.code;
-              if (code === 2) return resolve4([]);
+              if (code === 2) return resolve2([]);
               return reject(err);
             }
-            resolve4(list);
+            resolve2(list);
           });
         });
         for (const dirent of dirents) {
@@ -12931,10 +13041,10 @@ var SftpDestinationImpl = class {
     const target = this.fullPath(key);
     await this.withSftp(
       (sftp) => new Promise(
-        (resolve4, reject) => sftp.unlink(target, (err) => {
-          if (!err) return resolve4();
+        (resolve2, reject) => sftp.unlink(target, (err) => {
+          if (!err) return resolve2();
           const code = err.code;
-          if (code === 2) return resolve4();
+          if (code === 2) return resolve2();
           reject(err);
         })
       )
@@ -12946,11 +13056,11 @@ var SftpDestinationImpl = class {
     const failed = [];
     await this.withSftp(async (sftp) => {
       for (const key of keys) {
-        await new Promise((resolve4) => {
+        await new Promise((resolve2) => {
           sftp.unlink(this.fullPath(key), (err) => {
             if (!err) {
               deleted.push(key);
-              return resolve4();
+              return resolve2();
             }
             const code = err.code;
             if (code === 2) {
@@ -12958,7 +13068,7 @@ var SftpDestinationImpl = class {
             } else {
               failed.push({ key, error: err.message });
             }
-            resolve4();
+            resolve2();
           });
         });
       }
@@ -12969,1311 +13079,52 @@ var SftpDestinationImpl = class {
 registerDestination("sftp", (row) => new SftpDestinationImpl(row));
 registerDestination("openship_server", (row) => new SftpDestinationImpl(row));
 
-// src/lib/compose.ts
-import { spawn as spawn2, spawnSync as spawnSync3 } from "child_process";
-import { randomBytes as randomBytes5 } from "crypto";
-import { chmodSync, existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
-import { homedir as homedir2, userInfo } from "os";
-import { join as join7 } from "path";
-
-// src/lib/paths.ts
-import { homedir } from "os";
-import { join as join3, resolve as resolve2 } from "path";
-var DEFAULT_HOME = join3(homedir(), ".openship");
-var override = process.env.OPENSHIP_HOME?.trim();
-var OS_DIR = override ? resolve2(override) : DEFAULT_HOME;
-var IS_ALT_HOME = OS_DIR !== DEFAULT_HOME;
-var DATA_DIR = join3(OS_DIR, "data");
-var LOG_DIR = join3(OS_DIR, "logs");
-var AUTH_SECRET_FILE = join3(OS_DIR, "auth-secret");
-var INTERNAL_TOKEN_FILE = join3(OS_DIR, "internal-token");
-
-// src/lib/ports.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { join as join4 } from "path";
-
-// ../../packages/core/src/ports.ts
-import { createServer } from "net";
-var DEFAULT_API_PORT = 4e3;
-var DEFAULT_DASHBOARD_PORT = 3001;
-var LOOPBACK = "127.0.0.1";
-var SCAN_SPAN = 20;
-var MAX_PORT = 65535;
-function isPortFree(port, host = LOOPBACK) {
-  return new Promise((resolve4) => {
-    const srv = createServer();
-    srv.once("error", () => resolve4(false));
-    srv.listen(port, host, () => srv.close(() => resolve4(true)));
-  });
-}
-async function waitPortFree(port, opts = {}) {
-  const timeoutMs = opts.timeoutMs ?? 6e3;
-  const intervalMs = opts.intervalMs ?? 250;
-  const host = opts.host ?? LOOPBACK;
-  const deadline = Date.now() + timeoutMs;
-  for (; ; ) {
-    if (await isPortFree(port, host)) return true;
-    if (Date.now() >= deadline) return false;
-    await new Promise((r2) => setTimeout(r2, intervalMs));
-  }
-}
-function getFreePort(host = LOOPBACK) {
-  return new Promise((resolve4, reject) => {
-    const srv = createServer();
-    srv.once("error", reject);
-    srv.listen(0, host, () => {
-      const addr = srv.address();
-      const port = addr && typeof addr === "object" ? addr.port : 0;
-      srv.close(() => port ? resolve4(port) : reject(new Error("no free port")));
-    });
-  });
-}
-async function findPortNear(from, opts = {}) {
-  const host = opts.host ?? LOOPBACK;
-  const span = opts.span ?? SCAN_SPAN;
-  const skip = opts.skip ?? (() => false);
-  for (let port2 = from; port2 <= Math.min(from + span, MAX_PORT); port2++) {
-    if (!skip(port2) && await isPortFree(port2, host)) return port2;
-  }
-  let port = await getFreePort(host);
-  for (let tries = 0; tries < 10 && skip(port); tries++) port = await getFreePort(host);
-  return port;
-}
-async function resolvePortPair(prefs = {}) {
-  const host = prefs.bindAddr?.trim() || LOOPBACK;
-  const ours = new Set(prefs.reclaimable ?? []);
-  const prefFor = (kind) => prefs[kind] ?? prefs.previous?.[kind] ?? prefs.stored?.[kind] ?? prefs.defaults?.[kind];
-  const remembered = (kind, pref) => prefs[kind] === void 0 && (prefs.previous?.[kind] === pref || prefs.stored?.[kind] === pref);
-  const availableForPref = async (port) => ours.has(port) || await isPortFree(port, host);
-  const apiPref = prefFor("api");
-  const dashPref = prefFor("dashboard");
-  let api;
-  if (apiPref === void 0) api = await getFreePort(host);
-  else if (await availableForPref(apiPref)) api = apiPref;
-  else if (remembered("api", apiPref) && await waitPortFree(apiPref, { host })) api = apiPref;
-  else {
-    api = await findPortNear(apiPref + 1, {
-      host,
-      skip: (p2) => ours.has(p2) || p2 === dashPref
-    });
-  }
-  const skipForDash = (p2) => ours.has(p2) || p2 === api;
-  let dashboard;
-  if (dashPref === void 0) {
-    dashboard = await getFreePort(host);
-    for (let tries = 0; tries < 10 && dashboard === api; tries++) {
-      dashboard = await getFreePort(host);
-    }
-  } else if (dashPref !== api && await availableForPref(dashPref)) {
-    dashboard = dashPref;
-  } else if (dashPref !== api && remembered("dashboard", dashPref) && await waitPortFree(dashPref, { host })) {
-    dashboard = dashPref;
-  } else {
-    dashboard = await findPortNear(dashPref + 1, { host, skip: skipForDash });
-  }
-  return {
-    api,
-    dashboard,
-    switched: {
-      api: apiPref !== void 0 && api !== apiPref,
-      dashboard: dashPref !== void 0 && dashboard !== dashPref
-    },
-    preferred: { api: apiPref ?? api, dashboard: dashPref ?? dashboard }
-  };
-}
-
-// src/lib/ports.ts
-var PORTS_FILE = join4(OS_DIR, "ports.json");
-var INSTANCE_FILE = join4(OS_DIR, "instance.json");
-function saveInstanceUrl(publicUrl) {
-  try {
-    if (!existsSync(OS_DIR)) mkdirSync(OS_DIR, { recursive: true, mode: 448 });
-    writeFileSync(INSTANCE_FILE, JSON.stringify({ publicUrl: publicUrl ?? null }));
-  } catch {
-  }
-}
-function readInstanceUrl() {
-  try {
-    return JSON.parse(readFileSync(INSTANCE_FILE, "utf8")).publicUrl ?? null;
-  } catch {
-    return null;
-  }
-}
-function readStoredPorts() {
-  try {
-    return JSON.parse(readFileSync(PORTS_FILE, "utf-8"));
-  } catch {
-    return {};
-  }
-}
-function storedApiPort() {
-  return readStoredPorts().api ?? DEFAULT_API_PORT;
-}
-function storedDashboardPort() {
-  return readStoredPorts().dashboard ?? DEFAULT_DASHBOARD_PORT;
-}
-function saveStoredPorts(api, dashboard) {
-  try {
-    if (!existsSync(OS_DIR)) mkdirSync(OS_DIR, { recursive: true, mode: 448 });
-    writeFileSync(PORTS_FILE, JSON.stringify({ api, dashboard }));
-  } catch {
-  }
-}
-function portMoveNotice(resolved, trustedOriginUrls = []) {
-  if (!resolved.switched.api && !resolved.switched.dashboard) return [];
-  const lines = [
-    `A preferred port was busy \u2014 using API ${resolved.api}, dashboard ${resolved.dashboard}.`
-  ];
-  const stale = [...new Set(stalePortOrigins(resolved.preferred.dashboard, trustedOriginUrls))];
-  if (stale.length) {
-    lines.push(
-      `Heads up: ${stale.join(", ")} still names port ${resolved.preferred.dashboard}, so logins`,
-      `from that origin will be rejected. Point it at :${resolved.dashboard} (or free port`,
-      `${resolved.preferred.dashboard} and re-run to move back).`
-    );
-  }
-  return lines;
-}
-function stalePortOrigins(movedFrom, urls) {
-  const stale = [];
-  for (const raw of urls) {
-    for (const candidate of (raw ?? "").split(",")) {
-      const value = candidate.trim();
-      if (!value) continue;
-      try {
-        if (new URL(value).port === String(movedFrom)) stale.push(value);
-      } catch {
-      }
-    }
-  }
-  return stale;
-}
-async function resolvePorts(prefs, opts = {}) {
-  const resolved = await resolvePortPair({
-    ...prefs,
-    stored: readStoredPorts(),
-    defaults: { api: DEFAULT_API_PORT, dashboard: DEFAULT_DASHBOARD_PORT }
-  });
-  if (opts.persist !== false) saveStoredPorts(resolved.api, resolved.dashboard);
-  return resolved;
-}
-
-// src/lib/source-install.ts
-import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
-import { join as join6 } from "path";
-
-// src/lib/from-source.ts
-import { spawn, spawnSync } from "child_process";
-import { existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
-import { join as join5, resolve as resolve3 } from "path";
-var DEFAULT_REPO = "https://github.com/oblien/openship.git";
-var SOURCE_CHECKOUT_DIR = join5(OS_DIR, "src");
-var SOURCE_DIST_DIR = join5(OS_DIR, "from-source-dist");
-function has(cmd) {
-  try {
-    return spawnSync(cmd, ["--version"], { stdio: "ignore" }).status === 0;
-  } catch {
-    return false;
-  }
-}
-function run(cmd, args, cwd, env) {
-  return new Promise((res, rej) => {
-    const child = spawn(cmd, args, {
-      cwd,
-      stdio: "inherit",
-      // Windows resolves the bun/git shims (.cmd/.exe) only through a shell.
-      shell: process.platform === "win32",
-      env: env ? { ...process.env, ...env } : process.env
-    });
-    child.on("error", rej);
-    child.on(
-      "exit",
-      (code) => code === 0 ? res() : rej(new Error(`\`${cmd} ${args.join(" ")}\` (cwd=${cwd}) exited ${code ?? "?"}`))
-    );
-  });
-}
-function shortSha(cwd) {
-  const r2 = spawnSync("git", ["rev-parse", "--short", "HEAD"], { cwd, encoding: "utf8" });
-  return r2.status === 0 ? (r2.stdout ?? "").trim() || "unknown" : "unknown";
-}
-function isMonorepo(dir) {
-  return existsSync2(join5(dir, "package.json")) && existsSync2(join5(dir, "apps/api/package.json")) && existsSync2(join5(dir, "apps/dashboard/package.json"));
-}
-async function prepareFromSource(opts) {
-  if (!has("bun")) {
-    throw new Error(
-      "`bun` is required to build from source but wasn't found on PATH \u2014 install it: https://bun.sh"
-    );
-  }
-  let sourceDir;
-  let ref;
-  if (opts.source) {
-    sourceDir = resolve3(opts.source);
-    if (!isMonorepo(sourceDir)) {
-      throw new Error(
-        `--source ${sourceDir} doesn't look like an Openship checkout (missing package.json / apps/api / apps/dashboard).`
-      );
-    }
-    ref = "local";
-  } else {
-    if (!has("git")) {
-      throw new Error("`git` is required to clone the source but wasn't found on PATH.");
-    }
-    ref = (opts.ref || "main").trim();
-    const repoUrl = opts.repo || DEFAULT_REPO;
-    sourceDir = SOURCE_CHECKOUT_DIR;
-    mkdirSync2(OS_DIR, { recursive: true });
-    if (!existsSync2(join5(sourceDir, ".git"))) {
-      console.log(`  Cloning ${repoUrl} \u2192 ${sourceDir}`);
-      await run("git", ["clone", repoUrl, sourceDir], OS_DIR);
-    }
-    console.log(`  Fetching + checking out ${ref}`);
-    await run("git", ["fetch", "origin", ref, "--tags"], sourceDir);
-    await run("git", ["checkout", ref], sourceDir);
-    await run("git", ["pull", "--ff-only", "origin", ref], sourceDir).catch(() => {
-      console.log("  (pinned ref \u2014 not fast-forwarding)");
-    });
-  }
-  const sha = shortSha(sourceDir);
-  console.log(`  Source: ${sourceDir} @ ${ref} (${sha})`);
-  console.log("  Installing workspace dependencies (bun install)\u2026");
-  await run("bun", ["install"], sourceDir);
-  const distDir = SOURCE_DIST_DIR;
-  console.log("  Building release dist (compiles the dashboard \u2014 needs RAM/CPU)\u2026");
-  await run(
-    "bun",
-    ["run", join5(sourceDir, "apps/api/scripts/build-release.ts")],
-    sourceDir,
-    { DIST_DIR: distDir, NODE_ENV: "production", CLOUD_MODE: "false", OPENSHIP_TARGET: "local" }
-  );
-  console.log("  Installing runtime dependencies in the dist\u2026");
-  await run("bun", ["install", "--production", "--frozen-lockfile"], distDir);
-  const apiDir = join5(distDir, "api");
-  const dashboardDir = join5(distDir, "dashboard");
-  if (!existsSync2(join5(apiDir, "src/index.ts"))) {
-    throw new Error(`Build produced no API at ${apiDir}/src/index.ts \u2014 build-release layout drift?`);
-  }
-  if (!existsSync2(join5(dashboardDir, "apps/dashboard/server.js"))) {
-    throw new Error(`Build produced no dashboard at ${dashboardDir}/apps/dashboard/server.js.`);
-  }
-  return { apiDir, dashboardDir, ref, sha, sourceDir };
-}
-
-// src/lib/source-install.ts
-var MARKER = join6(OS_DIR, "source-install.json");
-function parseSourceInstall(raw) {
-  try {
-    const obj = JSON.parse(raw);
-    if (!obj || typeof obj.dir !== "string" || !obj.dir) return null;
-    return { repo: obj.repo || DEFAULT_REPO, ref: obj.ref || "main", dir: obj.dir };
-  } catch {
-    return null;
-  }
-}
-function readSourceInstall() {
-  if (!existsSync3(MARKER)) return null;
-  try {
-    return parseSourceInstall(readFileSync2(MARKER, "utf8"));
-  } catch {
-    return null;
-  }
+// src/lib/this-host.ts
+function thisHost() {
+  return envOps(resolveLocalEnvironmentSync());
 }
-function parseRemoteSha(stdout) {
-  const sha = stdout.split("\n")[0]?.trim().split(/\s+/)[0];
-  return sha && /^[0-9a-f]{7,40}$/i.test(sha) ? sha.slice(0, 7) : null;
+function pasteable(op) {
+  if (!op.supported) return null;
+  const sudo = thisHost().profile.isRoot ? "" : "sudo ";
+  return op.value.map((step) => `${sudo}${step}`).join(" && ");
 }
-function remoteSha(repo, ref) {
-  const r2 = spawnSync2("git", ["ls-remote", repo, ref], { encoding: "utf8" });
-  if (r2.status !== 0 || !r2.stdout) return null;
-  return parseRemoteSha(r2.stdout);
-}
-async function rebuildFromSource(info) {
-  if (!has("bun")) {
-    throw new Error("`bun` is required to rebuild from source but wasn't found on PATH \u2014 https://bun.sh");
-  }
-  if (!has("git")) {
-    throw new Error("`git` is required to update the source checkout but wasn't found on PATH.");
-  }
-  if (!existsSync3(join6(info.dir, ".git"))) {
-    throw new Error(
-      `Source checkout ${info.dir} is missing (no .git) \u2014 reinstall from source with scripts/install-source.sh.`
-    );
-  }
-  await run("git", ["fetch", "origin", info.ref, "--tags"], info.dir);
-  await run("git", ["checkout", info.ref], info.dir);
-  await run("git", ["pull", "--ff-only", "origin", info.ref], info.dir).catch(() => {
-  });
-  const cliDir = join6(info.dir, "apps/cli");
-  await run("bun", ["install"], info.dir);
-  await run("bun", ["run", "build"], cliDir);
-  await run("bun", ["run", "build/stage-dashboard.ts"], cliDir);
-  return shortSha(info.dir);
+function startUnitHint(unit) {
+  return pasteable(thisHost().serviceEnableStart(unit));
 }
 
-// src/lib/compose.ts
-var EDGE_SITES_HOST_DIR = `${EDGE_HOST_STATE_DIR}/sites-enabled`;
-var EDGE_ACME_HOST_DIR = `${EDGE_HOST_STATE_DIR}/acme`;
-function edgeVolumeYaml(indent) {
-  return EDGE_CONTAINER_MOUNTS.map((m2) => `${indent}- ${m2.host}:${m2.container}:z`).join("\n");
+// src/lib/compose-env.ts
+import { existsSync, readFileSync } from "fs";
+import { join as join3 } from "path";
+var COMPOSE_DIR = join3(OS_DIR, "compose");
+var COMPOSE_FILE = join3(COMPOSE_DIR, "docker-compose.yml");
+var COMPOSE_ENV_FILE = join3(COMPOSE_DIR, ".env");
+function composeInstallExists() {
+  return existsSync(COMPOSE_FILE);
 }
-var COMPOSE_DIR = join7(OS_DIR, "compose");
-var INSTALL_METHOD_FILE = join7(OS_DIR, "install-method");
-var COMPOSE_FILE = join7(COMPOSE_DIR, "docker-compose.yml");
-var BUILD_FILE = join7(COMPOSE_DIR, "docker-compose.build.yml");
-var ENV_FILE = join7(COMPOSE_DIR, ".env");
-var BUILT_SERVICES = [
-  { service: "api", dockerfile: "apps/api/Dockerfile" },
-  { service: "dashboard", dockerfile: "apps/dashboard/Dockerfile" },
-  { service: "edge", dockerfile: "apps/edge/Dockerfile" }
-];
-var ENV_CONSUMING_SERVICES = ["api", "dashboard", "edge"];
-function readInstallMethod() {
+function readComposeEnvFile() {
+  let text;
   try {
-    const v2 = readFileSync3(INSTALL_METHOD_FILE, "utf8").trim();
-    return v2 === "compose" || v2 === "bare" ? v2 : null;
-  } catch {
-    return null;
-  }
-}
-function writeInstallMethod(method) {
-  mkdirSync3(OS_DIR, { recursive: true, mode: 448 });
-  writeFileSync2(INSTALL_METHOD_FILE, method, { mode: 384 });
-}
-function dockerState() {
-  const ok = (args) => spawnSync3("docker", args, { stdio: "ignore" }).status === 0;
-  if (!ok(["--version"])) return { binary: false, plugin: false, daemon: false };
-  return { binary: true, plugin: ok(["compose", "version"]), daemon: ok(["version"]) };
-}
-function dockerGap(state = dockerState()) {
-  if (!state.binary) {
-    return { summary: "Docker isn't installed", installable: true };
-  }
-  if (!state.plugin) {
-    return {
-      summary: "Docker is installed but the Compose plugin (`docker compose`) is missing",
-      installable: true
-    };
-  }
-  if (!state.daemon) {
-    const asRoot = typeof process.getuid === "function" && process.getuid() === 0;
-    return {
-      summary: "Docker is installed but its daemon isn't reachable",
-      // Reinstalling changes nothing: a group change only applies to NEW logins,
-      // and a stopped daemon needs starting, not installing.
-      installable: false,
-      hint: asRoot ? "Start it with: systemctl start docker" : `Add your user to the docker group: sudo usermod -aG docker ${userInfo().username} \u2014 then log out and back in (or run: newgrp docker). If the daemon is stopped: sudo systemctl start docker`
-    };
+    text = readFileSync(COMPOSE_ENV_FILE, "utf8");
+  } catch (err) {
+    const code = err.code;
+    return { env: {}, unreadable: code === "ENOENT" ? null : err.message };
   }
-  return null;
-}
-function hasDockerCompose() {
-  return dockerGap() === null;
-}
-function hasCmd(cmd) {
-  return spawnSync3(cmd, ["--version"], { stdio: "ignore" }).status === 0;
-}
-function shQuote(s2) {
-  return `'${s2.replace(/'/g, `'\\''`)}'`;
-}
-function dockerInstallPreview(state = dockerState()) {
-  const gap = dockerGap(state);
-  if (!gap) return { state, gap: null, wouldInstall: false };
-  if (process.platform !== "linux" || !gap.installable) return { state, gap, wouldInstall: false };
-  const plan = systemCatalog.installs.docker({
-    os: "linux",
-    serviceManager: "systemd"
-  });
-  if (!plan.supported || !plan.installCommand) return { state, gap, wouldInstall: false };
-  return {
-    state,
-    gap,
-    wouldInstall: true,
-    installCommand: plan.installCommand,
-    ...plan.startCommand ? { startCommand: plan.startCommand } : {}
-  };
-}
-async function ensureDocker(opts = {}) {
-  const notice = opts.onNotice ?? ((line) => process.stderr.write(`  ${line}
-`));
-  const { state, gap, wouldInstall, installCommand, startCommand } = dockerInstallPreview();
-  if (!gap) return true;
-  if (process.platform !== "linux") return false;
-  if (!gap.installable) {
-    notice(gap.summary + ".");
-    if (gap.hint) notice(gap.hint);
-    return false;
-  }
-  if (!wouldInstall || !installCommand) return false;
-  const asRoot = typeof process.getuid === "function" && process.getuid() === 0;
-  const sudo = !asRoot && hasCmd("sudo") ? "sudo " : "";
-  notice("This can take 2-5 minutes on a small VPS (~150 MB of packages) and stays quiet while apt works.");
-  if (state.binary) {
-    notice("Docker's installer will warn that docker already exists and pause ~20s before continuing \u2014 that's expected.");
-  }
-  const sh = (script) => new Promise((resolve4) => {
-    const child = spawn2("sh", ["-c", sudo ? `${sudo}sh -c ${shQuote(script)}` : script], {
-      stdio: "inherit"
-    });
-    const started = Date.now();
-    const tick = setInterval(() => {
-      const s2 = Math.round((Date.now() - started) / 1e3);
-      notice(`still installing Docker \u2014 ${Math.floor(s2 / 60)}m${String(s2 % 60).padStart(2, "0")}s elapsed\u2026`);
-    }, 3e4);
-    const done = (code) => {
-      clearInterval(tick);
-      resolve4(code);
-    };
-    child.on("error", () => done(1));
-    child.on("close", (code) => done(code ?? 1));
-  });
-  if (await sh(installCommand) !== 0) return false;
-  if (startCommand) await sh(startCommand);
-  const after = dockerGap();
-  if (!after) {
-    notice("Docker ready.");
-    return true;
-  }
-  notice(after.summary + ".");
-  if (after.hint) notice(after.hint);
-  return false;
-}
-var COMPOSE_YAML = `# Managed by \`openship up\` \u2014 do not edit; re-run \`openship up\` to regenerate.
-services:
-  postgres:
-    image: postgres:16-alpine
-    restart: unless-stopped
-    environment:
-      # Keep the data dir in a subdirectory of the volume so a fresh install never
-      # runs initdb against a bare mount root (which fails on quirky host
-      # filesystems with EPERM \u2014 #350). OPENSHIP_PGDATA is decided ONCE at install
-      # by the CLI (fresh \u2192 subdir, pre-existing volume \u2192 root) and preserved in
-      # .env, so this never moves an existing database.
-      PGDATA: \${OPENSHIP_PGDATA:-/var/lib/postgresql/data/pgdata}
-      POSTGRES_USER: \${POSTGRES_USER:-openship}
-      POSTGRES_PASSWORD: \${POSTGRES_PASSWORD:?missing from .env \u2014 re-run openship up to regenerate it}
-      POSTGRES_DB: \${POSTGRES_DB:-openship}
-    expose: ["5432"]
-    volumes: [postgres_data:/var/lib/postgresql/data]
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U \${POSTGRES_USER:-openship} -d \${POSTGRES_DB:-openship}"]
-      interval: 5s
-      timeout: 3s
-      retries: 12
-
-  redis:
-    image: redis:7-alpine
-    restart: unless-stopped
-    command: ["redis-server", "--appendonly", "yes"]
-    expose: ["6379"]
-    volumes: [redis_data:/data]
-    healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
-      interval: 5s
-      timeout: 3s
-      retries: 12
-
-  api:
-    image: \${OPENSHIP_IMAGE_REGISTRY:-ghcr.io/oblien}/openship-api:\${OPENSHIP_VERSION:-latest}
-    restart: unless-stopped
-    # Loopback by default \u2014 the host-net edge reaches it over loopback, so nothing
-    # sits on a public interface. OPENSHIP_BIND_ADDR opts into a public/LAN interface
-    # (set by \`openship up\` when a public URL is configured for off-box access).
-    ports: ["\${OPENSHIP_BIND_ADDR:-127.0.0.1}:\${API_PORT:-4000}:\${API_PORT:-4000}"]
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      # Routing state shared with the edge, as HOST BIND MOUNTS (generated from
-      # EDGE_CONTAINER_MOUNTS): the vhost tree, /etc/letsencrypt, the ACME webroot
-      # and the static doc-roots the API writes and the edge serves. Named volumes
-      # hid all of it from every host-side reader (migrate's proxy scan, cert carry,
-      # cert reuse, mail cert symlinks), each of which then silently saw "nothing".
-${edgeVolumeYaml("      ")}
-      # Host-op SSH key (createHostExecutor \u2192 host.docker.internal). /dev/null
-      # when the host channel isn't provisioned \u2192 OPENSHIP_HOST_SSH_HOST stays
-      # unset and the API falls back to LocalExecutor.
-      - \${OPENSHIP_HOST_KEY_PATH:-/dev/null}:/run/secrets/openship_host_key:ro
-    extra_hosts: ["host.docker.internal:host-gateway"]
-    env_file: [.env]
-    environment:
-      NODE_ENV: production
-      PORT: "\${API_PORT:-4000}"
-      DATABASE_URL: postgresql://\${POSTGRES_USER:-openship}:\${POSTGRES_PASSWORD:?missing from .env \u2014 re-run openship up to regenerate it}@postgres:5432/\${POSTGRES_DB:-openship}
-      REDIS_URL: redis://redis:6379
-      OPENSHIP_EDGE_MODE: docker
-      OPENSHIP_EDGE_CONTAINER: openship-edge
-    depends_on:
-      postgres: { condition: service_healthy }
-      redis: { condition: service_healthy }
-    healthcheck:
-      test: ["CMD-SHELL", "bun -e \\"fetch('http://127.0.0.1:\${API_PORT:-4000}/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\\""]
-      interval: 10s
-      timeout: 5s
-      retries: 12
-      start_period: 40s
-
-  dashboard:
-    image: \${OPENSHIP_IMAGE_REGISTRY:-ghcr.io/oblien}/openship-dashboard:\${OPENSHIP_VERSION:-latest}
-    restart: unless-stopped
-    # Loopback by default (see api note); OPENSHIP_BIND_ADDR opts into a public interface.
-    ports: ["\${OPENSHIP_BIND_ADDR:-127.0.0.1}:\${DASHBOARD_PORT:-3001}:\${DASHBOARD_PORT:-3001}"]
-    env_file: [.env]
-    environment:
-      NODE_ENV: production
-      PORT: "\${DASHBOARD_PORT:-3001}"
-      INTERNAL_API_URL: http://api:\${API_PORT:-4000}
-    depends_on:
-      api: { condition: service_healthy }
-
-  edge:
-    image: \${OPENSHIP_IMAGE_REGISTRY:-ghcr.io/oblien}/openship-edge:\${OPENSHIP_VERSION:-latest}
-    # PINNED, and it must stay pinned: the api reaches the edge by NAME through
-    # DockerEdgeExecutor (OPENSHIP_EDGE_CONTAINER above), and "ours" edge
-    # detection greps \`docker ps --filter name=openship-edge\`. Without this,
-    # compose derives \`<project>-edge-1\` from the directory and every
-    # \`docker exec\` into the edge fails with "No such container: openship-edge" \u2014
-    # which silently migrated 0 sites after the operator's proxy was stopped.
-    # Safe here: the edge is a singleton (host networking, one per box).
-    container_name: openship-edge
-    restart: unless-stopped
-    network_mode: host
-    volumes:
-${edgeVolumeYaml("      ")}
-
-volumes:
-  postgres_data:
-  redis_data:
-`;
-function keepSecret(existing, key) {
-  return existing[key] || randomBytes5(32).toString("hex");
-}
-function readEnvFile() {
-  const out = {};
-  try {
-    for (const line of readFileSync3(ENV_FILE, "utf8").split("\n")) {
-      const m2 = line.match(/^([A-Z0-9_]+)=(.*)$/);
-      if (m2) out[m2[1]] = m2[2];
-    }
-  } catch {
-  }
-  return out;
-}
-var HOST_KEY_COMMENT = "openship-host-executor";
-var HOST_KEY_FROM = "172.16.0.0/12,192.168.0.0/16,10.0.0.0/8,127.0.0.1";
-function hostKeyAuthLine(pub) {
-  return `from="${HOST_KEY_FROM}",restrict,pty ${pub}`;
-}
-function rewriteHostAuthorizedKeys(existing, pub) {
-  const kept = existing.split("\n").filter((line) => line.trim() && !line.includes(HOST_KEY_COMMENT));
-  return [...kept, hostKeyAuthLine(pub)].join("\n") + "\n";
-}
-function plannedHostChannel(hostControl) {
-  if (!hostControl || process.platform !== "linux") return null;
-  let user;
-  try {
-    user = userInfo().username;
-  } catch {
-    user = process.env.USER || process.env.LOGNAME || "root";
-  }
-  return { user, keyPath: join7(COMPOSE_DIR, "host-ssh", "id_ed25519") };
-}
-function provisionHostSshChannel(hostControl) {
-  const target = plannedHostChannel(hostControl);
-  if (!target) return null;
-  const { user, keyPath } = target;
-  try {
-    mkdirSync3(join7(COMPOSE_DIR, "host-ssh"), { recursive: true, mode: 448 });
-    if (!existsSync4(keyPath)) {
-      const g2 = spawnSync3(
-        "ssh-keygen",
-        ["-t", "ed25519", "-N", "", "-q", "-f", keyPath, "-C", HOST_KEY_COMMENT],
-        { stdio: "ignore" }
-      );
-      if (g2.status !== 0) return null;
-    }
-    const pub = readFileSync3(`${keyPath}.pub`, "utf8").trim();
-    if (!pub) return null;
-    const userSshDir = join7(homedir2(), ".ssh");
-    mkdirSync3(userSshDir, { recursive: true, mode: 448 });
-    const authKeys = join7(userSshDir, "authorized_keys");
-    const existing = existsSync4(authKeys) ? readFileSync3(authKeys, "utf8") : "";
-    const next = rewriteHostAuthorizedKeys(existing, pub);
-    if (next !== existing) writeFileSync2(authKeys, next, { mode: 384 });
-    chmodSync(authKeys, 384);
-    return { user, keyPath };
-  } catch {
-    return null;
-  }
-}
-function composeProjectName(prev) {
-  if (prev.COMPOSE_PROJECT_NAME) return prev.COMPOSE_PROJECT_NAME;
-  return Object.keys(prev).length > 0 ? "compose" : "openship";
-}
-var PGDATA_ROOT = "/var/lib/postgresql/data";
-function resolvePgData(prev) {
-  if (prev.OPENSHIP_PGDATA) return prev.OPENSHIP_PGDATA;
-  return dbVolumeExists(composeProjectName(prev)) ? PGDATA_ROOT : `${PGDATA_ROOT}/pgdata`;
-}
-function orphanedStackContainers(project) {
-  const r2 = spawnSync3(
-    "docker",
-    [
-      "ps",
-      "-a",
-      "--format",
-      '{{.Names}}	{{.Label "com.docker.compose.project"}}	{{.Label "com.docker.compose.project.config_files"}}'
-    ],
-    { encoding: "utf8" }
-  );
-  if (r2.status !== 0 || !r2.stdout) return [];
-  return r2.stdout.split("\n").map((line) => line.trim()).filter(Boolean).map((line) => {
-    const [name, proj, configFiles] = line.split("	");
-    return { name: name ?? "", project: proj ?? "", configFiles: configFiles ?? "" };
-  }).filter(
-    (c2) => c2.name && c2.project && c2.project !== project && // config_files is a comma-separated list (base + build override).
-    c2.configFiles.split(",").some((f2) => f2.trim() === COMPOSE_FILE)
-  ).map(({ name, project: proj }) => ({ name, project: proj }));
-}
-function reconcileDbPassword(user, password) {
-  if (!password) return;
-  if (compose(["up", "-d", "--wait", "postgres"], { quiet: true }) !== 0) return;
-  const attempt = (asRole) => spawnSync3(
-    "docker",
-    [
-      "compose",
-      "-f",
-      COMPOSE_FILE,
-      "exec",
-      "-T",
-      "postgres",
-      "psql",
-      "-U",
-      asRole,
-      "-d",
-      "postgres",
-      "-v",
-      "ON_ERROR_STOP=1",
-      // Read the statement from STDIN, not `-c`: psql has no bind parameters for
-      // ALTER USER, so the password has to be inlined in SQL — and an argv copy
-      // would be readable in `ps` for the life of the call. stdin keeps it to this
-      // process and the socket. Our generated password is hex, so it cannot break
-      // out of the quoted literal either.
-      "-f",
-      "-"
-    ],
-    {
-      cwd: COMPOSE_DIR,
-      encoding: "utf8",
-      // Create the role if the volume predates it, else just realign it. Both
-      // branches leave exactly the credentials this `.env` will present.
-      input: `DO $$ BEGIN
-  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${user}') THEN
-    ALTER ROLE "${user}" WITH LOGIN PASSWORD '${password}';
-  ELSE
-    CREATE ROLE "${user}" WITH LOGIN SUPERUSER PASSWORD '${password}';
-  END IF;
-END $$;
-`
-    }
-  );
-  let r2 = attempt(user);
-  if (r2.status !== 0) r2 = attempt("postgres");
-  if (r2.status !== 0) {
-    console.log(
-      `
-  ! Could not realign the database password (${(r2.stderr ?? "").trim() || "psql failed"}).
-    The api will fail with "password authentication failed for user "${user}"" because the
-    existing data volume was initialized with a different password.
-
-    Fix it one of two ways:
-      \u2022 restore the .env that created the volume, or
-      \u2022 start fresh (DESTROYS DB DATA):  openship uninstall  then  openship up
-`
-    );
-  }
-}
-function removeOrphanedStack(project) {
-  const orphans = orphanedStackContainers(project);
-  if (orphans.length === 0) return;
-  const projects = [...new Set(orphans.map((o2) => o2.project))].join(", ");
-  console.log(
-    `  Removing ${orphans.length} container(s) from a previous stack (project "${projects}") \u2014 they would hold the ports this stack needs. Volumes are kept.`
-  );
-  spawnSync3("docker", ["rm", "-f", ...orphans.map((o2) => o2.name)], { stdio: "ignore" });
-}
-var EDGE_SWEEP_FORMAT = '{{.Names}}	{{.Label "com.docker.compose.project"}}	{{.Label "com.docker.compose.project.config_files"}}';
-function edgeNameNeedsReclaim(psStdout, project) {
-  const row = psStdout.split("\n").map((l2) => l2.trim()).find((l2) => l2.split("	")[0] === "openship-edge");
-  if (!row) return false;
-  const [, proj = "", configFiles = ""] = row.split("	");
-  const ours = proj === project && configFiles.split(",").some((f2) => f2.trim() === COMPOSE_FILE);
-  return !ours;
-}
-function reconcileEdgeContainerName(project) {
-  const r2 = spawnSync3("docker", ["ps", "-a", "--format", EDGE_SWEEP_FORMAT], {
-    encoding: "utf8"
-  });
-  if (r2.status !== 0 || !r2.stdout) return;
-  if (!edgeNameNeedsReclaim(r2.stdout, project)) return;
-  console.log(
-    "  Replacing an unmanaged `openship-edge` container so compose can own it (config is on the host, so no routes are lost)."
-  );
-  spawnSync3("docker", ["rm", "-f", "openship-edge"], { stdio: "ignore" });
-}
-function migrateLegacyEdgeVolumes(project) {
-  const pairs = [
-    { volume: `${project}_openship_sites`, host: EDGE_SITES_HOST_DIR },
-    { volume: `${project}_openship_certs`, host: "/etc/letsencrypt" },
-    { volume: `${project}_openship_acme`, host: EDGE_ACME_HOST_DIR },
-    { volume: `${project}_openship_static`, host: "/opt/openship/static" }
-  ];
-  const ls = spawnSync3("docker", ["volume", "ls", "--format", "{{.Name}}"], { encoding: "utf8" });
-  if (ls.status !== 0 || !ls.stdout) return;
-  const existing = new Set(ls.stdout.split("\n").map((l2) => l2.trim()).filter(Boolean));
-  for (const { volume, host } of pairs) {
-    if (!existing.has(volume)) continue;
-    mkdirSync3(host, { recursive: true });
-    const alreadyThere = spawnSync3("sh", ["-c", `ls -A ${JSON.stringify(host)} 2>/dev/null | head -1`], {
-      encoding: "utf8"
-    });
-    if (alreadyThere.stdout?.trim()) continue;
-    console.log(`  Moving edge state from volume ${volume} onto ${host}...`);
-    const copy = spawnSync3(
-      "docker",
-      [
-        "run",
-        "--rm",
-        "-v",
-        `${volume}:/from:ro`,
-        "-v",
-        `${host}:/to`,
-        "alpine:3",
-        "sh",
-        "-c",
-        "cp -a /from/. /to/ 2>/dev/null || true"
-      ],
-      { stdio: "inherit" }
-    );
-    if (copy.status !== 0) {
-      console.log(
-        `  Could not copy ${volume} \u2014 the stack will start with an empty ${host}.
-  Recover manually with: docker run --rm -v ${volume}:/from -v ${host}:/to alpine cp -a /from/. /to/`
-      );
-    }
-  }
-}
-function warnOrphanedVolumes(project) {
-  const r2 = spawnSync3("docker", ["volume", "ls", "--format", "{{.Name}}"], { encoding: "utf8" });
-  if (r2.status !== 0 || !r2.stdout) return;
-  const others = new Set(
-    r2.stdout.split("\n").map((l2) => l2.trim()).filter((l2) => l2.endsWith("_openship_sites")).map((l2) => l2.slice(0, -"_openship_sites".length)).filter((p2) => p2 && p2 !== project)
-  );
-  if (others.size === 0) return;
-  console.log(
-    `  Note: volumes from a previous install (project "${[...others].join(", ")}") are still on disk
-  and are NOT mounted by this stack \u2014 its database starts fresh. (Certificates and
-  vhosts now live on the host, so those carry over.)
-  Remove them with \`docker volume ls | grep _openship_\` once you're sure they aren't needed.`
-  );
-}
-function keepConfig(prev, key, explicit) {
-  const set = explicit?.trim();
-  if (set) return set;
-  const carried = prev[key]?.trim();
-  return carried || void 0;
-}
-var ACME_ENV_KEYS = [
-  "OPENSHIP_ACME_EMAIL",
-  "OPENSHIP_ACME_DIRECTORY_URL",
-  "OPENSHIP_ACME_EAB_KID",
-  "OPENSHIP_ACME_EAB_HMAC_KEY",
-  "OPENSHIP_ACME_KEY_TYPE",
-  "OPENSHIP_ACME_CA_BUNDLE",
-  "OPENSHIP_ACME_TOS_AGREED"
-];
-function renderAcmeEnv(prev) {
-  return ACME_ENV_KEYS.flatMap((key) => {
-    const value = process.env[key]?.trim() || prev[key]?.trim();
-    if (!value) return [];
-    if (/[\r\n]/.test(value)) throw new Error(`${key} must be a single-line value`);
-    return [`${key}=${value}`];
-  });
-}
-function resolveEnvConfig(prev, opts) {
-  const publicUrl = keepConfig(prev, "OPENSHIP_PUBLIC_URL", opts.publicUrl);
-  const bindAddr = keepConfig(prev, "OPENSHIP_BIND_ADDR") ?? (publicUrl ? "0.0.0.0" : void 0);
-  return {
-    apiPort: keepConfig(prev, "API_PORT", opts.apiPort) ?? String(DEFAULT_API_PORT),
-    dashPort: keepConfig(prev, "DASHBOARD_PORT", opts.dashboardPort) ?? String(DEFAULT_DASHBOARD_PORT),
-    ...bindAddr ? { bindAddr } : {},
-    ...publicUrl ? { publicUrl } : {},
-    // A public URL always implies a proxy in front; otherwise keep whatever the
-    // install was configured with.
-    trustProxy: Boolean(opts.trustProxy) || Boolean(publicUrl) || prev.TRUST_PROXY === "true",
-    ...keepConfig(prev, "OPENSHIP_EXTRA_TRUSTED_ORIGINS", opts.extraTrustedOrigins) ? {
-      extraTrustedOrigins: keepConfig(
-        prev,
-        "OPENSHIP_EXTRA_TRUSTED_ORIGINS",
-        opts.extraTrustedOrigins
-      )
-    } : {},
-    registry: keepConfig(prev, "OPENSHIP_IMAGE_REGISTRY", opts.registry) ?? DEFAULT_IMAGE_REGISTRY,
-    // Tri-state: the flag is absent on a plain re-run, so fall back to what the
-    // install chose rather than silently re-granting host control.
-    hostControl: opts.noHostControl === void 0 ? prev.OPENSHIP_HOST_CONTROL !== "false" : !opts.noHostControl
-  };
-}
-function toPort(value) {
-  const n2 = Number(value);
-  return Number.isInteger(n2) && n2 > 0 && n2 <= 65535 ? n2 : void 0;
-}
-function composeEnvPorts() {
-  const env = readEnvFile();
-  return { api: toPort(env.API_PORT), dashboard: toPort(env.DASHBOARD_PORT) };
-}
-function composeBindAddr() {
-  return readEnvFile().OPENSHIP_BIND_ADDR?.trim() || "127.0.0.1";
-}
-function composeTrustedOriginUrls() {
-  const env = readEnvFile();
-  return [env.OPENSHIP_PUBLIC_URL, env.OPENSHIP_EXTRA_TRUSTED_ORIGINS].filter(
-    (v2) => !!v2?.trim()
-  );
-}
-function composeHeldPorts() {
-  const r2 = spawnSync3(
-    "docker",
-    ["ps", "--format", '{{.Label "com.docker.compose.project.config_files"}}	{{.Ports}}'],
-    { encoding: "utf8" }
-  );
-  if (r2.status !== 0 || !r2.stdout) return [];
-  const ports = /* @__PURE__ */ new Set();
-  for (const line of r2.stdout.split("\n")) {
-    const [configFiles = "", published = ""] = line.split("	");
-    if (!configFiles.split(",").some((f2) => f2.trim() === COMPOSE_FILE)) continue;
-    for (const m2 of published.matchAll(/:(\d+)->/g)) ports.add(Number(m2[1]));
-  }
-  return [...ports];
-}
-async function resolveComposePorts(prefs, opts = {}) {
-  return resolvePorts(
-    {
-      api: toPort(prefs.api),
-      dashboard: toPort(prefs.dashboard),
-      previous: composeEnvPorts(),
-      bindAddr: composeBindAddr(),
-      reclaimable: composeHeldPorts()
-    },
-    opts
-  );
-}
-function renderEnv(opts, host, cfg) {
-  const prev = readEnvFile();
-  const lines = [
-    "# Managed by `openship up`. Secrets are generated once and preserved.",
-    // Do NOT edit on a live install — it is the volume prefix (see composeProjectName).
-    `COMPOSE_PROJECT_NAME=${composeProjectName(prev)}`,
-    "CLOUD_MODE=false",
-    "OPENSHIP_TARGET=local",
-    "OPENSHIP_REQUIRE_AUTH=true",
-    // Read by createHostExecutor (throws when false) and by the servers list
-    // (hides the local row). Written explicitly so the policy is visible in .env.
-    `OPENSHIP_HOST_CONTROL=${cfg.hostControl ? "true" : "false"}`,
-    `OPENSHIP_IMAGE_REGISTRY=${cfg.registry}`,
-    `OPENSHIP_VERSION=${opts.version || (true ? "0.6.1" : "latest")}`,
-    `POSTGRES_PASSWORD=${keepSecret(prev, "POSTGRES_PASSWORD")}`,
-    // Pinned once (see resolvePgData): fresh install → subdir, existing volume → root.
-    `OPENSHIP_PGDATA=${resolvePgData(prev)}`,
-    `BETTER_AUTH_SECRET=${keepSecret(prev, "BETTER_AUTH_SECRET")}`,
-    `INTERNAL_TOKEN=${keepSecret(prev, "INTERNAL_TOKEN")}`,
-    `API_PORT=${cfg.apiPort}`,
-    `DASHBOARD_PORT=${cfg.dashPort}`,
-    // The api's OWN view of the dashboard port: the self-app boot reconcile points
-    // the operator's domain at the dashboard through this (self-deploy.ts), and it
-    // silently defaults to 3001 when unset. Ports are dynamic now, so leaving it
-    // out publishes a domain routed to a port nothing is listening on.
-    `OPENSHIP_DASHBOARD_PORT=${cfg.dashPort}`,
-    // Alternate CA/EAB values are operator configuration (including one secret),
-    // so a routine `openship up`/upgrade must not silently discard them.
-    ...renderAcmeEnv(prev)
-  ];
-  if (cfg.bindAddr) lines.push(`OPENSHIP_BIND_ADDR=${cfg.bindAddr}`);
-  if (cfg.publicUrl) lines.push(`OPENSHIP_PUBLIC_URL=${cfg.publicUrl}`);
-  if (cfg.extraTrustedOrigins) {
-    lines.push(`OPENSHIP_EXTRA_TRUSTED_ORIGINS=${cfg.extraTrustedOrigins}`);
-  }
-  if (cfg.trustProxy) lines.push("TRUST_PROXY=true");
-  if (host) {
-    lines.push(
-      "OPENSHIP_HOST_SSH_HOST=host.docker.internal",
-      `OPENSHIP_HOST_SSH_USER=${host.user}`,
-      "OPENSHIP_HOST_SSH_PORT=22",
-      "OPENSHIP_HOST_SSH_KEY=/run/secrets/openship_host_key",
-      `OPENSHIP_HOST_KEY_PATH=${host.keyPath}`
-    );
-  }
-  return lines.join("\n") + "\n";
-}
-function sourceBuildDir() {
-  const marker = readSourceInstall();
-  if (!marker?.dir) return null;
-  const hasAll = BUILT_SERVICES.every((s2) => existsSync4(join7(marker.dir, s2.dockerfile)));
-  return hasAll ? marker.dir : null;
-}
-function renderBuildOverride(repoDir) {
-  const services = BUILT_SERVICES.map(
-    (s2) => `  ${s2.service}:
-    build:
-      context: ${repoDir}
-      dockerfile: ${s2.dockerfile}
-`
-  ).join("");
-  return `# Managed by \`openship up\` (from-source install) \u2014 builds instead of pulls.
-services:
-${services}`;
-}
-function materialize(opts) {
-  mkdirSync3(COMPOSE_DIR, { recursive: true, mode: 448 });
-  const prev = readEnvFile();
-  const cfg = resolveEnvConfig(prev, opts);
-  const host = provisionHostSshChannel(cfg.hostControl);
-  let before = "";
-  try {
-    before = readFileSync3(ENV_FILE, "utf8");
-  } catch {
-  }
-  const rendered = renderEnv(opts, host, cfg);
-  writeFileSync2(COMPOSE_FILE, COMPOSE_YAML);
-  writeFileSync2(ENV_FILE, rendered, { mode: 384 });
-  const buildDir = opts.build === false ? null : sourceBuildDir();
-  if (buildDir) writeFileSync2(BUILD_FILE, renderBuildOverride(buildDir));
-  return { buildDir, cfg, envChanged: before !== "" && rendered !== before };
-}
-var SECRET_ENV_KEY = /(PASSWORD|SECRET|TOKEN|HMAC_KEY)$/;
-function composePlan(opts) {
-  const prev = readEnvFile();
-  const cfg = resolveEnvConfig(prev, opts);
-  const buildDir = opts.build === false ? null : sourceBuildDir();
-  const hostChannel = plannedHostChannel(cfg.hostControl);
-  const settings = [];
-  const newSecrets = [];
-  for (const line of renderEnv(opts, hostChannel, cfg).split("\n")) {
-    const at2 = line.indexOf("=");
-    if (at2 < 1 || line.startsWith("#")) continue;
-    const key = line.slice(0, at2);
-    if (!SECRET_ENV_KEY.test(key)) {
-      settings.push({ key, value: line.slice(at2 + 1) });
-      continue;
-    }
-    const minted = !prev[key];
-    if (minted) newSecrets.push(key);
-    settings.push({ key, value: minted ? "<generated on this run>" : "<preserved>" });
-  }
-  return {
-    composeFile: COMPOSE_FILE,
-    envFile: ENV_FILE,
-    installMethodFile: INSTALL_METHOD_FILE,
-    ...buildDir ? { buildFile: BUILD_FILE } : {},
-    yaml: COMPOSE_YAML,
-    settings,
-    newSecrets,
-    existing: Object.keys(prev).length > 0,
-    mountDirs: EDGE_CONTAINER_MOUNTS.map((m2) => m2.host),
-    buildDir,
-    hostChannel
-  };
-}
-function dbVolumeExists(project) {
-  const r2 = spawnSync3("docker", ["volume", "inspect", `${project}_postgres_data`], {
-    stdio: "ignore"
-  });
-  return r2.status === 0;
-}
-function compose(args, opts) {
-  const files = ["-f", COMPOSE_FILE];
-  if (opts?.withBuildOverride) files.push("-f", BUILD_FILE);
-  const r2 = spawnSync3("docker", ["compose", ...files, ...args], {
-    cwd: COMPOSE_DIR,
-    stdio: opts?.quiet ? "ignore" : "inherit"
-  });
-  return r2.status ?? 1;
-}
-function composePrefetch(opts) {
-  const { buildDir } = materialize(opts);
-  if (buildDir) {
-    return compose(["pull", "postgres", "redis"], { withBuildOverride: true }) === 0 && compose(["build"], { withBuildOverride: true }) === 0;
-  }
-  return compose(["pull"]) === 0;
-}
-function ensureEdgeMountDirs() {
-  const failed = [];
-  for (const { host } of EDGE_CONTAINER_MOUNTS) {
-    try {
-      mkdirSync3(host, { recursive: true });
-    } catch (err) {
-      if (err.code !== "EEXIST") failed.push(host);
-    }
-  }
-  return failed;
-}
-function isRootlessDocker() {
-  const r2 = spawnSync3("docker", ["info", "-f", "{{println .SecurityOptions}}"], {
-    encoding: "utf8"
-  });
-  return r2.status === 0 && /rootless/i.test(r2.stdout ?? "");
-}
-async function composeUp(opts) {
-  const { buildDir, cfg, envChanged } = materialize(opts);
-  const apiPort = cfg.apiPort;
-  const dashPort = cfg.dashPort;
-  const up = (extra = {}) => compose(
-    envChanged ? ["up", "-d", "--force-recreate", ...ENV_CONSUMING_SERVICES] : ["up", "-d"],
-    extra
-  );
-  const env = readEnvFile();
-  const project = env.COMPOSE_PROJECT_NAME || "openship";
-  removeOrphanedStack(project);
-  reconcileEdgeContainerName(project);
-  migrateLegacyEdgeVolumes(project);
-  warnOrphanedVolumes(project);
-  const unmakeableMounts = ensureEdgeMountDirs();
-  if (unmakeableMounts.length && isRootlessDocker()) {
-    const dirs = unmakeableMounts.join(" ");
-    console.error(
-      `
-  Rootless Docker can't create the edge's host directories under root-owned paths:
-    ${unmakeableMounts.join("\n    ")}
-
-  Create them once (owned by your user), then re-run \`openship up --compose\`:
-    sudo mkdir -p ${dirs}
-    sudo chown -R "$(id -un)" ${dirs}
-`
-    );
-    return { ok: false, apiPort, dashPort };
-  }
-  if (dbVolumeExists(project)) {
-    reconcileDbPassword(env.POSTGRES_USER || "openship", env.POSTGRES_PASSWORD ?? "");
-  }
-  await sanitizeEdgeVhosts(
-    new LocalExecutor(),
-    EDGE_SITES_HOST_DIR,
-    (l2) => console.log(`  ${l2.message}`)
-  ).catch(() => {
-  });
-  if (buildDir) {
-    if (!opts.alreadyFetched) {
-      if (compose(["pull", "postgres", "redis"], { withBuildOverride: true }) !== 0) {
-        return { ok: false, apiPort, dashPort };
-      }
-      if (compose(["build"], { withBuildOverride: true }) !== 0) {
-        return { ok: false, apiPort, dashPort };
-      }
-    }
-    if (up({ withBuildOverride: true }) !== 0) {
-      return { ok: false, apiPort, dashPort };
-    }
-    onEdgeContainerChanged();
-    writeInstallMethod("compose");
-    return { ok: true, apiPort, dashPort };
-  }
-  if (!opts.alreadyFetched && compose(["pull"]) !== 0) {
-    return { ok: false, apiPort, dashPort };
-  }
-  if (up() !== 0) return { ok: false, apiPort, dashPort };
-  onEdgeContainerChanged();
-  writeInstallMethod("compose");
-  return { ok: true, apiPort, dashPort };
-}
-function onEdgeContainerChanged() {
-  invalidateEdgeContainer();
-}
-function composeDown() {
-  if (!existsSync4(COMPOSE_FILE)) return false;
-  return compose(["down"]) === 0;
-}
-function composeUninstall(opts = {}) {
-  const removedImages = [];
-  const ok = existsSync4(COMPOSE_FILE) ? compose(["down", "-v", "--remove-orphans"]) === 0 : false;
-  if (opts.removeImages) {
-    const env = readEnvFile();
-    const registry = env.OPENSHIP_IMAGE_REGISTRY || DEFAULT_IMAGE_REGISTRY;
-    const version = env.OPENSHIP_VERSION || "latest";
-    for (const { service } of BUILT_SERVICES) {
-      const ref = `${registry}/openship-${service}:${version}`;
-      if (spawnSync3("docker", ["image", "rm", "-f", ref], { stdio: "ignore" }).status === 0) {
-        removedImages.push(ref);
-      }
-    }
-  }
-  return { ok, removedImages };
-}
-async function composeUpdate(version) {
-  if (!existsSync4(COMPOSE_FILE)) return false;
-  return (await composeUp(version ? { version } : {})).ok;
-}
-function composePs() {
-  return compose(["ps"]);
-}
-function composeRunning() {
-  const r2 = spawnSync3(
-    "docker",
-    ["compose", "-f", COMPOSE_FILE, "ps", "--status", "running", "-q"],
-    { cwd: COMPOSE_DIR, encoding: "utf8" }
-  );
-  return r2.status === 0 && r2.stdout.trim().length > 0;
-}
-function composeStart() {
-  reconcileEdgeContainerName(readEnvFile().COMPOSE_PROJECT_NAME || "openship");
-  return compose(["up", "-d"], { quiet: true }) === 0;
-}
-function composeRestart() {
-  return compose(["restart"], { quiet: true }) === 0;
-}
-function composeInternalToken() {
-  return readEnvFile().INTERNAL_TOKEN ?? null;
-}
-
-// src/lib/edge-import.ts
-async function waitForApiHealth(port, tries) {
-  for (let i2 = 0; i2 < tries; i2++) {
-    try {
-      const r2 = await fetch(`http://127.0.0.1:${port}/api/health`, { signal: AbortSignal.timeout(2e3) });
-      if (r2.ok) return true;
-    } catch {
-    }
-    await new Promise((r2) => setTimeout(r2, 1e3));
-  }
-  return false;
-}
-async function waitForEdgeRunning(tries) {
-  const exec = new LocalExecutor();
-  for (let i2 = 0; i2 < tries; i2++) {
-    const out = await exec.exec(`docker inspect -f '{{.State.Running}}' ${EDGE_CONTAINER_NAME}`).catch(() => "");
-    if (out.trim() === "true") return true;
-    await new Promise((r2) => setTimeout(r2, 1e3));
-  }
-  return false;
-}
-async function importMigratedSites(apiPort, sites, certPems, staticRootOverrides) {
-  const token = composeInternalToken();
-  if (!token) {
-    const error = "couldn't read the stack's internal token";
-    console.log(chalk.yellow(`  Skipping site import \u2014 ${error}. Re-run to retry.
-`));
-    return { ok: false, registered: [], error };
-  }
-  const spinner = ora(
-    `Importing ${sites.length} migrated site${sites.length === 1 ? "" : "s"} into the edge\u2026`
-  ).start();
-  if (!await waitForApiHealth(apiPort, 60)) {
-    const error = "API didn't become healthy in time";
-    spinner.warn(`${error} \u2014 migrated sites not imported. Re-run \`openship up\` to retry.`);
-    return { ok: false, registered: [], error };
-  }
-  if (!await waitForEdgeRunning(60)) {
-    const error = `the ${EDGE_CONTAINER_NAME} container isn't running yet`;
-    spinner.warn(`${error} \u2014 migrated sites not imported. Re-run \`openship up\` to retry.`);
-    return { ok: false, registered: [], error };
-  }
-  try {
-    const r2 = await fetch(`http://127.0.0.1:${apiPort}/api/system/edge/import-sites`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json", "X-Internal-Token": token },
-      body: JSON.stringify({ sites, certPems, staticRootOverrides }),
-      signal: AbortSignal.timeout(12e4)
-    });
-    const data = await r2.json().catch(() => ({}));
-    if (!r2.ok) {
-      const error = data.error ?? `HTTP ${r2.status}`;
-      spinner.warn(`Site import failed: ${error}. Re-run to retry.`);
-      return { ok: false, registered: [], error };
-    }
-    const registered = data.registered ?? [];
-    const warnings = data.warnings ?? [];
-    const missed = sites.length - registered.length;
-    if (sites.length > 0 && registered.length === 0) {
-      spinner.fail(
-        `Migrated NONE of the ${sites.length} site${sites.length === 1 ? "" : "s"} \u2014 Openship holds :80/:443 and ${sites.length === 1 ? "that hostname is" : "those hostnames are"} NOT being served.`
-      );
-      for (const w2 of warnings.slice(0, 8)) console.log(chalk.red(`    \u2022 ${w2}`));
-      const edgeLog = await edgeCrashReason(new LocalExecutor());
-      if (edgeLog) {
-        console.log(chalk.red(`
-  The edge container is not running. Its log says:`));
-        console.log(chalk.red(`    ${edgeLog}`));
-      }
-      console.log(
-        chalk.yellow(
-          `
-  Retry the import with \`openship up\` once the cause above is fixed, or put your
-  previous proxy back:  docker stop ${EDGE_CONTAINER_NAME} && sudo systemctl enable --now nginx
-`
-        )
-      );
-      return { ok: false, registered, error: warnings[0] ?? "no sites were registered" };
-    }
-    if (missed > 0) {
-      spinner.warn(
-        `Migrated ${registered.length}/${sites.length} sites \u2014 ${missed} not served (see below).`
-      );
-      for (const w2 of warnings.slice(0, 8)) console.log(chalk.yellow(`    \u2022 ${w2}`));
-      return { ok: false, registered, error: `${missed} site(s) not registered` };
-    }
-    spinner.succeed(
-      `Migrated ${registered.length} site${registered.length === 1 ? "" : "s"} into Openship's edge.`
-    );
-    for (const w2 of warnings.slice(0, 8)) console.log(chalk.dim(`    \u2022 ${w2}`));
-    return { ok: true, registered };
-  } catch (e2) {
-    const error = e2.message;
-    spinner.warn(`Site import failed: ${error}. Re-run to retry.`);
-    return { ok: false, registered: [], error };
+  const env = {};
+  for (const line of text.split("\n")) {
+    const m2 = line.match(/^([A-Z0-9_]+)=(.*)$/);
+    if (m2) env[m2[1]] = m2[2];
   }
+  return { env, unreadable: null };
 }
 
 export {
-  OS_DIR,
-  IS_ALT_HOME,
-  DATA_DIR,
-  LOG_DIR,
-  AUTH_SECRET_FILE,
-  INTERNAL_TOKEN_FILE,
-  PORTS_FILE,
-  saveInstanceUrl,
-  readInstanceUrl,
-  readStoredPorts,
-  storedApiPort,
-  storedDashboardPort,
-  portMoveNotice,
-  resolvePorts,
-  DEFAULT_REPO,
-  SOURCE_CHECKOUT_DIR,
-  SOURCE_DIST_DIR,
-  has,
-  shortSha,
-  prepareFromSource,
-  readSourceInstall,
-  remoteSha,
-  rebuildFromSource,
-  readInstallMethod,
-  dockerGap,
-  hasDockerCompose,
-  dockerInstallPreview,
-  ensureDocker,
-  composeTrustedOriginUrls,
-  resolveComposePorts,
-  sourceBuildDir,
-  composePlan,
-  composePrefetch,
-  composeUp,
-  composeDown,
-  composeUninstall,
-  composeUpdate,
-  composePs,
-  composeRunning,
-  composeStart,
-  composeRestart,
-  composeInternalToken,
-  waitForApiHealth,
-  waitForEdgeRunning,
-  importMigratedSites
+  resolveLocalEnvironmentSync,
+  thisHost,
+  pasteable,
+  startUnitHint,
+  COMPOSE_DIR,
+  COMPOSE_FILE,
+  COMPOSE_ENV_FILE,
+  composeInstallExists,
+  readComposeEnvFile
 };