openship 0.6.1 → 0.6.6

package/dist/server/migrations/0098_instance_product_mode.sql

@@ -0,0 +1,12 @@
+-- Openship Mail: which product this instance presents itself as.
+--
+-- Nullable with NO default, deliberately. The instance_settings row exists on
+-- every instance, so a NOT NULL DEFAULT 'platform' would write a concrete value
+-- everywhere and permanently shadow the OPENSHIP_PRODUCT env var — the resolver
+-- reads `settings.product_mode ?? env.OPENSHIP_PRODUCT`, so "unset" has to stay
+-- representable. NULL means "no instance override".
+--
+-- Presentation scope only: this hides nav entries and rebrands the shell. It is
+-- not an authorization boundary and no route reads it — webmail deploys through
+-- the ordinary project pipeline, so the platform endpoints stay live in mail mode.
+ALTER TABLE "instance_settings" ADD COLUMN IF NOT EXISTS "product_mode" text;

package/dist/server/migrations/0099_mail_webmail_project.sql

@@ -0,0 +1,24 @@
+-- The webmail project serving a mail server, as a stored FK.
+--
+-- Webmail is now an ordinary catalog app (packages/core/src/apps/catalog/webmail.json)
+-- installed through the SAME generic installer as every other app, so its slug is
+-- derived from the project NAME the operator typed. The link therefore cannot be a
+-- naming convention any more: the old lookup parsed `webmail-<serverId>` back out of
+-- the slug, which the generic installer never produces — and which, while it existed,
+-- mislinked any project a user happened to name "Webmail Prod" (slug `webmail-prod`,
+-- read back as mail server "prod").
+--
+-- Nullable: most servers have no webmail, and an operator may run one outside
+-- openship. ON DELETE SET NULL so deleting the webmail project clears the link and
+-- /emails falls back to the install CTA rather than pointing at a row that is gone.
+--
+-- No backfill. A pre-existing webmail project still carries the retired
+-- `mail-webmail` template id and the `webmail-<serverId>` slug; the mail status
+-- resolver keeps that legacy slug lookup as a fallback for exactly those rows, and
+-- stamps this column the first time it resolves one.
+ALTER TABLE "mail_servers" ADD COLUMN IF NOT EXISTS "webmail_project_id" text;--> statement-breakpoint
+
+DO $$ BEGIN
+  ALTER TABLE "mail_servers" ADD CONSTRAINT "mail_servers_webmail_project_id_project_id_fk"
+    FOREIGN KEY ("webmail_project_id") REFERENCES "public"."project"("id") ON DELETE set null ON UPDATE no action;
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;

package/dist/server/migrations/0100_server_ssh_private_key.sql

@@ -0,0 +1,11 @@
+-- Pasted / uploaded SSH private-key material, stored encrypted at rest (enc1:).
+--
+-- Nullable with no default. The existing `ssh_key_path` points at a key file on
+-- the API host — useless on a remote / VPS instance where the operator's key
+-- lives on their own machine. This column holds the key bytes themselves so the
+-- dashboard can paste or upload a key from any browser; buildSshConfig() prefers
+-- it (decrypted) over reading `ssh_key_path` off disk.
+--
+-- Write-only: never serialized back to the client, and listed in
+-- ENCRYPTED_COLUMNS so it is stripped from any cross-host dump/restore.
+ALTER TABLE "servers" ADD COLUMN IF NOT EXISTS "ssh_private_key" text;

package/dist/server/migrations/0101_mail_resume_step.sql

@@ -0,0 +1,12 @@
+-- The setup step an incomplete mail install is paused at, mirrored from the
+-- on-host state file's `resumeStep` whenever the wizard halts (a failed step,
+-- or a DNS/PTR hold). NULL once the install completes or before it ever halts.
+--
+-- Lets the /emails server list surface WHERE an incomplete install stopped
+-- ("Stopped · step 6: Retrieve DKIM Keys") without the per-server SSH probe
+-- this table exists to avoid — only the step id is stored; the human label is
+-- derived from it against MAIL_SETUP_STEPS.
+--
+-- Nullable, no default, no backfill: a pre-existing incomplete install gets its
+-- step stamped the next time the wizard halts (or cleared on completion).
+ALTER TABLE "mail_servers" ADD COLUMN IF NOT EXISTS "resume_step" integer;

package/dist/server/migrations/0102_project_workload_axes.sql

@@ -0,0 +1,19 @@
+-- Deployment-class axes — deconflate the legacy `has_server` / `has_build`
+-- booleans, which each mixed two independent concerns (issue #538). See
+-- @repo/core deployment-class.ts.
+--
+-- All three are EXPLICIT OVERRIDES: NULL means "derive from the legacy flags +
+-- framework + source", so every pre-existing project keeps classifying exactly
+-- as before and no backfill is needed. `has_server` / `has_build` are kept and
+-- written in sync, never dropped — rollback snapshots and every legacy reader
+-- still depend on them.
+--
+--   source_kind    text  "git" | "image" | "upload"      (git needs a clone)
+--   build_kind     text  "dockerfile" | "buildpack" | "static" | "prebuilt"
+--   workload_type  text  "web" | "worker" | "static"     (worker = portless
+--                        long-running container: no port, no route)
+ALTER TABLE "project" ADD COLUMN IF NOT EXISTS "source_kind" text;
+--> statement-breakpoint
+ALTER TABLE "project" ADD COLUMN IF NOT EXISTS "build_kind" text;
+--> statement-breakpoint
+ALTER TABLE "project" ADD COLUMN IF NOT EXISTS "workload_type" text;

package/dist/server/migrations/0103_dns_credential.sql

@@ -0,0 +1,41 @@
+-- DNS provider credentials — the token that lets Openship write a domain's records.
+--
+-- Adding a custom domain has always ended the same way: Openship computes the exact
+-- A/CNAME + `_openship-challenge` TXT records and then asks the operator to go paste
+-- them somewhere else. Every minute between "added" and "pasted" is a domain that
+-- doesn't resolve, can't pass ACME, and looks broken. With a scoped provider token we
+-- write those records ourselves and the domain verifies on its own.
+--
+-- The token is the sensitive part: Zone:Read + DNS:Edit can rewrite every record in
+-- every zone it can see, so it is stored ONLY as an `enc1:` AES-256-GCM envelope
+-- (`encryptSecretField`) and is never returned by the API — not in full, not as a
+-- prefix. `status` exists so a token that gets revoked upstream becomes visible in the
+-- UI instead of silently turning auto-provisioning off forever.
+CREATE TABLE IF NOT EXISTS "dns_credential" (
+  "id" text PRIMARY KEY NOT NULL,
+  "organization_id" text NOT NULL REFERENCES "organization"("id") ON DELETE CASCADE,
+  -- Provider name ("cloudflare"). Text, not an enum: adding a provider should be a
+  -- registry entry, not a migration.
+  "provider" text NOT NULL,
+  -- Operator-facing label, e.g. "Cloudflare production".
+  "name" text NOT NULL,
+  "api_token_enc" text NOT NULL,
+  -- active | invalid. Flipped to 'invalid' by the provisioning path when the provider
+  -- answers 401/403, which is the only moment we learn a stored token stopped working.
+  "status" text NOT NULL DEFAULT 'active',
+  "last_verified_at" timestamp,
+  "created_at" timestamp NOT NULL DEFAULT now(),
+  "updated_at" timestamp NOT NULL DEFAULT now()
+);
+--> statement-breakpoint
+-- Zone resolution runs on EVERY domain add and remove and asks one question: "this
+-- org's active credentials". Leading org column means the plain org-wide listing rides
+-- the same index as a prefix, so this is the only one the table needs.
+CREATE INDEX IF NOT EXISTS "idx_dns_credential_org_status"
+  ON "dns_credential" ("organization_id", "status");
+--> statement-breakpoint
+-- One label per provider per org. A second "Cloudflare production" is a double-submit,
+-- and two credentials that resolve the same zone makes "which token wrote this record"
+-- unanswerable at cleanup time.
+CREATE UNIQUE INDEX IF NOT EXISTS "uq_dns_credential_org_provider_name"
+  ON "dns_credential" ("organization_id", "provider", "name");

package/dist/server/migrations/0104_instance_host_control.sql

@@ -0,0 +1,15 @@
+-- Runtime host-control toggle (#527): may OpenShip deploy to the machine it runs on?
+--
+-- Nullable with NO default, deliberately — the same contract as product_mode
+-- (0098). The instance_settings row exists on every instance, so a NOT NULL
+-- DEFAULT would write a concrete value everywhere and permanently shadow the
+-- OPENSHIP_HOST_CONTROL env var (written by `openship up --no-host-control`).
+-- The resolver reads `settings.host_control_enabled ?? env`, so "unset" has to
+-- stay representable. NULL means "no instance override, use env".
+--
+-- Unlike product_mode this DOES gate privileged behavior (host-root deploys via
+-- the container->host SSH channel + mounted docker socket), so the WRITE path is
+-- gated to the box-owning org's owner. The precedence still lets the DB override
+-- env: the operator's need is to re-enable from Settings what --no-host-control
+-- turned off.
+ALTER TABLE "instance_settings" ADD COLUMN IF NOT EXISTS "host_control_enabled" boolean;

package/dist/server/migrations/0105_mail_inbound_rules.sql

@@ -0,0 +1,80 @@
+-- Inbound-mail notification rules — "mail arrives at a watched address, tell me in a channel".
+--
+-- Capture is Postfix's own `recipient_bcc_maps`, which the shipped main.cf already points
+-- at two SQL tables in the engine's `vmail` DB (main.cf.pgsql:36-38). Arming a rule is
+-- therefore ONE row in `vmail.recipient_bcc_domain` — no postmap, no reload, no container
+-- recreate, and identical on the container and legacy host flavors, so it reaches every
+-- mail box already provisioned.
+--
+-- ONE TABLE, ON PURPOSE. The obvious second table — a record of each armed collector —
+-- would only cache state the mail engine already holds authoritatively: the token is
+-- literally inside `recipient_bcc_domain.bcc_address`
+-- (`openship-hook+<token>@<domain>`), the maildir is in `vmail.mailbox`, and "a foreign
+-- BCC took the slot" is derivable by comparing that address against our own prefix. A
+-- cache of the engine's own state is a thing that goes stale; the collector is READ from
+-- vmail instead.
+--
+-- What genuinely has to persist here is the RULES: they reference
+-- `notification_channel` ids, which exist only in this database, and they are created and
+-- edited from a dashboard tab. Keeping them on the mail box would make every list and
+-- toggle an SSH round-trip, and would make the rules unreadable exactly when the mail box
+-- is unreachable.
+--
+-- No cursor table either. The BCC copy is a full message in the collector's maildir, so
+-- the read job dispatches and then DELETES the file: deletion is the cursor, and it
+-- doubles as the prune that keeps a second full copy of every watched message from
+-- growing forever on a bind mount with no quota of its own.
+CREATE TABLE IF NOT EXISTS "mail_inbound_rule" (
+  "id" text PRIMARY KEY NOT NULL,
+  "server_id" text NOT NULL REFERENCES "mail_servers"("server_id") ON DELETE CASCADE,
+  -- Carried so dispatch can fan out to the right org's channels without joining back
+  -- through `servers`. This does NOT make the table organization-scope for dump purposes
+  -- (see dump.ts): its FK targets are instance-scope.
+  "organization_id" text NOT NULL REFERENCES "organization"("id") ON DELETE CASCADE,
+  -- Operator-facing label, e.g. "Support inbox → #support".
+  "name" text NOT NULL,
+  -- mailbox | domain | all. Text, not an enum: a new scope should be a registry entry and
+  -- a UI option, not a migration.
+  "scope" text NOT NULL,
+  -- Full address for `mailbox`, the domain for `domain`, NULL for `all`.
+  --
+  -- `all` is a genuine fan-out: there is no global `always_bcc` anywhere in the shipped
+  -- Postfix config, and the domain lookup keys on exact equality with no wildcard
+  -- convention — so it arms one row per domain and needs a reconcile when a domain is
+  -- added. There is deliberately no CHECK tying scope to target: this schema has no CHECK
+  -- constraints anywhere, and the SQL and the drizzle schema are hand-maintained in
+  -- parallel. The invariant is enforced fail-closed at the write boundary and in the
+  -- filter, where a mailbox rule with no target matches NOTHING rather than everything.
+  "target" text,
+  -- Optional extra matching, applied in the control plane at filter time so editing one
+  -- never touches the mail box.  NULL = match everything.
+  "from_pattern" text,
+  "subject_pattern" text,
+  -- Spam gate, and not optional in practice. The shipped amavis policy sets
+  -- spam_lover='Y' AND bad_header_lover='Y' on the catch-all '@.' policy with empty
+  -- quarantine targets, so the global $final_spam_destiny = D_DISCARD is dead for every
+  -- recipient: spam and bad-header mail ARE delivered and therefore ARE captured.
+  -- Nothing upstream filters on our behalf.
+  "max_spam_score" real,
+  -- Channel ids as a jsonb array, deliberately NOT a join table with an FK to
+  -- notification_channel: the dump's FK_PARENT maps a bare `channelId` column to that
+  -- table unconditionally for ANY table, which would make assertDumpSelfContained reject
+  -- any dump carrying a real join row on a remap path.
+  "channel_ids" jsonb NOT NULL DEFAULT '[]'::jsonb,
+  "enabled" boolean NOT NULL DEFAULT true,
+  -- Burst control state. The notification subsystem has no rate limiting or windowed
+  -- dedup of its own — that is explicitly the producer's job — so a mailing list hitting
+  -- a watched address must not become one alert per message.
+  "paused_reason" text,
+  "last_matched_at" timestamp,
+  "created_at" timestamp NOT NULL DEFAULT now(),
+  "updated_at" timestamp NOT NULL DEFAULT now()
+);
+--> statement-breakpoint
+-- The dispatch path's read on every tick: "enabled rules for this server".
+CREATE INDEX IF NOT EXISTS "idx_mail_inbound_rule_server_enabled"
+  ON "mail_inbound_rule" ("server_id", "enabled");
+--> statement-breakpoint
+-- The rules tab lists per org.
+CREATE INDEX IF NOT EXISTS "idx_mail_inbound_rule_org"
+  ON "mail_inbound_rule" ("organization_id");

package/dist/server/migrations/0106_mcp_call_tracking.sql

@@ -0,0 +1,23 @@
+-- MCP observability: attribute an audit row to the CLIENT that made it, and
+-- count how much a credential is used.
+--
+-- `source` already said "an AI assistant did this" (0088), unforgeably — but not
+-- WHICH assistant. With two clients connected under one user (Claude Desktop and
+-- Cursor, say) every row read the same, so "what did this agent do" could not be
+-- answered and disconnecting the wrong one was a coin flip. The column holds the
+-- canonical principal id the auth layer already mints (`oauth:<clientId>` /
+-- `pat:<tokenId>`), so it resolves to a name through existing tables.
+--
+-- The index is PARTIAL: only MCP rows ever carry a client id, and mcp.tool_called
+-- makes audit_event's highest-volume writer, so indexing the NULLs would be paid
+-- for on every insert in the table for no read.
+ALTER TABLE "audit_event" ADD COLUMN IF NOT EXISTS "source_client_id" text;--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "audit_event_org_client_idx"
+  ON "audit_event" ("organization_id", "source_client_id", "created_at" DESC)
+  WHERE "source_client_id" IS NOT NULL;--> statement-breakpoint
+
+-- Call counter for every bearer credential (manual PATs and the OAuth-binding
+-- rows behind MCP connections alike). NOT NULL DEFAULT 0 is safe here: existing
+-- rows genuinely have no counted history, and 0 alongside a non-null
+-- `last_used_at` reads correctly as "used before counting existed".
+ALTER TABLE "personal_access_token" ADD COLUMN IF NOT EXISTS "use_count" integer DEFAULT 0 NOT NULL;

package/dist/server/migrations/0107_build_minute_metering_indexes.sql

@@ -0,0 +1,20 @@
+-- Indexes for the build-minute allowance query.
+--
+-- `sumBuildMillisForOrg` joins build_session → deployment, filters on
+-- deployment.organization_id and windows on build_session.started_at. It used to
+-- run only on the billing page (once, on demand); it now runs on the plan gate in
+-- `createQueuedDeployment`, i.e. on every deploy. Neither side of that join had a
+-- supporting index — build_session carried only its primary key and
+-- deployment.organization_id had none — so the query was a double sequential scan
+-- whose cost grows with TOTAL deployment history across all orgs, not with the
+-- org being checked.
+--
+-- (domain.project_id, which the free-subdomain count joins on, is already covered
+-- by idx_domain_project.)
+CREATE INDEX IF NOT EXISTS "idx_build_session_started_at"
+  ON "build_session" ("started_at");--> statement-breakpoint
+
+-- Org scoping for the same join. Also serves the org-wide deployment listings,
+-- which had been scanning for the same reason.
+CREATE INDEX IF NOT EXISTS "idx_deployment_org"
+  ON "deployment" ("organization_id");

package/dist/server/migrations/0108_credential.sql

@@ -0,0 +1,68 @@
+-- Third-party credentials, in one place.
+--
+-- Openship needs other people's secrets for unrelated jobs — write a DNS record, pull a
+-- private image, later push a backup — and each job grew its own storage: a single token
+-- column on `dns_credential`, FIVE encrypted columns inlined on a backup destination, a
+-- channel's own on notifications. Same `enc1:` envelope in each, three shapes, three
+-- forms in the UI, and no way to reuse one credential for two features.
+--
+-- The unit here is the CREDENTIAL, deliberately not the thing that uses it. A backup
+-- destination is a place, a DNS zone is a zone, a notification channel is a route; each
+-- keeps its own row and points at a credential. That is what makes "one Cloudflare token
+-- for every zone" and "one ghcr.io login for every project" possible — the reuse is the
+-- point, fewer screens is the side effect.
+--
+-- Shape notes:
+--   • `provider` is TEXT, matching dns_credential's reasoning: adding a provider should
+--     be a registry entry in @repo/core, not a migration.
+--   • `selector` is what the credential APPLIES TO when one per provider is not enough —
+--     a registry host for `docker-registry`, NULL for an org-wide `cloudflare` token. It
+--     is stored normalized (see normalizeCredentialSelector) so the value a pull derives
+--     from an image reference matches the value the operator typed.
+--   • `secrets_enc` is ONE `enc1:` AES-256-GCM envelope over a JSON object, so a provider
+--     with several secret fields (an S3 key pair, an SFTP key + passphrase) needs no new
+--     columns. The readable half lives in `public_fields`, which is what the API can
+--     return without decrypting anything.
+--   • `status` + `last_error` exist so a credential that was revoked upstream becomes
+--     VISIBLE instead of silently failing every deploy or backup forever. `last_error` is
+--     the provider's redacted reason, never its response body.
+CREATE TABLE IF NOT EXISTS "credential" (
+  "id" text PRIMARY KEY NOT NULL,
+  "organization_id" text NOT NULL REFERENCES "organization"("id") ON DELETE CASCADE,
+  -- Provider id from CREDENTIAL_PROVIDERS ("docker-registry", "cloudflare").
+  "provider" text NOT NULL,
+  -- Operator-facing label, e.g. "GHCR read-only".
+  "name" text NOT NULL,
+  -- The resource this credential is for, normalized; NULL when the provider is org-wide.
+  "selector" text,
+  -- Non-secret fields (username, region, endpoint) — returned by the API as-is.
+  "public_fields" jsonb NOT NULL DEFAULT '{}'::jsonb,
+  -- Every secret field for this provider, as one enc1: envelope over a JSON object.
+  "secrets_enc" text NOT NULL,
+  -- active | invalid. Flipped to 'invalid' the moment a provider answers 401/403, which
+  -- is the only time we learn a stored credential stopped working.
+  "status" text NOT NULL DEFAULT 'active',
+  "last_verified_at" timestamp,
+  -- Redacted reason the last verify or use failed. Never provider response bodies.
+  "last_error" text,
+  "created_at" timestamp NOT NULL DEFAULT now(),
+  "updated_at" timestamp NOT NULL DEFAULT now()
+);
+--> statement-breakpoint
+-- The resolve path asks exactly one question — "this org's credential for this provider
+-- and this resource" — on every deploy that pulls and every domain that provisions.
+-- Leading org column means the plain org-wide listing and the per-provider listing both
+-- ride this index as prefixes, so it is the only lookup index the table needs. `status`
+-- is filtered in code: a handful of rows per org makes an extra column here dead weight.
+CREATE INDEX IF NOT EXISTS "idx_credential_org_provider_selector"
+  ON "credential" ("organization_id", "provider", "selector");
+--> statement-breakpoint
+-- One label per provider per resource per org. A second "GHCR read-only" for the same
+-- host is a double-submit, and two credentials matching one registry makes "which one
+-- authenticated this pull" unanswerable when one of them starts failing.
+--
+-- COALESCE, not a bare column: Postgres treats NULLs as DISTINCT in a unique index, so
+-- an org-wide provider (selector IS NULL — every Cloudflare token) would accept
+-- unlimited duplicates of the same name and this constraint would quietly do nothing.
+CREATE UNIQUE INDEX IF NOT EXISTS "uq_credential_org_provider_selector_name"
+  ON "credential" ("organization_id", "provider", COALESCE("selector", ''), "name");

package/dist/server/migrations/meta/_journal.json

@@ -687,6 +687,83 @@
       "when": 1787350907325,
       "tag": "0097_update_status_upstream_only",
       "breakpoints": true
+    },
+    {
+      "idx": 98,
+      "version": "7",
+      "when": 1787437307325,
+      "tag": "0098_instance_product_mode",
+      "breakpoints": true
+    },
+    {
+      "idx": 99,
+      "version": "7",
+      "when": 1787523707325,
+      "tag": "0099_mail_webmail_project",
+      "breakpoints": true
+    },
+    {
+      "idx": 100,
+      "version": "7",
+      "when": 1787610107325,
+      "tag": "0100_server_ssh_private_key",
+      "breakpoints": true
+    },
+    {
+      "idx": 101,
+      "version": "7",
+      "when": 1787696507325,
+      "tag": "0101_mail_resume_step",
+      "breakpoints": true
+    },
+    {
+      "idx": 102,
+      "version": "7",
+      "when": 1787782907325,
+      "tag": "0102_project_workload_axes",
+      "breakpoints": true
+    },
+    {
+      "idx": 103,
+      "version": "7",
+      "when": 1787869307325,
+      "tag": "0103_dns_credential",
+      "breakpoints": true
+    },
+    {
+      "idx": 104,
+      "version": "7",
+      "when": 1787955707325,
+      "tag": "0104_instance_host_control",
+      "breakpoints": true
+    },
+    {
+      "idx": 105,
+      "version": "7",
+      "when": 1788042107325,
+      "tag": "0105_mail_inbound_rules",
+      "breakpoints": true
+    },
+    {
+      "idx": 106,
+      "version": "7",
+      "when": 1788128507325,
+      "tag": "0106_mcp_call_tracking",
+      "breakpoints": true
+    },
+    {
+      "idx": 107,
+      "version": "7",
+      "when": 1788214907325,
+      "tag": "0107_build_minute_metering_indexes",
+      "breakpoints": true
+    },
+    {
+      "idx": 108,
+      "version": "7",
+      "when": 1788301307325,
+      "tag": "0108_credential",
+      "breakpoints": true
     }
   ]
 }

package/dist/{setup-M2ZDGH3O.js → setup-XGLGUUFW.js}

@@ -4,17 +4,18 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   SystemManager
-} from "./chunk-3NZICQHF.js";
-import "./chunk-IOT5ZX23.js";
-import "./chunk-IW2UKBVF.js";
-import "./chunk-ZCFVHA25.js";
-import "./chunk-EW6KB2J7.js";
+} from "./chunk-HKRQXPTI.js";
+import "./chunk-A4GXYE4L.js";
+import "./chunk-QVW76WDL.js";
+import "./chunk-RSR7PFIQ.js";
 import "./chunk-I3DPMTSF.js";
-import "./chunk-VZ2ZHPS2.js";
-import "./chunk-3LDWWY7U.js";
-import "./chunk-YIPMDGG6.js";
+import "./chunk-4I2BM2DT.js";
+import "./chunk-YMMQRE5J.js";
+import "./chunk-UVNMQM7W.js";
 import "./chunk-ZFJXPCQP.js";
-import "./chunk-OTLSJYAC.js";
+import "./chunk-2YM3NI2E.js";
+import "./chunk-SM26HDS2.js";
+import "./chunk-UJ6JZM65.js";
 import "./chunk-PXKCZB2I.js";
 export {
   SystemManager

package/dist/ssh-client-JBMA7SN4.js

@@ -0,0 +1,28 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  DOCKER_DIAL_STDIO_COMMAND,
+  attachDialStdioDiagnostics,
+  connectSshClient,
+  dialStdioDiagnostics,
+  execSshCommand,
+  openDockerDialStdioChannel,
+  openSftp,
+  openSshExecChannel,
+  openSshUnixSocket
+} from "./chunk-PCPVTH6M.js";
+import "./chunk-UJ6JZM65.js";
+import "./chunk-PXKCZB2I.js";
+export {
+  DOCKER_DIAL_STDIO_COMMAND,
+  attachDialStdioDiagnostics,
+  connectSshClient,
+  dialStdioDiagnostics,
+  execSshCommand,
+  openDockerDialStdioChannel,
+  openSftp,
+  openSshExecChannel,
+  openSshUnixSocket
+};

package/dist/up-K4BV7466.js

@@ -0,0 +1,57 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  normalizeUrl,
+  runHeadlessProvision,
+  startService,
+  upCommand
+} from "./chunk-NK5N5LXN.js";
+import "./chunk-WVAML4H6.js";
+import "./chunk-VTGPEC6B.js";
+import "./chunk-5DMWSTOM.js";
+import "./chunk-QWHBRY2K.js";
+import "./chunk-CBLD2HS5.js";
+import "./chunk-ELGRMZOW.js";
+import "./chunk-HKRQXPTI.js";
+import "./chunk-ONKEYSMY.js";
+import "./chunk-XZYFZ6A5.js";
+import "./chunk-PDW4L3NV.js";
+import "./chunk-DOD2BXHQ.js";
+import "./chunk-42WQABXM.js";
+import "./chunk-DRK3MEDS.js";
+import "./chunk-3NQQXMDR.js";
+import "./chunk-ZWLDLTJP.js";
+import "./chunk-FE7ZZQSE.js";
+import "./chunk-OBPKYXQL.js";
+import "./chunk-A4GXYE4L.js";
+import "./chunk-QVW76WDL.js";
+import "./chunk-RSR7PFIQ.js";
+import "./chunk-I3DPMTSF.js";
+import "./chunk-WNWQBB7F.js";
+import "./chunk-2GWYYHOR.js";
+import "./chunk-RXQBD4ZY.js";
+import "./chunk-77QDF6UD.js";
+import "./chunk-LUKYPVJ4.js";
+import "./chunk-LFE5KQ7Y.js";
+import "./chunk-YIMOCZBZ.js";
+import "./chunk-LH2PLRQO.js";
+import "./chunk-MLYSEZQB.js";
+import "./chunk-Q7WGTQQ5.js";
+import "./chunk-PCPVTH6M.js";
+import "./chunk-6FH4AXVY.js";
+import "./chunk-4I2BM2DT.js";
+import "./chunk-YMMQRE5J.js";
+import "./chunk-UVNMQM7W.js";
+import "./chunk-ZFJXPCQP.js";
+import "./chunk-2YM3NI2E.js";
+import "./chunk-SM26HDS2.js";
+import "./chunk-UJ6JZM65.js";
+import "./chunk-PXKCZB2I.js";
+export {
+  normalizeUrl,
+  runHeadlessProvision,
+  startService,
+  upCommand
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openship",
-  "version": "0.6.1",
+  "version": "0.6.6",
   "description": "Openship CLI - deploy, manage, and open your Openship platform from the terminal",
   "license": "Apache-2.0",
   "repository": {
@@ -20,6 +20,9 @@
   "bin": {
     "openship": "./dist/node-entry.js"
   },
+  "engines": {
+    "node": ">=22"
+  },
   "files": [
     "dist",
     "README.md"
@@ -42,7 +45,6 @@
     "commander": "^14.0.3",
     "dockerode": "^4.0.9",
     "open": "^10.2.0",
-    "openship": "^0.5.0",
     "ora": "^9.3.0",
     "ssh2": "^1.17.0"
   },