openship 0.6.5 → 0.6.6

package/dist/{chunk-QLX7NBEA.js → chunk-5DMWSTOM.js}

@@ -134,231 +134,41 @@ import {
 } from "./chunk-ZWLDLTJP.js";
 import {
   CloudRuntime
-} from "./chunk-3ZAGC5NT.js";
+} from "./chunk-OBPKYXQL.js";
 import {
-  systemCatalog
-} from "./chunk-7334NSJL.js";
+  OPENRESTY_DEFAULT_PATHS
+} from "./chunk-RSR7PFIQ.js";
 import {
-  DEFAULT_DOCKER_SOCKET_PATH,
   DockerRuntime,
   daemonConnectionFrom,
   isHostPathSource,
   resolveExecExitCode,
-  resolveLocalDockerSocketPath,
   scopedVolumeName,
   startAttachStream,
   startExecStream
-} from "./chunk-VDESJSG6.js";
+} from "./chunk-77QDF6UD.js";
 import {
   BareRuntime
-} from "./chunk-GRTXMUHA.js";
+} from "./chunk-LFE5KQ7Y.js";
 import {
   createExecutor
-} from "./chunk-VHMOQL5Y.js";
-import {
-  LocalExecutor
-} from "./chunk-6FH4AXVY.js";
-import {
-  invalidateEdgeContainer,
-  sanitizeEdgeVhosts
-} from "./chunk-WE7BXW6L.js";
-import {
-  EDGE_CONTAINER_MOUNTS,
-  EDGE_HOST_STATE_DIR,
-  OPENRESTY_DEFAULT_PATHS
-} from "./chunk-PZRRL5PC.js";
+} from "./chunk-MLYSEZQB.js";
 import {
   envOps
-} from "./chunk-EZPPTWJQ.js";
+} from "./chunk-YMMQRE5J.js";
 import {
   ENVIRONMENT_PROBE_SCRIPT,
   ENVIRONMENT_PROBE_TIMEOUT_MS,
   cacheEnvironment,
   parseEnvironmentProbe,
   profileIsFresh
-} from "./chunk-WFRXYWK2.js";
+} from "./chunk-UVNMQM7W.js";
 import {
-  DEFAULT_IMAGE_REGISTRY,
   FAMILY_BY_DISTRO,
-  HOST_CHANNEL_BLOCKED,
-  HOST_CHANNEL_RECHECK,
-  HOST_CHANNEL_UNAFFECTED,
-  explainHostChannelCause,
   isAwsS3Endpoint,
   safeErrorMessage,
-  withTimeout,
-  wrapText
-} from "./chunk-LEYSL46B.js";
-
-// src/lib/ports.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { join } from "path";
-
-// ../../packages/core/src/ports.ts
-import { createServer } from "net";
-var DEFAULT_API_PORT = 4e3;
-var DEFAULT_DASHBOARD_PORT = 3001;
-var LOOPBACK = "127.0.0.1";
-var SCAN_SPAN = 20;
-var MAX_PORT = 65535;
-function isPortFree(port, host = LOOPBACK) {
-  return new Promise((resolve3) => {
-    const srv = createServer();
-    srv.once("error", () => resolve3(false));
-    srv.listen(port, host, () => srv.close(() => resolve3(true)));
-  });
-}
-async function waitPortFree(port, opts = {}) {
-  const timeoutMs = opts.timeoutMs ?? 6e3;
-  const intervalMs = opts.intervalMs ?? 250;
-  const host = opts.host ?? LOOPBACK;
-  const deadline = Date.now() + timeoutMs;
-  for (; ; ) {
-    if (await isPortFree(port, host)) return true;
-    if (Date.now() >= deadline) return false;
-    await new Promise((r2) => setTimeout(r2, intervalMs));
-  }
-}
-function getFreePort(host = LOOPBACK) {
-  return new Promise((resolve3, reject) => {
-    const srv = createServer();
-    srv.once("error", reject);
-    srv.listen(0, host, () => {
-      const addr = srv.address();
-      const port = addr && typeof addr === "object" ? addr.port : 0;
-      srv.close(() => port ? resolve3(port) : reject(new Error("no free port")));
-    });
-  });
-}
-async function findPortNear(from, opts = {}) {
-  const host = opts.host ?? LOOPBACK;
-  const span = opts.span ?? SCAN_SPAN;
-  const skip = opts.skip ?? (() => false);
-  for (let port2 = from; port2 <= Math.min(from + span, MAX_PORT); port2++) {
-    if (!skip(port2) && await isPortFree(port2, host)) return port2;
-  }
-  let port = await getFreePort(host);
-  for (let tries = 0; tries < 10 && skip(port); tries++) port = await getFreePort(host);
-  return port;
-}
-async function resolvePortPair(prefs = {}) {
-  const host = prefs.bindAddr?.trim() || LOOPBACK;
-  const ours = new Set(prefs.reclaimable ?? []);
-  const prefFor = (kind) => prefs[kind] ?? prefs.previous?.[kind] ?? prefs.stored?.[kind] ?? prefs.defaults?.[kind];
-  const remembered = (kind, pref) => prefs[kind] === void 0 && (prefs.previous?.[kind] === pref || prefs.stored?.[kind] === pref);
-  const availableForPref = async (port) => ours.has(port) || await isPortFree(port, host);
-  const apiPref = prefFor("api");
-  const dashPref = prefFor("dashboard");
-  let api;
-  if (apiPref === void 0) api = await getFreePort(host);
-  else if (await availableForPref(apiPref)) api = apiPref;
-  else if (remembered("api", apiPref) && await waitPortFree(apiPref, { host })) api = apiPref;
-  else {
-    api = await findPortNear(apiPref + 1, {
-      host,
-      skip: (p2) => ours.has(p2) || p2 === dashPref
-    });
-  }
-  const skipForDash = (p2) => ours.has(p2) || p2 === api;
-  let dashboard;
-  if (dashPref === void 0) {
-    dashboard = await getFreePort(host);
-    for (let tries = 0; tries < 10 && dashboard === api; tries++) {
-      dashboard = await getFreePort(host);
-    }
-  } else if (dashPref !== api && await availableForPref(dashPref)) {
-    dashboard = dashPref;
-  } else if (dashPref !== api && remembered("dashboard", dashPref) && await waitPortFree(dashPref, { host })) {
-    dashboard = dashPref;
-  } else {
-    dashboard = await findPortNear(dashPref + 1, { host, skip: skipForDash });
-  }
-  return {
-    api,
-    dashboard,
-    switched: {
-      api: apiPref !== void 0 && api !== apiPref,
-      dashboard: dashPref !== void 0 && dashboard !== dashPref
-    },
-    preferred: { api: apiPref ?? api, dashboard: dashPref ?? dashboard }
-  };
-}
-
-// src/lib/ports.ts
-var PORTS_FILE = join(OS_DIR, "ports.json");
-var INSTANCE_FILE = join(OS_DIR, "instance.json");
-function saveInstanceUrl(publicUrl) {
-  try {
-    if (!existsSync(OS_DIR)) mkdirSync(OS_DIR, { recursive: true, mode: 448 });
-    writeFileSync(INSTANCE_FILE, JSON.stringify({ publicUrl: publicUrl ?? null }));
-  } catch {
-  }
-}
-function readInstanceUrl() {
-  try {
-    return JSON.parse(readFileSync(INSTANCE_FILE, "utf8")).publicUrl ?? null;
-  } catch {
-    return null;
-  }
-}
-function readStoredPorts() {
-  try {
-    return JSON.parse(readFileSync(PORTS_FILE, "utf-8"));
-  } catch {
-    return {};
-  }
-}
-function storedApiPort() {
-  return readStoredPorts().api ?? DEFAULT_API_PORT;
-}
-function storedDashboardPort() {
-  return readStoredPorts().dashboard ?? DEFAULT_DASHBOARD_PORT;
-}
-function saveStoredPorts(api, dashboard) {
-  try {
-    if (!existsSync(OS_DIR)) mkdirSync(OS_DIR, { recursive: true, mode: 448 });
-    writeFileSync(PORTS_FILE, JSON.stringify({ api, dashboard }));
-  } catch {
-  }
-}
-function portMoveNotice(resolved, trustedOriginUrls = []) {
-  if (!resolved.switched.api && !resolved.switched.dashboard) return [];
-  const lines = [
-    `A preferred port was busy \u2014 using API ${resolved.api}, dashboard ${resolved.dashboard}.`
-  ];
-  const stale = [...new Set(stalePortOrigins(resolved.preferred.dashboard, trustedOriginUrls))];
-  if (stale.length) {
-    lines.push(
-      `Heads up: ${stale.join(", ")} still names port ${resolved.preferred.dashboard}, so logins`,
-      `from that origin will be rejected. Point it at :${resolved.dashboard} (or free port`,
-      `${resolved.preferred.dashboard} and re-run to move back).`
-    );
-  }
-  return lines;
-}
-function stalePortOrigins(movedFrom, urls) {
-  const stale = [];
-  for (const raw of urls) {
-    for (const candidate of (raw ?? "").split(",")) {
-      const value = candidate.trim();
-      if (!value) continue;
-      try {
-        if (new URL(value).port === String(movedFrom)) stale.push(value);
-      } catch {
-      }
-    }
-  }
-  return stale;
-}
-async function resolvePorts(prefs, opts = {}) {
-  const resolved = await resolvePortPair({
-    ...prefs,
-    stored: readStoredPorts(),
-    defaults: { api: DEFAULT_API_PORT, dashboard: DEFAULT_DASHBOARD_PORT }
-  });
-  if (opts.persist !== false) saveStoredPorts(resolved.api, resolved.dashboard);
-  return resolved;
-}
+  withTimeout
+} from "./chunk-UJ6JZM65.js";
 
 // ../../packages/adapters/src/runtime/image-transfer.ts
 import { Transform } from "stream";
@@ -382,8 +192,10 @@ var MAIL_CONTAINER_MOUNTS = [
   { host: `${MAIL_HOST_STATE_DIR}/config/dovecot`, container: "/etc/dovecot", seed: true },
   { host: `${MAIL_HOST_STATE_DIR}/config/amavis`, container: "/etc/amavis/conf.d", seed: true },
   // ClamAV signatures — bind-mounted so a pull doesn't force a multi-hundred-MB
-  // freshclam re-download and delay readiness.
-  { host: `${MAIL_HOST_STATE_DIR}/clamav`, container: "/var/lib/clamav" },
+  // freshclam re-download and delay readiness. `seed: true` because that same mount
+  // HIDES the database baked into the image: with nothing copying it across, clamd
+  // finds an empty database directory and exits (issue #565).
+  { host: `${MAIL_HOST_STATE_DIR}/clamav`, container: "/var/lib/clamav", seed: true },
   { host: "/etc/letsencrypt", container: "/etc/letsencrypt", readonly: true }
 ];
 var MAIL_DB_HOST_DATA_DIR = `${MAIL_HOST_STATE_DIR}/pgdata`;
@@ -1421,7 +1233,7 @@ var DockerBackupExecutor = class {
       } catch {
       }
     }, opts.timeoutMs) : null;
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve2, reject) => {
       body.on("error", (err) => {
         if (timer) clearTimeout(timer);
         try {
@@ -1433,7 +1245,7 @@ var DockerBackupExecutor = class {
       stream.on("end", async () => {
         if (timer) clearTimeout(timer);
         try {
-          resolve3({
+          resolve2({
             code: await resolveExecExitCode(exec, exec.id),
             stderr: Buffer.concat(stderrChunks).toString("utf8").slice(0, 16 * 1024)
           });
@@ -1507,10 +1319,10 @@ var DockerBackupExecutor = class {
     );
     stream.on("data", () => watchdog.touch());
     const awaitExit = (async () => {
-      const onEnd = new Promise((resolve3, reject) => {
+      const onEnd = new Promise((resolve2, reject) => {
         stream.on("end", async () => {
           try {
-            resolve3({
+            resolve2({
               code: await resolveExecExitCode(docker.getExec(execId), execId),
               stderr: Buffer.concat(stderrChunks).toString("utf8").slice(0, 16 * 1024)
             });
@@ -1633,7 +1445,7 @@ var CloudBackupExecutor = class {
     const stdout = new Readable2({ read() {
     } });
     let stderrBuf = "";
-    const awaitExit = new Promise((resolve3, reject) => {
+    const awaitExit = new Promise((resolve2, reject) => {
       const timer = opts?.timeoutMs ? setTimeout(() => {
         stdout.destroy(new Error(`exec timed out after ${opts.timeoutMs}ms`));
         reject(new Error(`exec timed out after ${opts.timeoutMs}ms`));
@@ -1666,7 +1478,7 @@ var CloudBackupExecutor = class {
           }
           stdout.push(null);
           if (timer) clearTimeout(timer);
-          resolve3({ code: exitCode, stderr: stderrBuf });
+          resolve2({ code: exitCode, stderr: stderrBuf });
         } catch (err) {
           if (timer) clearTimeout(timer);
           stdout.destroy(err);
@@ -1775,7 +1587,7 @@ import { pipeline } from "stream/promises";
 import { createWriteStream, promises as fs } from "fs";
 import { randomBytes as randomBytes2 } from "crypto";
 import { tmpdir } from "os";
-import { join as join2 } from "path";
+import { join } from "path";
 var BareBackupExecutor = class {
   constructor(runtime) {
     this.runtime = runtime;
@@ -1849,8 +1661,8 @@ var BareBackupExecutor = class {
   async pipeIntoCommand(service, cmd, body, opts) {
     const exec = this.executor();
     const id = randomBytes2(6).toString("hex");
-    const localDir = join2(tmpdir(), `openship-bare-restore-${id}`);
-    const localFile = join2(localDir, "artifact.bin");
+    const localDir = join(tmpdir(), `openship-bare-restore-${id}`);
+    const localFile = join(localDir, "artifact.bin");
     const remoteDir = `/tmp/openship-bare-restore-${id}`;
     const remoteFile = `${remoteDir}/artifact.bin`;
     await fs.mkdir(localDir, { recursive: true });
@@ -1899,7 +1711,7 @@ registerExecutor("bare", (runtime) => {
 // ../../packages/adapters/src/backup/destinations/local.ts
 import { createHash as createHash4, randomBytes as randomBytes3 } from "crypto";
 import { createReadStream, createWriteStream as createWriteStream2, promises as fs2 } from "fs";
-import { dirname, join as join3, normalize, posix, resolve } from "path";
+import { dirname, join as join2, normalize, posix, resolve } from "path";
 import { pipeline as pipeline2 } from "stream";
 import { promisify } from "util";
 var pipelineP = promisify(pipeline2);
@@ -1922,13 +1734,13 @@ var LocalDestinationImpl = class {
     if (normalized.startsWith("..") || normalized.includes(`${normalize("../")}`)) {
       throw new Error(`Invalid key (traversal): ${key}`);
     }
-    return join3(this.root, normalized);
+    return join2(this.root, normalized);
   }
   async preflight() {
     try {
       await fs2.mkdir(this.root, { recursive: true });
       const probeKey = `.openship-probe-${randomBytes3(6).toString("hex")}`;
-      const probePath = join3(this.root, probeKey);
+      const probePath = join2(this.root, probeKey);
       await fs2.writeFile(probePath, "ok");
       await fs2.readFile(probePath);
       await fs2.unlink(probePath);
@@ -2002,7 +1814,7 @@ var LocalDestinationImpl = class {
       for (const dirent of dirents) {
         if (entries.length >= limit) return;
         const childRel = posix.join(relBase, dirent.name);
-        const childAbs = join3(dir, dirent.name);
+        const childAbs = join2(dir, dirent.name);
         if (dirent.isDirectory()) {
           await walk(childAbs, childRel);
         } else if (dirent.isFile()) {
@@ -11672,7 +11484,7 @@ var defaultProvider = (init = {}) => memoizeChain([
   },
   async (awsIdentityProperties) => {
     init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromIni");
-    const { fromIni } = await import("./dist-es-ZP5QDSJ3.js");
+    const { fromIni } = await import("./dist-es-AXFRS7PS.js");
     return fromIni(init)(awsIdentityProperties);
   },
   async (awsIdentityProperties) => {
@@ -11724,14 +11536,14 @@ var readableStreamHasher = (hashCtor, readableStream) => {
   const hash = new hashCtor();
   const hashCalculator = new HashCalculator(hash);
   readableStream.pipe(hashCalculator);
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve2, reject) => {
     readableStream.on("error", (err) => {
       hashCalculator.end();
       reject(err);
     });
     hashCalculator.on("error", reject);
     hashCalculator.on("finish", () => {
-      hash.digest().then(resolve3).catch(reject);
+      hash.digest().then(resolve2).catch(reject);
     });
   });
 };
@@ -12587,7 +12399,7 @@ to input.params.ContentLength in bytes.
     }
   }
   async __abortTimeout(abortSignal) {
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve2, reject) => {
       abortSignal.onabort = () => {
         const abortError = new Error("Upload aborted.");
         abortError.name = "AbortError";
@@ -13003,7 +12815,7 @@ var SftpDestinationImpl = class {
   // ── Connection helper ────────────────────────────────────────────────
   async withSftp(fn) {
     const client = new Client2();
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve2, reject) => {
       const cleanup = () => {
         try {
           client.end();
@@ -13020,7 +12832,7 @@ var SftpDestinationImpl = class {
           fn(sftp).then(
             (val) => {
               cleanup();
-              resolve3(val);
+              resolve2(val);
             },
             (e2) => {
               cleanup();
@@ -13040,12 +12852,12 @@ var SftpDestinationImpl = class {
     let current = dir.startsWith("/") ? "" : ".";
     for (const part of parts) {
       current = current === "" ? `/${part}` : posix2.join(current, part);
-      await new Promise((resolve3, reject) => {
+      await new Promise((resolve2, reject) => {
         sftp.mkdir(current, (err) => {
-          if (!err) return resolve3();
+          if (!err) return resolve2();
           sftp.stat(current, (statErr, stats) => {
             if (statErr) return reject(err);
-            if (stats.isDirectory()) return resolve3();
+            if (stats.isDirectory()) return resolve2();
             reject(new Error(`${current} exists but is not a directory`));
           });
         });
@@ -13059,14 +12871,14 @@ var SftpDestinationImpl = class {
       await this.withSftp(async (sftp) => {
         await this.ensureDir(sftp, this.rootPath);
         const probePath = posix2.join(this.rootPath, probeName);
-        await new Promise((resolve3, reject) => {
+        await new Promise((resolve2, reject) => {
           const ws = sftp.createWriteStream(probePath);
           ws.on("error", reject);
-          ws.on("close", () => resolve3());
+          ws.on("close", () => resolve2());
           ws.end("ok");
         });
         await new Promise(
-          (resolve3, reject) => sftp.unlink(probePath, (err) => err ? reject(err) : resolve3())
+          (resolve2, reject) => sftp.unlink(probePath, (err) => err ? reject(err) : resolve2())
         );
       });
       return { ok: true };
@@ -13083,7 +12895,7 @@ var SftpDestinationImpl = class {
     let bytesWritten = 0;
     await this.withSftp(async (sftp) => {
       await this.ensureDir(sftp, posix2.dirname(target));
-      await new Promise((resolve3, reject) => {
+      await new Promise((resolve2, reject) => {
         const ws = sftp.createWriteStream(tmp);
         let lastProgressAt = Date.now();
         let settled = false;
@@ -13097,7 +12909,7 @@ var SftpDestinationImpl = class {
             body.destroy();
             reject(err);
           } else {
-            resolve3();
+            resolve2();
           }
         };
         watchdog = setInterval(() => {
@@ -13118,14 +12930,14 @@ var SftpDestinationImpl = class {
         body.on("error", (err) => finish(err));
         body.pipe(ws);
       });
-      await new Promise((resolve3, reject) => {
+      await new Promise((resolve2, reject) => {
         sftp.rename(tmp, target, (err) => {
-          if (!err) return resolve3();
+          if (!err) return resolve2();
           sftp.unlink(target, () => {
             sftp.rename(
               tmp,
               target,
-              (err2) => err2 ? reject(err2) : resolve3()
+              (err2) => err2 ? reject(err2) : resolve2()
             );
           });
         });
@@ -13172,14 +12984,14 @@ var SftpDestinationImpl = class {
     const target = this.fullPath(key);
     try {
       return await this.withSftp(
-        (sftp) => new Promise((resolve3, reject) => {
+        (sftp) => new Promise((resolve2, reject) => {
           sftp.stat(target, (err, stats) => {
             if (err) {
               const code = err.code;
-              if (code === 2) return resolve3(null);
+              if (code === 2) return resolve2(null);
               return reject(err);
             }
-            resolve3({
+            resolve2({
               sizeBytes: stats.size,
               uploadedAt: new Date(stats.mtime * 1e3)
             });
@@ -13196,14 +13008,14 @@ var SftpDestinationImpl = class {
     const entries = [];
     await this.withSftp(async (sftp) => {
       const walk = async (dir, relBase) => {
-        const dirents = await new Promise((resolve3, reject) => {
+        const dirents = await new Promise((resolve2, reject) => {
           sftp.readdir(dir, (err, list) => {
             if (err) {
               const code = err.code;
-              if (code === 2) return resolve3([]);
+              if (code === 2) return resolve2([]);
               return reject(err);
             }
-            resolve3(list);
+            resolve2(list);
           });
         });
         for (const dirent of dirents) {
@@ -13229,10 +13041,10 @@ var SftpDestinationImpl = class {
     const target = this.fullPath(key);
     await this.withSftp(
       (sftp) => new Promise(
-        (resolve3, reject) => sftp.unlink(target, (err) => {
-          if (!err) return resolve3();
+        (resolve2, reject) => sftp.unlink(target, (err) => {
+          if (!err) return resolve2();
           const code = err.code;
-          if (code === 2) return resolve3();
+          if (code === 2) return resolve2();
           reject(err);
         })
       )
@@ -13244,11 +13056,11 @@ var SftpDestinationImpl = class {
     const failed = [];
     await this.withSftp(async (sftp) => {
       for (const key of keys) {
-        await new Promise((resolve3) => {
+        await new Promise((resolve2) => {
           sftp.unlink(this.fullPath(key), (err) => {
             if (!err) {
               deleted.push(key);
-              return resolve3();
+              return resolve2();
             }
             const code = err.code;
             if (code === 2) {
@@ -13256,7 +13068,7 @@ var SftpDestinationImpl = class {
             } else {
               failed.push({ key, error: err.message });
             }
-            resolve3();
+            resolve2();
           });
         });
       }
@@ -13280,1609 +13092,39 @@ function startUnitHint(unit) {
   return pasteable(thisHost().serviceEnableStart(unit));
 }
 
-// src/lib/from-source.ts
-import { spawn, spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
-import { join as join4, resolve as resolve2 } from "path";
-var DEFAULT_REPO = "https://github.com/oblien/openship.git";
-var SOURCE_CHECKOUT_DIR = join4(OS_DIR, "src");
-var SOURCE_DIST_DIR = join4(OS_DIR, "from-source-dist");
-function has(cmd) {
-  try {
-    return spawnSync2(cmd, ["--version"], { stdio: "ignore" }).status === 0;
-  } catch {
-    return false;
-  }
-}
-function run(cmd, args, cwd, env) {
-  return new Promise((res, rej) => {
-    const child = spawn(cmd, args, {
-      cwd,
-      stdio: "inherit",
-      // Windows resolves the bun/git shims (.cmd/.exe) only through a shell.
-      shell: process.platform === "win32",
-      env: env ? { ...process.env, ...env } : process.env
-    });
-    child.on("error", rej);
-    child.on(
-      "exit",
-      (code) => code === 0 ? res() : rej(new Error(`\`${cmd} ${args.join(" ")}\` (cwd=${cwd}) exited ${code ?? "?"}`))
-    );
-  });
-}
-function shortSha(cwd) {
-  const r2 = spawnSync2("git", ["rev-parse", "--short", "HEAD"], { cwd, encoding: "utf8" });
-  return r2.status === 0 ? (r2.stdout ?? "").trim() || "unknown" : "unknown";
-}
-function isMonorepo(dir) {
-  return existsSync2(join4(dir, "package.json")) && existsSync2(join4(dir, "apps/api/package.json")) && existsSync2(join4(dir, "apps/dashboard/package.json"));
-}
-async function prepareFromSource(opts) {
-  if (!has("bun")) {
-    throw new Error(
-      "`bun` is required to build from source but wasn't found on PATH \u2014 install it: https://bun.sh"
-    );
-  }
-  let sourceDir;
-  let ref;
-  if (opts.source) {
-    sourceDir = resolve2(opts.source);
-    if (!isMonorepo(sourceDir)) {
-      throw new Error(
-        `--source ${sourceDir} doesn't look like an Openship checkout (missing package.json / apps/api / apps/dashboard).`
-      );
-    }
-    ref = "local";
-  } else {
-    if (!has("git")) {
-      throw new Error("`git` is required to clone the source but wasn't found on PATH.");
-    }
-    ref = (opts.ref || "main").trim();
-    const repoUrl = opts.repo || DEFAULT_REPO;
-    sourceDir = SOURCE_CHECKOUT_DIR;
-    mkdirSync2(OS_DIR, { recursive: true });
-    if (!existsSync2(join4(sourceDir, ".git"))) {
-      console.log(`  Cloning ${repoUrl} \u2192 ${sourceDir}`);
-      await run("git", ["clone", repoUrl, sourceDir], OS_DIR);
-    }
-    console.log(`  Fetching + checking out ${ref}`);
-    await run("git", ["fetch", "origin", ref, "--tags"], sourceDir);
-    await run("git", ["checkout", ref], sourceDir);
-    await run("git", ["pull", "--ff-only", "origin", ref], sourceDir).catch(() => {
-      console.log("  (pinned ref \u2014 not fast-forwarding)");
-    });
-  }
-  const sha = shortSha(sourceDir);
-  console.log(`  Source: ${sourceDir} @ ${ref} (${sha})`);
-  console.log("  Installing workspace dependencies (bun install)\u2026");
-  await run("bun", ["install"], sourceDir);
-  const distDir = SOURCE_DIST_DIR;
-  console.log("  Building release dist (compiles the dashboard \u2014 needs RAM/CPU)\u2026");
-  await run(
-    "bun",
-    ["run", join4(sourceDir, "apps/api/scripts/build-release.ts")],
-    sourceDir,
-    { DIST_DIR: distDir, NODE_ENV: "production", CLOUD_MODE: "false", OPENSHIP_TARGET: "local" }
-  );
-  console.log("  Installing runtime dependencies in the dist\u2026");
-  await run("bun", ["install", "--production", "--frozen-lockfile"], distDir);
-  const apiDir = join4(distDir, "api");
-  const dashboardDir = join4(distDir, "dashboard");
-  if (!existsSync2(join4(apiDir, "src/index.ts"))) {
-    throw new Error(`Build produced no API at ${apiDir}/src/index.ts \u2014 build-release layout drift?`);
-  }
-  if (!existsSync2(join4(dashboardDir, "apps/dashboard/server.js"))) {
-    throw new Error(`Build produced no dashboard at ${dashboardDir}/apps/dashboard/server.js.`);
-  }
-  return { apiDir, dashboardDir, ref, sha, sourceDir };
-}
-
-// src/lib/compose.ts
-import { spawn as spawn2, spawnSync as spawnSync4 } from "child_process";
-import { randomBytes as randomBytes5 } from "crypto";
-import {
-  chmodSync,
-  existsSync as existsSync4,
-  mkdirSync as mkdirSync3,
-  readFileSync as readFileSync3,
-  renameSync,
-  rmSync,
-  writeFileSync as writeFileSync2
-} from "fs";
-import { homedir, userInfo } from "os";
-import { dirname as dirname2, join as join6 } from "path";
-
-// src/lib/source-install.ts
-import { spawnSync as spawnSync3 } from "child_process";
-import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
-import { join as join5 } from "path";
-var MARKER = join5(OS_DIR, "source-install.json");
-function parseSourceInstall(raw) {
-  try {
-    const obj = JSON.parse(raw);
-    if (!obj || typeof obj.dir !== "string" || !obj.dir) return null;
-    return { repo: obj.repo || DEFAULT_REPO, ref: obj.ref || "main", dir: obj.dir };
-  } catch {
-    return null;
-  }
-}
-function readSourceInstall() {
-  if (!existsSync3(MARKER)) return null;
-  try {
-    return parseSourceInstall(readFileSync2(MARKER, "utf8"));
-  } catch {
-    return null;
-  }
+// src/lib/compose-env.ts
+import { existsSync, readFileSync } from "fs";
+import { join as join3 } from "path";
+var COMPOSE_DIR = join3(OS_DIR, "compose");
+var COMPOSE_FILE = join3(COMPOSE_DIR, "docker-compose.yml");
+var COMPOSE_ENV_FILE = join3(COMPOSE_DIR, ".env");
+function composeInstallExists() {
+  return existsSync(COMPOSE_FILE);
 }
-function parseRemoteSha(stdout) {
-  const sha = stdout.split("\n")[0]?.trim().split(/\s+/)[0];
-  return sha && /^[0-9a-f]{7,40}$/i.test(sha) ? sha.slice(0, 7) : null;
-}
-function remoteSha(repo, ref) {
-  const r2 = spawnSync3("git", ["ls-remote", repo, ref], { encoding: "utf8" });
-  if (r2.status !== 0 || !r2.stdout) return null;
-  return parseRemoteSha(r2.stdout);
-}
-async function rebuildFromSource(info) {
-  if (!has("bun")) {
-    throw new Error("`bun` is required to rebuild from source but wasn't found on PATH \u2014 https://bun.sh");
-  }
-  if (!has("git")) {
-    throw new Error("`git` is required to update the source checkout but wasn't found on PATH.");
-  }
-  if (!existsSync3(join5(info.dir, ".git"))) {
-    throw new Error(
-      `Source checkout ${info.dir} is missing (no .git) \u2014 reinstall from source with scripts/install-source.sh.`
-    );
-  }
-  await run("git", ["fetch", "origin", info.ref, "--tags"], info.dir);
-  await run("git", ["checkout", info.ref], info.dir);
-  await run("git", ["pull", "--ff-only", "origin", info.ref], info.dir).catch(() => {
-  });
-  const cliDir = join5(info.dir, "apps/cli");
-  await run("bun", ["install"], info.dir);
-  await run("bun", ["run", "build"], cliDir);
-  await run("bun", ["run", "build/stage-dashboard.ts"], cliDir);
-  return shortSha(info.dir);
-}
-
-// src/lib/compose.ts
-var EDGE_SITES_HOST_DIR = `${EDGE_HOST_STATE_DIR}/sites-enabled`;
-var EDGE_ACME_HOST_DIR = `${EDGE_HOST_STATE_DIR}/acme`;
-function edgeVolumeYaml(indent) {
-  return EDGE_CONTAINER_MOUNTS.map((m2) => `${indent}- ${m2.host}:${m2.container}:z`).join("\n");
-}
-var COMPOSE_DIR = join6(OS_DIR, "compose");
-var INSTALL_METHOD_FILE = join6(OS_DIR, "install-method");
-var COMPOSE_FILE = join6(COMPOSE_DIR, "docker-compose.yml");
-var BUILD_FILE = join6(COMPOSE_DIR, "docker-compose.build.yml");
-var ENV_FILE = join6(COMPOSE_DIR, ".env");
-var ENV_BACKUP_FILE = join6(COMPOSE_DIR, ".env.bak");
-var ENV_TMP_FILE = join6(COMPOSE_DIR, ".env.tmp");
-var BUILT_SERVICES = [
-  { service: "api", dockerfile: "apps/api/Dockerfile" },
-  { service: "dashboard", dockerfile: "apps/dashboard/Dockerfile" },
-  { service: "edge", dockerfile: "apps/edge/Dockerfile" }
-];
-var ENV_CONSUMING_SERVICES = ["api", "dashboard", "edge"];
-function readInstallMethod() {
-  try {
-    const v2 = readFileSync3(INSTALL_METHOD_FILE, "utf8").trim();
-    return v2 === "compose" || v2 === "bare" ? v2 : null;
-  } catch {
-    return null;
-  }
-}
-function writeInstallMethod(method) {
-  mkdirSync3(OS_DIR, { recursive: true, mode: 448 });
-  writeFileSync2(INSTALL_METHOD_FILE, method, { mode: 384 });
-}
-function dockerState() {
-  const ok = (args) => spawnSync4("docker", args, { stdio: "ignore" }).status === 0;
-  if (!ok(["--version"])) return { binary: false, plugin: false, daemon: false };
-  return { binary: true, plugin: ok(["compose", "version"]), daemon: ok(["version"]) };
-}
-function dockerGap(state = dockerState()) {
-  if (!state.binary) {
-    return { summary: "Docker isn't installed", installable: true };
-  }
-  if (!state.plugin) {
-    return {
-      summary: "Docker is installed but the Compose plugin (`docker compose`) is missing",
-      installable: true
-    };
-  }
-  if (!state.daemon) {
-    const start = pasteable(thisHost().dockerStart());
-    return {
-      summary: "Docker is installed but its daemon isn't reachable",
-      // Reinstalling changes nothing: a group change only applies to NEW logins,
-      // and a stopped daemon needs starting, not installing.
-      installable: false,
-      hint: thisHost().profile.isRoot ? start ? `Start it with: ${start}` : "Start the Docker daemon \u2014 this host has no service manager Openship recognizes." : `Add your user to the docker group: sudo usermod -aG docker ${userInfo().username} \u2014 then log out and back in (or run: newgrp docker). If the daemon is stopped: ${start ?? "start it the way this host starts services"}`
-    };
-  }
-  return null;
-}
-function hasDockerCompose() {
-  return dockerGap() === null;
-}
-function hasCmd(cmd) {
-  return spawnSync4(cmd, ["--version"], { stdio: "ignore" }).status === 0;
-}
-function shQuote(s2) {
-  return `'${s2.replace(/'/g, `'\\''`)}'`;
-}
-function dockerInstallPreview(state = dockerState()) {
-  const gap = dockerGap(state);
-  if (!gap) return { state, gap: null, wouldInstall: false };
-  if (process.platform !== "linux" || !gap.installable) return { state, gap, wouldInstall: false };
-  const plan = systemCatalog.installs.docker(resolveLocalEnvironmentSync());
-  if (!plan.supported) return { state, gap, wouldInstall: false, unsupportedReason: plan.reason };
-  const start = plan.value.service;
-  return {
-    state,
-    gap,
-    wouldInstall: true,
-    installCommand: plan.value.installCommand,
-    ...start?.supported ? { startCommand: start.value } : {},
-    ...start && !start.supported ? { startBlockedReason: start.reason } : {}
-  };
-}
-async function ensureDocker(opts = {}) {
-  const notice = opts.onNotice ?? ((line) => process.stderr.write(`  ${line}
-`));
-  const { state, gap, wouldInstall, installCommand, startCommand, unsupportedReason, startBlockedReason } = dockerInstallPreview();
-  if (!gap) return true;
-  if (process.platform !== "linux") return false;
-  if (!gap.installable) {
-    notice(gap.summary + ".");
-    if (gap.hint) notice(gap.hint);
-    return false;
-  }
-  if (!wouldInstall || !installCommand) {
-    if (unsupportedReason) notice(unsupportedReason);
-    return false;
-  }
-  const asRoot = typeof process.getuid === "function" && process.getuid() === 0;
-  const sudo = !asRoot && hasCmd("sudo") ? "sudo " : "";
-  notice("This can take 2-5 minutes on a small VPS (~150 MB of packages) and stays quiet while apt works.");
-  if (state.binary) {
-    notice("Docker's installer will warn that docker already exists and pause ~20s before continuing \u2014 that's expected.");
-  }
-  const sh = (script) => new Promise((resolve3) => {
-    const child = spawn2("sh", ["-c", sudo ? `${sudo}sh -c ${shQuote(script)}` : script], {
-      stdio: "inherit"
-    });
-    const started = Date.now();
-    const tick = setInterval(() => {
-      const s2 = Math.round((Date.now() - started) / 1e3);
-      notice(`still installing Docker \u2014 ${Math.floor(s2 / 60)}m${String(s2 % 60).padStart(2, "0")}s elapsed\u2026`);
-    }, 3e4);
-    const done = (code) => {
-      clearInterval(tick);
-      resolve3(code);
-    };
-    child.on("error", () => done(1));
-    child.on("close", (code) => done(code ?? 1));
-  });
-  if (await sh(installCommand) !== 0) return false;
-  if (startCommand) await sh(startCommand);
-  else if (startBlockedReason) notice(startBlockedReason);
-  const after = dockerGap();
-  if (!after) {
-    notice("Docker ready.");
-    return true;
-  }
-  notice(after.summary + ".");
-  if (after.hint) notice(after.hint);
-  return false;
-}
-var COMPOSE_YAML = `# Managed by \`openship up\` \u2014 do not edit; re-run \`openship up\` to regenerate.
-services:
-  postgres:
-    image: postgres:16-alpine
-    restart: unless-stopped
-    environment:
-      # Keep the data dir in a subdirectory of the volume so a fresh install never
-      # runs initdb against a bare mount root (which fails on quirky host
-      # filesystems with EPERM \u2014 #350). OPENSHIP_PGDATA is decided ONCE at install
-      # by the CLI (fresh \u2192 subdir, pre-existing volume \u2192 root) and preserved in
-      # .env, so this never moves an existing database.
-      PGDATA: \${OPENSHIP_PGDATA:-/var/lib/postgresql/data/pgdata}
-      POSTGRES_USER: \${POSTGRES_USER:-openship}
-      POSTGRES_PASSWORD: \${POSTGRES_PASSWORD:?missing from .env \u2014 re-run openship up to regenerate it}
-      POSTGRES_DB: \${POSTGRES_DB:-openship}
-    expose: ["5432"]
-    volumes: [postgres_data:/var/lib/postgresql/data]
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U \${POSTGRES_USER:-openship} -d \${POSTGRES_DB:-openship}"]
-      interval: 5s
-      timeout: 3s
-      retries: 12
-
-  redis:
-    image: redis:7-alpine
-    restart: unless-stopped
-    command: ["redis-server", "--appendonly", "yes"]
-    expose: ["6379"]
-    volumes: [redis_data:/data]
-    healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
-      interval: 5s
-      timeout: 3s
-      retries: 12
-
-  api:
-    image: \${OPENSHIP_IMAGE_REGISTRY:-ghcr.io/oblien}/openship-api:\${OPENSHIP_VERSION:-latest}
-    restart: unless-stopped
-    # Loopback by default \u2014 the host-net edge reaches it over loopback, so nothing
-    # sits on a public interface. OPENSHIP_BIND_ADDR opts into a public/LAN interface
-    # (set by \`openship up\` when a public URL is configured for off-box access).
-    ports: ["\${OPENSHIP_BIND_ADDR:-127.0.0.1}:\${API_PORT:-4000}:\${API_PORT:-4000}"]
-    volumes:
-      # The daemon socket, at the path the api's own default expects INSIDE the
-      # container. The HOST side is a variable because it MOVES: a rootless daemon
-      # keeps its socket under the invoking user's runtime dir, and Docker creates a
-      # missing bind source as an empty DIRECTORY instead of failing \u2014 so the rootful
-      # path there brings the stack up and then fails every container operation in
-      # the transport, naming neither the path nor the cause (#482). \`openship up\`
-      # writes OPENSHIP_DOCKER_SOCKET when the detected path isn't this default.
-      - \${OPENSHIP_DOCKER_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock
-      # Routing state shared with the edge, as HOST BIND MOUNTS (generated from
-      # EDGE_CONTAINER_MOUNTS): the vhost tree, /etc/letsencrypt, the ACME webroot
-      # and the static doc-roots the API writes and the edge serves. Named volumes
-      # hid all of it from every host-side reader (migrate's proxy scan, cert carry,
-      # cert reuse, mail cert symlinks), each of which then silently saw "nothing".
-${edgeVolumeYaml("      ")}
-      # Host-op SSH key (createHostExecutor \u2192 host.docker.internal). /dev/null
-      # when the host channel isn't provisioned \u2192 OPENSHIP_HOST_SSH_HOST stays
-      # unset, and host operations REFUSE (they'd otherwise run against this
-      # container's filesystem, #509) while ordinary deploys keep working over
-      # the socket below.
-      - \${OPENSHIP_HOST_KEY_PATH:-/dev/null}:/run/secrets/openship_host_key:ro
-    # \`host-gateway\` is resolved by the daemon and is right on a stock rootful
-    # install. It is NOT universally right: under rootless Docker it lands in
-    # RootlessKit's namespace rather than the host's, so the host's sshd isn't
-    # there (#482). OPENSHIP_HOST_GATEWAY re-points the alias (e.g. at the box's
-    # LAN address) without patching this file, which \`openship up\` rewrites.
-    extra_hosts: ["host.docker.internal:\${OPENSHIP_HOST_GATEWAY:-host-gateway}"]
-    env_file: [.env]
-    environment:
-      NODE_ENV: production
-      PORT: "\${API_PORT:-4000}"
-      DATABASE_URL: postgresql://\${POSTGRES_USER:-openship}:\${POSTGRES_PASSWORD:?missing from .env \u2014 re-run openship up to regenerate it}@postgres:5432/\${POSTGRES_DB:-openship}
-      REDIS_URL: redis://redis:6379
-      OPENSHIP_EDGE_MODE: docker
-      OPENSHIP_EDGE_CONTAINER: openship-edge
-    depends_on:
-      postgres: { condition: service_healthy }
-      redis: { condition: service_healthy }
-    healthcheck:
-      test: ["CMD-SHELL", "bun -e \\"fetch('http://127.0.0.1:\${API_PORT:-4000}/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\\""]
-      interval: 10s
-      timeout: 5s
-      retries: 12
-      start_period: 40s
-
-  dashboard:
-    image: \${OPENSHIP_IMAGE_REGISTRY:-ghcr.io/oblien}/openship-dashboard:\${OPENSHIP_VERSION:-latest}
-    restart: unless-stopped
-    # Loopback by default (see api note); OPENSHIP_BIND_ADDR opts into a public interface.
-    ports: ["\${OPENSHIP_BIND_ADDR:-127.0.0.1}:\${DASHBOARD_PORT:-3001}:\${DASHBOARD_PORT:-3001}"]
-    env_file: [.env]
-    environment:
-      NODE_ENV: production
-      PORT: "\${DASHBOARD_PORT:-3001}"
-      INTERNAL_API_URL: http://api:\${API_PORT:-4000}
-    depends_on:
-      api: { condition: service_healthy }
-
-  edge:
-    image: \${OPENSHIP_IMAGE_REGISTRY:-ghcr.io/oblien}/openship-edge:\${OPENSHIP_VERSION:-latest}
-    # PINNED, and it must stay pinned: the api reaches the edge by NAME through
-    # DockerEdgeExecutor (OPENSHIP_EDGE_CONTAINER above), and "ours" edge
-    # detection greps \`docker ps --filter name=openship-edge\`. Without this,
-    # compose derives \`<project>-edge-1\` from the directory and every
-    # \`docker exec\` into the edge fails with "No such container: openship-edge" \u2014
-    # which silently migrated 0 sites after the operator's proxy was stopped.
-    # Safe here: the edge is a singleton (host networking, one per box).
-    container_name: openship-edge
-    restart: unless-stopped
-    network_mode: host
-    volumes:
-${edgeVolumeYaml("      ")}
-
-volumes:
-  postgres_data:
-  redis_data:
-`;
-function keepSecret(existing, key) {
-  return existing[key] || randomBytes5(32).toString("hex");
-}
-var GENERATED_SECRET_KEYS = ["POSTGRES_PASSWORD", "BETTER_AUTH_SECRET", "INTERNAL_TOKEN"];
-function survivingDbVolume(prev) {
-  const candidates = /* @__PURE__ */ new Set([prev.COMPOSE_PROJECT_NAME, "openship", "compose"]);
-  for (const project of candidates) {
-    if (project && dbVolumeExists(project)) return `${project}_postgres_data`;
-  }
-  return null;
-}
-function secretRotationRisk(prev) {
-  const keys = GENERATED_SECRET_KEYS.filter((k2) => !prev[k2]);
-  if (keys.length === 0) return null;
-  const volume = survivingDbVolume(prev);
-  return volume ? { volume, keys: [...keys] } : null;
-}
-function composeSecretRotationRisk(opts = {}) {
-  if (opts.resetSecrets) return null;
-  return secretRotationRisk(readEnvFile());
-}
-function renderSecretRotationRefusal(rotation, opts = {}) {
-  return `
-  ${opts.dryRun ? "A real run would REFUSE here" : "Refusing to continue"}: this would regenerate secrets your existing install already has.
-
-    missing from ${ENV_FILE}:  ${rotation.keys.join(", ")}
-    but this install's data is still here:  ${rotation.volume}
-
-  A new POSTGRES_PASSWORD cannot match that volume \u2014 Postgres only applies the password
-  when it first creates the data directory \u2014 and a new BETTER_AUTH_SECRET cannot decrypt
-  the environment variables already stored in the database. Nothing has been written yet.
-
-` + secretRecoveryAdvice(rotation);
-}
-function secretRecoveryAdvice(rotation) {
-  const adopted = adoptedStack(projectOfDbVolume(rotation.volume));
-  if (adopted) {
-    return `  This stack was not created by \`openship up\`: it is already running under the compose
-  project name we pin, so this run would ADOPT it.
-
-    project:      ${adopted.project}
-    started from: ${adopted.configFiles || "an unlabelled `docker run`"}
-    not from:     ${COMPOSE_FILE}
-
-  So there is no \`.env\` of ours to restore and no backup of one \u2014 the real values are in
-  the api container's own environment. Copy them out of it, then re-run:
-
-    echo 'COMPOSE_PROJECT_NAME=${adopted.project}' >> ${ENV_FILE}
-    docker inspect ${adopted.apiContainer} --format '{{range .Config.Env}}{{println .}}{{end}}' \\
-      | grep -E '^(${rotation.keys.join("|")})=' >> ${ENV_FILE}
-
-  COMPOSE_PROJECT_NAME matters as much as the secrets do: it is the volume prefix, so
-  without it this stack comes up on empty volumes beside the data above.
-
-  Only if that container is gone and the values exist nowhere else \u2014 this DESTROYS them,
-  leaving every environment variable stored in the database permanently unreadable:
-    openship up --reset-secrets
-`;
-  }
-  return `  Put the original values back and re-run:
-` + (existsSync4(ENV_BACKUP_FILE) ? `    cp ${ENV_BACKUP_FILE} ${ENV_FILE}     # the .env a previous \`openship up\` replaced
-` : `    restore ${ENV_FILE} from a backup, or copy the keys above out of one
-`) + `  If the file is there but this user can't read it, re-run as the user that owns it
-  (or as root) rather than letting the secrets be regenerated.
-
-  To reset instead \u2014 the database password gets realigned, but every stored environment
-  variable becomes permanently unreadable:
-    openship up --reset-secrets
-`;
-}
-function projectOfDbVolume(volume) {
-  return volume.replace(/_postgres_data$/, "");
-}
-function readEnvFile() {
-  const out = {};
+function readComposeEnvFile() {
   let text;
   try {
-    text = readFileSync3(ENV_FILE, "utf8");
+    text = readFileSync(COMPOSE_ENV_FILE, "utf8");
   } catch (err) {
-    if (err.code !== "ENOENT") {
-      console.log(
-        `  ! Could not read ${ENV_FILE}: ${err.message}
-    Its contents are being treated as absent. If this install already exists, fix the permissions and re-run rather than letting secrets be regenerated.`
-      );
-    }
-    return out;
+    const code = err.code;
+    return { env: {}, unreadable: code === "ENOENT" ? null : err.message };
   }
+  const env = {};
   for (const line of text.split("\n")) {
     const m2 = line.match(/^([A-Z0-9_]+)=(.*)$/);
-    if (m2) out[m2[1]] = m2[2];
-  }
-  return out;
-}
-var HOST_CHANNEL_DEFAULT_HOST = "host.docker.internal";
-var HOST_CHANNEL_DEFAULT_PORT = 22;
-var HOST_KEY_COMMENT = "openship-host-executor";
-var HOST_KEY_FROM = "172.16.0.0/12,192.168.0.0/16,10.0.0.0/8,127.0.0.1";
-function hostKeyAuthLine(pub) {
-  return `from="${HOST_KEY_FROM}",restrict,pty ${pub}`;
-}
-function rewriteHostAuthorizedKeys(existing, pub) {
-  return [...keptForeignKeys(existing), hostKeyAuthLine(pub)].join("\n") + "\n";
-}
-function keptForeignKeys(existing) {
-  return existing.split("\n").filter((line) => line.trim() && !line.includes(HOST_KEY_COMMENT));
-}
-function stripHostAuthorizedKeys(existing) {
-  const kept = keptForeignKeys(existing);
-  return kept.length ? kept.join("\n") + "\n" : "";
-}
-var ROOT_AUTHORIZED_KEYS = "/root/.ssh/authorized_keys";
-function chooseHostChannelUser(input) {
-  if (input.invokerUid === 0) {
-    return { user: "root", authKeysPath: ROOT_AUTHORIZED_KEYS, viaSudo: false, rootUnavailable: false };
-  }
-  if (input.hasPasswordlessSudo) {
-    return { user: "root", authKeysPath: ROOT_AUTHORIZED_KEYS, viaSudo: true, rootUnavailable: false };
+    if (m2) env[m2[1]] = m2[2];
   }
-  return {
-    user: input.invokerName,
-    authKeysPath: join6(input.invokerHome, ".ssh", "authorized_keys"),
-    viaSudo: false,
-    rootUnavailable: true
-  };
+  return { env, unreadable: null };
 }
-function hasPasswordlessSudo() {
-  try {
-    return spawnSync4("sudo", ["-n", "true"], { stdio: "ignore" }).status === 0;
-  } catch {
-    return false;
-  }
-}
-function plannedHostChannel(hostControl) {
-  if (!hostControl || process.platform !== "linux") return null;
-  let invoker;
-  try {
-    const info = userInfo();
-    invoker = { uid: info.uid, username: info.username, home: info.homedir };
-  } catch {
-    invoker = { uid: -1, username: process.env.USER || process.env.LOGNAME || "root", home: homedir() };
-  }
-  const decision = chooseHostChannelUser({
-    invokerUid: invoker.uid,
-    invokerName: invoker.username,
-    invokerHome: invoker.home,
-    // Only probe sudo when it could change the outcome — a root invoker never needs it.
-    hasPasswordlessSudo: invoker.uid !== 0 && hasPasswordlessSudo()
-  });
-  return { ...decision, keyPath: join6(COMPOSE_DIR, "host-ssh", "id_ed25519") };
-}
-function authorizeKeyAt(authKeysPath, pub) {
-  mkdirSync3(dirname2(authKeysPath), { recursive: true, mode: 448 });
-  const existing = existsSync4(authKeysPath) ? readFileSync3(authKeysPath, "utf8") : "";
-  const next = rewriteHostAuthorizedKeys(existing, pub);
-  if (next !== existing) writeFileSync2(authKeysPath, next, { mode: 384 });
-  chmodSync(authKeysPath, 384);
-}
-function authorizeRootKeyViaSudo(pub) {
-  const mk = spawnSync4("sudo", ["-n", "sh", "-c", "mkdir -p /root/.ssh && chmod 700 /root/.ssh"], {
-    stdio: "ignore"
-  });
-  if (mk.status !== 0) return false;
-  const read = spawnSync4(
-    "sudo",
-    ["-n", "sh", "-c", `cat ${ROOT_AUTHORIZED_KEYS} 2>/dev/null || true`],
-    { encoding: "utf8" }
-  );
-  if (read.status !== 0) return false;
-  const next = rewriteHostAuthorizedKeys(read.stdout ?? "", pub);
-  const write = spawnSync4("sudo", ["-n", "tee", ROOT_AUTHORIZED_KEYS], {
-    input: next,
-    stdio: ["pipe", "ignore", "ignore"]
-  });
-  if (write.status !== 0) return false;
-  return spawnSync4("sudo", ["-n", "chmod", "600", ROOT_AUTHORIZED_KEYS], { stdio: "ignore" }).status === 0;
-}
-function revokeKeyAt(authKeysPath) {
-  try {
-    if (!existsSync4(authKeysPath)) return true;
-    const existing = readFileSync3(authKeysPath, "utf8");
-    if (!existing.includes(HOST_KEY_COMMENT)) return true;
-    writeFileSync2(authKeysPath, stripHostAuthorizedKeys(existing), { mode: 384 });
-    chmodSync(authKeysPath, 384);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function revokeRootKeyViaSudo() {
-  const read = spawnSync4(
-    "sudo",
-    ["-n", "sh", "-c", `cat ${ROOT_AUTHORIZED_KEYS} 2>/dev/null || true`],
-    { encoding: "utf8" }
-  );
-  if (read.status !== 0) return false;
-  const existing = read.stdout ?? "";
-  if (!existing.includes(HOST_KEY_COMMENT)) return true;
-  const write = spawnSync4("sudo", ["-n", "tee", ROOT_AUTHORIZED_KEYS], {
-    input: stripHostAuthorizedKeys(existing),
-    stdio: ["pipe", "ignore", "ignore"]
-  });
-  return write.status === 0;
-}
-function retireHostSshChannel(prev) {
-  const keyDir = join6(COMPOSE_DIR, "host-ssh");
-  if (!existsSync4(keyDir) && !prev.OPENSHIP_HOST_SSH_HOST) return;
-  const invokerKeys = join6(homedir(), ".ssh", "authorized_keys");
-  const asRoot = (prev.OPENSHIP_HOST_SSH_USER?.trim() || "root") === "root";
-  const weAreRoot = typeof process.getuid === "function" && process.getuid() === 0;
-  const revoked = asRoot ? weAreRoot ? revokeKeyAt(ROOT_AUTHORIZED_KEYS) : hasPasswordlessSudo() && revokeRootKeyViaSudo() : revokeKeyAt(invokerKeys);
-  const alsoInvoker = asRoot ? revokeKeyAt(invokerKeys) : true;
-  try {
-    rmSync(keyDir, { recursive: true, force: true });
-  } catch {
-  }
-  const stuck = asRoot ? ROOT_AUTHORIZED_KEYS : invokerKeys;
-  console.log(
-    revoked && alsoInvoker ? "  Host control off: dropped OPENSHIP_HOST_SSH_* from .env, deleted the host key and\n  revoked its authorized_keys line." : `  Host control off: dropped OPENSHIP_HOST_SSH_* from .env and deleted the host key (it
-  can no longer be used). Removing its line needs root \u2014 run:
-  sudo sed -i '/${HOST_KEY_COMMENT}/d' ${stuck}`
-  );
-}
-function provisionHostSshChannel(cfg) {
-  const target = plannedHostChannel(cfg.hostControl);
-  if (!target) return { channel: null };
-  const { user, keyPath, authKeysPath, viaSudo, rootUnavailable } = target;
-  const provisioned = (channel) => {
-    const port = toPort(cfg.hostSshPort) ?? HOST_CHANNEL_DEFAULT_PORT;
-    return probeHostSshd(port) === "absent" ? { channel, issue: { code: "no-sshd", detail: `port ${port}` } } : { channel };
-  };
-  try {
-    mkdirSync3(join6(COMPOSE_DIR, "host-ssh"), { recursive: true, mode: 448 });
-    if (!existsSync4(keyPath)) {
-      const g2 = spawnSync4(
-        "ssh-keygen",
-        ["-t", "ed25519", "-N", "", "-q", "-f", keyPath, "-C", HOST_KEY_COMMENT],
-        // stderr is captured rather than discarded: it is the only account of why the
-        // channel is missing, and the caller prints it.
-        { encoding: "utf8", stdio: ["ignore", "ignore", "pipe"] }
-      );
-      if (g2.status !== 0) return { channel: null, issue: { code: "keygen", detail: keygenWhy(g2) } };
-    }
-    const pub = readFileSync3(`${keyPath}.pub`, "utf8").trim();
-    if (!pub) return { channel: null, issue: { code: "empty-key" } };
-    if (rootUnavailable) {
-      console.warn(
-        "  \u26A0 Host control needs root, but this user isn't root and passwordless sudo isn't\n    available. Mail and edge host operations will fail. Re-run `openship up` as root\n    (or enable passwordless sudo) to fix. Continuing with a limited host channel."
-      );
-      authorizeKeyAt(authKeysPath, pub);
-      return provisioned({ user, keyPath });
-    }
-    if (viaSudo) {
-      if (!authorizeRootKeyViaSudo(pub)) {
-        console.warn(
-          "  \u26A0 Could not authorize the host key for root via sudo \u2014 falling back to the\n    current user. Root host operations (mail/edge) may fail."
-        );
-        const invoker = userInfo().username;
-        authorizeKeyAt(join6(homedir(), ".ssh", "authorized_keys"), pub);
-        return provisioned({ user: invoker, keyPath });
-      }
-      revokeKeyAt(join6(homedir(), ".ssh", "authorized_keys"));
-      return provisioned({ user, keyPath });
-    }
-    authorizeKeyAt(authKeysPath, pub);
-    return provisioned({ user, keyPath });
-  } catch (err) {
-    return { channel: null, issue: { code: "error", detail: err?.message } };
-  }
-}
-function keygenWhy(r2) {
-  if (r2.error?.code === "ENOENT") {
-    return "ssh-keygen is not installed \u2014 the openssh-client package provides it";
-  }
-  const stderr = (r2.stderr ?? "").trim().split("\n").pop();
-  return stderr || r2.error?.message || `ssh-keygen exited ${r2.status ?? "abnormally"}`;
-}
-function probeHostSshd(port) {
-  for (const [cmd, args] of [
-    ["ss", ["-H", "-ltn"]],
-    ["netstat", ["-ltn"]]
-  ]) {
-    const r2 = spawnSync4(cmd, [...args], { encoding: "utf8" });
-    if (r2.status !== 0 || !r2.stdout) continue;
-    return listensOnPort(r2.stdout, port) ? "listening" : "absent";
-  }
-  return "unknown";
-}
-function listensOnPort(listing, port) {
-  return listing.split("\n").filter((line) => /\bLISTEN\b/.test(line)).some(
-    (line) => line.trim().split(/\s+/).some((token) => token.endsWith(`:${port}`))
-  );
-}
-function carriedHostChannel(prev) {
-  const keyPath = prev.OPENSHIP_HOST_KEY_PATH?.trim();
-  if (!prev.OPENSHIP_HOST_SSH_HOST?.trim() || !keyPath || !existsSync4(keyPath)) return null;
-  return { user: prev.OPENSHIP_HOST_SSH_USER?.trim() || "root", keyPath };
-}
-var HOST_ISSUE_INDENT = "    ";
-function hostIssueNote(text) {
-  return wrapText(text, 80).map((l2) => `${HOST_ISSUE_INDENT}${l2}
-`).join("");
-}
-function renderHostChannelIssue(issue, ctx) {
-  const detail = issue.detail ? ` (${issue.detail})` : "";
-  const headline = issue.code === "no-sshd" ? `  \u26A0 Host control is provisioned, but nothing on this host is listening for SSH${detail}.` : `  \u26A0 Host control could NOT be provisioned on this box.`;
-  let cause;
-  switch (issue.code) {
-    case "keygen":
-      cause = `The channel's key could not be generated${detail}.`;
-      break;
-    case "empty-key":
-      cause = "The channel's key was generated but its public half read back empty.";
-      break;
-    case "no-sshd":
-      cause = `The api container now has a key and an address, and will be refused the first time it dials ${ctx.target}:
-` + explainHostChannelCause("refused", {
-        target: ctx.target,
-        // Measured here rather than left to core's default, which is Debian's `ssh` —
-        // a unit name that does not exist on the RHEL family, so the remedy printed on
-        // an Amazon Linux box was a command that silently does nothing.
-        sshdEnableHint: thisHost().sshdEnableHint()
-      }).body;
-      break;
-    case "error":
-      cause = `Setting up the channel's key failed${detail}.`;
-      break;
-  }
-  const continuity = issue.code === "no-sshd" ? "" : ctx.kept ? hostIssueNote(
-    "Kept the host channel this install already had in `.env` rather than dropping it: its key is still authorized, so the api container keeps the access it had instead of losing it to this failure."
-  ) : hostIssueNote(
-    "OPENSHIP_HOST_SSH_HOST is therefore unset, and host operations refuse rather than run against the api container's own filesystem."
-  );
-  return `${headline}
-` + hostIssueNote(cause) + continuity + hostIssueNote(HOST_CHANNEL_UNAFFECTED) + `${HOST_ISSUE_INDENT}Unavailable until the channel works:
-` + HOST_CHANNEL_BLOCKED.map((l2) => `${HOST_ISSUE_INDENT}  \xB7 ${l2}
-`).join("") + hostIssueNote(HOST_CHANNEL_RECHECK);
-}
-function composeProjectName(prev) {
-  if (prev.COMPOSE_PROJECT_NAME) return prev.COMPOSE_PROJECT_NAME;
-  return Object.keys(prev).length > 0 ? "compose" : "openship";
-}
-var PGDATA_ROOT = "/var/lib/postgresql/data";
-function probePgDataDir(volume) {
-  const r2 = spawnSync4(
-    "docker",
-    [
-      "run",
-      "--rm",
-      "-v",
-      `${volume}:/from:ro`,
-      "alpine:3",
-      "sh",
-      "-c",
-      `if [ -f /from/PG_VERSION ]; then echo root; elif [ -f /from/pgdata/PG_VERSION ]; then echo sub; elif [ -z "$(ls -A /from 2>/dev/null | grep -v '^lost+found$')" ]; then echo empty; else echo foreign; fi`
-    ],
-    { encoding: "utf8" }
-  );
-  if (r2.status !== 0) return "unknown";
-  const out = `${r2.stdout ?? ""}`.trim();
-  return out === "root" || out === "sub" || out === "empty" || out === "foreign" ? out : "unknown";
-}
-function resolvePgData(prev) {
-  const SUB = `${PGDATA_ROOT}/pgdata`;
-  if (prev.OPENSHIP_PGDATA) return prev.OPENSHIP_PGDATA;
-  const volume = survivingDbVolume(prev);
-  if (!volume) return SUB;
-  return probePgDataDir(volume) === "root" ? PGDATA_ROOT : SUB;
-}
-function pgDataDetectionRisk(prev) {
-  if (prev.OPENSHIP_PGDATA) return null;
-  const volume = survivingDbVolume(prev);
-  if (!volume) return null;
-  return probePgDataDir(volume) === "foreign" ? { volume } : null;
-}
-function composePgDataRisk(_opts = {}) {
-  return pgDataDetectionRisk(readEnvFile());
-}
-function renderPgDataRefusal(risk, opts = {}) {
-  const SUB = `${PGDATA_ROOT}/pgdata`;
-  return `
-  ${opts.dryRun ? "A real run would REFUSE here" : "Refusing to continue"}: this install's data volume holds data, but not a Postgres cluster we recognize.
-
-    volume:  ${risk.volume}
-    checked: ${PGDATA_ROOT}/PG_VERSION and ${SUB}/PG_VERSION \u2014 neither present
-
-  Guessing where the cluster lives is how a wrong path makes Postgres run initdb over
-  your existing data and orphan it, so nothing has been written. If you know the layout,
-  pin it and re-run:
-
-    echo 'OPENSHIP_PGDATA=${SUB}' >> ${ENV_FILE}     # or ${PGDATA_ROOT} if the cluster is at the root
-`;
-}
-var PS_SWEEP_FORMAT = '{{.Names}}	{{.Label "com.docker.compose.project"}}	{{.Label "com.docker.compose.project.config_files"}}	{{.Label "com.docker.compose.service"}}';
-function parsePsSweep(stdout) {
-  return stdout.split("\n").map((line) => line.trim()).filter(Boolean).map((line) => {
-    const [name, project, configFiles, service] = line.split("	");
-    return {
-      name: name ?? "",
-      project: project ?? "",
-      configFiles: configFiles ?? "",
-      service: service ?? ""
-    };
-  });
-}
-function psSweepRaw() {
-  const r2 = spawnSync4("docker", ["ps", "-a", "--format", PS_SWEEP_FORMAT], { encoding: "utf8" });
-  return r2.status === 0 && r2.stdout ? r2.stdout : null;
-}
-function psSweep() {
-  return parsePsSweep(psSweepRaw() ?? "");
-}
-function fromOurComposeFile(row) {
-  return row.configFiles.split(",").some((f2) => f2.trim() === COMPOSE_FILE);
-}
-function orphanedStackContainers(project) {
-  return psSweep().filter((c2) => c2.name && c2.project && c2.project !== project && fromOurComposeFile(c2)).map(({ name, project: proj }) => ({ name, project: proj }));
-}
-function adoptedStackOrigin(psStdout, project) {
-  const rows = parsePsSweep(psStdout).filter((c2) => c2.name && c2.project === project);
-  if (rows.length === 0 || rows.some(fromOurComposeFile)) return null;
-  return {
-    project,
-    configFiles: rows.map((c2) => c2.configFiles).find(Boolean) ?? "",
-    apiContainer: rows.find((c2) => c2.service === "api")?.name || `${project}-api-1`
-  };
-}
-function adoptedStack(project) {
-  const sweep = psSweepRaw();
-  return sweep ? adoptedStackOrigin(sweep, project) : null;
-}
-function reconcileDbPassword(user, password) {
-  if (!password) return;
-  if (compose(["up", "-d", "--wait", "postgres"], { quiet: true }) !== 0) return;
-  const attempt = (asRole) => spawnSync4(
-    "docker",
-    [
-      "compose",
-      "-f",
-      COMPOSE_FILE,
-      "exec",
-      "-T",
-      "postgres",
-      "psql",
-      "-U",
-      asRole,
-      "-d",
-      "postgres",
-      "-v",
-      "ON_ERROR_STOP=1",
-      // Read the statement from STDIN, not `-c`: psql has no bind parameters for
-      // ALTER USER, so the password has to be inlined in SQL — and an argv copy
-      // would be readable in `ps` for the life of the call. stdin keeps it to this
-      // process and the socket. Our generated password is hex, so it cannot break
-      // out of the quoted literal either.
-      "-f",
-      "-"
-    ],
-    {
-      cwd: COMPOSE_DIR,
-      encoding: "utf8",
-      // Create the role if the volume predates it, else just realign it. Both
-      // branches leave exactly the credentials this `.env` will present.
-      input: `DO $$ BEGIN
-  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${user}') THEN
-    ALTER ROLE "${user}" WITH LOGIN PASSWORD '${password}';
-  ELSE
-    CREATE ROLE "${user}" WITH LOGIN SUPERUSER PASSWORD '${password}';
-  END IF;
-END $$;
-`
-    }
-  );
-  let r2 = attempt(user);
-  if (r2.status !== 0) r2 = attempt("postgres");
-  if (r2.status !== 0) {
-    console.log(
-      `
-  ! Could not realign the database password (${(r2.stderr ?? "").trim() || "psql failed"}).
-    The api will fail with "password authentication failed for user "${user}"" because the
-    existing data volume was initialized with a different password.
-
-    Fix it one of two ways:
-      \u2022 restore the .env that created the volume, or
-      \u2022 start fresh (DESTROYS DB DATA):  openship uninstall  then  openship up
-`
-    );
-  }
-}
-function removeOrphanedStack(project) {
-  const orphans = orphanedStackContainers(project);
-  if (orphans.length === 0) return;
-  const projects = [...new Set(orphans.map((o2) => o2.project))].join(", ");
-  console.log(
-    `  Removing ${orphans.length} container(s) from a previous stack (project "${projects}") \u2014 they would hold the ports this stack needs. Volumes are kept.`
-  );
-  spawnSync4("docker", ["rm", "-f", ...orphans.map((o2) => o2.name)], { stdio: "ignore" });
-}
-function edgeNameNeedsReclaim(psStdout, project) {
-  const row = parsePsSweep(psStdout).find((c2) => c2.name === "openship-edge");
-  if (!row) return false;
-  return !(row.project === project && fromOurComposeFile(row));
-}
-function reconcileEdgeContainerName(project) {
-  const sweep = psSweepRaw();
-  if (!sweep) return;
-  if (!edgeNameNeedsReclaim(sweep, project)) return;
-  console.log(
-    "  Replacing an unmanaged `openship-edge` container so compose can own it (config is on the host, so no routes are lost)."
-  );
-  spawnSync4("docker", ["rm", "-f", "openship-edge"], { stdio: "ignore" });
-}
-function migrateLegacyEdgeVolumes(project) {
-  const pairs = [
-    { volume: `${project}_openship_sites`, host: EDGE_SITES_HOST_DIR },
-    { volume: `${project}_openship_certs`, host: "/etc/letsencrypt" },
-    { volume: `${project}_openship_acme`, host: EDGE_ACME_HOST_DIR },
-    { volume: `${project}_openship_static`, host: "/opt/openship/static" }
-  ];
-  const ls = spawnSync4("docker", ["volume", "ls", "--format", "{{.Name}}"], { encoding: "utf8" });
-  if (ls.status !== 0 || !ls.stdout) return;
-  const existing = new Set(ls.stdout.split("\n").map((l2) => l2.trim()).filter(Boolean));
-  for (const { volume, host } of pairs) {
-    if (!existing.has(volume)) continue;
-    mkdirSync3(host, { recursive: true });
-    const alreadyThere = spawnSync4("sh", ["-c", `ls -A ${JSON.stringify(host)} 2>/dev/null | head -1`], {
-      encoding: "utf8"
-    });
-    if (alreadyThere.stdout?.trim()) continue;
-    console.log(`  Moving edge state from volume ${volume} onto ${host}...`);
-    const copy = spawnSync4(
-      "docker",
-      [
-        "run",
-        "--rm",
-        "-v",
-        `${volume}:/from:ro`,
-        "-v",
-        `${host}:/to`,
-        "alpine:3",
-        "sh",
-        "-c",
-        "cp -a /from/. /to/ 2>/dev/null || true"
-      ],
-      { stdio: "inherit" }
-    );
-    if (copy.status !== 0) {
-      console.log(
-        `  Could not copy ${volume} \u2014 the stack will start with an empty ${host}.
-  Recover manually with: docker run --rm -v ${volume}:/from -v ${host}:/to alpine cp -a /from/. /to/`
-      );
-    }
-  }
-}
-function warnOrphanedVolumes(project) {
-  const r2 = spawnSync4("docker", ["volume", "ls", "--format", "{{.Name}}"], { encoding: "utf8" });
-  if (r2.status !== 0 || !r2.stdout) return;
-  const others = new Set(
-    r2.stdout.split("\n").map((l2) => l2.trim()).filter((l2) => l2.endsWith("_openship_sites")).map((l2) => l2.slice(0, -"_openship_sites".length)).filter((p2) => p2 && p2 !== project)
-  );
-  if (others.size === 0) return;
-  console.log(
-    `  Note: volumes from a previous install (project "${[...others].join(", ")}") are still on disk
-  and are NOT mounted by this stack \u2014 its database starts fresh. (Certificates and
-  vhosts now live on the host, so those carry over.)
-  Remove them with \`docker volume ls | grep _openship_\` once you're sure they aren't needed.`
-  );
-}
-function keepConfig(prev, key, explicit) {
-  const set = explicit?.trim();
-  if (set) return set;
-  const carried = prev[key]?.trim();
-  return carried || void 0;
-}
-var ACME_ENV_KEYS = [
-  "OPENSHIP_ACME_EMAIL",
-  "OPENSHIP_ACME_DIRECTORY_URL",
-  "OPENSHIP_ACME_EAB_KID",
-  "OPENSHIP_ACME_EAB_HMAC_KEY",
-  "OPENSHIP_ACME_KEY_TYPE",
-  "OPENSHIP_ACME_CA_BUNDLE",
-  "OPENSHIP_ACME_TOS_AGREED"
-];
-function hostGatewayEnv(prev) {
-  const value = process.env.OPENSHIP_HOST_GATEWAY?.trim() || prev.OPENSHIP_HOST_GATEWAY?.trim();
-  return value ? [`OPENSHIP_HOST_GATEWAY=${value}`] : [];
-}
-function rootlessSocketCandidates() {
-  const runtimeDir = process.env.XDG_RUNTIME_DIR?.trim();
-  const sudoUid = process.env.SUDO_UID?.trim();
-  let uid;
-  try {
-    uid = userInfo().uid;
-  } catch {
-  }
-  return [
-    ...runtimeDir ? [join6(runtimeDir, "docker.sock")] : [],
-    ...sudoUid ? [`/run/user/${sudoUid}/docker.sock`] : [],
-    ...uid !== void 0 ? [`/run/user/${uid}/docker.sock`] : []
-  ];
-}
-function detectDockerSocketPath() {
-  const fromClient = resolveLocalDockerSocketPath(void 0, process.env);
-  if (fromClient !== DEFAULT_DOCKER_SOCKET_PATH) return fromClient;
-  if (existsSync4(DEFAULT_DOCKER_SOCKET_PATH)) return DEFAULT_DOCKER_SOCKET_PATH;
-  return rootlessSocketCandidates().find((p2) => existsSync4(p2)) ?? DEFAULT_DOCKER_SOCKET_PATH;
-}
-function resolveDockerSocket(prev) {
-  const pinned = process.env.OPENSHIP_DOCKER_SOCKET?.trim() || prev.OPENSHIP_DOCKER_SOCKET?.trim();
-  return pinned ? { path: pinned, pinned: true } : { path: detectDockerSocketPath(), pinned: false };
-}
-function dockerSocketEnv(prev) {
-  const { path, pinned } = resolveDockerSocket(prev);
-  return pinned || path !== DEFAULT_DOCKER_SOCKET_PATH ? [`OPENSHIP_DOCKER_SOCKET=${path}`] : [];
-}
-function warnMissingDockerSocket(path) {
-  console.warn(
-    `
-  ! The Docker socket this install mounts into the api isn't there:
-      ${path}
-    Docker will create that path as an empty DIRECTORY, so the stack will come up
-    and then fail every container operation with a transport error naming neither
-    this path nor the cause (#482). Point it at the real socket:
-      docker context inspect --format '{{.Endpoints.docker.Host}}'
-      OPENSHIP_DOCKER_SOCKET=/run/user/$(id -u)/docker.sock openship up --compose
-    (a rootless daemon keeps its socket under the daemon user's runtime dir).
-`
-  );
-}
-function renderAcmeEnv(prev) {
-  return ACME_ENV_KEYS.flatMap((key) => {
-    const value = process.env[key]?.trim() || prev[key]?.trim();
-    if (!value) return [];
-    if (/[\r\n]/.test(value)) throw new Error(`${key} must be a single-line value`);
-    return [`${key}=${value}`];
-  });
-}
-function resolveEnvConfig(prev, opts) {
-  const publicUrl = keepConfig(prev, "OPENSHIP_PUBLIC_URL", opts.publicUrl);
-  const bindAddr = keepConfig(prev, "OPENSHIP_BIND_ADDR") ?? (publicUrl ? "0.0.0.0" : void 0);
-  return {
-    apiPort: keepConfig(prev, "API_PORT", opts.apiPort) ?? String(DEFAULT_API_PORT),
-    dashPort: keepConfig(prev, "DASHBOARD_PORT", opts.dashboardPort) ?? String(DEFAULT_DASHBOARD_PORT),
-    ...bindAddr ? { bindAddr } : {},
-    ...publicUrl ? { publicUrl } : {},
-    // A public URL always implies a proxy in front; otherwise keep whatever the
-    // install was configured with.
-    trustProxy: Boolean(opts.trustProxy) || Boolean(publicUrl) || prev.TRUST_PROXY === "true",
-    ...keepConfig(prev, "OPENSHIP_EXTRA_TRUSTED_ORIGINS", opts.extraTrustedOrigins) ? {
-      extraTrustedOrigins: keepConfig(
-        prev,
-        "OPENSHIP_EXTRA_TRUSTED_ORIGINS",
-        opts.extraTrustedOrigins
-      )
-    } : {},
-    registry: keepConfig(prev, "OPENSHIP_IMAGE_REGISTRY", opts.registry) ?? DEFAULT_IMAGE_REGISTRY,
-    // Tri-state: the flag is absent on a plain re-run, so fall back to what the
-    // install chose rather than silently re-granting host control.
-    hostControl: opts.noHostControl === void 0 ? prev.OPENSHIP_HOST_CONTROL !== "false" : !opts.noHostControl,
-    // Sticky too: `--mail` is only the install-time default, so a plain re-run
-    // (or `openship update`) must not hand a mail box back the platform shell.
-    // Turning it OFF is the dashboard's job — Settings → Instance stores the mode
-    // in the database, which wins over this env var either way.
-    productMode: opts.mail || keepConfig(prev, "OPENSHIP_PRODUCT") === "mail" ? "mail" : "platform",
-    // Sticky like every other operator choice here. These were literals in
-    // `renderEnv`, so a box where `host.docker.internal:22` is simply not the
-    // right address — rootless Docker, sshd on another port — had nowhere to say
-    // so, and every `openship up` overwrote a hand-edited `.env` back to the
-    // value that didn't work (#490/#482).
-    hostSshHost: keepConfig(prev, "OPENSHIP_HOST_SSH_HOST", opts.hostSshHost) ?? HOST_CHANNEL_DEFAULT_HOST,
-    hostSshPort: keepConfig(prev, "OPENSHIP_HOST_SSH_PORT", opts.hostSshPort) ?? String(HOST_CHANNEL_DEFAULT_PORT)
-  };
-}
-function toPort(value) {
-  const n2 = Number(value);
-  return Number.isInteger(n2) && n2 > 0 && n2 <= 65535 ? n2 : void 0;
-}
-function composeEnvPorts() {
-  const env = readEnvFile();
-  return { api: toPort(env.API_PORT), dashboard: toPort(env.DASHBOARD_PORT) };
-}
-function composeBindAddr() {
-  return readEnvFile().OPENSHIP_BIND_ADDR?.trim() || "127.0.0.1";
-}
-function composeHostChannel() {
-  const env = readEnvFile();
-  const host = env.OPENSHIP_HOST_SSH_HOST?.trim();
-  if (!host) return null;
-  return {
-    host,
-    port: toPort(env.OPENSHIP_HOST_SSH_PORT) ?? 22,
-    user: env.OPENSHIP_HOST_SSH_USER?.trim() || "root"
-  };
-}
-function composeHostChannelExpected() {
-  if (!existsSync4(COMPOSE_FILE)) return false;
-  return readEnvFile().OPENSHIP_HOST_CONTROL !== "false";
-}
-function composeTrustedOriginUrls() {
-  const env = readEnvFile();
-  return [env.OPENSHIP_PUBLIC_URL, env.OPENSHIP_EXTRA_TRUSTED_ORIGINS].filter(
-    (v2) => !!v2?.trim()
-  );
-}
-function composeHeldPorts() {
-  const r2 = spawnSync4(
-    "docker",
-    ["ps", "--format", '{{.Label "com.docker.compose.project.config_files"}}	{{.Ports}}'],
-    { encoding: "utf8" }
-  );
-  if (r2.status !== 0 || !r2.stdout) return [];
-  const ports = /* @__PURE__ */ new Set();
-  for (const line of r2.stdout.split("\n")) {
-    const [configFiles = "", published = ""] = line.split("	");
-    if (!configFiles.split(",").some((f2) => f2.trim() === COMPOSE_FILE)) continue;
-    for (const m2 of published.matchAll(/:(\d+)->/g)) ports.add(Number(m2[1]));
-  }
-  return [...ports];
-}
-async function resolveComposePorts(prefs, opts = {}) {
-  return resolvePorts(
-    {
-      api: toPort(prefs.api),
-      dashboard: toPort(prefs.dashboard),
-      previous: composeEnvPorts(),
-      bindAddr: composeBindAddr(),
-      reclaimable: composeHeldPorts()
-    },
-    opts
-  );
-}
-var OMITTABLE_MANAGED_KEYS = /* @__PURE__ */ new Set([
-  "OPENSHIP_HOST_SSH_HOST",
-  "OPENSHIP_HOST_SSH_USER",
-  "OPENSHIP_HOST_SSH_PORT",
-  "OPENSHIP_HOST_SSH_KEY",
-  "OPENSHIP_HOST_KEY_PATH",
-  "OPENSHIP_HOST_GATEWAY",
-  "TRUST_PROXY"
-]);
-var envKeyOf = (line) => line.match(/^([A-Z0-9_]+)=/)?.[1];
-function operatorEnvPassthrough(managed, prev) {
-  return Object.entries(prev).filter(([key]) => !managed.has(key) && !OMITTABLE_MANAGED_KEYS.has(key)).map(([key, value]) => `${key}=${value}`);
-}
-var PRESERVED_ENV_HEADER = "# Preserved from your existing .env \u2014 set by you, not by `openship up` (#485).";
-function resolveImageVersion(opts) {
-  return opts.version?.trim() || process.env.OPENSHIP_VERSION?.trim() || (true ? "0.6.5" : "latest");
-}
-function managedEnvLines(opts, host, cfg, prev) {
-  const lines = [
-    "# Managed by `openship up`. Secrets are generated once and preserved.",
-    // Do NOT edit on a live install — it is the volume prefix (see composeProjectName).
-    `COMPOSE_PROJECT_NAME=${composeProjectName(prev)}`,
-    "CLOUD_MODE=false",
-    "OPENSHIP_TARGET=local",
-    "OPENSHIP_REQUIRE_AUTH=true",
-    // Read by createHostExecutor (throws when false) and by the servers list
-    // (hides the local row). Written explicitly so the policy is visible in .env.
-    `OPENSHIP_HOST_CONTROL=${cfg.hostControl ? "true" : "false"}`,
-    // The host side of the api's docker socket mount, when it isn't the rootful
-    // default. Unlike the host channel above this is NOT optional plumbing — every
-    // deploy goes through it — so it is resolved on every run, host control or not.
-    ...dockerSocketEnv(prev),
-    // Which shell the dashboard defaults to. Emitted on EVERY run, including the
-    // "platform" default: that keeps the key permanently in the managed set, so
-    // the #485 passthrough can never mistake it for operator config (which would
-    // pin it and make the Settings → Instance toggle look broken after an `up`).
-    `OPENSHIP_PRODUCT=${cfg.productMode}`,
-    `OPENSHIP_IMAGE_REGISTRY=${cfg.registry}`,
-    `OPENSHIP_VERSION=${resolveImageVersion(opts)}`,
-    `POSTGRES_PASSWORD=${keepSecret(prev, "POSTGRES_PASSWORD")}`,
-    // Pinned once (see resolvePgData): fresh install → subdir, existing volume → root.
-    `OPENSHIP_PGDATA=${resolvePgData(prev)}`,
-    `BETTER_AUTH_SECRET=${keepSecret(prev, "BETTER_AUTH_SECRET")}`,
-    `INTERNAL_TOKEN=${keepSecret(prev, "INTERNAL_TOKEN")}`,
-    `API_PORT=${cfg.apiPort}`,
-    `DASHBOARD_PORT=${cfg.dashPort}`,
-    // The api's OWN view of the dashboard port: the self-app boot reconcile points
-    // the operator's domain at the dashboard through this (self-deploy.ts), and it
-    // silently defaults to 3001 when unset. Ports are dynamic now, so leaving it
-    // out publishes a domain routed to a port nothing is listening on.
-    `OPENSHIP_DASHBOARD_PORT=${cfg.dashPort}`,
-    // Alternate CA/EAB values are operator configuration (including one secret),
-    // so a routine `openship up`/upgrade must not silently discard them.
-    ...renderAcmeEnv(prev)
-  ];
-  if (cfg.bindAddr) lines.push(`OPENSHIP_BIND_ADDR=${cfg.bindAddr}`);
-  if (cfg.publicUrl) lines.push(`OPENSHIP_PUBLIC_URL=${cfg.publicUrl}`);
-  if (cfg.extraTrustedOrigins) {
-    lines.push(`OPENSHIP_EXTRA_TRUSTED_ORIGINS=${cfg.extraTrustedOrigins}`);
-  }
-  if (cfg.trustProxy) lines.push("TRUST_PROXY=true");
-  if (host) {
-    lines.push(
-      `OPENSHIP_HOST_SSH_HOST=${cfg.hostSshHost}`,
-      `OPENSHIP_HOST_SSH_USER=${host.user}`,
-      `OPENSHIP_HOST_SSH_PORT=${cfg.hostSshPort}`,
-      "OPENSHIP_HOST_SSH_KEY=/run/secrets/openship_host_key",
-      `OPENSHIP_HOST_KEY_PATH=${host.keyPath}`,
-      ...hostGatewayEnv(prev)
-    );
-  }
-  return lines;
-}
-function renderEnvAndCarried(opts, host, cfg, prev) {
-  const lines = managedEnvLines(opts, host, cfg, prev);
-  const managed = new Set(lines.map(envKeyOf).filter((k2) => !!k2));
-  const preserved = operatorEnvPassthrough(managed, prev);
-  const body = preserved.length ? [...lines, "", PRESERVED_ENV_HEADER, ...preserved] : lines;
-  return {
-    text: body.join("\n") + "\n",
-    carried: preserved.map((line) => line.slice(0, line.indexOf("=")))
-  };
-}
-function renderEnv(opts, host, cfg) {
-  return renderEnvAndCarried(opts, host, cfg, readEnvFile()).text;
-}
-function sourceBuildDir() {
-  const marker = readSourceInstall();
-  if (!marker?.dir) return null;
-  const hasAll = BUILT_SERVICES.every((s2) => existsSync4(join6(marker.dir, s2.dockerfile)));
-  return hasAll ? marker.dir : null;
-}
-function renderBuildOverride(repoDir) {
-  const services = BUILT_SERVICES.map(
-    (s2) => `  ${s2.service}:
-    build:
-      context: ${repoDir}
-      dockerfile: ${s2.dockerfile}
-`
-  ).join("");
-  return `# Managed by \`openship up\` (from-source install) \u2014 builds instead of pulls.
-services:
-${services}`;
-}
-function materialize(opts) {
-  mkdirSync3(COMPOSE_DIR, { recursive: true, mode: 448 });
-  const prev = readEnvFile();
-  const cfg = resolveEnvConfig(prev, opts);
-  const provision = provisionHostSshChannel(cfg);
-  let host = provision.channel;
-  let kept = false;
-  if (!host && provision.issue) {
-    const previousChannel = carriedHostChannel(prev);
-    if (previousChannel) {
-      host = previousChannel;
-      kept = true;
-    }
-  }
-  if (!cfg.hostControl) retireHostSshChannel(prev);
-  if (provision.issue && !opts.alreadyFetched) {
-    console.warn(
-      renderHostChannelIssue(provision.issue, {
-        target: `${cfg.hostSshHost}:${cfg.hostSshPort}`,
-        kept
-      })
-    );
-  }
-  const socket = resolveDockerSocket(prev);
-  if (!opts.alreadyFetched && !existsSync4(socket.path)) warnMissingDockerSocket(socket.path);
-  let before = "";
-  try {
-    before = readFileSync3(ENV_FILE, "utf8");
-  } catch {
-  }
-  const { text: rendered, carried } = renderEnvAndCarried(opts, host, cfg, prev);
-  writeFileSync2(COMPOSE_FILE, COMPOSE_YAML);
-  writeEnvFile(rendered, before);
-  if (carried.length) {
-    console.log(`  Kept ${carried.length} operator-set .env variable(s): ${carried.join(", ")}`);
-  }
-  const buildDir = opts.build === false ? null : sourceBuildDir();
-  if (buildDir) writeFileSync2(BUILD_FILE, renderBuildOverride(buildDir));
-  return { buildDir, cfg, envChanged: before !== "" && rendered !== before };
-}
-function writeEnvFile(rendered, before) {
-  if (rendered === before) return;
-  if (before) writeFileSync2(ENV_BACKUP_FILE, before, { mode: 384 });
-  writeFileSync2(ENV_TMP_FILE, rendered, { mode: 384 });
-  renameSync(ENV_TMP_FILE, ENV_FILE);
-}
-var SECRET_ENV_KEY = /(PASSWORD|SECRET|TOKEN|HMAC_KEY)$/;
-function composePlan(opts) {
-  const prev = readEnvFile();
-  const cfg = resolveEnvConfig(prev, opts);
-  const buildDir = opts.build === false ? null : sourceBuildDir();
-  const hostChannel = plannedHostChannel(cfg.hostControl);
-  const settings = [];
-  const newSecrets = [];
-  for (const line of renderEnv(opts, hostChannel, cfg).split("\n")) {
-    const at2 = line.indexOf("=");
-    if (at2 < 1 || line.startsWith("#")) continue;
-    const key = line.slice(0, at2);
-    const value = line.slice(at2 + 1);
-    if (!SECRET_ENV_KEY.test(key)) {
-      settings.push({ key, value });
-      continue;
-    }
-    const preserved = !!prev[key] && prev[key] === value;
-    if (!preserved) newSecrets.push(key);
-    settings.push({ key, value: preserved ? "<preserved>" : "<generated on this run>" });
-  }
-  return {
-    composeFile: COMPOSE_FILE,
-    envFile: ENV_FILE,
-    installMethodFile: INSTALL_METHOD_FILE,
-    ...buildDir ? { buildFile: BUILD_FILE } : {},
-    yaml: COMPOSE_YAML,
-    settings,
-    newSecrets,
-    secretRotation: opts.resetSecrets ? null : secretRotationRisk(prev),
-    pgDataRisk: pgDataDetectionRisk(prev),
-    existing: Object.keys(prev).length > 0,
-    mountDirs: EDGE_CONTAINER_MOUNTS.map((m2) => m2.host),
-    buildDir,
-    hostChannel
-  };
-}
-function dbVolumeExists(project) {
-  const r2 = spawnSync4("docker", ["volume", "inspect", `${project}_postgres_data`], {
-    stdio: "ignore"
-  });
-  return r2.status === 0;
-}
-function compose(args, opts) {
-  const files = ["-f", COMPOSE_FILE];
-  if (opts?.withBuildOverride) files.push("-f", BUILD_FILE);
-  const r2 = spawnSync4("docker", ["compose", ...files, ...args], {
-    cwd: COMPOSE_DIR,
-    stdio: opts?.quiet ? "ignore" : "inherit"
-  });
-  return r2.status ?? 1;
-}
-function missingPinnedImages(registry, version) {
-  const missing = [];
-  for (const { service } of BUILT_SERVICES) {
-    const ref = `${registry}/openship-${service}:${version}`;
-    const r2 = spawnSync4("docker", ["manifest", "inspect", ref], { encoding: "utf8" });
-    if (r2.status === 0) continue;
-    const stderr = `${r2.stderr ?? ""}`.toLowerCase();
-    if (/manifest unknown|no such manifest|manifest for .+ not found/.test(stderr)) {
-      missing.push(ref);
-      continue;
-    }
-    return null;
-  }
-  return missing;
-}
-function pinnedImagesReady(opts) {
-  if (sourceBuildDir()) return true;
-  const prev = readEnvFile();
-  const version = resolveImageVersion(opts);
-  const missing = missingPinnedImages(resolveEnvConfig(prev, opts).registry, version);
-  if (!missing || missing.length === 0) return true;
-  const prevVersion = prev.OPENSHIP_VERSION?.trim();
-  const out = [
-    "",
-    `  The pinned image tag \`${version}\` isn't in the registry yet:`,
-    ...missing.map((ref) => `    ${ref}`),
-    "",
-    "  The CLI reached npm before its container images finished publishing \u2014 a",
-    "  release-ordering race (#486). Nothing on this box was changed.",
-    "",
-    "  Any one of these gets you moving:",
-    "    \u2022 Wait a few minutes and re-run \u2014 the images usually land right after a release.",
-    "    \u2022 Pin a tag that exists:",
-    "        openship up --compose --image-version <tag>",
-    "        OPENSHIP_VERSION=<tag> openship up --compose"
-  ];
-  if (prevVersion && prevVersion !== version) {
-    out.push(`    \u2022 Your current install runs \`${prevVersion}\`, a tag known good on this box.`);
-  }
-  out.push("");
-  console.error(out.join("\n"));
-  return false;
-}
-function composePrefetch(opts) {
-  const rotation = composeSecretRotationRisk(opts);
-  if (rotation) {
-    console.error(renderSecretRotationRefusal(rotation));
-    return { ok: false, envChanged: false };
-  }
-  const { buildDir, envChanged } = materialize(opts);
-  if (buildDir) {
-    return {
-      ok: compose(["pull", "postgres", "redis"], { withBuildOverride: true }) === 0 && compose(["build"], { withBuildOverride: true }) === 0,
-      envChanged
-    };
-  }
-  return { ok: compose(["pull"]) === 0, envChanged };
-}
-function ensureEdgeMountDirs() {
-  const failed = [];
-  for (const { host } of EDGE_CONTAINER_MOUNTS) {
-    try {
-      mkdirSync3(host, { recursive: true });
-    } catch (err) {
-      if (err.code !== "EEXIST") failed.push(host);
-    }
-  }
-  return failed;
-}
-function isRootlessDocker() {
-  const r2 = spawnSync4("docker", ["info", "-f", "{{println .SecurityOptions}}"], {
-    encoding: "utf8"
-  });
-  return r2.status === 0 && /rootless/i.test(r2.stdout ?? "");
-}
-async function composeUp(opts) {
-  if (!opts.alreadyFetched && !pinnedImagesReady(opts)) {
-    const pre = resolveEnvConfig(readEnvFile(), opts);
-    return { ok: false, apiPort: pre.apiPort, dashPort: pre.dashPort };
-  }
-  const rotation = composeSecretRotationRisk(opts);
-  if (rotation) {
-    const pre = resolveEnvConfig(readEnvFile(), opts);
-    console.error(renderSecretRotationRefusal(rotation));
-    return { ok: false, refused: true, apiPort: pre.apiPort, dashPort: pre.dashPort };
-  }
-  const pgData = composePgDataRisk(opts);
-  if (pgData) {
-    const pre = resolveEnvConfig(readEnvFile(), opts);
-    console.error(renderPgDataRefusal(pgData));
-    return { ok: false, refused: true, apiPort: pre.apiPort, dashPort: pre.dashPort };
-  }
-  const { buildDir, cfg, envChanged: rendered } = materialize(opts);
-  const apiPort = cfg.apiPort;
-  const dashPort = cfg.dashPort;
-  const envChanged = opts.envChanged ?? rendered;
-  const up = (extra = {}) => compose(
-    envChanged ? ["up", "-d", "--force-recreate", ...ENV_CONSUMING_SERVICES] : ["up", "-d"],
-    extra
-  );
-  const env = readEnvFile();
-  const project = env.COMPOSE_PROJECT_NAME || "openship";
-  removeOrphanedStack(project);
-  reconcileEdgeContainerName(project);
-  migrateLegacyEdgeVolumes(project);
-  warnOrphanedVolumes(project);
-  const unmakeableMounts = ensureEdgeMountDirs();
-  if (unmakeableMounts.length && isRootlessDocker()) {
-    const dirs = unmakeableMounts.join(" ");
-    console.error(
-      `
-  Rootless Docker can't create the edge's host directories under root-owned paths:
-    ${unmakeableMounts.join("\n    ")}
-
-  Create them once (owned by your user), then re-run \`openship up --compose\`:
-    sudo mkdir -p ${dirs}
-    sudo chown -R "$(id -un)" ${dirs}
-`
-    );
-    return { ok: false, apiPort, dashPort };
-  }
-  if (dbVolumeExists(project)) {
-    reconcileDbPassword(env.POSTGRES_USER || "openship", env.POSTGRES_PASSWORD ?? "");
-  }
-  await sanitizeEdgeVhosts(
-    new LocalExecutor(),
-    EDGE_SITES_HOST_DIR,
-    (l2) => console.log(`  ${l2.message}`)
-  ).catch(() => {
-  });
-  if (buildDir) {
-    if (!opts.alreadyFetched) {
-      if (compose(["pull", "postgres", "redis"], { withBuildOverride: true }) !== 0) {
-        return { ok: false, apiPort, dashPort };
-      }
-      if (compose(["build"], { withBuildOverride: true }) !== 0) {
-        return { ok: false, apiPort, dashPort };
-      }
-    }
-    if (up({ withBuildOverride: true }) !== 0) {
-      return { ok: false, apiPort, dashPort };
-    }
-    onEdgeContainerChanged();
-    writeInstallMethod("compose");
-    return { ok: true, apiPort, dashPort };
-  }
-  if (!opts.alreadyFetched && compose(["pull"]) !== 0) {
-    return { ok: false, apiPort, dashPort };
-  }
-  if (up() !== 0) return { ok: false, apiPort, dashPort };
-  onEdgeContainerChanged();
-  writeInstallMethod("compose");
-  return { ok: true, apiPort, dashPort };
-}
-function onEdgeContainerChanged() {
-  invalidateEdgeContainer();
-}
-function composeDown() {
-  if (!existsSync4(COMPOSE_FILE)) return false;
-  return compose(["down"]) === 0;
-}
-function composeUninstall(opts = {}) {
-  const removedImages = [];
-  const ok = existsSync4(COMPOSE_FILE) ? compose(["down", "-v", "--remove-orphans"]) === 0 : false;
-  if (opts.removeImages) {
-    const env = readEnvFile();
-    const registry = env.OPENSHIP_IMAGE_REGISTRY || DEFAULT_IMAGE_REGISTRY;
-    const version = env.OPENSHIP_VERSION || "latest";
-    for (const { service } of BUILT_SERVICES) {
-      const ref = `${registry}/openship-${service}:${version}`;
-      if (spawnSync4("docker", ["image", "rm", "-f", ref], { stdio: "ignore" }).status === 0) {
-        removedImages.push(ref);
-      }
-    }
-  }
-  return { ok, removedImages };
-}
-async function composeUpdate(version) {
-  if (!existsSync4(COMPOSE_FILE)) return { applied: false, refused: false };
-  const r2 = await composeUp(version ? { version } : {});
-  return { applied: r2.ok, refused: !!r2.refused };
-}
-function composePs() {
-  return compose(["ps"]);
-}
-function composeRunning() {
-  const r2 = spawnSync4(
-    "docker",
-    ["compose", "-f", COMPOSE_FILE, "ps", "--status", "running", "-q"],
-    { cwd: COMPOSE_DIR, encoding: "utf8" }
-  );
-  return r2.status === 0 && r2.stdout.trim().length > 0;
-}
-function composeStart() {
-  reconcileEdgeContainerName(readEnvFile().COMPOSE_PROJECT_NAME || "openship");
-  return compose(["up", "-d"], { quiet: true }) === 0;
-}
-function composeRestart() {
-  return compose(["restart"], { quiet: true }) === 0;
-}
-function composeInternalToken() {
-  return readEnvFile().INTERNAL_TOKEN ?? null;
-}
-var composePaths = {
-  dir: COMPOSE_DIR,
-  file: COMPOSE_FILE,
-  env: ENV_FILE,
-  envBackup: ENV_BACKUP_FILE
-};
 
 export {
-  PORTS_FILE,
-  saveInstanceUrl,
-  readInstanceUrl,
-  readStoredPorts,
-  storedApiPort,
-  storedDashboardPort,
-  portMoveNotice,
-  resolvePorts,
+  resolveLocalEnvironmentSync,
   thisHost,
+  pasteable,
   startUnitHint,
-  DEFAULT_REPO,
-  SOURCE_CHECKOUT_DIR,
-  SOURCE_DIST_DIR,
-  has,
-  shortSha,
-  prepareFromSource,
-  readSourceInstall,
-  remoteSha,
-  rebuildFromSource,
-  readInstallMethod,
-  hasDockerCompose,
-  dockerInstallPreview,
-  ensureDocker,
-  composeSecretRotationRisk,
-  renderSecretRotationRefusal,
-  composePgDataRisk,
-  renderPgDataRefusal,
-  composeHostChannel,
-  composeHostChannelExpected,
-  composeTrustedOriginUrls,
-  resolveComposePorts,
-  sourceBuildDir,
-  composePlan,
-  pinnedImagesReady,
-  composePrefetch,
-  composeUp,
-  composeDown,
-  composeUninstall,
-  composeUpdate,
-  composePs,
-  composeRunning,
-  composeStart,
-  composeRestart,
-  composeInternalToken,
-  composePaths
+  COMPOSE_DIR,
+  COMPOSE_FILE,
+  COMPOSE_ENV_FILE,
+  composeInstallExists,
+  readComposeEnvFile
 };