openship 0.6.5 → 0.6.6

package/dist/chunk-WVAML4H6.js

@@ -0,0 +1,2145 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  COMPOSE_DIR,
+  COMPOSE_ENV_FILE,
+  COMPOSE_FILE,
+  pasteable,
+  readComposeEnvFile,
+  resolveLocalEnvironmentSync,
+  thisHost
+} from "./chunk-5DMWSTOM.js";
+import {
+  OS_DIR
+} from "./chunk-ELGRMZOW.js";
+import {
+  systemCatalog
+} from "./chunk-A4GXYE4L.js";
+import {
+  EDGE_CONTAINER_MOUNTS,
+  EDGE_HOST_STATE_DIR
+} from "./chunk-RSR7PFIQ.js";
+import {
+  DEFAULT_DOCKER_SOCKET_PATH,
+  resolveLocalDockerSocketPath
+} from "./chunk-77QDF6UD.js";
+import {
+  LocalExecutor
+} from "./chunk-6FH4AXVY.js";
+import {
+  invalidateEdgeContainer,
+  sanitizeEdgeVhosts
+} from "./chunk-2YM3NI2E.js";
+import {
+  DEFAULT_IMAGE_REGISTRY,
+  HOST_CHANNEL_BLOCKED,
+  HOST_CHANNEL_DEFAULT_ACCOUNT,
+  HOST_CHANNEL_NOT_PROVISIONED,
+  HOST_CHANNEL_OPT_OUT,
+  HOST_CHANNEL_RECHECK,
+  HOST_CHANNEL_SYMPTOM,
+  HOST_CHANNEL_UNAFFECTED,
+  HOST_CHANNEL_UNPROVISIONED,
+  explainHostChannelCause,
+  firewallAllowSteps,
+  firewallManager,
+  firewallPersists,
+  hostChannelAccount,
+  hostChannelRuleScope,
+  hostFirewallRule,
+  hostFirewallRuleRemoval,
+  wrapText
+} from "./chunk-UJ6JZM65.js";
+
+// src/lib/host-channel-preflight.ts
+import { spawnSync as spawnSync4 } from "child_process";
+import chalk from "chalk";
+import { confirm, isCancel } from "@clack/prompts";
+
+// src/lib/compose.ts
+import { spawn as spawn2, spawnSync as spawnSync3 } from "child_process";
+import { randomBytes } from "crypto";
+import {
+  chmodSync,
+  existsSync as existsSync4,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync3,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { homedir, userInfo } from "os";
+import { dirname, join as join4, resolve as resolve2 } from "path";
+
+// src/lib/ports.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { join } from "path";
+
+// ../../packages/core/src/ports.ts
+import { createServer } from "net";
+var DEFAULT_API_PORT = 4e3;
+var DEFAULT_DASHBOARD_PORT = 3001;
+var LOOPBACK = "127.0.0.1";
+var SCAN_SPAN = 20;
+var MAX_PORT = 65535;
+function isPortFree(port, host = LOOPBACK) {
+  return new Promise((resolve3) => {
+    const srv = createServer();
+    srv.once("error", () => resolve3(false));
+    srv.listen(port, host, () => srv.close(() => resolve3(true)));
+  });
+}
+async function waitPortFree(port, opts = {}) {
+  const timeoutMs = opts.timeoutMs ?? 6e3;
+  const intervalMs = opts.intervalMs ?? 250;
+  const host = opts.host ?? LOOPBACK;
+  const deadline = Date.now() + timeoutMs;
+  for (; ; ) {
+    if (await isPortFree(port, host)) return true;
+    if (Date.now() >= deadline) return false;
+    await new Promise((r) => setTimeout(r, intervalMs));
+  }
+}
+function getFreePort(host = LOOPBACK) {
+  return new Promise((resolve3, reject) => {
+    const srv = createServer();
+    srv.once("error", reject);
+    srv.listen(0, host, () => {
+      const addr = srv.address();
+      const port = addr && typeof addr === "object" ? addr.port : 0;
+      srv.close(() => port ? resolve3(port) : reject(new Error("no free port")));
+    });
+  });
+}
+async function findPortNear(from, opts = {}) {
+  const host = opts.host ?? LOOPBACK;
+  const span = opts.span ?? SCAN_SPAN;
+  const skip = opts.skip ?? (() => false);
+  for (let port2 = from; port2 <= Math.min(from + span, MAX_PORT); port2++) {
+    if (!skip(port2) && await isPortFree(port2, host)) return port2;
+  }
+  let port = await getFreePort(host);
+  for (let tries = 0; tries < 10 && skip(port); tries++) port = await getFreePort(host);
+  return port;
+}
+async function resolvePortPair(prefs = {}) {
+  const host = prefs.bindAddr?.trim() || LOOPBACK;
+  const ours = new Set(prefs.reclaimable ?? []);
+  const prefFor = (kind) => prefs[kind] ?? prefs.previous?.[kind] ?? prefs.stored?.[kind] ?? prefs.defaults?.[kind];
+  const remembered = (kind, pref) => prefs[kind] === void 0 && (prefs.previous?.[kind] === pref || prefs.stored?.[kind] === pref);
+  const availableForPref = async (port) => ours.has(port) || await isPortFree(port, host);
+  const apiPref = prefFor("api");
+  const dashPref = prefFor("dashboard");
+  let api;
+  if (apiPref === void 0) api = await getFreePort(host);
+  else if (await availableForPref(apiPref)) api = apiPref;
+  else if (remembered("api", apiPref) && await waitPortFree(apiPref, { host })) api = apiPref;
+  else {
+    api = await findPortNear(apiPref + 1, {
+      host,
+      skip: (p) => ours.has(p) || p === dashPref
+    });
+  }
+  const skipForDash = (p) => ours.has(p) || p === api;
+  let dashboard;
+  if (dashPref === void 0) {
+    dashboard = await getFreePort(host);
+    for (let tries = 0; tries < 10 && dashboard === api; tries++) {
+      dashboard = await getFreePort(host);
+    }
+  } else if (dashPref !== api && await availableForPref(dashPref)) {
+    dashboard = dashPref;
+  } else if (dashPref !== api && remembered("dashboard", dashPref) && await waitPortFree(dashPref, { host })) {
+    dashboard = dashPref;
+  } else {
+    dashboard = await findPortNear(dashPref + 1, { host, skip: skipForDash });
+  }
+  return {
+    api,
+    dashboard,
+    switched: {
+      api: apiPref !== void 0 && api !== apiPref,
+      dashboard: dashPref !== void 0 && dashboard !== dashPref
+    },
+    preferred: { api: apiPref ?? api, dashboard: dashPref ?? dashboard }
+  };
+}
+
+// src/lib/ports.ts
+var PORTS_FILE = join(OS_DIR, "ports.json");
+var INSTANCE_FILE = join(OS_DIR, "instance.json");
+function saveInstanceUrl(publicUrl) {
+  try {
+    if (!existsSync(OS_DIR)) mkdirSync(OS_DIR, { recursive: true, mode: 448 });
+    writeFileSync(INSTANCE_FILE, JSON.stringify({ publicUrl: publicUrl ?? null }));
+  } catch {
+  }
+}
+function readInstanceUrl() {
+  try {
+    return JSON.parse(readFileSync(INSTANCE_FILE, "utf8")).publicUrl ?? null;
+  } catch {
+    return null;
+  }
+}
+function readStoredPorts() {
+  try {
+    return JSON.parse(readFileSync(PORTS_FILE, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+function storedApiPort() {
+  return readStoredPorts().api ?? DEFAULT_API_PORT;
+}
+function storedDashboardPort() {
+  return readStoredPorts().dashboard ?? DEFAULT_DASHBOARD_PORT;
+}
+function saveStoredPorts(api, dashboard) {
+  try {
+    if (!existsSync(OS_DIR)) mkdirSync(OS_DIR, { recursive: true, mode: 448 });
+    writeFileSync(PORTS_FILE, JSON.stringify({ api, dashboard }));
+  } catch {
+  }
+}
+function portMoveNotice(resolved, trustedOriginUrls = []) {
+  if (!resolved.switched.api && !resolved.switched.dashboard) return [];
+  const lines = [
+    `A preferred port was busy \u2014 using API ${resolved.api}, dashboard ${resolved.dashboard}.`
+  ];
+  const stale = [...new Set(stalePortOrigins(resolved.preferred.dashboard, trustedOriginUrls))];
+  if (stale.length) {
+    lines.push(
+      `Heads up: ${stale.join(", ")} still names port ${resolved.preferred.dashboard}, so logins`,
+      `from that origin will be rejected. Point it at :${resolved.dashboard} (or free port`,
+      `${resolved.preferred.dashboard} and re-run to move back).`
+    );
+  }
+  return lines;
+}
+function stalePortOrigins(movedFrom, urls) {
+  const stale = [];
+  for (const raw of urls) {
+    for (const candidate of (raw ?? "").split(",")) {
+      const value = candidate.trim();
+      if (!value) continue;
+      try {
+        if (new URL(value).port === String(movedFrom)) stale.push(value);
+      } catch {
+      }
+    }
+  }
+  return stale;
+}
+async function resolvePorts(prefs, opts = {}) {
+  const resolved = await resolvePortPair({
+    ...prefs,
+    stored: readStoredPorts(),
+    defaults: { api: DEFAULT_API_PORT, dashboard: DEFAULT_DASHBOARD_PORT }
+  });
+  if (opts.persist !== false) saveStoredPorts(resolved.api, resolved.dashboard);
+  return resolved;
+}
+
+// src/lib/source-install.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+import { join as join3 } from "path";
+
+// src/lib/from-source.ts
+import { spawn, spawnSync } from "child_process";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
+import { join as join2, resolve } from "path";
+var DEFAULT_REPO = "https://github.com/oblien/openship.git";
+var SOURCE_CHECKOUT_DIR = join2(OS_DIR, "src");
+var SOURCE_DIST_DIR = join2(OS_DIR, "from-source-dist");
+function has(cmd) {
+  try {
+    return spawnSync(cmd, ["--version"], { stdio: "ignore" }).status === 0;
+  } catch {
+    return false;
+  }
+}
+function run(cmd, args, cwd, env) {
+  return new Promise((res, rej) => {
+    const child = spawn(cmd, args, {
+      cwd,
+      stdio: "inherit",
+      // Windows resolves the bun/git shims (.cmd/.exe) only through a shell.
+      shell: process.platform === "win32",
+      env: env ? { ...process.env, ...env } : process.env
+    });
+    child.on("error", rej);
+    child.on(
+      "exit",
+      (code) => code === 0 ? res() : rej(new Error(`\`${cmd} ${args.join(" ")}\` (cwd=${cwd}) exited ${code ?? "?"}`))
+    );
+  });
+}
+function shortSha(cwd) {
+  const r = spawnSync("git", ["rev-parse", "--short", "HEAD"], { cwd, encoding: "utf8" });
+  return r.status === 0 ? (r.stdout ?? "").trim() || "unknown" : "unknown";
+}
+function isMonorepo(dir) {
+  return existsSync2(join2(dir, "package.json")) && existsSync2(join2(dir, "apps/api/package.json")) && existsSync2(join2(dir, "apps/dashboard/package.json"));
+}
+async function prepareFromSource(opts) {
+  if (!has("bun")) {
+    throw new Error(
+      "`bun` is required to build from source but wasn't found on PATH \u2014 install it: https://bun.sh"
+    );
+  }
+  let sourceDir;
+  let ref;
+  if (opts.source) {
+    sourceDir = resolve(opts.source);
+    if (!isMonorepo(sourceDir)) {
+      throw new Error(
+        `--source ${sourceDir} doesn't look like an Openship checkout (missing package.json / apps/api / apps/dashboard).`
+      );
+    }
+    ref = "local";
+  } else {
+    if (!has("git")) {
+      throw new Error("`git` is required to clone the source but wasn't found on PATH.");
+    }
+    ref = (opts.ref || "main").trim();
+    const repoUrl = opts.repo || DEFAULT_REPO;
+    sourceDir = SOURCE_CHECKOUT_DIR;
+    mkdirSync2(OS_DIR, { recursive: true });
+    if (!existsSync2(join2(sourceDir, ".git"))) {
+      console.log(`  Cloning ${repoUrl} \u2192 ${sourceDir}`);
+      await run("git", ["clone", repoUrl, sourceDir], OS_DIR);
+    }
+    console.log(`  Fetching + checking out ${ref}`);
+    await run("git", ["fetch", "origin", ref, "--tags"], sourceDir);
+    await run("git", ["checkout", ref], sourceDir);
+    await run("git", ["pull", "--ff-only", "origin", ref], sourceDir).catch(() => {
+      console.log("  (pinned ref \u2014 not fast-forwarding)");
+    });
+  }
+  const sha = shortSha(sourceDir);
+  console.log(`  Source: ${sourceDir} @ ${ref} (${sha})`);
+  console.log("  Installing workspace dependencies (bun install)\u2026");
+  await run("bun", ["install"], sourceDir);
+  const distDir = SOURCE_DIST_DIR;
+  console.log("  Building release dist (compiles the dashboard \u2014 needs RAM/CPU)\u2026");
+  await run(
+    "bun",
+    ["run", join2(sourceDir, "apps/api/scripts/build-release.ts")],
+    sourceDir,
+    { DIST_DIR: distDir, NODE_ENV: "production", CLOUD_MODE: "false", OPENSHIP_TARGET: "local" }
+  );
+  console.log("  Installing runtime dependencies in the dist\u2026");
+  await run("bun", ["install", "--production", "--frozen-lockfile"], distDir);
+  const apiDir = join2(distDir, "api");
+  const dashboardDir = join2(distDir, "dashboard");
+  if (!existsSync2(join2(apiDir, "src/index.ts"))) {
+    throw new Error(`Build produced no API at ${apiDir}/src/index.ts \u2014 build-release layout drift?`);
+  }
+  if (!existsSync2(join2(dashboardDir, "apps/dashboard/server.js"))) {
+    throw new Error(`Build produced no dashboard at ${dashboardDir}/apps/dashboard/server.js.`);
+  }
+  return { apiDir, dashboardDir, ref, sha, sourceDir };
+}
+
+// src/lib/source-install.ts
+var MARKER = join3(OS_DIR, "source-install.json");
+function parseSourceInstall(raw) {
+  try {
+    const obj = JSON.parse(raw);
+    if (!obj || typeof obj.dir !== "string" || !obj.dir) return null;
+    return { repo: obj.repo || DEFAULT_REPO, ref: obj.ref || "main", dir: obj.dir };
+  } catch {
+    return null;
+  }
+}
+function readSourceInstall() {
+  if (!existsSync3(MARKER)) return null;
+  try {
+    return parseSourceInstall(readFileSync2(MARKER, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function parseRemoteSha(stdout) {
+  const sha = stdout.split("\n")[0]?.trim().split(/\s+/)[0];
+  return sha && /^[0-9a-f]{7,40}$/i.test(sha) ? sha.slice(0, 7) : null;
+}
+function remoteSha(repo, ref) {
+  const r = spawnSync2("git", ["ls-remote", repo, ref], { encoding: "utf8" });
+  if (r.status !== 0 || !r.stdout) return null;
+  return parseRemoteSha(r.stdout);
+}
+async function rebuildFromSource(info) {
+  if (!has("bun")) {
+    throw new Error("`bun` is required to rebuild from source but wasn't found on PATH \u2014 https://bun.sh");
+  }
+  if (!has("git")) {
+    throw new Error("`git` is required to update the source checkout but wasn't found on PATH.");
+  }
+  if (!existsSync3(join3(info.dir, ".git"))) {
+    throw new Error(
+      `Source checkout ${info.dir} is missing (no .git) \u2014 reinstall from source with scripts/install-source.sh.`
+    );
+  }
+  await run("git", ["fetch", "origin", info.ref, "--tags"], info.dir);
+  await run("git", ["checkout", info.ref], info.dir);
+  await run("git", ["pull", "--ff-only", "origin", info.ref], info.dir).catch(() => {
+  });
+  const cliDir = join3(info.dir, "apps/cli");
+  await run("bun", ["install"], info.dir);
+  await run("bun", ["run", "build"], cliDir);
+  await run("bun", ["run", "build/stage-dashboard.ts"], cliDir);
+  return shortSha(info.dir);
+}
+
+// src/lib/compose.ts
+var EDGE_SITES_HOST_DIR = `${EDGE_HOST_STATE_DIR}/sites-enabled`;
+var EDGE_ACME_HOST_DIR = `${EDGE_HOST_STATE_DIR}/acme`;
+function edgeVolumeYaml(indent) {
+  return EDGE_CONTAINER_MOUNTS.map((m) => `${indent}- ${m.host}:${m.container}:z`).join("\n");
+}
+var DOCKER_CONFIG_MOUNT_MARKER = "__OPENSHIP_DOCKER_CONFIG_MOUNT__";
+function dockerConfigMountYaml(indent) {
+  const path = resolve2(process.env.DOCKER_CONFIG || join4(homedir(), ".docker"), "config.json");
+  try {
+    if (!statSync(path).isFile()) return "";
+  } catch {
+    return "";
+  }
+  return [
+    `${indent}- type: bind`,
+    `${indent}  source: ${JSON.stringify(path)}`,
+    `${indent}  target: /root/.docker/config.json`,
+    `${indent}  read_only: true`
+  ].join("\n");
+}
+function renderComposeYaml() {
+  const mount = dockerConfigMountYaml("      ");
+  return COMPOSE_YAML.split(`${DOCKER_CONFIG_MOUNT_MARKER}
+`).join(mount ? `${mount}
+` : "");
+}
+var INSTALL_METHOD_FILE = join4(OS_DIR, "install-method");
+var BUILD_FILE = join4(COMPOSE_DIR, "docker-compose.build.yml");
+var ENV_BACKUP_FILE = join4(COMPOSE_DIR, ".env.bak");
+var ENV_TMP_FILE = join4(COMPOSE_DIR, ".env.tmp");
+var BUILT_SERVICES = [
+  { service: "api", dockerfile: "apps/api/Dockerfile" },
+  { service: "dashboard", dockerfile: "apps/dashboard/Dockerfile" },
+  { service: "edge", dockerfile: "apps/edge/Dockerfile" }
+];
+var ENV_CONSUMING_SERVICES = ["api", "dashboard", "edge"];
+function readInstallMethod() {
+  try {
+    const v = readFileSync3(INSTALL_METHOD_FILE, "utf8").trim();
+    return v === "compose" || v === "bare" ? v : null;
+  } catch {
+    return null;
+  }
+}
+function writeInstallMethod(method) {
+  mkdirSync3(OS_DIR, { recursive: true, mode: 448 });
+  writeFileSync2(INSTALL_METHOD_FILE, method, { mode: 384 });
+}
+function dockerState() {
+  const ok = (args) => spawnSync3("docker", args, { stdio: "ignore" }).status === 0;
+  if (!ok(["--version"])) return { binary: false, plugin: false, daemon: false };
+  return { binary: true, plugin: ok(["compose", "version"]), daemon: ok(["version"]) };
+}
+function dockerGap(state = dockerState()) {
+  if (!state.binary) {
+    return { summary: "Docker isn't installed", installable: true };
+  }
+  if (!state.plugin) {
+    return {
+      summary: "Docker is installed but the Compose plugin (`docker compose`) is missing",
+      installable: true
+    };
+  }
+  if (!state.daemon) {
+    const start = pasteable(thisHost().dockerStart());
+    return {
+      summary: "Docker is installed but its daemon isn't reachable",
+      // Reinstalling changes nothing: a group change only applies to NEW logins,
+      // and a stopped daemon needs starting, not installing.
+      installable: false,
+      hint: thisHost().profile.isRoot ? start ? `Start it with: ${start}` : "Start the Docker daemon \u2014 this host has no service manager Openship recognizes." : `Add your user to the docker group: sudo usermod -aG docker ${userInfo().username} \u2014 then log out and back in (or run: newgrp docker). If the daemon is stopped: ${start ?? "start it the way this host starts services"}`
+    };
+  }
+  return null;
+}
+function hasDockerCompose() {
+  return dockerGap() === null;
+}
+function hasCmd(cmd) {
+  return spawnSync3(cmd, ["--version"], { stdio: "ignore" }).status === 0;
+}
+function shQuote(s) {
+  return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+function dockerInstallPreview(state = dockerState()) {
+  const gap = dockerGap(state);
+  if (!gap) return { state, gap: null, wouldInstall: false };
+  if (process.platform !== "linux" || !gap.installable) return { state, gap, wouldInstall: false };
+  const plan = systemCatalog.installs.docker(resolveLocalEnvironmentSync());
+  if (!plan.supported) return { state, gap, wouldInstall: false, unsupportedReason: plan.reason };
+  const start = plan.value.service;
+  return {
+    state,
+    gap,
+    wouldInstall: true,
+    installCommand: plan.value.installCommand,
+    ...start?.supported ? { startCommand: start.value } : {},
+    ...start && !start.supported ? { startBlockedReason: start.reason } : {}
+  };
+}
+async function ensureDocker(opts = {}) {
+  const notice = opts.onNotice ?? ((line) => process.stderr.write(`  ${line}
+`));
+  const { state, gap, wouldInstall, installCommand, startCommand, unsupportedReason, startBlockedReason } = dockerInstallPreview();
+  if (!gap) return true;
+  if (process.platform !== "linux") return false;
+  if (!gap.installable) {
+    notice(gap.summary + ".");
+    if (gap.hint) notice(gap.hint);
+    return false;
+  }
+  if (!wouldInstall || !installCommand) {
+    if (unsupportedReason) notice(unsupportedReason);
+    return false;
+  }
+  const asRoot = typeof process.getuid === "function" && process.getuid() === 0;
+  const sudo = !asRoot && hasCmd("sudo") ? "sudo " : "";
+  notice("This can take 2-5 minutes on a small VPS (~150 MB of packages) and stays quiet while apt works.");
+  if (state.binary) {
+    notice("Docker's installer will warn that docker already exists and pause ~20s before continuing \u2014 that's expected.");
+  }
+  const sh = (script) => new Promise((resolve3) => {
+    const child = spawn2("sh", ["-c", sudo ? `${sudo}sh -c ${shQuote(script)}` : script], {
+      stdio: "inherit"
+    });
+    const started = Date.now();
+    const tick = setInterval(() => {
+      const s = Math.round((Date.now() - started) / 1e3);
+      notice(`still installing Docker \u2014 ${Math.floor(s / 60)}m${String(s % 60).padStart(2, "0")}s elapsed\u2026`);
+    }, 3e4);
+    const done = (code) => {
+      clearInterval(tick);
+      resolve3(code);
+    };
+    child.on("error", () => done(1));
+    child.on("close", (code) => done(code ?? 1));
+  });
+  if (await sh(installCommand) !== 0) return false;
+  if (startCommand) await sh(startCommand);
+  else if (startBlockedReason) notice(startBlockedReason);
+  const after = dockerGap();
+  if (!after) {
+    notice("Docker ready.");
+    return true;
+  }
+  notice(after.summary + ".");
+  if (after.hint) notice(after.hint);
+  return false;
+}
+var COMPOSE_YAML = `# Managed by \`openship up\` \u2014 do not edit; re-run \`openship up\` to regenerate.
+services:
+  postgres:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    environment:
+      # Keep the data dir in a subdirectory of the volume so a fresh install never
+      # runs initdb against a bare mount root (which fails on quirky host
+      # filesystems with EPERM \u2014 #350). OPENSHIP_PGDATA is decided ONCE at install
+      # by the CLI (fresh \u2192 subdir, pre-existing volume \u2192 root) and preserved in
+      # .env, so this never moves an existing database.
+      PGDATA: \${OPENSHIP_PGDATA:-/var/lib/postgresql/data/pgdata}
+      POSTGRES_USER: \${POSTGRES_USER:-openship}
+      POSTGRES_PASSWORD: \${POSTGRES_PASSWORD:?missing from .env \u2014 re-run openship up to regenerate it}
+      POSTGRES_DB: \${POSTGRES_DB:-openship}
+    expose: ["5432"]
+    volumes: [postgres_data:/var/lib/postgresql/data]
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U \${POSTGRES_USER:-openship} -d \${POSTGRES_DB:-openship}"]
+      interval: 5s
+      timeout: 3s
+      retries: 12
+
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+    command: ["redis-server", "--appendonly", "yes"]
+    expose: ["6379"]
+    volumes: [redis_data:/data]
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 3s
+      retries: 12
+
+  api:
+    image: \${OPENSHIP_IMAGE_REGISTRY:-ghcr.io/oblien}/openship-api:\${OPENSHIP_VERSION:-latest}
+    restart: unless-stopped
+    # Loopback by default \u2014 the host-net edge reaches it over loopback, so nothing
+    # sits on a public interface. OPENSHIP_BIND_ADDR opts into a public/LAN interface
+    # (set by \`openship up\` when a public URL is configured for off-box access).
+    ports: ["\${OPENSHIP_BIND_ADDR:-127.0.0.1}:\${API_PORT:-4000}:\${API_PORT:-4000}"]
+    volumes:
+      # The daemon socket, at the path the api's own default expects INSIDE the
+      # container. The HOST side is a variable because it MOVES: a rootless daemon
+      # keeps its socket under the invoking user's runtime dir, and Docker creates a
+      # missing bind source as an empty DIRECTORY instead of failing \u2014 so the rootful
+      # path there brings the stack up and then fails every container operation in
+      # the transport, naming neither the path nor the cause (#482). \`openship up\`
+      # writes OPENSHIP_DOCKER_SOCKET when the detected path isn't this default.
+      - \${OPENSHIP_DOCKER_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock
+      # Registry credentials for private-image pulls. The API talks to the daemon over
+      # the socket above via dockerode, which \u2014 unlike the docker CLI \u2014 reads no
+      # config.json of its own, so a private pull went out anonymous on a logged-in
+      # host (#581). Mounted READ-ONLY and only into this service; absent entirely when
+      # the host has no config, so nothing is invented. Substituted at write time (the
+      # path depends on DOCKER_CONFIG and on the file existing), hence the marker.
+__OPENSHIP_DOCKER_CONFIG_MOUNT__
+      # Routing state shared with the edge, as HOST BIND MOUNTS (generated from
+      # EDGE_CONTAINER_MOUNTS): the vhost tree, /etc/letsencrypt, the ACME webroot
+      # and the static doc-roots the API writes and the edge serves. Named volumes
+      # hid all of it from every host-side reader (migrate's proxy scan, cert carry,
+      # cert reuse, mail cert symlinks), each of which then silently saw "nothing".
+${edgeVolumeYaml("      ")}
+      # Host-op SSH key (createHostExecutor \u2192 host.docker.internal). /dev/null
+      # when the host channel isn't provisioned \u2192 OPENSHIP_HOST_SSH_HOST stays
+      # unset, and host operations REFUSE (they'd otherwise run against this
+      # container's filesystem, #509) while ordinary deploys keep working over
+      # the socket below.
+      - \${OPENSHIP_HOST_KEY_PATH:-/dev/null}:/run/secrets/openship_host_key:ro
+    # \`host-gateway\` is resolved by the daemon and is right on a stock rootful
+    # install. It is NOT universally right: under rootless Docker it lands in
+    # RootlessKit's namespace rather than the host's, so the host's sshd isn't
+    # there (#482). OPENSHIP_HOST_GATEWAY re-points the alias (e.g. at the box's
+    # LAN address) without patching this file, which \`openship up\` rewrites.
+    extra_hosts: ["host.docker.internal:\${OPENSHIP_HOST_GATEWAY:-host-gateway}"]
+    env_file: [.env]
+    environment:
+      NODE_ENV: production
+      PORT: "\${API_PORT:-4000}"
+      DATABASE_URL: postgresql://\${POSTGRES_USER:-openship}:\${POSTGRES_PASSWORD:?missing from .env \u2014 re-run openship up to regenerate it}@postgres:5432/\${POSTGRES_DB:-openship}
+      REDIS_URL: redis://redis:6379
+      OPENSHIP_EDGE_MODE: docker
+      OPENSHIP_EDGE_CONTAINER: openship-edge
+    depends_on:
+      postgres: { condition: service_healthy }
+      redis: { condition: service_healthy }
+    healthcheck:
+      test: ["CMD-SHELL", "bun -e \\"fetch('http://127.0.0.1:\${API_PORT:-4000}/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\\""]
+      interval: 10s
+      timeout: 5s
+      retries: 12
+      start_period: 40s
+
+  dashboard:
+    image: \${OPENSHIP_IMAGE_REGISTRY:-ghcr.io/oblien}/openship-dashboard:\${OPENSHIP_VERSION:-latest}
+    restart: unless-stopped
+    # Loopback by default (see api note); OPENSHIP_BIND_ADDR opts into a public interface.
+    ports: ["\${OPENSHIP_BIND_ADDR:-127.0.0.1}:\${DASHBOARD_PORT:-3001}:\${DASHBOARD_PORT:-3001}"]
+    env_file: [.env]
+    environment:
+      NODE_ENV: production
+      PORT: "\${DASHBOARD_PORT:-3001}"
+      INTERNAL_API_URL: http://api:\${API_PORT:-4000}
+    depends_on:
+      api: { condition: service_healthy }
+
+  edge:
+    image: \${OPENSHIP_IMAGE_REGISTRY:-ghcr.io/oblien}/openship-edge:\${OPENSHIP_VERSION:-latest}
+    # PINNED, and it must stay pinned: the api reaches the edge by NAME through
+    # DockerEdgeExecutor (OPENSHIP_EDGE_CONTAINER above), and "ours" edge
+    # detection greps \`docker ps --filter name=openship-edge\`. Without this,
+    # compose derives \`<project>-edge-1\` from the directory and every
+    # \`docker exec\` into the edge fails with "No such container: openship-edge" \u2014
+    # which silently migrated 0 sites after the operator's proxy was stopped.
+    # Safe here: the edge is a singleton (host networking, one per box).
+    container_name: openship-edge
+    restart: unless-stopped
+    network_mode: host
+    volumes:
+${edgeVolumeYaml("      ")}
+
+volumes:
+  postgres_data:
+  redis_data:
+`;
+function keepSecret(existing, key) {
+  return existing[key] || randomBytes(32).toString("hex");
+}
+var GENERATED_SECRET_KEYS = ["POSTGRES_PASSWORD", "BETTER_AUTH_SECRET", "INTERNAL_TOKEN"];
+function survivingDbVolume(prev) {
+  const candidates = /* @__PURE__ */ new Set([prev.COMPOSE_PROJECT_NAME, "openship", "compose"]);
+  for (const project of candidates) {
+    if (project && dbVolumeExists(project)) return `${project}_postgres_data`;
+  }
+  return null;
+}
+function secretRotationRisk(prev) {
+  const keys = GENERATED_SECRET_KEYS.filter((k) => !prev[k]);
+  if (keys.length === 0) return null;
+  const volume = survivingDbVolume(prev);
+  return volume ? { volume, keys: [...keys] } : null;
+}
+function composeSecretRotationRisk(opts = {}) {
+  if (opts.resetSecrets) return null;
+  return secretRotationRisk(readEnvFile());
+}
+function renderSecretRotationRefusal(rotation, opts = {}) {
+  return `
+  ${opts.dryRun ? "A real run would REFUSE here" : "Refusing to continue"}: this would regenerate secrets your existing install already has.
+
+    missing from ${COMPOSE_ENV_FILE}:  ${rotation.keys.join(", ")}
+    but this install's data is still here:  ${rotation.volume}
+
+  A new POSTGRES_PASSWORD cannot match that volume \u2014 Postgres only applies the password
+  when it first creates the data directory \u2014 and a new BETTER_AUTH_SECRET cannot decrypt
+  the environment variables already stored in the database. Nothing has been written yet.
+
+` + secretRecoveryAdvice(rotation);
+}
+function secretRecoveryAdvice(rotation) {
+  const adopted = adoptedStack(projectOfDbVolume(rotation.volume));
+  if (adopted) {
+    return `  This stack was not created by \`openship up\`: it is already running under the compose
+  project name we pin, so this run would ADOPT it.
+
+    project:      ${adopted.project}
+    started from: ${adopted.configFiles || "an unlabelled `docker run`"}
+    not from:     ${COMPOSE_FILE}
+
+  So there is no \`.env\` of ours to restore and no backup of one \u2014 the real values are in
+  the api container's own environment. Copy them out of it, then re-run:
+
+    echo 'COMPOSE_PROJECT_NAME=${adopted.project}' >> ${COMPOSE_ENV_FILE}
+    docker inspect ${adopted.apiContainer} --format '{{range .Config.Env}}{{println .}}{{end}}' \\
+      | grep -E '^(${rotation.keys.join("|")})=' >> ${COMPOSE_ENV_FILE}
+
+  COMPOSE_PROJECT_NAME matters as much as the secrets do: it is the volume prefix, so
+  without it this stack comes up on empty volumes beside the data above.
+
+  Only if that container is gone and the values exist nowhere else \u2014 this DESTROYS them,
+  leaving every environment variable stored in the database permanently unreadable:
+    openship up --reset-secrets
+`;
+  }
+  return `  Put the original values back and re-run:
+` + (existsSync4(ENV_BACKUP_FILE) ? `    cp ${ENV_BACKUP_FILE} ${COMPOSE_ENV_FILE}     # the .env a previous \`openship up\` replaced
+` : `    restore ${COMPOSE_ENV_FILE} from a backup, or copy the keys above out of one
+`) + `  If the file is there but this user can't read it, re-run as the user that owns it
+  (or as root) rather than letting the secrets be regenerated.
+
+  To reset instead \u2014 the database password gets realigned, but every stored environment
+  variable becomes permanently unreadable:
+    openship up --reset-secrets
+`;
+}
+function projectOfDbVolume(volume) {
+  return volume.replace(/_postgres_data$/, "");
+}
+function readEnvFile() {
+  const { env, unreadable } = readComposeEnvFile();
+  if (unreadable) {
+    console.log(
+      `  ! Could not read ${COMPOSE_ENV_FILE}: ${unreadable}
+    Its contents are being treated as absent. If this install already exists, fix the permissions and re-run rather than letting secrets be regenerated.`
+    );
+  }
+  return env;
+}
+var HOST_CHANNEL_DEFAULT_HOST = "host.docker.internal";
+var HOST_CHANNEL_DEFAULT_PORT = 22;
+var HOST_KEY_COMMENT = "openship-host-executor";
+var HOST_KEY_FROM = "172.16.0.0/12,192.168.0.0/16,10.0.0.0/8,127.0.0.1";
+function hostKeyAuthLine(pub) {
+  return `from="${HOST_KEY_FROM}",restrict,pty,port-forwarding ${pub}`;
+}
+function rewriteHostAuthorizedKeys(existing, pub) {
+  return [...keptForeignKeys(existing), hostKeyAuthLine(pub)].join("\n") + "\n";
+}
+function keptForeignKeys(existing) {
+  return existing.split("\n").filter((line) => line.trim() && !line.includes(HOST_KEY_COMMENT));
+}
+function stripHostAuthorizedKeys(existing) {
+  const kept = keptForeignKeys(existing);
+  return kept.length ? kept.join("\n") + "\n" : "";
+}
+var ROOT_AUTHORIZED_KEYS = "/root/.ssh/authorized_keys";
+function chooseHostChannelUser(input) {
+  if (input.invokerUid === 0) {
+    return {
+      user: "root",
+      authKeysPath: ROOT_AUTHORIZED_KEYS,
+      rootUnavailable: false,
+      elevation: "login"
+    };
+  }
+  const invoker = {
+    user: input.invokerName,
+    authKeysPath: join4(input.invokerHome, ".ssh", "authorized_keys")
+  };
+  if (input.hasPasswordlessSudo) {
+    return { ...invoker, rootUnavailable: false, elevation: "sudo" };
+  }
+  return { ...invoker, rootUnavailable: true, elevation: "none" };
+}
+function hasPasswordlessSudo() {
+  try {
+    return spawnSync3("sudo", ["-n", "true"], { stdio: "ignore" }).status === 0;
+  } catch {
+    return false;
+  }
+}
+function plannedHostChannel(hostControl) {
+  if (!hostControl || process.platform !== "linux") return null;
+  let invoker;
+  try {
+    const info = userInfo();
+    invoker = { uid: info.uid, username: info.username, home: info.homedir };
+  } catch {
+    invoker = { uid: -1, username: process.env.USER || process.env.LOGNAME || "root", home: homedir() };
+  }
+  const decision = chooseHostChannelUser({
+    invokerUid: invoker.uid,
+    invokerName: invoker.username,
+    invokerHome: invoker.home,
+    // Only probe sudo when it could change the outcome — a root invoker never needs it.
+    hasPasswordlessSudo: invoker.uid !== 0 && hasPasswordlessSudo()
+  });
+  return { ...decision, keyPath: join4(COMPOSE_DIR, "host-ssh", "id_ed25519") };
+}
+function authorizeKeyAt(authKeysPath, pub) {
+  mkdirSync3(dirname(authKeysPath), { recursive: true, mode: 448 });
+  const existing = existsSync4(authKeysPath) ? readFileSync3(authKeysPath, "utf8") : "";
+  const next = rewriteHostAuthorizedKeys(existing, pub);
+  if (next !== existing) writeFileSync2(authKeysPath, next, { mode: 384 });
+  chmodSync(authKeysPath, 384);
+}
+function revokeKeyAt(authKeysPath) {
+  try {
+    if (!existsSync4(authKeysPath)) return true;
+    const existing = readFileSync3(authKeysPath, "utf8");
+    if (!existing.includes(HOST_KEY_COMMENT)) return true;
+    writeFileSync2(authKeysPath, stripHostAuthorizedKeys(existing), { mode: 384 });
+    chmodSync(authKeysPath, 384);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function revokeRootKeyViaSudo() {
+  const read = spawnSync3(
+    "sudo",
+    ["-n", "sh", "-c", `cat ${ROOT_AUTHORIZED_KEYS} 2>/dev/null || true`],
+    { encoding: "utf8" }
+  );
+  if (read.status !== 0) return false;
+  const existing = read.stdout ?? "";
+  if (!existing.includes(HOST_KEY_COMMENT)) return true;
+  const write = spawnSync3("sudo", ["-n", "tee", ROOT_AUTHORIZED_KEYS], {
+    input: stripHostAuthorizedKeys(existing),
+    stdio: ["pipe", "ignore", "ignore"]
+  });
+  return write.status === 0;
+}
+function retireHostSshChannel(prev) {
+  const keyDir = join4(COMPOSE_DIR, "host-ssh");
+  if (!existsSync4(keyDir) && !prev.OPENSHIP_HOST_SSH_HOST) return;
+  const invokerKeys = join4(homedir(), ".ssh", "authorized_keys");
+  const asRoot = hostChannelAccount(prev) === HOST_CHANNEL_DEFAULT_ACCOUNT;
+  const weAreRoot = typeof process.getuid === "function" && process.getuid() === 0;
+  const revoked = asRoot ? weAreRoot ? revokeKeyAt(ROOT_AUTHORIZED_KEYS) : hasPasswordlessSudo() && revokeRootKeyViaSudo() : revokeKeyAt(invokerKeys);
+  const alsoInvoker = asRoot ? revokeKeyAt(invokerKeys) : true;
+  try {
+    rmSync(keyDir, { recursive: true, force: true });
+  } catch {
+  }
+  const stuck = asRoot ? ROOT_AUTHORIZED_KEYS : invokerKeys;
+  console.log(
+    revoked && alsoInvoker ? "  Host control off: dropped OPENSHIP_HOST_SSH_* from .env, deleted the host key and\n  revoked its authorized_keys line." : `  Host control off: dropped OPENSHIP_HOST_SSH_* from .env and deleted the host key (it
+  can no longer be used). Removing its line needs root \u2014 run:
+  sudo sed -i '/${HOST_KEY_COMMENT}/d' ${stuck}`
+  );
+}
+function provisionHostSshChannel(cfg) {
+  const target = plannedHostChannel(cfg.hostControl);
+  if (!target) return { channel: null };
+  const { user, keyPath, authKeysPath, elevation, rootUnavailable } = target;
+  const provisioned = (channel) => {
+    const port = toPort(cfg.hostSshPort) ?? HOST_CHANNEL_DEFAULT_PORT;
+    if (probeHostSshd(port) === "absent") {
+      return { channel, issue: { code: "no-sshd", detail: `port ${port}` } };
+    }
+    const auth = verifyChannelAuth(channel.user, channel.keyPath, port);
+    return auth.state === "refused" ? { channel, issue: { code: "auth-refused", detail: auth.detail, account: channel.user } } : { channel };
+  };
+  try {
+    mkdirSync3(join4(COMPOSE_DIR, "host-ssh"), { recursive: true, mode: 448 });
+    if (!existsSync4(keyPath)) {
+      const g = spawnSync3(
+        "ssh-keygen",
+        ["-t", "ed25519", "-N", "", "-q", "-f", keyPath, "-C", HOST_KEY_COMMENT],
+        // stderr is captured rather than discarded: it is the only account of why the
+        // channel is missing, and the caller prints it.
+        { encoding: "utf8", stdio: ["ignore", "ignore", "pipe"] }
+      );
+      if (g.status !== 0) return { channel: null, issue: { code: "keygen", detail: keygenWhy(g) } };
+    }
+    const pub = readFileSync3(`${keyPath}.pub`, "utf8").trim();
+    if (!pub) return { channel: null, issue: { code: "empty-key" } };
+    if (rootUnavailable) {
+      console.warn(
+        "  \u26A0 Host control needs root, but this user isn't root and passwordless sudo isn't\n    available. Mail and edge host operations will fail. Re-run `openship up` as root\n    (or enable passwordless sudo) to fix. Continuing with a limited host channel."
+      );
+      authorizeKeyAt(authKeysPath, pub);
+      return provisioned({ user, keyPath });
+    }
+    authorizeKeyAt(authKeysPath, pub);
+    if (elevation === "sudo") revokeRootKeyViaSudo();
+    return provisioned({ user, keyPath });
+  } catch (err) {
+    return { channel: null, issue: { code: "error", detail: err?.message } };
+  }
+}
+function verifyChannelAuth(user, keyPath, port) {
+  const r = spawnSync3(
+    "ssh",
+    [
+      "-i",
+      keyPath,
+      "-p",
+      String(port),
+      "-o",
+      "BatchMode=yes",
+      "-o",
+      "StrictHostKeyChecking=no",
+      "-o",
+      "UserKnownHostsFile=/dev/null",
+      "-o",
+      "ConnectTimeout=5",
+      "-o",
+      "PreferredAuthentications=publickey",
+      "-o",
+      "IdentitiesOnly=yes",
+      `${user}@127.0.0.1`,
+      "true"
+    ],
+    { encoding: "utf8", stdio: ["ignore", "ignore", "pipe"], timeout: 15e3 }
+  );
+  if (r.status === 0) return { state: "ok" };
+  if (r.error?.code === "ENOENT" || r.status === null) {
+    return { state: "unknown" };
+  }
+  const detail = (r.stderr || "").split("\n").map((l) => l.trim()).filter((l) => l && !/^Warning: Permanently added/.test(l)).join(" ");
+  return { state: "refused", detail: detail || `ssh exited ${r.status}` };
+}
+function keygenWhy(r) {
+  if (r.error?.code === "ENOENT") {
+    return "ssh-keygen is not installed \u2014 the openssh-client package provides it";
+  }
+  const stderr = (r.stderr ?? "").trim().split("\n").pop();
+  return stderr || r.error?.message || `ssh-keygen exited ${r.status ?? "abnormally"}`;
+}
+function probeHostSshd(port) {
+  for (const [cmd, args] of [
+    ["ss", ["-H", "-ltn"]],
+    ["netstat", ["-ltn"]]
+  ]) {
+    const r = spawnSync3(cmd, [...args], { encoding: "utf8" });
+    if (r.status !== 0 || !r.stdout) continue;
+    return listensOnPort(r.stdout, port) ? "listening" : "absent";
+  }
+  return "unknown";
+}
+function listensOnPort(listing, port) {
+  return listing.split("\n").filter((line) => /\bLISTEN\b/.test(line)).some(
+    (line) => line.trim().split(/\s+/).some((token) => token.endsWith(`:${port}`))
+  );
+}
+function carriedHostChannel(prev) {
+  const keyPath = prev.OPENSHIP_HOST_KEY_PATH?.trim();
+  if (!prev.OPENSHIP_HOST_SSH_HOST?.trim() || !keyPath || !existsSync4(keyPath)) return null;
+  return { user: hostChannelAccount(prev), keyPath };
+}
+var HOST_ISSUE_INDENT = "    ";
+function hostIssueNote(text) {
+  return wrapText(text, 80).map((l) => `${HOST_ISSUE_INDENT}${l}
+`).join("");
+}
+function renderHostChannelIssue(issue, ctx) {
+  const detail = issue.detail ? ` (${issue.detail})` : "";
+  const headline = issue.code === "no-sshd" ? `  \u26A0 Host control is provisioned, but nothing on this host is listening for SSH${detail}.` : issue.code === "auth-refused" ? `  \u26A0 Host control is provisioned, but this host REFUSED the channel's key.` : `  \u26A0 Host control could NOT be provisioned on this box.`;
+  let cause;
+  switch (issue.code) {
+    case "keygen":
+      cause = `The channel's key could not be generated${detail}.`;
+      break;
+    case "empty-key":
+      cause = "The channel's key was generated but its public half read back empty.";
+      break;
+    case "no-sshd":
+      cause = `The api container now has a key and an address, and will be refused the first time it dials ${ctx.target}:
+` + explainHostChannelCause("refused", {
+        target: ctx.target,
+        // Measured here rather than left to core's default, which is Debian's `ssh` —
+        // a unit name that does not exist on the RHEL family, so the remedy printed on
+        // an Amazon Linux box was a command that silently does nothing.
+        sshdEnableHint: thisHost().sshdEnableHint()
+      }).body;
+      break;
+    case "auth-refused":
+      cause = `The key was authorized for \`${issue.account ?? "the channel account"}\` and sshd is listening, but the dial was refused${detail}. Either that account's \`authorized_keys\` is not the file we wrote to, or sshd permits it no login \u2014 \`sshd -T | grep -i permitrootlogin\` shows the second. Until it is fixed the api container will be refused every time it dials ${ctx.target}.`;
+      break;
+    case "error":
+      cause = `Setting up the channel's key failed${detail}.`;
+      break;
+  }
+  const continuity = issue.code === "no-sshd" || issue.code === "auth-refused" ? "" : ctx.kept ? hostIssueNote(
+    "Kept the host channel this install already had in `.env` rather than dropping it: its key is still authorized, so the api container keeps the access it had instead of losing it to this failure."
+  ) : hostIssueNote(
+    "OPENSHIP_HOST_SSH_HOST is therefore unset, and host operations refuse rather than run against the api container's own filesystem."
+  );
+  return `${headline}
+` + hostIssueNote(cause) + continuity + hostIssueNote(HOST_CHANNEL_UNAFFECTED) + `${HOST_ISSUE_INDENT}Unavailable until the channel works:
+` + HOST_CHANNEL_BLOCKED.map((l) => `${HOST_ISSUE_INDENT}  \xB7 ${l}
+`).join("") + hostIssueNote(HOST_CHANNEL_RECHECK);
+}
+function composeProjectName(prev) {
+  if (prev.COMPOSE_PROJECT_NAME) return prev.COMPOSE_PROJECT_NAME;
+  return Object.keys(prev).length > 0 ? "compose" : "openship";
+}
+var PGDATA_ROOT = "/var/lib/postgresql/data";
+function probePgDataDir(volume) {
+  const r = spawnSync3(
+    "docker",
+    [
+      "run",
+      "--rm",
+      "-v",
+      `${volume}:/from:ro`,
+      "alpine:3",
+      "sh",
+      "-c",
+      `if [ -f /from/PG_VERSION ]; then echo root; elif [ -f /from/pgdata/PG_VERSION ]; then echo sub; elif [ -z "$(ls -A /from 2>/dev/null | grep -v '^lost+found$')" ]; then echo empty; else echo foreign; fi`
+    ],
+    { encoding: "utf8" }
+  );
+  if (r.status !== 0) return "unknown";
+  const out = `${r.stdout ?? ""}`.trim();
+  return out === "root" || out === "sub" || out === "empty" || out === "foreign" ? out : "unknown";
+}
+function resolvePgData(prev) {
+  const SUB = `${PGDATA_ROOT}/pgdata`;
+  if (prev.OPENSHIP_PGDATA) return prev.OPENSHIP_PGDATA;
+  const volume = survivingDbVolume(prev);
+  if (!volume) return SUB;
+  return probePgDataDir(volume) === "root" ? PGDATA_ROOT : SUB;
+}
+function pgDataDetectionRisk(prev) {
+  if (prev.OPENSHIP_PGDATA) return null;
+  const volume = survivingDbVolume(prev);
+  if (!volume) return null;
+  return probePgDataDir(volume) === "foreign" ? { volume } : null;
+}
+function composePgDataRisk(_opts = {}) {
+  return pgDataDetectionRisk(readEnvFile());
+}
+function renderPgDataRefusal(risk, opts = {}) {
+  const SUB = `${PGDATA_ROOT}/pgdata`;
+  return `
+  ${opts.dryRun ? "A real run would REFUSE here" : "Refusing to continue"}: this install's data volume holds data, but not a Postgres cluster we recognize.
+
+    volume:  ${risk.volume}
+    checked: ${PGDATA_ROOT}/PG_VERSION and ${SUB}/PG_VERSION \u2014 neither present
+
+  Guessing where the cluster lives is how a wrong path makes Postgres run initdb over
+  your existing data and orphan it, so nothing has been written. If you know the layout,
+  pin it and re-run:
+
+    echo 'OPENSHIP_PGDATA=${SUB}' >> ${COMPOSE_ENV_FILE}     # or ${PGDATA_ROOT} if the cluster is at the root
+`;
+}
+var PS_SWEEP_FORMAT = '{{.Names}}	{{.Label "com.docker.compose.project"}}	{{.Label "com.docker.compose.project.config_files"}}	{{.Label "com.docker.compose.service"}}';
+function parsePsSweep(stdout) {
+  return stdout.split("\n").map((line) => line.trim()).filter(Boolean).map((line) => {
+    const [name, project, configFiles, service] = line.split("	");
+    return {
+      name: name ?? "",
+      project: project ?? "",
+      configFiles: configFiles ?? "",
+      service: service ?? ""
+    };
+  });
+}
+function psSweepRaw() {
+  const r = spawnSync3("docker", ["ps", "-a", "--format", PS_SWEEP_FORMAT], { encoding: "utf8" });
+  return r.status === 0 && r.stdout ? r.stdout : null;
+}
+function psSweep() {
+  return parsePsSweep(psSweepRaw() ?? "");
+}
+function fromOurComposeFile(row) {
+  return row.configFiles.split(",").some((f) => f.trim() === COMPOSE_FILE);
+}
+function orphanedStackContainers(project) {
+  return psSweep().filter((c) => c.name && c.project && c.project !== project && fromOurComposeFile(c)).map(({ name, project: proj }) => ({ name, project: proj }));
+}
+function adoptedStackOrigin(psStdout, project) {
+  const rows = parsePsSweep(psStdout).filter((c) => c.name && c.project === project);
+  if (rows.length === 0 || rows.some(fromOurComposeFile)) return null;
+  return {
+    project,
+    configFiles: rows.map((c) => c.configFiles).find(Boolean) ?? "",
+    apiContainer: rows.find((c) => c.service === "api")?.name || `${project}-api-1`
+  };
+}
+function adoptedStack(project) {
+  const sweep = psSweepRaw();
+  return sweep ? adoptedStackOrigin(sweep, project) : null;
+}
+function reconcileDbPassword(user, password) {
+  if (!password) return;
+  if (compose(["up", "-d", "--wait", "postgres"], { quiet: true }) !== 0) return;
+  const attempt = (asRole) => spawnSync3(
+    "docker",
+    [
+      "compose",
+      "-f",
+      COMPOSE_FILE,
+      "exec",
+      "-T",
+      "postgres",
+      "psql",
+      "-U",
+      asRole,
+      "-d",
+      "postgres",
+      "-v",
+      "ON_ERROR_STOP=1",
+      // Read the statement from STDIN, not `-c`: psql has no bind parameters for
+      // ALTER USER, so the password has to be inlined in SQL — and an argv copy
+      // would be readable in `ps` for the life of the call. stdin keeps it to this
+      // process and the socket. Our generated password is hex, so it cannot break
+      // out of the quoted literal either.
+      "-f",
+      "-"
+    ],
+    {
+      cwd: COMPOSE_DIR,
+      encoding: "utf8",
+      // Create the role if the volume predates it, else just realign it. Both
+      // branches leave exactly the credentials this `.env` will present.
+      input: `DO $$ BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${user}') THEN
+    ALTER ROLE "${user}" WITH LOGIN PASSWORD '${password}';
+  ELSE
+    CREATE ROLE "${user}" WITH LOGIN SUPERUSER PASSWORD '${password}';
+  END IF;
+END $$;
+`
+    }
+  );
+  let r = attempt(user);
+  if (r.status !== 0) r = attempt("postgres");
+  if (r.status !== 0) {
+    console.log(
+      `
+  ! Could not realign the database password (${(r.stderr ?? "").trim() || "psql failed"}).
+    The api will fail with "password authentication failed for user "${user}"" because the
+    existing data volume was initialized with a different password.
+
+    Fix it one of two ways:
+      \u2022 restore the .env that created the volume, or
+      \u2022 start fresh (DESTROYS DB DATA):  openship uninstall  then  openship up
+`
+    );
+  }
+}
+function removeOrphanedStack(project) {
+  const orphans = orphanedStackContainers(project);
+  if (orphans.length === 0) return;
+  const projects = [...new Set(orphans.map((o) => o.project))].join(", ");
+  console.log(
+    `  Removing ${orphans.length} container(s) from a previous stack (project "${projects}") \u2014 they would hold the ports this stack needs. Volumes are kept.`
+  );
+  spawnSync3("docker", ["rm", "-f", ...orphans.map((o) => o.name)], { stdio: "ignore" });
+}
+function edgeNameNeedsReclaim(psStdout, project) {
+  const row = parsePsSweep(psStdout).find((c) => c.name === "openship-edge");
+  if (!row) return false;
+  return !(row.project === project && fromOurComposeFile(row));
+}
+function reconcileEdgeContainerName(project) {
+  const sweep = psSweepRaw();
+  if (!sweep) return;
+  if (!edgeNameNeedsReclaim(sweep, project)) return;
+  console.log(
+    "  Replacing an unmanaged `openship-edge` container so compose can own it (config is on the host, so no routes are lost)."
+  );
+  spawnSync3("docker", ["rm", "-f", "openship-edge"], { stdio: "ignore" });
+}
+function migrateLegacyEdgeVolumes(project) {
+  const pairs = [
+    { volume: `${project}_openship_sites`, host: EDGE_SITES_HOST_DIR },
+    { volume: `${project}_openship_certs`, host: "/etc/letsencrypt" },
+    { volume: `${project}_openship_acme`, host: EDGE_ACME_HOST_DIR },
+    { volume: `${project}_openship_static`, host: "/opt/openship/static" }
+  ];
+  const ls = spawnSync3("docker", ["volume", "ls", "--format", "{{.Name}}"], { encoding: "utf8" });
+  if (ls.status !== 0 || !ls.stdout) return;
+  const existing = new Set(ls.stdout.split("\n").map((l) => l.trim()).filter(Boolean));
+  for (const { volume, host } of pairs) {
+    if (!existing.has(volume)) continue;
+    mkdirSync3(host, { recursive: true });
+    const alreadyThere = spawnSync3("sh", ["-c", `ls -A ${JSON.stringify(host)} 2>/dev/null | head -1`], {
+      encoding: "utf8"
+    });
+    if (alreadyThere.stdout?.trim()) continue;
+    console.log(`  Moving edge state from volume ${volume} onto ${host}...`);
+    const copy = spawnSync3(
+      "docker",
+      [
+        "run",
+        "--rm",
+        "-v",
+        `${volume}:/from:ro`,
+        "-v",
+        `${host}:/to`,
+        "alpine:3",
+        "sh",
+        "-c",
+        "cp -a /from/. /to/ 2>/dev/null || true"
+      ],
+      { stdio: "inherit" }
+    );
+    if (copy.status !== 0) {
+      console.log(
+        `  Could not copy ${volume} \u2014 the stack will start with an empty ${host}.
+  Recover manually with: docker run --rm -v ${volume}:/from -v ${host}:/to alpine cp -a /from/. /to/`
+      );
+    }
+  }
+}
+function warnOrphanedVolumes(project) {
+  const r = spawnSync3("docker", ["volume", "ls", "--format", "{{.Name}}"], { encoding: "utf8" });
+  if (r.status !== 0 || !r.stdout) return;
+  const others = new Set(
+    r.stdout.split("\n").map((l) => l.trim()).filter((l) => l.endsWith("_openship_sites")).map((l) => l.slice(0, -"_openship_sites".length)).filter((p) => p && p !== project)
+  );
+  if (others.size === 0) return;
+  console.log(
+    `  Note: volumes from a previous install (project "${[...others].join(", ")}") are still on disk
+  and are NOT mounted by this stack \u2014 its database starts fresh. (Certificates and
+  vhosts now live on the host, so those carry over.)
+  Remove them with \`docker volume ls | grep _openship_\` once you're sure they aren't needed.`
+  );
+}
+function keepConfig(prev, key, explicit) {
+  const set = explicit?.trim();
+  if (set) return set;
+  const carried = prev[key]?.trim();
+  return carried || void 0;
+}
+var ACME_ENV_KEYS = [
+  "OPENSHIP_ACME_EMAIL",
+  "OPENSHIP_ACME_DIRECTORY_URL",
+  "OPENSHIP_ACME_EAB_KID",
+  "OPENSHIP_ACME_EAB_HMAC_KEY",
+  "OPENSHIP_ACME_KEY_TYPE",
+  "OPENSHIP_ACME_CA_BUNDLE",
+  "OPENSHIP_ACME_TOS_AGREED"
+];
+function hostGatewayEnv(prev) {
+  const value = process.env.OPENSHIP_HOST_GATEWAY?.trim() || prev.OPENSHIP_HOST_GATEWAY?.trim();
+  return value ? [`OPENSHIP_HOST_GATEWAY=${value}`] : [];
+}
+function rootlessSocketCandidates() {
+  const runtimeDir = process.env.XDG_RUNTIME_DIR?.trim();
+  const sudoUid = process.env.SUDO_UID?.trim();
+  let uid;
+  try {
+    uid = userInfo().uid;
+  } catch {
+  }
+  return [
+    ...runtimeDir ? [join4(runtimeDir, "docker.sock")] : [],
+    ...sudoUid ? [`/run/user/${sudoUid}/docker.sock`] : [],
+    ...uid !== void 0 ? [`/run/user/${uid}/docker.sock`] : []
+  ];
+}
+function detectDockerSocketPath() {
+  const fromClient = resolveLocalDockerSocketPath(void 0, process.env);
+  if (fromClient !== DEFAULT_DOCKER_SOCKET_PATH) return fromClient;
+  if (existsSync4(DEFAULT_DOCKER_SOCKET_PATH)) return DEFAULT_DOCKER_SOCKET_PATH;
+  return rootlessSocketCandidates().find((p) => existsSync4(p)) ?? DEFAULT_DOCKER_SOCKET_PATH;
+}
+function resolveDockerSocket(prev) {
+  const pinned = process.env.OPENSHIP_DOCKER_SOCKET?.trim() || prev.OPENSHIP_DOCKER_SOCKET?.trim();
+  return pinned ? { path: pinned, pinned: true } : { path: detectDockerSocketPath(), pinned: false };
+}
+function dockerSocketEnv(prev) {
+  const { path, pinned } = resolveDockerSocket(prev);
+  return pinned || path !== DEFAULT_DOCKER_SOCKET_PATH ? [`OPENSHIP_DOCKER_SOCKET=${path}`] : [];
+}
+function warnMissingDockerSocket(path) {
+  console.warn(
+    `
+  ! The Docker socket this install mounts into the api isn't there:
+      ${path}
+    Docker will create that path as an empty DIRECTORY, so the stack will come up
+    and then fail every container operation with a transport error naming neither
+    this path nor the cause (#482). Point it at the real socket:
+      docker context inspect --format '{{.Endpoints.docker.Host}}'
+      OPENSHIP_DOCKER_SOCKET=/run/user/$(id -u)/docker.sock openship up --compose
+    (a rootless daemon keeps its socket under the daemon user's runtime dir).
+`
+  );
+}
+function renderAcmeEnv(prev) {
+  return ACME_ENV_KEYS.flatMap((key) => {
+    const value = process.env[key]?.trim() || prev[key]?.trim();
+    if (!value) return [];
+    if (/[\r\n]/.test(value)) throw new Error(`${key} must be a single-line value`);
+    return [`${key}=${value}`];
+  });
+}
+function resolveEnvConfig(prev, opts) {
+  const publicUrl = keepConfig(prev, "OPENSHIP_PUBLIC_URL", opts.publicUrl);
+  const bindAddr = keepConfig(prev, "OPENSHIP_BIND_ADDR") ?? (publicUrl ? "0.0.0.0" : void 0);
+  return {
+    apiPort: keepConfig(prev, "API_PORT", opts.apiPort) ?? String(DEFAULT_API_PORT),
+    dashPort: keepConfig(prev, "DASHBOARD_PORT", opts.dashboardPort) ?? String(DEFAULT_DASHBOARD_PORT),
+    ...bindAddr ? { bindAddr } : {},
+    ...publicUrl ? { publicUrl } : {},
+    // A public URL always implies a proxy in front; otherwise keep whatever the
+    // install was configured with.
+    trustProxy: Boolean(opts.trustProxy) || Boolean(publicUrl) || prev.TRUST_PROXY === "true",
+    ...keepConfig(prev, "OPENSHIP_EXTRA_TRUSTED_ORIGINS", opts.extraTrustedOrigins) ? {
+      extraTrustedOrigins: keepConfig(
+        prev,
+        "OPENSHIP_EXTRA_TRUSTED_ORIGINS",
+        opts.extraTrustedOrigins
+      )
+    } : {},
+    registry: keepConfig(prev, "OPENSHIP_IMAGE_REGISTRY", opts.registry) ?? DEFAULT_IMAGE_REGISTRY,
+    // Tri-state: the flag is absent on a plain re-run, so fall back to what the
+    // install chose rather than silently re-granting host control.
+    hostControl: opts.noHostControl === void 0 ? prev.OPENSHIP_HOST_CONTROL !== "false" : !opts.noHostControl,
+    // Sticky too: `--mail` is only the install-time default, so a plain re-run
+    // (or `openship update`) must not hand a mail box back the platform shell.
+    // Turning it OFF is the dashboard's job — Settings → Instance stores the mode
+    // in the database, which wins over this env var either way.
+    productMode: opts.mail || keepConfig(prev, "OPENSHIP_PRODUCT") === "mail" ? "mail" : "platform",
+    // Sticky like every other operator choice here. These were literals in
+    // `renderEnv`, so a box where `host.docker.internal:22` is simply not the
+    // right address — rootless Docker, sshd on another port — had nowhere to say
+    // so, and every `openship up` overwrote a hand-edited `.env` back to the
+    // value that didn't work (#490/#482).
+    hostSshHost: keepConfig(prev, "OPENSHIP_HOST_SSH_HOST", opts.hostSshHost) ?? HOST_CHANNEL_DEFAULT_HOST,
+    hostSshPort: keepConfig(prev, "OPENSHIP_HOST_SSH_PORT", opts.hostSshPort) ?? String(HOST_CHANNEL_DEFAULT_PORT)
+  };
+}
+function toPort(value) {
+  const n = Number(value);
+  return Number.isInteger(n) && n > 0 && n <= 65535 ? n : void 0;
+}
+function composeEnvPorts() {
+  const env = readEnvFile();
+  return { api: toPort(env.API_PORT), dashboard: toPort(env.DASHBOARD_PORT) };
+}
+function composeBindAddr() {
+  return readEnvFile().OPENSHIP_BIND_ADDR?.trim() || "127.0.0.1";
+}
+function composeHostChannel() {
+  const env = readEnvFile();
+  const host = env.OPENSHIP_HOST_SSH_HOST?.trim();
+  if (!host) return null;
+  return {
+    host,
+    port: toPort(env.OPENSHIP_HOST_SSH_PORT) ?? 22,
+    user: hostChannelAccount(env)
+  };
+}
+function composeHostChannelExpected() {
+  if (!existsSync4(COMPOSE_FILE)) return false;
+  return readEnvFile().OPENSHIP_HOST_CONTROL !== "false";
+}
+function composeTrustedOriginUrls() {
+  const env = readEnvFile();
+  return [env.OPENSHIP_PUBLIC_URL, env.OPENSHIP_EXTRA_TRUSTED_ORIGINS].filter(
+    (v) => !!v?.trim()
+  );
+}
+function composeHeldPorts() {
+  const r = spawnSync3(
+    "docker",
+    ["ps", "--format", '{{.Label "com.docker.compose.project.config_files"}}	{{.Ports}}'],
+    { encoding: "utf8" }
+  );
+  if (r.status !== 0 || !r.stdout) return [];
+  const ports = /* @__PURE__ */ new Set();
+  for (const line of r.stdout.split("\n")) {
+    const [configFiles = "", published = ""] = line.split("	");
+    if (!configFiles.split(",").some((f) => f.trim() === COMPOSE_FILE)) continue;
+    for (const m of published.matchAll(/:(\d+)->/g)) ports.add(Number(m[1]));
+  }
+  return [...ports];
+}
+async function resolveComposePorts(prefs, opts = {}) {
+  return resolvePorts(
+    {
+      api: toPort(prefs.api),
+      dashboard: toPort(prefs.dashboard),
+      previous: composeEnvPorts(),
+      bindAddr: composeBindAddr(),
+      reclaimable: composeHeldPorts()
+    },
+    opts
+  );
+}
+var OMITTABLE_MANAGED_KEYS = /* @__PURE__ */ new Set([
+  "OPENSHIP_HOST_SSH_HOST",
+  "OPENSHIP_HOST_SSH_USER",
+  "OPENSHIP_HOST_SSH_PORT",
+  "OPENSHIP_HOST_SSH_KEY",
+  "OPENSHIP_HOST_KEY_PATH",
+  "OPENSHIP_HOST_GATEWAY",
+  "TRUST_PROXY"
+]);
+var envKeyOf = (line) => line.match(/^([A-Z0-9_]+)=/)?.[1];
+function operatorEnvPassthrough(managed, prev) {
+  return Object.entries(prev).filter(([key]) => !managed.has(key) && !OMITTABLE_MANAGED_KEYS.has(key)).map(([key, value]) => `${key}=${value}`);
+}
+var PRESERVED_ENV_HEADER = "# Preserved from your existing .env \u2014 set by you, not by `openship up` (#485).";
+function resolveImageVersion(opts) {
+  return opts.version?.trim() || process.env.OPENSHIP_VERSION?.trim() || (true ? "0.6.6" : "latest");
+}
+function managedEnvLines(opts, host, cfg, prev) {
+  const lines = [
+    "# Managed by `openship up`. Secrets are generated once and preserved.",
+    // Do NOT edit on a live install — it is the volume prefix (see composeProjectName).
+    `COMPOSE_PROJECT_NAME=${composeProjectName(prev)}`,
+    "CLOUD_MODE=false",
+    "OPENSHIP_TARGET=local",
+    "OPENSHIP_REQUIRE_AUTH=true",
+    // Read by createHostExecutor (throws when false) and by the servers list
+    // (hides the local row). Written explicitly so the policy is visible in .env.
+    `OPENSHIP_HOST_CONTROL=${cfg.hostControl ? "true" : "false"}`,
+    // The host side of the api's docker socket mount, when it isn't the rootful
+    // default. Unlike the host channel above this is NOT optional plumbing — every
+    // deploy goes through it — so it is resolved on every run, host control or not.
+    ...dockerSocketEnv(prev),
+    // Which shell the dashboard defaults to. Emitted on EVERY run, including the
+    // "platform" default: that keeps the key permanently in the managed set, so
+    // the #485 passthrough can never mistake it for operator config (which would
+    // pin it and make the Settings → Instance toggle look broken after an `up`).
+    `OPENSHIP_PRODUCT=${cfg.productMode}`,
+    `OPENSHIP_IMAGE_REGISTRY=${cfg.registry}`,
+    `OPENSHIP_VERSION=${resolveImageVersion(opts)}`,
+    `POSTGRES_PASSWORD=${keepSecret(prev, "POSTGRES_PASSWORD")}`,
+    // Pinned once (see resolvePgData): fresh install → subdir, existing volume → root.
+    `OPENSHIP_PGDATA=${resolvePgData(prev)}`,
+    `BETTER_AUTH_SECRET=${keepSecret(prev, "BETTER_AUTH_SECRET")}`,
+    `INTERNAL_TOKEN=${keepSecret(prev, "INTERNAL_TOKEN")}`,
+    `API_PORT=${cfg.apiPort}`,
+    `DASHBOARD_PORT=${cfg.dashPort}`,
+    // The api's OWN view of the dashboard port: the self-app boot reconcile points
+    // the operator's domain at the dashboard through this (self-deploy.ts), and it
+    // silently defaults to 3001 when unset. Ports are dynamic now, so leaving it
+    // out publishes a domain routed to a port nothing is listening on.
+    `OPENSHIP_DASHBOARD_PORT=${cfg.dashPort}`,
+    // Alternate CA/EAB values are operator configuration (including one secret),
+    // so a routine `openship up`/upgrade must not silently discard them.
+    ...renderAcmeEnv(prev)
+  ];
+  if (cfg.bindAddr) lines.push(`OPENSHIP_BIND_ADDR=${cfg.bindAddr}`);
+  if (cfg.publicUrl) lines.push(`OPENSHIP_PUBLIC_URL=${cfg.publicUrl}`);
+  if (cfg.extraTrustedOrigins) {
+    lines.push(`OPENSHIP_EXTRA_TRUSTED_ORIGINS=${cfg.extraTrustedOrigins}`);
+  }
+  if (cfg.trustProxy) lines.push("TRUST_PROXY=true");
+  if (host) {
+    lines.push(
+      `OPENSHIP_HOST_SSH_HOST=${cfg.hostSshHost}`,
+      `OPENSHIP_HOST_SSH_USER=${host.user}`,
+      `OPENSHIP_HOST_SSH_PORT=${cfg.hostSshPort}`,
+      "OPENSHIP_HOST_SSH_KEY=/run/secrets/openship_host_key",
+      `OPENSHIP_HOST_KEY_PATH=${host.keyPath}`,
+      ...hostGatewayEnv(prev)
+    );
+  }
+  return lines;
+}
+function renderEnvAndCarried(opts, host, cfg, prev) {
+  const lines = managedEnvLines(opts, host, cfg, prev);
+  const managed = new Set(lines.map(envKeyOf).filter((k) => !!k));
+  const preserved = operatorEnvPassthrough(managed, prev);
+  const body = preserved.length ? [...lines, "", PRESERVED_ENV_HEADER, ...preserved] : lines;
+  return {
+    text: body.join("\n") + "\n",
+    carried: preserved.map((line) => line.slice(0, line.indexOf("=")))
+  };
+}
+function renderEnv(opts, host, cfg) {
+  return renderEnvAndCarried(opts, host, cfg, readEnvFile()).text;
+}
+function sourceBuildDir() {
+  const marker = readSourceInstall();
+  if (!marker?.dir) return null;
+  const hasAll = BUILT_SERVICES.every((s) => existsSync4(join4(marker.dir, s.dockerfile)));
+  return hasAll ? marker.dir : null;
+}
+function renderBuildOverride(repoDir) {
+  const services = BUILT_SERVICES.map(
+    (s) => `  ${s.service}:
+    build:
+      context: ${repoDir}
+      dockerfile: ${s.dockerfile}
+`
+  ).join("");
+  return `# Managed by \`openship up\` (from-source install) \u2014 builds instead of pulls.
+services:
+${services}`;
+}
+function materialize(opts) {
+  mkdirSync3(COMPOSE_DIR, { recursive: true, mode: 448 });
+  const prev = readEnvFile();
+  const cfg = resolveEnvConfig(prev, opts);
+  const provision = provisionHostSshChannel(cfg);
+  let host = provision.channel;
+  let kept = false;
+  if (!host && provision.issue) {
+    const previousChannel = carriedHostChannel(prev);
+    if (previousChannel) {
+      host = previousChannel;
+      kept = true;
+    }
+  }
+  if (!cfg.hostControl) retireHostSshChannel(prev);
+  if (provision.issue && !opts.alreadyFetched) {
+    console.warn(
+      renderHostChannelIssue(provision.issue, {
+        target: `${cfg.hostSshHost}:${cfg.hostSshPort}`,
+        kept
+      })
+    );
+  }
+  const socket = resolveDockerSocket(prev);
+  if (!opts.alreadyFetched && !existsSync4(socket.path)) warnMissingDockerSocket(socket.path);
+  let before = "";
+  try {
+    before = readFileSync3(COMPOSE_ENV_FILE, "utf8");
+  } catch {
+  }
+  const { text: rendered, carried } = renderEnvAndCarried(opts, host, cfg, prev);
+  writeFileSync2(COMPOSE_FILE, renderComposeYaml());
+  writeEnvFile(rendered, before);
+  if (carried.length) {
+    console.log(`  Kept ${carried.length} operator-set .env variable(s): ${carried.join(", ")}`);
+  }
+  const buildDir = opts.build === false ? null : sourceBuildDir();
+  if (buildDir) writeFileSync2(BUILD_FILE, renderBuildOverride(buildDir));
+  return { buildDir, cfg, envChanged: before !== "" && rendered !== before };
+}
+function writeEnvFile(rendered, before) {
+  if (rendered === before) return;
+  if (before) writeFileSync2(ENV_BACKUP_FILE, before, { mode: 384 });
+  writeFileSync2(ENV_TMP_FILE, rendered, { mode: 384 });
+  renameSync(ENV_TMP_FILE, COMPOSE_ENV_FILE);
+}
+var SECRET_ENV_KEY = /(PASSWORD|SECRET|TOKEN|HMAC_KEY)$/;
+function composePlan(opts) {
+  const prev = readEnvFile();
+  const cfg = resolveEnvConfig(prev, opts);
+  const buildDir = opts.build === false ? null : sourceBuildDir();
+  const hostChannel = plannedHostChannel(cfg.hostControl);
+  const settings = [];
+  const newSecrets = [];
+  for (const line of renderEnv(opts, hostChannel, cfg).split("\n")) {
+    const at = line.indexOf("=");
+    if (at < 1 || line.startsWith("#")) continue;
+    const key = line.slice(0, at);
+    const value = line.slice(at + 1);
+    if (!SECRET_ENV_KEY.test(key)) {
+      settings.push({ key, value });
+      continue;
+    }
+    const preserved = !!prev[key] && prev[key] === value;
+    if (!preserved) newSecrets.push(key);
+    settings.push({ key, value: preserved ? "<preserved>" : "<generated on this run>" });
+  }
+  return {
+    composeFile: COMPOSE_FILE,
+    envFile: COMPOSE_ENV_FILE,
+    installMethodFile: INSTALL_METHOD_FILE,
+    ...buildDir ? { buildFile: BUILD_FILE } : {},
+    yaml: COMPOSE_YAML,
+    settings,
+    newSecrets,
+    secretRotation: opts.resetSecrets ? null : secretRotationRisk(prev),
+    pgDataRisk: pgDataDetectionRisk(prev),
+    existing: Object.keys(prev).length > 0,
+    mountDirs: EDGE_CONTAINER_MOUNTS.map((m) => m.host),
+    buildDir,
+    hostChannel
+  };
+}
+function dbVolumeExists(project) {
+  const r = spawnSync3("docker", ["volume", "inspect", `${project}_postgres_data`], {
+    stdio: "ignore"
+  });
+  return r.status === 0;
+}
+function compose(args, opts) {
+  const files = ["-f", COMPOSE_FILE];
+  if (opts?.withBuildOverride) files.push("-f", BUILD_FILE);
+  const r = spawnSync3("docker", ["compose", ...files, ...args], {
+    cwd: COMPOSE_DIR,
+    stdio: opts?.quiet ? "ignore" : "inherit"
+  });
+  return r.status ?? 1;
+}
+function missingPinnedImages(registry, version) {
+  const missing = [];
+  for (const { service } of BUILT_SERVICES) {
+    const ref = `${registry}/openship-${service}:${version}`;
+    const r = spawnSync3("docker", ["manifest", "inspect", ref], { encoding: "utf8" });
+    if (r.status === 0) continue;
+    const stderr = `${r.stderr ?? ""}`.toLowerCase();
+    if (/manifest unknown|no such manifest|manifest for .+ not found/.test(stderr)) {
+      missing.push(ref);
+      continue;
+    }
+    return null;
+  }
+  return missing;
+}
+function pinnedImagesReady(opts) {
+  if (sourceBuildDir()) return true;
+  const prev = readEnvFile();
+  const version = resolveImageVersion(opts);
+  const missing = missingPinnedImages(resolveEnvConfig(prev, opts).registry, version);
+  if (!missing || missing.length === 0) return true;
+  const prevVersion = prev.OPENSHIP_VERSION?.trim();
+  const out = [
+    "",
+    `  The pinned image tag \`${version}\` isn't in the registry yet:`,
+    ...missing.map((ref) => `    ${ref}`),
+    "",
+    "  The CLI reached npm before its container images finished publishing \u2014 a",
+    "  release-ordering race (#486). Nothing on this box was changed.",
+    "",
+    "  Any one of these gets you moving:",
+    "    \u2022 Wait a few minutes and re-run \u2014 the images usually land right after a release.",
+    "    \u2022 Pin a tag that exists:",
+    "        openship up --compose --image-version <tag>",
+    "        OPENSHIP_VERSION=<tag> openship up --compose"
+  ];
+  if (prevVersion && prevVersion !== version) {
+    out.push(`    \u2022 Your current install runs \`${prevVersion}\`, a tag known good on this box.`);
+  }
+  out.push("");
+  console.error(out.join("\n"));
+  return false;
+}
+function composePrefetch(opts) {
+  const rotation = composeSecretRotationRisk(opts);
+  if (rotation) {
+    console.error(renderSecretRotationRefusal(rotation));
+    return { ok: false, envChanged: false };
+  }
+  const { buildDir, envChanged } = materialize(opts);
+  if (buildDir) {
+    return {
+      ok: compose(["pull", "postgres", "redis"], { withBuildOverride: true }) === 0 && compose(["build"], { withBuildOverride: true }) === 0,
+      envChanged
+    };
+  }
+  return { ok: compose(["pull"]) === 0, envChanged };
+}
+function ensureEdgeMountDirs() {
+  const failed = [];
+  for (const { host } of EDGE_CONTAINER_MOUNTS) {
+    try {
+      mkdirSync3(host, { recursive: true });
+    } catch (err) {
+      if (err.code !== "EEXIST") failed.push(host);
+    }
+  }
+  return failed;
+}
+function isRootlessDocker() {
+  const r = spawnSync3("docker", ["info", "-f", "{{println .SecurityOptions}}"], {
+    encoding: "utf8"
+  });
+  return r.status === 0 && /rootless/i.test(r.stdout ?? "");
+}
+async function composeUp(opts) {
+  if (!opts.alreadyFetched && !pinnedImagesReady(opts)) {
+    const pre = resolveEnvConfig(readEnvFile(), opts);
+    return { ok: false, apiPort: pre.apiPort, dashPort: pre.dashPort };
+  }
+  const rotation = composeSecretRotationRisk(opts);
+  if (rotation) {
+    const pre = resolveEnvConfig(readEnvFile(), opts);
+    console.error(renderSecretRotationRefusal(rotation));
+    return { ok: false, refused: true, apiPort: pre.apiPort, dashPort: pre.dashPort };
+  }
+  const pgData = composePgDataRisk(opts);
+  if (pgData) {
+    const pre = resolveEnvConfig(readEnvFile(), opts);
+    console.error(renderPgDataRefusal(pgData));
+    return { ok: false, refused: true, apiPort: pre.apiPort, dashPort: pre.dashPort };
+  }
+  const { buildDir, cfg, envChanged: rendered } = materialize(opts);
+  const apiPort = cfg.apiPort;
+  const dashPort = cfg.dashPort;
+  const envChanged = opts.envChanged ?? rendered;
+  const up = (extra = {}) => compose(
+    envChanged ? ["up", "-d", "--force-recreate", ...ENV_CONSUMING_SERVICES] : ["up", "-d"],
+    extra
+  );
+  const env = readEnvFile();
+  const project = env.COMPOSE_PROJECT_NAME || "openship";
+  removeOrphanedStack(project);
+  reconcileEdgeContainerName(project);
+  migrateLegacyEdgeVolumes(project);
+  warnOrphanedVolumes(project);
+  const unmakeableMounts = ensureEdgeMountDirs();
+  if (unmakeableMounts.length && isRootlessDocker()) {
+    const dirs = unmakeableMounts.join(" ");
+    console.error(
+      `
+  Rootless Docker can't create the edge's host directories under root-owned paths:
+    ${unmakeableMounts.join("\n    ")}
+
+  Create them once (owned by your user), then re-run \`openship up --compose\`:
+    sudo mkdir -p ${dirs}
+    sudo chown -R "$(id -un)" ${dirs}
+`
+    );
+    return { ok: false, apiPort, dashPort };
+  }
+  if (dbVolumeExists(project)) {
+    reconcileDbPassword(env.POSTGRES_USER || "openship", env.POSTGRES_PASSWORD ?? "");
+  }
+  await sanitizeEdgeVhosts(
+    new LocalExecutor(),
+    EDGE_SITES_HOST_DIR,
+    (l) => console.log(`  ${l.message}`)
+  ).catch(() => {
+  });
+  if (buildDir) {
+    if (!opts.alreadyFetched) {
+      if (compose(["pull", "postgres", "redis"], { withBuildOverride: true }) !== 0) {
+        return { ok: false, apiPort, dashPort };
+      }
+      if (compose(["build"], { withBuildOverride: true }) !== 0) {
+        return { ok: false, apiPort, dashPort };
+      }
+    }
+    if (up({ withBuildOverride: true }) !== 0) {
+      return { ok: false, apiPort, dashPort };
+    }
+    onEdgeContainerChanged();
+    writeInstallMethod("compose");
+    return { ok: true, apiPort, dashPort };
+  }
+  if (!opts.alreadyFetched && compose(["pull"]) !== 0) {
+    return { ok: false, apiPort, dashPort };
+  }
+  if (up() !== 0) return { ok: false, apiPort, dashPort };
+  onEdgeContainerChanged();
+  writeInstallMethod("compose");
+  return { ok: true, apiPort, dashPort };
+}
+function onEdgeContainerChanged() {
+  invalidateEdgeContainer();
+}
+function composeDown() {
+  if (!existsSync4(COMPOSE_FILE)) return false;
+  return compose(["down"]) === 0;
+}
+function composeUninstall(opts = {}) {
+  const removedImages = [];
+  const ok = existsSync4(COMPOSE_FILE) ? compose(["down", "-v", "--remove-orphans"]) === 0 : false;
+  if (opts.removeImages) {
+    const env = readEnvFile();
+    const registry = env.OPENSHIP_IMAGE_REGISTRY || DEFAULT_IMAGE_REGISTRY;
+    const version = env.OPENSHIP_VERSION || "latest";
+    for (const { service } of BUILT_SERVICES) {
+      const ref = `${registry}/openship-${service}:${version}`;
+      if (spawnSync3("docker", ["image", "rm", "-f", ref], { stdio: "ignore" }).status === 0) {
+        removedImages.push(ref);
+      }
+    }
+  }
+  return { ok, removedImages };
+}
+async function composeUpdate(version) {
+  if (!existsSync4(COMPOSE_FILE)) return { applied: false, refused: false };
+  const r = await composeUp(version ? { version } : {});
+  return { applied: r.ok, refused: !!r.refused };
+}
+function composePs() {
+  return compose(["ps"]);
+}
+function composeRunning() {
+  const r = spawnSync3(
+    "docker",
+    ["compose", "-f", COMPOSE_FILE, "ps", "--status", "running", "-q"],
+    { cwd: COMPOSE_DIR, encoding: "utf8" }
+  );
+  return r.status === 0 && r.stdout.trim().length > 0;
+}
+function composeStart() {
+  reconcileEdgeContainerName(readEnvFile().COMPOSE_PROJECT_NAME || "openship");
+  return compose(["up", "-d"], { quiet: true }) === 0;
+}
+function composeRestart() {
+  return compose(["restart"], { quiet: true }) === 0;
+}
+function composeInternalToken() {
+  return readEnvFile().INTERNAL_TOKEN ?? null;
+}
+var composePaths = {
+  dir: COMPOSE_DIR,
+  file: COMPOSE_FILE,
+  env: COMPOSE_ENV_FILE,
+  envBackup: ENV_BACKUP_FILE
+};
+
+// src/lib/host-channel-preflight.ts
+var INDENT = "  ";
+function dimWrapped(text, width = 84) {
+  return wrapText(text, width).map((l) => chalk.dim(`${INDENT}${l}
+`)).join("");
+}
+function blockedTail() {
+  return "\n" + dimWrapped(HOST_CHANNEL_RECHECK) + dimWrapped(HOST_CHANNEL_OPT_OUT);
+}
+var PROBE_SCRIPT = `const net = require("node:net");
+const s = net.connect({ host: process.env.OPENSHIP_PROBE_HOST, port: Number(process.env.OPENSHIP_PROBE_PORT) });
+const done = (m) => { console.log("openship-probe:" + m); try { s.destroy(); } catch {} process.exit(0); };
+s.setTimeout(Number(process.env.OPENSHIP_PROBE_TIMEOUT || 4000));
+s.on("connect", () => done("open"));
+s.on("timeout", () => done("timeout"));
+s.on("error", (e) => done("error:" + (e && e.code ? e.code : String(e && e.message))));`;
+async function realProbe(host, port) {
+  const r = spawnSync4(
+    "docker",
+    [
+      "compose",
+      "-f",
+      composePaths.file,
+      "exec",
+      "-T",
+      "-e",
+      `OPENSHIP_PROBE_HOST=${host}`,
+      "-e",
+      `OPENSHIP_PROBE_PORT=${port}`,
+      "api",
+      "bun",
+      "-e",
+      PROBE_SCRIPT
+    ],
+    { cwd: composePaths.dir, encoding: "utf8", timeout: 3e4 }
+  );
+  const token = (r.stdout || "").match(/openship-probe:(\S+)/)?.[1];
+  if (!token) {
+    const why = (r.stderr || r.stdout || r.error?.message || "").trim().split("\n").pop();
+    return { code: "unavailable", detail: why || void 0 };
+  }
+  if (token === "open" || token === "timeout") return { code: token };
+  const errno = token.startsWith("error:") ? token.slice("error:".length) : token;
+  if (errno === "ECONNREFUSED" || errno === "ECONNRESET") return { code: "refused", detail: errno };
+  if (errno === "ENOTFOUND" || errno === "EAI_AGAIN") return { code: "unresolved", detail: errno };
+  if (errno === "ENETUNREACH" || errno === "EHOSTUNREACH" || errno === "EHOSTDOWN") {
+    return { code: "no_route", detail: errno };
+  }
+  return { code: "error", detail: errno };
+}
+function realSourceCidrs() {
+  const id = spawnSync4("docker", ["compose", "-f", composePaths.file, "ps", "-q", "api"], {
+    cwd: composePaths.dir,
+    encoding: "utf8"
+  }).stdout?.trim().split("\n")[0];
+  if (!id) return [];
+  const nets = spawnSync4(
+    "docker",
+    ["inspect", id, "--format", "{{range $k, $v := .NetworkSettings.Networks}}{{$k}}\n{{end}}"],
+    { encoding: "utf8" }
+  ).stdout;
+  const cidrs = /* @__PURE__ */ new Set();
+  for (const net of (nets || "").split("\n").map((n) => n.trim()).filter(Boolean)) {
+    const subnets = spawnSync4(
+      "docker",
+      ["network", "inspect", net, "--format", "{{range .IPAM.Config}}{{.Subnet}}\n{{end}}"],
+      { encoding: "utf8" }
+    ).stdout;
+    for (const s of (subnets || "").split("\n").map((v) => v.trim())) {
+      if (/^\d+\.\d+\.\d+\.\d+\/\d+$/.test(s)) cidrs.add(s);
+    }
+  }
+  return [...cidrs];
+}
+function sudoPrefix() {
+  if (typeof process.getuid === "function" && process.getuid() === 0) return [];
+  return process.stdin.isTTY ? ["sudo"] : ["sudo", "-n"];
+}
+function realApplyRule(fw, cidrs, port) {
+  const steps = firewallAllowSteps(fw, hostChannelRuleScope(cidrs, port));
+  if (!steps.supported) return { ok: false, detail: steps.reason };
+  for (const step of steps.value) {
+    const [cmd, ...rest] = [...sudoPrefix(), "sh", "-c", step];
+    const r = spawnSync4(cmd, rest, { encoding: "utf8", stdio: ["inherit", "pipe", "pipe"] });
+    if (r.status !== 0) {
+      return { ok: false, detail: (r.stderr || r.stdout || "").trim().split("\n").pop() };
+    }
+  }
+  return { ok: true };
+}
+function defaultDeps() {
+  return {
+    platform: process.platform,
+    interactive: Boolean(process.stdin.isTTY && process.stdout.isTTY),
+    channel: composeHostChannel,
+    expected: composeHostChannelExpected,
+    probe: realProbe,
+    sourceCidrs: realSourceCidrs,
+    // All three off the one resolver, which measures this box once. This file used to
+    // run its own `command -v ufw` + `ufw status` ladder, so the CLI and the API could
+    // reach different conclusions about the same host — and it had no way at all to
+    // report nftables, the RHEL-family default.
+    firewall: () => thisHost().profile.firewall,
+    distroFamily: () => thisHost().profile.distroFamily,
+    sshdEnableHint: () => thisHost().sshdEnableHint(),
+    applyRule: realApplyRule,
+    confirmOpen: async ({ rule, port }) => {
+      const ok = await confirm({
+        message: `Open the host firewall so containers can reach port ${port}?`,
+        // Never default-yes: this edits the host's firewall.
+        initialValue: false
+      });
+      return !isCancel(ok) && ok === true;
+    },
+    print: (text) => console.log(text)
+  };
+}
+function impactLines() {
+  return dimWrapped(HOST_CHANNEL_UNAFFECTED) + chalk.dim(`${INDENT}Blocked until the channel works:
+`) + HOST_CHANNEL_BLOCKED.map((l) => chalk.dim(`${INDENT}  \xB7 ${l}
+`)).join("") + dimWrapped(HOST_CHANNEL_SYMPTOM);
+}
+function causeOf(code) {
+  switch (code) {
+    case "timeout":
+    case "refused":
+    case "unresolved":
+    case "no_route":
+    case "error":
+      return code;
+    default:
+      return null;
+  }
+}
+function diagnose(target, probe, sshdEnableHint) {
+  const cause = causeOf(probe.code);
+  if (!cause) {
+    return {
+      firewall: false,
+      text: chalk.yellow(`${INDENT}${target} \u2014 ${probe.detail || "the connection failed"}
+`)
+    };
+  }
+  const { headline, body, firewallShaped } = explainHostChannelCause(cause, {
+    target,
+    host: target.split(":")[0],
+    detail: probe.detail,
+    sshdEnableHint
+  });
+  return {
+    firewall: firewallShaped,
+    text: chalk.yellow(`${INDENT}${headline}
+
+`) + (body ? dimWrapped(body) : "")
+  };
+}
+async function checkHostChannel(overrides = {}) {
+  const deps = { ...defaultDeps(), ...overrides };
+  if (deps.platform !== "linux") return { configured: false };
+  const channel = deps.channel();
+  if (!channel) return { configured: false, unprovisioned: deps.expected() };
+  const probe = await deps.probe(channel.host, channel.port);
+  return {
+    configured: true,
+    target: `${channel.host}:${channel.port}`,
+    code: probe.code,
+    detail: probe.detail
+  };
+}
+async function verifyHostChannel(opts = {}, overrides = {}) {
+  const deps = { ...defaultDeps(), ...overrides };
+  if (deps.platform !== "linux") return { status: "skipped" };
+  const channel = deps.channel();
+  if (!channel) {
+    if (!deps.expected()) return { status: "skipped" };
+    deps.print(
+      chalk.yellow(`
+${INDENT}Host control was not provisioned on this box.
+
+`) + dimWrapped(HOST_CHANNEL_UNPROVISIONED) + "\n" + impactLines() + // The remedy, not a firewall rule: nothing was dialed, so no packet filter has
+      // been established — the same line core's `firewallShaped` draws. It carries the
+      // recheck command itself, so `blockedTail` would only repeat it.
+      chalk.dim(`
+${INDENT}Fix:
+`) + dimWrapped(HOST_CHANNEL_NOT_PROVISIONED) + dimWrapped(HOST_CHANNEL_OPT_OUT)
+    );
+    return { status: "unprovisioned" };
+  }
+  const target = `${channel.host}:${channel.port}`;
+  const probe = await deps.probe(channel.host, channel.port);
+  if (probe.code === "open") return { status: "ok", code: "open" };
+  if (probe.code === "unavailable") {
+    deps.print(
+      chalk.dim(
+        `
+${INDENT}Couldn't check the host channel from the api container${probe.detail ? ` (${probe.detail})` : ""}.
+${INDENT}Verify it later with \`openship doctor\`.
+`
+      )
+    );
+    return { status: "skipped", code: "unavailable" };
+  }
+  const { text, firewall: firewallShaped } = diagnose(target, probe, deps.sshdEnableHint());
+  deps.print(
+    chalk.yellow(`
+${INDENT}Host control is configured, but the api container can't reach it.
+
+`) + text + "\n" + impactLines()
+  );
+  if (!firewallShaped) {
+    deps.print(blockedTail());
+    return { status: "blocked", code: probe.code };
+  }
+  const cidrs = deps.sourceCidrs();
+  const firewall = deps.firewall();
+  const rule = hostFirewallRule(firewall, cidrs, channel.port, deps.distroFamily());
+  const ruleBlock = chalk.dim(`
+${INDENT}Rule to allow it${cidrs.length ? "" : ` (docker's default pool \u2014 the exact subnet couldn't be read)`}:
+`) + rule.split("\n").map((l) => `${INDENT}  ${chalk.cyan(l)}`).join("\n") + "\n";
+  const offerOnly = (why) => {
+    deps.print(ruleBlock + "\n" + dimWrapped(why) + blockedTail());
+    return { status: "blocked", code: probe.code, rule };
+  };
+  const manager = firewallManager(firewall);
+  if (!manager.supported) return offerOnly(manager.reason);
+  if (!firewallPersists(firewall)) {
+    return offerOnly(
+      `Openship won't add this ${firewall} rule for you: it lives in the running ruleset only, so it would not survive a reboot unless something saves it \u2014 and where that is depends on this box. A rule that quietly disappears is worse than one you installed knowing where it lives.`
+    );
+  }
+  deps.print(ruleBlock);
+  const consented = opts.openFirewall ? true : deps.interactive ? await deps.confirmOpen({ rule, port: channel.port }) : false;
+  if (!consented) {
+    deps.print(
+      chalk.dim(
+        `
+${INDENT}Left the firewall alone \u2014 apply the rule above when you're ready.
+` + (deps.interactive ? "" : `${INDENT}To have \`openship up\` add it for you: --open-host-firewall
+`)
+      ) + blockedTail()
+    );
+    return { status: "blocked", code: probe.code, rule };
+  }
+  const applied = deps.applyRule(manager.value, cidrs, channel.port);
+  if (!applied.ok) {
+    deps.print(
+      chalk.red(
+        `
+${INDENT}Couldn't add the rule${applied.detail ? `: ${applied.detail}` : "."}
+`
+      ) + chalk.dim(`${INDENT}Run it yourself with the command above.
+`) + blockedTail()
+    );
+    return { status: "blocked", code: probe.code, rule };
+  }
+  const again = await deps.probe(channel.host, channel.port);
+  if (again.code === "open") {
+    deps.print(chalk.green(`
+${INDENT}Opened \u2014 the host channel is reachable.
+`));
+    return { status: "fixed", code: "open", rule };
+  }
+  deps.print(
+    chalk.yellow(`
+${INDENT}Rule added, but ${target} still isn't reachable.
+
+`) + (again.code === probe.code ? chalk.dim(
+      `${INDENT}Nothing changed, so something ahead of ${firewall} is dropping it \u2014 check
+${INDENT}the DOCKER-USER chain and any cloud/provider firewall.
+`
+    ) : diagnose(target, again, deps.sshdEnableHint()).text) + // The rule is a host change made on the premise that it was the blocker, so it
+    // must not be left invisible. It is deliberately NOT reverted for us: a failure
+    // that changed shape means the rule did something, and it may well be needed
+    // once the real cause is fixed.
+    chalk.dim(`
+${INDENT}The rule is in place; to undo it:
+`) + hostFirewallRuleRemoval(firewall, cidrs, channel.port).split("\n").map((l) => `${INDENT}  ${chalk.cyan(l)}`).join("\n") + "\n" + blockedTail()
+  );
+  return { status: "blocked", code: again.code, rule };
+}
+
+export {
+  PORTS_FILE,
+  saveInstanceUrl,
+  readInstanceUrl,
+  readStoredPorts,
+  storedApiPort,
+  storedDashboardPort,
+  portMoveNotice,
+  resolvePorts,
+  DEFAULT_REPO,
+  SOURCE_CHECKOUT_DIR,
+  SOURCE_DIST_DIR,
+  has,
+  shortSha,
+  prepareFromSource,
+  readSourceInstall,
+  remoteSha,
+  rebuildFromSource,
+  readInstallMethod,
+  hasDockerCompose,
+  dockerInstallPreview,
+  ensureDocker,
+  composeSecretRotationRisk,
+  renderSecretRotationRefusal,
+  composePgDataRisk,
+  renderPgDataRefusal,
+  composeTrustedOriginUrls,
+  resolveComposePorts,
+  sourceBuildDir,
+  composePlan,
+  pinnedImagesReady,
+  composePrefetch,
+  composeUp,
+  composeDown,
+  composeUninstall,
+  composeUpdate,
+  composePs,
+  composeRunning,
+  composeStart,
+  composeRestart,
+  composeInternalToken,
+  checkHostChannel,
+  verifyHostChannel
+};