openship 0.6.5 → 0.6.7

package/dist/{chunk-QLX7NBEA.js → chunk-VQM6JHJB.js}

@@ -134,231 +134,50 @@ import {
 } from "./chunk-ZWLDLTJP.js";
 import {
   CloudRuntime
-} from "./chunk-3ZAGC5NT.js";
+} from "./chunk-CIJV43LH.js";
 import {
-  systemCatalog
-} from "./chunk-7334NSJL.js";
+  OPENRESTY_DEFAULT_PATHS
+} from "./chunk-QHMDCYZ3.js";
 import {
-  DEFAULT_DOCKER_SOCKET_PATH,
   DockerRuntime,
   daemonConnectionFrom,
+  ensureScopedVolumeName,
   isHostPathSource,
   resolveExecExitCode,
-  resolveLocalDockerSocketPath,
-  scopedVolumeName,
   startAttachStream,
   startExecStream
-} from "./chunk-VDESJSG6.js";
+} from "./chunk-LHFXSC36.js";
 import {
   BareRuntime
-} from "./chunk-GRTXMUHA.js";
+} from "./chunk-S6B2Z3OO.js";
 import {
   createExecutor
-} from "./chunk-VHMOQL5Y.js";
-import {
-  LocalExecutor
-} from "./chunk-6FH4AXVY.js";
-import {
-  invalidateEdgeContainer,
-  sanitizeEdgeVhosts
-} from "./chunk-WE7BXW6L.js";
-import {
-  EDGE_CONTAINER_MOUNTS,
-  EDGE_HOST_STATE_DIR,
-  OPENRESTY_DEFAULT_PATHS
-} from "./chunk-PZRRL5PC.js";
+} from "./chunk-GGIAIGUL.js";
 import {
   envOps
-} from "./chunk-EZPPTWJQ.js";
+} from "./chunk-BLEXTYRK.js";
 import {
   ENVIRONMENT_PROBE_SCRIPT,
   ENVIRONMENT_PROBE_TIMEOUT_MS,
   cacheEnvironment,
   parseEnvironmentProbe,
   profileIsFresh
-} from "./chunk-WFRXYWK2.js";
+} from "./chunk-FZ6QCF6B.js";
+import {
+  MAIL_HOST_STATE_DIR
+} from "./chunk-UWEV6XTS.js";
 import {
-  DEFAULT_IMAGE_REGISTRY,
   FAMILY_BY_DISTRO,
-  HOST_CHANNEL_BLOCKED,
-  HOST_CHANNEL_RECHECK,
-  HOST_CHANNEL_UNAFFECTED,
-  explainHostChannelCause,
   isAwsS3Endpoint,
+  isDbImage,
+  normalizeBackupPath,
+  payloadSpec,
   safeErrorMessage,
-  withTimeout,
-  wrapText
-} from "./chunk-LEYSL46B.js";
-
-// src/lib/ports.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { join } from "path";
-
-// ../../packages/core/src/ports.ts
-import { createServer } from "net";
-var DEFAULT_API_PORT = 4e3;
-var DEFAULT_DASHBOARD_PORT = 3001;
-var LOOPBACK = "127.0.0.1";
-var SCAN_SPAN = 20;
-var MAX_PORT = 65535;
-function isPortFree(port, host = LOOPBACK) {
-  return new Promise((resolve3) => {
-    const srv = createServer();
-    srv.once("error", () => resolve3(false));
-    srv.listen(port, host, () => srv.close(() => resolve3(true)));
-  });
-}
-async function waitPortFree(port, opts = {}) {
-  const timeoutMs = opts.timeoutMs ?? 6e3;
-  const intervalMs = opts.intervalMs ?? 250;
-  const host = opts.host ?? LOOPBACK;
-  const deadline = Date.now() + timeoutMs;
-  for (; ; ) {
-    if (await isPortFree(port, host)) return true;
-    if (Date.now() >= deadline) return false;
-    await new Promise((r2) => setTimeout(r2, intervalMs));
-  }
-}
-function getFreePort(host = LOOPBACK) {
-  return new Promise((resolve3, reject) => {
-    const srv = createServer();
-    srv.once("error", reject);
-    srv.listen(0, host, () => {
-      const addr = srv.address();
-      const port = addr && typeof addr === "object" ? addr.port : 0;
-      srv.close(() => port ? resolve3(port) : reject(new Error("no free port")));
-    });
-  });
-}
-async function findPortNear(from, opts = {}) {
-  const host = opts.host ?? LOOPBACK;
-  const span = opts.span ?? SCAN_SPAN;
-  const skip = opts.skip ?? (() => false);
-  for (let port2 = from; port2 <= Math.min(from + span, MAX_PORT); port2++) {
-    if (!skip(port2) && await isPortFree(port2, host)) return port2;
-  }
-  let port = await getFreePort(host);
-  for (let tries = 0; tries < 10 && skip(port); tries++) port = await getFreePort(host);
-  return port;
-}
-async function resolvePortPair(prefs = {}) {
-  const host = prefs.bindAddr?.trim() || LOOPBACK;
-  const ours = new Set(prefs.reclaimable ?? []);
-  const prefFor = (kind) => prefs[kind] ?? prefs.previous?.[kind] ?? prefs.stored?.[kind] ?? prefs.defaults?.[kind];
-  const remembered = (kind, pref) => prefs[kind] === void 0 && (prefs.previous?.[kind] === pref || prefs.stored?.[kind] === pref);
-  const availableForPref = async (port) => ours.has(port) || await isPortFree(port, host);
-  const apiPref = prefFor("api");
-  const dashPref = prefFor("dashboard");
-  let api;
-  if (apiPref === void 0) api = await getFreePort(host);
-  else if (await availableForPref(apiPref)) api = apiPref;
-  else if (remembered("api", apiPref) && await waitPortFree(apiPref, { host })) api = apiPref;
-  else {
-    api = await findPortNear(apiPref + 1, {
-      host,
-      skip: (p2) => ours.has(p2) || p2 === dashPref
-    });
-  }
-  const skipForDash = (p2) => ours.has(p2) || p2 === api;
-  let dashboard;
-  if (dashPref === void 0) {
-    dashboard = await getFreePort(host);
-    for (let tries = 0; tries < 10 && dashboard === api; tries++) {
-      dashboard = await getFreePort(host);
-    }
-  } else if (dashPref !== api && await availableForPref(dashPref)) {
-    dashboard = dashPref;
-  } else if (dashPref !== api && remembered("dashboard", dashPref) && await waitPortFree(dashPref, { host })) {
-    dashboard = dashPref;
-  } else {
-    dashboard = await findPortNear(dashPref + 1, { host, skip: skipForDash });
-  }
-  return {
-    api,
-    dashboard,
-    switched: {
-      api: apiPref !== void 0 && api !== apiPref,
-      dashboard: dashPref !== void 0 && dashboard !== dashPref
-    },
-    preferred: { api: apiPref ?? api, dashboard: dashPref ?? dashboard }
-  };
-}
-
-// src/lib/ports.ts
-var PORTS_FILE = join(OS_DIR, "ports.json");
-var INSTANCE_FILE = join(OS_DIR, "instance.json");
-function saveInstanceUrl(publicUrl) {
-  try {
-    if (!existsSync(OS_DIR)) mkdirSync(OS_DIR, { recursive: true, mode: 448 });
-    writeFileSync(INSTANCE_FILE, JSON.stringify({ publicUrl: publicUrl ?? null }));
-  } catch {
-  }
-}
-function readInstanceUrl() {
-  try {
-    return JSON.parse(readFileSync(INSTANCE_FILE, "utf8")).publicUrl ?? null;
-  } catch {
-    return null;
-  }
-}
-function readStoredPorts() {
-  try {
-    return JSON.parse(readFileSync(PORTS_FILE, "utf-8"));
-  } catch {
-    return {};
-  }
-}
-function storedApiPort() {
-  return readStoredPorts().api ?? DEFAULT_API_PORT;
-}
-function storedDashboardPort() {
-  return readStoredPorts().dashboard ?? DEFAULT_DASHBOARD_PORT;
-}
-function saveStoredPorts(api, dashboard) {
-  try {
-    if (!existsSync(OS_DIR)) mkdirSync(OS_DIR, { recursive: true, mode: 448 });
-    writeFileSync(PORTS_FILE, JSON.stringify({ api, dashboard }));
-  } catch {
-  }
-}
-function portMoveNotice(resolved, trustedOriginUrls = []) {
-  if (!resolved.switched.api && !resolved.switched.dashboard) return [];
-  const lines = [
-    `A preferred port was busy \u2014 using API ${resolved.api}, dashboard ${resolved.dashboard}.`
-  ];
-  const stale = [...new Set(stalePortOrigins(resolved.preferred.dashboard, trustedOriginUrls))];
-  if (stale.length) {
-    lines.push(
-      `Heads up: ${stale.join(", ")} still names port ${resolved.preferred.dashboard}, so logins`,
-      `from that origin will be rejected. Point it at :${resolved.dashboard} (or free port`,
-      `${resolved.preferred.dashboard} and re-run to move back).`
-    );
-  }
-  return lines;
-}
-function stalePortOrigins(movedFrom, urls) {
-  const stale = [];
-  for (const raw of urls) {
-    for (const candidate of (raw ?? "").split(",")) {
-      const value = candidate.trim();
-      if (!value) continue;
-      try {
-        if (new URL(value).port === String(movedFrom)) stale.push(value);
-      } catch {
-      }
-    }
-  }
-  return stale;
-}
-async function resolvePorts(prefs, opts = {}) {
-  const resolved = await resolvePortPair({
-    ...prefs,
-    stored: readStoredPorts(),
-    defaults: { api: DEFAULT_API_PORT, dashboard: DEFAULT_DASHBOARD_PORT }
-  });
-  if (opts.persist !== false) saveStoredPorts(resolved.api, resolved.dashboard);
-  return resolved;
-}
+  shellQuote,
+  validateBackupPath,
+  validateClearPath,
+  withTimeout
+} from "./chunk-2VSW6Q6C.js";
 
 // ../../packages/adapters/src/runtime/image-transfer.ts
 import { Transform } from "stream";
@@ -366,40 +185,6 @@ import { Transform } from "stream";
 // ../../packages/adapters/src/infra/edge-baked-conf.ts
 var LOGS_DIR = OPENRESTY_DEFAULT_PATHS.pidPath.replace(/\/[^/]+$/, "");
 
-// ../../packages/adapters/src/infra/mail-container.ts
-var MAIL_HOST_STATE_DIR = "/var/lib/openship/mail";
-var MAIL_CONTAINER_MOUNTS = [
-  { host: `${MAIL_HOST_STATE_DIR}/vmail`, container: "/var/vmail" },
-  // The Postfix queue. A recreate on an ephemeral layer would drop in-flight and
-  // deferred mail without this — keep it on the host.
-  { host: `${MAIL_HOST_STATE_DIR}/spool`, container: "/var/spool/postfix" },
-  // DKIM private keys. NEVER baked, never regenerated on pull — a fresh selector
-  // breaks DMARC until DNS repropagates.
-  { host: `${MAIL_HOST_STATE_DIR}/dkim`, container: "/var/lib/dkim" },
-  // Mutable daemon config the admin layer edits (sasl_passwd, relayhost maps,
-  // amavis 50-user). Seeded from baked defaults on first boot.
-  { host: `${MAIL_HOST_STATE_DIR}/config/postfix`, container: "/etc/postfix", seed: true },
-  { host: `${MAIL_HOST_STATE_DIR}/config/dovecot`, container: "/etc/dovecot", seed: true },
-  { host: `${MAIL_HOST_STATE_DIR}/config/amavis`, container: "/etc/amavis/conf.d", seed: true },
-  // ClamAV signatures — bind-mounted so a pull doesn't force a multi-hundred-MB
-  // freshclam re-download and delay readiness.
-  { host: `${MAIL_HOST_STATE_DIR}/clamav`, container: "/var/lib/clamav" },
-  { host: "/etc/letsencrypt", container: "/etc/letsencrypt", readonly: true }
-];
-var MAIL_DB_HOST_DATA_DIR = `${MAIL_HOST_STATE_DIR}/pgdata`;
-var MAIL_DB_CONTAINER_DATA_DIR = "/var/lib/postgresql/data";
-var MAIL_DB_PGDATA = `${MAIL_DB_CONTAINER_DATA_DIR}/pgdata`;
-var MAIL_HOST_PATHS = {
-  saslPasswd: `${MAIL_HOST_STATE_DIR}/config/postfix/sasl_passwd`,
-  senderRelayhost: `${MAIL_HOST_STATE_DIR}/config/postfix/sender_relayhost`,
-  // Per-nexthop TLS policy. Only split ("selected"-scope) relaying writes it: the
-  // relay hop must be `encrypt` so SASL credentials never cross a plaintext
-  // connection, while direct-to-MX delivery for the un-relayed domains stays
-  // opportunistic. A GLOBAL smtp_tls_security_level can't express both.
-  relayTlsPolicy: `${MAIL_HOST_STATE_DIR}/config/postfix/openship_tls_policy`,
-  amavisUserConf: `${MAIL_HOST_STATE_DIR}/config/amavis/50-user`
-};
-
 // ../../packages/adapters/src/system/mail/ensure-container-mail.ts
 var MAIL_DB_IMAGE = process.env.OPENSHIP_MAIL_DB_IMAGE?.trim() || "postgres:16-alpine";
 var ENGINE_ENV_FILE = `${MAIL_HOST_STATE_DIR}/engine.env`;
@@ -530,6 +315,102 @@ function decryptCredential(stored) {
 import { createHash as createHash3 } from "crypto";
 import { Transform as Transform2 } from "stream";
 
+// ../../packages/adapters/src/backup/common/dump-pipeline.ts
+function codecSuffix(codec) {
+  return codec === "zstd" ? ".zst" : codec === "gzip" ? ".gz" : "";
+}
+function preludeBlock(prelude) {
+  return `{
+${prelude}
+} >&2`;
+}
+function compressor(codec) {
+  if (codec === "zstd") return "zstd -c -3";
+  if (codec === "gzip") return "gzip -c";
+  return null;
+}
+function decompressor(codec) {
+  if (codec === "zstd") return "zstd -d -c";
+  if (codec === "gzip") return "gzip -d -c";
+  return null;
+}
+function recordedCodec(value) {
+  return value === "gzip" || value === "none" || value === "zstd" ? value : "zstd";
+}
+async function detectDumpCodec(service, executor) {
+  try {
+    const { stdout, awaitExit } = await executor.execStream(service, [
+      "sh",
+      "-c",
+      "if command -v zstd >/dev/null 2>&1; then echo zstd; elif command -v gzip >/dev/null 2>&1; then echo gzip; else echo none; fi"
+    ]);
+    const chunks = [];
+    stdout.on("data", (c2) => {
+      if (chunks.length < 8) chunks.push(c2);
+    });
+    stdout.on("error", () => {
+    });
+    const exit = await awaitExit;
+    await new Promise((resolve2) => setImmediate(resolve2));
+    if (exit.code !== 0) return "none";
+    const answer = Buffer.concat(chunks).toString("utf8").trim();
+    return answer === "zstd" || answer === "gzip" ? answer : "none";
+  } catch {
+    return "none";
+  }
+}
+function safePipelineFragment(left, right, labels) {
+  return [
+    // Duplicating stdout is harmless to repeat, so a caller may use more than one of
+    // these in a script.
+    "exec 4>&1",
+    // `{ right; } >&4` and not `right >&4`: a right-hand side containing `&&` (the redis
+    // loader is `cat > file && chmod …`) would otherwise attach the redirect to its LAST
+    // command only. Grouping covers the whole side whatever the caller passes.
+    `res=$( { { if ${left}; then echo "d=0" >&3; else echo "d=$?" >&3; fi; } | { if { ${right}; } >&4; then echo "c=0" >&3; else echo "c=$?" >&3; fi; } } 3>&1 )`,
+    // Both default to FAILURE, so a report that never arrived cannot read as success.
+    "d=1; c=1",
+    // Unquoted `$res` word-splits on IFS, which includes the newline separating the two
+    // reports — no `sed`/`awk` (a minimal image may have neither), and order-independent.
+    // The two writes are single sub-PIPE_BUF lines on one pipe, so they cannot interleave.
+    'for kv in $res; do case "$kv" in d=*) d=${kv#d=} ;; c=*) c=${kv#c=} ;; esac; done',
+    // A status we could not parse is a failure, never an implicit success.
+    `case "$d" in ''|*[!0-9]*) d=1 ;; esac`,
+    `case "$c" in ''|*[!0-9]*) c=1 ;; esac`,
+    `[ "$c" = 0 ] || { echo "openship: ${labels.right} failed with status $c" >&2; exit "$c"; }`,
+    `[ "$d" = 0 ] || { echo "openship: ${labels.left} failed with status $d" >&2; exit "$d"; }`
+  ].join("\n");
+}
+function safePipelineCommand(left, right, labels, prelude) {
+  const script = [
+    ...prelude ? [preludeBlock(prelude)] : [],
+    safePipelineFragment(left, right, labels)
+  ].join("\n");
+  return ["sh", "-c", script];
+}
+function safeDumpCommand(dump, codec, prelude) {
+  const comp = compressor(codec);
+  if (!comp) return ["sh", "-c", prelude ? `${preludeBlock(prelude)}
+${dump}` : dump];
+  return safePipelineCommand(
+    dump,
+    comp,
+    { left: "the dump command", right: `the compressor '${comp}'` },
+    prelude
+  );
+}
+function safeRestoreCommand(codec, load, prelude) {
+  const decomp = decompressor(codec);
+  if (!decomp) return ["sh", "-c", prelude ? `${preludeBlock(prelude)}
+${load}` : load];
+  return safePipelineCommand(
+    decomp,
+    load,
+    { left: `the decompressor '${decomp}'`, right: "the restore command" },
+    prelude
+  );
+}
+
 // ../../packages/adapters/src/backup/common/source-match.ts
 function matchBackupSource(sources, targetSourceId) {
   const wanted = targetSourceId.trim();
@@ -549,40 +430,53 @@ function matchBackupSource(sources, targetSourceId) {
   return null;
 }
 
+// ../../packages/adapters/src/backup/common/artifact-metadata.ts
+var REDACTED_USERINFO_MARKER = "://***@";
+function isRedactedCommand(command) {
+  return command.includes(REDACTED_USERINFO_MARKER);
+}
+
 // ../../packages/adapters/src/backup/volume-transfer.ts
 import { Transform as Transform3 } from "stream";
 
+// ../../packages/adapters/src/backup/common/exec-target.ts
+function canExecInService(service) {
+  return !!service.containerId && service.containerRunning !== false;
+}
+
 // ../../packages/adapters/src/backup/producers/pg-dump.ts
-var POSTGRES_IMAGE_RE = /^(postgres|postgis\/postgis):/i;
 function envOr(service, key, fallback) {
   return service.env[key] ?? fallback;
 }
 var PgDumpProducerImpl = class {
   kind = "pg_dump";
   detects(service) {
-    if (!service.image || !POSTGRES_IMAGE_RE.test(service.image)) return false;
-    const db = service.env.POSTGRES_DB ?? service.env.PGDATABASE;
-    return !!db;
+    if (!isDbImage(service.image, "pg_dump")) return false;
+    return canExecInService(service);
   }
   async *produce(service, executor, _opts) {
     const user = envOr(service, "POSTGRES_USER", "postgres");
-    const db = service.env.POSTGRES_DB ?? service.env.PGDATABASE ?? "postgres";
+    const db = service.env.POSTGRES_DB ?? service.env.PGDATABASE ?? service.env.POSTGRES_USER ?? "postgres";
     const password = service.env.POSTGRES_PASSWORD ?? service.env.PGPASSWORD ?? "";
-    const cmd = [
-      "sh",
-      "-c",
-      `export PGPASSWORD=${shellEscape(password)}; pg_dump -Fc -U ${shellEscape(user)} ${shellEscape(db)} | zstd -c -3`
-    ];
+    const cmd = safeDumpCommand(
+      `pg_dump -Fc -U ${shellQuote(user)} ${shellQuote(db)}`,
+      "none",
+      `export PGPASSWORD=${shellQuote(password)}`
+    );
     const { stdout, awaitExit } = await executor.execStream(service, cmd);
     yield {
-      name: "pg-dump.zst",
+      // These bytes are pg_dump's own container format, which pg_restore reads
+      // directly. `.dump` is what the Postgres docs call it.
+      name: "pg-dump.dump",
       stream: stdout,
       payloadKind: "pg_dump",
       metadata: {
         postgresUser: user,
         postgresDb: db,
         format: "custom",
-        compression: "zstd"
+        // The EXTERNAL codec only. The custom format's internal zlib is pg_restore's
+        // own business, so a `-Fc` artifact records "none".
+        compression: "none"
       }
     };
     const exit = await awaitExit;
@@ -594,17 +488,18 @@ var PgDumpProducerImpl = class {
   }
   async restore(service, executor, artifact, _opts) {
     const user = envOr(service, "POSTGRES_USER", "postgres");
-    const db = artifact.metadata.postgresDb ?? service.env.POSTGRES_DB ?? service.env.PGDATABASE ?? "postgres";
     const password = service.env.POSTGRES_PASSWORD ?? service.env.PGPASSWORD ?? "";
-    const cmd = [
-      "sh",
-      "-c",
-      `export PGPASSWORD=${shellEscape(password)}; zstd -d | pg_restore --clean --if-exists --no-owner -U ${shellEscape(user)} -d ${shellEscape(db)}`
-    ];
+    const codec = recordedCodec(artifact.metadata.compression);
+    const db = artifact.metadata.postgresDb ?? service.env.POSTGRES_DB ?? service.env.PGDATABASE ?? service.env.POSTGRES_USER ?? "postgres";
+    const cmd = safeRestoreCommand(
+      codec,
+      `pg_restore --clean --if-exists --no-owner --no-acl --single-transaction -U ${shellQuote(user)} -d ${shellQuote(db)}`,
+      `export PGPASSWORD=${shellQuote(password)}`
+    );
     const body = await artifact.open();
     const exit = await executor.pipeIntoCommand(service, cmd, body, {
-      timeoutMs: 60 * 60 * 1e3
-      // 1h for large restores
+      // Ceiling from the catalog, so the number is not a per-producer literal.
+      timeoutMs: payloadSpec("pg_dump").restoreTimeoutMs
     });
     if (exit.code !== 0) {
       throw new Error(
@@ -613,17 +508,10 @@ var PgDumpProducerImpl = class {
     }
   }
 };
-function shellEscape(s2) {
-  return `'${s2.replace(/'/g, "'\\''")}'`;
-}
 var PgDumpProducer = new PgDumpProducerImpl();
 registerProducer(PgDumpProducer);
 
 // ../../packages/adapters/src/backup/producers/mysql-dump.ts
-var MYSQL_IMAGE_RE = /^(mysql|mariadb|percona\/percona-server):/i;
-function shellEscape2(s2) {
-  return `'${s2.replace(/'/g, "'\\''")}'`;
-}
 function mysqlCredentials(env) {
   if (env.MYSQL_ROOT_PASSWORD) {
     return { user: "root", password: env.MYSQL_ROOT_PASSWORD };
@@ -633,27 +521,32 @@ function mysqlCredentials(env) {
 var MysqlDumpProducerImpl = class {
   kind = "mysql_dump";
   detects(service) {
-    if (!service.image || !MYSQL_IMAGE_RE.test(service.image)) return false;
+    if (!isDbImage(service.image, "mysql_dump")) return false;
+    if (!canExecInService(service)) return false;
     return !!(service.env.MYSQL_ROOT_PASSWORD ?? service.env.MYSQL_PASSWORD);
   }
   async *produce(service, executor, _opts) {
     const { user, password } = mysqlCredentials(service.env);
     const db = service.env.MYSQL_DATABASE ?? "";
-    const dbArg = db ? `--databases ${shellEscape2(db)}` : "--all-databases";
-    const cmd = [
-      "sh",
-      "-c",
-      `MYSQL_PWD=${shellEscape2(password)} mysqldump --single-transaction --routines --triggers -u ${shellEscape2(user)} ${dbArg} | zstd -c -3`
-    ];
+    const dbArg = db ? `--databases ${shellQuote(db)}` : "--all-databases";
+    const codec = await detectDumpCodec(service, executor);
+    const cmd = safeDumpCommand(
+      `mysqldump --single-transaction --routines --triggers -u ${shellQuote(user)} ${dbArg}`,
+      codec,
+      // `export`, not the `VAR=x cmd` prefix: with a pipeline the prefix form sets
+      // the variable on mysqldump only, and the safe-pipeline wrapper puts the
+      // compressor in the same shell.
+      `export MYSQL_PWD=${shellQuote(password)}`
+    );
     const { stdout, awaitExit } = await executor.execStream(service, cmd);
     yield {
-      name: "mysql-dump.sql.zst",
+      name: `mysql-dump.sql${codecSuffix(codec)}`,
       stream: stdout,
       payloadKind: "mysql_dump",
       metadata: {
         mysqlUser: user,
         mysqlDatabase: db || "(all)",
-        compression: "zstd"
+        compression: codec
       }
     };
     const exit = await awaitExit;
@@ -663,14 +556,16 @@ var MysqlDumpProducerImpl = class {
   }
   async restore(service, executor, artifact, _opts) {
     const { user, password } = mysqlCredentials(service.env);
-    const cmd = [
-      "sh",
-      "-c",
-      `export MYSQL_PWD=${shellEscape2(password)}; zstd -d | mysql -u ${shellEscape2(user)}`
-    ];
+    const codec = recordedCodec(artifact.metadata.compression);
+    const cmd = safeRestoreCommand(
+      codec,
+      `mysql -u ${shellQuote(user)}`,
+      `export MYSQL_PWD=${shellQuote(password)}`
+    );
     const body = await artifact.open();
     const exit = await executor.pipeIntoCommand(service, cmd, body, {
-      timeoutMs: 60 * 60 * 1e3
+      // Ceiling from the catalog, so the number is not a per-producer literal.
+      timeoutMs: payloadSpec("mysql_dump").restoreTimeoutMs
     });
     if (exit.code !== 0) {
       throw new Error(`mysql restore exited ${exit.code}: ${exit.stderr.slice(0, 500)}`);
@@ -681,36 +576,110 @@ var MysqlDumpProducer = new MysqlDumpProducerImpl();
 registerProducer(MysqlDumpProducer);
 
 // ../../packages/adapters/src/backup/producers/redis.ts
-var REDIS_IMAGE_RE = /^redis(\/|:)/i;
+async function probeOutput(res) {
+  const chunks = [];
+  let size = 0;
+  const drained = new Promise((resolve2) => {
+    res.stdout.on("data", (c2) => {
+      if (size < 4096) {
+        chunks.push(Buffer.from(c2));
+        size += c2.byteLength;
+      }
+    });
+    res.stdout.once("end", () => resolve2());
+    res.stdout.once("error", () => resolve2());
+    res.stdout.once("close", () => resolve2());
+  });
+  await withTimeout(drained, PROBE_TIMEOUT_MS, "redis config probe timed out").catch(
+    () => void 0
+  );
+  await res.awaitExit.catch(() => void 0);
+  return Buffer.concat(chunks).toString("utf8");
+}
+var PROBE_TIMEOUT_MS = 3e4;
+var BGSAVE_WAIT_SECONDS = 300;
 var RedisRdbProducerImpl = class {
   kind = "redis_rdb";
   detects(service) {
-    return !!service.image && REDIS_IMAGE_RE.test(service.image);
+    if (!isDbImage(service.image, "redis_rdb")) return false;
+    return canExecInService(service);
   }
   async *produce(service, executor, _opts) {
-    const auth = service.env.REDIS_PASSWORD ? `-a '${service.env.REDIS_PASSWORD.replace(/'/g, "'\\''")}'` : "";
-    const trigger = `
-      LAST=$(redis-cli ${auth} LASTSAVE);
-      redis-cli ${auth} BGSAVE >/dev/null;
-      for i in $(seq 1 60); do
-        CUR=$(redis-cli ${auth} LASTSAVE);
-        if [ "$CUR" != "$LAST" ]; then break; fi
-        sleep 1;
-      done;
-      cat /data/dump.rdb | zstd -c -3
-    `;
-    const { stdout, awaitExit } = await executor.execStream(service, [
-      "sh",
-      "-c",
-      trigger
-    ]);
+    const cli = this.cli(service);
+    const waitSeconds = BGSAVE_WAIT_SECONDS;
+    const codec = await detectDumpCodec(service, executor);
+    const prelude = [
+      // One reader for both LASTSAVE calls, because reading it correctly is not a
+      // one-liner: `redis-cli -a` has printed an auth warning on EVERY invocation since
+      // 4.0, so the capture is two lines and folding it into the timestamp with a bare
+      // `2>&1` would make every password-protected Redis look unreachable. Take the last
+      // all-digits LINE as the reply, and keep the rest as the diagnostic.
+      `lastsave() {`,
+      `  RAW=$(${cli} LASTSAVE 2>&1 | tr -d '\\r')`,
+      `  TS=$(printf '%s\\n' "$RAW" | grep -E '^[0-9]+$' | tail -n 1)`,
+      `}`,
+      `lastsave`,
+      `[ -n "$TS" ] || {`,
+      `  echo "openship: could not read Redis LASTSAVE, so a captured dump.rdb could not be proven fresh \u2014 refusing to archive a possibly stale one. redis-cli said: $RAW" >&2`,
+      `  exit 91`,
+      `}`,
+      `LAST=$TS`,
+      // Both halves of "did BGSAVE start", because which one answers depends on the
+      // version: Redis 6+ exits non-zero on an error reply, older builds exit 0 and only
+      // print it. An already-RUNNING save is not a failure — it will advance LASTSAVE, so
+      // the wait below covers it — and its reply contains ERR, which is why that arm comes
+      // first.
+      //
+      // `already in progress` and not `in progress`: Redis has a SECOND error with that
+      // phrase — "Can't BGSAVE while AOF log rewriting is in progress" — and it means the
+      // opposite, that no save was started at all. Matching the loose phrase waved it
+      // through and left the wait polling for a timestamp nothing was going to move.
+      `BG=$(${cli} BGSAVE 2>&1 | tr -d '\\r') || BGFAIL=1`,
+      `case "$BG" in`,
+      `  *"already in progress"*) ;;`,
+      `  *ERR*) BGFAIL=1 ;;`,
+      `esac`,
+      `[ -z "$BGFAIL" ] || {`,
+      `  echo "openship: Redis would not start a background save, so /data/dump.rdb is whatever an earlier save left there \u2014 refusing to archive it as this backup. redis-cli said: $BG" >&2`,
+      `  exit 92`,
+      `}`,
+      `i=0; SAVED=0`,
+      `while [ "$i" -lt ${waitSeconds} ]; do`,
+      `  lastsave`,
+      `  [ -n "$TS" ] || {`,
+      `    echo "openship: lost contact with Redis while waiting for BGSAVE to finish. redis-cli said: $RAW" >&2`,
+      `    exit 91`,
+      `  }`,
+      `  if [ "$TS" != "$LAST" ]; then SAVED=1; break; fi`,
+      // Fail on a save Redis has already given up on rather than waiting out the whole
+      // window for a timestamp that is never going to move. Gated on
+      // `rdb_bgsave_in_progress:0` because the status field still reports the PREVIOUS
+      // save's result while a new one runs. A missing `tr`/`grep`/`INFO` leaves this
+      // empty, which matches nothing and falls through to the timeout below — the checks
+      // here only ever ADD a reason to fail, never a reason to pass.
+      `  INFO=$(${cli} INFO persistence 2>/dev/null | tr -d '\\r')`,
+      `  case "$INFO" in *rdb_bgsave_in_progress:0*)`,
+      `    case "$INFO" in *rdb_last_bgsave_status:err*)`,
+      `      echo "openship: Redis reported its background save FAILED (rdb_last_bgsave_status:err) \u2014 usually no free space where /data lives. Nothing fresh was written, so refusing to archive the previous save." >&2`,
+      `      exit 93 ;;`,
+      `    esac ;;`,
+      `  esac`,
+      `  i=$((i+1)); sleep 1`,
+      `done`,
+      `[ "$SAVED" = 1 ] || {`,
+      `  echo "openship: Redis BGSAVE did not finish within ${waitSeconds}s \u2014 LASTSAVE never advanced, so /data/dump.rdb is still the PREVIOUS save. Refusing to archive it as this backup; use a volume payload for a dataset this large, or retry." >&2`,
+      `  exit 94`,
+      `}`
+    ].join("\n");
+    const cmd = safeDumpCommand("cat /data/dump.rdb", codec, prelude);
+    const { stdout, awaitExit } = await executor.execStream(service, cmd);
     yield {
-      name: "redis-dump.rdb.zst",
+      name: `redis-dump.rdb${codecSuffix(codec)}`,
       stream: stdout,
       payloadKind: "redis_rdb",
       metadata: {
         rdbPath: "/data/dump.rdb",
-        compression: "zstd"
+        compression: codec
       }
     };
     const exit = await awaitExit;
@@ -718,15 +687,31 @@ var RedisRdbProducerImpl = class {
       throw new Error(`redis BGSAVE/capture exited ${exit.code}: ${exit.stderr.slice(0, 500)}`);
     }
   }
+  /** `redis-cli` with auth, when a password is discoverable. */
+  cli(service) {
+    const pass = service.env.REDIS_PASSWORD;
+    return pass ? `redis-cli -a ${shellQuote(pass)}` : "redis-cli";
+  }
   async restore(service, executor, artifact, _opts) {
-    const cmd = [
-      "sh",
-      "-c",
-      "zstd -d > /data/dump.rdb && chmod 644 /data/dump.rdb"
-    ];
+    const aofValue = await probeOutput(
+      await executor.execStream(service, [
+        "sh",
+        "-c",
+        `${this.cli(service)} CONFIG GET appendonly 2>/dev/null | tail -n 1`
+      ])
+    );
+    if (aofValue.trim().toLowerCase() === "yes") {
+      throw new Error(
+        `This Redis has AOF persistence enabled (appendonly yes), so at startup it loads its append-only file INSTEAD of dump.rdb \u2014 restoring this RDB artifact would change nothing. Disable appendonly on the service and redeploy before restoring an RDB, or restore from a volume backup, which replaces /data wholesale.`
+      );
+    }
+    await executor.execStream(service, ["sh", "-c", `${this.cli(service)} CONFIG SET save '' >/dev/null 2>&1`]).then((r2) => r2.awaitExit).catch(() => void 0);
+    const codec = recordedCodec(artifact.metadata.compression);
+    const cmd = safeRestoreCommand(codec, "cat > /data/dump.rdb && chmod 644 /data/dump.rdb");
     const body = await artifact.open();
     const exit = await executor.pipeIntoCommand(service, cmd, body, {
-      timeoutMs: 30 * 60 * 1e3
+      // Ceiling from the catalog, so the number is not a per-producer literal.
+      timeoutMs: payloadSpec("redis_rdb").restoreTimeoutMs
     });
     if (exit.code !== 0) {
       throw new Error(`redis restore exited ${exit.code}: ${exit.stderr.slice(0, 500)}`);
@@ -737,20 +722,17 @@ var RedisRdbProducer = new RedisRdbProducerImpl();
 registerProducer(RedisRdbProducer);
 
 // ../../packages/adapters/src/backup/producers/mongo.ts
-var MONGO_IMAGE_RE = /^(mongo|percona\/percona-server-mongodb):/i;
-function shellEscape3(s2) {
-  return `'${s2.replace(/'/g, "'\\''")}'`;
-}
 var MongoDumpProducerImpl = class {
   kind = "mongo_dump";
   detects(service) {
-    return !!service.image && MONGO_IMAGE_RE.test(service.image);
+    if (!isDbImage(service.image, "mongo_dump")) return false;
+    return canExecInService(service);
   }
   authArgs(service) {
     const user = service.env.MONGO_INITDB_ROOT_USERNAME ?? service.env.MONGODB_ROOT_USERNAME ?? "";
     const pass = service.env.MONGO_INITDB_ROOT_PASSWORD ?? service.env.MONGODB_ROOT_PASSWORD ?? "";
     if (!user || !pass) return "";
-    return `-u ${shellEscape3(user)} -p ${shellEscape3(pass)} --authenticationDatabase admin`;
+    return `-u ${shellQuote(user)} -p ${shellQuote(pass)} --authenticationDatabase admin`;
   }
   async *produce(service, executor, _opts) {
     const auth = this.authArgs(service);
@@ -776,7 +758,8 @@ var MongoDumpProducerImpl = class {
     ];
     const body = await artifact.open();
     const exit = await executor.pipeIntoCommand(service, cmd, body, {
-      timeoutMs: 60 * 60 * 1e3
+      // Ceiling from the catalog, so the number is not a per-producer literal.
+      timeoutMs: payloadSpec("mongo_dump").restoreTimeoutMs
     });
     if (exit.code !== 0) {
       throw new Error(`mongorestore exited ${exit.code}: ${exit.stderr.slice(0, 500)}`);
@@ -826,12 +809,18 @@ var CustomCommandProducerImpl = class {
         "Backup has no restoreCommand recorded \u2014 restore is not possible for this artifact. Re-run the backup policy to capture a restorable one."
       );
     }
+    if (isRedactedCommand(restoreCommand)) {
+      throw new Error(
+        "Backup's recorded restoreCommand had its credentials redacted when it was captured, so running it would fail authentication partway through the restore. Re-run the backup policy to capture a restorable artifact (or restore by hand using the command on the policy)."
+      );
+    }
     const body = await artifact.open();
     const exit = await executor.pipeIntoCommand(
       service,
       ["sh", "-c", restoreCommand],
       body,
-      { timeoutMs: 60 * 60 * 1e3 }
+      // Ceiling from the catalog, so the number is not a per-producer literal.
+      { timeoutMs: payloadSpec("custom_command").restoreTimeoutMs }
     );
     if (exit.code !== 0) {
       throw new Error(
@@ -843,6 +832,130 @@ var CustomCommandProducerImpl = class {
 var CustomCommandProducer = new CustomCommandProducerImpl();
 registerProducer(CustomCommandProducer);
 
+// ../../packages/adapters/src/backup/producers/path.ts
+function guardSourcePath(path, serviceName) {
+  const q2 = shellQuote(path);
+  return [
+    `if [ ! -d ${q2} ]; then`,
+    `  echo "openship: ${path} does not exist inside service ${serviceName} (or is not a directory), so there is nothing to archive. Check the path, or point the policy at a volume instead." >&2`,
+    `  exit 66`,
+    `fi`,
+    `if [ -z "$(find ${q2} -mindepth 1 -print -quit 2>/dev/null)" ]; then`,
+    `  echo "openship: ${path} exists inside service ${serviceName} but is empty. Refusing to record an empty archive as a backup \u2014 a directory that should hold data and does not usually means the data lives somewhere else (a volume mounted one level off, or an app that moved its data directory). Fix the path, or remove it from the policy if it is expected to be empty." >&2`,
+    `  exit 67`,
+    `fi`
+  ].join("\n");
+}
+function guardRestorePath(path, codec, clear) {
+  const q2 = shellQuote(path);
+  const tool = codec === "zstd" ? "zstd" : codec === "gzip" ? "gzip" : null;
+  const lines = [];
+  if (tool && clear) {
+    lines.push(
+      `command -v ${tool} >/dev/null 2>&1 || { echo "openship: ${tool} is not available inside this service, so the archive cannot be decompressed. Refusing to clear ${path}: nothing was written and your data is untouched." >&2; exit 90; }`
+    );
+  }
+  lines.push(`mkdir -p ${q2} || exit 91`);
+  if (clear) {
+    lines.push(`find ${q2} -mindepth 1 -maxdepth 1 -exec rm -rf {} + 2>/dev/null || true`);
+  }
+  return lines.join("\n");
+}
+function pathSlug(path) {
+  return path.replace(/^\/+/, "").replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 80) || "root";
+}
+var PathArchiveProducerImpl = class {
+  kind = "path";
+  // No detects() — explicit selection only. See the module doc.
+  async *produce(service, executor, opts) {
+    const requested = opts.paths ?? [];
+    if (requested.length === 0) {
+      throw new Error(
+        `Nothing to back up for service "${service.name}": this policy archives files and folders but names none. Set \`payloadConfig.paths\` to one or more absolute paths inside the service.`
+      );
+    }
+    const paths = [];
+    for (const entry of requested) {
+      const problem = validateBackupPath(entry);
+      if (problem) throw new Error(problem);
+      const normalized = normalizeBackupPath(entry);
+      if (!paths.includes(normalized)) paths.push(normalized);
+    }
+    const codec = opts.compression ?? await detectDumpCodec(service, executor);
+    for (const path of paths) {
+      const { stdout, awaitExit } = await executor.execStream(
+        service,
+        safeDumpCommand(
+          // `-C <dir> .` rather than `tar -c <dir>`: the archive holds the directory's
+          // CONTENTS at relative paths, so it can be extracted into a different
+          // location — which is what makes an artifact captured from /data/app
+          // restorable after the app moved to /srv/app.
+          `tar -c -C ${shellQuote(path)} ${(opts.exclude ?? []).map((p2) => `--exclude=${shellQuote(p2)}`).join(" ")} .`.replace(/\s+/g, " "),
+          codec,
+          guardSourcePath(path, service.name)
+        )
+      );
+      yield {
+        name: `path-${pathSlug(path)}.tar${codecSuffix(codec)}`,
+        stream: stdout,
+        payloadKind: "path",
+        metadata: {
+          // The restore target. Recorded per-artifact rather than read back off the
+          // policy, because a policy is editable and soft-deletable: an artifact has to
+          // carry everything needed to put it back, or it stops being a restore point
+          // the moment somebody edits the schedule.
+          path,
+          compression: codec,
+          // See the module doc: always crash-consistent, and the artifact says so
+          // rather than leaving an operator to assume otherwise.
+          consistency: "crash"
+        }
+      };
+      const exit = await awaitExit;
+      if (exit.code !== 0) {
+        throw new Error(
+          `Archiving ${path} from service "${service.name}" failed (exit ${exit.code}): ${exit.stderr.slice(0, 500)}`
+        );
+      }
+    }
+  }
+  async restore(service, executor, artifact, opts) {
+    const recorded = artifact.metadata.path;
+    if (typeof recorded !== "string" || recorded.trim() === "") {
+      throw new Error(
+        `Artifact ${artifact.key} cannot restore: metadata.path missing. This artifact may have been produced by a different producer.`
+      );
+    }
+    const path = normalizeBackupPath(recorded);
+    const problem = validateBackupPath(path);
+    if (problem) throw new Error(`Artifact ${artifact.key} records an unusable path. ${problem}`);
+    const codec = recordedCodec(artifact.metadata.compression);
+    const wantsClear = opts.clearTarget === true;
+    if (wantsClear) {
+      const unsafe = validateClearPath(path);
+      if (unsafe) throw new Error(unsafe);
+    }
+    const body = await artifact.open();
+    const exit = await executor.pipeIntoCommand(
+      service,
+      safeRestoreCommand(
+        codec,
+        `tar -x -C ${shellQuote(path)}`,
+        guardRestorePath(path, codec, wantsClear)
+      ),
+      body,
+      { timeoutMs: payloadSpec("path").restoreTimeoutMs }
+    );
+    if (exit.code !== 0) {
+      throw new Error(
+        `Restoring ${path} into service "${service.name}" failed (exit ${exit.code}): ${exit.stderr.slice(0, 500)}`
+      );
+    }
+  }
+};
+var PathArchiveProducer = new PathArchiveProducerImpl();
+registerProducer(PathArchiveProducer);
+
 // ../../packages/adapters/src/backup/producers/volume.ts
 var VolumeCopyProducerImpl = class {
   kind = "volume";
@@ -851,16 +964,26 @@ var VolumeCopyProducerImpl = class {
   async *produce(service, executor, opts) {
     const sources = await executor.listSources(service);
     if (sources.length === 0) {
-      return;
+      throw new Error(
+        `Nothing to back up: no volumes or bind mounts found for service "${service.name}". ` + (service.containerId ? `Its live container (${service.containerId.slice(0, 12)}) reports no volume or bind mounts, so there is no persistent data here to capture.` : `No container was resolved for it, so only the service's recorded volumes could be checked and it has none. If this service does hold data, redeploy it so Openship records its volumes, or point the policy at a database payload instead of a volume snapshot.`)
+      );
     }
     const selected = opts.sourceIds && opts.sourceIds.length > 0 ? sources.filter((s2) => opts.sourceIds.includes(s2.id)) : sources.filter((s2) => s2.type !== "tmpfs");
+    if (selected.length === 0) {
+      const available = sources.map((s2) => `${s2.id} (${s2.type})`).join(", ");
+      throw new Error(
+        `Nothing to back up for service "${service.name}": ` + (opts.sourceIds && opts.sourceIds.length > 0 ? `the policy selects ${opts.sourceIds.join(", ")}, none of which is a source on this service. Available: ${available}.` : `its only mounts are tmpfs, which hold no data across a restart. Found: ${available}.`)
+      );
+    }
     for (const source of selected) {
+      const compression = opts.compression ?? "zstd";
       const { stdout, awaitExit } = await executor.streamPath(service, source.id, {
-        compression: "zstd",
-        exclude: opts.exclude
+        compression,
+        exclude: opts.exclude,
+        quiesce: opts.quiesce
       });
       yield {
-        name: `volume-${sanitizeArtifactName(source.id)}.tar.zst`,
+        name: `volume-${sanitizeArtifactName(source.id)}.tar${compression === "zstd" ? ".zst" : compression === "gzip" ? ".gz" : ""}`,
         stream: stdout,
         payloadKind: "volume",
         sizeHint: source.sizeHint,
@@ -869,7 +992,12 @@ var VolumeCopyProducerImpl = class {
           volumeSource: source.source,
           volumeTarget: source.target,
           volumeType: source.type,
-          compression: "zstd"
+          compression,
+          // Recorded so the artifact says what it IS, rather than leaving an operator to
+          // assume. `crash` means the service kept writing while tar walked the tree —
+          // usable for most payloads, and the reason a database deserves a logical dump
+          // instead. `quiesced` means the container was frozen for the copy.
+          consistency: opts.quiesce ? "quiesced" : "crash"
         }
       };
       const exit = await awaitExit;
@@ -889,7 +1017,12 @@ var VolumeCopyProducerImpl = class {
     }
     const stream = await artifact.open();
     await executor.receiveStream(service, volumeId, stream, {
-      compression: artifact.metadata.compression ?? "zstd",
+      // Through the recorded-codec reader rather than a cast: the cast trusted jsonb to
+      // hold one of three strings, and anything else (a typo in a hand-written policy,
+      // a value from a newer build) reached the restore helper as a codec it cannot
+      // build a pipeline for. `recordedCodec` maps the unknown to `zstd` — the only
+      // safe guess, and for the same documented reason.
+      compression: recordedCodec(artifact.metadata.compression),
       clearTarget: opts.clearTarget ?? true,
       signal: opts.signal
     });
@@ -903,10 +1036,116 @@ registerProducer(VolumeCopyProducer);
 
 // ../../packages/adapters/src/backup/executors/docker.ts
 import { PassThrough } from "stream";
+
+// ../../packages/adapters/src/runtime/docker-demux.ts
+var HEADER_BYTES = 8;
+var MAX_FRAME_BYTES = 64 * 1024 * 1024;
+var STREAM_STDIN = 0;
+var STREAM_STDOUT = 1;
+var STREAM_STDERR = 2;
+function gateSink(sink, onBlock, onUnblock, onWriteAfterEnd) {
+  let blocked = false;
+  return {
+    write(chunk) {
+      if (sink.destroyed || sink.writableEnded) return onWriteAfterEnd();
+      if (sink.write(chunk) !== false || blocked) return;
+      blocked = true;
+      onBlock();
+      sink.once("drain", () => {
+        blocked = false;
+        onUnblock();
+      });
+    }
+  };
+}
+function demuxDockerStream(source, stdout, stderr, onError) {
+  const src = source;
+  let blockedSinks = 0;
+  let pausedByUs = false;
+  const onBlock = () => {
+    blockedSinks += 1;
+    if (pausedByUs) return;
+    pausedByUs = true;
+    src.pause();
+  };
+  const onUnblock = () => {
+    blockedSinks -= 1;
+    if (blockedSinks > 0 || !pausedByUs) return;
+    pausedByUs = false;
+    src.resume();
+  };
+  const onWriteAfterEnd = () => fail(
+    new Error(
+      "Docker stream was ended while payload was still arriving: the sink had already closed, so those bytes were dropped. What was written is not a complete artifact."
+    )
+  );
+  const out = gateSink(stdout, onBlock, onUnblock, onWriteAfterEnd);
+  const err = gateSink(stderr, onBlock, onUnblock, onWriteAfterEnd);
+  let carry = null;
+  let failed = false;
+  const fail = (cause) => {
+    if (failed) return;
+    failed = true;
+    carry = null;
+    src.pause();
+    onError?.(cause);
+    stdout.destroy(cause);
+  };
+  src.on("data", (chunk) => {
+    if (failed) return;
+    let buf = carry === null ? chunk : Buffer.concat([carry, chunk]);
+    carry = null;
+    let offset = 0;
+    while (buf.length - offset >= HEADER_BYTES) {
+      const type = buf[offset];
+      const length = buf.readUInt32BE(offset + 4);
+      if (type !== STREAM_STDIN && type !== STREAM_STDOUT && type !== STREAM_STDERR) {
+        fail(
+          new Error(
+            `Docker stream desynchronized: frame type ${type} at offset ${offset} is not stdin/stdout/stderr. Refusing to guess where the payload resumes \u2014 the bytes already read cannot be trusted as a complete artifact.`
+          )
+        );
+        return;
+      }
+      if (length > MAX_FRAME_BYTES) {
+        fail(
+          new Error(
+            `Docker stream desynchronized: frame claims ${length} bytes, over the ${MAX_FRAME_BYTES}-byte sanity ceiling. Treating as a lost frame boundary rather than waiting for input that will never arrive.`
+          )
+        );
+        return;
+      }
+      if (buf.length - offset - HEADER_BYTES < length) break;
+      const payload = buf.subarray(offset + HEADER_BYTES, offset + HEADER_BYTES + length);
+      if (type === STREAM_STDOUT) out.write(payload);
+      else if (type === STREAM_STDERR) err.write(payload);
+      offset += HEADER_BYTES + length;
+    }
+    if (offset < buf.length) {
+      carry = Buffer.from(buf.subarray(offset));
+    }
+  });
+  src.on("error", (cause) => fail(cause));
+  src.on("end", () => {
+    if (failed || carry === null) return;
+    fail(
+      new Error(
+        `Docker stream ended mid-frame with ${carry.length} bytes of an incomplete frame buffered. The payload was cut short, so what was read is not a complete artifact.`
+      )
+    );
+  });
+  return {
+    pending: () => carry !== null || src.readableLength > 0 || blockedSinks > 0
+  };
+}
+
+// ../../packages/adapters/src/backup/executors/docker.ts
 var HELPER_IMAGE = "alpine:3";
+var ARTIFACT_BUFFER_BYTES = 4 * 1024 * 1024;
 var DEFAULT_HELPER_IDLE_MS = 10 * 60 * 1e3;
 var DEFAULT_HELPER_TIMEOUT_MS = 6 * 60 * 60 * 1e3;
 var EXIT_POLL_INTERVAL_MS = 2e3;
+var ATTACH_DRAIN_QUIET_MS = 3e3;
 function createIdleWatchdog(ms, message) {
   let timer;
   let done = false;
@@ -956,9 +1195,6 @@ function destroyQuietly(stream) {
   } catch {
   }
 }
-function shellEscape4(s2) {
-  return `'${s2.replace(/'/g, "'\\''")}'`;
-}
 function compressionFlag(compression) {
   switch (compression) {
     case "gzip":
@@ -988,6 +1224,26 @@ var DockerBackupExecutor = class {
   get dockerode() {
     return this.runtime.docker;
   }
+  /**
+   * Freeze / thaw the target container around a copy — Docker's native cgroup freezer.
+   *
+   * `unpause` is best-effort and deliberately swallows "not paused": the thaw runs from a
+   * `finally`, and a container the daemon already restarted (or that a human unpaused)
+   * must not turn a completed backup into a failed one. `pause` is NOT best-effort — see
+   * streamPath.
+   */
+  async freeze(containerId) {
+    await this.dockerode.getContainer(containerId).pause();
+  }
+  async thaw(containerId, label) {
+    try {
+      await this.dockerode.getContainer(containerId).unpause();
+    } catch (err) {
+      console.error(
+        `[backup] ${label}: could not unpause container ${containerId.slice(0, 12)} after the copy \u2014 the service may still be FROZEN and needs \`docker unpause\`: ${err?.message ?? String(err)}`
+      );
+    }
+  }
   async listSources(service) {
     if (service.containerId) {
       try {
@@ -1007,7 +1263,7 @@ var DockerBackupExecutor = class {
     return service.volumes.map((spec, i2) => {
       const parsed = parseVolumeSpec(spec);
       if (!parsed || !parsed.source) return null;
-      const source = parsed.type === "volume" && service.namespaceVolumes ? scopedVolumeName(service.projectSlug, parsed.source) : parsed.source;
+      const source = parsed.type === "volume" && service.namespaceVolumes ? ensureScopedVolumeName(service.projectSlug, parsed.source) : parsed.source;
       return {
         id: `${source}-${i2}`,
         source,
@@ -1016,6 +1272,31 @@ var DockerBackupExecutor = class {
       };
     }).filter((x2) => x2 !== null);
   }
+  /**
+   * The container's own `Config.Env`, as `KEY=value` pairs already split.
+   *
+   * This is the credentials source for every service Openship did not deploy
+   * itself — see `BackupExecutor.readContainerEnv`. Returns `{}` rather than
+   * throwing on any failure: it is an ENRICHMENT of the handle's env, so a
+   * container that has gone away, or a daemon that refuses the inspect, must leave
+   * the caller exactly as well off as before it asked.
+   */
+  async readContainerEnv(service) {
+    if (!service.containerId) return {};
+    try {
+      const data = await this.dockerode.getContainer(service.containerId).inspect();
+      const pairs = data.Config?.Env ?? [] ?? [];
+      const env = {};
+      for (const pair of pairs) {
+        const eq = pair.indexOf("=");
+        if (eq <= 0) continue;
+        env[pair.slice(0, eq)] = pair.slice(eq + 1);
+      }
+      return env;
+    } catch {
+      return {};
+    }
+  }
   async execStream(service, cmd, opts) {
     if (!service.containerId) {
       throw new Error(
@@ -1031,7 +1312,10 @@ var DockerBackupExecutor = class {
       WorkingDir: opts?.cwd,
       Env: opts?.env ? Object.entries(opts.env).map(([k2, v2]) => `${k2}=${v2}`) : void 0
     });
-    const stream = await exec.start({ stdin: false });
+    const stream = await startExecStream(daemonConnectionFrom(this.dockerode), exec.id, {
+      tty: false,
+      stdin: false
+    });
     return this.attachDemuxed(this.dockerode, exec.id, stream, opts, {
       label: `exec in service ${service.name}`
     });
@@ -1046,9 +1330,9 @@ var DockerBackupExecutor = class {
       throw new Error(`Backup source "${sourceId}" is tmpfs \u2014 not backupable`);
     }
     const compression = opts?.compression ?? "zstd";
-    const excludeArgs = (opts?.exclude ?? []).flatMap((p2) => ["--exclude", shellEscape4(p2)]);
+    const excludeArgs = (opts?.exclude ?? []).flatMap((p2) => ["--exclude", shellQuote(p2)]);
     const tarFlags = compressionFlag(compression);
-    const tarCmd = compression === "zstd" ? `tar -c${tarFlags} -C /mnt ${excludeArgs.join(" ")} . | zstd -c -3` : `tar -c${tarFlags} -C /mnt ${excludeArgs.join(" ")} .`;
+    const tarCmd = `tar -c${tarFlags} -C /mnt ${excludeArgs.join(" ")} .`;
     const helperImage = compression === "zstd" ? "alpine:3" : HELPER_IMAGE;
     await this.ensureImage(helperImage);
     const hostConfig = {
@@ -1068,14 +1352,52 @@ var DockerBackupExecutor = class {
       // the helper exits. Nothing ever reads these logs.
       LogConfig: { Type: "none", Config: {} }
     };
-    return this.handOffHelper(
+    const quiesceId = opts?.quiesce ? service.containerId : null;
+    if (opts?.quiesce && !quiesceId) {
+      throw new Error(
+        `Cannot quiesce service "${service.name}" for a consistent copy: it has no running container to freeze. Either deploy it, or take the copy without quiesce and accept a crash-consistent archive.`
+      );
+    }
+    if (quiesceId) await this.freeze(quiesceId);
+    const handed = await this.handOffHelper(
       {
         Image: helperImage,
-        Cmd: [
-          "sh",
-          "-c",
-          compression === "zstd" ? `apk add --no-cache zstd >/dev/null 2>&1; ${tarCmd}` : tarCmd
-        ],
+        // Built by the SAME helper the DB producers use, for the same reason: a shell
+        // pipeline exits with its LAST command's status, so `tar -c … | zstd` reported
+        // ZSTD's success and a tar that failed mid-archive — a permissions error, a
+        // vanishing file, ENOSPC in the pipe — came back as exit 0 over a truncated
+        // archive that the run then recorded as a complete backup. Closing that for
+        // `pg_dump | zstd` and leaving it here would have been the same bug with a
+        // different payload, and the volume producer is the DEFAULT one.
+        //
+        // gzip and none need no pipeline at all (busybox tar compresses in-process via
+        // `tarFlags`), so those pass `"none"` and keep tar's own status directly.
+        Cmd: safeDumpCommand(
+          tarCmd,
+          compression === "zstd" ? "zstd" : "none",
+          [
+            // REFUSE an empty mount before doing anything else.
+            //
+            // The daemon CREATES a missing bind directory and a missing named volume
+            // when it honors HostConfig.Binds, so a source that is not on this host
+            // produces a helper that starts fine and a `tar -c` of nothing that exits
+            // 0. That archive is ~350 bytes compressed, so the orchestrator's
+            // zero-byte guard passes and the run is recorded as a successful backup —
+            // a nightly green tick over an external disk that failed to mount, a data
+            // directory that was renamed under a still-running container, or a volume
+            // that `docker system prune --volumes` took.
+            //
+            // An intentionally-empty source fails too, which is the deliberate half of
+            // the trade: an archive of nothing is not a restore point either way, and
+            // the operator has `payloadConfig.sourceIds` to narrow the policy. Silence
+            // is the only outcome that cannot be recovered from.
+            `SRC=${shellQuote(sourceId)}`,
+            `[ -n "$(ls -A /mnt 2>/dev/null)" ] || { echo "openship: backup source $SRC is empty or missing on this host, so this archive would contain nothing. Refusing to record it as a backup. If it is a mount, check that it is mounted; if it is empty on purpose, narrow the policy's sourceIds." >&2; exit 91; }`,
+            // zstd is not in alpine:3, so the helper installs it. Second, so a doomed
+            // capture does not pay the ~20s fetch first.
+            compression === "zstd" ? "apk add --no-cache zstd >/dev/null 2>&1" : null
+          ].filter(Boolean).join("\n")
+        ),
         HostConfig: hostConfig,
         AttachStdout: true,
         AttachStderr: true,
@@ -1085,8 +1407,8 @@ var DockerBackupExecutor = class {
         NetworkDisabled: compression !== "zstd"
       },
       async (helper) => {
-        const stream = await helper.attach({
-          stream: true,
+        const stream = await startAttachStream(daemonConnectionFrom(this.dockerode), helper.id, {
+          stdin: false,
           stdout: true,
           stderr: true
         });
@@ -1097,7 +1419,22 @@ var DockerBackupExecutor = class {
           label: `Backup of "${sourceId}" on service ${service.name}`
         });
       }
-    );
+    ).catch(async (err) => {
+      if (quiesceId) await this.thaw(quiesceId, `backup of "${sourceId}"`);
+      throw err;
+    });
+    if (!quiesceId) return handed;
+    return {
+      stdout: handed.stdout,
+      // Thaw when the copy is DONE, however it ends. `awaitExit` settles once the helper
+      // has exited and its output has drained, which is precisely the window the freeze has
+      // to cover; unfreezing when `streamPath` returned would thaw before a single byte had
+      // been read. The original promise is handed back so a caller still sees its value or
+      // its rejection.
+      awaitExit: handed.awaitExit.finally(
+        () => this.thaw(quiesceId, `backup of "${sourceId}"`)
+      )
+    };
   }
   async receiveStream(service, targetSourceId, body, opts) {
     opts?.signal?.throwIfAborted();
@@ -1112,16 +1449,18 @@ var DockerBackupExecutor = class {
     const compression = opts?.compression ?? "zstd";
     const helperImage = compression === "zstd" ? "alpine:3" : HELPER_IMAGE;
     await this.ensureImage(helperImage);
-    const clearCmd = opts?.clearTarget ? `find /mnt -mindepth 1 -delete 2>/dev/null || true; ` : "";
-    const untarCmd = compression === "zstd" ? `${clearCmd}zstd -d -c | tar -x -C /mnt` : `${clearCmd}tar -x${compressionFlag(compression)}f - -C /mnt`;
+    const restoreCodec = compression === "none" ? "none" : compression;
+    const prelude = [
+      compression === "zstd" ? "apk add --no-cache zstd >/dev/null 2>&1 || true" : null,
+      compression === "zstd" ? 'command -v zstd >/dev/null 2>&1 || { echo "openship: zstd is not available in the restore helper and could not be installed (the host may have no egress). Refusing to clear the target: nothing was written and your data is untouched." >&2; exit 90; }' : null,
+      compression === "gzip" ? 'command -v gzip >/dev/null 2>&1 || { echo "openship: gzip is not available in the restore helper. Refusing to clear the target; your data is untouched." >&2; exit 90; }' : null,
+      // Only now, with every tool proven present.
+      opts?.clearTarget ? "find /mnt -mindepth 1 -delete 2>/dev/null || true" : null
+    ].filter(Boolean).join("\n");
     return this.withHelper(
       {
         Image: helperImage,
-        Cmd: [
-          "sh",
-          "-c",
-          compression === "zstd" ? `apk add --no-cache zstd >/dev/null 2>&1; ${untarCmd}` : untarCmd
-        ],
+        Cmd: safeRestoreCommand(restoreCodec, "tar -x -C /mnt", prelude),
         // AutoRemove is OFF deliberately, and this is the fix for the `404 no such
         // container` in #434: with it on, the daemon could reap the helper before
         // /containers/{id}/wait answered, and the exit status was then unknowable.
@@ -1406,47 +1745,69 @@ var DockerBackupExecutor = class {
     const { PassThrough: PassThrough3 } = await import("stream");
     const stdoutSink = new PassThrough3();
     stdoutSink.resume();
+    stdoutSink.on("error", () => {
+    });
     const stderrSink = new PassThrough3();
     stderrSink.on("data", (chunk) => {
       if (stderrChunks.length < 16) stderrChunks.push(chunk);
     });
-    this.dockerode.modem.demuxStream(
-      stream,
-      stdoutSink,
-      stderrSink
-    );
-    const timer = opts?.timeoutMs ? setTimeout(() => {
-      try {
-        stream.end?.();
-      } catch {
-      }
-    }, opts.timeoutMs) : null;
-    return new Promise((resolve3, reject) => {
+    demuxDockerStream(stream, stdoutSink, stderrSink);
+    const stderrTail = () => Buffer.concat(stderrChunks).toString("utf8").slice(0, 16 * 1024);
+    const timeoutMs = opts?.timeoutMs ?? DEFAULT_HELPER_TIMEOUT_MS;
+    let bodyEnded = false;
+    let polling = true;
+    const attachEnded = new Promise((resolve2, reject) => {
       body.on("error", (err) => {
-        if (timer) clearTimeout(timer);
         try {
           stream.end?.();
         } catch {
         }
         reject(err);
       });
+      body.on("end", () => {
+        bodyEnded = true;
+      });
       stream.on("end", async () => {
-        if (timer) clearTimeout(timer);
         try {
-          resolve3({
-            code: await resolveExecExitCode(exec, exec.id),
-            stderr: Buffer.concat(stderrChunks).toString("utf8").slice(0, 16 * 1024)
-          });
+          resolve2({ code: await resolveExecExitCode(exec, exec.id), stderr: stderrTail() });
         } catch (err) {
           reject(err);
         }
       });
-      stream.on("error", (err) => {
-        if (timer) clearTimeout(timer);
-        reject(err);
-      });
+      stream.on("error", (err) => reject(err));
       body.pipe(stream);
     });
+    const polledExit = async () => {
+      while (polling) {
+        await new Promise((r2) => {
+          const t8 = setTimeout(r2, EXIT_POLL_INTERVAL_MS);
+          t8.unref?.();
+        });
+        if (!polling || !bodyEnded) continue;
+        let info;
+        try {
+          info = await exec.inspect();
+        } catch {
+          continue;
+        }
+        if (info.Running === false && typeof info.ExitCode === "number") {
+          return { code: info.ExitCode, stderr: stderrTail() };
+        }
+      }
+      return new Promise(() => {
+      });
+    };
+    try {
+      return await withTimeout(
+        Promise.race([attachEnded, polledExit()]),
+        timeoutMs,
+        `Restore into service ${service.name} exceeded its ${Math.round(timeoutMs / 1e3)}s ceiling and was abandoned. The target may hold partial data.`
+      );
+    } finally {
+      polling = false;
+      destroyQuietly(stream);
+      destroyQuietly(body);
+    }
   }
   async stopService(service) {
     if (!service.containerId) return;
@@ -1485,13 +1846,18 @@ var DockerBackupExecutor = class {
     const label = meta?.label ?? "exec";
     const idleMs = opts?.idleTimeoutMs ?? DEFAULT_HELPER_IDLE_MS;
     const timeoutMs = opts?.timeoutMs ?? DEFAULT_HELPER_TIMEOUT_MS;
-    const stdout = new PassThrough();
+    const stdout = new PassThrough({ highWaterMark: ARTIFACT_BUFFER_BYTES });
     const stderrChunks = [];
     const stderrSink = new PassThrough();
     stderrSink.on("data", (chunk) => {
       if (stderrChunks.length < 16) stderrChunks.push(chunk);
     });
-    docker.modem.demuxStream(stream, stdout, stderrSink);
+    let demuxError = null;
+    let rejectExit = null;
+    demuxDockerStream(stream, stdout, stderrSink, (err) => {
+      demuxError ??= err;
+      rejectExit?.(err);
+    });
     let sinksEnded = false;
     const endSinks = () => {
       if (sinksEnded) return;
@@ -1506,11 +1872,15 @@ var DockerBackupExecutor = class {
       `${label} produced no data for ${Math.round(idleMs / 1e3)}s and was abandoned.`
     );
     stream.on("data", () => watchdog.touch());
+    stdout.on("drain", () => watchdog.touch());
     const awaitExit = (async () => {
-      const onEnd = new Promise((resolve3, reject) => {
+      const onEnd = new Promise((resolve2, reject) => {
+        rejectExit = reject;
+        if (demuxError) reject(demuxError);
         stream.on("end", async () => {
+          if (demuxError) return reject(demuxError);
           try {
-            resolve3({
+            resolve2({
               code: await resolveExecExitCode(docker.getExec(execId), execId),
               stderr: Buffer.concat(stderrChunks).toString("utf8").slice(0, 16 * 1024)
             });
@@ -1528,21 +1898,33 @@ var DockerBackupExecutor = class {
         );
       } catch (err) {
         stdout.destroy(err);
+        destroyQuietly(stream);
         throw err;
       } finally {
         watchdog.dispose();
       }
     })();
+    void awaitExit.catch(() => {
+    });
     return { stdout, awaitExit };
   }
   demuxContainerStream(container, stream, opts) {
-    const stdout = new PassThrough();
+    const stdout = new PassThrough({ highWaterMark: ARTIFACT_BUFFER_BYTES });
     const stderrChunks = [];
     const stderrSink = new PassThrough();
     stderrSink.on("data", (chunk) => {
       if (stderrChunks.length < 16) stderrChunks.push(chunk);
     });
-    container.modem.demuxStream(stream, stdout, stderrSink);
+    let demuxError = null;
+    const demux = demuxDockerStream(
+      stream,
+      stdout,
+      stderrSink,
+      (err) => {
+        demuxError = err;
+      }
+    );
+    let lastProgressAt = Date.now();
     let sinksEnded = false;
     let exited = false;
     const reapIfDone = () => {
@@ -1562,7 +1944,14 @@ var DockerBackupExecutor = class {
       opts.idleTimeoutMs,
       `${opts.label} produced no data for ${Math.round(opts.idleTimeoutMs / 1e3)}s and was abandoned. Nothing was written; the archive is incomplete and was not kept.`
     );
-    stream.on("data", () => watchdog.touch());
+    stream.on("data", () => {
+      lastProgressAt = Date.now();
+      watchdog.touch();
+    });
+    stdout.on("drain", () => {
+      lastProgressAt = Date.now();
+      watchdog.touch();
+    });
     const awaitExit = (async () => {
       try {
         const res = await this.awaitHelperExit(container, watchdog, () => sinksEnded, {
@@ -1571,8 +1960,19 @@ var DockerBackupExecutor = class {
           note: "Nothing was written; the archive is incomplete and was not kept."
         });
         exited = true;
-        setTimeout(endSinks, 3e3);
+        const armEndBackstop = () => {
+          const timer = setTimeout(() => {
+            if (sinksEnded) return;
+            if (Date.now() - lastProgressAt < ATTACH_DRAIN_QUIET_MS || demux.pending()) {
+              return armEndBackstop();
+            }
+            endSinks();
+          }, ATTACH_DRAIN_QUIET_MS);
+          timer.unref?.();
+        };
+        armEndBackstop();
         reapIfDone();
+        if (demuxError) throw demuxError;
         return {
           code: res.StatusCode,
           stderr: Buffer.concat(stderrChunks).toString("utf8").slice(0, 16 * 1024)
@@ -1630,10 +2030,23 @@ var CloudBackupExecutor = class {
     const ws = this.client.workspace(service.containerId);
     const rt = await ws.runtime();
     const fullCmd = this.composeShellCommand(cmd, opts);
-    const stdout = new Readable2({ read() {
-    } });
+    let resumeRead = null;
+    const stdout = new Readable2({
+      read() {
+        const resume = resumeRead;
+        resumeRead = null;
+        resume?.();
+      }
+    });
+    const pushWithBackpressure = async (chunk) => {
+      if (stdout.push(chunk)) return;
+      if (stdout.destroyed) return;
+      await new Promise((resolve2) => {
+        resumeRead = resolve2;
+      });
+    };
     let stderrBuf = "";
-    const awaitExit = new Promise((resolve3, reject) => {
+    const awaitExit = new Promise((resolve2, reject) => {
       const timer = opts?.timeoutMs ? setTimeout(() => {
         stdout.destroy(new Error(`exec timed out after ${opts.timeoutMs}ms`));
         reject(new Error(`exec timed out after ${opts.timeoutMs}ms`));
@@ -1647,7 +2060,7 @@ var CloudBackupExecutor = class {
           for await (const ev of stream) {
             switch (ev.event) {
               case "stdout":
-                stdout.push(Buffer.from(ev.data, "base64"));
+                await pushWithBackpressure(Buffer.from(ev.data, "base64"));
                 break;
               case "stderr": {
                 const decoded = Buffer.from(ev.data, "base64").toString("utf8");
@@ -1666,11 +2079,15 @@ var CloudBackupExecutor = class {
           }
           stdout.push(null);
           if (timer) clearTimeout(timer);
-          resolve3({ code: exitCode, stderr: stderrBuf });
+          resolve2({ code: exitCode, stderr: stderrBuf });
         } catch (err) {
           if (timer) clearTimeout(timer);
           stdout.destroy(err);
           reject(err);
+        } finally {
+          const resume = resumeRead;
+          resumeRead = null;
+          resume?.();
         }
       };
       void pump();
@@ -1680,9 +2097,9 @@ var CloudBackupExecutor = class {
   /** Bake env + cwd into a shell command since Oblien's ExecRunParams
    *  doesn't carry them. */
   composeShellCommand(cmd, opts) {
-    const envPrefix = opts?.env ? Object.entries(opts.env).map(([k2, v2]) => `${k2}=${shellEscape5(v2)}`).join(" ") + " " : "";
-    const cwdPrefix = opts?.cwd ? `cd ${shellEscape5(opts.cwd)} && ` : "";
-    const quotedCmd = cmd.map((arg) => shellEscape5(arg)).join(" ");
+    const envPrefix = opts?.env ? Object.entries(opts.env).map(([k2, v2]) => `${k2}=${shellQuote(v2)}`).join(" ") + " " : "";
+    const cwdPrefix = opts?.cwd ? `cd ${shellQuote(opts.cwd)} && ` : "";
+    const quotedCmd = cmd.map((arg) => shellQuote(arg)).join(" ");
     return ["sh", "-c", `${cwdPrefix}${envPrefix}${quotedCmd}`];
   }
   async streamPath(service, sourceId, opts) {
@@ -1690,10 +2107,13 @@ var CloudBackupExecutor = class {
     const compression = opts?.compression ?? "zstd";
     const excludeArgs = (opts?.exclude ?? []).flatMap((p2) => [
       "--exclude",
-      shellEscape5(p2)
+      shellQuote(p2)
     ]);
-    const tarCmd = compression === "zstd" ? `tar -c -C ${shellEscape5(path)} ${excludeArgs.join(" ")} . | zstd -c -3` : compression === "gzip" ? `tar -cz -C ${shellEscape5(path)} ${excludeArgs.join(" ")} .` : `tar -c -C ${shellEscape5(path)} ${excludeArgs.join(" ")} .`;
-    return this.execStream(service, ["sh", "-c", tarCmd]);
+    const tarCmd = compression === "gzip" ? `tar -cz -C ${shellQuote(path)} ${excludeArgs.join(" ")} .` : `tar -c -C ${shellQuote(path)} ${excludeArgs.join(" ")} .`;
+    return this.execStream(
+      service,
+      safeDumpCommand(tarCmd, compression === "zstd" ? "zstd" : "none")
+    );
   }
   async receiveStream(service, targetSourceId, body, opts) {
     if (!service.containerId) {
@@ -1730,7 +2150,7 @@ var CloudBackupExecutor = class {
       body,
       dest: tmpPath
     });
-    const wrapped = `${this.composeShellCommand(cmd, opts).slice(2).join(" ")} < ${shellEscape5(tmpPath)}; ec=$?; rm -f ${shellEscape5(tmpPath)}; exit $ec`;
+    const wrapped = `${this.composeShellCommand(cmd, opts).slice(2).join(" ")} < ${shellQuote(tmpPath)}; ec=$?; rm -f ${shellQuote(tmpPath)}; exit $ec`;
     const result = await this.execStream(service, ["sh", "-c", wrapped]);
     result.stdout.resume();
     return result.awaitExit;
@@ -1758,9 +2178,6 @@ var CloudBackupExecutor = class {
     }
   }
 };
-function shellEscape5(s2) {
-  return `'${s2.replace(/'/g, "'\\''")}'`;
-}
 registerExecutor("cloud", (runtime) => {
   if (!(runtime instanceof CloudRuntime)) {
     throw new Error(
@@ -1775,7 +2192,9 @@ import { pipeline } from "stream/promises";
 import { createWriteStream, promises as fs } from "fs";
 import { randomBytes as randomBytes2 } from "crypto";
 import { tmpdir } from "os";
-import { join as join2 } from "path";
+import { join } from "path";
+var DEFAULT_RESTORE_TIMEOUT_MS = 6 * 60 * 60 * 1e3;
+var KILL_GRACE_MS = 3e4;
 var BareBackupExecutor = class {
   constructor(runtime) {
     this.runtime = runtime;
@@ -1823,22 +2242,33 @@ var BareBackupExecutor = class {
     const compression = opts?.compression ?? "zstd";
     const excludeArgs = (opts?.exclude ?? []).flatMap((p2) => [
       "--exclude",
-      shellEscape6(p2)
+      shellQuote(p2)
     ]);
     const path = sourceId;
-    const tarCmd = compression === "zstd" ? `tar -c -C ${shellEscape6(path)} ${excludeArgs.join(" ")} . | zstd -c -3` : compression === "gzip" ? `tar -cz -C ${shellEscape6(path)} ${excludeArgs.join(" ")} .` : `tar -c -C ${shellEscape6(path)} ${excludeArgs.join(" ")} .`;
+    const tarCmd = compression === "zstd" ? `tar -c -C ${shellQuote(path)} ${excludeArgs.join(" ")} . | zstd -c -3` : compression === "gzip" ? `tar -cz -C ${shellQuote(path)} ${excludeArgs.join(" ")} .` : `tar -c -C ${shellQuote(path)} ${excludeArgs.join(" ")} .`;
     return this.execStream(service, ["sh", "-c", tarCmd], { timeoutMs: opts?.timeoutMs });
   }
   async receiveStream(service, targetSourceId, body, opts) {
     const compression = opts?.compression ?? "zstd";
-    const decompress = compression === "zstd" ? "zstd -d | " : compression === "gzip" ? "gzip -d | " : "";
-    const clear = opts?.clearTarget ? `rm -rf ${shellEscape6(targetSourceId)}/* ${shellEscape6(targetSourceId)}/.[!.]* 2>/dev/null; ` : "";
-    const cmd = `${clear}mkdir -p ${shellEscape6(targetSourceId)}; ${decompress}tar -x -C ${shellEscape6(targetSourceId)}`;
+    const tool = compression === "zstd" ? "zstd" : compression === "gzip" ? "gzip" : null;
+    const prelude = [
+      `mkdir -p ${shellQuote(targetSourceId)}`,
+      tool ? `command -v ${tool} >/dev/null 2>&1 || { echo "openship: '${tool}' is not installed on this host, so the artifact cannot be decompressed. Refusing to clear the target: nothing was written and your data is untouched." >&2; exit 90; }` : null,
+      // Only now, with the decompressor proven present.
+      opts?.clearTarget ? `rm -rf ${shellQuote(targetSourceId)}/* ${shellQuote(targetSourceId)}/.[!.]* 2>/dev/null || true` : null
+    ].filter(Boolean).join("\n");
+    const cmd = safeRestoreCommand(
+      compression === "none" ? "none" : compression,
+      `tar -x -C ${shellQuote(targetSourceId)}`,
+      prelude
+    );
     let bytesWritten = 0;
     body.on("data", (chunk) => {
       bytesWritten += chunk.byteLength;
     });
-    const exit = await this.pipeIntoCommand(service, ["sh", "-c", cmd], body);
+    const exit = await this.pipeIntoCommand(service, cmd, body, {
+      timeoutMs: opts?.timeoutMs
+    });
     if (exit.code !== 0) {
       throw new Error(
         `receiveStream tar-extract exited ${exit.code}: ${exit.stderr.slice(0, 500)}`
@@ -1849,19 +2279,34 @@ var BareBackupExecutor = class {
   async pipeIntoCommand(service, cmd, body, opts) {
     const exec = this.executor();
     const id = randomBytes2(6).toString("hex");
-    const localDir = join2(tmpdir(), `openship-bare-restore-${id}`);
-    const localFile = join2(localDir, "artifact.bin");
+    const localDir = join(tmpdir(), `openship-bare-restore-${id}`);
+    const localFile = join(localDir, "artifact.bin");
     const remoteDir = `/tmp/openship-bare-restore-${id}`;
     const remoteFile = `${remoteDir}/artifact.bin`;
+    const timeoutMs = opts?.timeoutMs ?? DEFAULT_RESTORE_TIMEOUT_MS;
+    const ceiling = () => `Restore into ${service.name} exceeded its ${Math.round(timeoutMs / 1e3)}s ceiling and was abandoned. The target may hold partial data.`;
+    if (exec.execWithInput) {
+      const run = exec.execWithInput(`sh -c ${shellQuote(shellScript(cmd, opts))}`, body);
+      const result = await withTimeout(run, timeoutMs, ceiling()).catch((err) => {
+        body.destroy();
+        throw err;
+      });
+      return { code: result.code, stderr: result.stderr };
+    }
+    const deadline = Date.now() + timeoutMs;
+    const remaining = () => Math.max(1e3, deadline - Date.now());
     await fs.mkdir(localDir, { recursive: true });
     try {
-      await pipeline(body, createWriteStream(localFile));
-      await exec.transferIn(localDir, remoteDir);
-      const wrapped = `${composeShell(cmd, opts).replace(/^sh -c /, "")} < ${shellEscape6(remoteFile)}`;
-      const runner = `sh -c ${shellEscape6(wrapped)}; ec=$?; rm -rf ${shellEscape6(remoteDir)}; exit $ec`;
-      const { stdout, awaitExit } = await this.execStream(service, ["sh", "-c", runner], opts);
+      await withTimeout(pipeline(body, createWriteStream(localFile)), remaining(), ceiling());
+      await withTimeout(exec.transferIn(localDir, remoteDir), remaining(), ceiling());
+      const wrapped = `${shellScript(cmd, opts)} < ${shellQuote(remoteFile)}`;
+      const runner = `sh -c ${shellQuote(wrapped)}; ec=$?; rm -rf ${shellQuote(remoteDir)}; exit $ec`;
+      const { stdout, awaitExit } = await this.execStream(service, ["sh", "-c", runner], {
+        ...opts,
+        timeoutMs: remaining()
+      });
       stdout.resume();
-      return await awaitExit;
+      return await withTimeout(awaitExit, remaining() + KILL_GRACE_MS, ceiling());
     } finally {
       await fs.rm(localDir, { recursive: true, force: true }).catch(() => {
       });
@@ -1878,14 +2323,14 @@ var BareBackupExecutor = class {
     return true;
   }
 };
-function composeShell(cmd, opts) {
-  const envPrefix = opts?.env ? Object.entries(opts.env).map(([k2, v2]) => `${k2}=${shellEscape6(v2)}`).join(" ") + " " : "";
-  const cwdPrefix = opts?.cwd ? `cd ${shellEscape6(opts.cwd)} && ` : "";
-  const inner = cmd.length >= 3 && cmd[0] === "sh" && cmd[1] === "-c" ? cmd.slice(2).join(" ") : cmd.map((a2) => shellEscape6(a2)).join(" ");
-  return `sh -c ${shellEscape6(`${cwdPrefix}${envPrefix}${inner}`)}`;
+function shellScript(cmd, opts) {
+  const envPrefix = opts?.env ? Object.entries(opts.env).map(([k2, v2]) => `${k2}=${shellQuote(v2)}`).join(" ") + " " : "";
+  const cwdPrefix = opts?.cwd ? `cd ${shellQuote(opts.cwd)} && ` : "";
+  const inner = cmd.length >= 3 && cmd[0] === "sh" && cmd[1] === "-c" ? cmd.slice(2).join(" ") : cmd.map((a2) => shellQuote(a2)).join(" ");
+  return `${cwdPrefix}${envPrefix}${inner}`;
 }
-function shellEscape6(s2) {
-  return `'${s2.replace(/'/g, "'\\''")}'`;
+function composeShell(cmd, opts) {
+  return `sh -c ${shellQuote(shellScript(cmd, opts))}`;
 }
 registerExecutor("bare", (runtime) => {
   if (!(runtime instanceof BareRuntime)) {
@@ -1899,7 +2344,7 @@ registerExecutor("bare", (runtime) => {
 // ../../packages/adapters/src/backup/destinations/local.ts
 import { createHash as createHash4, randomBytes as randomBytes3 } from "crypto";
 import { createReadStream, createWriteStream as createWriteStream2, promises as fs2 } from "fs";
-import { dirname, join as join3, normalize, posix, resolve } from "path";
+import { dirname, join as join2, normalize, posix, resolve } from "path";
 import { pipeline as pipeline2 } from "stream";
 import { promisify } from "util";
 var pipelineP = promisify(pipeline2);
@@ -1911,24 +2356,64 @@ var LocalDestinationImpl = class {
   kind = "local";
   capabilities = CAPS;
   root;
+  /**
+   * Where artifacts written BEFORE `pathPrefix` moved out of the key builder live, or
+   * null when this destination has no prefix and the two are the same place.
+   */
+  legacyRoot;
   constructor(row) {
     if (!row.endpoint) {
       throw new Error(`LocalDestination "${row.name}" has no endpoint (root path) configured`);
     }
-    this.root = resolve(row.endpoint);
+    const base = resolve(row.endpoint);
+    const prefix = (row.pathPrefix ?? "").replace(/^\/+|\/+$/g, "");
+    this.root = prefix ? resolve(base, prefix) : base;
+    this.legacyRoot = prefix ? base : null;
   }
   resolveKey(key) {
     const normalized = normalize(key);
     if (normalized.startsWith("..") || normalized.includes(`${normalize("../")}`)) {
       throw new Error(`Invalid key (traversal): ${key}`);
     }
-    return join3(this.root, normalized);
+    return join2(this.root, normalized);
+  }
+  /**
+   * The path to READ `key` from, preferring the current layout and falling back to the
+   * pre-prefix one.
+   *
+   * A run captured before this change recorded a key that already CONTAINS the prefix
+   * (the key builder put it there), and its bytes sit at `endpoint/<prefix>/<key…>` —
+   * which is `legacyRoot + key`, not `root + key`. Resolving it against the new root
+   * would look for `endpoint/<prefix>/<prefix>/…` and find nothing, so an existing
+   * restore point would quietly become unrestorable.
+   *
+   * Deliberately an existence check rather than a "does the key already start with the
+   * prefix" string test: the key builder's first literal segment is `openship`, so a
+   * destination whose prefix is also `openship` would make that test ambiguous. The
+   * filesystem is not ambiguous. Reads only — `put` always writes the current layout,
+   * so this shim shrinks to nothing as old runs age out of retention.
+   */
+  async resolveKeyForRead(key) {
+    const current = this.resolveKey(key);
+    if (this.legacyRoot === null) return current;
+    try {
+      await fs2.access(current);
+      return current;
+    } catch {
+      const legacy = join2(this.legacyRoot, normalize(key));
+      try {
+        await fs2.access(legacy);
+        return legacy;
+      } catch {
+        return current;
+      }
+    }
   }
   async preflight() {
     try {
       await fs2.mkdir(this.root, { recursive: true });
       const probeKey = `.openship-probe-${randomBytes3(6).toString("hex")}`;
-      const probePath = join3(this.root, probeKey);
+      const probePath = join2(this.root, probeKey);
       await fs2.writeFile(probePath, "ok");
       await fs2.readFile(probePath);
       await fs2.unlink(probePath);
@@ -1970,12 +2455,11 @@ var LocalDestinationImpl = class {
     return { bytesWritten, etag: digest };
   }
   async get(key) {
-    const path = this.resolveKey(key);
-    return createReadStream(path);
+    return createReadStream(await this.resolveKeyForRead(key));
   }
   async head(key) {
     try {
-      const stat = await fs2.stat(this.resolveKey(key));
+      const stat = await fs2.stat(await this.resolveKeyForRead(key));
       return {
         sizeBytes: stat.size,
         uploadedAt: stat.mtime
@@ -1987,7 +2471,7 @@ var LocalDestinationImpl = class {
     }
   }
   async list(prefix, opts) {
-    const root2 = this.resolveKey(prefix);
+    const root2 = await this.resolveKeyForRead(prefix);
     const entries = [];
     const limit = opts?.limit ?? 1e3;
     async function walk(dir, relBase) {
@@ -2002,7 +2486,7 @@ var LocalDestinationImpl = class {
       for (const dirent of dirents) {
         if (entries.length >= limit) return;
         const childRel = posix.join(relBase, dirent.name);
-        const childAbs = join3(dir, dirent.name);
+        const childAbs = join2(dir, dirent.name);
         if (dirent.isDirectory()) {
           await walk(childAbs, childRel);
         } else if (dirent.isFile()) {
@@ -2020,7 +2504,7 @@ var LocalDestinationImpl = class {
   }
   async delete(key) {
     try {
-      await fs2.unlink(this.resolveKey(key));
+      await fs2.unlink(await this.resolveKeyForRead(key));
     } catch (err) {
       const e2 = err;
       if (e2?.code !== "ENOENT") throw err;
@@ -11672,7 +12156,7 @@ var defaultProvider = (init = {}) => memoizeChain([
   },
   async (awsIdentityProperties) => {
     init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromIni");
-    const { fromIni } = await import("./dist-es-ZP5QDSJ3.js");
+    const { fromIni } = await import("./dist-es-AXFRS7PS.js");
     return fromIni(init)(awsIdentityProperties);
   },
   async (awsIdentityProperties) => {
@@ -11724,14 +12208,14 @@ var readableStreamHasher = (hashCtor, readableStream) => {
   const hash = new hashCtor();
   const hashCalculator = new HashCalculator(hash);
   readableStream.pipe(hashCalculator);
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve2, reject) => {
     readableStream.on("error", (err) => {
       hashCalculator.end();
       reject(err);
     });
     hashCalculator.on("error", reject);
     hashCalculator.on("finish", () => {
-      hash.digest().then(resolve3).catch(reject);
+      hash.digest().then(resolve2).catch(reject);
     });
   });
 };
@@ -12587,7 +13071,7 @@ to input.params.ContentLength in bytes.
     }
   }
   async __abortTimeout(abortSignal) {
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve2, reject) => {
       abortSignal.onabort = () => {
         const abortError = new Error("Upload aborted.");
         abortError.name = "AbortError";
@@ -12751,7 +13235,22 @@ var CAPS2 = /* @__PURE__ */ new Set([
 ]);
 var PRESIGN_TTL_DEFAULT = 60 * 60;
 var MULTIPART_PART_SIZE = 16 * 1024 * 1024;
-var MULTIPART_QUEUE_SIZE = 4;
+var MULTIPART_MEMORY_BUDGET = 64 * 1024 * 1024;
+var MULTIPART_MAX_PARTS = 9e3;
+var UNKNOWN_SIZE_PART_SIZE = 32 * 1024 * 1024;
+function partSizeFor(sizeBytes) {
+  if (!sizeBytes || sizeBytes <= 0) return UNKNOWN_SIZE_PART_SIZE;
+  return Math.max(MULTIPART_PART_SIZE, Math.ceil(sizeBytes / MULTIPART_MAX_PARTS));
+}
+function queueSizeFor(partSize) {
+  return Math.max(1, Math.floor(MULTIPART_MEMORY_BUDGET / partSize));
+}
+function partLimitCeiling(partSize) {
+  return partSize * MULTIPART_MAX_PARTS;
+}
+function gib(bytes) {
+  return Math.round(bytes / (1024 * 1024 * 1024));
+}
 var S3DestinationImpl = class {
   kind = "s3_compatible";
   capabilities = CAPS2;
@@ -12804,6 +13303,7 @@ var S3DestinationImpl = class {
   }
   async put(key, body, opts) {
     const fullKey = this.fullKey(key);
+    const partSize = partSizeFor(opts.size);
     const upload = new Upload({
       client: this.client,
       params: {
@@ -12813,15 +13313,34 @@ var S3DestinationImpl = class {
         ContentType: opts.contentType ?? "application/octet-stream",
         Metadata: opts.metadata
       },
-      partSize: MULTIPART_PART_SIZE,
-      queueSize: MULTIPART_QUEUE_SIZE,
+      // Derived, not fixed — see partSizeFor. An artifact whose size we know never trips
+      // S3's 10,000-part limit; one we don't (a DB dump has no sizeHint) gets
+      // UNKNOWN_SIZE_PART_SIZE, whose ceiling is enforced below rather than discovered
+      // at CompleteMultipartUpload.
+      partSize,
+      queueSize: queueSizeFor(partSize),
       leavePartsOnError: false
     });
+    const ceiling = partLimitCeiling(partSize);
     let bytesWritten = 0;
+    let ceilingError = null;
     upload.on("httpUploadProgress", (progress) => {
       if (typeof progress.loaded === "number") bytesWritten = progress.loaded;
+      if (!ceilingError && bytesWritten > ceiling) {
+        ceilingError = new Error(
+          `Artifact exceeds what one S3 multipart upload can hold at this part size: ${gib(bytesWritten)} GiB transferred, ceiling ${gib(ceiling)} GiB (${MULTIPART_MAX_PARTS} parts \xD7 ${Math.round(partSize / (1024 * 1024))} MiB). Aborted early rather than failing at CompleteMultipartUpload after transferring everything. A source whose size is known scales its part size automatically; a streamed database dump cannot, so this artifact needs to be split or sent to a destination without a part limit.`
+        );
+        void upload.abort().catch(() => {
+        });
+      }
     });
-    const result = await upload.done();
+    let result;
+    try {
+      result = await upload.done();
+    } catch (err) {
+      if (ceilingError) throw ceilingError;
+      throw err;
+    }
     return {
       bytesWritten,
       etag: result.ETag?.replace(/"/g, "") ?? void 0
@@ -12956,6 +13475,7 @@ var CAPS3 = /* @__PURE__ */ new Set([
 ]);
 var UPLOAD_STALL_TIMEOUT_MS = 10 * 60 * 1e3;
 var UPLOAD_STALL_PROBE_MS = 30 * 1e3;
+var UPLOAD_BUFFER_BYTES = 8 * 1024 * 1024;
 var SftpDestinationImpl = class {
   kind;
   capabilities = CAPS3;
@@ -13003,7 +13523,7 @@ var SftpDestinationImpl = class {
   // ── Connection helper ────────────────────────────────────────────────
   async withSftp(fn) {
     const client = new Client2();
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve2, reject) => {
       const cleanup = () => {
         try {
           client.end();
@@ -13020,7 +13540,7 @@ var SftpDestinationImpl = class {
           fn(sftp).then(
             (val) => {
               cleanup();
-              resolve3(val);
+              resolve2(val);
             },
             (e2) => {
               cleanup();
@@ -13040,12 +13560,12 @@ var SftpDestinationImpl = class {
     let current = dir.startsWith("/") ? "" : ".";
     for (const part of parts) {
       current = current === "" ? `/${part}` : posix2.join(current, part);
-      await new Promise((resolve3, reject) => {
+      await new Promise((resolve2, reject) => {
         sftp.mkdir(current, (err) => {
-          if (!err) return resolve3();
+          if (!err) return resolve2();
           sftp.stat(current, (statErr, stats) => {
             if (statErr) return reject(err);
-            if (stats.isDirectory()) return resolve3();
+            if (stats.isDirectory()) return resolve2();
             reject(new Error(`${current} exists but is not a directory`));
           });
         });
@@ -13059,14 +13579,14 @@ var SftpDestinationImpl = class {
       await this.withSftp(async (sftp) => {
         await this.ensureDir(sftp, this.rootPath);
         const probePath = posix2.join(this.rootPath, probeName);
-        await new Promise((resolve3, reject) => {
+        await new Promise((resolve2, reject) => {
           const ws = sftp.createWriteStream(probePath);
           ws.on("error", reject);
-          ws.on("close", () => resolve3());
+          ws.on("close", () => resolve2());
           ws.end("ok");
         });
         await new Promise(
-          (resolve3, reject) => sftp.unlink(probePath, (err) => err ? reject(err) : resolve3())
+          (resolve2, reject) => sftp.unlink(probePath, (err) => err ? reject(err) : resolve2())
         );
       });
       return { ok: true };
@@ -13083,21 +13603,25 @@ var SftpDestinationImpl = class {
     let bytesWritten = 0;
     await this.withSftp(async (sftp) => {
       await this.ensureDir(sftp, posix2.dirname(target));
-      await new Promise((resolve3, reject) => {
-        const ws = sftp.createWriteStream(tmp);
+      await new Promise((resolve2, reject) => {
+        const ws = sftp.createWriteStream(tmp, { highWaterMark: UPLOAD_BUFFER_BYTES });
         let lastProgressAt = Date.now();
         let settled = false;
         let watchdog;
+        const onSettled = [];
         const finish = (err) => {
           if (settled) return;
           settled = true;
           if (watchdog) clearInterval(watchdog);
+          for (const stop of onSettled) stop();
+          const acked = ws.bytesWritten ?? 0;
+          if (acked > bytesWritten) bytesWritten = acked;
           if (err) {
             ws.destroy();
             body.destroy();
             reject(err);
           } else {
-            resolve3();
+            resolve2();
           }
         };
         watchdog = setInterval(() => {
@@ -13111,21 +13635,25 @@ var SftpDestinationImpl = class {
         watchdog.unref?.();
         ws.on("error", (err) => finish(err));
         ws.on("close", () => finish());
-        body.on("data", (chunk) => {
-          bytesWritten += chunk.byteLength;
+        const trackProgress = setInterval(() => {
+          const acked = ws.bytesWritten ?? 0;
+          if (acked <= bytesWritten) return;
+          bytesWritten = acked;
           lastProgressAt = Date.now();
-        });
+        }, 1e3);
+        trackProgress.unref?.();
+        onSettled.push(() => clearInterval(trackProgress));
         body.on("error", (err) => finish(err));
         body.pipe(ws);
       });
-      await new Promise((resolve3, reject) => {
+      await new Promise((resolve2, reject) => {
         sftp.rename(tmp, target, (err) => {
-          if (!err) return resolve3();
+          if (!err) return resolve2();
           sftp.unlink(target, () => {
             sftp.rename(
               tmp,
               target,
-              (err2) => err2 ? reject(err2) : resolve3()
+              (err2) => err2 ? reject(err2) : resolve2()
             );
           });
         });
@@ -13172,14 +13700,14 @@ var SftpDestinationImpl = class {
     const target = this.fullPath(key);
     try {
       return await this.withSftp(
-        (sftp) => new Promise((resolve3, reject) => {
+        (sftp) => new Promise((resolve2, reject) => {
           sftp.stat(target, (err, stats) => {
             if (err) {
               const code = err.code;
-              if (code === 2) return resolve3(null);
+              if (code === 2) return resolve2(null);
               return reject(err);
             }
-            resolve3({
+            resolve2({
               sizeBytes: stats.size,
               uploadedAt: new Date(stats.mtime * 1e3)
             });
@@ -13196,14 +13724,14 @@ var SftpDestinationImpl = class {
     const entries = [];
     await this.withSftp(async (sftp) => {
       const walk = async (dir, relBase) => {
-        const dirents = await new Promise((resolve3, reject) => {
+        const dirents = await new Promise((resolve2, reject) => {
           sftp.readdir(dir, (err, list) => {
             if (err) {
               const code = err.code;
-              if (code === 2) return resolve3([]);
+              if (code === 2) return resolve2([]);
               return reject(err);
             }
-            resolve3(list);
+            resolve2(list);
           });
         });
         for (const dirent of dirents) {
@@ -13229,10 +13757,10 @@ var SftpDestinationImpl = class {
     const target = this.fullPath(key);
     await this.withSftp(
       (sftp) => new Promise(
-        (resolve3, reject) => sftp.unlink(target, (err) => {
-          if (!err) return resolve3();
+        (resolve2, reject) => sftp.unlink(target, (err) => {
+          if (!err) return resolve2();
           const code = err.code;
-          if (code === 2) return resolve3();
+          if (code === 2) return resolve2();
           reject(err);
         })
       )
@@ -13244,11 +13772,11 @@ var SftpDestinationImpl = class {
     const failed = [];
     await this.withSftp(async (sftp) => {
       for (const key of keys) {
-        await new Promise((resolve3) => {
+        await new Promise((resolve2) => {
           sftp.unlink(this.fullPath(key), (err) => {
             if (!err) {
               deleted.push(key);
-              return resolve3();
+              return resolve2();
             }
             const code = err.code;
             if (code === 2) {
@@ -13256,7 +13784,7 @@ var SftpDestinationImpl = class {
             } else {
               failed.push({ key, error: err.message });
             }
-            resolve3();
+            resolve2();
           });
         });
       }
@@ -13280,1609 +13808,39 @@ function startUnitHint(unit) {
   return pasteable(thisHost().serviceEnableStart(unit));
 }
 
-// src/lib/from-source.ts
-import { spawn, spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
-import { join as join4, resolve as resolve2 } from "path";
-var DEFAULT_REPO = "https://github.com/oblien/openship.git";
-var SOURCE_CHECKOUT_DIR = join4(OS_DIR, "src");
-var SOURCE_DIST_DIR = join4(OS_DIR, "from-source-dist");
-function has(cmd) {
-  try {
-    return spawnSync2(cmd, ["--version"], { stdio: "ignore" }).status === 0;
-  } catch {
-    return false;
-  }
-}
-function run(cmd, args, cwd, env) {
-  return new Promise((res, rej) => {
-    const child = spawn(cmd, args, {
-      cwd,
-      stdio: "inherit",
-      // Windows resolves the bun/git shims (.cmd/.exe) only through a shell.
-      shell: process.platform === "win32",
-      env: env ? { ...process.env, ...env } : process.env
-    });
-    child.on("error", rej);
-    child.on(
-      "exit",
-      (code) => code === 0 ? res() : rej(new Error(`\`${cmd} ${args.join(" ")}\` (cwd=${cwd}) exited ${code ?? "?"}`))
-    );
-  });
-}
-function shortSha(cwd) {
-  const r2 = spawnSync2("git", ["rev-parse", "--short", "HEAD"], { cwd, encoding: "utf8" });
-  return r2.status === 0 ? (r2.stdout ?? "").trim() || "unknown" : "unknown";
-}
-function isMonorepo(dir) {
-  return existsSync2(join4(dir, "package.json")) && existsSync2(join4(dir, "apps/api/package.json")) && existsSync2(join4(dir, "apps/dashboard/package.json"));
+// src/lib/compose-env.ts
+import { existsSync, readFileSync } from "fs";
+import { join as join3 } from "path";
+var COMPOSE_DIR = join3(OS_DIR, "compose");
+var COMPOSE_FILE = join3(COMPOSE_DIR, "docker-compose.yml");
+var COMPOSE_ENV_FILE = join3(COMPOSE_DIR, ".env");
+function composeInstallExists() {
+  return existsSync(COMPOSE_FILE);
 }
-async function prepareFromSource(opts) {
-  if (!has("bun")) {
-    throw new Error(
-      "`bun` is required to build from source but wasn't found on PATH \u2014 install it: https://bun.sh"
-    );
-  }
-  let sourceDir;
-  let ref;
-  if (opts.source) {
-    sourceDir = resolve2(opts.source);
-    if (!isMonorepo(sourceDir)) {
-      throw new Error(
-        `--source ${sourceDir} doesn't look like an Openship checkout (missing package.json / apps/api / apps/dashboard).`
-      );
-    }
-    ref = "local";
-  } else {
-    if (!has("git")) {
-      throw new Error("`git` is required to clone the source but wasn't found on PATH.");
-    }
-    ref = (opts.ref || "main").trim();
-    const repoUrl = opts.repo || DEFAULT_REPO;
-    sourceDir = SOURCE_CHECKOUT_DIR;
-    mkdirSync2(OS_DIR, { recursive: true });
-    if (!existsSync2(join4(sourceDir, ".git"))) {
-      console.log(`  Cloning ${repoUrl} \u2192 ${sourceDir}`);
-      await run("git", ["clone", repoUrl, sourceDir], OS_DIR);
-    }
-    console.log(`  Fetching + checking out ${ref}`);
-    await run("git", ["fetch", "origin", ref, "--tags"], sourceDir);
-    await run("git", ["checkout", ref], sourceDir);
-    await run("git", ["pull", "--ff-only", "origin", ref], sourceDir).catch(() => {
-      console.log("  (pinned ref \u2014 not fast-forwarding)");
-    });
-  }
-  const sha = shortSha(sourceDir);
-  console.log(`  Source: ${sourceDir} @ ${ref} (${sha})`);
-  console.log("  Installing workspace dependencies (bun install)\u2026");
-  await run("bun", ["install"], sourceDir);
-  const distDir = SOURCE_DIST_DIR;
-  console.log("  Building release dist (compiles the dashboard \u2014 needs RAM/CPU)\u2026");
-  await run(
-    "bun",
-    ["run", join4(sourceDir, "apps/api/scripts/build-release.ts")],
-    sourceDir,
-    { DIST_DIR: distDir, NODE_ENV: "production", CLOUD_MODE: "false", OPENSHIP_TARGET: "local" }
-  );
-  console.log("  Installing runtime dependencies in the dist\u2026");
-  await run("bun", ["install", "--production", "--frozen-lockfile"], distDir);
-  const apiDir = join4(distDir, "api");
-  const dashboardDir = join4(distDir, "dashboard");
-  if (!existsSync2(join4(apiDir, "src/index.ts"))) {
-    throw new Error(`Build produced no API at ${apiDir}/src/index.ts \u2014 build-release layout drift?`);
-  }
-  if (!existsSync2(join4(dashboardDir, "apps/dashboard/server.js"))) {
-    throw new Error(`Build produced no dashboard at ${dashboardDir}/apps/dashboard/server.js.`);
-  }
-  return { apiDir, dashboardDir, ref, sha, sourceDir };
-}
-
-// src/lib/compose.ts
-import { spawn as spawn2, spawnSync as spawnSync4 } from "child_process";
-import { randomBytes as randomBytes5 } from "crypto";
-import {
-  chmodSync,
-  existsSync as existsSync4,
-  mkdirSync as mkdirSync3,
-  readFileSync as readFileSync3,
-  renameSync,
-  rmSync,
-  writeFileSync as writeFileSync2
-} from "fs";
-import { homedir, userInfo } from "os";
-import { dirname as dirname2, join as join6 } from "path";
-
-// src/lib/source-install.ts
-import { spawnSync as spawnSync3 } from "child_process";
-import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
-import { join as join5 } from "path";
-var MARKER = join5(OS_DIR, "source-install.json");
-function parseSourceInstall(raw) {
-  try {
-    const obj = JSON.parse(raw);
-    if (!obj || typeof obj.dir !== "string" || !obj.dir) return null;
-    return { repo: obj.repo || DEFAULT_REPO, ref: obj.ref || "main", dir: obj.dir };
-  } catch {
-    return null;
-  }
-}
-function readSourceInstall() {
-  if (!existsSync3(MARKER)) return null;
-  try {
-    return parseSourceInstall(readFileSync2(MARKER, "utf8"));
-  } catch {
-    return null;
-  }
-}
-function parseRemoteSha(stdout) {
-  const sha = stdout.split("\n")[0]?.trim().split(/\s+/)[0];
-  return sha && /^[0-9a-f]{7,40}$/i.test(sha) ? sha.slice(0, 7) : null;
-}
-function remoteSha(repo, ref) {
-  const r2 = spawnSync3("git", ["ls-remote", repo, ref], { encoding: "utf8" });
-  if (r2.status !== 0 || !r2.stdout) return null;
-  return parseRemoteSha(r2.stdout);
-}
-async function rebuildFromSource(info) {
-  if (!has("bun")) {
-    throw new Error("`bun` is required to rebuild from source but wasn't found on PATH \u2014 https://bun.sh");
-  }
-  if (!has("git")) {
-    throw new Error("`git` is required to update the source checkout but wasn't found on PATH.");
-  }
-  if (!existsSync3(join5(info.dir, ".git"))) {
-    throw new Error(
-      `Source checkout ${info.dir} is missing (no .git) \u2014 reinstall from source with scripts/install-source.sh.`
-    );
-  }
-  await run("git", ["fetch", "origin", info.ref, "--tags"], info.dir);
-  await run("git", ["checkout", info.ref], info.dir);
-  await run("git", ["pull", "--ff-only", "origin", info.ref], info.dir).catch(() => {
-  });
-  const cliDir = join5(info.dir, "apps/cli");
-  await run("bun", ["install"], info.dir);
-  await run("bun", ["run", "build"], cliDir);
-  await run("bun", ["run", "build/stage-dashboard.ts"], cliDir);
-  return shortSha(info.dir);
-}
-
-// src/lib/compose.ts
-var EDGE_SITES_HOST_DIR = `${EDGE_HOST_STATE_DIR}/sites-enabled`;
-var EDGE_ACME_HOST_DIR = `${EDGE_HOST_STATE_DIR}/acme`;
-function edgeVolumeYaml(indent) {
-  return EDGE_CONTAINER_MOUNTS.map((m2) => `${indent}- ${m2.host}:${m2.container}:z`).join("\n");
-}
-var COMPOSE_DIR = join6(OS_DIR, "compose");
-var INSTALL_METHOD_FILE = join6(OS_DIR, "install-method");
-var COMPOSE_FILE = join6(COMPOSE_DIR, "docker-compose.yml");
-var BUILD_FILE = join6(COMPOSE_DIR, "docker-compose.build.yml");
-var ENV_FILE = join6(COMPOSE_DIR, ".env");
-var ENV_BACKUP_FILE = join6(COMPOSE_DIR, ".env.bak");
-var ENV_TMP_FILE = join6(COMPOSE_DIR, ".env.tmp");
-var BUILT_SERVICES = [
-  { service: "api", dockerfile: "apps/api/Dockerfile" },
-  { service: "dashboard", dockerfile: "apps/dashboard/Dockerfile" },
-  { service: "edge", dockerfile: "apps/edge/Dockerfile" }
-];
-var ENV_CONSUMING_SERVICES = ["api", "dashboard", "edge"];
-function readInstallMethod() {
-  try {
-    const v2 = readFileSync3(INSTALL_METHOD_FILE, "utf8").trim();
-    return v2 === "compose" || v2 === "bare" ? v2 : null;
-  } catch {
-    return null;
-  }
-}
-function writeInstallMethod(method) {
-  mkdirSync3(OS_DIR, { recursive: true, mode: 448 });
-  writeFileSync2(INSTALL_METHOD_FILE, method, { mode: 384 });
-}
-function dockerState() {
-  const ok = (args) => spawnSync4("docker", args, { stdio: "ignore" }).status === 0;
-  if (!ok(["--version"])) return { binary: false, plugin: false, daemon: false };
-  return { binary: true, plugin: ok(["compose", "version"]), daemon: ok(["version"]) };
-}
-function dockerGap(state = dockerState()) {
-  if (!state.binary) {
-    return { summary: "Docker isn't installed", installable: true };
-  }
-  if (!state.plugin) {
-    return {
-      summary: "Docker is installed but the Compose plugin (`docker compose`) is missing",
-      installable: true
-    };
-  }
-  if (!state.daemon) {
-    const start = pasteable(thisHost().dockerStart());
-    return {
-      summary: "Docker is installed but its daemon isn't reachable",
-      // Reinstalling changes nothing: a group change only applies to NEW logins,
-      // and a stopped daemon needs starting, not installing.
-      installable: false,
-      hint: thisHost().profile.isRoot ? start ? `Start it with: ${start}` : "Start the Docker daemon \u2014 this host has no service manager Openship recognizes." : `Add your user to the docker group: sudo usermod -aG docker ${userInfo().username} \u2014 then log out and back in (or run: newgrp docker). If the daemon is stopped: ${start ?? "start it the way this host starts services"}`
-    };
-  }
-  return null;
-}
-function hasDockerCompose() {
-  return dockerGap() === null;
-}
-function hasCmd(cmd) {
-  return spawnSync4(cmd, ["--version"], { stdio: "ignore" }).status === 0;
-}
-function shQuote(s2) {
-  return `'${s2.replace(/'/g, `'\\''`)}'`;
-}
-function dockerInstallPreview(state = dockerState()) {
-  const gap = dockerGap(state);
-  if (!gap) return { state, gap: null, wouldInstall: false };
-  if (process.platform !== "linux" || !gap.installable) return { state, gap, wouldInstall: false };
-  const plan = systemCatalog.installs.docker(resolveLocalEnvironmentSync());
-  if (!plan.supported) return { state, gap, wouldInstall: false, unsupportedReason: plan.reason };
-  const start = plan.value.service;
-  return {
-    state,
-    gap,
-    wouldInstall: true,
-    installCommand: plan.value.installCommand,
-    ...start?.supported ? { startCommand: start.value } : {},
-    ...start && !start.supported ? { startBlockedReason: start.reason } : {}
-  };
-}
-async function ensureDocker(opts = {}) {
-  const notice = opts.onNotice ?? ((line) => process.stderr.write(`  ${line}
-`));
-  const { state, gap, wouldInstall, installCommand, startCommand, unsupportedReason, startBlockedReason } = dockerInstallPreview();
-  if (!gap) return true;
-  if (process.platform !== "linux") return false;
-  if (!gap.installable) {
-    notice(gap.summary + ".");
-    if (gap.hint) notice(gap.hint);
-    return false;
-  }
-  if (!wouldInstall || !installCommand) {
-    if (unsupportedReason) notice(unsupportedReason);
-    return false;
-  }
-  const asRoot = typeof process.getuid === "function" && process.getuid() === 0;
-  const sudo = !asRoot && hasCmd("sudo") ? "sudo " : "";
-  notice("This can take 2-5 minutes on a small VPS (~150 MB of packages) and stays quiet while apt works.");
-  if (state.binary) {
-    notice("Docker's installer will warn that docker already exists and pause ~20s before continuing \u2014 that's expected.");
-  }
-  const sh = (script) => new Promise((resolve3) => {
-    const child = spawn2("sh", ["-c", sudo ? `${sudo}sh -c ${shQuote(script)}` : script], {
-      stdio: "inherit"
-    });
-    const started = Date.now();
-    const tick = setInterval(() => {
-      const s2 = Math.round((Date.now() - started) / 1e3);
-      notice(`still installing Docker \u2014 ${Math.floor(s2 / 60)}m${String(s2 % 60).padStart(2, "0")}s elapsed\u2026`);
-    }, 3e4);
-    const done = (code) => {
-      clearInterval(tick);
-      resolve3(code);
-    };
-    child.on("error", () => done(1));
-    child.on("close", (code) => done(code ?? 1));
-  });
-  if (await sh(installCommand) !== 0) return false;
-  if (startCommand) await sh(startCommand);
-  else if (startBlockedReason) notice(startBlockedReason);
-  const after = dockerGap();
-  if (!after) {
-    notice("Docker ready.");
-    return true;
-  }
-  notice(after.summary + ".");
-  if (after.hint) notice(after.hint);
-  return false;
-}
-var COMPOSE_YAML = `# Managed by \`openship up\` \u2014 do not edit; re-run \`openship up\` to regenerate.
-services:
-  postgres:
-    image: postgres:16-alpine
-    restart: unless-stopped
-    environment:
-      # Keep the data dir in a subdirectory of the volume so a fresh install never
-      # runs initdb against a bare mount root (which fails on quirky host
-      # filesystems with EPERM \u2014 #350). OPENSHIP_PGDATA is decided ONCE at install
-      # by the CLI (fresh \u2192 subdir, pre-existing volume \u2192 root) and preserved in
-      # .env, so this never moves an existing database.
-      PGDATA: \${OPENSHIP_PGDATA:-/var/lib/postgresql/data/pgdata}
-      POSTGRES_USER: \${POSTGRES_USER:-openship}
-      POSTGRES_PASSWORD: \${POSTGRES_PASSWORD:?missing from .env \u2014 re-run openship up to regenerate it}
-      POSTGRES_DB: \${POSTGRES_DB:-openship}
-    expose: ["5432"]
-    volumes: [postgres_data:/var/lib/postgresql/data]
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U \${POSTGRES_USER:-openship} -d \${POSTGRES_DB:-openship}"]
-      interval: 5s
-      timeout: 3s
-      retries: 12
-
-  redis:
-    image: redis:7-alpine
-    restart: unless-stopped
-    command: ["redis-server", "--appendonly", "yes"]
-    expose: ["6379"]
-    volumes: [redis_data:/data]
-    healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
-      interval: 5s
-      timeout: 3s
-      retries: 12
-
-  api:
-    image: \${OPENSHIP_IMAGE_REGISTRY:-ghcr.io/oblien}/openship-api:\${OPENSHIP_VERSION:-latest}
-    restart: unless-stopped
-    # Loopback by default \u2014 the host-net edge reaches it over loopback, so nothing
-    # sits on a public interface. OPENSHIP_BIND_ADDR opts into a public/LAN interface
-    # (set by \`openship up\` when a public URL is configured for off-box access).
-    ports: ["\${OPENSHIP_BIND_ADDR:-127.0.0.1}:\${API_PORT:-4000}:\${API_PORT:-4000}"]
-    volumes:
-      # The daemon socket, at the path the api's own default expects INSIDE the
-      # container. The HOST side is a variable because it MOVES: a rootless daemon
-      # keeps its socket under the invoking user's runtime dir, and Docker creates a
-      # missing bind source as an empty DIRECTORY instead of failing \u2014 so the rootful
-      # path there brings the stack up and then fails every container operation in
-      # the transport, naming neither the path nor the cause (#482). \`openship up\`
-      # writes OPENSHIP_DOCKER_SOCKET when the detected path isn't this default.
-      - \${OPENSHIP_DOCKER_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock
-      # Routing state shared with the edge, as HOST BIND MOUNTS (generated from
-      # EDGE_CONTAINER_MOUNTS): the vhost tree, /etc/letsencrypt, the ACME webroot
-      # and the static doc-roots the API writes and the edge serves. Named volumes
-      # hid all of it from every host-side reader (migrate's proxy scan, cert carry,
-      # cert reuse, mail cert symlinks), each of which then silently saw "nothing".
-${edgeVolumeYaml("      ")}
-      # Host-op SSH key (createHostExecutor \u2192 host.docker.internal). /dev/null
-      # when the host channel isn't provisioned \u2192 OPENSHIP_HOST_SSH_HOST stays
-      # unset, and host operations REFUSE (they'd otherwise run against this
-      # container's filesystem, #509) while ordinary deploys keep working over
-      # the socket below.
-      - \${OPENSHIP_HOST_KEY_PATH:-/dev/null}:/run/secrets/openship_host_key:ro
-    # \`host-gateway\` is resolved by the daemon and is right on a stock rootful
-    # install. It is NOT universally right: under rootless Docker it lands in
-    # RootlessKit's namespace rather than the host's, so the host's sshd isn't
-    # there (#482). OPENSHIP_HOST_GATEWAY re-points the alias (e.g. at the box's
-    # LAN address) without patching this file, which \`openship up\` rewrites.
-    extra_hosts: ["host.docker.internal:\${OPENSHIP_HOST_GATEWAY:-host-gateway}"]
-    env_file: [.env]
-    environment:
-      NODE_ENV: production
-      PORT: "\${API_PORT:-4000}"
-      DATABASE_URL: postgresql://\${POSTGRES_USER:-openship}:\${POSTGRES_PASSWORD:?missing from .env \u2014 re-run openship up to regenerate it}@postgres:5432/\${POSTGRES_DB:-openship}
-      REDIS_URL: redis://redis:6379
-      OPENSHIP_EDGE_MODE: docker
-      OPENSHIP_EDGE_CONTAINER: openship-edge
-    depends_on:
-      postgres: { condition: service_healthy }
-      redis: { condition: service_healthy }
-    healthcheck:
-      test: ["CMD-SHELL", "bun -e \\"fetch('http://127.0.0.1:\${API_PORT:-4000}/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\\""]
-      interval: 10s
-      timeout: 5s
-      retries: 12
-      start_period: 40s
-
-  dashboard:
-    image: \${OPENSHIP_IMAGE_REGISTRY:-ghcr.io/oblien}/openship-dashboard:\${OPENSHIP_VERSION:-latest}
-    restart: unless-stopped
-    # Loopback by default (see api note); OPENSHIP_BIND_ADDR opts into a public interface.
-    ports: ["\${OPENSHIP_BIND_ADDR:-127.0.0.1}:\${DASHBOARD_PORT:-3001}:\${DASHBOARD_PORT:-3001}"]
-    env_file: [.env]
-    environment:
-      NODE_ENV: production
-      PORT: "\${DASHBOARD_PORT:-3001}"
-      INTERNAL_API_URL: http://api:\${API_PORT:-4000}
-    depends_on:
-      api: { condition: service_healthy }
-
-  edge:
-    image: \${OPENSHIP_IMAGE_REGISTRY:-ghcr.io/oblien}/openship-edge:\${OPENSHIP_VERSION:-latest}
-    # PINNED, and it must stay pinned: the api reaches the edge by NAME through
-    # DockerEdgeExecutor (OPENSHIP_EDGE_CONTAINER above), and "ours" edge
-    # detection greps \`docker ps --filter name=openship-edge\`. Without this,
-    # compose derives \`<project>-edge-1\` from the directory and every
-    # \`docker exec\` into the edge fails with "No such container: openship-edge" \u2014
-    # which silently migrated 0 sites after the operator's proxy was stopped.
-    # Safe here: the edge is a singleton (host networking, one per box).
-    container_name: openship-edge
-    restart: unless-stopped
-    network_mode: host
-    volumes:
-${edgeVolumeYaml("      ")}
-
-volumes:
-  postgres_data:
-  redis_data:
-`;
-function keepSecret(existing, key) {
-  return existing[key] || randomBytes5(32).toString("hex");
-}
-var GENERATED_SECRET_KEYS = ["POSTGRES_PASSWORD", "BETTER_AUTH_SECRET", "INTERNAL_TOKEN"];
-function survivingDbVolume(prev) {
-  const candidates = /* @__PURE__ */ new Set([prev.COMPOSE_PROJECT_NAME, "openship", "compose"]);
-  for (const project of candidates) {
-    if (project && dbVolumeExists(project)) return `${project}_postgres_data`;
-  }
-  return null;
-}
-function secretRotationRisk(prev) {
-  const keys = GENERATED_SECRET_KEYS.filter((k2) => !prev[k2]);
-  if (keys.length === 0) return null;
-  const volume = survivingDbVolume(prev);
-  return volume ? { volume, keys: [...keys] } : null;
-}
-function composeSecretRotationRisk(opts = {}) {
-  if (opts.resetSecrets) return null;
-  return secretRotationRisk(readEnvFile());
-}
-function renderSecretRotationRefusal(rotation, opts = {}) {
-  return `
-  ${opts.dryRun ? "A real run would REFUSE here" : "Refusing to continue"}: this would regenerate secrets your existing install already has.
-
-    missing from ${ENV_FILE}:  ${rotation.keys.join(", ")}
-    but this install's data is still here:  ${rotation.volume}
-
-  A new POSTGRES_PASSWORD cannot match that volume \u2014 Postgres only applies the password
-  when it first creates the data directory \u2014 and a new BETTER_AUTH_SECRET cannot decrypt
-  the environment variables already stored in the database. Nothing has been written yet.
-
-` + secretRecoveryAdvice(rotation);
-}
-function secretRecoveryAdvice(rotation) {
-  const adopted = adoptedStack(projectOfDbVolume(rotation.volume));
-  if (adopted) {
-    return `  This stack was not created by \`openship up\`: it is already running under the compose
-  project name we pin, so this run would ADOPT it.
-
-    project:      ${adopted.project}
-    started from: ${adopted.configFiles || "an unlabelled `docker run`"}
-    not from:     ${COMPOSE_FILE}
-
-  So there is no \`.env\` of ours to restore and no backup of one \u2014 the real values are in
-  the api container's own environment. Copy them out of it, then re-run:
-
-    echo 'COMPOSE_PROJECT_NAME=${adopted.project}' >> ${ENV_FILE}
-    docker inspect ${adopted.apiContainer} --format '{{range .Config.Env}}{{println .}}{{end}}' \\
-      | grep -E '^(${rotation.keys.join("|")})=' >> ${ENV_FILE}
-
-  COMPOSE_PROJECT_NAME matters as much as the secrets do: it is the volume prefix, so
-  without it this stack comes up on empty volumes beside the data above.
-
-  Only if that container is gone and the values exist nowhere else \u2014 this DESTROYS them,
-  leaving every environment variable stored in the database permanently unreadable:
-    openship up --reset-secrets
-`;
-  }
-  return `  Put the original values back and re-run:
-` + (existsSync4(ENV_BACKUP_FILE) ? `    cp ${ENV_BACKUP_FILE} ${ENV_FILE}     # the .env a previous \`openship up\` replaced
-` : `    restore ${ENV_FILE} from a backup, or copy the keys above out of one
-`) + `  If the file is there but this user can't read it, re-run as the user that owns it
-  (or as root) rather than letting the secrets be regenerated.
-
-  To reset instead \u2014 the database password gets realigned, but every stored environment
-  variable becomes permanently unreadable:
-    openship up --reset-secrets
-`;
-}
-function projectOfDbVolume(volume) {
-  return volume.replace(/_postgres_data$/, "");
-}
-function readEnvFile() {
-  const out = {};
+function readComposeEnvFile() {
   let text;
   try {
-    text = readFileSync3(ENV_FILE, "utf8");
+    text = readFileSync(COMPOSE_ENV_FILE, "utf8");
   } catch (err) {
-    if (err.code !== "ENOENT") {
-      console.log(
-        `  ! Could not read ${ENV_FILE}: ${err.message}
-    Its contents are being treated as absent. If this install already exists, fix the permissions and re-run rather than letting secrets be regenerated.`
-      );
-    }
-    return out;
+    const code = err.code;
+    return { env: {}, unreadable: code === "ENOENT" ? null : err.message };
   }
+  const env = {};
   for (const line of text.split("\n")) {
     const m2 = line.match(/^([A-Z0-9_]+)=(.*)$/);
-    if (m2) out[m2[1]] = m2[2];
+    if (m2) env[m2[1]] = m2[2];
   }
-  return out;
+  return { env, unreadable: null };
 }
-var HOST_CHANNEL_DEFAULT_HOST = "host.docker.internal";
-var HOST_CHANNEL_DEFAULT_PORT = 22;
-var HOST_KEY_COMMENT = "openship-host-executor";
-var HOST_KEY_FROM = "172.16.0.0/12,192.168.0.0/16,10.0.0.0/8,127.0.0.1";
-function hostKeyAuthLine(pub) {
-  return `from="${HOST_KEY_FROM}",restrict,pty ${pub}`;
-}
-function rewriteHostAuthorizedKeys(existing, pub) {
-  return [...keptForeignKeys(existing), hostKeyAuthLine(pub)].join("\n") + "\n";
-}
-function keptForeignKeys(existing) {
-  return existing.split("\n").filter((line) => line.trim() && !line.includes(HOST_KEY_COMMENT));
-}
-function stripHostAuthorizedKeys(existing) {
-  const kept = keptForeignKeys(existing);
-  return kept.length ? kept.join("\n") + "\n" : "";
-}
-var ROOT_AUTHORIZED_KEYS = "/root/.ssh/authorized_keys";
-function chooseHostChannelUser(input) {
-  if (input.invokerUid === 0) {
-    return { user: "root", authKeysPath: ROOT_AUTHORIZED_KEYS, viaSudo: false, rootUnavailable: false };
-  }
-  if (input.hasPasswordlessSudo) {
-    return { user: "root", authKeysPath: ROOT_AUTHORIZED_KEYS, viaSudo: true, rootUnavailable: false };
-  }
-  return {
-    user: input.invokerName,
-    authKeysPath: join6(input.invokerHome, ".ssh", "authorized_keys"),
-    viaSudo: false,
-    rootUnavailable: true
-  };
-}
-function hasPasswordlessSudo() {
-  try {
-    return spawnSync4("sudo", ["-n", "true"], { stdio: "ignore" }).status === 0;
-  } catch {
-    return false;
-  }
-}
-function plannedHostChannel(hostControl) {
-  if (!hostControl || process.platform !== "linux") return null;
-  let invoker;
-  try {
-    const info = userInfo();
-    invoker = { uid: info.uid, username: info.username, home: info.homedir };
-  } catch {
-    invoker = { uid: -1, username: process.env.USER || process.env.LOGNAME || "root", home: homedir() };
-  }
-  const decision = chooseHostChannelUser({
-    invokerUid: invoker.uid,
-    invokerName: invoker.username,
-    invokerHome: invoker.home,
-    // Only probe sudo when it could change the outcome — a root invoker never needs it.
-    hasPasswordlessSudo: invoker.uid !== 0 && hasPasswordlessSudo()
-  });
-  return { ...decision, keyPath: join6(COMPOSE_DIR, "host-ssh", "id_ed25519") };
-}
-function authorizeKeyAt(authKeysPath, pub) {
-  mkdirSync3(dirname2(authKeysPath), { recursive: true, mode: 448 });
-  const existing = existsSync4(authKeysPath) ? readFileSync3(authKeysPath, "utf8") : "";
-  const next = rewriteHostAuthorizedKeys(existing, pub);
-  if (next !== existing) writeFileSync2(authKeysPath, next, { mode: 384 });
-  chmodSync(authKeysPath, 384);
-}
-function authorizeRootKeyViaSudo(pub) {
-  const mk = spawnSync4("sudo", ["-n", "sh", "-c", "mkdir -p /root/.ssh && chmod 700 /root/.ssh"], {
-    stdio: "ignore"
-  });
-  if (mk.status !== 0) return false;
-  const read = spawnSync4(
-    "sudo",
-    ["-n", "sh", "-c", `cat ${ROOT_AUTHORIZED_KEYS} 2>/dev/null || true`],
-    { encoding: "utf8" }
-  );
-  if (read.status !== 0) return false;
-  const next = rewriteHostAuthorizedKeys(read.stdout ?? "", pub);
-  const write = spawnSync4("sudo", ["-n", "tee", ROOT_AUTHORIZED_KEYS], {
-    input: next,
-    stdio: ["pipe", "ignore", "ignore"]
-  });
-  if (write.status !== 0) return false;
-  return spawnSync4("sudo", ["-n", "chmod", "600", ROOT_AUTHORIZED_KEYS], { stdio: "ignore" }).status === 0;
-}
-function revokeKeyAt(authKeysPath) {
-  try {
-    if (!existsSync4(authKeysPath)) return true;
-    const existing = readFileSync3(authKeysPath, "utf8");
-    if (!existing.includes(HOST_KEY_COMMENT)) return true;
-    writeFileSync2(authKeysPath, stripHostAuthorizedKeys(existing), { mode: 384 });
-    chmodSync(authKeysPath, 384);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function revokeRootKeyViaSudo() {
-  const read = spawnSync4(
-    "sudo",
-    ["-n", "sh", "-c", `cat ${ROOT_AUTHORIZED_KEYS} 2>/dev/null || true`],
-    { encoding: "utf8" }
-  );
-  if (read.status !== 0) return false;
-  const existing = read.stdout ?? "";
-  if (!existing.includes(HOST_KEY_COMMENT)) return true;
-  const write = spawnSync4("sudo", ["-n", "tee", ROOT_AUTHORIZED_KEYS], {
-    input: stripHostAuthorizedKeys(existing),
-    stdio: ["pipe", "ignore", "ignore"]
-  });
-  return write.status === 0;
-}
-function retireHostSshChannel(prev) {
-  const keyDir = join6(COMPOSE_DIR, "host-ssh");
-  if (!existsSync4(keyDir) && !prev.OPENSHIP_HOST_SSH_HOST) return;
-  const invokerKeys = join6(homedir(), ".ssh", "authorized_keys");
-  const asRoot = (prev.OPENSHIP_HOST_SSH_USER?.trim() || "root") === "root";
-  const weAreRoot = typeof process.getuid === "function" && process.getuid() === 0;
-  const revoked = asRoot ? weAreRoot ? revokeKeyAt(ROOT_AUTHORIZED_KEYS) : hasPasswordlessSudo() && revokeRootKeyViaSudo() : revokeKeyAt(invokerKeys);
-  const alsoInvoker = asRoot ? revokeKeyAt(invokerKeys) : true;
-  try {
-    rmSync(keyDir, { recursive: true, force: true });
-  } catch {
-  }
-  const stuck = asRoot ? ROOT_AUTHORIZED_KEYS : invokerKeys;
-  console.log(
-    revoked && alsoInvoker ? "  Host control off: dropped OPENSHIP_HOST_SSH_* from .env, deleted the host key and\n  revoked its authorized_keys line." : `  Host control off: dropped OPENSHIP_HOST_SSH_* from .env and deleted the host key (it
-  can no longer be used). Removing its line needs root \u2014 run:
-  sudo sed -i '/${HOST_KEY_COMMENT}/d' ${stuck}`
-  );
-}
-function provisionHostSshChannel(cfg) {
-  const target = plannedHostChannel(cfg.hostControl);
-  if (!target) return { channel: null };
-  const { user, keyPath, authKeysPath, viaSudo, rootUnavailable } = target;
-  const provisioned = (channel) => {
-    const port = toPort(cfg.hostSshPort) ?? HOST_CHANNEL_DEFAULT_PORT;
-    return probeHostSshd(port) === "absent" ? { channel, issue: { code: "no-sshd", detail: `port ${port}` } } : { channel };
-  };
-  try {
-    mkdirSync3(join6(COMPOSE_DIR, "host-ssh"), { recursive: true, mode: 448 });
-    if (!existsSync4(keyPath)) {
-      const g2 = spawnSync4(
-        "ssh-keygen",
-        ["-t", "ed25519", "-N", "", "-q", "-f", keyPath, "-C", HOST_KEY_COMMENT],
-        // stderr is captured rather than discarded: it is the only account of why the
-        // channel is missing, and the caller prints it.
-        { encoding: "utf8", stdio: ["ignore", "ignore", "pipe"] }
-      );
-      if (g2.status !== 0) return { channel: null, issue: { code: "keygen", detail: keygenWhy(g2) } };
-    }
-    const pub = readFileSync3(`${keyPath}.pub`, "utf8").trim();
-    if (!pub) return { channel: null, issue: { code: "empty-key" } };
-    if (rootUnavailable) {
-      console.warn(
-        "  \u26A0 Host control needs root, but this user isn't root and passwordless sudo isn't\n    available. Mail and edge host operations will fail. Re-run `openship up` as root\n    (or enable passwordless sudo) to fix. Continuing with a limited host channel."
-      );
-      authorizeKeyAt(authKeysPath, pub);
-      return provisioned({ user, keyPath });
-    }
-    if (viaSudo) {
-      if (!authorizeRootKeyViaSudo(pub)) {
-        console.warn(
-          "  \u26A0 Could not authorize the host key for root via sudo \u2014 falling back to the\n    current user. Root host operations (mail/edge) may fail."
-        );
-        const invoker = userInfo().username;
-        authorizeKeyAt(join6(homedir(), ".ssh", "authorized_keys"), pub);
-        return provisioned({ user: invoker, keyPath });
-      }
-      revokeKeyAt(join6(homedir(), ".ssh", "authorized_keys"));
-      return provisioned({ user, keyPath });
-    }
-    authorizeKeyAt(authKeysPath, pub);
-    return provisioned({ user, keyPath });
-  } catch (err) {
-    return { channel: null, issue: { code: "error", detail: err?.message } };
-  }
-}
-function keygenWhy(r2) {
-  if (r2.error?.code === "ENOENT") {
-    return "ssh-keygen is not installed \u2014 the openssh-client package provides it";
-  }
-  const stderr = (r2.stderr ?? "").trim().split("\n").pop();
-  return stderr || r2.error?.message || `ssh-keygen exited ${r2.status ?? "abnormally"}`;
-}
-function probeHostSshd(port) {
-  for (const [cmd, args] of [
-    ["ss", ["-H", "-ltn"]],
-    ["netstat", ["-ltn"]]
-  ]) {
-    const r2 = spawnSync4(cmd, [...args], { encoding: "utf8" });
-    if (r2.status !== 0 || !r2.stdout) continue;
-    return listensOnPort(r2.stdout, port) ? "listening" : "absent";
-  }
-  return "unknown";
-}
-function listensOnPort(listing, port) {
-  return listing.split("\n").filter((line) => /\bLISTEN\b/.test(line)).some(
-    (line) => line.trim().split(/\s+/).some((token) => token.endsWith(`:${port}`))
-  );
-}
-function carriedHostChannel(prev) {
-  const keyPath = prev.OPENSHIP_HOST_KEY_PATH?.trim();
-  if (!prev.OPENSHIP_HOST_SSH_HOST?.trim() || !keyPath || !existsSync4(keyPath)) return null;
-  return { user: prev.OPENSHIP_HOST_SSH_USER?.trim() || "root", keyPath };
-}
-var HOST_ISSUE_INDENT = "    ";
-function hostIssueNote(text) {
-  return wrapText(text, 80).map((l2) => `${HOST_ISSUE_INDENT}${l2}
-`).join("");
-}
-function renderHostChannelIssue(issue, ctx) {
-  const detail = issue.detail ? ` (${issue.detail})` : "";
-  const headline = issue.code === "no-sshd" ? `  \u26A0 Host control is provisioned, but nothing on this host is listening for SSH${detail}.` : `  \u26A0 Host control could NOT be provisioned on this box.`;
-  let cause;
-  switch (issue.code) {
-    case "keygen":
-      cause = `The channel's key could not be generated${detail}.`;
-      break;
-    case "empty-key":
-      cause = "The channel's key was generated but its public half read back empty.";
-      break;
-    case "no-sshd":
-      cause = `The api container now has a key and an address, and will be refused the first time it dials ${ctx.target}:
-` + explainHostChannelCause("refused", {
-        target: ctx.target,
-        // Measured here rather than left to core's default, which is Debian's `ssh` —
-        // a unit name that does not exist on the RHEL family, so the remedy printed on
-        // an Amazon Linux box was a command that silently does nothing.
-        sshdEnableHint: thisHost().sshdEnableHint()
-      }).body;
-      break;
-    case "error":
-      cause = `Setting up the channel's key failed${detail}.`;
-      break;
-  }
-  const continuity = issue.code === "no-sshd" ? "" : ctx.kept ? hostIssueNote(
-    "Kept the host channel this install already had in `.env` rather than dropping it: its key is still authorized, so the api container keeps the access it had instead of losing it to this failure."
-  ) : hostIssueNote(
-    "OPENSHIP_HOST_SSH_HOST is therefore unset, and host operations refuse rather than run against the api container's own filesystem."
-  );
-  return `${headline}
-` + hostIssueNote(cause) + continuity + hostIssueNote(HOST_CHANNEL_UNAFFECTED) + `${HOST_ISSUE_INDENT}Unavailable until the channel works:
-` + HOST_CHANNEL_BLOCKED.map((l2) => `${HOST_ISSUE_INDENT}  \xB7 ${l2}
-`).join("") + hostIssueNote(HOST_CHANNEL_RECHECK);
-}
-function composeProjectName(prev) {
-  if (prev.COMPOSE_PROJECT_NAME) return prev.COMPOSE_PROJECT_NAME;
-  return Object.keys(prev).length > 0 ? "compose" : "openship";
-}
-var PGDATA_ROOT = "/var/lib/postgresql/data";
-function probePgDataDir(volume) {
-  const r2 = spawnSync4(
-    "docker",
-    [
-      "run",
-      "--rm",
-      "-v",
-      `${volume}:/from:ro`,
-      "alpine:3",
-      "sh",
-      "-c",
-      `if [ -f /from/PG_VERSION ]; then echo root; elif [ -f /from/pgdata/PG_VERSION ]; then echo sub; elif [ -z "$(ls -A /from 2>/dev/null | grep -v '^lost+found$')" ]; then echo empty; else echo foreign; fi`
-    ],
-    { encoding: "utf8" }
-  );
-  if (r2.status !== 0) return "unknown";
-  const out = `${r2.stdout ?? ""}`.trim();
-  return out === "root" || out === "sub" || out === "empty" || out === "foreign" ? out : "unknown";
-}
-function resolvePgData(prev) {
-  const SUB = `${PGDATA_ROOT}/pgdata`;
-  if (prev.OPENSHIP_PGDATA) return prev.OPENSHIP_PGDATA;
-  const volume = survivingDbVolume(prev);
-  if (!volume) return SUB;
-  return probePgDataDir(volume) === "root" ? PGDATA_ROOT : SUB;
-}
-function pgDataDetectionRisk(prev) {
-  if (prev.OPENSHIP_PGDATA) return null;
-  const volume = survivingDbVolume(prev);
-  if (!volume) return null;
-  return probePgDataDir(volume) === "foreign" ? { volume } : null;
-}
-function composePgDataRisk(_opts = {}) {
-  return pgDataDetectionRisk(readEnvFile());
-}
-function renderPgDataRefusal(risk, opts = {}) {
-  const SUB = `${PGDATA_ROOT}/pgdata`;
-  return `
-  ${opts.dryRun ? "A real run would REFUSE here" : "Refusing to continue"}: this install's data volume holds data, but not a Postgres cluster we recognize.
-
-    volume:  ${risk.volume}
-    checked: ${PGDATA_ROOT}/PG_VERSION and ${SUB}/PG_VERSION \u2014 neither present
-
-  Guessing where the cluster lives is how a wrong path makes Postgres run initdb over
-  your existing data and orphan it, so nothing has been written. If you know the layout,
-  pin it and re-run:
-
-    echo 'OPENSHIP_PGDATA=${SUB}' >> ${ENV_FILE}     # or ${PGDATA_ROOT} if the cluster is at the root
-`;
-}
-var PS_SWEEP_FORMAT = '{{.Names}}	{{.Label "com.docker.compose.project"}}	{{.Label "com.docker.compose.project.config_files"}}	{{.Label "com.docker.compose.service"}}';
-function parsePsSweep(stdout) {
-  return stdout.split("\n").map((line) => line.trim()).filter(Boolean).map((line) => {
-    const [name, project, configFiles, service] = line.split("	");
-    return {
-      name: name ?? "",
-      project: project ?? "",
-      configFiles: configFiles ?? "",
-      service: service ?? ""
-    };
-  });
-}
-function psSweepRaw() {
-  const r2 = spawnSync4("docker", ["ps", "-a", "--format", PS_SWEEP_FORMAT], { encoding: "utf8" });
-  return r2.status === 0 && r2.stdout ? r2.stdout : null;
-}
-function psSweep() {
-  return parsePsSweep(psSweepRaw() ?? "");
-}
-function fromOurComposeFile(row) {
-  return row.configFiles.split(",").some((f2) => f2.trim() === COMPOSE_FILE);
-}
-function orphanedStackContainers(project) {
-  return psSweep().filter((c2) => c2.name && c2.project && c2.project !== project && fromOurComposeFile(c2)).map(({ name, project: proj }) => ({ name, project: proj }));
-}
-function adoptedStackOrigin(psStdout, project) {
-  const rows = parsePsSweep(psStdout).filter((c2) => c2.name && c2.project === project);
-  if (rows.length === 0 || rows.some(fromOurComposeFile)) return null;
-  return {
-    project,
-    configFiles: rows.map((c2) => c2.configFiles).find(Boolean) ?? "",
-    apiContainer: rows.find((c2) => c2.service === "api")?.name || `${project}-api-1`
-  };
-}
-function adoptedStack(project) {
-  const sweep = psSweepRaw();
-  return sweep ? adoptedStackOrigin(sweep, project) : null;
-}
-function reconcileDbPassword(user, password) {
-  if (!password) return;
-  if (compose(["up", "-d", "--wait", "postgres"], { quiet: true }) !== 0) return;
-  const attempt = (asRole) => spawnSync4(
-    "docker",
-    [
-      "compose",
-      "-f",
-      COMPOSE_FILE,
-      "exec",
-      "-T",
-      "postgres",
-      "psql",
-      "-U",
-      asRole,
-      "-d",
-      "postgres",
-      "-v",
-      "ON_ERROR_STOP=1",
-      // Read the statement from STDIN, not `-c`: psql has no bind parameters for
-      // ALTER USER, so the password has to be inlined in SQL — and an argv copy
-      // would be readable in `ps` for the life of the call. stdin keeps it to this
-      // process and the socket. Our generated password is hex, so it cannot break
-      // out of the quoted literal either.
-      "-f",
-      "-"
-    ],
-    {
-      cwd: COMPOSE_DIR,
-      encoding: "utf8",
-      // Create the role if the volume predates it, else just realign it. Both
-      // branches leave exactly the credentials this `.env` will present.
-      input: `DO $$ BEGIN
-  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${user}') THEN
-    ALTER ROLE "${user}" WITH LOGIN PASSWORD '${password}';
-  ELSE
-    CREATE ROLE "${user}" WITH LOGIN SUPERUSER PASSWORD '${password}';
-  END IF;
-END $$;
-`
-    }
-  );
-  let r2 = attempt(user);
-  if (r2.status !== 0) r2 = attempt("postgres");
-  if (r2.status !== 0) {
-    console.log(
-      `
-  ! Could not realign the database password (${(r2.stderr ?? "").trim() || "psql failed"}).
-    The api will fail with "password authentication failed for user "${user}"" because the
-    existing data volume was initialized with a different password.
-
-    Fix it one of two ways:
-      \u2022 restore the .env that created the volume, or
-      \u2022 start fresh (DESTROYS DB DATA):  openship uninstall  then  openship up
-`
-    );
-  }
-}
-function removeOrphanedStack(project) {
-  const orphans = orphanedStackContainers(project);
-  if (orphans.length === 0) return;
-  const projects = [...new Set(orphans.map((o2) => o2.project))].join(", ");
-  console.log(
-    `  Removing ${orphans.length} container(s) from a previous stack (project "${projects}") \u2014 they would hold the ports this stack needs. Volumes are kept.`
-  );
-  spawnSync4("docker", ["rm", "-f", ...orphans.map((o2) => o2.name)], { stdio: "ignore" });
-}
-function edgeNameNeedsReclaim(psStdout, project) {
-  const row = parsePsSweep(psStdout).find((c2) => c2.name === "openship-edge");
-  if (!row) return false;
-  return !(row.project === project && fromOurComposeFile(row));
-}
-function reconcileEdgeContainerName(project) {
-  const sweep = psSweepRaw();
-  if (!sweep) return;
-  if (!edgeNameNeedsReclaim(sweep, project)) return;
-  console.log(
-    "  Replacing an unmanaged `openship-edge` container so compose can own it (config is on the host, so no routes are lost)."
-  );
-  spawnSync4("docker", ["rm", "-f", "openship-edge"], { stdio: "ignore" });
-}
-function migrateLegacyEdgeVolumes(project) {
-  const pairs = [
-    { volume: `${project}_openship_sites`, host: EDGE_SITES_HOST_DIR },
-    { volume: `${project}_openship_certs`, host: "/etc/letsencrypt" },
-    { volume: `${project}_openship_acme`, host: EDGE_ACME_HOST_DIR },
-    { volume: `${project}_openship_static`, host: "/opt/openship/static" }
-  ];
-  const ls = spawnSync4("docker", ["volume", "ls", "--format", "{{.Name}}"], { encoding: "utf8" });
-  if (ls.status !== 0 || !ls.stdout) return;
-  const existing = new Set(ls.stdout.split("\n").map((l2) => l2.trim()).filter(Boolean));
-  for (const { volume, host } of pairs) {
-    if (!existing.has(volume)) continue;
-    mkdirSync3(host, { recursive: true });
-    const alreadyThere = spawnSync4("sh", ["-c", `ls -A ${JSON.stringify(host)} 2>/dev/null | head -1`], {
-      encoding: "utf8"
-    });
-    if (alreadyThere.stdout?.trim()) continue;
-    console.log(`  Moving edge state from volume ${volume} onto ${host}...`);
-    const copy = spawnSync4(
-      "docker",
-      [
-        "run",
-        "--rm",
-        "-v",
-        `${volume}:/from:ro`,
-        "-v",
-        `${host}:/to`,
-        "alpine:3",
-        "sh",
-        "-c",
-        "cp -a /from/. /to/ 2>/dev/null || true"
-      ],
-      { stdio: "inherit" }
-    );
-    if (copy.status !== 0) {
-      console.log(
-        `  Could not copy ${volume} \u2014 the stack will start with an empty ${host}.
-  Recover manually with: docker run --rm -v ${volume}:/from -v ${host}:/to alpine cp -a /from/. /to/`
-      );
-    }
-  }
-}
-function warnOrphanedVolumes(project) {
-  const r2 = spawnSync4("docker", ["volume", "ls", "--format", "{{.Name}}"], { encoding: "utf8" });
-  if (r2.status !== 0 || !r2.stdout) return;
-  const others = new Set(
-    r2.stdout.split("\n").map((l2) => l2.trim()).filter((l2) => l2.endsWith("_openship_sites")).map((l2) => l2.slice(0, -"_openship_sites".length)).filter((p2) => p2 && p2 !== project)
-  );
-  if (others.size === 0) return;
-  console.log(
-    `  Note: volumes from a previous install (project "${[...others].join(", ")}") are still on disk
-  and are NOT mounted by this stack \u2014 its database starts fresh. (Certificates and
-  vhosts now live on the host, so those carry over.)
-  Remove them with \`docker volume ls | grep _openship_\` once you're sure they aren't needed.`
-  );
-}
-function keepConfig(prev, key, explicit) {
-  const set = explicit?.trim();
-  if (set) return set;
-  const carried = prev[key]?.trim();
-  return carried || void 0;
-}
-var ACME_ENV_KEYS = [
-  "OPENSHIP_ACME_EMAIL",
-  "OPENSHIP_ACME_DIRECTORY_URL",
-  "OPENSHIP_ACME_EAB_KID",
-  "OPENSHIP_ACME_EAB_HMAC_KEY",
-  "OPENSHIP_ACME_KEY_TYPE",
-  "OPENSHIP_ACME_CA_BUNDLE",
-  "OPENSHIP_ACME_TOS_AGREED"
-];
-function hostGatewayEnv(prev) {
-  const value = process.env.OPENSHIP_HOST_GATEWAY?.trim() || prev.OPENSHIP_HOST_GATEWAY?.trim();
-  return value ? [`OPENSHIP_HOST_GATEWAY=${value}`] : [];
-}
-function rootlessSocketCandidates() {
-  const runtimeDir = process.env.XDG_RUNTIME_DIR?.trim();
-  const sudoUid = process.env.SUDO_UID?.trim();
-  let uid;
-  try {
-    uid = userInfo().uid;
-  } catch {
-  }
-  return [
-    ...runtimeDir ? [join6(runtimeDir, "docker.sock")] : [],
-    ...sudoUid ? [`/run/user/${sudoUid}/docker.sock`] : [],
-    ...uid !== void 0 ? [`/run/user/${uid}/docker.sock`] : []
-  ];
-}
-function detectDockerSocketPath() {
-  const fromClient = resolveLocalDockerSocketPath(void 0, process.env);
-  if (fromClient !== DEFAULT_DOCKER_SOCKET_PATH) return fromClient;
-  if (existsSync4(DEFAULT_DOCKER_SOCKET_PATH)) return DEFAULT_DOCKER_SOCKET_PATH;
-  return rootlessSocketCandidates().find((p2) => existsSync4(p2)) ?? DEFAULT_DOCKER_SOCKET_PATH;
-}
-function resolveDockerSocket(prev) {
-  const pinned = process.env.OPENSHIP_DOCKER_SOCKET?.trim() || prev.OPENSHIP_DOCKER_SOCKET?.trim();
-  return pinned ? { path: pinned, pinned: true } : { path: detectDockerSocketPath(), pinned: false };
-}
-function dockerSocketEnv(prev) {
-  const { path, pinned } = resolveDockerSocket(prev);
-  return pinned || path !== DEFAULT_DOCKER_SOCKET_PATH ? [`OPENSHIP_DOCKER_SOCKET=${path}`] : [];
-}
-function warnMissingDockerSocket(path) {
-  console.warn(
-    `
-  ! The Docker socket this install mounts into the api isn't there:
-      ${path}
-    Docker will create that path as an empty DIRECTORY, so the stack will come up
-    and then fail every container operation with a transport error naming neither
-    this path nor the cause (#482). Point it at the real socket:
-      docker context inspect --format '{{.Endpoints.docker.Host}}'
-      OPENSHIP_DOCKER_SOCKET=/run/user/$(id -u)/docker.sock openship up --compose
-    (a rootless daemon keeps its socket under the daemon user's runtime dir).
-`
-  );
-}
-function renderAcmeEnv(prev) {
-  return ACME_ENV_KEYS.flatMap((key) => {
-    const value = process.env[key]?.trim() || prev[key]?.trim();
-    if (!value) return [];
-    if (/[\r\n]/.test(value)) throw new Error(`${key} must be a single-line value`);
-    return [`${key}=${value}`];
-  });
-}
-function resolveEnvConfig(prev, opts) {
-  const publicUrl = keepConfig(prev, "OPENSHIP_PUBLIC_URL", opts.publicUrl);
-  const bindAddr = keepConfig(prev, "OPENSHIP_BIND_ADDR") ?? (publicUrl ? "0.0.0.0" : void 0);
-  return {
-    apiPort: keepConfig(prev, "API_PORT", opts.apiPort) ?? String(DEFAULT_API_PORT),
-    dashPort: keepConfig(prev, "DASHBOARD_PORT", opts.dashboardPort) ?? String(DEFAULT_DASHBOARD_PORT),
-    ...bindAddr ? { bindAddr } : {},
-    ...publicUrl ? { publicUrl } : {},
-    // A public URL always implies a proxy in front; otherwise keep whatever the
-    // install was configured with.
-    trustProxy: Boolean(opts.trustProxy) || Boolean(publicUrl) || prev.TRUST_PROXY === "true",
-    ...keepConfig(prev, "OPENSHIP_EXTRA_TRUSTED_ORIGINS", opts.extraTrustedOrigins) ? {
-      extraTrustedOrigins: keepConfig(
-        prev,
-        "OPENSHIP_EXTRA_TRUSTED_ORIGINS",
-        opts.extraTrustedOrigins
-      )
-    } : {},
-    registry: keepConfig(prev, "OPENSHIP_IMAGE_REGISTRY", opts.registry) ?? DEFAULT_IMAGE_REGISTRY,
-    // Tri-state: the flag is absent on a plain re-run, so fall back to what the
-    // install chose rather than silently re-granting host control.
-    hostControl: opts.noHostControl === void 0 ? prev.OPENSHIP_HOST_CONTROL !== "false" : !opts.noHostControl,
-    // Sticky too: `--mail` is only the install-time default, so a plain re-run
-    // (or `openship update`) must not hand a mail box back the platform shell.
-    // Turning it OFF is the dashboard's job — Settings → Instance stores the mode
-    // in the database, which wins over this env var either way.
-    productMode: opts.mail || keepConfig(prev, "OPENSHIP_PRODUCT") === "mail" ? "mail" : "platform",
-    // Sticky like every other operator choice here. These were literals in
-    // `renderEnv`, so a box where `host.docker.internal:22` is simply not the
-    // right address — rootless Docker, sshd on another port — had nowhere to say
-    // so, and every `openship up` overwrote a hand-edited `.env` back to the
-    // value that didn't work (#490/#482).
-    hostSshHost: keepConfig(prev, "OPENSHIP_HOST_SSH_HOST", opts.hostSshHost) ?? HOST_CHANNEL_DEFAULT_HOST,
-    hostSshPort: keepConfig(prev, "OPENSHIP_HOST_SSH_PORT", opts.hostSshPort) ?? String(HOST_CHANNEL_DEFAULT_PORT)
-  };
-}
-function toPort(value) {
-  const n2 = Number(value);
-  return Number.isInteger(n2) && n2 > 0 && n2 <= 65535 ? n2 : void 0;
-}
-function composeEnvPorts() {
-  const env = readEnvFile();
-  return { api: toPort(env.API_PORT), dashboard: toPort(env.DASHBOARD_PORT) };
-}
-function composeBindAddr() {
-  return readEnvFile().OPENSHIP_BIND_ADDR?.trim() || "127.0.0.1";
-}
-function composeHostChannel() {
-  const env = readEnvFile();
-  const host = env.OPENSHIP_HOST_SSH_HOST?.trim();
-  if (!host) return null;
-  return {
-    host,
-    port: toPort(env.OPENSHIP_HOST_SSH_PORT) ?? 22,
-    user: env.OPENSHIP_HOST_SSH_USER?.trim() || "root"
-  };
-}
-function composeHostChannelExpected() {
-  if (!existsSync4(COMPOSE_FILE)) return false;
-  return readEnvFile().OPENSHIP_HOST_CONTROL !== "false";
-}
-function composeTrustedOriginUrls() {
-  const env = readEnvFile();
-  return [env.OPENSHIP_PUBLIC_URL, env.OPENSHIP_EXTRA_TRUSTED_ORIGINS].filter(
-    (v2) => !!v2?.trim()
-  );
-}
-function composeHeldPorts() {
-  const r2 = spawnSync4(
-    "docker",
-    ["ps", "--format", '{{.Label "com.docker.compose.project.config_files"}}	{{.Ports}}'],
-    { encoding: "utf8" }
-  );
-  if (r2.status !== 0 || !r2.stdout) return [];
-  const ports = /* @__PURE__ */ new Set();
-  for (const line of r2.stdout.split("\n")) {
-    const [configFiles = "", published = ""] = line.split("	");
-    if (!configFiles.split(",").some((f2) => f2.trim() === COMPOSE_FILE)) continue;
-    for (const m2 of published.matchAll(/:(\d+)->/g)) ports.add(Number(m2[1]));
-  }
-  return [...ports];
-}
-async function resolveComposePorts(prefs, opts = {}) {
-  return resolvePorts(
-    {
-      api: toPort(prefs.api),
-      dashboard: toPort(prefs.dashboard),
-      previous: composeEnvPorts(),
-      bindAddr: composeBindAddr(),
-      reclaimable: composeHeldPorts()
-    },
-    opts
-  );
-}
-var OMITTABLE_MANAGED_KEYS = /* @__PURE__ */ new Set([
-  "OPENSHIP_HOST_SSH_HOST",
-  "OPENSHIP_HOST_SSH_USER",
-  "OPENSHIP_HOST_SSH_PORT",
-  "OPENSHIP_HOST_SSH_KEY",
-  "OPENSHIP_HOST_KEY_PATH",
-  "OPENSHIP_HOST_GATEWAY",
-  "TRUST_PROXY"
-]);
-var envKeyOf = (line) => line.match(/^([A-Z0-9_]+)=/)?.[1];
-function operatorEnvPassthrough(managed, prev) {
-  return Object.entries(prev).filter(([key]) => !managed.has(key) && !OMITTABLE_MANAGED_KEYS.has(key)).map(([key, value]) => `${key}=${value}`);
-}
-var PRESERVED_ENV_HEADER = "# Preserved from your existing .env \u2014 set by you, not by `openship up` (#485).";
-function resolveImageVersion(opts) {
-  return opts.version?.trim() || process.env.OPENSHIP_VERSION?.trim() || (true ? "0.6.5" : "latest");
-}
-function managedEnvLines(opts, host, cfg, prev) {
-  const lines = [
-    "# Managed by `openship up`. Secrets are generated once and preserved.",
-    // Do NOT edit on a live install — it is the volume prefix (see composeProjectName).
-    `COMPOSE_PROJECT_NAME=${composeProjectName(prev)}`,
-    "CLOUD_MODE=false",
-    "OPENSHIP_TARGET=local",
-    "OPENSHIP_REQUIRE_AUTH=true",
-    // Read by createHostExecutor (throws when false) and by the servers list
-    // (hides the local row). Written explicitly so the policy is visible in .env.
-    `OPENSHIP_HOST_CONTROL=${cfg.hostControl ? "true" : "false"}`,
-    // The host side of the api's docker socket mount, when it isn't the rootful
-    // default. Unlike the host channel above this is NOT optional plumbing — every
-    // deploy goes through it — so it is resolved on every run, host control or not.
-    ...dockerSocketEnv(prev),
-    // Which shell the dashboard defaults to. Emitted on EVERY run, including the
-    // "platform" default: that keeps the key permanently in the managed set, so
-    // the #485 passthrough can never mistake it for operator config (which would
-    // pin it and make the Settings → Instance toggle look broken after an `up`).
-    `OPENSHIP_PRODUCT=${cfg.productMode}`,
-    `OPENSHIP_IMAGE_REGISTRY=${cfg.registry}`,
-    `OPENSHIP_VERSION=${resolveImageVersion(opts)}`,
-    `POSTGRES_PASSWORD=${keepSecret(prev, "POSTGRES_PASSWORD")}`,
-    // Pinned once (see resolvePgData): fresh install → subdir, existing volume → root.
-    `OPENSHIP_PGDATA=${resolvePgData(prev)}`,
-    `BETTER_AUTH_SECRET=${keepSecret(prev, "BETTER_AUTH_SECRET")}`,
-    `INTERNAL_TOKEN=${keepSecret(prev, "INTERNAL_TOKEN")}`,
-    `API_PORT=${cfg.apiPort}`,
-    `DASHBOARD_PORT=${cfg.dashPort}`,
-    // The api's OWN view of the dashboard port: the self-app boot reconcile points
-    // the operator's domain at the dashboard through this (self-deploy.ts), and it
-    // silently defaults to 3001 when unset. Ports are dynamic now, so leaving it
-    // out publishes a domain routed to a port nothing is listening on.
-    `OPENSHIP_DASHBOARD_PORT=${cfg.dashPort}`,
-    // Alternate CA/EAB values are operator configuration (including one secret),
-    // so a routine `openship up`/upgrade must not silently discard them.
-    ...renderAcmeEnv(prev)
-  ];
-  if (cfg.bindAddr) lines.push(`OPENSHIP_BIND_ADDR=${cfg.bindAddr}`);
-  if (cfg.publicUrl) lines.push(`OPENSHIP_PUBLIC_URL=${cfg.publicUrl}`);
-  if (cfg.extraTrustedOrigins) {
-    lines.push(`OPENSHIP_EXTRA_TRUSTED_ORIGINS=${cfg.extraTrustedOrigins}`);
-  }
-  if (cfg.trustProxy) lines.push("TRUST_PROXY=true");
-  if (host) {
-    lines.push(
-      `OPENSHIP_HOST_SSH_HOST=${cfg.hostSshHost}`,
-      `OPENSHIP_HOST_SSH_USER=${host.user}`,
-      `OPENSHIP_HOST_SSH_PORT=${cfg.hostSshPort}`,
-      "OPENSHIP_HOST_SSH_KEY=/run/secrets/openship_host_key",
-      `OPENSHIP_HOST_KEY_PATH=${host.keyPath}`,
-      ...hostGatewayEnv(prev)
-    );
-  }
-  return lines;
-}
-function renderEnvAndCarried(opts, host, cfg, prev) {
-  const lines = managedEnvLines(opts, host, cfg, prev);
-  const managed = new Set(lines.map(envKeyOf).filter((k2) => !!k2));
-  const preserved = operatorEnvPassthrough(managed, prev);
-  const body = preserved.length ? [...lines, "", PRESERVED_ENV_HEADER, ...preserved] : lines;
-  return {
-    text: body.join("\n") + "\n",
-    carried: preserved.map((line) => line.slice(0, line.indexOf("=")))
-  };
-}
-function renderEnv(opts, host, cfg) {
-  return renderEnvAndCarried(opts, host, cfg, readEnvFile()).text;
-}
-function sourceBuildDir() {
-  const marker = readSourceInstall();
-  if (!marker?.dir) return null;
-  const hasAll = BUILT_SERVICES.every((s2) => existsSync4(join6(marker.dir, s2.dockerfile)));
-  return hasAll ? marker.dir : null;
-}
-function renderBuildOverride(repoDir) {
-  const services = BUILT_SERVICES.map(
-    (s2) => `  ${s2.service}:
-    build:
-      context: ${repoDir}
-      dockerfile: ${s2.dockerfile}
-`
-  ).join("");
-  return `# Managed by \`openship up\` (from-source install) \u2014 builds instead of pulls.
-services:
-${services}`;
-}
-function materialize(opts) {
-  mkdirSync3(COMPOSE_DIR, { recursive: true, mode: 448 });
-  const prev = readEnvFile();
-  const cfg = resolveEnvConfig(prev, opts);
-  const provision = provisionHostSshChannel(cfg);
-  let host = provision.channel;
-  let kept = false;
-  if (!host && provision.issue) {
-    const previousChannel = carriedHostChannel(prev);
-    if (previousChannel) {
-      host = previousChannel;
-      kept = true;
-    }
-  }
-  if (!cfg.hostControl) retireHostSshChannel(prev);
-  if (provision.issue && !opts.alreadyFetched) {
-    console.warn(
-      renderHostChannelIssue(provision.issue, {
-        target: `${cfg.hostSshHost}:${cfg.hostSshPort}`,
-        kept
-      })
-    );
-  }
-  const socket = resolveDockerSocket(prev);
-  if (!opts.alreadyFetched && !existsSync4(socket.path)) warnMissingDockerSocket(socket.path);
-  let before = "";
-  try {
-    before = readFileSync3(ENV_FILE, "utf8");
-  } catch {
-  }
-  const { text: rendered, carried } = renderEnvAndCarried(opts, host, cfg, prev);
-  writeFileSync2(COMPOSE_FILE, COMPOSE_YAML);
-  writeEnvFile(rendered, before);
-  if (carried.length) {
-    console.log(`  Kept ${carried.length} operator-set .env variable(s): ${carried.join(", ")}`);
-  }
-  const buildDir = opts.build === false ? null : sourceBuildDir();
-  if (buildDir) writeFileSync2(BUILD_FILE, renderBuildOverride(buildDir));
-  return { buildDir, cfg, envChanged: before !== "" && rendered !== before };
-}
-function writeEnvFile(rendered, before) {
-  if (rendered === before) return;
-  if (before) writeFileSync2(ENV_BACKUP_FILE, before, { mode: 384 });
-  writeFileSync2(ENV_TMP_FILE, rendered, { mode: 384 });
-  renameSync(ENV_TMP_FILE, ENV_FILE);
-}
-var SECRET_ENV_KEY = /(PASSWORD|SECRET|TOKEN|HMAC_KEY)$/;
-function composePlan(opts) {
-  const prev = readEnvFile();
-  const cfg = resolveEnvConfig(prev, opts);
-  const buildDir = opts.build === false ? null : sourceBuildDir();
-  const hostChannel = plannedHostChannel(cfg.hostControl);
-  const settings = [];
-  const newSecrets = [];
-  for (const line of renderEnv(opts, hostChannel, cfg).split("\n")) {
-    const at2 = line.indexOf("=");
-    if (at2 < 1 || line.startsWith("#")) continue;
-    const key = line.slice(0, at2);
-    const value = line.slice(at2 + 1);
-    if (!SECRET_ENV_KEY.test(key)) {
-      settings.push({ key, value });
-      continue;
-    }
-    const preserved = !!prev[key] && prev[key] === value;
-    if (!preserved) newSecrets.push(key);
-    settings.push({ key, value: preserved ? "<preserved>" : "<generated on this run>" });
-  }
-  return {
-    composeFile: COMPOSE_FILE,
-    envFile: ENV_FILE,
-    installMethodFile: INSTALL_METHOD_FILE,
-    ...buildDir ? { buildFile: BUILD_FILE } : {},
-    yaml: COMPOSE_YAML,
-    settings,
-    newSecrets,
-    secretRotation: opts.resetSecrets ? null : secretRotationRisk(prev),
-    pgDataRisk: pgDataDetectionRisk(prev),
-    existing: Object.keys(prev).length > 0,
-    mountDirs: EDGE_CONTAINER_MOUNTS.map((m2) => m2.host),
-    buildDir,
-    hostChannel
-  };
-}
-function dbVolumeExists(project) {
-  const r2 = spawnSync4("docker", ["volume", "inspect", `${project}_postgres_data`], {
-    stdio: "ignore"
-  });
-  return r2.status === 0;
-}
-function compose(args, opts) {
-  const files = ["-f", COMPOSE_FILE];
-  if (opts?.withBuildOverride) files.push("-f", BUILD_FILE);
-  const r2 = spawnSync4("docker", ["compose", ...files, ...args], {
-    cwd: COMPOSE_DIR,
-    stdio: opts?.quiet ? "ignore" : "inherit"
-  });
-  return r2.status ?? 1;
-}
-function missingPinnedImages(registry, version) {
-  const missing = [];
-  for (const { service } of BUILT_SERVICES) {
-    const ref = `${registry}/openship-${service}:${version}`;
-    const r2 = spawnSync4("docker", ["manifest", "inspect", ref], { encoding: "utf8" });
-    if (r2.status === 0) continue;
-    const stderr = `${r2.stderr ?? ""}`.toLowerCase();
-    if (/manifest unknown|no such manifest|manifest for .+ not found/.test(stderr)) {
-      missing.push(ref);
-      continue;
-    }
-    return null;
-  }
-  return missing;
-}
-function pinnedImagesReady(opts) {
-  if (sourceBuildDir()) return true;
-  const prev = readEnvFile();
-  const version = resolveImageVersion(opts);
-  const missing = missingPinnedImages(resolveEnvConfig(prev, opts).registry, version);
-  if (!missing || missing.length === 0) return true;
-  const prevVersion = prev.OPENSHIP_VERSION?.trim();
-  const out = [
-    "",
-    `  The pinned image tag \`${version}\` isn't in the registry yet:`,
-    ...missing.map((ref) => `    ${ref}`),
-    "",
-    "  The CLI reached npm before its container images finished publishing \u2014 a",
-    "  release-ordering race (#486). Nothing on this box was changed.",
-    "",
-    "  Any one of these gets you moving:",
-    "    \u2022 Wait a few minutes and re-run \u2014 the images usually land right after a release.",
-    "    \u2022 Pin a tag that exists:",
-    "        openship up --compose --image-version <tag>",
-    "        OPENSHIP_VERSION=<tag> openship up --compose"
-  ];
-  if (prevVersion && prevVersion !== version) {
-    out.push(`    \u2022 Your current install runs \`${prevVersion}\`, a tag known good on this box.`);
-  }
-  out.push("");
-  console.error(out.join("\n"));
-  return false;
-}
-function composePrefetch(opts) {
-  const rotation = composeSecretRotationRisk(opts);
-  if (rotation) {
-    console.error(renderSecretRotationRefusal(rotation));
-    return { ok: false, envChanged: false };
-  }
-  const { buildDir, envChanged } = materialize(opts);
-  if (buildDir) {
-    return {
-      ok: compose(["pull", "postgres", "redis"], { withBuildOverride: true }) === 0 && compose(["build"], { withBuildOverride: true }) === 0,
-      envChanged
-    };
-  }
-  return { ok: compose(["pull"]) === 0, envChanged };
-}
-function ensureEdgeMountDirs() {
-  const failed = [];
-  for (const { host } of EDGE_CONTAINER_MOUNTS) {
-    try {
-      mkdirSync3(host, { recursive: true });
-    } catch (err) {
-      if (err.code !== "EEXIST") failed.push(host);
-    }
-  }
-  return failed;
-}
-function isRootlessDocker() {
-  const r2 = spawnSync4("docker", ["info", "-f", "{{println .SecurityOptions}}"], {
-    encoding: "utf8"
-  });
-  return r2.status === 0 && /rootless/i.test(r2.stdout ?? "");
-}
-async function composeUp(opts) {
-  if (!opts.alreadyFetched && !pinnedImagesReady(opts)) {
-    const pre = resolveEnvConfig(readEnvFile(), opts);
-    return { ok: false, apiPort: pre.apiPort, dashPort: pre.dashPort };
-  }
-  const rotation = composeSecretRotationRisk(opts);
-  if (rotation) {
-    const pre = resolveEnvConfig(readEnvFile(), opts);
-    console.error(renderSecretRotationRefusal(rotation));
-    return { ok: false, refused: true, apiPort: pre.apiPort, dashPort: pre.dashPort };
-  }
-  const pgData = composePgDataRisk(opts);
-  if (pgData) {
-    const pre = resolveEnvConfig(readEnvFile(), opts);
-    console.error(renderPgDataRefusal(pgData));
-    return { ok: false, refused: true, apiPort: pre.apiPort, dashPort: pre.dashPort };
-  }
-  const { buildDir, cfg, envChanged: rendered } = materialize(opts);
-  const apiPort = cfg.apiPort;
-  const dashPort = cfg.dashPort;
-  const envChanged = opts.envChanged ?? rendered;
-  const up = (extra = {}) => compose(
-    envChanged ? ["up", "-d", "--force-recreate", ...ENV_CONSUMING_SERVICES] : ["up", "-d"],
-    extra
-  );
-  const env = readEnvFile();
-  const project = env.COMPOSE_PROJECT_NAME || "openship";
-  removeOrphanedStack(project);
-  reconcileEdgeContainerName(project);
-  migrateLegacyEdgeVolumes(project);
-  warnOrphanedVolumes(project);
-  const unmakeableMounts = ensureEdgeMountDirs();
-  if (unmakeableMounts.length && isRootlessDocker()) {
-    const dirs = unmakeableMounts.join(" ");
-    console.error(
-      `
-  Rootless Docker can't create the edge's host directories under root-owned paths:
-    ${unmakeableMounts.join("\n    ")}
-
-  Create them once (owned by your user), then re-run \`openship up --compose\`:
-    sudo mkdir -p ${dirs}
-    sudo chown -R "$(id -un)" ${dirs}
-`
-    );
-    return { ok: false, apiPort, dashPort };
-  }
-  if (dbVolumeExists(project)) {
-    reconcileDbPassword(env.POSTGRES_USER || "openship", env.POSTGRES_PASSWORD ?? "");
-  }
-  await sanitizeEdgeVhosts(
-    new LocalExecutor(),
-    EDGE_SITES_HOST_DIR,
-    (l2) => console.log(`  ${l2.message}`)
-  ).catch(() => {
-  });
-  if (buildDir) {
-    if (!opts.alreadyFetched) {
-      if (compose(["pull", "postgres", "redis"], { withBuildOverride: true }) !== 0) {
-        return { ok: false, apiPort, dashPort };
-      }
-      if (compose(["build"], { withBuildOverride: true }) !== 0) {
-        return { ok: false, apiPort, dashPort };
-      }
-    }
-    if (up({ withBuildOverride: true }) !== 0) {
-      return { ok: false, apiPort, dashPort };
-    }
-    onEdgeContainerChanged();
-    writeInstallMethod("compose");
-    return { ok: true, apiPort, dashPort };
-  }
-  if (!opts.alreadyFetched && compose(["pull"]) !== 0) {
-    return { ok: false, apiPort, dashPort };
-  }
-  if (up() !== 0) return { ok: false, apiPort, dashPort };
-  onEdgeContainerChanged();
-  writeInstallMethod("compose");
-  return { ok: true, apiPort, dashPort };
-}
-function onEdgeContainerChanged() {
-  invalidateEdgeContainer();
-}
-function composeDown() {
-  if (!existsSync4(COMPOSE_FILE)) return false;
-  return compose(["down"]) === 0;
-}
-function composeUninstall(opts = {}) {
-  const removedImages = [];
-  const ok = existsSync4(COMPOSE_FILE) ? compose(["down", "-v", "--remove-orphans"]) === 0 : false;
-  if (opts.removeImages) {
-    const env = readEnvFile();
-    const registry = env.OPENSHIP_IMAGE_REGISTRY || DEFAULT_IMAGE_REGISTRY;
-    const version = env.OPENSHIP_VERSION || "latest";
-    for (const { service } of BUILT_SERVICES) {
-      const ref = `${registry}/openship-${service}:${version}`;
-      if (spawnSync4("docker", ["image", "rm", "-f", ref], { stdio: "ignore" }).status === 0) {
-        removedImages.push(ref);
-      }
-    }
-  }
-  return { ok, removedImages };
-}
-async function composeUpdate(version) {
-  if (!existsSync4(COMPOSE_FILE)) return { applied: false, refused: false };
-  const r2 = await composeUp(version ? { version } : {});
-  return { applied: r2.ok, refused: !!r2.refused };
-}
-function composePs() {
-  return compose(["ps"]);
-}
-function composeRunning() {
-  const r2 = spawnSync4(
-    "docker",
-    ["compose", "-f", COMPOSE_FILE, "ps", "--status", "running", "-q"],
-    { cwd: COMPOSE_DIR, encoding: "utf8" }
-  );
-  return r2.status === 0 && r2.stdout.trim().length > 0;
-}
-function composeStart() {
-  reconcileEdgeContainerName(readEnvFile().COMPOSE_PROJECT_NAME || "openship");
-  return compose(["up", "-d"], { quiet: true }) === 0;
-}
-function composeRestart() {
-  return compose(["restart"], { quiet: true }) === 0;
-}
-function composeInternalToken() {
-  return readEnvFile().INTERNAL_TOKEN ?? null;
-}
-var composePaths = {
-  dir: COMPOSE_DIR,
-  file: COMPOSE_FILE,
-  env: ENV_FILE,
-  envBackup: ENV_BACKUP_FILE
-};
 
 export {
-  PORTS_FILE,
-  saveInstanceUrl,
-  readInstanceUrl,
-  readStoredPorts,
-  storedApiPort,
-  storedDashboardPort,
-  portMoveNotice,
-  resolvePorts,
+  resolveLocalEnvironmentSync,
   thisHost,
+  pasteable,
   startUnitHint,
-  DEFAULT_REPO,
-  SOURCE_CHECKOUT_DIR,
-  SOURCE_DIST_DIR,
-  has,
-  shortSha,
-  prepareFromSource,
-  readSourceInstall,
-  remoteSha,
-  rebuildFromSource,
-  readInstallMethod,
-  hasDockerCompose,
-  dockerInstallPreview,
-  ensureDocker,
-  composeSecretRotationRisk,
-  renderSecretRotationRefusal,
-  composePgDataRisk,
-  renderPgDataRefusal,
-  composeHostChannel,
-  composeHostChannelExpected,
-  composeTrustedOriginUrls,
-  resolveComposePorts,
-  sourceBuildDir,
-  composePlan,
-  pinnedImagesReady,
-  composePrefetch,
-  composeUp,
-  composeDown,
-  composeUninstall,
-  composeUpdate,
-  composePs,
-  composeRunning,
-  composeStart,
-  composeRestart,
-  composeInternalToken,
-  composePaths
+  COMPOSE_DIR,
+  COMPOSE_FILE,
+  COMPOSE_ENV_FILE,
+  composeInstallExists,
+  readComposeEnvFile
 };