openship 0.6.8 → 0.6.9

package/dist/{chunk-5I3COAFH.js → chunk-634DDFT5.js}

@@ -1627,7 +1627,7 @@ function operatorEnvPassthrough(managed, prev) {
 }
 var PRESERVED_ENV_HEADER = "# Preserved from your existing .env \u2014 set by you, not by `openship up` (#485).";
 function resolveImageVersion(opts) {
-  return opts.version?.trim() || process.env.OPENSHIP_VERSION?.trim() || (true ? "0.6.8" : "latest");
+  return opts.version?.trim() || process.env.OPENSHIP_VERSION?.trim() || (true ? "0.6.9" : "latest");
 }
 function managedEnvLines(opts, host, cfg, prev) {
   const lines = [

package/dist/{chunk-RCMERVBL.js → chunk-FCGJN5Q5.js}

@@ -28,7 +28,7 @@ import {
   resolvePorts,
   sourceBuildDir,
   verifyHostChannel
-} from "./chunk-5I3COAFH.js";
+} from "./chunk-634DDFT5.js";
 import {
   bootstrapAdmin,
   importMigratedSites,
@@ -1564,7 +1564,7 @@ async function runForeground(opts, source) {
     const uiSpinner = ora("Preparing the dashboard\u2026").start();
     try {
       const bundle = await ensureDashboard({
-        tag: source ? "local" : opts.uiVersion || `v${"0.6.8"}`,
+        tag: source ? "local" : opts.uiVersion || `v${"0.6.9"}`,
         onProgress: (received, total) => {
           if (total) {
             uiSpinner.text = `Downloading dashboard\u2026 ${Math.round(received / total * 100)}%`;

package/dist/{host-channel-preflight-OMCZMMKR.js → host-channel-preflight-OI2TRHSG.js}

@@ -5,7 +5,7 @@ const require = __ospCreateRequire(import.meta.url);
 import {
   checkHostChannel,
   verifyHostChannel
-} from "./chunk-5I3COAFH.js";
+} from "./chunk-634DDFT5.js";
 import "./chunk-5UXHT6ED.js";
 import "./chunk-QWHBRY2K.js";
 import "./chunk-ELGRMZOW.js";

package/dist/index.js

@@ -26,7 +26,7 @@ import {
   stop,
   upCommand,
   writeCliInstall
-} from "./chunk-RCMERVBL.js";
+} from "./chunk-FCGJN5Q5.js";
 import {
   composeDown,
   composeInternalToken,
@@ -60,7 +60,7 @@ import {
   sourceBuildDir,
   storedApiPort,
   storedDashboardPort
-} from "./chunk-5I3COAFH.js";
+} from "./chunk-634DDFT5.js";
 import {
   bootstrapAdmin,
   detectPublicIp,
@@ -313,7 +313,7 @@ function getDashboardUrl(name) {
 }
 
 // src/lib/api-client.ts
-var USER_AGENT = `openship-cli/${true ? "0.6.8" : "dev"}`;
+var USER_AGENT = `openship-cli/${true ? "0.6.9" : "dev"}`;
 function getApiUrl2() {
   return `${getApiUrl()}/api`;
 }
@@ -1109,7 +1109,7 @@ function dockerNameRunning(nameFilter) {
   return r.stdout.trim().length > 0;
 }
 async function hostControlCheck(api) {
-  const { checkHostChannel } = await import("./host-channel-preflight-OMCZMMKR.js");
+  const { checkHostChannel } = await import("./host-channel-preflight-OI2TRHSG.js");
   return hostControlRow(await checkHostChannel().catch(() => null), api);
 }
 var NEVER_PROVISIONED_DETAIL = `never provisioned \u2014 run \`${HOST_CHANNEL_PROVISION_COMMAND}\``;
@@ -1514,7 +1514,7 @@ async function interactiveDoctor() {
       continue;
     }
     if (action2 === "host-control") {
-      const { verifyHostChannel } = await import("./host-channel-preflight-OMCZMMKR.js");
+      const { verifyHostChannel } = await import("./host-channel-preflight-OI2TRHSG.js");
       const report3 = await verifyHostChannel().catch(() => null);
       if (report3?.status === "fixed") log2.success("Host control is reachable now.");
       else if (report3?.status === "ok") log2.success("Host control was already reachable.");
@@ -4576,7 +4576,7 @@ function printMonitoringNextSteps() {
   info("    openship edge analytics -p <project>            per-domain analytics");
 }
 async function runMonitoringInstall(opts) {
-  const up = await import("./up-HQS7IR7H.js");
+  const up = await import("./up-RC5ZQIAD.js");
   let adminName = opts.adminName;
   let adminEmail = opts.adminEmail;
   let adminPassword = opts.adminPassword;
@@ -6733,7 +6733,7 @@ function applyOnlyArgv(selfArgs, json) {
 // src/commands/update.ts
 async function verifyHostChannelAfterUpdate() {
   if (isJsonMode()) return;
-  const { verifyHostChannel } = await import("./host-channel-preflight-OMCZMMKR.js");
+  const { verifyHostChannel } = await import("./host-channel-preflight-OI2TRHSG.js");
   await verifyHostChannel().catch(() => {
   });
 }
@@ -6810,7 +6810,7 @@ async function runSourceUpdate(source, opts) {
 }
 var REINSTALL_HINT = "curl -fsSL https://get.openship.io | sh";
 async function runTarballUpdate(install, opts) {
-  const current = "0.6.8";
+  const current = "0.6.9";
   let latest;
   try {
     latest = (await resolveLatestTag()).replace(/^v/, "");
@@ -6894,7 +6894,7 @@ var updateCommand = new Command26("update").description("Update the Openship CLI
   if (source) return runSourceUpdate(source, opts);
   const cliInstall = readCliInstall();
   if (cliInstall?.method === "tarball") return runTarballUpdate(cliInstall, opts);
-  const current = "0.6.8";
+  const current = "0.6.9";
   let latest;
   try {
     latest = (await resolveLatestTag()).replace(/^v/, "");
@@ -7502,7 +7502,7 @@ async function runWizard() {
       }
     }
   }
-  const uiTag = `v${"0.6.8"}`;
+  const uiTag = `v${"0.6.9"}`;
   if (method === "bare") {
     const dl = spinner4();
     dl.start("Pulling the Openship dist from GitHub");
@@ -7562,7 +7562,7 @@ async function runWizard() {
     const dashboardPort = String(ports.dashboard);
     const moved = portMoveNotice(ports, composeTrustedOriginUrls());
     if (moved.length) log5.info(moved.join("\n"));
-    if (!pinnedImagesReady({ version: "0.6.8" })) {
+    if (!pinnedImagesReady({ version: "0.6.9" })) {
       cancel4("The pinned Openship image tag isn't in the registry yet \u2014 nothing on this box was changed.");
       process.exit(1);
     }
@@ -7586,7 +7586,7 @@ async function runWizard() {
       dashboardPort,
       publicUrl,
       trustProxy: behindProxy,
-      version: "0.6.8",
+      version: "0.6.9",
       noHostControl: !allowHostControl
     });
     if (!fetched.ok) {
@@ -7615,7 +7615,7 @@ async function runWizard() {
       dashboardPort,
       publicUrl,
       trustProxy: behindProxy,
-      version: "0.6.8",
+      version: "0.6.9",
       noHostControl: !allowHostControl
     });
     if (!up.ok) {
@@ -7716,7 +7716,7 @@ async function runWizard() {
     if (result.liveUrl) liveUrl2 = result.liveUrl;
     else if (!result.domainRegistered) liveUrl2 = `http://localhost:${started.dashPort}`;
     for (const w of result.warnings) log5.warn(w);
-    const { verifyHostChannel } = await import("./host-channel-preflight-OMCZMMKR.js");
+    const { verifyHostChannel } = await import("./host-channel-preflight-OI2TRHSG.js");
     await verifyHostChannel().catch(() => {
     });
     finishSetup({
@@ -7995,7 +7995,7 @@ function attachCompletion(program2) {
 
 // src/index.ts
 var program = new Command28();
-program.name("openship").description("Openship CLI \u2014 install, run, and manage Openship from your terminal").version("0.6.8").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
+program.name("openship").description("Openship CLI \u2014 install, run, and manage Openship from your terminal").version("0.6.9").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
   if (thisCommand.opts().json) setJsonMode(true);
 }).action(async () => {
   const installed = serviceStatus().installed || readInstallMethod() === "compose";

package/dist/server/index.js

@@ -123865,6 +123865,27 @@ function toComposeSpec(s4) {
     advanced
   };
 }
+function isComposeProvenanceUpgrade(baseInput, nextInput) {
+  const base = toComposeSpec(baseInput);
+  const next = toComposeSpec(nextInput);
+  const baseAdvanced = { ...base.advanced ?? {} };
+  const nextAdvanced = { ...next.advanced ?? {} };
+  const markerKeys = ["environmentTemplateKeys", "buildArgTemplateKeys"];
+  const addsMarker = markerKeys.some((key) => !Object.hasOwn(baseAdvanced, key) && Object.hasOwn(nextAdvanced, key));
+  if (!addsMarker)
+    return false;
+  for (const key of markerKeys) {
+    delete baseAdvanced[key];
+    delete nextAdvanced[key];
+  }
+  const envKeys = (value) => Object.keys(value).sort();
+  const comparable = (spec, advanced) => ({
+    ...spec,
+    environment: envKeys(spec.environment ?? {}),
+    advanced
+  });
+  return JSON.stringify(canonicalize(comparable(base, baseAdvanced))) === JSON.stringify(canonicalize(comparable(next, nextAdvanced)));
+}
 function composeWritePatch(parsed, stored, composeAuthoritative = false) {
   const hasBuildArgMarker = Object.hasOwn(parsed.advanced ?? {}, "buildArgTemplateKeys");
   const suppliedBuildArgCount = Object.keys(parsed.buildArgs ?? {}).length;
@@ -124216,6 +124237,10 @@ function createServiceRepo(db3) {
           });
           continue;
         }
+        if (isComposeProvenanceUpgrade(base, theirs)) {
+          await this.update(ex.id, { importedSpec: theirs, driftSpec: null });
+          continue;
+        }
         if (composeSpecsEqual(theirs, base)) {
           if (!Object.hasOwn(base, "buildArgs")) {
             await this.update(ex.id, { importedSpec: theirs, driftSpec: null });
@@ -214575,7 +214600,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@repo/api",
-    version: "0.6.8",
+    version: "0.6.9",
     license: "Apache-2.0",
     private: true,
     type: "module",
@@ -275257,6 +275282,9 @@ async function allocateAndReservePinnedHostPort(input) {
     avoid,
     reuseOccupiedPreferred: reusable ? ownsReusablePinnedHostPort(input.claims, reusable) && !avoid.has(reusable.port) : false
   });
+  if (input.lockPreferred && preferred !== undefined && allocation.port !== preferred) {
+    throw new Error(`Refusing to change the locked host port for ${input.lockPreferred.ownerLabel} from ` + `${preferred} to ${allocation.port} during a same-server redeploy. ` + `The existing workload and routes were left unchanged.`);
+  }
   const claim2 = await reserveTargetPinnedHostPort(input.target, {
     ...input.owner,
     containerPort: previousClaim ? previousClaim.containerPort : input.owner.containerPort,
@@ -282279,6 +282307,9 @@ var init_deployment_class2 = __esm(() => {
 });
 
 // ../api/src/modules/services/live-state.ts
+function liveMatchTiersForDeployment(meta6) {
+  return meta6?.adopt === true ? undefined : OWNED_CONTAINER_TIERS;
+}
 function canonicalServiceContainerName(slug, serviceName) {
   if (!slug || !serviceName)
     return null;
@@ -282401,8 +282432,9 @@ function describeLiveState(services, live, matches) {
     return `${svc.name} → ${name2 ? displayName(name2) : m4.containerId.slice(0, 12)} (${m4.status}, by ${m4.matchedBy})${dupes}`;
   });
 }
-var UNMATCHED, displayName = (c2) => c2.names[0] ?? c2.id.slice(0, 12);
+var OWNED_CONTAINER_TIERS, UNMATCHED, displayName = (c2) => c2.names[0] ?? c2.id.slice(0, 12);
 var init_live_state = __esm(() => {
+  OWNED_CONTAINER_TIERS = ["label", "name", "trackedId"];
   UNMATCHED = {
     containerId: null,
     status: "stopped",
@@ -298886,6 +298918,16 @@ function upstreamHostPortFor(args2) {
   return pinned.get(port) ?? (sameService && port === primaryPort && resultHostPort ? resultHostPort : undefined);
 }
 
+// ../api/src/modules/deployments/compose/foreign-compose-collision.ts
+function findForeignComposeCollisions(input) {
+  const services = new Set(input.serviceNames);
+  const tracked = new Set(input.trackedContainerIds ?? []);
+  return input.containers.filter((container) => !tracked.has(container.id) && container.composeProject === input.slug && !!container.composeService && services.has(container.composeService)).map((container) => ({
+    serviceName: container.composeService,
+    containerName: container.names[0] ?? container.id.slice(0, 12)
+  }));
+}
+
 // ../api/src/modules/deployments/compose/deploy.service.ts
 function composeDeployMadeNoChanges(result) {
   return result.status === "ready" && result.summary.total > 0 && result.summary.deployed === 0 && result.summary.failed === 0 && !result.summary.mutated;
@@ -299301,8 +299343,27 @@ async function deployComposeServicesUnlocked(project2, dep, runtime, logger4, op
 `, "info");
   }
   const previousServiceDeps = project2.activeDeploymentId ? await repos.service.listByDeployment(project2.activeDeploymentId) : [];
+  const activeDeployment = project2.activeDeploymentId ? await repos.deployment.findById(project2.activeDeploymentId) : null;
+  const activeServerId = (activeDeployment?.meta ?? {}).serverId ?? null;
+  const targetServerId = opts?.serverId ?? null;
+  const lockCarriedHostPorts = activeDeployment !== null && activeServerId === targetServerId;
   const previousByServiceId = new Map(previousServiceDeps.map((row) => [row.serviceId, row]));
   const enabledServiceIds = new Set(enabled.map((svc) => svc.id));
+  const activeMeta = activeDeployment?.meta ?? {};
+  if (activeMeta.adopt !== true && runtime.supports("hostContainerQuery") && runtime.listAllContainers) {
+    const collisions = findForeignComposeCollisions({
+      slug: project2.slug,
+      serviceNames: enabled.map((service2) => service2.name),
+      containers: await runtime.listAllContainers(),
+      trackedContainerIds: previousServiceDeps.map((row) => row.containerId).filter((id2) => !!id2)
+    });
+    if (collisions.length > 0) {
+      throw new DeployError(`Refusing to create a parallel stack: Docker Compose already runs ${collisions.map((collision) => `${collision.serviceName} (${collision.containerName})`).join(", ")} under project name "${project2.slug}". Import/adopt that stack, remove it explicitly, or choose a different project slug before deploying.`, "FOREIGN_COMPOSE_STACK", {
+        projectSlug: project2.slug,
+        collisions
+      });
+    }
+  }
   let keepSetPromise = null;
   const retentionKeepSet = () => {
     keepSetPromise ??= computeKeepSet(project2).catch(() => new Set);
@@ -299909,13 +299970,14 @@ async function deployComposeServicesUnlocked(project2, dep, runtime, logger4, op
             cachedPreferred,
             allowLegacyContainerPort: containerPort === primaryRoutedPort,
             additionalAvoid: allocatedHostPorts,
+            lockPreferred: lockCarriedHostPorts ? { ownerLabel: svc.name } : undefined,
             allocate: (allocationOptions) => allocateHostPort(opts.executor, allocationOptions)
           });
           serviceHostPortAllocations.push(allocation);
           const carried2 = allocation.preferred;
           const hostPort = allocation.port;
           if (carried2 && hostPort !== carried2) {
-            logger4.log(`Host port ${carried2} for ${svc.name} is taken on this server — using ${hostPort}. (Expected when a project moves to a different host.)
+            logger4.log(`Project moved hosts: ${svc.name} uses ${hostPort} instead of ${carried2}.
 `);
           }
           if (!allocation.scanned) {
@@ -302445,7 +302507,8 @@ async function getActiveServiceContainers(ctx2, projectId) {
           live: containers,
           projectId,
           slug: project2.slug,
-          trackedIds
+          trackedIds,
+          tiers: liveMatchTiersForDeployment(dep.meta)
         });
         return services.filter((svc) => svc.enabled !== false || matches.get(svc.id)?.containerId).map((svc) => {
           const m4 = matches.get(svc.id);
@@ -315757,7 +315820,11 @@ async function connect3(sub) {
     sub.connecting = false;
   }
 }
-function onEvent(sub, _event) {
+function onEvent(sub, event) {
+  if (!isTrackedHealthContainer(sub.key, event.containerId))
+    return;
+  if (!["die", "oom", "restart", "start", "unhealthy", "healthy", "destroy"].includes(event.action))
+    return;
   if (Date.now() - sub.lastRunAt >= MIN_RUN_GAP_MS)
     sub.followUpsLeft = MAX_FOLLOW_UPS;
   schedule(sub);
@@ -315891,6 +315958,12 @@ var init_container_events = __esm(async () => {
 });
 
 // ../api/src/modules/monitoring/health-watch.ts
+function listWorkloadHealthSnapshots(organizationId) {
+  return [...HEALTH_SNAPSHOTS.values()].filter((row) => row.organizationId === organizationId);
+}
+function isTrackedHealthContainer(groupKey, containerId) {
+  return TRACKED_CONTAINERS.get(groupKey)?.has(containerId) ?? false;
+}
 function memoryKey(projectId, serviceKey) {
   return `${projectId}:${serviceKey}`;
 }
@@ -316072,6 +316145,10 @@ async function sweepOnce(opts) {
       summary.stale++;
     MEMORY.delete(key);
   }
+  for (const [key, row] of HEALTH_SNAPSHOTS) {
+    if (!visited2.has(key) && settled(row.projectId))
+      HEALTH_SNAPSHOTS.delete(key);
+  }
   for (const key of MEMORY.keys()) {
     if (visited2.has(key))
       continue;
@@ -316187,6 +316264,7 @@ async function readServerGroup(ctx2, first, target) {
         });
       }
     }
+    TRACKED_CONTAINERS.set(watchGroupKey(serverId, organizationId), new Set(pending.map((entry) => entry.workload.containerId)));
     pending.sort((a2, b3) => inspectRank(a2.container) - inspectRank(b3.container));
     await mapWithLimit(pending, INSPECT_CONCURRENCY, async ({ candidate, workload, container }) => {
       if (handle2.abandoned)
@@ -316257,6 +316335,8 @@ async function resolveWorkloads(candidate, services, live) {
   });
   const workloads = [];
   for (const service2 of services) {
+    if (service2.advanced?.monitoringEnabled === false)
+      continue;
     const hint = hints.get(service2.id);
     if (!hint)
       continue;
@@ -316315,6 +316395,19 @@ async function evaluate(args2) {
     expectRunning: workload.expectRunning,
     createdTicks: sameContainer ? previous?.createdTicks ?? 0 : 0
   }) : missingContainerVerdict(workload);
+  HEALTH_SNAPSHOTS.set(key, {
+    organizationId: candidate.project.organizationId,
+    projectId: candidate.project.id,
+    projectName: candidate.project.name,
+    projectSlug: candidate.project.slug,
+    serviceId: workload.serviceId,
+    serviceKey: workload.serviceKey,
+    serviceName: workload.serviceName,
+    serverId: candidate.serverId,
+    containerId: workload.containerId,
+    state: verdict.clear === "unknown" ? "unknown" : verdict.kind ?? "healthy",
+    observedAt: new Date(nowMs).toISOString()
+  });
   if (verdict.clear === "unknown") {
     summary.indeterminate++;
     const carried = previous && sameContainer ? previous : {
@@ -316418,7 +316511,7 @@ async function pruneResolvedIncidents() {
   const cutoff = new Date(Date.now() - INCIDENT_RETENTION_DAYS * 24 * 60 * 60 * 1000);
   return { deleted: await repos.serviceIncident.deleteResolvedOlderThan(cutoff) };
 }
-var AGREE_TICKS = 2, MIN_CONFIRM_GAP_MS = 4000, RESTART_WINDOW_MS = 45000, RESTART_STALE_MS, DEPLOY_GRACE_MS, SERVER_CONCURRENCY = 4, GROUP_DEADLINE_MS = 90000, GROUP_DEADLINE_REASON, INSPECT_CONCURRENCY = 8, MAX_INSPECTS_PER_SERVER = 120, LOG_TAIL_LINES = 12, FLAP_WINDOW_MS, RECOVERY_HOLD_MS, SINGLE_APP_KEY = "__app__", MEMORY, LOCAL_SERVER_KEY = "__local__", sweepChain, KNOWN_STATES, INCIDENT_RETENTION_DAYS = 30;
+var AGREE_TICKS = 2, MIN_CONFIRM_GAP_MS = 4000, RESTART_WINDOW_MS = 45000, RESTART_STALE_MS, DEPLOY_GRACE_MS, SERVER_CONCURRENCY = 4, GROUP_DEADLINE_MS = 90000, GROUP_DEADLINE_REASON, INSPECT_CONCURRENCY = 8, MAX_INSPECTS_PER_SERVER = 120, LOG_TAIL_LINES = 12, FLAP_WINDOW_MS, RECOVERY_HOLD_MS, SINGLE_APP_KEY = "__app__", MEMORY, HEALTH_SNAPSHOTS, TRACKED_CONTAINERS, LOCAL_SERVER_KEY = "__local__", sweepChain, KNOWN_STATES, INCIDENT_RETENTION_DAYS = 30;
 var init_health_watch = __esm(async () => {
   init_src2();
   init_src();
@@ -316437,6 +316530,8 @@ var init_health_watch = __esm(async () => {
   FLAP_WINDOW_MS = 10 * 60000;
   RECOVERY_HOLD_MS = 2 * 60000;
   MEMORY = new Map;
+  HEALTH_SNAPSHOTS = new Map;
+  TRACKED_CONTAINERS = new Map;
   sweepChain = Promise.resolve();
   KNOWN_STATES = new Set([
     "created",
@@ -344050,6 +344145,11 @@ async function loadNames(organizationId) {
 }
 
 // ../api/src/modules/issues/issues.controller.ts
+init_env();
+await __promiseAll([
+  init_health_watch(),
+  init_src3()
+]);
 async function listIssues(c2) {
   const ctx2 = getRequestContext(c2);
   const status = c2.req.query("status") === "resolved" ? "resolved" : "open";
@@ -344061,30 +344161,72 @@ async function issuesSummary(c2) {
   const { counts } = await listOrganizationIssues(ctx2);
   return c2.json({ data: counts });
 }
+async function healthSnapshot(c2) {
+  const ctx2 = getRequestContext(c2);
+  const [rows, job2, servers2] = await Promise.all([
+    Promise.resolve(listWorkloadHealthSnapshots(ctx2.organizationId)),
+    repos.job.findByKey("services:health-watch"),
+    repos.server.listByOrganization(ctx2.organizationId)
+  ]);
+  const serverNames = new Map(servers2.map((server) => [server.id, server.name ?? server.sshHost]));
+  return c2.json({
+    data: rows.map((row) => ({
+      ...row,
+      serverName: row.serverId ? serverNames.get(row.serverId) ?? row.serverId : "This server"
+    })),
+    watching: job2?.enabled ?? false,
+    watcher: {
+      key: "services:health-watch",
+      schedule: job2?.cronExpression ?? null,
+      eventsEnabled: !env.OPENSHIP_DISABLE_CONTAINER_EVENTS
+    }
+  });
+}
 var RESCAN_JOBS = [
   "services:health-watch",
   "infra:scan",
   "domains:verify-pending",
   "updates:scan"
 ];
+var activeRescan = null;
+function rescanStatus(c2) {
+  return c2.json({ data: activeRescan });
+}
 async function rescanIssues(c2) {
+  if (activeRescan?.status === "running")
+    return c2.json({ data: activeRescan }, 202);
   const available = RESCAN_JOBS.filter((key) => {
     const def = SYSTEM_JOB_BY_KEY.get(key);
     return !def?.available || def.available();
   });
   const skipped = RESCAN_JOBS.filter((key) => !available.includes(key));
-  const settled = await Promise.allSettled(available.map((key) => runJobNow(key)));
-  const ran = [];
-  const failed = [];
-  settled.forEach((result, i3) => {
-    const key = available[i3];
-    if (result.status === "fulfilled")
-      ran.push(key);
-    else
-      failed.push({ key, error: result.reason?.message ?? "failed" });
+  activeRescan = {
+    id: crypto.randomUUID(),
+    status: "running",
+    startedAt: new Date().toISOString(),
+    stages: RESCAN_JOBS.map((key) => ({
+      key,
+      status: skipped.includes(key) ? "skipped" : "pending"
+    }))
+  };
+  const session5 = activeRescan;
+  Promise.all(available.map(async (key) => {
+    const stage = session5.stages.find((item) => item.key === key);
+    stage.status = "running";
+    try {
+      const result = await runJobNow(key);
+      stage.status = "completed";
+      stage.summary = result.summary ?? {};
+    } catch (err2) {
+      stage.status = "failed";
+      stage.error = err2?.message ?? "failed";
+    }
+  })).finally(() => {
+    session5.status = "completed";
+    session5.finishedAt = new Date().toISOString();
   });
-  c2.set("auditAfter", { ran, skipped, failed: failed.map((f3) => f3.key) });
-  return c2.json({ data: { ran, skipped, failed } });
+  c2.set("auditAfter", { scanSessionId: session5.id, stages: available, skipped });
+  return c2.json({ data: session5 }, 202);
 }
 
 // ../api/src/modules/issues/issues.routes.ts
@@ -344104,6 +344246,13 @@ r11.get("/summary", {
     description: "Counts only from the same feed as GET /issues: {outage, actionRequired, advisory, total}. Use for a quick health verdict; read GET /issues for the rows and their fixes."
   }
 }, issuesSummary);
+r11.get("/health", {
+  tag: "project:list",
+  localOnly: true,
+  mcp: {
+    description: "Latest health-watch snapshot for every expected workload in the organization. Cached only: this read performs no Docker polling. Includes healthy, unhealthy, crash-looping, down and unknown states plus watcher enabled status."
+  }
+}, healthSnapshot);
 r11.post("/rescan", {
   tag: "job:write",
   collection: true,
@@ -344112,6 +344261,7 @@ r11.post("/rescan", {
     description: "Run the checkers behind GET /issues immediately (health watch, managed-container scan, pending domain verification, update scan) instead of waiting for their schedules, then re-read GET /issues. Returns which jobs ran, which were skipped as not applicable to this platform, and which failed. Adds no new probing — these are the same scheduled jobs, recorded in the jobs history as manual runs. Self-hosted only."
   }
 }, rescanIssues);
+r11.get("/rescan/status", { tag: "job:read", localOnly: true }, rescanStatus);
 var issuesRoutes = r11.hono;
 
 // ../api/src/modules/jobs/job.routes.ts
@@ -344646,6 +344796,7 @@ var HealthcheckSchema = Type.Object({
 }, { additionalProperties: false });
 var AdvancedSchema = Type.Object({
   healthcheck: Type.Optional(Type.Union([HealthcheckSchema, Type.Null()])),
+  monitoringEnabled: Type.Optional(Type.Union([Type.Boolean(), Type.Null()])),
   readiness: Type.Optional(Type.Union([
     Type.Object({
       enabled: Type.Optional(Type.Boolean()),

package/dist/{up-HQS7IR7H.js → up-RC5ZQIAD.js}

@@ -7,8 +7,8 @@ import {
   runHeadlessProvision,
   startService,
   upCommand
-} from "./chunk-RCMERVBL.js";
-import "./chunk-5I3COAFH.js";
+} from "./chunk-FCGJN5Q5.js";
+import "./chunk-634DDFT5.js";
 import "./chunk-7YBWXEM6.js";
 import "./chunk-5UXHT6ED.js";
 import "./chunk-QWHBRY2K.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openship",
-  "version": "0.6.8",
+  "version": "0.6.9",
   "description": "Openship CLI - deploy, manage, and open your Openship platform from the terminal",
   "license": "Apache-2.0",
   "repository": {