openship 0.6.9 → 0.7.0

package/dist/{chunk-WEZFTL4V.js → chunk-IVRTIKNZ.js}

@@ -8621,6 +8621,156 @@ Two things worth knowing, both upstream behaviour: if the console shows a branch
           defaultMode: "domain"
         }
       ]
+    },
+    {
+      $schema: "https://openship.io/app.schema.json",
+      available: true,
+      minEngine: "0.6.6",
+      id: "pocketbase",
+      name: "PocketBase",
+      description: "Self-hosted PocketBase with auth, a realtime SQLite database, file storage, and an admin dashboard in one small service.",
+      repository: "https://github.com/pocketbase/pocketbase",
+      kind: "template",
+      logo: "pocketbase",
+      category: "backend",
+      tags: [
+        "auth",
+        "database",
+        "sqlite",
+        "realtime"
+      ],
+      framework: "docker-compose",
+      services: [
+        {
+          name: "pocketbase",
+          build: {
+            dockerfile: 'FROM alpine:3.24.1 AS downloader\nARG PB_VERSION=0.40.1\nRUN apk add --no-cache ca-certificates unzip wget \\\n    && ARCH=$(uname -m) \\\n    && case "$ARCH" in x86_64) ARCH=amd64 ;; aarch64) ARCH=arm64 ;; *) echo "Unsupported architecture: $ARCH" >&2; exit 1 ;; esac \\\n    && wget -q https://github.com/pocketbase/pocketbase/releases/download/v${PB_VERSION}/checksums.txt -O /tmp/checksums.txt \\\n    && wget -q https://github.com/pocketbase/pocketbase/releases/download/v${PB_VERSION}/pocketbase_${PB_VERSION}_linux_${ARCH}.zip -O /tmp/pocketbase_${PB_VERSION}_linux_${ARCH}.zip \\\n    && cd /tmp \\\n    && grep " pocketbase_${PB_VERSION}_linux_${ARCH}.zip$" checksums.txt | sha256sum -c - \\\n    && unzip pocketbase_${PB_VERSION}_linux_${ARCH}.zip -d /pb\nFROM alpine:3.24.1\nRUN apk add --no-cache ca-certificates su-exec \\\n    && addgroup -S pocketbase \\\n    && adduser -S -G pocketbase -h /pb pocketbase\nCOPY --chown=pocketbase:pocketbase --from=downloader /pb/pocketbase /pb/pocketbase\nCOPY --chown=pocketbase:pocketbase pocketbase/entrypoint.sh /pb/entrypoint.sh\nRUN chmod 755 /pb/entrypoint.sh\nWORKDIR /pb\nENTRYPOINT ["/pb/entrypoint.sh"]\nCMD ["/pb/pocketbase", "serve", "--http=0.0.0.0:8090", "--encryptionEnv=PB_ENCRYPTION_KEY"]\n',
+            files: [
+              {
+                path: "entrypoint.sh",
+                content: `#!/bin/sh
+set -eu
+mkdir -p /pb/pb_data
+chown pocketbase:pocketbase /pb/pb_data
+export PB_ENCRYPTION_KEY="$(printf '%.32s' "$PB_ENCRYPTION_SEED")"
+if [ ! -e /pb/pb_data/.openship-superuser ]; then
+  su-exec pocketbase /pb/pocketbase superuser upsert "$POCKETBASE_SUPERUSER_EMAIL" "$POCKETBASE_SUPERUSER_PASSWORD" --dir=/pb/pb_data --encryptionEnv=PB_ENCRYPTION_KEY >/dev/null
+  su-exec pocketbase touch /pb/pb_data/.openship-superuser
+fi
+exec su-exec pocketbase "$@"
+`
+              }
+            ]
+          },
+          environment: {
+            GOMEMLIMIT: "512MiB"
+          },
+          secretEnv: [
+            "PB_ENCRYPTION_SEED",
+            "POCKETBASE_SUPERUSER_PASSWORD"
+          ],
+          ports: [
+            "8090:8090"
+          ],
+          exposedPort: 8090,
+          exposed: true,
+          volumes: [
+            "pocketbase_data:/pb/pb_data"
+          ],
+          healthcheck: {
+            test: [
+              "CMD",
+              "wget",
+              "-qO-",
+              "http://127.0.0.1:8090/api/health"
+            ],
+            interval: "5s",
+            timeout: "3s",
+            retries: 20,
+            startPeriod: "10s"
+          },
+          stopGracePeriod: "30s",
+          restart: "unless-stopped"
+        }
+      ],
+      configFields: [
+        {
+          key: "PB_ENCRYPTION_SEED",
+          service: "pocketbase",
+          label: "Settings encryption seed",
+          help: "Derives the stable 32-character key that encrypts PocketBase settings in the data volume.",
+          generate: "secret",
+          secret: true
+        },
+        {
+          key: "POCKETBASE_SUPERUSER_PASSWORD",
+          service: "pocketbase",
+          label: "Initial superuser password",
+          help: "Auto-generated for the first deployment and shown in the connection card.",
+          generate: "secret",
+          secret: true
+        },
+        {
+          key: "POCKETBASE_SUPERUSER_EMAIL",
+          service: "pocketbase",
+          label: "Superuser email",
+          help: "Email for the superuser created during the first deployment.",
+          type: "text",
+          default: "admin@openship.local",
+          required: true
+        }
+      ],
+      connection: {
+        title: "Connect to PocketBase",
+        description: "Use the public URL from browsers and other projects. The admin dashboard is available at /_/.",
+        guide: {
+          intro: "PocketBase stores auth, records, and files in one persistent SQLite-backed volume.",
+          useHint: "Create scoped credentials for automation, configure off-host backups, and point each app at this URL.",
+          defaultMode: "public"
+        },
+        outputs: [
+          {
+            id: "url",
+            label: "PocketBase URL",
+            source: "publicUrl:pocketbase",
+            kind: "url",
+            envKey: "POCKETBASE_URL",
+            recommended: true
+          },
+          {
+            id: "email",
+            label: "Superuser email",
+            source: "env:pocketbase:POCKETBASE_SUPERUSER_EMAIL",
+            envKey: "POCKETBASE_SUPERUSER_EMAIL"
+          },
+          {
+            id: "password",
+            label: "Initial superuser password",
+            help: "Use this installation credential until you change the password in PocketBase.",
+            source: "env:pocketbase:POCKETBASE_SUPERUSER_PASSWORD",
+            envKey: "POCKETBASE_SUPERUSER_PASSWORD",
+            secret: true
+          }
+        ]
+      },
+      provides: [
+        {
+          id: "pocketbase",
+          outputRefs: [
+            "url"
+          ],
+          category: "database"
+        }
+      ],
+      endpoints: [
+        {
+          service: "pocketbase",
+          port: 8090,
+          label: "PocketBase API and dashboard",
+          kind: "http",
+          defaultMode: "domain"
+        }
+      ]
     }
   ]
 };
@@ -25919,6 +26069,39 @@ var AUDIT_EVENTS = {
     label: "GitHub app installed",
     tone: "info"
   },
+  "github.source.created": {
+    category: "system",
+    action: "registered the GitHub App source",
+    label: "GitHub App source registered",
+    tone: "info",
+    description: "An organization-owned GitHub App was verified and stored. Secret values are never recorded."
+  },
+  "github.source.updated": {
+    category: "system",
+    action: "updated the GitHub App source",
+    label: "GitHub App source updated",
+    tone: "info",
+    description: "A GitHub App's identity, endpoint, or encrypted credentials changed."
+  },
+  "github.source.verified": {
+    category: "system",
+    action: "verified the GitHub App source",
+    label: "GitHub App source verified",
+    tone: "info"
+  },
+  "github.source.defaulted": {
+    category: "system",
+    action: "made the default GitHub App source",
+    label: "Default GitHub App source changed",
+    tone: "info"
+  },
+  "github.source.deleted": {
+    category: "system",
+    action: "deleted the GitHub App source",
+    label: "GitHub App source deleted",
+    tone: "warning",
+    description: "The local App credentials and installation bindings were removed; the GitHub App itself was not uninstalled on GitHub."
+  },
   "github.disconnect": {
     category: "system",
     action: "disconnected GitHub from",

package/dist/{chunk-P7RCYELG.js → chunk-J2NDOB7D.js}

@@ -4,7 +4,7 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   shellQuote
-} from "./chunk-WEZFTL4V.js";
+} from "./chunk-IVRTIKNZ.js";
 
 // ../../packages/adapters/src/system/local-shell.ts
 import { execFile } from "child_process";

package/dist/{chunk-T6DVUX4F.js → chunk-J4SYG2LC.js}

@@ -8,13 +8,14 @@ import {
   getLocalShellPath,
   logEntry,
   sq
-} from "./chunk-P7RCYELG.js";
+} from "./chunk-J2NDOB7D.js";
 
 // ../../packages/adapters/src/system/local-executor.ts
 import { exec, spawn } from "child_process";
 import {
   access,
   mkdir as fsMkdir,
+  open as fsOpen,
   readFile as fsReadFile,
   rename as fsRename,
   rm as fsRm,
@@ -82,9 +83,19 @@ var LocalExecutor = class {
       });
     });
   }
-  async writeFile(path, content) {
+  async writeFile(path, content, opts) {
     await fsMkdir(dirname(path), { recursive: true });
-    await fsWriteFile(path, content, "utf-8");
+    if (opts?.mode === void 0) {
+      await fsWriteFile(path, content, "utf-8");
+      return;
+    }
+    const file = await fsOpen(path, "w", opts.mode);
+    try {
+      await file.chmod(opts.mode);
+      await file.writeFile(content, "utf-8");
+    } finally {
+      await file.close();
+    }
   }
   async rename(from, to) {
     await fsRename(from, to);

package/dist/{chunk-VAI5VOOI.js → chunk-JAKVPLHT.js}

@@ -4,7 +4,7 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   PACKAGE_ROOT_ONLY_EXCLUDES
-} from "./chunk-WEZFTL4V.js";
+} from "./chunk-IVRTIKNZ.js";
 
 // ../../packages/adapters/src/archive.ts
 import { execFile } from "child_process";

package/dist/{chunk-NPSRGIHV.js → chunk-JWW5YAFL.js}

@@ -4,7 +4,7 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   sq
-} from "./chunk-P7RCYELG.js";
+} from "./chunk-J2NDOB7D.js";
 import {
   formatDuration,
   isRemoteConnectionError,
@@ -17,7 +17,7 @@ import {
   parseSystemArch,
   parseSystemOs,
   safeErrorMessage
-} from "./chunk-WEZFTL4V.js";
+} from "./chunk-IVRTIKNZ.js";
 
 // ../../packages/adapters/src/system/elevated-executor.ts
 import { randomBytes } from "crypto";
@@ -47,12 +47,13 @@ function elevatedExecutor(inner) {
     if (await inner.exists(path).catch(() => false)) return true;
     return await inner.exec(elevateCommand(`test -e ${sq(path)}`)).then(() => true).catch(() => false);
   };
-  const writeFileElevated = async (path, content) => {
+  const writeFileElevated = async (path, content, opts) => {
     const stage = `/tmp/.openship-elev-${randomBytes(12).toString("hex")}`;
     await inner.exec(`mkdir -m 700 ${sq(stage)}`);
     try {
       const staged = `${stage}/payload`;
-      await inner.writeFile(staged, content);
+      if (opts === void 0) await inner.writeFile(staged, content);
+      else await inner.writeFile(staged, content, opts);
       await inner.exec(
         elevateCommand(
           `mkdir -p ${sq(dirOf(path))} && chown 0:0 ${sq(staged)} && mv -f ${sq(staged)} ${sq(path)}`

package/dist/{chunk-FCGJN5Q5.js → chunk-KYTTPWRP.js}

@@ -28,7 +28,7 @@ import {
   resolvePorts,
   sourceBuildDir,
   verifyHostChannel
-} from "./chunk-634DDFT5.js";
+} from "./chunk-TT7P5ZZ3.js";
 import {
   bootstrapAdmin,
   importMigratedSites,
@@ -36,18 +36,18 @@ import {
   internalPost,
   mintBareInternalToken,
   waitHealthy
-} from "./chunk-7YBWXEM6.js";
+} from "./chunk-LL7M7GL4.js";
 import {
   startUnitHint,
   thisHost
-} from "./chunk-5UXHT6ED.js";
+} from "./chunk-SPR7N2EK.js";
 import {
   completeHostEdge,
   markStoppedProxyImported,
   planAndApplyHostEdge,
   previewHostEdge,
   rollbackHostEdge
-} from "./chunk-NUT6HKK6.js";
+} from "./chunk-5D27WZBW.js";
 import {
   AUTH_SECRET_FILE,
   DATA_DIR,
@@ -58,17 +58,17 @@ import {
 } from "./chunk-ELGRMZOW.js";
 import {
   LocalExecutor
-} from "./chunk-T6DVUX4F.js";
+} from "./chunk-J4SYG2LC.js";
 import {
   edgeCrashReason,
   edgeIsBroken
-} from "./chunk-X53JXRS4.js";
+} from "./chunk-YGA52DHX.js";
 import {
   EDGE_CONTAINER_NAME
-} from "./chunk-D6HU4VUZ.js";
+} from "./chunk-CMGRMPRQ.js";
 import {
   isValidEmail
-} from "./chunk-WEZFTL4V.js";
+} from "./chunk-IVRTIKNZ.js";
 
 // src/commands/up.ts
 import { Command } from "commander";
@@ -1564,7 +1564,7 @@ async function runForeground(opts, source) {
     const uiSpinner = ora("Preparing the dashboard\u2026").start();
     try {
       const bundle = await ensureDashboard({
-        tag: source ? "local" : opts.uiVersion || `v${"0.6.9"}`,
+        tag: source ? "local" : opts.uiVersion || `v${"0.7.0"}`,
         onProgress: (received, total) => {
           if (total) {
             uiSpinner.text = `Downloading dashboard\u2026 ${Math.round(received / total * 100)}%`;

package/dist/{chunk-7YBWXEM6.js → chunk-LL7M7GL4.js}

@@ -7,20 +7,20 @@ import {
   composeInstallExists,
   readComposeEnvFile,
   startUnitHint
-} from "./chunk-5UXHT6ED.js";
+} from "./chunk-SPR7N2EK.js";
 import {
   INTERNAL_TOKEN_FILE,
   OS_DIR
 } from "./chunk-ELGRMZOW.js";
 import {
   LocalExecutor
-} from "./chunk-T6DVUX4F.js";
+} from "./chunk-J4SYG2LC.js";
 import {
   edgeCrashReason
-} from "./chunk-X53JXRS4.js";
+} from "./chunk-YGA52DHX.js";
 import {
   EDGE_CONTAINER_NAME
-} from "./chunk-D6HU4VUZ.js";
+} from "./chunk-CMGRMPRQ.js";
 
 // src/lib/edge-import.ts
 import chalk from "chalk";

package/dist/{chunk-SK4FFCFR.js → chunk-MZYD3LFP.js}

@@ -4,7 +4,7 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   sq
-} from "./chunk-P7RCYELG.js";
+} from "./chunk-J2NDOB7D.js";
 
 // ../../packages/adapters/src/runtime/managed-artifact.ts
 var MANAGED_ARTIFACT_BASE = "/opt/openship";

package/dist/{chunk-6GU6JSK6.js → chunk-QNQFS37A.js}

@@ -13,14 +13,14 @@ import {
   resolveDockerRootDirectory,
   resolveDockerfileCandidates,
   resolveWithinDirectory
-} from "./chunk-AHJYP7DG.js";
+} from "./chunk-SYQ3FOLE.js";
 import {
   getTarCreateEnv,
   prepareSourceTarArgs
-} from "./chunk-VAI5VOOI.js";
+} from "./chunk-JAKVPLHT.js";
 import {
   isValidEnvKey
-} from "./chunk-WEZFTL4V.js";
+} from "./chunk-IVRTIKNZ.js";
 import {
   __commonJS,
   __toESM

package/dist/{chunk-T46BQOLY.js → chunk-RHHCAWW3.js}

@@ -4,15 +4,15 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   hostRefusal
-} from "./chunk-GNOMEMNI.js";
+} from "./chunk-3LWGDMJU.js";
 import {
   elevatedExecutor,
   resolveEnvironment
-} from "./chunk-NPSRGIHV.js";
+} from "./chunk-JWW5YAFL.js";
 import {
   answered,
   refused
-} from "./chunk-WEZFTL4V.js";
+} from "./chunk-IVRTIKNZ.js";
 
 // ../../packages/adapters/src/system/privilege.ts
 function rootChecked(executor, why) {

package/dist/{chunk-5UXHT6ED.js → chunk-SPR7N2EK.js}

@@ -134,10 +134,10 @@ import {
 } from "./chunk-ZWLDLTJP.js";
 import {
   CloudRuntime
-} from "./chunk-MUWVC5R4.js";
+} from "./chunk-DZBXOF5Q.js";
 import {
   OPENRESTY_DEFAULT_PATHS
-} from "./chunk-7PEXM2UI.js";
+} from "./chunk-BOD2IQ3P.js";
 import {
   DockerRuntime,
   daemonConnectionFrom,
@@ -146,26 +146,26 @@ import {
   resolveExecExitCode,
   startAttachStream,
   startExecStream
-} from "./chunk-3MP6ACKM.js";
+} from "./chunk-TPGBT5UR.js";
 import {
   BareRuntime
-} from "./chunk-ENKJ7XIF.js";
+} from "./chunk-5CFUYMPE.js";
 import {
   createExecutor
-} from "./chunk-UAWY6X7V.js";
+} from "./chunk-3KUW2UC6.js";
 import {
   envOps
-} from "./chunk-GNOMEMNI.js";
+} from "./chunk-3LWGDMJU.js";
 import {
   ENVIRONMENT_PROBE_SCRIPT,
   ENVIRONMENT_PROBE_TIMEOUT_MS,
   cacheEnvironment,
   parseEnvironmentProbe,
   profileIsFresh
-} from "./chunk-NPSRGIHV.js";
+} from "./chunk-JWW5YAFL.js";
 import {
   MAIL_HOST_STATE_DIR
-} from "./chunk-D6HU4VUZ.js";
+} from "./chunk-CMGRMPRQ.js";
 import {
   FAMILY_BY_DISTRO,
   isAwsS3Endpoint,
@@ -177,7 +177,7 @@ import {
   validateBackupPath,
   validateClearPath,
   withTimeout
-} from "./chunk-WEZFTL4V.js";
+} from "./chunk-IVRTIKNZ.js";
 
 // ../../packages/adapters/src/runtime/image-transfer.ts
 import { Transform } from "stream";
@@ -1141,6 +1141,8 @@ function demuxDockerStream(source, stdout, stderr, onError) {
 
 // ../../packages/adapters/src/backup/executors/docker.ts
 var HELPER_IMAGE = "alpine:3";
+var BIND_PROBE_TARGET = "/__openship_bind_source";
+var DOCKER_MODE_DIRECTORY = 2 ** 31;
 var ARTIFACT_BUFFER_BYTES = 4 * 1024 * 1024;
 var DEFAULT_HELPER_IDLE_MS = 10 * 60 * 1e3;
 var DEFAULT_HELPER_TIMEOUT_MS = 6 * 60 * 60 * 1e3;
@@ -1216,6 +1218,29 @@ function parseVolumeSpec(spec) {
   const type = isHostPathSource(source) ? "bind" : "volume";
   return { source, target, type };
 }
+function archivePathIsDirectory(response, path) {
+  const rawHeader = response.headers?.["x-docker-container-path-stat"];
+  const encoded = Array.isArray(rawHeader) ? rawHeader[0] : rawHeader;
+  if (!encoded) {
+    throw new Error(`Docker returned no path-stat header while inspecting ${path}`);
+  }
+  let stat;
+  try {
+    stat = JSON.parse(Buffer.from(encoded, "base64").toString("utf8"));
+  } catch (err) {
+    throw new Error(`Docker returned an invalid path-stat header while inspecting ${path}`, {
+      cause: err
+    });
+  }
+  const mode = stat?.mode;
+  if (typeof mode !== "number" || !Number.isSafeInteger(mode)) {
+    throw new Error(`Docker returned no valid path mode while inspecting ${path}`);
+  }
+  return mode >= DOCKER_MODE_DIRECTORY;
+}
+function isMissingBindSourceError(err) {
+  return err?.statusCode === 400 && /bind source path does not exist/i.test(safeErrorMessage(err));
+}
 var DockerBackupExecutor = class {
   constructor(runtime) {
     this.runtime = runtime;
@@ -1244,23 +1269,82 @@ var DockerBackupExecutor = class {
       );
     }
   }
+  /**
+   * Ask the Docker daemon about a path in a container's mount namespace.
+   *
+   * The API may itself run in a container or connect to Docker over SSH/TLS, so
+   * `node:fs` would inspect the wrong filesystem. Docker's archive-info endpoint
+   * returns the daemon-side path's Go FileMode without copying any archive bytes.
+   */
+  async containerPathIsDirectory(container, path) {
+    let response;
+    try {
+      response = await container.infoArchive({ path });
+      return archivePathIsDirectory(response, path);
+    } finally {
+      response?.resume?.();
+    }
+  }
+  /**
+   * Classify a recorded bind source when there is no service container to inspect.
+   * A never-started helper gives Docker a mount namespace, and archive-info reports
+   * the source type from the daemon host. `Mounts` (rather than legacy `Binds`) is
+   * deliberate: a missing source is rejected instead of being created as a directory.
+   */
+  async declaredBindIsDirectory(sourcePath) {
+    try {
+      return await this.withHelper(
+        {
+          Image: HELPER_IMAGE,
+          NetworkDisabled: true,
+          HostConfig: {
+            Mounts: [
+              {
+                Type: "bind",
+                Source: sourcePath,
+                Target: BIND_PROBE_TARGET,
+                ReadOnly: true
+              }
+            ]
+          }
+        },
+        (helper) => this.containerPathIsDirectory(helper, BIND_PROBE_TARGET)
+      );
+    } catch (err) {
+      if (isMissingBindSourceError(err)) return true;
+      throw new Error(
+        `Could not inspect bind mount source "${sourcePath}" on the Docker host: ` + safeErrorMessage(err),
+        { cause: err }
+      );
+    }
+  }
   async listSources(service) {
     if (service.containerId) {
+      const container = this.dockerode.getContainer(service.containerId);
+      let data = null;
       try {
-        const data = await this.dockerode.getContainer(service.containerId).inspect();
-        const mounts = data.Mounts ?? [];
-        return mounts.filter((m2) => m2.Type === "volume" || m2.Type === "bind").map(
-          (m2, i2) => ({
-            id: m2.Name ?? m2.Source ?? `mount-${i2}`,
-            target: m2.Destination ?? "",
-            source: m2.Name ?? m2.Source ?? "",
-            type: m2.Type ?? "volume"
-          })
-        );
+        data = await container.inspect();
       } catch {
       }
+      if (data) {
+        const mounts = data.Mounts ?? [];
+        const sources2 = [];
+        for (const [i2, mount] of mounts.entries()) {
+          if (mount.Type !== "volume" && mount.Type !== "bind") continue;
+          if (mount.Type === "bind" && (!mount.Destination || !await this.containerPathIsDirectory(container, mount.Destination))) {
+            continue;
+          }
+          sources2.push({
+            id: mount.Name ?? mount.Source ?? `mount-${i2}`,
+            target: mount.Destination ?? "",
+            source: mount.Name ?? mount.Source ?? "",
+            type: mount.Type
+          });
+        }
+        return sources2;
+      }
     }
-    return service.volumes.map((spec, i2) => {
+    const sources = service.volumes.map((spec, i2) => {
       const parsed = parseVolumeSpec(spec);
       if (!parsed || !parsed.source) return null;
       const source = parsed.type === "volume" && service.namespaceVolumes ? ensureScopedVolumeName(service.projectSlug, parsed.source) : parsed.source;
@@ -1271,6 +1355,15 @@ var DockerBackupExecutor = class {
         type: parsed.type
       };
     }).filter((x2) => x2 !== null);
+    if (!sources.some((source) => source.type === "bind")) return sources;
+    await this.ensureImage(HELPER_IMAGE);
+    const backupable = [];
+    for (const source of sources) {
+      if (source.type !== "bind" || await this.declaredBindIsDirectory(source.source)) {
+        backupable.push(source);
+      }
+    }
+    return backupable;
   }
   /**
    * The container's own `Config.Env`, as `KEY=value` pairs already split.