@codions/portta 0.0.0-develop.154.sha-cf86996 → 0.0.0-develop.157.sha-ae5ce5e

package/dist/cli.js

@@ -22364,7 +22364,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@codions/portta",
-      version: "0.0.0-develop.154.sha-cf86996",
+      version: "0.0.0-develop.157.sha-ae5ce5e",
       description: "Machine-first CLI for a shared Docker development gateway",
       license: "MIT",
       type: "module",
@@ -22438,7 +22438,7 @@ var init_version = __esm({
     "use strict";
     init_package();
     CLI_VERSION = package_default.version;
-    CLI_BUILD_DATE = true ? "2026-09-16T16:23:04Z" : void 0;
+    CLI_BUILD_DATE = true ? "2026-09-16T21:32:25Z" : void 0;
   }
 });
 
@@ -89799,7 +89799,7 @@ function createDaemonTaskflowHost(context) {
       port: hostListen(env).port,
       workflowBuiltinsDir: taskflowAssets(env).workflowBuiltinsDir,
       version: env.PORTTA_VERSION || "0.0.0-local",
-      buildDate: true ? "2026-09-16T16:23:04Z" : (/* @__PURE__ */ new Date()).toISOString(),
+      buildDate: true ? "2026-09-16T21:32:25Z" : (/* @__PURE__ */ new Date()).toISOString(),
       environmentStore: createEnvironmentStore(paths3.database),
       hostEnvironmentProvider: new HostEnvironmentProvider(),
       devContainerProvider: new DevContainerProvider(),
@@ -100395,7 +100395,7 @@ var require_network = __commonJS({
     var exec3 = __require("child_process").exec;
     var execSync = __require("child_process").execSync;
     var execFileSync2 = __require("child_process").execFileSync;
-    var readFileSync38 = __require("fs").readFileSync;
+    var readFileSync39 = __require("fs").readFileSync;
     var fs = __require("fs");
     var util2 = require_util2();
     var _platform = process.platform;
@@ -100883,7 +100883,7 @@ var require_network = __commonJS({
         return result;
       }
       try {
-        const content = readFileSync38(file2, { encoding: "utf8" });
+        const content = readFileSync39(file2, { encoding: "utf8" });
         const lines = content.split("\n").filter((l) => /iface|source/.test(l));
         lines.forEach((line4) => {
           const parts2 = line4.replace(/\s+/g, " ").trim().split(" ");
@@ -119202,10 +119202,11 @@ async function panelSetupState(apiUrl) {
     return null;
   }
 }
+var PANEL_SERVICES = ["web", "web-socket-proxy"];
 async function webDown(command) {
   const context = gatewayContext({ profile: globals4(command).profile, overrides: { ...PANEL_OVERRIDES, PORTTA_WEB_DEV: "true" } });
   const env = { ...context.env, PORTTA_WEB: "true", PORTTA_WEB_DEV: "true" };
-  const services = ["db", "web", "web-socket-proxy"];
+  const services = PANEL_SERVICES;
   await runProcess("docker", ["compose", ...composeArguments({ ...context, env }), "stop", ...services], { cwd: context.root, env, reject: false });
   await runProcess("docker", ["compose", ...composeArguments({ ...context, env }), "rm", "-f", ...services], { cwd: context.root, env, reject: false });
   const output2 = new Output(globals4(command));
@@ -119222,7 +119223,7 @@ async function webRestart(command) {
 }
 async function webLogs(service2, command) {
   const target = service2 ?? "web";
-  if (!["web", "web-socket-proxy", "db", "portta-auth"].includes(target)) throw new UsageError(`unknown panel service: ${target}`);
+  if (!["web", "web-socket-proxy", "portta-auth"].includes(target)) throw new UsageError(`unknown panel service: ${target}`);
   const global3 = globals4(command);
   if (global3.json) {
     const result = await webCompose(command, ["logs", "--no-color", "--no-log-prefix", "--tail", "100", target], {}, "pipe");
@@ -120140,7 +120141,7 @@ async function runtimeAction(action, options, command) {
 init_src();
 init_src();
 init_context();
-import { chmodSync as chmodSync9, existsSync as existsSync38, mkdirSync as mkdirSync18, readFileSync as readFileSync30, readdirSync as readdirSync8, rmSync as rmSync10 } from "node:fs";
+import { chmodSync as chmodSync9, existsSync as existsSync38, mkdirSync as mkdirSync18, readFileSync as readFileSync31, readdirSync as readdirSync8, rmSync as rmSync10 } from "node:fs";
 import { join as join57 } from "node:path";
 init_errors3();
 init_version();
@@ -120762,35 +120763,9 @@ async function runDoctor(context) {
     const socket = (proxy.mounts ?? []).find((mount) => mount.source.includes("docker.sock"));
     add(!socket ? check2("proxy.socket", "warn", "docker socket mount", "could not determine mount mode") : socket.readWrite ? check2("proxy.socket", "fail", "docker socket mount", "mounted read-write", "mount /var/run/docker.sock read-only (:ro)") : check2("proxy.socket", "pass", "docker socket mount", "read-only"));
   }
-  const database = gatewayContainer(containers, "db");
-  const dbNetwork = env["PORTTA_DB_NETWORK"] || `${config3.network}-data`;
-  if (database) {
-    add(database.state === "running" ? check2("db.state", "pass", "panel database", "running") : config3.webEnabled ? check2("db.state", "fail", "panel database", `state=${database.state}; the panel refuses to start without it`, "portta web up") : check2("db.state", "warn", "panel database", `state=${database.state}; the panel is off, so nothing needs it`, "portta web up"));
-    const dbPublished = publishedBindings(database);
-    add(dbPublished ? check2(
-      "db.exposure",
-      "fail",
-      "panel database exposure",
-      `publishes host ports: ${dbPublished}`,
-      "remove every ports entry from docker/compose/features/db.yaml and recreate the database container"
-    ) : check2("db.exposure", "pass", "panel database exposure", "no host ports published"));
-    add(database.networks.includes(config3.network) ? check2(
-      "db.network.shared",
-      "fail",
-      "panel database network",
-      `attached to the shared HTTP network '${config3.network}'`,
-      `detach it; the panel database belongs only on '${dbNetwork}'`
-    ) : check2("db.network.shared", "pass", "panel database network", "off the shared HTTP network"));
-    const data = await networkFacts(dbNetwork);
-    add(!data.exists ? check2("db.network.internal", "warn", "panel data network", "not created yet", "portta web up") : data.internal ? check2("db.network.internal", "pass", "panel data network", `${dbNetwork} (internal)`) : check2(
-      "db.network.internal",
-      "fail",
-      "panel data network",
-      `${dbNetwork} is not internal`,
-      "recreate the panel database network from docker/compose/features/db.yaml"
-    ));
-  } else if (config3.webEnabled) {
-    add(check2("db.state", "warn", "panel database", "container not created; the panel will refuse to start without it", "portta web up"));
+  if (config3.webEnabled) {
+    const databaseFile = databaseFileFor(root2);
+    add(existsSync33(databaseFile) ? check2("db.file", "pass", "panel database", databaseFile) : check2("db.file", "warn", "panel database", `${databaseFile} not created yet; the panel creates it on first boot`, "portta web up"));
   }
   const panelIsPublic = (env["PORTTA_WEB_EXPOSE"] || "local") === "public";
   if (traefik && traefik.state === "running") {
@@ -121379,7 +121354,7 @@ async function reexecBuiltCli(root2) {
 init_src();
 init_context();
 init_errors3();
-import { existsSync as existsSync37, readdirSync as readdirSync7 } from "node:fs";
+import { existsSync as existsSync37, readdirSync as readdirSync7, readFileSync as readFileSync30 } from "node:fs";
 import { basename as basename19, join as join56 } from "node:path";
 var PORTTA_DIRECTORY = ".portta";
 var OVERLAY_FILE = "compose.portta.yaml";
@@ -121387,6 +121362,7 @@ var COMPOSE_FILE = "compose.yaml";
 var PANEL_WAIT_MS2 = 12e4;
 var PANEL_POLL_MS2 = 500;
 var DEMO_DIRECTORY_PREFIX = "portta-demo-";
+var MANIFEST_FILE = "portta.example.json";
 function demoDirectories(home2) {
   if (!existsSync37(home2)) return [];
   return readdirSync7(home2, { withFileTypes: true }).filter((entry) => entry.isDirectory() && entry.name.startsWith(DEMO_DIRECTORY_PREFIX)).map((entry) => join56(home2, entry.name)).sort();
@@ -121409,6 +121385,48 @@ function demoComposeArgs(stack, action) {
   if (action === "up") return ["compose", ...files, "up", "-d"];
   return ["compose", ...files, "down", "-v"];
 }
+function readDemoProject(stackDir) {
+  const path7 = join56(stackDir, PORTTA_DIRECTORY, MANIFEST_FILE);
+  if (!existsSync37(path7)) return null;
+  try {
+    const manifest = JSON.parse(readFileSync30(path7, "utf8"));
+    const project2 = manifest.project;
+    if (typeof project2?.["slug"] !== "string" || typeof project2["name"] !== "string") return null;
+    const repositories = (Array.isArray(manifest.repositories) ? manifest.repositories : []).filter((repository) => typeof repository?.["name"] === "string" && typeof repository["relativePath"] === "string").map((repository) => ({
+      name: repository["name"],
+      role: typeof repository["role"] === "string" ? repository["role"] : null,
+      relativePath: repository["relativePath"]
+    }));
+    return {
+      slug: project2["slug"],
+      name: project2["name"],
+      description: typeof project2["description"] === "string" ? project2["description"] : null,
+      relativePath: typeof project2["relativePath"] === "string" ? project2["relativePath"] : basename19(stackDir),
+      repositories
+    };
+  } catch {
+    return null;
+  }
+}
+async function registerDemoProjects(command, stacks, token) {
+  const projects2 = stacks.map((stack) => readDemoProject(stack.dir)).filter((project2) => project2 !== null);
+  if (projects2.length === 0) return;
+  const { client, output: output2 } = clientFor(command, { actor: void 0, actorKind: "human", ...token ? { token } : {} });
+  for (const { repositories, ...project2 } of projects2) {
+    const created = await client.answer("POST", "/projects", project2);
+    if (created.ok) output2.progress(`registered Project ${project2.name} (${project2.slug})`);
+    else if (created.status === 409) output2.progress(`Project ${project2.slug} already registered`);
+    else {
+      output2.warning(`could not register Project ${project2.slug}: the panel answered ${created.status}`);
+      output2.hint(`portta projects create --slug ${project2.slug} --path ${project2.relativePath}`);
+      continue;
+    }
+    for (const repository of repositories) {
+      const added = await client.answer("POST", `/projects/${encodeURIComponent(project2.slug)}/repositories`, repository);
+      if (!added.ok && added.status !== 409) output2.warning(`could not register repository ${repository.name} on ${project2.slug}: the panel answered ${added.status}`);
+    }
+  }
+}
 function outputFor(command) {
   return new Output(workGlobals(command));
 }
@@ -121418,15 +121436,24 @@ function demoHome(command) {
   const configured = context.env["PORTTA_PROJECTS_HOME"]?.trim() || defaultProjectsHome(userHome, typeof process.getuid === "function" && process.getuid() === 0);
   return normalizeProjectsHome(configured, context.root, userHome);
 }
-async function demoStacksUp(command) {
+function requireDemoStacks(command) {
+  const home2 = demoHome(command);
+  const stacks = findDemoStacks(home2);
+  if (stacks.length > 0) return stacks;
+  throw new PreconditionError(
+    `--demo found no portta-demo-* Compose project in ${home2}`,
+    "clone the example repositories there, or set PORTTA_PROJECTS_HOME in .env to the directory that holds them"
+  );
+}
+async function demoStacksUp(command, token) {
   const output2 = outputFor(command);
-  const stacks = findDemoStacks(demoHome(command));
-  if (stacks.length === 0) return;
+  const stacks = requireDemoStacks(command);
   output2.step("demo stacks");
   for (const stack of stacks) {
     output2.progress(`starting ${stack.name}`);
     await runProcess("docker", demoComposeArgs(stack, "up"), { cwd: stack.dir, stdio: "inherit" });
   }
+  await registerDemoProjects(command, stacks, token);
 }
 async function demoStacksDown(command) {
   const output2 = outputFor(command);
@@ -121624,6 +121651,7 @@ async function upCommand(profile, options, command) {
   if (options.localRelease) selectLocalRelease(gatewayContext({ profile: profile ?? globals8(command).profile }));
   const context = gatewayContext({ profile: profile ?? globals8(command).profile });
   if (options.localRelease) context.env["PORTTA_LOCAL_RELEASE"] = "true";
+  if (options.demo) requireDemoStacks(command);
   if (context.config.profile === "remote-public" && context.config.tcpEnabled) throw new RefusedError("TCP entrypoints must not run on the remote-public profile");
   if (context.config.profile === "remote-public" && context.config.webEnabled && context.config.webExpose === "vpn") {
     throw new RefusedError(
@@ -121682,6 +121710,7 @@ async function devCommand(profile, options, command) {
     await reexecBuiltCli(existing.root);
     return;
   }
+  if (options.demo) requireDemoStacks(command);
   const needsBootstrap = !existsSync38(join57(existing.root, ".env"));
   output2.progress(`dev runs: ${[
     ...options.reset ? ["wipe Portta-managed containers and volumes"] : [],
@@ -121703,7 +121732,7 @@ async function devCommand(profile, options, command) {
   await waitForPanel(command);
   const demoToken = await ensureDevDemoOwner(command);
   await finishWebUp(panel, command, false, demoToken);
-  if (options.demo) await demoStacksUp(command);
+  if (options.demo) await demoStacksUp(command, demoToken);
   await urlsCommand({}, command);
 }
 async function downCommand(options, command) {
@@ -121885,7 +121914,7 @@ function readAliases(root2) {
   const path7 = join57(root2, "config/traefik/dynamic/portta-aliases.yaml");
   if (!existsSync38(path7)) return [];
   try {
-    return parseAliases(readFileSync30(path7, "utf8"));
+    return parseAliases(readFileSync31(path7, "utf8"));
   } catch {
     return [];
   }
@@ -122038,7 +122067,7 @@ async function dnsSetup(options, command) {
 
 // src/commands/host-service.ts
 init_config2();
-import { chmodSync as chmodSync10, existsSync as existsSync39, mkdirSync as mkdirSync19, readFileSync as readFileSync31, realpathSync as realpathSync7, unlinkSync as unlinkSync6, writeFileSync as writeFileSync15 } from "node:fs";
+import { chmodSync as chmodSync10, existsSync as existsSync39, mkdirSync as mkdirSync19, readFileSync as readFileSync32, realpathSync as realpathSync7, unlinkSync as unlinkSync6, writeFileSync as writeFileSync15 } from "node:fs";
 import { homedir as homedir10 } from "node:os";
 import { dirname as dirname29, join as join59 } from "node:path";
 init_context();
@@ -122119,7 +122148,7 @@ var LAUNCHD_ENV_ENTRY_RE = /<key>([^<]+)<\/key>\s*<string>([^<]*)<\/string>/g;
 function readEnvVarsFromUnit(filePath, platform4) {
   let text;
   try {
-    text = readFileSync31(filePath, "utf8");
+    text = readFileSync32(filePath, "utf8");
   } catch {
     return {};
   }
@@ -122356,7 +122385,7 @@ async function configGet(name, command) {
   const global3 = globals10(command);
   const context = gatewayContext({ profile: global3.profile });
   const item = setting(name);
-  if (SECRETS.has(item.key)) throw new RefusedError(`${name} is a secret and is never printed`, "portta web auth status reports whether it is set");
+  if (SECRETS.has(item.key)) throw new RefusedError(`${name} is a secret and is never printed`, "portta doctor reports whether it is set");
   const value3 = context.env[item.key] ?? "";
   const output2 = new Output(global3);
   if (output2.json) output2.data({ setting: name, variable: item.key, value: value3 });
@@ -122520,7 +122549,7 @@ async function configSet(name, value3, options, command) {
   const output2 = new Output(global3);
   const context = gatewayContext({ profile: global3.profile });
   const item = setting(name);
-  if (SECRETS.has(item.key)) throw new RefusedError(`${name} is a secret and is not set this way`, "portta web auth set writes the panel credential");
+  if (SECRETS.has(item.key)) throw new RefusedError(`${name} is a secret and is not set this way`, "edit .env; portta web up generates PORTTA_AUTH_SECRET when it is empty");
   if (item.allowed && !item.allowed.includes(value3)) throw new UsageError(`${name} must be one of: ${item.allowed.join(", ")}`);
   let values;
   if (name === "panel.access") values = await setPanelAccess(context.root, value3, output2);
@@ -122643,7 +122672,7 @@ async function setupCommand(options, command) {
   const envFile = join61(target, ".env");
   prepareEnvFile(envFile);
   record6("environment", "updated", "environment prepared from .env.example");
-  for (const directory of ["state", "state/auth", "state/ssh", "state/runner", "state/access", "state/cloudflared", "state/git", "state/github", "state/metrics", "state/environment", "state/logs", "config/tls", "config/traefik/dynamic"]) mkdirSync20(join61(target, directory), { recursive: true });
+  for (const directory of ["state", "state/auth", "state/ssh", "state/runner", "state/access", "state/cloudflared", "state/git", "state/metrics", "state/environment", "state/logs", "config/tls", "config/traefik/dynamic"]) mkdirSync20(join61(target, directory), { recursive: true });
   for (const directory of ["state/auth", "state/ssh", "state/runner", "state/cloudflared"]) chmodSync11(join61(target, directory), 448);
   record6("directories", "ok", "gateway state directories");
   const context = gatewayContext({ root: target, profile });
@@ -122665,7 +122694,7 @@ async function setupCommand(options, command) {
 // src/commands/auth.ts
 init_context();
 init_errors3();
-import { readFileSync as readFileSync32 } from "node:fs";
+import { readFileSync as readFileSync33 } from "node:fs";
 function globals12(command) {
   return command.optsWithGlobals();
 }
@@ -122680,7 +122709,7 @@ function panelUrlFor2(command) {
 }
 async function authBootstrap(options, command) {
   if (!options.name || !options.email) throw new UsageError("--name and --email are required");
-  const password = options.passwordStdin ? readFileSync32(0, "utf8").trim() : "";
+  const password = options.passwordStdin ? readFileSync33(0, "utf8").trim() : "";
   if (!password) throw new UsageError("the password is read from stdin", 'printf %s "$PASSWORD" | portta auth bootstrap --name \u2026 --email \u2026 --password-stdin');
   if (password.length < 10) throw new UsageError("the password must be at least 10 characters");
   const { client, output: output2 } = clientFor(command, { actor: void 0, actorKind: "human" });
@@ -122713,7 +122742,7 @@ async function authLogin(options, command) {
 }
 async function readSecret() {
   if (!process.stdin.isTTY) {
-    const piped = readFileSync32(0, "utf8").trim();
+    const piped = readFileSync33(0, "utf8").trim();
     if (piped) return piped;
     throw new UsageError("no token on stdin", "pass --token, or run this in a terminal");
   }
@@ -122852,7 +122881,7 @@ init_src();
 init_context();
 init_errors3();
 import { randomBytes as randomBytes8 } from "node:crypto";
-import { chmodSync as chmodSync12, mkdirSync as mkdirSync21, readFileSync as readFileSync33 } from "node:fs";
+import { chmodSync as chmodSync12, mkdirSync as mkdirSync21, readFileSync as readFileSync34 } from "node:fs";
 import { dirname as dirname31, join as join62 } from "node:path";
 function globals13(command) {
   return command.optsWithGlobals();
@@ -122884,7 +122913,7 @@ async function protectHost(hostInput, options, command) {
   const entryPoint = options.entrypoint ?? (gatewayContext({ profile: globals13(command).profile }).config.tlsEnabled ? "websecure" : "web");
   if (!/^[A-Za-z0-9_-]+$/.test(entryPoint)) throw new UsageError(`invalid entrypoint: ${entryPoint}`);
   const generated = options.passwordStdin !== true;
-  const password = generated ? randomBytes8(20).toString("base64url").slice(0, 20).match(/.{1,5}/g).join("-") : readFileSync33(0, "utf8").trim();
+  const password = generated ? randomBytes8(20).toString("base64url").slice(0, 20).match(/.{1,5}/g).join("-") : readFileSync34(0, "utf8").trim();
   if (!password) throw new UsageError("no password on stdin");
   const target = paths(command);
   const existing = readProtectionStore(target.store);
@@ -122937,11 +122966,11 @@ async function protectStatus(hostInput, command) {
 init_src();
 init_errors3();
 init_context();
-import { readFileSync as readFileSync34 } from "node:fs";
+import { readFileSync as readFileSync35 } from "node:fs";
 import { randomBytes as randomBytes9 } from "node:crypto";
 function passwordFrom(options) {
   if (options.passwordStdin) {
-    const password2 = readFileSync34(0, "utf8").trim();
+    const password2 = readFileSync35(0, "utf8").trim();
     if (!password2) throw new UsageError("no password on stdin");
     if (password2.length < 10) throw new UsageError("the password must be at least 10 characters");
     return { password: password2, generated: false };
@@ -123334,7 +123363,7 @@ function paths2(root2) {
 init_src();
 init_context();
 init_errors3();
-import { chmodSync as chmodSync14, copyFileSync as copyFileSync5, cpSync as cpSync2, existsSync as existsSync43, mkdirSync as mkdirSync23, mkdtempSync as mkdtempSync3, readFileSync as readFileSync35, rmSync as rmSync12, statSync as statSync12, writeFileSync as writeFileSync17 } from "node:fs";
+import { chmodSync as chmodSync14, copyFileSync as copyFileSync5, cpSync as cpSync2, existsSync as existsSync43, mkdirSync as mkdirSync23, mkdtempSync as mkdtempSync3, readFileSync as readFileSync36, rmSync as rmSync12, statSync as statSync12, writeFileSync as writeFileSync17 } from "node:fs";
 import { hostname as hostname3, tmpdir as tmpdir5 } from "node:os";
 import { dirname as dirname32, join as join65 } from "node:path";
 function globals16(command) {
@@ -123397,7 +123426,7 @@ async function backupCommand(options, command) {
       database = await dumpDatabase(context, join65(staging, "panel.db"));
       if (!database) {
         output2.warning("the panel database was not included");
-        output2.hint("it is only there when the panel is running; --no-database silences this");
+        output2.hint("it exists once the panel has started, and copying it needs sqlite3 on this host; --no-database silences this");
       }
     }
     const previous = process.umask(63);
@@ -123446,7 +123475,7 @@ async function restoreCommand(archive, options, command) {
     if (extracted.failed) throw new UsageError("that file is not a Portta backup");
     const manifestPath2 = join65(staging, "portta-backup.json");
     if (!existsSync43(manifestPath2)) throw new UsageError("that archive has no Portta manifest");
-    const manifest = parseManifest(readFileSync35(manifestPath2, "utf8"));
+    const manifest = parseManifest(readFileSync36(manifestPath2, "utf8"));
     if (!manifest) throw new UsageError("that archive has an unreadable Portta manifest");
     output2.progress(`restoring a backup taken from Portta ${manifest.portta}`);
     if (!options.force && await containerRunning(`${context.env["PORTTA_PROJECT_NAME"] || "portta"}-traefik-1`)) {
@@ -128558,7 +128587,7 @@ async function buildCommand(command) {
 
 // src/commands/remote.ts
 init_src();
-import { existsSync as existsSync44, mkdirSync as mkdirSync24, readFileSync as readFileSync36, readdirSync as readdirSync10, rmSync as rmSync13, writeFileSync as writeFileSync18 } from "node:fs";
+import { existsSync as existsSync44, mkdirSync as mkdirSync24, readFileSync as readFileSync37, readdirSync as readdirSync10, rmSync as rmSync13, writeFileSync as writeFileSync18 } from "node:fs";
 import { basename as basename20, join as join67 } from "node:path";
 import { createServer as createServer3 } from "node:net";
 import { randomBytes as randomBytes10 } from "node:crypto";
@@ -128769,7 +128798,7 @@ function readTunnels(root2) {
   for (const name of readdirSync10(directory).filter((entry) => entry.endsWith(".json"))) {
     const path7 = join67(directory, name);
     try {
-      const record6 = parseTunnelRecord(basename20(name, ".json"), readFileSync36(path7, "utf8"));
+      const record6 = parseTunnelRecord(basename20(name, ".json"), readFileSync37(path7, "utf8"));
       if (record6) records.push(record6);
     } catch {
     }
@@ -128903,7 +128932,7 @@ init_src();
 init_src();
 init_context();
 init_errors3();
-import { chmodSync as chmodSync15, closeSync as closeSync3, existsSync as existsSync45, mkdirSync as mkdirSync25, openSync as openSync3, readFileSync as readFileSync37, rmSync as rmSync14, writeFileSync as writeFileSync19 } from "node:fs";
+import { chmodSync as chmodSync15, closeSync as closeSync3, existsSync as existsSync45, mkdirSync as mkdirSync25, openSync as openSync3, readFileSync as readFileSync38, rmSync as rmSync14, writeFileSync as writeFileSync19 } from "node:fs";
 import { ReadStream } from "node:tty";
 import { join as join68 } from "node:path";
 function globals20(command) {
@@ -129046,7 +129075,7 @@ async function tunnelSetup(options, command) {
   let token;
   if (options.tokenFile) {
     if (!existsSync45(options.tokenFile)) throw new UsageError(`no such file: ${options.tokenFile}`);
-    token = readFileSync37(options.tokenFile, "utf8").replace(/\s+/g, "");
+    token = readFileSync38(options.tokenFile, "utf8").replace(/\s+/g, "");
   } else {
     token = await promptForToken();
   }
@@ -129224,10 +129253,10 @@ describe3(program2.command("version"), "Print the installed version").action((_o
 describe3(program2.command("setup"), "Install or update a gateway from the packaged runtime").option("--dir <path>", "gateway installation directory").option("--dry-run", "print the idempotent plan without changing anything").option("--skip-pull", "do not pull images").action(setupCommand);
 describe3(program2.command("bootstrap"), "Prepare this installation and run diagnostics").option("--skip-pull", "do not pull component images").action(bootstrapCommand);
 describe3(program2.command("build"), "Build every local Portta image for this checkout").action((_options, command) => buildCommand(command));
-describe3(program2.command("up [profile]"), "Start gateway components").option("--local-release", "use the locally built image for this checkout").option("--attach", "run in the foreground").option("--demo", "also start portta-demo-* projects from PORTTA_PROJECTS_HOME and import their panel records").action((profile, options, command) => hasComposeRuntime() ? runtimeAction("up", {}, command) : upCommand(profile, options, command));
-describe3(program2.command("dev [profile]"), "Start a checkout from local Dockerfiles, never the published images").option("--reset", "stop every Portta-managed stack, drop their volumes, and start as if this checkout were new").option("--demo", "also start portta-demo-* projects from PORTTA_PROJECTS_HOME; example data is imported either way").action((profile, options, command) => devCommand(profile, options, command));
+describe3(program2.command("up [profile]"), "Start gateway components").option("--local-release", "use the locally built image for this checkout").option("--attach", "run in the foreground").option("--demo", "also start portta-demo-* projects from PORTTA_PROJECTS_HOME").action((profile, options, command) => hasComposeRuntime() ? runtimeAction("up", {}, command) : upCommand(profile, options, command));
+describe3(program2.command("dev [profile]"), "Start a checkout from local Dockerfiles, never the published images").option("--reset", "stop every Portta-managed stack, drop their volumes, and start as if this checkout were new").option("--demo", "also start portta-demo-* projects from PORTTA_PROJECTS_HOME").action((profile, options, command) => devCommand(profile, options, command));
 describe3(program2.command("down"), "Stop the current Compose runtime, or gateway components; keep projects and data").option("--demo", "also stop portta-demo-* projects from PORTTA_PROJECTS_HOME and drop their volumes").action((options, command) => hasComposeRuntime() ? runtimeAction("down", {}, command) : downCommand(options, command));
-describe3(program2.command("reset"), "Stop every Portta-managed stack, drop their volumes, and restart this checkout as if it were new").option("--demo", "also recreate portta-demo-* projects from PORTTA_PROJECTS_HOME and import their panel records").action((options, command) => resetCommand(options, command));
+describe3(program2.command("reset"), "Stop every Portta-managed stack, drop their volumes, and restart this checkout as if it were new").option("--demo", "also recreate portta-demo-* projects from PORTTA_PROJECTS_HOME").action((options, command) => resetCommand(options, command));
 describe3(program2.command("restart"), "Restart the current Compose runtime, or recreate gateway components").action((_options, command) => hasComposeRuntime() ? runtimeAction("restart", {}, command) : restartCommand(command));
 describe3(program2.command("status"), "Show the current Compose runtime, or gateway status").action((_options, command) => hasComposeRuntime() ? runtimeAction("status", {}, command) : statusCommand(command));
 describe3(program2.command("doctor"), "Run read-only host and gateway diagnostics").action((_options, command) => doctorCommand(command));
@@ -129296,7 +129325,7 @@ describe3(dns.command("check"), "Resolve a wildcard probe").action((_options, co
 describe3(dns.command("status"), "Show DNS configuration without secrets").action((_options, command) => dnsStatus(command));
 describe3(dns.command("setup"), "Plan or apply a Cloudflare wildcard record").option("--target <ip>").option("--dry-run").action(dnsSetup);
 var web = describe3(program2.command("web"), "Run the optional administration panel").option("--local-release", "use the locally built image for this checkout");
-describe3(web.command("up"), "Enable and start the panel").option("--expose <scope>", "local, tailscale, public or vpn").option("--port <number>").option("--read-only").option("--writable").action((options, command) => webUp({ ...options, localRelease: command.optsWithGlobals().localRelease }, command));
+describe3(web.command("up"), "Enable and start the panel").option("--expose <scope>", "local, tailscale, vpn, public or domain").option("--port <number>").option("--read-only").option("--writable").action((options, command) => webUp({ ...options, localRelease: command.optsWithGlobals().localRelease }, command));
 describe3(web.command("dev"), "Start the panel with hot reload").option("--expose <scope>").option("--port <number>").option("--read-only").option("--writable").action((options, command) => webUp({ ...options, dev: true }, command));
 describe3(web.command("down"), "Stop the panel only").action((_options, command) => webDown(command));
 describe3(web.command("disable"), "Stop and disable the panel").action((_options, command) => webDisable(command));