@codions/portta 0.0.0-develop.155.sha-e6e3870 → 0.0.0-develop.159.sha-0da77d5

package/dist/cli.js

@@ -20141,6 +20141,26 @@ function isLoopbackAddress(address) {
 function isWildcardAddress(address) {
   return address === "0.0.0.0" || address === "::";
 }
+function isLoopbackIp(address) {
+  return address === "::1" || /^127(\.\d{1,3}){3}$/.test(address);
+}
+function localhostDnsVerdict(addresses) {
+  const hint = "see docs/product/guides/local-development.md#how-localhost-resolves";
+  if (addresses.length === 0) return check2("dns.local", "warn", "local DNS", "could not confirm *.localhost resolution", hint);
+  const stray = addresses.filter((address) => !isLoopbackIp(address));
+  return stray.length === 0 ? check2("dns.local", "pass", "local DNS", "*.localhost resolves to loopback") : check2("dns.local", "warn", "local DNS", `*.localhost resolves to ${stray.join(", ")}, not loopback`, hint);
+}
+function loopbackDomainVerdict(domain2, resolved2, bind) {
+  if (!isLoopbackIp(resolved2)) return null;
+  const served = isWildcardAddress(bind) || bind === resolved2 || isLoopbackAddress(bind) && resolved2 === "127.0.0.1";
+  return served ? check2("domain.reachable", "pass", "project hostnames", `*.${domain2} resolves to loopback, served on ${bind}`) : check2(
+    "domain.reachable",
+    "warn",
+    "project hostnames",
+    `*.${domain2} resolves to ${resolved2}, but Traefik listens on ${bind}`,
+    "point the wildcard at an address Traefik listens on; see docs/product/guides/local-domains.md"
+  );
+}
 function publishesSensitivePort(published) {
   return SENSITIVE_PORTS.some((port) => published.includes(`0.0.0.0:`) && published.includes(`->${port}`));
 }
@@ -22364,7 +22384,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@codions/portta",
-      version: "0.0.0-develop.155.sha-e6e3870",
+      version: "0.0.0-develop.159.sha-0da77d5",
       description: "Machine-first CLI for a shared Docker development gateway",
       license: "MIT",
       type: "module",
@@ -22438,7 +22458,7 @@ var init_version = __esm({
     "use strict";
     init_package();
     CLI_VERSION = package_default.version;
-    CLI_BUILD_DATE = true ? "2026-09-16T16:54:30Z" : void 0;
+    CLI_BUILD_DATE = true ? "2026-09-17T17:01:02Z" : void 0;
   }
 });
 
@@ -89799,7 +89819,7 @@ function createDaemonTaskflowHost(context) {
       port: hostListen(env).port,
       workflowBuiltinsDir: taskflowAssets(env).workflowBuiltinsDir,
       version: env.PORTTA_VERSION || "0.0.0-local",
-      buildDate: true ? "2026-09-16T16:54:30Z" : (/* @__PURE__ */ new Date()).toISOString(),
+      buildDate: true ? "2026-09-17T17:01:02Z" : (/* @__PURE__ */ new Date()).toISOString(),
       environmentStore: createEnvironmentStore(paths3.database),
       hostEnvironmentProvider: new HostEnvironmentProvider(),
       devContainerProvider: new DevContainerProvider(),
@@ -100395,7 +100415,7 @@ var require_network = __commonJS({
     var exec3 = __require("child_process").exec;
     var execSync = __require("child_process").execSync;
     var execFileSync2 = __require("child_process").execFileSync;
-    var readFileSync38 = __require("fs").readFileSync;
+    var readFileSync39 = __require("fs").readFileSync;
     var fs = __require("fs");
     var util2 = require_util2();
     var _platform = process.platform;
@@ -100883,7 +100903,7 @@ var require_network = __commonJS({
         return result;
       }
       try {
-        const content = readFileSync38(file2, { encoding: "utf8" });
+        const content = readFileSync39(file2, { encoding: "utf8" });
         const lines = content.split("\n").filter((l) => /iface|source/.test(l));
         lines.forEach((line4) => {
           const parts2 = line4.replace(/\s+/g, " ").trim().split(" ");
@@ -120141,7 +120161,7 @@ async function runtimeAction(action, options, command) {
 init_src();
 init_src();
 init_context();
-import { chmodSync as chmodSync9, existsSync as existsSync38, mkdirSync as mkdirSync18, readFileSync as readFileSync30, readdirSync as readdirSync8, rmSync as rmSync10 } from "node:fs";
+import { chmodSync as chmodSync9, existsSync as existsSync38, mkdirSync as mkdirSync18, readFileSync as readFileSync31, readdirSync as readdirSync8, rmSync as rmSync10 } from "node:fs";
 import { join as join57 } from "node:path";
 init_errors3();
 init_version();
@@ -120763,35 +120783,9 @@ async function runDoctor(context) {
     const socket = (proxy.mounts ?? []).find((mount) => mount.source.includes("docker.sock"));
     add(!socket ? check2("proxy.socket", "warn", "docker socket mount", "could not determine mount mode") : socket.readWrite ? check2("proxy.socket", "fail", "docker socket mount", "mounted read-write", "mount /var/run/docker.sock read-only (:ro)") : check2("proxy.socket", "pass", "docker socket mount", "read-only"));
   }
-  const database = gatewayContainer(containers, "db");
-  const dbNetwork = env["PORTTA_DB_NETWORK"] || `${config3.network}-data`;
-  if (database) {
-    add(database.state === "running" ? check2("db.state", "pass", "panel database", "running") : config3.webEnabled ? check2("db.state", "fail", "panel database", `state=${database.state}; the panel refuses to start without it`, "portta web up") : check2("db.state", "warn", "panel database", `state=${database.state}; the panel is off, so nothing needs it`, "portta web up"));
-    const dbPublished = publishedBindings(database);
-    add(dbPublished ? check2(
-      "db.exposure",
-      "fail",
-      "panel database exposure",
-      `publishes host ports: ${dbPublished}`,
-      "remove every ports entry from docker/compose/features/db.yaml and recreate the database container"
-    ) : check2("db.exposure", "pass", "panel database exposure", "no host ports published"));
-    add(database.networks.includes(config3.network) ? check2(
-      "db.network.shared",
-      "fail",
-      "panel database network",
-      `attached to the shared HTTP network '${config3.network}'`,
-      `detach it; the panel database belongs only on '${dbNetwork}'`
-    ) : check2("db.network.shared", "pass", "panel database network", "off the shared HTTP network"));
-    const data = await networkFacts(dbNetwork);
-    add(!data.exists ? check2("db.network.internal", "warn", "panel data network", "not created yet", "portta web up") : data.internal ? check2("db.network.internal", "pass", "panel data network", `${dbNetwork} (internal)`) : check2(
-      "db.network.internal",
-      "fail",
-      "panel data network",
-      `${dbNetwork} is not internal`,
-      "recreate the panel database network from docker/compose/features/db.yaml"
-    ));
-  } else if (config3.webEnabled) {
-    add(check2("db.state", "warn", "panel database", "container not created; the panel will refuse to start without it", "portta web up"));
+  if (config3.webEnabled) {
+    const databaseFile = databaseFileFor(root2);
+    add(existsSync33(databaseFile) ? check2("db.file", "pass", "panel database", databaseFile) : check2("db.file", "warn", "panel database", `${databaseFile} not created yet; the panel creates it on first boot`, "portta web up"));
   }
   const panelIsPublic = (env["PORTTA_WEB_EXPOSE"] || "local") === "public";
   if (traefik && traefik.state === "running") {
@@ -121153,14 +121147,7 @@ async function domainChecks(config3, env) {
   const domain2 = config3.domain;
   const panelExpose = env["PORTTA_WEB_EXPOSE"] || "local";
   if (domain2 === "localhost" || domain2.endsWith(".localhost")) {
-    const probe = await resolveIpv4("portta-probe.localhost");
-    checks.push(probe.length > 0 ? check2("dns.local", "pass", "local DNS", "*.localhost resolves to loopback") : check2(
-      "dns.local",
-      "warn",
-      "local DNS",
-      "could not confirm *.localhost resolution",
-      "see docs/product/guides/local-development.md if hostnames do not resolve"
-    ));
+    checks.push(localhostDnsVerdict(await resolveIpv4("portta-probe.localhost")));
     if (panelExpose !== "local") {
       checks.push(check2(
         "domain.reachable",
@@ -121176,6 +121163,8 @@ async function domainChecks(config3, env) {
   const resolved2 = (await resolveIpv4(`portta-probe.${domain2}`))[0];
   if (!resolved2) {
     checks.push(check2("dns.wildcard", "fail", "wildcard DNS", `*.${domain2} does not resolve`, "portta dns setup"));
+  } else if (isLoopbackIp(resolved2)) {
+    checks.push(check2("dns.wildcard", "pass", "wildcard DNS", `*.${domain2} -> ${resolved2} (this machine)`));
   } else {
     const expected = env["PORTTA_PUBLIC_IP"] ?? "";
     checks.push(!expected ? check2("dns.wildcard", "pass", "wildcard DNS", `*.${domain2} -> ${resolved2}`) : resolved2 === expected ? check2("dns.wildcard", "pass", "wildcard DNS", `*.${domain2} -> ${resolved2} (this host)`) : check2(
@@ -121187,7 +121176,19 @@ async function domainChecks(config3, env) {
     ));
   }
   const bind = config3.bindAddress;
-  if (isLoopbackAddress(bind)) {
+  const loopback = resolved2 ? loopbackDomainVerdict(domain2, resolved2, bind) : null;
+  if (loopback) {
+    checks.push(loopback);
+    if (panelExpose !== "local") {
+      checks.push(check2(
+        "domain.reachable.remote",
+        "warn",
+        "project hostnames",
+        `*.${domain2} resolves to loopback, and the panel is reached from elsewhere`,
+        "point the wildcard at this host, or portta config set domain.mode auto"
+      ));
+    }
+  } else if (isLoopbackAddress(bind)) {
     const publicIp = env["PORTTA_PUBLIC_IP"] ?? "";
     const fix = publicIp && isPrivateAddress(publicIp) ? `portta config set gateway.bindAddress ${publicIp}   serves them on that network only` : "portta public enable   exposes the HTTP services that opted in";
     checks.push(check2(
@@ -121380,7 +121381,7 @@ async function reexecBuiltCli(root2) {
 init_src();
 init_context();
 init_errors3();
-import { existsSync as existsSync37, readdirSync as readdirSync7 } from "node:fs";
+import { existsSync as existsSync37, readdirSync as readdirSync7, readFileSync as readFileSync30 } from "node:fs";
 import { basename as basename19, join as join56 } from "node:path";
 var PORTTA_DIRECTORY = ".portta";
 var OVERLAY_FILE = "compose.portta.yaml";
@@ -121388,6 +121389,7 @@ var COMPOSE_FILE = "compose.yaml";
 var PANEL_WAIT_MS2 = 12e4;
 var PANEL_POLL_MS2 = 500;
 var DEMO_DIRECTORY_PREFIX = "portta-demo-";
+var MANIFEST_FILE = "portta.example.json";
 function demoDirectories(home2) {
   if (!existsSync37(home2)) return [];
   return readdirSync7(home2, { withFileTypes: true }).filter((entry) => entry.isDirectory() && entry.name.startsWith(DEMO_DIRECTORY_PREFIX)).map((entry) => join56(home2, entry.name)).sort();
@@ -121410,6 +121412,48 @@ function demoComposeArgs(stack, action) {
   if (action === "up") return ["compose", ...files, "up", "-d"];
   return ["compose", ...files, "down", "-v"];
 }
+function readDemoProject(stackDir) {
+  const path7 = join56(stackDir, PORTTA_DIRECTORY, MANIFEST_FILE);
+  if (!existsSync37(path7)) return null;
+  try {
+    const manifest = JSON.parse(readFileSync30(path7, "utf8"));
+    const project2 = manifest.project;
+    if (typeof project2?.["slug"] !== "string" || typeof project2["name"] !== "string") return null;
+    const repositories = (Array.isArray(manifest.repositories) ? manifest.repositories : []).filter((repository) => typeof repository?.["name"] === "string" && typeof repository["relativePath"] === "string").map((repository) => ({
+      name: repository["name"],
+      role: typeof repository["role"] === "string" ? repository["role"] : null,
+      relativePath: repository["relativePath"]
+    }));
+    return {
+      slug: project2["slug"],
+      name: project2["name"],
+      description: typeof project2["description"] === "string" ? project2["description"] : null,
+      relativePath: typeof project2["relativePath"] === "string" ? project2["relativePath"] : basename19(stackDir),
+      repositories
+    };
+  } catch {
+    return null;
+  }
+}
+async function registerDemoProjects(command, stacks, token) {
+  const projects2 = stacks.map((stack) => readDemoProject(stack.dir)).filter((project2) => project2 !== null);
+  if (projects2.length === 0) return;
+  const { client, output: output2 } = clientFor(command, { actor: void 0, actorKind: "human", ...token ? { token } : {} });
+  for (const { repositories, ...project2 } of projects2) {
+    const created = await client.answer("POST", "/projects", project2);
+    if (created.ok) output2.progress(`registered Project ${project2.name} (${project2.slug})`);
+    else if (created.status === 409) output2.progress(`Project ${project2.slug} already registered`);
+    else {
+      output2.warning(`could not register Project ${project2.slug}: the panel answered ${created.status}`);
+      output2.hint(`portta projects create --slug ${project2.slug} --path ${project2.relativePath}`);
+      continue;
+    }
+    for (const repository of repositories) {
+      const added = await client.answer("POST", `/projects/${encodeURIComponent(project2.slug)}/repositories`, repository);
+      if (!added.ok && added.status !== 409) output2.warning(`could not register repository ${repository.name} on ${project2.slug}: the panel answered ${added.status}`);
+    }
+  }
+}
 function outputFor(command) {
   return new Output(workGlobals(command));
 }
@@ -121419,15 +121463,24 @@ function demoHome(command) {
   const configured = context.env["PORTTA_PROJECTS_HOME"]?.trim() || defaultProjectsHome(userHome, typeof process.getuid === "function" && process.getuid() === 0);
   return normalizeProjectsHome(configured, context.root, userHome);
 }
-async function demoStacksUp(command) {
+function requireDemoStacks(command) {
+  const home2 = demoHome(command);
+  const stacks = findDemoStacks(home2);
+  if (stacks.length > 0) return stacks;
+  throw new PreconditionError(
+    `--demo found no portta-demo-* Compose project in ${home2}`,
+    "clone the example repositories there, or set PORTTA_PROJECTS_HOME in .env to the directory that holds them"
+  );
+}
+async function demoStacksUp(command, token) {
   const output2 = outputFor(command);
-  const stacks = findDemoStacks(demoHome(command));
-  if (stacks.length === 0) return;
+  const stacks = requireDemoStacks(command);
   output2.step("demo stacks");
   for (const stack of stacks) {
     output2.progress(`starting ${stack.name}`);
     await runProcess("docker", demoComposeArgs(stack, "up"), { cwd: stack.dir, stdio: "inherit" });
   }
+  await registerDemoProjects(command, stacks, token);
 }
 async function demoStacksDown(command) {
   const output2 = outputFor(command);
@@ -121625,6 +121678,7 @@ async function upCommand(profile, options, command) {
   if (options.localRelease) selectLocalRelease(gatewayContext({ profile: profile ?? globals8(command).profile }));
   const context = gatewayContext({ profile: profile ?? globals8(command).profile });
   if (options.localRelease) context.env["PORTTA_LOCAL_RELEASE"] = "true";
+  if (options.demo) requireDemoStacks(command);
   if (context.config.profile === "remote-public" && context.config.tcpEnabled) throw new RefusedError("TCP entrypoints must not run on the remote-public profile");
   if (context.config.profile === "remote-public" && context.config.webEnabled && context.config.webExpose === "vpn") {
     throw new RefusedError(
@@ -121683,6 +121737,7 @@ async function devCommand(profile, options, command) {
     await reexecBuiltCli(existing.root);
     return;
   }
+  if (options.demo) requireDemoStacks(command);
   const needsBootstrap = !existsSync38(join57(existing.root, ".env"));
   output2.progress(`dev runs: ${[
     ...options.reset ? ["wipe Portta-managed containers and volumes"] : [],
@@ -121704,7 +121759,7 @@ async function devCommand(profile, options, command) {
   await waitForPanel(command);
   const demoToken = await ensureDevDemoOwner(command);
   await finishWebUp(panel, command, false, demoToken);
-  if (options.demo) await demoStacksUp(command);
+  if (options.demo) await demoStacksUp(command, demoToken);
   await urlsCommand({}, command);
 }
 async function downCommand(options, command) {
@@ -121886,7 +121941,7 @@ function readAliases(root2) {
   const path7 = join57(root2, "config/traefik/dynamic/portta-aliases.yaml");
   if (!existsSync38(path7)) return [];
   try {
-    return parseAliases(readFileSync30(path7, "utf8"));
+    return parseAliases(readFileSync31(path7, "utf8"));
   } catch {
     return [];
   }
@@ -122039,7 +122094,7 @@ async function dnsSetup(options, command) {
 
 // src/commands/host-service.ts
 init_config2();
-import { chmodSync as chmodSync10, existsSync as existsSync39, mkdirSync as mkdirSync19, readFileSync as readFileSync31, realpathSync as realpathSync7, unlinkSync as unlinkSync6, writeFileSync as writeFileSync15 } from "node:fs";
+import { chmodSync as chmodSync10, existsSync as existsSync39, mkdirSync as mkdirSync19, readFileSync as readFileSync32, realpathSync as realpathSync7, unlinkSync as unlinkSync6, writeFileSync as writeFileSync15 } from "node:fs";
 import { homedir as homedir10 } from "node:os";
 import { dirname as dirname29, join as join59 } from "node:path";
 init_context();
@@ -122120,7 +122175,7 @@ var LAUNCHD_ENV_ENTRY_RE = /<key>([^<]+)<\/key>\s*<string>([^<]*)<\/string>/g;
 function readEnvVarsFromUnit(filePath, platform4) {
   let text;
   try {
-    text = readFileSync31(filePath, "utf8");
+    text = readFileSync32(filePath, "utf8");
   } catch {
     return {};
   }
@@ -122357,7 +122412,7 @@ async function configGet(name, command) {
   const global3 = globals10(command);
   const context = gatewayContext({ profile: global3.profile });
   const item = setting(name);
-  if (SECRETS.has(item.key)) throw new RefusedError(`${name} is a secret and is never printed`, "portta web auth status reports whether it is set");
+  if (SECRETS.has(item.key)) throw new RefusedError(`${name} is a secret and is never printed`, "portta doctor reports whether it is set");
   const value3 = context.env[item.key] ?? "";
   const output2 = new Output(global3);
   if (output2.json) output2.data({ setting: name, variable: item.key, value: value3 });
@@ -122521,7 +122576,7 @@ async function configSet(name, value3, options, command) {
   const output2 = new Output(global3);
   const context = gatewayContext({ profile: global3.profile });
   const item = setting(name);
-  if (SECRETS.has(item.key)) throw new RefusedError(`${name} is a secret and is not set this way`, "portta web auth set writes the panel credential");
+  if (SECRETS.has(item.key)) throw new RefusedError(`${name} is a secret and is not set this way`, "edit .env; portta web up generates PORTTA_AUTH_SECRET when it is empty");
   if (item.allowed && !item.allowed.includes(value3)) throw new UsageError(`${name} must be one of: ${item.allowed.join(", ")}`);
   let values;
   if (name === "panel.access") values = await setPanelAccess(context.root, value3, output2);
@@ -122644,7 +122699,7 @@ async function setupCommand(options, command) {
   const envFile = join61(target, ".env");
   prepareEnvFile(envFile);
   record6("environment", "updated", "environment prepared from .env.example");
-  for (const directory of ["state", "state/auth", "state/ssh", "state/runner", "state/access", "state/cloudflared", "state/git", "state/github", "state/metrics", "state/environment", "state/logs", "config/tls", "config/traefik/dynamic"]) mkdirSync20(join61(target, directory), { recursive: true });
+  for (const directory of ["state", "state/auth", "state/ssh", "state/runner", "state/access", "state/cloudflared", "state/git", "state/metrics", "state/environment", "state/logs", "config/tls", "config/traefik/dynamic"]) mkdirSync20(join61(target, directory), { recursive: true });
   for (const directory of ["state/auth", "state/ssh", "state/runner", "state/cloudflared"]) chmodSync11(join61(target, directory), 448);
   record6("directories", "ok", "gateway state directories");
   const context = gatewayContext({ root: target, profile });
@@ -122666,7 +122721,7 @@ async function setupCommand(options, command) {
 // src/commands/auth.ts
 init_context();
 init_errors3();
-import { readFileSync as readFileSync32 } from "node:fs";
+import { readFileSync as readFileSync33 } from "node:fs";
 function globals12(command) {
   return command.optsWithGlobals();
 }
@@ -122681,7 +122736,7 @@ function panelUrlFor2(command) {
 }
 async function authBootstrap(options, command) {
   if (!options.name || !options.email) throw new UsageError("--name and --email are required");
-  const password = options.passwordStdin ? readFileSync32(0, "utf8").trim() : "";
+  const password = options.passwordStdin ? readFileSync33(0, "utf8").trim() : "";
   if (!password) throw new UsageError("the password is read from stdin", 'printf %s "$PASSWORD" | portta auth bootstrap --name \u2026 --email \u2026 --password-stdin');
   if (password.length < 10) throw new UsageError("the password must be at least 10 characters");
   const { client, output: output2 } = clientFor(command, { actor: void 0, actorKind: "human" });
@@ -122714,7 +122769,7 @@ async function authLogin(options, command) {
 }
 async function readSecret() {
   if (!process.stdin.isTTY) {
-    const piped = readFileSync32(0, "utf8").trim();
+    const piped = readFileSync33(0, "utf8").trim();
     if (piped) return piped;
     throw new UsageError("no token on stdin", "pass --token, or run this in a terminal");
   }
@@ -122853,7 +122908,7 @@ init_src();
 init_context();
 init_errors3();
 import { randomBytes as randomBytes8 } from "node:crypto";
-import { chmodSync as chmodSync12, mkdirSync as mkdirSync21, readFileSync as readFileSync33 } from "node:fs";
+import { chmodSync as chmodSync12, mkdirSync as mkdirSync21, readFileSync as readFileSync34 } from "node:fs";
 import { dirname as dirname31, join as join62 } from "node:path";
 function globals13(command) {
   return command.optsWithGlobals();
@@ -122885,7 +122940,7 @@ async function protectHost(hostInput, options, command) {
   const entryPoint = options.entrypoint ?? (gatewayContext({ profile: globals13(command).profile }).config.tlsEnabled ? "websecure" : "web");
   if (!/^[A-Za-z0-9_-]+$/.test(entryPoint)) throw new UsageError(`invalid entrypoint: ${entryPoint}`);
   const generated = options.passwordStdin !== true;
-  const password = generated ? randomBytes8(20).toString("base64url").slice(0, 20).match(/.{1,5}/g).join("-") : readFileSync33(0, "utf8").trim();
+  const password = generated ? randomBytes8(20).toString("base64url").slice(0, 20).match(/.{1,5}/g).join("-") : readFileSync34(0, "utf8").trim();
   if (!password) throw new UsageError("no password on stdin");
   const target = paths(command);
   const existing = readProtectionStore(target.store);
@@ -122938,11 +122993,11 @@ async function protectStatus(hostInput, command) {
 init_src();
 init_errors3();
 init_context();
-import { readFileSync as readFileSync34 } from "node:fs";
+import { readFileSync as readFileSync35 } from "node:fs";
 import { randomBytes as randomBytes9 } from "node:crypto";
 function passwordFrom(options) {
   if (options.passwordStdin) {
-    const password2 = readFileSync34(0, "utf8").trim();
+    const password2 = readFileSync35(0, "utf8").trim();
     if (!password2) throw new UsageError("no password on stdin");
     if (password2.length < 10) throw new UsageError("the password must be at least 10 characters");
     return { password: password2, generated: false };
@@ -123335,7 +123390,7 @@ function paths2(root2) {
 init_src();
 init_context();
 init_errors3();
-import { chmodSync as chmodSync14, copyFileSync as copyFileSync5, cpSync as cpSync2, existsSync as existsSync43, mkdirSync as mkdirSync23, mkdtempSync as mkdtempSync3, readFileSync as readFileSync35, rmSync as rmSync12, statSync as statSync12, writeFileSync as writeFileSync17 } from "node:fs";
+import { chmodSync as chmodSync14, copyFileSync as copyFileSync5, cpSync as cpSync2, existsSync as existsSync43, mkdirSync as mkdirSync23, mkdtempSync as mkdtempSync3, readFileSync as readFileSync36, rmSync as rmSync12, statSync as statSync12, writeFileSync as writeFileSync17 } from "node:fs";
 import { hostname as hostname3, tmpdir as tmpdir5 } from "node:os";
 import { dirname as dirname32, join as join65 } from "node:path";
 function globals16(command) {
@@ -123398,7 +123453,7 @@ async function backupCommand(options, command) {
       database = await dumpDatabase(context, join65(staging, "panel.db"));
       if (!database) {
         output2.warning("the panel database was not included");
-        output2.hint("it is only there when the panel is running; --no-database silences this");
+        output2.hint("it exists once the panel has started, and copying it needs sqlite3 on this host; --no-database silences this");
       }
     }
     const previous = process.umask(63);
@@ -123447,7 +123502,7 @@ async function restoreCommand(archive, options, command) {
     if (extracted.failed) throw new UsageError("that file is not a Portta backup");
     const manifestPath2 = join65(staging, "portta-backup.json");
     if (!existsSync43(manifestPath2)) throw new UsageError("that archive has no Portta manifest");
-    const manifest = parseManifest(readFileSync35(manifestPath2, "utf8"));
+    const manifest = parseManifest(readFileSync36(manifestPath2, "utf8"));
     if (!manifest) throw new UsageError("that archive has an unreadable Portta manifest");
     output2.progress(`restoring a backup taken from Portta ${manifest.portta}`);
     if (!options.force && await containerRunning(`${context.env["PORTTA_PROJECT_NAME"] || "portta"}-traefik-1`)) {
@@ -128559,7 +128614,7 @@ async function buildCommand(command) {
 
 // src/commands/remote.ts
 init_src();
-import { existsSync as existsSync44, mkdirSync as mkdirSync24, readFileSync as readFileSync36, readdirSync as readdirSync10, rmSync as rmSync13, writeFileSync as writeFileSync18 } from "node:fs";
+import { existsSync as existsSync44, mkdirSync as mkdirSync24, readFileSync as readFileSync37, readdirSync as readdirSync10, rmSync as rmSync13, writeFileSync as writeFileSync18 } from "node:fs";
 import { basename as basename20, join as join67 } from "node:path";
 import { createServer as createServer3 } from "node:net";
 import { randomBytes as randomBytes10 } from "node:crypto";
@@ -128770,7 +128825,7 @@ function readTunnels(root2) {
   for (const name of readdirSync10(directory).filter((entry) => entry.endsWith(".json"))) {
     const path7 = join67(directory, name);
     try {
-      const record6 = parseTunnelRecord(basename20(name, ".json"), readFileSync36(path7, "utf8"));
+      const record6 = parseTunnelRecord(basename20(name, ".json"), readFileSync37(path7, "utf8"));
       if (record6) records.push(record6);
     } catch {
     }
@@ -128904,7 +128959,7 @@ init_src();
 init_src();
 init_context();
 init_errors3();
-import { chmodSync as chmodSync15, closeSync as closeSync3, existsSync as existsSync45, mkdirSync as mkdirSync25, openSync as openSync3, readFileSync as readFileSync37, rmSync as rmSync14, writeFileSync as writeFileSync19 } from "node:fs";
+import { chmodSync as chmodSync15, closeSync as closeSync3, existsSync as existsSync45, mkdirSync as mkdirSync25, openSync as openSync3, readFileSync as readFileSync38, rmSync as rmSync14, writeFileSync as writeFileSync19 } from "node:fs";
 import { ReadStream } from "node:tty";
 import { join as join68 } from "node:path";
 function globals20(command) {
@@ -129047,7 +129102,7 @@ async function tunnelSetup(options, command) {
   let token;
   if (options.tokenFile) {
     if (!existsSync45(options.tokenFile)) throw new UsageError(`no such file: ${options.tokenFile}`);
-    token = readFileSync37(options.tokenFile, "utf8").replace(/\s+/g, "");
+    token = readFileSync38(options.tokenFile, "utf8").replace(/\s+/g, "");
   } else {
     token = await promptForToken();
   }
@@ -129225,10 +129280,10 @@ describe3(program2.command("version"), "Print the installed version").action((_o
 describe3(program2.command("setup"), "Install or update a gateway from the packaged runtime").option("--dir <path>", "gateway installation directory").option("--dry-run", "print the idempotent plan without changing anything").option("--skip-pull", "do not pull images").action(setupCommand);
 describe3(program2.command("bootstrap"), "Prepare this installation and run diagnostics").option("--skip-pull", "do not pull component images").action(bootstrapCommand);
 describe3(program2.command("build"), "Build every local Portta image for this checkout").action((_options, command) => buildCommand(command));
-describe3(program2.command("up [profile]"), "Start gateway components").option("--local-release", "use the locally built image for this checkout").option("--attach", "run in the foreground").option("--demo", "also start portta-demo-* projects from PORTTA_PROJECTS_HOME and import their panel records").action((profile, options, command) => hasComposeRuntime() ? runtimeAction("up", {}, command) : upCommand(profile, options, command));
-describe3(program2.command("dev [profile]"), "Start a checkout from local Dockerfiles, never the published images").option("--reset", "stop every Portta-managed stack, drop their volumes, and start as if this checkout were new").option("--demo", "also start portta-demo-* projects from PORTTA_PROJECTS_HOME; example data is imported either way").action((profile, options, command) => devCommand(profile, options, command));
+describe3(program2.command("up [profile]"), "Start gateway components").option("--local-release", "use the locally built image for this checkout").option("--attach", "run in the foreground").option("--demo", "also start portta-demo-* projects from PORTTA_PROJECTS_HOME").action((profile, options, command) => hasComposeRuntime() ? runtimeAction("up", {}, command) : upCommand(profile, options, command));
+describe3(program2.command("dev [profile]"), "Start a checkout from local Dockerfiles, never the published images").option("--reset", "stop every Portta-managed stack, drop their volumes, and start as if this checkout were new").option("--demo", "also start portta-demo-* projects from PORTTA_PROJECTS_HOME").action((profile, options, command) => devCommand(profile, options, command));
 describe3(program2.command("down"), "Stop the current Compose runtime, or gateway components; keep projects and data").option("--demo", "also stop portta-demo-* projects from PORTTA_PROJECTS_HOME and drop their volumes").action((options, command) => hasComposeRuntime() ? runtimeAction("down", {}, command) : downCommand(options, command));
-describe3(program2.command("reset"), "Stop every Portta-managed stack, drop their volumes, and restart this checkout as if it were new").option("--demo", "also recreate portta-demo-* projects from PORTTA_PROJECTS_HOME and import their panel records").action((options, command) => resetCommand(options, command));
+describe3(program2.command("reset"), "Stop every Portta-managed stack, drop their volumes, and restart this checkout as if it were new").option("--demo", "also recreate portta-demo-* projects from PORTTA_PROJECTS_HOME").action((options, command) => resetCommand(options, command));
 describe3(program2.command("restart"), "Restart the current Compose runtime, or recreate gateway components").action((_options, command) => hasComposeRuntime() ? runtimeAction("restart", {}, command) : restartCommand(command));
 describe3(program2.command("status"), "Show the current Compose runtime, or gateway status").action((_options, command) => hasComposeRuntime() ? runtimeAction("status", {}, command) : statusCommand(command));
 describe3(program2.command("doctor"), "Run read-only host and gateway diagnostics").action((_options, command) => doctorCommand(command));
@@ -129297,7 +129352,7 @@ describe3(dns.command("check"), "Resolve a wildcard probe").action((_options, co
 describe3(dns.command("status"), "Show DNS configuration without secrets").action((_options, command) => dnsStatus(command));
 describe3(dns.command("setup"), "Plan or apply a Cloudflare wildcard record").option("--target <ip>").option("--dry-run").action(dnsSetup);
 var web = describe3(program2.command("web"), "Run the optional administration panel").option("--local-release", "use the locally built image for this checkout");
-describe3(web.command("up"), "Enable and start the panel").option("--expose <scope>", "local, tailscale, public or vpn").option("--port <number>").option("--read-only").option("--writable").action((options, command) => webUp({ ...options, localRelease: command.optsWithGlobals().localRelease }, command));
+describe3(web.command("up"), "Enable and start the panel").option("--expose <scope>", "local, tailscale, vpn, public or domain").option("--port <number>").option("--read-only").option("--writable").action((options, command) => webUp({ ...options, localRelease: command.optsWithGlobals().localRelease }, command));
 describe3(web.command("dev"), "Start the panel with hot reload").option("--expose <scope>").option("--port <number>").option("--read-only").option("--writable").action((options, command) => webUp({ ...options, dev: true }, command));
 describe3(web.command("down"), "Stop the panel only").action((_options, command) => webDown(command));
 describe3(web.command("disable"), "Stop and disable the panel").action((_options, command) => webDisable(command));