@envsync-cloud/deploy-cli 0.8.5

package/dist/index.js

@@ -0,0 +1,3531 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { createHash, randomBytes } from "crypto";
+import { spawnSync } from "child_process";
+import fs2 from "fs";
+import path2 from "path";
+import readline from "readline";
+import chalk from "chalk";
+import YAML from "yaml";
+import { formatDeploymentPlan, loadDeploymentPlanFromFile } from "@envsync-cloud/deploy-core";
+
+// src/render.ts
+function domainMap(rootDomain) {
+  return {
+    landing: rootDomain,
+    app: `app.${rootDomain}`,
+    api: `api.${rootDomain}`,
+    auth: `auth.${rootDomain}`,
+    obs: `obs.${rootDomain}`,
+    mail: `mail.${rootDomain}`,
+    s3: `s3.${rootDomain}`,
+    s3Console: `console.s3.${rootDomain}`
+  };
+}
+function publicHttpsOrigin(config, host) {
+  return `https://${host}${config.services.public_https_port === 443 ? "" : `:${config.services.public_https_port}`}`;
+}
+function publicHttpsUrl(config, host, urlPath = "") {
+  return `${publicHttpsOrigin(config, host)}${urlPath}`;
+}
+function publicBucketUrl(config, host, bucket) {
+  return publicHttpsUrl(config, host, `/${bucket}`);
+}
+function publicHttpsOriginVariants(config, host) {
+  const canonical = `https://${host}`;
+  if (config.services.public_https_port === 443) {
+    return [canonical];
+  }
+  return [canonical, publicHttpsOrigin(config, host)];
+}
+function publicHttpsUrlVariants(config, host, urlPath = "") {
+  return publicHttpsOriginVariants(config, host).map((origin) => `${origin}${urlPath}`);
+}
+function keycloakImageTag(image) {
+  return image.split(":").slice(1).join(":") || "local";
+}
+function slotServiceName(slot) {
+  return `envsync_api_${slot}`;
+}
+function slotHasApiDeployment(state) {
+  return state.api_image.length > 0;
+}
+function isOssConfig(config) {
+  return config.edition === "oss";
+}
+function createSteadyApiDeploymentState(config, generated) {
+  const deployment = generated.deployment;
+  const activeSlot = deployment.active_slot;
+  const activeState = deployment.slots[activeSlot];
+  if (slotHasApiDeployment(activeState)) {
+    return deployment;
+  }
+  return {
+    active_slot: activeSlot,
+    previous_slot: "",
+    maintenance_mode: deployment.maintenance_mode,
+    slots: {
+      ...deployment.slots,
+      [activeSlot]: {
+        api_image: config.images.api,
+        release_version: config.release.version,
+        deployed_at: deployment.slots[activeSlot].deployed_at
+      }
+    }
+  };
+}
+function buildRuntimeEnv(config, generated) {
+  const hosts = domainMap(config.domain.root_domain);
+  const bucketName = "envsync-bucket";
+  const oss = isOssConfig(config);
+  return {
+    NODE_ENV: "production",
+    ENVSYNC_EDITION: oss ? "oss" : "enterprise",
+    ENVSYNC_MANAGEMENT_ENABLED: oss ? "false" : "true",
+    ENVSYNC_LANDING_ENABLED: oss ? "false" : "true",
+    ENVSYNC_SINGLE_ORG_MODE: oss ? "true" : "false",
+    ENVSYNC_LICENSE_ENFORCEMENT: oss ? "false" : "true",
+    DB_AUTO_MIGRATE: "false",
+    PORT: `${config.services.api_port}`,
+    DATABASE_HOST: "postgres",
+    DATABASE_PORT: "5432",
+    DATABASE_USER: "postgres",
+    DATABASE_PASSWORD: "envsync-postgres",
+    DATABASE_NAME: "envsync",
+    POSTGRES_USER: "postgres",
+    POSTGRES_PASSWORD: "envsync-postgres",
+    POSTGRES_DB: "envsync",
+    S3_BUCKET: bucketName,
+    S3_REGION: "us-east-1",
+    S3_ACCESS_KEY: "envsync-rustfs",
+    S3_SECRET_KEY: generated.secrets.s3_secret_key,
+    S3_BUCKET_URL: publicBucketUrl(config, hosts.s3, bucketName),
+    S3_ENDPOINT: "http://rustfs:9000",
+    REDIS_URL: "redis://redis:6379",
+    SMTP_HOST: config.smtp.host,
+    SMTP_PORT: `${config.smtp.port}`,
+    SMTP_SECURE: `${config.smtp.secure}`,
+    SMTP_USER: config.smtp.user,
+    SMTP_PASS: config.smtp.pass,
+    SMTP_FROM: config.smtp.from,
+    KEYCLOAK_URL: "http://keycloak:8080",
+    KEYCLOAK_PUBLIC_URL: publicHttpsUrl(config, hosts.auth),
+    KEYCLOAK_REALM: config.auth.keycloak_realm,
+    KEYCLOAK_ADMIN_USER: config.auth.admin_user,
+    KEYCLOAK_ADMIN_PASSWORD: config.auth.admin_password,
+    KEYCLOAK_DB_PASSWORD: generated.secrets.keycloak_db_password || config.auth.admin_password,
+    KEYCLOAK_WEB_CLIENT_ID: config.auth.web_client_id,
+    KEYCLOAK_WEB_CLIENT_SECRET: generated.secrets.keycloak_web_client_secret,
+    KEYCLOAK_CLI_CLIENT_ID: config.auth.cli_client_id,
+    KEYCLOAK_API_CLIENT_ID: config.auth.api_client_id,
+    KEYCLOAK_API_CLIENT_SECRET: generated.secrets.keycloak_api_client_secret,
+    KEYCLOAK_WEB_REDIRECT_URI: publicHttpsUrl(config, hosts.api, "/api/access/web/callback"),
+    KEYCLOAK_WEB_CALLBACK_URL: publicHttpsUrl(config, hosts.app, "/auth/callback"),
+    KEYCLOAK_API_REDIRECT_URI: publicHttpsUrl(config, hosts.api, "/api/access/api/callback"),
+    LANDING_PAGE_URL: oss ? "" : publicHttpsUrl(config, hosts.landing),
+    DASHBOARD_URL: publicHttpsUrl(config, hosts.app),
+    OPENFGA_API_URL: "http://openfga:8090",
+    OPENFGA_STORE_ID: generated.openfga.store_id,
+    OPENFGA_MODEL_ID: generated.openfga.model_id,
+    OPENFGA_DB_PASSWORD: generated.secrets.openfga_db_password,
+    CLICKSTACK_OPERATOR_EMAIL: generated.clickstack.operator_email,
+    CLICKSTACK_OPERATOR_PASSWORD: generated.clickstack.operator_password,
+    CLICKSTACK_ACCESS_KEY: generated.clickstack.access_key,
+    CLICKSTACK_BROWSER_API_KEY: generated.clickstack.browser_api_key,
+    MINIKMS_GRPC_ADDR: "minikms:50051",
+    MINIKMS_TLS_ENABLED: "false",
+    MINIKMS_ROOT_KEY: generated.secrets.minikms_root_key,
+    MINIKMS_DB_USER: "postgres",
+    MINIKMS_DB_PASSWORD: generated.secrets.minikms_db_password,
+    OTEL_EXPORTER_OTLP_ENDPOINT: "http://otel-agent:4318",
+    OTEL_SERVICE_NAME: "envsync-api",
+    OTEL_SDK_DISABLED: "false",
+    CLICKSTACK_URL: publicHttpsUrl(config, hosts.obs),
+    KEYCLOAK_IMAGE_TAG: keycloakImageTag(config.images.keycloak)
+  };
+}
+function renderEnvFile(env) {
+  return Object.entries(env).sort(([a], [b]) => a.localeCompare(b)).map(([key, value]) => `${key}=${value}`).join("\n") + "\n";
+}
+function renderEnvList(values, indent = 6) {
+  const prefix = " ".repeat(indent);
+  return Object.entries(values).map(([key, value]) => `${prefix}- ${JSON.stringify(`${key}=${String(value)}`)}`).join("\n");
+}
+function renderKeycloakRealm(config, runtimeEnv) {
+  const hosts = domainMap(config.domain.root_domain);
+  const webRedirectUris = [
+    ...publicHttpsUrlVariants(config, hosts.api, "/api/access/web/callback"),
+    ...publicHttpsUrlVariants(config, hosts.app, "/auth/callback"),
+    ...publicHttpsUrlVariants(config, hosts.app)
+  ];
+  const webOrigins = publicHttpsOriginVariants(config, hosts.app);
+  const apiRedirectUris = publicHttpsUrlVariants(config, hosts.api, "/api/access/api/callback");
+  const apiOrigins = publicHttpsOriginVariants(config, hosts.api);
+  return JSON.stringify(
+    {
+      realm: config.auth.keycloak_realm,
+      enabled: true,
+      loginTheme: "envsync",
+      emailTheme: "envsync",
+      clients: [
+        {
+          clientId: config.auth.web_client_id,
+          name: "EnvSync Web",
+          protocol: "openid-connect",
+          publicClient: false,
+          secret: runtimeEnv.KEYCLOAK_WEB_CLIENT_SECRET,
+          standardFlowEnabled: true,
+          directAccessGrantsEnabled: false,
+          redirectUris: [...new Set(webRedirectUris)],
+          webOrigins: [...new Set(webOrigins)],
+          attributes: {
+            "post.logout.redirect.uris": "+"
+          },
+          defaultClientScopes: ["basic", "web-origins", "profile", "email", "roles"]
+        },
+        {
+          clientId: config.auth.api_client_id,
+          name: "EnvSync API",
+          protocol: "openid-connect",
+          publicClient: false,
+          secret: runtimeEnv.KEYCLOAK_API_CLIENT_SECRET,
+          standardFlowEnabled: true,
+          redirectUris: [...new Set(apiRedirectUris)],
+          webOrigins: [...new Set(apiOrigins)],
+          defaultClientScopes: ["basic", "profile", "email", "roles"]
+        },
+        {
+          clientId: config.auth.cli_client_id,
+          name: "EnvSync CLI",
+          protocol: "openid-connect",
+          publicClient: true,
+          standardFlowEnabled: false,
+          directAccessGrantsEnabled: false,
+          attributes: {
+            "oauth2.device.authorization.grant.enabled": "true"
+          },
+          defaultClientScopes: ["basic", "profile", "email", "roles"]
+        }
+      ]
+    },
+    null,
+    2
+  ) + "\n";
+}
+function renderTraefikDynamicConfig(config, generated) {
+  const hosts = domainMap(config.domain.root_domain);
+  const activeSlot = generated.deployment.active_slot;
+  const apiServiceName = generated.deployment.maintenance_mode ? "envsync-api-maintenance" : "envsync-api";
+  const landingEnabled = !isOssConfig(config);
+  const otelAllowedOrigins = [
+    ...landingEnabled ? publicHttpsOriginVariants(config, hosts.landing) : [],
+    ...publicHttpsOriginVariants(config, hosts.app)
+  ];
+  return [
+    "http:",
+    "  middlewares:",
+    "    secure-headers:",
+    "      headers:",
+    "        browserXssFilter: true",
+    "        contentTypeNosniff: true",
+    "        forceSTSHeader: true",
+    "        stsSeconds: 31536000",
+    "    gzip:",
+    "      compress: {}",
+    "    otel-cors:",
+    "      headers:",
+    "        accessControlAllowOriginList:",
+    ...otelAllowedOrigins.map((origin) => `          - ${origin}`),
+    "        accessControlAllowMethods:",
+    "          - POST",
+    "          - OPTIONS",
+    "        accessControlAllowHeaders:",
+    "          - Content-Type",
+    "          - content-type",
+    "          - Content-Encoding",
+    "          - content-encoding",
+    "          - Authorization",
+    "          - authorization",
+    "        accessControlAllowCredentials: true",
+    "        accessControlMaxAge: 600",
+    "        addVaryHeader: true",
+    "  services:",
+    "    envsync-api:",
+    "      loadBalancer:",
+    "        healthCheck:",
+    "          path: /health",
+    "          interval: 5s",
+    "          timeout: 3s",
+    "        servers:",
+    `          - url: http://${slotServiceName(activeSlot)}:4000`,
+    "    envsync-api-blue:",
+    "      loadBalancer:",
+    "        healthCheck:",
+    "          path: /health",
+    "          interval: 5s",
+    "          timeout: 3s",
+    "        servers:",
+    "          - url: http://envsync_api_blue:4000",
+    "    envsync-api-green:",
+    "      loadBalancer:",
+    "        healthCheck:",
+    "          path: /health",
+    "          interval: 5s",
+    "          timeout: 3s",
+    "        servers:",
+    "          - url: http://envsync_api_green:4000",
+    "    envsync-api-maintenance:",
+    "      loadBalancer:",
+    "        servers:",
+    "          - url: http://api_maintenance:8080",
+    ...landingEnabled ? [
+      "    landing:",
+      "      loadBalancer:",
+      "        servers:",
+      "          - url: http://landing_nginx:8080"
+    ] : [],
+    "    web:",
+    "      loadBalancer:",
+    "        servers:",
+    "          - url: http://web_nginx:8080",
+    "    clickstack-ui:",
+    "      loadBalancer:",
+    "        servers:",
+    "          - url: http://clickstack:8080",
+    "    clickstack-otlp:",
+    "      loadBalancer:",
+    "        servers:",
+    `          - url: http://clickstack:${config.services.clickstack_otlp_http_port}`,
+    "  routers:",
+    ...landingEnabled ? [
+      "    landing-router:",
+      `      rule: Host(\`${hosts.landing}\`)`,
+      "      service: landing",
+      "      entryPoints: [websecure]",
+      "      tls:",
+      "        certResolver: letsencrypt"
+    ] : [],
+    "    web-router:",
+    `      rule: Host(\`${hosts.app}\`)`,
+    "      service: web",
+    "      entryPoints: [websecure]",
+    "      tls:",
+    "        certResolver: letsencrypt",
+    "    obs-otlp-router:",
+    `      rule: Host(\`${hosts.obs}\`) && (PathPrefix(\`/v1/traces\`) || PathPrefix(\`/v1/logs\`) || PathPrefix(\`/v1/metrics\`))`,
+    "      service: clickstack-otlp",
+    "      middlewares: [otel-cors]",
+    "      priority: 100",
+    "      entryPoints: [websecure]",
+    "      tls:",
+    "        certResolver: letsencrypt",
+    "    obs-api-router:",
+    `      rule: Host(\`${hosts.obs}\`) && PathPrefix(\`/api\`)`,
+    "      service: clickstack-ui",
+    "      priority: 90",
+    "      entryPoints: [websecure]",
+    "      tls:",
+    "        certResolver: letsencrypt",
+    "    obs-ui-router:",
+    `      rule: Host(\`${hosts.obs}\`)`,
+    "      service: clickstack-ui",
+    "      priority: 10",
+    "      entryPoints: [websecure]",
+    "      tls:",
+    "        certResolver: letsencrypt",
+    "    api-router:",
+    `      rule: Host(\`${hosts.api}\`)`,
+    `      service: ${apiServiceName}`,
+    "      entryPoints: [websecure]",
+    "      tls:",
+    "        certResolver: letsencrypt"
+  ].join("\n") + "\n";
+}
+function renderNginxConf(kind) {
+  return [
+    "server {",
+    "  listen 8080;",
+    "  server_name _;",
+    `  root /srv/${kind};`,
+    "  index index.html;",
+    "  location = /runtime-config.js {",
+    '    add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;',
+    '    add_header Pragma "no-cache" always;',
+    '    add_header Expires "0" always;',
+    "    try_files /runtime-config.js =404;",
+    "  }",
+    "  location = /index.html {",
+    '    add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;',
+    '    add_header Pragma "no-cache" always;',
+    '    add_header Expires "0" always;',
+    "    try_files /index.html =404;",
+    "  }",
+    "  location / {",
+    "    try_files $uri $uri/ /index.html;",
+    "  }",
+    "}"
+  ].join("\n") + "\n";
+}
+function renderApiMaintenanceConf() {
+  return [
+    "server {",
+    "  listen 8080;",
+    "  server_name _;",
+    "  location / {",
+    "    default_type application/json;",
+    '    add_header Cache-Control "no-store" always;',
+    `    return 503 '{"error":"Upgrade in progress. Please retry shortly."}';`,
+    "  }",
+    "}"
+  ].join("\n") + "\n";
+}
+function renderFrontendRuntimeConfig(config, generated) {
+  const hosts = domainMap(config.domain.root_domain);
+  const otelEndpoint = publicHttpsUrl(config, hosts.obs);
+  const activeReleaseVersion = generated.deployment.slots[generated.deployment.active_slot].release_version || config.release.version;
+  return `window.__ENVSYNC_RUNTIME_CONFIG__ = ${JSON.stringify({
+    apiBaseUrl: publicHttpsUrl(config, hosts.api),
+    appBaseUrl: publicHttpsUrl(config, hosts.app),
+    authBaseUrl: publicHttpsUrl(config, hosts.auth),
+    keycloakRealm: config.auth.keycloak_realm,
+    webClientId: config.auth.web_client_id,
+    apiDocsUrl: publicHttpsUrl(config, hosts.api, "/docs"),
+    otelEndpoint,
+    hyperdxApiKey: generated.clickstack.browser_api_key || void 0,
+    hyperdxUrl: otelEndpoint,
+    hyperdxDisabled: generated.clickstack.browser_api_key.length === 0,
+    hyperdxAdvancedNetworkCapture: false,
+    releaseVersion: activeReleaseVersion,
+    activeApiSlot: generated.deployment.active_slot
+  }, null, 2)};
+`;
+}
+function renderOtelAgentConfig(config) {
+  return [
+    "receivers:",
+    "  otlp:",
+    "    protocols:",
+    "      grpc:",
+    "        endpoint: 0.0.0.0:4317",
+    "      http:",
+    "        endpoint: 0.0.0.0:4318",
+    "processors:",
+    "  batch: {}",
+    "  resource:",
+    "    attributes:",
+    "      - key: deployment.environment",
+    "        value: production",
+    "        action: upsert",
+    "exporters:",
+    "  otlphttp/clickstack:",
+    `    endpoint: http://clickstack:${config.services.clickstack_otlp_http_port}`,
+    "service:",
+    "  pipelines:",
+    "    traces:",
+    "      receivers: [otlp]",
+    "      processors: [resource, batch]",
+    "      exporters: [otlphttp/clickstack]",
+    "    logs:",
+    "      receivers: [otlp]",
+    "      processors: [resource, batch]",
+    "      exporters: [otlphttp/clickstack]",
+    "    metrics:",
+    "      receivers: [otlp]",
+    "      processors: [resource, batch]",
+    "      exporters: [otlphttp/clickstack]"
+  ].join("\n") + "\n";
+}
+function renderClickstackClickHouseConfig() {
+  return [
+    "<clickhouse>",
+    "  <listen_host>0.0.0.0</listen_host>",
+    "  <listen_try>1</listen_try>",
+    "</clickhouse>"
+  ].join("\n") + "\n";
+}
+function renderStack(config, runtimeEnv, generated, mode, paths) {
+  const hosts = domainMap(config.domain.root_domain);
+  const includeRuntimeInfra = mode !== "base";
+  const includeAppServices = mode === "full";
+  const landingEnabled = !isOssConfig(config);
+  const deployment = createSteadyApiDeploymentState(config, generated);
+  const stackName = config.services.stack_name;
+  const s3RouterName = `${stackName}-s3-router`;
+  const s3ServiceName = `${stackName}-s3-service`;
+  const s3ConsoleRouterName = `${stackName}-s3-console-router`;
+  const s3ConsoleServiceName = `${stackName}-s3-console-service`;
+  const apiEnvironment = {
+    ...runtimeEnv,
+    OTEL_EXPORTER_OTLP_ENDPOINT: "http://otel-agent:4318",
+    KEYCLOAK_URL: "http://keycloak:8080",
+    OPENFGA_API_URL: "http://openfga:8090",
+    MINIKMS_GRPC_ADDR: "minikms:50051",
+    S3_ENDPOINT: "http://rustfs:9000",
+    S3_BUCKET_URL: publicBucketUrl(config, hosts.s3, runtimeEnv.S3_BUCKET)
+  };
+  return `
+version: "3.9"
+services:
+  traefik:
+    image: ${config.images.traefik}
+    command:
+      - --providers.swarm=true
+      - --providers.swarm.endpoint=unix:///var/run/docker.sock
+      - --providers.swarm.exposedByDefault=false
+      - --providers.file.filename=/etc/traefik/dynamic/traefik-dynamic.yaml
+      - --entrypoints.web.address=:80
+      - --entrypoints.web.http.redirections.entryPoint.to=websecure
+      - --entrypoints.web.http.redirections.entryPoint.scheme=https
+      - --entrypoints.web.http.redirections.entryPoint.permanent=true
+      - --entrypoints.websecure.address=:443
+      - --certificatesresolvers.letsencrypt.acme.email=${config.domain.acme_email}
+      - --certificatesresolvers.letsencrypt.acme.storage=/var/lib/traefik/acme.json
+      - --certificatesresolvers.letsencrypt.acme.httpchallenge=true
+      - --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web
+    ports:
+      - target: 80
+        published: ${config.services.public_http_port}
+        protocol: tcp
+        mode: host
+      - target: 443
+        published: ${config.services.public_https_port}
+        protocol: tcp
+        mode: host
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ${paths.traefikStateRoot}:/var/lib/traefik
+      - ${paths.deployRoot}:/etc/traefik/dynamic:ro
+    networks: [envsync]
+
+  postgres:
+    image: postgres:17
+    environment:
+${renderEnvList({
+    POSTGRES_USER: "postgres",
+    POSTGRES_PASSWORD: "envsync-postgres",
+    POSTGRES_DB: "envsync"
+  })}
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    networks: [envsync]
+
+  redis:
+    image: redis:7
+    volumes:
+      - redis_data:/data
+    networks: [envsync]
+
+  rustfs:
+    image: rustfs/rustfs:latest
+    environment:
+${renderEnvList({
+    RUSTFS_DATA_DIR: "/data",
+    RUSTFS_ACCESS_KEY: "envsync-rustfs",
+    RUSTFS_SECRET_KEY: runtimeEnv.S3_SECRET_KEY,
+    RUSTFS_CONSOLE_ENABLE: "true"
+  })}
+    volumes:
+      - rustfs_data:/data
+    networks: [envsync]
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.${s3RouterName}.rule=Host(\`${hosts.s3}\`)
+        - traefik.http.routers.${s3RouterName}.entrypoints=websecure
+        - traefik.http.routers.${s3RouterName}.tls.certresolver=letsencrypt
+        - traefik.http.routers.${s3RouterName}.service=${s3ServiceName}
+        - traefik.http.services.${s3ServiceName}.loadbalancer.server.port=9000
+        - traefik.http.routers.${s3ConsoleRouterName}.rule=Host(\`${hosts.s3Console}\`)
+        - traefik.http.routers.${s3ConsoleRouterName}.entrypoints=websecure
+        - traefik.http.routers.${s3ConsoleRouterName}.tls.certresolver=letsencrypt
+        - traefik.http.routers.${s3ConsoleRouterName}.service=${s3ConsoleServiceName}
+        - traefik.http.services.${s3ConsoleServiceName}.loadbalancer.server.port=9001
+
+  keycloak_db:
+    image: postgres:17
+    environment:
+${renderEnvList({
+    POSTGRES_USER: "keycloak",
+    POSTGRES_PASSWORD: runtimeEnv.KEYCLOAK_DB_PASSWORD,
+    POSTGRES_DB: "keycloak"
+  })}
+    volumes:
+      - keycloak_db_data:/var/lib/postgresql/data
+    networks: [envsync]
+${includeRuntimeInfra ? `
+  keycloak:
+    image: ${config.images.keycloak}
+    entrypoint: ["/bin/sh", "-lc"]
+    command:
+      - /opt/keycloak/bin/kc.sh import --dir /opt/keycloak/data/import --override true && exec /opt/keycloak/bin/kc.sh start --optimized
+    environment:
+${renderEnvList({
+    KC_DB: "postgres",
+    KC_DB_URL: "jdbc:postgresql://keycloak_db:5432/keycloak",
+    KC_DB_USERNAME: "keycloak",
+    KC_DB_PASSWORD: runtimeEnv.KEYCLOAK_DB_PASSWORD,
+    KC_BOOTSTRAP_ADMIN_USERNAME: config.auth.admin_user,
+    KC_BOOTSTRAP_ADMIN_PASSWORD: config.auth.admin_password,
+    KC_HTTP_ENABLED: "true",
+    KC_HEALTH_ENABLED: "true",
+    KC_PROXY_HEADERS: "xforwarded",
+    KC_HOSTNAME: hosts.auth,
+    KC_HOSTNAME_STRICT: "false"
+  })}
+    configs:
+      - source: keycloak_realm
+        target: /opt/keycloak/data/import/realm.json
+    networks: [envsync]
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.keycloak.rule=Host(\`${hosts.auth}\`)
+        - traefik.http.routers.keycloak.entrypoints=websecure
+        - traefik.http.routers.keycloak.tls.certresolver=letsencrypt
+        - traefik.http.services.keycloak.loadbalancer.server.port=8080` : ""}
+
+  openfga_db:
+    image: postgres:17
+    environment:
+${renderEnvList({
+    POSTGRES_USER: "openfga",
+    POSTGRES_PASSWORD: runtimeEnv.OPENFGA_DB_PASSWORD,
+    POSTGRES_DB: "openfga"
+  })}
+    volumes:
+      - openfga_db_data:/var/lib/postgresql/data
+    networks: [envsync]
+${includeRuntimeInfra ? `
+  openfga:
+    image: openfga/openfga:v1.12.0
+    command: run
+    environment:
+${renderEnvList({
+    OPENFGA_DATASTORE_ENGINE: "postgres",
+    OPENFGA_DATASTORE_URI: `postgres://openfga:${runtimeEnv.OPENFGA_DB_PASSWORD}@openfga_db:5432/openfga?sslmode=disable`,
+    OPENFGA_HTTP_ADDR: "0.0.0.0:8090",
+    OPENFGA_GRPC_ADDR: "0.0.0.0:8091"
+  })}
+    networks: [envsync]` : ""}
+
+  minikms_db:
+    image: postgres:17
+    environment:
+${renderEnvList({
+    POSTGRES_USER: "postgres",
+    POSTGRES_PASSWORD: runtimeEnv.MINIKMS_DB_PASSWORD,
+    POSTGRES_DB: "minikms"
+  })}
+    volumes:
+      - minikms_db_data:/var/lib/postgresql/data
+    networks: [envsync]
+${includeRuntimeInfra ? `
+  minikms:
+    image: ghcr.io/envsync-cloud/minikms:sha-735dfe8
+    environment:
+${renderEnvList({
+    MINIKMS_ROOT_KEY: runtimeEnv.MINIKMS_ROOT_KEY,
+    MINIKMS_DB_URL: `postgres://postgres:${runtimeEnv.MINIKMS_DB_PASSWORD}@minikms_db:5432/minikms?sslmode=disable`,
+    MINIKMS_REDIS_URL: "redis://redis:6379",
+    MINIKMS_GRPC_ADDR: "0.0.0.0:50051",
+    MINIKMS_TLS_ENABLED: "false"
+  })}
+    networks: [envsync]` : ""}
+
+  clickstack:
+    image: ${config.images.clickstack}
+    environment:
+${renderEnvList({
+    HYPERDX_APP_URL: publicHttpsUrl(config, hosts.obs),
+    HYPERDX_API_URL: publicHttpsUrl(config, hosts.obs),
+    FRONTEND_URL: publicHttpsUrl(config, hosts.obs)
+  })}
+    volumes:
+      - clickstack_data:/data/db
+      - clickstack_ch_data:/var/lib/clickhouse
+      - clickstack_ch_logs:/var/log/clickhouse-server
+    configs:
+      - source: clickstack_clickhouse_conf
+        target: /etc/clickhouse-server/config.d/envsync-listen-host.xml
+    networks: [envsync]
+    healthcheck:
+      disable: true
+
+  otel-agent:
+    image: ${config.images.otel_agent}
+    command: ["--config=/etc/otel-agent.yaml"]
+    configs:
+      - source: otel_agent_conf
+        target: /etc/otel-agent.yaml
+    networks: [envsync]
+${includeAppServices ? `
+
+  api_maintenance:
+    image: nginx:1.27-alpine
+    configs:
+      - source: nginx_api_maintenance_conf
+        target: /etc/nginx/conf.d/default.conf
+    networks: [envsync]
+
+${landingEnabled ? `
+  landing_nginx:
+    image: nginx:1.27-alpine
+    configs:
+      - source: nginx_landing_conf
+        target: /etc/nginx/conf.d/default.conf
+    volumes:
+      - ${paths.releasesRoot}/landing/current:/srv/landing:ro
+    networks: [envsync]` : ""}
+
+  web_nginx:
+    image: nginx:1.27-alpine
+    configs:
+      - source: nginx_web_conf
+        target: /etc/nginx/conf.d/default.conf
+    volumes:
+      - ${paths.releasesRoot}/web/current:/srv/web:ro
+    networks: [envsync]
+
+  envsync_api_blue:
+    image: ${deployment.slots.blue.api_image || config.images.api}
+    environment:
+${renderEnvList({
+    ...apiEnvironment,
+    ENVSYNC_DEPLOY_SLOT: "blue",
+    ENVSYNC_DEPLOY_RELEASE_VERSION: deployment.slots.blue.release_version || config.release.version
+  })}
+    networks: [envsync]
+    deploy:
+      replicas: ${slotHasApiDeployment(deployment.slots.blue) ? 1 : 0}
+
+  envsync_api_green:
+    image: ${deployment.slots.green.api_image || config.images.api}
+    environment:
+${renderEnvList({
+    ...apiEnvironment,
+    ENVSYNC_DEPLOY_SLOT: "green",
+    ENVSYNC_DEPLOY_RELEASE_VERSION: deployment.slots.green.release_version || config.release.version
+  })}
+    networks: [envsync]
+    deploy:
+      replicas: ${slotHasApiDeployment(deployment.slots.green) ? 1 : 0}` : ""}
+
+networks:
+  envsync:
+    driver: overlay
+    attachable: true
+
+volumes:
+  postgres_data:
+  redis_data:
+  rustfs_data:
+  keycloak_db_data:
+  openfga_db_data:
+  minikms_db_data:
+  clickstack_data:
+  clickstack_ch_data:
+  clickstack_ch_logs:
+
+configs:
+  keycloak_realm:
+    file: ${paths.keycloakRealmFile}
+  clickstack_clickhouse_conf:
+    file: ${paths.clickstackClickhouseConf}
+  otel_agent_conf:
+    file: ${paths.otelAgentConf}
+${landingEnabled ? `  nginx_landing_conf:
+    file: ${paths.nginxLandingConf}
+` : ""}
+  nginx_web_conf:
+    file: ${paths.nginxWebConf}
+  nginx_api_maintenance_conf:
+    file: ${paths.nginxApiMaintenanceConf}
+`.trimStart();
+}
+
+// src/static-bundle.ts
+import fs from "fs";
+import path from "path";
+function exists(target) {
+  return fs.existsSync(target);
+}
+function normalizeExtractedStaticBundle(kind, targetDir) {
+  const directIndex = path.join(targetDir, "index.html");
+  if (exists(directIndex)) {
+    return;
+  }
+  const childDirs = fs.readdirSync(targetDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => path.join(targetDir, entry.name));
+  const candidateRoots = childDirs.filter((dir) => exists(path.join(dir, "index.html")));
+  if (candidateRoots.length !== 1) {
+    return;
+  }
+  const nestedRoot = candidateRoots[0];
+  for (const entry of fs.readdirSync(nestedRoot)) {
+    fs.cpSync(path.join(nestedRoot, entry), path.join(targetDir, entry), { recursive: true });
+  }
+  fs.rmSync(nestedRoot, { recursive: true, force: true });
+}
+function validateStaticBundle(kind, targetDir) {
+  if (exists(path.join(targetDir, "index.html"))) {
+    return;
+  }
+  const entries = exists(targetDir) ? fs.readdirSync(targetDir).slice(0, 20).join(", ") : "";
+  throw new Error(
+    `Invalid ${kind} static bundle at ${targetDir}: missing index.html${entries ? `. Found: ${entries}` : ""}`
+  );
+}
+
+// src/index.ts
+var HOST_ROOT = process.env.ENVSYNC_HOST_ROOT ?? "/opt/envsync";
+var ETC_ROOT = process.env.ENVSYNC_ETC_ROOT ?? "/etc/envsync";
+var TRAEFIK_STATE_ROOT = process.env.ENVSYNC_TRAEFIK_STATE_ROOT ?? "/var/lib/envsync/traefik";
+var DEPLOY_ROOT = path2.join(HOST_ROOT, "deploy");
+var RELEASES_ROOT = path2.join(HOST_ROOT, "releases");
+var BACKUPS_ROOT = path2.join(HOST_ROOT, "backups");
+var REPO_ROOT = process.env.ENVSYNC_REPO_ROOT ?? path2.join(HOST_ROOT, "repo");
+var DEPLOY_ENV = path2.join(ETC_ROOT, "deploy.env");
+var DEPLOY_YAML = path2.join(ETC_ROOT, "deploy.yaml");
+var VERSIONS_LOCK = path2.join(DEPLOY_ROOT, "versions.lock.json");
+var STACK_FILE = path2.join(DEPLOY_ROOT, "docker-stack.yaml");
+var BOOTSTRAP_BASE_STACK_FILE = path2.join(DEPLOY_ROOT, "docker-stack.bootstrap.base.yaml");
+var BOOTSTRAP_STACK_FILE = path2.join(DEPLOY_ROOT, "docker-stack.bootstrap.yaml");
+var TRAEFIK_DYNAMIC_FILE = path2.join(DEPLOY_ROOT, "traefik-dynamic.yaml");
+var KEYCLOAK_REALM_FILE = path2.join(DEPLOY_ROOT, "keycloak-realm.envsync.json");
+var NGINX_WEB_CONF = path2.join(DEPLOY_ROOT, "nginx-web.conf");
+var NGINX_LANDING_CONF = path2.join(DEPLOY_ROOT, "nginx-landing.conf");
+var NGINX_API_MAINTENANCE_CONF = path2.join(DEPLOY_ROOT, "nginx-api-maintenance.conf");
+var OTEL_AGENT_CONF = path2.join(DEPLOY_ROOT, "otel-agent.yaml");
+var CLICKSTACK_CLICKHOUSE_CONF = path2.join(DEPLOY_ROOT, "clickhouse-listen.xml");
+var INTERNAL_CONFIG_JSON = path2.join(DEPLOY_ROOT, "config.json");
+var UPGRADE_BACKUPS_ROOT = path2.join(BACKUPS_ROOT, "upgrade");
+var DEPLOY_RENDER_PATHS = {
+  traefikStateRoot: TRAEFIK_STATE_ROOT,
+  deployRoot: DEPLOY_ROOT,
+  releasesRoot: RELEASES_ROOT,
+  keycloakRealmFile: KEYCLOAK_REALM_FILE,
+  clickstackClickhouseConf: CLICKSTACK_CLICKHOUSE_CONF,
+  otelAgentConf: OTEL_AGENT_CONF,
+  nginxLandingConf: NGINX_LANDING_CONF,
+  nginxWebConf: NGINX_WEB_CONF,
+  nginxApiMaintenanceConf: NGINX_API_MAINTENANCE_CONF
+};
+var STACK_VOLUMES = [
+  "postgres_data",
+  "redis_data",
+  "rustfs_data",
+  "keycloak_db_data",
+  "openfga_db_data",
+  "minikms_db_data",
+  "clickstack_data",
+  "clickstack_ch_data",
+  "clickstack_ch_logs"
+];
+var REQUIRED_BOOTSTRAP_ENV_KEYS = [
+  "S3_SECRET_KEY",
+  "KEYCLOAK_WEB_CLIENT_SECRET",
+  "KEYCLOAK_API_CLIENT_SECRET",
+  "OPENFGA_DB_PASSWORD",
+  "MINIKMS_ROOT_KEY",
+  "MINIKMS_DB_PASSWORD",
+  "OPENFGA_STORE_ID",
+  "OPENFGA_MODEL_ID"
+];
+var REQUIRED_CLICKSTACK_SAVED_SEARCHES = [
+  "Frontend Errors - Web",
+  "Frontend Errors - Landing",
+  "API Errors",
+  "Org Onboarding Completed",
+  "Apps Created",
+  "Users Invited",
+  "Webhooks Created",
+  "Slow API Traces",
+  "Frontend API Calls"
+];
+var REQUIRED_CLICKSTACK_TAGS = [
+  "envsync",
+  "frontend",
+  "backend",
+  "onboarding",
+  "applications",
+  "webhooks",
+  "errors",
+  "performance",
+  "alerts"
+];
+var CLICKSTACK_SELFHOST_TEAM_NAME = "EnvSync Self-Hosted Team";
+var SEMVER_VERSION_RE = /^\d+\.\d+\.\d+$/;
+var currentOptions = { dryRun: false, force: false };
+var DEFAULT_SOURCE_REPO_URL = "https://github.com/EnvSync-Cloud/envsync.git";
+var MANAGED_VERSIONED_IMAGE_PREFIXES = {
+  api: "ghcr.io/envsync-cloud/envsync-api:",
+  keycloak: "envsync-keycloak:",
+  web: "ghcr.io/envsync-cloud/envsync-web-static:",
+  landing: "ghcr.io/envsync-cloud/envsync-landing-static:"
+};
+function formatShellArg(arg) {
+  if (/^[A-Za-z0-9_./:@%+=,-]+$/.test(arg)) return arg;
+  return JSON.stringify(arg);
+}
+function formatCommand(cmd, args) {
+  return [cmd, ...args].map(formatShellArg).join(" ");
+}
+function logSection(title) {
+  console.log(`
+${chalk.bold.blue(title)}`);
+}
+function logStep(message) {
+  console.log(`${chalk.cyan("[step]")} ${message}`);
+}
+function logInfo(message) {
+  console.log(`${chalk.blue("[info]")} ${message}`);
+}
+function logSuccess(message) {
+  console.log(`${chalk.green("[ok]")} ${message}`);
+}
+function logWarn(message) {
+  console.log(`${chalk.yellow("[warn]")} ${message}`);
+}
+function logDryRun(message) {
+  console.log(`${chalk.magenta("[dry-run]")} ${message}`);
+}
+function cmdEnterpriseTopologyPlan(configPath = DEPLOY_YAML, json = false) {
+  const plan = loadDeploymentPlanFromFile(configPath, "enterprise");
+  console.log(formatDeploymentPlan(plan, json ? "json" : "yaml"));
+}
+function cmdEnterpriseTopologyValidate(configPath = DEPLOY_YAML, json = false) {
+  const plan = loadDeploymentPlanFromFile(configPath, "enterprise");
+  if (json) {
+    console.log(JSON.stringify({ valid: true, edition: plan.edition, warnings: plan.warnings }, null, 2));
+    return;
+  }
+  logSuccess("Enterprise topology is valid.");
+  for (const warning of plan.warnings) {
+    logWarn(warning);
+  }
+}
+function logCommand(cmd, args) {
+  console.log(chalk.dim(`$ ${formatCommand(cmd, args)}`));
+}
+function run(cmd, args, opts = {}) {
+  const result = spawnSync(cmd, args, {
+    cwd: opts.cwd,
+    env: { ...process.env, ...opts.env },
+    stdio: opts.quiet ? "pipe" : "inherit",
+    encoding: "utf8"
+  });
+  if (result.status !== 0) {
+    const stderr = typeof result.stderr === "string" ? result.stderr : "";
+    throw new Error(`Command failed: ${cmd} ${args.join(" ")}${stderr ? `
+${stderr}` : ""}`);
+  }
+  return result.stdout?.toString() ?? "";
+}
+function tryRun(cmd, args, opts = {}) {
+  try {
+    return run(cmd, args, opts);
+  } catch {
+    return "";
+  }
+}
+function commandSucceeds(cmd, args, opts = {}) {
+  const result = spawnSync(cmd, args, {
+    cwd: opts.cwd,
+    env: { ...process.env, ...opts.env },
+    stdio: "ignore",
+    encoding: "utf8"
+  });
+  return result.status === 0;
+}
+function runIgnoringAbsent(cmd, args, opts = {}) {
+  const result = spawnSync(cmd, args, {
+    cwd: opts.cwd,
+    env: { ...process.env, ...opts.env },
+    stdio: "pipe",
+    encoding: "utf8"
+  });
+  if (result.status === 0) {
+    const stdout = typeof result.stdout === "string" ? result.stdout.trim() : "";
+    if (stdout) console.log(stdout);
+    return true;
+  }
+  const combined = `${typeof result.stdout === "string" ? result.stdout : ""}
+${typeof result.stderr === "string" ? result.stderr : ""}`.toLowerCase();
+  const absentPatterns = (opts.absentPatterns ?? []).map((pattern) => pattern.toLowerCase());
+  if (absentPatterns.some((pattern) => combined.includes(pattern))) {
+    return false;
+  }
+  const stderr = typeof result.stderr === "string" ? result.stderr : "";
+  throw new Error(`Command failed: ${cmd} ${args.join(" ")}${stderr ? `
+${stderr}` : ""}`);
+}
+function ensureDir(dir) {
+  fs2.mkdirSync(dir, { recursive: true });
+}
+function writeFile(target, content, mode) {
+  ensureDir(path2.dirname(target));
+  fs2.writeFileSync(target, content, "utf8");
+  if (mode != null) fs2.chmodSync(target, mode);
+}
+function writeFileMaybe(target, content, mode) {
+  if (currentOptions.dryRun) {
+    logDryRun(`Would write ${target}`);
+    return;
+  }
+  writeFile(target, content, mode);
+}
+function exists2(target) {
+  return fs2.existsSync(target);
+}
+function randomSecret(bytes = 24) {
+  return randomBytes(bytes).toString("hex");
+}
+function randomStrongPassword() {
+  return `EnvSync!${randomBytes(8).toString("hex")}Aa1`;
+}
+function emptyApiSlotState() {
+  return {
+    api_image: "",
+    release_version: "",
+    deployed_at: ""
+  };
+}
+function normalizeApiSlot(value) {
+  return value === "green" ? "green" : "blue";
+}
+function normalizeApiSlotState(raw) {
+  const defaults = emptyApiSlotState();
+  return {
+    api_image: raw?.api_image ?? defaults.api_image,
+    release_version: raw?.release_version ?? defaults.release_version,
+    deployed_at: raw?.deployed_at ?? defaults.deployed_at
+  };
+}
+function otherApiSlot(slot) {
+  return slot === "blue" ? "green" : "blue";
+}
+function toYaml(value, indent = 0) {
+  return YAML.stringify(value, {
+    indent: Math.max(2, indent || 2)
+  });
+}
+function parseSimpleYamlObject(input) {
+  const parsed = YAML.parse(input);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`Invalid deploy config in ${DEPLOY_YAML}. Expected a YAML object at the document root.`);
+  }
+  return parsed;
+}
+function parseEnvFile(content) {
+  const out = {};
+  for (const line of content.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eq = trimmed.indexOf("=");
+    if (eq === -1) continue;
+    const key = trimmed.slice(0, eq).trim();
+    let value = trimmed.slice(eq + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1).replace(/\\n/g, "\n").replace(/\\"/g, '"');
+    }
+    out[key] = value;
+  }
+  return out;
+}
+async function ask(question, fallback = "") {
+  if (!process.stdin.isTTY) return fallback;
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  return await new Promise((resolve) => {
+    rl.question(fallback ? `${question} [${fallback}]: ` : `${question}: `, (answer) => {
+      rl.close();
+      resolve(answer.trim() || fallback);
+    });
+  });
+}
+async function askRequired(question) {
+  if (!process.stdin.isTTY) {
+    throw new Error("Bootstrap confirmation requires an interactive terminal. Re-run with --force to bypass the prompt.");
+  }
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  return await new Promise((resolve) => {
+    rl.question(`${question} `, (answer) => {
+      rl.close();
+      resolve(answer.trim());
+    });
+  });
+}
+function sleepSeconds(seconds) {
+  spawnSync("sleep", [`${seconds}`], { stdio: "ignore" });
+}
+function domainMap2(rootDomain) {
+  return {
+    landing: rootDomain,
+    app: `app.${rootDomain}`,
+    api: `api.${rootDomain}`,
+    auth: `auth.${rootDomain}`,
+    obs: `obs.${rootDomain}`,
+    mail: `mail.${rootDomain}`,
+    s3: `s3.${rootDomain}`,
+    s3Console: `console.s3.${rootDomain}`
+  };
+}
+function publicHttpsOrigin2(config, host) {
+  return `https://${host}${config.services.public_https_port === 443 ? "" : `:${config.services.public_https_port}`}`;
+}
+function publicHttpsUrl2(config, host, path3 = "") {
+  return `${publicHttpsOrigin2(config, host)}${path3}`;
+}
+function getDeployCliVersion() {
+  try {
+    const packageJsonPath = new URL("../package.json", import.meta.url);
+    const raw = fs2.readFileSync(packageJsonPath, "utf8");
+    return JSON.parse(raw).version ?? "0.0.0";
+  } catch {
+    return process.env.npm_package_version ?? "0.0.0";
+  }
+}
+function hasExplicitRepoOverride() {
+  return typeof process.env.ENVSYNC_REPO_ROOT === "string" && process.env.ENVSYNC_REPO_ROOT.length > 0;
+}
+function logReleaseContext(config) {
+  const cliVersion = getDeployCliVersion();
+  logInfo(`Configured release version from ${DEPLOY_YAML}: ${config.release.version}`);
+  logInfo(`Running deploy-cli version: ${cliVersion}`);
+  if (cliVersion !== config.release.version) {
+    logWarn(
+      `The running deploy-cli version does not change the configured release target. This run will deploy the version pinned in ${DEPLOY_YAML}.`
+    );
+  }
+}
+function renderHelpBlock() {
+  return [
+    `${chalk.bold("EnvSync Self-Host Deploy CLI")}`,
+    "",
+    `${chalk.dim("Usage")}`,
+    "  envsync-deploy <command> [options]",
+    "",
+    `${chalk.dim("Commands")}`,
+    "  preinstall           Prepare the host with Docker, Swarm, and required packages",
+    "  setup                Write /etc/envsync/deploy.yaml for a new self-hosted install",
+    "  bootstrap            Destructively rebuild managed infra and bootstrap runtime state",
+    "  deploy               Deploy the configured release",
+    "  promote [blue|green] Promote the requested or inactive API slot",
+    "  rollback             Switch traffic back to the previous API slot",
+    "  health [--json]      Show operator health or machine-readable health JSON",
+    "  plan-topology [file] Render the Enterprise topology plan from deploy.yaml",
+    "  validate-topology    Validate Enterprise edition topology rules",
+    "  upgrade [version]    Pin a target release and deploy it",
+    "  upgrade-deps         Refresh dependency images and redeploy",
+    "  backup               Create a managed self-host backup archive",
+    "  restore <archive>    Restore a backup archive into the managed self-host roots",
+    "",
+    `${chalk.dim("Options")}`,
+    "  --dry-run            Preview mutating work without changing the host",
+    "  --force              Skip destructive confirmations where supported",
+    "  --deploy             Used with restore to start services after restore"
+  ].join("\n");
+}
+function buildOperatorOverview() {
+  const statusLines = [
+    `CLI version: ${chalk.cyan(getDeployCliVersion())}`,
+    `Config path: ${chalk.dim(DEPLOY_YAML)}`
+  ];
+  const dockerReady = commandSucceeds("docker", ["info"]);
+  statusLines.push(`Docker: ${dockerReady ? chalk.green("available") : chalk.red("not available")}`);
+  if (!exists2(DEPLOY_YAML)) {
+    statusLines.push(`Configured: ${chalk.red("no")}`);
+    return {
+      statusLines,
+      nextSteps: [
+        "`envsync-deploy preinstall` if this host has not been prepared yet",
+        "`envsync-deploy setup` to create the self-host deploy config"
+      ]
+    };
+  }
+  const { config, generated } = loadState();
+  const services = listStackServices(config);
+  const stackRunning = stackExists(config);
+  const bootstrapComplete = hasCompleteBootstrapState(generated) && generated.bootstrap.completed_at.length > 0;
+  const api = apiHealth(services, config.services.stack_name);
+  const web = serviceHealth(services, `${config.services.stack_name}_web_nginx`);
+  const landing = serviceHealth(services, `${config.services.stack_name}_landing_nginx`);
+  statusLines.push(`Configured: ${chalk.green("yes")}`);
+  statusLines.push(`Pinned release: ${chalk.cyan(config.release.version)}`);
+  statusLines.push(`Stack: ${stackRunning ? chalk.green(config.services.stack_name) : chalk.yellow("not running")}`);
+  statusLines.push(`Bootstrap: ${bootstrapComplete ? chalk.green("complete") : chalk.yellow("pending")}`);
+  statusLines.push(`Active API slot: ${chalk.cyan(generated.deployment.active_slot)}`);
+  statusLines.push(`API: ${api === "healthy" ? chalk.green(api) : api === "missing" ? chalk.red(api) : chalk.yellow(api)}`);
+  statusLines.push(`Web: ${web === "healthy" ? chalk.green(web) : web === "missing" ? chalk.red(web) : chalk.yellow(web)}`);
+  statusLines.push(`Landing: ${landing === "healthy" ? chalk.green(landing) : landing === "missing" ? chalk.red(landing) : chalk.yellow(landing)}`);
+  if (!bootstrapComplete) {
+    return {
+      statusLines,
+      nextSteps: [
+        "`envsync-deploy bootstrap` to create infrastructure, runtime secrets, and generated state",
+        "`envsync-deploy bootstrap --force` for non-interactive automation"
+      ]
+    };
+  }
+  if (api !== "healthy" || web !== "healthy" || landing !== "healthy") {
+    return {
+      statusLines,
+      nextSteps: [
+        "`envsync-deploy deploy` to reconcile services to the pinned release",
+        "`envsync-deploy health --json` to inspect exact slot and observability state"
+      ]
+    };
+  }
+  return {
+    statusLines,
+    nextSteps: [
+      "`envsync-deploy health --json` for machine-readable checks",
+      "`envsync-deploy upgrade` to move to the current deploy-cli release",
+      "`envsync-deploy backup` before an upgrade or major change"
+    ]
+  };
+}
+function printOperatorOverview() {
+  const overview = buildOperatorOverview();
+  const commonCommands = [
+    "`envsync-deploy setup`",
+    "`envsync-deploy bootstrap --force`",
+    "`envsync-deploy deploy`",
+    "`envsync-deploy upgrade`",
+    "`envsync-deploy health --json`",
+    "`envsync-deploy plan-topology --json`",
+    "`envsync-deploy backup`",
+    "`envsync-deploy restore <archive>`",
+    "`envsync-deploy promote`",
+    "`envsync-deploy rollback`"
+  ];
+  const importantNotes = [
+    "`bootstrap` is destructive",
+    "`upgrade` updates the pinned release target automatically",
+    "blue/green keeps the previous API slot for rollback",
+    "self-hosted release targets must be exact semver values"
+  ];
+  console.log(chalk.bold("EnvSync Self-Host Deploy CLI"));
+  printHealthSection("Current Status");
+  for (const line of overview.statusLines) {
+    console.log(`  ${line}`);
+  }
+  printHealthSection("Recommended Next Step");
+  for (const line of overview.nextSteps) {
+    console.log(`  - ${line}`);
+  }
+  printHealthSection("Common Commands");
+  for (const line of commonCommands) {
+    console.log(`  - ${line}`);
+  }
+  printHealthSection("Important Notes");
+  for (const line of importantNotes) {
+    console.log(`  - ${line}`);
+  }
+}
+function assertSemverVersion(version, label = "release version") {
+  if (!SEMVER_VERSION_RE.test(version)) {
+    throw new Error(`Invalid ${label} '${version}'. Expected an exact semver like 0.6.2.`);
+  }
+}
+function versionedImages(version) {
+  assertSemverVersion(version);
+  return {
+    api: `ghcr.io/envsync-cloud/envsync-api:${version}`,
+    keycloak: `envsync-keycloak:${version}`,
+    web: `ghcr.io/envsync-cloud/envsync-web-static:${version}`,
+    landing: `ghcr.io/envsync-cloud/envsync-landing-static:${version}`
+  };
+}
+function defaultSourceConfig(version) {
+  return {
+    repo_url: DEFAULT_SOURCE_REPO_URL,
+    ref: `v${version}`
+  };
+}
+function isOssConfig2(config) {
+  return config.edition === "oss";
+}
+function isManagedVersionedImage(image, key) {
+  return typeof image === "string" && image.startsWith(MANAGED_VERSIONED_IMAGE_PREFIXES[key]);
+}
+function resolveReleaseVersion(raw) {
+  const releaseVersion = raw.release?.version;
+  if (releaseVersion) {
+    assertSemverVersion(releaseVersion);
+    return releaseVersion;
+  }
+  if (typeof raw.release_channel === "string" && raw.release_channel.length > 0) {
+    if (SEMVER_VERSION_RE.test(raw.release_channel)) {
+      return raw.release_channel;
+    }
+    if (raw.release_channel === "stable" || raw.release_channel === "latest") {
+      throw new Error(
+        "Legacy release channel config is no longer supported for self-hosted installs. Set an exact release version in /etc/envsync/deploy.yaml."
+      );
+    }
+    throw new Error(`Invalid legacy release channel '${raw.release_channel}'. Set an exact release version in /etc/envsync/deploy.yaml.`);
+  }
+  return getDeployCliVersion();
+}
+function requireDefined(value, label) {
+  if (value === void 0) {
+    throw new Error(`Missing ${label} in ${DEPLOY_YAML}. Run setup again.`);
+  }
+  return value;
+}
+function normalizeConfig(raw) {
+  const version = resolveReleaseVersion(raw);
+  const derivedImages = versionedImages(version);
+  const { release_channel: _legacyReleaseChannel, ...rest } = raw;
+  const rootDomain = requireDefined(raw.domain?.root_domain, "domain.root_domain");
+  const acmeEmail = requireDefined(raw.domain?.acme_email, "domain.acme_email");
+  return {
+    ...rest,
+    edition: raw.edition ?? "enterprise",
+    source: {
+      repo_url: raw.source?.repo_url ?? DEFAULT_SOURCE_REPO_URL,
+      ref: `v${version}`
+    },
+    release: {
+      version
+    },
+    domain: {
+      root_domain: rootDomain,
+      acme_email: acmeEmail
+    },
+    images: {
+      api: !raw.images?.api || isManagedVersionedImage(raw.images.api, "api") ? derivedImages.api : raw.images.api,
+      keycloak: !raw.images?.keycloak || isManagedVersionedImage(raw.images.keycloak, "keycloak") ? derivedImages.keycloak : raw.images.keycloak,
+      web: !raw.images?.web || isManagedVersionedImage(raw.images.web, "web") ? derivedImages.web : raw.images.web,
+      landing: !raw.images?.landing || isManagedVersionedImage(raw.images.landing, "landing") ? derivedImages.landing : raw.images.landing,
+      clickstack: raw.images?.clickstack ?? "clickhouse/clickstack-all-in-one:latest",
+      traefik: raw.images?.traefik ?? "traefik:v3.6.6",
+      otel_agent: raw.images?.otel_agent ?? "otel/opentelemetry-collector-contrib:0.111.0"
+    },
+    services: {
+      stack_name: requireDefined(raw.services?.stack_name, "services.stack_name"),
+      api_port: requireDefined(raw.services?.api_port, "services.api_port"),
+      public_http_port: raw.services?.public_http_port ?? 80,
+      public_https_port: raw.services?.public_https_port ?? 443,
+      clickstack_ui_port: requireDefined(raw.services?.clickstack_ui_port, "services.clickstack_ui_port"),
+      clickstack_otlp_http_port: requireDefined(raw.services?.clickstack_otlp_http_port, "services.clickstack_otlp_http_port"),
+      clickstack_otlp_grpc_port: requireDefined(raw.services?.clickstack_otlp_grpc_port, "services.clickstack_otlp_grpc_port"),
+      keycloak_port: requireDefined(raw.services?.keycloak_port, "services.keycloak_port"),
+      rustfs_port: requireDefined(raw.services?.rustfs_port, "services.rustfs_port"),
+      rustfs_console_port: requireDefined(raw.services?.rustfs_console_port, "services.rustfs_console_port")
+    },
+    auth: {
+      keycloak_realm: requireDefined(raw.auth?.keycloak_realm, "auth.keycloak_realm"),
+      admin_user: requireDefined(raw.auth?.admin_user, "auth.admin_user"),
+      admin_password: requireDefined(raw.auth?.admin_password, "auth.admin_password"),
+      web_client_id: requireDefined(raw.auth?.web_client_id, "auth.web_client_id"),
+      api_client_id: requireDefined(raw.auth?.api_client_id, "auth.api_client_id"),
+      cli_client_id: requireDefined(raw.auth?.cli_client_id, "auth.cli_client_id")
+    },
+    observability: {
+      retention_days: requireDefined(raw.observability?.retention_days, "observability.retention_days"),
+      public_obs: requireDefined(raw.observability?.public_obs, "observability.public_obs"),
+      alert_webhook_url: raw.observability?.alert_webhook_url,
+      alert_webhook_headers: raw.observability?.alert_webhook_headers ?? {}
+    },
+    backup: {
+      output_dir: requireDefined(raw.backup?.output_dir, "backup.output_dir"),
+      encrypted: requireDefined(raw.backup?.encrypted, "backup.encrypted")
+    },
+    smtp: {
+      host: requireDefined(raw.smtp?.host, "smtp.host"),
+      port: requireDefined(raw.smtp?.port, "smtp.port"),
+      secure: requireDefined(raw.smtp?.secure, "smtp.secure"),
+      user: requireDefined(raw.smtp?.user, "smtp.user"),
+      pass: requireDefined(raw.smtp?.pass, "smtp.pass"),
+      from: requireDefined(raw.smtp?.from, "smtp.from")
+    },
+    exposure: {
+      public_auth: requireDefined(raw.exposure?.public_auth, "exposure.public_auth"),
+      public_obs: requireDefined(raw.exposure?.public_obs, "exposure.public_obs"),
+      mailpit_enabled: requireDefined(raw.exposure?.mailpit_enabled, "exposure.mailpit_enabled"),
+      s3_public: requireDefined(raw.exposure?.s3_public, "exposure.s3_public"),
+      s3_console_public: requireDefined(raw.exposure?.s3_console_public, "exposure.s3_console_public")
+    },
+    upgrade: {
+      maintenance_mode_enabled: raw.upgrade?.maintenance_mode_enabled ?? true,
+      db_snapshot_on_api_upgrade: raw.upgrade?.db_snapshot_on_api_upgrade ?? true,
+      keep_failed_upgrade_db_snapshot: raw.upgrade?.keep_failed_upgrade_db_snapshot ?? true
+    }
+  };
+}
+function emptyGeneratedState() {
+  return {
+    openfga: {
+      store_id: "",
+      model_id: ""
+    },
+    deployment: {
+      active_slot: "blue",
+      previous_slot: "",
+      maintenance_mode: false,
+      slots: {
+        blue: emptyApiSlotState(),
+        green: emptyApiSlotState()
+      }
+    },
+    clickstack: {
+      operator_email: "",
+      operator_password: "",
+      access_key: "",
+      browser_api_key: ""
+    },
+    secrets: {
+      s3_secret_key: "",
+      keycloak_db_password: "",
+      keycloak_web_client_secret: "",
+      keycloak_api_client_secret: "",
+      openfga_db_password: "",
+      minikms_root_key: "",
+      minikms_db_password: ""
+    },
+    bootstrap: {
+      completed_at: ""
+    }
+  };
+}
+function normalizeGeneratedState(raw) {
+  const defaults = emptyGeneratedState();
+  return {
+    openfga: {
+      store_id: raw?.openfga?.store_id ?? defaults.openfga.store_id,
+      model_id: raw?.openfga?.model_id ?? defaults.openfga.model_id
+    },
+    deployment: {
+      active_slot: normalizeApiSlot(raw?.deployment?.active_slot ?? defaults.deployment.active_slot),
+      previous_slot: raw?.deployment?.previous_slot === "blue" || raw?.deployment?.previous_slot === "green" ? raw.deployment.previous_slot : defaults.deployment.previous_slot,
+      maintenance_mode: raw?.deployment?.maintenance_mode ?? defaults.deployment.maintenance_mode,
+      slots: {
+        blue: normalizeApiSlotState(raw?.deployment?.slots?.blue),
+        green: normalizeApiSlotState(raw?.deployment?.slots?.green)
+      }
+    },
+    clickstack: {
+      operator_email: raw?.clickstack?.operator_email ?? defaults.clickstack.operator_email,
+      operator_password: raw?.clickstack?.operator_password ?? defaults.clickstack.operator_password,
+      access_key: raw?.clickstack?.access_key ?? defaults.clickstack.access_key,
+      browser_api_key: raw?.clickstack?.browser_api_key ?? defaults.clickstack.browser_api_key
+    },
+    secrets: {
+      s3_secret_key: raw?.secrets?.s3_secret_key ?? defaults.secrets.s3_secret_key,
+      keycloak_db_password: raw?.secrets?.keycloak_db_password ?? defaults.secrets.keycloak_db_password,
+      keycloak_web_client_secret: raw?.secrets?.keycloak_web_client_secret ?? defaults.secrets.keycloak_web_client_secret,
+      keycloak_api_client_secret: raw?.secrets?.keycloak_api_client_secret ?? defaults.secrets.keycloak_api_client_secret,
+      openfga_db_password: raw?.secrets?.openfga_db_password ?? defaults.secrets.openfga_db_password,
+      minikms_root_key: raw?.secrets?.minikms_root_key ?? defaults.secrets.minikms_root_key,
+      minikms_db_password: raw?.secrets?.minikms_db_password ?? defaults.secrets.minikms_db_password
+    },
+    bootstrap: {
+      completed_at: raw?.bootstrap?.completed_at ?? defaults.bootstrap.completed_at
+    }
+  };
+}
+function readInternalState() {
+  if (!exists2(INTERNAL_CONFIG_JSON)) return null;
+  const raw = JSON.parse(fs2.readFileSync(INTERNAL_CONFIG_JSON, "utf8"));
+  return {
+    config: raw.config ? normalizeConfig(raw.config) : void 0,
+    generated: normalizeGeneratedState(raw.generated)
+  };
+}
+function loadConfig() {
+  if (!exists2(DEPLOY_YAML)) {
+    throw new Error(`Missing deploy config at ${DEPLOY_YAML}. Run setup first.`);
+  }
+  const raw = fs2.readFileSync(DEPLOY_YAML, "utf8");
+  if (raw.trimStart().startsWith("{")) {
+    return normalizeConfig(JSON.parse(raw));
+  }
+  return normalizeConfig(parseSimpleYamlObject(raw));
+}
+function loadGeneratedEnv() {
+  if (!exists2(DEPLOY_ENV)) return {};
+  return parseEnvFile(fs2.readFileSync(DEPLOY_ENV, "utf8"));
+}
+function mergeGeneratedState(env, generated) {
+  const normalized = normalizeGeneratedState(generated);
+  return normalizeGeneratedState({
+    openfga: {
+      store_id: env.OPENFGA_STORE_ID ?? normalized.openfga.store_id,
+      model_id: env.OPENFGA_MODEL_ID ?? normalized.openfga.model_id
+    },
+    deployment: normalized.deployment,
+    clickstack: {
+      operator_email: env.CLICKSTACK_OPERATOR_EMAIL ?? normalized.clickstack.operator_email,
+      operator_password: env.CLICKSTACK_OPERATOR_PASSWORD ?? normalized.clickstack.operator_password,
+      access_key: env.CLICKSTACK_ACCESS_KEY ?? normalized.clickstack.access_key,
+      browser_api_key: env.CLICKSTACK_BROWSER_API_KEY ?? normalized.clickstack.browser_api_key
+    },
+    secrets: {
+      s3_secret_key: env.S3_SECRET_KEY ?? normalized.secrets.s3_secret_key,
+      keycloak_db_password: env.KEYCLOAK_DB_PASSWORD ?? normalized.secrets.keycloak_db_password,
+      keycloak_web_client_secret: env.KEYCLOAK_WEB_CLIENT_SECRET ?? normalized.secrets.keycloak_web_client_secret,
+      keycloak_api_client_secret: env.KEYCLOAK_API_CLIENT_SECRET ?? normalized.secrets.keycloak_api_client_secret,
+      openfga_db_password: env.OPENFGA_DB_PASSWORD ?? normalized.secrets.openfga_db_password,
+      minikms_root_key: env.MINIKMS_ROOT_KEY ?? normalized.secrets.minikms_root_key,
+      minikms_db_password: env.MINIKMS_DB_PASSWORD ?? normalized.secrets.minikms_db_password
+    },
+    bootstrap: normalized.bootstrap
+  });
+}
+function loadState() {
+  const config = loadConfig();
+  const internal = readInternalState();
+  const generated = mergeGeneratedState(loadGeneratedEnv(), internal?.generated);
+  return { config, generated };
+}
+function ensureGeneratedRuntimeState(config, generated) {
+  return normalizeGeneratedState({
+    openfga: generated.openfga,
+    deployment: generated.deployment,
+    clickstack: {
+      operator_email: generated.clickstack.operator_email || `operator@${config.domain.root_domain}`,
+      operator_password: generated.clickstack.operator_password || randomStrongPassword(),
+      access_key: generated.clickstack.access_key || `envsync-selfhost-${config.domain.root_domain}-dashboard-access-key`,
+      browser_api_key: generated.clickstack.browser_api_key
+    },
+    secrets: {
+      s3_secret_key: generated.secrets.s3_secret_key || randomSecret(16),
+      keycloak_db_password: generated.secrets.keycloak_db_password || "",
+      keycloak_web_client_secret: generated.secrets.keycloak_web_client_secret || randomSecret(),
+      keycloak_api_client_secret: generated.secrets.keycloak_api_client_secret || randomSecret(),
+      openfga_db_password: generated.secrets.openfga_db_password || randomSecret(),
+      minikms_root_key: generated.secrets.minikms_root_key || randomBytes(32).toString("hex"),
+      minikms_db_password: generated.secrets.minikms_db_password || randomSecret()
+    },
+    bootstrap: generated.bootstrap
+  });
+}
+function resetBootstrapGeneratedState(generated) {
+  return normalizeGeneratedState({
+    openfga: {
+      store_id: "",
+      model_id: ""
+    },
+    deployment: {
+      active_slot: "blue",
+      previous_slot: "",
+      maintenance_mode: false,
+      slots: {
+        blue: emptyApiSlotState(),
+        green: emptyApiSlotState()
+      }
+    },
+    clickstack: generated.clickstack,
+    secrets: generated.secrets,
+    bootstrap: {
+      completed_at: ""
+    }
+  });
+}
+function slotServiceName2(slot) {
+  return `envsync_api_${slot}`;
+}
+function serviceStackName(config, serviceName) {
+  return `${config.services.stack_name}_${serviceName}`;
+}
+function slotStackServiceName(config, slot) {
+  return serviceStackName(config, slotServiceName2(slot));
+}
+function slotHasApiDeployment2(state) {
+  return state.api_image.length > 0;
+}
+function createSteadyApiDeploymentState2(config, generated) {
+  const deployment = normalizeGeneratedState(generated).deployment;
+  const activeSlot = deployment.active_slot;
+  const activeState = deployment.slots[activeSlot];
+  if (slotHasApiDeployment2(activeState)) {
+    return deployment;
+  }
+  return {
+    active_slot: activeSlot,
+    previous_slot: "",
+    maintenance_mode: deployment.maintenance_mode,
+    slots: {
+      ...deployment.slots,
+      [activeSlot]: {
+        api_image: config.images.api,
+        release_version: config.release.version,
+        deployed_at: deployment.slots[activeSlot].deployed_at
+      }
+    }
+  };
+}
+function prepareApiSlotStateForTarget(state, config) {
+  return normalizeApiSlotState({
+    ...state,
+    api_image: config.images.api,
+    release_version: config.release.version
+  });
+}
+function stampApiSlotState(state, config) {
+  return normalizeApiSlotState({
+    ...state,
+    api_image: config.images.api,
+    release_version: config.release.version,
+    deployed_at: (/* @__PURE__ */ new Date()).toISOString()
+  });
+}
+function createPromotionCandidateState(config, generated) {
+  const deployment = createSteadyApiDeploymentState2(config, generated);
+  const activeSlot = deployment.active_slot;
+  const activeState = deployment.slots[activeSlot];
+  if (!slotHasApiDeployment2(activeState) || activeState.api_image === config.images.api) {
+    return null;
+  }
+  const targetSlot = otherApiSlot(activeSlot);
+  return normalizeGeneratedState({
+    ...generated,
+    deployment: {
+      active_slot: activeSlot,
+      previous_slot: deployment.previous_slot,
+      maintenance_mode: deployment.maintenance_mode,
+      slots: {
+        ...deployment.slots,
+        [targetSlot]: prepareApiSlotStateForTarget(deployment.slots[targetSlot], config)
+      }
+    }
+  }).deployment;
+}
+function createPromotedApiDeploymentState(config, generated) {
+  const candidate = createPromotionCandidateState(config, generated);
+  if (!candidate) {
+    return createSteadyApiDeploymentState2(config, generated);
+  }
+  const currentActive = candidate.active_slot;
+  const targetSlot = otherApiSlot(currentActive);
+  return {
+    active_slot: targetSlot,
+    previous_slot: currentActive,
+    maintenance_mode: candidate.maintenance_mode,
+    slots: {
+      ...candidate.slots,
+      [targetSlot]: stampApiSlotState(candidate.slots[targetSlot], config)
+    }
+  };
+}
+function createRolledBackApiDeploymentState(generated) {
+  const deployment = generated.deployment;
+  const rollbackSlot = deployment.previous_slot;
+  if (!rollbackSlot) {
+    throw new Error("No rollback target is available. A previous promoted slot has not been recorded yet.");
+  }
+  if (!slotHasApiDeployment2(deployment.slots[rollbackSlot])) {
+    throw new Error(`Rollback target slot '${rollbackSlot}' has no deployed API image recorded.`);
+  }
+  return {
+    active_slot: rollbackSlot,
+    previous_slot: deployment.active_slot,
+    maintenance_mode: deployment.maintenance_mode,
+    slots: deployment.slots
+  };
+}
+function markActiveApiSlotDeployed(config, deployment) {
+  const activeSlot = deployment.active_slot;
+  if (!slotHasApiDeployment2(deployment.slots[activeSlot])) {
+    return deployment;
+  }
+  return {
+    ...deployment,
+    slots: {
+      ...deployment.slots,
+      [activeSlot]: stampApiSlotState(deployment.slots[activeSlot], config)
+    }
+  };
+}
+function touchApiSlotDeployment(deployment, slot) {
+  if (!slotHasApiDeployment2(deployment.slots[slot])) {
+    return deployment;
+  }
+  return {
+    ...deployment,
+    slots: {
+      ...deployment.slots,
+      [slot]: {
+        ...deployment.slots[slot],
+        deployed_at: (/* @__PURE__ */ new Date()).toISOString()
+      }
+    }
+  };
+}
+function writeDeployArtifacts(config, generated) {
+  const runtimeEnv = buildRuntimeEnv(config, generated);
+  logStep("Rendering deploy artifacts");
+  writeFileMaybe(DEPLOY_ENV, renderEnvFile(runtimeEnv), 384);
+  writeFileMaybe(
+    INTERNAL_CONFIG_JSON,
+    JSON.stringify({ config, generated: mergeGeneratedState(runtimeEnv, generated) }, null, 2) + "\n"
+  );
+  writeFileMaybe(VERSIONS_LOCK, JSON.stringify(config.images, null, 2) + "\n");
+  writeFileMaybe(KEYCLOAK_REALM_FILE, renderKeycloakRealm(config, runtimeEnv));
+  writeFileMaybe(TRAEFIK_DYNAMIC_FILE, renderTraefikDynamicConfig(config, generated));
+  writeFileMaybe(BOOTSTRAP_BASE_STACK_FILE, renderStack(config, runtimeEnv, generated, "base", DEPLOY_RENDER_PATHS));
+  writeFileMaybe(BOOTSTRAP_STACK_FILE, renderStack(config, runtimeEnv, generated, "bootstrap", DEPLOY_RENDER_PATHS));
+  writeFileMaybe(STACK_FILE, renderStack(config, runtimeEnv, generated, "full", DEPLOY_RENDER_PATHS));
+  writeFileMaybe(NGINX_WEB_CONF, renderNginxConf("web"));
+  if (!isOssConfig2(config)) {
+    writeFileMaybe(NGINX_LANDING_CONF, renderNginxConf("landing"));
+  }
+  writeFileMaybe(NGINX_API_MAINTENANCE_CONF, renderApiMaintenanceConf());
+  writeFileMaybe(OTEL_AGENT_CONF, renderOtelAgentConfig(config));
+  writeFileMaybe(CLICKSTACK_CLICKHOUSE_CONF, renderClickstackClickHouseConfig());
+  logSuccess(currentOptions.dryRun ? "Deploy artifacts previewed" : "Deploy artifacts written");
+}
+function saveDesiredConfig(config) {
+  const internal = readInternalState();
+  const generated = mergeGeneratedState(loadGeneratedEnv(), internal?.generated);
+  logStep(`Saving desired config to ${DEPLOY_YAML}`);
+  writeFileMaybe(DEPLOY_YAML, toYaml(config) + "\n");
+  writeFileMaybe(
+    INTERNAL_CONFIG_JSON,
+    JSON.stringify({ config, generated }, null, 2) + "\n"
+  );
+  logSuccess(currentOptions.dryRun ? "Desired config previewed" : "Desired config saved");
+}
+function ensureRepoCheckout(config) {
+  logStep(`Ensuring pinned repo checkout at ${config.source.ref}`);
+  if (currentOptions.dryRun) {
+    logDryRun(`Would ensure repo checkout at ${REPO_ROOT}`);
+    return;
+  }
+  if (hasExplicitRepoOverride()) {
+    if (!exists2(path2.join(REPO_ROOT, ".git"))) {
+      throw new Error(`ENVSYNC_REPO_ROOT is set but no git repo was found at ${REPO_ROOT}`);
+    }
+    logInfo(`Using local repo override at ${REPO_ROOT}`);
+    logSuccess("Local repo override is ready");
+    return;
+  }
+  ensureDir(REPO_ROOT);
+  if (!exists2(path2.join(REPO_ROOT, ".git"))) {
+    logCommand("git", ["clone", config.source.repo_url, REPO_ROOT]);
+    run("git", ["clone", config.source.repo_url, REPO_ROOT]);
+  }
+  logCommand("git", ["remote", "set-url", "origin", config.source.repo_url]);
+  run("git", ["remote", "set-url", "origin", config.source.repo_url], { cwd: REPO_ROOT });
+  logCommand("git", ["fetch", "--tags", "--force", "origin"]);
+  run("git", ["fetch", "--tags", "--force", "origin"], { cwd: REPO_ROOT });
+  logCommand("git", ["checkout", "--force", config.source.ref]);
+  run("git", ["checkout", "--force", config.source.ref], { cwd: REPO_ROOT });
+  logSuccess(`Pinned repo checkout ready at ${config.source.ref}`);
+}
+function extractStaticBundle(kind, image, targetDir) {
+  logStep(`Extracting ${kind} static bundle from ${image}`);
+  if (currentOptions.dryRun) {
+    logDryRun(`Would extract ${kind} bundle from ${image} into ${targetDir}`);
+    return;
+  }
+  fs2.rmSync(targetDir, { recursive: true, force: true });
+  ensureDir(targetDir);
+  const containerId = run("docker", ["create", image], { quiet: true }).trim();
+  try {
+    run("docker", ["cp", `${containerId}:/app/dist/.`, targetDir]);
+  } finally {
+    run("docker", ["rm", "-f", containerId], { quiet: true });
+  }
+  normalizeExtractedStaticBundle(kind, targetDir);
+  validateStaticBundle(kind, targetDir);
+  logSuccess(`${kind} static bundle extracted to ${targetDir}`);
+}
+function releaseAssetDir(kind, version) {
+  return path2.join(RELEASES_ROOT, kind, version);
+}
+function currentReleaseDir(kind) {
+  return path2.join(RELEASES_ROOT, kind, "current");
+}
+function stageFrontendRelease(kind, image, version) {
+  const targetDir = releaseAssetDir(kind, version);
+  extractStaticBundle(kind, image, targetDir);
+}
+function writeFrontendRuntimeConfig(targetDir, runtimeConfig) {
+  writeFile(path2.join(targetDir, "runtime-config.js"), runtimeConfig);
+}
+function syncFrontendReleaseContents(sourceDir, targetDir) {
+  ensureDir(targetDir);
+  const deferredEntries = /* @__PURE__ */ new Set(["index.html", "runtime-config.js"]);
+  const entries = fs2.readdirSync(sourceDir, { withFileTypes: true });
+  for (const entry of entries) {
+    if (deferredEntries.has(entry.name)) {
+      continue;
+    }
+    fs2.cpSync(path2.join(sourceDir, entry.name), path2.join(targetDir, entry.name), {
+      recursive: true,
+      force: true
+    });
+  }
+  const stagedRuntimeConfig = path2.join(sourceDir, "runtime-config.js");
+  if (exists2(stagedRuntimeConfig)) {
+    fs2.cpSync(stagedRuntimeConfig, path2.join(targetDir, "runtime-config.js"), { force: true });
+  }
+  const stagedIndex = path2.join(sourceDir, "index.html");
+  if (exists2(stagedIndex)) {
+    fs2.cpSync(stagedIndex, path2.join(targetDir, "index.html"), { force: true });
+  }
+}
+function activateFrontendRelease(kind, version, runtimeConfig) {
+  const stagedDir = releaseAssetDir(kind, version);
+  const currentDir = currentReleaseDir(kind);
+  if (currentOptions.dryRun) {
+    logDryRun(`Would activate ${kind} release ${version} into ${currentDir}`);
+    logDryRun(`Would write ${kind} runtime-config.js for release ${version}`);
+    return;
+  }
+  if (!exists2(stagedDir)) {
+    throw new Error(`Missing staged ${kind} release at ${stagedDir}`);
+  }
+  validateStaticBundle(kind, stagedDir);
+  writeFrontendRuntimeConfig(stagedDir, runtimeConfig);
+  ensureDir(currentDir);
+  syncFrontendReleaseContents(stagedDir, currentDir);
+  validateStaticBundle(kind, currentDir);
+}
+function createApiDbUpgradeBackup(config, fromVersion, toVersion) {
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:]/g, "-");
+  const fileName = `envsync-db-preupgrade-${fromVersion || "unknown"}-to-${toVersion}-${timestamp}.dump`;
+  const hostPath = path2.join(UPGRADE_BACKUPS_ROOT, fileName);
+  logStep(`Creating API DB upgrade snapshot ${fileName}`);
+  if (currentOptions.dryRun) {
+    logDryRun(`Would create upgrade DB snapshot at ${hostPath}`);
+    return hostPath;
+  }
+  ensureDir(UPGRADE_BACKUPS_ROOT);
+  run("docker", [
+    "run",
+    "--rm",
+    "--network",
+    stackNetworkName(config),
+    "-e",
+    "PGPASSWORD=envsync-postgres",
+    "-v",
+    `${UPGRADE_BACKUPS_ROOT}:/backup`,
+    "postgres:17",
+    "sh",
+    "-lc",
+    `pg_dump -h postgres -U postgres -d envsync -Fc -f /backup/${fileName}`
+  ]);
+  logSuccess(`API DB upgrade snapshot created at ${hostPath}`);
+  return hostPath;
+}
+function restoreApiDbUpgradeBackup(config, backupPath) {
+  const fileName = path2.basename(backupPath);
+  logWarn(`Restoring API DB upgrade snapshot ${fileName}`);
+  if (currentOptions.dryRun) {
+    logDryRun(`Would restore upgrade DB snapshot from ${backupPath}`);
+    return;
+  }
+  run("docker", [
+    "run",
+    "--rm",
+    "--network",
+    stackNetworkName(config),
+    "-e",
+    "PGPASSWORD=envsync-postgres",
+    "-v",
+    `${UPGRADE_BACKUPS_ROOT}:/backup:ro`,
+    "postgres:17",
+    "sh",
+    "-lc",
+    `pg_restore --clean --if-exists --no-owner --no-privileges -h postgres -U postgres -d envsync /backup/${fileName}`
+  ]);
+  logSuccess(`API DB upgrade snapshot restored from ${backupPath}`);
+}
+function activateFrontendReleaseForState(config, state, fallbackVersion = config.release.version) {
+  const version = state.deployment.slots[state.deployment.active_slot].release_version || fallbackVersion;
+  activateFrontendRelease("web", version, renderFrontendRuntimeConfig(config, state));
+  if (!isOssConfig2(config)) {
+    activateFrontendRelease("landing", version, renderFrontendRuntimeConfig(config, state));
+  }
+}
+function buildKeycloakImage(imageTag, repoRoot = REPO_ROOT) {
+  const buildContext = path2.join(repoRoot, "packages/envsync-keycloak-theme");
+  if (!exists2(path2.join(buildContext, "Dockerfile"))) {
+    throw new Error(`Missing Keycloak Docker build context at ${buildContext}`);
+  }
+  logStep(`Building Keycloak image ${imageTag}`);
+  if (currentOptions.dryRun) {
+    logDryRun(`Would build ${imageTag} from ${buildContext}`);
+    return;
+  }
+  logCommand("docker", ["build", "-t", imageTag, buildContext]);
+  run("docker", ["build", "-t", imageTag, buildContext]);
+  logSuccess(`Built Keycloak image ${imageTag}`);
+}
+function stackNetworkName(config) {
+  return `${config.services.stack_name}_envsync`;
+}
+function assertSwarmManager() {
+  if (currentOptions.dryRun) {
+    logDryRun("Skipping Docker Swarm manager validation");
+    return;
+  }
+  logStep("Validating Docker Swarm manager state");
+  const state = tryRun("docker", ["info", "--format", "{{.Swarm.LocalNodeState}}|{{.Swarm.ControlAvailable}}"], { quiet: true }).trim();
+  if (state !== "active|true") {
+    throw new Error("Docker Swarm is not initialized on this node. Run 'docker swarm init' or 'envsync-deploy preinstall' first.");
+  }
+  logSuccess("Docker Swarm manager is ready");
+}
+function waitForCommand(config, label, image, command, timeoutSeconds = 120, env = {}, volumes = []) {
+  if (currentOptions.dryRun) {
+    logDryRun(`Would wait for ${label}`);
+    return;
+  }
+  logStep(`Waiting for ${label}`);
+  const deadline = Date.now() + timeoutSeconds * 1e3;
+  while (Date.now() < deadline) {
+    const args = ["run", "--rm", "--network", stackNetworkName(config)];
+    for (const volume of volumes) {
+      args.push("-v", volume);
+    }
+    for (const [key, value] of Object.entries(env)) {
+      args.push("-e", `${key}=${value}`);
+    }
+    args.push(image, "sh", "-lc", command);
+    if (commandSucceeds("docker", args)) {
+      logSuccess(`${label} is ready`);
+      return;
+    }
+    sleepSeconds(2);
+  }
+  throw new Error(`Timed out waiting for ${label}`);
+}
+function waitForPostgresService(config, label, host, user, password) {
+  waitForCommand(config, `${label} database readiness`, "postgres:17", `pg_isready -h ${host} -U ${user}`, 120, {
+    PGPASSWORD: password
+  });
+}
+function waitForRedisService(config) {
+  waitForCommand(config, "redis readiness", "redis:7", "redis-cli -h redis ping | grep PONG");
+}
+function waitForTcpService(config, label, host, port, timeoutSeconds = 120) {
+  const deadline = Date.now() + timeoutSeconds * 1e3;
+  while (Date.now() < deadline) {
+    if (commandSucceeds(
+      "docker",
+      ["run", "--rm", "--network", stackNetworkName(config), "alpine:3.20", "sh", "-lc", `nc -z -w 2 ${host} ${port}`]
+    )) {
+      return;
+    }
+    sleepSeconds(2);
+  }
+  throw new Error(`Timed out waiting for ${label} at ${host}:${port}`);
+}
+function waitForHttpService(config, label, url, timeoutSeconds = 120) {
+  if (currentOptions.dryRun) {
+    logDryRun(`Would wait for ${label} at ${url}`);
+    return;
+  }
+  logStep(`Waiting for ${label} on ${url}`);
+  const deadline = Date.now() + timeoutSeconds * 1e3;
+  while (Date.now() < deadline) {
+    if (commandSucceeds("docker", [
+      "run",
+      "--rm",
+      "--network",
+      stackNetworkName(config),
+      "alpine:3.20",
+      "sh",
+      "-lc",
+      `wget -q -O /dev/null ${JSON.stringify(url)}`
+    ])) {
+      logSuccess(`${label} is ready`);
+      return;
+    }
+    sleepSeconds(2);
+  }
+  throw new Error(`Timed out waiting for ${label} at ${url}`);
+}
+function runOpenFgaMigrate(config, runtimeEnv) {
+  logStep("Running OpenFGA datastore migrations");
+  if (currentOptions.dryRun) {
+    logDryRun("Would run OpenFGA datastore migrations");
+    logCommand("docker", [
+      "run",
+      "--rm",
+      "--network",
+      stackNetworkName(config),
+      "-e",
+      "OPENFGA_DATASTORE_ENGINE=postgres",
+      "-e",
+      `OPENFGA_DATASTORE_URI=postgres://openfga:${runtimeEnv.OPENFGA_DB_PASSWORD}@openfga_db:5432/openfga?sslmode=disable`,
+      "openfga/openfga:v1.12.0",
+      "migrate"
+    ]);
+    return;
+  }
+  run("docker", [
+    "run",
+    "--rm",
+    "--network",
+    stackNetworkName(config),
+    "-e",
+    "OPENFGA_DATASTORE_ENGINE=postgres",
+    "-e",
+    `OPENFGA_DATASTORE_URI=postgres://openfga:${runtimeEnv.OPENFGA_DB_PASSWORD}@openfga_db:5432/openfga?sslmode=disable`,
+    "openfga/openfga:v1.12.0",
+    "migrate"
+  ]);
+  logSuccess("OpenFGA datastore migrations completed");
+}
+function runMiniKmsMigrate(config, runtimeEnv) {
+  logStep("Running miniKMS datastore migrations");
+  if (currentOptions.dryRun) {
+    logDryRun("Would run miniKMS datastore migrations");
+    logCommand("docker", [
+      "run",
+      "--rm",
+      "--network",
+      stackNetworkName(config),
+      "-e",
+      `PGPASSWORD=${runtimeEnv.MINIKMS_DB_PASSWORD}`,
+      "-v",
+      `${path2.join(REPO_ROOT, "docker/minikms/migrations")}:/migrations:ro`,
+      "postgres:17",
+      "sh",
+      "-lc",
+      "psql -h minikms_db -U postgres -d minikms -f /migrations/001_initial_schema.sql && psql -h minikms_db -U postgres -d minikms -f /migrations/002_vault_storage.sql"
+    ]);
+    return;
+  }
+  run("docker", [
+    "run",
+    "--rm",
+    "--network",
+    stackNetworkName(config),
+    "-e",
+    `PGPASSWORD=${runtimeEnv.MINIKMS_DB_PASSWORD}`,
+    "-v",
+    `${path2.join(REPO_ROOT, "docker/minikms/migrations")}:/migrations:ro`,
+    "postgres:17",
+    "sh",
+    "-lc",
+    "psql -h minikms_db -U postgres -d minikms -f /migrations/001_initial_schema.sql && psql -h minikms_db -U postgres -d minikms -f /migrations/002_vault_storage.sql"
+  ]);
+  logSuccess("miniKMS datastore migrations completed");
+}
+function runBootstrapInit(config) {
+  logStep("Running API bootstrap init");
+  if (currentOptions.dryRun) {
+    logDryRun("Would run API bootstrap init and persist generated OpenFGA IDs");
+    logCommand("docker", [
+      "run",
+      "--rm",
+      "--network",
+      stackNetworkName(config),
+      "--env-file",
+      DEPLOY_ENV,
+      "-e",
+      "SKIP_ROOT_ENV=1",
+      "-e",
+      "SKIP_ROOT_ENV_WRITE=1",
+      config.images.api,
+      "bun",
+      "run",
+      "scripts/prod-init.ts",
+      "--json",
+      "--skip-migrations",
+      "--no-write-root-env"
+    ]);
+    return {
+      openfgaStoreId: "",
+      openfgaModelId: ""
+    };
+  }
+  const output = run(
+    "docker",
+    [
+      "run",
+      "--rm",
+      "--network",
+      stackNetworkName(config),
+      "--env-file",
+      DEPLOY_ENV,
+      "-e",
+      "SKIP_ROOT_ENV=1",
+      "-e",
+      "SKIP_ROOT_ENV_WRITE=1",
+      config.images.api,
+      "bun",
+      "run",
+      "scripts/prod-init.ts",
+      "--json",
+      "--skip-migrations",
+      "--no-write-root-env"
+    ],
+    { quiet: true }
+  ).trim();
+  const result = parseBootstrapInitJson(output);
+  if (!result.openfgaStoreId || !result.openfgaModelId) {
+    throw new Error("Bootstrap init did not return OpenFGA IDs");
+  }
+  logSuccess("API bootstrap init completed");
+  return {
+    openfgaStoreId: result.openfgaStoreId,
+    openfgaModelId: result.openfgaModelId
+  };
+}
+function parseClickstackBootstrapJson(output) {
+  const trimmed = output.trim();
+  if (!trimmed) {
+    throw new Error("ClickStack bootstrap returned no JSON output");
+  }
+  const lines = trimmed.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+  for (let index = lines.length - 1; index >= 0; index -= 1) {
+    const candidate = lines[index];
+    if (!candidate.startsWith("{") || !candidate.endsWith("}")) continue;
+    try {
+      return JSON.parse(candidate);
+    } catch {
+      continue;
+    }
+  }
+  throw new Error(`ClickStack bootstrap returned non-JSON output.
+Captured stdout:
+${trimmed}`);
+}
+function runClickstackBootstrap(config) {
+  logStep("Running ClickStack self-host bootstrap");
+  const { generated } = loadState();
+  if (currentOptions.dryRun) {
+    logDryRun("Would bootstrap ClickStack sources and dashboards");
+    logCommand("node", [path2.join(REPO_ROOT, "scripts/bootstrap-clickstack-selfhost.mjs")]);
+    return {
+      browserApiKey: generated.clickstack.browser_api_key
+    };
+  }
+  const deadline = Date.now() + 180 * 1e3;
+  let lastError = "unknown error";
+  while (Date.now() < deadline) {
+    try {
+      const output = run("node", [path2.join(REPO_ROOT, "scripts/bootstrap-clickstack-selfhost.mjs")], {
+        env: {
+          ENVSYNC_STACK_NAME: config.services.stack_name,
+          ENVSYNC_ROOT_DOMAIN: config.domain.root_domain,
+          ENVSYNC_CLICKSTACK_OPERATOR_EMAIL: generated.clickstack.operator_email,
+          ENVSYNC_CLICKSTACK_OPERATOR_PASSWORD: generated.clickstack.operator_password,
+          ENVSYNC_CLICKSTACK_ACCESS_KEY: generated.clickstack.access_key,
+          ENVSYNC_CLICKSTACK_BROWSER_API_KEY: generated.clickstack.browser_api_key,
+          ENVSYNC_CLICKSTACK_ALERT_WEBHOOK_URL: config.observability.alert_webhook_url ?? "",
+          ENVSYNC_CLICKSTACK_ALERT_WEBHOOK_HEADERS: JSON.stringify(config.observability.alert_webhook_headers ?? {})
+        },
+        quiet: true
+      });
+      const result = parseClickstackBootstrapJson(output);
+      logSuccess("ClickStack self-host bootstrap completed");
+      return result;
+    } catch (error) {
+      lastError = error instanceof Error ? error.message : String(error);
+      sleepSeconds(3);
+    }
+  }
+  throw new Error(`Timed out bootstrapping ClickStack: ${lastError}`);
+}
+function logClickstackCredentials(generated) {
+  logInfo(`ClickStack operator email: ${generated.clickstack.operator_email}`);
+  logInfo(`ClickStack operator password: ${generated.clickstack.operator_password}`);
+  logInfo(`ClickStack access key: ${generated.clickstack.access_key}`);
+  if (generated.clickstack.browser_api_key) {
+    logInfo(`ClickStack browser API key: ${generated.clickstack.browser_api_key}`);
+  }
+}
+function parseBootstrapInitJson(output) {
+  const trimmed = output.trim();
+  if (!trimmed) {
+    throw new Error("Bootstrap init returned no JSON output");
+  }
+  try {
+    return JSON.parse(trimmed);
+  } catch {
+    const lines = trimmed.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+    for (let index = lines.length - 1; index >= 0; index -= 1) {
+      const candidate = lines[index];
+      if (!candidate.startsWith("{") || !candidate.endsWith("}")) continue;
+      try {
+        return JSON.parse(candidate);
+      } catch {
+        continue;
+      }
+    }
+    throw new Error(
+      `Bootstrap init returned non-JSON output.
+Captured stdout:
+${trimmed}`
+    );
+  }
+}
+function readRenderedRuntimeConfig(filePath) {
+  if (!exists2(filePath)) return null;
+  const raw = fs2.readFileSync(filePath, "utf8").trim();
+  const prefix = "window.__ENVSYNC_RUNTIME_CONFIG__ = ";
+  if (!raw.startsWith(prefix) || !raw.endsWith(";")) return null;
+  try {
+    return JSON.parse(raw.slice(prefix.length, -1));
+  } catch {
+    return null;
+  }
+}
+function activeApiImage(config, generated) {
+  const slot = generated.deployment.active_slot;
+  return generated.deployment.slots[slot].api_image || config.images.api;
+}
+function parseMigrationCommandJson(output) {
+  const trimmed = output.trim();
+  if (!trimmed) {
+    throw new Error("Migration command returned no JSON output");
+  }
+  const lines = trimmed.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+  for (let index = lines.length - 1; index >= 0; index -= 1) {
+    const candidate = lines[index];
+    if (!candidate.startsWith("{") || !candidate.endsWith("}")) continue;
+    try {
+      return JSON.parse(candidate);
+    } catch {
+      continue;
+    }
+  }
+  throw new Error(`Migration command returned non-JSON output.
+Captured stdout:
+${trimmed}`);
+}
+function runApiMigrationJsonCommand(config, image, args) {
+  if (currentOptions.dryRun) {
+    logDryRun(`Would run API migration command in ${image}: ${args.join(" ")}`);
+    return {
+      ok: true,
+      currentHead: null,
+      executedMigrations: []
+    };
+  }
+  const output = run(
+    "docker",
+    [
+      "run",
+      "--rm",
+      "--network",
+      stackNetworkName(config),
+      "--env-file",
+      DEPLOY_ENV,
+      "-e",
+      "SKIP_ROOT_ENV=1",
+      image,
+      "bun",
+      "run",
+      "scripts/migrate.ts",
+      ...args,
+      "--json"
+    ],
+    { quiet: true }
+  );
+  return parseMigrationCommandJson(output);
+}
+function getApiMigrationHealth(config, generated) {
+  try {
+    const response = runApiMigrationJsonCommand(config, activeApiImage(config, generated), ["head"]);
+    return {
+      migration_head: response.currentHead,
+      auto_migrate_enabled: false
+    };
+  } catch (error) {
+    return {
+      migration_head: null,
+      auto_migrate_enabled: false,
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+function resolveClickstackContainerId(config) {
+  const output = tryRun(
+    "docker",
+    [
+      "ps",
+      "--filter",
+      `label=com.docker.swarm.service.name=${config.services.stack_name}_clickstack`,
+      "--format",
+      "{{.ID}}"
+    ],
+    { quiet: true }
+  ).trim();
+  return output.split(/\r?\n/).map((line) => line.trim()).find(Boolean) ?? "";
+}
+function runClickstackMongoJson(config, script) {
+  const containerId = resolveClickstackContainerId(config);
+  if (!containerId) return null;
+  try {
+    const payload = Buffer.from(script, "utf8").toString("base64");
+    const output = run(
+      "docker",
+      [
+        "exec",
+        "-e",
+        `HDX_SCRIPT=${payload}`,
+        containerId,
+        "sh",
+        "-lc",
+        `printf '%s' "$HDX_SCRIPT" | base64 -d >/tmp/envsync-clickstack-health.js && mongo hyperdx --quiet /tmp/envsync-clickstack-health.js`
+      ],
+      { quiet: true }
+    ).trim();
+    const parsed = output.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).at(-1);
+    if (!parsed) return null;
+    return JSON.parse(parsed);
+  } catch {
+    return null;
+  }
+}
+function getClickstackSearchState(config) {
+  return runClickstackMongoJson(config, `
+var team = db.teams.findOne({ name: ${JSON.stringify(CLICKSTACK_SELFHOST_TEAM_NAME)} });
+if (!team) {
+  print(JSON.stringify({ sourceNames: [], savedSearches: [], dashboardTags: [] }));
+  quit();
+}
+
+var sourceNames = db.sources.find({ team: team._id }, { name: 1 }).toArray().map(function(source) {
+  return source.name;
+}).filter(Boolean);
+
+var savedSearches = db.savedsearches.find({ team: team._id }, { name: 1, tags: 1 }).toArray().map(function(search) {
+  return {
+    name: search.name,
+    tags: Array.isArray(search.tags) ? search.tags : []
+  };
+}).filter(function(search) {
+  return Boolean(search.name);
+});
+
+var dashboardTags = [];
+db.dashboards.find({ team: team._id }, { tags: 1 }).toArray().forEach(function(dashboard) {
+  if (Array.isArray(dashboard.tags)) {
+    dashboard.tags.forEach(function(tag) {
+      dashboardTags.push(tag);
+    });
+  }
+});
+
+print(JSON.stringify({
+  sourceNames: sourceNames,
+  savedSearches: savedSearches,
+  dashboardTags: dashboardTags
+}));
+`);
+}
+function hasCompleteBootstrapState(generated) {
+  return REQUIRED_BOOTSTRAP_ENV_KEYS.every((key) => {
+    switch (key) {
+      case "S3_SECRET_KEY":
+        return generated.secrets.s3_secret_key.length > 0;
+      case "KEYCLOAK_WEB_CLIENT_SECRET":
+        return generated.secrets.keycloak_web_client_secret.length > 0;
+      case "KEYCLOAK_API_CLIENT_SECRET":
+        return generated.secrets.keycloak_api_client_secret.length > 0;
+      case "OPENFGA_DB_PASSWORD":
+        return generated.secrets.openfga_db_password.length > 0;
+      case "MINIKMS_ROOT_KEY":
+        return generated.secrets.minikms_root_key.length > 0;
+      case "MINIKMS_DB_PASSWORD":
+        return generated.secrets.minikms_db_password.length > 0;
+      case "OPENFGA_STORE_ID":
+        return generated.openfga.store_id.length > 0;
+      case "OPENFGA_MODEL_ID":
+        return generated.openfga.model_id.length > 0;
+      default:
+        return false;
+    }
+  });
+}
+function assertBootstrapState(generated) {
+  if (!hasCompleteBootstrapState(generated)) {
+    throw new Error("Missing bootstrap state. Run 'envsync-deploy bootstrap' first.");
+  }
+}
+function parseReplicaHealth(raw) {
+  const match = raw.match(/^(\d+)\/(\d+)$/);
+  if (!match) return raw.trim() ? "degraded" : "missing";
+  const current = Number(match[1]);
+  const desired = Number(match[2]);
+  if (desired === 0) return "missing";
+  if (current === desired) return "healthy";
+  return "degraded";
+}
+function listStackServices(config) {
+  const output = tryRun(
+    "docker",
+    ["stack", "services", config.services.stack_name, "--format", "{{.Name}}|{{.Replicas}}"],
+    { quiet: true }
+  );
+  const services = /* @__PURE__ */ new Map();
+  for (const line of output.split(/\r?\n/)) {
+    if (!line.trim()) continue;
+    const [name, replicas] = line.split("|");
+    services.set(name, parseReplicaHealth(replicas ?? ""));
+  }
+  return services;
+}
+function listManagedContainers(config) {
+  const output = tryRun("docker", ["ps", "-aq", "--filter", `name=^/${config.services.stack_name}_`], { quiet: true });
+  return output.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+}
+function stackExists(config) {
+  const output = tryRun("docker", ["stack", "ls", "--format", "{{.Name}}"], { quiet: true });
+  return output.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).includes(config.services.stack_name);
+}
+function waitForStackRemoval(config, timeoutSeconds = 60) {
+  if (currentOptions.dryRun) {
+    logDryRun(`Would wait for stack ${config.services.stack_name} to be removed`);
+    return;
+  }
+  const deadline = Date.now() + timeoutSeconds * 1e3;
+  while (Date.now() < deadline) {
+    if (!stackExists(config)) {
+      return;
+    }
+    sleepSeconds(2);
+  }
+  throw new Error(`Timed out waiting for stack ${config.services.stack_name} to be removed`);
+}
+async function confirmBootstrapReset(config) {
+  const volumeNames = STACK_VOLUMES.map((volume) => stackVolumeName(config, volume));
+  const containerIds = listManagedContainers(config);
+  const networkName = stackNetworkName(config);
+  logWarn("Bootstrap will delete existing EnvSync Docker resources before rebuilding infra.");
+  logWarn(`Stack: ${config.services.stack_name}`);
+  logWarn(`Network: ${networkName}`);
+  logWarn(`Volumes: ${volumeNames.join(", ")}`);
+  if (containerIds.length > 0) {
+    logWarn(`Containers: ${containerIds.join(", ")}`);
+  } else {
+    logWarn("Containers: none currently matched");
+  }
+  logWarn("This removes existing deployment data for the managed EnvSync services.");
+  if (currentOptions.force) {
+    logWarn("Skipping confirmation because --force was provided.");
+    logSuccess("Destructive bootstrap reset confirmed");
+    return;
+  }
+  const response = await askRequired(chalk.bold.red('Type "yes" to continue:'));
+  if (response !== "yes") {
+    throw new Error("Bootstrap aborted. Confirmation did not match 'yes'.");
+  }
+  logSuccess("Destructive bootstrap reset confirmed");
+}
+function cleanupBootstrapState(config) {
+  const volumeNames = STACK_VOLUMES.map((volume) => stackVolumeName(config, volume));
+  const containerIds = listManagedContainers(config);
+  const networkName = stackNetworkName(config);
+  logStep("Removing existing EnvSync deployment resources");
+  if (currentOptions.dryRun) {
+    if (stackExists(config)) {
+      logDryRun(`Would remove stack ${config.services.stack_name}`);
+      logCommand("docker", ["stack", "rm", config.services.stack_name]);
+    } else {
+      logDryRun(`No existing stack named ${config.services.stack_name} found`);
+    }
+    if (containerIds.length > 0) {
+      logDryRun(`Would remove containers: ${containerIds.join(", ")}`);
+      logCommand("docker", ["rm", "-f", ...containerIds]);
+    }
+    logDryRun(`Would remove network ${networkName} if present`);
+    logCommand("docker", ["network", "rm", networkName]);
+    for (const volumeName of volumeNames) {
+      logDryRun(`Would remove volume ${volumeName}`);
+      logCommand("docker", ["volume", "rm", "-f", volumeName]);
+    }
+    logSuccess("Bootstrap cleanup preview completed");
+    return;
+  }
+  if (stackExists(config)) {
+    logCommand("docker", ["stack", "rm", config.services.stack_name]);
+    run("docker", ["stack", "rm", config.services.stack_name]);
+    waitForStackRemoval(config);
+  }
+  const refreshedContainers = listManagedContainers(config);
+  if (refreshedContainers.length > 0) {
+    logCommand("docker", ["rm", "-f", ...refreshedContainers]);
+    const removed = runIgnoringAbsent("docker", ["rm", "-f", ...refreshedContainers], {
+      absentPatterns: ["no such container", "not found"]
+    });
+    if (!removed) {
+      logInfo("Managed containers were already absent");
+    }
+  }
+  if (commandSucceeds("docker", ["network", "inspect", networkName])) {
+    logCommand("docker", ["network", "rm", networkName]);
+    const removed = runIgnoringAbsent("docker", ["network", "rm", networkName], {
+      absentPatterns: ["network", "not found", "no such network"]
+    });
+    if (!removed) {
+      logInfo(`Network ${networkName} was already absent`);
+    }
+  }
+  for (const volumeName of volumeNames) {
+    if (commandSucceeds("docker", ["volume", "inspect", volumeName])) {
+      logCommand("docker", ["volume", "rm", "-f", volumeName]);
+      const removed = runIgnoringAbsent("docker", ["volume", "rm", "-f", volumeName], {
+        absentPatterns: ["no such volume", "not found"]
+      });
+      if (!removed) {
+        logInfo(`Volume ${volumeName} was already absent`);
+      }
+    }
+  }
+  logSuccess("Existing EnvSync deployment resources removed");
+}
+function serviceHealth(services, name) {
+  return services.get(`${name}`) ?? "missing";
+}
+function apiHealth(services, stackName) {
+  const blue = serviceHealth(services, `${stackName}_envsync_api_blue`);
+  const green = serviceHealth(services, `${stackName}_envsync_api_green`);
+  if (blue === "missing" && green === "missing") return "missing";
+  if (blue === "healthy" || green === "healthy") return "healthy";
+  return "degraded";
+}
+function waitForApiSlotHealthy(config, slot, timeoutSeconds = 180) {
+  if (currentOptions.dryRun) {
+    logDryRun(`Would wait for API ${slot} slot readiness`);
+    return;
+  }
+  const deadline = Date.now() + timeoutSeconds * 1e3;
+  const serviceName = slotStackServiceName(config, slot);
+  while (Date.now() < deadline) {
+    const services2 = listStackServices(config);
+    if (serviceHealth(services2, serviceName) === "healthy") {
+      logSuccess(`API ${slot} slot is healthy`);
+      return;
+    }
+    sleepSeconds(3);
+  }
+  const services = listStackServices(config);
+  throw new Error(`Timed out waiting for API ${slot} slot to become healthy: ${serviceHealth(services, serviceName)}`);
+}
+function waitForHealthyServices(config, checks, timeoutSeconds = 180) {
+  if (currentOptions.dryRun) {
+    logDryRun(`Would wait for ${checks.map((check) => check.label).join(", ")} service readiness`);
+    return;
+  }
+  const deadline = Date.now() + timeoutSeconds * 1e3;
+  while (Date.now() < deadline) {
+    const services2 = listStackServices(config);
+    const pending2 = checks.filter((check) => check.getHealth(services2) !== "healthy");
+    if (pending2.length === 0) {
+      return;
+    }
+    sleepSeconds(3);
+  }
+  const services = listStackServices(config);
+  const pending = checks.map((check) => `${check.label}=${check.getHealth(services)}`).join(", ");
+  throw new Error(`Timed out waiting for deployed services to become healthy: ${pending}`);
+}
+function deployRenderedStack(config, label) {
+  if (currentOptions.dryRun) {
+    logDryRun(`Would deploy ${label} stack for ${config.services.stack_name}`);
+    logCommand("docker", ["stack", "deploy", "-c", STACK_FILE, config.services.stack_name]);
+    return;
+  }
+  logStep(`Deploying ${label} stack`);
+  logCommand("docker", ["stack", "deploy", "-c", STACK_FILE, config.services.stack_name]);
+  for (let attempt = 1; attempt <= 5; attempt += 1) {
+    const result = spawnSync("docker", ["stack", "deploy", "-c", STACK_FILE, config.services.stack_name], {
+      env: process.env,
+      stdio: "pipe",
+      encoding: "utf8"
+    });
+    const stdout = typeof result.stdout === "string" ? result.stdout.trim() : "";
+    const stderr = typeof result.stderr === "string" ? result.stderr.trim() : "";
+    if (stdout) console.log(stdout);
+    if (stderr) console.error(stderr);
+    if (result.status === 0) {
+      logSuccess(`${label} stack deployed`);
+      return;
+    }
+    const combined = `${stdout}
+${stderr}`.toLowerCase();
+    if (attempt < 5 && combined.includes("update out of sequence")) {
+      logWarn(`Swarm reported an out-of-sequence service update while deploying ${label}; retrying (${attempt}/5)`);
+      sleepSeconds(3);
+      continue;
+    }
+    throw new Error(`Command failed: docker stack deploy -c ${STACK_FILE} ${config.services.stack_name}${stderr ? `
+${stderr}` : ""}`);
+  }
+}
+function persistGeneratedState(config, generated) {
+  if (currentOptions.dryRun) {
+    logDryRun("Would persist generated deployment state");
+    return;
+  }
+  writeDeployArtifacts(config, generated);
+}
+function formatHealthStatus(status) {
+  if (status === true || status === "healthy") {
+    return `${chalk.green("\u25CF")} ${chalk.green(typeof status === "boolean" ? "yes" : status)}`;
+  }
+  if (status === false || status === "missing") {
+    return `${chalk.red("\u25CF")} ${chalk.red(typeof status === "boolean" ? "no" : status)}`;
+  }
+  return `${chalk.yellow("\u25CF")} ${chalk.yellow(status)}`;
+}
+function printHealthLine(label, value) {
+  console.log(`  ${chalk.dim(label.padEnd(22))} ${value}`);
+}
+function printHealthSection(title) {
+  console.log(`
+${chalk.bold.blue(title)}`);
+}
+function printHealthSummary(checks) {
+  printHealthSection("EnvSync Health");
+  printHealthLine("Bootstrap", formatHealthStatus(checks.bootstrap.completed));
+  printHealthLine("Deploy API", formatHealthStatus(checks.deploy.api));
+  printHealthLine("Web", formatHealthStatus(checks.deploy.web));
+  printHealthLine("Landing", formatHealthStatus(checks.deploy.landing));
+  printHealthLine("ClickStack", formatHealthStatus(checks.observability.service));
+  printHealthLine("Active slot", chalk.cyan(checks.deploy.active_slot));
+  printHealthLine("Maintenance mode", checks.deploy.maintenance_mode ? chalk.yellow("enabled") : chalk.green("disabled"));
+  if (checks.deploy.previous_slot) {
+    printHealthLine("Rollback slot", chalk.yellow(checks.deploy.previous_slot));
+  }
+  printHealthSection("Bootstrap");
+  printHealthLine("Completed", formatHealthStatus(checks.bootstrap.completed));
+  printHealthLine("Completed at", checks.bootstrap.completed_at ?? chalk.dim("not completed"));
+  for (const [service, health] of Object.entries(checks.bootstrap.services)) {
+    printHealthLine(service, formatHealthStatus(health));
+  }
+  printHealthSection("Deployment");
+  for (const [slot, data] of Object.entries(checks.deploy.api_slots)) {
+    const heading = `${slot}${data.active ? " (active)" : ""}`;
+    printHealthLine(heading, formatHealthStatus(data.service));
+    if (data.release_version) printHealthLine(`${slot} release`, `v${data.release_version}`);
+    if (data.image) printHealthLine(`${slot} image`, chalk.dim(data.image));
+    if (data.deployed_at) printHealthLine(`${slot} deployed`, data.deployed_at);
+  }
+  printHealthSection("Database");
+  printHealthLine("API migration head", checks.database.api.migration_head ?? chalk.dim("none"));
+  printHealthLine("DB auto migrate", checks.database.api.auto_migrate_enabled ? chalk.red("enabled") : chalk.green("disabled"));
+  if (checks.database.api.error) {
+    printHealthLine("Migration probe", chalk.yellow(checks.database.api.error));
+  }
+  printHealthSection("Observability");
+  printHealthLine("Sessions source", formatHealthStatus(checks.observability.sessions_source.configured));
+  printHealthLine("Saved searches", formatHealthStatus(checks.observability.saved_searches.configured));
+  if (checks.observability.saved_searches.missing.length > 0) {
+    printHealthLine("Missing searches", chalk.yellow(checks.observability.saved_searches.missing.join(", ")));
+  }
+  printHealthLine("Tags", formatHealthStatus(checks.observability.tags.configured));
+  if (checks.observability.tags.missing.length > 0) {
+    printHealthLine("Missing tags", chalk.yellow(checks.observability.tags.missing.join(", ")));
+  }
+  printHealthLine("Replay web", formatHealthStatus(checks.observability.browser_replay_runtime.web.configured));
+  printHealthLine("Replay landing", formatHealthStatus(checks.observability.browser_replay_runtime.landing.configured));
+  printHealthLine("Obs UI", checks.observability.obs_ui.url);
+  printHealthLine("Obs API", checks.observability.obs_api.url);
+  printHealthLine("Obs OTLP", checks.observability.obs_otlp.url);
+  printHealthSection("Frontend Runtime");
+  printHealthLine("Web API", checks.frontend_runtime.web.api_base_url ?? chalk.dim("missing"));
+  printHealthLine("Web App", checks.frontend_runtime.web.app_base_url ?? chalk.dim("missing"));
+  printHealthLine("Web Auth", checks.frontend_runtime.web.auth_base_url ?? chalk.dim("missing"));
+  printHealthLine("Web Docs", checks.frontend_runtime.web.api_docs_url ?? chalk.dim("missing"));
+  if (checks.frontend_runtime.web.release_version) {
+    printHealthLine("Web Release", `v${checks.frontend_runtime.web.release_version}`);
+  }
+  if (checks.frontend_runtime.web.active_api_slot) {
+    printHealthLine("Web Slot", checks.frontend_runtime.web.active_api_slot);
+  }
+  printHealthLine("Landing API", checks.frontend_runtime.landing.api_base_url ?? chalk.dim("missing"));
+  printHealthLine("Landing App", checks.frontend_runtime.landing.app_base_url ?? chalk.dim("missing"));
+  printHealthLine("Landing Auth", checks.frontend_runtime.landing.auth_base_url ?? chalk.dim("missing"));
+  printHealthLine("Landing Docs", checks.frontend_runtime.landing.api_docs_url ?? chalk.dim("missing"));
+  if (checks.frontend_runtime.landing.release_version) {
+    printHealthLine("Landing Release", `v${checks.frontend_runtime.landing.release_version}`);
+  }
+  if (checks.frontend_runtime.landing.active_api_slot) {
+    printHealthLine("Landing Slot", checks.frontend_runtime.landing.active_api_slot);
+  }
+  printHealthSection("Public URLs");
+  for (const [label, url] of Object.entries(checks.public)) {
+    printHealthLine(label, url);
+  }
+  printHealthSection("Next Steps");
+  if (!checks.bootstrap.completed) {
+    printHealthLine("Recommended", chalk.cyan("envsync-deploy bootstrap"));
+    return;
+  }
+  if (checks.deploy.api !== "healthy" || checks.deploy.web !== "healthy" || checks.edition !== "oss" && checks.deploy.landing !== "healthy") {
+    printHealthLine("Recommended", chalk.cyan("envsync-deploy deploy"));
+    return;
+  }
+  printHealthLine("Inspect JSON", chalk.cyan("envsync-deploy health --json"));
+  printHealthLine("Upgrade", chalk.cyan("envsync-deploy upgrade"));
+  printHealthLine("Backup", chalk.cyan("envsync-deploy backup"));
+}
+async function cmdPreinstall() {
+  ensureDir(HOST_ROOT);
+  ensureDir(DEPLOY_ROOT);
+  ensureDir(RELEASES_ROOT);
+  ensureDir(BACKUPS_ROOT);
+  ensureDir(ETC_ROOT);
+  ensureDir(TRAEFIK_STATE_ROOT);
+  run("bash", ["-lc", "command -v apt-get >/dev/null"]);
+  run("sudo", ["apt-get", "update"]);
+  run("sudo", ["apt-get", "install", "-y", "docker.io", "docker-compose-v2", "git", "curl", "jq", "openssl", "tar"]);
+  run("sudo", ["systemctl", "enable", "--now", "docker"]);
+  try {
+    run("docker", ["swarm", "init"]);
+  } catch {
+  }
+  run("docker", ["buildx", "version"]);
+  run("bash", ["-lc", "curl -fsSL https://ghcr.io >/dev/null"]);
+  run("bash", ["-lc", "curl -fsSL https://acme-v02.api.letsencrypt.org/directory >/dev/null"]);
+}
+async function cmdSetup() {
+  logSection("Setup");
+  const rootDomain = await ask("Root domain", "example.com");
+  const acmeEmail = await ask("ACME email", `admin@${rootDomain}`);
+  const releaseVersion = await ask("Release version", getDeployCliVersion());
+  assertSemverVersion(releaseVersion, "release version");
+  const releaseImages = versionedImages(releaseVersion);
+  const adminUser = await ask("Keycloak admin user", "admin");
+  const adminPassword = await ask("Keycloak admin password", randomSecret(12));
+  const smtpHost = await ask("SMTP host", "smtp.example.com");
+  const smtpPort = Number(await ask("SMTP port", "587"));
+  const smtpSecure = await ask("SMTP secure (true/false)", "true") === "true";
+  const smtpUser = await ask("SMTP user", "");
+  const smtpPass = await ask("SMTP pass", "");
+  const smtpFrom = await ask("SMTP from", `noreply@${rootDomain}`);
+  const retentionDays = Number(await ask("ClickStack retention days", "30"));
+  const publicAuth = await ask("Expose auth.<domain> publicly (true/false)", "true") === "true";
+  const publicObs = await ask("Expose obs.<domain> publicly (true/false)", "true") === "true";
+  const mailpitEnabled = await ask("Enable mailpit (true/false)", "false") === "true";
+  const config = {
+    source: defaultSourceConfig(releaseVersion),
+    release: {
+      version: releaseVersion
+    },
+    domain: { root_domain: rootDomain, acme_email: acmeEmail },
+    images: {
+      api: releaseImages.api,
+      keycloak: releaseImages.keycloak,
+      web: releaseImages.web,
+      landing: releaseImages.landing,
+      clickstack: "clickhouse/clickstack-all-in-one:latest",
+      traefik: "traefik:v3.6.6",
+      otel_agent: "otel/opentelemetry-collector-contrib:0.111.0"
+    },
+    services: {
+      stack_name: "envsync",
+      api_port: 4e3,
+      public_http_port: 80,
+      public_https_port: 443,
+      clickstack_ui_port: 8080,
+      clickstack_otlp_http_port: 4318,
+      clickstack_otlp_grpc_port: 4317,
+      keycloak_port: 8080,
+      rustfs_port: 9e3,
+      rustfs_console_port: 9001
+    },
+    auth: {
+      keycloak_realm: "envsync",
+      admin_user: adminUser,
+      admin_password: adminPassword,
+      web_client_id: "envsync-web",
+      api_client_id: "envsync-api",
+      cli_client_id: "envsync-cli"
+    },
+    observability: {
+      retention_days: retentionDays,
+      public_obs: publicObs
+    },
+    backup: {
+      output_dir: BACKUPS_ROOT,
+      encrypted: true
+    },
+    smtp: {
+      host: smtpHost,
+      port: smtpPort,
+      secure: smtpSecure,
+      user: smtpUser,
+      pass: smtpPass,
+      from: smtpFrom
+    },
+    exposure: {
+      public_auth: publicAuth,
+      public_obs: publicObs,
+      mailpit_enabled: mailpitEnabled,
+      s3_public: true,
+      s3_console_public: true
+    },
+    upgrade: {
+      maintenance_mode_enabled: true,
+      db_snapshot_on_api_upgrade: true,
+      keep_failed_upgrade_db_snapshot: true
+    }
+  };
+  saveDesiredConfig(config);
+  logSuccess(`Config written to ${DEPLOY_YAML}`);
+  logInfo(`Pinned source checkout: ${config.source.repo_url} @ ${config.source.ref}`);
+  logInfo("Create these DNS records:");
+  console.log(JSON.stringify(domainMap2(rootDomain), null, 2));
+}
+async function cmdBootstrap() {
+  logSection("Bootstrap");
+  const { config, generated } = loadState();
+  const nextGenerated = ensureGeneratedRuntimeState(config, resetBootstrapGeneratedState(generated));
+  const runtimeEnv = buildRuntimeEnv(config, nextGenerated);
+  logReleaseContext(config);
+  assertSwarmManager();
+  if (currentOptions.dryRun) {
+    logWarn("Dry-run mode: bootstrap reset will be previewed but not executed.");
+  }
+  await confirmBootstrapReset(config);
+  cleanupBootstrapState(config);
+  ensureRepoCheckout(config);
+  writeDeployArtifacts(config, nextGenerated);
+  buildKeycloakImage(config.images.keycloak);
+  if (currentOptions.dryRun) {
+    logDryRun(`Would deploy base bootstrap stack for ${config.services.stack_name}`);
+    logCommand("docker", ["stack", "deploy", "-c", BOOTSTRAP_BASE_STACK_FILE, config.services.stack_name]);
+  } else {
+    logStep("Deploying base bootstrap stack");
+    logCommand("docker", ["stack", "deploy", "-c", BOOTSTRAP_BASE_STACK_FILE, config.services.stack_name]);
+    run("docker", ["stack", "deploy", "-c", BOOTSTRAP_BASE_STACK_FILE, config.services.stack_name]);
+    logSuccess("Base bootstrap stack deployed");
+  }
+  waitForPostgresService(config, "postgres", "postgres", "postgres", "envsync-postgres");
+  waitForRedisService(config);
+  waitForTcpService(config, "rustfs", "rustfs", 9e3);
+  waitForPostgresService(config, "keycloak", "keycloak_db", "keycloak", runtimeEnv.KEYCLOAK_DB_PASSWORD);
+  waitForPostgresService(config, "openfga", "openfga_db", "openfga", runtimeEnv.OPENFGA_DB_PASSWORD);
+  waitForPostgresService(config, "minikms", "minikms_db", "postgres", runtimeEnv.MINIKMS_DB_PASSWORD);
+  runOpenFgaMigrate(config, runtimeEnv);
+  runMiniKmsMigrate(config, runtimeEnv);
+  if (currentOptions.dryRun) {
+    logDryRun(`Would deploy runtime bootstrap stack for ${config.services.stack_name}`);
+    logCommand("docker", ["stack", "deploy", "-c", BOOTSTRAP_STACK_FILE, config.services.stack_name]);
+  } else {
+    logStep("Deploying runtime bootstrap stack");
+    logCommand("docker", ["stack", "deploy", "-c", BOOTSTRAP_STACK_FILE, config.services.stack_name]);
+    run("docker", ["stack", "deploy", "-c", BOOTSTRAP_STACK_FILE, config.services.stack_name]);
+    logSuccess("Runtime bootstrap stack deployed");
+  }
+  waitForHttpService(config, "keycloak management readiness", "http://keycloak:9000/health/ready", 180);
+  waitForHttpService(config, "openfga", "http://openfga:8090/stores");
+  waitForTcpService(config, "minikms", "minikms", 50051);
+  logStep("Running API database migrations");
+  runApiMigrationJsonCommand(config, config.images.api, ["latest"]);
+  logSuccess("API database migrations completed");
+  const initResult = runBootstrapInit(config);
+  const clickstackBootstrapResult = runClickstackBootstrap(config);
+  const persistedGenerated = normalizeGeneratedState({
+    openfga: {
+      store_id: initResult.openfgaStoreId,
+      model_id: initResult.openfgaModelId
+    },
+    deployment: nextGenerated.deployment,
+    clickstack: {
+      ...nextGenerated.clickstack,
+      browser_api_key: clickstackBootstrapResult.browserApiKey ?? nextGenerated.clickstack.browser_api_key
+    },
+    secrets: nextGenerated.secrets,
+    bootstrap: nextGenerated.bootstrap
+  });
+  if (!currentOptions.dryRun) {
+    writeDeployArtifacts(config, persistedGenerated);
+  }
+  if (currentOptions.dryRun) {
+    logDryRun("Skipping generated OpenFGA ID persistence in preview mode");
+    logSuccess("Bootstrap dry-run completed");
+    return;
+  }
+  const bootstrappedGenerated = normalizeGeneratedState({
+    openfga: {
+      store_id: initResult.openfgaStoreId,
+      model_id: initResult.openfgaModelId
+    },
+    deployment: nextGenerated.deployment,
+    clickstack: persistedGenerated.clickstack,
+    secrets: nextGenerated.secrets,
+    bootstrap: {
+      completed_at: (/* @__PURE__ */ new Date()).toISOString()
+    }
+  });
+  writeDeployArtifacts(config, bootstrappedGenerated);
+  logClickstackCredentials(bootstrappedGenerated);
+  logSuccess("Bootstrap completed");
+}
+async function cmdDeploy() {
+  logSection("Deploy");
+  const { config, generated } = loadState();
+  logReleaseContext(config);
+  assertSwarmManager();
+  assertBootstrapState(generated);
+  if (!currentOptions.dryRun) {
+    const services = listStackServices(config);
+    if (serviceHealth(services, `${config.services.stack_name}_keycloak`) === "missing" || serviceHealth(services, `${config.services.stack_name}_openfga`) === "missing" || serviceHealth(services, `${config.services.stack_name}_minikms`) === "missing") {
+      logWarn("Bootstrap services are not running. Recreating from persisted bootstrap state.");
+    }
+  } else {
+    logDryRun("Skipping runtime bootstrap service validation");
+  }
+  ensureRepoCheckout(config);
+  buildKeycloakImage(config.images.keycloak);
+  if (!currentOptions.dryRun) {
+    ensureDir(currentReleaseDir("web"));
+    if (!isOssConfig2(config)) {
+      ensureDir(currentReleaseDir("landing"));
+    }
+  }
+  stageFrontendRelease("web", config.images.web, config.release.version);
+  if (!isOssConfig2(config)) {
+    stageFrontendRelease("landing", config.images.landing, config.release.version);
+  }
+  const originalState = normalizeGeneratedState(generated);
+  let currentState = originalState;
+  let promoted = false;
+  const candidateDeployment = createPromotionCandidateState(config, currentState);
+  if (candidateDeployment) {
+    const targetSlot = otherApiSlot(candidateDeployment.active_slot);
+    const candidateState = normalizeGeneratedState({
+      ...currentState,
+      deployment: {
+        ...candidateDeployment,
+        maintenance_mode: config.upgrade.maintenance_mode_enabled
+      }
+    });
+    const activeImageBeforeUpgrade = currentState.deployment.slots[currentState.deployment.active_slot].api_image || config.images.api;
+    const activeReleaseBeforeUpgrade = currentState.deployment.slots[currentState.deployment.active_slot].release_version || config.release.version;
+    const preUpgradeHead = runApiMigrationJsonCommand(config, activeImageBeforeUpgrade, ["head"]).currentHead;
+    let snapshotPath = null;
+    let usedSnapshotRestore = false;
+    writeDeployArtifacts(config, candidateState);
+    try {
+      logInfo(`Deploying release ${config.release.version} into inactive API slot ${targetSlot}`);
+      deployRenderedStack(config, `candidate ${targetSlot}`);
+      logInfo(`API migration head before upgrade: ${preUpgradeHead ?? "none"}`);
+      if (config.upgrade.db_snapshot_on_api_upgrade) {
+        snapshotPath = createApiDbUpgradeBackup(config, activeReleaseBeforeUpgrade, config.release.version);
+      }
+      runApiMigrationJsonCommand(config, config.images.api, ["latest"]);
+      const postUpgradeHead = runApiMigrationJsonCommand(config, config.images.api, ["head"]).currentHead;
+      logInfo(`API migration head after upgrade: ${postUpgradeHead ?? "none"}`);
+      waitForApiSlotHealthy(config, targetSlot);
+      currentState = normalizeGeneratedState({
+        ...candidateState,
+        deployment: {
+          ...createPromotedApiDeploymentState(config, candidateState),
+          maintenance_mode: false
+        }
+      });
+      writeDeployArtifacts(config, currentState);
+      activateFrontendReleaseForState(config, currentState, config.release.version);
+      sleepSeconds(3);
+      promoted = true;
+      if (snapshotPath && !currentOptions.dryRun) {
+        fs2.rmSync(snapshotPath, { force: true });
+      }
+    } catch (error) {
+      const rollbackTarget = preUpgradeHead ?? "zero";
+      try {
+        logWarn(`Candidate deploy failed after migration. Rolling schema back to ${rollbackTarget}.`);
+        runApiMigrationJsonCommand(config, config.images.api, ["rollback_to", rollbackTarget]);
+      } catch (rollbackError) {
+        if (!snapshotPath) {
+          throw new Error(
+            `Deploy failed and migration rollback failed: ${error instanceof Error ? error.message : String(error)}
+${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`
+          );
+        }
+        logWarn(`Migration rollback failed. Restoring DB snapshot ${snapshotPath}.`);
+        restoreApiDbUpgradeBackup(config, snapshotPath);
+        usedSnapshotRestore = true;
+      }
+      const recoveredState = normalizeGeneratedState({
+        ...originalState,
+        deployment: {
+          ...originalState.deployment,
+          maintenance_mode: false
+        }
+      });
+      writeDeployArtifacts(config, recoveredState);
+      deployRenderedStack(config, "rollback recovery");
+      waitForApiSlotHealthy(config, recoveredState.deployment.active_slot);
+      if (snapshotPath && !config.upgrade.keep_failed_upgrade_db_snapshot && !currentOptions.dryRun) {
+        fs2.rmSync(snapshotPath, { force: true });
+      }
+      throw new Error(
+        usedSnapshotRestore ? `Deploy failed after DB migration. Previous release was restored using DB snapshot recovery. ${error instanceof Error ? error.message : String(error)}` : `Deploy failed after DB migration. Previous release was restored. ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
+  currentState = normalizeGeneratedState({
+    ...currentState,
+    deployment: {
+      ...createSteadyApiDeploymentState2(config, currentState),
+      maintenance_mode: false
+    }
+  });
+  writeDeployArtifacts(config, currentState);
+  if (!promoted) {
+    activateFrontendReleaseForState(config, currentState, config.release.version);
+    deployRenderedStack(config, "steady");
+  }
+  waitForHealthyServices(config, [
+    { label: "traefik", getHealth: (services) => serviceHealth(services, `${config.services.stack_name}_traefik`) },
+    { label: "keycloak", getHealth: (services) => serviceHealth(services, `${config.services.stack_name}_keycloak`) },
+    { label: "openfga", getHealth: (services) => serviceHealth(services, `${config.services.stack_name}_openfga`) },
+    { label: "minikms", getHealth: (services) => serviceHealth(services, `${config.services.stack_name}_minikms`) },
+    { label: "clickstack", getHealth: (services) => serviceHealth(services, `${config.services.stack_name}_clickstack`) },
+    ...isOssConfig2(config) ? [] : [{ label: "landing", getHealth: (services) => serviceHealth(services, `${config.services.stack_name}_landing_nginx`) }],
+    { label: "web", getHealth: (services) => serviceHealth(services, `${config.services.stack_name}_web_nginx`) },
+    { label: "api", getHealth: (services) => apiHealth(services, config.services.stack_name) }
+  ]);
+  waitForApiSlotHealthy(config, currentState.deployment.active_slot);
+  currentState = normalizeGeneratedState({
+    ...currentState,
+    deployment: markActiveApiSlotDeployed(config, currentState.deployment)
+  });
+  persistGeneratedState(config, currentState);
+  logInfo(`Active API slot: ${currentState.deployment.active_slot}`);
+  if (currentState.deployment.previous_slot) {
+    logInfo(`Rollback slot: ${currentState.deployment.previous_slot}`);
+  }
+  logSuccess("Deploy completed");
+}
+async function cmdPromote(target) {
+  logSection("Promote");
+  const { config, generated } = loadState();
+  logReleaseContext(config);
+  assertSwarmManager();
+  assertBootstrapState(generated);
+  const currentState = normalizeGeneratedState(generated);
+  const activeSlot = currentState.deployment.active_slot;
+  const targetSlot = target === "blue" || target === "green" ? target : otherApiSlot(activeSlot);
+  if (targetSlot === activeSlot) {
+    logInfo(`API slot ${targetSlot} is already active`);
+    return;
+  }
+  if (!slotHasApiDeployment2(currentState.deployment.slots[targetSlot])) {
+    throw new Error(`Cannot promote API slot '${targetSlot}' because it has no deployed image recorded.`);
+  }
+  const promotedState = normalizeGeneratedState({
+    ...currentState,
+    deployment: {
+      active_slot: targetSlot,
+      previous_slot: activeSlot,
+      maintenance_mode: false,
+      slots: currentState.deployment.slots
+    }
+  });
+  writeDeployArtifacts(config, promotedState);
+  if (exists2(releaseAssetDir("web", promotedState.deployment.slots[targetSlot].release_version)) && exists2(releaseAssetDir("landing", promotedState.deployment.slots[targetSlot].release_version))) {
+    activateFrontendReleaseForState(config, promotedState);
+  } else {
+    logWarn(`Missing staged frontend assets for release ${promotedState.deployment.slots[targetSlot].release_version}; leaving current frontend assets unchanged.`);
+  }
+  sleepSeconds(3);
+  waitForApiSlotHealthy(config, targetSlot);
+  const persistedState = normalizeGeneratedState({
+    ...promotedState,
+    deployment: touchApiSlotDeployment(promotedState.deployment, targetSlot)
+  });
+  persistGeneratedState(config, persistedState);
+  logInfo(`Active API slot: ${targetSlot}`);
+  logInfo(`Rollback slot: ${activeSlot}`);
+  logSuccess("Promotion completed");
+}
+async function cmdRollback() {
+  logSection("Rollback");
+  const { config, generated } = loadState();
+  logReleaseContext(config);
+  assertSwarmManager();
+  assertBootstrapState(generated);
+  const currentState = normalizeGeneratedState(generated);
+  const rollbackState = normalizeGeneratedState({
+    ...currentState,
+    deployment: {
+      ...createRolledBackApiDeploymentState(currentState),
+      maintenance_mode: false
+    }
+  });
+  writeDeployArtifacts(config, rollbackState);
+  if (exists2(releaseAssetDir("web", rollbackState.deployment.slots[rollbackState.deployment.active_slot].release_version)) && exists2(releaseAssetDir("landing", rollbackState.deployment.slots[rollbackState.deployment.active_slot].release_version))) {
+    activateFrontendReleaseForState(config, rollbackState);
+  } else {
+    logWarn(`Missing staged frontend assets for release ${rollbackState.deployment.slots[rollbackState.deployment.active_slot].release_version}; leaving current frontend assets unchanged.`);
+  }
+  sleepSeconds(3);
+  waitForApiSlotHealthy(config, rollbackState.deployment.active_slot);
+  persistGeneratedState(config, normalizeGeneratedState({
+    ...rollbackState,
+    deployment: touchApiSlotDeployment(rollbackState.deployment, rollbackState.deployment.active_slot)
+  }));
+  logInfo(`Active API slot: ${rollbackState.deployment.active_slot}`);
+  if (rollbackState.deployment.previous_slot) {
+    logInfo(`Rollback slot: ${rollbackState.deployment.previous_slot}`);
+  }
+  logSuccess("Rollback completed");
+}
+async function cmdHealth(asJson) {
+  const { config, generated } = loadState();
+  const hosts = domainMap2(config.domain.root_domain);
+  const services = listStackServices(config);
+  const stackName = config.services.stack_name;
+  const traefikDynamic = exists2(TRAEFIK_DYNAMIC_FILE) ? fs2.readFileSync(TRAEFIK_DYNAMIC_FILE, "utf8") : "";
+  const webRuntimeConfig = readRenderedRuntimeConfig(path2.join(RELEASES_ROOT, "web", "current", "runtime-config.js"));
+  const landingRuntimeConfig = readRenderedRuntimeConfig(path2.join(RELEASES_ROOT, "landing", "current", "runtime-config.js"));
+  const clickstackSearchState = getClickstackSearchState(config);
+  const sourceNames = new Set(clickstackSearchState?.sourceNames ?? []);
+  const savedSearchNames = new Set((clickstackSearchState?.savedSearches ?? []).map((search) => search.name).filter(Boolean));
+  const savedSearchTags = new Set((clickstackSearchState?.savedSearches ?? []).flatMap((search) => search.tags ?? []));
+  const dashboardTags = new Set(clickstackSearchState?.dashboardTags ?? []);
+  const combinedTags = /* @__PURE__ */ new Set([...savedSearchTags, ...dashboardTags]);
+  const databaseHealth = getApiMigrationHealth(config, generated);
+  const bootstrapServices = {
+    postgres: serviceHealth(services, `${stackName}_postgres`),
+    redis: serviceHealth(services, `${stackName}_redis`),
+    rustfs: serviceHealth(services, `${stackName}_rustfs`),
+    keycloak: serviceHealth(services, `${stackName}_keycloak`),
+    openfga: serviceHealth(services, `${stackName}_openfga`),
+    minikms: serviceHealth(services, `${stackName}_minikms`)
+  };
+  const checks = {
+    edition: config.edition ?? "enterprise",
+    bootstrap: {
+      completed: hasCompleteBootstrapState(generated) && generated.bootstrap.completed_at.length > 0,
+      completed_at: generated.bootstrap.completed_at || null,
+      services: bootstrapServices
+    },
+    deploy: {
+      active_slot: generated.deployment.active_slot,
+      previous_slot: generated.deployment.previous_slot || null,
+      maintenance_mode: generated.deployment.maintenance_mode,
+      api: apiHealth(services, stackName),
+      api_slots: {
+        blue: {
+          service: serviceHealth(services, slotStackServiceName(config, "blue")),
+          image: generated.deployment.slots.blue.api_image || null,
+          release_version: generated.deployment.slots.blue.release_version || null,
+          deployed_at: generated.deployment.slots.blue.deployed_at || null,
+          active: generated.deployment.active_slot === "blue"
+        },
+        green: {
+          service: serviceHealth(services, slotStackServiceName(config, "green")),
+          image: generated.deployment.slots.green.api_image || null,
+          release_version: generated.deployment.slots.green.release_version || null,
+          deployed_at: generated.deployment.slots.green.deployed_at || null,
+          active: generated.deployment.active_slot === "green"
+        }
+      },
+      web: serviceHealth(services, `${stackName}_web_nginx`),
+      landing: serviceHealth(services, `${stackName}_landing_nginx`)
+    },
+    database: {
+      api: databaseHealth
+    },
+    observability: {
+      service: serviceHealth(services, `${stackName}_clickstack`),
+      obs_ui: {
+        url: publicHttpsUrl2(config, hosts.obs),
+        configured: traefikDynamic.includes("obs-ui-router")
+      },
+      obs_api: {
+        url: publicHttpsUrl2(config, hosts.obs, "/api"),
+        configured: traefikDynamic.includes("obs-api-router")
+      },
+      obs_otlp: {
+        url: publicHttpsUrl2(config, hosts.obs, "/v1/traces"),
+        configured: traefikDynamic.includes("obs-otlp-router")
+      },
+      frontend_otel_endpoint: {
+        web: publicHttpsUrl2(config, hosts.obs),
+        landing: publicHttpsUrl2(config, hosts.obs)
+      },
+      browser_replay_runtime: {
+        web: {
+          configured: Boolean(webRuntimeConfig?.hyperdxApiKey && webRuntimeConfig?.hyperdxUrl && !webRuntimeConfig?.hyperdxDisabled),
+          hyperdx_url: webRuntimeConfig?.hyperdxUrl ?? null
+        },
+        landing: {
+          configured: Boolean(landingRuntimeConfig?.hyperdxApiKey && landingRuntimeConfig?.hyperdxUrl && !landingRuntimeConfig?.hyperdxDisabled),
+          hyperdx_url: landingRuntimeConfig?.hyperdxUrl ?? null
+        }
+      },
+      sessions_source: {
+        configured: sourceNames.has("Sessions")
+      },
+      saved_searches: {
+        configured: REQUIRED_CLICKSTACK_SAVED_SEARCHES.every((name) => savedSearchNames.has(name)),
+        required: [...REQUIRED_CLICKSTACK_SAVED_SEARCHES],
+        missing: REQUIRED_CLICKSTACK_SAVED_SEARCHES.filter((name) => !savedSearchNames.has(name))
+      },
+      tags: {
+        configured: REQUIRED_CLICKSTACK_TAGS.every((tag) => combinedTags.has(tag)),
+        required: [...REQUIRED_CLICKSTACK_TAGS],
+        missing: REQUIRED_CLICKSTACK_TAGS.filter((tag) => !combinedTags.has(tag))
+      }
+    },
+    public: {
+      ...isOssConfig2(config) ? {} : { landing: publicHttpsUrl2(config, hosts.landing) },
+      app: publicHttpsUrl2(config, hosts.app),
+      api: publicHttpsUrl2(config, hosts.api, "/health"),
+      auth: publicHttpsUrl2(config, hosts.auth, `/realms/${config.auth.keycloak_realm}/.well-known/openid-configuration`),
+      obs: publicHttpsUrl2(config, hosts.obs)
+    },
+    frontend_runtime: {
+      web: {
+        api_base_url: webRuntimeConfig?.apiBaseUrl ?? null,
+        app_base_url: webRuntimeConfig?.appBaseUrl ?? null,
+        auth_base_url: webRuntimeConfig?.authBaseUrl ?? null,
+        api_docs_url: webRuntimeConfig?.apiDocsUrl ?? null,
+        release_version: webRuntimeConfig?.releaseVersion ?? null,
+        active_api_slot: webRuntimeConfig?.activeApiSlot ?? null
+      },
+      landing: {
+        api_base_url: landingRuntimeConfig?.apiBaseUrl ?? null,
+        app_base_url: landingRuntimeConfig?.appBaseUrl ?? null,
+        auth_base_url: landingRuntimeConfig?.authBaseUrl ?? null,
+        api_docs_url: landingRuntimeConfig?.apiDocsUrl ?? null,
+        release_version: landingRuntimeConfig?.releaseVersion ?? null,
+        active_api_slot: landingRuntimeConfig?.activeApiSlot ?? null
+      }
+    }
+  };
+  if (asJson) {
+    console.log(JSON.stringify(checks, null, 2));
+    return;
+  }
+  printHealthSummary(checks);
+}
+async function cmdUpgrade(targetVersion) {
+  logSection("Upgrade");
+  const { config } = loadState();
+  const desiredVersion = targetVersion ?? getDeployCliVersion();
+  assertSemverVersion(desiredVersion, "target release version");
+  config.release.version = desiredVersion;
+  config.source = {
+    ...config.source,
+    ref: `v${desiredVersion}`
+  };
+  logReleaseContext(config);
+  config.images = {
+    ...config.images,
+    ...versionedImages(desiredVersion)
+  };
+  saveDesiredConfig(config);
+  if (currentOptions.dryRun) {
+    logDryRun(`Would upgrade stack to release ${desiredVersion}`);
+  }
+  await cmdDeploy();
+}
+async function cmdUpgradeDeps() {
+  logSection("Upgrade Dependencies");
+  const { config } = loadState();
+  logReleaseContext(config);
+  config.images.traefik = "traefik:v3.6.6";
+  config.images.clickstack = "clickhouse/clickstack-all-in-one:latest";
+  config.images.otel_agent = "otel/opentelemetry-collector-contrib:0.111.0";
+  saveDesiredConfig(config);
+  if (currentOptions.dryRun) {
+    logDryRun("Would refresh dependency image tags and redeploy");
+  }
+  await cmdDeploy();
+}
+function sha256File(filePath) {
+  const hash = createHash("sha256");
+  hash.update(fs2.readFileSync(filePath));
+  return hash.digest("hex");
+}
+function stackVolumeName(config, name) {
+  return `${config.services.stack_name}_${name}`;
+}
+function hasManagedRuntime(config) {
+  return stackExists(config) || listManagedContainers(config).length > 0;
+}
+function stopManagedRuntime(config, label = "Stopping existing EnvSync services") {
+  const containerIds = listManagedContainers(config);
+  const networkName = stackNetworkName(config);
+  logStep(label);
+  if (currentOptions.dryRun) {
+    if (stackExists(config)) {
+      logDryRun(`Would remove stack ${config.services.stack_name}`);
+      logCommand("docker", ["stack", "rm", config.services.stack_name]);
+    }
+    if (containerIds.length > 0) {
+      logDryRun(`Would remove containers: ${containerIds.join(", ")}`);
+      logCommand("docker", ["rm", "-f", ...containerIds]);
+    }
+    logDryRun(`Would remove network ${networkName} if present`);
+    logCommand("docker", ["network", "rm", networkName]);
+    logSuccess("Managed EnvSync runtime stop preview completed");
+    return;
+  }
+  if (stackExists(config)) {
+    logCommand("docker", ["stack", "rm", config.services.stack_name]);
+    run("docker", ["stack", "rm", config.services.stack_name]);
+    waitForStackRemoval(config);
+  }
+  const refreshedContainers = listManagedContainers(config);
+  if (refreshedContainers.length > 0) {
+    logCommand("docker", ["rm", "-f", ...refreshedContainers]);
+    const removed = runIgnoringAbsent("docker", ["rm", "-f", ...refreshedContainers], {
+      absentPatterns: ["no such container", "not found"]
+    });
+    if (!removed) {
+      logInfo("Managed containers were already absent");
+    }
+  }
+  if (commandSucceeds("docker", ["network", "inspect", networkName])) {
+    logCommand("docker", ["network", "rm", networkName]);
+    const removed = runIgnoringAbsent("docker", ["network", "rm", networkName], {
+      absentPatterns: ["network", "not found", "no such network"]
+    });
+    if (!removed) {
+      logInfo(`Network ${networkName} was already absent`);
+    }
+  }
+  logSuccess("Existing EnvSync services stopped");
+}
+function backupDockerVolume(volumeName, targetDir) {
+  logStep(`Backing up Docker volume ${volumeName}`);
+  if (currentOptions.dryRun) {
+    logDryRun(`Would back up ${volumeName} into ${targetDir}`);
+    return;
+  }
+  ensureDir(targetDir);
+  run("docker", [
+    "run",
+    "--rm",
+    "-v",
+    `${volumeName}:/from:ro`,
+    "-v",
+    `${targetDir}:/to`,
+    "alpine:3.20",
+    "sh",
+    "-lc",
+    "cd /from && tar -czf /to/volume.tar.gz ."
+  ]);
+  logSuccess(`Backed up Docker volume ${volumeName}`);
+}
+function restoreDockerVolume(volumeName, sourceDir) {
+  logStep(`Restoring Docker volume ${volumeName}`);
+  if (currentOptions.dryRun) {
+    logDryRun(`Would restore ${volumeName} from ${sourceDir}`);
+    return;
+  }
+  run("docker", ["volume", "create", volumeName], { quiet: true });
+  run("docker", [
+    "run",
+    "--rm",
+    "-v",
+    `${volumeName}:/to`,
+    "-v",
+    `${sourceDir}:/from:ro`,
+    "alpine:3.20",
+    "sh",
+    "-lc",
+    "cd /to && tar -xzf /from/volume.tar.gz"
+  ]);
+  logSuccess(`Restored Docker volume ${volumeName}`);
+}
+async function cmdBackup() {
+  logSection("Backup");
+  const { config } = loadState();
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:]/g, "-");
+  const archiveBase = path2.join(config.backup.output_dir, `envsync-backup-${timestamp}`);
+  const manifestPath = `${archiveBase}.manifest.json`;
+  const tarPath = `${archiveBase}.tar.gz`;
+  const staged = path2.join(BACKUPS_ROOT, `staging-${timestamp}`);
+  logInfo(`Backup archive target: ${tarPath}`);
+  if (currentOptions.dryRun) {
+    logDryRun(`Would stage backup files in ${staged}`);
+    if (hasManagedRuntime(config)) {
+      logWarn("Backup would temporarily stop the EnvSync stack to capture consistent volume data.");
+      stopManagedRuntime(config, "Stopping existing EnvSync services for consistent backup");
+      logDryRun("Would redeploy the EnvSync stack after the backup archive is created");
+    }
+    for (const volume of STACK_VOLUMES) {
+      backupDockerVolume(stackVolumeName(config, volume), path2.join(staged, "volumes", volume));
+    }
+    logDryRun(`Would write manifest ${manifestPath}`);
+    logDryRun(`Would create archive ${tarPath}`);
+    logSuccess("Backup dry-run completed");
+    console.log(tarPath);
+    return;
+  }
+  ensureDir(config.backup.output_dir);
+  ensureDir(staged);
+  const resumeRuntimeAfterBackup = hasManagedRuntime(config);
+  let backupCompleted = false;
+  let backupError = null;
+  try {
+    if (resumeRuntimeAfterBackup) {
+      logWarn("Backup will temporarily stop the EnvSync stack to capture consistent volume data.");
+      stopManagedRuntime(config, "Stopping existing EnvSync services for consistent backup");
+    }
+    writeFile(path2.join(staged, "deploy.env"), fs2.readFileSync(DEPLOY_ENV, "utf8"));
+    writeFile(path2.join(staged, "deploy.yaml"), fs2.readFileSync(DEPLOY_YAML, "utf8"));
+    writeFile(path2.join(staged, "config.json"), fs2.readFileSync(INTERNAL_CONFIG_JSON, "utf8"));
+    writeFile(path2.join(staged, "versions.lock.json"), fs2.readFileSync(VERSIONS_LOCK, "utf8"));
+    writeFile(path2.join(staged, "docker-stack.bootstrap.base.yaml"), fs2.readFileSync(BOOTSTRAP_BASE_STACK_FILE, "utf8"));
+    writeFile(path2.join(staged, "docker-stack.bootstrap.yaml"), fs2.readFileSync(BOOTSTRAP_STACK_FILE, "utf8"));
+    writeFile(path2.join(staged, "docker-stack.yaml"), fs2.readFileSync(STACK_FILE, "utf8"));
+    writeFile(path2.join(staged, "traefik-dynamic.yaml"), fs2.readFileSync(TRAEFIK_DYNAMIC_FILE, "utf8"));
+    writeFile(path2.join(staged, "keycloak-realm.envsync.json"), fs2.readFileSync(KEYCLOAK_REALM_FILE, "utf8"));
+    writeFile(path2.join(staged, "otel-agent.yaml"), fs2.readFileSync(OTEL_AGENT_CONF, "utf8"));
+    writeFile(path2.join(staged, "clickhouse-listen.xml"), fs2.readFileSync(CLICKSTACK_CLICKHOUSE_CONF, "utf8"));
+    const volumesDir = path2.join(staged, "volumes");
+    for (const volume of STACK_VOLUMES) {
+      backupDockerVolume(stackVolumeName(config, volume), path2.join(volumesDir, volume));
+    }
+    run("bash", ["-lc", `tar -czf ${JSON.stringify(tarPath)} -C ${JSON.stringify(staged)} .`]);
+    const manifest = {
+      archive: path2.basename(tarPath),
+      sha256: sha256File(tarPath),
+      created_at: (/* @__PURE__ */ new Date()).toISOString(),
+      stack_name: config.services.stack_name,
+      volumes: STACK_VOLUMES.map((volume) => stackVolumeName(config, volume))
+    };
+    writeFile(manifestPath, JSON.stringify(manifest, null, 2) + "\n");
+    backupCompleted = true;
+  } catch (error) {
+    backupError = error;
+  } finally {
+    if (resumeRuntimeAfterBackup) {
+      try {
+        logStep("Restarting EnvSync services after backup");
+        await cmdDeploy();
+      } catch (restartError) {
+        if (backupError) {
+          throw new Error(
+            `Backup failed and automatic service restart also failed: ${backupError instanceof Error ? backupError.message : String(backupError)}
+${restartError instanceof Error ? restartError.message : String(restartError)}`
+          );
+        }
+        throw new Error(
+          `Backup archive was created, but automatic service restart failed: ${restartError instanceof Error ? restartError.message : String(restartError)}`
+        );
+      }
+    }
+  }
+  if (backupError) {
+    throw backupError instanceof Error ? backupError : new Error(String(backupError));
+  }
+  if (!backupCompleted) {
+    throw new Error("Backup did not complete");
+  }
+  logSuccess("Backup completed");
+  console.log(tarPath);
+}
+async function cmdRestore(archivePath, autoDeploy = false) {
+  if (!archivePath) throw new Error("restore requires a .tar.gz path");
+  logSection("Restore");
+  const restoreRoot = path2.join(BACKUPS_ROOT, `restore-${Date.now()}`);
+  logInfo(`Restore archive: ${archivePath}`);
+  if (currentOptions.dryRun) {
+    logDryRun(`Would extract ${archivePath} into ${restoreRoot}`);
+    logDryRun(`Would restore deploy files into ${DEPLOY_ROOT} and ${ETC_ROOT}`);
+    if (hasManagedRuntime(loadState().config)) {
+      stopManagedRuntime(loadState().config, "Stopping existing EnvSync services before restore");
+    }
+    logDryRun("Would restore all managed Docker volumes from the archive");
+    logSuccess("Restore dry-run completed");
+    return;
+  }
+  const currentConfig = loadState().config;
+  if (hasManagedRuntime(currentConfig)) {
+    logWarn("Restore will stop the existing EnvSync stack before replacing managed data volumes.");
+    stopManagedRuntime(currentConfig, "Stopping existing EnvSync services before restore");
+  }
+  ensureDir(restoreRoot);
+  run("bash", ["-lc", `tar -xzf ${JSON.stringify(archivePath)} -C ${JSON.stringify(restoreRoot)}`]);
+  writeFile(DEPLOY_ENV, fs2.readFileSync(path2.join(restoreRoot, "deploy.env"), "utf8"), 384);
+  writeFile(DEPLOY_YAML, fs2.readFileSync(path2.join(restoreRoot, "deploy.yaml"), "utf8"));
+  writeFile(INTERNAL_CONFIG_JSON, fs2.readFileSync(path2.join(restoreRoot, "config.json"), "utf8"));
+  writeFile(VERSIONS_LOCK, fs2.readFileSync(path2.join(restoreRoot, "versions.lock.json"), "utf8"));
+  writeFile(BOOTSTRAP_BASE_STACK_FILE, fs2.readFileSync(path2.join(restoreRoot, "docker-stack.bootstrap.base.yaml"), "utf8"));
+  writeFile(BOOTSTRAP_STACK_FILE, fs2.readFileSync(path2.join(restoreRoot, "docker-stack.bootstrap.yaml"), "utf8"));
+  writeFile(STACK_FILE, fs2.readFileSync(path2.join(restoreRoot, "docker-stack.yaml"), "utf8"));
+  writeFile(TRAEFIK_DYNAMIC_FILE, fs2.readFileSync(path2.join(restoreRoot, "traefik-dynamic.yaml"), "utf8"));
+  writeFile(KEYCLOAK_REALM_FILE, fs2.readFileSync(path2.join(restoreRoot, "keycloak-realm.envsync.json"), "utf8"));
+  writeFile(OTEL_AGENT_CONF, fs2.readFileSync(path2.join(restoreRoot, "otel-agent.yaml"), "utf8"));
+  writeFile(CLICKSTACK_CLICKHOUSE_CONF, fs2.readFileSync(path2.join(restoreRoot, "clickhouse-listen.xml"), "utf8"));
+  const config = loadConfig();
+  for (const volume of STACK_VOLUMES) {
+    restoreDockerVolume(stackVolumeName(config, volume), path2.join(restoreRoot, "volumes", volume));
+  }
+  logSuccess("Restore completed");
+  logInfo(`Restored archive: ${archivePath}`);
+  logInfo(`Restored stack name: ${config.services.stack_name}`);
+  if (autoDeploy) {
+    logInfo("Starting services after restore because --deploy was provided");
+    await cmdDeploy();
+    return;
+  }
+  logInfo("Next: envsync-deploy deploy");
+}
+async function main() {
+  const argv = process.argv.slice(2);
+  const command = argv[0];
+  const args = argv.slice(1);
+  currentOptions = {
+    dryRun: args.includes("--dry-run"),
+    force: args.includes("--force")
+  };
+  const positionals = args.filter((arg) => arg !== "--dry-run" && arg !== "--force" && arg !== "--deploy");
+  if (!command) {
+    printOperatorOverview();
+    process.exit(0);
+  }
+  switch (command) {
+    case "preinstall":
+      await cmdPreinstall();
+      break;
+    case "setup":
+      await cmdSetup();
+      break;
+    case "bootstrap":
+      await cmdBootstrap();
+      break;
+    case "deploy":
+      await cmdDeploy();
+      break;
+    case "promote":
+      await cmdPromote(positionals[0]);
+      break;
+    case "rollback":
+      await cmdRollback();
+      break;
+    case "health":
+      await cmdHealth(positionals[0] === "--json");
+      break;
+    case "plan-topology":
+      cmdEnterpriseTopologyPlan(positionals[0], positionals.includes("--json"));
+      break;
+    case "validate-topology":
+      cmdEnterpriseTopologyValidate(positionals[0], positionals.includes("--json"));
+      break;
+    case "upgrade":
+      await cmdUpgrade(positionals[0]);
+      break;
+    case "upgrade-deps":
+      await cmdUpgradeDeps();
+      break;
+    case "backup":
+      await cmdBackup();
+      break;
+    case "restore":
+      await cmdRestore(positionals[0] ?? "", args.includes("--deploy"));
+      break;
+    default:
+      console.error(chalk.red(`Unknown command: ${command}`));
+      console.log(renderHelpBlock());
+      process.exit(1);
+  }
+}
+main().catch((err) => {
+  console.error(err instanceof Error ? err.message : err);
+  process.exit(1);
+});