@marcusrbrown/infra 0.13.12 → 0.13.14

package/dist/cli.js

@@ -6949,7 +6949,7 @@ import { goke } from "goke";
 // package.json
 var package_default = {
   name: "@marcusrbrown/infra",
-  version: "0.13.12",
+  version: "0.13.14",
   description: "Infrastructure management CLI \u2014 deploy automation, health checks, and MCP bridge",
   keywords: [
     "infra",
@@ -6985,7 +6985,7 @@ var package_default = {
   },
   dependencies: {
     "@clack/prompts": "^1.2.0",
-    "@goke/mcp": "^0.0.10",
+    "@goke/mcp": "^0.0.11",
     goke: "^6.3.2",
     "string-dedent": "^3.0.2",
     zod: "^4.3.6"
@@ -7004,6 +7004,329 @@ var package_default = {
   }
 };
 
+// src/commands/broker/deploy.ts
+import { existsSync as existsSync2 } from "fs";
+import { join as join2 } from "path";
+import { z } from "zod";
+
+// src/lib/repo-root.ts
+import { existsSync, readFileSync } from "fs";
+import { dirname, join } from "path";
+var WORKSPACE_MARKER_NAME = "@marcusrbrown/infra-workspace";
+function findRepoRoot(start) {
+  let current = start ?? import.meta.dir;
+  while (true) {
+    const candidate = join(current, "package.json");
+    if (existsSync(candidate)) {
+      try {
+        const pkg = JSON.parse(readFileSync(candidate, "utf-8"));
+        if (pkg.name === WORKSPACE_MARKER_NAME) {
+          return current;
+        }
+      } catch {}
+    }
+    const parent = dirname(current);
+    if (parent === current) {
+      break;
+    }
+    current = parent;
+  }
+  throw new Error(`Workspace root not found: could not locate a package.json with name "${WORKSPACE_MARKER_NAME}" ` + `in any ancestor of "${start ?? import.meta.dir}". ` + `These commands require a source checkout of the marcusrbrown/infra monorepo.`);
+}
+
+// src/commands/broker/deploy.ts
+var REPO = "marcusrbrown/infra";
+var WORKFLOW_NAME = "Deploy Broker";
+var WORKFLOW_URL = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-broker.yaml";
+function resolveLocalDeployScriptPath() {
+  return join2(findRepoRoot(), "apps", "broker", "src", "deploy.ts");
+}
+function getLocalDeployEnv() {
+  const path = process.env.PATH;
+  const home = process.env.HOME;
+  const sshAuthSock = process.env.SSH_AUTH_SOCK;
+  if (!path) {
+    throw new Error("PATH is required for local deploy");
+  }
+  if (!home) {
+    throw new Error("HOME is required for local deploy");
+  }
+  if (!sshAuthSock) {
+    throw new Error("SSH_AUTH_SOCK is required for local deploy. Start ssh-agent and load your deploy key first.");
+  }
+  return {
+    PATH: path,
+    HOME: home,
+    SSH_AUTH_SOCK: sshAuthSock,
+    BROKER_DOMAIN: process.env.BROKER_DOMAIN ?? "",
+    BROKER_HOST: process.env.BROKER_HOST ?? "",
+    CLIPROXY_MANAGEMENT_KEY: process.env.CLIPROXY_MANAGEMENT_KEY ?? "",
+    BROKER_AUD: process.env.BROKER_AUD ?? ""
+  };
+}
+function validateLocalPreconditions() {
+  const deployScriptPath = resolveLocalDeployScriptPath();
+  if (!existsSync2(deployScriptPath)) {
+    throw new Error(`Local deploy script not found at expected path: ${deployScriptPath}`);
+  }
+  getLocalDeployEnv();
+  return { deployScriptPath };
+}
+function validateRemotePreconditions() {
+  if (!Bun.which("gh")) {
+    throw new Error("gh CLI is required for remote deploy. Install gh and run `gh auth login`.");
+  }
+}
+function registerBrokerDeploy(cli) {
+  cli.command("broker deploy", "Deploy the credential broker. Default mode triggers the GitHub Deploy Broker workflow, while --local runs apps/broker/src/deploy.ts directly with Bun.").option("--local", z.boolean().default(false).describe("Run local deployment with Bun using apps/broker/src/deploy.ts instead of triggering GitHub Actions.")).option("--dry-run", z.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra broker deploy").example("# Validate local deploy preconditions and planned command").example("infra broker deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra broker deploy --local").action(async (options) => {
+    if (options.local) {
+      const { deployScriptPath } = validateLocalPreconditions();
+      const env = getLocalDeployEnv();
+      const command = ["bun", deployScriptPath];
+      if (options.dryRun) {
+        console.log("Dry run: local broker deploy");
+        console.log(`- deploy script: ${deployScriptPath}`);
+        console.log(`- command: ${command.join(" ")}`);
+        console.log(`- BROKER_DOMAIN=${env.BROKER_DOMAIN || "(unset)"}`);
+        return;
+      }
+      const child2 = Bun.spawn(command, {
+        env,
+        stdout: "inherit",
+        stderr: "inherit"
+      });
+      const exitCode2 = await child2.exited;
+      if (exitCode2 !== 0) {
+        throw new Error(`Local deploy failed with exit code ${exitCode2}`);
+      }
+      return;
+    }
+    validateRemotePreconditions();
+    if (options.dryRun) {
+      console.log("Dry run: remote broker deploy");
+      console.log(`- command: gh workflow run "${WORKFLOW_NAME}" --repo ${REPO}`);
+      console.log(`- workflow URL: ${WORKFLOW_URL}`);
+      return;
+    }
+    const child = Bun.spawn(["gh", "workflow", "run", WORKFLOW_NAME, "--repo", REPO], {
+      stdout: "inherit",
+      stderr: "inherit"
+    });
+    const exitCode = await child.exited;
+    if (exitCode !== 0) {
+      throw new Error(`Failed to trigger "${WORKFLOW_NAME}" workflow (exit code ${exitCode})`);
+    }
+    console.log(`Workflow triggered: ${WORKFLOW_URL}`);
+    console.log("Approve the broker environment deployment in GitHub Actions to continue.");
+  });
+}
+
+// src/commands/broker/logs.ts
+import { z as z2 } from "zod";
+
+// src/lib/known-hosts.ts
+import { existsSync as existsSync3 } from "fs";
+import { join as join3, resolve } from "path";
+
+// src/resources/known_hosts
+var known_hosts_default = "./known_hosts-c3ns9jne.";
+
+// src/lib/known-hosts.ts
+var FAIL_CLOSED_ERROR = "Pinned SSH known_hosts file not found; reinstall @marcusrbrown/infra or run from the repo checkout";
+function resolveKnownHostsPath(libDir) {
+  const dir = libDir ?? import.meta.dir;
+  const repoRoot = resolve(dir, "..", "..", "..", "..");
+  const repoCandidate = join3(repoRoot, ".github", "known_hosts");
+  if (existsSync3(repoCandidate))
+    return repoCandidate;
+  if (existsSync3(known_hosts_default))
+    return known_hosts_default;
+  throw new Error(FAIL_CLOSED_ERROR);
+}
+function buildKnownHostsArgs(libDir) {
+  const path = resolveKnownHostsPath(libDir);
+  return ["-o", `UserKnownHostsFile=${path}`];
+}
+
+// src/commands/broker/host.ts
+var VALID_HOST_RE = /^[a-z\d][a-z\d.\-]*$/i;
+function validateBrokerHost(host) {
+  if (!host) {
+    throw new Error("Invalid BROKER_HOST: value is empty");
+  }
+  if (!VALID_HOST_RE.test(host)) {
+    const excerpt = host.slice(0, 30).replaceAll(/[^\u0020-\u007E]/g, "?");
+    throw new Error(`Invalid BROKER_HOST: "${excerpt}" \u2014 must match ${String.raw`[A-Za-z0-9][A-Za-z0-9.\-]*`}`);
+  }
+  return host;
+}
+
+// src/commands/broker/logs.ts
+var SENSITIVE_WARNING = "Warning: Logs may contain run identities, minted key prefixes, or other sensitive broker information. Treat output as sensitive; do not capture in shared logs or chat.";
+function defaultLogsSpawn(cmd, opts) {
+  return Bun.spawn(cmd, opts);
+}
+async function streamBrokerLogs(opts, spawn = defaultLogsSpawn, printOut, printErr) {
+  const isCI = process.env.CI === "true";
+  if (isCI && !opts.allowCi) {
+    const msg = "Refusing to stream logs in CI without --allow-ci. Logs may contain sensitive broker data.";
+    if (printOut) {
+      printOut(msg);
+    } else {
+      console.log(msg);
+    }
+    return { refused: true };
+  }
+  if (printErr) {
+    printErr(SENSITIVE_WARNING);
+  } else {
+    console.error(SENSITIVE_WARNING);
+  }
+  validateBrokerHost(opts.host);
+  const sshCmd = [
+    "ssh",
+    "-o",
+    "BatchMode=yes",
+    "-o",
+    "StrictHostKeyChecking=yes",
+    ...buildKnownHostsArgs(),
+    `root@${opts.host}`,
+    `docker compose -f /opt/broker/docker-compose.yaml logs ${opts.service} --no-log-prefix --tail ${opts.tail}`
+  ];
+  const env = {
+    PATH: process.env.PATH ?? "/usr/bin:/bin",
+    HOME: process.env.HOME ?? "/tmp",
+    ...process.env.SSH_AUTH_SOCK ? { SSH_AUTH_SOCK: process.env.SSH_AUTH_SOCK } : {}
+  };
+  const child = spawn(sshCmd, { env, stdout: "inherit", stderr: "inherit" });
+  const exitCode = await child.exited;
+  return { refused: false, exitCode };
+}
+function registerBrokerLogs(cli) {
+  cli.command("broker logs", "Stream credential broker service logs via SSH.").option("--tail [n]", z2.number().default(100).describe("Number of log lines to tail.")).option("--service [service]", z2.string().default("broker").describe("Docker Compose service name to stream logs from.")).option("--allow-ci", z2.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive broker data.")).option("--key [key]", z2.string().describe("Environment variable name holding the SSH host. Falls back to BROKER_HOST when omitted.")).action(async (options) => {
+    const hostEnvKey = options.key ?? "BROKER_HOST";
+    const host = process.env[hostEnvKey] ?? process.env.BROKER_DOMAIN;
+    if (!host) {
+      console.error(`Broker host not set. Export ${hostEnvKey} or pass --key <env-name> pointing to a set variable.`);
+      process.exitCode = 1;
+      return;
+    }
+    const tail = typeof options.tail === "number" ? options.tail : 100;
+    const service = typeof options.service === "string" ? options.service : "broker";
+    const allowCi = options.allowCi === true;
+    const result = await streamBrokerLogs({ host, tail, service, allowCi });
+    if (result.refused) {
+      process.exitCode = 1;
+      return;
+    }
+    if (result.exitCode !== 0) {
+      process.exitCode = result.exitCode ?? 1;
+    }
+  });
+}
+
+// src/commands/broker/status.ts
+import { z as z3 } from "zod";
+var DEFAULT_BROKER_URL = "https://broker.fro.bot";
+var HTTP_TIMEOUT_MS = 1e4;
+async function checkBrokerHealth(baseUrl) {
+  const url = `${baseUrl}/healthz`;
+  const startedAt = performance.now();
+  try {
+    const response = await fetch(url, {
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS)
+    });
+    const elapsedMs = Math.max(0, Math.round(performance.now() - startedAt));
+    return {
+      ok: response.ok,
+      summary: `GET ${url} \u2192 ${response.status} (${elapsedMs}ms)`
+    };
+  } catch (error) {
+    const elapsedMs = Math.max(0, Math.round(performance.now() - startedAt));
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      ok: false,
+      summary: `Request failed after ${elapsedMs}ms: ${message}`
+    };
+  }
+}
+async function getBrokerStatusSummary(host) {
+  if (!host) {
+    return {
+      app: "broker",
+      http: "\u2014 (host not set)",
+      lastDeploy: "\u2014",
+      version: "\u2014",
+      contentHash: "\u2014",
+      usageStats: "\u2014"
+    };
+  }
+  const baseUrl = `https://${host}`;
+  const health = await checkBrokerHealth(baseUrl);
+  return {
+    app: "broker",
+    http: health.ok ? `OK: ${health.summary}` : `ERROR: ${health.summary}`,
+    lastDeploy: "\u2014",
+    version: "\u2014",
+    contentHash: "\u2014",
+    usageStats: "\u2014"
+  };
+}
+async function brokerStatusAction(options, ctx) {
+  let errorCount = 0;
+  try {
+    const hostEnvKey = options.key ?? "BROKER_HOST";
+    const hostFromEnv = process.env[hostEnvKey] ?? process.env.BROKER_DOMAIN ?? process.env.BROKER_HOST;
+    const baseUrl = options.url ?? hostFromEnv ?? DEFAULT_BROKER_URL;
+    if (!options.url && !hostFromEnv) {
+      ctx.console.log("Broker status");
+      ctx.console.log("");
+      ctx.console.error("[WARN] Broker host not set. Export BROKER_DOMAIN or BROKER_HOST, or pass --url. Skipping health check.");
+      ctx.process.exit(1);
+      return;
+    }
+    try {
+      const urlObj = new URL(baseUrl.startsWith("http") ? baseUrl : `https://${baseUrl}`);
+      validateBrokerHost(urlObj.hostname);
+    } catch (error) {
+      ctx.console.error(error instanceof Error ? error.message : String(error));
+      ctx.process.exit(1);
+      return;
+    }
+    ctx.console.log("Broker status");
+    ctx.console.log("");
+    const health = await checkBrokerHealth(baseUrl.startsWith("http") ? baseUrl : `https://${baseUrl}`);
+    if (health.ok) {
+      ctx.console.log(`[OK] HTTP reachability`);
+      ctx.console.log(`  ${health.summary}`);
+    } else {
+      ctx.console.log(`[ERROR] HTTP reachability`);
+      ctx.console.log(`  ${health.summary}`);
+      errorCount++;
+    }
+    ctx.console.log("");
+    ctx.console.log(`Summary: 1 check, ${errorCount} errors, 0 warnings`);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    ctx.console.error(message);
+    ctx.process.exit(1);
+    return;
+  }
+  if (errorCount > 0) {
+    ctx.process.exit(1);
+  }
+}
+function registerBrokerStatus(cli) {
+  cli.command("broker status", "Show operational health of the credential broker.").option("--url [url]", z3.string().describe("Base URL for broker health checks. Falls back to BROKER_DOMAIN, BROKER_HOST, or https://broker.fro.bot.")).option("--key [key]", z3.string().describe("Environment variable name holding the broker host. Falls back to BROKER_DOMAIN when omitted.")).option("--verbose", "Enable verbose output for all commands").action(brokerStatusAction);
+}
+
+// src/commands/broker/index.ts
+function registerBrokerCommands(cli) {
+  registerBrokerStatus(cli);
+  registerBrokerDeploy(cli);
+  registerBrokerLogs(cli);
+}
+
 // src/commands/cliproxy/config.ts
 import { chmodSync } from "fs";
 
@@ -7054,7 +7377,7 @@ var $visit = visit.visit;
 var $visitAsync = visit.visitAsync;
 
 // ../shared/cliproxy/management.ts
-var HTTP_TIMEOUT_MS = 1e4;
+var HTTP_TIMEOUT_MS2 = 1e4;
 function toStringArray(payload) {
   if (Array.isArray(payload)) {
     return payload.filter((item) => typeof item === "string");
@@ -7093,7 +7416,7 @@ function managementHeaders(key) {
 async function requestJson(endpoint, init) {
   const response = await fetch(endpoint, {
     ...init,
-    signal: AbortSignal.timeout(HTTP_TIMEOUT_MS)
+    signal: AbortSignal.timeout(HTTP_TIMEOUT_MS2)
   });
   if (!response.ok) {
     const body = await response.text();
@@ -7110,7 +7433,7 @@ async function requestJson(endpoint, init) {
 }
 
 // src/commands/cliproxy/config.ts
-import { z } from "zod";
+import { z as z4 } from "zod";
 var DEFAULT_CLIPROXY_URL = "https://cliproxy.fro.bot";
 function stripTrailingSlash(value) {
   return value.endsWith("/") ? value.slice(0, -1) : value;
@@ -7242,48 +7565,21 @@ async function cliproxyConfigSetAction(field, value, options, ctx) {
   }
 }
 function registerCliproxyConfig(cli) {
-  cli.command("cliproxy config get", "Fetch current CLIProxyAPI config as JSON.").option("--url [url]", z.string().describe("Base URL for CLIProxyAPI management requests. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.")).option("--key [key]", z.string().describe("Management API key. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.")).option("--output [file]", z.string().describe("Write config JSON to a file instead of stdout. File permissions set to 0600 (owner-read-only).")).option("--json", "Output raw JSON instead of aligned key: value columns.").action(cliproxyConfigGetAction);
-  cli.command("cliproxy config set <field> <value>", "Update a mutable CLIProxyAPI config field via its dedicated management endpoint.").option("--url [url]", z.string().describe("Base URL for CLIProxyAPI management requests. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.")).option("--key [key]", z.string().describe("Management API key. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.")).example("infra cliproxy config set debug true").example("infra cliproxy config set request-retry 5").example("infra cliproxy config set proxy-url https://proxy.example.com").action(cliproxyConfigSetAction);
+  cli.command("cliproxy config get", "Fetch current CLIProxyAPI config as JSON.").option("--url [url]", z4.string().describe("Base URL for CLIProxyAPI management requests. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.")).option("--key [key]", z4.string().describe("Management API key. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.")).option("--output [file]", z4.string().describe("Write config JSON to a file instead of stdout. File permissions set to 0600 (owner-read-only).")).option("--json", "Output raw JSON instead of aligned key: value columns.").action(cliproxyConfigGetAction);
+  cli.command("cliproxy config set <field> <value>", "Update a mutable CLIProxyAPI config field via its dedicated management endpoint.").option("--url [url]", z4.string().describe("Base URL for CLIProxyAPI management requests. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.")).option("--key [key]", z4.string().describe("Management API key. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.")).example("infra cliproxy config set debug true").example("infra cliproxy config set request-retry 5").example("infra cliproxy config set proxy-url https://proxy.example.com").action(cliproxyConfigSetAction);
 }
 
 // src/commands/cliproxy/deploy.ts
-import { existsSync as existsSync2 } from "fs";
-import { join as join2 } from "path";
-import { z as z2 } from "zod";
-
-// src/lib/repo-root.ts
-import { existsSync, readFileSync } from "fs";
-import { dirname, join } from "path";
-var WORKSPACE_MARKER_NAME = "@marcusrbrown/infra-workspace";
-function findRepoRoot(start) {
-  let current = start ?? import.meta.dir;
-  while (true) {
-    const candidate = join(current, "package.json");
-    if (existsSync(candidate)) {
-      try {
-        const pkg = JSON.parse(readFileSync(candidate, "utf-8"));
-        if (pkg.name === WORKSPACE_MARKER_NAME) {
-          return current;
-        }
-      } catch {}
-    }
-    const parent = dirname(current);
-    if (parent === current) {
-      break;
-    }
-    current = parent;
-  }
-  throw new Error(`Workspace root not found: could not locate a package.json with name "${WORKSPACE_MARKER_NAME}" ` + `in any ancestor of "${start ?? import.meta.dir}". ` + `These commands require a source checkout of the marcusrbrown/infra monorepo.`);
-}
-
-// src/commands/cliproxy/deploy.ts
-var REPO = "marcusrbrown/infra";
-var WORKFLOW_NAME = "Deploy CLIProxy";
-var WORKFLOW_URL = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-cliproxy.yaml";
-function resolveLocalDeployScriptPath() {
-  return join2(findRepoRoot(), "apps", "cliproxy", "src", "deploy.ts");
+import { existsSync as existsSync4 } from "fs";
+import { join as join4 } from "path";
+import { z as z5 } from "zod";
+var REPO2 = "marcusrbrown/infra";
+var WORKFLOW_NAME2 = "Deploy CLIProxy";
+var WORKFLOW_URL2 = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-cliproxy.yaml";
+function resolveLocalDeployScriptPath2() {
+  return join4(findRepoRoot(), "apps", "cliproxy", "src", "deploy.ts");
 }
-function getLocalDeployEnv() {
+function getLocalDeployEnv2() {
   const path = process.env.PATH;
   const home = process.env.HOME;
   const sshAuthSock = process.env.SSH_AUTH_SOCK;
@@ -7304,24 +7600,24 @@ function getLocalDeployEnv() {
     CLIPROXY_MANAGEMENT_KEY: process.env.CLIPROXY_MANAGEMENT_KEY ?? ""
   };
 }
-function validateLocalPreconditions() {
-  const deployScriptPath = resolveLocalDeployScriptPath();
-  if (!existsSync2(deployScriptPath)) {
+function validateLocalPreconditions2() {
+  const deployScriptPath = resolveLocalDeployScriptPath2();
+  if (!existsSync4(deployScriptPath)) {
     throw new Error(`Local deploy script not found at expected path: ${deployScriptPath}`);
   }
-  getLocalDeployEnv();
+  getLocalDeployEnv2();
   return { deployScriptPath };
 }
-function validateRemotePreconditions() {
+function validateRemotePreconditions2() {
   if (!Bun.which("gh")) {
     throw new Error("gh CLI is required for remote deploy. Install gh and run `gh auth login`.");
   }
 }
 function registerCliproxyDeploy(cli) {
-  cli.command("cliproxy deploy", "Deploy CLIProxyAPI. Default mode triggers the GitHub Deploy CLIProxy workflow, while --local runs apps/cliproxy/src/deploy.ts directly with Bun.").option("--local", z2.boolean().default(false).describe("Run local deployment with Bun using apps/cliproxy/src/deploy.ts instead of triggering GitHub Actions.")).option("--force-config", z2.boolean().default(false).describe("Force upload config.yaml even if it exists on the server. WARNING: overwrites runtime API keys and settings.")).option("--dry-run", z2.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra cliproxy deploy").example("# Validate local deploy preconditions and planned command").example("infra cliproxy deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra cliproxy deploy --local").action(async (options) => {
+  cli.command("cliproxy deploy", "Deploy CLIProxyAPI. Default mode triggers the GitHub Deploy CLIProxy workflow, while --local runs apps/cliproxy/src/deploy.ts directly with Bun.").option("--local", z5.boolean().default(false).describe("Run local deployment with Bun using apps/cliproxy/src/deploy.ts instead of triggering GitHub Actions.")).option("--force-config", z5.boolean().default(false).describe("Force upload config.yaml even if it exists on the server. WARNING: overwrites runtime API keys and settings.")).option("--dry-run", z5.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra cliproxy deploy").example("# Validate local deploy preconditions and planned command").example("infra cliproxy deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra cliproxy deploy --local").action(async (options) => {
     if (options.local) {
-      const { deployScriptPath } = validateLocalPreconditions();
-      const env = getLocalDeployEnv();
+      const { deployScriptPath } = validateLocalPreconditions2();
+      const env = getLocalDeployEnv2();
       const command = ["bun", deployScriptPath, ...options.forceConfig ? ["--force-config"] : []];
       if (options.dryRun) {
         console.log("Dry run: local CLIProxyAPI deploy");
@@ -7344,28 +7640,28 @@ function registerCliproxyDeploy(cli) {
       }
       return;
     }
-    validateRemotePreconditions();
+    validateRemotePreconditions2();
     if (options.dryRun) {
       console.log("Dry run: remote CLIProxyAPI deploy");
-      console.log(`- command: gh workflow run ${WORKFLOW_NAME} --repo ${REPO}`);
-      console.log(`- workflow URL: ${WORKFLOW_URL}`);
+      console.log(`- command: gh workflow run ${WORKFLOW_NAME2} --repo ${REPO2}`);
+      console.log(`- workflow URL: ${WORKFLOW_URL2}`);
       return;
     }
-    const child = Bun.spawn(["gh", "workflow", "run", WORKFLOW_NAME, "--repo", REPO], {
+    const child = Bun.spawn(["gh", "workflow", "run", WORKFLOW_NAME2, "--repo", REPO2], {
       stdout: "inherit",
       stderr: "inherit"
     });
     const exitCode = await child.exited;
     if (exitCode !== 0) {
-      throw new Error(`Failed to trigger ${WORKFLOW_NAME} workflow (exit code ${exitCode})`);
+      throw new Error(`Failed to trigger ${WORKFLOW_NAME2} workflow (exit code ${exitCode})`);
     }
-    console.log(`Workflow triggered: ${WORKFLOW_URL}`);
+    console.log(`Workflow triggered: ${WORKFLOW_URL2}`);
     console.log("Approve the cliproxy environment deployment in GitHub Actions to continue.");
   });
 }
 
 // src/commands/cliproxy/keys.ts
-import { z as z3 } from "zod";
+import { z as z6 } from "zod";
 var DEFAULT_CLIPROXY_URL2 = "https://cliproxy.fro.bot";
 function stripTrailingSlash2(value) {
   return value.endsWith("/") ? value.slice(0, -1) : value;
@@ -7453,21 +7749,21 @@ async function cliproxyKeysRemoveAction(apiKeyToRemove, options, ctx) {
   }
 }
 function registerCliproxyKeys(cli) {
-  cli.command("cliproxy keys list", "List CLIProxyAPI API keys from the management API.").option("--url [url]", z3.string().describe("Base URL for CLIProxyAPI management requests. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.")).option("--key [key]", z3.string().describe("Management API key. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.")).option("--json", "Output raw JSON array instead of a numbered list.").action(cliproxyKeysListAction);
-  cli.command("cliproxy keys add <key>", "Add an API key by fetching current keys, appending the value, and replacing full key set.").option("--url [url]", z3.string().describe("Base URL for CLIProxyAPI management requests. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.")).option("--key [key]", z3.string().describe("Management API key. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.")).example("# Add a new API key to the current key set").example("infra cliproxy keys add sk-live-123").action(cliproxyKeysAddAction);
-  cli.command("cliproxy keys remove <key>", "Remove an API key via management API endpoint query parameter.").option("--url [url]", z3.string().describe("Base URL for CLIProxyAPI management requests. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.")).option("--key [key]", z3.string().describe("Management API key. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.")).example("# Remove an API key from CLIProxyAPI").example("infra cliproxy keys remove sk-live-123").action(cliproxyKeysRemoveAction);
+  cli.command("cliproxy keys list", "List CLIProxyAPI API keys from the management API.").option("--url [url]", z6.string().describe("Base URL for CLIProxyAPI management requests. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.")).option("--key [key]", z6.string().describe("Management API key. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.")).option("--json", "Output raw JSON array instead of a numbered list.").action(cliproxyKeysListAction);
+  cli.command("cliproxy keys add <key>", "Add an API key by fetching current keys, appending the value, and replacing full key set.").option("--url [url]", z6.string().describe("Base URL for CLIProxyAPI management requests. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.")).option("--key [key]", z6.string().describe("Management API key. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.")).example("# Add a new API key to the current key set").example("infra cliproxy keys add sk-live-123").action(cliproxyKeysAddAction);
+  cli.command("cliproxy keys remove <key>", "Remove an API key via management API endpoint query parameter.").option("--url [url]", z6.string().describe("Base URL for CLIProxyAPI management requests. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.")).option("--key [key]", z6.string().describe("Management API key. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.")).example("# Remove an API key from CLIProxyAPI").example("infra cliproxy keys remove sk-live-123").action(cliproxyKeysRemoveAction);
 }
 
 // src/commands/cliproxy/login.ts
-import { z as z4 } from "zod";
+import { z as z7 } from "zod";
 
 // src/commands/cliproxy/host.ts
-var VALID_HOST_RE = /^[a-z\d][a-z\d.\-]*$/i;
+var VALID_HOST_RE2 = /^[a-z\d][a-z\d.\-]*$/i;
 function validateCliproxyHost(host) {
   if (!host) {
     throw new Error("Invalid CLIPROXY_DOMAIN: value is empty");
   }
-  if (!VALID_HOST_RE.test(host)) {
+  if (!VALID_HOST_RE2.test(host)) {
     const excerpt = host.slice(0, 30).replaceAll(/[^\u0020-\u007E]/g, "?");
     throw new Error(`Invalid CLIPROXY_DOMAIN: "${excerpt}" \u2014 must match ${String.raw`[A-Za-z0-9][A-Za-z0-9.\-]*`}`);
   }
@@ -7544,22 +7840,22 @@ async function cliproxyLoginAction(provider, options, spawnFn = Bun.spawn) {
   console.log("If an OAuth URL was printed above, open it in your browser to complete login.");
 }
 function registerCliproxyLogin(cli) {
-  cli.command("cliproxy login <provider>", `Run provider login on the remote CLIProxyAPI host. Supported providers: ${SUPPORTED_PROVIDERS_DISPLAY}.`).option("--host [host]", z4.string().describe("CLIProxyAPI droplet host for SSH execution. Falls back to CLIPROXY_DOMAIN or cliproxy.fro.bot.")).example("# Start Claude login flow on remote CLIProxyAPI instance").example("infra cliproxy login claude").example("# Start ChatGPT Pro login flow via device-code").example("infra cliproxy login codex").action((provider, options) => cliproxyLoginAction(provider, options));
+  cli.command("cliproxy login <provider>", `Run provider login on the remote CLIProxyAPI host. Supported providers: ${SUPPORTED_PROVIDERS_DISPLAY}.`).option("--host [host]", z7.string().describe("CLIProxyAPI droplet host for SSH execution. Falls back to CLIPROXY_DOMAIN or cliproxy.fro.bot.")).example("# Start Claude login flow on remote CLIProxyAPI instance").example("infra cliproxy login claude").example("# Start ChatGPT Pro login flow via device-code").example("infra cliproxy login codex").action((provider, options) => cliproxyLoginAction(provider, options));
 }
 
 // src/commands/cliproxy/models.ts
-import { z as z5 } from "zod";
+import { z as z8 } from "zod";
 var DEFAULT_CLIPROXY_URL3 = "https://cliproxy.fro.bot";
 function stripTrailingSlash3(value) {
   return value.endsWith("/") ? value.slice(0, -1) : value;
 }
-var modelEntrySchema = z5.object({
-  id: z5.string(),
-  owned_by: z5.string().optional(),
-  created: z5.number().optional()
+var modelEntrySchema = z8.object({
+  id: z8.string(),
+  owned_by: z8.string().optional(),
+  created: z8.number().optional()
 }).passthrough();
-var modelsResponseSchema = z5.object({
-  data: z5.array(modelEntrySchema)
+var modelsResponseSchema = z8.object({
+  data: z8.array(modelEntrySchema)
 }).passthrough();
 var PROVIDER_ID_PATTERNS = {
   openai: /^(?:gpt-|o1-|o3-|codex)/i,
@@ -7665,11 +7961,11 @@ async function cliproxyModelsAction(options, ctx) {
   }
 }
 function registerCliproxyModels(cli) {
-  cli.command("cliproxy models [provider]", "List the models CLIProxyAPI serves.").option("--url [url]", z5.string().describe("Base URL for CLIProxyAPI. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.")).option("--key [key]", z5.string().describe("API key (bearer). Falls back to CLIPROXY_API_KEY when omitted.")).option("--verbose", "Show owned_by and created date for each model.").example("# List all models served by CLIProxyAPI").example("infra cliproxy models").example("# Filter to Anthropic models only").example("infra cliproxy models anthropic").example("# Show verbose output with owned_by and created date").example("infra cliproxy models --verbose").example("# Filter to OpenAI models with verbose output").example("infra cliproxy models openai --verbose").action((provider, options, ctx) => cliproxyModelsAction({ ...options, provider }, ctx));
+  cli.command("cliproxy models [provider]", "List the models CLIProxyAPI serves.").option("--url [url]", z8.string().describe("Base URL for CLIProxyAPI. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.")).option("--key [key]", z8.string().describe("API key (bearer). Falls back to CLIPROXY_API_KEY when omitted.")).option("--verbose", "Show owned_by and created date for each model.").example("# List all models served by CLIProxyAPI").example("infra cliproxy models").example("# Filter to Anthropic models only").example("infra cliproxy models anthropic").example("# Show verbose output with owned_by and created date").example("infra cliproxy models --verbose").example("# Filter to OpenAI models with verbose output").example("infra cliproxy models openai --verbose").action((provider, options, ctx) => cliproxyModelsAction({ ...options, provider }, ctx));
 }
 
 // src/commands/cliproxy/open.ts
-import { z as z6 } from "zod";
+import { z as z9 } from "zod";
 var DEFAULT_HOST2 = "cliproxy.fro.bot";
 var DEFAULT_REMOTE_USER2 = "root";
 function resolveHost2(input) {
@@ -7680,7 +7976,7 @@ function resolveHost2(input) {
   return host;
 }
 function registerCliproxyOpen(cli) {
-  cli.command("cliproxy open", "Launch CLIProxyAPI TUI dashboard via SSH.").option("--host [host]", z6.string().describe("SSH host for CLIProxyAPI server. Falls back to CLIPROXY_DOMAIN or cliproxy.fro.bot.")).example("# Open the TUI dashboard on the remote CLIProxyAPI instance").example("infra cliproxy open").example("# Open on a custom host").example("infra cliproxy open --host custom.example.com").action(async (options) => {
+  cli.command("cliproxy open", "Launch CLIProxyAPI TUI dashboard via SSH.").option("--host [host]", z9.string().describe("SSH host for CLIProxyAPI server. Falls back to CLIPROXY_DOMAIN or cliproxy.fro.bot.")).example("# Open the TUI dashboard on the remote CLIProxyAPI instance").example("infra cliproxy open").example("# Open on a custom host").example("infra cliproxy open --host custom.example.com").action(async (options) => {
     const host = validateCliproxyHost(resolveHost2(options.host));
     if (!process.stdin.isTTY) {
       throw new Error("cliproxy open requires an interactive terminal. Run from a shell with TTY attached.");
@@ -7721,7 +8017,7 @@ function registerCliproxyOpen(cli) {
 
 // src/commands/cliproxy/setup.ts
 import { cancel as cancel2, confirm as confirm2, intro, log as log2, note, outro, select as select2, text as text3 } from "@clack/prompts";
-import { z as z11 } from "zod";
+import { z as z14 } from "zod";
 
 // src/commands/cliproxy/setup/gh.ts
 import { confirm, log, spinner } from "@clack/prompts";
@@ -7875,10 +8171,10 @@ async function assertGhAuthenticated() {
   }
 }
 async function assertRepoAccess(repo) {
-  const { z: z7 } = await import("zod");
-  const ghRepoViewSchema = z7.object({
-    nameWithOwner: z7.string(),
-    viewerPermission: z7.string()
+  const { z: z10 } = await import("zod");
+  const ghRepoViewSchema = z10.object({
+    nameWithOwner: z10.string(),
+    viewerPermission: z10.string()
   });
   const result = await runGh(["repo", "view", repo, "--json", "nameWithOwner,viewerPermission"]);
   if (result.exitCode !== 0) {
@@ -7891,8 +8187,8 @@ async function assertRepoAccess(repo) {
   }
 }
 async function listExistingGhNames(repo, kind) {
-  const { z: z7 } = await import("zod");
-  const ghNameListSchema = z7.array(z7.object({ name: z7.string() }));
+  const { z: z10 } = await import("zod");
+  const ghNameListSchema = z10.array(z10.object({ name: z10.string() }));
   const result = await runGh([kind, "list", "--repo", repo, "--json", "name"]);
   if (result.exitCode !== 0) {
     throw new Error(`Unable to list existing GitHub ${kind}s for ${repo}. ${result.stderr.trim()}`.trim());
@@ -7978,8 +8274,8 @@ function formatDryRunPreview(opts) {
 
 // src/commands/cliproxy/setup/providers.ts
 import { isCancel as isCancel2, multiselect, select, text as text2 } from "@clack/prompts";
-import { z as z7 } from "zod";
-var providerIdSchema = z7.enum(["anthropic", "openai"]);
+import { z as z10 } from "zod";
+var providerIdSchema = z10.enum(["anthropic", "openai"]);
 var MODEL_ID_RE = /^(?:anthropic|openai)\/[a-z\d](?:[a-z\d.\-]*[a-z\d])?$/;
 function parseProviders(input) {
   const parts = input.split(",").map((p) => p.trim()).filter(Boolean);
@@ -8068,25 +8364,25 @@ async function promptForCustomModel() {
 }
 
 // src/commands/cliproxy/setup/smoke-test.ts
-import { z as z8 } from "zod";
-var baselineRunSchema = z8.array(z8.object({ databaseId: z8.number() }));
-var ghRunEntrySchema = z8.object({
-  databaseId: z8.number(),
-  status: z8.string(),
-  conclusion: z8.string().nullable(),
-  url: z8.string(),
-  createdAt: z8.string()
+import { z as z11 } from "zod";
+var baselineRunSchema = z11.array(z11.object({ databaseId: z11.number() }));
+var ghRunEntrySchema = z11.object({
+  databaseId: z11.number(),
+  status: z11.string(),
+  conclusion: z11.string().nullable(),
+  url: z11.string(),
+  createdAt: z11.string()
 });
 async function runSmokeTest(repo, _model, internals = {}) {
   const BACKOFF_MS = [5000, 15000, 30000, 60000, 60000];
   const delayFn = async (ms) => {
     if (internals._testDelayMs !== undefined) {
       if (internals._testDelayMs > 0) {
-        await new Promise((resolve) => setTimeout(resolve, internals._testDelayMs));
+        await new Promise((resolve2) => setTimeout(resolve2, internals._testDelayMs));
       }
       return;
     }
-    await new Promise((resolve) => setTimeout(resolve, ms));
+    await new Promise((resolve2) => setTimeout(resolve2, ms));
   };
   const repoUrl = `https://github.com/${repo}`;
   let baselineId = null;
@@ -8205,8 +8501,8 @@ async function runSmokeTest(repo, _model, internals = {}) {
 }
 
 // src/commands/cliproxy/setup/templates.ts
-import { z as z9 } from "zod";
-var harnessSchema = z9.enum(["opencode", "claude-code", "generic"]);
+import { z as z12 } from "zod";
+var harnessSchema = z12.enum(["opencode", "claude-code", "generic"]);
 var DEFAULT_CLIPROXY_URL4 = "https://cliproxy.fro.bot";
 function stripTrailingSlash4(value) {
   return value.endsWith("/") ? value.slice(0, -1) : value;
@@ -8297,16 +8593,16 @@ function collectCollisions(template, existingSecrets, existingVariables) {
 }
 
 // src/commands/cliproxy/setup/validation.ts
-import { z as z10 } from "zod";
-var modelEntrySchema2 = z10.object({
-  id: z10.string(),
-  owned_by: z10.string().optional()
+import { z as z13 } from "zod";
+var modelEntrySchema2 = z13.object({
+  id: z13.string(),
+  owned_by: z13.string().optional()
 }).passthrough();
-var modelsResponseSchema2 = z10.object({
-  data: z10.array(modelEntrySchema2)
+var modelsResponseSchema2 = z13.object({
+  data: z13.array(modelEntrySchema2)
 }).passthrough();
 var MODEL_ID_RE2 = /^(?:anthropic|openai)\/[a-z\d](?:[a-z\d.\-]*[a-z\d])?$/;
-var HTTP_TIMEOUT_MS2 = 1e4;
+var HTTP_TIMEOUT_MS3 = 1e4;
 var PROVIDER_ID_PATTERNS2 = {
   openai: /^(?:gpt-|o1-|o3-|codex)/i,
   anthropic: /^claude-/i
@@ -8378,7 +8674,7 @@ async function verifyModelsAvailable(baseUrl, key, providers, model) {
   try {
     parsed = modelsResponseSchema2.parse(json);
   } catch (error) {
-    const message = error instanceof z10.ZodError ? error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ") : extractErrorMessage3(error);
+    const message = error instanceof z13.ZodError ? error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ") : extractErrorMessage3(error);
     throw new Error(`Malformed /v1/models response: ${message}`);
   }
   const entries = parsed.data;
@@ -8401,7 +8697,7 @@ async function verifyModelsAvailable(baseUrl, key, providers, model) {
 async function assertProxyReachable(baseUrl) {
   try {
     const response = await fetch(`${baseUrl}/healthz`, {
-      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS2)
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS3)
     });
     if (!response.ok) {
       throw new Error(`Proxy check failed for ${baseUrl}: HTTP ${response.status}. Is the proxy running and reachable?`);
@@ -8419,7 +8715,7 @@ async function assertProxyKeyWorks(baseUrl, keyValue) {
       headers: {
         authorization: `Bearer ${keyValue}`
       },
-      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS2)
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS3)
     });
     if (!response.ok) {
       throw new Error(`Proxy key verification failed with HTTP ${response.status}`);
@@ -8924,13 +9220,13 @@ async function runSetupCommand(options, deps = {}) {
   }
 }
 function registerCliproxySetup(cli) {
-  cli.command("cliproxy setup", "Interactively onboard a GitHub repository to CLIProxyAPI by creating or reusing a key and wiring the required GitHub secrets and variables.").option("--key [key]", z11.string().describe("Existing CLIProxyAPI API key value. When provided, setup skips key creation and reuses this key for GitHub secrets.")).option("--repo [repo]", z11.string().describe("Target GitHub repository in owner/repo format. Skips the repository prompt when provided.")).option("--harness [harness]", harnessSchema.describe("Harness template to configure. Choose opencode, claude-code, or generic. Generic remains interactive-only.")).option("--providers [providers]", z11.string().describe("Comma-separated list of providers to enable. Default: anthropic. Supported values: anthropic, openai. Example: --providers anthropic,openai")).option("--model [model]", z11.string().regex(MODEL_ID_RE2).describe("Override the default model. Must be provider-prefixed and lowercase. Required when multiple providers selected. Examples: anthropic/claude-sonnet-4-6, openai/gpt-4o")).option("--force", z11.boolean().optional().describe("Overwrite existing GitHub secrets and variables without prompting.")).option("--dry-run", z11.boolean().optional().describe("Print the plan without applying any changes.")).option("--verify-smoke", z11.boolean().optional().describe("Run a smoke test against the proxy after setup completes.")).option("--ack-key-reuse", z11.boolean().default(false).describe("Acknowledge that --key matches the bearer token inside the existing OPENCODE_AUTH_JSON. Required in non-interactive mode when --key is supplied for a repo with existing OPENCODE_AUTH_JSON.")).example("# Preview planned actions without applying any changes (no flags required)").example("infra cliproxy setup --dry-run").example("# Run the interactive onboarding wizard").example("infra cliproxy setup").example("# Run non-interactively with an existing key (anthropic-only)").example("infra cliproxy setup --repo owner/repo --harness opencode --key sk-existing --force").example("# Enable both providers non-interactively (requires --force and --model)").example("infra cliproxy setup --repo owner/repo --harness opencode --providers anthropic,openai --model openai/gpt-5.4-mini --key sk-existing --ack-key-reuse --force").action(async (options, ctx) => {
+  cli.command("cliproxy setup", "Interactively onboard a GitHub repository to CLIProxyAPI by creating or reusing a key and wiring the required GitHub secrets and variables.").option("--key [key]", z14.string().describe("Existing CLIProxyAPI API key value. When provided, setup skips key creation and reuses this key for GitHub secrets.")).option("--repo [repo]", z14.string().describe("Target GitHub repository in owner/repo format. Skips the repository prompt when provided.")).option("--harness [harness]", harnessSchema.describe("Harness template to configure. Choose opencode, claude-code, or generic. Generic remains interactive-only.")).option("--providers [providers]", z14.string().describe("Comma-separated list of providers to enable. Default: anthropic. Supported values: anthropic, openai. Example: --providers anthropic,openai")).option("--model [model]", z14.string().regex(MODEL_ID_RE2).describe("Override the default model. Must be provider-prefixed and lowercase. Required when multiple providers selected. Examples: anthropic/claude-sonnet-4-6, openai/gpt-4o")).option("--force", z14.boolean().optional().describe("Overwrite existing GitHub secrets and variables without prompting.")).option("--dry-run", z14.boolean().optional().describe("Print the plan without applying any changes.")).option("--verify-smoke", z14.boolean().optional().describe("Run a smoke test against the proxy after setup completes.")).option("--ack-key-reuse", z14.boolean().default(false).describe("Acknowledge that --key matches the bearer token inside the existing OPENCODE_AUTH_JSON. Required in non-interactive mode when --key is supplied for a repo with existing OPENCODE_AUTH_JSON.")).example("# Preview planned actions without applying any changes (no flags required)").example("infra cliproxy setup --dry-run").example("# Run the interactive onboarding wizard").example("infra cliproxy setup").example("# Run non-interactively with an existing key (anthropic-only)").example("infra cliproxy setup --repo owner/repo --harness opencode --key sk-existing --force").example("# Enable both providers non-interactively (requires --force and --model)").example("infra cliproxy setup --repo owner/repo --harness opencode --providers anthropic,openai --model openai/gpt-5.4-mini --key sk-existing --ack-key-reuse --force").action(async (options, ctx) => {
     await runSetupCommand(options, { ctx });
   });
 }
 
 // src/commands/cliproxy/status.ts
-import { z as z12 } from "zod";
+import { z as z15 } from "zod";
 var DEFAULT_CLIPROXY_URL6 = "https://cliproxy.fro.bot";
 function levelLabel(level) {
   if (level === "ok") {
@@ -8961,7 +9257,7 @@ async function checkHttpReachability(url, verbose) {
   const startedAt = performance.now();
   try {
     const response = await fetch(url, {
-      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS)
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS2)
     });
     const elapsedMs = performance.now() - startedAt;
     const details = [];
@@ -8985,7 +9281,7 @@ async function checkHttpReachability(url, verbose) {
       title: "HTTP reachability",
       level: "error",
       summary: `Request failed after ${formatDurationMs(elapsedMs)}: ${message}`,
-      details: verbose ? [`URL: ${url}`, `Timeout: ${HTTP_TIMEOUT_MS}ms`] : undefined
+      details: verbose ? [`URL: ${url}`, `Timeout: ${HTTP_TIMEOUT_MS2}ms`] : undefined
     };
   }
 }
@@ -9012,7 +9308,7 @@ async function checkUsageStats(baseUrl, key) {
   try {
     const response = await fetch(endpoint, {
       headers: managementHeaders(key),
-      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS)
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS2)
     });
     if (response.status === 429) {
       return {
@@ -9064,7 +9360,7 @@ async function checkVersion(baseUrl, key) {
   try {
     const response = await fetch(endpoint, {
       headers: managementHeaders(key),
-      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS)
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS2)
     });
     if (response.status === 429) {
       return {
@@ -9114,7 +9410,7 @@ async function checkProviderAuth(baseUrl, apiKey, options) {
         messages: [{ role: "user", content: "ping" }],
         max_tokens: 1
       }),
-      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS)
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS2)
     });
     const details = [];
     if (verbose) {
@@ -9174,7 +9470,7 @@ async function probeManagementAuth(baseUrl, key) {
   try {
     const response = await fetch(endpoint, {
       headers: managementHeaders(key),
-      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS)
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS2)
     });
     if (response.ok) {
       return null;
@@ -9336,7 +9632,7 @@ async function cliproxyStatusAction(options, ctx) {
   }
 }
 function registerCliproxyStatus(cli) {
-  cli.command("cliproxy status", "Show operational health of CLIProxyAPI and its management endpoints.").option("--url [url]", z12.string().describe("Base URL for CLIProxyAPI health checks. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.")).option("--key [key]", z12.string().describe("Management API key. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.")).option("--api-key [key]", z12.string().describe("Downstream API key (bearer) for the upstream provider-auth probe. Falls back to CLIPROXY_API_KEY. Skipped when absent.")).option("--verbose", "Enable verbose output for all commands").action(cliproxyStatusAction);
+  cli.command("cliproxy status", "Show operational health of CLIProxyAPI and its management endpoints.").option("--url [url]", z15.string().describe("Base URL for CLIProxyAPI health checks. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.")).option("--key [key]", z15.string().describe("Management API key. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.")).option("--api-key [key]", z15.string().describe("Downstream API key (bearer) for the upstream provider-auth probe. Falls back to CLIPROXY_API_KEY. Skipped when absent.")).option("--verbose", "Enable verbose output for all commands").action(cliproxyStatusAction);
 }
 
 // src/commands/cliproxy/index.ts
@@ -9352,10 +9648,10 @@ function registerCliproxyCommands(cli) {
 }
 
 // src/commands/dashboard/deploy.ts
-import { z as z13 } from "zod";
-var REPO2 = "marcusrbrown/infra";
-var WORKFLOW_NAME2 = "Deploy Dashboard";
-var WORKFLOW_URL2 = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-dashboard.yaml";
+import { z as z16 } from "zod";
+var REPO3 = "marcusrbrown/infra";
+var WORKFLOW_NAME3 = "Deploy Dashboard";
+var WORKFLOW_URL3 = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-dashboard.yaml";
 var CALVER_RE = /^\d{4}\.\d{2}\.\d+$/;
 var DIGEST_RE = /^sha256:[0-9a-f]{64}$/;
 function validateReleaseFlags(options) {
@@ -9374,7 +9670,7 @@ function validateReleaseFlags(options) {
   }
 }
 function buildRemoteArgv(options) {
-  const argv = ["gh", "workflow", "run", WORKFLOW_NAME2, "--repo", REPO2];
+  const argv = ["gh", "workflow", "run", WORKFLOW_NAME3, "--repo", REPO3];
   if (options.imageVersion !== undefined) {
     argv.push("-f", `version=${options.imageVersion}`);
   }
@@ -9414,7 +9710,7 @@ function validateDashboardRemotePreconditions() {
   }
 }
 function registerDashboardDeploy(cli) {
-  cli.command("dashboard deploy", "Deploy the dashboard. Default mode triggers the GitHub Deploy Dashboard workflow, while --local runs apps/dashboard deploy directly with Bun.").option("--local", z13.boolean().default(false).describe("Run local deployment with Bun using apps/dashboard instead of triggering GitHub Actions.")).option("--dry-run", z13.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).option("--image-version <version>", z13.string().optional().describe("CalVer version to deploy (e.g. 2026.06.47). Remote-only. Triggers the versioned release path and requires dashboard environment approval. Must match YYYY.MM.N. Forwarded as -f version=<value> to gh workflow run.")).option("--digest <digest>", z13.string().optional().describe("Expected sha256 digest (e.g. sha256:abc...def). Remote-only. Requires --image-version. When set, the workflow fails if GHCR resolves the tag to a different digest. Must match sha256:<64 hex chars>.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra dashboard deploy").example("# Deploy a specific CalVer release via GitHub Actions").example("infra dashboard deploy --image-version 2026.06.47").example("# Deploy a specific release with digest cross-check").example("infra dashboard deploy --image-version 2026.06.47 --digest sha256:<64 hex>").example("# Validate local deploy preconditions and planned command").example("infra dashboard deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra dashboard deploy --local").action(async (options) => {
+  cli.command("dashboard deploy", "Deploy the dashboard. Default mode triggers the GitHub Deploy Dashboard workflow, while --local runs apps/dashboard deploy directly with Bun.").option("--local", z16.boolean().default(false).describe("Run local deployment with Bun using apps/dashboard instead of triggering GitHub Actions.")).option("--dry-run", z16.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).option("--image-version <version>", z16.string().optional().describe("CalVer version to deploy (e.g. 2026.06.47). Remote-only. Triggers the versioned release path and requires dashboard environment approval. Must match YYYY.MM.N. Forwarded as -f version=<value> to gh workflow run.")).option("--digest <digest>", z16.string().optional().describe("Expected sha256 digest (e.g. sha256:abc...def). Remote-only. Requires --image-version. When set, the workflow fails if GHCR resolves the tag to a different digest. Must match sha256:<64 hex chars>.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra dashboard deploy").example("# Deploy a specific CalVer release via GitHub Actions").example("infra dashboard deploy --image-version 2026.06.47").example("# Deploy a specific release with digest cross-check").example("infra dashboard deploy --image-version 2026.06.47 --digest sha256:<64 hex>").example("# Validate local deploy preconditions and planned command").example("infra dashboard deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra dashboard deploy --local").action(async (options) => {
     validateReleaseFlags({ imageVersion: options.imageVersion, digest: options.digest, local: options.local });
     if (options.local) {
       const command = ["bun", "run", "--cwd", "apps/dashboard", "deploy"];
@@ -9440,7 +9736,7 @@ function registerDashboardDeploy(cli) {
     if (options.dryRun) {
       console.log("Dry run: remote dashboard deploy");
       console.log(`- command: ${formatArgv(remoteArgv)}`);
-      console.log(`- workflow URL: ${WORKFLOW_URL2}`);
+      console.log(`- workflow URL: ${WORKFLOW_URL3}`);
       return;
     }
     const child = Bun.spawn(remoteArgv, {
@@ -9449,47 +9745,23 @@ function registerDashboardDeploy(cli) {
     });
     const exitCode = await child.exited;
     if (exitCode !== 0) {
-      throw new Error(`Failed to trigger "${WORKFLOW_NAME2}" workflow (exit code ${exitCode})`);
+      throw new Error(`Failed to trigger "${WORKFLOW_NAME3}" workflow (exit code ${exitCode})`);
     }
-    console.log(`Workflow triggered: ${WORKFLOW_URL2}`);
+    console.log(`Workflow triggered: ${WORKFLOW_URL3}`);
     console.log("Approve the dashboard environment deployment in GitHub Actions to continue.");
   });
 }
 
 // src/commands/dashboard/logs.ts
-import { z as z14 } from "zod";
-
-// src/lib/known-hosts.ts
-import { existsSync as existsSync3 } from "fs";
-import { join as join3, resolve } from "path";
-
-// src/resources/known_hosts
-var known_hosts_default = "./known_hosts-tk724cp0.";
-
-// src/lib/known-hosts.ts
-var FAIL_CLOSED_ERROR = "Pinned SSH known_hosts file not found; reinstall @marcusrbrown/infra or run from the repo checkout";
-function resolveKnownHostsPath(libDir) {
-  const dir = libDir ?? import.meta.dir;
-  const repoRoot = resolve(dir, "..", "..", "..", "..");
-  const repoCandidate = join3(repoRoot, ".github", "known_hosts");
-  if (existsSync3(repoCandidate))
-    return repoCandidate;
-  if (existsSync3(known_hosts_default))
-    return known_hosts_default;
-  throw new Error(FAIL_CLOSED_ERROR);
-}
-function buildKnownHostsArgs(libDir) {
-  const path = resolveKnownHostsPath(libDir);
-  return ["-o", `UserKnownHostsFile=${path}`];
-}
+import { z as z17 } from "zod";
 
 // ../shared/server/droplet-helpers.ts
 import { appendFileSync, chmodSync as chmodSync2, mkdtempSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "fs";
 import { tmpdir } from "os";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 function materializeIdentityFile(privateKey) {
-  const dir = mkdtempSync(join4(tmpdir(), "infra-ssh-key-"));
-  const path = join4(dir, "id");
+  const dir = mkdtempSync(join5(tmpdir(), "infra-ssh-key-"));
+  const path = join5(dir, "id");
   const cleanup = () => {
     try {
       rmSync(dir, { recursive: true, force: true });
@@ -9523,12 +9795,12 @@ function buildIdentityArgs(privateKey) {
 }
 
 // src/commands/dashboard/host.ts
-var VALID_HOST_RE2 = /^[a-z\d][a-z\d.\-]*$/i;
+var VALID_HOST_RE3 = /^[a-z\d][a-z\d.\-]*$/i;
 function validateDashboardHost(host) {
   if (!host) {
     throw new Error("Invalid DASHBOARD_DOMAIN: value is empty");
   }
-  if (!VALID_HOST_RE2.test(host)) {
+  if (!VALID_HOST_RE3.test(host)) {
     throw new Error(`Invalid DASHBOARD_DOMAIN: value is not a valid hostname (must match ${String.raw`[A-Za-z0-9][A-Za-z0-9.\-]*`})`);
   }
   return host;
@@ -9536,17 +9808,17 @@ function validateDashboardHost(host) {
 
 // src/commands/dashboard/logs.ts
 var COMPOSE_PROJECT_DIR = "/opt/dashboard";
-var SENSITIVE_WARNING = "Warning: Logs may contain database passwords, app secrets, or user data. Treat output as sensitive; do not capture in shared logs or chat.";
+var SENSITIVE_WARNING2 = "Warning: Logs may contain database passwords, app secrets, or user data. Treat output as sensitive; do not capture in shared logs or chat.";
 var VALID_SERVICES = ["dashboard", "caddy"];
 function validateService(service) {
   if (!VALID_SERVICES.includes(service)) {
     throw new Error(`Invalid service "${service}". Valid services: ${VALID_SERVICES.join(", ")}`);
   }
 }
-function defaultLogsSpawn(cmd, opts) {
+function defaultLogsSpawn2(cmd, opts) {
   return Bun.spawn(cmd, opts);
 }
-async function streamDashboardLogs(opts, spawn = defaultLogsSpawn, printOut, printErr) {
+async function streamDashboardLogs(opts, spawn = defaultLogsSpawn2, printOut, printErr) {
   validateService(opts.service);
   const isCI = process.env.CI === "true";
   if (isCI && !opts.allowCi) {
@@ -9559,9 +9831,9 @@ async function streamDashboardLogs(opts, spawn = defaultLogsSpawn, printOut, pri
     return { refused: true };
   }
   if (printErr) {
-    printErr(SENSITIVE_WARNING);
+    printErr(SENSITIVE_WARNING2);
   } else {
-    console.error(SENSITIVE_WARNING);
+    console.error(SENSITIVE_WARNING2);
   }
   validateDashboardHost(opts.host);
   const { args: identityArgs, cleanup } = buildIdentityArgs(process.env.DASHBOARD_SSH_KEY);
@@ -9593,7 +9865,7 @@ async function streamDashboardLogs(opts, spawn = defaultLogsSpawn, printOut, pri
   return { refused: false, exitCode };
 }
 function registerDashboardLogs(cli) {
-  cli.command("dashboard logs [service]", "Stream logs from a dashboard service via SSH and docker compose.").option("--tail [n]", z14.number().default(100).describe("Number of log lines to tail from each service.")).option("--allow-ci", z14.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive credentials.")).option("--key [key]", z14.string().describe("Environment variable name holding the SSH host. Falls back to DASHBOARD_DOMAIN when omitted.")).action(async (service, options) => {
+  cli.command("dashboard logs [service]", "Stream logs from a dashboard service via SSH and docker compose.").option("--tail [n]", z17.number().default(100).describe("Number of log lines to tail from each service.")).option("--allow-ci", z17.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive credentials.")).option("--key [key]", z17.string().describe("Environment variable name holding the SSH host. Falls back to DASHBOARD_DOMAIN when omitted.")).action(async (service, options) => {
     const targetService = service ?? "dashboard";
     try {
       validateService(targetService);
@@ -9623,7 +9895,7 @@ function registerDashboardLogs(cli) {
 }
 
 // src/commands/dashboard/status.ts
-import { z as z15 } from "zod";
+import { z as z18 } from "zod";
 
 // src/lib/redact.ts
 function redactHost(text4, host) {
@@ -9807,7 +10079,7 @@ async function dashboardStatusAction(options, ctx, spawn) {
   }
 }
 function registerDashboardStatus(cli) {
-  cli.command("dashboard status", "Show operational health of the dashboard deployment via docker compose ps.").option("--key [key]", z15.string().optional().describe("Environment variable name holding the SSH host. Falls back to DASHBOARD_DOMAIN when omitted.")).action((options, ctx) => dashboardStatusAction(options, ctx));
+  cli.command("dashboard status", "Show operational health of the dashboard deployment via docker compose ps.").option("--key [key]", z18.string().optional().describe("Environment variable name holding the SSH host. Falls back to DASHBOARD_DOMAIN when omitted.")).action((options, ctx) => dashboardStatusAction(options, ctx));
 }
 
 // src/commands/dashboard/index.ts
@@ -9819,15 +10091,15 @@ function registerDashboardCommands(cli) {
 
 // src/commands/gateway/backup.ts
 import { closeSync, constants as fsConstants, openSync, renameSync, unlinkSync, writeSync } from "fs";
-import { z as z16 } from "zod";
+import { z as z19 } from "zod";
 
 // src/commands/gateway/host.ts
-var VALID_HOST_RE3 = /^[a-z\d][a-z\d.\-]*$/i;
+var VALID_HOST_RE4 = /^[a-z\d][a-z\d.\-]*$/i;
 function validateGatewayHost(host) {
   if (!host) {
     throw new Error("Invalid GATEWAY_HOST: value is empty");
   }
-  if (!VALID_HOST_RE3.test(host)) {
+  if (!VALID_HOST_RE4.test(host)) {
     throw new Error(`Invalid GATEWAY_HOST: value is not a valid hostname (must match ${String.raw`[A-Za-z0-9][A-Za-z0-9.\-]*`})`);
   }
   return host;
@@ -9838,7 +10110,7 @@ var MITMPROXY_CERTS_VOLUME = "mitmproxy-certs";
 var CA_CERT_FILE = "mitmproxy-ca-cert.pem";
 var CA_KEY_FILE = "mitmproxy-ca.pem";
 var DEFAULT_OUTPUT = "apps/gateway/.local/mitmproxy-ca.tar";
-var SENSITIVE_WARNING2 = "Warning: Output contains the mitmproxy CA private trust anchor; treat as sensitive.";
+var SENSITIVE_WARNING3 = "Warning: Output contains the mitmproxy CA private trust anchor; treat as sensitive.";
 function defaultSpawn2(cmd, opts) {
   return Bun.spawn(cmd, opts);
 }
@@ -9906,7 +10178,7 @@ async function backupGatewayCa(opts, spawn = defaultSpawn2, printErr) {
   }
   const warn = printErr ?? ((msg) => process.stderr.write(`${msg}
 `));
-  warn(SENSITIVE_WARNING2);
+  warn(SENSITIVE_WARNING3);
   return { ok: true, output: opts.output, bytesWritten: tarBytes.byteLength };
 }
 async function gatewayBackupAction(options, ctx, spawn) {
@@ -9929,14 +10201,14 @@ async function gatewayBackupAction(options, ctx, spawn) {
   ctx.console.log(`CA backup written to: ${output}`);
 }
 function registerGatewayBackup(cli) {
-  cli.command("gateway backup", "Back up the mitmproxy CA certificate and private key from the gateway Docker volume to a local tarball. The output contains the CA private trust anchor \u2014 treat it as sensitive material.").option("--output [file]", z16.string().default(DEFAULT_OUTPUT).describe("Local path to write the CA tarball. File permissions are set to 0600 after writing.")).option("--include-ca", z16.boolean().default(true).describe("Include the mitmproxy CA certificate and private key in the backup. Currently the only supported backup target.")).example("# Back up the CA to the default path").example("infra gateway backup --include-ca").example("# Back up the CA to a custom path").example("infra gateway backup --output /secure/backup/mitmproxy-ca.tar").action(gatewayBackupAction);
+  cli.command("gateway backup", "Back up the mitmproxy CA certificate and private key from the gateway Docker volume to a local tarball. The output contains the CA private trust anchor \u2014 treat it as sensitive material.").option("--output [file]", z19.string().default(DEFAULT_OUTPUT).describe("Local path to write the CA tarball. File permissions are set to 0600 after writing.")).option("--include-ca", z19.boolean().default(true).describe("Include the mitmproxy CA certificate and private key in the backup. Currently the only supported backup target.")).example("# Back up the CA to the default path").example("infra gateway backup --include-ca").example("# Back up the CA to a custom path").example("infra gateway backup --output /secure/backup/mitmproxy-ca.tar").action(gatewayBackupAction);
 }
 
 // src/commands/gateway/deploy.ts
-import { z as z17 } from "zod";
-var REPO3 = "marcusrbrown/infra";
-var WORKFLOW_NAME3 = "Deploy Gateway";
-var WORKFLOW_URL3 = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-gateway.yaml";
+import { z as z20 } from "zod";
+var REPO4 = "marcusrbrown/infra";
+var WORKFLOW_NAME4 = "Deploy Gateway";
+var WORKFLOW_URL4 = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-gateway.yaml";
 function getGatewayDeployEnv() {
   const path = process.env.PATH;
   const home = process.env.HOME;
@@ -9998,7 +10270,7 @@ function validateGatewayRemotePreconditions() {
   }
 }
 function registerGatewayDeploy(cli) {
-  cli.command("gateway deploy", "Deploy the gateway. Default mode triggers the GitHub Deploy Gateway workflow, while --local runs apps/gateway deploy directly with Bun.").option("--local", z17.boolean().default(false).describe("Run local deployment with Bun using apps/gateway instead of triggering GitHub Actions.")).option("--dry-run", z17.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).option("--force-recreate", z17.boolean().default(false).describe("Force recreate containers. Forwarded only in local mode.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra gateway deploy").example("# Validate local deploy preconditions and planned command").example("infra gateway deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra gateway deploy --local").action(async (options) => {
+  cli.command("gateway deploy", "Deploy the gateway. Default mode triggers the GitHub Deploy Gateway workflow, while --local runs apps/gateway deploy directly with Bun.").option("--local", z20.boolean().default(false).describe("Run local deployment with Bun using apps/gateway instead of triggering GitHub Actions.")).option("--dry-run", z20.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).option("--force-recreate", z20.boolean().default(false).describe("Force recreate containers. Forwarded only in local mode.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra gateway deploy").example("# Validate local deploy preconditions and planned command").example("infra gateway deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra gateway deploy --local").action(async (options) => {
     if (options.local) {
       const command = [
         "bun",
@@ -10028,37 +10300,37 @@ function registerGatewayDeploy(cli) {
     validateGatewayRemotePreconditions();
     if (options.dryRun) {
       console.log("Dry run: remote gateway deploy");
-      console.log(`- command: gh workflow run "${WORKFLOW_NAME3}" --repo ${REPO3}`);
-      console.log(`- workflow URL: ${WORKFLOW_URL3}`);
+      console.log(`- command: gh workflow run "${WORKFLOW_NAME4}" --repo ${REPO4}`);
+      console.log(`- workflow URL: ${WORKFLOW_URL4}`);
       return;
     }
-    const child = Bun.spawn(["gh", "workflow", "run", WORKFLOW_NAME3, "--repo", REPO3], {
+    const child = Bun.spawn(["gh", "workflow", "run", WORKFLOW_NAME4, "--repo", REPO4], {
       stdout: "inherit",
       stderr: "inherit"
     });
     const exitCode = await child.exited;
     if (exitCode !== 0) {
-      throw new Error(`Failed to trigger "${WORKFLOW_NAME3}" workflow (exit code ${exitCode})`);
+      throw new Error(`Failed to trigger "${WORKFLOW_NAME4}" workflow (exit code ${exitCode})`);
     }
-    console.log(`Workflow triggered: ${WORKFLOW_URL3}`);
+    console.log(`Workflow triggered: ${WORKFLOW_URL4}`);
     console.log("Approve the gateway environment deployment in GitHub Actions to continue.");
   });
 }
 
 // src/commands/gateway/logs.ts
-import { z as z18 } from "zod";
+import { z as z21 } from "zod";
 var COMPOSE_PROJECT_DIR3 = "/opt/gateway/deploy";
-var SENSITIVE_WARNING3 = "Warning: Logs may contain Discord tokens, S3 credentials, or user data. Treat output as sensitive; do not capture in shared logs or chat.";
+var SENSITIVE_WARNING4 = "Warning: Logs may contain Discord tokens, S3 credentials, or user data. Treat output as sensitive; do not capture in shared logs or chat.";
 var VALID_SERVICES2 = ["gateway", "workspace", "mitmproxy"];
 function validateService2(service) {
   if (!VALID_SERVICES2.includes(service)) {
     throw new Error(`Invalid service "${service}". Valid services: ${VALID_SERVICES2.join(", ")}`);
   }
 }
-function defaultLogsSpawn2(cmd, opts) {
+function defaultLogsSpawn3(cmd, opts) {
   return Bun.spawn(cmd, opts);
 }
-async function streamGatewayLogs(opts, spawn = defaultLogsSpawn2, printOut, printErr) {
+async function streamGatewayLogs(opts, spawn = defaultLogsSpawn3, printOut, printErr) {
   const isCI = process.env.CI === "true";
   if (isCI && !opts.allowCi) {
     const msg = "Refusing to stream logs in CI without --allow-ci. Logs may contain sensitive tokens or user data.";
@@ -10070,9 +10342,9 @@ async function streamGatewayLogs(opts, spawn = defaultLogsSpawn2, printOut, prin
     return { refused: true };
   }
   if (printErr) {
-    printErr(SENSITIVE_WARNING3);
+    printErr(SENSITIVE_WARNING4);
   } else {
-    console.error(SENSITIVE_WARNING3);
+    console.error(SENSITIVE_WARNING4);
   }
   validateGatewayHost(opts.host);
   const sshCmd = [
@@ -10095,7 +10367,7 @@ async function streamGatewayLogs(opts, spawn = defaultLogsSpawn2, printOut, prin
   return { refused: false, exitCode };
 }
 function registerGatewayLogs(cli) {
-  cli.command("gateway logs [service]", "Stream logs from a gateway service via SSH and docker compose.").option("--tail [n]", z18.number().default(100).describe("Number of log lines to tail from each service.")).option("--allow-ci", z18.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive credentials.")).option("--key [key]", z18.string().describe("Environment variable name holding the SSH host. Falls back to GATEWAY_HOST when omitted.")).action(async (service, options) => {
+  cli.command("gateway logs [service]", "Stream logs from a gateway service via SSH and docker compose.").option("--tail [n]", z21.number().default(100).describe("Number of log lines to tail from each service.")).option("--allow-ci", z21.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive credentials.")).option("--key [key]", z21.string().describe("Environment variable name holding the SSH host. Falls back to GATEWAY_HOST when omitted.")).action(async (service, options) => {
     const targetService = service ?? "gateway";
     try {
       validateService2(targetService);
@@ -10125,7 +10397,7 @@ function registerGatewayLogs(cli) {
 }
 
 // src/commands/gateway/restore.ts
-import { z as z19 } from "zod";
+import { z as z22 } from "zod";
 var MITMPROXY_CERTS_VOLUME2 = "mitmproxy-certs";
 var CA_CERT_FILE2 = "mitmproxy-ca-cert.pem";
 var CA_KEY_FILE2 = "mitmproxy-ca.pem";
@@ -10279,7 +10551,7 @@ async function restoreGatewayCa(opts, spawn = defaultSpawn3) {
   }
 }
 function registerGatewayRestore(cli) {
-  cli.command("gateway restore", "Restore the mitmproxy CA certificate and private key from a local tarball into the gateway Docker volume. Restarts mitmproxy and gateway services after restore and confirms byte-equal content before reporting success.").option("--input <file>", z19.string().describe("Path to the tarball produced by `gateway backup --include-ca`. Required.")).option("--include-ca", z19.boolean().default(true).describe("Restore the mitmproxy CA certificate and private key. Currently the only supported restore target.")).example("# Restore CA from a backup tarball").example("infra gateway restore --input apps/gateway/.local/mitmproxy-ca.tar").example("# Restore CA from a custom path").example("infra gateway restore --input /secure/backup/mitmproxy-ca.tar --include-ca").action(async (options) => {
+  cli.command("gateway restore", "Restore the mitmproxy CA certificate and private key from a local tarball into the gateway Docker volume. Restarts mitmproxy and gateway services after restore and confirms byte-equal content before reporting success.").option("--input <file>", z22.string().describe("Path to the tarball produced by `gateway backup --include-ca`. Required.")).option("--include-ca", z22.boolean().default(true).describe("Restore the mitmproxy CA certificate and private key. Currently the only supported restore target.")).example("# Restore CA from a backup tarball").example("infra gateway restore --input apps/gateway/.local/mitmproxy-ca.tar").example("# Restore CA from a custom path").example("infra gateway restore --input /secure/backup/mitmproxy-ca.tar --include-ca").action(async (options) => {
     const hostEnvKey = "GATEWAY_HOST";
     const host = process.env[hostEnvKey];
     if (!host) {
@@ -10300,7 +10572,7 @@ function registerGatewayRestore(cli) {
 }
 
 // src/commands/gateway/status.ts
-import { z as z20 } from "zod";
+import { z as z23 } from "zod";
 var COMPOSE_PROJECT_DIR5 = "/opt/gateway/deploy";
 function parseComposePsOutput2(stdoutText) {
   const trimmed = stdoutText.trim();
@@ -10442,7 +10714,7 @@ async function gatewayStatusAction(options, ctx, spawn) {
   }
 }
 function registerGatewayStatus(cli) {
-  cli.command("gateway status", "Show operational health of the gateway deployment via docker compose ps.").option("--key [key]", z20.string().describe("Environment variable name holding the SSH host. Falls back to GATEWAY_HOST when omitted.")).action((options, ctx) => gatewayStatusAction(options, ctx));
+  cli.command("gateway status", "Show operational health of the gateway deployment via docker compose ps.").option("--key [key]", z23.string().describe("Environment variable name holding the SSH host. Falls back to GATEWAY_HOST when omitted.")).action((options, ctx) => gatewayStatusAction(options, ctx));
 }
 
 // src/commands/gateway/index.ts
@@ -10455,22 +10727,22 @@ function registerGatewayCommands(cli) {
 }
 
 // src/commands/keeweb/deploy.ts
-import { existsSync as existsSync4 } from "fs";
-import { join as join5 } from "path";
-import { z as z21 } from "zod";
-var REPO4 = "marcusrbrown/infra";
-var WORKFLOW_NAME4 = "Deploy KeeWeb";
-var WORKFLOW_URL4 = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-keeweb.yaml";
+import { existsSync as existsSync5 } from "fs";
+import { join as join6 } from "path";
+import { z as z24 } from "zod";
+var REPO5 = "marcusrbrown/infra";
+var WORKFLOW_NAME5 = "Deploy KeeWeb";
+var WORKFLOW_URL5 = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-keeweb.yaml";
 var DEFAULT_HOST3 = "box.heatvision.co";
 var DEFAULT_REMOTE_USER3 = "deploy-kw";
 var DEFAULT_SITE_DIR = "/home/user-data/www/kw.igg.ms";
 function resolveDeployScriptPath() {
-  return join5(findRepoRoot(), "apps", "keeweb", "deploy.sh");
+  return join6(findRepoRoot(), "apps", "keeweb", "deploy.sh");
 }
 function resolveDistIndexPath() {
-  return join5(findRepoRoot(), "apps", "keeweb", "dist", "index.html");
+  return join6(findRepoRoot(), "apps", "keeweb", "dist", "index.html");
 }
-function getLocalDeployEnv2() {
+function getLocalDeployEnv3() {
   const path = process.env.PATH;
   const home = process.env.HOME;
   const sshAuthSock = process.env.SSH_AUTH_SOCK;
@@ -10492,26 +10764,26 @@ function getLocalDeployEnv2() {
     HOME: home
   };
 }
-function validateLocalPreconditions2(options) {
+function validateLocalPreconditions3(options) {
   const deployScriptPath = resolveDeployScriptPath();
-  if (!existsSync4(deployScriptPath)) {
+  if (!existsSync5(deployScriptPath)) {
     throw new Error(`deploy.sh not found at expected path: ${deployScriptPath}`);
   }
   const distIndexPath = resolveDistIndexPath();
-  if (!existsSync4(distIndexPath)) {
+  if (!existsSync5(distIndexPath)) {
     throw new Error(`Local deploy requires built assets. Missing: ${distIndexPath}`);
   }
-  getLocalDeployEnv2();
+  getLocalDeployEnv3();
   if (options.nginx) {}
   return { deployScriptPath, distIndexPath };
 }
-function validateRemotePreconditions2() {
+function validateRemotePreconditions3() {
   if (!Bun.which("gh")) {
     throw new Error("gh CLI is required for remote deploy. Install gh and run `gh auth login`.");
   }
 }
 function registerKeewebDeploy(cli) {
-  cli.command("keeweb deploy", "Trigger KeeWeb deployment. Default mode dispatches the GitHub Deploy KeeWeb workflow. Use --local to run apps/keeweb/deploy.sh directly from this repo.").option("--local", z21.boolean().default(false).describe("Run local deployment using apps/keeweb/deploy.sh instead of triggering GitHub Actions.")).option("--nginx", z21.boolean().default(false).describe("Include nginx config deployment. Valid only with --local and passed through to deploy.sh as --nginx.")).option("--dry-run", z21.boolean().default(false).describe("Print planned actions without validating preconditions, executing deploy.sh, or triggering GitHub Actions.")).example("# Trigger GitHub Deploy KeeWeb workflow (default mode)").example("infra keeweb deploy").example("# Preview local deploy plan without side effects").example("infra keeweb deploy --local --dry-run").example("# Run local deploy including nginx config update").example("infra keeweb deploy --local --nginx").action(async (options) => {
+  cli.command("keeweb deploy", "Trigger KeeWeb deployment. Default mode dispatches the GitHub Deploy KeeWeb workflow. Use --local to run apps/keeweb/deploy.sh directly from this repo.").option("--local", z24.boolean().default(false).describe("Run local deployment using apps/keeweb/deploy.sh instead of triggering GitHub Actions.")).option("--nginx", z24.boolean().default(false).describe("Include nginx config deployment. Valid only with --local and passed through to deploy.sh as --nginx.")).option("--dry-run", z24.boolean().default(false).describe("Print planned actions without validating preconditions, executing deploy.sh, or triggering GitHub Actions.")).example("# Trigger GitHub Deploy KeeWeb workflow (default mode)").example("infra keeweb deploy").example("# Preview local deploy plan without side effects").example("infra keeweb deploy --local --dry-run").example("# Run local deploy including nginx config update").example("infra keeweb deploy --local --nginx").action(async (options) => {
     if (options.nginx && !options.local) {
       throw new Error("--nginx is only valid with --local");
     }
@@ -10528,8 +10800,8 @@ function registerKeewebDeploy(cli) {
         console.log(`- command: ${args2.join(" ")}`);
         return;
       }
-      const { deployScriptPath } = validateLocalPreconditions2({ nginx: options.nginx });
-      const env = getLocalDeployEnv2();
+      const { deployScriptPath } = validateLocalPreconditions3({ nginx: options.nginx });
+      const env = getLocalDeployEnv3();
       const args = ["bash", deployScriptPath];
       if (options.nginx) {
         args.push("--nginx");
@@ -10547,14 +10819,14 @@ function registerKeewebDeploy(cli) {
     }
     if (options.dryRun) {
       console.log("Dry run: remote KeeWeb deploy");
-      console.log(`- command: gh workflow run ${WORKFLOW_NAME4} --repo ${REPO4}`);
-      console.log(`- workflow URL: ${WORKFLOW_URL4}`);
+      console.log(`- command: gh workflow run ${WORKFLOW_NAME5} --repo ${REPO5}`);
+      console.log(`- workflow URL: ${WORKFLOW_URL5}`);
       return;
     }
-    validateRemotePreconditions2();
+    validateRemotePreconditions3();
     console.warn("Warning: the Deploy KeeWeb workflow includes nginx config deployment as part of workflow_dispatch logic.");
     console.warn("Warning: the workflow requires keeweb environment approval before jobs execute.");
-    const child = Bun.spawn(["gh", "workflow", "run", WORKFLOW_NAME4, "--repo", REPO4], {
+    const child = Bun.spawn(["gh", "workflow", "run", WORKFLOW_NAME5, "--repo", REPO5], {
       stdout: "inherit",
       stderr: "inherit"
     });
@@ -10562,7 +10834,7 @@ function registerKeewebDeploy(cli) {
     if (exitCode !== 0) {
       throw new Error(`Failed to trigger Deploy KeeWeb workflow (exit code ${exitCode})`);
     }
-    console.log(`Workflow triggered: ${WORKFLOW_URL4}`);
+    console.log(`Workflow triggered: ${WORKFLOW_URL5}`);
     console.log("Approve the keeweb environment deployment in GitHub Actions to continue.");
   });
 }
@@ -10589,14 +10861,14 @@ function registerKeewebOpen(cli) {
 }
 
 // src/commands/keeweb/status.ts
-import { join as join6 } from "path";
-import { z as z22 } from "zod";
+import { join as join7 } from "path";
+import { z as z25 } from "zod";
 var SITE_URL = "https://kw.igg.ms/";
 var GH_REPO = "marcusrbrown/infra";
-var HTTP_TIMEOUT_MS3 = 1e4;
-var ghRunSchema = z22.array(z22.object({
-  createdAt: z22.string().min(1),
-  url: z22.url()
+var HTTP_TIMEOUT_MS4 = 1e4;
+var ghRunSchema = z25.array(z25.object({
+  createdAt: z25.string().min(1),
+  url: z25.url()
 }));
 function levelLabel2(level) {
   if (level === "ok") {
@@ -10635,7 +10907,7 @@ async function checkHttpReachability2(verbose) {
   const startedAt = performance.now();
   try {
     const response = await fetch(SITE_URL, {
-      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS3)
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS4)
     });
     const elapsedMs = performance.now() - startedAt;
     const details = [];
@@ -10662,7 +10934,7 @@ async function checkHttpReachability2(verbose) {
       title: "HTTP reachability",
       level: "error",
       summary: `Request failed after ${formatDurationMs2(elapsedMs)}: ${message}`,
-      details: verbose ? [`URL: ${SITE_URL}`, `Timeout: ${HTTP_TIMEOUT_MS3}ms`] : undefined
+      details: verbose ? [`URL: ${SITE_URL}`, `Timeout: ${HTTP_TIMEOUT_MS4}ms`] : undefined
     };
   }
 }
@@ -10736,7 +11008,7 @@ async function checkLastDeploy(verbose) {
   }
 }
 async function isSourceCheckout(root) {
-  const sourceMarker = join6(root, "apps", "keeweb", "src", "build.ts");
+  const sourceMarker = join7(root, "apps", "keeweb", "src", "build.ts");
   return Bun.file(sourceMarker).exists();
 }
 async function checkContentHash(verbose, repoRoot) {
@@ -10755,7 +11027,7 @@ async function checkContentHash(verbose, repoRoot) {
   } else {
     root = repoRoot;
   }
-  const distIndexPath = join6(root, "apps", "keeweb", "dist", "index.html");
+  const distIndexPath = join7(root, "apps", "keeweb", "dist", "index.html");
   const sourceCheckout = await isSourceCheckout(root);
   if (!sourceCheckout) {
     return {
@@ -10777,7 +11049,7 @@ async function checkContentHash(verbose, repoRoot) {
   }
   try {
     const response = await fetch(SITE_URL, {
-      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS3)
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS4)
     });
     if (!response.ok) {
       return {
@@ -10883,6 +11155,7 @@ var MCP_ALLOWLIST = new Set([
   "umami status",
   "dashboard status",
   "vpn status",
+  "broker status",
   "status"
 ]);
 function registerMcp(cli) {
@@ -10893,13 +11166,13 @@ function registerMcp(cli) {
 }
 
 // src/commands/status.ts
-import { z as z31 } from "zod";
+import { z as z34 } from "zod";
 
 // src/commands/umami/deploy.ts
-import { z as z23 } from "zod";
-var REPO5 = "marcusrbrown/infra";
-var WORKFLOW_NAME5 = "Deploy Umami";
-var WORKFLOW_URL5 = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-umami.yaml";
+import { z as z26 } from "zod";
+var REPO6 = "marcusrbrown/infra";
+var WORKFLOW_NAME6 = "Deploy Umami";
+var WORKFLOW_URL6 = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-umami.yaml";
 function getUmamiDeployEnv() {
   const path = process.env.PATH;
   const home = process.env.HOME;
@@ -10931,7 +11204,7 @@ function validateUmamiRemotePreconditions() {
   }
 }
 function registerUmamiDeploy(cli) {
-  cli.command("umami deploy", "Deploy Umami analytics. Default mode triggers the GitHub Deploy Umami workflow, while --local runs apps/umami deploy directly with Bun.").option("--local", z23.boolean().default(false).describe("Run local deployment with Bun using apps/umami instead of triggering GitHub Actions.")).option("--dry-run", z23.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra umami deploy").example("# Validate local deploy preconditions and planned command").example("infra umami deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra umami deploy --local").action(async (options) => {
+  cli.command("umami deploy", "Deploy Umami analytics. Default mode triggers the GitHub Deploy Umami workflow, while --local runs apps/umami deploy directly with Bun.").option("--local", z26.boolean().default(false).describe("Run local deployment with Bun using apps/umami instead of triggering GitHub Actions.")).option("--dry-run", z26.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra umami deploy").example("# Validate local deploy preconditions and planned command").example("infra umami deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra umami deploy --local").action(async (options) => {
     if (options.local) {
       const command = ["bun", "run", "--cwd", "apps/umami", "deploy"];
       if (options.dryRun) {
@@ -10954,33 +11227,33 @@ function registerUmamiDeploy(cli) {
     validateUmamiRemotePreconditions();
     if (options.dryRun) {
       console.log("Dry run: remote umami deploy");
-      console.log(`- command: gh workflow run "${WORKFLOW_NAME5}" --repo ${REPO5}`);
-      console.log(`- workflow URL: ${WORKFLOW_URL5}`);
+      console.log(`- command: gh workflow run "${WORKFLOW_NAME6}" --repo ${REPO6}`);
+      console.log(`- workflow URL: ${WORKFLOW_URL6}`);
       return;
     }
-    const child = Bun.spawn(["gh", "workflow", "run", WORKFLOW_NAME5, "--repo", REPO5], {
+    const child = Bun.spawn(["gh", "workflow", "run", WORKFLOW_NAME6, "--repo", REPO6], {
       stdout: "inherit",
       stderr: "inherit"
     });
     const exitCode = await child.exited;
     if (exitCode !== 0) {
-      throw new Error(`Failed to trigger "${WORKFLOW_NAME5}" workflow (exit code ${exitCode})`);
+      throw new Error(`Failed to trigger "${WORKFLOW_NAME6}" workflow (exit code ${exitCode})`);
     }
-    console.log(`Workflow triggered: ${WORKFLOW_URL5}`);
+    console.log(`Workflow triggered: ${WORKFLOW_URL6}`);
     console.log("Approve the umami environment deployment in GitHub Actions to continue.");
   });
 }
 
 // src/commands/umami/logs.ts
-import { z as z24 } from "zod";
+import { z as z27 } from "zod";
 
 // src/commands/umami/host.ts
-var VALID_HOST_RE4 = /^[a-z\d][a-z\d.\-]*$/i;
+var VALID_HOST_RE5 = /^[a-z\d][a-z\d.\-]*$/i;
 function validateUmamiHost(host) {
   if (!host) {
     throw new Error("Invalid UMAMI_DOMAIN: value is empty");
   }
-  if (!VALID_HOST_RE4.test(host)) {
+  if (!VALID_HOST_RE5.test(host)) {
     throw new Error(`Invalid UMAMI_DOMAIN: value is not a valid hostname (must match ${String.raw`[A-Za-z0-9][A-Za-z0-9.\-]*`})`);
   }
   return host;
@@ -10988,17 +11261,17 @@ function validateUmamiHost(host) {
 
 // src/commands/umami/logs.ts
 var COMPOSE_PROJECT_DIR6 = "/opt/umami";
-var SENSITIVE_WARNING4 = "Warning: Logs may contain database passwords, app secrets, or user data. Treat output as sensitive; do not capture in shared logs or chat.";
+var SENSITIVE_WARNING5 = "Warning: Logs may contain database passwords, app secrets, or user data. Treat output as sensitive; do not capture in shared logs or chat.";
 var VALID_SERVICES3 = ["umami", "db", "caddy"];
 function validateService3(service) {
   if (!VALID_SERVICES3.includes(service)) {
     throw new Error(`Invalid service "${service}". Valid services: ${VALID_SERVICES3.join(", ")}`);
   }
 }
-function defaultLogsSpawn3(cmd, opts) {
+function defaultLogsSpawn4(cmd, opts) {
   return Bun.spawn(cmd, opts);
 }
-async function streamUmamiLogs(opts, spawn = defaultLogsSpawn3, printOut, printErr) {
+async function streamUmamiLogs(opts, spawn = defaultLogsSpawn4, printOut, printErr) {
   validateService3(opts.service);
   const isCI = process.env.CI === "true";
   if (isCI && !opts.allowCi) {
@@ -11011,9 +11284,9 @@ async function streamUmamiLogs(opts, spawn = defaultLogsSpawn3, printOut, printE
     return { refused: true };
   }
   if (printErr) {
-    printErr(SENSITIVE_WARNING4);
+    printErr(SENSITIVE_WARNING5);
   } else {
-    console.error(SENSITIVE_WARNING4);
+    console.error(SENSITIVE_WARNING5);
   }
   validateUmamiHost(opts.host);
   const sshCmd = [
@@ -11036,7 +11309,7 @@ async function streamUmamiLogs(opts, spawn = defaultLogsSpawn3, printOut, printE
   return { refused: false, exitCode };
 }
 function registerUmamiLogs(cli) {
-  cli.command("umami logs [service]", "Stream logs from an Umami service via SSH and docker compose.").option("--tail [n]", z24.number().default(100).describe("Number of log lines to tail from each service.")).option("--allow-ci", z24.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive credentials.")).option("--key [key]", z24.string().describe("Environment variable name holding the SSH host. Falls back to UMAMI_DOMAIN when omitted.")).action(async (service, options) => {
+  cli.command("umami logs [service]", "Stream logs from an Umami service via SSH and docker compose.").option("--tail [n]", z27.number().default(100).describe("Number of log lines to tail from each service.")).option("--allow-ci", z27.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive credentials.")).option("--key [key]", z27.string().describe("Environment variable name holding the SSH host. Falls back to UMAMI_DOMAIN when omitted.")).action(async (service, options) => {
     const targetService = service ?? "umami";
     try {
       validateService3(targetService);
@@ -11066,7 +11339,7 @@ function registerUmamiLogs(cli) {
 }
 
 // src/commands/umami/status.ts
-import { z as z25 } from "zod";
+import { z as z28 } from "zod";
 var COMPOSE_PROJECT_DIR7 = "/opt/umami";
 function parseComposePsOutput3(stdoutText) {
   const trimmed = stdoutText.trim();
@@ -11237,7 +11510,7 @@ async function umamiStatusAction(options, ctx, spawn) {
   }
 }
 function registerUmamiStatus(cli) {
-  cli.command("umami status", "Show operational health of the Umami analytics deployment via docker compose ps.").option("--key [key]", z25.string().optional().describe("Environment variable name holding the SSH host. Falls back to UMAMI_DOMAIN when omitted.")).action((options, ctx) => umamiStatusAction(options, ctx));
+  cli.command("umami status", "Show operational health of the Umami analytics deployment via docker compose ps.").option("--key [key]", z28.string().optional().describe("Environment variable name holding the SSH host. Falls back to UMAMI_DOMAIN when omitted.")).action((options, ctx) => umamiStatusAction(options, ctx));
 }
 
 // src/commands/umami/index.ts
@@ -11249,25 +11522,25 @@ function registerUmamiCommands(cli) {
 
 // src/commands/vpn/client.ts
 import { mkdir, writeFile as writeFile2 } from "fs/promises";
-import { join as join7, resolve as resolve2 } from "path";
-import { z as z27 } from "zod";
+import { join as join8, resolve as resolve2 } from "path";
+import { z as z30 } from "zod";
 
 // src/commands/vpn/peers.ts
 import { readFile, writeFile } from "fs/promises";
-import { z as z26 } from "zod";
-var peerSchema = z26.object({
-  name: z26.string(),
-  publicKey: z26.string(),
-  tunnelIp: z26.string()
+import { z as z29 } from "zod";
+var peerSchema = z29.object({
+  name: z29.string(),
+  publicKey: z29.string(),
+  tunnelIp: z29.string()
 });
-var peersFileSchema = z26.object({
-  peers: z26.array(peerSchema)
+var peersFileSchema = z29.object({
+  peers: z29.array(peerSchema)
 }).superRefine((data, ctx) => {
   const seenIps = new Set;
   for (const peer of data.peers) {
     if (seenIps.has(peer.tunnelIp)) {
       ctx.addIssue({
-        code: z26.ZodIssueCode.custom,
+        code: z29.ZodIssueCode.custom,
         message: `Duplicate tunnel IP "${peer.tunnelIp}" \u2014 each peer must have a unique tunnel IP.`,
         path: ["peers"]
       });
@@ -11279,7 +11552,7 @@ var peersFileSchema = z26.object({
   for (const peer of data.peers) {
     if (seenNames.has(peer.name)) {
       ctx.addIssue({
-        code: z26.ZodIssueCode.custom,
+        code: z29.ZodIssueCode.custom,
         message: `Duplicate name "${peer.name}" \u2014 each peer must have a unique name.`,
         path: ["peers"]
       });
@@ -11515,13 +11788,13 @@ async function vpnClientRemove(name, peersJsonPath, opts = {}) {
   await syncPeersSecret(peersJson, spawnFn, syncTimeoutMs);
 }
 function resolveDefaultPeersJsonPath() {
-  return join7(findRepoRoot(), "apps", "vpn", "config", "peers.json");
+  return join8(findRepoRoot(), "apps", "vpn", "config", "peers.json");
 }
 function resolveDefaultClientsDir() {
-  return join7(findRepoRoot(), "apps", "vpn", "clients");
+  return join8(findRepoRoot(), "apps", "vpn", "clients");
 }
 function registerVpnClient(cli) {
-  cli.command("vpn client add <name>", "Add a new VPN client peer. Generates a keypair, assigns a tunnel IP, writes the client .conf to apps/vpn/clients/, and syncs the roster to the VPN_PEERS GitHub secret (best-effort).").option("--split-tunnel [cidrs]", z27.string().describe("Comma-separated CIDRs for split-tunnel routing. Defaults to 0.0.0.0/0 (full tunnel).")).option("--dns [dns]", z27.string().describe("DNS server for the client config.")).option("--server-pubkey [key]", z27.string().describe("Server public key. Falls back to VPN_SERVER_PUBKEY env var.")).option("--endpoint [host]", z27.string().describe("VPN server endpoint (IP or hostname). Falls back to VPN_HOST env var.")).example('# Add a new client named "laptop"').example("infra vpn client add laptop").example("# Add a split-tunnel client").example("infra vpn client add laptop --split-tunnel 10.0.0.0/8,192.168.0.0/16").action(async (name, options) => {
+  cli.command("vpn client add <name>", "Add a new VPN client peer. Generates a keypair, assigns a tunnel IP, writes the client .conf to apps/vpn/clients/, and syncs the roster to the VPN_PEERS GitHub secret (best-effort).").option("--split-tunnel [cidrs]", z30.string().describe("Comma-separated CIDRs for split-tunnel routing. Defaults to 0.0.0.0/0 (full tunnel).")).option("--dns [dns]", z30.string().describe("DNS server for the client config.")).option("--server-pubkey [key]", z30.string().describe("Server public key. Falls back to VPN_SERVER_PUBKEY env var.")).option("--endpoint [host]", z30.string().describe("VPN server endpoint (IP or hostname). Falls back to VPN_HOST env var.")).example('# Add a new client named "laptop"').example("infra vpn client add laptop").example("# Add a split-tunnel client").example("infra vpn client add laptop --split-tunnel 10.0.0.0/8,192.168.0.0/16").action(async (name, options) => {
     const serverPublicKey = options.serverPubkey ?? process.env.VPN_SERVER_PUBKEY;
     const endpoint = options.endpoint ?? process.env.VPN_HOST;
     if (!serverPublicKey) {
@@ -11585,10 +11858,10 @@ function registerVpnClient(cli) {
 }
 
 // src/commands/vpn/deploy.ts
-import { z as z28 } from "zod";
-var REPO6 = "marcusrbrown/infra";
-var WORKFLOW_NAME6 = "Deploy VPN";
-var WORKFLOW_URL6 = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-vpn.yaml";
+import { z as z31 } from "zod";
+var REPO7 = "marcusrbrown/infra";
+var WORKFLOW_NAME7 = "Deploy VPN";
+var WORKFLOW_URL7 = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-vpn.yaml";
 function getVpnDeployEnv() {
   const path = process.env.PATH;
   const home = process.env.HOME;
@@ -11615,7 +11888,7 @@ function validateVpnRemotePreconditions() {
   }
 }
 function registerVpnDeploy(cli) {
-  cli.command("vpn deploy", "Deploy the VPN. Default mode triggers the GitHub Deploy VPN workflow, while --local runs apps/vpn deploy directly with Bun.").option("--local", z28.boolean().default(false).describe("Run local deployment with Bun using apps/vpn instead of triggering GitHub Actions.")).option("--dry-run", z28.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).option("--force-server-key", z28.boolean().default(false).describe("Force regeneration of the server WireGuard keypair. WARNING: invalidates all existing client configs.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra vpn deploy").example("# Validate local deploy preconditions and planned command").example("infra vpn deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra vpn deploy --local").action(async (options) => {
+  cli.command("vpn deploy", "Deploy the VPN. Default mode triggers the GitHub Deploy VPN workflow, while --local runs apps/vpn deploy directly with Bun.").option("--local", z31.boolean().default(false).describe("Run local deployment with Bun using apps/vpn instead of triggering GitHub Actions.")).option("--dry-run", z31.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).option("--force-server-key", z31.boolean().default(false).describe("Force regeneration of the server WireGuard keypair. WARNING: invalidates all existing client configs.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra vpn deploy").example("# Validate local deploy preconditions and planned command").example("infra vpn deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra vpn deploy --local").action(async (options) => {
     if (options.local) {
       const command = [
         "bun",
@@ -11645,44 +11918,44 @@ function registerVpnDeploy(cli) {
     validateVpnRemotePreconditions();
     if (options.dryRun) {
       console.log("Dry run: remote vpn deploy");
-      console.log(`- command: gh workflow run "${WORKFLOW_NAME6}" --repo ${REPO6}`);
-      console.log(`- workflow URL: ${WORKFLOW_URL6}`);
+      console.log(`- command: gh workflow run "${WORKFLOW_NAME7}" --repo ${REPO7}`);
+      console.log(`- workflow URL: ${WORKFLOW_URL7}`);
       return;
     }
-    const child = Bun.spawn(["gh", "workflow", "run", WORKFLOW_NAME6, "--repo", REPO6], {
+    const child = Bun.spawn(["gh", "workflow", "run", WORKFLOW_NAME7, "--repo", REPO7], {
       stdout: "inherit",
       stderr: "inherit"
     });
     const exitCode = await child.exited;
     if (exitCode !== 0) {
-      throw new Error(`Failed to trigger "${WORKFLOW_NAME6}" workflow (exit code ${exitCode})`);
+      throw new Error(`Failed to trigger "${WORKFLOW_NAME7}" workflow (exit code ${exitCode})`);
     }
-    console.log(`Workflow triggered: ${WORKFLOW_URL6}`);
+    console.log(`Workflow triggered: ${WORKFLOW_URL7}`);
     console.log("Approve the vpn environment deployment in GitHub Actions to continue.");
   });
 }
 
 // src/commands/vpn/logs.ts
-import { z as z29 } from "zod";
+import { z as z32 } from "zod";
 
 // src/commands/vpn/host.ts
-var VALID_HOST_RE5 = /^[a-z\d][a-z\d.\-]*$/i;
+var VALID_HOST_RE6 = /^[a-z\d][a-z\d.\-]*$/i;
 function validateVpnHost(host) {
   if (!host) {
     throw new Error("Invalid VPN_HOST: value is empty");
   }
-  if (!VALID_HOST_RE5.test(host)) {
+  if (!VALID_HOST_RE6.test(host)) {
     throw new Error(`Invalid VPN_HOST: value is not a valid hostname (must match ${String.raw`[A-Za-z0-9][A-Za-z0-9.\-]*`})`);
   }
   return host;
 }
 
 // src/commands/vpn/logs.ts
-var SENSITIVE_WARNING5 = "Warning: Logs may contain peer IP addresses, handshake data, or other sensitive VPN information. Treat output as sensitive; do not capture in shared logs or chat.";
-function defaultLogsSpawn4(cmd, opts) {
+var SENSITIVE_WARNING6 = "Warning: Logs may contain peer IP addresses, handshake data, or other sensitive VPN information. Treat output as sensitive; do not capture in shared logs or chat.";
+function defaultLogsSpawn5(cmd, opts) {
   return Bun.spawn(cmd, opts);
 }
-async function streamVpnLogs(opts, spawn = defaultLogsSpawn4, printOut, printErr) {
+async function streamVpnLogs(opts, spawn = defaultLogsSpawn5, printOut, printErr) {
   const isCI = process.env.CI === "true";
   if (isCI && !opts.allowCi) {
     const msg = "Refusing to stream logs in CI without --allow-ci. Logs may contain sensitive VPN data.";
@@ -11694,9 +11967,9 @@ async function streamVpnLogs(opts, spawn = defaultLogsSpawn4, printOut, printErr
     return { refused: true };
   }
   if (printErr) {
-    printErr(SENSITIVE_WARNING5);
+    printErr(SENSITIVE_WARNING6);
   } else {
-    console.error(SENSITIVE_WARNING5);
+    console.error(SENSITIVE_WARNING6);
   }
   validateVpnHost(opts.host);
   const sshCmd = [
@@ -11719,7 +11992,7 @@ async function streamVpnLogs(opts, spawn = defaultLogsSpawn4, printOut, printErr
   return { refused: false, exitCode };
 }
 function registerVpnLogs(cli) {
-  cli.command("vpn logs", "Stream WireGuard VPN logs via SSH and journalctl.").option("--tail [n]", z29.number().default(100).describe("Number of log lines to tail.")).option("--allow-ci", z29.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive VPN data.")).option("--key [key]", z29.string().describe("Environment variable name holding the SSH host. Falls back to VPN_HOST when omitted.")).action(async (options) => {
+  cli.command("vpn logs", "Stream WireGuard VPN logs via SSH and journalctl.").option("--tail [n]", z32.number().default(100).describe("Number of log lines to tail.")).option("--allow-ci", z32.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive VPN data.")).option("--key [key]", z32.string().describe("Environment variable name holding the SSH host. Falls back to VPN_HOST when omitted.")).action(async (options) => {
     const hostEnvKey = options.key ?? "VPN_HOST";
     const host = process.env[hostEnvKey];
     if (!host) {
@@ -11741,7 +12014,7 @@ function registerVpnLogs(cli) {
 }
 
 // src/commands/vpn/status.ts
-import { z as z30 } from "zod";
+import { z as z33 } from "zod";
 
 // src/commands/vpn/shared.ts
 function parseWgShowOutput(output) {
@@ -11868,7 +12141,7 @@ async function vpnStatusAction(options, ctx, spawn) {
   }
 }
 function registerVpnStatus(cli) {
-  cli.command("vpn status", "Show operational health of the VPN box via SSH and wg show.").option("--key [key]", z30.string().describe("Environment variable name holding the SSH host. Falls back to VPN_HOST when omitted.")).action((options, ctx) => vpnStatusAction(options, ctx));
+  cli.command("vpn status", "Show operational health of the VPN box via SSH and wg show.").option("--key [key]", z33.string().describe("Environment variable name holding the SSH host. Falls back to VPN_HOST when omitted.")).action((options, ctx) => vpnStatusAction(options, ctx));
 }
 
 // src/commands/vpn/index.ts
@@ -11912,7 +12185,8 @@ function toJsonPayload(rows) {
     gateway: rows.find((row) => row.app === "gateway") ?? errorSummary("gateway", "missing result"),
     umami: rows.find((row) => row.app === "umami") ?? errorSummary("umami", "missing result"),
     dashboard: rows.find((row) => row.app === "dashboard") ?? errorSummary("dashboard", "missing result"),
-    vpn: rows.find((row) => row.app === "vpn") ?? errorSummary("vpn", "missing result")
+    vpn: rows.find((row) => row.app === "vpn") ?? errorSummary("vpn", "missing result"),
+    broker: rows.find((row) => row.app === "broker") ?? errorSummary("broker", "missing result")
   };
 }
 function formatRow(row) {
@@ -11925,7 +12199,8 @@ async function unifiedStatusAction(options, ctx, dependencies = {
   getGatewayStatusSummary,
   getUmamiStatusSummary,
   getDashboardStatusSummary,
-  getVpnStatusSummary
+  getVpnStatusSummary,
+  getBrokerStatusSummary
 }) {
   const verbose = options.verbose === true;
   const cliproxyBaseUrl = stripTrailingSlash6(process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL7);
@@ -11934,15 +12209,17 @@ async function unifiedStatusAction(options, ctx, dependencies = {
   const umamiHost = process.env.UMAMI_DOMAIN ?? "";
   const dashboardHost = process.env.DASHBOARD_DOMAIN ?? "";
   const vpnHost = process.env.VPN_HOST ?? "";
+  const brokerHost = process.env.BROKER_DOMAIN ?? process.env.BROKER_HOST ?? "";
   const results = await Promise.allSettled([
     dependencies.getKeewebStatusSummary(verbose),
     dependencies.getCliproxyStatusSummary(cliproxyBaseUrl, cliproxyKey, verbose),
     dependencies.getGatewayStatusSummary(gatewayHost),
     dependencies.getUmamiStatusSummary(umamiHost),
     dependencies.getDashboardStatusSummary(dashboardHost),
-    dependencies.getVpnStatusSummary(vpnHost)
+    dependencies.getVpnStatusSummary(vpnHost),
+    dependencies.getBrokerStatusSummary(brokerHost)
   ]);
-  const appNames = ["keeweb", "cliproxy", "gateway", "umami", "dashboard", "vpn"];
+  const appNames = ["keeweb", "cliproxy", "gateway", "umami", "dashboard", "vpn", "broker"];
   const rows = results.map((result, index) => {
     const app = appNames[index] ?? "keeweb";
     if (result.status === "fulfilled") {
@@ -11968,9 +12245,10 @@ function registerStatus(cli, dependencies = {
   getGatewayStatusSummary,
   getUmamiStatusSummary,
   getDashboardStatusSummary,
-  getVpnStatusSummary
+  getVpnStatusSummary,
+  getBrokerStatusSummary
 }) {
-  cli.command("status", "Show status of all deployments").option("--json", z31.boolean().describe("Output machine-readable JSON with keeweb, cliproxy, gateway, umami, dashboard, and vpn summary objects.")).option("--verbose", z31.boolean().describe("Include verbose per-app health check details when building the summary rows.")).action((options, ctx) => unifiedStatusAction(options, ctx, dependencies));
+  cli.command("status", "Show status of all deployments").option("--json", z34.boolean().describe("Output machine-readable JSON with keeweb, cliproxy, gateway, umami, dashboard, vpn, and broker summary objects.")).option("--verbose", z34.boolean().describe("Include verbose per-app health check details when building the summary rows.")).action((options, ctx) => unifiedStatusAction(options, ctx, dependencies));
 }
 
 // src/cli.ts
@@ -11978,6 +12256,7 @@ var cli = goke("infra");
 cli.option("--verbose", "Enable verbose output for all commands");
 registerKeewebCommands(cli);
 registerCliproxyCommands(cli);
+registerBrokerCommands(cli);
 registerGatewayCommands(cli);
 registerUmamiCommands(cli);
 registerDashboardCommands(cli);