@marcusrbrown/infra 0.20.0 → 0.22.0

package/dist/cli.js

@@ -6949,7 +6949,7 @@ import { goke } from "goke";
 // package.json
 var package_default = {
   name: "@marcusrbrown/infra",
-  version: "0.20.0",
+  version: "0.22.0",
   description: "Infrastructure management CLI \u2014 deploy automation, health checks, and MCP bridge",
   keywords: [
     "infra",
@@ -7142,7 +7142,7 @@ async function promptValue(promise, cancelMessage) {
 }
 function buildApiKeyValue(keyName) {
   const slug = (keyName.trim().toLowerCase().match(/[a-z0-9]+/g) ?? []).join("-").slice(0, 24);
-  const random = crypto.randomUUID().split("-").join("");
+  const random = crypto.randomUUID().replaceAll("-", "");
   return `sk-${slug || "cliproxy"}-${random}`;
 }
 function extractErrorMessage(error) {
@@ -7842,7 +7842,7 @@ async function verifyModelsAvailable(baseUrl, key, providers, model) {
   }
   const slashIndex = model.indexOf("/");
   const bareId = slashIndex === -1 ? model : model.slice(slashIndex + 1);
-  const providerPrefix = slashIndex >= 0 ? model.slice(0, slashIndex) : undefined;
+  const providerPrefix = slashIndex === -1 ? undefined : model.slice(0, slashIndex);
   const modelPresent = entries.some((e) => e.id === bareId || e.id === model);
   if (!modelPresent) {
     const matchingIds = providerPrefix ? entries.filter((e) => entryMatchesProvider(e, providerPrefix)).map((e) => e.id) : entries.map((e) => e.id);
@@ -11404,6 +11404,104 @@ function registerCliproxyOpen(cli) {
   });
 }
 
+// src/commands/cliproxy/reset-quota.ts
+import { z as z18 } from "zod";
+var DEFAULT_CLIPROXY_URL8 = "https://cliproxy.fro.bot";
+var ResetQuotaResponseSchema = z18.object({
+  status: z18.literal("ok"),
+  auth_index: z18.string(),
+  models: z18.array(z18.unknown())
+});
+var AuthFileSchema = z18.object({
+  id: z18.string(),
+  auth_index: z18.string(),
+  name: z18.string(),
+  type: z18.string(),
+  provider: z18.string(),
+  email: z18.string()
+});
+var AuthFilesResponseSchema = z18.object({
+  files: z18.array(AuthFileSchema)
+});
+var ManagementErrorSchema = z18.object({ error: z18.string() });
+function stripTrailingSlash6(value) {
+  return value.endsWith("/") ? value.slice(0, -1) : value;
+}
+function resolveBaseUrl4(input) {
+  return stripTrailingSlash6(input ?? process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL8);
+}
+function resolveManagementKey4(input) {
+  const key = input ?? process.env.CLIPROXY_MANAGEMENT_KEY;
+  if (!key) {
+    throw new Error("Management API key is required. Pass --key or set CLIPROXY_MANAGEMENT_KEY.");
+  }
+  return key;
+}
+async function requestParsedJson(endpoint, init, schema) {
+  const response = await fetch(endpoint, {
+    ...init,
+    signal: AbortSignal.timeout(HTTP_TIMEOUT_MS)
+  });
+  const body = await response.text();
+  let payload;
+  try {
+    payload = body.length === 0 ? null : JSON.parse(body);
+  } catch {
+    payload = undefined;
+  }
+  if (!response.ok) {
+    const error = ManagementErrorSchema.safeParse(payload);
+    if (error.success) {
+      throw new Error(error.data.error);
+    }
+    throw new Error(`${init.method ?? "GET"} ${endpoint} failed with HTTP ${response.status}: ${body}`);
+  }
+  return schema.parse(payload);
+}
+function formatAuthFile(file, index) {
+  return `${index + 1}. ${file.auth_index} \u2014 ${file.name} (${file.provider}, ${file.email})`;
+}
+async function cliproxyResetQuotaAction(authIndex, options, ctx) {
+  try {
+    const baseUrl = resolveBaseUrl4(options.url);
+    const managementKey = resolveManagementKey4(options.key);
+    if (options.list) {
+      const files = (await requestParsedJson(`${baseUrl}/v0/management/auth-files`, {
+        method: "GET",
+        headers: managementHeaders(managementKey)
+      }, AuthFilesResponseSchema)).files;
+      if (options.json) {
+        ctx.console.log(JSON.stringify(files, null, 2));
+      } else if (files.length === 0) {
+        ctx.console.log("No auth files configured");
+      } else {
+        for (const [index, file] of files.entries()) {
+          ctx.console.log(formatAuthFile(file, index));
+        }
+      }
+      return files;
+    }
+    if (!authIndex) {
+      throw new Error("auth_index is required. Pass an auth index or use --list to enumerate auth files.");
+    }
+    const payload = await requestParsedJson(`${baseUrl}/v0/management/reset-quota`, {
+      method: "POST",
+      headers: managementHeaders(managementKey),
+      body: JSON.stringify({ auth_index: authIndex })
+    }, ResetQuotaResponseSchema);
+    ctx.console.log(JSON.stringify(payload, null, 2));
+    return payload;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    ctx.console.error(message);
+    ctx.process.exit(1);
+    return [];
+  }
+}
+function registerCliproxyResetQuota(cli) {
+  cli.command("cliproxy reset-quota [auth-index]", "Reset the quota for one CLIProxyAPI auth record, or list valid auth indexes.").option("--url [url]", z18.string().describe("Base URL for CLIProxyAPI management requests. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.")).option("--key [key]", z18.string().describe("Management API key. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.")).option("--list", "List auth records and their auth indexes without resetting quota.").option("--json", "Output auth records as JSON when used with --list.").example("# List valid auth indexes before resetting one").example("infra cliproxy reset-quota --list").example("# Reset quota for one auth record").example("infra cliproxy reset-quota auth-index-123").action(cliproxyResetQuotaAction);
+}
+
 // src/commands/cliproxy/setup.ts
 function registerCliproxySetup(cli) {
   registerSetupCommand(cli, "cliproxy setup");
@@ -11419,11 +11517,12 @@ function registerCliproxyCommands(cli) {
   registerCliproxyModels(cli);
   registerCliproxyMonitor(cli);
   registerCliproxyOpen(cli);
+  registerCliproxyResetQuota(cli);
   registerCliproxySetup(cli);
 }
 
 // src/commands/dashboard/deploy.ts
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 var REPO3 = "marcusrbrown/infra";
 var WORKFLOW_NAME3 = "Deploy Dashboard";
 var WORKFLOW_URL3 = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-dashboard.yaml";
@@ -11485,7 +11584,7 @@ function validateDashboardRemotePreconditions() {
   }
 }
 function registerDashboardDeploy(cli) {
-  cli.command("dashboard deploy", "Deploy the dashboard. Default mode triggers the GitHub Deploy Dashboard workflow, while --local runs apps/dashboard deploy directly with Bun.").option("--local", z18.boolean().default(false).describe("Run local deployment with Bun using apps/dashboard instead of triggering GitHub Actions.")).option("--dry-run", z18.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).option("--image-version <version>", z18.string().optional().describe("CalVer version to deploy (e.g. 2026.06.47). Remote-only. Triggers the versioned release path and requires dashboard environment approval. Must match YYYY.MM.N. Forwarded as -f version=<value> to gh workflow run.")).option("--digest <digest>", z18.string().optional().describe("Expected sha256 digest (e.g. sha256:abc...def). Remote-only. Requires --image-version. When set, the workflow fails if GHCR resolves the tag to a different digest. Must match sha256:<64 hex chars>.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra dashboard deploy").example("# Deploy a specific CalVer release via GitHub Actions").example("infra dashboard deploy --image-version 2026.06.47").example("# Deploy a specific release with digest cross-check").example("infra dashboard deploy --image-version 2026.06.47 --digest sha256:<64 hex>").example("# Validate local deploy preconditions and planned command").example("infra dashboard deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra dashboard deploy --local").action(async (options) => {
+  cli.command("dashboard deploy", "Deploy the dashboard. Default mode triggers the GitHub Deploy Dashboard workflow, while --local runs apps/dashboard deploy directly with Bun.").option("--local", z19.boolean().default(false).describe("Run local deployment with Bun using apps/dashboard instead of triggering GitHub Actions.")).option("--dry-run", z19.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).option("--image-version <version>", z19.string().optional().describe("CalVer version to deploy (e.g. 2026.06.47). Remote-only. Triggers the versioned release path and requires dashboard environment approval. Must match YYYY.MM.N. Forwarded as -f version=<value> to gh workflow run.")).option("--digest <digest>", z19.string().optional().describe("Expected sha256 digest (e.g. sha256:abc...def). Remote-only. Requires --image-version. When set, the workflow fails if GHCR resolves the tag to a different digest. Must match sha256:<64 hex chars>.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra dashboard deploy").example("# Deploy a specific CalVer release via GitHub Actions").example("infra dashboard deploy --image-version 2026.06.47").example("# Deploy a specific release with digest cross-check").example("infra dashboard deploy --image-version 2026.06.47 --digest sha256:<64 hex>").example("# Validate local deploy preconditions and planned command").example("infra dashboard deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra dashboard deploy --local").action(async (options) => {
     validateReleaseFlags({ imageVersion: options.imageVersion, digest: options.digest, local: options.local });
     if (options.local) {
       const command = ["bun", "run", "--cwd", "apps/dashboard", "deploy"];
@@ -11528,7 +11627,7 @@ function registerDashboardDeploy(cli) {
 }
 
 // src/commands/dashboard/logs.ts
-import { z as z19 } from "zod";
+import { z as z20 } from "zod";
 
 // src/commands/dashboard/host.ts
 var VALID_HOST_RE3 = /^[a-z\d][a-z\d.\-]*$/i;
@@ -11601,7 +11700,7 @@ async function streamDashboardLogs(opts, spawn = defaultLogsSpawn2, printOut, pr
   return { refused: false, exitCode };
 }
 function registerDashboardLogs(cli) {
-  cli.command("dashboard logs [service]", "Stream logs from a dashboard service via SSH and docker compose.").option("--tail [n]", z19.number().default(100).describe("Number of log lines to tail from each service.")).option("--allow-ci", z19.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive credentials.")).option("--key [key]", z19.string().describe("Environment variable name holding the SSH host. Falls back to DASHBOARD_DOMAIN when omitted.")).action(async (service, options) => {
+  cli.command("dashboard logs [service]", "Stream logs from a dashboard service via SSH and docker compose.").option("--tail [n]", z20.number().default(100).describe("Number of log lines to tail from each service.")).option("--allow-ci", z20.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive credentials.")).option("--key [key]", z20.string().describe("Environment variable name holding the SSH host. Falls back to DASHBOARD_DOMAIN when omitted.")).action(async (service, options) => {
     const targetService = service ?? "dashboard";
     try {
       validateService(targetService);
@@ -11631,7 +11730,7 @@ function registerDashboardLogs(cli) {
 }
 
 // src/commands/dashboard/status.ts
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 var COMPOSE_PROJECT_DIR2 = "/opt/dashboard";
 function parseComposePsOutput(stdoutText) {
   const trimmed = stdoutText.trim();
@@ -11805,7 +11904,7 @@ async function dashboardStatusAction(options, ctx, spawn) {
   }
 }
 function registerDashboardStatus(cli) {
-  cli.command("dashboard status", "Show operational health of the dashboard deployment via docker compose ps.").option("--key [key]", z20.string().optional().describe("Environment variable name holding the SSH host. Falls back to DASHBOARD_DOMAIN when omitted.")).action((options, ctx) => dashboardStatusAction(options, ctx));
+  cli.command("dashboard status", "Show operational health of the dashboard deployment via docker compose ps.").option("--key [key]", z21.string().optional().describe("Environment variable name holding the SSH host. Falls back to DASHBOARD_DOMAIN when omitted.")).action((options, ctx) => dashboardStatusAction(options, ctx));
 }
 
 // src/commands/dashboard/index.ts
@@ -11817,7 +11916,7 @@ function registerDashboardCommands(cli) {
 
 // src/commands/gateway/backup.ts
 import { closeSync, constants as fsConstants, openSync, renameSync, unlinkSync, writeSync } from "fs";
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 
 // src/commands/gateway/host.ts
 var VALID_HOST_RE4 = /^[a-z\d][a-z\d.\-]*$/i;
@@ -11927,11 +12026,11 @@ async function gatewayBackupAction(options, ctx, spawn) {
   ctx.console.log(`CA backup written to: ${output}`);
 }
 function registerGatewayBackup(cli) {
-  cli.command("gateway backup", "Back up the mitmproxy CA certificate and private key from the gateway Docker volume to a local tarball. The output contains the CA private trust anchor \u2014 treat it as sensitive material.").option("--output [file]", z21.string().default(DEFAULT_OUTPUT).describe("Local path to write the CA tarball. File permissions are set to 0600 after writing.")).option("--include-ca", z21.boolean().default(true).describe("Include the mitmproxy CA certificate and private key in the backup. Currently the only supported backup target.")).example("# Back up the CA to the default path").example("infra gateway backup --include-ca").example("# Back up the CA to a custom path").example("infra gateway backup --output /secure/backup/mitmproxy-ca.tar").action(gatewayBackupAction);
+  cli.command("gateway backup", "Back up the mitmproxy CA certificate and private key from the gateway Docker volume to a local tarball. The output contains the CA private trust anchor \u2014 treat it as sensitive material.").option("--output [file]", z22.string().default(DEFAULT_OUTPUT).describe("Local path to write the CA tarball. File permissions are set to 0600 after writing.")).option("--include-ca", z22.boolean().default(true).describe("Include the mitmproxy CA certificate and private key in the backup. Currently the only supported backup target.")).example("# Back up the CA to the default path").example("infra gateway backup --include-ca").example("# Back up the CA to a custom path").example("infra gateway backup --output /secure/backup/mitmproxy-ca.tar").action(gatewayBackupAction);
 }
 
 // src/commands/gateway/deploy.ts
-import { z as z22 } from "zod";
+import { z as z23 } from "zod";
 var REPO4 = "marcusrbrown/infra";
 var WORKFLOW_NAME4 = "Deploy Gateway";
 var WORKFLOW_URL4 = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-gateway.yaml";
@@ -12000,7 +12099,7 @@ function validateGatewayRemotePreconditions() {
   }
 }
 function registerGatewayDeploy(cli) {
-  cli.command("gateway deploy", "Deploy the gateway. Default mode triggers the GitHub Deploy Gateway workflow, while --local runs apps/gateway deploy directly with Bun.").option("--local", z22.boolean().default(false).describe("Run local deployment with Bun using apps/gateway instead of triggering GitHub Actions.")).option("--dry-run", z22.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).option("--force-recreate", z22.boolean().default(false).describe("Force recreate containers. Forwarded only in local mode.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra gateway deploy").example("# Validate local deploy preconditions and planned command").example("infra gateway deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra gateway deploy --local").action(async (options) => {
+  cli.command("gateway deploy", "Deploy the gateway. Default mode triggers the GitHub Deploy Gateway workflow, while --local runs apps/gateway deploy directly with Bun.").option("--local", z23.boolean().default(false).describe("Run local deployment with Bun using apps/gateway instead of triggering GitHub Actions.")).option("--dry-run", z23.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).option("--force-recreate", z23.boolean().default(false).describe("Force recreate containers. Forwarded only in local mode.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra gateway deploy").example("# Validate local deploy preconditions and planned command").example("infra gateway deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra gateway deploy --local").action(async (options) => {
     if (options.local) {
       const command = [
         "bun",
@@ -12048,7 +12147,7 @@ function registerGatewayDeploy(cli) {
 }
 
 // src/commands/gateway/logs.ts
-import { z as z23 } from "zod";
+import { z as z24 } from "zod";
 var COMPOSE_PROJECT_DIR3 = "/opt/gateway/deploy";
 var SENSITIVE_WARNING4 = "Warning: Logs may contain Discord tokens, S3 credentials, or user data. Treat output as sensitive; do not capture in shared logs or chat.";
 var VALID_SERVICES2 = ["gateway", "workspace", "mitmproxy"];
@@ -12097,7 +12196,7 @@ async function streamGatewayLogs(opts, spawn = defaultLogsSpawn3, printOut, prin
   return { refused: false, exitCode };
 }
 function registerGatewayLogs(cli) {
-  cli.command("gateway logs [service]", "Stream logs from a gateway service via SSH and docker compose.").option("--tail [n]", z23.number().default(100).describe("Number of log lines to tail from each service.")).option("--allow-ci", z23.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive credentials.")).option("--key [key]", z23.string().describe("Environment variable name holding the SSH host. Falls back to GATEWAY_HOST when omitted.")).action(async (service, options) => {
+  cli.command("gateway logs [service]", "Stream logs from a gateway service via SSH and docker compose.").option("--tail [n]", z24.number().default(100).describe("Number of log lines to tail from each service.")).option("--allow-ci", z24.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive credentials.")).option("--key [key]", z24.string().describe("Environment variable name holding the SSH host. Falls back to GATEWAY_HOST when omitted.")).action(async (service, options) => {
     const targetService = service ?? "gateway";
     try {
       validateService2(targetService);
@@ -12127,7 +12226,7 @@ function registerGatewayLogs(cli) {
 }
 
 // src/commands/gateway/restore.ts
-import { z as z24 } from "zod";
+import { z as z25 } from "zod";
 var MITMPROXY_CERTS_VOLUME2 = "mitmproxy-certs";
 var CA_CERT_FILE2 = "mitmproxy-ca-cert.pem";
 var CA_KEY_FILE2 = "mitmproxy-ca.pem";
@@ -12281,7 +12380,7 @@ async function restoreGatewayCa(opts, spawn = defaultSpawn4) {
   }
 }
 function registerGatewayRestore(cli) {
-  cli.command("gateway restore", "Restore the mitmproxy CA certificate and private key from a local tarball into the gateway Docker volume. Restarts mitmproxy and gateway services after restore and confirms byte-equal content before reporting success.").option("--input <file>", z24.string().describe("Path to the tarball produced by `gateway backup --include-ca`. Required.")).option("--include-ca", z24.boolean().default(true).describe("Restore the mitmproxy CA certificate and private key. Currently the only supported restore target.")).example("# Restore CA from a backup tarball").example("infra gateway restore --input apps/gateway/.local/mitmproxy-ca.tar").example("# Restore CA from a custom path").example("infra gateway restore --input /secure/backup/mitmproxy-ca.tar --include-ca").action(async (options) => {
+  cli.command("gateway restore", "Restore the mitmproxy CA certificate and private key from a local tarball into the gateway Docker volume. Restarts mitmproxy and gateway services after restore and confirms byte-equal content before reporting success.").option("--input <file>", z25.string().describe("Path to the tarball produced by `gateway backup --include-ca`. Required.")).option("--include-ca", z25.boolean().default(true).describe("Restore the mitmproxy CA certificate and private key. Currently the only supported restore target.")).example("# Restore CA from a backup tarball").example("infra gateway restore --input apps/gateway/.local/mitmproxy-ca.tar").example("# Restore CA from a custom path").example("infra gateway restore --input /secure/backup/mitmproxy-ca.tar --include-ca").action(async (options) => {
     const hostEnvKey = "GATEWAY_HOST";
     const host = process.env[hostEnvKey];
     if (!host) {
@@ -12302,7 +12401,7 @@ function registerGatewayRestore(cli) {
 }
 
 // src/commands/gateway/status.ts
-import { z as z25 } from "zod";
+import { z as z26 } from "zod";
 var COMPOSE_PROJECT_DIR5 = "/opt/gateway/deploy";
 function parseComposePsOutput2(stdoutText) {
   const trimmed = stdoutText.trim();
@@ -12444,7 +12543,7 @@ async function gatewayStatusAction(options, ctx, spawn) {
   }
 }
 function registerGatewayStatus(cli) {
-  cli.command("gateway status", "Show operational health of the gateway deployment via docker compose ps.").option("--key [key]", z25.string().describe("Environment variable name holding the SSH host. Falls back to GATEWAY_HOST when omitted.")).action((options, ctx) => gatewayStatusAction(options, ctx));
+  cli.command("gateway status", "Show operational health of the gateway deployment via docker compose ps.").option("--key [key]", z26.string().describe("Environment variable name holding the SSH host. Falls back to GATEWAY_HOST when omitted.")).action((options, ctx) => gatewayStatusAction(options, ctx));
 }
 
 // src/commands/gateway/index.ts
@@ -12459,7 +12558,7 @@ function registerGatewayCommands(cli) {
 // src/commands/keeweb/deploy.ts
 import { existsSync as existsSync5 } from "fs";
 import { join as join6 } from "path";
-import { z as z26 } from "zod";
+import { z as z27 } from "zod";
 var REPO5 = "marcusrbrown/infra";
 var WORKFLOW_NAME5 = "Deploy KeeWeb";
 var WORKFLOW_URL5 = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-keeweb.yaml";
@@ -12513,7 +12612,7 @@ function validateRemotePreconditions3() {
   }
 }
 function registerKeewebDeploy(cli) {
-  cli.command("keeweb deploy", "Trigger KeeWeb deployment. Default mode dispatches the GitHub Deploy KeeWeb workflow. Use --local to run apps/keeweb/deploy.sh directly from this repo.").option("--local", z26.boolean().default(false).describe("Run local deployment using apps/keeweb/deploy.sh instead of triggering GitHub Actions.")).option("--nginx", z26.boolean().default(false).describe("Include nginx config deployment. Valid only with --local and passed through to deploy.sh as --nginx.")).option("--dry-run", z26.boolean().default(false).describe("Print planned actions without validating preconditions, executing deploy.sh, or triggering GitHub Actions.")).example("# Trigger GitHub Deploy KeeWeb workflow (default mode)").example("infra keeweb deploy").example("# Preview local deploy plan without side effects").example("infra keeweb deploy --local --dry-run").example("# Run local deploy including nginx config update").example("infra keeweb deploy --local --nginx").action(async (options) => {
+  cli.command("keeweb deploy", "Trigger KeeWeb deployment. Default mode dispatches the GitHub Deploy KeeWeb workflow. Use --local to run apps/keeweb/deploy.sh directly from this repo.").option("--local", z27.boolean().default(false).describe("Run local deployment using apps/keeweb/deploy.sh instead of triggering GitHub Actions.")).option("--nginx", z27.boolean().default(false).describe("Include nginx config deployment. Valid only with --local and passed through to deploy.sh as --nginx.")).option("--dry-run", z27.boolean().default(false).describe("Print planned actions without validating preconditions, executing deploy.sh, or triggering GitHub Actions.")).example("# Trigger GitHub Deploy KeeWeb workflow (default mode)").example("infra keeweb deploy").example("# Preview local deploy plan without side effects").example("infra keeweb deploy --local --dry-run").example("# Run local deploy including nginx config update").example("infra keeweb deploy --local --nginx").action(async (options) => {
     if (options.nginx && !options.local) {
       throw new Error("--nginx is only valid with --local");
     }
@@ -12592,13 +12691,13 @@ function registerKeewebOpen(cli) {
 
 // src/commands/keeweb/status.ts
 import { join as join7 } from "path";
-import { z as z27 } from "zod";
+import { z as z28 } from "zod";
 var SITE_URL = "https://kw.igg.ms/";
 var GH_REPO = "marcusrbrown/infra";
 var HTTP_TIMEOUT_MS4 = 1e4;
-var ghRunSchema = z27.array(z27.object({
-  createdAt: z27.string().min(1),
-  url: z27.url()
+var ghRunSchema = z28.array(z28.object({
+  createdAt: z28.string().min(1),
+  url: z28.url()
 }));
 function levelLabel2(level) {
   if (level === "ok") {
@@ -12896,10 +12995,10 @@ function registerMcp(cli) {
 }
 
 // src/commands/status.ts
-import { z as z36 } from "zod";
+import { z as z37 } from "zod";
 
 // src/commands/umami/deploy.ts
-import { z as z28 } from "zod";
+import { z as z29 } from "zod";
 var REPO6 = "marcusrbrown/infra";
 var WORKFLOW_NAME6 = "Deploy Umami";
 var WORKFLOW_URL6 = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-umami.yaml";
@@ -12934,7 +13033,7 @@ function validateUmamiRemotePreconditions() {
   }
 }
 function registerUmamiDeploy(cli) {
-  cli.command("umami deploy", "Deploy Umami analytics. Default mode triggers the GitHub Deploy Umami workflow, while --local runs apps/umami deploy directly with Bun.").option("--local", z28.boolean().default(false).describe("Run local deployment with Bun using apps/umami instead of triggering GitHub Actions.")).option("--dry-run", z28.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra umami deploy").example("# Validate local deploy preconditions and planned command").example("infra umami deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra umami deploy --local").action(async (options) => {
+  cli.command("umami deploy", "Deploy Umami analytics. Default mode triggers the GitHub Deploy Umami workflow, while --local runs apps/umami deploy directly with Bun.").option("--local", z29.boolean().default(false).describe("Run local deployment with Bun using apps/umami instead of triggering GitHub Actions.")).option("--dry-run", z29.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra umami deploy").example("# Validate local deploy preconditions and planned command").example("infra umami deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra umami deploy --local").action(async (options) => {
     if (options.local) {
       const command = ["bun", "run", "--cwd", "apps/umami", "deploy"];
       if (options.dryRun) {
@@ -12975,7 +13074,7 @@ function registerUmamiDeploy(cli) {
 }
 
 // src/commands/umami/logs.ts
-import { z as z29 } from "zod";
+import { z as z30 } from "zod";
 
 // src/commands/umami/host.ts
 var VALID_HOST_RE5 = /^[a-z\d][a-z\d.\-]*$/i;
@@ -13039,7 +13138,7 @@ async function streamUmamiLogs(opts, spawn = defaultLogsSpawn4, printOut, printE
   return { refused: false, exitCode };
 }
 function registerUmamiLogs(cli) {
-  cli.command("umami logs [service]", "Stream logs from an Umami service via SSH and docker compose.").option("--tail [n]", z29.number().default(100).describe("Number of log lines to tail from each service.")).option("--allow-ci", z29.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive credentials.")).option("--key [key]", z29.string().describe("Environment variable name holding the SSH host. Falls back to UMAMI_DOMAIN when omitted.")).action(async (service, options) => {
+  cli.command("umami logs [service]", "Stream logs from an Umami service via SSH and docker compose.").option("--tail [n]", z30.number().default(100).describe("Number of log lines to tail from each service.")).option("--allow-ci", z30.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive credentials.")).option("--key [key]", z30.string().describe("Environment variable name holding the SSH host. Falls back to UMAMI_DOMAIN when omitted.")).action(async (service, options) => {
     const targetService = service ?? "umami";
     try {
       validateService3(targetService);
@@ -13069,7 +13168,7 @@ function registerUmamiLogs(cli) {
 }
 
 // src/commands/umami/status.ts
-import { z as z30 } from "zod";
+import { z as z31 } from "zod";
 var COMPOSE_PROJECT_DIR7 = "/opt/umami";
 function parseComposePsOutput3(stdoutText) {
   const trimmed = stdoutText.trim();
@@ -13240,7 +13339,7 @@ async function umamiStatusAction(options, ctx, spawn) {
   }
 }
 function registerUmamiStatus(cli) {
-  cli.command("umami status", "Show operational health of the Umami analytics deployment via docker compose ps.").option("--key [key]", z30.string().optional().describe("Environment variable name holding the SSH host. Falls back to UMAMI_DOMAIN when omitted.")).action((options, ctx) => umamiStatusAction(options, ctx));
+  cli.command("umami status", "Show operational health of the Umami analytics deployment via docker compose ps.").option("--key [key]", z31.string().optional().describe("Environment variable name holding the SSH host. Falls back to UMAMI_DOMAIN when omitted.")).action((options, ctx) => umamiStatusAction(options, ctx));
 }
 
 // src/commands/umami/index.ts
@@ -13253,24 +13352,24 @@ function registerUmamiCommands(cli) {
 // src/commands/vpn/client.ts
 import { mkdir, writeFile as writeFile2 } from "fs/promises";
 import { join as join8, resolve as resolve2 } from "path";
-import { z as z32 } from "zod";
+import { z as z33 } from "zod";
 
 // src/commands/vpn/peers.ts
 import { readFile, writeFile } from "fs/promises";
-import { z as z31 } from "zod";
-var peerSchema = z31.object({
-  name: z31.string(),
-  publicKey: z31.string(),
-  tunnelIp: z31.string()
+import { z as z32 } from "zod";
+var peerSchema = z32.object({
+  name: z32.string(),
+  publicKey: z32.string(),
+  tunnelIp: z32.string()
 });
-var peersFileSchema = z31.object({
-  peers: z31.array(peerSchema)
+var peersFileSchema = z32.object({
+  peers: z32.array(peerSchema)
 }).superRefine((data, ctx) => {
   const seenIps = new Set;
   for (const peer of data.peers) {
     if (seenIps.has(peer.tunnelIp)) {
       ctx.addIssue({
-        code: z31.ZodIssueCode.custom,
+        code: z32.ZodIssueCode.custom,
         message: `Duplicate tunnel IP "${peer.tunnelIp}" \u2014 each peer must have a unique tunnel IP.`,
         path: ["peers"]
       });
@@ -13282,7 +13381,7 @@ var peersFileSchema = z31.object({
   for (const peer of data.peers) {
     if (seenNames.has(peer.name)) {
       ctx.addIssue({
-        code: z31.ZodIssueCode.custom,
+        code: z32.ZodIssueCode.custom,
         message: `Duplicate name "${peer.name}" \u2014 each peer must have a unique name.`,
         path: ["peers"]
       });
@@ -13524,7 +13623,7 @@ function resolveDefaultClientsDir() {
   return join8(findRepoRoot(), "apps", "vpn", "clients");
 }
 function registerVpnClient(cli) {
-  cli.command("vpn client add <name>", "Add a new VPN client peer. Generates a keypair, assigns a tunnel IP, writes the client .conf to apps/vpn/clients/, and syncs the roster to the VPN_PEERS GitHub secret (best-effort).").option("--split-tunnel [cidrs]", z32.string().describe("Comma-separated CIDRs for split-tunnel routing. Defaults to 0.0.0.0/0 (full tunnel).")).option("--dns [dns]", z32.string().describe("DNS server for the client config.")).option("--server-pubkey [key]", z32.string().describe("Server public key. Falls back to VPN_SERVER_PUBKEY env var.")).option("--endpoint [host]", z32.string().describe("VPN server endpoint (IP or hostname). Falls back to VPN_HOST env var.")).example('# Add a new client named "laptop"').example("infra vpn client add laptop").example("# Add a split-tunnel client").example("infra vpn client add laptop --split-tunnel 10.0.0.0/8,192.168.0.0/16").action(async (name, options) => {
+  cli.command("vpn client add <name>", "Add a new VPN client peer. Generates a keypair, assigns a tunnel IP, writes the client .conf to apps/vpn/clients/, and syncs the roster to the VPN_PEERS GitHub secret (best-effort).").option("--split-tunnel [cidrs]", z33.string().describe("Comma-separated CIDRs for split-tunnel routing. Defaults to 0.0.0.0/0 (full tunnel).")).option("--dns [dns]", z33.string().describe("DNS server for the client config.")).option("--server-pubkey [key]", z33.string().describe("Server public key. Falls back to VPN_SERVER_PUBKEY env var.")).option("--endpoint [host]", z33.string().describe("VPN server endpoint (IP or hostname). Falls back to VPN_HOST env var.")).example('# Add a new client named "laptop"').example("infra vpn client add laptop").example("# Add a split-tunnel client").example("infra vpn client add laptop --split-tunnel 10.0.0.0/8,192.168.0.0/16").action(async (name, options) => {
     const serverPublicKey = options.serverPubkey ?? process.env.VPN_SERVER_PUBKEY;
     const endpoint = options.endpoint ?? process.env.VPN_HOST;
     if (!serverPublicKey) {
@@ -13588,7 +13687,7 @@ function registerVpnClient(cli) {
 }
 
 // src/commands/vpn/deploy.ts
-import { z as z33 } from "zod";
+import { z as z34 } from "zod";
 var REPO7 = "marcusrbrown/infra";
 var WORKFLOW_NAME7 = "Deploy VPN";
 var WORKFLOW_URL7 = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-vpn.yaml";
@@ -13618,7 +13717,7 @@ function validateVpnRemotePreconditions() {
   }
 }
 function registerVpnDeploy(cli) {
-  cli.command("vpn deploy", "Deploy the VPN. Default mode triggers the GitHub Deploy VPN workflow, while --local runs apps/vpn deploy directly with Bun.").option("--local", z33.boolean().default(false).describe("Run local deployment with Bun using apps/vpn instead of triggering GitHub Actions.")).option("--dry-run", z33.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).option("--force-server-key", z33.boolean().default(false).describe("Force regeneration of the server WireGuard keypair. WARNING: invalidates all existing client configs.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra vpn deploy").example("# Validate local deploy preconditions and planned command").example("infra vpn deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra vpn deploy --local").action(async (options) => {
+  cli.command("vpn deploy", "Deploy the VPN. Default mode triggers the GitHub Deploy VPN workflow, while --local runs apps/vpn deploy directly with Bun.").option("--local", z34.boolean().default(false).describe("Run local deployment with Bun using apps/vpn instead of triggering GitHub Actions.")).option("--dry-run", z34.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).option("--force-server-key", z34.boolean().default(false).describe("Force regeneration of the server WireGuard keypair. WARNING: invalidates all existing client configs.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra vpn deploy").example("# Validate local deploy preconditions and planned command").example("infra vpn deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra vpn deploy --local").action(async (options) => {
     if (options.local) {
       const command = [
         "bun",
@@ -13666,7 +13765,7 @@ function registerVpnDeploy(cli) {
 }
 
 // src/commands/vpn/logs.ts
-import { z as z34 } from "zod";
+import { z as z35 } from "zod";
 
 // src/commands/vpn/host.ts
 var VALID_HOST_RE6 = /^[a-z\d][a-z\d.\-]*$/i;
@@ -13722,7 +13821,7 @@ async function streamVpnLogs(opts, spawn = defaultLogsSpawn5, printOut, printErr
   return { refused: false, exitCode };
 }
 function registerVpnLogs(cli) {
-  cli.command("vpn logs", "Stream WireGuard VPN logs via SSH and journalctl.").option("--tail [n]", z34.number().default(100).describe("Number of log lines to tail.")).option("--allow-ci", z34.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive VPN data.")).option("--key [key]", z34.string().describe("Environment variable name holding the SSH host. Falls back to VPN_HOST when omitted.")).action(async (options) => {
+  cli.command("vpn logs", "Stream WireGuard VPN logs via SSH and journalctl.").option("--tail [n]", z35.number().default(100).describe("Number of log lines to tail.")).option("--allow-ci", z35.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive VPN data.")).option("--key [key]", z35.string().describe("Environment variable name holding the SSH host. Falls back to VPN_HOST when omitted.")).action(async (options) => {
     const hostEnvKey = options.key ?? "VPN_HOST";
     const host = process.env[hostEnvKey];
     if (!host) {
@@ -13744,7 +13843,7 @@ function registerVpnLogs(cli) {
 }
 
 // src/commands/vpn/status.ts
-import { z as z35 } from "zod";
+import { z as z36 } from "zod";
 
 // src/commands/vpn/shared.ts
 function parseWgShowOutput(output) {
@@ -13871,7 +13970,7 @@ async function vpnStatusAction(options, ctx, spawn) {
   }
 }
 function registerVpnStatus(cli) {
-  cli.command("vpn status", "Show operational health of the VPN box via SSH and wg show.").option("--key [key]", z35.string().describe("Environment variable name holding the SSH host. Falls back to VPN_HOST when omitted.")).action((options, ctx) => vpnStatusAction(options, ctx));
+  cli.command("vpn status", "Show operational health of the VPN box via SSH and wg show.").option("--key [key]", z36.string().describe("Environment variable name holding the SSH host. Falls back to VPN_HOST when omitted.")).action((options, ctx) => vpnStatusAction(options, ctx));
 }
 
 // src/commands/vpn/index.ts
@@ -13883,7 +13982,7 @@ function registerVpnCommands(cli) {
 }
 
 // src/commands/status.ts
-var DEFAULT_CLIPROXY_URL8 = "https://cliproxy.fro.bot";
+var DEFAULT_CLIPROXY_URL9 = "https://cliproxy.fro.bot";
 var ERROR_PREFIX = "\u274C";
 var TABLE_COLUMNS = [
   { key: "app", label: "App" },
@@ -13893,7 +13992,7 @@ var TABLE_COLUMNS = [
   { key: "contentHash", label: "Content Hash" },
   { key: "usageStats", label: "Usage Stats" }
 ];
-function stripTrailingSlash6(value) {
+function stripTrailingSlash7(value) {
   return value.endsWith("/") ? value.slice(0, -1) : value;
 }
 function errorSummary(app, reason) {
@@ -13933,7 +14032,7 @@ async function unifiedStatusAction(options, ctx, dependencies = {
   getBrokerStatusSummary
 }) {
   const verbose = options.verbose === true;
-  const cliproxyBaseUrl = stripTrailingSlash6(process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL8);
+  const cliproxyBaseUrl = stripTrailingSlash7(process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL9);
   const cliproxyKey = process.env.CLIPROXY_MANAGEMENT_KEY ?? "";
   const gatewayHost = process.env.GATEWAY_HOST ?? "";
   const umamiHost = process.env.UMAMI_DOMAIN ?? "";
@@ -13978,7 +14077,7 @@ function registerStatus(cli, dependencies = {
   getVpnStatusSummary,
   getBrokerStatusSummary
 }) {
-  cli.command("status", "Show status of all deployments").option("--json", z36.boolean().describe("Output machine-readable JSON with keeweb, cliproxy, gateway, umami, dashboard, vpn, and broker summary objects.")).option("--verbose", z36.boolean().describe("Include verbose per-app health check details when building the summary rows.")).action((options, ctx) => unifiedStatusAction(options, ctx, dependencies));
+  cli.command("status", "Show status of all deployments").option("--json", z37.boolean().describe("Output machine-readable JSON with keeweb, cliproxy, gateway, umami, dashboard, vpn, and broker summary objects.")).option("--verbose", z37.boolean().describe("Include verbose per-app health check details when building the summary rows.")).action((options, ctx) => unifiedStatusAction(options, ctx, dependencies));
 }
 
 // src/cli.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marcusrbrown/infra",
-  "version": "0.20.0",
+  "version": "0.22.0",
   "description": "Infrastructure management CLI — deploy automation, health checks, and MCP bridge",
   "keywords": [
     "infra",