@marcusrbrown/infra 0.26.3 → 0.27.0

package/dist/cli.js

@@ -6950,7 +6950,7 @@ import { goke } from "goke";
 // package.json
 var package_default = {
   name: "@marcusrbrown/infra",
-  version: "0.26.3",
+  version: "0.27.0",
   description: "Infrastructure management CLI \u2014 deploy automation, health checks, and MCP bridge",
   keywords: [
     "infra",
@@ -9763,49 +9763,207 @@ function registerBrokerLogs(cli) {
 
 // src/commands/broker/status.ts
 import { z as z9 } from "zod";
-var DEFAULT_BROKER_URL = "https://broker.fro.bot";
-var HTTP_TIMEOUT_MS3 = 1e4;
-async function checkBrokerHealth(baseUrl) {
-  const url = `${baseUrl}/healthz`;
-  const startedAt = performance.now();
+
+// src/status/public-probes.ts
+var PUBLIC_PROBE_TIMEOUT_MS = 1e4;
+var PUBLIC_PROBE_RETRIES = 1;
+var MAX_BODY_CHARS = 64 * 1024;
+var KEEWEB_ORIGIN = "https://kw.igg.ms";
+var CLIPROXY_ORIGIN = "https://cliproxy.fro.bot";
+var BROKER_ORIGIN = "https://broker.fro.bot";
+var UMAMI_ORIGIN = "https://metrics.fro.bot";
+var DASHBOARD_ORIGIN = "https://dashboard.fro.bot";
+var PUBLIC_REACHABILITY_ID = "public-reachability";
+function isTimeoutError(error) {
+  if (typeof error !== "object" || error === null || !("name" in error)) {
+    return false;
+  }
+  return error.name === "TimeoutError" || error.name === "AbortError";
+}
+function discardBody(response) {
   try {
-    const response = await fetch(url, {
-      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS3)
+    response.body?.cancel().catch(() => {
+      return;
+    });
+  } catch {}
+}
+async function readBoundedBody(response, signal) {
+  const reader = response.body?.getReader();
+  if (reader === undefined) {
+    return "";
+  }
+  const aborted = new Promise((_resolve, reject) => {
+    if (signal.aborted) {
+      reject(signal.reason);
+    }
+    signal.addEventListener("abort", () => reject(signal.reason), { once: true });
+  });
+  aborted.catch(() => {
+    return;
+  });
+  const decoder = new TextDecoder;
+  let text = "";
+  try {
+    while (text.length < MAX_BODY_CHARS) {
+      const chunk = await Promise.race([reader.read(), aborted]);
+      if (chunk.done) {
+        text += decoder.decode();
+        break;
+      }
+      text += decoder.decode(chunk.value, { stream: true });
+    }
+    return text.slice(0, MAX_BODY_CHARS);
+  } catch {
+    return;
+  } finally {
+    reader.cancel().catch(() => {
+      return;
     });
-    const elapsedMs = Math.max(0, Math.round(performance.now() - startedAt));
+  }
+}
+async function httpGet(url, options) {
+  const retries = options.retries ?? 0;
+  let lastError;
+  for (let attempt = 0;attempt <= retries; attempt++) {
+    const startedAt = performance.now();
+    const signal = AbortSignal.timeout(options.timeoutMs);
+    let response;
+    try {
+      response = await fetch(url, { signal });
+    } catch (error) {
+      lastError = {
+        kind: "network-error",
+        error,
+        timedOut: isTimeoutError(error),
+        durationMs: Math.max(0, performance.now() - startedAt)
+      };
+      continue;
+    }
+    let body;
+    if (!response.ok) {
+      discardBody(response);
+    } else if (options.readBody === true) {
+      body = await readBoundedBody(response, signal);
+    }
     return {
+      kind: "response",
+      response,
+      status: response.status,
       ok: response.ok,
-      summary: `GET ${url} \u2192 ${response.status} (${elapsedMs}ms)`
-    };
-  } catch (error) {
-    const elapsedMs = Math.max(0, Math.round(performance.now() - startedAt));
-    const message = error instanceof Error ? error.message : String(error);
-    return {
-      ok: false,
-      summary: `Request failed after ${elapsedMs}ms: ${message}`
+      durationMs: Math.max(0, performance.now() - startedAt),
+      body
     };
   }
+  return lastError;
 }
-async function getBrokerStatusSummary(host) {
-  if (!host) {
+function parseJsonObject(body) {
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return;
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return;
+  }
+  return parsed;
+}
+function checkUmamiHeartbeat(body) {
+  return parseJsonObject(body)?.ok === true ? { ok: true } : { ok: false };
+}
+var CONTRACT_VERSION_PATTERN = /^[\w.+-]{1,64}$/;
+function checkOperatorHealth(body) {
+  const version = parseJsonObject(body)?.contractVersion;
+  if (typeof version !== "string" || !CONTRACT_VERSION_PATTERN.test(version)) {
+    return { ok: false };
+  }
+  return { ok: true, detail: { contractVersion: version } };
+}
+function stripTrailingSlash2(value) {
+  return value.endsWith("/") ? value.slice(0, -1) : value;
+}
+async function runProbe(spec, options = {}) {
+  const url = `${stripTrailingSlash2(options.baseUrl ?? spec.origin)}${spec.path}`;
+  const attempt = await httpGet(url, {
+    timeoutMs: options.timeoutMs ?? PUBLIC_PROBE_TIMEOUT_MS,
+    retries: PUBLIC_PROBE_RETRIES,
+    readBody: spec.checkBody !== undefined
+  });
+  const observedAt = (options.now?.() ?? new Date).toISOString();
+  const durationMs = Math.round(attempt.durationMs);
+  const make = (result, detail) => ({
+    id: PUBLIC_REACHABILITY_ID,
+    kind: "reachability",
+    result,
+    observedAt,
+    source: "http",
+    detail
+  });
+  if (attempt.kind === "network-error") {
+    let reason = attempt.timedOut ? "timeout" : "network-error";
+    if (spec.unreachableReason === "dependency-unreachable") {
+      reason = "dependency-unreachable";
+    }
+    return make("unknown", { durationMs, reason });
+  }
+  const detail = { statusCode: attempt.status, durationMs };
+  if (!attempt.ok) {
+    return make("fail", detail);
+  }
+  if (spec.checkBody === undefined) {
+    return make("pass", detail);
+  }
+  const verdict = spec.checkBody(attempt.body ?? "");
+  return verdict.ok ? make("pass", { ...detail, ...verdict.detail }) : make("fail", detail);
+}
+function probeKeeweb(options) {
+  return runProbe({ origin: KEEWEB_ORIGIN, path: "/", unreachableReason: "network-error" }, options);
+}
+function probeCliproxy(options) {
+  return runProbe({ origin: CLIPROXY_ORIGIN, path: "/healthz", unreachableReason: "network-error" }, options);
+}
+function probeBroker(options) {
+  return runProbe({ origin: BROKER_ORIGIN, path: "/healthz", unreachableReason: "network-error" }, options);
+}
+function probeUmami(options) {
+  return runProbe({ origin: UMAMI_ORIGIN, path: "/api/heartbeat", checkBody: checkUmamiHeartbeat, unreachableReason: "network-error" }, options);
+}
+function probeDashboard(options) {
+  return runProbe({ origin: DASHBOARD_ORIGIN, path: "/api/healthz", unreachableReason: "network-error" }, options);
+}
+function probeGateway(options) {
+  return runProbe({
+    origin: DASHBOARD_ORIGIN,
+    path: "/operator/health",
+    checkBody: checkOperatorHealth,
+    unreachableReason: "dependency-unreachable"
+  }, options);
+}
+var PUBLIC_PROBES = {
+  keeweb: probeKeeweb,
+  cliproxy: probeCliproxy,
+  gateway: probeGateway,
+  umami: probeUmami,
+  dashboard: probeDashboard,
+  broker: probeBroker
+};
+
+// src/commands/broker/status.ts
+var DEFAULT_BROKER_URL = "https://broker.fro.bot";
+async function checkBrokerHealth(baseUrl) {
+  const url = `${baseUrl}/healthz`;
+  const attempt = await httpGet(url, { timeoutMs: PUBLIC_PROBE_TIMEOUT_MS });
+  const elapsedMs = Math.max(0, Math.round(attempt.durationMs));
+  if (attempt.kind === "response") {
     return {
-      app: "broker",
-      http: "\u2014 (host not set)",
-      lastDeploy: "\u2014",
-      version: "\u2014",
-      contentHash: "\u2014",
-      usageStats: "\u2014"
+      ok: attempt.ok,
+      summary: `GET ${url} \u2192 ${attempt.status} (${elapsedMs}ms)`
     };
   }
-  const baseUrl = `https://${host}`;
-  const health = await checkBrokerHealth(baseUrl);
+  const message = attempt.error instanceof Error ? attempt.error.message : String(attempt.error);
   return {
-    app: "broker",
-    http: health.ok ? `OK: ${health.summary}` : `ERROR: ${health.summary}`,
-    lastDeploy: "\u2014",
-    version: "\u2014",
-    contentHash: "\u2014",
-    usageStats: "\u2014"
+    ok: false,
+    summary: `Request failed after ${elapsedMs}ms: ${message}`
   };
 }
 async function brokerStatusAction(options, ctx) {
@@ -9867,11 +10025,11 @@ function registerBrokerCommands(cli) {
 import { chmodSync } from "fs";
 import { z as z10 } from "zod";
 var DEFAULT_CLIPROXY_URL3 = "https://cliproxy.fro.bot";
-function stripTrailingSlash2(value) {
+function stripTrailingSlash3(value) {
   return value.endsWith("/") ? value.slice(0, -1) : value;
 }
 function resolveBaseUrl2(input) {
-  return stripTrailingSlash2(input ?? process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL3);
+  return stripTrailingSlash3(input ?? process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL3);
 }
 var resolveManagementKey2 = resolveManagementKey;
 function parseBoolean(value) {
@@ -10089,11 +10247,11 @@ function registerCliproxyDeploy(cli) {
 // src/commands/cliproxy/keys.ts
 import { z as z12 } from "zod";
 var DEFAULT_CLIPROXY_URL4 = "https://cliproxy.fro.bot";
-function stripTrailingSlash3(value) {
+function stripTrailingSlash4(value) {
   return value.endsWith("/") ? value.slice(0, -1) : value;
 }
 function resolveBaseUrl3(input) {
-  return stripTrailingSlash3(input ?? process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL4);
+  return stripTrailingSlash4(input ?? process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL4);
 }
 function resolveManagementKey3(input) {
   const key = input ?? process.env.CLIPROXY_MANAGEMENT_KEY;
@@ -10272,7 +10430,7 @@ function registerCliproxyLogin(cli) {
 // src/commands/cliproxy/models.ts
 import { z as z14 } from "zod";
 var DEFAULT_CLIPROXY_URL5 = "https://cliproxy.fro.bot";
-function stripTrailingSlash4(value) {
+function stripTrailingSlash5(value) {
   return value.endsWith("/") ? value.slice(0, -1) : value;
 }
 var modelEntrySchema2 = z14.object({
@@ -10344,8 +10502,8 @@ function formatVerboseEntry(entry) {
 }
 async function cliproxyModelsAction(options, ctx) {
   try {
-    const baseUrl = stripTrailingSlash4(options.url ?? process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL5);
-    const trustedUrl = stripTrailingSlash4(process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL5);
+    const baseUrl = stripTrailingSlash5(options.url ?? process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL5);
+    const trustedUrl = stripTrailingSlash5(process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL5);
     const urlIsExplicitlyOverridden = options.url !== undefined && baseUrl !== trustedUrl;
     const key = options.key ?? (urlIsExplicitlyOverridden ? undefined : process.env.CLIPROXY_API_KEY);
     if (!key) {
@@ -10397,11 +10555,28 @@ import { z as z16 } from "zod";
 import { z as z15 } from "zod";
 
 // src/lib/redact.ts
+function lowerAscii(value) {
+  let result = "";
+  for (const char of value) {
+    const code = char.codePointAt(0) ?? 0;
+    result += code >= 65 && code <= 90 ? String.fromCodePoint(code + 32) : char;
+  }
+  return result;
+}
 function redactHost(text, host) {
   if (!host)
     return text;
-  const escaped = host.replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
-  return text.replaceAll(new RegExp(escaped, "gi"), "<host>");
+  const foldedText = lowerAscii(text);
+  const foldedHost = lowerAscii(host);
+  let result = "";
+  let cursor = 0;
+  let match = foldedText.indexOf(foldedHost, cursor);
+  while (match !== -1) {
+    result += `${text.slice(cursor, match)}<host>`;
+    cursor = match + foldedHost.length;
+    match = foldedText.indexOf(foldedHost, cursor);
+  }
+  return result + text.slice(cursor);
 }
 
 // ../shared/server/droplet-helpers.ts
@@ -10443,6 +10618,125 @@ function buildIdentityArgs(privateKey) {
   return { args: ["-i", path, "-o", "IdentitiesOnly=yes"], cleanup };
 }
 
+// src/status/collect.ts
+function observe(spec, result, options = {}) {
+  return {
+    id: spec.id,
+    kind: spec.kind,
+    source: spec.source,
+    result,
+    observedAt: (options.now ?? new Date).toISOString(),
+    ...options.detail === undefined ? {} : { detail: options.detail }
+  };
+}
+function notMeasured(spec, reason) {
+  return { id: spec.id, kind: spec.kind, source: "config", result: "not_measured", observedAt: null, detail: { reason } };
+}
+function composeObservation(spec, result) {
+  if (result.services.length === 0) {
+    return result.error === undefined ? observe(spec, "fail", { detail: { reason: "no-services" } }) : observe(spec, "unknown", { detail: { reason: "compose-failed" } });
+  }
+  return result.ok ? observe(spec, "pass") : observe(spec, "fail", { detail: { reason: "degraded" } });
+}
+function servicesFact(services) {
+  return services.map(({ service, state, health }) => ({ service, state, health }));
+}
+
+// src/status/declared.ts
+var publicReachability = {
+  id: PUBLIC_REACHABILITY_ID,
+  kind: "reachability",
+  source: "http",
+  owner: "probe"
+};
+var deployState = {
+  id: "deploy-state",
+  kind: "deploy-state",
+  source: "github-api",
+  owner: "github"
+};
+var composeServices = {
+  id: "compose-services",
+  kind: "container-health",
+  source: "ssh",
+  owner: "collector"
+};
+var DECLARED_OBSERVATIONS = {
+  keeweb: [publicReachability, deployState],
+  cliproxy: [
+    publicReachability,
+    { id: "container-running", kind: "container-health", source: "ssh", owner: "collector" },
+    deployState,
+    { id: "provider-route", kind: "end-to-end", source: "monitor", owner: "github" }
+  ],
+  gateway: [
+    publicReachability,
+    composeServices,
+    { id: "workspace-memory", kind: "resource", source: "ssh", owner: "collector" },
+    deployState
+  ],
+  umami: [publicReachability, composeServices, deployState],
+  dashboard: [publicReachability, composeServices, deployState],
+  vpn: [
+    { id: PUBLIC_REACHABILITY_ID, kind: "reachability", source: "config", owner: "not-applicable" },
+    { id: "wireguard-interface", kind: "container-health", source: "ssh", owner: "collector" },
+    deployState,
+    { id: "egress-route", kind: "end-to-end", source: "config", owner: "not-applicable" }
+  ],
+  broker: [publicReachability, deployState]
+};
+function declaredObservation(app, id) {
+  const declared = DECLARED_OBSERVATIONS[app].find((entry) => entry.id === id);
+  if (declared === undefined) {
+    throw new Error(`${app} does not declare observation "${id}"`);
+  }
+  return declared;
+}
+function unknown(declared, reason, now) {
+  return observe(declared, "unknown", { detail: { reason }, now });
+}
+function resolveObservation(declared, probe, collector, github, now) {
+  switch (declared.owner) {
+    case "not-applicable":
+      return notMeasured(declared, declared.owner);
+    case "github":
+      return github.find((observation) => observation.id === declared.id) ?? unknown(declared, "missing-result", now);
+    case "probe":
+      if (probe.kind === "ok")
+        return probe.observation;
+      return unknown(declared, probe.kind === "failed" ? "check-failed" : "missing-result", now);
+    case "collector":
+      if (collector.kind === "missing-config")
+        return notMeasured(declared, "missing-config");
+      if (collector.kind === "failed")
+        return unknown(declared, "check-failed", now);
+      if (collector.kind === "timeout")
+        return unknown(declared, "timeout", now);
+      if (collector.kind === "none")
+        return unknown(declared, "missing-result", now);
+      return collector.collection.observations.find((observation) => observation.id === declared.id) ?? unknown(declared, "missing-result", now);
+  }
+}
+function assembleAppStatus(app, probe, collector, now, github = []) {
+  return {
+    app,
+    observations: DECLARED_OBSERVATIONS[app].map((declared) => resolveObservation(declared, probe, collector, github, now)),
+    facts: collector.kind === "ok" ? collector.collection.facts : {}
+  };
+}
+var SEVERITY = { pass: 0, not_measured: 1, unknown: 2, fail: 3 };
+function worstResult(app, kind) {
+  let worst;
+  for (const observation of app.observations) {
+    if (observation.kind !== kind)
+      continue;
+    if (worst === undefined || SEVERITY[observation.result] > SEVERITY[worst]) {
+      worst = observation.result;
+    }
+  }
+  return worst;
+}
+
 // src/commands/cliproxy/status.ts
 var DEFAULT_CLIPROXY_URL6 = "https://cliproxy.fro.bot";
 function defaultSpawn(cmd, opts) {
@@ -10460,7 +10754,7 @@ function levelLabel(level) {
 function formatDurationMs(durationMs) {
   return `${Math.max(0, Math.round(durationMs))}ms`;
 }
-function stripTrailingSlash5(value) {
+function stripTrailingSlash6(value) {
   return value.endsWith("/") ? value.slice(0, -1) : value;
 }
 async function parseJsonResponse(response) {
@@ -10474,12 +10768,9 @@ function toNumber(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : null;
 }
 async function checkHttpReachability(url, verbose) {
-  const startedAt = performance.now();
-  try {
-    const response = await fetch(url, {
-      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS)
-    });
-    const elapsedMs = performance.now() - startedAt;
+  const attempt = await httpGet(url, { timeoutMs: HTTP_TIMEOUT_MS });
+  if (attempt.kind === "response") {
+    const { response } = attempt;
     const details = [];
     if (verbose) {
       details.push(`URL: ${url}`);
@@ -10490,20 +10781,18 @@ async function checkHttpReachability(url, verbose) {
     }
     return {
       title: "HTTP reachability",
-      level: response.ok ? "ok" : "error",
-      summary: `GET ${url} \u2192 ${response.status} (${formatDurationMs(elapsedMs)})`,
+      level: attempt.ok ? "ok" : "error",
+      summary: `GET ${url} \u2192 ${attempt.status} (${formatDurationMs(attempt.durationMs)})`,
       details
     };
-  } catch (error) {
-    const elapsedMs = performance.now() - startedAt;
-    const message = error instanceof Error ? error.message : String(error);
-    return {
-      title: "HTTP reachability",
-      level: "error",
-      summary: `Request failed after ${formatDurationMs(elapsedMs)}: ${message}`,
-      details: verbose ? [`URL: ${url}`, `Timeout: ${HTTP_TIMEOUT_MS}ms`] : undefined
-    };
   }
+  const message = attempt.error instanceof Error ? attempt.error.message : String(attempt.error);
+  return {
+    title: "HTTP reachability",
+    level: "error",
+    summary: `Request failed after ${formatDurationMs(attempt.durationMs)}: ${message}`,
+    details: verbose ? [`URL: ${url}`, `Timeout: ${HTTP_TIMEOUT_MS}ms`] : undefined
+  };
 }
 function countQueueErrors(records) {
   let count = 0;
@@ -10613,7 +10902,7 @@ async function checkVersion(baseUrl, key) {
     return { title: "Latest available version", level: "error", summary: `Unable to check latest version: ${message}` };
   }
 }
-async function checkRunningVersion(host, spawn = defaultSpawn) {
+async function inspectRunningContainer(host, spawn = defaultSpawn, signal) {
   let cleanup = () => {
     return;
   };
@@ -10640,7 +10929,7 @@ async function checkRunningVersion(host, spawn = defaultSpawn) {
       HOME: process.env.HOME ?? "/tmp",
       ...process.env.SSH_AUTH_SOCK ? { SSH_AUTH_SOCK: process.env.SSH_AUTH_SOCK } : {}
     };
-    const child = spawn(sshCmd, { env, stdout: "pipe", stderr: "pipe" });
+    const child = spawn(sshCmd, { env, stdout: "pipe", stderr: "pipe", ...signal === undefined ? {} : { signal } });
     const [stdoutText, stderrText, exitCode] = await Promise.all([
       new Response(child.stdout).text(),
       new Response(child.stderr).text(),
@@ -10648,27 +10937,29 @@ async function checkRunningVersion(host, spawn = defaultSpawn) {
     ]);
     if (exitCode !== 0) {
       return {
-        title: "Running version",
-        level: "warning",
+        kind: "unavailable",
         summary: `SSH command failed (exit ${exitCode}): ${redactHost(stderrText.trim(), host) || "unknown error"}`
       };
     }
     const imageMatch = /(?:^|\s)eceasy\/cli-proxy-api:([^\s@]+)/m.exec(stdoutText);
-    if (!imageMatch) {
-      return {
-        title: "Running version",
-        level: "warning",
-        summary: "No running eceasy/cli-proxy-api container found."
-      };
-    }
-    return { title: "Running version", level: "ok", summary: imageMatch[1] ?? "unknown" };
+    return imageMatch ? { kind: "running", version: imageMatch[1] ?? "unknown" } : { kind: "none" };
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    return { title: "Running version", level: "warning", summary: `Unable to check running version via SSH: ${message}` };
+    return { kind: "unavailable", summary: `Unable to check running version via SSH: ${message}` };
   } finally {
     cleanup();
   }
 }
+async function checkRunningVersion(host, spawn = defaultSpawn) {
+  const container = await inspectRunningContainer(host, spawn);
+  if (container.kind === "running") {
+    return { title: "Running version", level: "ok", summary: container.version };
+  }
+  if (container.kind === "none") {
+    return { title: "Running version", level: "warning", summary: "No running eceasy/cli-proxy-api container found." };
+  }
+  return { title: "Running version", level: "warning", summary: container.summary };
+}
 var DEFAULT_PROVIDER_MODEL = "claude-sonnet-4-6";
 async function readBodyText(response) {
   try {
@@ -10818,35 +11109,50 @@ async function probeManagementAuth(baseUrl, key) {
       const isBanBody = payload !== null && typeof payload === "object" && Object.values(payload).some((v) => typeof v === "string" && /\b(?:ip[- ]?)?bann?ed\b/i.test(v));
       if (isBanBody) {
         return {
-          title: "Management access",
-          level: "error",
-          summary: "IP banned \u2014 stop retrying for ~30 min. Management checks skipped."
+          access: "denied",
+          result: {
+            title: "Management access",
+            level: "error",
+            summary: "IP banned \u2014 stop retrying for ~30 min. Management checks skipped."
+          }
         };
       }
       return {
-        title: "Management access",
-        level: "error",
-        summary: "Management API returned HTTP 403. Management checks skipped."
+        access: "denied",
+        result: {
+          title: "Management access",
+          level: "error",
+          summary: "Management API returned HTTP 403. Management checks skipped."
+        }
       };
     }
     if (response.status === 401) {
       return {
-        title: "Management access",
-        level: "error",
-        summary: "Management API returned HTTP 401 (invalid key). Management checks skipped."
+        access: "denied",
+        result: {
+          title: "Management access",
+          level: "error",
+          summary: "Management API returned HTTP 401 (invalid key). Management checks skipped."
+        }
       };
     }
     return {
-      title: "Management access",
-      level: "warning",
-      summary: `Management auth probe returned HTTP ${response.status}. Management checks skipped.`
+      access: response.status === 429 ? "rate-limited" : "unavailable",
+      result: {
+        title: "Management access",
+        level: "warning",
+        summary: `Management auth probe returned HTTP ${response.status}. Management checks skipped.`
+      }
     };
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     return {
-      title: "Management access",
-      level: "error",
-      summary: `Management auth probe failed: ${message}`
+      access: "unavailable",
+      result: {
+        title: "Management access",
+        level: "error",
+        summary: `Management auth probe failed: ${message}`
+      }
     };
   }
 }
@@ -10856,7 +11162,7 @@ async function runManagementChecks(baseUrl, key) {
   }
   const authFailure = await probeManagementAuth(baseUrl, key);
   if (authFailure !== null) {
-    return { kind: "auth-failure", result: authFailure };
+    return { kind: "auth-failure", result: authFailure.result, access: authFailure.access };
   }
   const [usage, version] = await Promise.all([checkUsageStats(baseUrl, key), checkVersion(baseUrl, key)]);
   return { kind: "checks", usage, version };
@@ -10870,35 +11176,7 @@ function printCheckResult(result, ctx) {
     }
   }
 }
-function formatCheckSummary(result) {
-  return `${levelLabel(result.level)}: ${result.summary}`;
-}
 var RUNNING_VERSION_NOT_CHECKED_SUMMARY = "Not checked for explicit URL override.";
-function formatVersionSummary(running, available) {
-  const latestFailure = /429|rate limit/i.test(available.summary) ? "rate-limited" : /auth|\b40[13]\b|ip banned/i.test(available.summary) ? "auth" : "unknown";
-  if (running.summary === RUNNING_VERSION_NOT_CHECKED_SUMMARY) {
-    if (available.level === "ok") {
-      return `not checked (latest ${available.summary})`;
-    }
-    if (available.summary === "Not checked (no management key).") {
-      return "not checked (latest: no key)";
-    }
-    return `not checked (latest ${latestFailure})`;
-  }
-  if (running.level === "ok" && available.level === "ok") {
-    return running.summary === available.summary ? `${running.summary} (latest)` : `${running.summary} (latest ${available.summary})`;
-  }
-  if (running.level === "ok") {
-    return available.summary === "Not checked (no management key)." ? `${running.summary} (latest: no key)` : `${running.summary} (latest ${latestFailure})`;
-  }
-  if (available.level === "ok") {
-    return `unknown (latest ${available.summary})`;
-  }
-  if (latestFailure === "auth") {
-    return "unknown (auth)";
-  }
-  return latestFailure === "rate-limited" ? "unknown (latest rate-limited)" : "unknown";
-}
 function getRunningVersionNotChecked(host) {
   try {
     validateCliproxyHost(host);
@@ -10908,51 +11186,64 @@ function getRunningVersionNotChecked(host) {
     return { title: "Running version", level: "warning", summary: `Unable to validate running-version host: ${message}` };
   }
 }
-function formatUsageSummaryLine(result) {
+function parseUsageCounts(result) {
   const recentMatch = /recent:\s*(\d+)/.exec(result.summary);
   if (!recentMatch) {
     return null;
   }
-  const total = Number(recentMatch[1]);
   const errorMatch = /errors:\s*(\d+)/.exec(result.summary);
-  const errors = errorMatch ? Number(errorMatch[1]) : 0;
-  return `Recent requests: ${total}${errors > 0 ? `, ${errors} errors` : ""}`;
+  return { recent: Number(recentMatch[1]), errors: errorMatch ? Number(errorMatch[1]) : 0 };
 }
-async function getCliproxyStatusSummary(baseUrl, key, verbose, spawn = defaultSpawn) {
-  const normalizedBaseUrl = stripTrailingSlash5(baseUrl);
+function formatUsageSummaryLine(result) {
+  const counts = parseUsageCounts(result);
+  if (counts === null) {
+    return null;
+  }
+  return `Recent requests: ${counts.recent}${counts.errors > 0 ? `, ${counts.errors} errors` : ""}`;
+}
+async function getCliproxyStatusSummary(baseUrl, key, spawn = defaultSpawn, signal) {
+  const normalizedBaseUrl = stripTrailingSlash6(baseUrl);
   const host = new URL(normalizedBaseUrl).hostname;
-  const [httpResult, mgmt, running] = await Promise.all([
-    checkHttpReachability(`${normalizedBaseUrl}/healthz`, verbose),
+  const [mgmt, running] = await Promise.all([
     runManagementChecks(normalizedBaseUrl, key || undefined),
-    checkRunningVersion(host, spawn)
+    inspectRunningContainer(host, spawn, signal)
   ]);
-  let available;
-  let usageStats;
+  const spec = declaredObservation("cliproxy", "container-running");
+  let container;
+  if (running.kind === "running") {
+    container = observe(spec, "pass");
+  } else if (running.kind === "none") {
+    container = observe(spec, "fail", { detail: { reason: "not-running" } });
+  } else {
+    container = observe(spec, "unknown", { detail: { reason: "ssh-failed" } });
+  }
+  let managementAccess = "ok";
+  let latestVersion = null;
+  let usage = null;
   if (mgmt.kind === "no-key") {
-    available = { title: "Latest available version", level: "warning", summary: "Not checked (no management key)." };
-    usageStats = "\u2014 (no key)";
+    managementAccess = "no-key";
   } else if (mgmt.kind === "auth-failure") {
-    available = mgmt.result;
-    usageStats = formatCheckSummary(mgmt.result);
+    managementAccess = mgmt.access;
   } else {
-    available = mgmt.version;
-    usageStats = formatCheckSummary(mgmt.usage);
+    latestVersion = mgmt.version.level === "ok" ? mgmt.version.summary : null;
+    usage = parseUsageCounts(mgmt.usage);
   }
   return {
-    app: "cliproxy",
-    http: formatCheckSummary(httpResult),
-    lastDeploy: "\u2014",
-    version: formatVersionSummary(running, available),
-    contentHash: "\u2014",
-    usageStats
+    observations: [container],
+    facts: {
+      runningVersion: running.kind === "running" ? running.version : null,
+      latestVersion,
+      usage,
+      managementAccess
+    }
   };
 }
 async function cliproxyStatusAction(options, ctx, spawn = defaultSpawn) {
   let errorCount = 0;
   try {
     const verbose = options.verbose === true;
-    const baseUrl = stripTrailingSlash5(options.url ?? process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL6);
-    const trustedUrl = stripTrailingSlash5(process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL6);
+    const baseUrl = stripTrailingSlash6(options.url ?? process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL6);
+    const trustedUrl = stripTrailingSlash6(process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL6);
     const urlIsExplicitlyOverridden = options.url !== undefined && baseUrl !== trustedUrl;
     const managementKey = options.key ?? (urlIsExplicitlyOverridden ? undefined : process.env.CLIPROXY_MANAGEMENT_KEY);
     const providerKey = options.apiKey ?? (urlIsExplicitlyOverridden ? undefined : process.env.CLIPROXY_API_KEY);
@@ -11030,6 +11321,9 @@ function formatMonitorRunSummary(summary) {
   const issue = summary.issue.length > 0 ? summary.issue.join("+") : "none";
   return `CLIProxy auth monitor summary: probe=${summary.probeState} reason=${summary.probeReason} transition=${summary.transition} issue=${issue} discord=${summary.discord} at ${summary.timestamp}`;
 }
+function formatMonitorProbeLine(probe) {
+  return `CLIProxy auth monitor probe: probe=${probe.probeState} reason=${probe.probeReason} at ${probe.timestamp}`;
+}
 var githubIssueSchema = z16.object({
   number: z16.number().int().nonnegative(),
   state: z16.enum(["open", "closed"]),
@@ -11332,6 +11626,7 @@ async function cliproxyMonitorAction(options, ctx, runtime = defaultMonitorRunti
   const timestamp = new Date().toISOString();
   try {
     const classification = validation === "live" ? await checkProviderAuthState(proxyUrl, inputs.apiKey) : providerState(validation);
+    ctx.console.log(formatMonitorProbeLine({ probeState: classification.state, probeReason: classification.reason, timestamp }));
     const finish = (transition, issue = [], discord = "none") => {
       const summary = {
         probeState: classification.state,
@@ -11467,11 +11762,11 @@ var AuthFilesResponseSchema = z18.object({
   files: z18.array(AuthFileSchema)
 });
 var ManagementErrorSchema = z18.object({ error: z18.string() });
-function stripTrailingSlash6(value) {
+function stripTrailingSlash7(value) {
   return value.endsWith("/") ? value.slice(0, -1) : value;
 }
 function resolveBaseUrl4(input) {
-  return stripTrailingSlash6(input ?? process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL8);
+  return stripTrailingSlash7(input ?? process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL8);
 }
 function resolveManagementKey4(input) {
   const key = input ?? process.env.CLIPROXY_MANAGEMENT_KEY;
@@ -11805,7 +12100,7 @@ function isAllRunning(rows) {
 function defaultSpawn2(cmd, opts) {
   return Bun.spawn(cmd, opts);
 }
-async function getDashboardComposeStatus(host, spawn = defaultSpawn2) {
+async function getDashboardComposeStatus(host, spawn = defaultSpawn2, signal) {
   validateDashboardHost(host);
   const knownHostsArgs = buildKnownHostsArgs();
   const { args: identityArgs, cleanup } = buildIdentityArgs(process.env.DASHBOARD_SSH_KEY);
@@ -11831,7 +12126,7 @@ async function getDashboardComposeStatus(host, spawn = defaultSpawn2) {
   let stderrText;
   let exitCode;
   try {
-    const child = spawn(sshCmd, { env, stdout: "pipe", stderr: "pipe" });
+    const child = spawn(sshCmd, { env, stdout: "pipe", stderr: "pipe", ...signal === undefined ? {} : { signal } });
     [stdoutText, stderrText, exitCode] = await Promise.all([
       new Response(child.stdout).text(),
       new Response(child.stderr).text(),
@@ -11861,50 +12156,11 @@ async function getDashboardComposeStatus(host, spawn = defaultSpawn2) {
   const ok = isAllRunning(services);
   return { ok, services };
 }
-async function getDashboardStatusSummary(host, spawn) {
-  let result;
-  try {
-    result = await getDashboardComposeStatus(host, spawn);
-  } catch (error) {
-    const errorMsg = error instanceof Error ? error.message : String(error);
-    return {
-      app: "dashboard",
-      http: `ERROR: ${errorMsg}`,
-      lastDeploy: "\u2014",
-      version: "\u2014",
-      contentHash: "\u2014",
-      usageStats: "\u2014"
-    };
-  }
-  if (result.services.length === 0) {
-    const errorMsg = result.error ?? "No services reported";
-    return {
-      app: "dashboard",
-      http: `ERROR: ${errorMsg}`,
-      lastDeploy: "\u2014",
-      version: "\u2014",
-      contentHash: "\u2014",
-      usageStats: "\u2014"
-    };
-  }
-  const rows = result.services.map((s) => `${s.service}:${s.state}/${s.health}`).join(", ");
-  if (!result.ok) {
-    return {
-      app: "dashboard",
-      http: `DEGRADED: ${rows}`,
-      lastDeploy: "\u2014",
-      version: "\u2014",
-      contentHash: "\u2014",
-      usageStats: "\u2014"
-    };
-  }
+async function getDashboardStatusSummary(host, spawn, signal) {
+  const result = await getDashboardComposeStatus(host, spawn, signal);
   return {
-    app: "dashboard",
-    http: `OK: ${rows}`,
-    lastDeploy: "\u2014",
-    version: "\u2014",
-    contentHash: "\u2014",
-    usageStats: "\u2014"
+    observations: [composeObservation(declaredObservation("dashboard", "compose-services"), result)],
+    facts: { services: servicesFact(result.services) }
   };
 }
 async function dashboardStatusAction(options, ctx, spawn) {
@@ -12647,12 +12903,6 @@ function formatWorkspaceMemory(status) {
     `  OpenCode:    ${formatOpencode(status)}`
   ];
 }
-function formatWorkspaceSummary(status) {
-  if (status.status === "unknown")
-    return "workspace=unknown";
-  const mem = status.limitBytes === 0 ? `mem=${formatMiB(status.currentBytes)}MiB limit=none` : `mem=${formatMiB(status.currentBytes)}/${formatMiB(status.limitBytes)}MiB`;
-  return `workspace ${mem} oom_kills=${status.oomKills} opencode=${status.opencode}`;
-}
 
 // src/commands/gateway/status.ts
 var WORKSPACE_PROBE_TIMEOUT_MS = 1e4;
@@ -12686,7 +12936,7 @@ function isAllRunning2(rows) {
 function defaultSpawn5(cmd, opts) {
   return Bun.spawn(cmd, opts);
 }
-async function getGatewayComposeStatus(host, spawn = defaultSpawn5) {
+async function getGatewayComposeStatus(host, spawn = defaultSpawn5, signal) {
   validateGatewayHost(host);
   const knownHostsArgs = buildKnownHostsArgs();
   const { args: identityArgs, cleanup } = buildIdentityArgs(process.env.GATEWAY_SSH_KEY);
@@ -12710,7 +12960,7 @@ async function getGatewayComposeStatus(host, spawn = defaultSpawn5) {
   let stderrText;
   let exitCode;
   try {
-    const child = spawn(sshCmd, { env, stdout: "pipe", stderr: "pipe" });
+    const child = spawn(sshCmd, { env, stdout: "pipe", stderr: "pipe", ...signal === undefined ? {} : { signal } });
     [stdoutText, stderrText, exitCode] = await Promise.all([
       new Response(child.stdout).text(),
       new Response(child.stderr).text(),
@@ -12741,7 +12991,7 @@ async function getGatewayComposeStatus(host, spawn = defaultSpawn5) {
   const ok = isAllRunning2(services);
   return { ok, services };
 }
-async function getGatewayWorkspaceStatus(host, spawn = defaultSpawn5, timeoutMs = WORKSPACE_PROBE_TIMEOUT_MS) {
+async function getGatewayWorkspaceStatus(host, spawn = defaultSpawn5, timeoutMs = WORKSPACE_PROBE_TIMEOUT_MS, signal) {
   validateGatewayHost(host);
   const knownHostsArgs = buildKnownHostsArgs();
   const { args: identityArgs, cleanup } = buildIdentityArgs(process.env.GATEWAY_SSH_KEY);
@@ -12766,7 +13016,7 @@ async function getGatewayWorkspaceStatus(host, spawn = defaultSpawn5, timeoutMs
     timer = setTimeout(() => resolve("timeout"), timeoutMs);
   });
   try {
-    const child = spawn(sshCmd, { env, stdout: "pipe", stderr: "pipe" });
+    const child = spawn(sshCmd, { env, stdout: "pipe", stderr: "pipe", ...signal === undefined ? {} : { signal } });
     const collected = Promise.all([new Response(child.stdout).text(), new Response(child.stderr).text(), child.exited]);
     collected.catch(() => {
       return;
@@ -12787,30 +13037,43 @@ async function getGatewayWorkspaceStatus(host, spawn = defaultSpawn5, timeoutMs
     cleanup();
   }
 }
-async function getGatewayStatusSummary(host, spawn) {
-  const result = await getGatewayComposeStatus(host, spawn);
+function workspaceObservation(workspace) {
+  const spec = declaredObservation("gateway", "workspace-memory");
+  if (workspace.status === "unknown")
+    return observe(spec, "unknown", { detail: { reason: "probe-failed" } });
+  if (workspace.oomKilled || workspace.oomKills > 0)
+    return observe(spec, "fail", { detail: { reason: "oom-kill" } });
+  switch (workspace.opencode) {
+    case "ready":
+      return observe(spec, "pass");
+    case "down":
+    case "degraded":
+      return observe(spec, "fail", { detail: { reason: `supervisor-${workspace.opencode}` } });
+    case "skipped":
+      return workspace.limitBytes > 0 ? observe(spec, "fail", { detail: { reason: "near-limit" } }) : observe(spec, "pass");
+    case "starting":
+    case "unknown":
+      return observe(spec, "unknown", { detail: { reason: `supervisor-${workspace.opencode}` } });
+  }
+}
+async function getGatewayStatusSummary(host, spawn, signal) {
+  const result = await getGatewayComposeStatus(host, spawn, signal);
+  const compose = composeObservation(declaredObservation("gateway", "compose-services"), result);
   if (result.services.length === 0) {
-    const errorMsg = result.error ?? "No services reported";
     return {
-      app: "gateway",
-      http: `ERROR: ${errorMsg}`,
-      lastDeploy: "\u2014",
-      version: "\u2014",
-      contentHash: "\u2014",
-      usageStats: "\u2014"
+      observations: [
+        compose,
+        observe(declaredObservation("gateway", "workspace-memory"), "unknown", {
+          detail: { reason: "compose-unavailable" }
+        })
+      ],
+      facts: { services: [] }
     };
   }
-  const rows = result.services.map((s) => `${s.service}:${s.state}/${s.health}`).join(", ");
-  const workspace = await getGatewayWorkspaceStatus(host, spawn);
-  const prefix = result.ok ? `OK: ${rows}` : `DEGRADED: ${rows}`;
+  const workspace = await getGatewayWorkspaceStatus(host, spawn, undefined, signal);
   return {
-    app: "gateway",
-    http: `${prefix}; ${formatWorkspaceSummary(workspace)}`,
-    lastDeploy: "\u2014",
-    version: "\u2014",
-    contentHash: "\u2014",
-    usageStats: "\u2014",
-    workspace
+    observations: [compose, workspaceObservation(workspace)],
+    facts: { services: servicesFact(result.services), workspace: { ...workspace } }
   };
 }
 async function gatewayStatusAction(options, ctx, spawn, workspaceTimeoutMs) {
@@ -13011,7 +13274,7 @@ import { join as join7 } from "path";
 import { z as z28 } from "zod";
 var SITE_URL = "https://kw.igg.ms/";
 var GH_REPO = "marcusrbrown/infra";
-var HTTP_TIMEOUT_MS4 = 1e4;
+var HTTP_TIMEOUT_MS3 = 1e4;
 var ghRunSchema = z28.array(z28.object({
   createdAt: z28.string().min(1),
   url: z28.url()
@@ -13053,7 +13316,7 @@ async function checkHttpReachability2(verbose) {
   const startedAt = performance.now();
   try {
     const response = await fetch(SITE_URL, {
-      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS4)
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS3)
     });
     const elapsedMs = performance.now() - startedAt;
     const details = [];
@@ -13080,11 +13343,11 @@ async function checkHttpReachability2(verbose) {
       title: "HTTP reachability",
       level: "error",
       summary: `Request failed after ${formatDurationMs2(elapsedMs)}: ${message}`,
-      details: verbose ? [`URL: ${SITE_URL}`, `Timeout: ${HTTP_TIMEOUT_MS4}ms`] : undefined
+      details: verbose ? [`URL: ${SITE_URL}`, `Timeout: ${HTTP_TIMEOUT_MS3}ms`] : undefined
     };
   }
 }
-async function checkLastDeploy(verbose) {
+async function checkLastDeploy(verbose, signal) {
   try {
     const proc = Bun.spawn([
       "gh",
@@ -13099,7 +13362,8 @@ async function checkLastDeploy(verbose) {
       GH_REPO
     ], {
       stderr: "pipe",
-      stdout: "pipe"
+      stdout: "pipe",
+      ...signal === undefined ? {} : { signal }
     });
     const [exitCode, stdout, stderr] = await Promise.all([
       proc.exited,
@@ -13141,7 +13405,8 @@ async function checkLastDeploy(verbose) {
       title: "Last successful deploy",
       level: "ok",
       summary: `${formatDate(latestRun.createdAt)}`,
-      details
+      details,
+      value: latestRun.createdAt
     };
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
@@ -13195,7 +13460,7 @@ async function checkContentHash(verbose, repoRoot) {
   }
   try {
     const response = await fetch(SITE_URL, {
-      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS4)
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS3)
     });
     if (!response.ok) {
       return {
@@ -13214,14 +13479,16 @@ async function checkContentHash(verbose, repoRoot) {
         title: "Content hash",
         level: "ok",
         summary: "Remote index.html matches local dist/index.html",
-        details
+        details,
+        value: "match"
       };
     }
     return {
       title: "Content hash",
       level: "warning",
       summary: "Remote index.html differs from local dist/index.html",
-      details
+      details,
+      value: "differs"
     };
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
@@ -13242,22 +13509,17 @@ function printCheckResult2(result, ctx) {
     }
   }
 }
-function formatCheckSummary2(result) {
-  return `${levelLabel2(result.level)}: ${result.summary}`;
-}
-async function getKeewebStatusSummary(verbose) {
-  const [httpResult, lastDeployResult, contentHashResult] = await Promise.all([
-    checkHttpReachability2(verbose),
-    checkLastDeploy(verbose),
-    checkContentHash(verbose)
+async function getKeewebStatusSummary(signal) {
+  const [lastDeployResult, contentHashResult] = await Promise.all([
+    checkLastDeploy(false, signal),
+    checkContentHash(false)
   ]);
   return {
-    app: "keeweb",
-    http: formatCheckSummary2(httpResult),
-    lastDeploy: formatCheckSummary2(lastDeployResult),
-    version: "\u2014",
-    contentHash: formatCheckSummary2(contentHashResult),
-    usageStats: "\u2014"
+    observations: [],
+    facts: {
+      lastDeploy: lastDeployResult.value ?? null,
+      contentHash: contentHashResult.value ?? "unavailable"
+    }
   };
 }
 async function keewebStatusAction(options, ctx) {
@@ -13312,10 +13574,811 @@ function registerMcp(cli) {
 }
 
 // src/commands/status.ts
-import { z as z37 } from "zod";
+import { z as z43 } from "zod";
 
-// src/commands/umami/deploy.ts
+// src/status/deploy-state.ts
+import { z as z30 } from "zod";
+
+// src/status/github-api.ts
+var GITHUB_API_ORIGIN = "https://api.github.com";
+var GITHUB_REPOSITORY = "marcusrbrown/infra";
+var GITHUB_REQUEST_TIMEOUT_MS = 1e4;
+var MAX_LOG_BYTES = 4 * 1024 * 1024;
+function hasToken(token) {
+  return token !== undefined && token.trim() !== "";
+}
+function resolveGithubToken(env) {
+  return [env.GITHUB_TOKEN, env.GH_TOKEN].find(hasToken);
+}
+function apiHeaders(token) {
+  return {
+    accept: "application/vnd.github+json",
+    authorization: `Bearer ${token}`,
+    "x-github-api-version": "2022-11-28",
+    "user-agent": "marcusrbrown-infra-status"
+  };
+}
+async function githubGetJson(fetchFn, token, path, schema) {
+  try {
+    const response = await fetchFn(`${GITHUB_API_ORIGIN}${path}`, {
+      headers: apiHeaders(token),
+      signal: AbortSignal.timeout(GITHUB_REQUEST_TIMEOUT_MS)
+    });
+    if (!response.ok) {
+      await response.body?.cancel().catch(() => {
+        return;
+      });
+      return { ok: false };
+    }
+    const parsed = schema.safeParse(await response.json());
+    return parsed.success ? { ok: true, data: parsed.data } : { ok: false };
+  } catch {
+    return { ok: false };
+  }
+}
+async function readBoundedText(response) {
+  const declared = Number(response.headers.get("content-length"));
+  if (Number.isFinite(declared) && declared > MAX_LOG_BYTES) {
+    await response.body?.cancel().catch(() => {
+      return;
+    });
+    return;
+  }
+  const text = await response.text();
+  return text.length > MAX_LOG_BYTES ? undefined : text;
+}
+async function githubGetLogText(fetchFn, token, path) {
+  try {
+    const first = await fetchFn(`${GITHUB_API_ORIGIN}${path}`, {
+      headers: apiHeaders(token),
+      redirect: "manual",
+      signal: AbortSignal.timeout(GITHUB_REQUEST_TIMEOUT_MS)
+    });
+    if (first.status === 200) {
+      const text = await readBoundedText(first);
+      return text === undefined ? { ok: false } : { ok: true, data: text };
+    }
+    await first.body?.cancel().catch(() => {
+      return;
+    });
+    const location = first.headers.get("location");
+    if (first.status !== 302 || location === null || !location.startsWith("https://")) {
+      return { ok: false };
+    }
+    const second = await fetchFn(location, { signal: AbortSignal.timeout(GITHUB_REQUEST_TIMEOUT_MS) });
+    if (!second.ok) {
+      await second.body?.cancel().catch(() => {
+        return;
+      });
+      return { ok: false };
+    }
+    const text = await readBoundedText(second);
+    return text === undefined ? { ok: false } : { ok: true, data: text };
+  } catch {
+    return { ok: false };
+  }
+}
+
+// src/status/observation.ts
 import { z as z29 } from "zod";
+var STATUS_SCHEMA_VERSION = 1;
+var OBSERVATION_KINDS = ["reachability", "container-health", "deploy-state", "end-to-end", "resource"];
+var OBSERVATION_SOURCES = ["http", "ssh", "github-api", "monitor", "config"];
+var APP_IDS = ["keeweb", "cliproxy", "gateway", "umami", "dashboard", "vpn", "broker"];
+var isoTimestampSchema = z29.iso.datetime();
+var observationDetailSchema = z29.strictObject({
+  statusCode: z29.number().int().min(100).max(599).optional(),
+  durationMs: z29.number().int().min(0).max(600000).optional(),
+  contractVersion: z29.string().min(1).max(64).optional(),
+  since: isoTimestampSchema.optional(),
+  probeAt: isoTimestampSchema.optional(),
+  reason: z29.string().max(32).regex(/^[a-z][a-z0-9_-]*$/).optional()
+});
+var observationBaseShape = {
+  id: z29.string().max(64).regex(/^[a-z][a-z0-9-]*$/),
+  kind: z29.enum(OBSERVATION_KINDS),
+  source: z29.enum(OBSERVATION_SOURCES),
+  detail: observationDetailSchema.optional()
+};
+var observationSchema = z29.discriminatedUnion("result", [
+  z29.strictObject({
+    ...observationBaseShape,
+    result: z29.enum(["pass", "fail", "unknown"]),
+    observedAt: isoTimestampSchema
+  }),
+  z29.strictObject({
+    ...observationBaseShape,
+    result: z29.literal("not_measured"),
+    observedAt: z29.null()
+  })
+]);
+var jsonValueSchema = z29.lazy(() => z29.union([
+  z29.string(),
+  z29.number(),
+  z29.boolean(),
+  z29.null(),
+  z29.array(jsonValueSchema),
+  z29.record(z29.string(), jsonValueSchema)
+]));
+var appStatusSchema = z29.strictObject({
+  app: z29.enum(APP_IDS),
+  observations: z29.array(observationSchema),
+  facts: z29.record(z29.string().max(64), jsonValueSchema)
+}).check((ctx) => {
+  const seen = new Set;
+  for (const [index, observation] of ctx.value.observations.entries()) {
+    if (seen.has(observation.id)) {
+      ctx.issues.push({
+        code: "custom",
+        message: `Duplicate observation id "${observation.id}" for app "${ctx.value.app}"`,
+        input: ctx.value,
+        path: ["observations", index, "id"]
+      });
+    }
+    seen.add(observation.id);
+  }
+});
+var statusEnvelopeSchema = z29.strictObject({
+  schemaVersion: z29.literal(STATUS_SCHEMA_VERSION),
+  generatedAt: isoTimestampSchema,
+  apps: z29.array(appStatusSchema)
+}).check((ctx) => {
+  const seen = new Set;
+  for (const [index, entry] of ctx.value.apps.entries()) {
+    if (seen.has(entry.app)) {
+      ctx.issues.push({
+        code: "custom",
+        message: `Duplicate app entry "${entry.app}"`,
+        input: ctx.value,
+        path: ["apps", index, "app"]
+      });
+    }
+    seen.add(entry.app);
+  }
+});
+
+// src/status/deploy-state.ts
+var DEPLOY_STATE_ID = "deploy-state";
+var DEPLOY_STATE_REF = "main";
+var DEPLOY_STATE_CALLS_PER_APP = 2;
+var DEPLOY_STATE_CALL_BUDGET = APP_IDS.length * DEPLOY_STATE_CALLS_PER_APP;
+var SPEC = { id: DEPLOY_STATE_ID, kind: "deploy-state", source: "github-api" };
+var deploymentListSchema = z30.array(z30.object({ id: z30.number().int().positive(), ref: z30.string() }));
+var statusListSchema = z30.array(z30.object({ state: z30.string().min(1).max(32), created_at: z30.iso.datetime() }));
+function mapDeploymentState(state) {
+  switch (state) {
+    case "success":
+      return { result: "pass" };
+    case "failure":
+    case "error":
+      return { result: "fail" };
+    case "waiting":
+      return { result: "unknown", reason: "at_gate" };
+    case "queued":
+    case "in_progress":
+    case "pending":
+      return { result: "unknown", reason: "running" };
+    case "inactive":
+      return { result: "unknown", reason: "inactive" };
+    default:
+      return { result: "unknown", reason: "unknown-state" };
+  }
+}
+function apiError(now) {
+  return observe(SPEC, "unknown", { detail: { reason: "api-error" }, now });
+}
+async function readAppDeployState(app, fetchFn, token, now) {
+  const deployments = await githubGetJson(fetchFn, token, `/repos/${GITHUB_REPOSITORY}/deployments?environment=${encodeURIComponent(app)}&ref=${DEPLOY_STATE_REF}&per_page=1`, deploymentListSchema);
+  if (!deployments.ok)
+    return apiError(now);
+  const newest = deployments.data[0];
+  if (newest === undefined)
+    return notMeasured(SPEC, "none");
+  if (newest.ref !== DEPLOY_STATE_REF)
+    return apiError(now);
+  const statuses = await githubGetJson(fetchFn, token, `/repos/${GITHUB_REPOSITORY}/deployments/${newest.id}/statuses?per_page=1`, statusListSchema);
+  if (!statuses.ok)
+    return apiError(now);
+  const status = statuses.data[0];
+  if (status === undefined)
+    return observe(SPEC, "unknown", { detail: { reason: "no-status" }, now });
+  const mapping = mapDeploymentState(status.state);
+  const detail = {
+    ..."reason" in mapping ? { reason: mapping.reason } : {},
+    since: status.created_at
+  };
+  return observe(SPEC, mapping.result, { detail, now });
+}
+async function readDeployStates(options) {
+  const now = options.now ?? new Date;
+  const { token } = options;
+  if (!hasToken(token)) {
+    return Object.fromEntries(APP_IDS.map((app) => [app, notMeasured(SPEC, "missing-config")]));
+  }
+  const fetchFn = options.fetch ?? fetch;
+  const entries = await Promise.all(APP_IDS.map(async (app) => [app, await readAppDeployState(app, fetchFn, token, now)]));
+  return Object.fromEntries(entries);
+}
+
+// src/status/monitor-state.ts
+import { z as z31 } from "zod";
+var MONITOR_OBSERVATION_ID = "provider-route";
+var MONITOR_WORKFLOW_FILE = "cliproxy-auth-monitor.yaml";
+var PROBE_LINE_PREFIX = "CLIProxy auth monitor probe:";
+var MONITOR_LOG_RETRY_BUDGET = 1;
+var MONITOR_STALE_AFTER_MS = 45 * 60000;
+var MAX_FUTURE_SKEW_MS = 5 * 60000;
+var SPEC2 = { id: MONITOR_OBSERVATION_ID, kind: "end-to-end", source: "monitor" };
+var PROBE_REASON_STATE = {
+  ok: "healthy",
+  "auth-401": "dead",
+  "auth-unavailable-503": "dead",
+  "provider-missing": "dead",
+  "unrelated-http": "unknown",
+  timeout: "unknown",
+  network: "unknown"
+};
+var runsSchema = z31.object({
+  workflow_runs: z31.array(z31.object({
+    id: z31.number().int().positive(),
+    event: z31.string(),
+    head_branch: z31.string().nullable(),
+    status: z31.string()
+  }))
+});
+var jobsSchema = z31.object({ jobs: z31.array(z31.object({ id: z31.number().int().positive() })) });
+var isoSchema = z31.iso.datetime();
+var RUNNER_PREFIX = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z /;
+var PROBE_LINE = /^CLIProxy auth monitor probe: probe=([a-z]+) reason=([a-z0-9-]+) at (\S+)$/;
+function isReason(value) {
+  return Object.keys(PROBE_REASON_STATE).includes(value);
+}
+function parseProbeLine(log) {
+  const lines = log.replace(/^\uFEFF/, "").split(`
+`).map((line) => line.replace(/\r$/, "").replace(RUNNER_PREFIX, "")).filter((line) => line.startsWith(PROBE_LINE_PREFIX));
+  if (lines.length === 0)
+    return { kind: "none" };
+  if (lines.length > 1)
+    return { kind: "multiple" };
+  const match = PROBE_LINE.exec(lines[0] ?? "");
+  if (match === null)
+    return { kind: "malformed" };
+  const [, state, reason, at] = match;
+  if (state === undefined || reason === undefined || at === undefined)
+    return { kind: "malformed" };
+  if (!isReason(reason) || PROBE_REASON_STATE[reason] !== state || !isoSchema.safeParse(at).success) {
+    return { kind: "malformed" };
+  }
+  return { kind: "probe", state: PROBE_REASON_STATE[reason], reason, at };
+}
+function unknown2(reason, now) {
+  return observe(SPEC2, "unknown", { detail: { reason }, now });
+}
+async function readLog(fetchFn, token, jobId) {
+  for (let attempt = 0;attempt <= MONITOR_LOG_RETRY_BUDGET; attempt += 1) {
+    const log = await githubGetLogText(fetchFn, token, `/repos/${GITHUB_REPOSITORY}/actions/jobs/${jobId}/logs`);
+    if (!log.ok)
+      return { kind: "error" };
+    if (log.data.trim() !== "")
+      return { kind: "log", text: log.data };
+  }
+  return { kind: "empty" };
+}
+async function readMonitorState(options) {
+  const now = options.now ?? new Date;
+  const { token } = options;
+  if (!hasToken(token))
+    return notMeasured(SPEC2, "missing-config");
+  const fetchFn = options.fetch ?? fetch;
+  const runs = await githubGetJson(fetchFn, token, `/repos/${GITHUB_REPOSITORY}/actions/workflows/${MONITOR_WORKFLOW_FILE}/runs?event=schedule&branch=main&per_page=1`, runsSchema);
+  if (!runs.ok)
+    return unknown2("api-error", now);
+  const run = runs.data.workflow_runs[0];
+  if (run === undefined || run.event !== "schedule" || run.head_branch !== "main")
+    return unknown2("no-run", now);
+  if (run.status !== "completed")
+    return unknown2("running", now);
+  const jobs = await githubGetJson(fetchFn, token, `/repos/${GITHUB_REPOSITORY}/actions/runs/${run.id}/jobs?per_page=2`, jobsSchema);
+  if (!jobs.ok)
+    return unknown2("api-error", now);
+  const [job, ...extra] = jobs.data.jobs;
+  if (job === undefined || extra.length > 0)
+    return unknown2("job-missing", now);
+  const log = await readLog(fetchFn, token, job.id);
+  if (log.kind === "error")
+    return unknown2("api-error", now);
+  if (log.kind === "empty")
+    return unknown2("log-empty", now);
+  const parsed = parseProbeLine(log.text);
+  switch (parsed.kind) {
+    case "none":
+      return unknown2("no-probe-line", now);
+    case "multiple":
+      return unknown2("multiple-probe-lines", now);
+    case "malformed":
+      return unknown2("malformed-probe-line", now);
+    case "probe":
+      break;
+  }
+  const age = now.getTime() - Date.parse(parsed.at);
+  if (age < -MAX_FUTURE_SKEW_MS)
+    return unknown2("malformed-probe-line", now);
+  if (age > MONITOR_STALE_AFTER_MS) {
+    return observe(SPEC2, "unknown", { detail: { reason: "stale", probeAt: parsed.at }, now });
+  }
+  const result = parsed.state === "healthy" ? "pass" : parsed.state === "dead" ? "fail" : "unknown";
+  return observe(SPEC2, result, { detail: { reason: parsed.reason, probeAt: parsed.at }, now });
+}
+
+// src/status/github-reads.ts
+async function runGithubReads(readers, options) {
+  const [deploy, monitor] = await Promise.allSettled([
+    readers.readDeployStates(options),
+    readers.readMonitorState(options)
+  ]);
+  return { deploy, monitor };
+}
+function checkFailed(app, id, now) {
+  return observe(declaredObservation(app, id), "unknown", { detail: { reason: "check-failed" }, now });
+}
+function githubObservationsFor(app, reads, now) {
+  const observations = [];
+  if (reads.deploy.status === "rejected") {
+    observations.push(checkFailed(app, "deploy-state", now));
+  } else {
+    const deployState = reads.deploy.value[app];
+    if (deployState !== undefined)
+      observations.push(deployState);
+  }
+  if (app === "cliproxy") {
+    observations.push(reads.monitor.status === "rejected" ? checkFailed(app, MONITOR_OBSERVATION_ID, now) : reads.monitor.value);
+  }
+  return observations;
+}
+
+// src/commands/status-history-locate.ts
+import { appendFile } from "fs/promises";
+import { z as z32 } from "zod";
+var HISTORY_ARTIFACT_NAME = "status-history";
+var SNAPSHOT_WORKFLOW_PATH = ".github/workflows/status-snapshot.yaml";
+var HISTORY_LOCATE_RUN_CHECK_BUDGET = 5;
+var LIST_PAGE_SIZE = 100;
+var WRITER_EVENTS = new Set(["schedule", "workflow_dispatch"]);
+var REPOSITORY_PATTERN = /^[\w.-]+\/[\w.-]+$/;
+var artifactsSchema = z32.object({
+  total_count: z32.number().int().nonnegative(),
+  artifacts: z32.array(z32.object({
+    name: z32.string(),
+    expired: z32.boolean(),
+    created_at: z32.iso.datetime({ offset: true }),
+    workflow_run: z32.object({ id: z32.number().int().positive(), head_branch: z32.string().nullable() }).nullable()
+  }))
+});
+var runSchema = z32.object({
+  id: z32.number().int().positive(),
+  event: z32.string(),
+  head_branch: z32.string().nullable(),
+  path: z32.string()
+});
+async function locateHistory(fetchFn, token, repository) {
+  const listed = await githubGetJson(fetchFn, token, `/repos/${repository}/actions/artifacts?name=${HISTORY_ARTIFACT_NAME}&per_page=${LIST_PAGE_SIZE}`, artifactsSchema);
+  if (!listed.ok)
+    return { state: "error", reason: "api-error" };
+  const candidates = listed.data.artifacts.filter((artifact) => artifact.name === HISTORY_ARTIFACT_NAME && !artifact.expired).flatMap((artifact) => artifact.workflow_run?.head_branch === "main" ? [{ createdAt: Date.parse(artifact.created_at), runId: artifact.workflow_run.id }] : []).toSorted((left, right) => right.createdAt - left.createdAt);
+  let checked = 0;
+  for (const candidate of candidates) {
+    if (checked >= HISTORY_LOCATE_RUN_CHECK_BUDGET)
+      return { state: "error", reason: "run-check-budget-exceeded" };
+    checked += 1;
+    const run = await githubGetJson(fetchFn, token, `/repos/${repository}/actions/runs/${candidate.runId}`, runSchema);
+    if (!run.ok)
+      return { state: "error", reason: "api-error" };
+    const { data } = run;
+    if (data.id === candidate.runId && data.head_branch === "main" && WRITER_EVENTS.has(data.event) && data.path === SNAPSHOT_WORKFLOW_PATH) {
+      return { state: "found", runId: candidate.runId };
+    }
+  }
+  if (listed.data.total_count > listed.data.artifacts.length)
+    return { state: "error", reason: "incomplete-listing" };
+  return { state: "empty" };
+}
+function outputLines(result) {
+  return result.state === "found" ? `state=found
+run-id=${result.runId}
+` : `state=empty
+`;
+}
+async function statusHistoryLocateAction(ctx, deps = {}, env = process.env) {
+  const fail = (reason) => {
+    ctx.console.error(`status history-locate failed: ${reason}`);
+    ctx.process.exit(1);
+  };
+  const token = resolveGithubToken(env);
+  if (!hasToken(token))
+    return fail("missing-token");
+  const repository = env.GITHUB_REPOSITORY?.trim() || GITHUB_REPOSITORY;
+  if (!REPOSITORY_PATTERN.test(repository))
+    return fail("invalid-repository");
+  const result = await locateHistory(deps.fetch ?? fetch, token, repository);
+  if (result.state === "error")
+    return fail(result.reason);
+  const outputPath = env.GITHUB_OUTPUT?.trim() ?? "";
+  if (outputPath !== "") {
+    try {
+      await appendFile(outputPath, outputLines(result));
+    } catch {
+      return fail("output-file-error");
+    }
+  }
+  ctx.console.log(result.state === "found" ? `found run-id=${result.runId}` : "empty");
+}
+function registerStatusHistoryLocate(cli, deps) {
+  cli.command("status history-locate", 'Find the newest usable status-history artifact for the snapshot workflow. Needs GITHUB_TOKEN or GH_TOKEN (read-only, actions: read) and reads GITHUB_REPOSITORY. Prints exactly "found run-id=<id>" or "empty" and exits 0; any API error, truncated listing or exhausted call budget exits non-zero, so an outage is never mistaken for an empty history. When GITHUB_OUTPUT is set it also appends state= and run-id= lines. CLI-only: not exposed over MCP.').example("# Locate the history artifact in CI").example("infra status history-locate").action((_options, ctx) => statusHistoryLocateAction(ctx, deps));
+}
+
+// src/commands/status-snapshot.ts
+import { z as z34 } from "zod";
+
+// src/status/history.ts
+import { randomUUID } from "crypto";
+import { mkdir, readdir, readFile, rename, rm, stat, writeFile } from "fs/promises";
+import { join as join8 } from "path";
+import { z as z33 } from "zod";
+var HISTORY_SCHEMA_VERSION = 1;
+var HISTORY_WINDOW_DAYS = 90;
+var HISTORY_WINDOW_MS = HISTORY_WINDOW_DAYS * 24 * 60 * 60000;
+var HISTORY_MAX_BYTES = 10 * 1024 * 1024;
+var MAX_FUTURE_SKEW_MS2 = 5 * 60000;
+var MAX_OBSERVATIONS_PER_SAMPLE = 32;
+var MESSAGES = {
+  "missing-history": "history not found; pass --bootstrap to create it",
+  "history-exists": "history already exists; refusing to bootstrap over it",
+  "unsupported-schema": "unsupported history schemaVersion",
+  malformed: "history is malformed",
+  "unknown-app": "history holds an unknown app",
+  "duplicate-sample": "history holds a duplicate run and attempt",
+  "future-sample": "a sample is dated more than 5 minutes in the future",
+  "sample-dropped": "merge would drop a sample inside the 90-day window",
+  "newest-regressed": "newest sample time would move backwards",
+  "too-large": "history exceeds the 10 MB cap",
+  "invalid-sample": "snapshot sample is invalid",
+  "invalid-run": "GITHUB_RUN_ID or GITHUB_RUN_ATTEMPT is invalid",
+  "invalid-now": "--now must be a UTC ISO timestamp"
+};
+
+class HistoryError extends Error {
+  code;
+  app;
+  constructor(code, app) {
+    super(app === undefined ? MESSAGES[code] : `${MESSAGES[code]} (${app})`);
+    this.name = "HistoryError";
+    this.code = code;
+    this.app = app;
+  }
+}
+var RESULT_CODES = { pass: "p", fail: "f", unknown: "u", not_measured: "n" };
+var resultCodeSchema = z33.enum(["p", "f", "u", "n"]);
+var observationIdSchema = z33.string().max(64).regex(/^[a-z][a-z0-9-]*$/);
+var SAMPLE_DETAIL_KEYS = ["statusCode", "reason", "contractVersion", "since", "probeAt"];
+var sampleDetailSchema = observationDetailSchema.pick({
+  statusCode: true,
+  reason: true,
+  contractVersion: true,
+  since: true,
+  probeAt: true
+});
+var historySampleSchema = z33.strictObject({
+  t: z33.iso.datetime(),
+  run: z33.string().regex(/^(?:\d{1,20}|local(?:-\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z)?)$/),
+  att: z33.number().int().min(1).max(1e4),
+  r: z33.record(observationIdSchema, resultCodeSchema),
+  d: z33.record(observationIdSchema, sampleDetailSchema).optional()
+}).refine((sample) => {
+  const count = Object.keys(sample.r).length;
+  return count >= 1 && count <= MAX_OBSERVATIONS_PER_SAMPLE;
+}, "r must hold 1 to 32 results").refine((sample) => Object.keys(sample.d ?? {}).every((id) => (id in sample.r)), "d may only describe ids present in r");
+var historyMetaSchema = z33.strictObject({
+  schemaVersion: z33.literal(HISTORY_SCHEMA_VERSION),
+  lastSampleAt: z33.iso.datetime()
+});
+var historyAppFileSchema = z33.array(historySampleSchema);
+function recordByApp(build) {
+  return {
+    keeweb: build("keeweb"),
+    cliproxy: build("cliproxy"),
+    gateway: build("gateway"),
+    umami: build("umami"),
+    dashboard: build("dashboard"),
+    vpn: build("vpn"),
+    broker: build("broker")
+  };
+}
+function pickDetail(detail) {
+  if (detail === undefined)
+    return;
+  const picked = Object.fromEntries(SAMPLE_DETAIL_KEYS.flatMap((key) => detail[key] === undefined ? [] : [[key, detail[key]]]));
+  if (Object.keys(picked).length === 0)
+    return;
+  const parsed = sampleDetailSchema.safeParse(picked);
+  if (!parsed.success)
+    throw new HistoryError("invalid-sample");
+  return parsed.data;
+}
+function compactSample(observations, identity, now) {
+  const r = {};
+  const d = {};
+  for (const observation of observations) {
+    r[observation.id] = RESULT_CODES[observation.result];
+    const detail = pickDetail(observation.detail);
+    if (detail !== undefined)
+      d[observation.id] = detail;
+  }
+  const parsed = historySampleSchema.safeParse({
+    t: now.toISOString(),
+    run: identity.run,
+    att: identity.att,
+    r,
+    ...Object.keys(d).length === 0 ? {} : { d }
+  });
+  if (!parsed.success)
+    throw new HistoryError("invalid-sample");
+  return parsed.data;
+}
+function serializeHistory(history) {
+  const files = [
+    ...APP_IDS.map((app) => ({ path: `apps/${app}.json`, content: JSON.stringify(history.apps[app]) })),
+    { path: "meta.json", content: JSON.stringify(history.meta) }
+  ];
+  const encoder = new TextEncoder;
+  return { files, bytes: files.reduce((total, file) => total + encoder.encode(file.content).length, 0) };
+}
+var sampleKey = (sample) => `${sample.run}:${sample.att}`;
+var sampleTime = (sample) => Date.parse(sample.t);
+var KNOWN_APPS = APP_IDS;
+function isAppId(value) {
+  return KNOWN_APPS.includes(value);
+}
+function assertHistoryInvariants({ previous, next, now, maxBytes = HISTORY_MAX_BYTES }) {
+  const nowMs = now.getTime();
+  const cutoff = nowMs - HISTORY_WINDOW_MS;
+  const futureLimit = nowMs + MAX_FUTURE_SKEW_MS2;
+  for (const app of Object.keys(next.apps)) {
+    if (!isAppId(app))
+      throw new HistoryError("unknown-app");
+  }
+  if (Date.parse(next.meta.lastSampleAt) > futureLimit)
+    throw new HistoryError("future-sample");
+  let newest = Number.NEGATIVE_INFINITY;
+  for (const app of APP_IDS) {
+    const keys = new Set;
+    for (const sample of next.apps[app]) {
+      if (sampleTime(sample) > futureLimit)
+        throw new HistoryError("future-sample", app);
+      const key = sampleKey(sample);
+      if (keys.has(key))
+        throw new HistoryError("duplicate-sample", app);
+      keys.add(key);
+      newest = Math.max(newest, sampleTime(sample));
+    }
+    const before = previous?.apps[app] ?? [];
+    const insideWindow = before.filter((sample) => sampleTime(sample) >= cutoff);
+    const outsideWindow = before.length - insideWindow.length;
+    if (next.apps[app].length < before.length - outsideWindow || insideWindow.some((sample) => !keys.has(sampleKey(sample)))) {
+      throw new HistoryError("sample-dropped", app);
+    }
+  }
+  if (previous !== undefined) {
+    const floor = Date.parse(previous.meta.lastSampleAt);
+    if (floor >= cutoff && (newest < floor || Date.parse(next.meta.lastSampleAt) < floor)) {
+      throw new HistoryError("newest-regressed");
+    }
+  }
+  if (serializeHistory(next).bytes > maxBytes)
+    throw new HistoryError("too-large");
+}
+function mergeHistory(input) {
+  const { previous, incoming, now } = input;
+  const cutoff = now.getTime() - HISTORY_WINDOW_MS;
+  let added = 0;
+  let trimmed = 0;
+  let newest;
+  const apps = {};
+  for (const app of APP_IDS) {
+    const existing = previous?.apps[app] ?? [];
+    const known = new Set(existing.map(sampleKey));
+    const fresh = incoming[app];
+    const appended = known.has(sampleKey(fresh)) ? [] : [fresh];
+    const candidates = [...existing, ...appended];
+    const kept = candidates.filter((sample) => sampleTime(sample) >= cutoff).sort((a, b) => sampleTime(a) - sampleTime(b));
+    added += appended.length;
+    trimmed += candidates.length - kept.length;
+    apps[app] = kept;
+    for (const sample of kept) {
+      if (newest === undefined || sampleTime(sample) > sampleTime(newest))
+        newest = sample;
+    }
+  }
+  const history = {
+    meta: { schemaVersion: HISTORY_SCHEMA_VERSION, lastSampleAt: newest?.t ?? now.toISOString() },
+    apps
+  };
+  assertHistoryInvariants({
+    previous,
+    next: history,
+    now,
+    ...input.maxBytes === undefined ? {} : { maxBytes: input.maxBytes }
+  });
+  return { history, added, trimmed };
+}
+function isNotFound(error) {
+  return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+async function pathExists(path) {
+  try {
+    await stat(path);
+    return true;
+  } catch (error) {
+    if (isNotFound(error))
+      return false;
+    throw error;
+  }
+}
+async function readBounded(path, budget, app) {
+  let size;
+  try {
+    size = (await stat(path)).size;
+  } catch (error) {
+    if (isNotFound(error))
+      throw new HistoryError("malformed", app);
+    throw error;
+  }
+  budget.remaining -= size;
+  if (budget.remaining < 0)
+    throw new HistoryError("too-large");
+  return readFile(path, "utf8");
+}
+function parseJson(text, app) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new HistoryError("malformed", app);
+  }
+}
+async function loadHistory(dir, mode, options = {}) {
+  const metaPath = join8(dir, "meta.json");
+  const appsDir = join8(dir, "apps");
+  const hasMeta = await pathExists(metaPath);
+  if (mode === "bootstrap") {
+    const hasApps = await pathExists(appsDir) && (await readdir(appsDir)).length > 0;
+    if (hasMeta || hasApps)
+      throw new HistoryError("history-exists");
+    return;
+  }
+  if (!hasMeta)
+    throw new HistoryError("missing-history");
+  const budget = { remaining: options.maxBytes ?? HISTORY_MAX_BYTES };
+  const rawMeta = parseJson(await readBounded(metaPath, budget));
+  if (typeof rawMeta === "object" && rawMeta !== null && "schemaVersion" in rawMeta && rawMeta.schemaVersion !== 1) {
+    throw new HistoryError("unsupported-schema");
+  }
+  const meta = historyMetaSchema.safeParse(rawMeta);
+  if (!meta.success)
+    throw new HistoryError("malformed");
+  let entries;
+  try {
+    entries = await readdir(appsDir);
+  } catch (error) {
+    if (isNotFound(error))
+      throw new HistoryError("malformed");
+    throw error;
+  }
+  for (const entry of entries) {
+    if (!entry.endsWith(".json") || !isAppId(entry.slice(0, -".json".length)))
+      throw new HistoryError("unknown-app");
+  }
+  const apps = {};
+  for (const app of APP_IDS) {
+    const parsed = historyAppFileSchema.safeParse(parseJson(await readBounded(join8(appsDir, `${app}.json`), budget, app), app));
+    if (!parsed.success)
+      throw new HistoryError("malformed", app);
+    const keys = new Set(parsed.data.map(sampleKey));
+    if (keys.size !== parsed.data.length)
+      throw new HistoryError("duplicate-sample", app);
+    apps[app] = parsed.data;
+  }
+  return { meta: meta.data, apps };
+}
+async function writeHistory(dir, history) {
+  const { files } = serializeHistory(history);
+  const staged = [];
+  try {
+    await mkdir(join8(dir, "apps"), { recursive: true });
+    for (const file of files) {
+      const final = join8(dir, file.path);
+      const temp = `${final}.${randomUUID()}.tmp`;
+      staged.push({ temp, final });
+      await writeFile(temp, file.content, { flag: "wx" });
+    }
+    for (const { temp, final } of staged)
+      await rename(temp, final);
+  } catch (error) {
+    await Promise.all(staged.map(({ temp }) => rm(temp, { force: true })));
+    throw error;
+  }
+}
+
+// src/commands/status-snapshot.ts
+function resolveRunIdentity(env, now) {
+  const run = env.GITHUB_RUN_ID?.trim() ?? "";
+  if (run === "")
+    return { run: `local-${now.toISOString()}`, att: 1 };
+  const attempt = env.GITHUB_RUN_ATTEMPT?.trim() ?? "";
+  if (!/^\d{1,20}$/.test(run) || attempt !== "" && !/^\d{1,5}$/.test(attempt)) {
+    throw new HistoryError("invalid-run");
+  }
+  return { run, att: attempt === "" ? 1 : Number(attempt) };
+}
+function resolveNow(value, clock) {
+  if (value === undefined)
+    return clock();
+  if (!z34.iso.datetime().safeParse(value).success)
+    throw new HistoryError("invalid-now");
+  return new Date(value);
+}
+var SNAPSHOT_IDS = recordByApp((app) => new Set(DECLARED_OBSERVATIONS[app].filter((declared) => declared.owner === "probe" || declared.owner === "github").map((declared) => declared.id)));
+async function runProbe2(probe) {
+  if (probe === undefined)
+    return { kind: "none" };
+  try {
+    return { kind: "ok", observation: await probe() };
+  } catch {
+    return { kind: "failed" };
+  }
+}
+async function collectObservations(deps, token, now) {
+  const reads = runGithubReads(deps, { token, now, ...deps.fetch === undefined ? {} : { fetch: deps.fetch } });
+  const probes = await Promise.all(APP_IDS.map(async (app) => [app, await runProbe2(deps.publicProbes[app])]));
+  const settled = await reads;
+  return recordByApp((app) => {
+    const probe = probes.find(([candidate]) => candidate === app)?.[1] ?? { kind: "none" };
+    const status = assembleAppStatus(app, probe, { kind: "none" }, now, githubObservationsFor(app, settled, now));
+    return status.observations.filter((observation) => SNAPSHOT_IDS[app].has(observation.id));
+  });
+}
+function describeFailure(error) {
+  if (error instanceof HistoryError)
+    return error.message;
+  if (error instanceof Error && "code" in error && typeof error.code === "string" && /^E[A-Z\d]+$/.test(error.code)) {
+    return `filesystem error (${error.code})`;
+  }
+  return "unexpected error";
+}
+async function statusSnapshotAction(options, ctx, deps, env = process.env) {
+  try {
+    const now = resolveNow(options.now, deps.now);
+    const identity = resolveRunIdentity(env, now);
+    const previous = await loadHistory(options.history, options.bootstrap === true ? "bootstrap" : "existing");
+    const observations = await collectObservations(deps, resolveGithubToken(env), now);
+    const incoming = recordByApp((app) => compactSample(observations[app], identity, now));
+    const merged = mergeHistory({ previous, incoming, now });
+    if (previous === undefined || merged.added > 0 || merged.trimmed > 0) {
+      await writeHistory(options.history, merged.history);
+    }
+    ctx.console.log(`samples: ${APP_IDS.map((app) => `${app}=${merged.history.apps[app].length}`).join(" ")}`);
+    ctx.console.log(`added: ${merged.added}`);
+    ctx.console.log(`trimmed: ${merged.trimmed}`);
+    ctx.console.log(`bytes: ${serializeHistory(merged.history).bytes}`);
+  } catch (error) {
+    ctx.console.error(`status snapshot failed: ${describeFailure(error)}`);
+    ctx.process.exit(1);
+  }
+}
+function registerStatusSnapshot(cli, deps) {
+  cli.command("status snapshot", "Take one public-safe status sample and merge it into the 90-day history directory. Runs only the public HTTPS probes, the GitHub Deployments reader and the auth monitor reader (GITHUB_TOKEN or GH_TOKEN, read-only); it uses no SSH and no deploy secrets. Stages every file as a temp file before renaming any into place; any invariant violation exits non-zero and writes nothing. Prints counts only. Exits 0 once the snapshot is written, even when observations are fail or unknown, because those are data. CLI-only: not exposed over MCP.").option("--history <dir>", z34.string().min(1).describe("History directory holding meta.json and apps/<app>.json. It must already contain a valid history unless --bootstrap is given.")).option("--bootstrap", z34.boolean().describe("Create the history and its first sample. Fails if meta.json or any app file already exists; without this flag a missing history fails.")).option("--now [iso]", z34.string().describe("UTC ISO timestamp (for example 2026-11-01T12:00:00Z) to use as the sample time and the 90-day trim reference instead of the clock. Intended for tests and replays.")).example("# Create the first history sample in an empty directory").example("infra status snapshot --history ./status-history --bootstrap").example("# Append a sample to an existing history").example("infra status snapshot --history ./status-history").action((options, ctx) => statusSnapshotAction(options, ctx, deps));
+}
+
+// src/commands/umami/deploy.ts
+import { z as z35 } from "zod";
 var REPO6 = "marcusrbrown/infra";
 var WORKFLOW_NAME6 = "Deploy Umami";
 var WORKFLOW_URL6 = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-umami.yaml";
@@ -13350,7 +14413,7 @@ function validateUmamiRemotePreconditions() {
   }
 }
 function registerUmamiDeploy(cli) {
-  cli.command("umami deploy", "Deploy Umami analytics. Default mode triggers the GitHub Deploy Umami workflow, while --local runs apps/umami deploy directly with Bun.").option("--local", z29.boolean().default(false).describe("Run local deployment with Bun using apps/umami instead of triggering GitHub Actions.")).option("--dry-run", z29.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra umami deploy").example("# Validate local deploy preconditions and planned command").example("infra umami deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra umami deploy --local").action(async (options) => {
+  cli.command("umami deploy", "Deploy Umami analytics. Default mode triggers the GitHub Deploy Umami workflow, while --local runs apps/umami deploy directly with Bun.").option("--local", z35.boolean().default(false).describe("Run local deployment with Bun using apps/umami instead of triggering GitHub Actions.")).option("--dry-run", z35.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra umami deploy").example("# Validate local deploy preconditions and planned command").example("infra umami deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra umami deploy --local").action(async (options) => {
     if (options.local) {
       const command = ["bun", "run", "--cwd", "apps/umami", "deploy"];
       if (options.dryRun) {
@@ -13391,7 +14454,7 @@ function registerUmamiDeploy(cli) {
 }
 
 // src/commands/umami/logs.ts
-import { z as z30 } from "zod";
+import { z as z36 } from "zod";
 
 // src/commands/umami/host.ts
 var VALID_HOST_RE5 = /^[a-z\d][a-z\d.\-]*$/i;
@@ -13455,7 +14518,7 @@ async function streamUmamiLogs(opts, spawn = defaultLogsSpawn4, printOut, printE
   return { refused: false, exitCode };
 }
 function registerUmamiLogs(cli) {
-  cli.command("umami logs [service]", "Stream logs from an Umami service via SSH and docker compose.").option("--tail [n]", z30.number().default(100).describe("Number of log lines to tail from each service.")).option("--allow-ci", z30.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive credentials.")).option("--key [key]", z30.string().describe("Environment variable name holding the SSH host. Falls back to UMAMI_DOMAIN when omitted.")).action(async (service, options) => {
+  cli.command("umami logs [service]", "Stream logs from an Umami service via SSH and docker compose.").option("--tail [n]", z36.number().default(100).describe("Number of log lines to tail from each service.")).option("--allow-ci", z36.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive credentials.")).option("--key [key]", z36.string().describe("Environment variable name holding the SSH host. Falls back to UMAMI_DOMAIN when omitted.")).action(async (service, options) => {
     const targetService = service ?? "umami";
     try {
       validateService3(targetService);
@@ -13485,7 +14548,7 @@ function registerUmamiLogs(cli) {
 }
 
 // src/commands/umami/status.ts
-import { z as z31 } from "zod";
+import { z as z37 } from "zod";
 var COMPOSE_PROJECT_DIR7 = "/opt/umami";
 function parseComposePsOutput3(stdoutText) {
   const trimmed = stdoutText.trim();
@@ -13517,7 +14580,7 @@ function isAllRunning3(rows) {
 function defaultSpawn6(cmd, opts) {
   return Bun.spawn(cmd, opts);
 }
-async function getUmamiComposeStatus(host, spawn = defaultSpawn6) {
+async function getUmamiComposeStatus(host, spawn = defaultSpawn6, signal) {
   validateUmamiHost(host);
   const knownHostsArgs = buildKnownHostsArgs();
   const { args: identityArgs, cleanup } = buildIdentityArgs(process.env.UMAMI_SSH_KEY);
@@ -13541,7 +14604,7 @@ async function getUmamiComposeStatus(host, spawn = defaultSpawn6) {
   let stderrText;
   let exitCode;
   try {
-    const child = spawn(sshCmd, { env, stdout: "pipe", stderr: "pipe" });
+    const child = spawn(sshCmd, { env, stdout: "pipe", stderr: "pipe", ...signal === undefined ? {} : { signal } });
     [stdoutText, stderrText, exitCode] = await Promise.all([
       new Response(child.stdout).text(),
       new Response(child.stderr).text(),
@@ -13571,50 +14634,11 @@ async function getUmamiComposeStatus(host, spawn = defaultSpawn6) {
   const ok = isAllRunning3(services);
   return { ok, services };
 }
-async function getUmamiStatusSummary(host, spawn) {
-  let result;
-  try {
-    result = await getUmamiComposeStatus(host, spawn);
-  } catch (error) {
-    const errorMsg = error instanceof Error ? error.message : String(error);
-    return {
-      app: "umami",
-      http: `ERROR: ${errorMsg}`,
-      lastDeploy: "\u2014",
-      version: "\u2014",
-      contentHash: "\u2014",
-      usageStats: "\u2014"
-    };
-  }
-  if (result.services.length === 0) {
-    const errorMsg = result.error ?? "No services reported";
-    return {
-      app: "umami",
-      http: `ERROR: ${errorMsg}`,
-      lastDeploy: "\u2014",
-      version: "\u2014",
-      contentHash: "\u2014",
-      usageStats: "\u2014"
-    };
-  }
-  const rows = result.services.map((s) => `${s.service}:${s.state}/${s.health}`).join(", ");
-  if (!result.ok) {
-    return {
-      app: "umami",
-      http: `DEGRADED: ${rows}`,
-      lastDeploy: "\u2014",
-      version: "\u2014",
-      contentHash: "\u2014",
-      usageStats: "\u2014"
-    };
-  }
+async function getUmamiStatusSummary(host, spawn, signal) {
+  const result = await getUmamiComposeStatus(host, spawn, signal);
   return {
-    app: "umami",
-    http: `OK: ${rows}`,
-    lastDeploy: "\u2014",
-    version: "\u2014",
-    contentHash: "\u2014",
-    usageStats: "\u2014"
+    observations: [composeObservation(declaredObservation("umami", "compose-services"), result)],
+    facts: { services: servicesFact(result.services) }
   };
 }
 async function umamiStatusAction(options, ctx, spawn) {
@@ -13656,7 +14680,7 @@ async function umamiStatusAction(options, ctx, spawn) {
   }
 }
 function registerUmamiStatus(cli) {
-  cli.command("umami status", "Show operational health of the Umami analytics deployment via docker compose ps.").option("--key [key]", z31.string().optional().describe("Environment variable name holding the SSH host. Falls back to UMAMI_DOMAIN when omitted.")).action((options, ctx) => umamiStatusAction(options, ctx));
+  cli.command("umami status", "Show operational health of the Umami analytics deployment via docker compose ps.").option("--key [key]", z37.string().optional().describe("Environment variable name holding the SSH host. Falls back to UMAMI_DOMAIN when omitted.")).action((options, ctx) => umamiStatusAction(options, ctx));
 }
 
 // src/commands/umami/index.ts
@@ -13667,26 +14691,26 @@ function registerUmamiCommands(cli) {
 }
 
 // src/commands/vpn/client.ts
-import { mkdir, writeFile as writeFile2 } from "fs/promises";
-import { join as join8, resolve as resolve2 } from "path";
-import { z as z33 } from "zod";
+import { mkdir as mkdir2, writeFile as writeFile3 } from "fs/promises";
+import { join as join9, resolve as resolve2 } from "path";
+import { z as z39 } from "zod";
 
 // src/commands/vpn/peers.ts
-import { readFile, writeFile } from "fs/promises";
-import { z as z32 } from "zod";
-var peerSchema = z32.object({
-  name: z32.string(),
-  publicKey: z32.string(),
-  tunnelIp: z32.string()
+import { readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
+import { z as z38 } from "zod";
+var peerSchema = z38.object({
+  name: z38.string(),
+  publicKey: z38.string(),
+  tunnelIp: z38.string()
 });
-var peersFileSchema = z32.object({
-  peers: z32.array(peerSchema)
+var peersFileSchema = z38.object({
+  peers: z38.array(peerSchema)
 }).superRefine((data, ctx) => {
   const seenIps = new Set;
   for (const peer of data.peers) {
     if (seenIps.has(peer.tunnelIp)) {
       ctx.addIssue({
-        code: z32.ZodIssueCode.custom,
+        code: z38.ZodIssueCode.custom,
         message: `Duplicate tunnel IP "${peer.tunnelIp}" \u2014 each peer must have a unique tunnel IP.`,
         path: ["peers"]
       });
@@ -13698,7 +14722,7 @@ var peersFileSchema = z32.object({
   for (const peer of data.peers) {
     if (seenNames.has(peer.name)) {
       ctx.addIssue({
-        code: z32.ZodIssueCode.custom,
+        code: z38.ZodIssueCode.custom,
         message: `Duplicate name "${peer.name}" \u2014 each peer must have a unique name.`,
         path: ["peers"]
       });
@@ -13711,7 +14735,7 @@ function parsePeersJson(raw) {
   return peersFileSchema.parse(raw);
 }
 async function readPeers(filePath) {
-  const content = await readFile(filePath, "utf-8");
+  const content = await readFile2(filePath, "utf-8");
   const raw = JSON.parse(content);
   return parsePeersJson(raw);
 }
@@ -13728,7 +14752,7 @@ async function readPeersOrEmpty(filePath) {
 async function writePeers(filePath, peersFile) {
   const content = `${JSON.stringify(peersFile, null, 2)}
 `;
-  await writeFile(filePath, content, { mode: 384 });
+  await writeFile2(filePath, content, { mode: 384 });
 }
 var TUNNEL_SUBNET_PREFIX = "10.8.0.";
 var SERVER_OCTET = 1;
@@ -13911,8 +14935,8 @@ async function vpnClientAdd(name, opts) {
     allowedIps,
     dns
   });
-  await mkdir(clientsDir, { recursive: true });
-  await writeFile2(confPath, confContent, { mode: 384 });
+  await mkdir2(clientsDir, { recursive: true });
+  await writeFile3(confPath, confContent, { mode: 384 });
   const peersJson = `${JSON.stringify(updatedPeersFile, null, 2)}
 `;
   await syncPeersSecret(peersJson, spawnFn, syncTimeoutMs);
@@ -13934,13 +14958,13 @@ async function vpnClientRemove(name, peersJsonPath, opts = {}) {
   await syncPeersSecret(peersJson, spawnFn, syncTimeoutMs);
 }
 function resolveDefaultPeersJsonPath() {
-  return join8(findRepoRoot(), "apps", "vpn", "config", "peers.json");
+  return join9(findRepoRoot(), "apps", "vpn", "config", "peers.json");
 }
 function resolveDefaultClientsDir() {
-  return join8(findRepoRoot(), "apps", "vpn", "clients");
+  return join9(findRepoRoot(), "apps", "vpn", "clients");
 }
 function registerVpnClient(cli) {
-  cli.command("vpn client add <name>", "Add a new VPN client peer. Generates a keypair, assigns a tunnel IP, writes the client .conf to apps/vpn/clients/, and syncs the roster to the VPN_PEERS GitHub secret (best-effort).").option("--split-tunnel [cidrs]", z33.string().describe("Comma-separated CIDRs for split-tunnel routing. Defaults to 0.0.0.0/0 (full tunnel).")).option("--dns [dns]", z33.string().describe("DNS server for the client config.")).option("--server-pubkey [key]", z33.string().describe("Server public key. Falls back to VPN_SERVER_PUBKEY env var.")).option("--endpoint [host]", z33.string().describe("VPN server endpoint (IP or hostname). Falls back to VPN_HOST env var.")).example('# Add a new client named "laptop"').example("infra vpn client add laptop").example("# Add a split-tunnel client").example("infra vpn client add laptop --split-tunnel 10.0.0.0/8,192.168.0.0/16").action(async (name, options) => {
+  cli.command("vpn client add <name>", "Add a new VPN client peer. Generates a keypair, assigns a tunnel IP, writes the client .conf to apps/vpn/clients/, and syncs the roster to the VPN_PEERS GitHub secret (best-effort).").option("--split-tunnel [cidrs]", z39.string().describe("Comma-separated CIDRs for split-tunnel routing. Defaults to 0.0.0.0/0 (full tunnel).")).option("--dns [dns]", z39.string().describe("DNS server for the client config.")).option("--server-pubkey [key]", z39.string().describe("Server public key. Falls back to VPN_SERVER_PUBKEY env var.")).option("--endpoint [host]", z39.string().describe("VPN server endpoint (IP or hostname). Falls back to VPN_HOST env var.")).example('# Add a new client named "laptop"').example("infra vpn client add laptop").example("# Add a split-tunnel client").example("infra vpn client add laptop --split-tunnel 10.0.0.0/8,192.168.0.0/16").action(async (name, options) => {
     const serverPublicKey = options.serverPubkey ?? process.env.VPN_SERVER_PUBKEY;
     const endpoint = options.endpoint ?? process.env.VPN_HOST;
     if (!serverPublicKey) {
@@ -14004,7 +15028,7 @@ function registerVpnClient(cli) {
 }
 
 // src/commands/vpn/deploy.ts
-import { z as z34 } from "zod";
+import { z as z40 } from "zod";
 var REPO7 = "marcusrbrown/infra";
 var WORKFLOW_NAME7 = "Deploy VPN";
 var WORKFLOW_URL7 = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-vpn.yaml";
@@ -14034,7 +15058,7 @@ function validateVpnRemotePreconditions() {
   }
 }
 function registerVpnDeploy(cli) {
-  cli.command("vpn deploy", "Deploy the VPN. Default mode triggers the GitHub Deploy VPN workflow, while --local runs apps/vpn deploy directly with Bun.").option("--local", z34.boolean().default(false).describe("Run local deployment with Bun using apps/vpn instead of triggering GitHub Actions.")).option("--dry-run", z34.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).option("--force-server-key", z34.boolean().default(false).describe("Force regeneration of the server WireGuard keypair. WARNING: invalidates all existing client configs.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra vpn deploy").example("# Validate local deploy preconditions and planned command").example("infra vpn deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra vpn deploy --local").action(async (options) => {
+  cli.command("vpn deploy", "Deploy the VPN. Default mode triggers the GitHub Deploy VPN workflow, while --local runs apps/vpn deploy directly with Bun.").option("--local", z40.boolean().default(false).describe("Run local deployment with Bun using apps/vpn instead of triggering GitHub Actions.")).option("--dry-run", z40.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).option("--force-server-key", z40.boolean().default(false).describe("Force regeneration of the server WireGuard keypair. WARNING: invalidates all existing client configs.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra vpn deploy").example("# Validate local deploy preconditions and planned command").example("infra vpn deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra vpn deploy --local").action(async (options) => {
     if (options.local) {
       const command = [
         "bun",
@@ -14082,7 +15106,7 @@ function registerVpnDeploy(cli) {
 }
 
 // src/commands/vpn/logs.ts
-import { z as z35 } from "zod";
+import { z as z41 } from "zod";
 
 // src/commands/vpn/host.ts
 var VALID_HOST_RE6 = /^[a-z\d][a-z\d.\-]*$/i;
@@ -14138,7 +15162,7 @@ async function streamVpnLogs(opts, spawn = defaultLogsSpawn5, printOut, printErr
   return { refused: false, exitCode };
 }
 function registerVpnLogs(cli) {
-  cli.command("vpn logs", "Stream WireGuard VPN logs via SSH and journalctl.").option("--tail [n]", z35.number().default(100).describe("Number of log lines to tail.")).option("--allow-ci", z35.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive VPN data.")).option("--key [key]", z35.string().describe("Environment variable name holding the SSH host. Falls back to VPN_HOST when omitted.")).action(async (options) => {
+  cli.command("vpn logs", "Stream WireGuard VPN logs via SSH and journalctl.").option("--tail [n]", z41.number().default(100).describe("Number of log lines to tail.")).option("--allow-ci", z41.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive VPN data.")).option("--key [key]", z41.string().describe("Environment variable name holding the SSH host. Falls back to VPN_HOST when omitted.")).action(async (options) => {
     const hostEnvKey = options.key ?? "VPN_HOST";
     const host = process.env[hostEnvKey];
     if (!host) {
@@ -14160,7 +15184,7 @@ function registerVpnLogs(cli) {
 }
 
 // src/commands/vpn/status.ts
-import { z as z36 } from "zod";
+import { z as z42 } from "zod";
 
 // src/commands/vpn/shared.ts
 function parseWgShowOutput(output) {
@@ -14180,7 +15204,7 @@ function parseWgShowOutput(output) {
 function defaultSpawn7(cmd, opts) {
   return Bun.spawn(cmd, opts);
 }
-async function getVpnWgStatus(host, spawn = defaultSpawn7) {
+async function getVpnWgStatus(host, spawn = defaultSpawn7, signal) {
   validateVpnHost(host);
   const knownHostsArgs = buildKnownHostsArgs();
   const { args: identityArgs, cleanup } = buildIdentityArgs(process.env.VPN_SSH_KEY);
@@ -14204,7 +15228,7 @@ async function getVpnWgStatus(host, spawn = defaultSpawn7) {
   let stderrText;
   let exitCode;
   try {
-    const child = spawn(sshCmd, { env, stdout: "pipe", stderr: "pipe" });
+    const child = spawn(sshCmd, { env, stdout: "pipe", stderr: "pipe", ...signal === undefined ? {} : { signal } });
     [stdoutText, stderrText, exitCode] = await Promise.all([
       new Response(child.stdout).text(),
       new Response(child.stderr).text(),
@@ -14217,35 +15241,26 @@ async function getVpnWgStatus(host, spawn = defaultSpawn7) {
     const redacted = redactHost(stderrText.trim(), host) || "unknown error";
     return {
       ok: false,
-      error: `SSH command failed (exit ${exitCode}): ${redacted}`
+      error: `SSH command failed (exit ${exitCode}): ${redacted}`,
+      exitCode
     };
   }
   const wgShow = parseWgShowOutput(stdoutText);
   return { ok: wgShow.interfaceUp, wgShow };
 }
-async function getVpnStatusSummary(host, spawn) {
-  const result = await getVpnWgStatus(host, spawn);
+var SSH_FAILURE_EXIT_CODE = 255;
+async function getVpnStatusSummary(host, spawn, signal) {
+  const result = await getVpnWgStatus(host, spawn, signal);
+  const spec = declaredObservation("vpn", "wireguard-interface");
+  if (result.exitCode === SSH_FAILURE_EXIT_CODE) {
+    return { observations: [observe(spec, "unknown", { detail: { reason: "ssh-failed" } })], facts: {} };
+  }
   if (!result.ok || !result.wgShow) {
-    const errorMsg = result.error ?? "WireGuard interface not up";
-    return {
-      app: "vpn",
-      http: `ERROR: ${errorMsg}`,
-      lastDeploy: "\u2014",
-      version: "\u2014",
-      contentHash: "\u2014",
-      usageStats: "\u2014"
-    };
+    return { observations: [observe(spec, "fail", { detail: { reason: "interface-down" } })], facts: {} };
   }
-  const { wgShow } = result;
-  const pubKeyInfo = wgShow.serverPublicKey ? ` pubkey:${wgShow.serverPublicKey}` : "";
-  const peerInfo = `${wgShow.peerCount} peer(s)`;
   return {
-    app: "vpn",
-    http: `OK: wg0 up,${pubKeyInfo} ${peerInfo}`,
-    lastDeploy: "\u2014",
-    version: "\u2014",
-    contentHash: "\u2014",
-    usageStats: "\u2014"
+    observations: [observe(spec, "pass")],
+    facts: { peerCount: result.wgShow.peerCount, serverPublicKey: result.wgShow.serverPublicKey ?? null }
   };
 }
 
@@ -14287,7 +15302,7 @@ async function vpnStatusAction(options, ctx, spawn) {
   }
 }
 function registerVpnStatus(cli) {
-  cli.command("vpn status", "Show operational health of the VPN box via SSH and wg show.").option("--key [key]", z36.string().describe("Environment variable name holding the SSH host. Falls back to VPN_HOST when omitted.")).action((options, ctx) => vpnStatusAction(options, ctx));
+  cli.command("vpn status", "Show operational health of the VPN box via SSH and wg show.").option("--key [key]", z42.string().describe("Environment variable name holding the SSH host. Falls back to VPN_HOST when omitted.")).action((options, ctx) => vpnStatusAction(options, ctx));
 }
 
 // src/commands/vpn/index.ts
@@ -14300,101 +15315,167 @@ function registerVpnCommands(cli) {
 
 // src/commands/status.ts
 var DEFAULT_CLIPROXY_URL9 = "https://cliproxy.fro.bot";
-var ERROR_PREFIX = "\u274C";
+var COLLECTOR_DEADLINE_MS = 30000;
+var defaultDependencies = {
+  getKeewebStatusSummary,
+  getCliproxyStatusSummary: (baseUrl, key, signal) => getCliproxyStatusSummary(baseUrl, key, undefined, signal),
+  getGatewayStatusSummary: (host, signal) => getGatewayStatusSummary(host, undefined, signal),
+  getUmamiStatusSummary: (host, signal) => getUmamiStatusSummary(host, undefined, signal),
+  getDashboardStatusSummary: (host, signal) => getDashboardStatusSummary(host, undefined, signal),
+  getVpnStatusSummary: (host, signal) => getVpnStatusSummary(host, undefined, signal),
+  publicProbes: PUBLIC_PROBES,
+  readDeployStates,
+  readMonitorState,
+  now: () => new Date,
+  collectorDeadlineMs: COLLECTOR_DEADLINE_MS
+};
 var TABLE_COLUMNS = [
-  { key: "app", label: "App" },
-  { key: "http", label: "HTTP" },
-  { key: "lastDeploy", label: "Last Deploy" },
-  { key: "version", label: "Version" },
-  { key: "contentHash", label: "Content Hash" },
-  { key: "usageStats", label: "Usage Stats" }
+  { kind: "reachability", label: "Reachability" },
+  { kind: "container-health", label: "Container" },
+  { kind: "deploy-state", label: "Deploy" },
+  { kind: "end-to-end", label: "End-to-end" },
+  { kind: "resource", label: "Resource" }
 ];
-function stripTrailingSlash7(value) {
+var RESULT_CELLS = {
+  pass: "\u2705 pass",
+  fail: "\u274C fail",
+  unknown: "\u2753 unknown",
+  not_measured: "\u26AA not measured"
+};
+var UNDECLARED_CELL = "\u2014";
+function stripTrailingSlash8(value) {
   return value.endsWith("/") ? value.slice(0, -1) : value;
 }
-function errorSummary(app, reason) {
-  const message = reason instanceof Error ? reason.message : String(reason);
-  const errorCell = `${ERROR_PREFIX} ${message}`;
-  return {
-    app,
-    http: errorCell,
-    lastDeploy: errorCell,
-    version: errorCell,
-    contentHash: errorCell,
-    usageStats: errorCell
-  };
+function brokerBaseUrl(domain) {
+  const trimmed = domain?.trim() ?? "";
+  if (trimmed === "")
+    return;
+  return /^[a-z][a-z\d+.-]*:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`;
 }
-function toJsonPayload(rows) {
-  return {
-    keeweb: rows.find((row) => row.app === "keeweb") ?? errorSummary("keeweb", "missing result"),
-    cliproxy: rows.find((row) => row.app === "cliproxy") ?? errorSummary("cliproxy", "missing result"),
-    gateway: rows.find((row) => row.app === "gateway") ?? errorSummary("gateway", "missing result"),
-    umami: rows.find((row) => row.app === "umami") ?? errorSummary("umami", "missing result"),
-    dashboard: rows.find((row) => row.app === "dashboard") ?? errorSummary("dashboard", "missing result"),
-    vpn: rows.find((row) => row.app === "vpn") ?? errorSummary("vpn", "missing result"),
-    broker: rows.find((row) => row.app === "broker") ?? errorSummary("broker", "missing result")
+function describeReason(reason) {
+  return reason instanceof Error ? reason.message : String(reason);
+}
+var TIMED_OUT = Symbol("collector-timed-out");
+function hostCollector(host, run) {
+  return host === "" ? { kind: "missing-config" } : { kind: "run", run: (signal) => run(host, signal) };
+}
+async function withDeadline(run, deadlineMs) {
+  const controller = new AbortController;
+  let timer;
+  const deadline = new Promise((resolve) => {
+    timer = setTimeout(() => {
+      controller.abort();
+      resolve(TIMED_OUT);
+    }, deadlineMs);
+  });
+  try {
+    const work = run.run(controller.signal);
+    work.catch(() => {
+      return;
+    });
+    return await Promise.race([work, deadline]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function collectApp(app, probe, collector, options) {
+  const { ctx, now, deadlineMs, json, githubReads } = options;
+  const [probeResult, collectorResult] = await Promise.allSettled([
+    probe === undefined ? Promise.resolve(undefined) : probe(),
+    collector.kind === "run" ? withDeadline(collector, deadlineMs) : Promise.resolve(undefined)
+  ]);
+  const logFailure = (message) => {
+    if (!json)
+      ctx.console.error(`${app} ${message}`);
   };
+  let probeOutcome = { kind: "none" };
+  if (probeResult.status === "rejected") {
+    logFailure(`status check failed: ${describeReason(probeResult.reason)}`);
+    probeOutcome = { kind: "failed" };
+  } else if (probeResult.value !== undefined) {
+    probeOutcome = { kind: "ok", observation: probeResult.value };
+  }
+  let collectorOutcome = { kind: collector.kind === "run" ? "none" : collector.kind };
+  if (collectorResult.status === "rejected") {
+    logFailure(`status check failed: ${describeReason(collectorResult.reason)}`);
+    collectorOutcome = { kind: "failed" };
+  } else if (collectorResult.value === TIMED_OUT) {
+    logFailure(`status check timed out after ${deadlineMs}ms`);
+    collectorOutcome = { kind: "timeout" };
+  } else if (collectorResult.value !== undefined) {
+    collectorOutcome = { kind: "ok", collection: collectorResult.value };
+  }
+  return assembleAppStatus(app, probeOutcome, collectorOutcome, now(), githubObservationsFor(app, await githubReads, now()));
+}
+function formatRow(app) {
+  const cells = TABLE_COLUMNS.map(({ kind }) => {
+    const worst = worstResult(app, kind);
+    return worst === undefined ? UNDECLARED_CELL : RESULT_CELLS[worst];
+  });
+  return `| ${[app.app, ...cells].join(" | ")} |`;
 }
-function formatRow(row) {
-  const values = TABLE_COLUMNS.map(({ key }) => row[key]);
-  return `| ${values.join(" | ")} |`;
+function formatHeader() {
+  return `| ${["App", ...TABLE_COLUMNS.map(({ label }) => label)].join(" | ")} |`;
 }
-async function unifiedStatusAction(options, ctx, dependencies = {
-  getKeewebStatusSummary,
-  getCliproxyStatusSummary,
-  getGatewayStatusSummary,
-  getUmamiStatusSummary,
-  getDashboardStatusSummary,
-  getVpnStatusSummary,
-  getBrokerStatusSummary
-}) {
-  const verbose = options.verbose === true;
-  const cliproxyBaseUrl = stripTrailingSlash7(process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL9);
+async function unifiedStatusAction(options, ctx, dependencies = defaultDependencies) {
+  const cliproxyBaseUrl = stripTrailingSlash8(process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL9);
   const cliproxyKey = process.env.CLIPROXY_MANAGEMENT_KEY ?? "";
   const gatewayHost = process.env.GATEWAY_HOST ?? "";
   const umamiHost = process.env.UMAMI_DOMAIN ?? "";
   const dashboardHost = process.env.DASHBOARD_DOMAIN ?? "";
   const vpnHost = process.env.VPN_HOST ?? "";
-  const brokerHost = process.env.BROKER_DOMAIN ?? process.env.BROKER_HOST ?? "";
-  const results = await Promise.allSettled([
-    dependencies.getKeewebStatusSummary(verbose),
-    dependencies.getCliproxyStatusSummary(cliproxyBaseUrl, cliproxyKey, verbose),
-    dependencies.getGatewayStatusSummary(gatewayHost),
-    dependencies.getUmamiStatusSummary(umamiHost),
-    dependencies.getDashboardStatusSummary(dashboardHost),
-    dependencies.getVpnStatusSummary(vpnHost),
-    dependencies.getBrokerStatusSummary(brokerHost)
-  ]);
-  const appNames = ["keeweb", "cliproxy", "gateway", "umami", "dashboard", "vpn", "broker"];
-  const rows = results.map((result, index) => {
-    const app = appNames[index] ?? "keeweb";
-    if (result.status === "fulfilled") {
-      return result.value;
-    }
-    const reason = result.reason;
-    const message = reason instanceof Error ? reason.message : String(reason);
-    ctx.console.error(`${app} status check failed: ${message}`);
-    return errorSummary(app, reason);
+  const collectors = {
+    keeweb: { kind: "run", run: (signal) => dependencies.getKeewebStatusSummary(signal) },
+    cliproxy: {
+      kind: "run",
+      run: (signal) => dependencies.getCliproxyStatusSummary(cliproxyBaseUrl, cliproxyKey, signal)
+    },
+    gateway: hostCollector(gatewayHost, dependencies.getGatewayStatusSummary),
+    umami: hostCollector(umamiHost, dependencies.getUmamiStatusSummary),
+    dashboard: hostCollector(dashboardHost, dependencies.getDashboardStatusSummary),
+    vpn: hostCollector(vpnHost, dependencies.getVpnStatusSummary),
+    broker: { kind: "none" }
+  };
+  const probeBaseUrls = {
+    cliproxy: cliproxyBaseUrl,
+    broker: brokerBaseUrl(process.env.BROKER_DOMAIN)
+  };
+  const json = options.json === true;
+  const githubReads = runGithubReads(dependencies, {
+    token: resolveGithubToken(process.env),
+    now: dependencies.now(),
+    ...dependencies.fetch === undefined ? {} : { fetch: dependencies.fetch }
   });
-  if (options.json === true) {
-    ctx.console.log(JSON.stringify(toJsonPayload(rows)));
+  const apps = await Promise.all(APP_IDS.map((app) => {
+    const probe = dependencies.publicProbes[app];
+    const baseUrl = probeBaseUrls[app];
+    const probeOptions = baseUrl === undefined ? undefined : { baseUrl };
+    return collectApp(app, probe && (() => probe(probeOptions)), collectors[app], {
+      ctx,
+      now: dependencies.now,
+      deadlineMs: dependencies.collectorDeadlineMs,
+      json,
+      githubReads
+    });
+  }));
+  if (json) {
+    const envelope = {
+      schemaVersion: STATUS_SCHEMA_VERSION,
+      generatedAt: dependencies.now().toISOString(),
+      apps
+    };
+    ctx.console.log(JSON.stringify(envelope));
     return;
   }
-  ctx.console.log("| App | HTTP | Last Deploy | Version | Content Hash | Usage Stats |");
-  for (const row of rows) {
-    ctx.console.log(formatRow(row));
+  ctx.console.log(formatHeader());
+  for (const app of apps) {
+    ctx.console.log(formatRow(app));
   }
 }
-function registerStatus(cli, dependencies = {
-  getKeewebStatusSummary,
-  getCliproxyStatusSummary,
-  getGatewayStatusSummary,
-  getUmamiStatusSummary,
-  getDashboardStatusSummary,
-  getVpnStatusSummary,
-  getBrokerStatusSummary
-}) {
-  cli.command("status", "Show status of all deployments").option("--json", z37.boolean().describe("Output machine-readable JSON with keeweb, cliproxy, gateway, umami, dashboard, vpn, and broker summary objects. The gateway object also carries a structured workspace field.")).option("--verbose", z37.boolean().describe("Include verbose per-app health check details when building the summary rows.")).action((options, ctx) => unifiedStatusAction(options, ctx, dependencies));
+function registerStatus(cli, dependencies = defaultDependencies) {
+  cli.command("status", "Show status of all deployments").option("--json", z43.boolean().describe("Output a schema-versioned JSON envelope: schemaVersion, generatedAt, and one entry per app with typed observations (id, kind, result, observedAt, source) and facts. The gateway workspace memory status is in facts.workspace.")).action((options, ctx) => unifiedStatusAction(options, ctx, dependencies));
+  registerStatusSnapshot(cli, dependencies);
+  registerStatusHistoryLocate(cli, dependencies);
 }
 
 // src/cli.ts