@sealant/mend 0.26.0 → 0.27.2

package/README.md

@@ -47,11 +47,11 @@ mend server upgrade --version 0.24.0 --assets-dir ./release-0.24.0 --offline
 
 Each asset directory must contain `compose.v2.yaml` and `postgres-init.sh`. Mend copies them into an
 immutable private generation; the source directory is not needed afterward. Preload official
-`postgres:17-alpine` and canonical `ghcr.io/sealant-sh/mend:VERSION`. Image labels and health must
-report that exact version. `--offline` forbids GitHub requests and release-image pulls.
-Start/restart always reuse local release images and retained assets. The bundle publishes only the
-web port (`--port`, default `3105`) and the SSH gateway port (`--ssh-port`, default `2222`); the two
-must differ.
+`postgres:17-alpine`, `dxflrs/garage:v2.4.1` and canonical `ghcr.io/sealant-sh/mend:VERSION`. Image
+labels and health must report that exact version. `--offline` forbids GitHub requests and
+release-image pulls. Start/restart always reuse local release images and retained assets. The bundle
+publishes only the web port (`--port`, default `3105`) and the SSH gateway port (`--ssh-port`,
+default `2222`); the two must differ.
 
 Stop/restart/upgrade interrupt connections. Workspace containers and data remain, but active work
 may lose connectivity and need reconnection. No volumes are deleted. Status/logs never start an

package/dist/{chunk-4MX7ZC34.js → chunk-TBMOGB3T.js}

@@ -26640,6 +26640,14 @@ var Project = class extends Schema_exports.Class("Project")({
    * effectively instant. Explicit resource intent: N ready containers per project.
    */
   hotSessions: Schema_exports.Number,
+  /**
+   * The command that builds this project's dependency tree, run by Mend in a workspace whose
+   * tree does not match the executor's platform and by the install job that feeds the shared
+   * cache (ADR-0002 decisions 2/9). Null = detected from the base tree's lockfile at launch.
+   */
+  installCommand: Schema_exports.NullOr(Schema_exports.String).pipe(
+    Schema_exports.withDecodingDefaultKey(Effect_exports.succeed(null))
+  ),
   createdAt: Timestamp,
   updatedAt: Timestamp
 }) {
@@ -27180,7 +27188,7 @@ var ProjectClusterBindingsSnapshot = class extends Schema_exports.Class(
 }) {
 };
 
-// ../../node_modules/.pnpm/@sealant+api-contracts@0.28.0_effect@4.0.0-beta.93/node_modules/@sealant/api-contracts/dist/workspace-environment.js
+// ../../node_modules/.pnpm/@sealant+api-contracts@0.31.0_effect@4.0.0-beta.93/node_modules/@sealant/api-contracts/dist/workspace-environment.js
 var RESERVED_NAMES = new Map([
   // Identity/process roots the daemon and shells own.
   ...[

package/dist/{dashboard-JIWYW3EM.js → dashboard-5CBGTPSJ.js}

@@ -8,7 +8,7 @@ import {
   normalizeProjectName,
   pendingId,
   repositoryCloneUrlIssue
-} from "./chunk-4MX7ZC34.js";
+} from "./chunk-TBMOGB3T.js";
 
 // src/dashboard.tsx
 import { CliRenderEvents, createCliRenderer } from "@opentui/core";

package/dist/main.js

@@ -17,7 +17,7 @@ import {
   repositoryCloneUrlIssue,
   sessionDisplayName,
   trackBracketedPaste
-} from "./chunk-4MX7ZC34.js";
+} from "./chunk-TBMOGB3T.js";
 
 // src/main.ts
 import { spawn as spawn3, spawnSync as spawnSync2 } from "node:child_process";
@@ -1112,7 +1112,7 @@ var COMMANDS = [
   {
     name: "server stop",
     section: "this machine",
-    summary: "stop Mend and Postgres without deleting data",
+    summary: "stop Mend, Postgres and Garage without deleting data",
     synopsis: [""],
     description: [
       "Stops only the installation's Compose services. Connections are interrupted. Workspace containers and volumes remain, but active work may lose connectivity and need reconnection. No volume deletion or Docker prune is performed."
@@ -1125,7 +1125,7 @@ var COMMANDS = [
     summary: "restart Mend using the same generation and pin",
     synopsis: ["[--offline]"],
     description: [
-      "Checks preloaded images before stopping Mend, then starts the saved generation and verifies exact-version health. Postgres stays running. Connections are interrupted; workspace containers and data remain, but active work may need reconnection."
+      "Checks preloaded images before stopping Mend, then starts the saved generation and verifies exact-version health. Postgres and Garage stay running. Connections are interrupted; workspace containers and data remain, but active work may need reconnection."
     ],
     options: [{ flag: "--offline", text: "use local release images and assets" }],
     see: ["server status", "server logs"]
@@ -1759,7 +1759,7 @@ var loginCommand = async (args, deps) => {
 };
 
 // src/server-setup.ts
-import { randomBytes } from "node:crypto";
+import { createHmac, randomBytes } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import * as net2 from "node:net";
 import * as os3 from "node:os";
@@ -1772,6 +1772,11 @@ var MEND_DOCKER_NAMESPACE = {
   store: "mend-store",
   control: "mend-control"
 };
+var MEND_DOCKER_NAMESPACE_WITH_GARAGE = {
+  ...MEND_DOCKER_NAMESPACE,
+  garage: "mend-garage"
+};
+var secondaryVolumesOf = (namespace) => namespace.garage === void 0 ? [namespace.control] : [namespace.control, namespace.garage];
 var SERVER_VOLUME_OWNER_LABEL = "dev.sealant.mend.installation";
 var ServerVolumeOwnershipError = class extends Error {
   /** Stable error discriminator. */
@@ -1863,9 +1868,10 @@ var inProjectNamespace = (name, project2) => ["-", "_"].some(
   (separator) => name.startsWith(`${project2}${separator}`) && name.length > project2.length + 1
 );
 var reservedResourceName = (name, kind, namespace) => {
-  if ([namespace.project, namespace.store, namespace.control].includes(name)) return true;
+  if ([namespace.project, namespace.store, namespace.control, namespace.garage ?? ""].includes(name))
+    return true;
   return ["-", "_"].some(
-    (separator) => (kind === "container" ? ["mend", "postgres"] : ["default"]).some((service) => {
+    (separator) => (kind === "container" ? ["mend", "postgres", "garage"] : ["default"]).some((service) => {
       const reserved = `${namespace.project}${separator}${service}`;
       return name === reserved || kind === "container" && name.startsWith(reserved) && /^[-_](?:[0-9]+|run[-_][a-f0-9]+)$/.test(name.slice(reserved.length));
     })
@@ -1901,7 +1907,9 @@ var inspectForeignProject = async (runtime, context, kind, name, project2) => {
   }
 };
 var refuseOldData = async (runtime, context, namespace, volumes) => {
-  if (volumes.some((name) => name === namespace.control || name.startsWith(`${namespace.project}_`)))
+  if (volumes.some(
+    (name) => secondaryVolumesOf(namespace).includes(name) || name.startsWith(`${namespace.project}_`)
+  ))
     return fail3("unowned-data", "existing volumes without anchor");
   for (const kind of ["volume", "container", "network"]) {
     const labelled = await listNames(runtime, context, kind, namespace.project);
@@ -1930,9 +1938,9 @@ var refuseOldData = async (runtime, context, namespace, volumes) => {
 };
 var parseOwnershipInput = (input) => {
   const namespace = input.namespace ?? MEND_DOCKER_NAMESPACE;
-  if (!input.dockerContext.trim() || input.identityBytes.byteLength === 0 || !/^[a-z0-9][a-z0-9_-]*$/.test(namespace.project) || ![namespace.store, namespace.control].every(
+  if (!input.dockerContext.trim() || input.identityBytes.byteLength === 0 || !/^[a-z0-9][a-z0-9_-]*$/.test(namespace.project) || ![namespace.store, ...secondaryVolumesOf(namespace)].every(
     (name) => /^[a-zA-Z0-9][a-zA-Z0-9_.-]+$/.test(name)
-  ) || namespace.store === namespace.control)
+  ) || (/* @__PURE__ */ new Set([namespace.store, ...secondaryVolumesOf(namespace)])).size !== 1 + secondaryVolumesOf(namespace).length)
     return fail3("invalid-input", "ownership inputs");
   const owner = createHash("sha256").update(input.identityBytes).digest("hex");
   return { _tag: "ok", value: { owner, namespace } };
@@ -1955,13 +1963,16 @@ var ownership = async (runtime, input, mode) => {
   }
   const current = await listNames(runtime, input.dockerContext, "volume");
   if (current._tag === "error") return current;
-  if (current.value.includes(namespace.control)) {
-    const control = await inspectOwner(runtime, input.dockerContext, namespace.control, owner);
-    if (control._tag === "error") return control;
-  } else {
-    if (mode === "verify") return fail3("missing", "control");
-    const control = await ensureVolume(runtime, input.dockerContext, namespace.control, owner);
-    if (control._tag === "error") return control;
+  for (const name of secondaryVolumesOf(namespace)) {
+    const role = name === namespace.control ? "control" : "garage";
+    if (current.value.includes(name)) {
+      const owned = await inspectOwner(runtime, input.dockerContext, name, owner);
+      if (owned._tag === "error") return owned;
+    } else {
+      if (mode === "verify") return fail3("missing", role);
+      const created = await ensureVolume(runtime, input.dockerContext, name, owner);
+      if (created._tag === "error") return created;
+    }
   }
   return { _tag: "ok", value: { owner, namespace } };
 };
@@ -2471,6 +2482,8 @@ var COMPOSE_ASSET = "compose.v2.yaml";
 var POSTGRES_INIT_ASSET = "postgres-init.sh";
 var RELEASE_BASE = "https://github.com/sealant-sh/Mend/releases/download";
 var LATEST_RELEASE_URL = "https://api.github.com/repos/sealant-sh/Mend/releases/latest";
+var GARAGE_IMAGE = "dxflrs/garage:v2.4.1";
+var GARAGE_BUCKET = "mend";
 var ServerSetupError = class extends Error {
   _tag = "ServerSetupError";
 };
@@ -2486,6 +2499,12 @@ var requiredString = (fields, key) => {
   }
   return value;
 };
+var requiredBucket = (fields) => {
+  const value = fields.get("bucket");
+  if (value !== "garage")
+    throw setupError("Server config is corrupt: bucket must be garage when present.");
+  return value;
+};
 var requiredInteger = (fields, key) => {
   const value = fields.get(key);
   if (typeof value !== "number" || !Number.isInteger(value)) {
@@ -2668,7 +2687,8 @@ var parseServerConfig = (raw) => {
     ),
     appPort: requiredInteger(fields, "appPort"),
     sshPort: requiredInteger(fields, "sshPort"),
-    ...fields.has("registryPort") ? { registryPort: requiredInteger(fields, "registryPort") } : {}
+    ...fields.has("registryPort") ? { registryPort: requiredInteger(fields, "registryPort") } : {},
+    ...fields.has("bucket") ? { bucket: requiredBucket(fields) } : {}
   };
   if (config.schemaVersion !== CONFIG_SCHEMA_VERSION || config.assetContract !== ASSET_CONTRACT && !LEGACY_ASSET_CONTRACTS.has(config.assetContract)) {
     throw setupError(
@@ -2893,10 +2913,15 @@ var resolveLatestVersion = async (runtime) => {
   if (version === "latest") throw setupError("GitHub returned an invalid latest release tag.");
   return version;
 };
-var validateComposeAsset = (body) => {
+var composeServiceNames = (body) => {
   const [, afterServices = ""] = body.split(/^services:\s*$/m);
   const [servicesBlock = ""] = afterServices.split(/^\S/m);
-  const serviceNames = [...servicesBlock.matchAll(/^ {2}([0-9A-Za-z_-]+):\s*$/gm)].map((match) => match[1]).filter((name) => name !== void 0).toSorted((left, right) => left.localeCompare(right));
+  return [...servicesBlock.matchAll(/^ {2}([0-9A-Za-z_-]+):\s*$/gm)].map((match) => match[1]).filter((name) => name !== void 0).toSorted((left, right) => left.localeCompare(right));
+};
+var composeBucket = (body) => composeServiceNames(body).includes("garage") ? "garage" : void 0;
+var validateComposeAsset = (body) => {
+  const serviceNames = composeServiceNames(body);
+  const withGarage = serviceNames.includes("garage");
   const volumeSections = body.split(/^volumes:[ \t]*$/m);
   const volumeBlock = (volumeSections[1] ?? "").split(/^\S/m)[0] ?? "";
   const volumeDeclarations = [
@@ -2904,7 +2929,8 @@ var validateComposeAsset = (body) => {
   ];
   for (const [name, variable] of [
     ["mend-store", "MEND_STORE_VOLUME_NAME"],
-    ["mend-control", "MEND_CONTROL_VOLUME_NAME"]
+    ["mend-control", "MEND_CONTROL_VOLUME_NAME"],
+    ...withGarage ? [["mend-garage", "MEND_GARAGE_VOLUME_NAME"]] : []
   ]) {
     const declarations = volumeDeclarations.filter((match) => match[1] === name);
     const properties = (declarations[0]?.[2] ?? "").split("\n").map((line) => line.trim()).filter((line) => line !== "" && !line.startsWith("#"));
@@ -2930,9 +2956,22 @@ var validateComposeAsset = (body) => {
     "mend-ssh:",
     "mend-postgres:",
     "/var/lib/mend/store",
-    "/run/sealant/sockets"
+    "/run/sealant/sockets",
+    // The capture store's bucket (a release since the capture store); an older release's asset
+    // has none and is still a valid v2 bundle.
+    ...withGarage ? [
+      `image: ${GARAGE_IMAGE}`,
+      "  garage:",
+      "mend-garage:",
+      "MEND_GARAGE_RPC_SECRET",
+      "MEND_GARAGE_ADMIN_TOKEN",
+      "MEND_GARAGE_KEY_ID",
+      "MEND_GARAGE_KEY_SECRET",
+      "MEND_BLOB_STORE",
+      "MEND_SESSION_ENDPOINT_URL"
+    ] : []
   ];
-  if (requiredFragments.some((fragment) => !body.includes(fragment)) || serviceNames.join(",") !== "mend,postgres") {
+  if (requiredFragments.some((fragment) => !body.includes(fragment)) || serviceNames.join(",") !== "mend,postgres" && serviceNames.join(",") !== "garage,mend,postgres") {
     throw setupError(`Downloaded ${COMPOSE_ASSET} does not implement ${ASSET_CONTRACT}.`);
   }
 };
@@ -2962,6 +3001,27 @@ var renderIdentity = (secrets) => [
   `WORKSPACE_SSH_GATEWAY_TOKEN=${secrets.workspaceSshGatewayToken}`,
   ""
 ].join("\n");
+var garageSecrets = (secrets) => {
+  const derive = (label) => createHmac("sha256", Buffer.from(secrets.betterAuthSecret, "hex")).update(label).digest("hex");
+  return {
+    rpcSecret: derive("mend-garage-rpc-secret"),
+    adminToken: derive("mend-garage-admin-token"),
+    keyId: `GK${derive("mend-garage-key-id").slice(0, 24)}`,
+    keySecret: derive("mend-garage-key-secret")
+  };
+};
+var renderGarage = (secrets, config) => {
+  if (config.bucket !== "garage") return [];
+  const garage = garageSecrets(secrets);
+  return [
+    `MEND_GARAGE_RPC_SECRET=${garage.rpcSecret}`,
+    `MEND_GARAGE_ADMIN_TOKEN=${garage.adminToken}`,
+    `MEND_GARAGE_KEY_ID=${garage.keyId}`,
+    `MEND_GARAGE_KEY_SECRET=${garage.keySecret}`,
+    "MEND_GARAGE_VOLUME_NAME=mend-garage"
+  ];
+};
+var namespaceOf = (config) => config.bucket === "garage" ? MEND_DOCKER_NAMESPACE_WITH_GARAGE : MEND_DOCKER_NAMESPACE;
 var renderSecrets = (secrets, config) => {
   const sshHost = parseUrl(config.appUrl, "Server config appUrl").hostname.replace(/^\[|\]$/g, "");
   const composeBind = net2.isIP(config.bind) === 6 ? `[${config.bind}]` : config.bind;
@@ -2978,6 +3038,7 @@ var renderSecrets = (secrets, config) => {
     `SEALANT_SSH_HOST=${sshHost}`,
     "MEND_STORE_VOLUME_NAME=mend-store",
     "MEND_CONTROL_VOLUME_NAME=mend-control",
+    ...renderGarage(secrets, config),
     `DOCKER_SOCKET_PATH=${config.dockerSocket}`,
     ""
   ].join("\n");
@@ -3147,6 +3208,17 @@ var checkLocalImages = async (runtime, config, policy = "local") => {
   );
   if (postgres.status !== 0)
     throw commandFailure("Preload postgres:17-alpine before continuing", postgres);
+  if (config.bucket === "garage") {
+    const garage = await inspectImage(
+      runtime,
+      config.dockerContext,
+      GARAGE_IMAGE,
+      "{{.Id}}",
+      policy
+    );
+    if (garage.status !== 0)
+      throw commandFailure(`Preload ${GARAGE_IMAGE} before continuing`, garage);
+  }
 };
 var checkComposeImages = async (runtime, installation) => {
   const output = await runtime.run(
@@ -3160,14 +3232,50 @@ var checkComposeImages = async (runtime, installation) => {
   const images = output.stdout.trim().split(/\s+/).toSorted();
   const expected = [
     `ghcr.io/sealant-sh/mend:${installation.config.serverVersion}`,
-    "postgres:17-alpine"
+    "postgres:17-alpine",
+    ...installation.config.bucket === "garage" ? [GARAGE_IMAGE] : []
   ].toSorted();
   if (images.join("\n") !== expected.join("\n")) {
     throw setupError(
-      "Compose must use only the canonical pinned Mend image and official postgres:17-alpine."
+      `Compose must use only the canonical pinned Mend image, official postgres:17-alpine${installation.config.bucket === "garage" ? ` and ${GARAGE_IMAGE}` : ""}.`
     );
   }
 };
+var initGarage = async (runtime, installation, secrets) => {
+  if (installation.config.bucket !== "garage") return;
+  const garage = garageSecrets(secrets);
+  const exec = (args) => runtime.run(
+    "docker",
+    serverComposeArgs(
+      { directory: installation.directory, dockerContext: installation.config.dockerContext },
+      ["exec", "-T", "garage", "/garage", "-c", "/etc/garage.toml", ...args]
+    ),
+    { timeoutMs: serverProcessDeadlines.ordinary }
+  );
+  const status = await exec(["status"]);
+  if (status.status !== 0 || status.error !== void 0)
+    throw commandFailure("Garage did not answer its status", status);
+  const node = status.stdout.match(/^([0-9a-f]{16})\s/m)?.[1];
+  if (node === void 0) throw setupError("Garage reported no node in `garage status`.");
+  await exec(["layout", "assign", "-z", "mend", "-c", "1GB", node]);
+  await exec(["layout", "apply", "--version", "1"]);
+  await exec(["bucket", "create", GARAGE_BUCKET]);
+  await exec(["key", "import", "--yes", "-n", GARAGE_BUCKET, garage.keyId, garage.keySecret]);
+  await exec([
+    "bucket",
+    "allow",
+    "--read",
+    "--write",
+    "--owner",
+    GARAGE_BUCKET,
+    "--key",
+    GARAGE_BUCKET
+  ]);
+  const info = await exec(["bucket", "info", GARAGE_BUCKET]);
+  if (info.status !== 0 || info.error !== void 0 || !info.stdout.includes(garage.keyId))
+    throw commandFailure(`Garage bucket ${GARAGE_BUCKET} is not readable by Mend's key`, info);
+  runtime.writeLine(`Capture store bucket ${GARAGE_BUCKET} is laid out in Garage`);
+};
 var startingNotice = (runtime, version) => runtime.writeLine(
   `Starting Mend ${version} containers; Docker waits up to ${serverProcessDeadlines.composeWaitSeconds}s for them to report healthy`
 );
@@ -3214,7 +3322,7 @@ var setupServer = async (args, runtime, store) => {
   const operatingSystem = await checkDocker(runtime, selectedContext.name);
   runtime.writeLine(`Using Docker context "${selectedContext.name}" (${selectedContext.endpoint})`);
   const serverVersion = await resolveServerVersion(runtime, options, existing?.config ?? null);
-  const config = {
+  const configWithoutBucket = {
     schemaVersion: CONFIG_SCHEMA_VERSION,
     assetContract: ASSET_CONTRACT,
     serverVersion,
@@ -3227,17 +3335,24 @@ var setupServer = async (args, runtime, store) => {
     ...validateExposure(existing?.config ?? null, options)
   };
   const assets = await resolveAssets(runtime, serverVersion, existing, store, options);
+  const bucket = composeBucket(assets.compose);
+  const config = {
+    ...configWithoutBucket,
+    ...bucket === void 0 ? {} : { bucket }
+  };
   const secrets = savedSecrets ?? createSecrets(runtime);
   const generation = persistSetup(store, config, secrets, assets);
   await checkComposeImages(runtime, { directory: generation.directory, config });
   const ownership2 = await claimServerDockerVolumes(runtime, {
     dockerContext: config.dockerContext,
-    identityBytes: Buffer.from(generation.files.identity)
+    identityBytes: Buffer.from(generation.files.identity),
+    namespace: namespaceOf(config)
   });
   if (ownership2._tag === "error") throw setupError(ownership2.error.message);
   await checkLocalImages(runtime, config, options.offline ? "local" : "pull-missing");
   storeValue(store.activate(generation));
   await startCompose(runtime, config, generation);
+  await initGarage(runtime, { directory: generation.directory, config }, secrets);
   await probeHealth(runtime, config.appUrl, config.serverVersion);
   runtime.writeLine(`Mend ${config.serverVersion} is reachable at ${config.appUrl}`);
   runtime.writeLine(
@@ -3302,7 +3417,7 @@ var composeCommand = async (runtime, installation, args) => {
 var interruptionNotice = (runtime) => runtime.writeLine(
   "Connections will be interrupted. Workspace containers and data are retained, but active work can lose connectivity and may need reconnection. Mend does not stop workspace containers."
 );
-var startInstallation = async (runtime, installation) => {
+var startInstallation = async (runtime, installation, secrets) => {
   startingNotice(runtime, installation.config.serverVersion);
   await composeCommand(runtime, installation, [
     "up",
@@ -3312,6 +3427,7 @@ var startInstallation = async (runtime, installation) => {
     "never",
     "--no-build"
   ]);
+  await initGarage(runtime, installation, secrets);
   await probeHealth(runtime, installation.config.appUrl, installation.config.serverVersion);
   runtime.writeLine(
     `Mend ${installation.config.serverVersion} is reachable at ${installation.config.appUrl}`
@@ -3349,11 +3465,17 @@ var upgradeServer = async (args, runtime, store, existing) => {
   const previous = storeValue(store.readActive());
   if (previous === null) throw setupError("The active server generation is missing.");
   const assets = await resolveAssets(runtime, version, existing, store, options);
-  const { registryPort: _legacyRegistryPort, ...carried } = existing.config;
+  const {
+    registryPort: _legacyRegistryPort,
+    bucket: _previousBucket,
+    ...carried
+  } = existing.config;
+  const bucket = composeBucket(assets.compose);
   const config = {
     ...carried,
     assetContract: ASSET_CONTRACT,
-    serverVersion: version
+    serverVersion: version,
+    ...bucket === void 0 ? {} : { bucket }
   };
   const secrets = parseSecrets(previous.files.identity);
   const files = {
@@ -3371,6 +3493,14 @@ var upgradeServer = async (args, runtime, store, existing) => {
   const target = storeValue(store.prepare(files));
   const installation = { directory: target.directory, config };
   await checkComposeImages(runtime, installation);
+  if (config.bucket === "garage" && existing.config.bucket !== "garage") {
+    const ownership2 = await claimServerDockerVolumes(runtime, {
+      dockerContext: config.dockerContext,
+      identityBytes: Buffer.from(previous.files.identity),
+      namespace: namespaceOf(config)
+    });
+    if (ownership2._tag === "error") throw setupError(ownership2.error.message);
+  }
   const running = await composeCommand(runtime, existing, [
     "ps",
     "--status",
@@ -3418,7 +3548,7 @@ var upgradeServer = async (args, runtime, store, existing) => {
       recovery = "Could not reselect the previous generation. Inspect active before retrying any command.";
     else if (appWasRunning) {
       try {
-        await startInstallation(runtime, existing);
+        await startInstallation(runtime, existing, secrets);
         recovery = "Previous pin and app recovered.";
       } catch {
         recovery = "Previous pin retained, but the old app could not recover. Run mend server start after fixing Docker.";
@@ -3430,7 +3560,7 @@ var upgradeServer = async (args, runtime, store, existing) => {
     );
   }
   try {
-    await startInstallation(runtime, installation);
+    await startInstallation(runtime, installation, secrets);
   } catch {
     throw setupError(
       `Mend ${version} startup, exact-version health or registry verification failed; migrations may have begun. The target pin remains active. Do NOT downgrade or restore the database automatically. Run mend server logs --tail 100 and mend server status; fix the target, then mend server start --offline. Previous generation: ${previous.directory}. Target generation: ${target.directory}. Database backup and recovery record: ${backup.directory}.`
@@ -3480,9 +3610,11 @@ var manageServer = async (command, args, runtime, store) => {
   if (identity === null) throw setupError("The persisted server identity is missing.");
   const ownership2 = await verifyServerDockerVolumes(runtime, {
     dockerContext: installation.config.dockerContext,
-    identityBytes: Buffer.from(identity)
+    identityBytes: Buffer.from(identity),
+    namespace: namespaceOf(installation.config)
   });
   if (ownership2._tag === "error") throw setupError(ownership2.error.message);
+  const secrets = parseSecrets(identity);
   if (command === "upgrade") return upgradeServer(args, runtime, store, installation);
   if (command === "logs") {
     let tail = 100;
@@ -3512,7 +3644,7 @@ var manageServer = async (command, args, runtime, store) => {
     interruptionNotice(runtime);
     await composeCommand(runtime, installation, ["stop", "--timeout", "30"]);
     runtime.writeLine(
-      "Mend and Postgres stopped. Volumes, configuration and workspace containers are retained."
+      `Mend, Postgres${installation.config.bucket === "garage" ? " and Garage" : ""} stopped. Volumes, configuration and workspace containers are retained.`
     );
     return;
   }
@@ -3521,7 +3653,7 @@ var manageServer = async (command, args, runtime, store) => {
     interruptionNotice(runtime);
     await composeCommand(runtime, installation, ["stop", "--timeout", "30", "mend"]);
   }
-  await startInstallation(runtime, installation);
+  await startInstallation(runtime, installation, secrets);
 };
 var nodeServerRuntime = () => {
   const environment = { ...process.env };
@@ -4503,7 +4635,7 @@ var planLines = (plan, configDir) => {
     );
     if (dockerContext !== "") {
       lines.push(
-        `         containers mend, postgres \xB7 volumes ${[MEND_DOCKER_NAMESPACE.store, MEND_DOCKER_NAMESPACE.control, "mend-config", "mend-ssh", "mend-postgres"].join(", ")} \xB7 image ghcr.io/sealant-sh/mend:${version}`
+        `         containers mend, postgres, garage \xB7 volumes ${[MEND_DOCKER_NAMESPACE_WITH_GARAGE.store, ...secondaryVolumesOf(MEND_DOCKER_NAMESPACE_WITH_GARAGE), "mend-config", "mend-ssh", "mend-postgres"].join(", ")} \xB7 image ghcr.io/sealant-sh/mend:${version}`
       );
     }
     lines.push(
@@ -4559,40 +4691,33 @@ var removeServer = async (runtime, failures, leftovers) => {
             `docker compose down failed: ${(down.error ?? down.stderr.trim()) || "no output"}. Containers and files are retained; fix Docker and run mend uninstall again.`
           );
         }
-        server.writeLine("removed containers mend, postgres and the Compose-owned volumes");
+        server.writeLine("removed containers mend, postgres, garage and the Compose-owned volumes");
+        const namespace = installation.config.bucket === "garage" ? MEND_DOCKER_NAMESPACE_WITH_GARAGE : MEND_DOCKER_NAMESPACE;
+        const dataVolumes = [namespace.store, ...secondaryVolumesOf(namespace)];
         const identity = store.readIdentity();
         if (identity._tag === "error") throw identity.error;
         const owned = identity.value === null ? null : await verifyServerDockerVolumes(server, {
           dockerContext: context,
-          identityBytes: Buffer.from(identity.value)
+          identityBytes: Buffer.from(identity.value),
+          namespace
         });
         if (owned !== null && owned._tag === "ok") {
           const removed = await server.run(
             "docker",
-            dockerArgs(
-              context,
-              "volume",
-              "rm",
-              MEND_DOCKER_NAMESPACE.store,
-              MEND_DOCKER_NAMESPACE.control
-            )
+            dockerArgs(context, "volume", "rm", ...dataVolumes)
           );
           if (removed.status === 0) {
-            server.writeLine(
-              `removed volumes ${MEND_DOCKER_NAMESPACE.store}, ${MEND_DOCKER_NAMESPACE.control}`
-            );
+            server.writeLine(`removed volumes ${dataVolumes.join(", ")}`);
           } else {
             failures.push(
-              `could not remove volumes ${MEND_DOCKER_NAMESPACE.store}, ${MEND_DOCKER_NAMESPACE.control}: ${(removed.error ?? removed.stderr.trim()) || "no output"}`
+              `could not remove volumes ${dataVolumes.join(", ")}: ${(removed.error ?? removed.stderr.trim()) || "no output"}`
             );
           }
         } else if (owned !== null && owned.error.reason === "missing") {
-          server.writeLine(
-            `volumes ${MEND_DOCKER_NAMESPACE.store}, ${MEND_DOCKER_NAMESPACE.control} were already gone`
-          );
+          server.writeLine(`volumes ${dataVolumes.join(", ")} were already gone`);
         } else {
           leftovers.push(
-            `volumes ${MEND_DOCKER_NAMESPACE.store}, ${MEND_DOCKER_NAMESPACE.control}: ownership could not be confirmed for this installation, so they stay (docker --context ${context} volume ls)`
+            `volumes ${dataVolumes.join(", ")}: ownership could not be confirmed for this installation, so they stay (docker --context ${context} volume ls)`
           );
         }
         const image = `ghcr.io/sealant-sh/mend:${installation.config.serverVersion}`;
@@ -7062,7 +7187,7 @@ var dashboard = async (config) => {
     );
     process.exit(rerun.status ?? 0);
   }
-  const { runDashboard } = await import("./dashboard-JIWYW3EM.js");
+  const { runDashboard } = await import("./dashboard-5CBGTPSJ.js");
   const agentShare = await startShareIfBridge(config);
   try {
     await runDashboard({

package/man/mend-accounts.1

@@ -1,4 +1,4 @@
-.TH MEND-ACCOUNTS 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-ACCOUNTS 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-accounts \- your connected accounts on the platform
 .SH SYNOPSIS

package/man/mend-adopt.1

@@ -1,4 +1,4 @@
-.TH MEND-ADOPT 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-ADOPT 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-adopt \- adopt a repository into the store
 .SH SYNOPSIS

package/man/mend-attach.1

@@ -1,4 +1,4 @@
-.TH MEND-ATTACH 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-ATTACH 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-attach \- reattach this terminal to a running session
 .SH SYNOPSIS

package/man/mend-codex.1

@@ -1,4 +1,4 @@
-.TH MEND-CODEX 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-CODEX 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-codex \- launch codex, claude, or opencode in a recorded worktree
 .SH SYNOPSIS

package/man/mend-completions.1

@@ -1,4 +1,4 @@
-.TH MEND-COMPLETIONS 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-COMPLETIONS 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-completions \- print the TAB\-completion hook
 .SH SYNOPSIS

package/man/mend-connect.1

@@ -1,4 +1,4 @@
-.TH MEND-CONNECT 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-CONNECT 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-connect \- send this machine's provider credential to the platform
 .SH SYNOPSIS

package/man/mend-continue.1

@@ -1,4 +1,4 @@
-.TH MEND-CONTINUE 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-CONTINUE 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-continue \- resume a session with its pending review follow\-up
 .SH SYNOPSIS

package/man/mend-doctor.1

@@ -1,4 +1,4 @@
-.TH MEND-DOCTOR 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-DOCTOR 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-doctor \- check this machine's setup
 .SH SYNOPSIS

package/man/mend-dotfiles-sync.1

@@ -1,4 +1,4 @@
-.TH MEND-DOTFILES-SYNC 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-DOTFILES-SYNC 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-dotfiles\-sync \- capture config files from this machine into your store
 .SH SYNOPSIS

package/man/mend-dotfiles.1

@@ -1,4 +1,4 @@
-.TH MEND-DOTFILES 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-DOTFILES 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-dotfiles \- your dotfiles on the server: repo and synced files
 .SH SYNOPSIS

package/man/mend-env-cluster.1

@@ -1,4 +1,4 @@
-.TH MEND-ENV-CLUSTER 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-ENV-CLUSTER 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-env\-cluster \- bind Kubernetes secrets and configmaps to the workspaces
 .SH SYNOPSIS

package/man/mend-env-load.1

@@ -1,4 +1,4 @@
-.TH MEND-ENV-LOAD 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-ENV-LOAD 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-env\-load \- load a .env into the project
 .SH SYNOPSIS

package/man/mend-env-show.1

@@ -1,4 +1,4 @@
-.TH MEND-ENV-SHOW 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-ENV-SHOW 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-env\-show \- what the project store holds: names only, never values
 .SH SYNOPSIS

package/man/mend-help.1

@@ -1,4 +1,4 @@
-.TH MEND-HELP 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-HELP 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-help \- this index, or one command's page
 .SH SYNOPSIS

package/man/mend-keys-init.1

@@ -1,4 +1,4 @@
-.TH MEND-KEYS-INIT 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-KEYS-INIT 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-keys\-init \- create your Mend key (ed25519) on the server
 .SH SYNOPSIS

package/man/mend-keys-mode.1

@@ -1,4 +1,4 @@
-.TH MEND-KEYS-MODE 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-KEYS-MODE 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-keys\-mode \- how your remotes are reached: mend\-key or bridge
 .SH SYNOPSIS

package/man/mend-keys-share.1

@@ -1,4 +1,4 @@
-.TH MEND-KEYS-SHARE 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-KEYS-SHARE 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-keys\-share \- relay this machine's ssh\-agent to the server
 .SH SYNOPSIS

package/man/mend-keys-show.1

@@ -1,4 +1,4 @@
-.TH MEND-KEYS-SHOW 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-KEYS-SHOW 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-keys\-show \- print your Mend public key
 .SH SYNOPSIS

package/man/mend-login.1

@@ -1,4 +1,4 @@
-.TH MEND-LOGIN 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-LOGIN 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-login \- sign this terminal in through the browser
 .SH SYNOPSIS

package/man/mend-logout.1

@@ -1,4 +1,4 @@
-.TH MEND-LOGOUT 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-LOGOUT 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-logout \- revoke this terminal's device token and forget it
 .SH SYNOPSIS

package/man/mend-man.1

@@ -1,4 +1,4 @@
-.TH MEND-MAN 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-MAN 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-man \- one command's page, or the whole manual, in man
 .SH SYNOPSIS

package/man/mend-pair.1

@@ -1,4 +1,4 @@
-.TH MEND-PAIR 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-PAIR 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-pair \- pair a phone or a second machine
 .SH SYNOPSIS

package/man/mend-projects.1

@@ -1,4 +1,4 @@
-.TH MEND-PROJECTS 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-PROJECTS 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-projects \- adopted projects and their live sessions
 .SH SYNOPSIS

package/man/mend-refresh.1

@@ -1,4 +1,4 @@
-.TH MEND-REFRESH 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-REFRESH 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-refresh \- fetch origin's branches into the store
 .SH SYNOPSIS

package/man/mend-rejoin.1

@@ -1,4 +1,4 @@
-.TH MEND-REJOIN 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-REJOIN 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-rejoin \- attach if live, otherwise resume
 .SH SYNOPSIS

package/man/mend-resume.1

@@ -1,4 +1,4 @@
-.TH MEND-RESUME 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-RESUME 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-resume \- rejoin a settled session with its state restored
 .SH SYNOPSIS

package/man/mend-run.1

@@ -1,4 +1,4 @@
-.TH MEND-RUN 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-RUN 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-run \- run any command as a session
 .SH SYNOPSIS

package/man/mend-server-logs.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVER-LOGS 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-SERVER-LOGS 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-server\-logs \- print a bounded tail of the installation's container logs
 .SH SYNOPSIS

package/man/mend-server-restart.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVER-RESTART 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-SERVER-RESTART 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-server\-restart \- restart Mend using the same generation and pin
 .SH SYNOPSIS
@@ -6,7 +6,7 @@ mend\-server\-restart \- restart Mend using the same generation and pin
 .br
 .SH DESCRIPTION
 .PP
-Checks preloaded images before stopping Mend, then starts the saved generation and verifies exact\-version health. Postgres stays running. Connections are interrupted; workspace containers and data remain, but active work may need reconnection.
+Checks preloaded images before stopping Mend, then starts the saved generation and verifies exact\-version health. Postgres and Garage stay running. Connections are interrupted; workspace containers and data remain, but active work may need reconnection.
 .SH OPTIONS
 .TP
 .B \-\-offline

package/man/mend-server-setup.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVER-SETUP 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-SERVER-SETUP 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-server\-setup \- install or repair the local Mend server
 .SH SYNOPSIS

package/man/mend-server-start.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVER-START 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-SERVER-START 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-server\-start \- start the selected server generation
 .SH SYNOPSIS

package/man/mend-server-status.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVER-STATUS 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-SERVER-STATUS 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-server\-status \- show the saved pin, generation and container state
 .SH SYNOPSIS

package/man/mend-server-stop.1

@@ -1,6 +1,6 @@
-.TH MEND-SERVER-STOP 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-SERVER-STOP 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
-mend\-server\-stop \- stop Mend and Postgres without deleting data
+mend\-server\-stop \- stop Mend, Postgres and Garage without deleting data
 .SH SYNOPSIS
 .B mend server stop
 .br

package/man/mend-server-upgrade.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVER-UPGRADE 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-SERVER-UPGRADE 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-server\-upgrade \- upgrade to an explicit version with a database backup
 .SH SYNOPSIS

package/man/mend-server.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVER 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-SERVER 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-server \- install and manage this machine's Mend server
 .SH SYNOPSIS

package/man/mend-service-add.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVICE-ADD 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-SERVICE-ADD 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-service\-add \- adopt a port something in the workspace already listens on
 .SH SYNOPSIS

package/man/mend-service-connect.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVICE-CONNECT 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-SERVICE-CONNECT 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-service\-connect \- bring live Services to this machine's loopback
 .SH SYNOPSIS

package/man/mend-service-init.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVICE-INIT 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-SERVICE-INIT 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-service\-init \- scaffold mend.toml from package.json and compose ports
 .SH SYNOPSIS

package/man/mend-service-list.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVICE-LIST 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-SERVICE-LIST 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-service\-list \- every live service and its observed state
 .SH SYNOPSIS

package/man/mend-service-logs.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVICE-LOGS 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-SERVICE-LOGS 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-service\-logs \- follow a supervised service's output
 .SH SYNOPSIS

package/man/mend-service-restart.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVICE-RESTART 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-SERVICE-RESTART 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-service\-restart \- re\-run a service's recorded command, same URL
 .SH SYNOPSIS

package/man/mend-service-run.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVICE-RUN 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-SERVICE-RUN 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-service\-run \- start and supervise a server in the session's workspace
 .SH SYNOPSIS

package/man/mend-service-stop.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVICE-STOP 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-SERVICE-STOP 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-service\-stop \- stop a service and close its host port
 .SH SYNOPSIS

package/man/mend-sessions.1

@@ -1,4 +1,4 @@
-.TH MEND-SESSIONS 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-SESSIONS 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-sessions \- sessions with their review facts
 .SH SYNOPSIS

package/man/mend-shell.1

@@ -1,4 +1,4 @@
-.TH MEND-SHELL 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-SHELL 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-shell \- open a shell in a live session's workspace
 .SH SYNOPSIS

package/man/mend-skills-push.1

@@ -1,4 +1,4 @@
-.TH MEND-SKILLS-PUSH 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-SKILLS-PUSH 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-skills\-push \- upload ~/.agents/skills into the library
 .SH SYNOPSIS

package/man/mend-skills.1

@@ -1,4 +1,4 @@
-.TH MEND-SKILLS 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-SKILLS 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-skills \- your skill library on the server, or a project's
 .SH SYNOPSIS

package/man/mend-ssh-setup.1

@@ -1,4 +1,4 @@
-.TH MEND-SSH-SETUP 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-SSH-SETUP 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-ssh\-setup \- make this machine ready to ssh into workspaces, once
 .SH SYNOPSIS

package/man/mend-ssh.1

@@ -1,4 +1,4 @@
-.TH MEND-SSH 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-SSH 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-ssh \- workspace SSH status: gateway, registered keys, ssh config
 .SH SYNOPSIS

package/man/mend-stop.1

@@ -1,4 +1,4 @@
-.TH MEND-STOP 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-STOP 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-stop \- stop the agent; the record and the review remain
 .SH SYNOPSIS

package/man/mend-ui.1

@@ -1,4 +1,4 @@
-.TH MEND-UI 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-UI 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-ui \- the dashboard: every project and session, live
 .SH SYNOPSIS

package/man/mend-uninstall.1

@@ -1,4 +1,4 @@
-.TH MEND-UNINSTALL 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-UNINSTALL 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-uninstall \- remove the server, this machine's Mend files, or both
 .SH SYNOPSIS

package/man/mend-version.1

@@ -1,4 +1,4 @@
-.TH MEND-VERSION 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-VERSION 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-version \- this CLI's version, and the server's when it answers
 .SH SYNOPSIS

package/man/mend-worktrees.1

@@ -1,4 +1,4 @@
-.TH MEND-WORKTREES 1 "" "mend 0.26.0" "mend manual"
+.TH MEND-WORKTREES 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend\-worktrees \- every worktree and the sessions inside it
 .SH SYNOPSIS

package/man/mend.1

@@ -1,4 +1,4 @@
-.TH MEND 1 "" "mend 0.26.0" "mend manual"
+.TH MEND 1 "" "mend 0.27.2" "mend manual"
 .SH NAME
 mend \- the agent workbench
 .SH SYNOPSIS
@@ -137,7 +137,7 @@ show the saved pin, generation and container state
 start the selected server generation
 .TP
 .B mend server stop
-stop Mend and Postgres without deleting data
+stop Mend, Postgres and Garage without deleting data
 .TP
 .B mend server restart
 restart Mend using the same generation and pin

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/mend",
-  "version": "0.26.0",
+  "version": "0.27.2",
   "description": "The mend CLI: adopt a repository into Mend's store, launch your coding agent in a recorded session worktree, detach and reattach from any terminal",
   "keywords": [
     "claude-code",
@@ -48,8 +48,8 @@
     "typescript": "^5.7.2",
     "vitest": "^3.0.5",
     "@mend/domain": "0.0.0",
-    "@mend/typescript": "0.0.0",
-    "@mend/workspace-ssh": "0.0.0"
+    "@mend/workspace-ssh": "0.0.0",
+    "@mend/typescript": "0.0.0"
   },
   "engines": {
     "node": ">=22"