@semiont/cli 0.3.1 → 0.3.3

package/dist/cli.mjs

@@ -512,8 +512,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path46, errorMaps, issueData } = params;
-      const fullPath = [...path46, ...issueData.path || []];
+      const { data, path: path47, errorMaps, issueData } = params;
+      const fullPath = [...path47, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -821,11 +821,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path46, key) {
+      constructor(parent, value, path47, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path46;
+        this._path = path47;
         this._key = key;
       }
       get path() {
@@ -4398,6 +4398,7 @@ var init_cli_paths = __esm({
 import { execFileSync } from "child_process";
 import * as fs from "fs";
 import * as net from "net";
+import * as path2 from "path";
 function checkContainerRuntime(runtime) {
   try {
     execFileSync(runtime, ["--version"], { stdio: "ignore", timeout: 5e3 });
@@ -4406,12 +4407,32 @@ function checkContainerRuntime(runtime) {
     return { name: "container-runtime", pass: false, message: `${runtime} is not installed or not in PATH` };
   }
 }
+function findPortOwner(port) {
+  const { execFileSync: execFileSync45 } = __require("child_process");
+  try {
+    if (process.platform === "darwin" || process.platform === "linux") {
+      const out = execFileSync45("lsof", ["-ti", `:${port}`], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] });
+      const pids = out.trim().split("\n").filter(Boolean);
+      if (pids.length > 0) return `PID ${pids.join(", ")}`;
+    }
+  } catch {
+  }
+  try {
+    const out = execFileSync45("fuser", [`${port}/tcp`], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] });
+    const pids = out.trim().split(/\s+/).filter(Boolean);
+    if (pids.length > 0) return `PID ${pids.join(", ")}`;
+  } catch {
+  }
+  return null;
+}
 async function checkPortFree(port) {
   return new Promise((resolve9) => {
     const server = net.createServer();
     server.once("error", (err) => {
       if (err.code === "EADDRINUSE") {
-        resolve9({ name: `port-${port}`, pass: false, message: `Port ${port} is in use` });
+        const owner = findPortOwner(port);
+        const hint = owner ? ` (${owner})` : "";
+        resolve9({ name: `port-${port}`, pass: false, message: `Port ${port} is in use${hint}` });
       } else {
         resolve9({ name: `port-${port}`, pass: false, message: `Cannot check port ${port}: ${err.message}` });
       }
@@ -4526,6 +4547,60 @@ function checkConfigNonEmptyArray(arr, fieldPath) {
   }
   return { name: `config-${fieldPath}`, pass: true, message: `${fieldPath} has ${arr.length} entries` };
 }
+function readEnvKey(filePath, key) {
+  if (!fs.existsSync(filePath)) return void 0;
+  const content = fs.readFileSync(filePath, "utf-8");
+  for (const line of content.split("\n")) {
+    if (line.startsWith("#") || !line.includes("=")) continue;
+    const [k, ...rest] = line.split("=");
+    if (k.trim() === key) return rest.join("=").trim();
+  }
+  return void 0;
+}
+function resolveSharedSecret(projectRoot, thisEnvFile, thisKey, peerEnvFile, peerKey, generate2, forceGenerate = false) {
+  const peerFile = path2.join(projectRoot, peerEnvFile);
+  const peerSecret = readEnvKey(peerFile, peerKey);
+  const thisFile = path2.join(projectRoot, thisEnvFile);
+  const thisSecret = readEnvKey(thisFile, thisKey);
+  if (forceGenerate) {
+    const secret = generate2();
+    const peerWillBeOutOfSync = !!peerSecret && peerSecret !== secret;
+    return { secret, message: `Generated new ${thisKey} (--rotate-secret)`, peerWillBeOutOfSync };
+  }
+  if (!peerSecret) {
+    const secret = generate2();
+    return { secret, message: `Generated new ${thisKey}`, peerWillBeOutOfSync: false };
+  }
+  if (!thisSecret) {
+    return { secret: peerSecret, message: `Copied ${peerKey} from ${peerEnvFile} to ${thisKey}`, peerWillBeOutOfSync: false };
+  }
+  if (thisSecret !== peerSecret) {
+    return { secret: peerSecret, message: `${thisKey} was out of sync with ${peerEnvFile} \u2014 updated to match`, peerWillBeOutOfSync: false };
+  }
+  return { secret: thisSecret, message: `${thisKey} is already in sync with ${peerEnvFile}`, peerWillBeOutOfSync: false };
+}
+function checkSecretsInSync(projectRoot) {
+  const backendEnv = fs.existsSync(projectRoot + "/backend/.env") ? projectRoot + "/backend/.env" : null;
+  const frontendEnv = fs.existsSync(projectRoot + "/frontend/.env.local") ? projectRoot + "/frontend/.env.local" : null;
+  if (!backendEnv) {
+    return { name: "secrets-in-sync", pass: false, message: "backend/.env not found \u2014 run: semiont provision --service backend" };
+  }
+  if (!frontendEnv) {
+    return { name: "secrets-in-sync", pass: false, message: "frontend/.env.local not found \u2014 run: semiont provision --service frontend" };
+  }
+  const jwtSecret = readEnvKey(backendEnv, "JWT_SECRET");
+  const nextAuthSecret = readEnvKey(frontendEnv, "NEXTAUTH_SECRET");
+  if (!jwtSecret) {
+    return { name: "secrets-in-sync", pass: false, message: "JWT_SECRET missing from backend/.env" };
+  }
+  if (!nextAuthSecret) {
+    return { name: "secrets-in-sync", pass: false, message: "NEXTAUTH_SECRET missing from frontend/.env.local" };
+  }
+  if (jwtSecret !== nextAuthSecret) {
+    return { name: "secrets-in-sync", pass: false, message: "JWT_SECRET (backend) and NEXTAUTH_SECRET (frontend) do not match \u2014 re-provision both services" };
+  }
+  return { name: "secrets-in-sync", pass: true, message: "JWT_SECRET and NEXTAUTH_SECRET are in sync" };
+}
 function passingPreflight() {
   return { pass: true, checks: [] };
 }
@@ -4981,7 +5056,7 @@ var init_service_command_capabilities = __esm({
 // src/services/backend-service.ts
 import { execFileSync as execFileSync2 } from "child_process";
 import { getNodeEnvForEnvironment } from "@semiont/core";
-import * as path3 from "path";
+import * as path4 from "path";
 import * as fs3 from "fs";
 var BackendService;
 var init_backend_service = __esm({
@@ -5028,7 +5103,7 @@ var init_backend_service = __esm({
           },
           build: buildConfig || {
             dockerfile: "Dockerfile.backend",
-            buildContext: path3.join(this.projectRoot, "apps/backend"),
+            buildContext: path4.join(this.projectRoot, "apps/backend"),
             buildArgs: {
               NODE_ENV: this.environment,
               VERSION: process.env.VERSION || "latest"
@@ -5140,7 +5215,7 @@ var init_backend_service = __esm({
         }
       }
       async collectProcessLogs() {
-        const logPath = path3.join(this.typedConfig.projectRoot || this.projectRoot, "backend", "logs", "app.log");
+        const logPath = path4.join(this.typedConfig.projectRoot || this.projectRoot, "backend", "logs", "app.log");
         const recent = [];
         const errorLogs = [];
         try {
@@ -5352,7 +5427,7 @@ var init_frontend_service = __esm({
 // src/services/database-service.ts
 import { execFileSync as execFileSync4 } from "child_process";
 import * as fs5 from "fs";
-import * as path4 from "path";
+import * as path5 from "path";
 var DatabaseService;
 var init_database_service = __esm({
   "src/services/database-service.ts"() {
@@ -5521,14 +5596,14 @@ var init_database_service = __esm({
         const possibleLogPaths = [
           "/var/log/postgresql/",
           "/usr/local/var/log/",
-          path4.join(this.projectRoot, "data/logs")
+          path5.join(this.projectRoot, "data/logs")
         ];
         for (const logPath of possibleLogPaths) {
           if (fs5.existsSync(logPath)) {
             try {
               const logFiles = fs5.readdirSync(logPath).filter((f) => f.endsWith(".log"));
               if (logFiles.length === 0) continue;
-              const latestLogFile = path4.join(logPath, logFiles[logFiles.length - 1]);
+              const latestLogFile = path5.join(logPath, logFiles[logFiles.length - 1]);
               const logs = execFileSync4("tail", ["-50", latestLogFile], { encoding: "utf-8" }).split("\n").filter((line) => line.trim());
               return {
                 recent: logs.slice(-10),
@@ -5562,7 +5637,7 @@ var init_database_service = __esm({
 });
 
 // src/services/filesystem-service.ts
-import * as path5 from "path";
+import * as path6 from "path";
 var FilesystemService;
 var init_filesystem_service = __esm({
   "src/services/filesystem-service.ts"() {
@@ -5649,7 +5724,7 @@ var init_filesystem_service = __esm({
       // Helper methods
       // =====================================================================
       getDataPath() {
-        return this.typedConfig.path || path5.join(this.projectRoot, "data");
+        return this.typedConfig.path || path6.join(this.projectRoot, "data");
       }
     };
   }
@@ -5855,7 +5930,7 @@ var init_service_cli_behaviors = __esm({
 });
 
 // src/services/mcp-service.ts
-import * as path6 from "path";
+import * as path7 from "path";
 import * as fs6 from "fs";
 var MCPService;
 var init_mcp_service = __esm({
@@ -5930,16 +6005,16 @@ var init_mcp_service = __esm({
       }
       findMCPServer() {
         const cliPath = new URL(import.meta.url).pathname;
-        const cliDir = path6.dirname(cliPath);
+        const cliDir = path7.dirname(cliPath);
         const possiblePaths = [
           // Look for bundled MCP server in CLI dist directory
-          path6.join(cliDir, "mcp-server", "index.js"),
-          path6.join(cliDir, "..", "mcp-server", "index.js"),
+          path7.join(cliDir, "mcp-server", "index.js"),
+          path7.join(cliDir, "..", "mcp-server", "index.js"),
           // Development paths (when running from source)
-          path6.join(this.typedConfig.projectRoot || process.cwd(), "packages/mcp-server/dist/index.js"),
-          path6.join(this.typedConfig.projectRoot || process.cwd(), "apps/mcp-server/dist/index.js"),
+          path7.join(this.typedConfig.projectRoot || process.cwd(), "packages/mcp-server/dist/index.js"),
+          path7.join(this.typedConfig.projectRoot || process.cwd(), "apps/mcp-server/dist/index.js"),
           // Fallback to current directory
-          path6.join(process.cwd(), "mcp-server/index.js"),
+          path7.join(process.cwd(), "mcp-server/index.js"),
           "mcp-server"
           // Global install
         ];
@@ -6349,26 +6424,26 @@ __export(state_manager_exports, {
   StateManager: () => StateManager
 });
 import * as fs7 from "fs";
-import * as path7 from "path";
+import * as path8 from "path";
 var StateManager;
 var init_state_manager = __esm({
   "src/core/state-manager.ts"() {
     "use strict";
     StateManager = class {
       static getStateDir(projectRoot) {
-        return path7.join(projectRoot, "state");
+        return path8.join(projectRoot, "state");
       }
       static getStateFile(projectRoot, environment, service) {
         const stateDir = this.getStateDir(projectRoot);
-        const envDir = path7.join(stateDir, environment);
-        return path7.join(envDir, `${service}.json`);
+        const envDir = path8.join(stateDir, environment);
+        return path8.join(envDir, `${service}.json`);
       }
       /**
        * Save service state after successful start
        */
       static async save(projectRoot, environment, service, state) {
         const stateFile = this.getStateFile(projectRoot, environment, service);
-        const stateDir = path7.dirname(stateFile);
+        const stateDir = path8.dirname(stateFile);
         await fs7.promises.mkdir(stateDir, { recursive: true });
         await fs7.promises.writeFile(
           stateFile,
@@ -6402,14 +6477,14 @@ var init_state_manager = __esm({
        * List all services with saved state for an environment
        */
       static async list(projectRoot, environment) {
-        const envDir = path7.join(this.getStateDir(projectRoot), environment);
+        const envDir = path8.join(this.getStateDir(projectRoot), environment);
         try {
           const files = await fs7.promises.readdir(envDir);
           const states = [];
           for (const file of files) {
             if (file.endsWith(".json")) {
               const content = await fs7.promises.readFile(
-                path7.join(envDir, file),
+                path8.join(envDir, file),
                 "utf-8"
               );
               try {
@@ -6427,7 +6502,7 @@ var init_state_manager = __esm({
        * Clear all state for an environment
        */
       static async clearEnvironment(projectRoot, environment) {
-        const envDir = path7.join(this.getStateDir(projectRoot), environment);
+        const envDir = path8.join(this.getStateDir(projectRoot), environment);
         try {
           await fs7.promises.rm(envDir, { recursive: true, force: true });
         } catch {
@@ -6495,17 +6570,17 @@ var init_network_utils = __esm({
 });
 
 // src/platforms/posix/handlers/database-paths.ts
-import * as path8 from "path";
+import * as path9 from "path";
 function getDatabasePaths(context) {
   const projectRoot = context.service.projectRoot;
-  const runtimeDir = path8.join(projectRoot, "database");
-  const dataDir = path8.join(runtimeDir, "data", context.service.name);
+  const runtimeDir = path9.join(projectRoot, "database");
+  const dataDir = path9.join(runtimeDir, "data", context.service.name);
   return {
     runtimeDir,
-    pidFile: path8.join(runtimeDir, "database.pid"),
-    logsDir: path8.join(runtimeDir, "logs"),
-    appLogFile: path8.join(runtimeDir, "logs", "app.log"),
-    errorLogFile: path8.join(runtimeDir, "logs", "error.log"),
+    pidFile: path9.join(runtimeDir, "database.pid"),
+    logsDir: path9.join(runtimeDir, "logs"),
+    appLogFile: path9.join(runtimeDir, "logs", "app.log"),
+    errorLogFile: path9.join(runtimeDir, "logs", "error.log"),
     dataDir
   };
 }
@@ -6629,7 +6704,7 @@ var init_database_check = __esm({
 });
 
 // src/platforms/posix/handlers/filesystem-paths.ts
-import * as path9 from "path";
+import * as path10 from "path";
 function getFilesystemPaths(context) {
   const service = context.service;
   const config = service.config;
@@ -6637,13 +6712,13 @@ function getFilesystemPaths(context) {
   if (!basePath) {
     throw new Error("Filesystem path not configured");
   }
-  const baseDir = path9.isAbsolute(basePath) ? basePath : path9.join(service.projectRoot, basePath);
+  const baseDir = path10.isAbsolute(basePath) ? basePath : path10.join(service.projectRoot, basePath);
   return {
     baseDir,
-    uploadsDir: path9.join(baseDir, "uploads"),
-    tempDir: path9.join(baseDir, "temp"),
-    cacheDir: path9.join(baseDir, "cache"),
-    logsDir: path9.join(baseDir, "logs")
+    uploadsDir: path10.join(baseDir, "uploads"),
+    tempDir: path10.join(baseDir, "temp"),
+    cacheDir: path10.join(baseDir, "cache"),
+    logsDir: path10.join(baseDir, "logs")
   };
 }
 var init_filesystem_paths = __esm({
@@ -6767,22 +6842,22 @@ var init_filesystem_check = __esm({
 });
 
 // src/platforms/posix/handlers/mcp-paths.ts
-import * as path10 from "path";
+import * as path11 from "path";
 import * as os from "os";
 function getMCPPaths(context) {
   const service = context.service;
-  const configDir = path10.join(
+  const configDir = path11.join(
     os.homedir(),
     ".config",
     "semiont"
   );
-  const authFile = path10.join(
+  const authFile = path11.join(
     configDir,
     `mcp-auth-${service.environment}.json`
   );
   return {
     configDir,
-    pidFile: path10.join(configDir, "mcp.pid"),
+    pidFile: path11.join(configDir, "mcp.pid"),
     authFile
   };
 }
@@ -7011,23 +7086,23 @@ var init_graph_check = __esm({
 });
 
 // src/platforms/posix/handlers/backend-paths.ts
-import * as path11 from "path";
+import * as path12 from "path";
 import { createRequire } from "module";
 function resolveBackendNpmPackage(projectRoot) {
   try {
-    const require2 = createRequire(path11.join(projectRoot, "node_modules", ".package.json"));
+    const require2 = createRequire(path12.join(projectRoot, "node_modules", ".package.json"));
     const pkgPath = require2.resolve("@semiont/backend/package.json");
-    return path11.dirname(pkgPath);
+    return path12.dirname(pkgPath);
   } catch {
     return null;
   }
 }
 function getBackendPaths(context) {
   const projectRoot = context.service.projectRoot;
-  const runtimeDir = path11.join(projectRoot, "backend");
+  const runtimeDir = path12.join(projectRoot, "backend");
   const semiontRepo = context.options?.semiontRepo;
   if (semiontRepo) {
-    const sourceDir = path11.join(semiontRepo, "apps", "backend");
+    const sourceDir = path12.join(semiontRepo, "apps", "backend");
     return buildPaths(sourceDir, runtimeDir, false);
   }
   const npmDir = resolveBackendNpmPackage(projectRoot);
@@ -7042,13 +7117,13 @@ function buildPaths(sourceDir, runtimeDir, fromNpmPackage) {
   return {
     sourceDir,
     runtimeDir,
-    pidFile: path11.join(runtimeDir, "backend.pid"),
-    envFile: path11.join(runtimeDir, ".env"),
-    logsDir: path11.join(runtimeDir, "logs"),
-    appLogFile: path11.join(runtimeDir, "logs", "app.log"),
-    errorLogFile: path11.join(runtimeDir, "logs", "error.log"),
-    tmpDir: path11.join(runtimeDir, "tmp"),
-    distDir: path11.join(sourceDir, "dist"),
+    pidFile: path12.join(runtimeDir, "backend.pid"),
+    envFile: path12.join(runtimeDir, ".env"),
+    logsDir: path12.join(runtimeDir, "logs"),
+    appLogFile: path12.join(runtimeDir, "logs", "app.log"),
+    errorLogFile: path12.join(runtimeDir, "logs", "error.log"),
+    tmpDir: path12.join(runtimeDir, "tmp"),
+    distDir: path12.join(sourceDir, "dist"),
     fromNpmPackage
   };
 }
@@ -7218,23 +7293,23 @@ var init_backend_check = __esm({
 });
 
 // src/platforms/posix/handlers/frontend-paths.ts
-import * as path12 from "path";
+import * as path13 from "path";
 import { createRequire as createRequire2 } from "module";
 function resolveFrontendNpmPackage(projectRoot) {
   try {
-    const require2 = createRequire2(path12.join(projectRoot, "node_modules", ".package.json"));
+    const require2 = createRequire2(path13.join(projectRoot, "node_modules", ".package.json"));
     const pkgPath = require2.resolve("@semiont/frontend/package.json");
-    return path12.dirname(pkgPath);
+    return path13.dirname(pkgPath);
   } catch {
     return null;
   }
 }
 function getFrontendPaths(context) {
   const projectRoot = context.service.projectRoot;
-  const runtimeDir = path12.join(projectRoot, "frontend");
+  const runtimeDir = path13.join(projectRoot, "frontend");
   const semiontRepo = context.options?.semiontRepo;
   if (semiontRepo) {
-    const sourceDir = path12.join(semiontRepo, "apps", "frontend");
+    const sourceDir = path13.join(semiontRepo, "apps", "frontend");
     return buildPaths2(sourceDir, runtimeDir, false);
   }
   const npmDir = resolveFrontendNpmPackage(projectRoot);
@@ -7249,13 +7324,13 @@ function buildPaths2(sourceDir, runtimeDir, fromNpmPackage) {
   return {
     sourceDir,
     runtimeDir,
-    pidFile: path12.join(runtimeDir, "frontend.pid"),
-    envLocalFile: path12.join(runtimeDir, ".env.local"),
-    logsDir: path12.join(runtimeDir, "logs"),
-    appLogFile: path12.join(runtimeDir, "logs", "app.log"),
-    errorLogFile: path12.join(runtimeDir, "logs", "error.log"),
-    tmpDir: path12.join(runtimeDir, "tmp"),
-    nextDir: path12.join(sourceDir, ".next"),
+    pidFile: path13.join(runtimeDir, "frontend.pid"),
+    envLocalFile: path13.join(runtimeDir, ".env.local"),
+    logsDir: path13.join(runtimeDir, "logs"),
+    appLogFile: path13.join(runtimeDir, "logs", "app.log"),
+    errorLogFile: path13.join(runtimeDir, "logs", "error.log"),
+    tmpDir: path13.join(runtimeDir, "tmp"),
+    nextDir: path13.join(sourceDir, ".next"),
     fromNpmPackage
   };
 }
@@ -7438,17 +7513,17 @@ var init_frontend_check = __esm({
 });
 
 // src/platforms/posix/handlers/proxy-paths.ts
-import * as path13 from "path";
+import * as path14 from "path";
 function getProxyPaths(context) {
   const projectRoot = context.service.projectRoot;
-  const runtimeDir = path13.join(projectRoot, "proxy");
+  const runtimeDir = path14.join(projectRoot, "proxy");
   return {
     runtimeDir,
-    pidFile: path13.join(runtimeDir, "proxy.pid"),
-    configFile: path13.join(runtimeDir, "envoy.yaml"),
-    logsDir: path13.join(runtimeDir, "logs"),
-    appLogFile: path13.join(runtimeDir, "logs", "proxy.log"),
-    accessLogFile: path13.join(runtimeDir, "logs", "access.log")
+    pidFile: path14.join(runtimeDir, "proxy.pid"),
+    configFile: path14.join(runtimeDir, "envoy.yaml"),
+    logsDir: path14.join(runtimeDir, "logs"),
+    appLogFile: path14.join(runtimeDir, "logs", "proxy.log"),
+    accessLogFile: path14.join(runtimeDir, "logs", "access.log")
   };
 }
 var init_proxy_paths = __esm({
@@ -7940,7 +8015,7 @@ var init_mcp_start = __esm({
 });
 
 // src/platforms/posix/handlers/graph-paths.ts
-import * as path14 from "path";
+import * as path15 from "path";
 function getGraphPaths(context) {
   const service = context.service;
   const serviceConfig = service.config;
@@ -7952,17 +8027,17 @@ function getGraphPaths(context) {
   if (!dataDir) {
     throw new Error("JANUSGRAPH_DATA_DIR not configured");
   }
-  const janusgraphDir = path14.join(dataDir, `janusgraph-${janusgraphVersion}`);
+  const janusgraphDir = path15.join(dataDir, `janusgraph-${janusgraphVersion}`);
   return {
     dataDir,
-    pidFile: path14.join(dataDir, "graph.pid"),
+    pidFile: path15.join(dataDir, "graph.pid"),
     janusgraphDir,
-    janusgraphZipPath: path14.join(dataDir, `janusgraph-${janusgraphVersion}.zip`),
-    configPath: path14.join(janusgraphDir, "conf", "gremlin-server", "custom-server.yaml"),
-    graphConfigPath: path14.join(janusgraphDir, "conf", "custom-graph.properties"),
-    gremlinServerScript: path14.join(janusgraphDir, "bin", "gremlin-server.sh"),
-    gremlinShellScript: path14.join(janusgraphDir, "bin", "gremlin.sh"),
-    dataStorageDir: path14.join(dataDir, "data")
+    janusgraphZipPath: path15.join(dataDir, `janusgraph-${janusgraphVersion}.zip`),
+    configPath: path15.join(janusgraphDir, "conf", "gremlin-server", "custom-server.yaml"),
+    graphConfigPath: path15.join(janusgraphDir, "conf", "custom-graph.properties"),
+    gremlinServerScript: path15.join(janusgraphDir, "bin", "gremlin-server.sh"),
+    gremlinShellScript: path15.join(janusgraphDir, "bin", "gremlin.sh"),
+    dataStorageDir: path15.join(dataDir, "data")
   };
 }
 var init_graph_paths = __esm({
@@ -8081,9 +8156,9 @@ async function startJanusGraph(context) {
     }
   };
 }
-async function fileExists(path46) {
+async function fileExists(path47) {
   try {
-    await fs17.access(path46);
+    await fs17.access(path47);
     return true;
   } catch {
     return false;
@@ -8130,7 +8205,7 @@ var init_graph_start = __esm({
 // src/platforms/posix/handlers/backend-start.ts
 import { spawn as spawn4 } from "child_process";
 import * as fs18 from "fs";
-import * as path15 from "path";
+import * as path16 from "path";
 var startBackendService, preflightBackendStart, backendStartDescriptor;
 var init_backend_start = __esm({
   "src/platforms/posix/handlers/backend-start.ts"() {
@@ -8208,8 +8283,8 @@ var init_backend_start = __esm({
         TMP_DIR: tmpDir
       };
       fs18.mkdirSync(logsDir, { recursive: true });
-      const appLogPath = path15.join(logsDir, "app.log");
-      const errorLogPath = path15.join(logsDir, "error.log");
+      const appLogPath = path16.join(logsDir, "app.log");
+      const errorLogPath = path16.join(logsDir, "error.log");
       const appLogStream = fs18.createWriteStream(appLogPath, { flags: "a" });
       const errorLogStream = fs18.createWriteStream(errorLogPath, { flags: "a" });
       const startupMessage = `
@@ -8227,7 +8302,7 @@ var init_backend_start = __esm({
       let args;
       if (paths.fromNpmPackage) {
         command = "node";
-        args = [path15.join(backendSourceDir, "dist", "index.js")];
+        args = [path16.join(backendSourceDir, "dist", "index.js")];
       } else if (config.devMode) {
         command = "npm";
         args = ["run", "dev"];
@@ -8334,6 +8409,7 @@ var init_backend_start = __esm({
       if (config.port) {
         checks.push(await checkPortFree(config.port));
       }
+      checks.push(checkSecretsInSync(context.service.projectRoot));
       return preflightFromChecks(checks);
     };
     backendStartDescriptor = {
@@ -8349,7 +8425,7 @@ var init_backend_start = __esm({
 // src/platforms/posix/handlers/frontend-start.ts
 import { spawn as spawn5 } from "child_process";
 import * as fs19 from "fs";
-import * as path16 from "path";
+import * as path17 from "path";
 var startFrontendService, preflightFrontendStart, frontendStartDescriptor;
 var init_frontend_start = __esm({
   "src/platforms/posix/handlers/frontend-start.ts"() {
@@ -8426,8 +8502,8 @@ var init_frontend_start = __esm({
         nextPublicVars.forEach((k) => printInfo(`  ${k}=${env[k]}`));
       }
       fs19.mkdirSync(logsDir, { recursive: true });
-      const appLogPath = path16.join(logsDir, "app.log");
-      const errorLogPath = path16.join(logsDir, "error.log");
+      const appLogPath = path17.join(logsDir, "app.log");
+      const errorLogPath = path17.join(logsDir, "error.log");
       const appLogStream = fs19.createWriteStream(appLogPath, { flags: "a" });
       const errorLogStream = fs19.createWriteStream(errorLogPath, { flags: "a" });
       const startupMessage = `
@@ -8445,7 +8521,7 @@ var init_frontend_start = __esm({
       let args;
       if (paths.fromNpmPackage) {
         command = "node";
-        args = [path16.join(frontendSourceDir, "standalone", "apps", "frontend", "server.js")];
+        args = [path17.join(frontendSourceDir, "standalone", "apps", "frontend", "server.js")];
       } else if (config.devMode) {
         command = "npm";
         args = ["run", "dev"];
@@ -8552,6 +8628,7 @@ var init_frontend_start = __esm({
       if (config.port) {
         checks.push(await checkPortFree(config.port));
       }
+      checks.push(checkSecretsInSync(context.service.projectRoot));
       return preflightFromChecks(checks);
     };
     frontendStartDescriptor = {
@@ -8874,7 +8951,7 @@ var init_mcp_provision = __esm({
 
 // src/platforms/posix/handlers/filesystem-provision.ts
 import * as fs22 from "fs";
-import * as path17 from "path";
+import * as path18 from "path";
 var provisionFilesystemService, preflightFilesystemProvision, filesystemProvisionDescriptor;
 var init_filesystem_provision = __esm({
   "src/platforms/posix/handlers/filesystem-provision.ts"() {
@@ -8906,7 +8983,7 @@ var init_filesystem_provision = __esm({
         }
         const standardDirs = ["uploads", "temp", "cache", "logs"];
         for (const dir of standardDirs) {
-          const dirPath = path17.join(absolutePath, dir);
+          const dirPath = path18.join(absolutePath, dir);
           fs22.mkdirSync(dirPath, { recursive: true });
           metadata.directories.push(dirPath);
         }
@@ -8928,7 +9005,7 @@ var init_filesystem_provision = __esm({
           }
         } catch {
         }
-        const readmePath = path17.join(absolutePath, "README.md");
+        const readmePath = path18.join(absolutePath, "README.md");
         if (!fs22.existsSync(readmePath)) {
           const readmeContent = `# Semiont Filesystem Storage
 
@@ -8999,7 +9076,7 @@ Files placed here will persist across service restarts.
     };
     preflightFilesystemProvision = async (context) => {
       const paths = getFilesystemPaths(context);
-      const parentDir = path17.dirname(paths.baseDir);
+      const parentDir = path18.dirname(paths.baseDir);
       return preflightFromChecks([
         checkDirectoryWritable(parentDir)
       ]);
@@ -9017,9 +9094,9 @@ Files placed here will persist across service restarts.
 // src/platforms/posix/handlers/graph-provision.ts
 import * as fs23 from "fs/promises";
 import { execFileSync as execFileSync9 } from "child_process";
-async function fileExists2(path46) {
+async function fileExists2(path47) {
   try {
-    await fs23.access(path46);
+    await fs23.access(path47);
     return true;
   } catch {
     return false;
@@ -9202,7 +9279,7 @@ ssl: {
 
 // src/platforms/posix/handlers/backend-provision.ts
 import * as fs24 from "fs";
-import * as path18 from "path";
+import * as path19 from "path";
 import * as crypto from "crypto";
 import { execFileSync as execFileSync10 } from "child_process";
 import { getNodeEnvForEnvironment as getNodeEnvForEnvironment2 } from "@semiont/core";
@@ -9271,7 +9348,7 @@ var init_backend_provision = __esm({
         const backupPath = `${envFile}.backup.${Date.now()}`;
         fs24.copyFileSync(envFile, backupPath);
         if (!service.quiet) {
-          printWarning(`.env already exists, backing up to: ${path18.basename(backupPath)}`);
+          printWarning(`.env already exists, backing up to: ${path19.basename(backupPath)}`);
           printInfo("Creating new .env with updated configuration...");
         }
       }
@@ -9283,7 +9360,19 @@ var init_backend_provision = __esm({
       const allowedDomains = oauthAllowedDomains.join(",");
       const nodeEnv = getNodeEnvForEnvironment2(service.environmentConfig);
       const enableLocalAuth = service.environmentConfig.app?.security?.enableLocalAuth ?? nodeEnv === "development";
-      const jwtSecret = service.environmentConfig.app?.security?.jwtSecret ?? crypto.randomBytes(32).toString("base64");
+      const { secret: jwtSecret, message: jwtSecretMessage, peerWillBeOutOfSync: jwtPeerOutOfSync } = resolveSharedSecret(
+        projectRoot,
+        "backend/.env",
+        "JWT_SECRET",
+        "frontend/.env.local",
+        "NEXTAUTH_SECRET",
+        () => service.environmentConfig.app?.security?.jwtSecret ?? crypto.randomBytes(32).toString("base64"),
+        options.rotateSecret === true
+      );
+      printInfo(jwtSecretMessage);
+      if (jwtPeerOutOfSync) {
+        printWarning("frontend NEXTAUTH_SECRET is now out of sync \u2014 re-provision frontend to restore authentication");
+      }
       const envUpdates = {
         "NODE_ENV": nodeEnv,
         "PORT": port.toString(),
@@ -9308,14 +9397,14 @@ var init_backend_provision = __esm({
       if (!service.quiet) {
         printSuccess("Created .env with configuration from environment file");
       }
-      const prismaSchemaPath = path18.join(backendSourceDir, "prisma", "schema.prisma");
+      const prismaSchemaPath = path19.join(backendSourceDir, "prisma", "schema.prisma");
       if (!paths.fromNpmPackage) {
-        const staleEnv = path18.join(backendSourceDir, ".env");
+        const staleEnv = path19.join(backendSourceDir, ".env");
         if (fs24.existsSync(staleEnv)) {
           const backupPath = `${staleEnv}.backup.${Date.now()}`;
           fs24.renameSync(staleEnv, backupPath);
           if (!service.quiet) {
-            printWarning(`Moved stale ${staleEnv} to ${path18.basename(backupPath)}`);
+            printWarning(`Moved stale ${staleEnv} to ${path19.basename(backupPath)}`);
             printInfo(`Runtime .env is now at: ${envFile}`);
           }
         }
@@ -9349,8 +9438,8 @@ var init_backend_provision = __esm({
           if (!semiontRepo) {
             throw new Error("SEMIONT_REPO not configured");
           }
-          const monorepoRoot = path18.resolve(semiontRepo);
-          const rootPackageJsonPath = path18.join(monorepoRoot, "package.json");
+          const monorepoRoot = path19.resolve(semiontRepo);
+          const rootPackageJsonPath = path19.join(monorepoRoot, "package.json");
           if (fs24.existsSync(rootPackageJsonPath)) {
             const rootPackageJson = JSON.parse(fs24.readFileSync(rootPackageJsonPath, "utf-8"));
             if (rootPackageJson.workspaces) {
@@ -9401,8 +9490,8 @@ var init_backend_provision = __esm({
           printInfo("Building workspace dependencies...");
         }
         try {
-          const monorepoRoot = path18.dirname(path18.dirname(backendSourceDir));
-          const rootPackageJsonPath = path18.join(monorepoRoot, "package.json");
+          const monorepoRoot = path19.dirname(path19.dirname(backendSourceDir));
+          const rootPackageJsonPath = path19.join(monorepoRoot, "package.json");
           if (fs24.existsSync(rootPackageJsonPath)) {
             const rootPackageJson = JSON.parse(fs24.readFileSync(rootPackageJsonPath, "utf-8"));
             if (rootPackageJson.workspaces) {
@@ -9475,7 +9564,7 @@ var init_backend_provision = __esm({
           printInfo("You may need to run migrations manually: npx prisma migrate deploy");
         }
       }
-      const readmePath = path18.join(runtimeDir, "RUNTIME.md");
+      const readmePath = path19.join(runtimeDir, "RUNTIME.md");
       if (!fs24.existsSync(readmePath)) {
         const readmeContent = `# Backend Runtime Directory
 
@@ -9542,11 +9631,11 @@ ${paths.fromNpmPackage ? `Installed npm package: ${backendSourceDir}` : `Semiont
       const db = envConfig.services?.database;
       const paths = getBackendPaths(context);
       const checks = paths.fromNpmPackage ? [
-        checkFileExists(path18.join(paths.sourceDir, "dist", "index.js"), "backend dist/index.js")
+        checkFileExists(path19.join(paths.sourceDir, "dist", "index.js"), "backend dist/index.js")
       ] : [
         checkCommandAvailable("npm"),
         checkCommandAvailable("npx"),
-        checkFileExists(path18.join(paths.sourceDir, "package.json"), "backend package.json")
+        checkFileExists(path19.join(paths.sourceDir, "package.json"), "backend package.json")
       ];
       checks.push(
         checkConfigPort(config.port, "backend.port"),
@@ -9573,7 +9662,7 @@ ${paths.fromNpmPackage ? `Installed npm package: ${backendSourceDir}` : `Semiont
 
 // src/platforms/posix/handlers/frontend-provision.ts
 import * as fs25 from "fs";
-import * as path19 from "path";
+import * as path20 from "path";
 import * as crypto2 from "crypto";
 import { execFileSync as execFileSync11 } from "child_process";
 var provisionFrontendService, preflightFrontendProvision, frontendProvisionDescriptor;
@@ -9584,7 +9673,7 @@ var init_frontend_provision = __esm({
     init_frontend_paths();
     init_preflight_utils();
     provisionFrontendService = async (context) => {
-      const { service } = context;
+      const { service, options } = context;
       const projectRoot = service.projectRoot;
       if (!context.options?.semiontRepo && !resolveFrontendNpmPackage(projectRoot)) {
         if (!service.quiet) {
@@ -9623,16 +9712,28 @@ var init_frontend_provision = __esm({
       if (!service.quiet) {
         printInfo(`Created runtime directories in: ${runtimeDir}`);
       }
-      const envExamplePath = path19.join(frontendSourceDir, ".env.example");
+      const envExamplePath = path20.join(frontendSourceDir, ".env.example");
       if (fs25.existsSync(envFile)) {
         const backupPath = `${envFile}.backup.${Date.now()}`;
         fs25.copyFileSync(envFile, backupPath);
         if (!service.quiet) {
-          printWarning(`.env.local already exists, backing up to: ${path19.basename(backupPath)}`);
+          printWarning(`.env.local already exists, backing up to: ${path20.basename(backupPath)}`);
           printInfo("Creating new .env.local with updated configuration...");
         }
       }
-      const nextAuthSecret = crypto2.randomBytes(32).toString("base64");
+      const { secret: nextAuthSecret, message: nextAuthSecretMessage, peerWillBeOutOfSync: nextAuthPeerOutOfSync } = resolveSharedSecret(
+        projectRoot,
+        "frontend/.env.local",
+        "NEXTAUTH_SECRET",
+        "backend/.env",
+        "JWT_SECRET",
+        () => crypto2.randomBytes(32).toString("base64"),
+        options.rotateSecret === true
+      );
+      printInfo(nextAuthSecretMessage);
+      if (nextAuthPeerOutOfSync) {
+        printWarning("backend JWT_SECRET is now out of sync \u2014 re-provision backend to restore authentication");
+      }
       const config = service.config;
       const port = config.port;
       const siteName = config.siteName;
@@ -9707,12 +9808,12 @@ NEXT_PUBLIC_OAUTH_ALLOWED_DOMAINS=${oauthAllowedDomains.join(",")}
         }
       }
       if (!paths.fromNpmPackage) {
-        const staleEnvLocal = path19.join(frontendSourceDir, ".env.local");
+        const staleEnvLocal = path20.join(frontendSourceDir, ".env.local");
         if (fs25.existsSync(staleEnvLocal)) {
           const backupPath = `${staleEnvLocal}.backup.${Date.now()}`;
           fs25.renameSync(staleEnvLocal, backupPath);
           if (!service.quiet) {
-            printWarning(`Moved stale ${staleEnvLocal} to ${path19.basename(backupPath)}`);
+            printWarning(`Moved stale ${staleEnvLocal} to ${path20.basename(backupPath)}`);
             printInfo(`Runtime .env.local is now at: ${envFile}`);
           }
         }
@@ -9726,8 +9827,8 @@ NEXT_PUBLIC_OAUTH_ALLOWED_DOMAINS=${oauthAllowedDomains.join(",")}
           printInfo("Installing npm dependencies...");
         }
         try {
-          const monorepoRoot = path19.dirname(path19.dirname(frontendSourceDir));
-          const rootPackageJsonPath = path19.join(monorepoRoot, "package.json");
+          const monorepoRoot = path20.dirname(path20.dirname(frontendSourceDir));
+          const rootPackageJsonPath = path20.join(monorepoRoot, "package.json");
           if (fs25.existsSync(rootPackageJsonPath)) {
             const rootPackageJson = JSON.parse(fs25.readFileSync(rootPackageJsonPath, "utf-8"));
             if (rootPackageJson.workspaces) {
@@ -9762,8 +9863,8 @@ NEXT_PUBLIC_OAUTH_ALLOWED_DOMAINS=${oauthAllowedDomains.join(",")}
           printInfo("Building workspace dependencies...");
         }
         try {
-          const monorepoRoot = path19.dirname(path19.dirname(frontendSourceDir));
-          const rootPackageJsonPath = path19.join(monorepoRoot, "package.json");
+          const monorepoRoot = path20.dirname(path20.dirname(frontendSourceDir));
+          const rootPackageJsonPath = path20.join(monorepoRoot, "package.json");
           if (fs25.existsSync(rootPackageJsonPath)) {
             const rootPackageJson = JSON.parse(fs25.readFileSync(rootPackageJsonPath, "utf-8"));
             if (rootPackageJson.workspaces) {
@@ -9809,7 +9910,7 @@ NEXT_PUBLIC_OAUTH_ALLOWED_DOMAINS=${oauthAllowedDomains.join(",")}
           }
         }
       }
-      const readmePath = path19.join(runtimeDir, "RUNTIME.md");
+      const readmePath = path20.join(runtimeDir, "RUNTIME.md");
       if (!fs25.existsSync(readmePath)) {
         const readmeContent = `# Frontend Runtime Directory
 
@@ -9875,10 +9976,10 @@ ${paths.fromNpmPackage ? `Installed npm package: ${frontendSourceDir}` : `Semion
       const envConfig = context.service.environmentConfig;
       const paths = getFrontendPaths(context);
       const checks = paths.fromNpmPackage ? [
-        checkFileExists(path19.join(paths.sourceDir, "standalone", "apps", "frontend", "server.js"), "frontend standalone server.js")
+        checkFileExists(path20.join(paths.sourceDir, "standalone", "apps", "frontend", "server.js"), "frontend standalone server.js")
       ] : [
         checkCommandAvailable("npm"),
-        checkFileExists(path19.join(paths.sourceDir, "package.json"), "frontend package.json")
+        checkFileExists(path20.join(paths.sourceDir, "package.json"), "frontend package.json")
       ];
       checks.push(
         checkConfigPort(config.port, "frontend.port"),
@@ -9900,7 +10001,7 @@ ${paths.fromNpmPackage ? `Installed npm package: ${frontendSourceDir}` : `Semion
 
 // src/platforms/posix/handlers/proxy-provision.ts
 import * as fs26 from "fs";
-import * as path20 from "path";
+import * as path21 from "path";
 function processProxyConfig(templatePath, outputPath, replacements) {
   let content = fs26.readFileSync(templatePath, "utf-8");
   for (const [key, value] of Object.entries(replacements)) {
@@ -9934,7 +10035,7 @@ var init_proxy_provision = __esm({
       const backendPort = config.backendPort || 4e3;
       const frontendPort = config.frontendPort || 3e3;
       if (config.type === "envoy") {
-        const templatePath = path20.join(getTemplatesDir(import.meta.url), "envoy.yaml");
+        const templatePath = path21.join(getTemplatesDir(import.meta.url), "envoy.yaml");
         if (!fs26.existsSync(templatePath)) {
           return {
             success: false,
@@ -10006,7 +10107,7 @@ var init_proxy_provision = __esm({
 });
 
 // src/platforms/posix/handlers/backend-publish.ts
-import * as path21 from "path";
+import * as path22 from "path";
 import { execFileSync as execFileSync12 } from "child_process";
 var publishBackendService, backendPublishDescriptor;
 var init_backend_publish = __esm({
@@ -10056,7 +10157,7 @@ var init_backend_publish = __esm({
           success: true,
           metadata: { serviceType: "backend", devMode: false },
           artifacts: {
-            buildPath: path21.join(sourceDir, "dist")
+            buildPath: path22.join(sourceDir, "dist")
           }
         };
       } catch (error) {
@@ -10078,7 +10179,7 @@ var init_backend_publish = __esm({
 });
 
 // src/platforms/posix/handlers/frontend-publish.ts
-import * as path22 from "path";
+import * as path23 from "path";
 import { execFileSync as execFileSync13 } from "child_process";
 var publishFrontendService, frontendPublishDescriptor;
 var init_frontend_publish = __esm({
@@ -10128,7 +10229,7 @@ var init_frontend_publish = __esm({
           success: true,
           metadata: { serviceType: "frontend", devMode: false },
           artifacts: {
-            buildPath: path22.join(sourceDir, ".next")
+            buildPath: path23.join(sourceDir, ".next")
           }
         };
       } catch (error) {
@@ -10268,9 +10369,9 @@ async function stopJanusGraph(context) {
     };
   }
 }
-async function fileExists3(path46) {
+async function fileExists3(path47) {
   try {
-    await fs27.access(path46);
+    await fs27.access(path47);
     return true;
   } catch {
     return false;
@@ -10311,7 +10412,7 @@ var init_graph_stop = __esm({
 
 // src/platforms/posix/handlers/filesystem-stop.ts
 import * as fs28 from "fs";
-import * as path23 from "path";
+import * as path24 from "path";
 import { execFileSync as execFileSync14 } from "child_process";
 var stopFilesystemService, filesystemStopDescriptor;
 var init_filesystem_stop = __esm({
@@ -10383,7 +10484,7 @@ var init_filesystem_stop = __esm({
             }
             const tempFiles = fs28.readdirSync(tempDir);
             for (const file of tempFiles) {
-              const filePath = path23.join(tempDir, file);
+              const filePath = path24.join(tempDir, file);
               try {
                 if (fs28.statSync(filePath).isDirectory()) {
                   fs28.rmSync(filePath, { recursive: true, force: true });
@@ -10402,7 +10503,7 @@ var init_filesystem_stop = __esm({
             }
             const cacheFiles = fs28.readdirSync(cacheDir);
             for (const file of cacheFiles) {
-              const filePath = path23.join(cacheDir, file);
+              const filePath = path24.join(cacheDir, file);
               try {
                 if (fs28.statSync(filePath).isDirectory()) {
                   fs28.rmSync(filePath, { recursive: true, force: true });
@@ -11073,16 +11174,16 @@ var init_inference_check = __esm({
 });
 
 // src/platforms/posix/handlers/inference-paths.ts
-import * as path24 from "path";
+import * as path25 from "path";
 function getInferencePaths(context) {
   const projectRoot = context.service.projectRoot;
-  const runtimeDir = path24.join(projectRoot, "inference");
+  const runtimeDir = path25.join(projectRoot, "inference");
   return {
     runtimeDir,
-    pidFile: path24.join(runtimeDir, "ollama.pid"),
-    logsDir: path24.join(runtimeDir, "logs"),
-    appLogFile: path24.join(runtimeDir, "logs", "ollama.log"),
-    errorLogFile: path24.join(runtimeDir, "logs", "ollama-error.log")
+    pidFile: path25.join(runtimeDir, "ollama.pid"),
+    logsDir: path25.join(runtimeDir, "logs"),
+    appLogFile: path25.join(runtimeDir, "logs", "ollama.log"),
+    errorLogFile: path25.join(runtimeDir, "logs", "ollama-error.log")
   };
 }
 var init_inference_paths = __esm({
@@ -11506,7 +11607,7 @@ var init_handlers = __esm({
 // src/platforms/posix/platform.ts
 import { execFileSync as execFileSync17 } from "child_process";
 import * as fs35 from "fs";
-import * as path25 from "path";
+import * as path26 from "path";
 var PosixPlatform;
 var init_platform2 = __esm({
   "src/platforms/posix/platform.ts"() {
@@ -11642,19 +11743,19 @@ var init_platform2 = __esm({
           }
           if (logs.length === 0) {
             const logPaths = [
-              path25.join("/var/log", service.name, "*.log"),
-              path25.join(service.projectRoot, "logs", "*.log"),
-              path25.join(service.projectRoot, ".logs", "*.log")
+              path26.join("/var/log", service.name, "*.log"),
+              path26.join(service.projectRoot, "logs", "*.log"),
+              path26.join(service.projectRoot, ".logs", "*.log")
             ];
             for (const pattern of logPaths) {
-              const dir = path25.dirname(pattern);
-              const filePattern = path25.basename(pattern);
+              const dir = path26.dirname(pattern);
+              const filePattern = path26.basename(pattern);
               if (fs35.existsSync(dir)) {
                 const files = fs35.readdirSync(dir).filter(
                   (f) => f.match(filePattern.replace("*", ".*"))
                 );
                 for (const file of files) {
-                  const fullPath = path25.join(dir, file);
+                  const fullPath = path26.join(dir, file);
                   const content = this.tailFile(fullPath, tail);
                   if (content) {
                     const lines = content.split("\n");
@@ -11688,17 +11789,17 @@ var init_platform2 = __esm({
           "/var/log/postgresql/*.log",
           "/var/log/mysql/*.log",
           "/var/log/mongodb/*.log",
-          path25.join(service.projectRoot, "data", "logs", "*.log")
+          path26.join(service.projectRoot, "data", "logs", "*.log")
         ];
         for (const pattern of logPaths) {
-          const dir = path25.dirname(pattern);
-          const filePattern = path25.basename(pattern);
+          const dir = path26.dirname(pattern);
+          const filePattern = path26.basename(pattern);
           if (fs35.existsSync(dir)) {
             const files = fs35.readdirSync(dir).filter(
               (f) => f.match(filePattern.replace("*", ".*"))
             );
             for (const file of files.slice(-1)) {
-              const fullPath = path25.join(dir, file);
+              const fullPath = path26.join(dir, file);
               const content = this.tailFile(fullPath, tail);
               if (content) {
                 const lines = content.split("\n");
@@ -12672,11 +12773,11 @@ var init_database_start2 = __esm({
 
 // src/platforms/container/handlers/graph-start.ts
 import * as fs36 from "fs/promises";
-import * as path26 from "path";
+import * as path27 from "path";
 import { execFileSync as execFileSync23 } from "child_process";
 async function startJanusGraph2(context) {
   const { service, runtime, containerName } = context;
-  const composePath = path26.join(service.projectRoot, "docker-compose.janusgraph.yml");
+  const composePath = path27.join(service.projectRoot, "docker-compose.janusgraph.yml");
   if (!await fileExists4(composePath)) {
     return {
       success: false,
@@ -12801,9 +12902,9 @@ async function startJanusGraph2(context) {
     };
   }
 }
-async function fileExists4(path46) {
+async function fileExists4(path47) {
   try {
-    await fs36.access(path46);
+    await fs36.access(path47);
     return true;
   } catch {
     return false;
@@ -12853,7 +12954,7 @@ var init_graph_start2 = __esm({
 // src/platforms/container/handlers/database-provision.ts
 import { execFileSync as execFileSync24 } from "child_process";
 import * as fs37 from "fs";
-import * as path27 from "path";
+import * as path28 from "path";
 var provisionDatabaseContainer, preflightDatabaseProvision, databaseProvisionDescriptor;
 var init_database_provision = __esm({
   "src/platforms/container/handlers/database-provision.ts"() {
@@ -12889,9 +12990,9 @@ var init_database_provision = __esm({
       } catch (error) {
         printWarning(`Failed to pull image ${image}, will try to use local`);
       }
-      const initScriptsPath = path27.join(service.projectRoot, "db", "init");
-      const migrationsPath = path27.join(service.projectRoot, "db", "migrations");
-      const seedDataPath = path27.join(service.projectRoot, "db", "seed");
+      const initScriptsPath = path28.join(service.projectRoot, "db", "init");
+      const migrationsPath = path28.join(service.projectRoot, "db", "migrations");
+      const seedDataPath = path28.join(service.projectRoot, "db", "seed");
       const hasInitScripts = fs37.existsSync(initScriptsPath);
       const hasMigrations = fs37.existsSync(migrationsPath);
       const hasSeedData = fs37.existsSync(seedDataPath);
@@ -15644,7 +15745,7 @@ var init_js_yaml = __esm({
 
 // src/platforms/container/handlers/graph-provision.ts
 import * as fs38 from "fs/promises";
-import * as path28 from "path";
+import * as path29 from "path";
 import { execFileSync as execFileSync25 } from "child_process";
 var provisionGraphService2, preflightGraphProvision2, graphProvisionDescriptor2;
 var init_graph_provision2 = __esm({
@@ -15786,7 +15887,7 @@ var init_graph_provision2 = __esm({
             ...withElasticsearch && { "elasticsearch-data": {} }
           }
         };
-        const composePath = path28.join(service.projectRoot, "docker-compose.janusgraph.yml");
+        const composePath = path29.join(service.projectRoot, "docker-compose.janusgraph.yml");
         await fs38.writeFile(
           composePath,
           `# Generated by semiont provision --service janusgraph
@@ -15855,12 +15956,12 @@ var init_graph_provision2 = __esm({
 });
 
 // src/platforms/container/handlers/graph-stop.ts
-import * as path29 from "path";
+import * as path30 from "path";
 import { execFileSync as execFileSync26 } from "child_process";
 import * as fs39 from "fs/promises";
 async function stopJanusGraph2(context) {
   const { service, runtime, options, containerName } = context;
-  const composePath = path29.join(service.projectRoot, "docker-compose.janusgraph.yml");
+  const composePath = path30.join(service.projectRoot, "docker-compose.janusgraph.yml");
   if (!await fileExists5(composePath)) {
     if (!service.quiet) {
       printWarning("JanusGraph is not provisioned.");
@@ -15956,9 +16057,9 @@ async function stopJanusGraph2(context) {
     };
   }
 }
-async function fileExists5(path46) {
+async function fileExists5(path47) {
   try {
-    await fs39.access(path46);
+    await fs39.access(path47);
     return true;
   } catch {
     return false;
@@ -16159,18 +16260,18 @@ var init_database_stop = __esm({
 });
 
 // src/platforms/container/handlers/proxy-paths.ts
-import * as path30 from "path";
+import * as path31 from "path";
 function getProxyPaths2(context) {
   const projectRoot = context.service.projectRoot;
-  const runtimeDir = path30.join(projectRoot, "proxy");
+  const runtimeDir = path31.join(projectRoot, "proxy");
   return {
     runtimeDir,
-    logsDir: path30.join(runtimeDir, "logs"),
-    pidFile: path30.join(runtimeDir, "proxy.pid"),
-    configFile: path30.join(runtimeDir, "envoy.yaml"),
-    containerLogFile: path30.join(runtimeDir, "logs", "container.log"),
-    accessLogFile: path30.join(runtimeDir, "logs", "access.log"),
-    adminLogFile: path30.join(runtimeDir, "logs", "admin.log")
+    logsDir: path31.join(runtimeDir, "logs"),
+    pidFile: path31.join(runtimeDir, "proxy.pid"),
+    configFile: path31.join(runtimeDir, "envoy.yaml"),
+    containerLogFile: path31.join(runtimeDir, "logs", "container.log"),
+    accessLogFile: path31.join(runtimeDir, "logs", "access.log"),
+    adminLogFile: path31.join(runtimeDir, "logs", "admin.log")
   };
 }
 var init_proxy_paths2 = __esm({
@@ -16181,7 +16282,7 @@ var init_proxy_paths2 = __esm({
 
 // src/platforms/container/handlers/proxy-provision.ts
 import * as fs40 from "fs";
-import * as path31 from "path";
+import * as path32 from "path";
 import { execFileSync as execFileSync28 } from "child_process";
 function getHostAddress(runtime) {
   const platform = process.platform;
@@ -16248,7 +16349,7 @@ var init_proxy_provision2 = __esm({
       const backendPort = config.backendPort || 4e3;
       const frontendPort = config.frontendPort || 3e3;
       if (config.type === "envoy") {
-        const templatePath = path31.join(getTemplatesDir(import.meta.url), "envoy.yaml");
+        const templatePath = path32.join(getTemplatesDir(import.meta.url), "envoy.yaml");
         if (!fs40.existsSync(templatePath)) {
           return {
             success: false,
@@ -16441,6 +16542,8 @@ var init_proxy_start2 = __esm({
         `${adminPort}:9901`,
         "-v",
         `${paths.runtimeDir}:/etc/envoy:ro`,
+        "--add-host=host.docker.internal:host-gateway",
+        // Ensure IPv4 resolution for upstream services
         "--restart",
         "unless-stopped",
         "--log-driver",
@@ -16653,7 +16756,10 @@ import { execFileSync as execFileSync31 } from "child_process";
 import * as fs42 from "fs";
 async function checkUrl(url, timeout = 5e3) {
   try {
-    execFileSync31("curl", ["-s", "-f", "-m", Math.floor(timeout / 1e3).toString(), "-o", "/dev/null", url], { stdio: "pipe" });
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeout);
+    await fetch(url, { signal: controller.signal, redirect: "follow" });
+    clearTimeout(timer);
     return true;
   } catch {
     return false;
@@ -16810,7 +16916,7 @@ var init_proxy_check2 = __esm({
         healthCheck.logs = getRecentLogs(runtime, containerName, 10);
         if (healthCheck.logs && !service.quiet && service.verbose) {
           printInfo("\nRecent container logs:");
-          console.log(healthCheck.logs);
+          printInfo(healthCheck.logs);
         }
       }
       const isHealthy = healthCheck.containerRunning && (config.type !== "envoy" || healthCheck.adminHealthy);
@@ -16859,8 +16965,7 @@ Proxy service ${service.name} is healthy`);
     };
     preflightProxyCheck2 = async (context) => {
       return preflightFromChecks([
-        checkContainerRuntime(context.runtime),
-        checkCommandAvailable("curl")
+        checkContainerRuntime(context.runtime)
       ]);
     };
     proxyCheckDescriptor2 = {
@@ -17440,11 +17545,11 @@ var init_platform3 = __esm({
        */
       detectContainerRuntime() {
         try {
-          execFileSync36("docker", ["version"], { stdio: "ignore" });
+          execFileSync36("docker", ["--version"], { stdio: "ignore" });
           return "docker";
         } catch {
           try {
-            execFileSync36("podman", ["version"], { stdio: "ignore" });
+            execFileSync36("podman", ["--version"], { stdio: "ignore" });
             return "podman";
           } catch {
             throw new Error("No container runtime (Docker or Podman) found");
@@ -18613,7 +18718,7 @@ var init_rds_start = __esm({
 
 // src/platforms/aws/handlers/stack-provision.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import * as path32 from "path";
+import * as path33 from "path";
 import * as fs43 from "fs";
 var provisionStackService, preflightStackProvision, stackProvisionDescriptor;
 var init_stack_provision = __esm({
@@ -18684,7 +18789,7 @@ var init_stack_provision = __esm({
           continue;
         }
         try {
-          const cdkContextPath = path32.join(projectRoot, "cdk.context.json");
+          const cdkContextPath = path33.join(projectRoot, "cdk.context.json");
           const cdkContext = fs43.existsSync(cdkContextPath) ? JSON.parse(fs43.readFileSync(cdkContextPath, "utf-8")) : {};
           cdkContext[`availability-zones:account=${awsConfig.accountId}:region=${awsConfig.region}`] = cdkContext[`availability-zones:account=${awsConfig.accountId}:region=${awsConfig.region}`] || [`${awsConfig.region}a`, `${awsConfig.region}b`];
           fs43.writeFileSync(cdkContextPath, JSON.stringify(cdkContext, null, 2));
@@ -18788,7 +18893,7 @@ var init_stack_provision = __esm({
 
 // src/platforms/aws/handlers/ecs-publish.ts
 import { execFileSync as execFileSync41, spawnSync as spawnSync3 } from "child_process";
-import * as path33 from "path";
+import * as path34 from "path";
 import * as fs44 from "fs";
 async function createNewTaskDefinition(service, imageUri, region, _accountId, cfnDiscoveredResources, resourceName) {
   if (!service || !imageUri) return "";
@@ -18945,7 +19050,7 @@ var init_ecs_publish = __esm({
         }
       }
       try {
-        const apiTypesPath = path33.join(buildContext, "packages", "api-types");
+        const apiTypesPath = path34.join(buildContext, "packages", "api-types");
         if (fs44.existsSync(apiTypesPath)) {
           execFileSync41("npm", ["run", "build"], {
             cwd: apiTypesPath,
@@ -18953,7 +19058,7 @@ var init_ecs_publish = __esm({
             stdio: service.verbose ? "inherit" : "pipe"
           });
         }
-        const appPath = path33.join(buildContext, "apps", service.name);
+        const appPath = path34.join(buildContext, "apps", service.name);
         if (fs44.existsSync(appPath)) {
           execFileSync41("npm", ["run", "build"], {
             cwd: appPath,
@@ -22001,17 +22106,17 @@ var init_headers = __esm({
 function encodeURIPath(str2) {
   return str2.replace(/[^A-Za-z0-9\-._~!$&'()*+,;=:@]+/g, encodeURIComponent);
 }
-var EMPTY, createPathTagFunction, path34;
+var EMPTY, createPathTagFunction, path35;
 var init_path = __esm({
   "node_modules/@anthropic-ai/sdk/internal/utils/path.mjs"() {
     init_error();
     EMPTY = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.create(null));
-    createPathTagFunction = (pathEncoder = encodeURIPath) => function path46(statics, ...params) {
+    createPathTagFunction = (pathEncoder = encodeURIPath) => function path47(statics, ...params) {
       if (statics.length === 1)
         return statics[0];
       let postPath = false;
       const invalidSegments = [];
-      const path47 = statics.reduce((previousValue, currentValue, index) => {
+      const path48 = statics.reduce((previousValue, currentValue, index) => {
         if (/[?#]/.test(currentValue)) {
           postPath = true;
         }
@@ -22028,7 +22133,7 @@ var init_path = __esm({
         }
         return previousValue + currentValue + (index === params.length ? "" : encoded);
       }, "");
-      const pathOnly = path47.split(/[?#]/, 1)[0];
+      const pathOnly = path48.split(/[?#]/, 1)[0];
       const invalidSegmentPattern = /(?<=^|\/)(?:\.|%2e){1,2}(?=\/|$)/gi;
       let match;
       while ((match = invalidSegmentPattern.exec(pathOnly)) !== null) {
@@ -22049,12 +22154,12 @@ var init_path = __esm({
         }, "");
         throw new AnthropicError(`Path parameters result in path with invalid segments:
 ${invalidSegments.map((e) => e.error).join("\n")}
-${path47}
+${path48}
 ${underline}`);
       }
-      return path47;
+      return path48;
     };
-    path34 = /* @__PURE__ */ createPathTagFunction(encodeURIPath);
+    path35 = /* @__PURE__ */ createPathTagFunction(encodeURIPath);
   }
 });
 
@@ -22102,7 +22207,7 @@ var init_files = __esm({
        */
       delete(fileID, params = {}, options) {
         const { betas } = params ?? {};
-        return this._client.delete(path34`/v1/files/${fileID}`, {
+        return this._client.delete(path35`/v1/files/${fileID}`, {
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "files-api-2025-04-14"].toString() },
@@ -22125,7 +22230,7 @@ var init_files = __esm({
        */
       download(fileID, params = {}, options) {
         const { betas } = params ?? {};
-        return this._client.get(path34`/v1/files/${fileID}/content`, {
+        return this._client.get(path35`/v1/files/${fileID}/content`, {
           ...options,
           headers: buildHeaders([
             {
@@ -22148,7 +22253,7 @@ var init_files = __esm({
        */
       retrieveMetadata(fileID, params = {}, options) {
         const { betas } = params ?? {};
-        return this._client.get(path34`/v1/files/${fileID}`, {
+        return this._client.get(path35`/v1/files/${fileID}`, {
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "files-api-2025-04-14"].toString() },
@@ -22205,7 +22310,7 @@ var init_models = __esm({
        */
       retrieve(modelID, params = {}, options) {
         const { betas } = params ?? {};
-        return this._client.get(path34`/v1/models/${modelID}?beta=true`, {
+        return this._client.get(path35`/v1/models/${modelID}?beta=true`, {
           ...options,
           headers: buildHeaders([
             { ...betas?.toString() != null ? { "anthropic-beta": betas?.toString() } : void 0 },
@@ -22358,7 +22463,7 @@ var init_batches = __esm({
        */
       retrieve(messageBatchID, params = {}, options) {
         const { betas } = params ?? {};
-        return this._client.get(path34`/v1/messages/batches/${messageBatchID}?beta=true`, {
+        return this._client.get(path35`/v1/messages/batches/${messageBatchID}?beta=true`, {
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "message-batches-2024-09-24"].toString() },
@@ -22411,7 +22516,7 @@ var init_batches = __esm({
        */
       delete(messageBatchID, params = {}, options) {
         const { betas } = params ?? {};
-        return this._client.delete(path34`/v1/messages/batches/${messageBatchID}?beta=true`, {
+        return this._client.delete(path35`/v1/messages/batches/${messageBatchID}?beta=true`, {
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "message-batches-2024-09-24"].toString() },
@@ -22443,7 +22548,7 @@ var init_batches = __esm({
        */
       cancel(messageBatchID, params = {}, options) {
         const { betas } = params ?? {};
-        return this._client.post(path34`/v1/messages/batches/${messageBatchID}/cancel?beta=true`, {
+        return this._client.post(path35`/v1/messages/batches/${messageBatchID}/cancel?beta=true`, {
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "message-batches-2024-09-24"].toString() },
@@ -24347,7 +24452,7 @@ var init_batches2 = __esm({
        * ```
        */
       retrieve(messageBatchID, options) {
-        return this._client.get(path34`/v1/messages/batches/${messageBatchID}`, options);
+        return this._client.get(path35`/v1/messages/batches/${messageBatchID}`, options);
       }
       /**
        * List all Message Batches within a Workspace. Most recently created batches are
@@ -24383,7 +24488,7 @@ var init_batches2 = __esm({
        * ```
        */
       delete(messageBatchID, options) {
-        return this._client.delete(path34`/v1/messages/batches/${messageBatchID}`, options);
+        return this._client.delete(path35`/v1/messages/batches/${messageBatchID}`, options);
       }
       /**
        * Batches may be canceled any time before processing ends. Once cancellation is
@@ -24407,7 +24512,7 @@ var init_batches2 = __esm({
        * ```
        */
       cancel(messageBatchID, options) {
-        return this._client.post(path34`/v1/messages/batches/${messageBatchID}/cancel`, options);
+        return this._client.post(path35`/v1/messages/batches/${messageBatchID}/cancel`, options);
       }
       /**
        * Streams the results of a Message Batch as a `.jsonl` file.
@@ -24534,7 +24639,7 @@ var init_models2 = __esm({
        */
       retrieve(modelID, params = {}, options) {
         const { betas } = params ?? {};
-        return this._client.get(path34`/v1/models/${modelID}`, {
+        return this._client.get(path35`/v1/models/${modelID}`, {
           ...options,
           headers: buildHeaders([
             { ...betas?.toString() != null ? { "anthropic-beta": betas?.toString() } : void 0 },
@@ -24735,9 +24840,9 @@ var init_client = __esm({
       makeStatusError(status, error, message, headers) {
         return APIError.generate(status, error, message, headers);
       }
-      buildURL(path46, query, defaultBaseURL) {
+      buildURL(path47, query, defaultBaseURL) {
         const baseURL = !__classPrivateFieldGet(this, _BaseAnthropic_instances, "m", _BaseAnthropic_baseURLOverridden).call(this) && defaultBaseURL || this.baseURL;
-        const url = isAbsoluteURL(path46) ? new URL(path46) : new URL(baseURL + (baseURL.endsWith("/") && path46.startsWith("/") ? path46.slice(1) : path46));
+        const url = isAbsoluteURL(path47) ? new URL(path47) : new URL(baseURL + (baseURL.endsWith("/") && path47.startsWith("/") ? path47.slice(1) : path47));
         const defaultQuery = this.defaultQuery();
         if (!isEmptyObj(defaultQuery)) {
           query = { ...defaultQuery, ...query };
@@ -24768,24 +24873,24 @@ var init_client = __esm({
        */
       async prepareRequest(request, { url, options }) {
       }
-      get(path46, opts) {
-        return this.methodRequest("get", path46, opts);
+      get(path47, opts) {
+        return this.methodRequest("get", path47, opts);
       }
-      post(path46, opts) {
-        return this.methodRequest("post", path46, opts);
+      post(path47, opts) {
+        return this.methodRequest("post", path47, opts);
       }
-      patch(path46, opts) {
-        return this.methodRequest("patch", path46, opts);
+      patch(path47, opts) {
+        return this.methodRequest("patch", path47, opts);
       }
-      put(path46, opts) {
-        return this.methodRequest("put", path46, opts);
+      put(path47, opts) {
+        return this.methodRequest("put", path47, opts);
       }
-      delete(path46, opts) {
-        return this.methodRequest("delete", path46, opts);
+      delete(path47, opts) {
+        return this.methodRequest("delete", path47, opts);
       }
-      methodRequest(method, path46, opts) {
+      methodRequest(method, path47, opts) {
         return this.request(Promise.resolve(opts).then((opts2) => {
-          return { method, path: path46, ...opts2 };
+          return { method, path: path47, ...opts2 };
         }));
       }
       request(options, remainingRetries = null) {
@@ -24889,8 +24994,8 @@ var init_client = __esm({
         }));
         return { response, options, controller, requestLogID, retryOfRequestLogID, startTime };
       }
-      getAPIList(path46, Page2, opts) {
-        return this.requestAPIList(Page2, { method: "get", path: path46, ...opts });
+      getAPIList(path47, Page2, opts) {
+        return this.requestAPIList(Page2, { method: "get", path: path47, ...opts });
       }
       requestAPIList(Page2, options) {
         const request = this.makeRequest(options, null, void 0);
@@ -24977,8 +25082,8 @@ var init_client = __esm({
       }
       async buildRequest(inputOptions, { retryCount = 0 } = {}) {
         const options = { ...inputOptions };
-        const { method, path: path46, query, defaultBaseURL } = options;
-        const url = this.buildURL(path46, query, defaultBaseURL);
+        const { method, path: path47, query, defaultBaseURL } = options;
+        const url = this.buildURL(path47, query, defaultBaseURL);
         if ("timeout" in options)
           validatePositiveInteger("timeout", options.timeout);
         options.timeout = options.timeout ?? this.timeout;
@@ -25730,7 +25835,7 @@ __export(config_loader_exports, {
   loadEnvironmentConfig: () => loadEnvironmentConfig
 });
 import * as fs45 from "fs";
-import * as path35 from "path";
+import * as path36 from "path";
 import { createConfigLoader, listEnvironmentNames, ConfigurationError } from "@semiont/core";
 function findProjectRoot() {
   const root = process.env.SEMIONT_ROOT;
@@ -25748,8 +25853,8 @@ function findProjectRoot() {
       "Check that SEMIONT_ROOT environment variable is set correctly"
     );
   }
-  const hasSemiontJson = fs45.existsSync(path35.join(root, "semiont.json"));
-  const hasEnvironments = fs45.existsSync(path35.join(root, "environments"));
+  const hasSemiontJson = fs45.existsSync(path36.join(root, "semiont.json"));
+  const hasEnvironments = fs45.existsSync(path36.join(root, "environments"));
   if (!hasSemiontJson && !hasEnvironments) {
     throw new ConfigurationError(
       `SEMIONT_ROOT does not point to a valid Semiont project: ${root}`,
@@ -25762,7 +25867,7 @@ function findProjectRoot() {
 function getAvailableEnvironments() {
   try {
     const projectRoot = findProjectRoot();
-    const configDir = path35.join(projectRoot, "environments");
+    const configDir = path36.join(projectRoot, "environments");
     if (!fs45.existsSync(configDir)) {
       return [];
     }
@@ -25781,11 +25886,11 @@ var init_config_loader = __esm({
     "use strict";
     nodeFileReader = {
       readIfExists: (filePath) => {
-        const absolutePath = path35.resolve(filePath);
+        const absolutePath = path36.resolve(filePath);
         return fs45.existsSync(absolutePath) ? fs45.readFileSync(absolutePath, "utf-8") : null;
       },
       readRequired: (filePath) => {
-        const absolutePath = path35.resolve(filePath);
+        const absolutePath = path36.resolve(filePath);
         if (!fs45.existsSync(absolutePath)) {
           throw new ConfigurationError(
             `Configuration file not found: ${absolutePath}`,
@@ -26945,7 +27050,7 @@ import express from "express";
 import { createServer as createServer4 } from "http";
 import { Server as SocketIOServer } from "socket.io";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { dirname as dirname11, join as join35 } from "path";
+import { dirname as dirname11, join as join36 } from "path";
 import fs46 from "fs";
 var __filename, __dirname, embeddedJS, embeddedCSS, WebDashboardServer;
 var init_web_dashboard_server = __esm({
@@ -26996,15 +27101,15 @@ var init_web_dashboard_server = __esm({
           });
         } else {
           const possibleDirs = [
-            join35(__dirname, "..", "..", "..", "dist", "dashboard"),
-            join35(__dirname, "dashboard"),
-            join35(__dirname, "..", "dashboard"),
-            join35(process.cwd(), "dist", "dashboard"),
-            join35(process.cwd(), "apps", "cli", "dist", "dashboard")
+            join36(__dirname, "..", "..", "..", "dist", "dashboard"),
+            join36(__dirname, "dashboard"),
+            join36(__dirname, "..", "dashboard"),
+            join36(process.cwd(), "dist", "dashboard"),
+            join36(process.cwd(), "apps", "cli", "dist", "dashboard")
           ];
           let distDir = null;
           for (const dir of possibleDirs) {
-            if (fs46.existsSync(join35(dir, "dashboard.js"))) {
+            if (fs46.existsSync(join36(dir, "dashboard.js"))) {
               distDir = dir;
               bundleExists = true;
               console.log(`Found dashboard bundle at: ${dir}`);
@@ -27405,7 +27510,7 @@ var require_package = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@semiont/cli",
-      version: "0.3.1",
+      version: "0.3.3",
       description: "Semiont CLI - Unified environment management tool",
       _comment: "AWS SDK dependencies (@aws-sdk/*) are only used by platforms/aws",
       type: "module",
@@ -27469,12 +27574,12 @@ var require_package = __commonJS({
         "@aws-sdk/client-secrets-manager": "^3.600.0",
         "@aws-sdk/client-sts": "^3.859.0",
         "@aws-sdk/client-wafv2": "^3.859.0",
-        "@semiont/api-client": "^0.3.1",
-        "@semiont/content": "^0.3.1",
-        "@semiont/core": "^0.3.1",
-        "@semiont/event-sourcing": "^0.3.1",
-        "@semiont/graph": "^0.3.1",
-        "@semiont/make-meaning": "^0.3.1",
+        "@semiont/api-client": "^0.3.3",
+        "@semiont/content": "^0.3.3",
+        "@semiont/core": "^0.3.3",
+        "@semiont/event-sourcing": "^0.3.3",
+        "@semiont/graph": "^0.3.3",
+        "@semiont/make-meaning": "^0.3.3",
         arg: "^5.0.2",
         argon2: "^0.43.0",
         express: "^4.18.2",
@@ -27515,7 +27620,7 @@ init_base_options_schema();
 init_cli_paths();
 init_preflight_utils();
 import * as fs2 from "fs";
-import * as path2 from "path";
+import * as path3 from "path";
 var InitOptionsSchema = BaseOptionsSchema.extend({
   name: external_exports.string().optional(),
   directory: external_exports.string().optional(),
@@ -27536,12 +27641,12 @@ function getTemplatesDir2() {
 }
 function copyTemplate(source, dest, replacements) {
   const templatesDir = getTemplatesDir2();
-  const sourcePath = path2.join(templatesDir, source);
+  const sourcePath = path3.join(templatesDir, source);
   if (fs2.statSync(sourcePath).isDirectory()) {
     fs2.mkdirSync(dest, { recursive: true });
     const files = fs2.readdirSync(sourcePath);
     for (const file of files) {
-      copyTemplate(path2.join(source, file), path2.join(dest, file), replacements);
+      copyTemplate(path3.join(source, file), path3.join(dest, file), replacements);
     }
   } else {
     let content = fs2.readFileSync(sourcePath, "utf8");
@@ -27550,14 +27655,14 @@ function copyTemplate(source, dest, replacements) {
         content = content.replace(new RegExp(key, "g"), value);
       }
     }
-    fs2.mkdirSync(path2.dirname(dest), { recursive: true });
+    fs2.mkdirSync(path3.dirname(dest), { recursive: true });
     fs2.writeFileSync(dest, content);
   }
 }
 async function init(options) {
   const startTime = Date.now();
   const projectDir = options.directory || process.cwd();
-  const projectName = options.name || path2.basename(projectDir);
+  const projectName = options.name || path3.basename(projectDir);
   let environments = options.environments;
   if (environments.length === 1 && environments[0].includes(",")) {
     environments = environments[0].split(",").map((env) => env.trim());
@@ -27581,7 +27686,7 @@ async function init(options) {
     }
   };
   try {
-    const configPath = path2.join(projectDir, "semiont.json");
+    const configPath = path3.join(projectDir, "semiont.json");
     if (fs2.existsSync(configPath) && !options.force) {
       throw new Error("semiont.json already exists. Use --force to overwrite.");
     }
@@ -27605,19 +27710,19 @@ async function init(options) {
         dryRun: true
       };
     } else {
-      copyTemplate("semiont.json", path2.join(projectDir, "semiont.json"), {
+      copyTemplate("semiont.json", path3.join(projectDir, "semiont.json"), {
         "my-semiont-project": projectName
       });
       if (!options.quiet) {
         console.log(`${colors.green}\u2705 Created semiont.json${colors.reset}`);
       }
-      const envDir = path2.join(projectDir, "environments");
+      const envDir = path3.join(projectDir, "environments");
       fs2.mkdirSync(envDir, { recursive: true });
       for (const envName of environments) {
         const templatesDir = getTemplatesDir2();
-        const templatePath = path2.join(templatesDir, "environments", `${envName}.json`);
+        const templatePath = path3.join(templatesDir, "environments", `${envName}.json`);
         if (fs2.existsSync(templatePath)) {
-          copyTemplate(`environments/${envName}.json`, path2.join(envDir, `${envName}.json`));
+          copyTemplate(`environments/${envName}.json`, path3.join(envDir, `${envName}.json`));
           if (!options.quiet) {
             console.log(`${colors.green}\u2705 Created environments/${envName}.json${colors.reset}`);
           }
@@ -27627,15 +27732,15 @@ async function init(options) {
           }
         }
       }
-      copyTemplate("cdk", path2.join(projectDir, "cdk"));
-      copyTemplate("package.json", path2.join(projectDir, "package.json"));
-      copyTemplate("tsconfig.json", path2.join(projectDir, "tsconfig.json"));
-      copyTemplate("cdk.json", path2.join(projectDir, "cdk.json"));
+      copyTemplate("cdk", path3.join(projectDir, "cdk"));
+      copyTemplate("package.json", path3.join(projectDir, "package.json"));
+      copyTemplate("tsconfig.json", path3.join(projectDir, "tsconfig.json"));
+      copyTemplate("cdk.json", path3.join(projectDir, "cdk.json"));
       if (!options.quiet) {
         console.log(`${colors.green}\u2705 Created CDK infrastructure files${colors.reset}`);
       }
       for (const envName of environments) {
-        const envFilePath = path2.join(envDir, `${envName}.json`);
+        const envFilePath = path3.join(envDir, `${envName}.json`);
         if (fs2.existsSync(envFilePath)) {
           try {
             const envContent = JSON.parse(fs2.readFileSync(envFilePath, "utf8"));
@@ -27754,6 +27859,7 @@ var startDescriptor = createCommandDescriptor({
         serviceType
       }
     }, {
+      status: handlerResult.success ? "running" : "unknown",
       startTime: startResult.startTime,
       endpoint: startResult.endpoint,
       resources: startResult.resources
@@ -27830,6 +27936,7 @@ var stopDescriptor = createCommandDescriptor({
         serviceType
       }
     }, {
+      status: handlerResult.success ? "stopped" : "unknown",
       stop: {
         stopTime: stopResult.stopTime,
         graceful: stopResult.graceful
@@ -27897,7 +28004,8 @@ var ProvisionOptionsSchema = BaseOptionsSchema.extend({
   skipValidation: external_exports.boolean().default(false),
   skipDependencies: external_exports.boolean().default(false),
   destroy: external_exports.boolean().default(false),
-  semiontRepo: external_exports.string().optional()
+  semiontRepo: external_exports.string().optional(),
+  rotateSecret: external_exports.boolean().default(false)
 });
 var provisionDescriptor = createCommandDescriptor({
   name: "provision",
@@ -27958,6 +28066,9 @@ var provisionDescriptor = createCommandDescriptor({
     if (options.stack && options.all) {
       throw new Error("Cannot specify both --stack and --all");
     }
+    if (options.rotateSecret && options.service && !["frontend", "backend"].includes(options.service)) {
+      throw new Error("--rotate-secret only applies to frontend and backend services");
+    }
   },
   continueOnError: true,
   // Continue provisioning all services even if one fails
@@ -28007,6 +28118,11 @@ var provisionCommand = new CommandBuilder().name("provision").description("Provi
     "--semiont-repo": {
       type: "string",
       description: "Path to semiont repository (for local development)"
+    },
+    "--rotate-secret": {
+      type: "boolean",
+      description: "Force generation of a new shared secret for frontend/backend (JWT_SECRET / NEXTAUTH_SECRET). Has no effect on other services. Warns if the peer service will be left out of sync.",
+      default: false
     }
   },
   aliases: {
@@ -28541,10 +28657,10 @@ init_cli_logger();
 init_config_loader();
 import * as crypto3 from "crypto";
 import * as argon2 from "argon2";
-import * as path36 from "path";
+import * as path37 from "path";
 import { createRequire as createRequire3 } from "module";
 function loadPrismaClient(projectRoot) {
-  const req = createRequire3(path36.join(projectRoot, "node_modules", ".package.json"));
+  const req = createRequire3(path37.join(projectRoot, "node_modules", ".package.json"));
   try {
     const backendPkgPath = req.resolve("@semiont/backend/package.json");
     const backendReq = createRequire3(backendPkgPath);
@@ -28787,7 +28903,7 @@ init_base_options_schema();
 init_cli_logger();
 init_config_loader();
 import * as fs47 from "fs";
-import * as path37 from "path";
+import * as path38 from "path";
 import { createEventStore } from "@semiont/event-sourcing";
 import { FilesystemRepresentationStore } from "@semiont/content";
 import { exportBackup } from "@semiont/make-meaning";
@@ -28818,7 +28934,7 @@ async function runBackup(options) {
   if (!baseUrl3) {
     throw new Error("services.backend.publicURL is required in environment config");
   }
-  const basePath = path37.isAbsolute(configuredPath) ? configuredPath : path37.resolve(projectRoot, configuredPath);
+  const basePath = path38.isAbsolute(configuredPath) ? configuredPath : path38.resolve(projectRoot, configuredPath);
   const logger = createCliLogger(options.verbose ?? false);
   const eventStore = createEventStore(basePath, void 0, void 0, logger);
   const contentStore = new FilesystemRepresentationStore(
@@ -28826,7 +28942,7 @@ async function runBackup(options) {
     projectRoot,
     logger.child({ component: "representation-store" })
   );
-  const outPath = path37.resolve(options.out);
+  const outPath = path38.resolve(options.out);
   if (!options.quiet) {
     printInfo(`Creating backup at ${outPath}`);
   }
@@ -28876,7 +28992,7 @@ init_base_options_schema();
 init_cli_logger();
 init_config_loader();
 import * as fs48 from "fs";
-import * as path38 from "path";
+import * as path39 from "path";
 import { EventBus } from "@semiont/core";
 import { createEventStore as createEventStore2 } from "@semiont/event-sourcing";
 import { importBackup, Stower, createKnowledgeBase } from "@semiont/make-meaning";
@@ -28945,9 +29061,9 @@ async function runRestore(options) {
   if (!configuredPath) {
     throw new Error("services.filesystem.path is required in environment config");
   }
-  const basePath = path38.isAbsolute(configuredPath) ? configuredPath : path38.resolve(projectRoot, configuredPath);
+  const basePath = path39.isAbsolute(configuredPath) ? configuredPath : path39.resolve(projectRoot, configuredPath);
   const logger = createCliLogger2(options.verbose ?? false);
-  const filePath = path38.resolve(options.file);
+  const filePath = path39.resolve(options.file);
   if (!fs48.existsSync(filePath)) {
     throw new Error(`File not found: ${filePath}`);
   }
@@ -29012,7 +29128,7 @@ init_command_definition();
 init_base_options_schema();
 init_cli_logger();
 import * as fs49 from "fs";
-import * as path39 from "path";
+import * as path40 from "path";
 import { isBackupManifest, validateManifestVersion, BACKUP_FORMAT } from "@semiont/make-meaning";
 import { createGunzip } from "node:zlib";
 var BLOCK_SIZE = 512;
@@ -29049,7 +29165,7 @@ var VerifyOptionsSchema = BaseOptionsSchema.extend({
 });
 async function runVerify(options) {
   const startTime = Date.now();
-  const filePath = path39.resolve(options.file);
+  const filePath = path40.resolve(options.file);
   if (!fs49.existsSync(filePath)) {
     throw new Error(`File not found: ${filePath}`);
   }
@@ -29186,7 +29302,7 @@ init_base_options_schema();
 init_cli_logger();
 init_config_loader();
 import * as fs50 from "fs";
-import * as path40 from "path";
+import * as path41 from "path";
 import { createEventStore as createEventStore3 } from "@semiont/event-sourcing";
 import { FilesystemRepresentationStore as FilesystemRepresentationStore2 } from "@semiont/content";
 import { exportLinkedData } from "@semiont/make-meaning";
@@ -29219,7 +29335,7 @@ async function runExport(options) {
   if (!baseUrl3) {
     throw new Error("services.backend.publicURL is required in environment config");
   }
-  const basePath = path40.isAbsolute(configuredPath) ? configuredPath : path40.resolve(projectRoot, configuredPath);
+  const basePath = path41.isAbsolute(configuredPath) ? configuredPath : path41.resolve(projectRoot, configuredPath);
   const logger = createCliLogger3(options.verbose ?? false);
   const eventStore = createEventStore3(basePath, void 0, void 0, logger);
   const contentStore = new FilesystemRepresentationStore2(
@@ -29231,7 +29347,7 @@ async function runExport(options) {
     services: { filesystem: envConfig.services.filesystem },
     _metadata: { projectRoot }
   });
-  const outPath = path40.resolve(options.out);
+  const outPath = path41.resolve(options.out);
   if (!options.quiet) {
     printInfo(`Exporting knowledge base as JSON-LD to ${outPath}`);
     if (options.includeArchived) {
@@ -29295,7 +29411,7 @@ init_base_options_schema();
 init_cli_logger();
 init_config_loader();
 import * as fs51 from "fs";
-import * as path41 from "path";
+import * as path42 from "path";
 import { EventBus as EventBus2 } from "@semiont/core";
 import { createEventStore as createEventStore4 } from "@semiont/event-sourcing";
 import { importLinkedData, Stower as Stower2, createKnowledgeBase as createKnowledgeBase2 } from "@semiont/make-meaning";
@@ -29365,9 +29481,9 @@ async function runImport(options) {
   if (!configuredPath) {
     throw new Error("services.filesystem.path is required in environment config");
   }
-  const basePath = path41.isAbsolute(configuredPath) ? configuredPath : path41.resolve(projectRoot, configuredPath);
+  const basePath = path42.isAbsolute(configuredPath) ? configuredPath : path42.resolve(projectRoot, configuredPath);
   const logger = createCliLogger4(options.verbose ?? false);
-  const filePath = path41.resolve(options.file);
+  const filePath = path42.resolve(options.file);
   if (!fs51.existsSync(filePath)) {
     throw new Error(`File not found: ${filePath}`);
   }
@@ -29439,7 +29555,7 @@ init_cli_colors();
 init_command_definition();
 init_base_options_schema();
 import * as fs52 from "fs";
-import * as path42 from "path";
+import * as path43 from "path";
 import * as readline from "readline";
 import { execFileSync as execFileSync44 } from "child_process";
 var LocalOptionsSchema = BaseOptionsSchema.extend({
@@ -29538,11 +29654,11 @@ function parseCheckOutput(jsonOutput) {
 function isProvisioned(serviceName, semiotRoot) {
   switch (serviceName) {
     case "backend":
-      return fs52.existsSync(path42.join(semiotRoot, "backend", ".env"));
+      return fs52.existsSync(path43.join(semiotRoot, "backend", ".env"));
     case "frontend":
-      return fs52.existsSync(path42.join(semiotRoot, "frontend", ".env"));
+      return fs52.existsSync(path43.join(semiotRoot, "frontend", ".env"));
     case "filesystem":
-      return fs52.existsSync(path42.join(semiotRoot, "data"));
+      return fs52.existsSync(path43.join(semiotRoot, "data"));
     case "database":
     case "proxy":
     // For these, rely on check result only — we don't have a simple local sentinel
@@ -29573,7 +29689,7 @@ ${colors.bright}\u{1F310} Semiont Local Setup${colors.reset}
   try {
     let semiotRoot = process.env.SEMIONT_ROOT || "";
     if (!semiotRoot) {
-      const defaultPath = path42.join(process.env.HOME || process.cwd(), "semiont");
+      const defaultPath = path43.join(process.env.HOME || process.cwd(), "semiont");
       const answer = await prompt(
         `${colors.cyan}SEMIONT_ROOT is not set.${colors.reset}
 Press Enter to use ${colors.bright}${defaultPath}${colors.reset}, or type a path: `
@@ -29600,8 +29716,8 @@ Press Enter to use ${colors.bright}${defaultPath}${colors.reset}, or type a path
 `);
     }
     const env = { ...process.env };
-    const semiontJsonPath = path42.join(semiotRoot, "semiont.json");
-    const envFilePath = path42.join(semiotRoot, "environments", `${semiotEnv}.json`);
+    const semiontJsonPath = path43.join(semiotRoot, "semiont.json");
+    const envFilePath = path43.join(semiotRoot, "environments", `${semiotEnv}.json`);
     const isInitialized = fs52.existsSync(semiontJsonPath) && fs52.existsSync(envFilePath);
     if (isInitialized) {
       console.log(`${colors.green}\u2713${colors.reset} Project already initialized
@@ -29681,7 +29797,7 @@ Press Enter to use ${colors.bright}${defaultPath}${colors.reset}, or type a path
       }
     }
     console.log("");
-    const credentialsPath = path42.join(semiotRoot, "credentials.txt");
+    const credentialsPath = path43.join(semiotRoot, "credentials.txt");
     if (fs52.existsSync(credentialsPath)) {
       console.log(`${colors.green}\u2713${colors.reset} Credentials file already exists at ${credentialsPath}
 `);
@@ -29837,7 +29953,7 @@ function isCommandDefinition(obj) {
 
 // src/core/service-discovery.ts
 init_config_loader();
-import * as path43 from "path";
+import * as path44 from "path";
 import * as fs53 from "fs";
 var BUILT_IN_SERVICES = ["frontend", "backend", "database", "filesystem"];
 var environmentServicesCache = /* @__PURE__ */ new Map();
@@ -29847,7 +29963,7 @@ async function loadEnvironmentServices(environment) {
   }
   try {
     const PROJECT_ROOT = findProjectRoot();
-    const configPath = path43.join(PROJECT_ROOT, "environments", `${environment}.json`);
+    const configPath = path44.join(PROJECT_ROOT, "environments", `${environment}.json`);
     if (!fs53.existsSync(configPath)) {
       return [...BUILT_IN_SERVICES];
     }
@@ -29882,7 +29998,7 @@ async function isValidService(service, environment) {
 import { parseEnvironment as parseEnvironment2 } from "@semiont/core";
 
 // src/core/service-resolver.ts
-import * as path44 from "path";
+import * as path45 from "path";
 import { ConfigurationError as ConfigurationError2 } from "@semiont/core";
 function getServicePlatform(serviceName, config) {
   const environment = config._metadata?.environment;
@@ -29930,7 +30046,7 @@ function resolveServiceDeployments(serviceNames, config) {
     const serviceConfig = config.services?.[serviceName];
     if (!serviceConfig) {
       const availableServices = Object.keys(config.services || {});
-      const configPath = path44.join(projectRoot, "environments", `${environment}.json`);
+      const configPath = path45.join(projectRoot, "environments", `${environment}.json`);
       console.warn(`\u274C Service '${serviceName}' not found in environment '${environment}'`);
       if (availableServices.length > 0) {
         console.warn(`   Available services: ${availableServices.join(", ")}`);
@@ -29969,7 +30085,7 @@ function resolveServiceDeployments(serviceNames, config) {
 // src/core/command-service-matcher.ts
 init_service_factory();
 init_service_command_capabilities();
-import * as path45 from "path";
+import * as path46 from "path";
 async function checkServiceSupportsCommand(serviceName, command, envConfig) {
   try {
     const projectRoot = envConfig._metadata?.projectRoot;
@@ -30053,7 +30169,7 @@ async function resolveServiceSelector(selector, capability, envConfig) {
     if (!projectRoot) {
       throw new Error("Project root is required in envConfig._metadata");
     }
-    const configPath = path45.join(projectRoot, "environments", `${environment}.json`);
+    const configPath = path46.join(projectRoot, "environments", `${environment}.json`);
     const errorMessage = [
       `Unknown service '${selector}' in environment '${environment}'`,
       `Available services: ${availableServices.join(", ")}`,
@@ -30549,14 +30665,14 @@ var OutputFormatter = class {
   /**
    * Get nested value from object using dot notation
    */
-  static getNestedValue(obj, path46) {
-    return path46.split(".").reduce((current, key) => current?.[key], obj);
+  static getNestedValue(obj, path47) {
+    return path47.split(".").reduce((current, key) => current?.[key], obj);
   }
   /**
    * Set nested value in object using dot notation
    */
-  static setNestedValue(obj, path46, value) {
-    const keys = path46.split(".");
+  static setNestedValue(obj, path47, value) {
+    const keys = path47.split(".");
     const lastKey = keys.pop();
     const target = keys.reduce((current, key) => {
       if (!(key in current)) {
@@ -30714,6 +30830,16 @@ function printPreamble(options) {
   console.log(getPreamble(version));
   console.log(getPreambleSeparator());
 }
+function printVerboseEnv(options) {
+  if (!options.verbose) return;
+  const vars = ["SEMIONT_ROOT", "SEMIONT_ENV", "SEMIONT_REPO"];
+  for (const v of vars) {
+    const val = process.env[v];
+    if (val !== void 0) {
+      printInfo(`${v}=${val}`);
+    }
+  }
+}
 async function executeCommand(commandName, argv) {
   try {
     const command = await loadCommand(commandName);
@@ -30766,6 +30892,7 @@ async function executeCommand(commandName, argv) {
       }
     }
     printPreamble(options);
+    printVerboseEnv(options);
     if (command.requiresEnvironment) {
       if (!options.environment) {
         const envFromVariable = process.env.SEMIONT_ENV;