@studiometa/forge-cli 0.4.5 → 0.4.7

package/dist/cli.js

@@ -1,10 +1,12 @@
 #!/usr/bin/env node
-import { S as isOutputFormat, _ as ApiError, a as createContext, b as ValidationError, c as colors, d as deleteToken, g as setToken, h as setOrganizationSlug, i as runCommand, l as setColorEnabled, m as getToken, n as exitWithValidationError, p as getOrganizationSlug, s as OutputFormatter, u as createConfigStore } from "./error-handler-peS_8nl4.js";
-import { activateCertificate, createAuditLogger, createBackupConfig, createCommand, createDatabaseUser, createMonitor, createNginxTemplate, createRedirectRule, createScheduledJob, createSecurityRule, deleteBackupConfig, deleteDatabaseUser, deleteMonitor, deleteNginxTemplate, deleteRedirectRule, deleteScheduledJob, deleteSecurityRule, deploySiteAndWait, getBackupConfig, getCertificate, getCommand, getDaemon, getDatabase, getDatabaseUser, getEnv, getFirewallRule, getMonitor, getNginxConfig, getNginxTemplate, getRecipe, getRedirectRule, getScheduledJob, getSecurityRule, getServer, getSite, getSshKey, getUser, listBackupConfigs, listCommands, listDaemons, listDatabaseUsers, listDatabases, listDeployments, listFirewallRules, listMonitors, listNginxTemplates, listRecipes, listRedirectRules, listScheduledJobs, listSecurityRules, listServers, listSites, listSshKeys, matchByName, rebootServer, restartDaemon, runRecipe, updateBackupConfig, updateDaemon, updateDatabaseUser, updateEnv, updateNginxConfig, updateNginxTemplate, updateRecipe, updateSecurityRule, updateSite } from "@studiometa/forge-core";
-import { mkdirSync, writeFileSync } from "node:fs";
+import { C as isOutputFormat, _ as setToken, a as runCommand, c as OutputFormatter, d as createConfigStore, f as deleteToken, g as setOrganizationSlug, h as getToken, l as colors, m as getOrganizationSlug, n as exitWithError, o as createContext, r as exitWithValidationError, t as ExitCode, u as setColorEnabled, v as ApiError, x as ValidationError } from "./error-handler-Adi84RcF.js";
+import { PHP_CONFIG_TYPES, RESTARTABLE_SERVICES, activateCertificate, createAuditLogger, createBackupConfig, createCommand, createDatabaseUser, createMonitor, createNginxTemplate, createRedirectRule, createScheduledJob, createSecurityRule, createSshKey, deleteBackupConfig, deleteDatabaseUser, deleteMonitor, deleteNginxTemplate, deleteRedirectRule, deleteScheduledJob, deleteSecurityRule, deleteSshKey, deploySiteAndWait, disablePhpOpcache, enablePhpOpcache, getBackupConfig, getCertificate, getCommand, getDaemon, getDaemonLog, getDatabase, getDatabaseUser, getDeploymentLog, getDeploymentScript, getEnv, getFirewallRule, getMonitor, getNginxConfig, getNginxTemplate, getPhpConfig, getPhpMaxExecutionTime, getPhpMaxUploadSize, getPhpOpcache, getRecipe, getRedirectRule, getScheduledJob, getSecurityRule, getServer, getSite, getSshKey, getUser, listBackupConfigs, listCommands, listDaemons, listDatabaseUsers, listDatabases, listDeployments, listFirewallRules, listMonitors, listNginxTemplates, listPhpVersions, listRecipes, listRedirectRules, listScheduledJobs, listSecurityRules, listServers, listServices, listSites, listSshKeys, matchByName, rebootServer, restartDaemon, restartService, runRecipe, updateBackupConfig, updateDaemon, updateDatabaseUser, updateDeploymentScript, updateEnv, updateNginxConfig, updateNginxTemplate, updatePhpConfig, updatePhpMaxExecutionTime, updatePhpMaxUploadSize, updateRecipe, updateSecurityRule, updateSite } from "@studiometa/forge-core";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { diff } from "node:util";
 import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
 //#region src/audit.ts
 /**
 * Shared audit logger for CLI write operations.
@@ -76,7 +78,14 @@ function createCommandRouter(config) {
 */
 async function resolveServerId(value, execCtx) {
 	if (/^\d+$/.test(value)) return value;
-	const servers = (await listServers({}, execCtx)).data;
+	return matchServerId(value, (await listServers({}, execCtx)).data);
+}
+/**
+* Resolve a --server value to a numeric server ID string, against a list of servers
+* that is already loaded. Same rules as {@link resolveServerId}, with no API call.
+*/
+function matchServerId(value, servers) {
+	if (/^\d+$/.test(value)) return value;
 	const { exact, partial } = matchByName(servers, value, (s) => s.name);
 	if (exact.length === 1) return String(exact[0].id);
 	if (partial.length === 0) {
@@ -336,24 +345,26 @@ _forge_completions() {
   prev="\${COMP_WORDS[COMP_CWORD-1]}"
 
   # Main commands
-  commands="config servers s sites deployments d databases db database-users daemons env nginx certificates certs firewall-rules fw ssh ssh-keys backups commands scheduled-jobs user monitors nginx-templates security-rules redirect-rules recipes completion help"
+  commands="config servers s sites deployments d databases db database-users daemons env nginx certificates certs firewall-rules fw ssh ssh-keys backups commands scheduled-jobs services php user monitors nginx-templates security-rules redirect-rules recipes completion help"
 
   # Subcommands for each command
   local config_cmds="set get delete"
   local servers_cmds="list ls get reboot"
   local sites_cmds="list ls get"
-  local deployments_cmds="list ls deploy"
+  local deployments_cmds="list ls deploy logs log script update-script"
   local databases_cmds="list ls get"
   local database_users_cmds="list ls get create delete"
-  local daemons_cmds="list ls get restart"
+  local daemons_cmds="list ls get restart logs log"
   local env_cmds="get update"
   local nginx_cmds="get update"
   local certificates_cmds="get activate"
   local firewall_rules_cmds="list ls get"
-  local ssh_keys_cmds="list ls get"
+  local ssh_keys_cmds="list ls get sync"
   local backups_cmds="list ls get create delete"
   local commands_cmds="list ls get create"
   local scheduled_jobs_cmds="list ls get create delete"
+  local services_cmds="list ls restart"
+  local php_cmds="list ls config update-config max-upload-size set-max-upload-size max-execution-time set-max-execution-time opcache enable-opcache disable-opcache"
   local user_cmds="get"
   local monitors_cmds="list ls get create delete"
   local nginx_templates_cmds="list ls get create update delete"
@@ -363,7 +374,7 @@ _forge_completions() {
   local completion_cmds="bash zsh fish"
 
   # Global options
-  options="--token --server --site -f --format --no-color -h --help -v --version --name --command --content --from --to --provider --frequency --type --operator --threshold --minutes --key --port --ip-address --user --private --dry-run --script --servers --domain --password --credential-id --region --size --project-type --directory"
+  options="--token --server --site -f --format --no-color -h --help -v --version --name --command --content --from --to --provider --frequency --type --operator --threshold --minutes --key --port --ip-address --user --private --dry-run --script --servers --domain --password --credential-id --region --size --project-type --directory --file --script-file --check --all-servers --prune"
 
   # Format options
   local formats="json human table"
@@ -422,6 +433,12 @@ _forge_completions() {
         scheduled-jobs)
           COMPREPLY=( $(compgen -W "\${scheduled_jobs_cmds}" -- "\${cur}") )
           ;;
+        services)
+          COMPREPLY=( $(compgen -W "\${services_cmds}" -- "\${cur}") )
+          ;;
+        php)
+          COMPREPLY=( $(compgen -W "\${php_cmds}" -- "\${cur}") )
+          ;;
         user)
           COMPREPLY=( $(compgen -W "\${user_cmds}" -- "\${cur}") )
           ;;
@@ -454,7 +471,11 @@ _forge_completions() {
         --format|-f)
           COMPREPLY=( $(compgen -W "\${formats}" -- "\${cur}") )
           ;;
-        --token|--server|--site|--name|--command|--content|--from|--to|--provider|--frequency|--type|--operator|--threshold|--minutes|--key|--port|--ip-address|--user|--script|--servers|--domain|--password|--credential-id|--region|--size|--project-type|--directory)
+        --file|--script-file)
+          # Complete file paths
+          COMPREPLY=( $(compgen -f -- "\${cur}") )
+          ;;
+        --token|--server|--site|--version|--name|--command|--content|--from|--to|--provider|--frequency|--type|--operator|--threshold|--minutes|--key|--port|--ip-address|--user|--script|--servers|--domain|--password|--credential-id|--region|--size|--project-type|--directory)
           # No completion for values requiring arguments
           COMPREPLY=()
           ;;
@@ -505,6 +526,8 @@ _forge() {
         'backups:Manage backup configurations'
         'commands:Manage site commands'
         'scheduled-jobs:Manage scheduled jobs'
+        'services:List and restart server services'
+        'php:Manage PHP versions, configuration, limits and OPcache'
         'user:Display authenticated user profile'
         'monitors:Manage server monitors'
         'nginx-templates:Manage Nginx templates'
@@ -552,6 +575,10 @@ _forge() {
             'list:List deployments'
             'ls:List deployments (alias)'
             'deploy:Trigger a deployment'
+            'logs:Show deployment output'
+            'log:Show deployment output (alias)'
+            'script:Show the deployment script'
+            'update-script:Update the deployment script'
           )
           _describe 'deployments command' deployments_cmds
           ;;
@@ -582,6 +609,8 @@ _forge() {
             'ls:List daemons (alias)'
             'get:Get daemon details'
             'restart:Restart a daemon'
+            'logs:Show daemon log output'
+            'log:Show daemon log output (alias)'
           )
           _describe 'daemons command' daemons_cmds
           ;;
@@ -624,6 +653,7 @@ _forge() {
             'list:List SSH keys'
             'ls:List SSH keys (alias)'
             'get:Get SSH key details'
+            'sync:Make server SSH keys match a file'
           )
           _describe 'ssh-keys command' ssh_keys_cmds
           ;;
@@ -659,6 +689,32 @@ _forge() {
           )
           _describe 'scheduled-jobs command' scheduled_jobs_cmds
           ;;
+        services)
+          local -a services_cmds
+          services_cmds=(
+            'list:List services on a server'
+            'ls:List services on a server (alias)'
+            'restart:Restart a service'
+          )
+          _describe 'services command' services_cmds
+          ;;
+        php)
+          local -a php_cmds
+          php_cmds=(
+            'list:List installed PHP versions'
+            'ls:List installed PHP versions (alias)'
+            'config:Show a PHP configuration file'
+            'update-config:Replace a PHP configuration file'
+            'max-upload-size:Show the max upload size'
+            'set-max-upload-size:Set the max upload size'
+            'max-execution-time:Show the max execution time'
+            'set-max-execution-time:Set the max execution time'
+            'opcache:Show the OPcache status'
+            'enable-opcache:Enable OPcache'
+            'disable-opcache:Disable OPcache'
+          )
+          _describe 'php command' php_cmds
+          ;;
         user)
           local -a user_cmds
           user_cmds=(
@@ -740,7 +796,8 @@ _forge() {
         '(-f --format)'{-f,--format}'[Output format]:format:(json human table)' \\
         '--no-color[Disable colored output]' \\
         '(-h --help)'{-h,--help}'[Show help]' \\
-        '(-v --version)'{-v,--version}'[Show version]' \\
+        '-v[Show version]' \\
+        '--version[PHP version (php, services)]:version:' \\
         '--name[Name]:name:' \\
         '--command[Command]:command:' \\
         '--content[Content]:content:' \\
@@ -764,7 +821,13 @@ _forge() {
         '--region[Region]:region:' \\
         '--size[Size]:size:' \\
         '--project-type[Project type]:project type:' \\
-        '--directory[Directory]:directory:'
+        '--directory[Directory]:directory:' \\
+        '--file[File path (- for stdin)]:file:_files' \\
+        '--script-file[Deployment script file]:file:_files' \\
+        '--all-servers[Target every server]' \\
+        '--prune[Remove SSH keys that are not in the file]' \\
+        '--dry-run[Print the plan and change nothing]' \\
+        '--check[Compare with Forge, do not write]'
       ;;
   esac
 }
@@ -795,6 +858,8 @@ complete -c forge -f -n "__fish_use_subcommand" -a "ssh-keys" -d "Manage SSH key
 complete -c forge -f -n "__fish_use_subcommand" -a "backups" -d "Manage backup configurations"
 complete -c forge -f -n "__fish_use_subcommand" -a "commands" -d "Manage site commands"
 complete -c forge -f -n "__fish_use_subcommand" -a "scheduled-jobs" -d "Manage scheduled jobs"
+complete -c forge -f -n "__fish_use_subcommand" -a "services" -d "List and restart server services"
+complete -c forge -f -n "__fish_use_subcommand" -a "php" -d "Manage PHP versions, configuration, limits and OPcache"
 complete -c forge -f -n "__fish_use_subcommand" -a "user" -d "Display authenticated user profile"
 complete -c forge -f -n "__fish_use_subcommand" -a "monitors" -d "Manage server monitors"
 complete -c forge -f -n "__fish_use_subcommand" -a "nginx-templates" -d "Manage Nginx templates"
@@ -824,6 +889,10 @@ complete -c forge -f -n "__fish_seen_subcommand_from sites" -a "get" -d "Get sit
 complete -c forge -f -n "__fish_seen_subcommand_from deployments d" -a "list" -d "List deployments"
 complete -c forge -f -n "__fish_seen_subcommand_from deployments d" -a "ls" -d "List deployments (alias)"
 complete -c forge -f -n "__fish_seen_subcommand_from deployments d" -a "deploy" -d "Trigger a deployment"
+complete -c forge -f -n "__fish_seen_subcommand_from deployments d" -a "logs" -d "Show deployment output"
+complete -c forge -f -n "__fish_seen_subcommand_from deployments d" -a "log" -d "Show deployment output (alias)"
+complete -c forge -f -n "__fish_seen_subcommand_from deployments d" -a "script" -d "Show the deployment script"
+complete -c forge -f -n "__fish_seen_subcommand_from deployments d" -a "update-script" -d "Update the deployment script"
 
 # databases subcommands
 complete -c forge -f -n "__fish_seen_subcommand_from databases db" -a "list" -d "List databases"
@@ -842,6 +911,8 @@ complete -c forge -f -n "__fish_seen_subcommand_from daemons" -a "list" -d "List
 complete -c forge -f -n "__fish_seen_subcommand_from daemons" -a "ls" -d "List daemons (alias)"
 complete -c forge -f -n "__fish_seen_subcommand_from daemons" -a "get" -d "Get daemon details"
 complete -c forge -f -n "__fish_seen_subcommand_from daemons" -a "restart" -d "Restart a daemon"
+complete -c forge -f -n "__fish_seen_subcommand_from daemons" -a "logs" -d "Show daemon log output"
+complete -c forge -f -n "__fish_seen_subcommand_from daemons" -a "log" -d "Show daemon log output (alias)"
 
 # env subcommands
 complete -c forge -f -n "__fish_seen_subcommand_from env" -a "get" -d "Get env variables"
@@ -865,6 +936,7 @@ complete -c forge -f -n "__fish_seen_subcommand_from firewall-rules fw" -a "get"
 complete -c forge -f -n "__fish_seen_subcommand_from ssh-keys" -a "list" -d "List SSH keys"
 complete -c forge -f -n "__fish_seen_subcommand_from ssh-keys" -a "ls" -d "List SSH keys (alias)"
 complete -c forge -f -n "__fish_seen_subcommand_from ssh-keys" -a "get" -d "Get SSH key details"
+complete -c forge -f -n "__fish_seen_subcommand_from ssh-keys" -a "sync" -d "Make server SSH keys match a file"
 
 # backups subcommands
 complete -c forge -f -n "__fish_seen_subcommand_from backups" -a "list" -d "List backup configurations"
@@ -886,6 +958,24 @@ complete -c forge -f -n "__fish_seen_subcommand_from scheduled-jobs" -a "get" -d
 complete -c forge -f -n "__fish_seen_subcommand_from scheduled-jobs" -a "create" -d "Create a scheduled job"
 complete -c forge -f -n "__fish_seen_subcommand_from scheduled-jobs" -a "delete" -d "Delete a scheduled job"
 
+# services subcommands
+complete -c forge -f -n "__fish_seen_subcommand_from services" -a "list" -d "List services on a server"
+complete -c forge -f -n "__fish_seen_subcommand_from services" -a "ls" -d "List services on a server (alias)"
+complete -c forge -f -n "__fish_seen_subcommand_from services" -a "restart" -d "Restart a service"
+
+# php subcommands
+complete -c forge -f -n "__fish_seen_subcommand_from php" -a "list" -d "List installed PHP versions"
+complete -c forge -f -n "__fish_seen_subcommand_from php" -a "ls" -d "List installed PHP versions (alias)"
+complete -c forge -f -n "__fish_seen_subcommand_from php" -a "config" -d "Show a PHP configuration file"
+complete -c forge -f -n "__fish_seen_subcommand_from php" -a "update-config" -d "Replace a PHP configuration file"
+complete -c forge -f -n "__fish_seen_subcommand_from php" -a "max-upload-size" -d "Show the max upload size"
+complete -c forge -f -n "__fish_seen_subcommand_from php" -a "set-max-upload-size" -d "Set the max upload size"
+complete -c forge -f -n "__fish_seen_subcommand_from php" -a "max-execution-time" -d "Show the max execution time"
+complete -c forge -f -n "__fish_seen_subcommand_from php" -a "set-max-execution-time" -d "Set the max execution time"
+complete -c forge -f -n "__fish_seen_subcommand_from php" -a "opcache" -d "Show the OPcache status"
+complete -c forge -f -n "__fish_seen_subcommand_from php" -a "enable-opcache" -d "Enable OPcache"
+complete -c forge -f -n "__fish_seen_subcommand_from php" -a "disable-opcache" -d "Disable OPcache"
+
 # user subcommands
 complete -c forge -f -n "__fish_seen_subcommand_from user" -a "get" -d "Get the authenticated user profile"
 
@@ -961,6 +1051,12 @@ complete -c forge -l region -d "Region" -r
 complete -c forge -l size -d "Size" -r
 complete -c forge -l project-type -d "Project type" -r
 complete -c forge -l directory -d "Directory" -r
+complete -c forge -l file -d "File path (- for stdin)" -r -F
+complete -c forge -l script-file -d "Deployment script file" -r -F
+complete -c forge -l all-servers -d "Target every server"
+complete -c forge -l prune -d "Remove SSH keys that are not in the file"
+complete -c forge -l dry-run -d "Print the plan and change nothing"
+complete -c forge -l check -d "Compare with Forge, do not write"
 `;
 /**
 * Get the appropriate completion file path for the shell
@@ -1432,6 +1528,22 @@ async function daemonsGet(args, ctx) {
 		]);
 	}, ctx.formatter);
 }
+async function daemonsLogs(args, ctx) {
+	const [id] = args;
+	const server = String(ctx.options.server ?? "");
+	if (!id) exitWithValidationError("daemon_id", "forge daemons logs <daemon_id> --server <server_id>", ctx.formatter);
+	if (!server) exitWithValidationError("server_id", "forge daemons logs <daemon_id> --server <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await getDaemonLog({
+			server_id: await resolveServerId(server, execCtx),
+			id
+		}, execCtx);
+		if (result.data) ctx.formatter.outputText(result.data);
+		else ctx.formatter.info("No log output available.");
+	}, ctx.formatter);
+}
 async function daemonsUpdate(args, ctx) {
 	const [id] = args;
 	const server = String(ctx.options.server ?? "");
@@ -1483,6 +1595,8 @@ var handleDaemonsCommand = createCommandRouter({
 		list: daemonsList,
 		ls: daemonsList,
 		get: [daemonsGet, "args"],
+		logs: [daemonsLogs, "args"],
+		log: [daemonsLogs, "args"],
 		restart: [daemonsRestart, "args"],
 		update: [daemonsUpdate, "args"]
 	},
@@ -1502,6 +1616,12 @@ ${colors.bold("forge daemons get")} - Get daemon details
 
 ${colors.bold("USAGE:")}
   forge daemons get <daemon_id> --server <server_id>
+`);
+	else if (subcommand === "logs" || subcommand === "log") console.log(`
+${colors.bold("forge daemons logs")} - Show the log output of a daemon
+
+${colors.bold("USAGE:")}
+  forge daemons logs <daemon_id> --server <server_id>
 `);
 	else if (subcommand === "update") console.log(`
 ${colors.bold("forge daemons update")} - Update a daemon
@@ -1524,6 +1644,7 @@ ${colors.bold("USAGE:")}
 ${colors.bold("SUBCOMMANDS:")}
   list, ls            List daemons
   get <id>            Get daemon details
+  logs <id>           Show the log output of a daemon
   update <id>         Update a daemon
   restart <id>        Restart a daemon
 
@@ -1810,6 +1931,133 @@ Run ${colors.cyan("forge database-users <subcommand> --help")} for details.
 `);
 }
 //#endregion
+//#region src/utils/content-source.ts
+/**
+* Read the content of an update command from a file, stdin or an inline option.
+*/
+/**
+* Exit when the content is empty, so Forge never gets a blank file.
+*/
+function assertNotEmpty(content, field, source) {
+	if (!content.trim()) exitWithError(new ValidationError(`${source.label.charAt(0).toUpperCase() + source.label.slice(1)} is empty`, field), source.formatter);
+}
+/**
+* Read content from a file path, or from stdin when the path is "-".
+* Exits with a validation error when the path is missing, the file cannot be read or it is empty.
+*/
+function readContentFile(path, field, source) {
+	if (typeof path !== "string" || !path) exitWithError(new ValidationError(`--${field} requires a path (use - for stdin)`, field, [`Usage: ${source.usage}`]), source.formatter);
+	let content;
+	try {
+		content = readFileSync(path === "-" ? 0 : path, "utf8");
+	} catch (error) {
+		const reason = error instanceof Error ? error.message : String(error);
+		exitWithError(new ValidationError(`Cannot read ${source.label} from ${path}: ${reason}`, field), source.formatter);
+	}
+	assertNotEmpty(content, field, source);
+	return content;
+}
+/**
+* Read content from exactly one of `--file <path|->` or `--content <string>`.
+* Exits with a validation error when both or none are given, or when the content is empty.
+*/
+function readContentOption(options, source) {
+	const { file, content } = options;
+	if (file !== void 0 && content !== void 0) exitWithError(new ValidationError("Use either --file or --content, not both", "file", [`Usage: ${source.usage}`]), source.formatter);
+	if (file !== void 0) return readContentFile(file, "file", source);
+	if (content === void 0) exitWithError(new ValidationError(`Missing ${source.label}: use --file or --content`, "file", [`Usage: ${source.usage}`]), source.formatter);
+	const inline = typeof content === "string" ? content : "";
+	assertNotEmpty(inline, "content", source);
+	return inline;
+}
+//#endregion
+//#region src/utils/drift.ts
+/**
+* Compare local content with the content on Forge for `--check`.
+*/
+/**
+* Normalize CRLF to LF and drop a single trailing newline,
+* so editor and platform differences do not count as drift.
+*/
+function normalizeContent(text) {
+	const lf = text.replaceAll("\r\n", "\n");
+	return lf.endsWith("\n") ? lf.slice(0, -1) : lf;
+}
+function toLines(normalized) {
+	return normalized === "" ? [] : normalized.split("\n");
+}
+/**
+* Build a unified-style line diff from `remote` to `local`, with `context`
+* unchanged lines around each change. Returns an empty string when both
+* are equal after normalization.
+*/
+function unifiedDiff(remote, local, context = 3) {
+	const remoteText = normalizeContent(remote);
+	const localText = normalizeContent(local);
+	if (remoteText === localText) return "";
+	const entries = diff(toLines(remoteText), toLines(localText));
+	let remoteCount = 0;
+	let localCount = 0;
+	const lines = entries.map(([op, text]) => {
+		const line = {
+			op: op === 0 ? " " : op === 1 ? "-" : "+",
+			text,
+			remoteBefore: remoteCount,
+			localBefore: localCount
+		};
+		if (op !== -1) remoteCount++;
+		if (op !== 1) localCount++;
+		return line;
+	});
+	const changes = lines.flatMap((line, index) => line.op === " " ? [] : [index]);
+	const groups = [];
+	for (const index of changes) {
+		const group = groups.at(-1);
+		if (group && index - group[group.length - 1] - 1 <= 2 * context) group.push(index);
+		else groups.push([index]);
+	}
+	const output = ["--- remote", "+++ local"];
+	for (const group of groups) {
+		const start = Math.max(0, group[0] - context);
+		const end = Math.min(lines.length, group[group.length - 1] + context + 1);
+		const hunk = lines.slice(start, end);
+		const remoteLength = hunk.filter((line) => line.op !== "+").length;
+		const localLength = hunk.filter((line) => line.op !== "-").length;
+		const remoteStart = hunk[0].remoteBefore + (remoteLength > 0 ? 1 : 0);
+		const localStart = hunk[0].localBefore + (localLength > 0 ? 1 : 0);
+		output.push(`@@ -${remoteStart},${remoteLength} +${localStart},${localLength} @@`);
+		for (const line of hunk) output.push(`${line.op}${line.text}`);
+	}
+	return output.join("\n");
+}
+/**
+* Print the result of a `--check` and set exit code 1 when the local content differs from Forge.
+* It sets `process.exitCode` and does not call `process.exit`, so a long diff
+* written to a pipe is not cut. JSON output is `{ inSync: true }` or `{ inSync: false, diff }`.
+*/
+function reportDrift(label, drift, formatter) {
+	const name = label.charAt(0).toUpperCase() + label.slice(1);
+	if (formatter.isJson()) formatter.output(drift ? {
+		inSync: false,
+		diff: drift.json
+	} : { inSync: true });
+	else if (drift) {
+		console.log(drift.text);
+		formatter.error(`${name} differs from Forge.`);
+	} else formatter.success(`${name} is in sync with Forge.`);
+	if (drift) process.exitCode = ExitCode.GENERAL_ERROR;
+}
+/**
+* Check `local` against `remote` as text and report a line diff.
+*/
+function reportTextDrift(label, remote, local, formatter) {
+	const text = unifiedDiff(remote, local);
+	reportDrift(label, text ? {
+		text,
+		json: text
+	} : null, formatter);
+}
+//#endregion
 //#region src/commands/deployments/handlers.ts
 async function deploymentsList(ctx) {
 	const server = String(ctx.options.server ?? "");
@@ -1832,17 +2080,113 @@ async function deploymentsList(ctx) {
 		], "No deployments found.", (d) => `${String(d.id).padEnd(8)} ${d.status.padEnd(12)} ${(d.commit.hash ?? "—").padEnd(10)} ${d.started_at}`);
 	}, ctx.formatter);
 }
+async function deploymentsLogs(args, ctx) {
+	const [deploymentId] = args;
+	const server = String(ctx.options.server ?? "");
+	const site = String(ctx.options.site ?? "");
+	if (!server) exitWithValidationError("server_id", "forge deployments logs [deployment_id] --server <server_id> --site <site_id>", ctx.formatter);
+	if (!site) exitWithValidationError("site_id", "forge deployments logs [deployment_id] --server <server_id> --site <site_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const server_id = await resolveServerId(server, execCtx);
+		const site_id = await resolveSiteId(site, server_id, execCtx);
+		let deployment_id = deploymentId;
+		if (!deployment_id) {
+			const deployments = await listDeployments({
+				server_id,
+				site_id
+			}, execCtx);
+			if (deployments.data.length === 0) {
+				ctx.formatter.info("No deployments found.");
+				return;
+			}
+			deployment_id = String(deployments.data[0].id);
+		}
+		const result = await getDeploymentLog({
+			server_id,
+			site_id,
+			deployment_id
+		}, execCtx);
+		if (result.data) ctx.formatter.outputText(result.data);
+		else ctx.formatter.info("No log output available.");
+	}, ctx.formatter);
+}
+async function deploymentsScript(ctx) {
+	const server = String(ctx.options.server ?? "");
+	const site = String(ctx.options.site ?? "");
+	if (!server) exitWithValidationError("server_id", "forge deployments script --server <server_id> --site <site_id>", ctx.formatter);
+	if (!site) exitWithValidationError("site_id", "forge deployments script --server <server_id> --site <site_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const server_id = await resolveServerId(server, execCtx);
+		const result = await getDeploymentScript({
+			server_id,
+			site_id: await resolveSiteId(site, server_id, execCtx)
+		}, execCtx);
+		if (ctx.formatter.isJson()) console.log(JSON.stringify({ content: result.data }));
+		else process.stdout.write(result.data.endsWith("\n") ? result.data : `${result.data}\n`);
+	}, ctx.formatter);
+}
+async function deploymentsUpdateScript(ctx) {
+	const usage = "forge deployments update-script --server <server_id> --site <site_id> (--file <path|-> | --content <script>) [--check]";
+	const server = String(ctx.options.server ?? "");
+	const site = String(ctx.options.site ?? "");
+	const check = Boolean(ctx.options.check);
+	if (!server) exitWithValidationError("server_id", usage, ctx.formatter);
+	if (!site) exitWithValidationError("site_id", usage, ctx.formatter);
+	const script = readContentOption(ctx.options, {
+		label: "deployment script",
+		usage,
+		formatter: ctx.formatter
+	});
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const server_id = await resolveServerId(server, execCtx);
+		const site_id = await resolveSiteId(site, server_id, execCtx);
+		if (check) {
+			reportTextDrift("deployment script", (await getDeploymentScript({
+				server_id,
+				site_id
+			}, execCtx)).data, script, ctx.formatter);
+			return;
+		}
+		await updateDeploymentScript({
+			server_id,
+			site_id,
+			content: script
+		}, execCtx);
+		ctx.formatter.success("Deployment script updated.");
+	}, ctx.formatter);
+}
 async function deploymentsDeploy(ctx) {
+	const usage = "forge deployments deploy --server <server_id> --site <site_id> [--script-file <path>]";
 	const server = String(ctx.options.server ?? "");
 	const site = String(ctx.options.site ?? "");
 	const streamLogs = Boolean(ctx.options.stream);
-	if (!server) exitWithValidationError("server_id", "forge deployments deploy --server <server_id> --site <site_id>", ctx.formatter);
-	if (!site) exitWithValidationError("site_id", "forge deployments deploy --server <server_id> --site <site_id>", ctx.formatter);
+	const scriptFile = ctx.options["script-file"];
+	if (!server) exitWithValidationError("server_id", usage, ctx.formatter);
+	if (!site) exitWithValidationError("site_id", usage, ctx.formatter);
+	const script = scriptFile === void 0 ? void 0 : readContentFile(scriptFile, "script-file", {
+		label: "deployment script",
+		usage,
+		formatter: ctx.formatter
+	});
 	await runCommand(async () => {
 		const token = ctx.getToken();
 		const execCtx = ctx.createExecutorContext(token);
 		const server_id = await resolveServerId(server, execCtx);
 		const site_id = await resolveSiteId(site, server_id, execCtx);
+		if (script !== void 0) {
+			await updateDeploymentScript({
+				server_id,
+				site_id,
+				content: script
+			}, execCtx);
+			process.stderr.write("Deployment script updated.\n");
+		}
 		const result = await deploySiteAndWait({
 			server_id,
 			site_id,
@@ -1868,9 +2212,13 @@ var handleDeploymentsCommand = createCommandRouter({
 	handlers: {
 		list: deploymentsList,
 		ls: deploymentsList,
-		deploy: deploymentsDeploy
+		deploy: deploymentsDeploy,
+		logs: [deploymentsLogs, "args"],
+		log: [deploymentsLogs, "args"],
+		script: deploymentsScript,
+		"update-script": deploymentsUpdateScript
 	},
-	writeSubcommands: ["deploy"]
+	writeSubcommands: ["deploy", "update-script"]
 });
 //#endregion
 //#region src/commands/deployments/help.ts
@@ -1886,17 +2234,68 @@ ${colors.bold("OPTIONS:")}
   --site <id>         Site ID (required)
   -f, --format <fmt>  Output format: json, human, table
 `);
-	else if (subcommand === "deploy") console.log(`
-${colors.bold("forge deployments deploy")} - Trigger a deployment
+	else if (subcommand === "logs" || subcommand === "log") console.log(`
+${colors.bold("forge deployments logs")} - Show output of a deployment (latest if no id)
 
 ${colors.bold("USAGE:")}
-  forge deployments deploy --server <server_id> --site <site_id> [options]
+  forge deployments logs [deployment_id] --server <server_id> --site <site_id>
 
 ${colors.bold("OPTIONS:")}
   --server <id>       Server ID (required)
   --site <id>         Site ID (required)
-  --stream            Stream deployment logs in real-time (default: show progress)
   -f, --format <fmt>  Output format: json, human, table
+`);
+	else if (subcommand === "script") console.log(`
+${colors.bold("forge deployments script")} - Show the deployment script of a site
+
+${colors.bold("USAGE:")}
+  forge deployments script --server <server_id> --site <site_id>
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  --site <id>         Site ID (required)
+  -f, --format <fmt>  Output format: json ({ content }), human (raw script)
+
+${colors.bold("EXAMPLES:")}
+  forge deployments script --server 123 --site 456 > deploy.sh
+`);
+	else if (subcommand === "update-script") console.log(`
+${colors.bold("forge deployments update-script")} - Update the deployment script of a site
+
+${colors.bold("USAGE:")}
+  forge deployments update-script --server <server_id> --site <site_id> --file <path>
+  forge deployments update-script --server <server_id> --site <site_id> --content <script>
+  forge deployments update-script --server <server_id> --site <site_id> --file <path> --check
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  --site <id>         Site ID (required)
+  --file <path>       Read the script from a file (use - for stdin)
+  --content <str>     Script content
+  --check             Compare with the content on Forge and do not write.
+                      Exit 0 when in sync, 1 with a line diff (- remote, + local).
+  -f, --format <fmt>  Output format: json ({ inSync, diff? } with --check), human
+
+  Give exactly one of --file or --content. An empty script is rejected.
+
+${colors.bold("EXAMPLES:")}
+  forge deployments update-script --server 123 --site 456 --file deploy.sh
+  cat deploy.sh | forge deployments update-script --server 123 --site 456 --file -
+  forge deployments update-script --server 123 --site 456 --file deploy.sh --check
+`);
+	else if (subcommand === "deploy") console.log(`
+${colors.bold("forge deployments deploy")} - Trigger a deployment
+
+${colors.bold("USAGE:")}
+  forge deployments deploy --server <server_id> --site <site_id> [options]
+
+${colors.bold("OPTIONS:")}
+  --server <id>         Server ID (required)
+  --site <id>           Site ID (required)
+  --script-file <path>  Upload this deployment script before deploying (use - for stdin).
+                        If the upload fails, the deployment does not start.
+  --stream              Stream deployment logs in real-time (default: show progress)
+  -f, --format <fmt>    Output format: json, human, table
 `);
 	else console.log(`
 ${colors.bold("forge deployments")} - Manage deployments
@@ -1910,16 +2309,96 @@ ${colors.bold("ALIASES:")}
 ${colors.bold("SUBCOMMANDS:")}
   list, ls            List deployments for a site
   deploy              Trigger a deployment
+  logs                Show output of a deployment (latest if no id)
+  script              Show the deployment script
+  update-script       Update the deployment script from a file, stdin or a string
 
 ${colors.bold("OPTIONS:")}
-  --server <id>       Server ID (required)
-  --site <id>         Site ID (required)
-  -f, --format <fmt>  Output format: json, human, table
+  --server <id>         Server ID (required)
+  --site <id>           Site ID (required)
+  --file <path>         Script file, - for stdin (for update-script)
+  --content <str>       Script content (for update-script)
+  --check               Compare with Forge, do not write (for update-script)
+  --script-file <path>  Upload this script before deploying (for deploy)
+  -f, --format <fmt>    Output format: json, human, table
 
 Run ${colors.cyan("forge deployments <subcommand> --help")} for details.
 `);
 }
 //#endregion
+//#region src/commands/env/env-diff.ts
+var NAME = /^[A-Za-z_][A-Za-z0-9_.]*$/;
+/**
+* Find the closing quote of a quoted value. `\` escapes a character in double quotes only.
+* Returns -1 when the value is not closed.
+*/
+function closingQuote(value, quote) {
+	for (let index = 1; index < value.length; index++) if (quote === "\"" && value[index] === "\\") index++;
+	else if (value[index] === quote) return index;
+	return -1;
+}
+/**
+* Parse a .env file into a map of name to value, with the dotenv rules used by Laravel:
+* an optional `export ` prefix, quoted values that can span lines, and ` #` inline comments
+* after unquoted values. Blank lines, comments and lines without a valid name are ignored,
+* so a part of a value can never show as a name.
+*/
+function parseEnv(content) {
+	const variables = /* @__PURE__ */ new Map();
+	const lines = content.split(/\r?\n/);
+	for (let index = 0; index < lines.length; index++) {
+		const line = lines[index].trim();
+		const separator = line.indexOf("=");
+		const name = line.slice(0, Math.max(separator, 0)).trim().replace(/^export\s+/, "");
+		if (!NAME.test(name)) continue;
+		let value = line.slice(separator + 1).trim();
+		const quote = value[0];
+		if (quote === "\"" || quote === "'") {
+			let end = closingQuote(value, quote);
+			while (end === -1 && index + 1 < lines.length) {
+				index++;
+				value += `\n${lines[index]}`;
+				end = closingQuote(value, quote);
+			}
+			value = value.slice(1, end === -1 ? void 0 : end);
+		} else value = value.replace(/\s+#.*$/, "");
+		variables.set(name, value);
+	}
+	return variables;
+}
+/**
+* Compare the variables of two .env files. Returns only variable names.
+*/
+function diffEnv(remote, local) {
+	const remoteVars = parseEnv(remote);
+	const localVars = parseEnv(local);
+	const result = {
+		added: [],
+		removed: [],
+		changed: []
+	};
+	for (const [name, value] of localVars) if (!remoteVars.has(name)) result.added.push(name);
+	else if (remoteVars.get(name) !== value) result.changed.push(name);
+	for (const name of remoteVars.keys()) if (!localVars.has(name)) result.removed.push(name);
+	return result;
+}
+/**
+* Turn an env diff into a drift report, or null when the variables are the same.
+* The report holds variable names only, never values, because CI logs are often shared.
+*/
+function envDrift(remote, local) {
+	const result = diffEnv(remote, local);
+	const lines = [
+		...result.added.map((name) => `+ ${name} (added)`),
+		...result.removed.map((name) => `- ${name} (removed)`),
+		...result.changed.map((name) => `~ ${name} (changed)`)
+	];
+	return lines.length > 0 ? {
+		text: lines.join("\n"),
+		json: result
+	} : null;
+}
+//#endregion
 //#region src/commands/env/handlers.ts
 async function envGet(ctx) {
 	const server = String(ctx.options.server ?? "");
@@ -1939,19 +2418,32 @@ async function envGet(ctx) {
 	}, ctx.formatter);
 }
 async function envUpdate(ctx) {
+	const usage = "forge env update --server <server_id> --site <site_id> (--file <path|-> | --content <content>) [--check]";
 	const server = String(ctx.options.server ?? "");
 	const site = String(ctx.options.site ?? "");
-	const content = String(ctx.options.content ?? "");
-	if (!server) exitWithValidationError("server_id", "forge env update --server <server_id> --site <site_id> --content <content>", ctx.formatter);
-	if (!site) exitWithValidationError("site_id", "forge env update --server <server_id> --site <site_id> --content <content>", ctx.formatter);
-	if (!content) exitWithValidationError("content", "forge env update --server <server_id> --site <site_id> --content <content>", ctx.formatter);
+	const check = Boolean(ctx.options.check);
+	if (!server) exitWithValidationError("server_id", usage, ctx.formatter);
+	if (!site) exitWithValidationError("site_id", usage, ctx.formatter);
+	const content = readContentOption(ctx.options, {
+		label: "environment file",
+		usage,
+		formatter: ctx.formatter
+	});
 	await runCommand(async () => {
 		const token = ctx.getToken();
 		const execCtx = ctx.createExecutorContext(token);
 		const server_id = await resolveServerId(server, execCtx);
+		const site_id = await resolveSiteId(site, server_id, execCtx);
+		if (check) {
+			reportDrift("environment file", envDrift((await getEnv({
+				server_id,
+				site_id
+			}, execCtx)).data, content), ctx.formatter);
+			return;
+		}
 		await updateEnv({
 			server_id,
-			site_id: await resolveSiteId(site, server_id, execCtx),
+			site_id,
 			content
 		}, execCtx);
 		ctx.formatter.success("Environment variables updated.");
@@ -1980,7 +2472,26 @@ ${colors.bold("USAGE:")}
 ${colors.bold("forge env update")} - Update environment variables
 
 ${colors.bold("USAGE:")}
+  forge env update --server <server_id> --site <site_id> --file <path>
+  forge env update --server <server_id> --site <site_id> --file <path> --check
   forge env update --server <server_id> --site <site_id> --content <env_content>
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  --site <id>         Site ID (required)
+  --file <path>       Read the content from a file (use - for stdin)
+  --content <str>     New env content
+  --check             Compare with the .env on Forge and do not write.
+                      Exit 0 when in sync, 1 when different. Prints only variable
+                      names (added, removed, changed), never values.
+  -f, --format <fmt>  Output format: json ({ inSync, diff? } with --check), human
+
+  Give exactly one of --file or --content. Empty content is rejected.
+
+${colors.bold("EXAMPLES:")}
+  forge env update --server 123 --site 456 --file .env
+  cat .env | forge env update --server 123 --site 456 --file -
+  forge env update --server 123 --site 456 --file .env --check
 `);
 	else console.log(`
 ${colors.bold("forge env")} - Manage environment variables
@@ -1995,7 +2506,9 @@ ${colors.bold("SUBCOMMANDS:")}
 ${colors.bold("OPTIONS:")}
   --server <id>       Server ID (required)
   --site <id>         Site ID (required)
+  --file <path>       Content file, - for stdin (for update)
   --content <str>     New env content (for update)
+  --check             Compare with Forge, do not write (for update)
   -f, --format <fmt>  Output format: json, human
 
 Run ${colors.cyan("forge env <subcommand> --help")} for details.
@@ -2266,19 +2779,32 @@ async function nginxGet(ctx) {
 	}, ctx.formatter);
 }
 async function nginxUpdate(ctx) {
+	const usage = "forge nginx update --server <server_id> --site <site_id> (--file <path|-> | --content <content>) [--check]";
 	const server = String(ctx.options.server ?? "");
 	const site = String(ctx.options.site ?? "");
-	const content = String(ctx.options.content ?? "");
-	if (!server) exitWithValidationError("server_id", "forge nginx update --server <server_id> --site <site_id> --content <content>", ctx.formatter);
-	if (!site) exitWithValidationError("site_id", "forge nginx update --server <server_id> --site <site_id> --content <content>", ctx.formatter);
-	if (!content) exitWithValidationError("content", "forge nginx update --server <server_id> --site <site_id> --content <content>", ctx.formatter);
+	const check = Boolean(ctx.options.check);
+	if (!server) exitWithValidationError("server_id", usage, ctx.formatter);
+	if (!site) exitWithValidationError("site_id", usage, ctx.formatter);
+	const content = readContentOption(ctx.options, {
+		label: "nginx configuration",
+		usage,
+		formatter: ctx.formatter
+	});
 	await runCommand(async () => {
 		const token = ctx.getToken();
 		const execCtx = ctx.createExecutorContext(token);
 		const server_id = await resolveServerId(server, execCtx);
+		const site_id = await resolveSiteId(site, server_id, execCtx);
+		if (check) {
+			reportTextDrift("nginx configuration", (await getNginxConfig({
+				server_id,
+				site_id
+			}, execCtx)).data, content, ctx.formatter);
+			return;
+		}
 		await updateNginxConfig({
 			server_id,
-			site_id: await resolveSiteId(site, server_id, execCtx),
+			site_id,
 			content
 		}, execCtx);
 		ctx.formatter.success("Nginx configuration updated.");
@@ -2307,7 +2833,25 @@ ${colors.bold("USAGE:")}
 ${colors.bold("forge nginx update")} - Update nginx configuration
 
 ${colors.bold("USAGE:")}
+  forge nginx update --server <server_id> --site <site_id> --file <path>
+  forge nginx update --server <server_id> --site <site_id> --file <path> --check
   forge nginx update --server <server_id> --site <site_id> --content <nginx_config>
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  --site <id>         Site ID (required)
+  --file <path>       Read the content from a file (use - for stdin)
+  --content <str>     New nginx config
+  --check             Compare with the content on Forge and do not write.
+                      Exit 0 when in sync, 1 with a line diff (- remote, + local).
+  -f, --format <fmt>  Output format: json ({ inSync, diff? } with --check), human
+
+  Give exactly one of --file or --content. Empty content is rejected.
+
+${colors.bold("EXAMPLES:")}
+  forge nginx update --server 123 --site 456 --file nginx.conf
+  cat nginx.conf | forge nginx update --server 123 --site 456 --file -
+  forge nginx update --server 123 --site 456 --file nginx.conf --check
 `);
 	else console.log(`
 ${colors.bold("forge nginx")} - Manage nginx configuration
@@ -2322,7 +2866,9 @@ ${colors.bold("SUBCOMMANDS:")}
 ${colors.bold("OPTIONS:")}
   --server <id>       Server ID (required)
   --site <id>         Site ID (required)
+  --file <path>       Content file, - for stdin (for update)
   --content <str>     New nginx config (for update)
+  --check             Compare with Forge, do not write (for update)
 
 Run ${colors.cyan("forge nginx <subcommand> --help")} for details.
 `);
@@ -2512,6 +3058,328 @@ Run ${colors.cyan("forge nginx-templates <subcommand> --help")} for details.
 `);
 }
 //#endregion
+//#region src/commands/php/handlers.ts
+var CONFIG_USAGE = "forge php config --server <server_id> --version <version> --type <cli|fpm|pool> [--user <user>]";
+var UPDATE_CONFIG_USAGE = "forge php update-config --server <server_id> --version <version> --type <cli|fpm|pool> (--file <path|-> | --content <content>) [--user <user>] [--check]";
+/**
+* Return the --server option, or exit with a validation error when it is missing.
+*/
+function requireServer(ctx, usage) {
+	const server = String(ctx.options.server ?? "");
+	if (!server) exitWithValidationError("server_id", usage, ctx.formatter);
+	return server;
+}
+/**
+* Resolve the server and run `fn` with its ID, with the CLI error handling.
+*/
+async function withServer(ctx, server, fn) {
+	await runCommand(async () => {
+		const execCtx = ctx.createExecutorContext(ctx.getToken());
+		await fn(await resolveServerId(server, execCtx), execCtx);
+	}, ctx.formatter);
+}
+/**
+* Read --version, --type and --user for the config commands.
+* Exits with a validation error when --version is missing, --type is not cli, fpm or pool,
+* or --user is given for a type other than pool.
+*/
+function requireConfigTarget(ctx, usage) {
+	const { version, type, user } = ctx.options;
+	if (typeof version !== "string" || !version) exitWithValidationError("version", usage, ctx.formatter);
+	if (typeof type !== "string" || !PHP_CONFIG_TYPES.includes(type)) exitWithError(new ValidationError(typeof type === "string" ? `Invalid --type "${type}"` : "type is required", "type", [`Valid types: ${PHP_CONFIG_TYPES.join(", ")}`, `Usage: ${usage}`]), ctx.formatter);
+	if (typeof user === "string" && user && type !== "pool") exitWithError(new ValidationError(`--user applies to --type pool only, not "${type}"`, "user", [`Usage: ${usage}`]), ctx.formatter);
+	return {
+		version,
+		type,
+		user: typeof user === "string" ? user : void 0
+	};
+}
+/**
+* Parse a whole number argument, or exit with a validation error.
+*/
+function requireWholeNumber(value, field, usage, ctx) {
+	if (value === void 0 || !/^\d+$/.test(value)) exitWithError(new ValidationError(value === void 0 ? `${field} is required` : `${field} must be a whole number: "${value}"`, field, [`Usage: ${usage}`]), ctx.formatter);
+	return Number(value);
+}
+/**
+* List the PHP versions installed on a server.
+*/
+async function phpList(ctx) {
+	await withServer(ctx, requireServer(ctx, "forge php list --server <server_id>"), async (server_id, execCtx) => {
+		const result = await listPhpVersions({ server_id }, execCtx);
+		ctx.formatter.outputList(result.data, [
+			"id",
+			"version",
+			"binary_name",
+			"status"
+		], "No PHP versions installed.", (v) => `${String(v.id).padEnd(8)} ${v.version.padEnd(6)} ${v.binary_name.padEnd(10)} ${v.status}`);
+	});
+}
+/**
+* Print a PHP configuration file (cli, fpm or pool).
+*/
+async function phpConfig(ctx) {
+	const server = requireServer(ctx, CONFIG_USAGE);
+	const target = requireConfigTarget(ctx, CONFIG_USAGE);
+	await withServer(ctx, server, async (server_id, execCtx) => {
+		const result = await getPhpConfig({
+			server_id,
+			...target
+		}, execCtx);
+		if (ctx.formatter.isJson()) console.log(JSON.stringify({ content: result.data }));
+		else console.log(result.data);
+	});
+}
+/**
+* Replace a PHP configuration file, or compare it with Forge when --check is set.
+*/
+async function phpUpdateConfig(ctx) {
+	const server = requireServer(ctx, UPDATE_CONFIG_USAGE);
+	const target = requireConfigTarget(ctx, UPDATE_CONFIG_USAGE);
+	const label = `PHP ${target.type} configuration`;
+	const content = readContentOption(ctx.options, {
+		label,
+		usage: UPDATE_CONFIG_USAGE,
+		formatter: ctx.formatter
+	});
+	await withServer(ctx, server, async (server_id, execCtx) => {
+		if (ctx.options.check) {
+			const remote = await getPhpConfig({
+				server_id,
+				...target
+			}, execCtx);
+			reportTextDrift(label, remote.data, content, ctx.formatter);
+			return;
+		}
+		await updatePhpConfig({
+			server_id,
+			...target,
+			content
+		}, execCtx);
+		ctx.formatter.success(`${label} updated.`);
+	});
+}
+/**
+* Print the PHP max upload size, in megabytes.
+*/
+async function phpMaxUploadSize(ctx) {
+	await withServer(ctx, requireServer(ctx, "forge php max-upload-size --server <server_id>"), async (server_id, execCtx) => {
+		const { data } = await getPhpMaxUploadSize({ server_id }, execCtx);
+		if (ctx.formatter.isJson()) ctx.formatter.output({ max_upload_size: data });
+		else console.log(`${data} MB`);
+	});
+}
+/**
+* Set the PHP max upload size, in megabytes.
+*/
+async function phpSetMaxUploadSize(args, ctx) {
+	const usage = "forge php set-max-upload-size <megabytes> --server <server_id>";
+	const size = requireWholeNumber(args[0], "megabytes", usage, ctx);
+	await withServer(ctx, requireServer(ctx, usage), async (server_id, execCtx) => {
+		await updatePhpMaxUploadSize({
+			server_id,
+			size
+		}, execCtx);
+		ctx.formatter.success(`PHP max upload size set to ${size} MB.`);
+	});
+}
+/**
+* Print the PHP max execution time, in seconds.
+*/
+async function phpMaxExecutionTime(ctx) {
+	await withServer(ctx, requireServer(ctx, "forge php max-execution-time --server <server_id>"), async (server_id, execCtx) => {
+		const { data } = await getPhpMaxExecutionTime({ server_id }, execCtx);
+		if (ctx.formatter.isJson()) ctx.formatter.output({ max_execution_time: data });
+		else console.log(`${data} seconds`);
+	});
+}
+/**
+* Set the PHP max execution time, in seconds.
+*/
+async function phpSetMaxExecutionTime(args, ctx) {
+	const usage = "forge php set-max-execution-time <seconds> --server <server_id>";
+	const seconds = requireWholeNumber(args[0], "seconds", usage, ctx);
+	await withServer(ctx, requireServer(ctx, usage), async (server_id, execCtx) => {
+		await updatePhpMaxExecutionTime({
+			server_id,
+			seconds
+		}, execCtx);
+		ctx.formatter.success(`PHP max execution time set to ${seconds} seconds.`);
+	});
+}
+/**
+* Print whether OPcache is enabled.
+*/
+async function phpOpcache(ctx) {
+	await withServer(ctx, requireServer(ctx, "forge php opcache --server <server_id>"), async (server_id, execCtx) => {
+		const { data } = await getPhpOpcache({ server_id }, execCtx);
+		if (ctx.formatter.isJson()) ctx.formatter.output({ opcache_enabled: data });
+		else console.log(`OPcache is ${data ? "enabled" : "disabled"}.`);
+	});
+}
+/**
+* Enable OPcache.
+*/
+async function phpEnableOpcache(ctx) {
+	await withServer(ctx, requireServer(ctx, "forge php enable-opcache --server <server_id>"), async (server_id, execCtx) => {
+		await enablePhpOpcache({ server_id }, execCtx);
+		ctx.formatter.success("OPcache enabled.");
+	});
+}
+/**
+* Disable OPcache.
+*/
+async function phpDisableOpcache(ctx) {
+	await withServer(ctx, requireServer(ctx, "forge php disable-opcache --server <server_id>"), async (server_id, execCtx) => {
+		await disablePhpOpcache({ server_id }, execCtx);
+		ctx.formatter.success("OPcache disabled.");
+	});
+}
+//#endregion
+//#region src/commands/php/command.ts
+var handlePhpCommand = createCommandRouter({
+	resource: "php",
+	handlers: {
+		list: phpList,
+		ls: phpList,
+		config: phpConfig,
+		"update-config": phpUpdateConfig,
+		"max-upload-size": phpMaxUploadSize,
+		"set-max-upload-size": [phpSetMaxUploadSize, "args"],
+		"max-execution-time": phpMaxExecutionTime,
+		"set-max-execution-time": [phpSetMaxExecutionTime, "args"],
+		opcache: phpOpcache,
+		"enable-opcache": phpEnableOpcache,
+		"disable-opcache": phpDisableOpcache
+	},
+	writeSubcommands: [
+		"update-config",
+		"set-max-upload-size",
+		"set-max-execution-time",
+		"enable-opcache",
+		"disable-opcache"
+	]
+});
+//#endregion
+//#region src/commands/php/help.ts
+function showPhpHelp(subcommand) {
+	if (subcommand === "list" || subcommand === "ls") console.log(`
+${colors.bold("forge php list")} - List the PHP versions installed on a server
+
+${colors.bold("USAGE:")}
+  forge php list --server <server_id>
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID or name (required)
+  -f, --format <fmt>  Output format: json, human, table
+
+${colors.bold("EXAMPLES:")}
+  forge php list --server 123
+`);
+	else if (subcommand === "config") console.log(`
+${colors.bold("forge php config")} - Print a PHP configuration file
+
+${colors.bold("USAGE:")}
+  forge php config --server <server_id> --version <version> --type <cli|fpm|pool>
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID or name (required)
+  --version <ver>     PHP version ID, or a version such as 8.3, php83 or php8.3 (required)
+  --type <type>       cli (CLI php.ini), fpm (FPM php.ini) or pool (FPM pool) (required)
+  --user <name>       FPM pool user (pool only)
+  -f, --format <fmt>  Output format: json ({ content }), human
+
+${colors.bold("EXAMPLES:")}
+  forge php config --server 123 --version 8.3 --type fpm
+  forge php config --server 123 --version 8.3 --type pool > www.conf
+`);
+	else if (subcommand === "update-config") console.log(`
+${colors.bold("forge php update-config")} - Replace a PHP configuration file
+
+${colors.bold("USAGE:")}
+  forge php update-config --server <server_id> --version <version> --type <cli|fpm|pool> --file <path>
+  forge php update-config --server <server_id> --version <version> --type <cli|fpm|pool> --file <path> --check
+  forge php update-config --server <server_id> --version <version> --type <cli|fpm|pool> --content <config>
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID or name (required)
+  --version <ver>     PHP version ID, or a version such as 8.3, php83 or php8.3 (required)
+  --type <type>       cli (CLI php.ini), fpm (FPM php.ini) or pool (FPM pool) (required)
+  --user <name>       FPM pool user (pool only)
+  --file <path>       Read the content from a file (use - for stdin)
+  --content <str>     New configuration file content
+  --check             Compare with the content on Forge and do not write.
+                      Exit 0 when in sync, 1 with a line diff (- remote, + local).
+  -f, --format <fmt>  Output format: json ({ inSync, diff? } with --check), human
+
+  Give exactly one of --file or --content. Empty content is rejected.
+  The content replaces the whole file.
+
+${colors.bold("EXAMPLES:")}
+  forge php update-config --server 123 --version 8.3 --type fpm --file php.ini
+  cat php.ini | forge php update-config --server 123 --version 8.3 --type cli --file -
+  forge php update-config --server 123 --version 8.3 --type fpm --file php.ini --check
+`);
+	else if (subcommand === "max-upload-size" || subcommand === "set-max-upload-size" || subcommand === "max-execution-time" || subcommand === "set-max-execution-time") console.log(`
+${colors.bold("forge php max-upload-size / max-execution-time")} - Get or set PHP limits
+
+${colors.bold("USAGE:")}
+  forge php max-upload-size --server <server_id>
+  forge php set-max-upload-size <megabytes> --server <server_id>
+  forge php max-execution-time --server <server_id>
+  forge php set-max-execution-time <seconds> --server <server_id>
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID or name (required)
+  -f, --format <fmt>  Output format: json, human
+
+${colors.bold("EXAMPLES:")}
+  forge php set-max-upload-size 128 --server 123
+  forge php set-max-execution-time 120 --server 123
+`);
+	else if (subcommand === "opcache" || subcommand === "enable-opcache" || subcommand === "disable-opcache") console.log(`
+${colors.bold("forge php opcache")} - Get, enable or disable OPcache
+
+${colors.bold("USAGE:")}
+  forge php opcache --server <server_id>
+  forge php enable-opcache --server <server_id>
+  forge php disable-opcache --server <server_id>
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID or name (required)
+  -f, --format <fmt>  Output format: json, human
+`);
+	else console.log(`
+${colors.bold("forge php")} - Manage PHP on a server
+
+${colors.bold("USAGE:")}
+  forge php <subcommand> [options]
+
+${colors.bold("SUBCOMMANDS:")}
+  list, ls                         List installed PHP versions
+  config                           Print a configuration file (--version --type)
+  update-config                    Replace a configuration file (--version --type --file|--content) [--check]
+  max-upload-size                  Print the max upload size (MB)
+  set-max-upload-size <mb>         Set the max upload size (MB)
+  max-execution-time               Print the max execution time (seconds)
+  set-max-execution-time <sec>     Set the max execution time (seconds)
+  opcache                          Print the OPcache status
+  enable-opcache                   Enable OPcache
+  disable-opcache                  Disable OPcache
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID or name (required)
+  --version <ver>     PHP version ID or version (8.3, php83) (for config commands)
+  --type <type>       cli, fpm or pool (for config commands)
+  --user <name>       FPM pool user (for --type pool)
+  --file <path>       Content file, - for stdin (for update-config)
+  --content <str>     New content (for update-config)
+  --check             Compare with Forge, do not write (for update-config)
+
+Run ${colors.cyan("forge php <subcommand> --help")} for details.
+`);
+}
+//#endregion
 //#region src/commands/recipes/handlers.ts
 async function recipesList(ctx) {
 	await runCommand(async () => {
@@ -3321,6 +4189,122 @@ Run ${colors.cyan("forge servers <subcommand> --help")} for subcommand details.
 `);
 }
 //#endregion
+//#region src/commands/services/handlers.ts
+/**
+* List services on a server with a derived availability flag.
+*/
+async function servicesList(args, ctx) {
+	const [server] = args;
+	if (!server) exitWithValidationError("server", "forge services list <server>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await listServices({ server_id: await resolveServerId(server, execCtx) }, execCtx);
+		ctx.formatter.outputList(result.data, [
+			"service",
+			"available",
+			"detail"
+		], "No services.", (row) => {
+			const status = row.available ? "yes" : "no";
+			const detail = row.detail ? ` (${row.detail})` : "";
+			return `${row.service.padEnd(12)}${status}${detail}`;
+		});
+	}, ctx.formatter);
+}
+/**
+* Restart a service on a server.
+*/
+async function servicesRestart(args, ctx) {
+	const [server, service] = args;
+	if (!server) exitWithValidationError("server", "forge services restart <server> <service>", ctx.formatter);
+	if (!service) exitWithValidationError("service", "forge services restart <server> <service>", ctx.formatter);
+	const version = typeof ctx.options.version === "string" && ctx.options.version ? ctx.options.version : void 0;
+	await runCommand(async () => {
+		if (!RESTARTABLE_SERVICES.includes(service)) throw new ValidationError(`Invalid service "${service}"`, "service", [`Valid services: ${RESTARTABLE_SERVICES.join(", ")}`]);
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const server_id = await resolveServerId(server, execCtx);
+		let resolvedVersion = version;
+		if (service === "php" && !resolvedVersion) {
+			const { data: srv } = await getServer({ server_id }, execCtx);
+			if (!srv.php_version) throw new ValidationError("The php service requires a version", "version", ["Pass --version <php_version> (e.g. --version php83)"]);
+			resolvedVersion = srv.php_version;
+		}
+		await restartService({
+			server_id,
+			service,
+			version: resolvedVersion
+		}, execCtx);
+		ctx.formatter.success(`${service} restart initiated on server ${server_id}.`);
+	}, ctx.formatter);
+}
+//#endregion
+//#region src/commands/services/command.ts
+var handleServicesCommand = createCommandRouter({
+	resource: "services",
+	handlers: {
+		list: [servicesList, "args"],
+		ls: [servicesList, "args"],
+		restart: [servicesRestart, "args"]
+	},
+	writeSubcommands: ["restart"]
+});
+//#endregion
+//#region src/commands/services/help.ts
+function showServicesHelp(subcommand) {
+	if (subcommand === "list" || subcommand === "ls") console.log(`
+${colors.bold("forge services list")} - List services on a server
+
+${colors.bold("USAGE:")}
+  forge services list <server> [options]
+
+${colors.bold("ARGUMENTS:")}
+  <server>            Server ID or name (required)
+
+${colors.bold("NOTES:")}
+  Availability is a heuristic derived from the server object — the API has
+  no services listing endpoint.
+
+${colors.bold("EXAMPLES:")}
+  forge services list 123
+  forge services list my-server --format json
+`);
+	else if (subcommand === "restart") console.log(`
+${colors.bold("forge services restart")} - Restart a service on a server
+
+${colors.bold("USAGE:")}
+  forge services restart <server> <service> [options]
+
+${colors.bold("ARGUMENTS:")}
+  <server>            Server ID or name (required)
+  <service>           One of: nginx, php, mysql, postgres, redis, supervisor
+
+${colors.bold("OPTIONS:")}
+  --version <ver>     PHP version (e.g. php83) — required for the php service
+                        (defaults to the server's php_version when omitted)
+
+${colors.bold("EXAMPLES:")}
+  forge services restart 123 nginx
+  forge services restart 123 php --version php83
+`);
+	else console.log(`
+${colors.bold("forge services")} - List and restart server services
+
+${colors.bold("USAGE:")}
+  forge services <subcommand> [options]
+
+${colors.bold("SUBCOMMANDS:")}
+  list, ls            List services on a server
+  restart <service>   Restart a service (nginx, php, mysql, postgres, redis, supervisor)
+
+${colors.bold("OPTIONS:")}
+  --version <ver>     PHP version (for the php service)
+  -f, --format <fmt>  Output format: json, human, table
+
+Run ${colors.cyan("forge services <subcommand> --help")} for details.
+`);
+}
+//#endregion
 //#region src/commands/sites/handlers.ts
 async function sitesList(ctx) {
 	const server = String(ctx.options.server ?? "");
@@ -3661,14 +4645,285 @@ async function sshKeysGet(args, ctx) {
 	}, ctx.formatter);
 }
 //#endregion
+//#region src/commands/ssh-keys/sync-plan.ts
+/**
+* Pure logic for `forge ssh-keys sync`: parse an authorized_keys file, give each key
+* a stable managed name, and compare the file with the keys on a server.
+*
+* The Forge API does not return public keys, so keys are matched by name. The name
+* ends with a fingerprint of the key, so a changed key gets a new name.
+*/
+/** The Forge API documents no name limit: keep names short enough to read in a list. */
+var MAX_SLUG_LENGTH = 40;
+var KEY_TYPE = /^(ssh-|ecdsa-sha2-|sk-)[a-z0-9@.-]+$/;
+var BASE64 = /^[A-Za-z0-9+/]+={0,2}$/;
+/**
+* Check the base64 key data of a public key, as OpenSSH does: it must be canonical
+* base64, and the decoded key must start with its own type as a length-prefixed string.
+*/
+function isValidKeyBlob(type, blob) {
+	if (!BASE64.test(blob) || blob.length % 4 !== 0) return false;
+	const data = Buffer.from(blob, "base64");
+	if (data.toString("base64") !== blob || data.length < 4) return false;
+	const typeLength = data.readUInt32BE(0);
+	return 4 + typeLength <= data.length && data.toString("latin1", 4, 4 + typeLength) === type;
+}
+/**
+* Convert a key comment to a name prefix: lowercase, `[a-z0-9-]` only, "key" when empty.
+*/
+function slugify(comment) {
+	return comment.toLowerCase().replaceAll(/[^a-z0-9]+/g, "-").slice(0, MAX_SLUG_LENGTH).replaceAll(/^-+|-+$/g, "") || "key";
+}
+/**
+* Managed name of a key: "<slug(comment)>-<first 8 hex chars of the SHA-256 of the key blob>".
+* The blob is the decoded base64 field, as in an OpenSSH fingerprint.
+*/
+function managedKeyName(comment, blob) {
+	const hash = createHash("sha256").update(Buffer.from(blob, "base64")).digest("hex");
+	return `${slugify(comment)}-${hash.slice(0, 8)}`;
+}
+/**
+* Parse an authorized_keys file: one "<type> <base64> [comment]" per line.
+* Blank lines and "#" comments are ignored.
+*
+* @throws ValidationError for a malformed or duplicate key, with its line number.
+*/
+function parseAuthorizedKeys(content) {
+	const keys = [];
+	const seen = /* @__PURE__ */ new Map();
+	for (const [index, raw] of content.split(/\r?\n/).entries()) {
+		const line = index + 1;
+		const text = raw.trim();
+		if (!text || text.startsWith("#")) continue;
+		const [type, blob = "", ...rest] = text.split(/\s+/);
+		const problem = !KEY_TYPE.test(type) ? "unknown key type" : !isValidKeyBlob(type, blob) ? "missing or invalid base64 key data" : void 0;
+		if (problem) throw new ValidationError(`Line ${line}: ${problem}, expected "<type> <base64> [comment]"`, "file", ["Use one public key per line, as in ~/.ssh/authorized_keys (no options prefix)"]);
+		const first = seen.get(blob);
+		if (first !== void 0) throw new ValidationError(`Line ${line}: duplicate of the key on line ${first}`, "file");
+		seen.set(blob, line);
+		const comment = rest.join(" ");
+		keys.push({
+			name: managedKeyName(comment, blob),
+			key: [
+				type,
+				blob,
+				comment
+			].filter(Boolean).join(" "),
+			line
+		});
+	}
+	return keys;
+}
+/**
+* Compare the file keys with the keys on a server, for one user.
+* Keys of other users are ignored.
+*/
+function planSync(fileKeys, serverKeys, user) {
+	const userKeys = serverKeys.filter((k) => k.user === user);
+	const serverNames = new Set(userKeys.map((k) => k.name));
+	const fileNames = new Set(fileKeys.map((k) => k.name));
+	return {
+		add: fileKeys.filter((k) => !serverNames.has(k.name)),
+		remove: userKeys.filter((k) => !fileNames.has(k.name)),
+		unchanged: fileKeys.filter((k) => serverNames.has(k.name))
+	};
+}
+//#endregion
+//#region src/commands/ssh-keys/sync.ts
+var USAGE = "forge ssh-keys sync --file <path|-> (--server <id>... | --all-servers) [--user <name>] [--prune] [--dry-run]";
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+/**
+* Read the --server values: repeated and/or comma separated.
+*/
+function serverValues(value) {
+	return [value].flat().filter((v) => typeof v === "string").flatMap((v) => v.split(",")).map((v) => v.trim()).filter(Boolean);
+}
+/**
+* Read and parse the --file option. Exits on a missing, unreadable, malformed or empty file.
+*/
+function readFileKeys(ctx) {
+	const { file } = ctx.options;
+	const content = readContentFile(file, "file", {
+		label: "SSH keys file",
+		usage: USAGE,
+		formatter: ctx.formatter
+	});
+	let keys;
+	try {
+		keys = parseAuthorizedKeys(content);
+	} catch (error) {
+		exitWithError(error, ctx.formatter);
+	}
+	if (keys.length === 0) exitWithError(new ValidationError(`No SSH keys found in ${String(file)}`, "file"), ctx.formatter);
+	return keys;
+}
+/**
+* Resolve the target servers to ids and names, without duplicates.
+* Names are matched against one list of servers: one API call for all targets.
+*/
+async function resolveTargets(values, allServers, execCtx) {
+	const servers = (await listServers({}, execCtx)).data;
+	if (allServers) return servers.map((s) => ({
+		id: s.id,
+		name: s.name
+	}));
+	const targets = /* @__PURE__ */ new Map();
+	for (const value of values) {
+		const id = Number(matchServerId(value, servers));
+		targets.set(id, servers.find((s) => s.id === id)?.name ?? String(id));
+	}
+	return [...targets].map(([id, name]) => ({
+		id,
+		name
+	}));
+}
+function printPlan(syncs, user, prune) {
+	for (const sync of syncs) {
+		console.log(colors.bold(`${sync.name} (${sync.id})`));
+		for (const error of sync.errors) console.log(colors.red(`  ✗ ${error}`));
+		if (!sync.plan) continue;
+		const { add, remove, unchanged } = sync.plan;
+		for (const key of add) console.log(colors.green(`  + ${key.name}`));
+		if (prune) for (const key of remove) console.log(colors.red(`  - ${key.name}`));
+		for (const key of unchanged) console.log(colors.dim(`  = ${key.name}`));
+		if (!prune && remove.length > 0) console.log(colors.yellow(`  ${remove.length} key(s) of user "${user}" not in the file are kept (use --prune to remove them)`));
+	}
+}
+function printResult(syncs) {
+	for (const sync of syncs) {
+		const summary = `${sync.name} (${sync.id}): ${sync.added.length} added, ${sync.removed.length} removed, ${sync.unchanged.length} unchanged`;
+		if (sync.errors.length === 0) {
+			console.log(colors.green(`✓ ${summary}`));
+			continue;
+		}
+		console.log(colors.red(`✗ ${summary}, ${sync.errors.length} failed`));
+		for (const error of sync.errors) console.log(colors.red(`  ${error}`));
+	}
+}
+/**
+* Apply a plan to one server. Each failed operation is recorded and the next one runs.
+* When an add fails, the removals are skipped: the user must not lose access to the server.
+*/
+async function applyPlan(sync, plan, user, prune, execCtx) {
+	const server_id = String(sync.id);
+	let addFailed = false;
+	for (const key of plan.add) try {
+		await createSshKey({
+			server_id,
+			name: key.name,
+			key: key.key,
+			user
+		}, execCtx);
+		sync.added.push(key.name);
+	} catch (error) {
+		addFailed = true;
+		sync.errors.push(`add ${key.name}: ${errorMessage(error)}`);
+	}
+	if (!prune) return;
+	for (const key of plan.remove) {
+		if (addFailed) {
+			sync.errors.push(`remove ${key.name}: skipped because an add failed`);
+			continue;
+		}
+		try {
+			await deleteSshKey({
+				server_id,
+				id: String(key.id)
+			}, execCtx);
+			sync.removed.push(key.name);
+		} catch (error) {
+			sync.errors.push(`remove ${key.name}: ${errorMessage(error)}`);
+		}
+	}
+}
+/**
+* Make the SSH keys of a user on one or more servers match an authorized_keys file.
+*/
+async function sshKeysSync(ctx) {
+	const { options, formatter } = ctx;
+	const servers = serverValues(options.server);
+	const allServers = options["all-servers"] === true;
+	const userOption = options.user;
+	const prune = options.prune === true;
+	const dryRun = options["dry-run"] === true;
+	if (options.file === void 0) exitWithValidationError("file", USAGE, formatter);
+	if (userOption !== void 0 && (typeof userOption !== "string" || userOption === "")) exitWithError(new ValidationError("--user requires a name", "user", [`Usage: ${USAGE}`]), formatter);
+	const user = typeof userOption === "string" ? userOption : "forge";
+	if (allServers && options.server !== void 0) exitWithError(new ValidationError("Use either --server or --all-servers, not both", "server", [`Usage: ${USAGE}`]), formatter);
+	if (!allServers && servers.length === 0) exitWithError(new ValidationError("A target is required: --server <id> or --all-servers", "server", [`Usage: ${USAGE}`]), formatter);
+	const fileKeys = readFileKeys(ctx);
+	const failed = await runCommand(async () => {
+		const execCtx = ctx.createExecutorContext(ctx.getToken());
+		const targets = await resolveTargets(servers, allServers, execCtx);
+		const syncs = [];
+		for (const { id, name } of targets) {
+			const sync = {
+				id,
+				name,
+				added: [],
+				removed: [],
+				unchanged: [],
+				errors: []
+			};
+			try {
+				const keys = await listSshKeys({
+					server_id: String(id),
+					user
+				}, execCtx);
+				sync.plan = planSync(fileKeys, keys.data, user);
+				sync.unchanged = sync.plan.unchanged.map((k) => k.name);
+			} catch (error) {
+				sync.errors.push(`list keys: ${errorMessage(error)}`);
+			}
+			syncs.push(sync);
+		}
+		const json = formatter.isJson();
+		if (!json) printPlan(syncs, user, prune);
+		if (dryRun) {
+			for (const sync of syncs) {
+				if (!sync.plan) continue;
+				sync.added = sync.plan.add.map((k) => k.name);
+				if (prune) sync.removed = sync.plan.remove.map((k) => k.name);
+			}
+			if (!json) console.log(colors.cyan("\nDry run: no changes made."));
+		} else {
+			for (const sync of syncs) if (sync.plan) await applyPlan(sync, sync.plan, user, prune, execCtx);
+			if (!json) {
+				console.log("");
+				printResult(syncs);
+			}
+		}
+		if (json) console.log(JSON.stringify({
+			dry_run: dryRun,
+			servers: syncs.map(({ id, name, added, removed, unchanged, errors }) => ({
+				id,
+				name,
+				added,
+				removed,
+				unchanged,
+				errors
+			}))
+		}, null, 2));
+		return syncs.reduce((count, sync) => count + sync.errors.length, 0);
+	}, formatter);
+	if (failed) {
+		if (!formatter.isJson()) formatter.error(`${failed} SSH key operation(s) failed`);
+		process.exit(ExitCode.GENERAL_ERROR);
+	}
+}
+//#endregion
 //#region src/commands/ssh-keys/command.ts
 var handleSshKeysCommand = createCommandRouter({
 	resource: "ssh-keys",
 	handlers: {
 		list: sshKeysList,
 		ls: sshKeysList,
-		get: [sshKeysGet, "args"]
-	}
+		get: [sshKeysGet, "args"],
+		sync: sshKeysSync
+	},
+	writeSubcommands: ["sync"]
 });
 //#endregion
 //#region src/commands/ssh-keys/help.ts
@@ -3684,6 +4939,41 @@ ${colors.bold("forge ssh-keys get")} - Get SSH key details
 
 ${colors.bold("USAGE:")}
   forge ssh-keys get <key_id> --server <server_id>
+`);
+	else if (subcommand === "sync") console.log(`
+${colors.bold("forge ssh-keys sync")} - Make the SSH keys of servers match a file
+
+${colors.bold("USAGE:")}
+  forge ssh-keys sync --file <path|-> --server <id> [--server <id>...] [options]
+  forge ssh-keys sync --file <path|-> --all-servers [options]
+
+${colors.bold("OPTIONS:")}
+  --file <path>       authorized_keys file: one "<type> <base64> [comment]" per line,
+                      blank lines and # comments ignored (use - for stdin)
+  --server <id>       Target server ID or name (repeatable or comma separated)
+  --all-servers       Target every server in the organization
+  --user <name>       Server user of the keys (default: forge)
+  --prune             Also remove the keys of the user that are not in the file
+  --dry-run           Print the plan and change nothing
+  -f, --format <fmt>  Output format: json, human
+
+${colors.bold("HOW IT WORKS:")}
+  Each key gets the name "<comment slug>-<first 8 hex chars of SHA-256 of the key>".
+  The Forge API does not return public keys, so keys are matched by name: a changed
+  key gets a new name. The command lists the plan per server (+ add, - remove,
+  = unchanged), applies it, then prints the result. Without --prune, keys are only
+  added. Servers run one after the other; when an operation fails, the others still
+  run and the command exits non-zero. When an add fails on a server, the removals on
+  that server are skipped, so nobody loses access.
+
+${colors.bold("JSON OUTPUT:")}
+  { "dry_run": bool, "servers": [{ id, name, added, removed, unchanged, errors }] }
+  With --dry-run, "added" and "removed" hold the planned changes, not applied ones.
+
+${colors.bold("EXAMPLES:")}
+  forge ssh-keys sync --file .forge/authorized_keys --server 123 --dry-run
+  forge ssh-keys sync --file .forge/authorized_keys --all-servers --prune
+  cat keys.pub | forge ssh-keys sync --file - --server web-1,web-2 --user deploy
 `);
 	else console.log(`
 ${colors.bold("forge ssh-keys")} - Manage SSH keys
@@ -3694,9 +4984,11 @@ ${colors.bold("USAGE:")}
 ${colors.bold("SUBCOMMANDS:")}
   list, ls            List SSH keys
   get <id>            Get SSH key details
+  sync                Make the SSH keys of servers match a file
 
 ${colors.bold("OPTIONS:")}
-  --server <id>       Server ID (required)
+  --server <id>       Server ID or name (required, except for sync --all-servers)
+  --file <path>       authorized_keys file, - for stdin (for sync)
   -f, --format <fmt>  Output format: json, human, table
 
 Run ${colors.cyan("forge ssh-keys <subcommand> --help")} for details.
@@ -3746,6 +5038,26 @@ Run ${colors.cyan("forge user <subcommand> --help")} for details.
 }
 //#endregion
 //#region src/utils/args.ts
+/**
+* Whether an argument can be the value of the option before it.
+* A lone "-" is a value (it means stdin), other "-" prefixed arguments are options.
+*/
+function isOptionValue(arg) {
+	return arg === "-" || !arg.startsWith("-");
+}
+/**
+* Options that accept several values. Every other option keeps the last value.
+*/
+var REPEATABLE = /* @__PURE__ */ new Set(["server"]);
+/**
+* Set an option value. A repeatable option given more than once collects its string
+* values into an array (`--server 1 --server 2` → `["1", "2"]`).
+*/
+function setOption(options, key, value) {
+	const previous = options[key];
+	if (REPEATABLE.has(key) && typeof value === "string" && previous !== void 0 && typeof previous !== "boolean") options[key] = [previous, value].flat();
+	else options[key] = value;
+}
 function parseArgs(argv = process.argv.slice(2)) {
 	const options = {};
 	const positional = [];
@@ -3754,24 +5066,22 @@ function parseArgs(argv = process.argv.slice(2)) {
 		const arg = argv[i];
 		if (arg.startsWith("--")) {
 			const equalIndex = arg.indexOf("=");
-			if (equalIndex > -1) {
-				const key = arg.slice(2, equalIndex);
-				options[key] = arg.slice(equalIndex + 1);
-			} else {
+			if (equalIndex > -1) setOption(options, arg.slice(2, equalIndex), arg.slice(equalIndex + 1));
+			else {
 				const key = arg.slice(2);
 				const nextArg = argv[i + 1];
-				if (nextArg !== void 0 && !nextArg.startsWith("-")) {
-					options[key] = nextArg;
+				if (nextArg !== void 0 && isOptionValue(nextArg)) {
+					setOption(options, key, nextArg);
 					i++;
-				} else options[key] = true;
+				} else setOption(options, key, true);
 			}
 		} else if (arg.startsWith("-") && arg.length > 1) if (arg.length === 2) {
 			const key = arg[1];
 			const nextArg = argv[i + 1];
-			if (nextArg !== void 0 && !nextArg.startsWith("-")) {
-				options[key] = nextArg;
+			if (nextArg !== void 0 && isOptionValue(nextArg)) {
+				setOption(options, key, nextArg);
 				i++;
-			} else options[key] = true;
+			} else setOption(options, key, true);
 		} else for (let j = 1; j < arg.length; j++) options[arg[j]] = true;
 		else if (command.length < 2) command.push(arg);
 		else positional.push(arg);
@@ -3782,9 +5092,17 @@ function parseArgs(argv = process.argv.slice(2)) {
 		positional
 	};
 }
+/**
+* Whether the arguments ask for the CLI version: a bare `--version` or `-v`
+* with no command. Commands such as `php config` and `services restart` take
+* `--version <value>`, so a bare `--version` after a command is not a version request.
+*/
+function isVersionRequest({ command, options }) {
+	return command.length === 0 && (options.version === true || options.v === true);
+}
 //#endregion
 //#region src/cli.ts
-var VERSION = "0.4.5";
+var VERSION = "0.4.7";
 function showHelp() {
 	console.log(`
 ${colors.bold("forge")} v${VERSION}
@@ -3810,6 +5128,9 @@ ${colors.bold("COMMANDS:")}
   deployments, d      Manage deployments
     list, ls            List deployments (requires --server --site)
     deploy              Trigger a deployment (requires --server --site)
+    logs [id]           Show deployment output (requires --server --site)
+    script              Show the deployment script (requires --server --site)
+    update-script       Update the deployment script (requires --server --site --file|--content) [--check]
 
   databases, db       Manage databases
     list, ls            List databases (requires --server)
@@ -3828,11 +5149,11 @@ ${colors.bold("COMMANDS:")}
 
   env                 Manage environment variables
     get                 Get env variables (requires --server --site)
-    update              Update env variables (requires --server --site --content)
+    update              Update env variables (requires --server --site --file|--content) [--check]
 
   nginx               Manage nginx configuration
     get                 Get nginx config (requires --server --site)
-    update              Update nginx config (requires --server --site --content)
+    update              Update nginx config (requires --server --site --file|--content) [--check]
 
   certificates, certs Manage SSL certificates (per-domain in v2)
     get                 Get certificate for a domain (requires --server --site --domain)
@@ -3849,6 +5170,7 @@ ${colors.bold("COMMANDS:")}
   ssh-keys            Manage SSH keys
     list, ls            List SSH keys (requires --server)
     get <id>            Get SSH key details (requires --server)
+    sync                Make server SSH keys match a file (requires --file, --server|--all-servers)
 
   backups             Manage backup configurations
     list, ls            List backup configurations (requires --server)
@@ -3867,6 +5189,24 @@ ${colors.bold("COMMANDS:")}
     create              Create a scheduled job (requires --server --command)
     delete <id>         Delete a scheduled job (requires --server)
 
+  services            List and restart server services
+    list, ls            List services on a server (forge services list <server>)
+    restart <service>   Restart a service (forge services restart <server> <service>)
+
+  php                 Manage PHP versions, configuration, limits and OPcache
+    list, ls            List installed PHP versions (requires --server)
+    config              Show a configuration file (requires --server --version --type)
+    update-config       Replace a configuration file (requires --server --version --type --file|--content) [--check]
+    max-upload-size     Show the max upload size (requires --server)
+    set-max-upload-size <mb>
+                        Set the max upload size (requires --server)
+    max-execution-time  Show the max execution time (requires --server)
+    set-max-execution-time <seconds>
+                        Set the max execution time (requires --server)
+    opcache             Show the OPcache status (requires --server)
+    enable-opcache      Enable OPcache (requires --server)
+    disable-opcache     Disable OPcache (requires --server)
+
   user                Display authenticated user profile
     get                 Get the authenticated user profile
 
@@ -3948,14 +5288,15 @@ ${colors.bold("ENVIRONMENT VARIABLES:")}
 `);
 }
 async function main() {
-	const { command, options, positional } = parseArgs();
+	const args = parseArgs();
+	const { command, options, positional } = args;
 	const [mainCommand, subcommand] = command;
 	const wantsHelp = options.help !== void 0 || options.h !== void 0;
 	if (wantsHelp && !mainCommand) {
 		showHelp();
 		process.exit(0);
 	}
-	if (options.version || options.v) {
+	if (isVersionRequest(args)) {
 		console.log(VERSION);
 		process.exit(0);
 	}
@@ -4083,6 +5424,20 @@ async function main() {
 				}
 				await handleScheduledJobsCommand(subcommand ?? "list", positional, options);
 				break;
+			case "services":
+				if (wantsHelp) {
+					showServicesHelp(subcommand);
+					process.exit(0);
+				}
+				await handleServicesCommand(subcommand ?? "list", positional, options);
+				break;
+			case "php":
+				if (wantsHelp) {
+					showPhpHelp(subcommand);
+					process.exit(0);
+				}
+				await handlePhpCommand(subcommand ?? "list", positional, options);
+				break;
 			case "user":
 				if (wantsHelp) {
 					showUserHelp(subcommand);