vela 0.11.2 → 0.11.4

package/dist/bin.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/bin.ts
-import process38 from "node:process";
+import process39 from "node:process";
 
 // src/lib/argv.ts
 function normalizeArgv(argv) {
@@ -11,7 +11,7 @@ function normalizeArgv(argv) {
 }
 
 // src/program.ts
-import process37 from "node:process";
+import process38 from "node:process";
 import * as p61 from "@clack/prompts";
 import { Command as Command104 } from "commander";
 import nodePath from "node:path";
@@ -21,7 +21,7 @@ import pc38 from "picocolors";
 // package.json
 var package_default = {
   name: "vela",
-  version: "0.11.2",
+  version: "0.11.4",
   type: "module",
   description: "A CLI for creating and updating SvelteKit projects",
   license: "MIT",
@@ -45,17 +45,19 @@ var package_default = {
     build: "node --experimental-strip-types scripts/build.ts",
     dev: "node --experimental-strip-types scripts/build.ts --watch",
     clean: "rm -rf dist",
-    lint: "npm run lint:ts && npm run lint:format",
+    lint: "npm run lint:ts && npm run lint:format && npm run lint:sh",
     "lint:ts": "tsc --noEmit",
     "lint:format": "prettier --check .",
     format: "prettier --write .",
     test: "vitest run",
-    prepare: "npm run build"
+    prepare: "npm run build",
+    "lint:sh": "shellcheck -x -P SCRIPTDIR -S warning templates/server/*.sh",
+    "test:scripts": "bash scripts/test-server-scripts.sh"
   },
   dependencies: {
     "@clack/prompts": "^1.7.0",
     "@faker-js/faker": "^10.6.0",
-    "@velastack/patterns": "^0.2.2",
+    "@velastack/patterns": "^0.2.3",
     "@velastack/pocketbase-codegen": "^0.1.0",
     "annotate-json-schema": "^0.1.0",
     commander: "^13.1.0",
@@ -83,7 +85,8 @@ var package_default = {
     prettier: "^3.9.6",
     typescript: "^5.6.0",
     vite: "^8.2.2",
-    vitest: "^4.1.11"
+    vitest: "^4.1.11",
+    shellcheck: "^4.1.0"
   },
   peerDependencies: {
     "@sveltejs/kit": "^2.57.1",
@@ -2462,7 +2465,7 @@ var form = new Command4("form").description("generate a form from a model").argu
 ).option(
   "--ai <description>",
   "design the form with AI from a natural-language description (two stages: schema \u2192 layout)"
-).allowUnknownOption(true).configureHelp(helpConfig).action(
+).allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(
   (model, fields, options) => runCommand(async () => {
     let argv;
     let modelName;
@@ -2521,7 +2524,7 @@ var form = new Command4("form").description("generate a form from a model").argu
 // src/commands/generate/schema.ts
 import { Command as Command5 } from "commander";
 import * as p12 from "@clack/prompts";
-var schema = new Command5("schema").description("generate a schema from a model").argument("[model]", "model name").argument("[fields...]", "field definitions").option("--ai <description>", "design the schema with AI from a natural-language description").allowUnknownOption(true).configureHelp(helpConfig).action(
+var schema = new Command5("schema").description("generate a schema from a model").argument("[model]", "model name").argument("[fields...]", "field definitions").option("--ai <description>", "design the schema with AI from a natural-language description").allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(
   (model, fields, options) => runCommand(async () => {
     let argv;
     let modelName;
@@ -2565,7 +2568,7 @@ var schema = new Command5("schema").description("generate a schema from a model"
 
 // src/commands/generate/resource.ts
 import { Command as Command6 } from "commander";
-var resource = new Command6("resource").description("generate a resource (model + CRUD pages)").argument("<model>", "model name").argument("[fields...]", "field definitions").allowUnknownOption(true).configureHelp(helpConfig).action(
+var resource = new Command6("resource").description("generate a resource (model + CRUD pages)").argument("<model>", "model name").argument("[fields...]", "field definitions").allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(
   (model, fields) => runCommand(
     () => runPattern(
       "generate-resource",
@@ -2598,7 +2601,7 @@ var scaffold = new Command7("scaffold").description("generate a full CRUD scaffo
 ).option(
   "--ai <description>",
   "design the scaffold with AI from a natural-language description (two stages: schema \u2192 layout)"
-).allowUnknownOption(true).configureHelp(helpConfig).action(
+).allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(
   (model, fields, options) => runCommand(async () => {
     let argv;
     let modelName;
@@ -2657,7 +2660,7 @@ var scaffold = new Command7("scaffold").description("generate a full CRUD scaffo
 
 // src/commands/generate/migration.ts
 import { Command as Command8 } from "commander";
-var migration = new Command8("migration").description("generate a migration for an existing collection").argument("<collection>", "collection name").argument("<op>", "operation (add, remove, rename, references)").argument("[args...]", 'operation arguments (e.g. "birthday:date")').allowUnknownOption(true).configureHelp(helpConfig).action(
+var migration = new Command8("migration").description("generate a migration for an existing collection").argument("<collection>", "collection name").argument("<op>", "operation (add, remove, rename, references)").argument("[args...]", 'operation arguments (e.g. "birthday:date")').allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(
   (collection, op, args) => runCommand(
     () => runPattern(
       "generate-migration",
@@ -2688,7 +2691,7 @@ import { Command as Command24 } from "commander";
 
 // src/commands/enable/auth.ts
 import { Command as Command10 } from "commander";
-var auth = new Command10("auth").description("enable authentication (email/password + OAuth scaffold)").allowUnknownOption(true).configureHelp(helpConfig).action(
+var auth = new Command10("auth").description("enable authentication (email/password + OAuth scaffold)").allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(
   (_opts, cmd) => runCommand(
     () => runPattern(
       "enable-auth",
@@ -2714,7 +2717,7 @@ var auth = new Command10("auth").description("enable authentication (email/passw
 
 // src/commands/enable/api.ts
 import { Command as Command11 } from "commander";
-var api = new Command11("api").description("enable the PocketBase REST API").allowUnknownOption(true).configureHelp(helpConfig).action(
+var api = new Command11("api").description("enable the PocketBase REST API").allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(
   (_opts, cmd) => runCommand(
     () => runPattern(
       "enable-api",
@@ -2740,7 +2743,7 @@ var api = new Command11("api").description("enable the PocketBase REST API").all
 
 // src/commands/enable/api-keys.ts
 import { Command as Command12 } from "commander";
-var apiKeys = new Command12("api-keys").description("enable API key management").allowUnknownOption(true).configureHelp(helpConfig).action(
+var apiKeys = new Command12("api-keys").description("enable API key management").allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(
   (_opts, cmd) => runCommand(
     () => runPattern(
       "enable-api-keys",
@@ -2766,7 +2769,7 @@ var apiKeys = new Command12("api-keys").description("enable API key management")
 
 // src/commands/enable/backend.ts
 import { Command as Command13 } from "commander";
-var backend = new Command13("backend").description("enable the PocketBase backend").allowUnknownOption(true).configureHelp(helpConfig).action(
+var backend = new Command13("backend").description("enable the PocketBase backend").allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(
   (_opts, cmd) => runCommand(
     () => runPattern(
       "enable-backend",
@@ -2792,7 +2795,7 @@ var backend = new Command13("backend").description("enable the PocketBase backen
 
 // src/commands/enable/i18n.ts
 import { Command as Command14 } from "commander";
-var i18n = new Command14("i18n").description("enable internationalization").allowUnknownOption(true).configureHelp(helpConfig).action(
+var i18n = new Command14("i18n").description("enable internationalization").allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(
   (_opts, cmd) => runCommand(
     () => runPattern(
       "enable-i18n",
@@ -2818,7 +2821,7 @@ var i18n = new Command14("i18n").description("enable internationalization").allo
 
 // src/commands/enable/teams.ts
 import { Command as Command15 } from "commander";
-var teams = new Command15("teams").description("enable team / multi-tenant support").allowUnknownOption(true).configureHelp(helpConfig).action(
+var teams = new Command15("teams").description("enable team / multi-tenant support").allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(
   (_opts, cmd) => runCommand(
     () => runPattern(
       "enable-teams",
@@ -2847,7 +2850,7 @@ import process9 from "node:process";
 import { Command as Command16 } from "commander";
 import * as p14 from "@clack/prompts";
 var PROVIDERS = [{ value: "stripe", label: "Stripe" }];
-var payments = new Command16("payments").description("enable payments").option("--provider <provider>", "payment provider", "stripe").allowUnknownOption(true).configureHelp(helpConfig).action(
+var payments = new Command16("payments").description("enable payments").option("--provider <provider>", "payment provider", "stripe").allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(
   (opts, cmd) => runCommand(async () => {
     const provider = await resolveProvider(opts.provider, cmd.getOptionValueSource("provider"));
     const input = {
@@ -2945,7 +2948,7 @@ async function promptPassword(message) {
 
 // src/commands/enable/subscriptions.ts
 import { Command as Command17 } from "commander";
-var subscriptions = new Command17("subscriptions").description("enable Stripe subscriptions (requires auth and payments)").allowUnknownOption(true).configureHelp(helpConfig).action(
+var subscriptions = new Command17("subscriptions").description("enable Stripe subscriptions (requires auth and payments)").allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(
   (_opts, cmd) => runCommand(
     () => runPattern(
       "enable-subscriptions",
@@ -2971,7 +2974,7 @@ var subscriptions = new Command17("subscriptions").description("enable Stripe su
 
 // src/commands/enable/notifications.ts
 import { Command as Command18 } from "commander";
-var notifications = new Command18("notifications").description("enable in-app notifications with a bell dropdown (requires auth)").allowUnknownOption(true).configureHelp(helpConfig).action(
+var notifications = new Command18("notifications").description("enable in-app notifications with a bell dropdown (requires auth)").allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(
   (_opts, cmd) => runCommand(
     () => runPattern(
       "enable-notifications",
@@ -2996,13 +2999,13 @@ var notifications = new Command18("notifications").description("enable in-app no
 );
 
 // src/commands/enable/s3.ts
-import process12 from "node:process";
+import process13 from "node:process";
 import { Command as Command19 } from "commander";
 import * as p17 from "@clack/prompts";
 import pc8 from "picocolors";
 
 // src/lib/server-command.ts
-import process11 from "node:process";
+import process12 from "node:process";
 import * as v6 from "valibot";
 import * as p15 from "@clack/prompts";
 import pc5 from "picocolors";
@@ -3133,6 +3136,7 @@ function writeBinding(workspaceRootDir, envTag, binding) {
 }
 
 // src/lib/instance.ts
+import crypto2 from "node:crypto";
 var PROD_ENV = "prod";
 var MAX_SEGMENT = 48;
 function normalizeEnvTag(tag) {
@@ -3145,9 +3149,14 @@ function normalizeEnvTag(tag) {
   }
   return normalized === "production" ? PROD_ENV : normalized;
 }
+var SLUG_HASH = 6;
 function branchToEnvTag(branch) {
-  const slug2 = branch.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, MAX_SEGMENT);
-  return `preview--${slug2}`;
+  const lower = branch.toLowerCase();
+  const slug2 = lower.replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  if (slug2 === branch && slug2.length <= MAX_SEGMENT) return `preview--${slug2}`;
+  const hash = crypto2.createHash("sha256").update(branch).digest("hex").slice(0, SLUG_HASH);
+  const head = slug2.slice(0, MAX_SEGMENT - SLUG_HASH - 1).replace(/-+$/, "");
+  return `preview--${head}-${hash}`;
 }
 function instanceId(appId, envTag = PROD_ENV) {
   const env2 = normalizeEnvTag(envTag);
@@ -3156,8 +3165,12 @@ function instanceId(appId, envTag = PROD_ENV) {
 function isProd(envTag) {
   return normalizeEnvTag(envTag) === PROD_ENV;
 }
-function releaseId(date = /* @__PURE__ */ new Date()) {
-  return date.toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
+function releaseId(date = /* @__PURE__ */ new Date(), suffix = randomSuffix()) {
+  const stamp = date.toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
+  return `${stamp}-${suffix}`;
+}
+function randomSuffix() {
+  return crypto2.randomBytes(2).toString("hex");
 }
 
 // src/lib/artifact.ts
@@ -3170,7 +3183,7 @@ import { resolveCommand as resolveCommand4 } from "package-manager-detector/comm
 import fs20 from "node:fs";
 import os3 from "node:os";
 import path19 from "node:path";
-import crypto2 from "node:crypto";
+import crypto3 from "node:crypto";
 import process10 from "node:process";
 import { spawn as spawn2 } from "node:child_process";
 var RemoteCommandError = class extends Error {
@@ -3214,7 +3227,7 @@ var SshSession = class {
     if (this.controlPath) return;
     const dir = path19.join(os3.tmpdir(), "vela-ssh");
     fs20.mkdirSync(dir, { recursive: true, mode: 448 });
-    const socket = path19.join(dir, `${crypto2.randomBytes(6).toString("hex")}.sock`);
+    const socket = path19.join(dir, `${crypto3.randomBytes(6).toString("hex")}.sock`);
     this.controlPath = socket;
     const args = [
       ...this.sshArgs(),
@@ -3562,24 +3575,75 @@ function sshOptionsFrom(options) {
 }
 
 // src/lib/remote.ts
+import crypto4 from "node:crypto";
+import fs22 from "node:fs";
 import path21 from "node:path";
+import process11 from "node:process";
 var VELA_ROOT = "/var/lib/vela";
 var VELA_ETC = "/etc/vela";
 var VELA_USER = "vela";
-var SCRIPTS_DIR = `${VELA_ROOT}/scripts`;
+var SCRIPT_VERSIONS_DIR = `${VELA_ROOT}/script-versions`;
 var PROVISIONED_MARKER = `${VELA_ETC}/provisioned`;
 var ORIGIN_FILE = `${VELA_ETC}/origin.json`;
 function serverTemplatesDir() {
   return path21.join(templatesDir(), "server");
 }
+var DIGEST_LENGTH = 12;
+function serverScriptsDigest(dir = serverTemplatesDir()) {
+  const hash = crypto4.createHash("sha256");
+  for (const file of listFiles(dir).sort()) {
+    hash.update(file).update("\0").update(fs22.readFileSync(path21.join(dir, file))).update("\0");
+  }
+  return hash.digest("hex").slice(0, DIGEST_LENGTH);
+}
+function listFiles(root, prefix = "") {
+  const files = [];
+  for (const entry of fs22.readdirSync(path21.join(root, prefix), { withFileTypes: true })) {
+    const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
+    if (entry.isDirectory()) files.push(...listFiles(root, rel));
+    else if (entry.isFile()) files.push(rel);
+  }
+  return files;
+}
+var scriptDirs = /* @__PURE__ */ new WeakMap();
 async function syncServerScripts(session) {
-  await session.script(`mkdir -p "$1" && chmod 0755 "$1"`, { args: [SCRIPTS_DIR] });
-  await session.uploadDir(serverTemplatesDir(), SCRIPTS_DIR, ["--chmod=D755,F755"]);
-  await session.script(`chown -R root:root "$1"`, { args: [SCRIPTS_DIR] });
+  const digest = serverScriptsDigest();
+  const dir = `${SCRIPT_VERSIONS_DIR}/${digest}`;
+  const present = await session.script(`[ -d "$1" ] && echo yes || echo no`, { args: [dir] });
+  if (present.stdout.trim() !== "yes") {
+    const incoming = `${SCRIPT_VERSIONS_DIR}/.incoming.${digest}.${process11.pid}.${Date.now()}`;
+    await session.script(`mkdir -p "$1" && chmod 0755 "$(dirname "$1")" "$1"`, {
+      args: [incoming]
+    });
+    await session.uploadDir(serverTemplatesDir(), incoming, ["--chmod=D755,F755"]);
+    await session.script(
+      `chown -R root:root "$1"
+			if [ -d "$2" ]; then rm -rf "$1"; else mv -T "$1" "$2" || { rm -rf "$1"; [ -d "$2" ]; }; fi`,
+      { args: [incoming, dir] }
+    );
+  }
+  await session.script(
+    `touch "$1"
+		ln -sfn "$1" "$2/.current.tmp" && mv -Tf "$2/.current.tmp" "$2/current"
+		find "$2" -mindepth 1 -maxdepth 1 -type d -name '[0-9a-f]*' ! -name "$(basename "$1")" -mtime +30 -exec rm -rf {} + 2>/dev/null || true
+		find "$2" -mindepth 1 -maxdepth 1 -type d -name '.incoming.*' -mmin +120 -exec rm -rf {} + 2>/dev/null || true`,
+    { args: [dir, SCRIPT_VERSIONS_DIR] }
+  );
+  scriptDirs.set(session, dir);
+  return dir;
+}
+async function serverTime(session) {
+  const result = await session.script(`date -u +%s`);
+  const seconds = Number(result.stdout.trim());
+  if (!Number.isFinite(seconds) || seconds <= 0) {
+    throw new Error(`could not read the clock on ${session.target}`);
+  }
+  return new Date(seconds * 1e3);
 }
 async function runServerScript(session, name, opts = {}) {
+  const dir = scriptDirs.get(session) ?? `${SCRIPT_VERSIONS_DIR}/current`;
   const result = await session.script(`script="$1"; shift; exec "$script" "$@"`, {
-    args: [`${SCRIPTS_DIR}/${name}`, ...opts.args ?? []],
+    args: [`${dir}/${name}`, ...opts.args ?? []],
     stream: opts.stream
   });
   return parseResult(result);
@@ -3653,7 +3717,7 @@ var remotePaths = {
 };
 
 // src/lib/remote-env.ts
-import fs22 from "node:fs";
+import fs23 from "node:fs";
 import dotenv from "dotenv";
 var KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
 function isValidKey(key) {
@@ -3701,7 +3765,7 @@ function quote(value) {
   return `"${escaped}"`;
 }
 function readLocalEnvFile(file) {
-  const parsed = dotenv.parse(fs22.readFileSync(file));
+  const parsed = dotenv.parse(fs23.readFileSync(file));
   const result = {};
   for (const [key, value] of Object.entries(parsed)) {
     if (isValidKey(key)) result[key] = value;
@@ -3817,6 +3881,20 @@ var SERVER_OPTIONS_SCHEMA = {
   server: v6.optional(v6.string())
 };
 var OptionsSchema = v6.object(SERVER_OPTIONS_SCHEMA);
+var DEFAULT_LOCK_WAIT = "300";
+var LOCK_WAIT_SCHEMA = {
+  lockWait: v6.optional(v6.pipe(v6.string(), v6.regex(/^\d+$/, "must be a whole number of seconds")))
+};
+function addLockWaitOption(command) {
+  return command.option(
+    "--lock-wait <seconds>",
+    "how long to wait for another operation on this target to finish before giving up",
+    DEFAULT_LOCK_WAIT
+  );
+}
+function lockWaitArgs(lockWait) {
+  return ["--lock-wait", lockWait ?? DEFAULT_LOCK_WAIT];
+}
 function addTargetOptions(command, fallback) {
   return addSshOptions(command).option("-t, --target <target>", "which copy of the app to act on", fallback).option("--server <ssh>", "server this target runs on \u2014 recorded on first use");
 }
@@ -3883,6 +3961,7 @@ async function ensureBinding(workspaceRootDir, target, request = {}) {
   const key = bindingKey(target);
   const existing = readBinding(workspaceRootDir, key);
   const moving = Boolean(request.server && existing && existing.server !== request.server);
+  if (moving) await confirmMove(target, existing.server, request.server);
   let server = request.server ?? existing?.server;
   if (!server) {
     server = await promptServer(target);
@@ -3905,12 +3984,31 @@ longer reach it. Remove it there first if that was not intended.`
   }
   return binding;
 }
+async function confirmMove(target, from, to) {
+  const name = bindingName(target);
+  if (!process12.stdout.isTTY || process12.env.CI) {
+    throw new Error(
+      `${pc5.cyan(`--server ${to}`)} does not match the server recorded for ${pc5.cyan(name)}, ${pc5.cyan(from)}.
+
+Drop ${pc5.cyan("--server")} to use the recorded one, or move the binding on purpose by running
+this command once from a terminal (or editing .vela/project.json).`
+    );
+  }
+  const ok = await p15.confirm({
+    message: `${name} ${target.kind === "preview" ? "run" : "runs"} on ${from}. Point ${name} at ${to} instead?`,
+    initialValue: false
+  });
+  if (p15.isCancel(ok) || !ok) {
+    p15.cancel("Operation cancelled.");
+    process12.exit(0);
+  }
+}
 function bindingName(target) {
   return target.kind === "preview" ? "previews" : target.name;
 }
 async function promptServer(target) {
   const name = bindingName(target);
-  if (!process11.stdout.isTTY || process11.env.CI) {
+  if (!process12.stdout.isTTY || process12.env.CI) {
     throw new Error(
       `${name} ${target.kind === "preview" ? "are" : "is"} not bound to a server yet, and there is no terminal to ask on.
 
@@ -3928,19 +4026,19 @@ and commit ${pc5.cyan(".vela/project.json")}.`
   });
   if (p15.isCancel(value)) {
     p15.cancel("Operation cancelled.");
-    process11.exit(0);
+    process12.exit(0);
   }
   return value.trim();
 }
 async function promptDomain(target) {
-  if (!process11.stdout.isTTY || process11.env.CI) return void 0;
+  if (!process12.stdout.isTTY || process12.env.CI) return void 0;
   const value = await p15.text({
     message: `Which hostname should ${target.name} be served on?`,
     placeholder: "example.com \u2014 leave blank to decide later"
   });
   if (p15.isCancel(value)) {
     p15.cancel("Operation cancelled.");
-    process11.exit(0);
+    process12.exit(0);
   }
   return value.trim() || void 0;
 }
@@ -3996,17 +4094,17 @@ function envFilePath(workspaceRootDir) {
 import pc7 from "picocolors";
 
 // src/lib/local-env.ts
-import fs23 from "node:fs";
+import fs24 from "node:fs";
 import * as p16 from "@clack/prompts";
 import pc6 from "picocolors";
 function readLocalEnv(envFile) {
-  if (!fs23.existsSync(envFile)) return {};
+  if (!fs24.existsSync(envFile)) return {};
   return readLocalEnvFile(envFile);
 }
 function editLocalEnv(envFile, edit) {
-  const before = fs23.existsSync(envFile) ? fs23.readFileSync(envFile, "utf8") : "";
+  const before = fs24.existsSync(envFile) ? fs24.readFileSync(envFile, "utf8") : "";
   const after = edit(before);
-  if (after !== before) fs23.writeFileSync(envFile, after);
+  if (after !== before) fs24.writeFileSync(envFile, after);
 }
 function setLocalEnv(envFile, key, value) {
   editLocalEnv(envFile, (content) => upsertEnvVar(content, key, value));
@@ -4138,7 +4236,7 @@ Set ${pc7.cyan("POCKETBASE_SUPERUSER_EMAIL")} and ${pc7.cyan("POCKETBASE_SUPERUS
 }
 
 // src/lib/s3-settings.ts
-import fs24 from "node:fs";
+import fs25 from "node:fs";
 import path22 from "node:path";
 var VIRTUAL_HOSTED = [/\.amazonaws\.com$/i, /\.r2\.cloudflarestorage\.com$/i];
 function defaultForcePathStyle(endpoint) {
@@ -4182,7 +4280,7 @@ async function hasLocalUploads(session, instance, workspaceRootDir) {
 function hasFile(dir) {
   let entries;
   try {
-    entries = fs24.readdirSync(dir, { withFileTypes: true });
+    entries = fs25.readdirSync(dir, { withFileTypes: true });
   } catch {
     return false;
   }
@@ -4261,8 +4359,8 @@ async function promptConfig(options, existing) {
   const bucket = options.bucket ?? await text7("S3 bucket name", existing.bucket);
   const region = options.region ?? await text7("S3 region", existing.region || "us-east-1");
   const accessKey = options.accessKey ?? await text7("S3 access key", existing.accessKey);
-  const secret = options.secret ?? process12.env.VELA_S3_SECRET ?? await password5("S3 secret key");
-  const forcePathStyle = options.forcePathStyle ?? await confirm3(
+  const secret = options.secret ?? process13.env.VELA_S3_SECRET ?? await password5("S3 secret key");
+  const forcePathStyle = options.forcePathStyle ?? await confirm4(
     "Address the bucket in the path? (MinIO, Ceph and most self-hosted gateways need this)",
     defaultForcePathStyle(endpoint)
   );
@@ -4276,7 +4374,7 @@ async function text7(message, initialValue = "") {
   });
   if (p17.isCancel(value)) {
     p17.cancel("Operation cancelled.");
-    process12.exit(0);
+    process13.exit(0);
   }
   return value.trim();
 }
@@ -4287,21 +4385,21 @@ async function password5(message) {
   });
   if (p17.isCancel(value)) {
     p17.cancel("Operation cancelled.");
-    process12.exit(0);
+    process13.exit(0);
   }
   return value;
 }
-async function confirm3(message, initialValue) {
+async function confirm4(message, initialValue) {
   const value = await p17.confirm({ message, initialValue });
   if (p17.isCancel(value)) {
     p17.cancel("Operation cancelled.");
-    process12.exit(0);
+    process13.exit(0);
   }
   return value;
 }
 
 // src/commands/enable/smtp.ts
-import process13 from "node:process";
+import process14 from "node:process";
 import { Command as Command20 } from "commander";
 import * as p18 from "@clack/prompts";
 var smtp = new Command20("smtp").description("configure SMTP for transactional email").configureHelp(helpConfig).action(
@@ -4330,7 +4428,7 @@ var smtp = new Command20("smtp").description("configure SMTP for transactional e
       {
         onCancel: () => {
           p18.cancel("Operation cancelled.");
-          process13.exit(0);
+          process14.exit(0);
         }
       }
     );
@@ -4357,47 +4455,45 @@ var smtp = new Command20("smtp").description("configure SMTP for transactional e
 );
 
 // src/commands/enable/cms.ts
-import process14 from "node:process";
+import process15 from "node:process";
 import { Command as Command21 } from "commander";
 import * as p19 from "@clack/prompts";
 import pc9 from "picocolors";
-var cms = new Command21("cms").description("enable an inline-editing CMS with an admin bar").allowUnknownOption(true).configureHelp(helpConfig).action(
-  (_opts, cmd) => runCommand(async () => {
-    if (!hasBackend()) {
+var cms = new Command21("cms").description("enable an inline-editing CMS with an admin bar").option(
+  "--endpoint <url>",
+  "read from a hosted CMS at this URL instead of installing the backend in this app"
+).allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(
+  (opts, cmd) => runCommand(async () => {
+    if (!opts.endpoint && !hasBackend()) {
       p19.log.error(
         `${pc9.cyan("vela enable cms")} needs a server to host the CMS backend, and this project is static.
 
-Run ${pc9.cyan("vela bless")} to add a backend first.`
+Run ${pc9.cyan("vela bless")} to add a backend, or point at a hosted CMS with ${pc9.cyan("vela enable cms --endpoint <url>")}.`
       );
       p19.log.message();
       p19.cancel("Operation failed.");
-      process14.exitCode = 1;
+      process15.exitCode = 1;
       return;
     }
-    await runPattern(
-      "enable-cms",
-      cmd.args,
-      {},
-      {
-        summary: "Enabled CMS.",
-        nextSteps: [
-          "Run `vela cms editor add you@example.com` to create the first editor login.",
-          "Run `vela dev`, open any page with `?edit` on the URL, and sign in from the admin bar.",
-          "Wrap page copy in `<CmsText>` and images in `<CmsImage>` to make them editable."
-        ],
-        task: {
-          title: "Enabling CMS",
-          success: "Enabled CMS",
-          error: "Failed to enable CMS"
-        }
+    await runPattern("enable-cms", cmd.args, opts.endpoint ? { endpoint: opts.endpoint } : {}, {
+      summary: "Enabled CMS.",
+      nextSteps: [
+        opts.endpoint ? "Editors are managed where the CMS is hosted, not with `vela cms editor`." : "Run `vela cms editor add you@example.com` to create the first editor login.",
+        "Run `vela dev`, open any page with `?edit` on the URL, and sign in from the admin bar.",
+        "Wrap page copy in `<CmsText>` and images in `<CmsImage>` to make them editable."
+      ],
+      task: {
+        title: "Enabling CMS",
+        success: "Enabled CMS",
+        error: "Failed to enable CMS"
       }
-    );
+    });
   }, "Failed to enable CMS.")
 );
 
 // src/commands/enable/blog.ts
 import { Command as Command22 } from "commander";
-var blog = new Command22("blog").description("enable an mdsvex blog with posts, tags, and RSS").allowUnknownOption(true).configureHelp(helpConfig).action(
+var blog = new Command22("blog").description("enable an mdsvex blog with posts, tags, and RSS").allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(
   (_opts, cmd) => runCommand(
     () => runPattern(
       "enable-blog",
@@ -4423,7 +4519,7 @@ var blog = new Command22("blog").description("enable an mdsvex blog with posts,
 
 // src/commands/enable/content-negotiation.ts
 import { Command as Command23 } from "commander";
-var contentNegotiation = new Command23("content-negotiation").description("enable content negotiation (sveltekit-negotiate)").allowUnknownOption(true).configureHelp(helpConfig).action(
+var contentNegotiation = new Command23("content-negotiation").description("enable content negotiation (sveltekit-negotiate)").allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(
   (_opts, cmd) => runCommand(
     () => runPattern(
       "enable-content-negotiation",
@@ -4456,7 +4552,7 @@ import { Command as Command35 } from "commander";
 import { Command as Command25 } from "commander";
 
 // src/commands/disable/_shared.ts
-import process15 from "node:process";
+import process16 from "node:process";
 import * as p20 from "@clack/prompts";
 async function runDisable(opts, flags, cmdArgs) {
   if (!flags.yes) {
@@ -4466,14 +4562,14 @@ async function runDisable(opts, flags, cmdArgs) {
     });
     if (p20.isCancel(ok) || !ok) {
       p20.cancel("Operation cancelled.");
-      process15.exit(0);
+      process16.exit(0);
     }
   }
   await runPattern(opts.slug, cmdArgs, { destructive: true }, opts.report);
 }
 
 // src/commands/disable/auth.ts
-var auth2 = new Command25("auth").description("disable authentication").option("-y, --yes", "skip confirmation prompt").allowUnknownOption(true).configureHelp(helpConfig).action(
+var auth2 = new Command25("auth").description("disable authentication").option("-y, --yes", "skip confirmation prompt").allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(
   (opts, cmd) => runCommand(
     () => runDisable(
       {
@@ -4500,7 +4596,7 @@ var auth2 = new Command25("auth").description("disable authentication").option("
 
 // src/commands/disable/api.ts
 import { Command as Command26 } from "commander";
-var api2 = new Command26("api").description("disable the REST API").option("-y, --yes", "skip confirmation prompt").allowUnknownOption(true).configureHelp(helpConfig).action(
+var api2 = new Command26("api").description("disable the REST API").option("-y, --yes", "skip confirmation prompt").allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(
   (opts, cmd) => runCommand(
     () => runDisable(
       {
@@ -4524,7 +4620,7 @@ var api2 = new Command26("api").description("disable the REST API").option("-y,
 
 // src/commands/disable/api-keys.ts
 import { Command as Command27 } from "commander";
-var apiKeys2 = new Command27("api-keys").description("disable API key management").option("-y, --yes", "skip confirmation prompt").allowUnknownOption(true).configureHelp(helpConfig).action(
+var apiKeys2 = new Command27("api-keys").description("disable API key management").option("-y, --yes", "skip confirmation prompt").allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(
   (opts, cmd) => runCommand(
     () => runDisable(
       {
@@ -4548,7 +4644,7 @@ var apiKeys2 = new Command27("api-keys").description("disable API key management
 
 // src/commands/disable/backend.ts
 import { Command as Command28 } from "commander";
-var backend2 = new Command28("backend").description("disable the PocketBase backend").option("-y, --yes", "skip confirmation prompt").allowUnknownOption(true).configureHelp(helpConfig).action(
+var backend2 = new Command28("backend").description("disable the PocketBase backend").option("-y, --yes", "skip confirmation prompt").allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(
   (opts, cmd) => runCommand(
     () => runDisable(
       {
@@ -4572,7 +4668,7 @@ var backend2 = new Command28("backend").description("disable the PocketBase back
 
 // src/commands/disable/content-negotiation.ts
 import { Command as Command29 } from "commander";
-var contentNegotiation2 = new Command29("content-negotiation").description("disable content negotiation").option("-y, --yes", "skip confirmation prompt").allowUnknownOption(true).configureHelp(helpConfig).action(
+var contentNegotiation2 = new Command29("content-negotiation").description("disable content negotiation").option("-y, --yes", "skip confirmation prompt").allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(
   (opts, cmd) => runCommand(
     () => runDisable(
       {
@@ -4596,7 +4692,7 @@ var contentNegotiation2 = new Command29("content-negotiation").description("disa
 
 // src/commands/disable/i18n.ts
 import { Command as Command30 } from "commander";
-var i18n2 = new Command30("i18n").description("disable internationalization").option("-y, --yes", "skip confirmation prompt").allowUnknownOption(true).configureHelp(helpConfig).action(
+var i18n2 = new Command30("i18n").description("disable internationalization").option("-y, --yes", "skip confirmation prompt").allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(
   (opts, cmd) => runCommand(
     () => runDisable(
       {
@@ -4623,7 +4719,7 @@ var i18n2 = new Command30("i18n").description("disable internationalization").op
 
 // src/commands/disable/teams.ts
 import { Command as Command31 } from "commander";
-var teams2 = new Command31("teams").description("disable teams").option("-y, --yes", "skip confirmation prompt").allowUnknownOption(true).configureHelp(helpConfig).action(
+var teams2 = new Command31("teams").description("disable teams").option("-y, --yes", "skip confirmation prompt").allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(
   (opts, cmd) => runCommand(
     () => runDisable(
       {
@@ -4650,7 +4746,7 @@ var teams2 = new Command31("teams").description("disable teams").option("-y, --y
 
 // src/commands/disable/payments.ts
 import { Command as Command32 } from "commander";
-var payments2 = new Command32("payments").description("disable payments").option("-y, --yes", "skip confirmation prompt").allowUnknownOption(true).configureHelp(helpConfig).action(
+var payments2 = new Command32("payments").description("disable payments").option("-y, --yes", "skip confirmation prompt").allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(
   (opts, cmd) => runCommand(
     () => runDisable(
       {
@@ -4737,14 +4833,14 @@ import { Command as Command41 } from "commander";
 import { Command as Command36 } from "commander";
 
 // src/commands/destroy/_shared.ts
-import process16 from "node:process";
+import process17 from "node:process";
 import * as p22 from "@clack/prompts";
 async function runDestroy(slug2, model, confirmMessage, report4, flags) {
   if (!flags.yes) {
     const ok = await p22.confirm({ message: confirmMessage, initialValue: false });
     if (p22.isCancel(ok) || !ok) {
       p22.cancel("Operation cancelled.");
-      process16.exit(0);
+      process17.exit(0);
     }
   }
   await runPattern(slug2, [model], { destructive: true, route: flags.route }, report4);
@@ -4754,7 +4850,7 @@ async function runDestroy(slug2, model, confirmMessage, report4, flags) {
 var form2 = new Command36("form").description("destroy a form generated by `vela generate form`").argument("<model>", "model name used when the form was generated (e.g., contact, login)").option("-y, --yes", "skip confirmation prompt").option(
   "--route <route>",
   "custom route the form was generated at (must match the --route used at generation)"
-).allowUnknownOption(true).configureHelp(helpConfig).action(
+).allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(
   (model, opts) => runCommand(
     () => runDestroy(
       "destroy-form",
@@ -4776,7 +4872,7 @@ var form2 = new Command36("form").description("destroy a form generated by `vela
 
 // src/commands/destroy/schema.ts
 import { Command as Command37 } from "commander";
-var schema2 = new Command37("schema").description("destroy a zod schema generated by `vela generate schema`").argument("<model>", "schema model name (e.g., contact, login)").option("-y, --yes", "skip confirmation prompt").allowUnknownOption(true).configureHelp(helpConfig).action(
+var schema2 = new Command37("schema").description("destroy a zod schema generated by `vela generate schema`").argument("<model>", "schema model name (e.g., contact, login)").option("-y, --yes", "skip confirmation prompt").allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(
   (model, opts) => runCommand(
     () => runDestroy(
       "destroy-schema",
@@ -4798,7 +4894,7 @@ var schema2 = new Command37("schema").description("destroy a zod schema generate
 
 // src/commands/destroy/resource.ts
 import { Command as Command38 } from "commander";
-var resource2 = new Command38("resource").description("destroy a resource generated by `vela generate resource`").argument("<model>", "model path used when the resource was generated (e.g., contacts, articles)").option("-y, --yes", "skip confirmation prompt").allowUnknownOption(true).configureHelp(helpConfig).action(
+var resource2 = new Command38("resource").description("destroy a resource generated by `vela generate resource`").argument("<model>", "model path used when the resource was generated (e.g., contacts, articles)").option("-y, --yes", "skip confirmation prompt").allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(
   (model, opts) => runCommand(
     () => runDestroy(
       "destroy-resource",
@@ -4823,7 +4919,7 @@ import { Command as Command39 } from "commander";
 var scaffold2 = new Command39("scaffold").description("destroy a scaffold generated by `vela generate scaffold`").argument("<model>", "model name used when the scaffold was generated (e.g., contact, todo)").option("-y, --yes", "skip confirmation prompt").option(
   "--route <route>",
   "custom route the scaffold was generated at (must match the --route used at generation)"
-).allowUnknownOption(true).configureHelp(helpConfig).action(
+).allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(
   (model, opts) => runCommand(
     () => runDestroy(
       "destroy-scaffold",
@@ -4847,11 +4943,55 @@ var scaffold2 = new Command39("scaffold").description("destroy a scaffold genera
 );
 
 // src/commands/destroy/deployment.ts
-import process17 from "node:process";
+import process18 from "node:process";
 import { Command as Command40 } from "commander";
 import * as p25 from "@clack/prompts";
 import pc13 from "picocolors";
 
+// src/lib/destroy-guard.ts
+function isPreview(envTag) {
+  return envTag.startsWith("preview--");
+}
+function destroyDecision(request) {
+  const { appName, purge, yes, confirm: confirm14, interactive } = request;
+  const dangerous = isProd(request.envTag) || purge && !isPreview(request.envTag);
+  const what = describe(request);
+  if (confirm14 !== void 0) {
+    if (confirm14 === appName) return { kind: "proceed" };
+    return {
+      kind: "refuse",
+      message: `\`--confirm ${confirm14}\` does not name this app. Removing ${what} takes \`--confirm ${appName}\`.`
+    };
+  }
+  if (dangerous) {
+    if (yes) {
+      return {
+        kind: "refuse",
+        message: `\`--yes\` is not enough to remove ${what}.
+
+Pass \`--confirm ${appName}\` as well \u2014 the app name, the same thing a terminal would ask you to type.`
+      };
+    }
+    if (interactive) return { kind: "prompt", byName: true };
+    return {
+      kind: "refuse",
+      message: `Removing ${what} needs a confirmation, and there is no terminal to ask on.
+
+Pass \`--confirm ${appName}\` \u2014 the app name, the same thing a terminal would ask you to type.`
+    };
+  }
+  if (yes) return { kind: "proceed" };
+  if (interactive) return { kind: "prompt", byName: false };
+  return {
+    kind: "refuse",
+    message: `Removing ${what} needs a confirmation, and there is no terminal to ask on. Pass \`--yes\`.`
+  };
+}
+function describe({ appName, envTag, purge }) {
+  const target = isProd(envTag) ? "production" : `the ${envTag} environment`;
+  return purge ? `${target} of ${appName} and its database` : `${target} of ${appName}`;
+}
+
 // src/lib/deploy-report.ts
 import * as p24 from "@clack/prompts";
 import pc12 from "picocolors";
@@ -5044,26 +5184,52 @@ ${pc12.dim(err instanceof Error ? err.message : String(err))}`
 }
 
 // src/commands/destroy/deployment.ts
-var deployment = addTargetOptions(
-  new Command40("deployment").description("remove a deployed environment from its server").configureHelp(helpConfig),
-  "production"
-).option("--purge", "also delete the database and uploaded files").option("-y, --yes", "skip the confirmation prompt").action(
+var deployment = addLockWaitOption(
+  addTargetOptions(
+    new Command40("deployment").description("remove a deployed environment from its server").configureHelp(helpConfig),
+    "production"
+  )
+).option("--purge", "also delete the database and uploaded files").option("-y, --yes", "skip the confirmation prompt").option(
+  "--confirm <app-name>",
+  "confirm removing production, or a purge, by typing the app name \u2014 what a terminal would ask for"
+).action(
   (raw) => runCommand(async () => {
     const options = raw;
     await withTarget(
       raw,
       {
         remote: async (ctx) => {
-          if (!options.yes) {
-            await confirm7(ctx.appName, ctx.targetName, ctx.envTag, options.purge === true);
+          const decision = destroyDecision({
+            appName: ctx.appName,
+            envTag: ctx.envTag,
+            purge: options.purge === true,
+            yes: options.yes === true,
+            confirm: options.confirm,
+            interactive: Boolean(process18.stdin.isTTY && process18.stdout.isTTY)
+          });
+          if (decision.kind === "refuse") throw new Error(decision.message);
+          if (decision.kind === "prompt") {
+            await confirm8(ctx.appName, ctx.targetName, decision.byName);
           }
           const result = await runServerScript(ctx.session, "destroy.sh", {
-            args: [ctx.instance, ...options.purge ? ["--purge"] : []],
+            args: [
+              ctx.instance,
+              ...options.purge ? ["--purge"] : [],
+              ...lockWaitArgs(options.lockWait)
+            ],
             stream: true
           });
+          if (result?.existed === false) {
+            p25.log.info(
+              `Nothing named ${pc13.cyan(`${ctx.appName} (${ctx.targetName})`)} on ${ctx.server}; nothing to remove.`
+            );
+            return;
+          }
           await reportEnvironmentDestroyed(ctx.workspaceRootDir, ctx.envTag);
           p25.log.success(
-            `Removed ${pc13.cyan(`${ctx.appName} (${ctx.targetName})`)} from ${ctx.server}.` + (result?.purged ? "" : `
+            `Removed ${pc13.cyan(`${ctx.appName} (${ctx.targetName})`)} from ${ctx.server}.` + (result?.purged ? result.trash ? `
+
+A snapshot of its data is at ${pc13.cyan(result.trash)} on the server for two weeks.` : "" : `
 
 The database and uploads are still in the instance's shared directory. Pass ${pc13.cyan("--purge")} to delete them.`)
           );
@@ -5076,15 +5242,15 @@ The database and uploads are still in the instance's shared directory. Pass ${pc
     );
   }, "Failed to remove the deployment.")
 );
-async function confirm7(appName, targetName, envTag, purge) {
-  if (isProd(envTag) || purge) {
+async function confirm8(appName, targetName, byName) {
+  if (byName) {
     const answer = await p25.text({
-      message: `This removes ${pc13.cyan(`${appName} (${targetName})`)}${purge ? " and its database" : ""}. Type the app name to confirm`,
+      message: `This removes ${pc13.cyan(`${appName} (${targetName})`)}. Type the app name to confirm`,
       validate: (value) => value === appName ? void 0 : `Type ${appName} to confirm`
     });
     if (p25.isCancel(answer)) {
       p25.cancel("Operation cancelled.");
-      process17.exit(0);
+      process18.exit(0);
     }
     return;
   }
@@ -5094,7 +5260,7 @@ async function confirm7(appName, targetName, envTag, purge) {
   });
   if (p25.isCancel(ok) || !ok) {
     p25.cancel("Operation cancelled.");
-    process17.exit(0);
+    process18.exit(0);
   }
 }
 
@@ -5378,13 +5544,13 @@ var ui = new Command47("ui").description("generate ui components").configureHelp
 import { Command as Command50 } from "commander";
 
 // src/commands/legal/terms.ts
-import fs25 from "node:fs";
+import fs26 from "node:fs";
 import path23 from "node:path";
 import { Command as Command48 } from "commander";
 import * as p32 from "@clack/prompts";
 
 // src/commands/legal/shared.ts
-import process18 from "node:process";
+import process19 from "node:process";
 import * as p31 from "@clack/prompts";
 var sharedFields = {
   websiteUrl: () => p31.text({
@@ -5453,7 +5619,7 @@ var sharedFields = {
 };
 var onCancel = () => {
   p31.cancel("Operation cancelled.");
-  process18.exit(0);
+  process19.exit(0);
 };
 async function contactMethods(type) {
   const selection = await p31.multiselect({
@@ -6046,9 +6212,9 @@ async function termsAction() {
     "+page.svelte"
   );
   const termsPageTs = path23.join(workspaceRootDir, publicRoutesDir, LEGAL_DIR, "terms", "+page.ts");
-  fs25.mkdirSync(path23.dirname(termsPage), { recursive: true });
-  fs25.writeFileSync(termsPage, html);
-  fs25.writeFileSync(
+  fs26.mkdirSync(path23.dirname(termsPage), { recursive: true });
+  fs26.writeFileSync(termsPage, html);
+  fs26.writeFileSync(
     termsPageTs,
     pageMetaTagsLoader("Terms of Service", `Terms of Service for ${core.websiteName}`)
   );
@@ -6067,7 +6233,7 @@ async function termsAction() {
 var terms = new Command48("terms").description("generate placeholder terms and conditions").configureHelp(helpConfig).action(() => runCommand(termsAction, "Failed to generate terms and conditions."));
 
 // src/commands/legal/privacy.ts
-import fs26 from "node:fs";
+import fs27 from "node:fs";
 import path24 from "node:path";
 import { Command as Command49 } from "commander";
 import * as p33 from "@clack/prompts";
@@ -6795,9 +6961,9 @@ async function privacyAction() {
     "privacy",
     "+page.ts"
   );
-  fs26.mkdirSync(path24.dirname(privacyPage), { recursive: true });
-  fs26.writeFileSync(privacyPage, html);
-  fs26.writeFileSync(
+  fs27.mkdirSync(path24.dirname(privacyPage), { recursive: true });
+  fs27.writeFileSync(privacyPage, html);
+  fs27.writeFileSync(
     privacyPageTs,
     pageMetaTagsLoader("Privacy Policy", `Privacy Policy for ${core.websiteName}`)
   );
@@ -6825,7 +6991,7 @@ import { Command as Command56 } from "commander";
 import { Command as Command51 } from "commander";
 
 // src/lib/data.ts
-import fs27 from "node:fs";
+import fs28 from "node:fs";
 import path25 from "node:path";
 import { ClientResponseError } from "pocketbase";
 
@@ -6867,8 +7033,8 @@ function dataDir(cwd, kind) {
 }
 function getDataFiles(cwd, kind) {
   const dir = dataDir(cwd, kind);
-  if (!fs27.existsSync(dir)) return [];
-  return fs27.readdirSync(dir).filter((file) => file.endsWith(".json")).sort((a, b) => a.localeCompare(b)).map((file) => ({
+  if (!fs28.existsSync(dir)) return [];
+  return fs28.readdirSync(dir).filter((file) => file.endsWith(".json")).sort((a, b) => a.localeCompare(b)).map((file) => ({
     collectionName: file.replace(/\.json$/i, "").replace(/^\d+[-_]?/, ""),
     filePath: path25.join(dir, file)
   }));
@@ -6880,7 +7046,7 @@ function getFixtureFiles(cwd) {
   return getDataFiles(cwd, "fixtures");
 }
 function readRecords(filePath) {
-  return JSON.parse(fs27.readFileSync(filePath, "utf8"));
+  return JSON.parse(fs28.readFileSync(filePath, "utf8"));
 }
 function readSeedIds(cwd) {
   const ids = /* @__PURE__ */ new Map();
@@ -7099,7 +7265,7 @@ var reset = new Command53("reset").description("clear and reload fixtures").conf
 );
 
 // src/commands/fixtures/generate.ts
-import fs28 from "node:fs";
+import fs29 from "node:fs";
 import path26 from "node:path";
 import { Command as Command54, InvalidArgumentError } from "commander";
 import * as p34 from "@clack/prompts";
@@ -7137,9 +7303,9 @@ async function loadCollections(pb) {
 }
 async function generateFixtureFiles(pb, workspaceRootDir, opts) {
   const fixturesDir = dataDir(workspaceRootDir, "fixtures");
-  fs28.mkdirSync(fixturesDir, { recursive: true });
-  for (const file of fs28.readdirSync(fixturesDir)) {
-    if (file.endsWith(".json")) fs28.unlinkSync(path26.join(fixturesDir, file));
+  fs29.mkdirSync(fixturesDir, { recursive: true });
+  for (const file of fs29.readdirSync(fixturesDir)) {
+    if (file.endsWith(".json")) fs29.unlinkSync(path26.join(fixturesDir, file));
   }
   if (opts.seed !== void 0) faker.seed(opts.seed);
   const generator = createGenerator({
@@ -7206,7 +7372,7 @@ async function generateFixtureFiles(pb, workspaceRootDir, opts) {
       items.push(record);
     }
     const filename = `${padZeros(fileIndex, 2)}-${collection.name}.json`;
-    fs28.writeFileSync(path26.join(fixturesDir, filename), JSON.stringify(items, null, 2));
+    fs29.writeFileSync(path26.join(fixturesDir, filename), JSON.stringify(items, null, 2));
     writtenFiles.push(`${path26.join(DATA_DIR, "fixtures", filename)} (${items.length} records)`);
     fileIndex++;
   }
@@ -7354,7 +7520,7 @@ var load2 = new Command57("load").description("load seeds into the database").op
 );
 
 // src/commands/seeds/save.ts
-import fs29 from "node:fs";
+import fs30 from "node:fs";
 import path27 from "node:path";
 import { Command as Command58 } from "commander";
 var padZeros2 = (num, length) => num.toString().padStart(length, "0");
@@ -7375,10 +7541,10 @@ var save = new Command58("save").description("save the current data as seeds").o
     if (existing.length > 0 && !opts.force) {
       throw new Error("Existing seed files found in data/seeds. Pass --force to overwrite.");
     }
-    fs29.mkdirSync(seedsPath, { recursive: true });
+    fs30.mkdirSync(seedsPath, { recursive: true });
     if (opts.force) {
-      for (const file of fs29.readdirSync(seedsPath)) {
-        if (file.endsWith(".json")) fs29.unlinkSync(path27.join(seedsPath, file));
+      for (const file of fs30.readdirSync(seedsPath)) {
+        if (file.endsWith(".json")) fs30.unlinkSync(path27.join(seedsPath, file));
       }
     }
     const saved = [];
@@ -7413,7 +7579,7 @@ var save = new Command58("save").description("save the current data as seeds").o
           `${padZeros2(count, 2)}-${collectionName}.json`
         );
         const seedPath = path27.join(workspaceRootDir, relativeSeedPath);
-        fs29.writeFileSync(seedPath, JSON.stringify(filtered, null, 2));
+        fs30.writeFileSync(seedPath, JSON.stringify(filtered, null, 2));
         saved.push(`${relativeSeedPath} (${filtered.length} records)`);
         count++;
       }
@@ -7625,10 +7791,10 @@ import { Command as Command65 } from "commander";
 
 // src/lib/migrate.ts
 import path28 from "node:path";
-import process19 from "node:process";
+import process20 from "node:process";
 import { x as x2 } from "tinyexec";
 async function runPocketbaseMigrate(args) {
-  const cwd = process19.cwd();
+  const cwd = process20.cwd();
   const { getBinaryPath } = await import("pocketbase-server");
   const binaryPath = getBinaryPath();
   await x2(
@@ -7685,13 +7851,13 @@ var down = new Command66("down").alias("rollback").description("revert the last
 );
 
 // src/commands/migrate/create.ts
-import fs30 from "node:fs";
+import fs31 from "node:fs";
 import path29 from "node:path";
-import process20 from "node:process";
+import process21 from "node:process";
 import { Command as Command67 } from "commander";
 var create2 = new Command67("create").alias("new").description("create a new blank migration").argument("<name>", "migration name (snake_case)").configureHelp(helpConfig).action(
   (name) => runCommand(async () => {
-    const cwd = process20.cwd();
+    const cwd = process21.cwd();
     const before = listMigrationFiles(cwd);
     await runPocketbaseMigrate(["create", name]);
     const after = listMigrationFiles(cwd);
@@ -7708,18 +7874,18 @@ var create2 = new Command67("create").alias("new").description("create a new bla
 );
 function listMigrationFiles(cwd) {
   const dir = path29.join(cwd, MIGRATIONS_DIR);
-  if (!fs30.existsSync(dir)) return /* @__PURE__ */ new Set();
-  return new Set(fs30.readdirSync(dir).filter((f) => /\.[jt]s$/.test(f)));
+  if (!fs31.existsSync(dir)) return /* @__PURE__ */ new Set();
+  return new Set(fs31.readdirSync(dir).filter((f) => /\.[jt]s$/.test(f)));
 }
 
 // src/commands/migrate/collections.ts
-import fs31 from "node:fs";
+import fs32 from "node:fs";
 import path30 from "node:path";
-import process21 from "node:process";
+import process22 from "node:process";
 import { Command as Command68 } from "commander";
 var collections = new Command68("collections").alias("snapshot").description("snapshot local collections into a new migration").configureHelp(helpConfig).action(
   () => runCommand(async () => {
-    const cwd = process21.cwd();
+    const cwd = process22.cwd();
     const before = listMigrationFiles2(cwd);
     await runPocketbaseMigrate(["collections"]);
     const after = listMigrationFiles2(cwd);
@@ -7743,8 +7909,8 @@ var collections = new Command68("collections").alias("snapshot").description("sn
 );
 function listMigrationFiles2(cwd) {
   const dir = path30.join(cwd, MIGRATIONS_DIR);
-  if (!fs31.existsSync(dir)) return /* @__PURE__ */ new Set();
-  return new Set(fs31.readdirSync(dir).filter((f) => /\.[jt]s$/.test(f)));
+  if (!fs32.existsSync(dir)) return /* @__PURE__ */ new Set();
+  return new Set(fs32.readdirSync(dir).filter((f) => /\.[jt]s$/.test(f)));
 }
 
 // src/commands/migrate/history-sync.ts
@@ -7763,9 +7929,9 @@ var historySync = new Command69("history-sync").description("drop _migrations ro
 var migrate = new Command70("migrate").description("manage database migrations").configureHelp(helpConfig).action(() => runCommand(runMigrateUp, "Failed to run migrations.")).addCommand(up).addCommand(down).addCommand(create2).addCommand(collections).addCommand(historySync);
 
 // src/commands/dev.ts
-import fs32 from "node:fs";
+import fs33 from "node:fs";
 import path32 from "node:path";
-import process23 from "node:process";
+import process24 from "node:process";
 import { performance } from "node:perf_hooks";
 import { Command as Command71, InvalidArgumentError as InvalidArgumentError4 } from "commander";
 import pc15 from "picocolors";
@@ -7773,7 +7939,7 @@ import PocketBase4 from "pocketbase";
 
 // src/lib/vite.ts
 import path31 from "node:path";
-import process22 from "node:process";
+import process23 from "node:process";
 import { createRequire as createRequire2 } from "node:module";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 import pc14 from "picocolors";
@@ -7797,13 +7963,13 @@ function resolveProjectVite(cwd) {
     return null;
   }
 }
-async function loadVite(cwd = process22.cwd()) {
+async function loadVite(cwd = process23.cwd()) {
   const entry = resolveProjectVite(cwd);
   const vite = entry ? await import(pathToFileURL2(entry).href) : await import("vite");
   const error = viteVersionError(vite.version);
   if (error) {
     console.error(`${pc14.redBright("\u2717")} ${error}`);
-    process22.exit(1);
+    process23.exit(1);
   }
   return vite;
 }
@@ -7817,18 +7983,18 @@ function parsePort(value) {
   return port;
 }
 var dev = new Command71("dev").description("start the development server").option("--open [path]", "open the app in a browser once the server is ready").option("--host [host]", "expose the server on the network").option("--port <port>", "port to listen on", parsePort).option("--strictPort", "exit if the port is already in use instead of taking the next one").option("--cors", "enable CORS").option("--force", "re-bundle dependencies, ignoring the optimizer cache").configureHelp(helpConfig).action(async (options) => {
-  const cwd = process23.cwd();
-  process23.env.VELA_DATA_DIR ??= localDataDir(cwd);
+  const cwd = process24.cwd();
+  process24.env.VELA_DATA_DIR ??= localDataDir(cwd);
   const startTime = performance.now();
   const { createServer, version } = await loadVite(cwd);
   const viteMetadataDir = path32.join(cwd, "node_modules", ".vite");
   const viteMetadataFile = path32.join(viteMetadataDir, "_pocketbase_metadata.json");
   let pbProc;
   const backend3 = hasBackend(cwd);
-  const needsStart = backend3 && !process23.env.POCKETBASE_URL;
+  const needsStart = backend3 && !process24.env.POCKETBASE_URL;
   const cleanup = () => {
     if (pbProc?.pid) pbProc.kill();
-    if (fs32.existsSync(viteMetadataFile)) fs32.rmSync(viteMetadataFile);
+    if (fs33.existsSync(viteMetadataFile)) fs33.rmSync(viteMetadataFile);
   };
   if (needsStart) {
     const dataDir2 = path32.join(cwd, DATA_DIR);
@@ -7840,15 +8006,15 @@ var dev = new Command71("dev").description("start the development server").optio
       stdio: "pipe"
     });
     pbProc = started.proc;
-    process23.env.POCKETBASE_URL = started.url;
-    pbProc.stdout?.pipe(process23.stdout);
-    pbProc.stderr?.pipe(process23.stderr);
+    process24.env.POCKETBASE_URL = started.url;
+    pbProc.stdout?.pipe(process24.stdout);
+    pbProc.stderr?.pipe(process24.stderr);
     pbProc.on("error", (err) => console.error("PocketBase error:", err));
     pbProc.on("exit", (code) => console.log(`PocketBase exited with code ${code}`));
-    process23.on("exit", cleanup);
-    process23.on("SIGINT", () => {
+    process24.on("exit", cleanup);
+    process24.on("SIGINT", () => {
       cleanup();
-      process23.exit(0);
+      process24.exit(0);
     });
   }
   const serverOptions = {};
@@ -7866,25 +8032,25 @@ var dev = new Command71("dev").description("start the development server").optio
     if (!backend3) return;
     const { address, port: vitePort } = server.httpServer.address();
     const viteHost = address === "::1" ? "localhost" : address;
-    await fs32.promises.mkdir(viteMetadataDir, { recursive: true });
-    await fs32.promises.writeFile(
+    await fs33.promises.mkdir(viteMetadataDir, { recursive: true });
+    await fs33.promises.writeFile(
       viteMetadataFile,
       JSON.stringify({
-        pocketbaseUrl: process23.env.POCKETBASE_URL,
+        pocketbaseUrl: process24.env.POCKETBASE_URL,
         vitePort,
         viteHost
       })
     );
-    const pb = new PocketBase4(process23.env.POCKETBASE_URL);
+    const pb = new PocketBase4(process24.env.POCKETBASE_URL);
     await pb.collection("_superusers").authWithPassword(
-      process23.env.POCKETBASE_SUPERUSER_EMAIL,
-      process23.env.POCKETBASE_SUPERUSER_PASSWORD
+      process24.env.POCKETBASE_SUPERUSER_EMAIL,
+      process24.env.POCKETBASE_SUPERUSER_PASSWORD
     );
     await pb.settings.update({ meta: { appURL: `http://${viteHost}:${vitePort}` } });
     await startWatchingTypes(cwd, pb);
   });
   await server.listen();
-  const hasExistingLogs = process23.stdout.bytesWritten > 0 || process23.stderr.bytesWritten > 0;
+  const hasExistingLogs = process24.stdout.bytesWritten > 0 || process24.stderr.bytesWritten > 0;
   const startupDurationString = pc15.dim(
     `ready in ${pc15.reset(pc15.bold(Math.ceil(performance.now() - startTime)))} ms`
   );
@@ -7908,9 +8074,9 @@ async function startWatchingTypes(cwd, pb) {
   void (async () => {
     for (; ; ) {
       try {
-        await fs32.promises.mkdir(pocketbaseDir, { recursive: true });
-        for await (const event of fs32.promises.watch(pocketbaseDir)) {
-          if (event.eventType === "rename" && event.filename === "$types.d.ts" && !fs32.existsSync(pocketbaseTypes)) {
+        await fs33.promises.mkdir(pocketbaseDir, { recursive: true });
+        for await (const event of fs33.promises.watch(pocketbaseDir)) {
+          if (event.eventType === "rename" && event.filename === "$types.d.ts" && !fs33.existsSync(pocketbaseTypes)) {
             setTimeout(regenerate, 100);
           }
         }
@@ -7922,9 +8088,9 @@ async function startWatchingTypes(cwd, pb) {
 }
 
 // src/commands/build.ts
-import fs33 from "node:fs";
+import fs34 from "node:fs";
 import path33 from "node:path";
-import process25 from "node:process";
+import process26 from "node:process";
 import { Command as Command72 } from "commander";
 import * as p40 from "@clack/prompts";
 import pc16 from "picocolors";
@@ -7939,10 +8105,10 @@ function applyBuildEnv(cwd, env2 = process.env) {
 }
 
 // src/lib/origin.ts
-import process24 from "node:process";
+import process25 from "node:process";
 function resolveOrigin(workspaceRootDir, envTag, config = {}) {
   return normalizeOrigin(
-    process24.env.VELA_ORIGIN ?? readBinding(workspaceRootDir, envTag)?.domain ?? config.deploy?.domain
+    process25.env.VELA_ORIGIN ?? readBinding(workspaceRootDir, envTag)?.domain ?? config.deploy?.domain
   );
 }
 function normalizeOrigin(value) {
@@ -7963,12 +8129,12 @@ function splitHosts(value) {
 // src/commands/build.ts
 var PRERENDERED_DIR = path33.join(".svelte-kit", "output", "prerendered");
 var build = new Command72("build").description("build the app").configureHelp(helpConfig).option("-t, --target <target>", "which copy of the app to build for", PRODUCTION_TARGET).action(async (options) => {
-  const cwd = process25.cwd();
+  const cwd = process26.cwd();
   applyBuildEnv(cwd);
   const origin = await originForBuild(cwd, options.target);
-  if (origin) process25.env.VELA_ORIGIN = origin;
+  if (origin) process26.env.VELA_ORIGIN = origin;
   let pbProc;
-  const needsStart = hasBackend(cwd) && !process25.env.POCKETBASE_URL;
+  const needsStart = hasBackend(cwd) && !process26.env.POCKETBASE_URL;
   const cleanup = () => {
     if (pbProc?.pid) pbProc.kill();
   };
@@ -7982,11 +8148,11 @@ var build = new Command72("build").description("build the app").configureHelp(he
       dev: true
     });
     pbProc = started.proc;
-    process25.env.POCKETBASE_URL = started.url;
-    process25.on("exit", cleanup);
-    process25.on("SIGINT", () => {
+    process26.env.POCKETBASE_URL = started.url;
+    process26.on("exit", cleanup);
+    process26.on("SIGINT", () => {
       cleanup();
-      process25.exit(0);
+      process26.exit(0);
     });
   }
   try {
@@ -8018,7 +8184,7 @@ async function originForBuild(cwd, target) {
 }
 function warnIfPrerendered(cwd) {
   const dir = path33.join(cwd, PRERENDERED_DIR);
-  if (!fs33.existsSync(dir) || fs33.readdirSync(dir).length === 0) return;
+  if (!fs34.existsSync(dir) || fs34.readdirSync(dir).length === 0) return;
   p40.log.warn(
     `Prerendered pages were built with no domain configured, so their canonical
 links point at SvelteKit's placeholder host rather than at this site.
@@ -8029,16 +8195,16 @@ Set one with ${pc16.cyan("vela deploy --domain example.com")}, or pass ${pc16.cy
 
 // src/commands/preview.ts
 import path34 from "node:path";
-import process26 from "node:process";
+import process27 from "node:process";
 import { Command as Command73 } from "commander";
 import { x as x4 } from "tinyexec";
 import { detect as detect6 } from "package-manager-detector";
 import { resolveCommand as resolveCommand6 } from "package-manager-detector/commands";
 var preview = new Command73("preview").description("preview the built app").configureHelp(helpConfig).action(async () => {
-  const cwd = process26.cwd();
-  process26.env.VELA_DATA_DIR ??= localDataDir(cwd);
+  const cwd = process27.cwd();
+  process27.env.VELA_DATA_DIR ??= localDataDir(cwd);
   let pbProc;
-  const needsStart = hasBackend(cwd) && !process26.env.POCKETBASE_URL;
+  const needsStart = hasBackend(cwd) && !process27.env.POCKETBASE_URL;
   const cleanup = () => {
     if (pbProc?.pid) pbProc.kill();
   };
@@ -8051,11 +8217,11 @@ var preview = new Command73("preview").description("preview the built app").conf
       dev: true
     });
     pbProc = started.proc;
-    process26.env.POCKETBASE_URL = started.url;
-    process26.on("exit", cleanup);
-    process26.on("SIGINT", () => {
+    process27.env.POCKETBASE_URL = started.url;
+    process27.on("exit", cleanup);
+    process27.on("SIGINT", () => {
       cleanup();
-      process26.exit(0);
+      process27.exit(0);
     });
   }
   try {
@@ -8141,23 +8307,23 @@ var provision = addSshOptions(
 
 // src/commands/deploy.ts
 import path37 from "node:path";
-import fs35 from "node:fs";
+import fs36 from "node:fs";
 import { Command as Command76, Option as Option2 } from "commander";
 import * as p42 from "@clack/prompts";
 import pc18 from "picocolors";
 import * as v8 from "valibot";
 
 // src/lib/pocketbase-settings.ts
-import fs34 from "node:fs";
+import fs35 from "node:fs";
 import path36 from "node:path";
-import process27 from "node:process";
+import process28 from "node:process";
 import PocketBase5 from "pocketbase";
 var COPIED_KEYS = ["appName", "senderName", "senderAddress"];
 async function readLocalMeta(cwd) {
   const dataDir2 = path36.join(cwd, DATA_DIR);
-  if (!fs34.existsSync(dataDir2)) return null;
-  const email3 = process27.env.POCKETBASE_SUPERUSER_EMAIL;
-  const password11 = process27.env.POCKETBASE_SUPERUSER_PASSWORD;
+  if (!fs35.existsSync(dataDir2)) return null;
+  const email3 = process28.env.POCKETBASE_SUPERUSER_EMAIL;
+  const password11 = process28.env.POCKETBASE_SUPERUSER_PASSWORD;
   if (!email3 || !password11) return null;
   let proc;
   try {
@@ -8210,6 +8376,7 @@ var OptionsSchema3 = v8.object({
   ...SSH_OPTION_SCHEMA,
   env: v8.optional(v8.string()),
   project: v8.optional(v8.string()),
+  ...LOCK_WAIT_SCHEMA,
   remoteDb: v8.optional(v8.boolean()),
   domain: v8.optional(v8.string()),
   healthPath: v8.optional(v8.string()),
@@ -8217,9 +8384,11 @@ var OptionsSchema3 = v8.object({
   pbVersion: v8.optional(v8.string()),
   build: v8.optional(v8.boolean())
 });
-var deploy = addTargetOptions(
-  new Command76("deploy").description("deploy the app").configureHelp(helpConfig),
-  "production"
+var deploy = addLockWaitOption(
+  addTargetOptions(
+    new Command76("deploy").description("deploy the app").configureHelp(helpConfig),
+    "production"
+  )
 ).option("--project <name>", "override the project name").option("--domain <hosts>", "hostname(s) to serve on, comma separated").option("--health-path <path>", "path the health check requests").option("--keep <count>", "how many old releases to keep on the server").option("--pb-version <version>", "PocketBase version to run").option("--no-build", "deploy the existing build output without rebuilding").addOption(
   new Option2(
     "--remote-db",
@@ -8233,7 +8402,6 @@ var deploy = addTargetOptions(
   (raw) => runCommand(async () => {
     const options = parseOptions(OptionsSchema3, raw);
     const backend3 = hasBackend();
-    const release = releaseId();
     p42.intro(pc18.bgCyan(pc18.black(" vela deploy ")));
     await withTarget(
       raw,
@@ -8244,8 +8412,9 @@ var deploy = addTargetOptions(
             `${pc18.cyan(ctx.appName)} ${pc18.dim("\u2192")} ${pc18.cyan(ctx.targetName)} ${pc18.dim(`(${ctx.server})`)}`
           );
           const [existing] = await readInstanceStates(session, instance);
-          const isPreview = ctx.target.kind === "preview";
-          const configured = options.domain ?? (isPreview ? existing?.domain : ctx.binding.domain ?? config.deploy?.domain ?? existing?.domain) ?? "";
+          const release = releaseId(await serverTimeOrLocal(session));
+          const isPreview2 = ctx.target.kind === "preview";
+          const configured = options.domain ?? (isPreview2 ? existing?.domain : ctx.binding.domain ?? config.deploy?.domain ?? existing?.domain) ?? "";
           const askedForRemoteDb = options.remoteDb ?? config.deploy?.buildAgainstRemote;
           const remoteDb = askedForRemoteDb ?? Boolean(existing?.pbPort);
           const sha = await gitSha(workspaceRootDir);
@@ -8267,17 +8436,17 @@ var deploy = addTargetOptions(
           const managed = managedHosts.join(",");
           const primaryHost = directHosts[0] ?? managedHosts[0] ?? "";
           const primaryUrl = started?.environment.primaryUrl || normalizeOrigin(primaryHost) || "";
-          if (isPreview && !primaryHost) {
-            throw new Error(
-              `Nothing routes to this preview.
+          let result = null;
+          try {
+            if (isPreview2 && !primaryHost) {
+              throw new Error(
+                `Nothing routes to this preview.
 
 Previews get a free velastack.app hostname from velastack.dev: ${pc18.cyan("vela link")} the
 project and ${pc18.cyan("vela login")} (or set ${pc18.cyan("VELA_API_KEY")}). Or pass ${pc18.cyan("--domain <host>")}
 with DNS of your own pointing at ${ctx.server}.`
-            );
-          }
-          let result = null;
-          try {
+              );
+            }
             if (options.build !== false) {
               const origin = normalizeOrigin(process.env.VELA_ORIGIN ?? primaryUrl);
               let buildEnv = origin ? { VELA_ORIGIN: origin } : {};
@@ -8335,7 +8504,8 @@ ${pc18.dim(String(err))}`
                 "--pb-version",
                 options.pbVersion ?? config.deploy?.pocketbaseVersion ?? pocketbaseVersion(),
                 "--git-sha",
-                sha
+                sha,
+                ...lockWaitArgs(options.lockWait)
               ],
               stream: true
             });
@@ -8349,7 +8519,7 @@ ${pc18.dim(String(err))}`
           writeBinding(
             workspaceRootDir,
             bindingKey(ctx.target),
-            isPreview ? { server: ctx.server } : { server: ctx.server, domain: domain || void 0 }
+            isPreview2 ? { server: ctx.server } : { server: ctx.server, domain: domain || void 0 }
           );
           if (!existing) await reportEmptyEnvironment(session, instance, workspaceRootDir);
           const url = result?.url ?? "";
@@ -8500,7 +8670,7 @@ async function superuserAuthenticates(port, identity, password11) {
 }
 async function uploadRelease(session, instance, release, entries) {
   const dir = remotePaths.release(instance, release);
-  await session.script(`mkdir -p "$1"`, { args: [dir] });
+  await session.script(`mkdir -p "$(dirname "$1")" && mkdir "$1"`, { args: [dir] });
   const byTarget = /* @__PURE__ */ new Map();
   for (const entry of entries) {
     const target = entry.remoteDir ? `${dir}/${entry.remoteDir}` : dir;
@@ -8514,7 +8684,7 @@ async function uploadRelease(session, instance, release, entries) {
 }
 function isDirectory(target) {
   try {
-    return fs35.statSync(target).isDirectory();
+    return fs36.statSync(target).isDirectory();
   } catch {
     return false;
   }
@@ -8522,7 +8692,7 @@ function isDirectory(target) {
 async function reportEmptyEnvironment(session, instance, workspaceRootDir) {
   const remote = await readRemoteEnv(session, instance);
   if (Object.keys(remote).length > 0) return;
-  if (!fs35.existsSync(path37.join(workspaceRootDir, ".env"))) return;
+  if (!fs36.existsSync(path37.join(workspaceRootDir, ".env"))) return;
   p42.log.warn(
     `This app has no production environment variables yet.
 
@@ -8530,10 +8700,18 @@ Local ${pc18.cyan(".env")} values are not uploaded by a deploy. Set them with
 ${pc18.cyan("vela env set KEY")}, or copy a file across with ${pc18.cyan("vela env import .env.production")}.`
   );
 }
+async function serverTimeOrLocal(session) {
+  try {
+    return await serverTime(session);
+  } catch {
+    p42.log.warn("Could not read the clock on the server; stamping this release from this machine.");
+    return /* @__PURE__ */ new Date();
+  }
+}
 
 // src/commands/link.ts
 import path38 from "node:path";
-import process28 from "node:process";
+import process29 from "node:process";
 import { Command as Command77 } from "commander";
 import * as p43 from "@clack/prompts";
 var CREATE_NEW = "__new__";
@@ -8584,7 +8762,7 @@ async function pickExistingProject(projects) {
   });
   if (p43.isCancel(choice)) {
     p43.cancel("Operation cancelled.");
-    process28.exit(0);
+    process29.exit(0);
   }
   return choice;
 }
@@ -8599,7 +8777,7 @@ async function pickTeam(teams3) {
   });
   if (p43.isCancel(choice)) {
     p43.cancel("Operation cancelled.");
-    process28.exit(0);
+    process29.exit(0);
   }
   return teams3.find((team) => team.id === choice);
 }
@@ -8614,7 +8792,7 @@ async function promptProjectName(workspaceRootDir) {
   });
   if (p43.isCancel(value)) {
     p43.cancel("Operation cancelled.");
-    process28.exit(0);
+    process29.exit(0);
   }
   return value.trim();
 }
@@ -8669,7 +8847,7 @@ function report(keys, where) {
 }
 
 // src/commands/env/set.ts
-import process29 from "node:process";
+import process30 from "node:process";
 import { Command as Command79 } from "commander";
 import * as p45 from "@clack/prompts";
 import pc20 from "picocolors";
@@ -8711,7 +8889,7 @@ async function promptValue(key) {
   });
   if (p45.isCancel(value)) {
     p45.cancel("Operation cancelled.");
-    process29.exit(0);
+    process30.exit(0);
   }
   return value;
 }
@@ -8756,9 +8934,9 @@ var envUnset = addTargetOptions(
 );
 
 // src/commands/env/import.ts
-import fs36 from "node:fs";
+import fs37 from "node:fs";
 import path39 from "node:path";
-import process30 from "node:process";
+import process31 from "node:process";
 import { Command as Command81 } from "commander";
 import * as p47 from "@clack/prompts";
 import pc22 from "picocolors";
@@ -8803,10 +8981,10 @@ var envImport = addTargetOptions(
   )
 );
 function resolve(file) {
-  return path39.resolve(process30.cwd(), file);
+  return path39.resolve(process31.cwd(), file);
 }
 function read(resolved, shown) {
-  if (!fs36.existsSync(resolved)) throw new Error(`${shown} does not exist.`);
+  if (!fs37.existsSync(resolved)) throw new Error(`${shown} does not exist.`);
   const incoming = readLocalEnvFile(resolved);
   if (Object.keys(incoming).length === 0) p47.log.info(`${shown} has no variables to import.`);
   return incoming;
@@ -8855,10 +9033,10 @@ function report2(states, json) {
     return;
   }
   for (const state of states) {
-    p48.log.info(describe(state));
+    p48.log.info(describe2(state));
   }
 }
-function describe(state) {
+function describe2(state) {
   const health = (value) => value === "active" ? pc23.green(value) : pc23.red(value || "inactive");
   const rows = [
     ["Instance", state.instance],
@@ -8882,9 +9060,11 @@ function describe(state) {
 import { Command as Command84 } from "commander";
 import * as p49 from "@clack/prompts";
 import pc24 from "picocolors";
-var rollback = addTargetOptions(
-  new Command84("rollback").description("put the previous release back").configureHelp(helpConfig),
-  "production"
+var rollback = addLockWaitOption(
+  addTargetOptions(
+    new Command84("rollback").description("put the previous release back").configureHelp(helpConfig),
+    "production"
+  )
 ).option("--to <release>", "roll back to a specific release instead of the previous one").action(
   (raw) => runCommand(async () => {
     const options = raw;
@@ -8899,7 +9079,11 @@ var rollback = addTargetOptions(
             ctx.session,
             "rollback.sh",
             {
-              args: [ctx.instance, ...options.to ? ["--to", options.to] : []],
+              args: [
+                ctx.instance,
+                ...options.to ? ["--to", options.to] : [],
+                ...lockWaitArgs(options.lockWait)
+              ],
               stream: true
             }
           );
@@ -8956,7 +9140,7 @@ var logs = addTargetOptions(
 import { Command as Command87 } from "commander";
 
 // src/commands/admin/create.ts
-import process31 from "node:process";
+import process32 from "node:process";
 import { Command as Command86 } from "commander";
 import * as p50 from "@clack/prompts";
 import pc25 from "picocolors";
@@ -9023,7 +9207,7 @@ async function upsertSuperuser(pb, email3, password11) {
     });
     if (p50.isCancel(confirmed) || !confirmed) {
       p50.cancel("Operation cancelled.");
-      process31.exit(0);
+      process32.exit(0);
     }
     await pb.collection("_superusers").update(existing, { password: password11, passwordConfirm: password11 });
     p50.log.success(`Password updated for ${pc25.cyan(email3)}, you can sign in now`);
@@ -9047,7 +9231,7 @@ async function promptEmail() {
   });
   if (p50.isCancel(value)) {
     p50.cancel("Operation cancelled.");
-    process31.exit(0);
+    process32.exit(0);
   }
   return value.trim();
 }
@@ -9058,7 +9242,7 @@ async function promptPassword2() {
   });
   if (p50.isCancel(value)) {
     p50.cancel("Operation cancelled.");
-    process31.exit(0);
+    process32.exit(0);
   }
   const again = await p50.password({
     message: "Password again",
@@ -9066,7 +9250,7 @@ async function promptPassword2() {
   });
   if (p50.isCancel(again)) {
     p50.cancel("Operation cancelled.");
-    process31.exit(0);
+    process32.exit(0);
   }
   return value;
 }
@@ -9078,7 +9262,7 @@ var admin = new Command87("admin").description("manage admin panel logins").conf
 import { Command as Command93 } from "commander";
 
 // src/commands/backup/create.ts
-import fs37 from "node:fs";
+import fs38 from "node:fs";
 import path40 from "node:path";
 import { Command as Command88 } from "commander";
 import * as p51 from "@clack/prompts";
@@ -9234,10 +9418,10 @@ Your bucket's own versioning is what protects the uploaded files.`
 );
 async function download(ctx, key, outputDir) {
   const dir = path40.resolve(ctx.workspaceRootDir, outputDir);
-  fs37.mkdirSync(dir, { recursive: true });
+  fs38.mkdirSync(dir, { recursive: true });
   const destination = path40.join(dir, key);
   if (!ctx.session) {
-    fs37.copyFileSync(path40.join(ctx.workspaceRootDir, "data", "backups", key), destination);
+    fs38.copyFileSync(path40.join(ctx.workspaceRootDir, "data", "backups", key), destination);
     return path40.relative(ctx.workspaceRootDir, destination);
   }
   const spinner7 = p51.spinner();
@@ -9283,7 +9467,7 @@ Take one with ${pc27.cyan("vela backup create")}.`
 );
 
 // src/commands/backup/download.ts
-import fs38 from "node:fs";
+import fs39 from "node:fs";
 import path41 from "node:path";
 import { Command as Command90 } from "commander";
 import * as p53 from "@clack/prompts";
@@ -9312,10 +9496,10 @@ Fetch it from the bucket directly \u2014 vela does not hold its credentials.`
         );
       }
       const dir = path41.resolve(ctx.workspaceRootDir, options.output);
-      fs38.mkdirSync(dir, { recursive: true });
+      fs39.mkdirSync(dir, { recursive: true });
       const destination = path41.join(dir, key);
       if (!ctx.session) {
-        fs38.copyFileSync(path41.join(ctx.workspaceRootDir, "data", "backups", key), destination);
+        fs39.copyFileSync(path41.join(ctx.workspaceRootDir, "data", "backups", key), destination);
       } else {
         const spinner7 = p53.spinner();
         spinner7.start(`Downloading ${key} (${formatBytes(found.size)})`);
@@ -9336,7 +9520,7 @@ Fetch it from the bucket directly \u2014 vela does not hold its credentials.`
 );
 
 // src/commands/backup/delete.ts
-import process32 from "node:process";
+import process33 from "node:process";
 import { Command as Command91 } from "commander";
 import * as p54 from "@clack/prompts";
 import pc29 from "picocolors";
@@ -9362,7 +9546,7 @@ Run ${pc29.cyan("vela backup list")} to see what it does have.`
         });
         if (p54.isCancel(confirmed) || !confirmed) {
           p54.cancel("Operation cancelled.");
-          process32.exit(0);
+          process33.exit(0);
         }
       }
       await ctx.pb.backups.delete(key);
@@ -9424,15 +9608,17 @@ Set one with ${pc30.cyan('vela backup schedule "0 3 * * *"')}.`
 var backup = new Command93("backup").description("back up the database and uploads, locally or on a target").configureHelp(helpConfig).addCommand(backupCreate).addCommand(backupList).addCommand(backupDownload).addCommand(backupDelete).addCommand(backupSchedule);
 
 // src/commands/restore.ts
-import fs39 from "node:fs";
+import fs40 from "node:fs";
 import path42 from "node:path";
-import process33 from "node:process";
+import process34 from "node:process";
 import { Command as Command94 } from "commander";
 import * as p56 from "@clack/prompts";
 import pc31 from "picocolors";
-var restore = addTargetOptions(
-  new Command94("restore").description("replace a deployment\u2019s database and uploads from a backup").argument("[source]", "a backup key on the target, or a path to a local archive").configureHelp(helpConfig),
-  "production"
+var restore = addLockWaitOption(
+  addTargetOptions(
+    new Command94("restore").description("replace a deployment\u2019s database and uploads from a backup").argument("[source]", "a backup key on the target, or a path to a local archive").configureHelp(helpConfig),
+    "production"
+  )
 ).option("-y, --yes", "skip the confirmation prompt").option("--no-migrate", "do not run migrations against the restored database").option("--keep-previous <n>", "how many replaced databases to keep", "1").action(
   (source, raw) => runCommand(async () => {
     const options = raw;
@@ -9446,10 +9632,10 @@ var restore = addTargetOptions(
               `${ctx.targetName} was deployed without a database, so there is nothing to restore.`
             );
           }
-          const local = source && fs39.existsSync(source) ? source : void 0;
+          const local = source && fs40.existsSync(source) ? source : void 0;
           const key = local ? void 0 : await resolveKey(ctx, source);
           if (!options.yes) {
-            await confirm12(ctx.appName, ctx.targetName, ctx.envTag, local ?? key);
+            await confirm13(ctx.appName, ctx.targetName, ctx.envTag, local ?? key);
           }
           const archive = local ? await stage(ctx, local) : remotePaths.backup(ctx.instance, key);
           const result = await runServerScript(ctx.session, "restore.sh", {
@@ -9462,7 +9648,8 @@ var restore = addTargetOptions(
               ...options.migrate ? [] : ["--no-migrate"],
               // A copy this machine pushed up is scratch; one already in the
               // instance's own backups directory is not ours to delete.
-              ...local ? ["--cleanup-archive"] : []
+              ...local ? ["--cleanup-archive"] : [],
+              ...lockWaitArgs(options.lockWait)
             ],
             stream: true
           });
@@ -9528,7 +9715,7 @@ Take one with ${pc31.cyan("vela backup create")}, or pass the path to an archive
   });
   if (p56.isCancel(chosen)) {
     p56.cancel("Operation cancelled.");
-    process33.exit(0);
+    process34.exit(0);
   }
   return chosen;
 }
@@ -9547,7 +9734,7 @@ async function stage(ctx, file) {
   spinner7.stop(`Uploaded ${path42.basename(file)}`);
   return remote;
 }
-async function confirm12(appName, targetName, envTag, from) {
+async function confirm13(appName, targetName, envTag, from) {
   const what = `${pc31.cyan(`${appName} (${targetName})`)} from ${pc31.cyan(path42.basename(from))}`;
   if (isProd(envTag)) {
     const answer = await p56.text({
@@ -9556,7 +9743,7 @@ async function confirm12(appName, targetName, envTag, from) {
     });
     if (p56.isCancel(answer)) {
       p56.cancel("Operation cancelled.");
-      process33.exit(0);
+      process34.exit(0);
     }
     return;
   }
@@ -9566,7 +9753,7 @@ async function confirm12(appName, targetName, envTag, from) {
   });
   if (p56.isCancel(ok) || !ok) {
     p56.cancel("Operation cancelled.");
-    process33.exit(0);
+    process34.exit(0);
   }
 }
 
@@ -9660,20 +9847,20 @@ Release and domain are shown from what this project recorded.`
 
 // src/commands/test.ts
 import path43 from "node:path";
-import process34 from "node:process";
+import process35 from "node:process";
 import { Command as Command96 } from "commander";
 import PocketBase6 from "pocketbase";
 import pc33 from "picocolors";
 import { x as x5 } from "tinyexec";
 import { detect as detect7 } from "package-manager-detector";
 import { resolveCommand as resolveCommand7 } from "package-manager-detector/commands";
-import fs40 from "node:fs";
+import fs41 from "node:fs";
 var testServer = new Command96("test:server").description("run server tests").allowUnknownOption(true).allowExcessArguments(true).configureHelp(helpConfig).action(async (_opts, cmd) => {
-  const cwd = process34.cwd();
+  const cwd = process35.cwd();
   const email3 = `test-${Math.random().toString(36).slice(2)}@example.com`;
   const password11 = "password";
   const testDataDir = path43.join(cwd, "test-data");
-  fs40.rmSync(testDataDir, { recursive: true, force: true });
+  fs41.rmSync(testDataDir, { recursive: true, force: true });
   const { stop, url } = await launchPocketbase(cwd, {
     dir: testDataDir,
     migrationsDir: path43.join(cwd, MIGRATIONS_DIR),
@@ -9684,11 +9871,11 @@ var testServer = new Command96("test:server").description("run server tests").al
     email: email3,
     password: password11
   });
-  process34.env.POCKETBASE_URL = url;
-  process34.env.POCKETBASE_SUPERUSER_EMAIL = email3;
-  process34.env.POCKETBASE_SUPERUSER_PASSWORD = password11;
-  process34.env.VELA_DATA_DIR = testDataDir;
-  process34.env.TEST = "true";
+  process35.env.POCKETBASE_URL = url;
+  process35.env.POCKETBASE_SUPERUSER_EMAIL = email3;
+  process35.env.POCKETBASE_SUPERUSER_PASSWORD = password11;
+  process35.env.VELA_DATA_DIR = testDataDir;
+  process35.env.TEST = "true";
   console.log(`${pc33.greenBright("\u2713")} Created test database`);
   let vite;
   let cleanedUp = false;
@@ -9696,7 +9883,7 @@ var testServer = new Command96("test:server").description("run server tests").al
     if (cleanedUp) return;
     cleanedUp = true;
     stop();
-    fs40.rmSync(testDataDir, { recursive: true, force: true });
+    fs41.rmSync(testDataDir, { recursive: true, force: true });
   };
   const cleanup = async () => {
     if (cleanedUp) return;
@@ -9707,12 +9894,12 @@ var testServer = new Command96("test:server").description("run server tests").al
   const fail = async (message) => {
     console.error(`${pc33.redBright("\u2717")} ${message}`);
     await cleanup();
-    process34.exit(1);
+    process35.exit(1);
   };
-  process34.on("exit", cleanupSync);
-  process34.on("SIGINT", () => {
+  process35.on("exit", cleanupSync);
+  process35.on("SIGINT", () => {
     cleanupSync();
-    process34.exit(130);
+    process35.exit(130);
   });
   const pb = new PocketBase6(url);
   try {
@@ -9740,7 +9927,7 @@ var testServer = new Command96("test:server").description("run server tests").al
   });
   const vitePort = await findFreePort();
   await vite.listen(vitePort);
-  process34.env.VITE_TEST_URL = `http://localhost:${vitePort}`;
+  process35.env.VITE_TEST_URL = `http://localhost:${vitePort}`;
   console.log(`${pc33.greenBright("\u2713")} Started Vite: http://localhost:${vitePort}`);
   console.log(`${pc33.greenBright("\u2713")} Started PocketBase: ${url}`);
   const extraArgs = (cmd.parent?.args ?? []).slice(1);
@@ -9759,12 +9946,12 @@ var testServer = new Command96("test:server").description("run server tests").al
     const resolvedArgs = resolved.args.slice();
     if (pm === "npm") resolvedArgs.unshift("--yes");
     const result = await x5(resolved.command, resolvedArgs, {
-      nodeOptions: { cwd, stdio: "inherit", env: { ...process34.env, CI: "1" } }
+      nodeOptions: { cwd, stdio: "inherit", env: { ...process35.env, CI: "1" } }
     });
-    process34.exitCode = result.exitCode ?? 1;
+    process35.exitCode = result.exitCode ?? 1;
   } catch (e) {
     console.error(`${pc33.redBright("\u2717")} ${e.message}`);
-    process34.exitCode = 1;
+    process35.exitCode = 1;
   } finally {
     await cleanup();
   }
@@ -9795,7 +9982,7 @@ function stubPagesPlugin() {
 }
 
 // src/commands/routes.ts
-import fs41 from "node:fs";
+import fs42 from "node:fs";
 import path44 from "node:path";
 import { Command as Command97 } from "commander";
 var HTTP_METHODS = /* @__PURE__ */ new Set([
@@ -9816,7 +10003,7 @@ var routes = new Command97("routes").description("list routes").configureHelp(he
   printTable(found);
 });
 function walk(root, dir) {
-  const entries = fs41.readdirSync(dir, { withFileTypes: true });
+  const entries = fs42.readdirSync(dir, { withFileTypes: true });
   const routes2 = [];
   const hasLeaf = entries.some((e) => e.isFile() && isRouteFile(e.name));
   if (hasLeaf) {
@@ -9842,7 +10029,7 @@ function isRouteFile(name) {
 }
 function extractMethods(file) {
   try {
-    const content = fs41.readFileSync(file, "utf8");
+    const content = fs42.readFileSync(file, "utf8");
     const methods = [];
     const exportRegex = /export\s+(?:const|async\s+function|function)\s+(\w+)/g;
     let match;
@@ -9883,13 +10070,13 @@ function printTable(routes2) {
 }
 
 // src/commands/i18n.ts
-import process35 from "node:process";
+import process36 from "node:process";
 import { Command as Command98 } from "commander";
 import { x as x6 } from "tinyexec";
 import { detect as detect8 } from "package-manager-detector";
 import { resolveCommand as resolveCommand8 } from "package-manager-detector/commands";
 async function runWuchale(extraArgs) {
-  const cwd = process35.cwd();
+  const cwd = process36.cwd();
   const pm = (await detect8({ cwd }))?.name ?? "npm";
   const resolved = resolveCommand8(pm, "execute", ["wuchale", ...extraArgs]);
   const args = resolved.args.slice();
@@ -9926,7 +10113,7 @@ import pc35 from "picocolors";
 // src/lib/cms-backend.ts
 import { createRequire as createRequire3 } from "node:module";
 import path45 from "node:path";
-import process36 from "node:process";
+import process37 from "node:process";
 import { pathToFileURL as pathToFileURL3 } from "node:url";
 import pc34 from "picocolors";
 var DEFAULT_PROJECT = "default";
@@ -9943,7 +10130,7 @@ Run ${pc34.cyan("vela enable cms")} first.`
   }
   return await import(pathToFileURL3(entry).href);
 }
-async function withCmsBackend(fn, cwd = process36.cwd()) {
+async function withCmsBackend(fn, cwd = process37.cwd()) {
   const root = findWorkspaceRoot(cwd);
   if (!root) {
     throw new Error("Could not find workspace root (no package.json found)");
@@ -10062,7 +10249,7 @@ var SELF_CREDENTIALED_COMMANDS = /* @__PURE__ */ new Set(["test:server"]);
 var program = new Command104().name(package_default.name).description(package_default.description).version(package_default.version, "-v, --version").configureHelp(helpConfig);
 program.hook("preAction", (_thisCommand, actionCommand) => {
   if (isStub(actionCommand)) return;
-  const envRoot = findWorkspaceRoot() ?? process37.cwd();
+  const envRoot = findWorkspaceRoot() ?? process38.cwd();
   dotenv2.config({ path: nodePath.join(envRoot, ".env"), quiet: true });
   const path46 = getCommandPath(actionCommand);
   if (NO_BACKEND_COMMMANDS.has(path46)) return;
@@ -10079,10 +10266,10 @@ To add a backend to this project, run ${pc38.cyan("vela bless")}.`
     );
     p61.log.message();
     p61.cancel("Operation failed.");
-    process37.exit(1);
+    process38.exit(1);
   }
   if (SELF_CREDENTIALED_COMMANDS.has(path46)) return;
-  if (!process37.env.POCKETBASE_SUPERUSER_EMAIL || !process37.env.POCKETBASE_SUPERUSER_PASSWORD) {
+  if (!process38.env.POCKETBASE_SUPERUSER_EMAIL || !process38.env.POCKETBASE_SUPERUSER_PASSWORD) {
     p61.log.error(
       `PocketBase superuser credentials are required.
 
@@ -10093,7 +10280,7 @@ To set up an existing project, run ${pc38.cyan("vela bless")}.`
     );
     p61.log.message();
     p61.cancel("Operation failed.");
-    process37.exit(1);
+    process38.exit(1);
   }
 });
 function getCommandPath(cmd) {
@@ -10147,5 +10334,5 @@ for (const command of [
 }
 
 // src/bin.ts
-program.parse(normalizeArgv(process38.argv.slice(2)), { from: "user" });
+program.parse(normalizeArgv(process39.argv.slice(2)), { from: "user" });
 //# sourceMappingURL=bin.js.map