chore: migrate to start-sdk 2.0 and bump Bunker46 to latest upstream (0.1.0:3)

.github/workflows/build.yml

@@ -13,8 +13,6 @@ concurrency:
 jobs:
   build:
     if: github.event.pull_request.draft == false
-    uses: start9labs/shared-workflows/.github/workflows/build.yml@master
-    # with:
-    #   FREE_DISK_SPACE: true
+    uses: Start9Labs/start-technologies/.github/workflows/build.yml@master
     secrets:
       DEV_KEY: ${{ secrets.DEV_KEY }}

.github/workflows/release.yml

@@ -7,9 +7,8 @@ on:
 
 jobs:
   release:
-    uses: start9labs/shared-workflows/.github/workflows/release.yml@master
+    uses: Start9Labs/start-technologies/.github/workflows/release.yml@master
     with:
-      # FREE_DISK_SPACE: true
       RELEASE_REGISTRY: ${{ vars.RELEASE_REGISTRY }}
       S3_S9PKS_BASE_URL: ${{ vars.S3_S9PKS_BASE_URL }}
     secrets:

.github/workflows/tagAndRelease.yml

@@ -11,10 +11,9 @@ concurrency:
 
 jobs:
   tag:
-    uses: start9labs/shared-workflows/.github/workflows/tagAndRelease.yml@master
+    uses: Start9Labs/start-technologies/.github/workflows/tagAndRelease.yml@master
     with:
       REFERENCE_REGISTRY: ${{ vars.REFERENCE_REGISTRY }}
-      # FREE_DISK_SPACE: true
       RELEASE_REGISTRY: ${{ vars.RELEASE_REGISTRY }}
       S3_S9PKS_BASE_URL: ${{ vars.S3_S9PKS_BASE_URL }}
     secrets:

AGENTS.md

@@ -7,3 +7,11 @@ which provides the packaging guide and agent context one level up. If you're rea
 bare clone with no workspace, the full guide is at <https://docs.start9.com/packaging>.
 
 Work this package's `TODO.md` from top to bottom. Keep `README.md` (architecture, for developers and LLMs) and `instructions.md` (end-user docs) in sync with your changes.
+
+## This repo
+
+- **Package id is `bunker46`.** Self-hosted NIP-46 Nostr key manager. Four daemons in `main.ts`: `postgres` (bundled Postgres, subcontainer `bunker46-db`), `valkey` (Redis-compatible cache, `bunker46-valkey`), `server` (the API server, `bunker46-server`), and `web` (the web UI, `bunker46-web`). Exposes a single `ui` interface; no dependents. Secrets (Postgres password, JWT/encryption keys) are generated once and persisted in `store.json`. Postgres is backed up via `Backups.withPgDump`.
+
+## Inspecting a running install
+
+To run a command inside the service's container (read its generated config, grep app logs), use `start-cli package attach bunker46 -n <name> -- <cmd>`. Select the subcontainer by **name** with `-n` (the name passed to `SubContainer.of` in `main.ts` — e.g. `bunker46-server`, `bunker46-db`, `bunker46-web`, `bunker46-valkey`) or by image with `-i`. Note: `-s/--subcontainer` matches the internal **Guid**, not the name, so passing a name to `-s` fails with "no matching subcontainers".

Dockerfile.server

@@ -1,6 +1,6 @@
 FROM node:24-slim AS base
 
-ARG BUNKER46_REF=387d8a6f7b7d5b44ba5a414ed59e96d0e7dd4d89
+ARG BUNKER46_REF=1a9c6c3d36d48e4c48b5ea47347fec29b206cdb3
 
 RUN apt-get update -y \
   && apt-get install -y --no-install-recommends ca-certificates git openssl \

Dockerfile.web

@@ -1,6 +1,6 @@
 FROM node:24-slim AS base
 
-ARG BUNKER46_REF=387d8a6f7b7d5b44ba5a414ed59e96d0e7dd4d89
+ARG BUNKER46_REF=1a9c6c3d36d48e4c48b5ea47347fec29b206cdb3
 
 RUN apt-get update -y \
   && apt-get install -y --no-install-recommends ca-certificates git \

Makefile

@@ -1,3 +1,3 @@
 ARCHES := x86 arm
 # overrides to s9pk.mk must precede the include statement
-include s9pk.mk
+include node_modules/@start9labs/start-sdk/s9pk.mk