@absolutejs/deploy 0.2.0 → 0.3.0

package/README.md

@@ -154,6 +154,40 @@ interface so you can BYO `request(method, path, body?)` for retry /
 observability — the bundled `createDigitalOceanClient(token)` is just
 a sensible default.
 
+## `@absolutejs/deploy/hetzner` — provision-or-reuse from code (0.3.0)
+
+Same shape as the DigitalOcean adapter, Hetzner Cloud v1 API
+mappings underneath. Hetzner-specific differences: locations
+(`nbg1` / `fsn1` / `hel1` / `ash` / `hil`), server types
+(`cx22` / `cpx11` / `ccx13` / …), labels (key-value, not array),
+and public-net IPv4/IPv6 are independently toggleable.
+
+```ts
+import { createDeployer } from '@absolutejs/deploy';
+import { hetznerTarget } from '@absolutejs/deploy/hetzner';
+
+const target = await hetznerTarget({
+  token: process.env.HETZNER_TOKEN!,
+  name: 'absolutejs-prod-1',
+  location: 'nbg1',
+  serverType: 'cx22',
+  image: 'ubuntu-22.04',
+  sshKeys: [process.env.HETZNER_KEY_FINGERPRINT!],
+  labels: { env: 'prod', team: 'platform' },
+  userData: '#!/bin/bash\ncurl -fsSL https://bun.sh/install | bash',
+});
+
+const deployer = createDeployer({ appName: 'my-app', target });
+await deployer.deploy({ source: { kind: 'directory', path: './build' } });
+await target.destroy();
+```
+
+Hetzner enforces unique server names per project, so the
+idempotency contract is structural — `name` collisions never
+happen. Admin helpers: `listHetznerServers({ token, labelSelector?
+})` (Hetzner's `'env=prod'` / `'env in (prod,staging)'` syntax);
+`destroyHetznerServer({ token, id })` (404 idempotent success).
+
 ## DigitalOcean Droplet — first deploy (manual)
 
 Assuming a fresh Ubuntu/Debian Droplet:
@@ -173,9 +207,9 @@ bun run my-deploy-script.ts
 
 The first run creates `/srv/<appName>/releases/<id>/`, drops a systemd unit at `/etc/systemd/system/<appName>.service` (if you're using `systemdManager`), starts the service, and probes. Subsequent runs just add a new release dir and swap the symlink.
 
-## What v0.2.0 does NOT include
+## What v0.3.0 does NOT include
 
-- Provider-specific HTTP-API adapters beyond DigitalOcean (Cloudflare Workers, Fly Machines, AWS Fargate, GCP Cloud Run). Hetzner / Linode / Vultr follow the same shape as `digitalOceanTarget` and are next on the list.
+- Provider-specific HTTP-API adapters beyond DigitalOcean + Hetzner (Cloudflare Workers, Fly Machines, AWS Fargate, GCP Cloud Run). Linode / Vultr follow the same shape and are next on the list.
 - Bun installation on the remote — caller does it once, out of band.
 - Multi-target / fan-out deploys (caller iterates).
 - Zero-downtime port-swap (start new release on a fresh port, then nginx-reload). The default pipeline does stop-then-start; for true zero-downtime, replace the `restart` step.

package/dist/hetzner.d.ts

@@ -0,0 +1,153 @@
+/**
+ * @absolutejs/deploy/hetzner — provision-or-reuse Target adapter for
+ * Hetzner Cloud servers. Sibling to {@link digitalOceanTarget}; same
+ * shape, different API.
+ *
+ * What it does:
+ *
+ *   1. Looks up a server by `name`. If present and running, reuses it.
+ *   2. If not present, creates it via the Hetzner Cloud v1 API and
+ *      waits for `status === 'running'` with a public IPv4 assigned.
+ *   3. Waits for SSH readiness (TCP connect on port 22 with backoff,
+ *      or a caller-supplied probe).
+ *   4. Returns a Target that wraps sshTarget against the server's
+ *      public IPv4, plus `serverId`, `ipv4`, and a `destroy()` helper.
+ *
+ * Idempotent by name — Hetzner enforces unique server names per
+ * project, so calling twice with the same name returns the same
+ * server.
+ *
+ * Narrow HetznerClientLike interface keeps the official `hcloud-js`
+ * SDK out as a hard dep. Default client uses `fetch` against
+ * `api.hetzner.cloud/v1`; pass your own for retry / observability.
+ */
+import type { Target } from './targets';
+/**
+ * Minimal subset of Hetzner Cloud API calls we make. Lets callers
+ * BYO a client with retry / observability / etc.
+ */
+export type HetznerClientLike = {
+    request: <T = unknown>(method: 'GET' | 'POST' | 'DELETE', path: string, body?: unknown) => Promise<T>;
+};
+/** A Hetzner Cloud server, narrowed to what we inspect. */
+export type HetznerServer = {
+    id: number;
+    name: string;
+    status: 'initializing' | 'starting' | 'running' | 'stopping' | 'off' | 'deleting' | 'migrating' | 'rebuilding' | 'unknown';
+    public_net: {
+        ipv4: {
+            id: number;
+            ip: string;
+            blocked: boolean;
+            dns_ptr?: string;
+        } | null;
+        ipv6: {
+            id: number;
+            ip: string;
+            blocked: boolean;
+        } | null;
+    };
+    server_type?: {
+        name: string;
+    };
+    datacenter?: {
+        location: {
+            name: string;
+        };
+    };
+    labels?: Record<string, string>;
+};
+export type HetznerTargetOptions = {
+    /** API token (https://docs.hetzner.cloud/#authentication). Required unless `client` is set. */
+    token?: string;
+    /** Custom client. Overrides token-built default. */
+    client?: HetznerClientLike;
+    /** Server name. Hetzner-unique per project; also our idempotency key. */
+    name: string;
+    /** Location slug — `'nbg1'`, `'fsn1'`, `'hel1'`, `'ash'`, `'hil'`. */
+    location: string;
+    /** Server type slug — `'cx22'`, `'cpx11'`, `'ccx13'`, etc. */
+    serverType: string;
+    /** Image slug or numeric id, e.g. `'ubuntu-22.04'`. */
+    image: string | number;
+    /** SSH key fingerprints, numeric ids, or names. At least one required. */
+    sshKeys: ReadonlyArray<string | number>;
+    /** Labels (Hetzner's key-value tags). */
+    labels?: Record<string, string>;
+    /** cloud-init user data — a shell script or YAML config. */
+    userData?: string;
+    /** Attach to a Cloud Network (by id). */
+    networkId?: number;
+    /** Disable IPv4 public addressing. Default: enabled. */
+    disablePublicIpv4?: boolean;
+    /** Disable IPv6 public addressing. Default: enabled. */
+    disablePublicIpv6?: boolean;
+    /** SSH login user. Default `'root'`. */
+    user?: string;
+    /** Path to SSH identity file forwarded to sshTarget. */
+    identity?: string;
+    /** SSH port. Default 22. */
+    port?: number;
+    /** Max time to wait for server `running` + IPv4. Default 5 min. */
+    provisionTimeoutMs?: number;
+    /** Max time to wait for SSH probe to succeed. Default 2 min. */
+    sshReadinessTimeoutMs?: number;
+    /** Poll interval for provision + ssh probe. Default 5 s. */
+    pollIntervalMs?: number;
+    /** Called with status updates (one line each). Default: noop. */
+    onLog?: (line: string) => void;
+    /**
+     * Override the SSH readiness probe. Default opens a TCP socket to
+     * `host:port`. Tests pass a fake probe to skip real network IO.
+     */
+    probeSsh?: (host: string, port: number) => Promise<boolean>;
+    /** Sleep used between polls. Tests can pass a synchronous resolver. */
+    sleep?: (ms: number) => Promise<void>;
+    /** Wall clock. Defaults to `Date.now`. Tests can swap. */
+    now?: () => number;
+};
+export type HetznerTarget = Target & {
+    readonly serverId: number;
+    readonly ipv4: string;
+    /** Destroy the server via the Hetzner API. */
+    destroy: () => Promise<void>;
+};
+export declare class HetznerError extends Error {
+    readonly status: number;
+    readonly body: unknown;
+    constructor(message: string, status: number, body: unknown);
+}
+/**
+ * fetch-backed default client. Talks JSON to `api.hetzner.cloud/v1`.
+ * Throws HetznerError on non-2xx with the response body attached so
+ * the caller can switch on `err.status`.
+ */
+export declare const createHetznerClient: (token: string, options?: {
+    baseUrl?: string;
+    fetch?: typeof fetch;
+}) => HetznerClientLike;
+/**
+ * Find a server by name. Returns undefined if absent. Hetzner
+ * enforces unique server names per project, so duplicates aren't
+ * possible — but if the API ever returns >1 we still surface that
+ * loudly.
+ */
+export declare const findHetznerServer: (client: HetznerClientLike, name: string) => Promise<HetznerServer | undefined>;
+/** List servers, optionally filtered by label selector. */
+export declare const listHetznerServers: (options: {
+    token?: string;
+    client?: HetznerClientLike;
+    /** Label selector, e.g. `'env=prod'` or `'env in (prod,staging)'`. */
+    labelSelector?: string;
+}) => Promise<HetznerServer[]>;
+/** Destroy a server by id. 404 treated as idempotent success. */
+export declare const destroyHetznerServer: (options: {
+    token?: string;
+    client?: HetznerClientLike;
+    id: number;
+}) => Promise<void>;
+/**
+ * Provision-or-reuse a Hetzner Cloud server by name, wait for SSH,
+ * return a Target. Idempotent: same name → same server.
+ */
+export declare const hetznerTarget: (options: HetznerTargetOptions) => Promise<HetznerTarget>;

package/dist/hetzner.js

@@ -0,0 +1,374 @@
+// @bun
+// src/targets.ts
+import { mkdir } from "fs/promises";
+import { join } from "path";
+var decodeChunks = async (reader, onLine) => {
+  if (!reader)
+    return "";
+  const decoder = new TextDecoder;
+  let buffer = "";
+  let collected = "";
+  const stream = reader.getReader();
+  try {
+    while (true) {
+      const { done, value } = await stream.read();
+      if (done)
+        break;
+      const chunk = decoder.decode(value, { stream: true });
+      collected += chunk;
+      if (!onLine)
+        continue;
+      buffer += chunk;
+      let newline = buffer.indexOf(`
+`);
+      while (newline !== -1) {
+        const line = buffer.slice(0, newline).replace(/\r$/, "");
+        if (line.length > 0)
+          onLine(line);
+        buffer = buffer.slice(newline + 1);
+        newline = buffer.indexOf(`
+`);
+      }
+    }
+    const tail = decoder.decode();
+    collected += tail;
+    if (onLine && (buffer + tail).length > 0)
+      onLine((buffer + tail).replace(/\r$/, ""));
+  } finally {
+    stream.releaseLock();
+  }
+  return collected;
+};
+var runSpawn = async (argv, options) => {
+  const proc = Bun.spawn(argv, {
+    cwd: options.cwd,
+    env: options.env,
+    stderr: "pipe",
+    stdin: options.stdin === undefined ? "ignore" : "pipe",
+    stdout: "pipe"
+  });
+  if (options.stdin !== undefined && proc.stdin) {
+    const sink = proc.stdin;
+    const wrote = sink.write(options.stdin);
+    if (wrote && typeof wrote.then === "function") {
+      await wrote;
+    }
+    const ended = sink.end();
+    if (ended && typeof ended.then === "function") {
+      await ended;
+    }
+  }
+  const timeout = options.timeoutMs ?? 600000;
+  let timer;
+  if (timeout > 0) {
+    timer = setTimeout(() => {
+      try {
+        proc.kill();
+      } catch {}
+    }, timeout);
+  }
+  const stdoutPromise = decodeChunks(proc.stdout, options.onLog ? (line) => options.onLog(line, "stdout") : undefined);
+  const stderrPromise = decodeChunks(proc.stderr, options.onLog ? (line) => options.onLog(line, "stderr") : undefined);
+  const [stdout, stderr, exitCode] = await Promise.all([
+    stdoutPromise,
+    stderrPromise,
+    proc.exited
+  ]);
+  if (timer)
+    clearTimeout(timer);
+  return { exitCode: exitCode ?? -1, stderr, stdout };
+};
+var localTarget = (options) => {
+  const baseEnv = { ...options.env };
+  const ensureRoot = async () => {
+    await mkdir(options.root, { recursive: true });
+  };
+  return {
+    description: `local ${options.root}`,
+    exec: async (cmd, opts) => {
+      await ensureRoot();
+      return runSpawn(["sh", "-c", cmd], {
+        cwd: opts?.cwd ?? options.root,
+        env: { ...process.env, ...baseEnv, ...opts?.env ?? {} },
+        onLog: opts?.onLog,
+        stdin: opts?.stdin,
+        timeoutMs: opts?.timeoutMs
+      });
+    },
+    upload: async (localPath, remotePath, opts) => {
+      await ensureRoot();
+      const dest = remotePath.startsWith("/") ? remotePath : join(options.root, remotePath);
+      const argv = ["rsync", "-a"];
+      if (opts?.deleteOrphans)
+        argv.push("--delete");
+      for (const pattern of opts?.exclude ?? [])
+        argv.push("--exclude", pattern);
+      argv.push(localPath, dest);
+      const result = await runSpawn(argv, { timeoutMs: 600000 });
+      if (result.exitCode !== 0) {
+        throw new Error(`local upload failed (exit ${result.exitCode}): ${result.stderr || result.stdout}`);
+      }
+    }
+  };
+};
+var sshTargetString = (options) => {
+  const user = options.user ?? "root";
+  return `${user}@${options.host}`;
+};
+var sshBaseFlags = (options) => {
+  const flags = [];
+  if (options.port !== undefined && options.port !== 22)
+    flags.push("-p", String(options.port));
+  if (options.identity !== undefined)
+    flags.push("-i", options.identity);
+  flags.push("-o", "BatchMode=yes", "-o", "StrictHostKeyChecking=accept-new");
+  for (const flag of options.sshFlags ?? [])
+    flags.push(flag);
+  return flags;
+};
+var shellQuote = (value) => `'${value.replace(/'/g, `'\\''`)}'`;
+var buildRemoteCmd = (cmd, opts) => {
+  const env = opts?.env;
+  const envPrefix = env ? Object.entries(env).map(([k, v]) => `${k}=${shellQuote(v)}`).join(" ") + " " : "";
+  if (opts?.cwd) {
+    return `cd ${shellQuote(opts.cwd)} && ${envPrefix}${cmd}`;
+  }
+  return `${envPrefix}${cmd}`;
+};
+var sshTarget = (options) => {
+  const remote = sshTargetString(options);
+  const useRsync = options.rsync ?? true;
+  return {
+    description: `ssh ${remote}${options.port && options.port !== 22 ? `:${options.port}` : ""}`,
+    exec: async (cmd, opts) => {
+      const argv = ["ssh", ...sshBaseFlags(options)];
+      for (const name of options.forwardEnv ?? [])
+        argv.push("-o", `SendEnv=${name}`);
+      argv.push(remote, buildRemoteCmd(cmd, opts));
+      return runSpawn(argv, {
+        onLog: opts?.onLog,
+        stdin: opts?.stdin,
+        timeoutMs: opts?.timeoutMs
+      });
+    },
+    upload: async (localPath, remotePath, opts) => {
+      if (useRsync) {
+        const sshCmd = ["ssh", ...sshBaseFlags(options)].map((part) => part.includes(" ") ? `'${part}'` : part).join(" ");
+        const argv2 = ["rsync", "-az", "-e", sshCmd];
+        if (opts?.deleteOrphans)
+          argv2.push("--delete");
+        for (const pattern of opts?.exclude ?? [])
+          argv2.push("--exclude", pattern);
+        argv2.push(localPath, `${remote}:${remotePath}`);
+        const result2 = await runSpawn(argv2, { timeoutMs: 600000 });
+        if (result2.exitCode !== 0) {
+          throw new Error(`rsync upload failed (exit ${result2.exitCode}): ${result2.stderr || result2.stdout}`);
+        }
+        return;
+      }
+      const argv = ["scp", "-r", ...sshBaseFlags(options), localPath, `${remote}:${remotePath}`];
+      const result = await runSpawn(argv, { timeoutMs: 600000 });
+      if (result.exitCode !== 0) {
+        throw new Error(`scp upload failed (exit ${result.exitCode}): ${result.stderr || result.stdout}`);
+      }
+    }
+  };
+};
+
+// src/hetzner.ts
+var HETZNER_API_BASE = "https://api.hetzner.cloud/v1";
+
+class HetznerError extends Error {
+  status;
+  body;
+  constructor(message, status, body) {
+    super(message);
+    this.name = "HetznerError";
+    this.status = status;
+    this.body = body;
+  }
+}
+var createHetznerClient = (token, options = {}) => {
+  const base = options.baseUrl ?? HETZNER_API_BASE;
+  const f = options.fetch ?? fetch;
+  return {
+    request: async (method, path, body) => {
+      const init = {
+        headers: {
+          authorization: `Bearer ${token}`,
+          "content-type": "application/json"
+        },
+        method
+      };
+      if (body !== undefined)
+        init.body = JSON.stringify(body);
+      const response = await f(`${base}${path}`, init);
+      if (response.status === 204)
+        return;
+      const text = await response.text();
+      const parsed = text.length > 0 ? JSON.parse(text) : undefined;
+      if (!response.ok) {
+        throw new HetznerError(`Hetzner Cloud API ${method} ${path} failed: ${response.status} ${response.statusText}`, response.status, parsed);
+      }
+      return parsed;
+    }
+  };
+};
+var resolveClient = (options) => {
+  if (options.client !== undefined)
+    return options.client;
+  if (options.token !== undefined && options.token.length > 0) {
+    return createHetznerClient(options.token);
+  }
+  throw new Error("[deploy/hetzner] either `token` or `client` must be provided");
+};
+var publicIpv4 = (server) => server.public_net.ipv4?.ip;
+var defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var defaultProbeSsh = async (host, port) => {
+  const PROBE_TIMEOUT_MS = 2000;
+  return new Promise((resolve) => {
+    let settled = false;
+    const settle = (value) => {
+      if (settled)
+        return;
+      settled = true;
+      resolve(value);
+    };
+    const timer = setTimeout(() => settle(false), PROBE_TIMEOUT_MS);
+    Bun.connect({
+      hostname: host,
+      port,
+      socket: {
+        data: () => {},
+        error: () => {
+          clearTimeout(timer);
+          settle(false);
+        },
+        open: (socket) => {
+          clearTimeout(timer);
+          socket.end();
+          settle(true);
+        }
+      }
+    }).catch(() => {
+      clearTimeout(timer);
+      settle(false);
+    });
+  });
+};
+var findHetznerServer = async (client, name) => {
+  const body = await client.request("GET", `/servers?name=${encodeURIComponent(name)}`);
+  const matches = body.servers.filter((server) => server.name === name);
+  if (matches.length === 0)
+    return;
+  if (matches.length > 1) {
+    throw new Error(`[deploy/hetzner] multiple servers named "${name}" (${matches.map((server) => server.id).join(", ")}). Hetzner shouldn't allow this \u2014 resolve manually.`);
+  }
+  return matches[0];
+};
+var listHetznerServers = async (options) => {
+  const client = resolveClient(options);
+  const path = options.labelSelector !== undefined ? `/servers?label_selector=${encodeURIComponent(options.labelSelector)}` : "/servers";
+  const body = await client.request("GET", path);
+  return body.servers;
+};
+var destroyHetznerServer = async (options) => {
+  const client = resolveClient(options);
+  try {
+    await client.request("DELETE", `/servers/${options.id}`);
+  } catch (error) {
+    if (error instanceof HetznerError && error.status === 404) {
+      return;
+    }
+    throw error;
+  }
+};
+var hetznerTarget = async (options) => {
+  const client = resolveClient(options);
+  const log = options.onLog ?? (() => {});
+  const probeSsh = options.probeSsh ?? defaultProbeSsh;
+  const sleep = options.sleep ?? defaultSleep;
+  const now = options.now ?? Date.now;
+  const pollMs = options.pollIntervalMs ?? 5000;
+  const provisionTimeout = options.provisionTimeoutMs ?? 5 * 60000;
+  const sshTimeout = options.sshReadinessTimeoutMs ?? 2 * 60000;
+  const port = options.port ?? 22;
+  const existing = await findHetznerServer(client, options.name);
+  let current;
+  if (existing === undefined) {
+    log(`[hetzner] creating server "${options.name}" in ${options.location}`);
+    const publicIpv4Enabled = options.disablePublicIpv4 !== true;
+    const publicIpv6Enabled = options.disablePublicIpv6 !== true;
+    const created = await client.request("POST", "/servers", {
+      name: options.name,
+      location: options.location,
+      server_type: options.serverType,
+      image: options.image,
+      ssh_keys: [...options.sshKeys],
+      start_after_create: true,
+      public_net: {
+        enable_ipv4: publicIpv4Enabled,
+        enable_ipv6: publicIpv6Enabled
+      },
+      ...options.labels !== undefined ? { labels: options.labels } : {},
+      ...options.userData !== undefined ? { user_data: options.userData } : {},
+      ...options.networkId !== undefined ? { networks: [options.networkId] } : {}
+    });
+    current = created.server;
+  } else {
+    log(`[hetzner] reusing server "${options.name}" (id ${existing.id}, status ${existing.status})`);
+    current = existing;
+  }
+  const provisionStart = now();
+  let ipv4 = publicIpv4(current);
+  while (current.status !== "running" || ipv4 === undefined) {
+    if (now() - provisionStart > provisionTimeout) {
+      throw new Error(`[deploy/hetzner] provision timeout after ${provisionTimeout}ms \u2014 server ${current.id} status "${current.status}", ipv4 ${ipv4 ?? "(unassigned)"}`);
+    }
+    await sleep(pollMs);
+    const refreshed = await client.request("GET", `/servers/${current.id}`);
+    current = refreshed.server;
+    ipv4 = publicIpv4(current);
+    log(`[hetzner] poll: status=${current.status} ipv4=${ipv4 ?? "(none yet)"}`);
+  }
+  log(`[hetzner] server running at ${ipv4}`);
+  const sshStart = now();
+  while (!await probeSsh(ipv4, port)) {
+    if (now() - sshStart > sshTimeout) {
+      throw new Error(`[deploy/hetzner] SSH readiness timeout after ${sshTimeout}ms \u2014 ${ipv4}:${port} did not accept connections`);
+    }
+    await sleep(pollMs);
+    log(`[hetzner] waiting on ssh ${ipv4}:${port}`);
+  }
+  log(`[hetzner] ssh ready at ${ipv4}:${port}`);
+  const ssh = sshTarget({
+    host: ipv4,
+    ...options.user !== undefined ? { user: options.user } : {},
+    ...options.identity !== undefined ? { identity: options.identity } : {},
+    ...options.port !== undefined ? { port: options.port } : {}
+  });
+  const serverId = current.id;
+  const resolvedIpv4 = ipv4;
+  return {
+    description: `hetzner server "${options.name}" (${ssh.description})`,
+    destroy: () => destroyHetznerServer({ client, id: serverId }).then(() => {
+      log(`[hetzner] destroyed server ${serverId}`);
+    }),
+    exec: ssh.exec,
+    ipv4: resolvedIpv4,
+    serverId,
+    upload: ssh.upload,
+    ...ssh.close !== undefined ? { close: ssh.close } : {}
+  };
+};
+export {
+  listHetznerServers,
+  hetznerTarget,
+  findHetznerServer,
+  destroyHetznerServer,
+  createHetznerClient,
+  HetznerError
+};
+
+//# debugId=0EE85A74FB8C508064756E2164756E21
+//# sourceMappingURL=hetzner.js.map

package/dist/hetzner.js.map

@@ -0,0 +1,11 @@
+{
+  "version": 3,
+  "sources": ["../src/targets.ts", "../src/hetzner.ts"],
+  "sourcesContent": [
+    "/**\n * Target interface + bundled adapters (localTarget, sshTarget).\n *\n * A Target is the narrowest abstraction over \"a place I can deploy to\":\n *\n *   - `exec(cmd, opts?)` — run a shell command, capture stdout/stderr/exitCode.\n *   - `upload(localPath, remotePath, opts?)` — copy a local file or directory\n *     to the target. Implementation is free to use whatever is fast (rsync,\n *     scp, mv).\n *   - `close?()` — optional teardown.\n *\n * Two adapters are bundled:\n *\n *   - `localTarget` runs in a temp directory on the local filesystem. Useful\n *     for tests and for \"deploy\" workflows that happen on the same host.\n *   - `sshTarget` shells out to the system `ssh` and `rsync` binaries. No\n *     `ssh2` npm dependency — the controller machine just needs `ssh` and\n *     (optionally) `rsync` in PATH, which is universal on Mac/Linux/WSL.\n *\n * Provider-specific targets (Cloudflare Workers HTTP API, Fly Machines API,\n * AWS Fargate) don't fit \"exec + upload\" and ship as siblings later.\n */\n\nimport { mkdir } from 'node:fs/promises';\nimport { join } from 'node:path';\n\nexport type ExecOptions = {\n\t/** Working directory on the target. Default: target's root. */\n\tcwd?: string;\n\t/** Env vars to set for this command (merged onto target.env). */\n\tenv?: Record<string, string>;\n\t/** Hard kill after this many ms. Default 600_000 (10 min). 0 disables. */\n\ttimeoutMs?: number;\n\t/** Pipe stdout/stderr through here as it streams (lines, newline-stripped). */\n\tonLog?: (line: string, stream: 'stdout' | 'stderr') => void;\n\t/** Stdin payload — a string is written verbatim. */\n\tstdin?: string;\n};\n\nexport type ExecResult = {\n\tstdout: string;\n\tstderr: string;\n\texitCode: number;\n};\n\nexport type UploadOptions = {\n\t/** Exclude paths matching these globs from a directory upload. */\n\texclude?: string[];\n\t/** When uploading a directory, delete remote files not present locally. */\n\tdeleteOrphans?: boolean;\n};\n\nexport type Target = {\n\t/** Human-readable description (e.g. \"ssh root@droplet-1.example.com\"). */\n\treadonly description: string;\n\texec: (cmd: string, opts?: ExecOptions) => Promise<ExecResult>;\n\tupload: (localPath: string, remotePath: string, opts?: UploadOptions) => Promise<void>;\n\tclose?: () => Promise<void>;\n};\n\n// -----------------------------------------------------------------------------\n// localTarget\n// -----------------------------------------------------------------------------\n\nexport type LocalTargetOptions = {\n\t/** Root directory the target operates in. Created if missing. */\n\troot: string;\n\t/** Env merged into every exec. */\n\tenv?: Record<string, string>;\n};\n\nconst decodeChunks = async (\n\treader: ReadableStream<Uint8Array> | null,\n\tonLine: ((line: string) => void) | undefined,\n): Promise<string> => {\n\tif (!reader) return '';\n\tconst decoder = new TextDecoder();\n\tlet buffer = '';\n\tlet collected = '';\n\tconst stream = reader.getReader();\n\ttry {\n\t\twhile (true) {\n\t\t\tconst { done, value } = await stream.read();\n\t\t\tif (done) break;\n\t\t\tconst chunk = decoder.decode(value, { stream: true });\n\t\t\tcollected += chunk;\n\t\t\tif (!onLine) continue;\n\t\t\tbuffer += chunk;\n\t\t\tlet newline = buffer.indexOf('\\n');\n\t\t\twhile (newline !== -1) {\n\t\t\t\tconst line = buffer.slice(0, newline).replace(/\\r$/, '');\n\t\t\t\tif (line.length > 0) onLine(line);\n\t\t\t\tbuffer = buffer.slice(newline + 1);\n\t\t\t\tnewline = buffer.indexOf('\\n');\n\t\t\t}\n\t\t}\n\t\tconst tail = decoder.decode();\n\t\tcollected += tail;\n\t\tif (onLine && (buffer + tail).length > 0) onLine((buffer + tail).replace(/\\r$/, ''));\n\t} finally {\n\t\tstream.releaseLock();\n\t}\n\treturn collected;\n};\n\nconst runSpawn = async (\n\targv: string[],\n\toptions: {\n\t\tcwd?: string;\n\t\tenv?: Record<string, string>;\n\t\ttimeoutMs?: number;\n\t\tonLog?: ExecOptions['onLog'];\n\t\tstdin?: string;\n\t},\n): Promise<ExecResult> => {\n\tconst proc = Bun.spawn(argv, {\n\t\tcwd: options.cwd,\n\t\tenv: options.env,\n\t\tstderr: 'pipe',\n\t\tstdin: options.stdin === undefined ? 'ignore' : 'pipe',\n\t\tstdout: 'pipe',\n\t});\n\n\tif (options.stdin !== undefined && proc.stdin) {\n\t\t// Bun.spawn returns a FileSink for piped stdin — `write` + `end`, not a\n\t\t// WritableStream. (We use a permissive cast because @types/bun's\n\t\t// Subprocess.stdin discriminant flips based on the stdin generic.)\n\t\tconst sink = proc.stdin as unknown as {\n\t\t\twrite: (chunk: string | Uint8Array) => number | Promise<number>;\n\t\t\tend: () => void | Promise<void>;\n\t\t};\n\t\tconst wrote = sink.write(options.stdin);\n\t\tif (wrote && typeof (wrote as Promise<number>).then === 'function') {\n\t\t\tawait wrote;\n\t\t}\n\t\tconst ended = sink.end();\n\t\tif (ended && typeof (ended as Promise<void>).then === 'function') {\n\t\t\tawait ended;\n\t\t}\n\t}\n\n\tconst timeout = options.timeoutMs ?? 600_000;\n\tlet timer: ReturnType<typeof setTimeout> | undefined;\n\tif (timeout > 0) {\n\t\ttimer = setTimeout(() => {\n\t\t\ttry { proc.kill(); } catch { /* already gone */ }\n\t\t}, timeout);\n\t}\n\n\tconst stdoutPromise = decodeChunks(\n\t\tproc.stdout as unknown as ReadableStream<Uint8Array>,\n\t\toptions.onLog ? (line) => options.onLog!(line, 'stdout') : undefined,\n\t);\n\tconst stderrPromise = decodeChunks(\n\t\tproc.stderr as unknown as ReadableStream<Uint8Array>,\n\t\toptions.onLog ? (line) => options.onLog!(line, 'stderr') : undefined,\n\t);\n\n\tconst [stdout, stderr, exitCode] = await Promise.all([\n\t\tstdoutPromise,\n\t\tstderrPromise,\n\t\tproc.exited,\n\t]);\n\tif (timer) clearTimeout(timer);\n\n\treturn { exitCode: exitCode ?? -1, stderr, stdout };\n};\n\nexport const localTarget = (options: LocalTargetOptions): Target => {\n\tconst baseEnv = { ...options.env };\n\tconst ensureRoot = async () => { await mkdir(options.root, { recursive: true }); };\n\n\treturn {\n\t\tdescription: `local ${options.root}`,\n\t\texec: async (cmd, opts) => {\n\t\t\tawait ensureRoot();\n\t\t\treturn runSpawn(['sh', '-c', cmd], {\n\t\t\t\tcwd: opts?.cwd ?? options.root,\n\t\t\t\tenv: { ...process.env, ...baseEnv, ...(opts?.env ?? {}) } as Record<string, string>,\n\t\t\t\tonLog: opts?.onLog,\n\t\t\t\tstdin: opts?.stdin,\n\t\t\t\ttimeoutMs: opts?.timeoutMs,\n\t\t\t});\n\t\t},\n\t\tupload: async (localPath, remotePath, opts) => {\n\t\t\tawait ensureRoot();\n\t\t\tconst dest = remotePath.startsWith('/') ? remotePath : join(options.root, remotePath);\n\t\t\tconst argv = ['rsync', '-a'];\n\t\t\tif (opts?.deleteOrphans) argv.push('--delete');\n\t\t\tfor (const pattern of opts?.exclude ?? []) argv.push('--exclude', pattern);\n\t\t\t// rsync semantics: a trailing slash on the source copies *contents*; without it the dir itself is nested.\n\t\t\targv.push(localPath, dest);\n\t\t\tconst result = await runSpawn(argv, { timeoutMs: 600_000 });\n\t\t\tif (result.exitCode !== 0) {\n\t\t\t\tthrow new Error(`local upload failed (exit ${result.exitCode}): ${result.stderr || result.stdout}`);\n\t\t\t}\n\t\t},\n\t};\n};\n\n// -----------------------------------------------------------------------------\n// sshTarget\n// -----------------------------------------------------------------------------\n\nexport type SshTargetOptions = {\n\t/** Hostname or IP of the remote. */\n\thost: string;\n\t/** Login user. Default `root`. */\n\tuser?: string;\n\t/** SSH port. Default 22. */\n\tport?: number;\n\t/** Path to SSH identity file. Default: ssh's own search. */\n\tidentity?: string;\n\t/** Extra flags appended to every `ssh` invocation. */\n\tsshFlags?: string[];\n\t/**\n\t * Use rsync for `upload`. Default true. When false, falls back to `scp`\n\t * which is universal but doesn't support delete / exclude.\n\t */\n\trsync?: boolean;\n\t/**\n\t * Env vars to forward via `ssh -o SendEnv=...`. Most remote sshd configs\n\t * accept only `LANG` and `LC_*` by default; for app env vars use the\n\t * step `env` option instead, which prepends `KEY=value` to the command.\n\t */\n\tforwardEnv?: string[];\n};\n\nconst sshTargetString = (options: SshTargetOptions): string => {\n\tconst user = options.user ?? 'root';\n\treturn `${user}@${options.host}`;\n};\n\nconst sshBaseFlags = (options: SshTargetOptions): string[] => {\n\tconst flags: string[] = [];\n\tif (options.port !== undefined && options.port !== 22) flags.push('-p', String(options.port));\n\tif (options.identity !== undefined) flags.push('-i', options.identity);\n\t// Never get stuck on a host-key prompt; treat unknown hosts as a fatal config issue rather than a UX detour.\n\tflags.push('-o', 'BatchMode=yes', '-o', 'StrictHostKeyChecking=accept-new');\n\tfor (const flag of options.sshFlags ?? []) flags.push(flag);\n\treturn flags;\n};\n\nconst shellQuote = (value: string): string => `'${value.replace(/'/g, `'\\\\''`)}'`;\n\nconst buildRemoteCmd = (cmd: string, opts: ExecOptions | undefined): string => {\n\tconst env = opts?.env;\n\tconst envPrefix = env\n\t\t? Object.entries(env).map(([k, v]) => `${k}=${shellQuote(v)}`).join(' ') + ' '\n\t\t: '';\n\tif (opts?.cwd) {\n\t\treturn `cd ${shellQuote(opts.cwd)} && ${envPrefix}${cmd}`;\n\t}\n\treturn `${envPrefix}${cmd}`;\n};\n\nexport const sshTarget = (options: SshTargetOptions): Target => {\n\tconst remote = sshTargetString(options);\n\tconst useRsync = options.rsync ?? true;\n\n\treturn {\n\t\tdescription: `ssh ${remote}${options.port && options.port !== 22 ? `:${options.port}` : ''}`,\n\t\texec: async (cmd, opts) => {\n\t\t\tconst argv = ['ssh', ...sshBaseFlags(options)];\n\t\t\tfor (const name of options.forwardEnv ?? []) argv.push('-o', `SendEnv=${name}`);\n\t\t\targv.push(remote, buildRemoteCmd(cmd, opts));\n\t\t\treturn runSpawn(argv, {\n\t\t\t\tonLog: opts?.onLog,\n\t\t\t\tstdin: opts?.stdin,\n\t\t\t\ttimeoutMs: opts?.timeoutMs,\n\t\t\t});\n\t\t},\n\t\tupload: async (localPath, remotePath, opts) => {\n\t\t\tif (useRsync) {\n\t\t\t\tconst sshCmd = ['ssh', ...sshBaseFlags(options)].map((part) => part.includes(' ') ? `'${part}'` : part).join(' ');\n\t\t\t\tconst argv = ['rsync', '-az', '-e', sshCmd];\n\t\t\t\tif (opts?.deleteOrphans) argv.push('--delete');\n\t\t\t\tfor (const pattern of opts?.exclude ?? []) argv.push('--exclude', pattern);\n\t\t\t\targv.push(localPath, `${remote}:${remotePath}`);\n\t\t\t\tconst result = await runSpawn(argv, { timeoutMs: 600_000 });\n\t\t\t\tif (result.exitCode !== 0) {\n\t\t\t\t\tthrow new Error(`rsync upload failed (exit ${result.exitCode}): ${result.stderr || result.stdout}`);\n\t\t\t\t}\n\t\t\t\treturn;\n\t\t\t}\n\t\t\t// scp fallback — no exclude, no delete. We still need -r to copy directories.\n\t\t\tconst argv = ['scp', '-r', ...sshBaseFlags(options), localPath, `${remote}:${remotePath}`];\n\t\t\tconst result = await runSpawn(argv, { timeoutMs: 600_000 });\n\t\t\tif (result.exitCode !== 0) {\n\t\t\t\tthrow new Error(`scp upload failed (exit ${result.exitCode}): ${result.stderr || result.stdout}`);\n\t\t\t}\n\t\t},\n\t};\n};\n",
+    "/**\n * @absolutejs/deploy/hetzner — provision-or-reuse Target adapter for\n * Hetzner Cloud servers. Sibling to {@link digitalOceanTarget}; same\n * shape, different API.\n *\n * What it does:\n *\n *   1. Looks up a server by `name`. If present and running, reuses it.\n *   2. If not present, creates it via the Hetzner Cloud v1 API and\n *      waits for `status === 'running'` with a public IPv4 assigned.\n *   3. Waits for SSH readiness (TCP connect on port 22 with backoff,\n *      or a caller-supplied probe).\n *   4. Returns a Target that wraps sshTarget against the server's\n *      public IPv4, plus `serverId`, `ipv4`, and a `destroy()` helper.\n *\n * Idempotent by name — Hetzner enforces unique server names per\n * project, so calling twice with the same name returns the same\n * server.\n *\n * Narrow HetznerClientLike interface keeps the official `hcloud-js`\n * SDK out as a hard dep. Default client uses `fetch` against\n * `api.hetzner.cloud/v1`; pass your own for retry / observability.\n */\n\nimport type { Target } from './targets';\nimport { sshTarget } from './targets';\n\nconst HETZNER_API_BASE = 'https://api.hetzner.cloud/v1';\n\n/**\n * Minimal subset of Hetzner Cloud API calls we make. Lets callers\n * BYO a client with retry / observability / etc.\n */\nexport type HetznerClientLike = {\n\trequest: <T = unknown>(\n\t\tmethod: 'GET' | 'POST' | 'DELETE',\n\t\tpath: string,\n\t\tbody?: unknown\n\t) => Promise<T>;\n};\n\n/** A Hetzner Cloud server, narrowed to what we inspect. */\nexport type HetznerServer = {\n\tid: number;\n\tname: string;\n\tstatus:\n\t\t| 'initializing'\n\t\t| 'starting'\n\t\t| 'running'\n\t\t| 'stopping'\n\t\t| 'off'\n\t\t| 'deleting'\n\t\t| 'migrating'\n\t\t| 'rebuilding'\n\t\t| 'unknown';\n\tpublic_net: {\n\t\tipv4: { id: number; ip: string; blocked: boolean; dns_ptr?: string } | null;\n\t\tipv6: { id: number; ip: string; blocked: boolean } | null;\n\t};\n\tserver_type?: { name: string };\n\tdatacenter?: { location: { name: string } };\n\tlabels?: Record<string, string>;\n};\n\nexport type HetznerTargetOptions = {\n\t/** API token (https://docs.hetzner.cloud/#authentication). Required unless `client` is set. */\n\ttoken?: string;\n\t/** Custom client. Overrides token-built default. */\n\tclient?: HetznerClientLike;\n\n\t// ── Server shape ─────────────────────────────────────────────────\n\t/** Server name. Hetzner-unique per project; also our idempotency key. */\n\tname: string;\n\t/** Location slug — `'nbg1'`, `'fsn1'`, `'hel1'`, `'ash'`, `'hil'`. */\n\tlocation: string;\n\t/** Server type slug — `'cx22'`, `'cpx11'`, `'ccx13'`, etc. */\n\tserverType: string;\n\t/** Image slug or numeric id, e.g. `'ubuntu-22.04'`. */\n\timage: string | number;\n\t/** SSH key fingerprints, numeric ids, or names. At least one required. */\n\tsshKeys: ReadonlyArray<string | number>;\n\t/** Labels (Hetzner's key-value tags). */\n\tlabels?: Record<string, string>;\n\t/** cloud-init user data — a shell script or YAML config. */\n\tuserData?: string;\n\t/** Attach to a Cloud Network (by id). */\n\tnetworkId?: number;\n\t/** Disable IPv4 public addressing. Default: enabled. */\n\tdisablePublicIpv4?: boolean;\n\t/** Disable IPv6 public addressing. Default: enabled. */\n\tdisablePublicIpv6?: boolean;\n\n\t// ── SSH wrap ────────────────────────────────────────────────────\n\t/** SSH login user. Default `'root'`. */\n\tuser?: string;\n\t/** Path to SSH identity file forwarded to sshTarget. */\n\tidentity?: string;\n\t/** SSH port. Default 22. */\n\tport?: number;\n\n\t// ── Timing ──────────────────────────────────────────────────────\n\t/** Max time to wait for server `running` + IPv4. Default 5 min. */\n\tprovisionTimeoutMs?: number;\n\t/** Max time to wait for SSH probe to succeed. Default 2 min. */\n\tsshReadinessTimeoutMs?: number;\n\t/** Poll interval for provision + ssh probe. Default 5 s. */\n\tpollIntervalMs?: number;\n\n\t// ── Observability + injection points ───────────────────────────\n\t/** Called with status updates (one line each). Default: noop. */\n\tonLog?: (line: string) => void;\n\t/**\n\t * Override the SSH readiness probe. Default opens a TCP socket to\n\t * `host:port`. Tests pass a fake probe to skip real network IO.\n\t */\n\tprobeSsh?: (host: string, port: number) => Promise<boolean>;\n\t/** Sleep used between polls. Tests can pass a synchronous resolver. */\n\tsleep?: (ms: number) => Promise<void>;\n\t/** Wall clock. Defaults to `Date.now`. Tests can swap. */\n\tnow?: () => number;\n};\n\nexport type HetznerTarget = Target & {\n\treadonly serverId: number;\n\treadonly ipv4: string;\n\t/** Destroy the server via the Hetzner API. */\n\tdestroy: () => Promise<void>;\n};\n\nexport class HetznerError extends Error {\n\treadonly status: number;\n\treadonly body: unknown;\n\tconstructor(message: string, status: number, body: unknown) {\n\t\tsuper(message);\n\t\tthis.name = 'HetznerError';\n\t\tthis.status = status;\n\t\tthis.body = body;\n\t}\n}\n\n/**\n * fetch-backed default client. Talks JSON to `api.hetzner.cloud/v1`.\n * Throws HetznerError on non-2xx with the response body attached so\n * the caller can switch on `err.status`.\n */\nexport const createHetznerClient = (\n\ttoken: string,\n\toptions: { baseUrl?: string; fetch?: typeof fetch } = {}\n): HetznerClientLike => {\n\tconst base = options.baseUrl ?? HETZNER_API_BASE;\n\tconst f = options.fetch ?? fetch;\n\treturn {\n\t\trequest: async <T>(\n\t\t\tmethod: 'GET' | 'POST' | 'DELETE',\n\t\t\tpath: string,\n\t\t\tbody?: unknown\n\t\t): Promise<T> => {\n\t\t\tconst init: RequestInit = {\n\t\t\t\theaders: {\n\t\t\t\t\tauthorization: `Bearer ${token}`,\n\t\t\t\t\t'content-type': 'application/json'\n\t\t\t\t},\n\t\t\t\tmethod\n\t\t\t};\n\t\t\tif (body !== undefined) init.body = JSON.stringify(body);\n\t\t\tconst response = await f(`${base}${path}`, init);\n\t\t\tif (response.status === 204) return undefined as T;\n\t\t\tconst text = await response.text();\n\t\t\tconst parsed = text.length > 0 ? JSON.parse(text) : undefined;\n\t\t\tif (!response.ok) {\n\t\t\t\tthrow new HetznerError(\n\t\t\t\t\t`Hetzner Cloud API ${method} ${path} failed: ${response.status} ${response.statusText}`,\n\t\t\t\t\tresponse.status,\n\t\t\t\t\tparsed\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn parsed as T;\n\t\t}\n\t};\n};\n\nconst resolveClient = (\n\toptions: Pick<HetznerTargetOptions, 'client' | 'token'>\n): HetznerClientLike => {\n\tif (options.client !== undefined) return options.client;\n\tif (options.token !== undefined && options.token.length > 0) {\n\t\treturn createHetznerClient(options.token);\n\t}\n\tthrow new Error(\n\t\t'[deploy/hetzner] either `token` or `client` must be provided'\n\t);\n};\n\nconst publicIpv4 = (server: HetznerServer): string | undefined =>\n\tserver.public_net.ipv4?.ip;\n\nconst defaultSleep = (ms: number): Promise<void> =>\n\tnew Promise((resolve) => setTimeout(resolve, ms));\n\nconst defaultProbeSsh = async (host: string, port: number): Promise<boolean> => {\n\tconst PROBE_TIMEOUT_MS = 2_000;\n\treturn new Promise<boolean>((resolve) => {\n\t\tlet settled = false;\n\t\tconst settle = (value: boolean) => {\n\t\t\tif (settled) return;\n\t\t\tsettled = true;\n\t\t\tresolve(value);\n\t\t};\n\t\tconst timer = setTimeout(() => settle(false), PROBE_TIMEOUT_MS);\n\t\tBun.connect({\n\t\t\thostname: host,\n\t\t\tport,\n\t\t\tsocket: {\n\t\t\t\tdata: () => {},\n\t\t\t\terror: () => {\n\t\t\t\t\tclearTimeout(timer);\n\t\t\t\t\tsettle(false);\n\t\t\t\t},\n\t\t\t\topen: (socket) => {\n\t\t\t\t\tclearTimeout(timer);\n\t\t\t\t\tsocket.end();\n\t\t\t\t\tsettle(true);\n\t\t\t\t}\n\t\t\t}\n\t\t}).catch(() => {\n\t\t\tclearTimeout(timer);\n\t\t\tsettle(false);\n\t\t});\n\t});\n};\n\n/**\n * Find a server by name. Returns undefined if absent. Hetzner\n * enforces unique server names per project, so duplicates aren't\n * possible — but if the API ever returns >1 we still surface that\n * loudly.\n */\nexport const findHetznerServer = async (\n\tclient: HetznerClientLike,\n\tname: string\n): Promise<HetznerServer | undefined> => {\n\tconst body = await client.request<{ servers: HetznerServer[] }>(\n\t\t'GET',\n\t\t`/servers?name=${encodeURIComponent(name)}`\n\t);\n\tconst matches = body.servers.filter((server) => server.name === name);\n\tif (matches.length === 0) return undefined;\n\tif (matches.length > 1) {\n\t\tthrow new Error(\n\t\t\t`[deploy/hetzner] multiple servers named \"${name}\" (${matches\n\t\t\t\t.map((server) => server.id)\n\t\t\t\t.join(', ')}). Hetzner shouldn't allow this — resolve manually.`\n\t\t);\n\t}\n\treturn matches[0];\n};\n\n/** List servers, optionally filtered by label selector. */\nexport const listHetznerServers = async (options: {\n\ttoken?: string;\n\tclient?: HetznerClientLike;\n\t/** Label selector, e.g. `'env=prod'` or `'env in (prod,staging)'`. */\n\tlabelSelector?: string;\n}): Promise<HetznerServer[]> => {\n\tconst client = resolveClient(options);\n\tconst path =\n\t\toptions.labelSelector !== undefined\n\t\t\t? `/servers?label_selector=${encodeURIComponent(options.labelSelector)}`\n\t\t\t: '/servers';\n\tconst body = await client.request<{ servers: HetznerServer[] }>('GET', path);\n\treturn body.servers;\n};\n\n/** Destroy a server by id. 404 treated as idempotent success. */\nexport const destroyHetznerServer = async (options: {\n\ttoken?: string;\n\tclient?: HetznerClientLike;\n\tid: number;\n}): Promise<void> => {\n\tconst client = resolveClient(options);\n\ttry {\n\t\tawait client.request('DELETE', `/servers/${options.id}`);\n\t} catch (error) {\n\t\tif (error instanceof HetznerError && error.status === 404) {\n\t\t\treturn; // already destroyed — idempotent\n\t\t}\n\t\tthrow error;\n\t}\n};\n\n/**\n * Provision-or-reuse a Hetzner Cloud server by name, wait for SSH,\n * return a Target. Idempotent: same name → same server.\n */\nexport const hetznerTarget = async (\n\toptions: HetznerTargetOptions\n): Promise<HetznerTarget> => {\n\tconst client = resolveClient(options);\n\tconst log = options.onLog ?? (() => {});\n\tconst probeSsh = options.probeSsh ?? defaultProbeSsh;\n\tconst sleep = options.sleep ?? defaultSleep;\n\tconst now = options.now ?? Date.now;\n\tconst pollMs = options.pollIntervalMs ?? 5_000;\n\tconst provisionTimeout = options.provisionTimeoutMs ?? 5 * 60_000;\n\tconst sshTimeout = options.sshReadinessTimeoutMs ?? 2 * 60_000;\n\tconst port = options.port ?? 22;\n\n\tconst existing = await findHetznerServer(client, options.name);\n\tlet current: HetznerServer;\n\tif (existing === undefined) {\n\t\tlog(`[hetzner] creating server \"${options.name}\" in ${options.location}`);\n\t\tconst publicIpv4Enabled = options.disablePublicIpv4 !== true;\n\t\tconst publicIpv6Enabled = options.disablePublicIpv6 !== true;\n\t\tconst created = await client.request<{ server: HetznerServer }>(\n\t\t\t'POST',\n\t\t\t'/servers',\n\t\t\t{\n\t\t\t\tname: options.name,\n\t\t\t\tlocation: options.location,\n\t\t\t\tserver_type: options.serverType,\n\t\t\t\timage: options.image,\n\t\t\t\tssh_keys: [...options.sshKeys],\n\t\t\t\tstart_after_create: true,\n\t\t\t\tpublic_net: {\n\t\t\t\t\tenable_ipv4: publicIpv4Enabled,\n\t\t\t\t\tenable_ipv6: publicIpv6Enabled\n\t\t\t\t},\n\t\t\t\t...(options.labels !== undefined ? { labels: options.labels } : {}),\n\t\t\t\t...(options.userData !== undefined\n\t\t\t\t\t? { user_data: options.userData }\n\t\t\t\t\t: {}),\n\t\t\t\t...(options.networkId !== undefined\n\t\t\t\t\t? { networks: [options.networkId] }\n\t\t\t\t\t: {})\n\t\t\t}\n\t\t);\n\t\tcurrent = created.server;\n\t} else {\n\t\tlog(\n\t\t\t`[hetzner] reusing server \"${options.name}\" (id ${existing.id}, status ${existing.status})`\n\t\t);\n\t\tcurrent = existing;\n\t}\n\n\t// Wait for status=running AND public IPv4 assigned.\n\tconst provisionStart = now();\n\tlet ipv4 = publicIpv4(current);\n\twhile (current.status !== 'running' || ipv4 === undefined) {\n\t\tif (now() - provisionStart > provisionTimeout) {\n\t\t\tthrow new Error(\n\t\t\t\t`[deploy/hetzner] provision timeout after ${provisionTimeout}ms — server ${current.id} status \"${current.status}\", ipv4 ${ipv4 ?? '(unassigned)'}`\n\t\t\t);\n\t\t}\n\t\tawait sleep(pollMs);\n\t\tconst refreshed: { server: HetznerServer } = await client.request(\n\t\t\t'GET',\n\t\t\t`/servers/${current.id}`\n\t\t);\n\t\tcurrent = refreshed.server;\n\t\tipv4 = publicIpv4(current);\n\t\tlog(`[hetzner] poll: status=${current.status} ipv4=${ipv4 ?? '(none yet)'}`);\n\t}\n\tlog(`[hetzner] server running at ${ipv4}`);\n\n\t// Wait for SSH readiness.\n\tconst sshStart = now();\n\twhile (!(await probeSsh(ipv4, port))) {\n\t\tif (now() - sshStart > sshTimeout) {\n\t\t\tthrow new Error(\n\t\t\t\t`[deploy/hetzner] SSH readiness timeout after ${sshTimeout}ms — ${ipv4}:${port} did not accept connections`\n\t\t\t);\n\t\t}\n\t\tawait sleep(pollMs);\n\t\tlog(`[hetzner] waiting on ssh ${ipv4}:${port}`);\n\t}\n\tlog(`[hetzner] ssh ready at ${ipv4}:${port}`);\n\n\tconst ssh = sshTarget({\n\t\thost: ipv4,\n\t\t...(options.user !== undefined ? { user: options.user } : {}),\n\t\t...(options.identity !== undefined ? { identity: options.identity } : {}),\n\t\t...(options.port !== undefined ? { port: options.port } : {})\n\t});\n\n\tconst serverId = current.id;\n\tconst resolvedIpv4 = ipv4;\n\n\treturn {\n\t\tdescription: `hetzner server \"${options.name}\" (${ssh.description})`,\n\t\tdestroy: () =>\n\t\t\tdestroyHetznerServer({ client, id: serverId }).then(() => {\n\t\t\t\tlog(`[hetzner] destroyed server ${serverId}`);\n\t\t\t}),\n\t\texec: ssh.exec,\n\t\tipv4: resolvedIpv4,\n\t\tserverId,\n\t\tupload: ssh.upload,\n\t\t...(ssh.close !== undefined ? { close: ssh.close } : {})\n\t};\n};\n"
+  ],
+  "mappings": ";;AAuBA;AACA;AA+CA,IAAM,eAAe,OACpB,QACA,WACqB;AAAA,EACrB,IAAI,CAAC;AAAA,IAAQ,OAAO;AAAA,EACpB,MAAM,UAAU,IAAI;AAAA,EACpB,IAAI,SAAS;AAAA,EACb,IAAI,YAAY;AAAA,EAChB,MAAM,SAAS,OAAO,UAAU;AAAA,EAChC,IAAI;AAAA,IACH,OAAO,MAAM;AAAA,MACZ,QAAQ,MAAM,UAAU,MAAM,OAAO,KAAK;AAAA,MAC1C,IAAI;AAAA,QAAM;AAAA,MACV,MAAM,QAAQ,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;AAAA,MACpD,aAAa;AAAA,MACb,IAAI,CAAC;AAAA,QAAQ;AAAA,MACb,UAAU;AAAA,MACV,IAAI,UAAU,OAAO,QAAQ;AAAA,CAAI;AAAA,MACjC,OAAO,YAAY,IAAI;AAAA,QACtB,MAAM,OAAO,OAAO,MAAM,GAAG,OAAO,EAAE,QAAQ,OAAO,EAAE;AAAA,QACvD,IAAI,KAAK,SAAS;AAAA,UAAG,OAAO,IAAI;AAAA,QAChC,SAAS,OAAO,MAAM,UAAU,CAAC;AAAA,QACjC,UAAU,OAAO,QAAQ;AAAA,CAAI;AAAA,MAC9B;AAAA,IACD;AAAA,IACA,MAAM,OAAO,QAAQ,OAAO;AAAA,IAC5B,aAAa;AAAA,IACb,IAAI,WAAW,SAAS,MAAM,SAAS;AAAA,MAAG,QAAQ,SAAS,MAAM,QAAQ,OAAO,EAAE,CAAC;AAAA,YAClF;AAAA,IACD,OAAO,YAAY;AAAA;AAAA,EAEpB,OAAO;AAAA;AAGR,IAAM,WAAW,OAChB,MACA,YAOyB;AAAA,EACzB,MAAM,OAAO,IAAI,MAAM,MAAM;AAAA,IAC5B,KAAK,QAAQ;AAAA,IACb,KAAK,QAAQ;AAAA,IACb,QAAQ;AAAA,IACR,OAAO,QAAQ,UAAU,YAAY,WAAW;AAAA,IAChD,QAAQ;AAAA,EACT,CAAC;AAAA,EAED,IAAI,QAAQ,UAAU,aAAa,KAAK,OAAO;AAAA,IAI9C,MAAM,OAAO,KAAK;AAAA,IAIlB,MAAM,QAAQ,KAAK,MAAM,QAAQ,KAAK;AAAA,IACtC,IAAI,SAAS,OAAQ,MAA0B,SAAS,YAAY;AAAA,MACnE,MAAM;AAAA,IACP;AAAA,IACA,MAAM,QAAQ,KAAK,IAAI;AAAA,IACvB,IAAI,SAAS,OAAQ,MAAwB,SAAS,YAAY;AAAA,MACjE,MAAM;AAAA,IACP;AAAA,EACD;AAAA,EAEA,MAAM,UAAU,QAAQ,aAAa;AAAA,EACrC,IAAI;AAAA,EACJ,IAAI,UAAU,GAAG;AAAA,IAChB,QAAQ,WAAW,MAAM;AAAA,MACxB,IAAI;AAAA,QAAE,KAAK,KAAK;AAAA,QAAK,MAAM;AAAA,OACzB,OAAO;AAAA,EACX;AAAA,EAEA,MAAM,gBAAgB,aACrB,KAAK,QACL,QAAQ,QAAQ,CAAC,SAAS,QAAQ,MAAO,MAAM,QAAQ,IAAI,SAC5D;AAAA,EACA,MAAM,gBAAgB,aACrB,KAAK,QACL,QAAQ,QAAQ,CAAC,SAAS,QAAQ,MAAO,MAAM,QAAQ,IAAI,SAC5D;AAAA,EAEA,OAAO,QAAQ,QAAQ,YAAY,MAAM,QAAQ,IAAI;AAAA,IACpD;AAAA,IACA;AAAA,IACA,KAAK;AAAA,EACN,CAAC;AAAA,EACD,IAAI;AAAA,IAAO,aAAa,KAAK;AAAA,EAE7B,OAAO,EAAE,UAAU,YAAY,IAAI,QAAQ,OAAO;AAAA;AAG5C,IAAM,cAAc,CAAC,YAAwC;AAAA,EACnE,MAAM,UAAU,KAAK,QAAQ,IAAI;AAAA,EACjC,MAAM,aAAa,YAAY;AAAA,IAAE,MAAM,MAAM,QAAQ,MAAM,EAAE,WAAW,KAAK,CAAC;AAAA;AAAA,EAE9E,OAAO;AAAA,IACN,aAAa,SAAS,QAAQ;AAAA,IAC9B,MAAM,OAAO,KAAK,SAAS;AAAA,MAC1B,MAAM,WAAW;AAAA,MACjB,OAAO,SAAS,CAAC,MAAM,MAAM,GAAG,GAAG;AAAA,QAClC,KAAK,MAAM,OAAO,QAAQ;AAAA,QAC1B,KAAK,KAAK,QAAQ,QAAQ,YAAa,MAAM,OAAO,CAAC,EAAG;AAAA,QACxD,OAAO,MAAM;AAAA,QACb,OAAO,MAAM;AAAA,QACb,WAAW,MAAM;AAAA,MAClB,CAAC;AAAA;AAAA,IAEF,QAAQ,OAAO,WAAW,YAAY,SAAS;AAAA,MAC9C,MAAM,WAAW;AAAA,MACjB,MAAM,OAAO,WAAW,WAAW,GAAG,IAAI,aAAa,KAAK,QAAQ,MAAM,UAAU;AAAA,MACpF,MAAM,OAAO,CAAC,SAAS,IAAI;AAAA,MAC3B,IAAI,MAAM;AAAA,QAAe,KAAK,KAAK,UAAU;AAAA,MAC7C,WAAW,WAAW,MAAM,WAAW,CAAC;AAAA,QAAG,KAAK,KAAK,aAAa,OAAO;AAAA,MAEzE,KAAK,KAAK,WAAW,IAAI;AAAA,MACzB,MAAM,SAAS,MAAM,SAAS,MAAM,EAAE,WAAW,OAAQ,CAAC;AAAA,MAC1D,IAAI,OAAO,aAAa,GAAG;AAAA,QAC1B,MAAM,IAAI,MAAM,6BAA6B,OAAO,cAAc,OAAO,UAAU,OAAO,QAAQ;AAAA,MACnG;AAAA;AAAA,EAEF;AAAA;AA+BD,IAAM,kBAAkB,CAAC,YAAsC;AAAA,EAC9D,MAAM,OAAO,QAAQ,QAAQ;AAAA,EAC7B,OAAO,GAAG,QAAQ,QAAQ;AAAA;AAG3B,IAAM,eAAe,CAAC,YAAwC;AAAA,EAC7D,MAAM,QAAkB,CAAC;AAAA,EACzB,IAAI,QAAQ,SAAS,aAAa,QAAQ,SAAS;AAAA,IAAI,MAAM,KAAK,MAAM,OAAO,QAAQ,IAAI,CAAC;AAAA,EAC5F,IAAI,QAAQ,aAAa;AAAA,IAAW,MAAM,KAAK,MAAM,QAAQ,QAAQ;AAAA,EAErE,MAAM,KAAK,MAAM,iBAAiB,MAAM,kCAAkC;AAAA,EAC1E,WAAW,QAAQ,QAAQ,YAAY,CAAC;AAAA,IAAG,MAAM,KAAK,IAAI;AAAA,EAC1D,OAAO;AAAA;AAGR,IAAM,aAAa,CAAC,UAA0B,IAAI,MAAM,QAAQ,MAAM,OAAO;AAE7E,IAAM,iBAAiB,CAAC,KAAa,SAA0C;AAAA,EAC9E,MAAM,MAAM,MAAM;AAAA,EAClB,MAAM,YAAY,MACf,OAAO,QAAQ,GAAG,EAAE,IAAI,EAAE,GAAG,OAAO,GAAG,KAAK,WAAW,CAAC,GAAG,EAAE,KAAK,GAAG,IAAI,MACzE;AAAA,EACH,IAAI,MAAM,KAAK;AAAA,IACd,OAAO,MAAM,WAAW,KAAK,GAAG,QAAQ,YAAY;AAAA,EACrD;AAAA,EACA,OAAO,GAAG,YAAY;AAAA;AAGhB,IAAM,YAAY,CAAC,YAAsC;AAAA,EAC/D,MAAM,SAAS,gBAAgB,OAAO;AAAA,EACtC,MAAM,WAAW,QAAQ,SAAS;AAAA,EAElC,OAAO;AAAA,IACN,aAAa,OAAO,SAAS,QAAQ,QAAQ,QAAQ,SAAS,KAAK,IAAI,QAAQ,SAAS;AAAA,IACxF,MAAM,OAAO,KAAK,SAAS;AAAA,MAC1B,MAAM,OAAO,CAAC,OAAO,GAAG,aAAa,OAAO,CAAC;AAAA,MAC7C,WAAW,QAAQ,QAAQ,cAAc,CAAC;AAAA,QAAG,KAAK,KAAK,MAAM,WAAW,MAAM;AAAA,MAC9E,KAAK,KAAK,QAAQ,eAAe,KAAK,IAAI,CAAC;AAAA,MAC3C,OAAO,SAAS,MAAM;AAAA,QACrB,OAAO,MAAM;AAAA,QACb,OAAO,MAAM;AAAA,QACb,WAAW,MAAM;AAAA,MAClB,CAAC;AAAA;AAAA,IAEF,QAAQ,OAAO,WAAW,YAAY,SAAS;AAAA,MAC9C,IAAI,UAAU;AAAA,QACb,MAAM,SAAS,CAAC,OAAO,GAAG,aAAa,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,SAAS,GAAG,IAAI,IAAI,UAAU,IAAI,EAAE,KAAK,GAAG;AAAA,QAChH,MAAM,QAAO,CAAC,SAAS,OAAO,MAAM,MAAM;AAAA,QAC1C,IAAI,MAAM;AAAA,UAAe,MAAK,KAAK,UAAU;AAAA,QAC7C,WAAW,WAAW,MAAM,WAAW,CAAC;AAAA,UAAG,MAAK,KAAK,aAAa,OAAO;AAAA,QACzE,MAAK,KAAK,WAAW,GAAG,UAAU,YAAY;AAAA,QAC9C,MAAM,UAAS,MAAM,SAAS,OAAM,EAAE,WAAW,OAAQ,CAAC;AAAA,QAC1D,IAAI,QAAO,aAAa,GAAG;AAAA,UAC1B,MAAM,IAAI,MAAM,6BAA6B,QAAO,cAAc,QAAO,UAAU,QAAO,QAAQ;AAAA,QACnG;AAAA,QACA;AAAA,MACD;AAAA,MAEA,MAAM,OAAO,CAAC,OAAO,MAAM,GAAG,aAAa,OAAO,GAAG,WAAW,GAAG,UAAU,YAAY;AAAA,MACzF,MAAM,SAAS,MAAM,SAAS,MAAM,EAAE,WAAW,OAAQ,CAAC;AAAA,MAC1D,IAAI,OAAO,aAAa,GAAG;AAAA,QAC1B,MAAM,IAAI,MAAM,2BAA2B,OAAO,cAAc,OAAO,UAAU,OAAO,QAAQ;AAAA,MACjG;AAAA;AAAA,EAEF;AAAA;;;ACzQD,IAAM,mBAAmB;AAAA;AAsGlB,MAAM,qBAAqB,MAAM;AAAA,EAC9B;AAAA,EACA;AAAA,EACT,WAAW,CAAC,SAAiB,QAAgB,MAAe;AAAA,IAC3D,MAAM,OAAO;AAAA,IACb,KAAK,OAAO;AAAA,IACZ,KAAK,SAAS;AAAA,IACd,KAAK,OAAO;AAAA;AAEd;AAOO,IAAM,sBAAsB,CAClC,OACA,UAAsD,CAAC,MAChC;AAAA,EACvB,MAAM,OAAO,QAAQ,WAAW;AAAA,EAChC,MAAM,IAAI,QAAQ,SAAS;AAAA,EAC3B,OAAO;AAAA,IACN,SAAS,OACR,QACA,MACA,SACgB;AAAA,MAChB,MAAM,OAAoB;AAAA,QACzB,SAAS;AAAA,UACR,eAAe,UAAU;AAAA,UACzB,gBAAgB;AAAA,QACjB;AAAA,QACA;AAAA,MACD;AAAA,MACA,IAAI,SAAS;AAAA,QAAW,KAAK,OAAO,KAAK,UAAU,IAAI;AAAA,MACvD,MAAM,WAAW,MAAM,EAAE,GAAG,OAAO,QAAQ,IAAI;AAAA,MAC/C,IAAI,SAAS,WAAW;AAAA,QAAK;AAAA,MAC7B,MAAM,OAAO,MAAM,SAAS,KAAK;AAAA,MACjC,MAAM,SAAS,KAAK,SAAS,IAAI,KAAK,MAAM,IAAI,IAAI;AAAA,MACpD,IAAI,CAAC,SAAS,IAAI;AAAA,QACjB,MAAM,IAAI,aACT,qBAAqB,UAAU,gBAAgB,SAAS,UAAU,SAAS,cAC3E,SAAS,QACT,MACD;AAAA,MACD;AAAA,MACA,OAAO;AAAA;AAAA,EAET;AAAA;AAGD,IAAM,gBAAgB,CACrB,YACuB;AAAA,EACvB,IAAI,QAAQ,WAAW;AAAA,IAAW,OAAO,QAAQ;AAAA,EACjD,IAAI,QAAQ,UAAU,aAAa,QAAQ,MAAM,SAAS,GAAG;AAAA,IAC5D,OAAO,oBAAoB,QAAQ,KAAK;AAAA,EACzC;AAAA,EACA,MAAM,IAAI,MACT,8DACD;AAAA;AAGD,IAAM,aAAa,CAAC,WACnB,OAAO,WAAW,MAAM;AAEzB,IAAM,eAAe,CAAC,OACrB,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAEjD,IAAM,kBAAkB,OAAO,MAAc,SAAmC;AAAA,EAC/E,MAAM,mBAAmB;AAAA,EACzB,OAAO,IAAI,QAAiB,CAAC,YAAY;AAAA,IACxC,IAAI,UAAU;AAAA,IACd,MAAM,SAAS,CAAC,UAAmB;AAAA,MAClC,IAAI;AAAA,QAAS;AAAA,MACb,UAAU;AAAA,MACV,QAAQ,KAAK;AAAA;AAAA,IAEd,MAAM,QAAQ,WAAW,MAAM,OAAO,KAAK,GAAG,gBAAgB;AAAA,IAC9D,IAAI,QAAQ;AAAA,MACX,UAAU;AAAA,MACV;AAAA,MACA,QAAQ;AAAA,QACP,MAAM,MAAM;AAAA,QACZ,OAAO,MAAM;AAAA,UACZ,aAAa,KAAK;AAAA,UAClB,OAAO,KAAK;AAAA;AAAA,QAEb,MAAM,CAAC,WAAW;AAAA,UACjB,aAAa,KAAK;AAAA,UAClB,OAAO,IAAI;AAAA,UACX,OAAO,IAAI;AAAA;AAAA,MAEb;AAAA,IACD,CAAC,EAAE,MAAM,MAAM;AAAA,MACd,aAAa,KAAK;AAAA,MAClB,OAAO,KAAK;AAAA,KACZ;AAAA,GACD;AAAA;AASK,IAAM,oBAAoB,OAChC,QACA,SACwC;AAAA,EACxC,MAAM,OAAO,MAAM,OAAO,QACzB,OACA,iBAAiB,mBAAmB,IAAI,GACzC;AAAA,EACA,MAAM,UAAU,KAAK,QAAQ,OAAO,CAAC,WAAW,OAAO,SAAS,IAAI;AAAA,EACpE,IAAI,QAAQ,WAAW;AAAA,IAAG;AAAA,EAC1B,IAAI,QAAQ,SAAS,GAAG;AAAA,IACvB,MAAM,IAAI,MACT,4CAA4C,UAAU,QACpD,IAAI,CAAC,WAAW,OAAO,EAAE,EACzB,KAAK,IAAI,2DACZ;AAAA,EACD;AAAA,EACA,OAAO,QAAQ;AAAA;AAIT,IAAM,qBAAqB,OAAO,YAKT;AAAA,EAC/B,MAAM,SAAS,cAAc,OAAO;AAAA,EACpC,MAAM,OACL,QAAQ,kBAAkB,YACvB,2BAA2B,mBAAmB,QAAQ,aAAa,MACnE;AAAA,EACJ,MAAM,OAAO,MAAM,OAAO,QAAsC,OAAO,IAAI;AAAA,EAC3E,OAAO,KAAK;AAAA;AAIN,IAAM,uBAAuB,OAAO,YAItB;AAAA,EACpB,MAAM,SAAS,cAAc,OAAO;AAAA,EACpC,IAAI;AAAA,IACH,MAAM,OAAO,QAAQ,UAAU,YAAY,QAAQ,IAAI;AAAA,IACtD,OAAO,OAAO;AAAA,IACf,IAAI,iBAAiB,gBAAgB,MAAM,WAAW,KAAK;AAAA,MAC1D;AAAA,IACD;AAAA,IACA,MAAM;AAAA;AAAA;AAQD,IAAM,gBAAgB,OAC5B,YAC4B;AAAA,EAC5B,MAAM,SAAS,cAAc,OAAO;AAAA,EACpC,MAAM,MAAM,QAAQ,UAAU,MAAM;AAAA,EACpC,MAAM,WAAW,QAAQ,YAAY;AAAA,EACrC,MAAM,QAAQ,QAAQ,SAAS;AAAA,EAC/B,MAAM,MAAM,QAAQ,OAAO,KAAK;AAAA,EAChC,MAAM,SAAS,QAAQ,kBAAkB;AAAA,EACzC,MAAM,mBAAmB,QAAQ,sBAAsB,IAAI;AAAA,EAC3D,MAAM,aAAa,QAAQ,yBAAyB,IAAI;AAAA,EACxD,MAAM,OAAO,QAAQ,QAAQ;AAAA,EAE7B,MAAM,WAAW,MAAM,kBAAkB,QAAQ,QAAQ,IAAI;AAAA,EAC7D,IAAI;AAAA,EACJ,IAAI,aAAa,WAAW;AAAA,IAC3B,IAAI,8BAA8B,QAAQ,YAAY,QAAQ,UAAU;AAAA,IACxE,MAAM,oBAAoB,QAAQ,sBAAsB;AAAA,IACxD,MAAM,oBAAoB,QAAQ,sBAAsB;AAAA,IACxD,MAAM,UAAU,MAAM,OAAO,QAC5B,QACA,YACA;AAAA,MACC,MAAM,QAAQ;AAAA,MACd,UAAU,QAAQ;AAAA,MAClB,aAAa,QAAQ;AAAA,MACrB,OAAO,QAAQ;AAAA,MACf,UAAU,CAAC,GAAG,QAAQ,OAAO;AAAA,MAC7B,oBAAoB;AAAA,MACpB,YAAY;AAAA,QACX,aAAa;AAAA,QACb,aAAa;AAAA,MACd;AAAA,SACI,QAAQ,WAAW,YAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,SAC7D,QAAQ,aAAa,YACtB,EAAE,WAAW,QAAQ,SAAS,IAC9B,CAAC;AAAA,SACA,QAAQ,cAAc,YACvB,EAAE,UAAU,CAAC,QAAQ,SAAS,EAAE,IAChC,CAAC;AAAA,IACL,CACD;AAAA,IACA,UAAU,QAAQ;AAAA,EACnB,EAAO;AAAA,IACN,IACC,6BAA6B,QAAQ,aAAa,SAAS,cAAc,SAAS,SACnF;AAAA,IACA,UAAU;AAAA;AAAA,EAIX,MAAM,iBAAiB,IAAI;AAAA,EAC3B,IAAI,OAAO,WAAW,OAAO;AAAA,EAC7B,OAAO,QAAQ,WAAW,aAAa,SAAS,WAAW;AAAA,IAC1D,IAAI,IAAI,IAAI,iBAAiB,kBAAkB;AAAA,MAC9C,MAAM,IAAI,MACT,4CAA4C,oCAA8B,QAAQ,cAAc,QAAQ,iBAAiB,QAAQ,gBAClI;AAAA,IACD;AAAA,IACA,MAAM,MAAM,MAAM;AAAA,IAClB,MAAM,YAAuC,MAAM,OAAO,QACzD,OACA,YAAY,QAAQ,IACrB;AAAA,IACA,UAAU,UAAU;AAAA,IACpB,OAAO,WAAW,OAAO;AAAA,IACzB,IAAI,0BAA0B,QAAQ,eAAe,QAAQ,cAAc;AAAA,EAC5E;AAAA,EACA,IAAI,+BAA+B,MAAM;AAAA,EAGzC,MAAM,WAAW,IAAI;AAAA,EACrB,OAAO,CAAE,MAAM,SAAS,MAAM,IAAI,GAAI;AAAA,IACrC,IAAI,IAAI,IAAI,WAAW,YAAY;AAAA,MAClC,MAAM,IAAI,MACT,gDAAgD,uBAAiB,QAAQ,iCAC1E;AAAA,IACD;AAAA,IACA,MAAM,MAAM,MAAM;AAAA,IAClB,IAAI,4BAA4B,QAAQ,MAAM;AAAA,EAC/C;AAAA,EACA,IAAI,0BAA0B,QAAQ,MAAM;AAAA,EAE5C,MAAM,MAAM,UAAU;AAAA,IACrB,MAAM;AAAA,OACF,QAAQ,SAAS,YAAY,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;AAAA,OACvD,QAAQ,aAAa,YAAY,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,OACnE,QAAQ,SAAS,YAAY,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;AAAA,EAC5D,CAAC;AAAA,EAED,MAAM,WAAW,QAAQ;AAAA,EACzB,MAAM,eAAe;AAAA,EAErB,OAAO;AAAA,IACN,aAAa,mBAAmB,QAAQ,UAAU,IAAI;AAAA,IACtD,SAAS,MACR,qBAAqB,EAAE,QAAQ,IAAI,SAAS,CAAC,EAAE,KAAK,MAAM;AAAA,MACzD,IAAI,8BAA8B,UAAU;AAAA,KAC5C;AAAA,IACF,MAAM,IAAI;AAAA,IACV,MAAM;AAAA,IACN;AAAA,IACA,QAAQ,IAAI;AAAA,OACR,IAAI,UAAU,YAAY,EAAE,OAAO,IAAI,MAAM,IAAI,CAAC;AAAA,EACvD;AAAA;",
+  "debugId": "0EE85A74FB8C508064756E2164756E21",
+  "names": []
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@absolutejs/deploy",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Generic Bun-project deploy pipeline. A Target (localTarget / sshTarget) is anywhere you can exec + upload — DigitalOcean droplets, Linode, Hetzner, Vultr, your own boxes. Bundled pipeline: prepare → upload → install → build → link → restart → verify. Atomic symlink swap, release history, prune, hooks. SSH shells out to system ssh/rsync — zero ssh2 deps.",
   "repository": {
     "type": "git",
@@ -26,7 +26,7 @@
     "release"
   ],
   "scripts": {
-    "build": "rm -rf dist && bun build src/index.ts src/digitalocean.ts --outdir dist --sourcemap --target=bun && tsc --project tsconfig.build.json",
+    "build": "rm -rf dist && bun build src/index.ts src/digitalocean.ts src/hetzner.ts --outdir dist --sourcemap --target=bun && tsc --project tsconfig.build.json",
     "test": "bun test tests/",
     "typecheck": "tsc --noEmit",
     "format": "prettier --write \"./**/*.{ts,json,md}\"",
@@ -51,6 +51,11 @@
       "types": "./dist/digitalocean.d.ts",
       "import": "./dist/digitalocean.js",
       "default": "./dist/digitalocean.js"
+    },
+    "./hetzner": {
+      "types": "./dist/hetzner.d.ts",
+      "import": "./dist/hetzner.js",
+      "default": "./dist/hetzner.js"
     }
   },
   "files": ["dist", "README.md"]