@mybase-dev/cli 1.0.12 → 1.0.13

package/dist/mybase.js

@@ -100,6 +100,7 @@ var init_src = __esm(() => {
     { id: "captcha", name: "Captcha", description: "Captcha settings (read), and verifying tokens (write)" },
     { id: "realtime", name: "Realtime", description: "Channels, members, and settings (read), and publishing messages (write)" },
     { id: "sandbox", name: "Agent sandboxes", description: "Sandboxes, executions, files, artifacts, and browser connections" },
+    { id: "hosting", name: "Hosting", description: "Sites, deploys, and logs (read); pushing images, deploying, and changing sites (write)" },
     { id: "audit", name: "Audit log", description: "Who did what: sign-ins, key and project changes, secret reads (read only)" }
   ];
 });
@@ -109,7 +110,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@mybase-dev/cli",
-    version: "1.0.12",
+    version: "1.0.13",
     description: "The mybase CLI: projects, keys, cron, queues, cache, rate limits, analytics, docs, and agent setup for a self-hosted mybase.",
     type: "module",
     repository: {
@@ -1347,7 +1348,7 @@ ${h}
       }
     }
   }).prompt();
-}, log, cancel = (o = "", t) => {
+}, log2, cancel = (o = "", t) => {
   const i = t?.output ?? process.stdout, e = t?.withGuide ?? settings.withGuide ? `${styleText2("gray", S_BAR_END)}  ` : "";
   i.write(`${e}${styleText2("red", o)}
 
@@ -1557,7 +1558,7 @@ ${f}
       }
     }
   }).prompt();
-}, i, text = (t) => new n({
+}, i, text2 = (t) => new n({
   validate: t.validate,
   placeholder: t.placeholder,
   defaultValue: t.defaultValue,
@@ -1638,7 +1639,7 @@ var init_dist4 = __esm(() => {
     `${styleText2("dim", "Space:")} select`,
     `${styleText2("dim", "Enter:")} confirm`
   ];
-  log = {
+  log2 = {
     message: (s = [], {
       symbol: e = styleText2("gray", S_BAR),
       secondarySymbol: r = styleText2("gray", S_BAR),
@@ -1662,22 +1663,22 @@ var init_dist4 = __esm(() => {
 `);
     },
     info: (s, e) => {
-      log.message(s, { ...e, symbol: styleText2("blue", S_INFO) });
+      log2.message(s, { ...e, symbol: styleText2("blue", S_INFO) });
     },
     success: (s, e) => {
-      log.message(s, { ...e, symbol: styleText2("green", S_SUCCESS) });
+      log2.message(s, { ...e, symbol: styleText2("green", S_SUCCESS) });
     },
     step: (s, e) => {
-      log.message(s, { ...e, symbol: styleText2("green", S_STEP_SUBMIT) });
+      log2.message(s, { ...e, symbol: styleText2("green", S_STEP_SUBMIT) });
     },
     warn: (s, e) => {
-      log.message(s, { ...e, symbol: styleText2("yellow", S_WARN) });
+      log2.message(s, { ...e, symbol: styleText2("yellow", S_WARN) });
     },
     warning: (s, e) => {
-      log.warn(s, e);
+      log2.warn(s, e);
     },
     error: (s, e) => {
-      log.message(s, { ...e, symbol: styleText2("red", S_ERROR) });
+      log2.message(s, { ...e, symbol: styleText2("red", S_ERROR) });
     }
   };
   u2 = {
@@ -1868,8 +1869,17 @@ services:
       MYBASE_SANDBOX_WORKER_URL: \${MYBASE_SANDBOX_WORKER_URL:-}
       MYBASE_SANDBOX_WORKER_KEY: \${MYBASE_SANDBOX_WORKER_KEY:-}
       MYBASE_SANDBOX_CONFIG: \${MYBASE_SANDBOX_CONFIG:-}
+      # Hosting (see the hosting services below). Sites live at <site>.MYBASE_HOSTING_DOMAIN.
+      MYBASE_HOSTING_WORKER_URL: \${MYBASE_HOSTING_WORKER_URL:-}
+      MYBASE_HOSTING_WORKER_KEY: \${MYBASE_HOSTING_WORKER_KEY:-}
+      MYBASE_HOSTING_DOMAIN: \${MYBASE_HOSTING_DOMAIN:-}
+      MYBASE_HOSTING_MEMORY: \${MYBASE_HOSTING_MEMORY:-512m}
+      MYBASE_HOSTING_PORT: \${MYBASE_HOSTING_PORT:-80}
     ports:
       - "\${MYBASE_BIND:-0.0.0.0}:\${MYBASE_PORT:-4000}:4000"
+    volumes:
+      # Caddy's admin socket (hosting). Only the API shares this volume.
+      - caddy-admin:/run/caddy
 
   # Official Postgres plus extensions projects can enable (see postgres.Dockerfile).
   # Upgrading from postgres:17-alpine: the data volume is compatible, but text sort order
@@ -1967,6 +1977,60 @@ services:
       start_period: 30s
     # Private Compose network only. No published worker or browser-debugging ports.
 
+  # Hosting (opt-in, COMPOSE_PROFILES=hosting; \`mybase server hosting\` sets it up). Sites run as
+  # containers on this Docker host, one network per project; Caddy routes <site>.<domain> to them.
+  # Image registry: internal. Pushes go through the API (\`docker login <mybase host>\` with an API
+  # key); the Docker daemon pulls from 127.0.0.1:5000, which only this machine can reach.
+  registry:
+    image: registry:3.0.0
+    profiles: [hosting]
+    restart: \${MYBASE_RESTART:-unless-stopped}
+    environment:
+      REGISTRY_STORAGE_DELETE_ENABLED: "true"
+      # Upload URLs stay relative, so they work through the API's /v2 proxy.
+      REGISTRY_HTTP_RELATIVEURLS: "true"
+      OTEL_TRACES_EXPORTER: none
+    ports:
+      - "127.0.0.1:\${MYBASE_REGISTRY_PORT:-5000}:5000"
+    volumes:
+      - registry-data:/var/lib/registry
+
+  # Routes <site>.<domain> to each site's live container. Its config comes from the API, over an
+  # admin socket on a volume only the API shares (Caddy is on every project network). TLS ends at
+  # Cloudflare; on a LAN, sites answer on port 80 (MYBASE_HOSTING_PORT).
+  caddy:
+    image: caddy:2.10.2-alpine
+    profiles: [hosting]
+    restart: \${MYBASE_RESTART:-unless-stopped}
+    command: caddy run --resume --config /etc/caddy/initial.json
+    configs:
+      - source: caddy
+        target: /etc/caddy/initial.json
+    ports:
+      - "\${MYBASE_HOSTING_BIND:-0.0.0.0}:\${MYBASE_HOSTING_PORT:-80}:80"
+    volumes:
+      - caddy-admin:/run/caddy
+      - caddy-config:/config
+      - caddy-data:/data
+
+  # Trusted worker that runs site containers. No site ever gets this socket or key, and the
+  # worker isn't on project networks.
+  hosting-worker:
+    image: \${MYBASE_HOSTING_WORKER_IMAGE:-ghcr.io/landonharter/mybase-hosting-worker:latest}
+    profiles: [hosting]
+    restart: \${MYBASE_RESTART:-unless-stopped}
+    environment:
+      MYBASE_HOSTING_WORKER_KEY: \${MYBASE_HOSTING_WORKER_KEY:-}
+      MYBASE_COMPOSE_PROJECT: mybase
+      LOG_LEVEL: \${LOG_LEVEL:-info}
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+    healthcheck:
+      test: ["CMD", "bun", "-e", "fetch('http://127.0.0.1:4020/health',{headers:{Authorization:'Bearer '+process.env.MYBASE_HOSTING_WORKER_KEY}}).then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
+      interval: 30s
+      timeout: 5s
+      start_period: 20s
+
   # Cloudflare Tunnel: public HTTPS without opening router ports. Off unless COMPOSE_PROFILES=tunnel.
   # Hostnames are set up in the Cloudflare dashboard (see the top of this file).
   cloudflared:
@@ -1985,6 +2049,11 @@ services:
       - mybase
 
 configs:
+  # Caddy's first config, until the API loads the real one (and after that, its autosave).
+  caddy:
+    content: |
+      {"admin":{"listen":"unix//run/caddy/admin.sock|0666"},"apps":{"http":{"servers":{"sites":{"listen":[":80"],"automatic_https":{"disable":true}}}}}}
+
   garage:
     content: |
       metadata_dir = "/var/lib/garage/meta"
@@ -2029,6 +2098,10 @@ volumes:
   garage-meta:
   garage-data:
   valkey-data:
+  registry-data:
+  caddy-admin:
+  caddy-config:
+  caddy-data:
 `;
 var init_compose = () => {};
 
@@ -2138,7 +2211,7 @@ function versionAtLeast(version, min) {
       return (a[i] ?? 0) > (b[i] ?? 0);
   return true;
 }
-var SECRET_KEYS, SECTIONS, LINE, isSecretKey = (key) => (key in SECRET_KEYS) || key === "CLOUDFLARE_TUNNEL_TOKEN" || key === "MYBASE_SANDBOX_WORKER_KEY";
+var SECRET_KEYS, SECTIONS, LINE, isSecretKey = (key) => (key in SECRET_KEYS) || key === "CLOUDFLARE_TUNNEL_TOKEN" || key === "MYBASE_SANDBOX_WORKER_KEY" || key === "MYBASE_HOSTING_WORKER_KEY";
 var init_server_env = __esm(() => {
   SECRET_KEYS = {
     POSTGRES_PASSWORD: { bytes: 24, encoding: "hex" },
@@ -2173,7 +2246,7 @@ var init_server_env = __esm(() => {
 });
 
 // src/server-docker.ts
-import { existsSync, readFileSync } from "fs";
+import { existsSync as existsSync2, readFileSync } from "fs";
 import { statfs } from "fs/promises";
 import { freemem, hostname as hostname2, networkInterfaces, totalmem } from "os";
 function run2(cmd, cwd) {
@@ -2219,7 +2292,7 @@ async function compose(dir, args) {
   return { ok: code === 0, stdout: stdout.trim(), stderr: stderr.trim() };
 }
 async function stackExists(dir) {
-  if (!existsSync(`${dir}/compose.yml`))
+  if (!existsSync2(`${dir}/compose.yml`))
     return false;
   const ps = await compose(dir, ["ps", "-a", "-q"]);
   return ps.ok && ps.stdout.length > 0;
@@ -2271,7 +2344,7 @@ function machine() {
 }
 async function freeDiskGb(dir) {
   for (let d = dir;; d = d.replace(/\/[^/]*$/, "") || "/") {
-    if (existsSync(d)) {
+    if (existsSync2(d)) {
       try {
         const s = await statfs(d);
         return s.bavail * s.bsize / 2 ** 30;
@@ -2368,7 +2441,7 @@ var MIN_COMPOSE = "2.23.1", DOCKER_INSTALL_URL = "https://docs.docker.com/engine
 var init_server_docker = __esm(() => {
   init_compose();
   init_server_env();
-  LOG_SERVICES = ["mybase", "postgres", "garage", "valkey", "searxng", "cloudflared", "sandbox-worker"];
+  LOG_SERVICES = ["mybase", "postgres", "garage", "valkey", "searxng", "cloudflared", "sandbox-worker", "hosting-worker", "caddy", "registry"];
   LOG_ALIASES = {
     api: "mybase",
     dashboard: "mybase",
@@ -2380,16 +2453,18 @@ var init_server_docker = __esm(() => {
     search: "searxng",
     tunnel: "cloudflared",
     sandbox: "sandbox-worker",
-    worker: "sandbox-worker"
+    worker: "sandbox-worker",
+    hosting: "hosting-worker",
+    proxy: "caddy"
   };
 });
 
 // src/server-gvisor.ts
-import { createHash } from "crypto";
-import { access, mkdtemp, rm } from "fs/promises";
+import { createHash as createHash2 } from "crypto";
+import { access, mkdtemp, rm as rm3 } from "fs/promises";
 import { constants as constants2 } from "fs";
-import { tmpdir } from "os";
-import { join as join3 } from "path";
+import { tmpdir as tmpdir3 } from "os";
+import { join as join5 } from "path";
 async function tail(stream) {
   const decoder = new TextDecoder;
   let text = "";
@@ -2443,7 +2518,7 @@ async function installGvisor(info, run = hostRun) {
       break;
     } catch {}
   }
-  const root = await mkdtemp(join3(tmpdir(), "mybase-gvisor-"));
+  const root = await mkdtemp(join5(tmpdir3(), "mybase-gvisor-"));
   try {
     let archive = null;
     if (!binary) {
@@ -2456,9 +2531,9 @@ async function installGvisor(info, run = hostRun) {
       const response = await fetch(`${base}/gvisor.tar.bz2`, { signal: AbortSignal.timeout(180000) });
       if (!response.ok || !response.body)
         throw new CliError("couldn't download the gVisor release bundle");
-      archive = join3(root, "gvisor.tar.bz2");
+      archive = join5(root, "gvisor.tar.bz2");
       const sink = Bun.file(archive).writer();
-      const hash = createHash("sha512");
+      const hash = createHash2("sha512");
       let size = 0;
       try {
         for await (const chunk of response.body) {
@@ -2501,7 +2576,7 @@ async function installGvisor(info, run = hostRun) {
       throw new CliError("gVisor was installed, but Docker's systemd service couldn't reload. Reload the daemon's runtime configuration on this host, then rerun this command; existing containers were not restarted");
     return true;
   } finally {
-    await rm(root, { recursive: true, force: true });
+    await rm3(root, { recursive: true, force: true });
   }
 }
 var hostRun = async (args, options = {}) => {
@@ -2638,6 +2713,10 @@ function cloudflare(token, fetcher = fetch, permissions = TOKEN_PERMISSIONS) {
     putIngress: (accountId, tunnelId, rules) => call("PUT", `/accounts/${accountId}/cfd_tunnel/${tunnelId}/configurations`, {
       config: { ingress: [...rules, { service: "http_status:404" }] }
     }),
+    async getIngress(accountId, tunnelId) {
+      const result = await call("GET", `/accounts/${accountId}/cfd_tunnel/${tunnelId}/configurations`);
+      return (result.config?.ingress ?? []).flatMap((r) => r.hostname ? [{ hostname: r.hostname, service: r.service }] : []);
+    },
     async findRecord(zoneId, name) {
       const records = await call("GET", `/zones/${zoneId}/dns_records?name=${encodeURIComponent(name)}`);
       return records[0] ?? null;
@@ -2653,6 +2732,11 @@ function cloudflare(token, fetcher = fetch, permissions = TOKEN_PERMISSIONS) {
     tunnelToken: (accountId, tunnelId) => call("GET", `/accounts/${accountId}/cfd_tunnel/${tunnelId}/token`)
   };
 }
+function mergeIngress(existing, updates, remove = []) {
+  const drop = new Set([...updates.map((r) => r.hostname), ...remove]);
+  const all = [...updates, ...existing.filter((r) => !drop.has(r.hostname))];
+  return [...all.filter((r) => !r.hostname.startsWith("*.")), ...all.filter((r) => r.hostname.startsWith("*."))];
+}
 function zoneOf(zones, host) {
   const name = host.toLowerCase().replace(/\.$/, "");
   let best = null;
@@ -2679,7 +2763,7 @@ var init_cloudflare2 = __esm(() => {
 // src/server-setup.ts
 import { chmod as chmod2, mkdir as mkdir3 } from "fs/promises";
 import { homedir as homedir2, hostname as hostname3 } from "os";
-import { join as join4, resolve as resolve4 } from "path";
+import { join as join6, resolve as resolve5 } from "path";
 import { styleText as styleText3 } from "util";
 function flag(args, name) {
   const i = args.indexOf(name);
@@ -2693,7 +2777,7 @@ function flag(args, name) {
 async function serverDir(args) {
   const given = flag(args, "--dir");
   if (given)
-    return resolve4(given.replace(/^~(?=$|\/)/, homedir2()));
+    return resolve5(given.replace(/^~(?=$|\/)/, homedir2()));
   return (await loadConfig()).server ?? DEFAULT_DIR;
 }
 async function ask(answer) {
@@ -2732,13 +2816,13 @@ async function preflight(dir) {
 async function chooseDir(args, interactive) {
   let dir = await serverDir(args);
   if (interactive && !args.includes("--dir")) {
-    const answer = await ask(text({
+    const answer = await ask(text2({
       message: "Where should mybase keep its files?",
       placeholder: tilde(dir),
       defaultValue: dir,
       validate: (v) => v && !v.trim().startsWith("/") && !v.trim().startsWith("~") ? "use an absolute path (or ~/\u2026)" : undefined
     }));
-    dir = resolve4(answer.trim().replace(/^~(?=$|\/)/, homedir2()));
+    dir = resolve5(answer.trim().replace(/^~(?=$|\/)/, homedir2()));
   }
   const other = otherInstall(dir);
   if (other) {
@@ -2755,7 +2839,7 @@ async function chooseHost(current) {
   const picked = await ask(select({ message: "Which address should apps on your network use?", options, initialValue: current ?? options[0]?.value }));
   if (picked)
     return picked;
-  return (await ask(text({ message: "Address (hostname or IP)", validate: (v) => v?.trim() ? undefined : "required" }))).trim();
+  return (await ask(text2({ message: "Address (hostname or IP)", validate: (v) => v?.trim() ? undefined : "required" }))).trim();
 }
 async function tunnelStep() {
   const mode = await ask(select({
@@ -2816,8 +2900,8 @@ async function autoTunnel() {
     let apiHost = "";
     let s3Host = "";
     for (;; ) {
-      const apiSub = await ask(text({ message: "Subdomain for the dashboard + API", placeholder: "mybase", defaultValue: "mybase" }));
-      const s3Sub = await ask(text({ message: "Subdomain for S3 storage", placeholder: "s3", defaultValue: "s3" }));
+      const apiSub = await ask(text2({ message: "Subdomain for the dashboard + API", placeholder: "mybase", defaultValue: "mybase" }));
+      const s3Sub = await ask(text2({ message: "Subdomain for S3 storage", placeholder: "s3", defaultValue: "s3" }));
       apiHost = `${apiSub.trim()}.${zone.name}`;
       s3Host = `${s3Sub.trim()}.${zone.name}`;
       if (validHost(apiHost) || validHost(s3Host) || apiHost === s3Host) {
@@ -2838,10 +2922,11 @@ async function autoTunnel() {
     }
     s.start("Routing hostnames to the tunnel");
     try {
-      await cf.putIngress(zone.account.id, tunnel.id, [
+      const current = tunnel.created ? [] : await cf.getIngress(zone.account.id, tunnel.id).catch(() => []);
+      await cf.putIngress(zone.account.id, tunnel.id, mergeIngress(current, [
         { hostname: apiHost, service: "http://mybase:4000" },
         { hostname: s3Host, service: "http://garage:3900" }
-      ]);
+      ]));
       await cf.upsertCname(zone.id, apiHost, tunnel.id);
       await cf.upsertCname(zone.id, s3Host, tunnel.id);
       const tunnelToken = await cf.tunnelToken(zone.account.id, tunnel.id);
@@ -2868,9 +2953,9 @@ async function manualTunnel() {
   ].join(`
 `), "Cloudflare Tunnel, by hand");
   const token = await ask(password({ message: "Tunnel token", validate: (v) => tunnelIdFromToken(v ?? "") ? undefined : "that isn't a tunnel token (copy the part after --token)" }));
-  const apiHost = (await ask(text({ message: "Hostname for the dashboard + API", placeholder: "mybase.example.com", validate: validHost }))).trim();
+  const apiHost = (await ask(text2({ message: "Hostname for the dashboard + API", placeholder: "mybase.example.com", validate: validHost }))).trim();
   const defaultS3 = apiHost.replace(/^[^.]+/, "s3");
-  const s3Host = (await ask(text({ message: "Hostname for S3", placeholder: defaultS3, defaultValue: defaultS3, validate: (v) => validHost(v || defaultS3) }))).trim();
+  const s3Host = (await ask(text2({ message: "Hostname for S3", placeholder: defaultS3, defaultValue: defaultS3, validate: (v) => validHost(v || defaultS3) }))).trim();
   return { env: tunnelEnv(token.trim(), apiHost, s3Host), apiHost, s3Host };
 }
 async function bindStep(lan, existing) {
@@ -2916,7 +3001,7 @@ async function dbPublicStep(existing) {
     const zoneId = zones.length === 1 ? zones[0].id : await ask(select({ message: "Which domain?", options: zones.map((z) => ({ value: z.id, label: z.name })), initialValue: preferred?.id }));
     const chosen = zones.find((z) => z.id === zoneId);
     const suggested = existing.MYBASE_DB_PUBLIC_HOST && zoneOf([chosen], existing.MYBASE_DB_PUBLIC_HOST) ? existing.MYBASE_DB_PUBLIC_HOST : `db.${chosen.name}`;
-    const host = (await ask(text({
+    const host = (await ask(text2({
       message: "Hostname for the database",
       placeholder: suggested,
       defaultValue: suggested,
@@ -2934,7 +3019,7 @@ async function dbPublicStep(existing) {
         continue;
       await cf.deleteRecord(chosen.id, record.id);
     }
-    const email = (await ask(text({ message: "Email for Let's Encrypt expiry notices (optional)", placeholder: "skip" }))).trim();
+    const email = (await ask(text2({ message: "Email for Let's Encrypt expiry notices (optional)", placeholder: "skip" }))).trim();
     return {
       MYBASE_DB_PUBLIC: "on",
       MYBASE_DB_PUBLIC_HOST: host,
@@ -2954,7 +3039,7 @@ async function adminStep() {
   }));
   if (when === "later")
     return null;
-  const username = (await ask(text({ message: "Admin username", placeholder: "admin", defaultValue: "admin", validate: (v) => !v || USERNAME_PATTERN.test(v) ? undefined : "letters, digits, or . _ @ -" }))).trim();
+  const username = (await ask(text2({ message: "Admin username", placeholder: "admin", defaultValue: "admin", validate: (v) => !v || USERNAME_PATTERN.test(v) ? undefined : "letters, digits, or . _ @ -" }))).trim();
   for (;; ) {
     const password2 = await ask(password({ message: `Password (at least ${ADMIN_PASSWORD_MIN} characters)`, validate: (v) => (v?.length ?? 0) >= ADMIN_PASSWORD_MIN ? undefined : `at least ${ADMIN_PASSWORD_MIN} characters` }));
     const again = await ask(password({ message: "Same password again" }));
@@ -3007,7 +3092,7 @@ async function advancedStep(env) {
     else if (env[key] !== undefined)
       out[key] = null;
   };
-  const port = (key, label, fallback) => ask(text({ message: `${label} port`, placeholder: env[key] ?? fallback, defaultValue: env[key] ?? fallback, validate: (v) => v ? validPort(v) : undefined })).then((v) => set(key, v.trim(), fallback));
+  const port = (key, label, fallback) => ask(text2({ message: `${label} port`, placeholder: env[key] ?? fallback, defaultValue: env[key] ?? fallback, validate: (v) => v ? validPort(v) : undefined })).then((v) => set(key, v.trim(), fallback));
   await port("MYBASE_PORT", "Dashboard + API", "4000");
   await port("POSTGRES_PORT", "Postgres", "5432");
   await port("GARAGE_S3_PORT", "S3", "3900");
@@ -3018,7 +3103,7 @@ async function advancedStep(env) {
     options: ["64mb", "128mb", "256mb", "512mb", "1gb"].map((v) => ({ value: v, label: v, hint: v === "64mb" ? "default, fine for a Pi" : undefined }))
   }));
   set("CACHE_MAXMEMORY", memory, "64mb");
-  const capacity = await ask(text({ message: "Storage capacity Garage advertises", placeholder: env.GARAGE_CAPACITY ?? "100G", defaultValue: env.GARAGE_CAPACITY ?? "100G", validate: (v) => !v || /^\d+[KMGT]?$/i.test(v) ? undefined : "like 100G or 2T" }));
+  const capacity = await ask(text2({ message: "Storage capacity Garage advertises", placeholder: env.GARAGE_CAPACITY ?? "100G", defaultValue: env.GARAGE_CAPACITY ?? "100G", validate: (v) => !v || /^\d+[KMGT]?$/i.test(v) ? undefined : "like 100G or 2T" }));
   set("GARAGE_CAPACITY", capacity.trim(), "100G");
   const level = await ask(select({ message: "Log level", initialValue: env.LOG_LEVEL ?? "info", options: ["debug", "info", "warn", "error"].map((v) => ({ value: v, label: v })) }));
   set("LOG_LEVEL", level, "info");
@@ -3041,28 +3126,28 @@ async function portStep(env, interactive) {
     let next = Number(current) + 1;
     while (!portFree(next) && next < 65535)
       next++;
-    const answer = await ask(text({ message: `Port ${current} (${label}) is in use by something else. Use which port?`, placeholder: String(next), defaultValue: String(next), validate: (v) => v ? validPort(v) : undefined }));
+    const answer = await ask(text2({ message: `Port ${current} (${label}) is in use by something else. Use which port?`, placeholder: String(next), defaultValue: String(next), validate: (v) => v ? validPort(v) : undefined }));
     out[key] = answer.trim();
   }
   return out;
 }
 async function writeFiles(dir, envText, interactive, replaceCompose = interactive) {
   await mkdir3(dir, { recursive: true });
-  const envPath = join4(dir, ".env");
+  const envPath = join6(dir, ".env");
   await Bun.write(envPath, envText);
   await chmod2(envPath, 384);
   await writeCompose(dir, interactive, replaceCompose);
 }
 async function writeCompose(dir, interactive, replace) {
-  const file = Bun.file(join4(dir, "compose.yml"));
+  const file = Bun.file(join6(dir, "compose.yml"));
   if (await file.exists()) {
     const current = await file.text();
     if (current === compose_default)
       return false;
-    const ok = interactive ? await ask(confirm2({ message: `${tilde(join4(dir, "compose.yml"))} differs from this CLI's (${CLI_VERSION}). Replace it? (the old one is kept as compose.yml.bak)` })) : replace;
+    const ok = interactive ? await ask(confirm2({ message: `${tilde(join6(dir, "compose.yml"))} differs from this CLI's (${CLI_VERSION}). Replace it? (the old one is kept as compose.yml.bak)` })) : replace;
     if (!ok)
       return false;
-    await Bun.write(join4(dir, "compose.yml.bak"), current);
+    await Bun.write(join6(dir, "compose.yml.bak"), current);
   }
   await Bun.write(file, compose_default);
   return true;
@@ -3117,7 +3202,7 @@ ${tail2(pulled.stderr || pulled.stdout)}${pullHint(pulled.stderr || pulled.stdou
     } else
       s.stop("Images downloaded");
   }
-  const current = parseEnv(await Bun.file(join4(dir, ".env")).text());
+  const current = parseEnv(await Bun.file(join6(dir, ".env")).text());
   if (sandboxProfileOn(current)) {
     s.start("Updating sandbox runtime images");
     await init_server_sandbox();
@@ -3190,7 +3275,7 @@ async function setup(args) {
 ${dim("Nothing is changed until you confirm at the end. Ctrl-C leaves at any time.")}`);
   const dir = await chooseDir(args, interactive);
   await preflight(dir);
-  const envFile = Bun.file(join4(dir, ".env"));
+  const envFile = Bun.file(join6(dir, ".env"));
   const envText = await envFile.exists() ? await envFile.text() : null;
   const existing = envText ? parseEnv(envText) : {};
   const running = await stackExists(dir);
@@ -3307,7 +3392,7 @@ ${dim("Nothing is changed until you confirm at the end. Ctrl-C leaves at any tim
   ui.note([
     ...Object.entries(values).map(([k, v]) => `${k.padEnd(24)} ${isSecretKey(k) ? dim(maskSecret(v)) : v}`),
     "",
-    dim(`Writes ${tilde(join4(dir, ".env"))} (only you can read it) and ${tilde(join4(dir, "compose.yml"))}`)
+    dim(`Writes ${tilde(join6(dir, ".env"))} (only you can read it) and ${tilde(join6(dir, "compose.yml"))}`)
   ].join(`
 `), "Settings");
   if (interactive && !await ask(confirm2({ message: running ? "Save and restart mybase?" : "Save and start mybase?" }))) {
@@ -3358,10 +3443,10 @@ ${dim("Nothing is changed until you confirm at the end. Ctrl-C leaves at any tim
   ].join(`
 `), "mybase is running");
   if (secrets.MYBASE_SECRETS_KEY) {
-    ui.warn(`${bold("Back up MYBASE_SECRETS_KEY")} (in ${tilde(join4(dir, ".env"))}) somewhere other than this machine,
+    ui.warn(`${bold("Back up MYBASE_SECRETS_KEY")} (in ${tilde(join6(dir, ".env"))}) somewhere other than this machine,
 like a password manager. If it's lost, every stored secret is lost with it.`);
     if (interactive && await ask(confirm2({ message: "Show it now so you can copy it?", initialValue: false }))) {
-      log.message(secrets.MYBASE_SECRETS_KEY);
+      log2.message(secrets.MYBASE_SECRETS_KEY);
     }
   }
   outro(`Done. Config for this CLI: ${dim(tilde(configPath))}`);
@@ -3380,17 +3465,17 @@ var init_server_setup = __esm(async () => {
   init_server_env();
   init_server_sandbox_env();
   await init_api();
-  DEFAULT_DIR = join4(homedir2(), "mybase");
+  DEFAULT_DIR = join6(homedir2(), "mybase");
   USERNAME_PATTERN = /^[a-zA-Z0-9_.@-]{1,64}$/;
   HOST_PATTERN = /^(?=.{1,253}$)([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/i;
   TUNNEL_KEYS = ["COMPOSE_PROFILES", "CLOUDFLARE_TUNNEL_TOKEN", "MYBASE_PUBLIC_URL", "MYBASE_S3_PUBLIC_URL", "MYBASE_TRUST_PROXY"];
   BIND_KEYS = ["POSTGRES_BIND", "GARAGE_S3_BIND", "VALKEY_BIND"];
   ui = {
-    info: (m) => !jsonMode && log.info(m),
-    success: (m) => !jsonMode && log.success(m),
-    warn: (m) => !jsonMode && log.warn(m),
-    error: (m) => !jsonMode && log.error(m),
-    step: (m) => !jsonMode && log.step(m),
+    info: (m) => !jsonMode && log2.info(m),
+    success: (m) => !jsonMode && log2.success(m),
+    warn: (m) => !jsonMode && log2.warn(m),
+    error: (m) => !jsonMode && log2.error(m),
+    step: (m) => !jsonMode && log2.step(m),
     note: (m, title) => !jsonMode && note(m, title),
     spinner() {
       return jsonMode ? { start() {}, stop() {}, error() {}, message() {} } : spinner();
@@ -3407,7 +3492,7 @@ __export(exports_server_sandbox, {
   sandboxWorkerHealth: () => sandboxWorkerHealth,
   setupSandboxServer: () => setupSandboxServer
 });
-import { join as join5 } from "path";
+import { join as join7 } from "path";
 import { isIP as isIP3 } from "net";
 async function publicIp() {
   try {
@@ -3446,8 +3531,8 @@ async function refreshSandboxImages(dir, values, pull = true, run = hostRun) {
   await pullImage(images.workerImage, run, pull);
   const updates = { MYBASE_SANDBOX_IMAGE: images.image, MYBASE_SANDBOX_WORKER_IMAGE: images.workerImage };
   if (Object.entries(updates).some(([key, value]) => values[key] !== value)) {
-    const text = await Bun.file(join5(dir, ".env")).text();
-    await Bun.write(join5(dir, ".env"), mergeEnv(text, updates));
+    const text = await Bun.file(join7(dir, ".env")).text();
+    await Bun.write(join7(dir, ".env"), mergeEnv(text, updates));
   }
   return { ...values, ...updates };
 }
@@ -3505,8 +3590,8 @@ Check the host's gVisor and cgroup support. Ordinary containers will not be used
 async function prepareSandboxHost(args, options = {}, overrides = {}) {
   const io = { ...defaults, ...overrides };
   const dir = await serverDir(args);
-  const file = Bun.file(join5(dir, ".env"));
-  if (!await file.exists() || !await Bun.file(join5(dir, "compose.yml")).exists())
+  const file = Bun.file(join7(dir, ".env"));
+  if (!await file.exists() || !await Bun.file(join7(dir, "compose.yml")).exists())
     throw new CliError(`no mybase server in ${dir}; run mybase server setup --sandboxes first`, 4);
   const text = await file.text();
   const values = parseEnv(text);
@@ -4922,6 +5007,611 @@ async function doctor(args) {
   }
 }
 
+// src/hosting.ts
+await init_api();
+import { existsSync } from "fs";
+import { rm as rm2 } from "fs/promises";
+import { tmpdir as tmpdir2 } from "os";
+import { dirname as dirname3, join as join4, resolve as resolve4 } from "path";
+
+// src/oci-push.ts
+import { createHash } from "crypto";
+import { tmpdir } from "os";
+import { join as join3 } from "path";
+import { rm } from "fs/promises";
+var CHUNK_BYTES = 32 * 1024 * 1024;
+var text = (b) => new TextDecoder().decode(b).replace(/\0.*$/s, "");
+function tarSize(field) {
+  if (field[0] & 128) {
+    let n = 0;
+    for (let i = 1;i < field.length; i++)
+      n = n * 256 + field[i];
+    return n;
+  }
+  return parseInt(text(field).trim() || "0", 8);
+}
+async function readTar(path) {
+  const file = Bun.file(path);
+  const entries = new Map;
+  let at = 0;
+  let longName = null;
+  while (at + 512 <= file.size) {
+    const h = new Uint8Array(await file.slice(at, at + 512).arrayBuffer());
+    if (h.every((b) => b === 0))
+      break;
+    const size = tarSize(h.subarray(124, 136));
+    const type = String.fromCharCode(h[156]);
+    const prefix = text(h.subarray(345, 500));
+    let name = longName ?? (prefix ? `${prefix}/${text(h.subarray(0, 100))}` : text(h.subarray(0, 100)));
+    const body = at + 512;
+    if (type === "L") {
+      longName = text(new Uint8Array(await file.slice(body, body + size).arrayBuffer()));
+    } else if (type === "x") {
+      const pax = new TextDecoder().decode(await file.slice(body, body + size).arrayBuffer());
+      longName = /\d+ path=([^\n]*)\n/.exec(pax)?.[1] ?? null;
+    } else {
+      longName = null;
+      name = name.replace(/^\.\//, "");
+      if (type === "0" || type === "\x00")
+        entries.set(name, { name, offset: body, size });
+    }
+    at = body + Math.ceil(size / 512) * 512;
+  }
+  return entries;
+}
+async function savedImage(tar, entries) {
+  const read = async (name) => {
+    const e = entries.get(name);
+    if (!e)
+      throw new Error(`the saved image is missing ${name}`);
+    return new Uint8Array(await Bun.file(tar).slice(e.offset, e.offset + e.size).arrayBuffer());
+  };
+  const manifest = JSON.parse(new TextDecoder().decode(await read("manifest.json")));
+  if (manifest.length !== 1)
+    throw new Error("expected exactly one image in the saved tar");
+  const bytes = await read(manifest[0].Config);
+  const parsed = JSON.parse(new TextDecoder().decode(bytes));
+  const layers = manifest[0].Layers.map((name) => {
+    const e = entries.get(name);
+    if (!e)
+      throw new Error(`the saved image is missing layer ${name}`);
+    return e;
+  });
+  return { config: { bytes, architecture: parsed.architecture, os: parsed.os }, layers };
+}
+async function isGzip(tar, e) {
+  const head = new Uint8Array(await Bun.file(tar).slice(e.offset, e.offset + 2).arrayBuffer());
+  return head[0] === 31 && head[1] === 139;
+}
+async function sha256Stream(stream) {
+  const hash = createHash("sha256");
+  for await (const chunk of stream)
+    hash.update(chunk);
+  return `sha256:${hash.digest("hex")}`;
+}
+async function layerBlob(tar, e) {
+  const slice = () => Bun.file(tar).slice(e.offset, e.offset + e.size);
+  if (await isGzip(tar, e)) {
+    const fromName = /blobs\/sha256\/([0-9a-f]{64})$/.exec(e.name)?.[1];
+    const digest = fromName ? `sha256:${fromName}` : await sha256Stream(slice().stream());
+    return { digest, size: e.size, mediaType: "application/vnd.oci.image.layer.v1.tar+gzip", source: slice };
+  }
+  const out = join3(tmpdir(), `mybase-layer-${crypto.randomUUID()}.tar.gz`);
+  const hash = createHash("sha256");
+  const writer = Bun.file(out).writer();
+  let size = 0;
+  for await (const chunk of slice().stream().pipeThrough(new CompressionStream("gzip"))) {
+    hash.update(chunk);
+    writer.write(chunk);
+    size += chunk.length;
+  }
+  await writer.end();
+  return {
+    digest: `sha256:${hash.digest("hex")}`,
+    size,
+    mediaType: "application/vnd.oci.image.layer.v1.tar+gzip",
+    source: () => Bun.file(out),
+    cleanup: () => rm(out, { force: true })
+  };
+}
+async function registry(t, path, init = {}, attempts = 3) {
+  const url = path.startsWith("http") ? path : `${t.url}${path}`;
+  for (let i = 1;; i++) {
+    let res = null;
+    try {
+      res = await fetch(url, { ...init, headers: { Authorization: `Bearer ${t.token}`, ...init.headers } });
+    } catch (err) {
+      if (i >= attempts)
+        throw new Error(`can't reach the registry at ${t.url}: ${err.message}`);
+    }
+    if (res && (res.status < 500 || i >= attempts))
+      return res;
+    await Bun.sleep(1000 * i);
+  }
+}
+async function failure(res, what) {
+  const body = await res.text().catch(() => "");
+  let reason = body.slice(0, 300);
+  try {
+    const parsed = JSON.parse(body);
+    reason = parsed.error ?? parsed.errors?.map((e) => e.message).join("; ") ?? reason;
+  } catch {}
+  return new Error(`${what} failed (${res.status}): ${reason}`);
+}
+async function uploadBlob(t, blob, progress) {
+  const head = await registry(t, `/v2/${t.repo}/blobs/${blob.digest}`, { method: "HEAD" });
+  if (head.ok)
+    return progress({ kind: "skip", digest: blob.digest, size: blob.size });
+  const start = await registry(t, `/v2/${t.repo}/blobs/uploads/`, { method: "POST", headers: { "Content-Length": "0" } });
+  if (start.status !== 202)
+    throw await failure(start, "starting an upload");
+  let location = start.headers.get("Location");
+  const absolute = (loc) => loc.startsWith("http") ? loc.replace(/^https?:\/\/[^/]+/, t.url) : `${t.url}${loc}`;
+  location = absolute(location);
+  const file = blob.source();
+  const step = t.chunkBytes ?? CHUNK_BYTES;
+  for (let sent = 0;sent < blob.size; sent += step) {
+    const end = Math.min(sent + step, blob.size);
+    const chunk = await file.slice(sent, end).arrayBuffer();
+    const res = await registry(t, location, {
+      method: "PATCH",
+      headers: { "Content-Type": "application/octet-stream", "Content-Range": `${sent}-${end - 1}`, "Content-Length": String(end - sent) },
+      body: chunk
+    }, 1);
+    if (res.status !== 202)
+      throw await failure(res, "uploading a layer chunk");
+    location = absolute(res.headers.get("Location"));
+    progress({ kind: "upload", digest: blob.digest, sent: end, size: blob.size });
+  }
+  const done = await registry(t, `${location}${location.includes("?") ? "&" : "?"}digest=${encodeURIComponent(blob.digest)}`, {
+    method: "PUT",
+    headers: { "Content-Length": "0" }
+  });
+  if (done.status !== 201)
+    throw await failure(done, "finishing an upload");
+  progress({ kind: "done", digest: blob.digest, size: blob.size });
+}
+async function pushImage(tar, t, progress = () => {}) {
+  const image = await savedImage(tar, await readTar(tar));
+  const configDigest = `sha256:${createHash("sha256").update(image.config.bytes).digest("hex")}`;
+  const configPath = join3(tmpdir(), `mybase-config-${crypto.randomUUID()}.json`);
+  await Bun.write(configPath, image.config.bytes);
+  const blobs = [];
+  try {
+    for (const layer of image.layers)
+      blobs.push(await layerBlob(tar, layer));
+    const config = { digest: configDigest, size: image.config.bytes.length, mediaType: "application/vnd.oci.image.config.v1+json", source: () => Bun.file(configPath) };
+    for (const blob of [...blobs, config])
+      await uploadBlob(t, blob, progress);
+    const manifest = new TextEncoder().encode(JSON.stringify({
+      schemaVersion: 2,
+      mediaType: "application/vnd.oci.image.manifest.v1+json",
+      config: { mediaType: config.mediaType, digest: config.digest, size: config.size },
+      layers: blobs.map((b) => ({ mediaType: b.mediaType, digest: b.digest, size: b.size }))
+    }));
+    const digest = `sha256:${createHash("sha256").update(manifest).digest("hex")}`;
+    const res = await registry(t, `/v2/${t.repo}/manifests/${digest}`, {
+      method: "PUT",
+      headers: { "Content-Type": "application/vnd.oci.image.manifest.v1+json" },
+      body: manifest
+    });
+    if (res.status !== 201)
+      throw await failure(res, "pushing the manifest");
+    return { digest, architecture: image.config.architecture };
+  } finally {
+    await rm(configPath, { force: true });
+    for (const b of blobs)
+      await b.cleanup?.();
+  }
+}
+
+// src/hosting.ts
+init_output();
+
+// src/hosting-templates.ts
+var TEMPLATES = ["nextjs", "static", "node"];
+var install = `RUN if [ -f pnpm-lock.yaml ]; then corepack enable pnpm && pnpm install --frozen-lockfile; \\
+    elif [ -f yarn.lock ]; then corepack enable yarn && yarn install --frozen-lockfile; \\
+    elif [ -f package-lock.json ]; then npm ci; \\
+    elif [ -f bun.lock ]; then npm install -g bun && bun install --frozen-lockfile; \\
+    else npm install; fi`;
+var lockfiles = "COPY package.json package-lock.json* pnpm-lock.yaml* yarn.lock* bun.lock* ./";
+var DOCKERFILES = {
+  nextjs: `# Next.js, built with output: "standalone" (set it in next.config).
+FROM node:22-alpine AS deps
+WORKDIR /app
+${lockfiles}
+${install}
+
+FROM node:22-alpine AS build
+WORKDIR /app
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+ENV NEXT_TELEMETRY_DISABLED=1
+RUN mkdir -p public && npm run build
+
+FROM node:22-alpine
+WORKDIR /app
+ENV NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 PORT=3000 HOSTNAME=0.0.0.0
+RUN addgroup -S app && adduser -S app -G app
+COPY --from=build --chown=app:app /app/public ./public
+COPY --from=build --chown=app:app /app/.next/standalone ./
+COPY --from=build --chown=app:app /app/.next/static ./.next/static
+USER app
+EXPOSE 3000
+CMD ["node", "server.js"]
+`,
+  static: `# Static site: \`npm run build\` writes OUT_DIR, Caddy serves it on :3000.
+FROM node:22-alpine AS build
+WORKDIR /app
+${lockfiles}
+${install}
+COPY . .
+RUN npm run build
+
+FROM caddy:2.10.2-alpine
+ARG OUT_DIR=dist
+COPY --from=build /app/\${OUT_DIR} /srv
+RUN printf '{\\n  admin off\\n  persist_config off\\n}\\n:3000 {\\n  root * /srv\\n  encode gzip\\n  try_files {path} {path}/ /index.html\\n  file_server\\n}\\n' > /etc/caddy/Caddyfile
+ENV XDG_CONFIG_HOME=/tmp XDG_DATA_HOME=/tmp
+USER nobody
+EXPOSE 3000
+CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
+`,
+  node: `# Bun or Node server: \`bun run start\` must listen on $PORT.
+FROM oven/bun:1.3-alpine
+WORKDIR /app
+COPY package.json bun.lock* package-lock.json* ./
+RUN bun install --production
+COPY . .
+ENV NODE_ENV=production PORT=3000
+USER bun
+EXPOSE 3000
+CMD ["bun", "run", "start"]
+`
+};
+var DOCKERIGNORE = `node_modules
+.git
+.next
+dist
+.env
+.env.*
+!.env.example
+npm-debug.log*
+Dockerfile
+.dockerignore
+`;
+var configFile = (project, site) => `import { defineConfig } from "@mybase-dev/sdk/config";
+
+export default defineConfig({
+  project: ${JSON.stringify(project)},
+  hosting: {
+    // \`mybase deploy\` builds ./Dockerfile and runs it at https://${site}.<your domain>.
+    sites: { ${JSON.stringify(site)}: { port: 3000 } },
+  },
+});
+`;
+
+// src/hosting.ts
+await init_service_enable();
+var hostingUsage = `  hosting enable <project>       Turn on hosting (sites at <site>.<domain>; needs \`mybase server hosting\` once)
+  hosting sites <project>        List sites, their URLs, and the latest deploy
+  hosting create <project> <site> [--port 3000] [--health /]  Add a site (names are unique across projects)
+  hosting set <project> <site> [--port n] [--health /path] [--secrets-env <env> | --no-secrets-env]
+  hosting env list|set|unset <project> <site> [KEY=VALUE\u2026 | KEY\u2026]  The site's own env vars (applied on the next deploy)
+  hosting deploys <project> <site>  Deploy history
+  hosting redeploy <project> <site>  Restart the live image (picks up env changes)
+  hosting rollback <project> <site> [<deploy id>]  Go back to the previous (or a given) deploy
+  hosting logs <project> <site> [--deploy <id>] [--tail 200] [--no-follow]  Container output
+  hosting delete <project> <site> [--yes]  Remove a site, its containers, and its images
+  hosting init [--template nextjs|static|node] [--project p] [--site s]  Write a Dockerfile, .dockerignore, and mybase.config.ts
+  hosting disable <project> [--yes]  Turn hosting off: every site goes down
+  deploy [--project p] [--site s] [--config mybase.config.ts] [--no-wait]  Build here, push, and go live`;
+var base4 = (p) => `/projects/${encodeURIComponent(p)}/hosting`;
+var sitePath = (p, s) => `${base4(p)}/sites/${encodeURIComponent(s)}`;
+var short = (id) => id.slice(0, 8);
+var ago = (iso) => {
+  const s = Math.round((Date.now() - +new Date(iso)) / 1000);
+  return s < 60 ? `${s}s ago` : s < 3600 ? `${Math.round(s / 60)}m ago` : s < 86400 ? `${Math.round(s / 3600)}h ago` : `${Math.round(s / 86400)}d ago`;
+};
+function printDeploy(d) {
+  console.log([short(d.id), d.status.padEnd(8), d.digest.slice(7, 19), ago(d.createdAt).padEnd(8), d.createdBy, d.rollbackOf ? `rollback of ${short(d.rollbackOf)}` : "", d.error ?? ""].join("  ").trimEnd());
+}
+function printSite(s) {
+  const status = s.latest ? `${s.latest.status}${s.latest.id !== s.liveDeploy && s.liveDeploy ? ` (live: ${short(s.liveDeploy)})` : ""}` : "never deployed";
+  console.log(`${s.name.padEnd(16)} ${(s.url ?? `http://${s.name}.localhost`).padEnd(36)} :${String(s.port).padEnd(5)} ${status}`);
+}
+async function hosting(sub, args) {
+  const { positional, flags } = parseArgs(args);
+  const [project, site] = positional;
+  switch (sub) {
+    case "enable": {
+      const p = need(project, "project name");
+      await enableService(p, "hosting", flags);
+      const o = await api(base4(p));
+      print({ enabled: "hosting", project: p, ...o }, () => {
+        console.log(`Hosting enabled for "${p}".`);
+        if (!o.domain)
+          console.log("No MYBASE_HOSTING_DOMAIN on the server: sites answer at http://<site>.localhost only (run `mybase server hosting`).");
+        console.log(`
+Next, in your app's directory:
+  mybase hosting init --project ${p} --site <name>
+  mybase deploy`);
+      });
+      return true;
+    }
+    case "sites": {
+      const p = need(project, "project name");
+      const o = await api(base4(p));
+      print(o, () => {
+        if (!o.sites.length)
+          return console.log(`No sites yet. Create one: mybase hosting create ${p} <site>`);
+        for (const s of o.sites)
+          printSite(s);
+        console.log(`
+Images: ${o.registry}/<site> (${o.platform})`);
+      });
+      return true;
+    }
+    case "create": {
+      const p = need(project, "project name");
+      const s = await api(`${base4(p)}/sites`, {
+        method: "POST",
+        body: JSON.stringify({ name: need(site, "site name"), port: flagInt(flags, "port"), healthPath: flagString(flags, "health") })
+      });
+      print(s, () => console.log(`Site "${s.name}" created. It goes live at ${s.url ?? `http://${s.name}.localhost`} after the first deploy (mybase deploy).`));
+      return true;
+    }
+    case "set": {
+      const p = need(project, "project name");
+      const body = { port: flagInt(flags, "port"), healthPath: flagString(flags, "health") };
+      if (flags.has("no-secrets-env"))
+        body.secretsEnv = null;
+      else if (flags.has("secrets-env"))
+        body.secretsEnv = flagString(flags, "secrets-env");
+      const s = await api(sitePath(p, need(site, "site name")), { method: "PATCH", body: JSON.stringify(body) });
+      print(s, () => {
+        printSite(s);
+        console.log(`secrets env: ${s.secretsEnv ?? "none"}. Env changes apply on the next deploy (mybase hosting redeploy ${p} ${s.name}).`);
+      });
+      return true;
+    }
+    case "env":
+      return env(positional, flags);
+    case "deploys": {
+      const p = need(project, "project name");
+      const list = await api(`${sitePath(p, need(site, "site name"))}/deploys`);
+      print(list, () => list.length ? list.forEach(printDeploy) : console.log("No deploys yet."));
+      return true;
+    }
+    case "redeploy":
+    case "rollback": {
+      const p = need(project, "project name");
+      const s = need(site, "site name");
+      const deploy = sub === "redeploy" ? await api(`${sitePath(p, s)}/deploys`, { method: "POST", body: "{}" }) : await api(`${sitePath(p, s)}/rollback`, { method: "POST", body: JSON.stringify(positional[2] ? { deployId: await fullDeployId(p, s, positional[2]) } : {}) });
+      await finish(p, s, deploy, flags.has("no-wait"));
+      return true;
+    }
+    case "logs": {
+      const p = need(project, "project name");
+      const s = need(site, "site name");
+      const q = new URLSearchParams({ tail: String(flagInt(flags, "tail") ?? 200), follow: flags.has("no-follow") || jsonMode ? "0" : "1" });
+      const deploy = flagString(flags, "deploy");
+      if (deploy)
+        q.set("deploy", await fullDeployId(p, s, deploy));
+      const res = await api(`${sitePath(p, s)}/logs?${q}`, { raw: true });
+      const text = jsonMode ? await res.text() : null;
+      if (text !== null)
+        print({ site: s, logs: text.split(`
+`).filter(Boolean) }, () => {});
+      else
+        for await (const chunk of res.body)
+          process.stdout.write(chunk);
+      return true;
+    }
+    case "delete": {
+      const p = need(project, "project name");
+      const s = need(site, "site name");
+      confirm(flags.has("yes"), `Site "${s}" goes offline, and its deploys and images are deleted.`, s, "the site name");
+      await api(sitePath(p, s), { method: "DELETE" });
+      print({ deleted: s, project: p }, () => console.log(`Site "${s}" deleted.`));
+      return true;
+    }
+    case "disable": {
+      const p = need(project, "project name");
+      confirm(flags.has("yes"), `Every site in "${p}" goes offline, and their deploys and images are deleted.`, p, "the project name");
+      await api(`/projects/${encodeURIComponent(p)}/services/hosting`, { method: "DELETE" });
+      print({ disabled: "hosting", project: p }, () => console.log(`Hosting disabled for "${p}".`));
+      return true;
+    }
+    case "init":
+      await init(flags);
+      return true;
+    case "deploy":
+      await deploy(args);
+      return true;
+  }
+  return false;
+}
+async function fullDeployId(p, s, id) {
+  if (/^[0-9a-f-]{36}$/.test(id))
+    return id;
+  const match = (await api(`${sitePath(p, s)}/deploys`)).filter((d) => d.id.startsWith(id));
+  if (match.length !== 1)
+    throw new CliError(match.length ? `"${id}" matches more than one deploy` : `no deploy starting with "${id}"`, 4);
+  return match[0].id;
+}
+async function env(positional, flags) {
+  const [action, project, site, ...pairs] = positional;
+  if (!action || !["list", "set", "unset"].includes(action))
+    throw usageError("usage: mybase hosting env list|set|unset <project> <site> [KEY=VALUE\u2026 | KEY\u2026]");
+  const p = need(project, "project name");
+  const s = need(site, "site name");
+  const path = `${sitePath(p, s)}/env`;
+  const current = (await api(path)).env;
+  if (action === "list") {
+    const values = flags.has("values");
+    print(values ? current : Object.keys(current), () => {
+      if (!Object.keys(current).length)
+        return console.log("No env vars. Set some: mybase hosting env set <project> <site> KEY=VALUE");
+      for (const [k, v] of Object.entries(current))
+        console.log(values ? `${k}=${v}` : k);
+    });
+    return true;
+  }
+  const next = { ...current };
+  if (action === "set") {
+    if (!pairs.length)
+      throw usageError("give at least one KEY=VALUE");
+    for (const pair of pairs) {
+      const at = pair.indexOf("=");
+      if (at < 1)
+        throw usageError(`"${pair}" isn't KEY=VALUE`);
+      next[pair.slice(0, at)] = pair.slice(at + 1);
+    }
+  } else {
+    if (!pairs.length)
+      throw usageError("give at least one KEY");
+    for (const k of pairs)
+      delete next[k];
+  }
+  await api(path, { method: "PUT", body: JSON.stringify({ env: next }) });
+  print({ site: s, keys: Object.keys(next) }, () => console.log(`Saved ${Object.keys(next).length} env vars. They apply on the next deploy: mybase hosting redeploy ${p} ${s}`));
+  return true;
+}
+async function init(flags) {
+  const template = flagString(flags, "template") ?? "nextjs";
+  if (!TEMPLATES.includes(template))
+    throw usageError(`--template must be one of ${TEMPLATES.join(", ")}`);
+  const dir = resolve4(flagString(flags, "dir") ?? ".");
+  const written = [];
+  const write = async (name, content) => {
+    const path = join4(dir, name);
+    if (existsSync(path) && !flags.has("force"))
+      return console.error(`${name} exists; left as is (--force replaces it)`);
+    await Bun.write(path, content);
+    written.push(name);
+  };
+  await write("Dockerfile", DOCKERFILES[template]);
+  await write(".dockerignore", DOCKERIGNORE);
+  const project = flagString(flags, "project");
+  const site = flagString(flags, "site");
+  if (project && site)
+    await write("mybase.config.ts", configFile(project, site));
+  print({ template, written }, () => {
+    if (written.length)
+      console.log(`Wrote ${written.join(", ")} (${template}).`);
+    if (template === "nextjs")
+      console.log('Set output: "standalone" in next.config so the image stays small.');
+    if (!(project && site))
+      console.log("Add a hosting block to mybase.config.ts (or pass --project and --site here), then: mybase deploy");
+    else
+      console.log("Next: mybase deploy");
+  });
+}
+async function docker(args, quiet = false) {
+  const child = Bun.spawn(["docker", ...args], { stdin: "ignore", stdout: quiet || jsonMode ? "ignore" : 2, stderr: "inherit" });
+  if (await child.exited !== 0)
+    throw new CliError(`docker ${args[0]} failed`);
+}
+var goArch = (arch) => arch === "x64" ? "amd64" : arch;
+async function deploy(args) {
+  const { flags } = parseArgs(args);
+  const configPath = flagString(flags, "config") ?? "mybase.config.ts";
+  const config = existsSync(configPath) ? await readConfigFile(configPath) : null;
+  const project = flagString(flags, "project") ?? config?.project;
+  if (!project)
+    throw usageError("which project? Pass --project, or run in a directory with a mybase.config.ts");
+  const sites = config?.project === project ? config.hosting?.sites ?? {} : {};
+  const names = Object.keys(sites);
+  const site = flagString(flags, "site") ?? (names.length === 1 ? names[0] : undefined);
+  if (!site)
+    throw usageError(names.length ? `which site? --site ${names.join(" | --site ")}` : "which site? Pass --site, or add hosting.sites to mybase.config.ts");
+  const settings = sites[site] ?? {};
+  const root = config ? dirname3(resolve4(configPath)) : process.cwd();
+  const context = resolve4(root, flagString(flags, "dir") ?? settings.context ?? ".");
+  const dockerfile = resolve4(context, flagString(flags, "dockerfile") ?? settings.dockerfile ?? "Dockerfile");
+  if (!existsSync(dockerfile))
+    throw new CliError(`no Dockerfile at ${dockerfile}. Write one: mybase hosting init --template nextjs|static|node`);
+  const token = apiToken();
+  if (!token)
+    throw new CliError("not signed in. Run `mybase login` (or set MYBASE_TOKEN).", 3);
+  let existing = null;
+  try {
+    existing = await api(sitePath(project, site));
+  } catch (err) {
+    if (!(err instanceof CliError && err.status === 404 && /no site named/.test(err.message)))
+      throw err;
+  }
+  if (!existing) {
+    existing = await api(`${base4(project)}/sites`, { method: "POST", body: JSON.stringify({ name: site, port: settings.port, healthPath: settings.healthPath }) });
+    log(`Created site "${site}".`);
+  } else if (settings.port !== undefined && settings.port !== existing.port || settings.healthPath !== undefined && settings.healthPath !== existing.healthPath) {
+    existing = await api(sitePath(project, site), { method: "PATCH", body: JSON.stringify({ port: settings.port, healthPath: settings.healthPath }) });
+  }
+  const health = await api("/health");
+  const platform = `linux/${goArch(health.arch ?? process.arch)}`;
+  const tag = `mybase-deploy/${project}-${site}:latest`;
+  log(`Building ${site} for ${platform}\u2026`);
+  await docker(["build", "--platform", platform, "-t", tag, "-f", dockerfile, context]);
+  const tar = join4(tmpdir2(), `mybase-${project}-${site}-${crypto.randomUUID()}.tar`);
+  try {
+    await docker(["save", "-o", tar, tag], true);
+    log(`Pushing to ${new URL(API_URL).host}/${project}/${site} (${CHUNK_BYTES / 1024 / 1024} MB chunks)\u2026`);
+    let lastPct = -1;
+    const { digest, architecture } = await pushImage(tar, { url: API_URL, token, repo: `${project}/${site}` }, (e) => {
+      if (jsonMode)
+        return;
+      if (e.kind === "skip")
+        process.stderr.write(`  ${e.digest.slice(7, 19)} already there
+`);
+      if (e.kind === "upload") {
+        const pct = Math.floor((e.sent ?? 0) / e.size * 100);
+        if (pct !== lastPct)
+          process.stderr.write(`\r  ${e.digest.slice(7, 19)} ${pct}% of ${(e.size / 1024 / 1024).toFixed(1)} MB`);
+        lastPct = pct;
+      }
+      if (e.kind === "done")
+        process.stderr.write(`\r  ${e.digest.slice(7, 19)} pushed ${(e.size / 1024 / 1024).toFixed(1)} MB   
+`);
+    });
+    if (architecture && `linux/${architecture}` !== platform)
+      throw new CliError(`the image is ${architecture}, but the server runs ${platform}`);
+    const body = { digest };
+    const created = await api(`${sitePath(project, site)}/deploys`, { method: "POST", body: JSON.stringify(body) });
+    await finish(project, site, created, flags.has("no-wait"));
+  } finally {
+    await rm2(tar, { force: true });
+  }
+}
+var log = (line) => {
+  if (!jsonMode)
+    console.error(line);
+};
+async function finish(project, site, deploy, noWait) {
+  let d = deploy;
+  if (!noWait) {
+    log(`Deploy ${short(d.id)} queued; waiting for the container to answer\u2026`);
+    const deadline = Date.now() + 20 * 60000;
+    while ((d.status === "queued" || d.status === "starting") && Date.now() < deadline) {
+      await Bun.sleep(2000);
+      d = (await api(`${sitePath(project, site)}/deploys`)).find((x) => x.id === d.id) ?? d;
+    }
+  }
+  const s = await api(sitePath(project, site));
+  print({ deploy: d, url: s.url }, () => {
+    if (d.status === "live")
+      console.log(`Live: ${s.url ?? `http://${site}.localhost`}  (deploy ${short(d.id)})`);
+    else if (d.status === "failed")
+      console.log(`Deploy ${short(d.id)} failed: ${d.error}
+The previous deploy (if any) is still live.`);
+    else
+      console.log(`Deploy ${short(d.id)} is ${d.status}. Check: mybase hosting deploys ${project} ${site}`);
+  });
+  if (d.status === "failed")
+    process.exitCode = 1;
+}
+
 // src/queue.ts
 init_src();
 init_output();
@@ -4942,8 +5632,8 @@ var queueUsage = `  queue enable <project>         Turn on queues
   queue redrive <project> <dlq> [--to <queue>]  Move dead letters back to their queues
   queue stats <project> [--range 24h|7d]  Sent, received, deleted, dead-lettered per queue
   queue sync [--config <file>] [--dry-run] [--yes]  Make code-defined queues match mybase.config.ts`;
-var base4 = (project) => `/projects/${encodeURIComponent(project)}/queue`;
-var queuePath = (project, name, rest = "") => `${base4(project)}/queues/${encodeURIComponent(name)}${rest}`;
+var base5 = (project) => `/projects/${encodeURIComponent(project)}/queue`;
+var queuePath = (project, name, rest = "") => `${base5(project)}/queues/${encodeURIComponent(name)}${rest}`;
 function formatMs(ms) {
   for (const [unit, size] of [["d", 86400000], ["h", 3600000], ["m", 60000], ["s", 1000]]) {
     if (ms >= size && ms % size === 0)
@@ -4967,7 +5657,7 @@ async function queue(sub, args) {
     case "enable": {
       const p = need(project, "project name");
       const { linked } = await enableService(p, "queue", flags);
-      const settings = await api(base4(p));
+      const settings = await api(base5(p));
       print({ enabled: "queue", project: p, linked, ...settings }, () => {
         console.log(`Queues enabled for "${p}"
 `);
@@ -4985,7 +5675,7 @@ async function queue(sub, args) {
     }
     case "list": {
       const p = need(project, "project name");
-      const queues = await api(`${base4(p)}/queues`);
+      const queues = await api(`${base5(p)}/queues`);
       print(queues, () => {
         if (queues.length === 0)
           console.log("No queues yet.");
@@ -5011,7 +5701,7 @@ async function queue(sub, args) {
         contentDedup: flags.has("content-dedup") || undefined,
         deadLetter: dlq ? { queue: dlq, maxReceives: flagInt(flags, "max-receives") ?? 5 } : undefined
       };
-      const q = await api(`${base4(p)}/queues`, { method: "POST", body: JSON.stringify(body) });
+      const q = await api(`${base5(p)}/queues`, { method: "POST", body: JSON.stringify(body) });
       print(q, () => console.log(`Created ${q.fifo ? "FIFO" : "standard"} queue "${q.name}" (visibility ${formatMs(q.visibilityTimeoutMs)}, retention ${formatMs(q.retentionMs)})`));
       return true;
     }
@@ -5096,7 +5786,7 @@ async function queue(sub, args) {
       const range = flagString(flags, "range") ?? "24h";
       if (!QUEUE_STATS_RANGES.includes(range))
         throw new Error(`--range must be one of ${QUEUE_STATS_RANGES.join(", ")}`);
-      const stats = await api(`${base4(p)}/stats?range=${range}`);
+      const stats = await api(`${base5(p)}/stats?range=${range}`);
       print(stats, () => {
         const { queues } = stats;
         console.log(`Last ${range}:`);
@@ -5125,7 +5815,7 @@ function parseDuration(value) {
 async function sync2(file, dryRun, yes) {
   const config = await readConfigFile(file);
   const queues = Object.entries(config.queue?.queues ?? {}).map(([name, q]) => ({ ...q, name }));
-  const path = `${base4(config.project)}/queues`;
+  const path = `${base5(config.project)}/queues`;
   const plan = await api(path, { method: "PUT", body: JSON.stringify({ queues, dryRun: true }) });
   if (dryRun)
     return printSync(config.project, true, plan);
@@ -5151,8 +5841,8 @@ var vectorUsage = `  vector enable <project>        Turn on vector + full-text s
   vector documents <project> <index> [--limit 20] [--after <id>]  List documents in id order
   vector query <project> <index> [<text>] [--mode text|vector|hybrid] [--top 10] [--filter <json>]
   vector sync [--config <file>] [--dry-run] [--yes]  Make code-defined indexes match mybase.config.ts`;
-var base5 = (project) => `/projects/${encodeURIComponent(project)}/vector`;
-var indexPath = (project, name, rest = "") => `${base5(project)}/indexes/${encodeURIComponent(name)}${rest}`;
+var base6 = (project) => `/projects/${encodeURIComponent(project)}/vector`;
+var indexPath = (project, name, rest = "") => `${base6(project)}/indexes/${encodeURIComponent(name)}${rest}`;
 function describe(i) {
   const vectors = i.dimensions ? `${i.dimensions}d ${i.metric}` : "text only";
   return [i.name, vectors, i.language, i.embed ? "embeds" : "", `${i.documents} docs`, i.source].filter(Boolean).join("\t");
@@ -5171,7 +5861,7 @@ async function vector(sub, args) {
     case "enable": {
       const p = need(project, "project name");
       const { linked } = await enableService(p, "vector", flags);
-      const settings = await api(base5(p));
+      const settings = await api(base6(p));
       print({ enabled: "vector", project: p, linked, ...settings }, () => {
         console.log(`Vector search enabled for "${p}"
 `);
@@ -5189,7 +5879,7 @@ async function vector(sub, args) {
     }
     case "settings": {
       const p = need(project, "project name");
-      const settings = await api(base5(p));
+      const settings = await api(base6(p));
       print(settings, () => {
         const e = settings.embedding;
         console.log(e ? `embedding  ${e.model} (${e.dimensions}d) at ${e.url}${e.hasKey ? ", API key stored" : ""}` : "embedding  none (apps send their own vectors)");
@@ -5208,13 +5898,13 @@ async function vector(sub, args) {
         const apiKey = flags.has("key") ? await readSecret("API key: ") : undefined;
         body = { embedding: { url: need(flagString(flags, "url"), "--url"), model: need(flagString(flags, "model"), "--model"), dimensions: dims, apiKey } };
       }
-      const settings = await api(base5(p), { method: "PUT", body: JSON.stringify(body) });
+      const settings = await api(base6(p), { method: "PUT", body: JSON.stringify(body) });
       print(settings, () => console.log(settings.embedding ? `Embedding with ${settings.embedding.model} (${settings.embedding.dimensions}d)` : "Embedding provider removed"));
       return true;
     }
     case "list": {
       const p = need(project, "project name");
-      const indexes = await api(`${base5(p)}/indexes`);
+      const indexes = await api(`${base6(p)}/indexes`);
       print(indexes, () => {
         if (indexes.length === 0)
           console.log("No indexes yet.");
@@ -5232,7 +5922,7 @@ async function vector(sub, args) {
         language: flagString(flags, "lang"),
         embed: flags.has("embed") || undefined
       };
-      const index = await api(`${base5(p)}/indexes`, { method: "POST", body: JSON.stringify(body) });
+      const index = await api(`${base6(p)}/indexes`, { method: "POST", body: JSON.stringify(body) });
       print(index, () => console.log(`Created index "${index.name}" (${index.dimensions ? `${index.dimensions}d ${index.metric}` : "text only"}, ${index.language})`));
       return true;
     }
@@ -5315,7 +6005,7 @@ async function vector(sub, args) {
 async function sync3(file, dryRun, yes) {
   const config = await readConfigFile(file);
   const indexes = Object.entries(config.vector?.indexes ?? {}).map(([name, i]) => ({ ...i, name }));
-  const path = `${base5(config.project)}/indexes`;
+  const path = `${base6(config.project)}/indexes`;
   const plan = await api(path, { method: "PUT", body: JSON.stringify({ indexes, dryRun: true }) });
   if (dryRun)
     return printSync(config.project, true, plan);
@@ -5340,7 +6030,7 @@ var ratelimitUsage = `  ratelimit enable <project>     Turn on rate limits
   ratelimit delete <project> <name>  Delete a rule
   ratelimit stats <project> [--range 24h|7d]  Allowed and blocked requests per rule
   ratelimit sync [--config <file>] [--dry-run]  Make code-defined rules match mybase.config.ts`;
-var base6 = (project) => `/projects/${encodeURIComponent(project)}/ratelimit`;
+var base7 = (project) => `/projects/${encodeURIComponent(project)}/ratelimit`;
 function formatWindow(ms) {
   for (const [unit, size] of [["d", 86400000], ["h", 3600000], ["m", 60000], ["s", 1000]]) {
     if (ms % size === 0)
@@ -5364,7 +6054,7 @@ async function ratelimit(sub, args) {
     case "enable": {
       const p = need(project, "project name");
       const { linked } = await enableService(p, "ratelimit", flags);
-      const settings = await api(base6(p));
+      const settings = await api(base7(p));
       print({ enabled: "ratelimit", project: p, linked, ...settings }, () => {
         console.log(`Rate limits enabled for "${p}"
 `);
@@ -5382,7 +6072,7 @@ async function ratelimit(sub, args) {
     }
     case "rules": {
       const p = need(project, "project name");
-      const rules = await api(`${base6(p)}/rules`);
+      const rules = await api(`${base7(p)}/rules`);
       print(rules, () => {
         if (rules.length === 0)
           console.log("No rules yet. Inline limits still work.");
@@ -5402,14 +6092,14 @@ async function ratelimit(sub, args) {
         algorithm: flagString(flags, "algorithm"),
         burst: flagInt(flags, "burst")
       };
-      const r = await api(`${base6(p)}/rules`, { method: "POST", body: JSON.stringify(body) });
+      const r = await api(`${base7(p)}/rules`, { method: "POST", body: JSON.stringify(body) });
       print(r, () => console.log(`Created rule "${r.name}": ${r.limit} per ${formatWindow(r.windowMs)} (${r.algorithm})`));
       return true;
     }
     case "delete": {
       const p = need(project, "project name");
       const n = need(name, "rule name");
-      await api(`${base6(p)}/rules/${encodeURIComponent(n)}`, { method: "DELETE" });
+      await api(`${base7(p)}/rules/${encodeURIComponent(n)}`, { method: "DELETE" });
       print({ deleted: n }, () => console.log(`Deleted rule "${n}"`));
       return true;
     }
@@ -5418,7 +6108,7 @@ async function ratelimit(sub, args) {
       const range = flagString(flags, "range") ?? "24h";
       if (!RATELIMIT_STATS_RANGES.includes(range))
         throw new Error(`--range must be one of ${RATELIMIT_STATS_RANGES.join(", ")}`);
-      const stats = await api(`${base6(p)}/stats?range=${range}`);
+      const stats = await api(`${base7(p)}/stats?range=${range}`);
       print(stats, () => {
         const { rules } = stats;
         console.log(`Last ${range}:`);
@@ -5449,7 +6139,7 @@ async function sync4(file, dryRun) {
       burst: rule.burst
     }))
   };
-  printSync(config.project, dryRun, await api(`${base6(config.project)}/rules`, { method: "PUT", body: JSON.stringify(body) }));
+  printSync(config.project, dryRun, await api(`${base7(config.project)}/rules`, { method: "PUT", body: JSON.stringify(body) }));
 }
 
 // src/realtime.ts
@@ -5466,7 +6156,7 @@ var realtimeUsage = `  realtime enable <project>      Turn on realtime and print
   realtime channels <project> [--prefix p]   Channels with subscribers right now
   realtime publish <project> <channel> <event> [json]   Send a message to everyone subscribed
   realtime disable <project> [--yes]  Turn it off (closes every connection)`;
-var base7 = (project) => `/projects/${encodeURIComponent(project)}/realtime`;
+var base8 = (project) => `/projects/${encodeURIComponent(project)}/realtime`;
 function printSettings3(s) {
   console.log(`  socket      ${s.socketUrl}  (connectRealtime in @mybase-dev/sdk/realtime)`);
   console.log(`  publish     POST ${s.publishUrl}  (realtime:write key)`);
@@ -5491,7 +6181,7 @@ async function realtime(sub, args) {
     case "enable": {
       const p = need(project, "project name");
       const { linked } = await enableService(p, "realtime", flags);
-      const s = await api(base7(p));
+      const s = await api(base8(p));
       print({ enabled: "realtime", project: p, linked, ...s }, () => {
         console.log(`Realtime enabled for "${p}"
 `);
@@ -5502,7 +6192,7 @@ async function realtime(sub, args) {
     }
     case "info": {
       const p = need(project, "project name");
-      const [s, stats] = await Promise.all([api(base7(p)), api(`${base7(p)}/stats`)]);
+      const [s, stats] = await Promise.all([api(base8(p)), api(`${base8(p)}/stats`)]);
       const { secret: _secret, ...settings } = s;
       print({ ...settings, stats }, () => {
         printSettings3({ ...s, secret: "(mybase realtime key)" });
@@ -5519,7 +6209,7 @@ async function realtime(sub, args) {
       const p = need(project, "project name");
       if (flags.has("rotate"))
         confirm(args.includes("--yes"), `Every open realtime connection on "${p}" closes, and tokens signed with the old secret stop working.`, p, "the project name");
-      const s = flags.has("rotate") ? await api(`${base7(p)}/secret/rotate`, { method: "POST" }) : await api(base7(p));
+      const s = flags.has("rotate") ? await api(`${base8(p)}/secret/rotate`, { method: "POST" }) : await api(base8(p));
       print({ secret: s.secret }, () => {
         if (flags.has("rotate"))
           console.log(`Rotated. Update MYBASE_REALTIME_SECRET where your server signs tokens.
@@ -5549,7 +6239,7 @@ async function realtime(sub, args) {
         if (n !== undefined)
           body[key] = n;
       }
-      const s = Object.keys(body).length ? await api(base7(p), { method: "PATCH", body: JSON.stringify(body) }) : await api(base7(p));
+      const s = Object.keys(body).length ? await api(base8(p), { method: "PATCH", body: JSON.stringify(body) }) : await api(base8(p));
       const { secret: _secret, ...shown } = s;
       print(shown, () => printSettings3({ ...s, secret: "(mybase realtime key)" }));
       return true;
@@ -5557,7 +6247,7 @@ async function realtime(sub, args) {
     case "channels": {
       const p = need(project, "project name");
       const prefix = flagString(flags, "prefix");
-      const { channels } = await api(`${base7(p)}/channels${prefix ? `?prefix=${encodeURIComponent(prefix)}` : ""}`);
+      const { channels } = await api(`${base8(p)}/channels${prefix ? `?prefix=${encodeURIComponent(prefix)}` : ""}`);
       print(channels, () => {
         if (!channels.length)
           return console.log("No channels have subscribers right now.");
@@ -5576,7 +6266,7 @@ async function realtime(sub, args) {
           payload = data;
         }
       }
-      const { ids } = await api(`${base7(p)}/publish`, {
+      const { ids } = await api(`${base8(p)}/publish`, {
         method: "POST",
         body: JSON.stringify({ channel: need(channel, "channel"), event: need(event, "event"), data: payload })
       });
@@ -5635,8 +6325,8 @@ async function target(flags, needEnv = true) {
   }
   return { project, env: env ?? "" };
 }
-var base8 = (project) => `/projects/${encodeURIComponent(project)}/secrets`;
-var envPath = (project, env, rest = "") => `${base8(project)}/envs/${encodeURIComponent(env)}${rest}`;
+var base9 = (project) => `/projects/${encodeURIComponent(project)}/secrets`;
+var envPath = (project, env, rest = "") => `${base9(project)}/envs/${encodeURIComponent(env)}${rest}`;
 var fetchSecrets = (project, env) => api(`/secrets/${encodeURIComponent(project)}/${encodeURIComponent(env)}`);
 var describeEnv = (e) => [e.name, e.parent ? `branch of ${e.parent}` : "root", `${e.keys} keys`, `rev ${e.revision}`, e.linked ? "linked" : ""].filter(Boolean).join("\t");
 async function readStdin() {
@@ -5655,7 +6345,7 @@ async function secrets(sub, args) {
     case "enable": {
       const p = need(positional[0] ?? flagString(flags, "project"), "project name");
       await api(`/projects/${encodeURIComponent(p)}/services/secrets`, { method: "PUT" });
-      const overview = await api(base8(p));
+      const overview = await api(base9(p));
       print({ enabled: "secrets", project: p, ...overview }, () => {
         console.log(`Secrets enabled for "${p}": ${overview.envs.map((e) => e.name).join(", ")}
 `);
@@ -5675,7 +6365,7 @@ async function secrets(sub, args) {
     }
     case "setup": {
       const { project, env } = await target(flags);
-      const overview = await api(base8(project));
+      const overview = await api(base9(project));
       if (!overview.envs.some((e) => e.name === env)) {
         throw usageError(`"${project}" has no env "${env}" (envs: ${overview.envs.map((e) => e.name).join(", ")})`);
       }
@@ -5685,7 +6375,7 @@ async function secrets(sub, args) {
     }
     case "envs": {
       const { project } = await target(flags, false);
-      const overview = await api(base8(project));
+      const overview = await api(base9(project));
       print(overview.envs, () => {
         for (const e of overview.envs)
           console.log(describeEnv(e));
@@ -5696,7 +6386,7 @@ async function secrets(sub, args) {
       const [action, name, next] = positional;
       const { project } = await target(flags, false);
       if (action === "create") {
-        const env = await api(`${base8(project)}/envs`, {
+        const env = await api(`${base9(project)}/envs`, {
           method: "POST",
           body: JSON.stringify({ name: need(name, "env name"), parent: flagString(flags, "from") ?? null })
         });
@@ -5799,7 +6489,7 @@ async function secrets(sub, args) {
       const { project, env } = await target(flags);
       const envs = env.split(",").map((e) => e.trim()).filter(Boolean);
       confirm(yes, `This rotates the credentials of "${project}" (database password, storage key, cache password if the cache is on, and the API key link made before) and stores the new ones, with the other services' keys, in ${envs.join(", ")} plus any env linked before. Apps still using the old credentials will stop working.`, project, "the project name");
-      const result = await api(`${base8(project)}/link`, { method: "POST", body: JSON.stringify({ envs }) });
+      const result = await api(`${base9(project)}/link`, { method: "POST", body: JSON.stringify({ envs }) });
       print(result, () => {
         console.log(`Rotated and stored in ${result.envs.join(", ")}: ${result.keys.join(", ")}`);
         console.log("Restart your apps with `mybase run` to pick them up.");
@@ -5809,7 +6499,7 @@ async function secrets(sub, args) {
     case "unlink": {
       const { project, env } = await target(flags);
       confirm(yes, `This removes the project credentials from "${env}". They stay valid; nothing is rotated.`, env, "the env name");
-      await api(`${base8(project)}/link/${encodeURIComponent(env)}`, { method: "DELETE" });
+      await api(`${base9(project)}/link/${encodeURIComponent(env)}`, { method: "DELETE" });
       print({ unlinked: env, project }, () => console.log(`Removed the credentials from "${env}"`));
       return true;
     }
@@ -5985,8 +6675,8 @@ async function sandbox(sub, args) {
 
 // src/server.ts
 init_dist4();
-import { join as join6 } from "path";
-import { styleText as styleText4 } from "util";
+import { join as join9 } from "path";
+import { styleText as styleText5 } from "util";
 
 // ../../packages/shared/src/logger.ts
 var LEVELS = { debug: 10, info: 20, warn: 30, error: 40 };
@@ -6029,6 +6719,8 @@ var SERVICE_COLORS = {
   realtime: color.magenta,
   sandbox: color.yellow,
   "sandbox-worker": color.yellow,
+  hosting: color.green,
+  "hosting-worker": color.green,
   "db-public": color.cyan,
   dev: color.gray
 };
@@ -6101,9 +6793,125 @@ init_server_env();
 init_server_sandbox_env();
 await __promiseAll([
   init_api(),
-  init_server_sandbox(),
-  init_server_setup()
+  init_server_sandbox()
 ]);
+
+// src/server-hosting.ts
+init_dist4();
+init_cloudflare2();
+init_output();
+init_server_docker();
+init_server_env();
+await init_server_setup();
+import { join as join8 } from "path";
+import { styleText as styleText4 } from "util";
+var LOCAL_HOSTING_WORKER = "http://hosting-worker:4020";
+var DOMAIN = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/;
+function guessDomain(values) {
+  try {
+    const host = new URL(values.MYBASE_PUBLIC_URL ?? "").hostname;
+    const parts = host.split(".");
+    return parts.length >= 3 && DOMAIN.test(host) ? parts.slice(1).join(".") : null;
+  } catch {
+    return null;
+  }
+}
+function hostingSettings(values, domain) {
+  const key = values.MYBASE_HOSTING_WORKER_KEY || Buffer.from(crypto.getRandomValues(new Uint8Array(32))).toString("hex");
+  return {
+    COMPOSE_PROFILES: composeProfile(values.COMPOSE_PROFILES, "hosting", true),
+    MYBASE_HOSTING_WORKER_URL: LOCAL_HOSTING_WORKER,
+    MYBASE_HOSTING_WORKER_KEY: key,
+    MYBASE_HOSTING_DOMAIN: domain
+  };
+}
+async function ask2(answer) {
+  const value = await answer;
+  if (isCancel(value))
+    throw new CliError("cancelled; nothing changed");
+  return value;
+}
+async function routeWildcard(tunnelToken, domain, apiToken, interactive) {
+  const tunnelId = tunnelIdFromToken(tunnelToken);
+  if (!tunnelId)
+    throw new CliError("CLOUDFLARE_TUNNEL_TOKEN in .env isn't a tunnel token");
+  let token = apiToken;
+  if (!token) {
+    if (!interactive)
+      return false;
+    ui.note([`Same token as the tunnel setup: ${TOKEN_URL}`, ...TOKEN_PERMISSIONS.map((perm) => `  \u2022 ${perm}`), "", "Used now to add *." + domain + ", not saved."].join(`
+`), "Cloudflare API token");
+    token = (await ask2(password({ message: "Cloudflare API token (empty to skip)" }))).trim();
+    if (!token)
+      return false;
+  }
+  const cf = cloudflare(token);
+  const zone = zoneOf(await cf.listZones(), domain);
+  if (!zone)
+    throw new CliError(`${domain} isn't an active zone on this Cloudflare token`);
+  if (zone.name !== domain)
+    ui.warn(`${domain} is under ${zone.name}: Cloudflare's free certificate only covers one level (*.${zone.name}), so https://<site>.${domain} needs Advanced Certificate Manager.`);
+  const wildcard = `*.${domain}`;
+  const record = await cf.findRecord(zone.id, wildcard).catch(() => null);
+  if (record && !pointsAtTunnel(record, tunnelId)) {
+    if (!interactive)
+      throw new CliError(`${wildcard} already points at ${record.content}; replace it by hand or rerun in a terminal`);
+    const replace = await ask2(confirm2({ message: `${wildcard} already points at ${record.content}. Replace it?`, initialValue: false }));
+    if (!replace)
+      return false;
+  }
+  const current = await cf.getIngress(zone.account.id, tunnelId);
+  await cf.putIngress(zone.account.id, tunnelId, mergeIngress(current, [{ hostname: wildcard, service: "http://caddy:80" }]));
+  await cf.upsertCname(zone.id, wildcard, tunnelId);
+  return true;
+}
+async function setupHostingServer(args) {
+  const dir = await serverDir(args);
+  const envFile = Bun.file(join8(dir, ".env"));
+  if (!await envFile.exists())
+    throw new CliError(`no mybase server in ${dir}. Run \`mybase server setup\` (or pass --dir).`, 4);
+  const text = await envFile.text();
+  const values = parseEnv(text);
+  const interactive = !jsonMode && process.stdin.isTTY === true;
+  if (!jsonMode)
+    intro(`${styleText4("bold", " mybase ")} ${styleText4("dim", "server hosting")}`);
+  if (args.includes("--off")) {
+    await Bun.write(join8(dir, ".env"), mergeEnv(text, { COMPOSE_PROFILES: composeProfile(values.COMPOSE_PROFILES, "hosting", false), MYBASE_HOSTING_WORKER_URL: null }));
+    await compose(dir, ["--profile", "hosting", "rm", "-sf", "caddy", "registry", "hosting-worker"]);
+    await startStack(dir, values, false);
+    return print({ dir, hosting: false }, () => outro("Hosting off: sites aren't reachable. Turn it off per project to remove their containers."));
+  }
+  let domain = flag(args, "--domain")?.toLowerCase() ?? null;
+  if (!domain && interactive) {
+    const guess = values.MYBASE_HOSTING_DOMAIN || guessDomain(values) || "";
+    domain = (await ask2(text2({ message: "Base domain for sites (<site>.<domain>); empty for LAN only", placeholder: "example.com", defaultValue: guess, initialValue: guess }))).trim().toLowerCase() || null;
+  } else if (!domain)
+    domain = values.MYBASE_HOSTING_DOMAIN || null;
+  if (domain && !DOMAIN.test(domain))
+    throw usageError(`"${domain}" isn't a domain name`);
+  const updates = hostingSettings(values, domain);
+  let routed = false;
+  if (domain && values.CLOUDFLARE_TUNNEL_TOKEN) {
+    try {
+      routed = await routeWildcard(values.CLOUDFLARE_TUNNEL_TOKEN, domain, flag(args, "--cf-token") ?? process.env.CLOUDFLARE_API_TOKEN, interactive);
+    } catch (err) {
+      throw new CliError(err instanceof CloudflareError ? err.message : err.message);
+    }
+  }
+  await Bun.write(join8(dir, ".env"), mergeEnv(text, updates));
+  const version = await startStack(dir, values);
+  const url = domain ? `https://<site>.${domain}` : `http://<site>.localhost:${values.MYBASE_HOSTING_PORT || "80"}`;
+  print({ dir, version, hosting: true, domain, wildcardRouted: routed }, () => {
+    if (domain && values.CLOUDFLARE_TUNNEL_TOKEN && !routed)
+      ui.warn(`*.${domain} isn't routed yet. In the tunnel's public hostnames, add *.${domain} \u2192 http://caddy:80, and a proxied CNAME *.${domain} \u2192 <tunnel id>.cfargotunnel.com. Or rerun with --cf-token.`);
+    if (domain && !values.CLOUDFLARE_TUNNEL_TOKEN)
+      ui.info(`No tunnel: point *.${domain} at this machine yourself (port ${values.MYBASE_HOSTING_PORT || "80"}, plain HTTP), or run mybase server tunnel first.`);
+    outro(`Hosting is on. Sites answer at ${url}. Next: mybase hosting enable <project>, then mybase deploy.`);
+  });
+}
+
+// src/server.ts
+await init_server_setup();
 var serverUsage = `  server setup [--dir <dir>]     Install mybase on this machine: checks Docker, generates keys, sets up
                                  LAN/Tailscale access, a Cloudflare Tunnel, start on boot, and the admin
     [--yes] [--public-host <h>] [--tunnel-token <t> --domain <d>] [--port <n>] [--no-autostart]
@@ -6113,6 +6921,9 @@ var serverUsage = `  server setup [--dir <dir>]     Install mybase on this machi
                                  Set up sandbox host support; optionally enable it for a project
     [--deny-hosts <host,ip,\u2026>] [--image <guest>] [--worker-image <worker>]
                                  Public IP/hostnames, keys and release images are detected automatically
+  server hosting [--dir <dir>] [--domain <example.com>] [--cf-token <t>] | --off
+                                 Run sites here: registry, Caddy, and the hosting worker; with a tunnel,
+                                 routes *.<domain> to them (the Cloudflare token isn't saved)
   server status [--dir <dir>]    Containers, health, and whether mybase starts on boot
   server update [--dir <dir>]    Download new images and restart (also refreshes compose.yml)
   server restart [--dir <dir>]   Restart every container (API, Postgres, storage, cache, search, tunnel)
@@ -6125,19 +6936,19 @@ var serverUsage = `  server setup [--dir <dir>]     Install mybase on this machi
     [--host <db.domain> --dns-token <t> [--email <e>] [--staging]] | --off
   server autostart on|off        Start mybase when this machine boots (and restart it after crashes)
   Default dir: the last one setup used, else ~/mybase`;
-var dim2 = (s) => styleText4("dim", s);
-var green = (s) => styleText4("green", s);
-var red = (s) => styleText4("red", s);
+var dim2 = (s) => styleText5("dim", s);
+var green = (s) => styleText5("green", s);
+var red = (s) => styleText5("red", s);
 async function loadEnv(dir) {
-  const file = Bun.file(join6(dir, ".env"));
-  if (!await file.exists() || !await Bun.file(join6(dir, "compose.yml")).exists()) {
+  const file = Bun.file(join9(dir, ".env"));
+  if (!await file.exists() || !await Bun.file(join9(dir, "compose.yml")).exists()) {
     throw new CliError(`no mybase server in ${dir}. Run \`mybase server setup\` (or pass --dir).`, 4);
   }
   const text = await file.text();
   return { text, values: parseEnv(text) };
 }
 async function saveEnv(dir, text) {
-  await Bun.write(join6(dir, ".env"), text);
+  await Bun.write(join9(dir, ".env"), text);
 }
 async function status(args) {
   const dir = await serverDir(args);
@@ -6195,7 +7006,7 @@ async function update(args) {
   const { values } = await loadEnv(dir);
   const interactive = !jsonMode && process.stdin.isTTY === true && !args.includes("--yes");
   if (!jsonMode)
-    intro(`${styleText4("bold", " mybase ")} ${dim2("server update")}`);
+    intro(`${styleText5("bold", " mybase ")} ${dim2("server update")}`);
   const replaced = await writeCompose(dir, interactive, true);
   if (replaced)
     ui.success(`compose.yml updated to this CLI's (${CLI_VERSION})`);
@@ -6306,7 +7117,7 @@ async function tunnel(args) {
   const { text, values } = await loadEnv(dir);
   const interactive = !jsonMode && process.stdin.isTTY === true;
   if (!jsonMode)
-    intro(`${styleText4("bold", " mybase ")} ${dim2("server tunnel")}`);
+    intro(`${styleText5("bold", " mybase ")} ${dim2("server tunnel")}`);
   let updates;
   let host = null;
   if (args.includes("--off")) {
@@ -6341,7 +7152,7 @@ async function databasePublic(args) {
   const interactive = !jsonMode && process.stdin.isTTY === true;
   const off = args.includes("--off");
   if (!jsonMode)
-    intro(`${styleText4("bold", " mybase ")} ${dim2("server database-public")}`);
+    intro(`${styleText5("bold", " mybase ")} ${dim2("server database-public")}`);
   let updates;
   if (off) {
     updates = Object.fromEntries(DB_PUBLIC_KEYS.map((k) => [k, null]));
@@ -6456,6 +7267,8 @@ async function server(command, args) {
     await setup(args);
   else if (command === "sandbox")
     await setupSandboxServer(args);
+  else if (command === "hosting")
+    await setupHostingServer(args);
   else if (command === "status")
     await status(args);
   else if (command === "update")
@@ -6479,8 +7292,8 @@ async function server(command, args) {
 init_config();
 init_output();
 await init_api();
-import { chmod as chmod3, rename, rm as rm2 } from "fs/promises";
-import { join as join7 } from "path";
+import { chmod as chmod3, rename, rm as rm4 } from "fs/promises";
+import { join as join10 } from "path";
 var updateUsage = `  update [--version <v>] [--cli] [--yes]
                                  Update this CLI to the latest release (or <v>), then the server on this
                                  machine, if there is one. --cli: only the CLI`;
@@ -6535,11 +7348,11 @@ async function replaceBinary(version) {
   }
   const check = Bun.spawnSync([temp, "help"], { stdout: "ignore", stderr: "ignore" });
   if (check.exitCode !== 0) {
-    await rm2(temp, { force: true });
+    await rm4(temp, { force: true });
     throw new CliError(`the downloaded binary doesn't run on this machine; kept ${CLI_VERSION}`);
   }
   if (process.platform === "win32") {
-    await rm2(`${target}.old`, { force: true });
+    await rm4(`${target}.old`, { force: true });
     await rename(target, `${target}.old`);
   }
   await rename(temp, target);
@@ -6578,7 +7391,7 @@ async function update2(args) {
     }
   }
   const dir = (await loadConfig()).server;
-  const installed = dir && await Bun.file(join7(dir, "compose.yml")).exists();
+  const installed = dir && await Bun.file(join10(dir, "compose.yml")).exists();
   if (installed && !args.includes("--cli")) {
     let go = yes || jsonMode;
     if (!go && process.stdin.isTTY) {
@@ -6608,7 +7421,7 @@ var usersUsage = `  users enable <project>         Turn on users: an auth schema
   users revoke <project> <user-id> [<session-id>]  Sign a user out (one session, or everywhere)
   users delete <project> <user-id> [--yes]  Delete a user and their sessions
   users disable <project> [--yes]  Turn it off, deleting every user account`;
-var base9 = (project) => `/projects/${encodeURIComponent(project)}/users`;
+var base10 = (project) => `/projects/${encodeURIComponent(project)}/users`;
 function authSnippet(project, apiUrl) {
   return `// auth.ts: npm i better-auth pg @mybase-dev/sdk
 import { betterAuth } from "better-auth";
@@ -6639,7 +7452,7 @@ async function users(sub, args) {
     case "enable": {
       const p = need(project, "project name");
       const { linked } = await enableService(p, "users", flags);
-      const o = await api(base9(p));
+      const o = await api(base10(p));
       print({ enabled: "users", project: p, linked, ...o }, () => {
         console.log(`Users enabled for "${p}". Better Auth's tables go in the "${o.schema}" schema.
 `);
@@ -6653,7 +7466,7 @@ async function users(sub, args) {
     }
     case "init": {
       const p = need(project, "project name");
-      const o = await api(base9(p));
+      const o = await api(base10(p));
       const env = flagString(flags, "env");
       let stored = null;
       if (env) {
@@ -6676,7 +7489,7 @@ Set BETTER_AUTH_SECRET to 32+ random bytes (openssl rand -base64 32), or rerun w
     case "list": {
       const p = need(project, "project name");
       const search = flagString(flags, "search");
-      const list = await api(`${base9(p)}/accounts?limit=100${search ? `&search=${encodeURIComponent(search)}` : ""}`);
+      const list = await api(`${base10(p)}/accounts?limit=100${search ? `&search=${encodeURIComponent(search)}` : ""}`);
       print(list, () => {
         if (list.users.length === 0)
           console.log(search ? "No users match." : "No users yet.");
@@ -6689,7 +7502,7 @@ Set BETTER_AUTH_SECRET to 32+ random bytes (openssl rand -base64 32), or rerun w
     }
     case "show": {
       const p = need(project, "project name");
-      const u = await api(`${base9(p)}/accounts/${encodeURIComponent(need(userId, "user id"))}`);
+      const u = await api(`${base10(p)}/accounts/${encodeURIComponent(need(userId, "user id"))}`);
       print(u, () => {
         console.log(`${u.email ?? u.id}${u.name ? ` (${u.name})` : ""}${u.banned ? "  BANNED" : ""}`);
         console.log(`  id          ${u.id}`);
@@ -6707,10 +7520,10 @@ Active sessions (${u.sessions.length}):`);
       const p = need(project, "project name");
       const id = encodeURIComponent(need(userId, "user id"));
       if (sessionId) {
-        await api(`${base9(p)}/accounts/${id}/sessions/${encodeURIComponent(sessionId)}`, { method: "DELETE" });
+        await api(`${base10(p)}/accounts/${id}/sessions/${encodeURIComponent(sessionId)}`, { method: "DELETE" });
         print({ revoked: 1 }, () => console.log("Signed out that session."));
       } else {
-        const r = await api(`${base9(p)}/accounts/${id}/sessions`, { method: "DELETE" });
+        const r = await api(`${base10(p)}/accounts/${id}/sessions`, { method: "DELETE" });
         print(r, () => console.log(`Signed out ${r.revoked} session(s).`));
       }
       return true;
@@ -6719,7 +7532,7 @@ Active sessions (${u.sessions.length}):`);
       const p = need(project, "project name");
       const id = need(userId, "user id");
       confirm(args.includes("--yes"), `This deletes user ${id} of "${p}" and signs them out.`, id, "the user id");
-      await api(`${base9(p)}/accounts/${encodeURIComponent(id)}`, { method: "DELETE" });
+      await api(`${base10(p)}/accounts/${encodeURIComponent(id)}`, { method: "DELETE" });
       print({ deleted: id }, () => console.log(`Deleted user ${id}`));
       return true;
     }
@@ -6763,6 +7576,7 @@ var USAGE = {
   users: usersUsage,
   captcha: captchaUsage,
   realtime: realtimeUsage,
+  hosting: hostingUsage,
   run: runUsage
 };
 var GLOBAL_FLAGS = `  --json                         Print results as JSON (errors too, on stderr)
@@ -6901,6 +7715,12 @@ async function main(args) {
     if (await realtime(sub, rest))
       return;
   }
+  if (command === "hosting" && sub) {
+    if (await hosting(sub, rest))
+      return;
+  }
+  if (command === "deploy")
+    return deploy(args.slice(1));
   if (command && command !== "help")
     throw usageError(`unknown command: mybase ${args.filter((a) => !a.startsWith("-")).slice(0, 2).join(" ")}