@nmakarov/cli-toolkit 0.29.0 → 0.32.0

package/dist/index.cjs

@@ -561,7 +561,7 @@ async function showScreen(config2) {
     onRender,
     parentData = {}
   } = config2;
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     let instance2;
     const keyBindings = [];
     const actions = {};
@@ -736,7 +736,7 @@ async function showScreen(config2) {
     };
     const cleanup = (result) => {
       if (instance2) instance2.unmount();
-      setTimeout(() => resolve2(result), 50);
+      setTimeout(() => resolve3(result), 50);
     };
     instance2 = (0, import_ink3.render)((0, import_react3.createElement)(Screen));
   });
@@ -1072,6 +1072,7 @@ var src_exports = {};
 __export(src_exports, {
   AbstractTask: () => AbstractTask,
   Args: () => Args,
+  Aws: () => Aws,
   Box: () => import_ink5.Box,
   Db: () => Db,
   Divider: () => Divider,
@@ -1085,6 +1086,7 @@ __export(src_exports, {
   MultiColumnListComponent: () => MultiColumnListComponent,
   MultiColumnListWithPreviewComponent: () => MultiColumnListWithPreviewComponent,
   Params: () => Params,
+  REMOTE_CLI_REL: () => REMOTE_CLI_REL,
   React: () => import_react5.default,
   S3: () => S3,
   SERVICE_TASK_NAMES: () => SERVICE_TASK_NAMES,
@@ -1105,51 +1107,94 @@ __export(src_exports, {
   TasksRegistry: () => TasksRegistry,
   Text: () => import_ink5.Text,
   TextBlock: () => TextBlock,
+  activateRelease: () => activateRelease,
+  appendDeployLog: () => appendDeployLog,
   appendTaskIpcLog: () => appendTaskIpcLog,
+  bootstrapHost: () => bootstrapHost,
   buildBreadcrumb: () => buildBreadcrumb,
   buildDetailBreadcrumb: () => buildDetailBreadcrumb,
   buildFooter: () => buildFooter,
+  bumpPatchVersion: () => bumpPatchVersion,
+  cloneRepo: () => cloneRepo,
   convertPattern: () => convertPattern,
+  createRelease: () => createRelease,
   defaultFileSynopsisFunction: () => defaultFileSynopsisFunction,
   defaultTasksRegistry: () => defaultTasksRegistry,
   defaultVersionSynopsisFunction: () => defaultVersionSynopsisFunction,
+  defineService: () => defineService,
+  deployService: () => deployService,
+  deriveRepoDirName: () => deriveRepoDirName,
+  enableNginxUpstream: () => enableNginxUpstream,
   enqueueStopTask: () => enqueueStopTask,
   enqueueTask: () => enqueueTask,
+  ensureDeployKeyOnRemote: () => ensureDeployKeyOnRemote,
+  ensureEnvOnRemote: () => ensureEnvOnRemote,
+  ensureRemoteRepo: () => ensureRemoteRepo,
+  ensureRepoDependencies: () => ensureRepoDependencies,
   ensureTaskTables: () => ensureTaskTables,
   flushTaskIpcLogs: () => flushTaskIpcLogs,
   getArgsInstance: () => getArgsInstance,
   h: () => import_react5.createElement,
+  initServiceStructure: () => initServiceStructure,
+  installDeps: () => installDeps,
   ipcFileLogsTableNameForSourceResource: () => ipcFileLogsTableNameForSourceResource,
   joiEdateType: () => joiEdateType,
   joiStringArrayType: () => joiStringArrayType,
   listAliveRunnerHeartbeats: () => listServicesRegistry,
+  listReleases: () => listReleases,
   listServicesRegistry: () => listServicesRegistry,
   listSources: () => listSources,
   listTables: () => listTables,
   load: () => load,
+  loadServices: () => loadServices,
   matchesParsedPattern: () => matchesParsedPattern,
   memo: () => import_react5.memo,
   mergeAllowedTasksWithServiceTasks: () => mergeAllowedTasksWithServiceTasks,
   nextTimeMatch: () => nextTimeMatch,
   normalizeAllowedTasks: () => normalizeAllowedTasks,
+  npmEnv: () => npmEnv,
+  npmInstallEnv: () => npmInstallEnv,
   organizeFooterMessages: () => organizeFooterMessages,
+  parseGitHost: () => parseGitHost,
+  prepareGitHost: () => prepareGitHost,
+  provisionService: () => provisionService,
+  pruneReleases: () => pruneReleases,
+  pullRepo: () => pullRepo,
   queueToTableNames: () => queueToTableNames,
+  readCurrentRelease: () => readCurrentRelease,
+  readReleaseBuildInfo: () => readReleaseBuildInfo,
   readTaskIpcLogsSnapshot: () => readTaskIpcLogsSnapshot,
   registerInServicesRegistry: () => registerInServicesRegistry,
   registerRunnerHeartbeat: () => registerInServicesRegistry,
+  releaseDir: () => releaseDir,
+  releaseStamp: () => releaseStamp,
+  reloadPm2: () => reloadPm2,
   resolveAsterisks: () => resolveAsterisks,
   resolveIpcFileLogsDir: () => resolveIpcFileLogsDir,
+  resolveNextVersion: () => resolveNextVersion,
   resolveRanges: () => resolveRanges,
+  resolveServiceFrom: () => resolveServiceFrom,
   resolveSteps: () => resolveSteps,
+  rollbackService: () => rollbackService,
+  run: () => run,
   runNodeTaskScript: () => runNodeTaskScript,
+  runReleaseTests: () => runReleaseTests,
+  runRemoteCli: () => runRemoteCli,
+  runRemoteStatus: () => runRemoteStatus,
+  runShell: () => runShell,
   runTasksLoop: () => runTasksLoop,
+  scrubEnvContent: () => scrubEnvContent,
+  servicePaths: () => servicePaths,
   setupContext: () => setupContext,
+  shellQuote: () => shellQuote,
   showListScreen: () => showListScreen,
   showMenuScreen: () => showMenuScreen,
   showMultiColumnListScreen: () => showMultiColumnListScreen,
   showMultiColumnListWithPreviewScreen: () => showMultiColumnListWithPreviewScreen,
   showScreen: () => showScreen,
   showWordGridScreen: () => showWordGridScreen,
+  sshRun: () => sshRun,
+  syncEnv: () => syncEnv,
   taskHistoryInsertFromQueueRow: () => taskHistoryInsertFromQueueRow,
   timeMatcher: () => timeMatcher,
   touchRunnerHeartbeat: () => touchServicesRegistry,
@@ -1165,7 +1210,8 @@ __export(src_exports, {
   useMemo: () => import_react5.useMemo,
   useRef: () => import_react5.useRef,
   useState: () => import_react5.useState,
-  waitForTaskResult: () => waitForTaskResult
+  waitForTaskResult: () => waitForTaskResult,
+  writeReleaseBuildInfo: () => writeReleaseBuildInfo
 });
 module.exports = __toCommonJS(src_exports);
 
@@ -2559,8 +2605,8 @@ var FileDatabase = class _FileDatabase {
       const items = await import_fs4.default.promises.readdir(destPath);
       const versions = items.filter((item) => {
         const itemPath = import_path4.default.join(destPath, item);
-        const stat = import_fs4.default.statSync(itemPath);
-        return stat.isDirectory() && isTimestampFolder(item);
+        const stat2 = import_fs4.default.statSync(itemPath);
+        return stat2.isDirectory() && isTimestampFolder(item);
       });
       return versions.sort();
     } catch (error) {
@@ -2625,8 +2671,8 @@ var FileDatabase = class _FileDatabase {
     }
     const versionFolders = items.filter((item) => {
       const itemPath = import_path4.default.join(tablePath, item);
-      const stat = import_fs4.default.statSync(itemPath);
-      return stat.isDirectory() && isTimestampFolder(item);
+      const stat2 = import_fs4.default.statSync(itemPath);
+      return stat2.isDirectory() && isTimestampFolder(item);
     });
     if (versionFolders.length > 0) {
       const latestVersion = versionFolders.sort().pop();
@@ -4082,6 +4128,189 @@ var S3 = class _S3 {
   }
 };
 
+// src/aws/index.js
+var import_client_sts = require("@aws-sdk/client-sts");
+var import_client_ec2 = require("@aws-sdk/client-ec2");
+var import_client_route_53 = require("@aws-sdk/client-route-53");
+var DEFAULT_REGION = "us-east-1";
+var CANONICAL_OWNER_ID = "099720109477";
+var DEFAULT_UBUNTU_PATTERN = "ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-server-*";
+function nameTag(tags) {
+  const t = (tags ?? []).find((x) => x.Key === "Name");
+  return t?.Value ?? null;
+}
+var Aws = class _Aws {
+  /**
+   * Resolve credentials/region from params and return an Aws instance.
+   * Does not call AWS until you invoke a method (clients are lazy).
+   */
+  static async init(context, options = {}) {
+    const getOpt = async (k) => {
+      try {
+        const v = await context?.params?.get?.(k, "string");
+        return v != null && String(v).trim() !== "" ? v : void 0;
+      } catch {
+        return void 0;
+      }
+    };
+    const config2 = {
+      region: options.region ?? await getOpt("awsRegion") ?? DEFAULT_REGION,
+      accessKeyId: options.accessKeyId ?? await getOpt("awsAccessKeyId"),
+      secretAccessKey: options.secretAccessKey ?? await getOpt("awsSecretAccessKey"),
+      sessionToken: options.sessionToken ?? await getOpt("awsSessionToken")
+    };
+    const aws = new _Aws(context, config2);
+    context?.logger?.debug?.(
+      `[aws] region=${config2.region} credentials=${config2.accessKeyId ? "explicit" : "default-chain"}`
+    );
+    return aws;
+  }
+  constructor(context, config2) {
+    this.logger = context?.logger ?? console;
+    this.region = config2.region || DEFAULT_REGION;
+    this._credentials = config2.accessKeyId && config2.secretAccessKey ? {
+      accessKeyId: config2.accessKeyId,
+      secretAccessKey: config2.secretAccessKey,
+      ...config2.sessionToken ? { sessionToken: config2.sessionToken } : {}
+    } : void 0;
+    process.env.AWS_SDK_JS_NODE_VERSION_SUPPORT_WARNING_DISABLED ??= "true";
+    this._clients = {};
+  }
+  // ── clients (lazy, optionally region-scoped) ──────────────────────────────
+  _clientConfig(region) {
+    const cfg = { region: region || this.region };
+    if (this._credentials) cfg.credentials = this._credentials;
+    return cfg;
+  }
+  _sts() {
+    return this._clients.sts ??= new import_client_sts.STSClient(this._clientConfig());
+  }
+  _ec2(region) {
+    const key = `ec2:${region || this.region}`;
+    return this._clients[key] ??= new import_client_ec2.EC2Client(this._clientConfig(region));
+  }
+  _route53() {
+    return this._clients.route53 ??= new import_client_route_53.Route53Client(this._clientConfig());
+  }
+  getRegion() {
+    return this.region;
+  }
+  // ── identity ──────────────────────────────────────────────────────────────
+  /** { account, arn, userId } — confirm which account/identity the keys belong to. */
+  async whoAmI() {
+    const out = await this._sts().send(new import_client_sts.GetCallerIdentityCommand({}));
+    return { account: out.Account, arn: out.Arn, userId: out.UserId };
+  }
+  // ── regions / AZs ──────────────────────────────────────────────────────────
+  /** Enabled region names, sorted. */
+  async listRegions({ allRegions = false } = {}) {
+    const out = await this._ec2().send(new import_client_ec2.DescribeRegionsCommand({ AllRegions: allRegions }));
+    return (out.Regions ?? []).map((r) => r.RegionName).sort();
+  }
+  /** Availability zone names for a region (defaults to the instance region). */
+  async listAvailabilityZones(region) {
+    const out = await this._ec2(region).send(new import_client_ec2.DescribeAvailabilityZonesCommand({}));
+    return (out.AvailabilityZones ?? []).filter((z) => z.State === "available").map((z) => z.ZoneName).sort();
+  }
+  // ── VPC / subnets / SGs / key pairs ────────────────────────────────────────
+  /** [{ id, cidr, isDefault, name }] in a region. */
+  async listVpcs(region) {
+    const out = await this._ec2(region).send(new import_client_ec2.DescribeVpcsCommand({}));
+    return (out.Vpcs ?? []).map((v) => ({
+      id: v.VpcId,
+      cidr: v.CidrBlock,
+      isDefault: !!v.IsDefault,
+      name: nameTag(v.Tags)
+    }));
+  }
+  /** [{ id, vpcId, az, cidr, public, name }]; pass vpcId to scope. */
+  async listSubnets({ vpcId, region } = {}) {
+    const Filters = vpcId ? [{ Name: "vpc-id", Values: [vpcId] }] : void 0;
+    const out = await this._ec2(region).send(new import_client_ec2.DescribeSubnetsCommand({ Filters }));
+    return (out.Subnets ?? []).map((s) => ({
+      id: s.SubnetId,
+      vpcId: s.VpcId,
+      az: s.AvailabilityZone,
+      cidr: s.CidrBlock,
+      public: !!s.MapPublicIpOnLaunch,
+      name: nameTag(s.Tags)
+    }));
+  }
+  /** [{ id, name, vpcId, description }]; pass vpcId to scope. */
+  async listSecurityGroups({ vpcId, region } = {}) {
+    const Filters = vpcId ? [{ Name: "vpc-id", Values: [vpcId] }] : void 0;
+    const out = await this._ec2(region).send(new import_client_ec2.DescribeSecurityGroupsCommand({ Filters }));
+    return (out.SecurityGroups ?? []).map((g) => ({
+      id: g.GroupId,
+      name: g.GroupName,
+      vpcId: g.VpcId,
+      description: g.Description
+    }));
+  }
+  /** [{ name, fingerprint }] EC2 key pairs in a region. */
+  async listKeyPairs(region) {
+    const out = await this._ec2(region).send(new import_client_ec2.DescribeKeyPairsCommand({}));
+    return (out.KeyPairs ?? []).map((k) => ({ name: k.KeyName, fingerprint: k.KeyFingerprint }));
+  }
+  // ── Route53 ────────────────────────────────────────────────────────────────
+  /** [{ id, name, private, recordCount }] — id is the bare zone id (no /hostedzone/). */
+  async listHostedZones() {
+    const zones = [];
+    let marker;
+    do {
+      const out = await this._route53().send(new import_client_route_53.ListHostedZonesCommand({ Marker: marker }));
+      for (const z of out.HostedZones ?? []) {
+        zones.push({
+          id: (z.Id ?? "").replace("/hostedzone/", ""),
+          name: (z.Name ?? "").replace(/\.$/, ""),
+          // strip trailing dot
+          private: !!z.Config?.PrivateZone,
+          recordCount: z.ResourceRecordSetCount
+        });
+      }
+      marker = out.IsTruncated ? out.NextMarker : void 0;
+    } while (marker);
+    return zones;
+  }
+  /**
+   * Best hosted zone for a domain: exact match, else the longest zone name that
+   * is a suffix of the domain (so "api.foo.com" matches the "foo.com" zone).
+   * Returns the zone object or null.
+   */
+  async findHostedZoneForDomain(domain) {
+    const target = String(domain ?? "").replace(/\.$/, "").toLowerCase();
+    if (!target) return null;
+    const zones = await this.listHostedZones();
+    const exact = zones.find((z) => z.name.toLowerCase() === target);
+    if (exact) return exact;
+    return zones.filter((z) => target.endsWith(`.${z.name.toLowerCase()}`)).sort((a, b) => b.name.length - a.name.length)[0] ?? null;
+  }
+  // ── AMI lookup ──────────────────────────────────────────────────────────────
+  /**
+   * Latest Ubuntu AMI matching a name pattern in a region.
+   * Returns { id, name, creationDate, architecture } or null.
+   */
+  async findLatestUbuntuAmi({ region, pattern = DEFAULT_UBUNTU_PATTERN, architecture = "x86_64" } = {}) {
+    const out = await this._ec2(region).send(new import_client_ec2.DescribeImagesCommand({
+      Owners: [CANONICAL_OWNER_ID],
+      Filters: [
+        { Name: "name", Values: [pattern] },
+        { Name: "virtualization-type", Values: ["hvm"] },
+        { Name: "state", Values: ["available"] },
+        ...architecture ? [{ Name: "architecture", Values: [architecture] }] : []
+      ]
+    }));
+    const newest = (out.Images ?? []).sort((a, b) => String(b.CreationDate).localeCompare(String(a.CreationDate)))[0];
+    if (!newest) return null;
+    return {
+      id: newest.ImageId,
+      name: newest.Name,
+      creationDate: newest.CreationDate,
+      architecture: newest.Architecture
+    };
+  }
+};
+
 // src/logger/index.js
 var import_chalk = __toESM(require("chalk"), 1);
 var import_util = __toESM(require("util"), 1);
@@ -4454,12 +4683,1061 @@ function setupContext(opts = {}) {
   return setup(opts);
 }
 
+// src/deploy/service.js
+function deriveRepoDirName(repoUrl) {
+  const tail = String(repoUrl ?? "").split("/").pop() ?? "repo";
+  return tail.replace(/\.git$/, "") || "repo";
+}
+function defineService(service) {
+  if (!service?.name) throw new Error("service manifest needs a `name`");
+  if (!service.appsRoot) throw new Error(`service "${service.name}" needs an appsRoot`);
+  if (!service.repoUrl) throw new Error(`service "${service.name}" needs a repoUrl`);
+  if (!service.pm2?.script) throw new Error(`service "${service.name}" needs pm2.script`);
+  const pm2 = {
+    appName: service.name,
+    args: "",
+    ...service.pm2
+  };
+  const nginx = service.nginx ? { siteName: service.name, ...service.nginx } : null;
+  return {
+    repoDirName: deriveRepoDirName(service.repoUrl),
+    repoSubdir: "",
+    keepReleases: 3,
+    testCommand: null,
+    envScrubPatterns: [],
+    legacyRepoEnv: null,
+    buildInfoPath: "build-info.json",
+    deployKey: null,
+    requireEnv: false,
+    ...service,
+    pm2,
+    nginx
+  };
+}
+
+// src/deploy/paths.js
+var import_node_path = require("path");
+function servicePaths(service) {
+  const root = service.appsRoot;
+  const repoDirName = service.repoDirName ?? "repo";
+  const repoSubdir = service.repoSubdir ?? "";
+  const repo = (0, import_node_path.join)(root, repoDirName);
+  const repoRun = repoSubdir ? (0, import_node_path.join)(repo, repoSubdir) : repo;
+  return {
+    root,
+    repo,
+    repoRun,
+    repoEnv: (0, import_node_path.join)(repoRun, ".env"),
+    releases: (0, import_node_path.join)(root, "releases"),
+    shared: (0, import_node_path.join)(root, "shared"),
+    logs: (0, import_node_path.join)(root, "logs"),
+    current: (0, import_node_path.join)(root, "current"),
+    sharedEnv: (0, import_node_path.join)(root, "shared", ".env"),
+    ecosystem: (0, import_node_path.join)(root, "shared", "ecosystem.config.cjs"),
+    deployLog: (0, import_node_path.join)(root, "logs", "deploy.log"),
+    lockHashFile: (0, import_node_path.join)(root, "shared", ".package-lock.sha256")
+  };
+}
+function releaseStamp(date = /* @__PURE__ */ new Date()) {
+  return date.toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+function releaseDir(releasesRoot, stamp) {
+  return (0, import_node_path.join)(releasesRoot, stamp);
+}
+
+// src/deploy/run.js
+var import_node_child_process = require("child_process");
+function npmEnv(baseEnv = process.env) {
+  const env = { ...baseEnv };
+  delete env.NODE_ENV;
+  return env;
+}
+function npmInstallEnv(baseEnv = process.env) {
+  return {
+    ...npmEnv(baseEnv),
+    NPM_CONFIG_PRODUCTION: "false",
+    npm_config_production: "false"
+  };
+}
+function run(cmd, args, options = {}) {
+  const { cwd, env, logger } = options;
+  return new Promise((resolve3, reject) => {
+    logger?.info?.(`$ ${cmd} ${args.join(" ")}${cwd ? `  (cwd=${cwd})` : ""}`);
+    const child = (0, import_node_child_process.spawn)(cmd, args, {
+      cwd,
+      env: env ?? process.env,
+      stdio: "inherit"
+    });
+    child.on("error", reject);
+    child.on("close", (code) => {
+      if (code === 0) resolve3();
+      else reject(new Error(`${cmd} exited with code ${code}`));
+    });
+  });
+}
+function runShell(command, options = {}) {
+  return run("bash", ["-lc", command], options);
+}
+
+// src/deploy/log.js
+var import_promises = require("fs/promises");
+async function appendDeployLog(deployLogPath, message) {
+  await (0, import_promises.mkdir)(deployLogPath.replace(/\/[^/]+$/, ""), { recursive: true });
+  const line = `[${(/* @__PURE__ */ new Date()).toISOString()}] ${message}
+`;
+  await (0, import_promises.appendFile)(deployLogPath, line);
+}
+
+// src/deploy/git.js
+var import_promises2 = require("fs/promises");
+async function pathExists(path5) {
+  try {
+    await (0, import_promises2.access)(path5);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function cloneRepo(service, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  const paths = servicePaths(service);
+  if (await pathExists(paths.repo)) {
+    throw new Error(`Repo already exists at ${paths.repo} \u2014 use git pull instead`);
+  }
+  if (dryRun) {
+    logger.info(`[dryRun] would git clone ${service.repoUrl} ${paths.repo}`);
+    return;
+  }
+  await run("git", ["clone", service.repoUrl, paths.repo], { logger });
+  logger.info(`cloned ${service.repoUrl} \u2192 ${paths.repo}`);
+}
+async function pullRepo(service, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  const paths = servicePaths(service);
+  if (!await pathExists(paths.repo)) {
+    throw new Error(`Repo missing at ${paths.repo} \u2014 run provision first`);
+  }
+  if (dryRun) {
+    logger.info(`[dryRun] would git -C ${paths.repo} pull --ff-only`);
+    return;
+  }
+  await run("git", ["-C", paths.repo, "pull", "--ff-only"], { logger });
+  logger.info(`pulled ${paths.repo}`);
+}
+
+// src/deploy/release.js
+var import_promises3 = require("fs/promises");
+var import_node_path2 = require("path");
+var SKIP_TOP = /* @__PURE__ */ new Set(["node_modules", ".git"]);
+function shouldCopyEntry(srcPath) {
+  const parts = srcPath.split(import_node_path2.sep);
+  if (parts.some((p) => p === "node_modules" || p === ".git")) return false;
+  const top = parts.at(-1);
+  if (parts.length === 1 && SKIP_TOP.has(top)) return false;
+  return true;
+}
+async function createRelease(service, options = {}) {
+  const { stamp = releaseStamp(), dryRun = false, logger = console } = options;
+  const paths = servicePaths(service);
+  const dest = releaseDir(paths.releases, stamp);
+  if (dryRun) {
+    logger.info(`[dryRun] would copy ${paths.repoRun} \u2192 ${dest}`);
+    return { stamp, path: dest };
+  }
+  await (0, import_promises3.mkdir)(paths.releases, { recursive: true });
+  await (0, import_promises3.cp)(paths.repoRun, dest, {
+    recursive: true,
+    filter: (src) => shouldCopyEntry(src)
+  });
+  logger.info(`release ${stamp} created at ${dest}`);
+  return { stamp, path: dest };
+}
+async function readCurrentRelease(paths) {
+  try {
+    const target = await (0, import_promises3.readlink)(paths.current);
+    return target.startsWith("/") ? target : (0, import_node_path2.join)((0, import_node_path2.dirname)(paths.current), target);
+  } catch {
+    return null;
+  }
+}
+async function listReleases(paths) {
+  let names;
+  try {
+    names = await (0, import_promises3.readdir)(paths.releases);
+  } catch {
+    return [];
+  }
+  const entries = [];
+  for (const name of names) {
+    const full = releaseDir(paths.releases, name);
+    const s = await (0, import_promises3.stat)(full);
+    if (s.isDirectory()) entries.push({ name, path: full, mtime: s.mtime });
+  }
+  entries.sort((a, b) => b.name.localeCompare(a.name));
+  return entries;
+}
+
+// src/deploy/activate.js
+var import_promises4 = require("fs/promises");
+var import_node_path3 = require("path");
+async function activateRelease(releasePath, paths, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  if (dryRun) {
+    logger.info(`[dryRun] would activate ${releasePath} \u2192 ${paths.current}`);
+    return;
+  }
+  try {
+    await (0, import_promises4.unlink)(paths.current);
+  } catch {
+  }
+  await (0, import_promises4.symlink)(releasePath, paths.current);
+  const envLink = (0, import_node_path3.join)(releasePath, ".env");
+  try {
+    await (0, import_promises4.unlink)(envLink);
+  } catch {
+  }
+  await (0, import_promises4.symlink)(paths.sharedEnv, envLink);
+  logger.info(`active release: ${releasePath}`);
+}
+
+// src/deploy/deps.js
+var import_node_crypto = require("crypto");
+var import_promises5 = require("fs/promises");
+var import_node_path4 = require("path");
+async function pathExists2(path5) {
+  try {
+    await (0, import_promises5.access)(path5);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function lockfileHash(releasePath) {
+  const lockPath = (0, import_node_path4.join)(releasePath, "package-lock.json");
+  try {
+    const buf = await (0, import_promises5.readFile)(lockPath);
+    return (0, import_node_crypto.createHash)("sha256").update(buf).digest("hex");
+  } catch {
+    return null;
+  }
+}
+async function readHashFile(path5) {
+  try {
+    return (await (0, import_promises5.readFile)(path5, "utf8")).trim();
+  } catch {
+    return null;
+  }
+}
+async function npmInstall(releasePath, hasLock, logger) {
+  await (0, import_promises5.rm)((0, import_node_path4.join)(releasePath, "node_modules"), { recursive: true, force: true });
+  const cmd = hasLock ? ["ci", "--include=dev"] : ["install", "--include=dev", "--no-audit", "--no-fund"];
+  logger.info(`running npm ${cmd.join(" ")} in ${releasePath}`);
+  await run("npm", cmd, { cwd: releasePath, logger, env: npmInstallEnv() });
+}
+async function installDeps(service, releasePath, paths, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  if (dryRun) {
+    logger.info(`[dryRun] would install deps in ${releasePath}`);
+    return { hash: null, copied: false };
+  }
+  const hash = await lockfileHash(releasePath);
+  const hasLock = hash !== null;
+  const hashMarker = (0, import_node_path4.join)(releasePath, ".deploy-package-lock.sha256");
+  const currentPath = await readCurrentRelease(paths);
+  let copied = false;
+  if (hasLock && currentPath && await pathExists2((0, import_node_path4.join)(currentPath, "node_modules"))) {
+    const currentHash = await readHashFile((0, import_node_path4.join)(currentPath, ".deploy-package-lock.sha256"));
+    if (currentHash === hash) {
+      logger.info("lockfile unchanged \u2014 copying node_modules from current release");
+      await (0, import_promises5.cp)((0, import_node_path4.join)(currentPath, "node_modules"), (0, import_node_path4.join)(releasePath, "node_modules"), {
+        recursive: true,
+        force: true
+      });
+      copied = true;
+    }
+  }
+  if (!copied) {
+    await npmInstall(releasePath, hasLock, logger);
+  }
+  if (hasLock) {
+    await (0, import_promises5.writeFile)(hashMarker, `${hash}
+`, "utf8");
+    await (0, import_promises5.mkdir)(paths.shared, { recursive: true });
+    await (0, import_promises5.writeFile)(paths.lockHashFile, `${hash}
+`, "utf8");
+  }
+  return { hash, copied };
+}
+
+// src/deploy/test.js
+var import_promises6 = require("fs/promises");
+var import_node_path5 = require("path");
+async function runReleaseTests(service, releasePath, paths, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  if (!service.testCommand) {
+    logger.info("no testCommand configured \u2014 skipping tests");
+    return;
+  }
+  if (dryRun) {
+    logger.info(`[dryRun] would run "${service.testCommand}" in ${releasePath}`);
+    return;
+  }
+  const envLink = (0, import_node_path5.join)(releasePath, ".env");
+  try {
+    await (0, import_promises6.unlink)(envLink);
+  } catch {
+  }
+  await (0, import_promises6.symlink)(paths.sharedEnv, envLink);
+  logger.info(`running "${service.testCommand}" in ${releasePath}`);
+  await runShell(service.testCommand, { cwd: releasePath, logger, env: npmInstallEnv() });
+}
+
+// src/deploy/prune.js
+var import_promises7 = require("fs/promises");
+async function pruneReleases(service, paths, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  const keep = service.keepReleases ?? 3;
+  const releases = await listReleases(paths);
+  let activeName = null;
+  try {
+    const target = await (0, import_promises7.readlink)(paths.current);
+    activeName = target.split("/").pop();
+  } catch {
+  }
+  const keepSet = /* @__PURE__ */ new Set();
+  for (const rel of releases) {
+    if (keepSet.size < keep) keepSet.add(rel.name);
+  }
+  if (activeName) keepSet.add(activeName);
+  const toRemove = releases.filter((rel) => !keepSet.has(rel.name));
+  for (const rel of toRemove) {
+    if (dryRun) {
+      logger.info(`[dryRun] would rm -rf ${rel.path}`);
+    } else {
+      await (0, import_promises7.rm)(rel.path, { recursive: true, force: true });
+      logger.info(`pruned ${rel.path}`);
+    }
+  }
+  return { removed: toRemove.map((r) => r.name) };
+}
+
+// src/deploy/pm2.js
+async function reloadPm2(paths, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  if (dryRun) {
+    logger.info(`[dryRun] would pm2 startOrReload ${paths.ecosystem} --update-env`);
+    return;
+  }
+  await runShell(`pm2 startOrReload "${paths.ecosystem}" --update-env`, { logger });
+  logger.info("pm2 reloaded");
+}
+
+// src/deploy/nginx.js
+var import_promises8 = require("fs/promises");
+var import_node_os = require("os");
+var import_node_path6 = require("path");
+async function hasTlsCert(certPath) {
+  try {
+    await runShell(`sudo test -f '${certPath}'`, {});
+    return true;
+  } catch {
+    return false;
+  }
+}
+function proxyBlock(port) {
+  return `  location / {
+    proxy_pass http://127.0.0.1:${port};
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_read_timeout 120s;
+  }`;
+}
+function buildNginxConfig(service) {
+  const { nginx, pm2 } = service;
+  const certDir = `/etc/letsencrypt/live/${nginx.fqdn}`;
+  return `# ${nginx.siteName} \u2014 managed by cli-toolkit deploy (proxy mode)
+# ${nginx.fqdn} \u2192 127.0.0.1:${pm2.port}
+
+server {
+  listen 80;
+  listen [::]:80;
+  server_name ${nginx.fqdn};
+  location / { return 301 https://$host$request_uri; }
+}
+
+server {
+  listen 443 ssl;
+  listen [::]:443 ssl;
+  server_name ${nginx.fqdn};
+
+  ssl_certificate ${certDir}/fullchain.pem;
+  ssl_certificate_key ${certDir}/privkey.pem;
+  include /etc/letsencrypt/options-ssl-nginx.conf;
+  ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+  client_max_body_size 25m;
+
+${proxyBlock(pm2.port)}
+}
+`;
+}
+function buildNginxConfigHttpOnly(service) {
+  const { nginx, pm2 } = service;
+  return `# ${nginx.siteName} \u2014 managed by cli-toolkit deploy (HTTP proxy, no TLS cert yet)
+
+server {
+  listen 80;
+  listen [::]:80;
+  server_name ${nginx.fqdn};
+
+  client_max_body_size 25m;
+
+${proxyBlock(pm2.port)}
+}
+`;
+}
+async function enableNginxUpstream(service, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  const { nginx } = service;
+  if (!nginx) {
+    logger.info("no nginx config on service \u2014 skipping nginx step");
+    return { skipped: true };
+  }
+  const siteAvailable = `/etc/nginx/sites-available/${nginx.siteName}`;
+  const siteEnabled = `/etc/nginx/sites-enabled/${nginx.siteName}`;
+  const cert = `/etc/letsencrypt/live/${nginx.fqdn}/fullchain.pem`;
+  if (dryRun) {
+    logger.info(`[dryRun] would write ${siteAvailable} (proxy \u2192 127.0.0.1:${service.pm2.port}) and reload nginx`);
+    return { hasCert: null };
+  }
+  const hasCert = await hasTlsCert(cert);
+  const config2 = hasCert ? buildNginxConfig(service) : buildNginxConfigHttpOnly(service);
+  const tmp = (0, import_node_path6.join)((0, import_node_os.tmpdir)(), `${service.name}-nginx.conf`);
+  await (0, import_promises8.writeFile)(tmp, config2);
+  await runShell(
+    `sudo cp '${tmp}' '${siteAvailable}' && sudo ln -sf '${siteAvailable}' '${siteEnabled}' && sudo nginx -t && sudo systemctl reload nginx`,
+    { logger }
+  );
+  logger.info(`nginx upstream enabled for ${nginx.fqdn} \u2192 127.0.0.1:${service.pm2.port} (tls=${hasCert})`);
+  return { hasCert };
+}
+
+// src/deploy/sync-env.js
+var import_promises9 = require("fs/promises");
+function scrubEnvContent(content, patterns = []) {
+  const regexes = patterns.map((p) => p instanceof RegExp ? p : new RegExp(p));
+  if (regexes.length === 0) return content;
+  return content.split("\n").filter((line) => !regexes.some((re) => re.test(line.trim()))).join("\n");
+}
+async function pathExists3(path5) {
+  try {
+    await (0, import_promises9.access)(path5);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function syncEnv(service, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  const paths = servicePaths(service);
+  const patterns = service.envScrubPatterns ?? [];
+  if (dryRun) {
+    logger.info(`[dryRun] would sync ${paths.repoEnv} \u2192 ${paths.sharedEnv}`);
+    return { source: paths.repoEnv, dest: paths.sharedEnv };
+  }
+  let source = paths.repoEnv;
+  if (!await pathExists3(source) && service.legacyRepoEnv && await pathExists3(service.legacyRepoEnv)) {
+    logger.info(`using legacy env: ${service.legacyRepoEnv}`);
+    source = service.legacyRepoEnv;
+  }
+  await (0, import_promises9.mkdir)(paths.shared, { recursive: true });
+  if (!await pathExists3(source)) {
+    if (service.requireEnv) {
+      throw new Error(
+        `No .env found at ${paths.repoEnv}` + (service.legacyRepoEnv ? ` or ${service.legacyRepoEnv}` : "") + " \u2014 place .env on the host or run the remote deploy from a laptop with a local .env (auto-scp)"
+      );
+    }
+    if (!await pathExists3(paths.sharedEnv)) {
+      await (0, import_promises9.writeFile)(paths.sharedEnv, "", { mode: 384 });
+    }
+    logger.warn(`no .env found (source ${source}) \u2014 using empty ${paths.sharedEnv}`);
+    return { source: null, dest: paths.sharedEnv };
+  }
+  const raw = await (0, import_promises9.readFile)(source, "utf8");
+  await (0, import_promises9.writeFile)(paths.sharedEnv, scrubEnvContent(raw, patterns), { mode: 384 });
+  logger.info(`synced ${source} \u2192 ${paths.sharedEnv}`);
+  return { source, dest: paths.sharedEnv };
+}
+
+// src/deploy/build-info.js
+var import_promises10 = require("fs/promises");
+var import_node_path7 = require("path");
+var import_node_child_process2 = require("child_process");
+var import_node_util = require("util");
+var execFileAsync = (0, import_node_util.promisify)(import_node_child_process2.execFile);
+function bumpPatchVersion(version) {
+  const parts = String(version).trim().split(".");
+  const major = Number.parseInt(parts[0], 10) || 0;
+  const minor = Number.parseInt(parts[1], 10) || 0;
+  const patch = Number.parseInt(parts[2], 10) || 0;
+  return `${major}.${minor}.${patch + 1}`;
+}
+async function readJson(path5) {
+  try {
+    return JSON.parse(await (0, import_promises10.readFile)(path5, "utf8"));
+  } catch {
+    return null;
+  }
+}
+async function gitShortCommit(repoPath) {
+  try {
+    const { stdout } = await execFileAsync("git", ["-C", repoPath, "rev-parse", "--short", "HEAD"], {
+      encoding: "utf8"
+    });
+    return stdout.trim() || null;
+  } catch {
+    return null;
+  }
+}
+async function resolveNextVersion(service, paths, pkgPath) {
+  const pkg = await readJson(pkgPath) ?? {};
+  const baseVersion = pkg.version || "0.1.0";
+  const currentPath = await readCurrentRelease(paths);
+  if (currentPath) {
+    const active = await readJson((0, import_node_path7.join)(currentPath, service.buildInfoPath));
+    if (active?.version) return bumpPatchVersion(active.version);
+  }
+  return baseVersion;
+}
+async function readReleaseBuildInfo(service, releasePath) {
+  return readJson((0, import_node_path7.join)(releasePath, service.buildInfoPath));
+}
+async function writeReleaseBuildInfo(service, releasePath, { stamp, dryRun = false, logger = console }) {
+  const paths = servicePaths(service);
+  const pkgPath = (0, import_node_path7.join)(paths.repoRun, "package.json");
+  const version = await resolveNextVersion(service, paths, pkgPath);
+  const gitCommit = await gitShortCommit(paths.repo);
+  const buildInfo = {
+    version,
+    release: stamp,
+    deployedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    gitCommit,
+    service: service.name
+  };
+  const dest = (0, import_node_path7.join)(releasePath, service.buildInfoPath);
+  if (dryRun) {
+    logger.info(`[dryRun] would write ${dest} (${JSON.stringify(buildInfo)})`);
+    return buildInfo;
+  }
+  await (0, import_promises10.mkdir)((0, import_node_path7.dirname)(dest), { recursive: true });
+  await (0, import_promises10.writeFile)(dest, `${JSON.stringify(buildInfo, null, 2)}
+`, { mode: 420 });
+  const gitSuffix = gitCommit ? ` git=${gitCommit}` : "";
+  logger.info(`build info: v${version} release=${stamp}${gitSuffix}`);
+  return buildInfo;
+}
+
+// src/deploy/init-structure.js
+var import_promises11 = require("fs/promises");
+var import_node_path8 = require("path");
+async function pathExists4(path5) {
+  try {
+    await (0, import_promises11.access)(path5);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function requireDeployRoot(parentDir, serviceRoot) {
+  if (await pathExists4(parentDir)) return;
+  throw new Error(
+    `Cannot create ${serviceRoot}: parent directory ${parentDir} does not exist.
+This is meant to run on the target host (where ${parentDir} exists). For a local dry run use --appsRoot=/tmp/<service>.`
+  );
+}
+function buildEcosystemConfig(service, paths) {
+  const { pm2 } = service;
+  const outLog = (0, import_node_path8.join)(paths.logs, `${pm2.appName}.out.log`);
+  const errLog = (0, import_node_path8.join)(paths.logs, `${pm2.appName}.err.log`);
+  return `/**
+ * pm2 ecosystem for ${service.name} \u2014 seeded by cli-toolkit deploy (init).
+ *
+ * cwd points at the \`current\` symlink (created on first deploy).
+ * Tweak \`args\` here, then: pm2 reload ${paths.ecosystem} --update-env
+ */
+module.exports = {
+    apps: [
+        {
+            name: "${pm2.appName}",
+            script: "${pm2.script}",
+            cwd: "${paths.current}",
+            args: "${pm2.args}",
+            instances: 1,
+            exec_mode: "fork",
+            autorestart: true,
+            min_uptime: "10s",
+            max_restarts: 10,
+            restart_delay: 2000,
+            max_memory_restart: "1500M",
+            out_file: "${outLog}",
+            error_file: "${errLog}",
+            merge_logs: true,
+            time: true,
+            env: {
+                NODE_ENV: "production",
+            },
+        },
+    ],
+};
+`;
+}
+async function initServiceStructure(service, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  const paths = servicePaths(service);
+  const dirs = [paths.releases, paths.shared, paths.logs];
+  const created = [];
+  const skipped = [];
+  if (!dryRun) {
+    await requireDeployRoot((0, import_node_path8.dirname)(paths.root), paths.root);
+  }
+  for (const dir of dirs) {
+    if (await pathExists4(dir)) {
+      skipped.push(dir);
+      continue;
+    }
+    if (!dryRun) await (0, import_promises11.mkdir)(dir, { recursive: true });
+    created.push(dir);
+  }
+  let ecosystemCreated = false;
+  if (await pathExists4(paths.ecosystem)) {
+    skipped.push(paths.ecosystem);
+  } else {
+    if (!dryRun) {
+      await (0, import_promises11.writeFile)(paths.ecosystem, buildEcosystemConfig(service, paths), { mode: 420 });
+    }
+    ecosystemCreated = true;
+    created.push(paths.ecosystem);
+  }
+  const line = `[${(/* @__PURE__ */ new Date()).toISOString()}] init-structure service=${service.name} dryRun=${dryRun} created=${created.length} skipped=${skipped.length}
+`;
+  if (!dryRun) {
+    await (0, import_promises11.mkdir)(paths.logs, { recursive: true });
+    await (0, import_promises11.appendFile)(paths.deployLog, line);
+  }
+  logger.info(`service=${service.name} appsRoot=${paths.root}`);
+  logger.info(`created: ${created.length ? created.join(", ") : "(none)"}`);
+  logger.info(`already present: ${skipped.length ? skipped.join(", ") : "(none)"}`);
+  if (ecosystemCreated) logger.info(`seeded ${paths.ecosystem}`);
+  return { paths, created, skipped, ecosystemCreated };
+}
+
+// src/deploy/bootstrap-host.js
+var import_node_child_process3 = require("child_process");
+var import_promises12 = require("fs/promises");
+var import_node_os2 = require("os");
+var import_node_path9 = require("path");
+async function pathExists5(path5) {
+  try {
+    await (0, import_promises12.access)(path5);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function expandHome(path5) {
+  return path5.startsWith("~/") ? (0, import_node_path9.join)((0, import_node_os2.homedir)(), path5.slice(2)) : path5;
+}
+async function ensurePm2Startup(options = {}) {
+  const { user = "ubuntu", dryRun = false, logger = console } = options;
+  if (dryRun) {
+    logger.info("[dryRun] would configure pm2 startup systemd");
+    return;
+  }
+  try {
+    (0, import_node_child_process3.execSync)("pm2 ping", { stdio: "ignore" });
+  } catch {
+  }
+  try {
+    const out = (0, import_node_child_process3.execSync)(`pm2 startup systemd -u ${user} --hp /home/${user}`, { encoding: "utf8" });
+    const sudoLine = out.split("\n").find((l) => l.trim().startsWith("sudo"));
+    if (sudoLine) {
+      (0, import_node_child_process3.execSync)(sudoLine.trim(), { stdio: "inherit" });
+      logger.info("pm2 startup systemd configured");
+    }
+  } catch (err) {
+    logger.warn(`pm2 startup skipped or already configured: ${err.message}`);
+  }
+}
+async function installDeployKey(deployKeyPath, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  const keyPath = expandHome(deployKeyPath);
+  if (!await pathExists5(keyPath)) {
+    logger.warn(`deploy key not found at ${keyPath} \u2014 skipping git ssh setup`);
+    return;
+  }
+  const keyBase = (0, import_node_path9.basename)(keyPath);
+  const sshDir = (0, import_node_path9.join)((0, import_node_os2.homedir)(), ".ssh");
+  const destKey = (0, import_node_path9.join)(sshDir, keyBase);
+  const configPath = (0, import_node_path9.join)(sshDir, "config");
+  const block = `
+Host github.com
+  HostName github.com
+  User git
+  IdentityFile ${destKey}
+  IdentitiesOnly yes
+`;
+  if (dryRun) {
+    logger.info(`[dryRun] would install deploy key ${keyPath} \u2192 ${destKey}`);
+    return;
+  }
+  await (0, import_promises12.mkdir)(sshDir, { recursive: true, mode: 448 });
+  await (0, import_promises12.copyFile)(keyPath, destKey);
+  await (0, import_promises12.chmod)(destKey, 384);
+  let config2 = "";
+  if (await pathExists5(configPath)) config2 = await (0, import_promises12.readFile)(configPath, "utf8");
+  if (!config2.includes("Host github.com")) {
+    await (0, import_promises12.writeFile)(configPath, `${config2.trimEnd()}
+${block}
+`, { mode: 384 });
+    logger.info("updated ~/.ssh/config for github.com");
+  }
+  logger.info(`deploy key installed at ${destKey}`);
+}
+async function installLogrotate(service, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  const conf = `/etc/logrotate.d/${service.name}`;
+  const body = `${service.appsRoot}/logs/*.log {
+  daily
+  rotate 14
+  compress
+  delaycompress
+  missingok
+  notifempty
+  copytruncate
+}
+`;
+  if (dryRun) {
+    logger.info(`[dryRun] would write ${conf}`);
+    return;
+  }
+  const tmp = (0, import_node_path9.join)("/tmp", `${service.name}-logrotate.conf`);
+  await (0, import_promises12.writeFile)(tmp, body);
+  await runShell(`sudo cp '${tmp}' '${conf}'`, { logger });
+  logger.info(`logrotate config written: ${conf}`);
+}
+async function bootstrapHost(service, options = {}) {
+  const { deployKey = service.deployKey, user = "ubuntu", dryRun = false, logger = console } = options;
+  await ensurePm2Startup({ user, dryRun, logger });
+  if (deployKey) await installDeployKey(deployKey, { dryRun, logger });
+  await installLogrotate(service, { dryRun, logger });
+  logger.info("bootstrap-host complete");
+}
+
+// src/deploy/deploy-service.js
+async function deployService(service, options = {}) {
+  const {
+    dryRun = false,
+    skipPull = false,
+    skipTests = false,
+    skipNginx = false,
+    logger = console
+  } = options;
+  const paths = servicePaths(service);
+  await initServiceStructure(service, { dryRun, logger });
+  if (!skipPull) await pullRepo(service, { dryRun, logger });
+  await syncEnv(service, { dryRun, logger });
+  const { stamp, path: releasePath } = await createRelease(service, { dryRun, logger });
+  await writeReleaseBuildInfo(service, releasePath, { stamp, dryRun, logger });
+  await installDeps(service, releasePath, paths, { dryRun, logger });
+  if (!skipTests) await runReleaseTests(service, releasePath, paths, { dryRun, logger });
+  await activateRelease(releasePath, paths, { dryRun, logger });
+  await pruneReleases(service, paths, { dryRun, logger });
+  await reloadPm2(paths, { dryRun, logger });
+  if (!skipNginx) await enableNginxUpstream(service, { dryRun, logger });
+  const summary = `deploy complete stamp=${stamp} dryRun=${dryRun}`;
+  logger.info(summary);
+  if (!dryRun) await appendDeployLog(paths.deployLog, summary);
+  return { stamp, releasePath };
+}
+
+// src/deploy/provision-service.js
+var import_promises13 = require("fs/promises");
+async function pathExists6(path5) {
+  try {
+    await (0, import_promises13.access)(path5);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function provisionService(service, options = {}) {
+  const {
+    dryRun = false,
+    deploy = true,
+    skipBootstrap = true,
+    deployKey,
+    logger = console
+  } = options;
+  if (!skipBootstrap) {
+    await bootstrapHost(service, { deployKey, dryRun, logger });
+  }
+  await initServiceStructure(service, { dryRun, logger });
+  const paths = servicePaths(service);
+  if (await pathExists6(paths.repo)) {
+    logger.info(`repo exists at ${paths.repo} \u2014 pulling`);
+    await pullRepo(service, { dryRun, logger });
+  } else {
+    await cloneRepo(service, { dryRun, logger });
+  }
+  await syncEnv(service, { dryRun, logger });
+  if (deploy) {
+    await deployService(service, { dryRun, logger, skipPull: true });
+  } else {
+    logger.info("provision complete (deploy skipped)");
+  }
+}
+
+// src/deploy/rollback-service.js
+var import_promises14 = require("fs/promises");
+async function rollbackService(service, options = {}) {
+  const { release: targetName, dryRun = false, logger = console } = options;
+  const paths = servicePaths(service);
+  const releases = await listReleases(paths);
+  if (releases.length === 0) throw new Error("No releases to roll back to");
+  let activeName = null;
+  try {
+    const target = await (0, import_promises14.readlink)(paths.current);
+    activeName = target.split("/").pop();
+  } catch {
+    throw new Error("No active release (current symlink missing)");
+  }
+  let rollbackTarget;
+  if (targetName) {
+    rollbackTarget = releases.find((r) => r.name === targetName);
+    if (!rollbackTarget) throw new Error(`Release not found: ${targetName}`);
+  } else {
+    rollbackTarget = releases.find((r) => r.name !== activeName);
+    if (!rollbackTarget) throw new Error("No previous release to roll back to");
+  }
+  if (rollbackTarget.name === activeName) throw new Error(`Already on release ${activeName}`);
+  logger.info(`rollback ${activeName} \u2192 ${rollbackTarget.name}`);
+  const buildInfo = await readReleaseBuildInfo(service, rollbackTarget.path);
+  if (buildInfo?.version) {
+    logger.info(`rollback target: v${buildInfo.version} release=${buildInfo.release ?? rollbackTarget.name}`);
+  }
+  await activateRelease(rollbackTarget.path, paths, { dryRun, logger });
+  await reloadPm2(paths, { dryRun, logger });
+  const summary = `rollback ${activeName} \u2192 ${rollbackTarget.name} dryRun=${dryRun}`;
+  if (!dryRun) await appendDeployLog(paths.deployLog, summary);
+  return { from: activeName, to: rollbackTarget.name, path: rollbackTarget.path };
+}
+
+// src/deploy/ssh-remote.js
+var import_promises15 = require("fs/promises");
+var import_node_os3 = require("os");
+var import_node_path10 = require("path");
+var import_node_child_process4 = require("child_process");
+var REMOTE_CLI_REL = "node_modules/@nmakarov/cli-toolkit/scripts/deploy/cli.js";
+async function pathExists7(path5) {
+  try {
+    await (0, import_promises15.access)(path5);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function expandHome2(path5) {
+  return path5.startsWith("~/") ? (0, import_node_path10.join)((0, import_node_os3.homedir)(), path5.slice(2)) : path5;
+}
+function resolveLocalEnvPath(envFile) {
+  if (envFile) {
+    const expanded = expandHome2(envFile);
+    return expanded.startsWith("/") ? expanded : (0, import_node_path10.join)(process.cwd(), expanded);
+  }
+  return (0, import_node_path10.join)(process.cwd(), ".env");
+}
+function parseGitHost(repoUrl) {
+  const u = String(repoUrl ?? "");
+  let m = u.match(/^[^@]+@([^:]+):/);
+  if (m) return m[1];
+  m = u.match(/^ssh:\/\/[^@]+@([^/:]+)/);
+  if (m) return m[1];
+  return null;
+}
+function shellQuote(value) {
+  return `'${String(value).replace(/'/g, `'\\''`)}'`;
+}
+function sshRun(host, remoteCommand, options = {}) {
+  const { logger } = options;
+  return new Promise((resolve3, reject) => {
+    logger?.info?.(`ssh ${host} ${remoteCommand.slice(0, 120)}${remoteCommand.length > 120 ? "\u2026" : ""}`);
+    const child = (0, import_node_child_process4.spawn)("ssh", [host, remoteCommand], { stdio: "inherit" });
+    child.on("error", reject);
+    child.on("close", (code) => code === 0 ? resolve3() : reject(new Error(`ssh ${host} exited with code ${code}`)));
+  });
+}
+function scp(localPath, remoteSpec) {
+  return new Promise((resolve3, reject) => {
+    const child = (0, import_node_child_process4.spawn)("scp", [localPath, remoteSpec], { stdio: "inherit" });
+    child.on("error", reject);
+    child.on("close", (code) => code === 0 ? resolve3() : reject(new Error(`scp exited with code ${code}`)));
+  });
+}
+async function ensureDeployKeyOnRemote(host, deployKeyPath, options = {}) {
+  const { logger = console } = options;
+  if (!deployKeyPath) return false;
+  const localPath = expandHome2(deployKeyPath);
+  if (!await pathExists7(localPath)) return false;
+  const keyBase = (0, import_node_path10.basename)(localPath);
+  logger.info(`copying deploy key ${localPath} \u2192 ${host}:~/.ssh/${keyBase}`);
+  await sshRun(host, "mkdir -p ~/.ssh && chmod 700 ~/.ssh", { logger });
+  await scp(localPath, `${host}:.ssh/${keyBase}`, { logger });
+  await sshRun(host, `chmod 600 ~/.ssh/${keyBase}`, { logger });
+  return true;
+}
+async function prepareGitHost(host, options = {}) {
+  const { logger = console, gitHost, keyBasename } = options;
+  if (!gitHost) return;
+  const configBlock = keyBasename ? `if ! grep -q 'Host ${gitHost}' ~/.ssh/config 2>/dev/null; then
+  printf '%s\\n' '' 'Host ${gitHost}' '  HostName ${gitHost}' '  User git' '  IdentityFile ~/.ssh/${keyBasename}' '  IdentitiesOnly yes' >> ~/.ssh/config
+  chmod 600 ~/.ssh/config
+  echo "configured ~/.ssh/config for ${gitHost}"
+fi` : `:`;
+  const script = `
+set -euo pipefail
+mkdir -p ~/.ssh
+chmod 700 ~/.ssh
+if ! grep -q '^${gitHost}' ~/.ssh/known_hosts 2>/dev/null; then
+  ssh-keyscan -t ed25519,rsa ${gitHost} >> ~/.ssh/known_hosts 2>/dev/null
+  echo "added ${gitHost} to known_hosts"
+fi
+${configBlock}
+`.trim();
+  await sshRun(host, script, { logger });
+}
+async function ensureRepoDependencies(host, service, options = {}) {
+  const { logger = console } = options;
+  const paths = servicePaths(service);
+  const run2 = shellQuote(paths.repoRun);
+  await sshRun(
+    host,
+    `cd ${run2} && if [ ! -d node_modules/@nmakarov/cli-toolkit ] || [ package-lock.json -nt node_modules/.package-lock.json ]; then npm ci; fi`,
+    { logger }
+  );
+}
+async function ensureEnvOnRemote(host, service, options = {}) {
+  const { logger = console, envFile } = options;
+  const paths = servicePaths(service);
+  const localPath = resolveLocalEnvPath(envFile);
+  if (!await pathExists7(localPath)) return false;
+  logger.info(`copying .env ${localPath} \u2192 ${host}:${paths.repoEnv}`);
+  await sshRun(host, `mkdir -p ${shellQuote((0, import_node_path10.dirname)(paths.repoEnv))}`, { logger });
+  const scrubbed = scrubEnvContent(await (0, import_promises15.readFile)(localPath, "utf8"), service.envScrubPatterns ?? []);
+  const tmp = (0, import_node_path10.join)((0, import_node_os3.tmpdir)(), `deploy-env-${Date.now()}`);
+  await (0, import_promises15.writeFile)(tmp, scrubbed, { mode: 384 });
+  await scp(tmp, `${host}:${paths.repoEnv}`, { logger });
+  await sshRun(host, `chmod 600 ${shellQuote(paths.repoEnv)}`, { logger });
+  return true;
+}
+async function ensureRemoteRepo(host, service, options = {}) {
+  const { logger = console, deployKey = service.deployKey, envFile } = options;
+  const paths = servicePaths(service);
+  const repo = shellQuote(paths.repo);
+  const repoUrl = shellQuote(service.repoUrl);
+  const root = shellQuote(paths.root);
+  const localKeyBase = deployKey ? (0, import_node_path10.basename)(expandHome2(deployKey)) : null;
+  await ensureDeployKeyOnRemote(host, deployKey, { logger });
+  await prepareGitHost(host, { logger, gitHost: parseGitHost(service.repoUrl), keyBasename: localKeyBase });
+  await sshRun(
+    host,
+    `mkdir -p ${root} && if [ -d ${repo}/.git ]; then git -C ${repo} pull --ff-only; else git clone ${repoUrl} ${repo}; fi`,
+    { logger }
+  );
+  await ensureRepoDependencies(host, service, { logger });
+  await ensureEnvOnRemote(host, service, { logger, envFile });
+}
+async function runRemoteCli(host, service, command, args = [], options = {}) {
+  const { logger = console, manifests, skipPull = false, deployKey = service.deployKey, envFile } = options;
+  const paths = servicePaths(service);
+  const run2 = shellQuote(paths.repoRun);
+  const cli = shellQuote(REMOTE_CLI_REL);
+  if (!skipPull) {
+    await ensureRemoteRepo(host, service, { logger, deployKey, envFile });
+  } else {
+    await ensureRepoDependencies(host, service, { logger });
+    await ensureEnvOnRemote(host, service, { logger, envFile });
+  }
+  const passthrough = [
+    `--service=${service.name}`,
+    ...manifests ? [`--manifests=${manifests}`] : [],
+    ...args
+  ].map(shellQuote).join(" ");
+  await sshRun(host, `cd ${run2} && node ${cli} ${shellQuote(command)} ${passthrough}`.trim(), { logger });
+}
+async function runRemoteStatus(host, service, options = {}) {
+  const { logger = console } = options;
+  const paths = servicePaths(service);
+  const port = service.pm2.port;
+  const app = service.pm2.appName;
+  const script = `
+echo "=== apps root ==="
+ls -la ${shellQuote(paths.root)} 2>/dev/null || echo "(missing)"
+echo ""
+echo "=== current ==="
+readlink ${shellQuote(paths.current)} 2>/dev/null || echo "(not set)"
+echo ""
+echo "=== releases ==="
+ls -1 ${shellQuote(paths.releases)} 2>/dev/null || echo "(none)"
+echo ""
+echo "=== pm2 ==="
+pm2 describe ${app} 2>/dev/null | head -20 || pm2 status ${app} 2>/dev/null || echo "(not running)"
+${port ? `echo ""
+echo "=== app health (localhost) ==="
+curl -sf http://127.0.0.1:${port}/healthz 2>/dev/null || echo "(no /healthz on :${port})"` : ""}
+`.trim();
+  await sshRun(host, script, { logger });
+}
+
+// src/deploy/manifests.js
+var import_node_path11 = require("path");
+var import_node_url = require("url");
+async function loadServices({ manifests = "deploy/services.js", cwd = process.cwd() } = {}) {
+  const abs = (0, import_node_path11.isAbsolute)(manifests) ? manifests : (0, import_node_path11.resolve)(cwd, manifests);
+  let mod;
+  try {
+    mod = await import((0, import_node_url.pathToFileURL)(abs).href);
+  } catch (err) {
+    throw new Error(`Could not load deploy manifests from ${abs}: ${err.message}`);
+  }
+  const raw = mod.services ?? mod.default;
+  if (!raw) {
+    throw new Error(`Manifests module ${abs} must export \`services\` (or default): a map or array of service manifests`);
+  }
+  const list = Array.isArray(raw) ? raw : Object.values(raw);
+  const out = {};
+  for (const entry of list) {
+    const svc = defineService(entry);
+    out[svc.name] = svc;
+  }
+  return out;
+}
+function resolveServiceFrom(serviceMap, name, { appsRoot } = {}) {
+  const svc = serviceMap[name];
+  if (!svc) {
+    throw new Error(`Unknown service "${name}". Known: ${Object.keys(serviceMap).join(", ") || "(none)"}`);
+  }
+  return appsRoot ? { ...svc, appsRoot } : svc;
+}
+
 // src/tasks/index.js
-var import_node_os3 = __toESM(require("os"), 1);
+var import_node_os6 = __toESM(require("os"), 1);
 
 // src/utils/core-utils.js
 function sleepMs(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 function toJsonColumn(value) {
   if (value === void 0 || value === null) return null;
@@ -4467,10 +5745,10 @@ function toJsonColumn(value) {
 }
 
 // src/tasks/servicesRegistry.js
-var import_node_os = __toESM(require("os"), 1);
+var import_node_os4 = __toESM(require("os"), 1);
 
 // src/tasks/taskUtils.js
-var import_node_crypto = require("crypto");
+var import_node_crypto2 = require("crypto");
 
 // src/tasks/time-matcher.js
 var RANGES = ["0-59", "0-59", "0-23", "1-31", "1-12", "0-6"];
@@ -4652,7 +5930,7 @@ async function enqueueTask(context, options) {
   const db = getDb(context);
   const queueName = options.queueName ?? "tasks";
   const { tasksTable } = queueToTableNames(queueName);
-  const id = (0, import_node_crypto.randomUUID)();
+  const id = (0, import_node_crypto2.randomUUID)();
   const name = options.name ?? options.task;
   if (!name) {
     throw new Error("enqueueTask: name (or task) is required");
@@ -4786,7 +6064,7 @@ async function registerInServicesRegistry(context, options) {
   if (!serviceGroup) {
     throw new Error("registerInServicesRegistry: serviceGroup is required");
   }
-  const serverName = import_node_os.default.hostname();
+  const serverName = import_node_os4.default.hostname();
   const pid = typeof process.pid === "number" ? process.pid : null;
   const meta = buildMetadata(options);
   const groupBase = sanitizeNamePart(serviceGroup);
@@ -4899,7 +6177,7 @@ async function registerInServicesRegistry(context, options) {
 }
 async function touchServicesRegistry(context, registration) {
   const db = getDb2(context);
-  const serverName = import_node_os.default.hostname();
+  const serverName = import_node_os4.default.hostname();
   const pid = typeof process.pid === "number" ? process.pid : null;
   await db(registration.registryTable).where({ id: registration.rowId }).update({
     last_seen_at: db.fn.now(),
@@ -4936,7 +6214,7 @@ async function listServicesRegistry(context, options = { queueName: "tasks" }) {
 }
 
 // src/tasks/taskLogs.js
-var import_node_path = __toESM(require("path"), 1);
+var import_node_path12 = __toESM(require("path"), 1);
 function getLogsState(context) {
   const holder = context;
   if (holder.__tasksLogsState) return holder.__tasksLogsState;
@@ -5044,7 +6322,7 @@ function resolveIpcFileLogsDir(context, target) {
   const basePath = target.basePath ?? (holder.params?.get?.("tasksLogsBasePath") || "./data");
   const namespace = target.namespace ?? (holder.params?.get?.("tasksLogsNamespace") || "tasks-logs");
   const segments = target.tableName.split("/").filter(Boolean);
-  return import_node_path.default.resolve(basePath, namespace, ...segments);
+  return import_node_path12.default.resolve(basePath, namespace, ...segments);
 }
 function getLogsStateForTarget(context, target) {
   const holder = context;
@@ -5518,10 +6796,10 @@ var TaskSampleProcess = class extends AbstractTask {
 };
 
 // src/tasks/coreTasks/TaskShellCommand.js
-var import_node_child_process = require("child_process");
+var import_node_child_process5 = require("child_process");
 function runShellCommand(command, cwd) {
-  return new Promise((resolve2, reject) => {
-    const child = (0, import_node_child_process.spawn)(command, {
+  return new Promise((resolve3, reject) => {
+    const child = (0, import_node_child_process5.spawn)(command, {
       shell: true,
       cwd: cwd || process.cwd(),
       stdio: ["ignore", "pipe", "pipe"]
@@ -5538,7 +6816,7 @@ function runShellCommand(command, cwd) {
       reject(error);
     });
     child.on("close", (exitCode, signal) => {
-      resolve2({
+      resolve3({
         exitCode,
         output: output.trim(),
         stderr: stderr.trim(),
@@ -5617,8 +6895,8 @@ var TaskShellCommand = class extends AbstractTask {
 };
 
 // src/tasks/coreTasks/TaskSystemInfo.js
-var import_node_os2 = __toESM(require("os"), 1);
-var import_promises = __toESM(require("fs/promises"), 1);
+var import_node_os5 = __toESM(require("os"), 1);
+var import_promises16 = __toESM(require("fs/promises"), 1);
 function toGb(valueBytes) {
   return `${(valueBytes / 1024 ** 3).toFixed(2)} GB`;
 }
@@ -5626,7 +6904,7 @@ function toMb(valueBytes) {
   return `${(valueBytes / 1024 ** 2).toFixed(2)} MB`;
 }
 async function getDiskStats() {
-  const stats = await import_promises.default.statfs("/");
+  const stats = await import_promises16.default.statfs("/");
   const total = Number(stats.bsize) * Number(stats.blocks);
   const free = Number(stats.bsize) * Number(stats.bavail);
   const used = total - free;
@@ -5648,10 +6926,10 @@ var TaskSystemInfo = class extends AbstractTask {
    */
   async run() {
     try {
-      const totalMemory = import_node_os2.default.totalmem();
-      const freeMemory = import_node_os2.default.freemem();
+      const totalMemory = import_node_os5.default.totalmem();
+      const freeMemory = import_node_os5.default.freemem();
       const usedMemory = totalMemory - freeMemory;
-      const cpus = import_node_os2.default.cpus();
+      const cpus = import_node_os5.default.cpus();
       const cpuUtilization = cpus.map((cpu) => {
         const total = Object.values(cpu.times).reduce((acc, time) => acc + time, 0);
         const usage = (total - cpu.times.idle) / total * 100;
@@ -5677,10 +6955,10 @@ var TaskSystemInfo = class extends AbstractTask {
           utilization: cpuUtilization
         },
         runtime: {
-          platform: import_node_os2.default.platform(),
-          arch: import_node_os2.default.arch(),
-          uptimeSec: import_node_os2.default.uptime(),
-          hostname: import_node_os2.default.hostname()
+          platform: import_node_os5.default.platform(),
+          arch: import_node_os5.default.arch(),
+          uptimeSec: import_node_os5.default.uptime(),
+          hostname: import_node_os5.default.hostname()
         }
       };
       this.context.logger.info?.(`[TaskSystemInfo] collected system metrics (${this.task.id})`);
@@ -6010,7 +7288,7 @@ function mergeAllowedTasksWithServiceTasks(names) {
 }
 
 // src/tasks/taskScriptRunner.js
-var import_node_child_process2 = require("child_process");
+var import_node_child_process6 = require("child_process");
 var MAX_PROGRESS_TEXT_LEN = 4e3;
 function toCliArgs(args = []) {
   return args.filter((a) => typeof a === "string" && a.length > 0);
@@ -6088,7 +7366,7 @@ function createSerializedQueue() {
 async function runNodeTaskScript(context, options) {
   const cliArgs = toCliArgs(["--route=ipc", "--mode=json", ...options.args || []]);
   const nodeArgs = buildNodeArgs(options.scriptPath, cliArgs);
-  const child = (0, import_node_child_process2.spawn)(process.execPath, nodeArgs, {
+  const child = (0, import_node_child_process6.spawn)(process.execPath, nodeArgs, {
     cwd: options.cwd || process.cwd(),
     stdio: ["ignore", "pipe", "pipe", "ipc"],
     env: {
@@ -6175,13 +7453,13 @@ async function runNodeTaskScript(context, options) {
     }
     forwardChildLogToParent(context, prefix, message);
   });
-  return await new Promise((resolve2, reject) => {
+  return await new Promise((resolve3, reject) => {
     child.on("error", (error) => reject(error));
     child.on("close", (exitCode, signal) => {
       void (async () => {
         await flushTaskIpcLogs(context);
         await progressQueue.drain();
-        resolve2({
+        resolve3({
           exitCode,
           signal,
           stdout: state.stdout.trim(),
@@ -6459,7 +7737,7 @@ async function runTasksLoop(context, options) {
     });
     runnerIdentity = {
       service_name: registryReg.serviceName,
-      server_name: import_node_os3.default.hostname(),
+      server_name: import_node_os6.default.hostname(),
       instance_number: registryReg.instanceNumber
     };
     registryInterval = setInterval(() => {
@@ -6748,6 +8026,7 @@ var TasksManager = class _TasksManager {
 0 && (module.exports = {
   AbstractTask,
   Args,
+  Aws,
   Box,
   Db,
   Divider,
@@ -6761,6 +8040,7 @@ var TasksManager = class _TasksManager {
   MultiColumnListComponent,
   MultiColumnListWithPreviewComponent,
   Params,
+  REMOTE_CLI_REL,
   React,
   S3,
   SERVICE_TASK_NAMES,
@@ -6781,51 +8061,94 @@ var TasksManager = class _TasksManager {
   TasksRegistry,
   Text,
   TextBlock,
+  activateRelease,
+  appendDeployLog,
   appendTaskIpcLog,
+  bootstrapHost,
   buildBreadcrumb,
   buildDetailBreadcrumb,
   buildFooter,
+  bumpPatchVersion,
+  cloneRepo,
   convertPattern,
+  createRelease,
   defaultFileSynopsisFunction,
   defaultTasksRegistry,
   defaultVersionSynopsisFunction,
+  defineService,
+  deployService,
+  deriveRepoDirName,
+  enableNginxUpstream,
   enqueueStopTask,
   enqueueTask,
+  ensureDeployKeyOnRemote,
+  ensureEnvOnRemote,
+  ensureRemoteRepo,
+  ensureRepoDependencies,
   ensureTaskTables,
   flushTaskIpcLogs,
   getArgsInstance,
   h,
+  initServiceStructure,
+  installDeps,
   ipcFileLogsTableNameForSourceResource,
   joiEdateType,
   joiStringArrayType,
   listAliveRunnerHeartbeats,
+  listReleases,
   listServicesRegistry,
   listSources,
   listTables,
   load,
+  loadServices,
   matchesParsedPattern,
   memo,
   mergeAllowedTasksWithServiceTasks,
   nextTimeMatch,
   normalizeAllowedTasks,
+  npmEnv,
+  npmInstallEnv,
   organizeFooterMessages,
+  parseGitHost,
+  prepareGitHost,
+  provisionService,
+  pruneReleases,
+  pullRepo,
   queueToTableNames,
+  readCurrentRelease,
+  readReleaseBuildInfo,
   readTaskIpcLogsSnapshot,
   registerInServicesRegistry,
   registerRunnerHeartbeat,
+  releaseDir,
+  releaseStamp,
+  reloadPm2,
   resolveAsterisks,
   resolveIpcFileLogsDir,
+  resolveNextVersion,
   resolveRanges,
+  resolveServiceFrom,
   resolveSteps,
+  rollbackService,
+  run,
   runNodeTaskScript,
+  runReleaseTests,
+  runRemoteCli,
+  runRemoteStatus,
+  runShell,
   runTasksLoop,
+  scrubEnvContent,
+  servicePaths,
   setupContext,
+  shellQuote,
   showListScreen,
   showMenuScreen,
   showMultiColumnListScreen,
   showMultiColumnListWithPreviewScreen,
   showScreen,
   showWordGridScreen,
+  sshRun,
+  syncEnv,
   taskHistoryInsertFromQueueRow,
   timeMatcher,
   touchRunnerHeartbeat,
@@ -6841,6 +8164,7 @@ var TasksManager = class _TasksManager {
   useMemo,
   useRef,
   useState,
-  waitForTaskResult
+  waitForTaskResult,
+  writeReleaseBuildInfo
 });
 //# sourceMappingURL=index.cjs.map