@stacksjs/actions 0.70.87 → 0.70.90

package/dist/deploy/index.js

@@ -1,15 +1,613 @@
-// @bun
-import{Lb as Z}from"../chunk-h3d81wrg.js";import{existsSync as JJ,readFileSync as BJ,statSync as TJ}from"fs";import T from"process";import{runCommand as KJ,spinner as S}from"@stacksjs/cli";import{config as OJ}from"@stacksjs/config";import{path as X}from"@stacksjs/path";import{storage as RJ}from"@stacksjs/storage";import{ExitCode as EJ}from"@stacksjs/types";var $={debug:(...J)=>{if(T.argv.includes("--verbose")||T.argv.includes("-v"))console.log("\uD83D\uDD0D",...J)},success:(...J)=>console.log("\u2713",...J),error:(...J)=>console.error("\u2717",...J)},GJ="github.com/mail-os/mail",NJ=`${GJ}@0.1.0`,jJ="linux-x86_64",XJ=["mail","mail-x86_64-linux","mail-x86_64-linux-gnu"],V=T.argv.includes("--verbose")||T.argv.includes("-v");async function DJ(J,U,H=8){let{existsSync:Q,readdirSync:_,statSync:b}=await import("fs"),{join:G,basename:y}=await import("path"),c=new Set(U),k=[];if(!Q(J))return k;function N(QJ,UJ){if(UJ>H)return;for(let o of _(QJ)){if(o===".git"||o==="node_modules")continue;let r=G(QJ,o),n=b(r);if(n.isDirectory())N(r,UJ+1);else if(n.isFile()&&c.has(y(r)))k.push(r)}}return N(J,0),k}async function MJ(J){let{readFileSync:U}=await import("fs"),H=U(J).slice(0,4);return H[0]===127&&H[1]===69&&H[2]===76&&H[3]===70}async function IJ(){let{existsSync:J}=await import("fs"),U=`${T.env.HOME}/Code/Tools/pantry/packages/ts-pantry/bin/cli.ts`;if(J(U))return{command:"bun",args:[U]};let H=X.projectPath("pantry/.bin/pantry");if(J(H))return{command:H,args:[]};let Q=`${T.env.HOME}/.local/share/pantry/global/bin/pantry`;if(J(Q))return{command:Q,args:[]};return{command:"pantry",args:[]}}async function PJ(){let{execFileSync:J}=await import("child_process"),U=X.projectPath("pantry"),H=await IJ();J(H.command,[...H.args,"install",NJ,"--install-dir",U,"--platform",jJ,"--quiet"],{cwd:X.projectPath(),stdio:V?"inherit":"pipe",env:T.env})}async function fJ(){let{existsSync:J}=await import("fs"),{join:U}=await import("path"),H=[X.projectPath("pantry"),`${T.env.HOME}/.local/share/pantry`],Q=[...XJ.map((_)=>X.projectPath(`pantry/.bin/${_}`)),...XJ.map((_)=>U(`${T.env.HOME}/.local/share/pantry/global/bin`,_))];for(let _ of Q)if(J(_)&&await MJ(_))return _;for(let _ of H){let b=await DJ(_,XJ);for(let G of b)if(await MJ(G))return G}return null}var bJ={".html":"text/html",".css":"text/css",".js":"application/javascript",".json":"application/json",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".gif":"image/gif",".svg":"image/svg+xml",".ico":"image/x-icon",".woff":"font/woff",".woff2":"font/woff2",".ttf":"font/ttf",".eot":"application/vnd.ms-fontobject",".otf":"font/otf",".webp":"image/webp",".mp4":"video/mp4",".webm":"video/webm",".mp3":"audio/mpeg",".wav":"audio/wav",".pdf":"application/pdf",".xml":"application/xml",".txt":"text/plain"};function WJ(J){let U=J.lastIndexOf("."),H=U>=0?J.slice(U).toLowerCase():"";return bJ[H]||"application/octet-stream"}async function HJ(J,U,H="",Q=[".DS_Store"]){let{readdirSync:_,statSync:b}=await import("fs"),{join:G}=await import("path"),y=_(J);for(let c of y){if(Q.includes(c))continue;let k=G(J,c),N=H?`${H}/${c}`:c;if(b(k).isDirectory())await HJ(k,U,N,Q);else await U(k,N)}}async function a(J,U="s3 operation"){for(let Q=0;Q<=3;Q++)try{return await J()}catch(_){if(Q>=3)throw _;let b=Math.min(500*2**Q+Math.random()*200,5000);if(V)$.debug(`  Retrying ${U} (attempt ${Q+2}/4) in ${Math.round(b)}ms...`);await new Promise((G)=>setTimeout(G,b))}throw Error(`${U} failed after 4 attempts`)}function wJ(J){if(!J)return[];return Array.isArray(J)?J:[J]}function AJ(J,U,H=""){if(U===null||U===void 0)return"";if(typeof U==="boolean")return`${H}<${J}>${U}</${J}>
-`;if(typeof U==="number"||typeof U==="string")return`${H}<${J}>${U}</${J}>
-`;if(Array.isArray(U))return U.map((Q)=>AJ(J,Q,H)).join("");if(typeof U==="object"){if(J.startsWith("@_")||J==="?xml")return"";let Q="";for(let[_,b]of Object.entries(U))if(!_.startsWith("@_")&&_!=="#text")Q+=AJ(_,b,`${H}  `);if(U["#text"]!==void 0)return`${H}<${J}>${U["#text"]}</${J}>
-`;return`${H}<${J}>
-${Q}${H}</${J}>
-`}return""}function hJ(J){return`<?xml version="1.0" encoding="UTF-8"?>
+import { existsSync, readFileSync, statSync } from "node:fs";
+import process from "node:process";
+import { runCommand, spinner } from "@stacksjs/cli";
+import { config } from "@stacksjs/config";
+import { path as p } from "@stacksjs/path";
+import { storage } from "@stacksjs/storage";
+import { ExitCode } from "@stacksjs/types";
+const log = {
+  debug: (...args) => {
+    if (process.argv.includes("--verbose") || process.argv.includes("-v"))
+      console.log("\uD83D\uDD0D", ...args);
+  },
+  success: (...args) => console.log("\u2713", ...args),
+  error: (...args) => console.error("\u2717", ...args)
+}, MAIL_PACKAGE_DOMAIN = "github.com/mail-os/mail", MAIL_PACKAGE_SPEC = `${MAIL_PACKAGE_DOMAIN}@0.1.0`, MAIL_TARGET_PLATFORM = "linux-x86_64", MAIL_BINARY_NAMES = ["mail", "mail-x86_64-linux", "mail-x86_64-linux-gnu"], isVerbose = process.argv.includes("--verbose") || process.argv.includes("-v");
+async function collectMatchingFiles(root, names, maxDepth = 8) {
+  const { existsSync, readdirSync, statSync } = await import("node:fs"), { join, basename } = await import("node:path"), nameSet = new Set(names), matches = [];
+  if (!existsSync(root))
+    return matches;
+  function walk(dir, depth) {
+    if (depth > maxDepth)
+      return;
+    for (const entry of readdirSync(dir)) {
+      if (entry === ".git" || entry === "node_modules")
+        continue;
+      const fullPath = join(dir, entry), stat = statSync(fullPath);
+      if (stat.isDirectory())
+        walk(fullPath, depth + 1);
+      else if (stat.isFile() && nameSet.has(basename(fullPath)))
+        matches.push(fullPath);
+    }
+  }
+  walk(root, 0);
+  return matches;
+}
+async function isElfBinary(filePath) {
+  const { readFileSync } = await import("node:fs"), header = readFileSync(filePath).slice(0, 4);
+  return header[0] === 127 && header[1] === 69 && header[2] === 76 && header[3] === 70;
+}
+async function resolvePantryInstallCommand() {
+  const { existsSync } = await import("node:fs"), localPantryCli = `${process.env.HOME}/Code/Tools/pantry/packages/ts-pantry/bin/cli.ts`;
+  if (existsSync(localPantryCli))
+    return { command: "bun", args: [localPantryCli] };
+  const projectPantry = p.projectPath("pantry/.bin/pantry");
+  if (existsSync(projectPantry))
+    return { command: projectPantry, args: [] };
+  const globalPantry = `${process.env.HOME}/.local/share/pantry/global/bin/pantry`;
+  if (existsSync(globalPantry))
+    return { command: globalPantry, args: [] };
+  return { command: "pantry", args: [] };
+}
+async function installMailBinaryWithPantry() {
+  const { execFileSync } = await import("node:child_process"), installDir = p.projectPath("pantry"), pantry = await resolvePantryInstallCommand();
+  execFileSync(pantry.command, [
+    ...pantry.args,
+    "install",
+    MAIL_PACKAGE_SPEC,
+    "--install-dir",
+    installDir,
+    "--platform",
+    MAIL_TARGET_PLATFORM,
+    "--quiet"
+  ], {
+    cwd: p.projectPath(),
+    stdio: isVerbose ? "inherit" : "pipe",
+    env: process.env
+  });
+}
+async function findPantryMailBinary() {
+  const { existsSync } = await import("node:fs"), { join } = await import("node:path"), pantryRoots = [
+    p.projectPath("pantry"),
+    `${process.env.HOME}/.local/share/pantry`
+  ], directCandidates = [
+    ...MAIL_BINARY_NAMES.map((name) => p.projectPath(`pantry/.bin/${name}`)),
+    ...MAIL_BINARY_NAMES.map((name) => join(`${process.env.HOME}/.local/share/pantry/global/bin`, name))
+  ];
+  for (const candidate of directCandidates)
+    if (existsSync(candidate) && await isElfBinary(candidate))
+      return candidate;
+  for (const root of pantryRoots) {
+    const candidates = await collectMatchingFiles(root, MAIL_BINARY_NAMES);
+    for (const candidate of candidates)
+      if (await isElfBinary(candidate))
+        return candidate;
+  }
+  return null;
+}
+const MIME_TYPES = {
+  ".html": "text/html",
+  ".css": "text/css",
+  ".js": "application/javascript",
+  ".json": "application/json",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".svg": "image/svg+xml",
+  ".ico": "image/x-icon",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".ttf": "font/ttf",
+  ".eot": "application/vnd.ms-fontobject",
+  ".otf": "font/otf",
+  ".webp": "image/webp",
+  ".mp4": "video/mp4",
+  ".webm": "video/webm",
+  ".mp3": "audio/mpeg",
+  ".wav": "audio/wav",
+  ".pdf": "application/pdf",
+  ".xml": "application/xml",
+  ".txt": "text/plain"
+};
+function getMimeType(filePath) {
+  const dotIndex = filePath.lastIndexOf("."), ext = dotIndex >= 0 ? filePath.slice(dotIndex).toLowerCase() : "";
+  return MIME_TYPES[ext] || "application/octet-stream";
+}
+async function traverseDirectory(dir, callback, prefix = "", skipPatterns = [".DS_Store"]) {
+  const { readdirSync, statSync } = await import("node:fs"), { join } = await import("node:path"), items = readdirSync(dir);
+  for (const item of items) {
+    if (skipPatterns.includes(item))
+      continue;
+    const filePath = join(dir, item), key = prefix ? `${prefix}/${item}` : item;
+    if (statSync(filePath).isDirectory())
+      await traverseDirectory(filePath, callback, key, skipPatterns);
+    else
+      await callback(filePath, key);
+  }
+}
+async function withS3Retry(fn, label = "s3 operation") {
+  const maxRetries = 3;
+  for (let attempt = 0;attempt <= maxRetries; attempt++)
+    try {
+      return await fn();
+    } catch (error) {
+      if (attempt >= maxRetries)
+        throw error;
+      const delay = Math.min(500 * 2 ** attempt + Math.random() * 200, 5000);
+      if (isVerbose)
+        log.debug(`  Retrying ${label} (attempt ${attempt + 2}/${maxRetries + 1}) in ${Math.round(delay)}ms...`);
+      await new Promise((resolve) => setTimeout(resolve, delay));
+    }
+  throw Error(`${label} failed after ${maxRetries + 1} attempts`);
+}
+function normalizeArray(value) {
+  if (!value)
+    return [];
+  return Array.isArray(value) ? value : [value];
+}
+function buildCloudFrontXmlElement(name, value, indent = "") {
+  if (value === null || value === void 0)
+    return "";
+  if (typeof value === "boolean")
+    return `${indent}<${name}>${value}</${name}>
+`;
+  if (typeof value === "number" || typeof value === "string")
+    return `${indent}<${name}>${value}</${name}>
+`;
+  if (Array.isArray(value))
+    return value.map((item) => buildCloudFrontXmlElement(name, item, indent)).join("");
+  if (typeof value === "object") {
+    if (name.startsWith("@_") || name === "?xml")
+      return "";
+    let children = "";
+    for (const [key, val] of Object.entries(value))
+      if (!key.startsWith("@_") && key !== "#text")
+        children += buildCloudFrontXmlElement(key, val, `${indent}  `);
+    if (value["#text"] !== void 0)
+      return `${indent}<${name}>${value["#text"]}</${name}>
+`;
+    return `${indent}<${name}>
+${children}${indent}</${name}>
+`;
+  }
+  return "";
+}
+function buildCloudFrontDistributionConfigXml(config) {
+  return `<?xml version="1.0" encoding="UTF-8"?>
 <DistributionConfig xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">
-${Object.entries(J).filter(([U])=>!U.startsWith("@_")).map(([U,H])=>AJ(U,H,"  ")).join("")}</DistributionConfig>
-`}function _J(J){let U=[...new Set(J)].filter((Q)=>Number.isFinite(Q)&&Q>0).sort((Q,_)=>Q-_);if(U.length===0)return"true";return`if command -v firewall-cmd >/dev/null 2>&1; then firewall-cmd --permanent ${U.map((Q)=>`--add-port=${Q}/tcp`).join(" ")} && firewall-cmd --reload; fi`}async function CJ(J,U,H){if(!U)return;if(((await J.describeSecurityGroups({GroupIds:[U]}))?.SecurityGroups?.[0]?.IpPermissions||[]).some((G)=>{return G.IpProtocol==="tcp"&&Number(G.FromPort)<=H&&Number(G.ToPort)>=H&&wJ(G.IpRanges).some((y)=>y.CidrIp==="0.0.0.0/0")}))return;try{await J.authorizeSecurityGroupIngress({GroupId:U,IpPermissions:[{IpProtocol:"tcp",FromPort:H,ToPort:H,IpRanges:[{CidrIp:"0.0.0.0/0",Description:`Stacks API port ${H}`}]}]})}catch(G){if(!String(G?.message||"").includes("InvalidPermission.Duplicate"))throw G}}async function kJ(J,U,H){if(!U)return;let Q=await J.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${U}/config`,returnHeaders:!0}),_=Q.headers?.etag||Q.headers?.ETag||"",b=Q.body?.DistributionConfig||Q.DistributionConfig||Q.body;if(!_||!b?.Origins?.Items)return;let y=wJ(b.Origins.Items.Origin).find((c)=>String(c.Id||"").includes("-api"));if(!y?.CustomOriginConfig)return;if(Number(y.CustomOriginConfig.HTTPPort)===H)return;y.CustomOriginConfig.HTTPPort=H,await J.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${U}/config`,body:hJ(b),headers:{"Content-Type":"application/xml","If-Match":_}})}var xJ=S("Building framework...");xJ.start();await KJ("bun run build",{cwd:X.frameworkPath("core"),quiet:!1});xJ.succeed("Framework built");var LJ=X.projectPath("docs"),SJ=X.projectPath("dist/docs/.bunpress");if(RJ.hasFiles(LJ)){let J=S("Building documentation with BunPress...");J.start();try{let{rm:U}=await import("fs/promises"),H=`${T.env.HOME}/Code/Tools/bunpress/packages/bunpress/bin/cli.ts`,Q=X.projectPath("node_modules/@stacksjs/bunpress/dist/bin/cli.js"),_=await Bun.file(H).exists(),b=await Bun.file(Q).exists(),G=_?`bun ${H} build --dir ${LJ} --outdir ${X.projectPath("dist/docs")}`:b?`bun ${Q} build --dir ${LJ} --outdir ${X.projectPath("dist/docs")}`:"bunx @stacksjs/bunpress@0.1.5 build --dir ./docs --outdir ./dist/docs";await U(SJ,{recursive:!0,force:!0}),await KJ(G,{cwd:X.projectPath(),quiet:!V}),J.succeed(`Documentation built with BunPress${_?" (local checkout)":""}`)}catch(U){if(J.stop(),console.log(`\u26A0 Documentation build skipped: ${U.message}`),V)$.debug("To build docs manually: cd ~/Code/Tools/bunpress && bun packages/bunpress/bin/cli.ts build --dir /path/to/docs --outdir /path/to/dist/docs")}}else if(V)$.debug("No docs directory found, skipping documentation build");var vJ=RJ.hasFiles(X.projectPath("dist/blog")),yJ=["CampmateScript-Regular.woff2","SequoiaSans-Regular.woff2","Switchback-Regular.woff2"].every((J)=>JJ(X.projectPath(`dist/blog/assets/fonts/nps/${J}`))),gJ=["topography.svg","park-ridge.svg"].every((J)=>JJ(X.projectPath(`dist/blog/assets/images/${J}`))),ZJ=X.projectPath("dist/blog/index.html"),i=JJ(ZJ)?BJ(ZJ,"utf8"):"",cJ=i.length>0&&!i.includes("woff2-variations"),mJ=i.includes("--on-primary")&&i.includes("--newsletter-bg"),dJ=i.includes("topography.svg")&&i.includes("park-ridge.svg"),pJ=!i.includes("stamp-trail")&&!i.includes("blog-sign-tree.svg"),uJ=X.frameworkPath("core/cms/src/build.ts"),sJ=X.projectPath("config/blog.ts"),lJ=JJ(ZJ)&&[uJ,sJ].filter((J)=>JJ(J)).every((J)=>TJ(ZJ).mtimeMs>=TJ(J).mtimeMs);if(!vJ||!yJ||!gJ||!cJ||!mJ||!dJ||!pJ||!lJ){let J=S("Building blog...");J.start();try{let U=(await import(X.projectPath("config/blog"))).default,{buildBlogSite:H}=await import(X.frameworkPath("core/cms/src/build"));await H({config:U,outDir:X.projectPath("dist/blog")}),J.succeed("Blog built successfully")}catch(U){if(J.stop(),console.log(`\u26A0 Blog build skipped: ${U.message}`),V)$.debug(`Blog build error: ${U.stack}`)}}else if(V)$.debug("Pre-built blog found at dist/blog, skipping build");if(V)$.debug("Skipping views build (vite-config not configured)");var aJ=await import(X.projectPath("config/cloud")),iJ=aJ?.tsCloud?.mode||"server";if(iJ==="serverless"){let J=S("Building server...");J.start(),await KJ("bun build.ts",{cwd:X.frameworkPath("server"),quiet:!V}),J.succeed("Server built");let U=S("Packaging for deployment...");U.start(),await KJ("bun zip.ts",{cwd:X.corePath("cloud"),quiet:!V}),U.succeed("Package ready")}else if(V)$.debug("Skipping server build and packaging (server mode)");if(!T.env.AWS_ACCESS_KEY_ID||!T.env.AWS_SECRET_ACCESS_KEY){let{existsSync:J,readFileSync:U}=await import("fs"),H=T.env.APP_ENV||T.env.NODE_ENV||"production",Q=[X.projectPath(`.env.${H}`),X.projectPath(".env")];for(let _ of Q)if(J(_)){let b=U(_,"utf-8");for(let G of b.split(`
-`)){let y=G.trim();if(y.startsWith("#")||!y.includes("="))continue;let c=y.indexOf("="),k=y.slice(0,c).trim(),N=y.slice(c+1).trim();if(N.startsWith('"')&&N.endsWith('"')||N.startsWith("'")&&N.endsWith("'"))N=N.slice(1,-1);if(k==="AWS_ACCESS_KEY_ID"&&N)T.env.AWS_ACCESS_KEY_ID=N;else if(k==="AWS_SECRET_ACCESS_KEY"&&N)T.env.AWS_SECRET_ACCESS_KEY=N;else if(k==="AWS_REGION"&&N&&!T.env.AWS_REGION)T.env.AWS_REGION=N;else if(k==="AWS_ACCOUNT_ID"&&N&&!T.env.AWS_ACCOUNT_ID)T.env.AWS_ACCOUNT_ID=N;else if(k.startsWith("MAIL_PASSWORD_")&&N&&!T.env[k])T.env[k]=N}if(V)$.debug(`Loaded AWS credentials from ${_}`);break}}try{let{deployStack:J,deployFrontend:U}=await import("../chunk-0h27aa4r.js"),H=T.env.APP_ENV||T.env.NODE_ENV||"production",Q=T.env.AWS_REGION||"us-east-1",_=await import(X.projectPath("config/cloud")),b=_?.tsCloud?.mode||"server",G=_?.tsCloud?.project?.name||_?.tsCloud?.project?.slug||"stacks";if(b==="serverless"){console.log(""),console.log("Serverless deployment mode detected"),console.log("Building and pushing container image..."),console.log("");let z=T.env.AWS_ACCOUNT_ID||await y(Q);if(!z||z.length<10)throw Error(`Invalid AWS Account ID: "${z||"(empty)"}"
-Set AWS_ACCOUNT_ID in your .env file or ensure valid AWS credentials are configured.`);let q=`${z}.dkr.ecr.${Q}.amazonaws.com/${G}-${H}-api`,A=`${q}:latest`;if(V)$.debug(`ECR repository: ${q}`);if(V)$.debug("ECR credentials will be validated before push...");let W=S("Building Docker image...");W.start();try{let{exec:Y}=await import("child_process"),{promisify:F}=await import("util"),x=F(Y),E=`docker build --platform linux/amd64 -t ${A} -f Dockerfile .`,{stdout:M,stderr:O}=await x(E,{cwd:X.projectPath(),env:T.env,maxBuffer:10485760,timeout:900000});if(V&&M)$.debug(M);if(V&&O)$.debug(O);W.succeed(`Docker image built: ${A}`)}catch(Y){if(W.fail("Docker build failed"),V)$.debug(`Docker build error: ${Y.message}`);throw Y}let K=S("Checking ECR repository...");K.start();try{let{ECRClient:Y}=await import("@stacksjs/ts-cloud"),F=new Y(Q),x=`${G}-${H}-api`;try{await F.describeRepositories({repositoryNames:[x]}),K.succeed(`ECR repository exists: ${x}`)}catch(E){if(E.code==="RepositoryNotFoundException"||E.message?.includes("RepositoryNotFoundException"))K.text=`Creating ECR repository: ${x}...`,await F.createRepository({repositoryName:x,imageScanningConfiguration:{scanOnPush:!0},imageTagMutability:"MUTABLE"}),K.succeed(`ECR repository created: ${x}`);else throw E}}catch(Y){if(K.fail("ECR repository check failed"),V)$.debug(`ECR repository error: ${Y.message}`);throw Y}let w=S("Authenticating to ECR...");w.start();try{let{ECRClient:Y}=await import("@stacksjs/ts-cloud"),E=(await new Y(Q).getAuthorizationToken()).authorizationData?.[0];if(!E?.authorizationToken)throw Error("No authorization token received from ECR");let M=Buffer.from(E.authorizationToken,"base64").toString("utf-8"),O=M.indexOf(":");if(O===-1)throw Error("ECR authorization token has unexpected format (missing colon separator)");let L=M.slice(O+1),j=Bun.spawnSync(["docker","login","--username","AWS","--password-stdin",`${z}.dkr.ecr.${Q}.amazonaws.com`],{stdin:new TextEncoder().encode(L),stdout:"pipe",stderr:"pipe"});if(j.exitCode!==0){let P=new TextDecoder().decode(j.stderr);throw Error(`Docker login failed: ${P}`)}w.succeed("Authenticated to ECR")}catch(Y){if(w.fail("ECR authentication failed"),V)$.debug(`ECR auth error: ${Y.message}`);throw Y}console.log("");let I=S("Pushing image to ECR...");I.start();try{let{exec:Y}=await import("child_process"),{promisify:F}=await import("util"),x=F(Y),E=`docker push ${A}`;await x(E,{env:T.env}),I.succeed(`Image pushed: ${A}`)}catch(Y){if(I.fail("Docker push failed"),V)$.debug(`Push error: ${Y.message}`);throw Y}console.log(""),console.log("Container image ready in ECR. CloudFormation will use this image."),console.log("")}else console.log(""),console.log("Server deployment mode detected"),console.log("Deploying EC2 infrastructure via CloudFormation..."),console.log("");async function y(z){try{let{STSClient:q}=await import("@stacksjs/ts-cloud"),K=(await new q(z).getCallerIdentity()).Account||T.env.AWS_ACCOUNT_ID||"";if(V)$.debug(`Retrieved AWS Account ID: ${K||"(empty)"}`);return K}catch(q){if(V)$.debug(`Failed to get AWS Account ID: ${q.message}`);return T.env.AWS_ACCOUNT_ID||""}}try{let z=await import(X.projectPath("cloud/deploy-script"));if(typeof z.beforeDeploy==="function")await z.beforeDeploy({environment:H,region:Q})}catch(z){if(z.code==="ERR_MODULE_NOT_FOUND"||z.code==="MODULE_NOT_FOUND"){if(V)$.debug("No beforeDeploy hook found (cloud/deploy-script not found)")}else if(console.warn(`\u26A0 beforeDeploy hook failed: ${z.message}`),V)$.debug(`beforeDeploy error stack: ${z.stack}`)}await J({environment:H,region:Q,waitForCompletion:!0,verbose:V});try{let z=await import(X.projectPath("cloud/deploy-script"));if(typeof z.afterDeploy==="function"){let{CloudFormationClient:q}=await import("@stacksjs/ts-cloud"),A=new q(Q),W=`${G}-cloud`,K={};try{K=await A.getStackOutputs(W)}catch(w){if(V)$.debug(`Failed to get stack outputs: ${w instanceof Error?w.message:String(w)}`)}await z.afterDeploy({environment:H,region:Q,outputs:K})}}catch(z){if(z.code==="ERR_MODULE_NOT_FOUND"||z.code==="MODULE_NOT_FOUND"){if(V)$.debug("No afterDeploy hook found (cloud/deploy-script not found)")}else if(console.warn(`\u26A0 afterDeploy hook failed: ${z.message}`),V)$.debug(`afterDeploy error stack: ${z.stack}`)}let c=S("Running database migrations...");c.start();try{let{generateMigrations:z,runDatabaseMigration:q}=await import("@stacksjs/database");await z(),await q(),c.succeed("Database migrations completed")}catch(z){if(c.stop(),console.log(`\u26A0 Database migrations skipped: ${z.message}`),V)$.debug(`Migration error: ${z.stack}`)}let k=S("Ensuring framework tables (auth, notifications, RBAC)...");k.start();try{let{migrateAuthTables:z,migrateNotificationTables:q,migrateRbacTables:A}=await import("@stacksjs/database"),W=[],K=[["auth",z],["notification",q],["RBAC",A]];for(let[w,I]of K){let Y=await I({verbose:V});if(!Y.success)W.push(`${w}: ${Y.error}`)}if(W.length>0)k.stop(),console.log(`\u26A0 Some framework tables could not be migrated: ${W.join("; ")}`);else k.succeed("Framework tables ensured (auth, notifications, RBAC)")}catch(z){if(k.stop(),console.log(`\u26A0 Framework table migrations skipped: ${z.message}`),V)$.debug(`Framework table migration error: ${z.stack}`)}if(b==="server"){let z=S("Retrieving server instance details...");z.start();try{let{CloudFormationClient:W}=await import("@stacksjs/ts-cloud"),K=new W(Q),w=`${G}-cloud`,I=await K.getStackOutputs(w);z.succeed("Server instances deployed"),console.log(""),console.log("Server instances:");for(let[Y,F]of Object.entries(I)){if(Y.endsWith("PublicIp"))console.log(`  ${Y}: ${F}`);if(Y.endsWith("InstanceId"))console.log(`  ${Y}: ${F}`)}console.log("")}catch(W){if(z.stop(),console.log(`\u26A0 Could not retrieve server details: ${W.message}`),V)$.debug(`Output retrieval error: ${W.stack}`)}let q=S("Deploying API server to EC2...");q.start();try{let{S3Client:W,CloudFormationClient:K,AWSClient:w}=await import("@stacksjs/ts-cloud"),{readFileSync:I,existsSync:Y}=await import("fs"),{resolve:F}=await import("path"),x=new W(Q),E=new K(Q),M=new w,O=`${G}-cloud`,L=await E.getStackOutputs(O),j=L.FrontendBucketName,P=Number(OJ.ports?.api||3008),C;for(let[g,v]of Object.entries(L))if(g.endsWith("InstanceId")&&typeof v==="string"){C=v;break}let f;if(C){let{EC2Client:g}=await import("@stacksjs/ts-cloud"),v=new g(Q);f=(await v.describeInstances({Filters:[{Name:"instance-id",Values:[C]}]}))?.Reservations?.[0]?.Instances?.[0]?.SecurityGroups?.[0]?.GroupId,await CJ(v,f,P)}if(!C||!j){if(q.stop(),!C)console.log("\u26A0 No EC2 instance found in stack outputs, skipping server deploy");if(!j)console.log("\u26A0 No S3 bucket found for staging server artifacts")}else{let g=L.publicCloudFrontDistributionId||L.CloudFrontDistributionId;await kJ(M,g,P);let v=F(X.projectPath("node_modules/@stacksjs/ts-cloud/dist/index.js"));if(Y(v)){let R=I(v);if(await a(()=>x.putObject({bucket:j,key:"_deploy/ts-cloud-dist.js",body:R,contentType:"application/javascript"}),"upload ts-cloud dist"),V)$.debug("  Uploaded ts-cloud dist to S3")}let m=`import { Database } from "bun:sqlite";
+${Object.entries(config).filter(([key]) => !key.startsWith("@_")).map(([key, val]) => buildCloudFrontXmlElement(key, val, "  ")).join("")}</DistributionConfig>
+`;
+}
+function firewallOpenCommand(ports) {
+  const uniquePorts = [...new Set(ports)].filter((port) => Number.isFinite(port) && port > 0).sort((a, b) => a - b);
+  if (uniquePorts.length === 0)
+    return "true";
+  return `if command -v firewall-cmd >/dev/null 2>&1; then firewall-cmd --permanent ${uniquePorts.map((port) => `--add-port=${port}/tcp`).join(" ")} && firewall-cmd --reload; fi`;
+}
+async function ensureSecurityGroupPort(ec2, securityGroupId, port) {
+  if (!securityGroupId)
+    return;
+  if (((await ec2.describeSecurityGroups({ GroupIds: [securityGroupId] }))?.SecurityGroups?.[0]?.IpPermissions || []).some((permission) => {
+    return permission.IpProtocol === "tcp" && Number(permission.FromPort) <= port && Number(permission.ToPort) >= port && normalizeArray(permission.IpRanges).some((range) => range.CidrIp === "0.0.0.0/0");
+  }))
+    return;
+  try {
+    await ec2.authorizeSecurityGroupIngress({
+      GroupId: securityGroupId,
+      IpPermissions: [{
+        IpProtocol: "tcp",
+        FromPort: port,
+        ToPort: port,
+        IpRanges: [{ CidrIp: "0.0.0.0/0", Description: `Stacks API port ${port}` }]
+      }]
+    });
+  } catch (error) {
+    if (!String(error?.message || "").includes("InvalidPermission.Duplicate"))
+      throw error;
+  }
+}
+async function ensureCloudFrontApiOriginPort(awsClient, distributionId, port) {
+  if (!distributionId)
+    return;
+  const getResult = await awsClient.request({
+    service: "cloudfront",
+    region: "us-east-1",
+    method: "GET",
+    path: `/2020-05-31/distribution/${distributionId}/config`,
+    returnHeaders: !0
+  }), etag = getResult.headers?.etag || getResult.headers?.ETag || "", currentConfig = getResult.body?.DistributionConfig || getResult.DistributionConfig || getResult.body;
+  if (!etag || !currentConfig?.Origins?.Items)
+    return;
+  const apiOrigin = normalizeArray(currentConfig.Origins.Items.Origin).find((origin) => String(origin.Id || "").includes("-api"));
+  if (!apiOrigin?.CustomOriginConfig)
+    return;
+  if (Number(apiOrigin.CustomOriginConfig.HTTPPort) === port)
+    return;
+  apiOrigin.CustomOriginConfig.HTTPPort = port;
+  await awsClient.request({
+    service: "cloudfront",
+    region: "us-east-1",
+    method: "PUT",
+    path: `/2020-05-31/distribution/${distributionId}/config`,
+    body: buildCloudFrontDistributionConfigXml(currentConfig),
+    headers: {
+      "Content-Type": "application/xml",
+      "If-Match": etag
+    }
+  });
+}
+const frameworkBuildSpinner = spinner("Building framework...");
+frameworkBuildSpinner.start();
+await runCommand("bun run build", {
+  cwd: p.frameworkPath("core"),
+  quiet: !1
+});
+frameworkBuildSpinner.succeed("Framework built");
+const docsDir = p.projectPath("docs"), docsBuildDir = p.projectPath("dist/docs/.bunpress");
+if (storage.hasFiles(docsDir)) {
+  const docsSpinner = spinner("Building documentation with BunPress...");
+  docsSpinner.start();
+  try {
+    const { rm } = await import("node:fs/promises"), localBunpressCli = `${process.env.HOME}/Code/Tools/bunpress/packages/bunpress/bin/cli.ts`, installedBunpressCli = p.projectPath("node_modules/@stacksjs/bunpress/dist/bin/cli.js"), hasLocalBunpress = await Bun.file(localBunpressCli).exists(), hasInstalledBunpress = await Bun.file(installedBunpressCli).exists(), command = hasLocalBunpress ? `bun ${localBunpressCli} build --dir ${docsDir} --outdir ${p.projectPath("dist/docs")}` : hasInstalledBunpress ? `bun ${installedBunpressCli} build --dir ${docsDir} --outdir ${p.projectPath("dist/docs")}` : "bunx @stacksjs/bunpress@0.1.5 build --dir ./docs --outdir ./dist/docs";
+    await rm(docsBuildDir, { recursive: !0, force: !0 });
+    await runCommand(command, {
+      cwd: p.projectPath(),
+      quiet: !isVerbose
+    });
+    docsSpinner.succeed(`Documentation built with BunPress${hasLocalBunpress ? " (local checkout)" : ""}`);
+  } catch (docsError) {
+    docsSpinner.stop();
+    console.log(`\u26A0 Documentation build skipped: ${docsError.message}`);
+    if (isVerbose)
+      log.debug("To build docs manually: cd ~/Code/Tools/bunpress && bun packages/bunpress/bin/cli.ts build --dir /path/to/docs --outdir /path/to/dist/docs");
+  }
+} else if (isVerbose)
+  log.debug("No docs directory found, skipping documentation build");
+const blogDistExists = storage.hasFiles(p.projectPath("dist/blog")), blogFontAssetsExist = [
+  "CampmateScript-Regular.woff2",
+  "SequoiaSans-Regular.woff2",
+  "Switchback-Regular.woff2"
+].every((file) => existsSync(p.projectPath(`dist/blog/assets/fonts/nps/${file}`))), blogImageAssetsExist = [
+  "topography.svg",
+  "park-ridge.svg"
+].every((file) => existsSync(p.projectPath(`dist/blog/assets/images/${file}`))), blogIndexPath = p.projectPath("dist/blog/index.html"), blogIndexHtml = existsSync(blogIndexPath) ? readFileSync(blogIndexPath, "utf8") : "", blogHtmlUsesCurrentFontFormat = blogIndexHtml.length > 0 && !blogIndexHtml.includes("woff2-variations"), blogHtmlUsesCurrentParkTheme = blogIndexHtml.includes("--on-primary") && blogIndexHtml.includes("--newsletter-bg"), blogHtmlUsesCurrentParkImages = blogIndexHtml.includes("topography.svg") && blogIndexHtml.includes("park-ridge.svg"), blogHtmlOmitsRetiredDecorations = !blogIndexHtml.includes("stamp-trail") && !blogIndexHtml.includes("blog-sign-tree.svg"), blogBuilderPath = p.frameworkPath("core/cms/src/build.ts"), blogConfigPath = p.projectPath("config/blog.ts"), blogHtmlIsFresh = existsSync(blogIndexPath) && [blogBuilderPath, blogConfigPath].filter((path) => existsSync(path)).every((path) => statSync(blogIndexPath).mtimeMs >= statSync(path).mtimeMs);
+if (!blogDistExists || !blogFontAssetsExist || !blogImageAssetsExist || !blogHtmlUsesCurrentFontFormat || !blogHtmlUsesCurrentParkTheme || !blogHtmlUsesCurrentParkImages || !blogHtmlOmitsRetiredDecorations || !blogHtmlIsFresh) {
+  const blogBuildSpinner = spinner("Building blog...");
+  blogBuildSpinner.start();
+  try {
+    const blogConfig = (await import(p.projectPath("config/blog"))).default, { buildBlogSite } = await import(p.frameworkPath("core/cms/src/build"));
+    await buildBlogSite({ config: blogConfig, outDir: p.projectPath("dist/blog") });
+    blogBuildSpinner.succeed("Blog built successfully");
+  } catch (blogBuildError) {
+    blogBuildSpinner.stop();
+    console.log(`\u26A0 Blog build skipped: ${blogBuildError.message}`);
+    if (isVerbose)
+      log.debug(`Blog build error: ${blogBuildError.stack}`);
+  }
+} else if (isVerbose)
+  log.debug("Pre-built blog found at dist/blog, skipping build");
+if (isVerbose)
+  log.debug("Skipping views build (vite-config not configured)");
+const earlyCloudConfig = await import(p.projectPath("config/cloud")), earlyDeploymentMode = earlyCloudConfig?.tsCloud?.mode || "server";
+if (earlyDeploymentMode === "serverless") {
+  const serverSpinner = spinner("Building server...");
+  serverSpinner.start();
+  await runCommand("bun build.ts", {
+    cwd: p.frameworkPath("server"),
+    quiet: !isVerbose
+  });
+  serverSpinner.succeed("Server built");
+  const packageSpinner = spinner("Packaging for deployment...");
+  packageSpinner.start();
+  await runCommand("bun zip.ts", {
+    cwd: p.corePath("cloud"),
+    quiet: !isVerbose
+  });
+  packageSpinner.succeed("Package ready");
+} else if (isVerbose)
+  log.debug("Skipping server build and packaging (server mode)");
+if (!process.env.AWS_ACCESS_KEY_ID || !process.env.AWS_SECRET_ACCESS_KEY) {
+  const { existsSync, readFileSync } = await import("node:fs"), environment = process.env.APP_ENV || process.env.NODE_ENV || "production", envFiles = [
+    p.projectPath(`.env.${environment}`),
+    p.projectPath(".env")
+  ];
+  for (const envPath of envFiles)
+    if (existsSync(envPath)) {
+      const content = readFileSync(envPath, "utf-8");
+      for (const line of content.split(`
+`)) {
+        const trimmed = line.trim();
+        if (trimmed.startsWith("#") || !trimmed.includes("="))
+          continue;
+        const eqIndex = trimmed.indexOf("="), key = trimmed.slice(0, eqIndex).trim();
+        let value = trimmed.slice(eqIndex + 1).trim();
+        if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'"))
+          value = value.slice(1, -1);
+        if (key === "AWS_ACCESS_KEY_ID" && value)
+          process.env.AWS_ACCESS_KEY_ID = value;
+        else if (key === "AWS_SECRET_ACCESS_KEY" && value)
+          process.env.AWS_SECRET_ACCESS_KEY = value;
+        else if (key === "AWS_REGION" && value && !process.env.AWS_REGION)
+          process.env.AWS_REGION = value;
+        else if (key === "AWS_ACCOUNT_ID" && value && !process.env.AWS_ACCOUNT_ID)
+          process.env.AWS_ACCOUNT_ID = value;
+        else if (key.startsWith("MAIL_PASSWORD_") && value && !process.env[key])
+          process.env[key] = value;
+      }
+      if (isVerbose)
+        log.debug(`Loaded AWS credentials from ${envPath}`);
+      break;
+    }
+}
+try {
+  const { deployStack, deployFrontend: _deployFrontend } = await import("../../deploy"), environment = process.env.APP_ENV || process.env.NODE_ENV || "production", region = process.env.AWS_REGION || "us-east-1", cloudConfigModule = await import(p.projectPath("config/cloud")), deploymentMode = cloudConfigModule?.tsCloud?.mode || "server", projectName = cloudConfigModule?.tsCloud?.project?.name || cloudConfigModule?.tsCloud?.project?.slug || "stacks";
+  if (deploymentMode === "serverless") {
+    console.log("");
+    console.log("Serverless deployment mode detected");
+    console.log("Building and pushing container image...");
+    console.log("");
+    const accountId = process.env.AWS_ACCOUNT_ID || await getAwsAccountId(region);
+    if (!accountId || accountId.length < 10)
+      throw Error(`Invalid AWS Account ID: "${accountId || "(empty)"}"
+Set AWS_ACCOUNT_ID in your .env file or ensure valid AWS credentials are configured.`);
+    const ecrRepository = `${accountId}.dkr.ecr.${region}.amazonaws.com/${projectName}-${environment}-api`, imageTag = `${ecrRepository}:latest`;
+    if (isVerbose)
+      log.debug(`ECR repository: ${ecrRepository}`);
+    if (isVerbose)
+      log.debug("ECR credentials will be validated before push...");
+    const buildSpinner = spinner("Building Docker image...");
+    buildSpinner.start();
+    try {
+      const { exec } = await import("node:child_process"), { promisify } = await import("node:util"), execAsync = promisify(exec), buildCmd = `docker build --platform linux/amd64 -t ${imageTag} -f Dockerfile .`, { stdout, stderr } = await execAsync(buildCmd, {
+        cwd: p.projectPath(),
+        env: process.env,
+        maxBuffer: 10485760,
+        timeout: 900000
+      });
+      if (isVerbose && stdout)
+        log.debug(stdout);
+      if (isVerbose && stderr)
+        log.debug(stderr);
+      buildSpinner.succeed(`Docker image built: ${imageTag}`);
+    } catch (error) {
+      buildSpinner.fail("Docker build failed");
+      if (isVerbose)
+        log.debug(`Docker build error: ${error.message}`);
+      throw error;
+    }
+    const repoSpinner = spinner("Checking ECR repository...");
+    repoSpinner.start();
+    try {
+      const { ECRClient } = await import("@stacksjs/ts-cloud"), ecr = new ECRClient(region), repoName = `${projectName}-${environment}-api`;
+      try {
+        await ecr.describeRepositories({ repositoryNames: [repoName] });
+        repoSpinner.succeed(`ECR repository exists: ${repoName}`);
+      } catch (err) {
+        if (err.code === "RepositoryNotFoundException" || err.message?.includes("RepositoryNotFoundException")) {
+          repoSpinner.text = `Creating ECR repository: ${repoName}...`;
+          await ecr.createRepository({
+            repositoryName: repoName,
+            imageScanningConfiguration: { scanOnPush: !0 },
+            imageTagMutability: "MUTABLE"
+          });
+          repoSpinner.succeed(`ECR repository created: ${repoName}`);
+        } else
+          throw err;
+      }
+    } catch (error) {
+      repoSpinner.fail("ECR repository check failed");
+      if (isVerbose)
+        log.debug(`ECR repository error: ${error.message}`);
+      throw error;
+    }
+    const authSpinner = spinner("Authenticating to ECR...");
+    authSpinner.start();
+    try {
+      const { ECRClient } = await import("@stacksjs/ts-cloud"), token = (await new ECRClient(region).getAuthorizationToken()).authorizationData?.[0];
+      if (!token?.authorizationToken)
+        throw Error("No authorization token received from ECR");
+      const decoded = Buffer.from(token.authorizationToken, "base64").toString("utf-8"), colonIndex = decoded.indexOf(":");
+      if (colonIndex === -1)
+        throw Error("ECR authorization token has unexpected format (missing colon separator)");
+      const password = decoded.slice(colonIndex + 1), loginResult = Bun.spawnSync([
+        "docker",
+        "login",
+        "--username",
+        "AWS",
+        "--password-stdin",
+        `${accountId}.dkr.ecr.${region}.amazonaws.com`
+      ], {
+        stdin: new TextEncoder().encode(password),
+        stdout: "pipe",
+        stderr: "pipe"
+      });
+      if (loginResult.exitCode !== 0) {
+        const loginError = new TextDecoder().decode(loginResult.stderr);
+        throw Error(`Docker login failed: ${loginError}`);
+      }
+      authSpinner.succeed("Authenticated to ECR");
+    } catch (error) {
+      authSpinner.fail("ECR authentication failed");
+      if (isVerbose)
+        log.debug(`ECR auth error: ${error.message}`);
+      throw error;
+    }
+    console.log("");
+    const pushSpinner = spinner("Pushing image to ECR...");
+    pushSpinner.start();
+    try {
+      const { exec } = await import("node:child_process"), { promisify } = await import("node:util"), execAsync = promisify(exec), pushCmd = `docker push ${imageTag}`;
+      await execAsync(pushCmd, { env: process.env });
+      pushSpinner.succeed(`Image pushed: ${imageTag}`);
+    } catch (error) {
+      pushSpinner.fail("Docker push failed");
+      if (isVerbose)
+        log.debug(`Push error: ${error.message}`);
+      throw error;
+    }
+    console.log("");
+    console.log("Container image ready in ECR. CloudFormation will use this image.");
+    console.log("");
+  } else {
+    console.log("");
+    console.log("Server deployment mode detected");
+    console.log("Deploying EC2 infrastructure via CloudFormation...");
+    console.log("");
+  }
+  async function getAwsAccountId(region) {
+    try {
+      const { STSClient } = await import("@stacksjs/ts-cloud"), accountId = (await new STSClient(region).getCallerIdentity()).Account || process.env.AWS_ACCOUNT_ID || "";
+      if (isVerbose)
+        log.debug(`Retrieved AWS Account ID: ${accountId || "(empty)"}`);
+      return accountId;
+    } catch (error) {
+      if (isVerbose)
+        log.debug(`Failed to get AWS Account ID: ${error.message}`);
+      return process.env.AWS_ACCOUNT_ID || "";
+    }
+  }
+  try {
+    const deployScript = await import(p.projectPath("cloud/deploy-script"));
+    if (typeof deployScript.beforeDeploy === "function")
+      await deployScript.beforeDeploy({ environment, region });
+  } catch (hookError) {
+    if (hookError.code === "ERR_MODULE_NOT_FOUND" || hookError.code === "MODULE_NOT_FOUND") {
+      if (isVerbose)
+        log.debug("No beforeDeploy hook found (cloud/deploy-script not found)");
+    } else {
+      console.warn(`\u26A0 beforeDeploy hook failed: ${hookError.message}`);
+      if (isVerbose)
+        log.debug(`beforeDeploy error stack: ${hookError.stack}`);
+    }
+  }
+  await deployStack({
+    environment,
+    region,
+    waitForCompletion: !0,
+    verbose: isVerbose
+  });
+  try {
+    const deployScript = await import(p.projectPath("cloud/deploy-script"));
+    if (typeof deployScript.afterDeploy === "function") {
+      const { CloudFormationClient } = await import("@stacksjs/ts-cloud"), cf = new CloudFormationClient(region), stackName = `${projectName}-cloud`;
+      let stackOutputs = {};
+      try {
+        stackOutputs = await cf.getStackOutputs(stackName);
+      } catch (e) {
+        if (isVerbose)
+          log.debug(`Failed to get stack outputs: ${e instanceof Error ? e.message : String(e)}`);
+      }
+      await deployScript.afterDeploy({ environment, region, outputs: stackOutputs });
+    }
+  } catch (hookError) {
+    if (hookError.code === "ERR_MODULE_NOT_FOUND" || hookError.code === "MODULE_NOT_FOUND") {
+      if (isVerbose)
+        log.debug("No afterDeploy hook found (cloud/deploy-script not found)");
+    } else {
+      console.warn(`\u26A0 afterDeploy hook failed: ${hookError.message}`);
+      if (isVerbose)
+        log.debug(`afterDeploy error stack: ${hookError.stack}`);
+    }
+  }
+  const migrateSpinner = spinner("Running database migrations...");
+  migrateSpinner.start();
+  try {
+    const { generateMigrations, runDatabaseMigration } = await import("@stacksjs/database");
+    await generateMigrations();
+    await runDatabaseMigration();
+    migrateSpinner.succeed("Database migrations completed");
+  } catch (migrationError) {
+    migrateSpinner.stop();
+    console.log(`\u26A0 Database migrations skipped: ${migrationError.message}`);
+    if (isVerbose)
+      log.debug(`Migration error: ${migrationError.stack}`);
+  }
+  const frameworkTablesSpinner = spinner("Ensuring framework tables (auth, notifications, RBAC)...");
+  frameworkTablesSpinner.start();
+  try {
+    const { migrateAuthTables, migrateNotificationTables, migrateRbacTables } = await import("@stacksjs/database"), failures = [], steps = [
+      ["auth", migrateAuthTables],
+      ["notification", migrateNotificationTables],
+      ["RBAC", migrateRbacTables]
+    ];
+    for (const [name, migrateTables] of steps) {
+      const result = await migrateTables({ verbose: isVerbose });
+      if (!result.success)
+        failures.push(`${name}: ${result.error}`);
+    }
+    if (failures.length > 0) {
+      frameworkTablesSpinner.stop();
+      console.log(`\u26A0 Some framework tables could not be migrated: ${failures.join("; ")}`);
+    } else
+      frameworkTablesSpinner.succeed("Framework tables ensured (auth, notifications, RBAC)");
+  } catch (frameworkTablesError) {
+    frameworkTablesSpinner.stop();
+    console.log(`\u26A0 Framework table migrations skipped: ${frameworkTablesError.message}`);
+    if (isVerbose)
+      log.debug(`Framework table migration error: ${frameworkTablesError.stack}`);
+  }
+  if (deploymentMode === "server") {
+    const serverOutputSpinner = spinner("Retrieving server instance details...");
+    serverOutputSpinner.start();
+    try {
+      const { CloudFormationClient } = await import("@stacksjs/ts-cloud"), cf = new CloudFormationClient(region), stackName = `${projectName}-cloud`, outputs = await cf.getStackOutputs(stackName);
+      serverOutputSpinner.succeed("Server instances deployed");
+      console.log("");
+      console.log("Server instances:");
+      for (const [key, value] of Object.entries(outputs)) {
+        if (key.endsWith("PublicIp"))
+          console.log(`  ${key}: ${value}`);
+        if (key.endsWith("InstanceId"))
+          console.log(`  ${key}: ${value}`);
+      }
+      console.log("");
+    } catch (outputError) {
+      serverOutputSpinner.stop();
+      console.log(`\u26A0 Could not retrieve server details: ${outputError.message}`);
+      if (isVerbose)
+        log.debug(`Output retrieval error: ${outputError.stack}`);
+    }
+    const serverDeploySpinner = spinner("Deploying API server to EC2...");
+    serverDeploySpinner.start();
+    try {
+      const { S3Client, CloudFormationClient, AWSClient } = await import("@stacksjs/ts-cloud"), { readFileSync: readServerFile, existsSync: serverFileExists } = await import("node:fs"), { resolve } = await import("node:path"), s3 = new S3Client(region), cf = new CloudFormationClient(region), awsClient = new AWSClient, stackName = `${projectName}-cloud`, outputs = await cf.getStackOutputs(stackName), bucketName = outputs.FrontendBucketName, apiServerPort = Number(config.ports?.api || 3008);
+      let instanceId;
+      for (const [key, value] of Object.entries(outputs))
+        if (key.endsWith("InstanceId") && typeof value === "string") {
+          instanceId = value;
+          break;
+        }
+      let securityGroupId;
+      if (instanceId) {
+        const { EC2Client } = await import("@stacksjs/ts-cloud"), ec2 = new EC2Client(region);
+        securityGroupId = (await ec2.describeInstances({
+          Filters: [{ Name: "instance-id", Values: [instanceId] }]
+        }))?.Reservations?.[0]?.Instances?.[0]?.SecurityGroups?.[0]?.GroupId;
+        await ensureSecurityGroupPort(ec2, securityGroupId, apiServerPort);
+      }
+      if (!instanceId || !bucketName) {
+        serverDeploySpinner.stop();
+        if (!instanceId)
+          console.log("\u26A0 No EC2 instance found in stack outputs, skipping server deploy");
+        if (!bucketName)
+          console.log("\u26A0 No S3 bucket found for staging server artifacts");
+      } else {
+        const publicDistributionId = outputs.publicCloudFrontDistributionId || outputs.CloudFrontDistributionId;
+        await ensureCloudFrontApiOriginPort(awsClient, publicDistributionId, apiServerPort);
+        const tsCloudDistPath = resolve(p.projectPath("node_modules/@stacksjs/ts-cloud/dist/index.js"));
+        if (serverFileExists(tsCloudDistPath)) {
+          const tsCloudDist = readServerFile(tsCloudDistPath);
+          await withS3Retry(() => s3.putObject({
+            bucket: bucketName,
+            key: "_deploy/ts-cloud-dist.js",
+            body: tsCloudDist,
+            contentType: "application/javascript"
+          }), "upload ts-cloud dist");
+          if (isVerbose)
+            log.debug("  Uploaded ts-cloud dist to S3");
+        }
+        const serverCode = `import { Database } from "bun:sqlite";
 import { SESClient } from "./ts-cloud-dist.js";
 
 const db = new Database("/var/www/api/stacks.db");
@@ -27,7 +625,7 @@ const CORS_HEADERS = {
   "Access-Control-Allow-Headers": "Content-Type",
 };
 
-const ses = new SESClient("${Q}");
+const ses = new SESClient("${region}");
 
 async function readBody(req) {
   const contentType = req.headers.get("content-type") || "";
@@ -76,7 +674,7 @@ async function sendWelcomeEmail(email) {
 }
 
 const server = Bun.serve({
-  port: ${P},
+  port: ${apiServerPort},
   hostname: "0.0.0.0",
   async fetch(req) {
     const url = new URL(req.url);
@@ -130,7 +728,21 @@ const server = Bun.serve({
 });
 
 console.log(\`Stacks API server running on port \${server.port}\`);
-`;if(await a(()=>x.putObject({bucket:j,key:"_deploy/server.ts",body:Buffer.from(m),contentType:"application/typescript"}),"upload server.ts"),V)$.debug("  Uploaded server.ts to S3");let p=["mkdir -p /var/www/api",`aws s3 cp s3://${j}/_deploy/ts-cloud-dist.js /var/www/api/ts-cloud-dist.js`,`aws s3 cp s3://${j}/_deploy/server.ts /var/www/api/server.ts`,_J([P]),`cat > /etc/systemd/system/stacks-api.service << 'SERVICEFILE'
+`;
+        await withS3Retry(() => s3.putObject({
+          bucket: bucketName,
+          key: "_deploy/server.ts",
+          body: Buffer.from(serverCode),
+          contentType: "application/typescript"
+        }), "upload server.ts");
+        if (isVerbose)
+          log.debug("  Uploaded server.ts to S3");
+        const ssmCommand = [
+          "mkdir -p /var/www/api",
+          `aws s3 cp s3://${bucketName}/_deploy/ts-cloud-dist.js /var/www/api/ts-cloud-dist.js`,
+          `aws s3 cp s3://${bucketName}/_deploy/server.ts /var/www/api/server.ts`,
+          firewallOpenCommand([apiServerPort]),
+          `cat > /etc/systemd/system/stacks-api.service << 'SERVICEFILE'
 [Unit]
 Description=Stacks Bun API Server
 After=network.target
@@ -147,16 +759,172 @@ Environment=NODE_ENV=production
 WantedBy=multi-user.target
 SERVICEFILE
 systemctl daemon-reload
-systemctl enable stacks-api`,"systemctl reset-failed stacks-api || true","systemctl restart stacks-api",`for i in $(seq 1 20); do curl -fsS http://127.0.0.1:${P}/api/health && break; sleep 1; done`,`curl -fsS http://127.0.0.1:${P}/api/health`,`echo "API server deployed and restarted on port ${P}"`].join(" && "),h=(await M.request({service:"ssm",region:Q,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":"AmazonSSM.SendCommand"},body:JSON.stringify({InstanceIds:[C],DocumentName:"AWS-RunShellScript",Parameters:{commands:[p]},TimeoutSeconds:120})}))?.Command?.CommandId;if(h){let R=0;while(R<30){await new Promise((B)=>setTimeout(B,3000));try{let B=await M.request({service:"ssm",region:Q,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":"AmazonSSM.GetCommandInvocation"},body:JSON.stringify({CommandId:h,InstanceId:C})}),d=B?.Status;if(d==="Success"){q.succeed("API server deployed to EC2");break}else if(d==="Failed"||d==="Cancelled"||d==="TimedOut"){let t=B?.StandardErrorContent||"Unknown error";q.fail(`API server deploy failed: ${t}`);break}}catch{}R++}if(R>=30)q.fail("API server deploy timed out waiting for SSM command")}else q.fail("Failed to send SSM command");try{await x.deleteObject({bucket:j,key:"_deploy/ts-cloud-dist.js"}),await x.deleteObject({bucket:j,key:"_deploy/server.ts"})}catch{}}}catch(W){if(q.fail(`API server deployment failed: ${W.message}`),V)$.debug(`Server deploy error: ${W.stack}`)}let A=OJ.email;if(A?.server?.enabled){let W=A?.server?.mode||"server",K=S(`Deploying mail server (${W} mode) to EC2...`);K.start();try{let{S3Client:w,AWSClient:I,EC2Client:Y}=await import("@stacksjs/ts-cloud"),{readFileSync:F,existsSync:x}=await import("fs"),{resolve:E,join:M}=await import("path"),{execSync:O}=await import("child_process"),L=new w(Q),j=new I,P=new Y(Q),C=`${G}-cloud`,f,g,v,m;try{let{AWSCloudFormationClient:p}=await import("@stacksjs/ts-cloud"),h=await new p(Q).getStackOutputs(C);for(let[R,B]of Object.entries(h)){if(R.endsWith("InstanceId")&&typeof B==="string")f=B;if(R==="FrontendBucketName"&&typeof B==="string")g=B;if(R==="emailBucketName"&&typeof B==="string")v=B}}catch{}if(!v)v=`${G}-production-s3-email`;if(f&&g){let p=[25,80,110,143,465,587,993,995];try{let B=(await P.describeInstances({Filters:[{Name:"instance-id",Values:[f]}]}))?.Reservations?.[0]?.Instances?.[0]?.SecurityGroups;if(B?.[0]?.GroupId)m=B[0].GroupId}catch{if(V)$.debug("Could not get security group for instance")}if(m)for(let R of p)try{if(await P.authorizeSecurityGroupIngress({GroupId:m,IpPermissions:[{IpProtocol:"tcp",FromPort:R,ToPort:R,IpRanges:[{CidrIp:"0.0.0.0/0",Description:`Mail port ${R}`}]}]}),V)$.debug(`  Opened port ${R} on security group ${m}`)}catch(B){if(!B.message?.includes("already exists")){if(V)$.debug(`  Port ${R}: ${B.message}`)}}let D=A.domain||"stacksjs.com",h=A?.server?.subdomain||"mail";if(W==="server"){if(V)$.debug("Deploying Zig mail server binary...");try{await PJ()}catch(B){if(V)$.debug(`  Pantry mail install failed: ${B.message}`)}let R=await fJ();if(R&&x(R)){if(!await MJ(R))throw K.fail(`Pantry installed ${GJ}, but the ${jJ} binary is not an ELF file.`),Error("Linux binary is not a valid ELF file");let B=F(R);if(await L.putObject({bucket:v,key:"mail-server/smtp-server",body:B,contentType:"application/octet-stream"}),V)$.debug(`  Uploaded Zig binary (${(B.length/1024/1024).toFixed(1)}MB) to S3`);let d=["systemctl stop stacks-mail 2>/dev/null || true","systemctl disable stacks-mail 2>/dev/null || true","systemctl stop stacks-smtp 2>/dev/null || true","systemctl disable stacks-smtp 2>/dev/null || true","systemctl stop smtp-server 2>/dev/null || true","mkdir -p /opt/smtp-server /var/lib/smtp-server /var/log/smtp-server /var/spool/mail /etc/smtp-server /var/lib/smtp-server/backups",`aws s3 cp s3://${v}/mail-server/smtp-server /opt/smtp-server/smtp-server --region ${Q}`,"chmod +x /opt/smtp-server/smtp-server",'file /opt/smtp-server/smtp-server | grep -q ELF || { echo "Binary is not ELF"; exit 1; }',_J(p),`cat > /etc/smtp-server/smtp-server.env << 'ENVEOF'
+systemctl enable stacks-api`,
+          "systemctl reset-failed stacks-api || true",
+          "systemctl restart stacks-api",
+          `for i in $(seq 1 20); do curl -fsS http://127.0.0.1:${apiServerPort}/api/health && break; sleep 1; done`,
+          `curl -fsS http://127.0.0.1:${apiServerPort}/api/health`,
+          `echo "API server deployed and restarted on port ${apiServerPort}"`
+        ].join(" && "), commandId = (await awsClient.request({
+          service: "ssm",
+          region,
+          method: "POST",
+          path: "/",
+          headers: {
+            "Content-Type": "application/x-amz-json-1.1",
+            "X-Amz-Target": "AmazonSSM.SendCommand"
+          },
+          body: JSON.stringify({
+            InstanceIds: [instanceId],
+            DocumentName: "AWS-RunShellScript",
+            Parameters: {
+              commands: [ssmCommand]
+            },
+            TimeoutSeconds: 120
+          })
+        }))?.Command?.CommandId;
+        if (commandId) {
+          let attempts = 0;
+          while (attempts < 30) {
+            await new Promise((resolve) => setTimeout(resolve, 3000));
+            try {
+              const invocation = await awsClient.request({
+                service: "ssm",
+                region,
+                method: "POST",
+                path: "/",
+                headers: {
+                  "Content-Type": "application/x-amz-json-1.1",
+                  "X-Amz-Target": "AmazonSSM.GetCommandInvocation"
+                },
+                body: JSON.stringify({
+                  CommandId: commandId,
+                  InstanceId: instanceId
+                })
+              }), status = invocation?.Status;
+              if (status === "Success") {
+                serverDeploySpinner.succeed("API server deployed to EC2");
+                break;
+              } else if (status === "Failed" || status === "Cancelled" || status === "TimedOut") {
+                const errOutput = invocation?.StandardErrorContent || "Unknown error";
+                serverDeploySpinner.fail(`API server deploy failed: ${errOutput}`);
+                break;
+              }
+            } catch {}
+            attempts++;
+          }
+          if (attempts >= 30)
+            serverDeploySpinner.fail("API server deploy timed out waiting for SSM command");
+        } else
+          serverDeploySpinner.fail("Failed to send SSM command");
+        try {
+          await s3.deleteObject({ bucket: bucketName, key: "_deploy/ts-cloud-dist.js" });
+          await s3.deleteObject({ bucket: bucketName, key: "_deploy/server.ts" });
+        } catch {}
+      }
+    } catch (serverDeployError) {
+      serverDeploySpinner.fail(`API server deployment failed: ${serverDeployError.message}`);
+      if (isVerbose)
+        log.debug(`Server deploy error: ${serverDeployError.stack}`);
+    }
+    const emailConfig = config.email;
+    if (emailConfig?.server?.enabled) {
+      const mailServerMode = emailConfig?.server?.mode || "server", smtpSpinner = spinner(`Deploying mail server (${mailServerMode} mode) to EC2...`);
+      smtpSpinner.start();
+      try {
+        const { S3Client, AWSClient, EC2Client } = await import("@stacksjs/ts-cloud"), { readFileSync: readSmtpFile, existsSync: smtpFileExists } = await import("node:fs"), { resolve: resolvePath, join: joinPath } = await import("node:path"), { execSync } = await import("node:child_process"), s3 = new S3Client(region), awsClient = new AWSClient, ec2 = new EC2Client(region), stackName = `${projectName}-cloud`;
+        let smtpInstanceId, smtpBucketName, emailBucketName, securityGroupId;
+        try {
+          const { AWSCloudFormationClient: CfnClient } = await import("@stacksjs/ts-cloud"), cfnOutputs = await new CfnClient(region).getStackOutputs(stackName);
+          for (const [key, value] of Object.entries(cfnOutputs)) {
+            if (key.endsWith("InstanceId") && typeof value === "string")
+              smtpInstanceId = value;
+            if (key === "FrontendBucketName" && typeof value === "string")
+              smtpBucketName = value;
+            if (key === "emailBucketName" && typeof value === "string")
+              emailBucketName = value;
+          }
+        } catch {}
+        if (!emailBucketName)
+          emailBucketName = `${projectName}-production-s3-email`;
+        if (smtpInstanceId && smtpBucketName) {
+          const mailPorts = [25, 80, 110, 143, 465, 587, 993, 995];
+          try {
+            const sgs = (await ec2.describeInstances({
+              Filters: [{ Name: "instance-id", Values: [smtpInstanceId] }]
+            }))?.Reservations?.[0]?.Instances?.[0]?.SecurityGroups;
+            if (sgs?.[0]?.GroupId)
+              securityGroupId = sgs[0].GroupId;
+          } catch {
+            if (isVerbose)
+              log.debug("Could not get security group for instance");
+          }
+          if (securityGroupId)
+            for (const port of mailPorts)
+              try {
+                await ec2.authorizeSecurityGroupIngress({
+                  GroupId: securityGroupId,
+                  IpPermissions: [{
+                    IpProtocol: "tcp",
+                    FromPort: port,
+                    ToPort: port,
+                    IpRanges: [{ CidrIp: "0.0.0.0/0", Description: `Mail port ${port}` }]
+                  }]
+                });
+                if (isVerbose)
+                  log.debug(`  Opened port ${port} on security group ${securityGroupId}`);
+              } catch (e) {
+                if (!e.message?.includes("already exists")) {
+                  if (isVerbose)
+                    log.debug(`  Port ${port}: ${e.message}`);
+                }
+              }
+          const domain = emailConfig.domain || "stacksjs.com", mailSubdomain = emailConfig?.server?.subdomain || "mail";
+          if (mailServerMode === "server") {
+            if (isVerbose)
+              log.debug("Deploying Zig mail server binary...");
+            try {
+              await installMailBinaryWithPantry();
+            } catch (error) {
+              if (isVerbose)
+                log.debug(`  Pantry mail install failed: ${error.message}`);
+            }
+            const linuxBinaryPath = await findPantryMailBinary();
+            if (linuxBinaryPath && smtpFileExists(linuxBinaryPath)) {
+              if (!await isElfBinary(linuxBinaryPath)) {
+                smtpSpinner.fail(`Pantry installed ${MAIL_PACKAGE_DOMAIN}, but the ${MAIL_TARGET_PLATFORM} binary is not an ELF file.`);
+                throw Error("Linux binary is not a valid ELF file");
+              }
+              const binaryContent = readSmtpFile(linuxBinaryPath);
+              await s3.putObject({
+                bucket: emailBucketName,
+                key: "mail-server/smtp-server",
+                body: binaryContent,
+                contentType: "application/octet-stream"
+              });
+              if (isVerbose)
+                log.debug(`  Uploaded Zig binary (${(binaryContent.length / 1024 / 1024).toFixed(1)}MB) to S3`);
+              const zigSsmCommand = [
+                "systemctl stop stacks-mail 2>/dev/null || true",
+                "systemctl disable stacks-mail 2>/dev/null || true",
+                "systemctl stop stacks-smtp 2>/dev/null || true",
+                "systemctl disable stacks-smtp 2>/dev/null || true",
+                "systemctl stop smtp-server 2>/dev/null || true",
+                "mkdir -p /opt/smtp-server /var/lib/smtp-server /var/log/smtp-server /var/spool/mail /etc/smtp-server /var/lib/smtp-server/backups",
+                `aws s3 cp s3://${emailBucketName}/mail-server/smtp-server /opt/smtp-server/smtp-server --region ${region}`,
+                "chmod +x /opt/smtp-server/smtp-server",
+                'file /opt/smtp-server/smtp-server | grep -q ELF || { echo "Binary is not ELF"; exit 1; }',
+                firewallOpenCommand(mailPorts),
+                `cat > /etc/smtp-server/smtp-server.env << 'ENVEOF'
 SMTP_PROFILE=production
 SMTP_HOST=0.0.0.0
 SMTP_PORT=25
-SMTP_HOSTNAME=${h}.${D}
+SMTP_HOSTNAME=${mailSubdomain}.${domain}
 SMTP_ENABLE_TLS=false
 SMTP_ENABLE_AUTH=true
 SMTP_DB_PATH=/var/lib/smtp-server/smtp.db
-AWS_S3_BUCKET=${v}
-AWS_REGION=${Q}
+AWS_S3_BUCKET=${emailBucketName}
+AWS_REGION=${region}
 SMTP_ENABLE_JSON_LOGGING=true
 SMTP_LOG_LEVEL=info
 SMTP_MAILBOX_PATH=/var/spool/mail
@@ -167,7 +935,9 @@ SMTP_MAX_RECIPIENTS=100
 SMTP_RATE_LIMIT_PER_IP=100
 SMTP_RATE_LIMIT_PER_USER=200
 SMTP_IO_MODE=epoll
-ENVEOF`,"chmod 600 /etc/smtp-server/smtp-server.env",`cat > /etc/systemd/system/smtp-server.service << 'SVCEOF'
+ENVEOF`,
+                "chmod 600 /etc/smtp-server/smtp-server.env",
+                `cat > /etc/systemd/system/smtp-server.service << 'SVCEOF'
 [Unit]
 Description=Stacks Mail Server (Zig)
 After=network.target
@@ -185,20 +955,99 @@ SyslogIdentifier=smtp-server
 
 [Install]
 WantedBy=multi-user.target
-SVCEOF`,"systemctl daemon-reload","systemctl enable smtp-server","systemctl restart smtp-server","sleep 3",'systemctl is-active smtp-server && echo "Mail server is running" || echo "Mail server failed to start"','ss -tlnp | grep -E "(25|143)" || echo "Warning: mail ports not listening yet"'].join(" && "),$J=(await j.request({service:"ssm",region:Q,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":"AmazonSSM.SendCommand"},body:JSON.stringify({InstanceIds:[f],DocumentName:"AWS-RunShellScript",Parameters:{commands:[d]},TimeoutSeconds:300})}))?.Command?.CommandId;if($J){let zJ=0;while(zJ<100){await new Promise((u)=>setTimeout(u,3000));try{let u=await j.request({service:"ssm",region:Q,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":"AmazonSSM.GetCommandInvocation"},body:JSON.stringify({CommandId:$J,InstanceId:f})}),e=u?.Status;if(e==="Success"){if(K.succeed("Zig mail server deployed to EC2"),V&&u?.StandardOutputContent)console.log(u.StandardOutputContent);break}else if(e==="Failed"||e==="Cancelled"||e==="TimedOut"){let qJ=u?.StandardErrorContent||u?.StandardOutputContent||"Unknown error";K.fail(`Zig mail server deploy failed: ${qJ.slice(0,500)}`);break}}catch{}zJ++}if(zJ>=100)K.fail("Zig mail server deploy timed out")}else K.fail("Failed to send SSM command for mail server")}else K.fail(`No Pantry-provided ${jJ} mail binary found. Release ${GJ}, then run the Pantry binary sync for that package.`)}else{let R=E(X.projectPath("storage/framework/core/cloud/src/imap/smtp-server.ts")),B=M(X.projectPath(),".stacks/tmp/smtp-bundle");O(`bun build ${R} --target=bun --outdir=${B}`,{stdio:"pipe"});let d=M(B,"smtp-server.js");if(x(d)){let t=F(d),$J=A.mailboxes||["chris","blake","glenn"],zJ=$J.map((s)=>{let l=`MAIL_PASSWORD_${s.toUpperCase()}`;return`  "${s}": { password: process.env["${l}"] || "", email: "${s}@${D}" }`}).join(`,
-`),u=`import { SmtpServer } from "./smtp-server.js";
+SVCEOF`,
+                "systemctl daemon-reload",
+                "systemctl enable smtp-server",
+                "systemctl restart smtp-server",
+                "sleep 3",
+                'systemctl is-active smtp-server && echo "Mail server is running" || echo "Mail server failed to start"',
+                'ss -tlnp | grep -E "(25|143)" || echo "Warning: mail ports not listening yet"'
+              ].join(" && "), cmdId = (await awsClient.request({
+                service: "ssm",
+                region,
+                method: "POST",
+                path: "/",
+                headers: {
+                  "Content-Type": "application/x-amz-json-1.1",
+                  "X-Amz-Target": "AmazonSSM.SendCommand"
+                },
+                body: JSON.stringify({
+                  InstanceIds: [smtpInstanceId],
+                  DocumentName: "AWS-RunShellScript",
+                  Parameters: { commands: [zigSsmCommand] },
+                  TimeoutSeconds: 300
+                })
+              }))?.Command?.CommandId;
+              if (cmdId) {
+                let ssmAttempts = 0;
+                while (ssmAttempts < 100) {
+                  await new Promise((resolve) => setTimeout(resolve, 3000));
+                  try {
+                    const invocation = await awsClient.request({
+                      service: "ssm",
+                      region,
+                      method: "POST",
+                      path: "/",
+                      headers: {
+                        "Content-Type": "application/x-amz-json-1.1",
+                        "X-Amz-Target": "AmazonSSM.GetCommandInvocation"
+                      },
+                      body: JSON.stringify({ CommandId: cmdId, InstanceId: smtpInstanceId })
+                    }), status = invocation?.Status;
+                    if (status === "Success") {
+                      smtpSpinner.succeed("Zig mail server deployed to EC2");
+                      if (isVerbose && invocation?.StandardOutputContent)
+                        console.log(invocation.StandardOutputContent);
+                      break;
+                    } else if (status === "Failed" || status === "Cancelled" || status === "TimedOut") {
+                      const errOutput = invocation?.StandardErrorContent || invocation?.StandardOutputContent || "Unknown error";
+                      smtpSpinner.fail(`Zig mail server deploy failed: ${errOutput.slice(0, 500)}`);
+                      break;
+                    }
+                  } catch {}
+                  ssmAttempts++;
+                }
+                if (ssmAttempts >= 100)
+                  smtpSpinner.fail("Zig mail server deploy timed out");
+              } else
+                smtpSpinner.fail("Failed to send SSM command for mail server");
+            } else
+              smtpSpinner.fail(`No Pantry-provided ${MAIL_TARGET_PLATFORM} mail binary found. Release ${MAIL_PACKAGE_DOMAIN}, then run the Pantry binary sync for that package.`);
+          } else {
+            const smtpServerSrc = resolvePath(p.projectPath("storage/framework/core/cloud/src/imap/smtp-server.ts")), bundleOutDir = joinPath(p.projectPath(), ".stacks/tmp/smtp-bundle");
+            execSync(`bun build ${smtpServerSrc} --target=bun --outdir=${bundleOutDir}`, { stdio: "pipe" });
+            const bundlePath = joinPath(bundleOutDir, "smtp-server.js");
+            if (smtpFileExists(bundlePath)) {
+              const smtpBundle = readSmtpFile(bundlePath), mailboxes = emailConfig.mailboxes || ["chris", "blake", "glenn"], usersEntries = mailboxes.map((name) => {
+                const envKey = `MAIL_PASSWORD_${name.toUpperCase()}`;
+                return `  "${name}": { password: process.env["${envKey}"] || "", email: "${name}@${domain}" }`;
+              }).join(`,
+`), entryPoint = `import { SmtpServer } from "./smtp-server.js";
 import * as fs from "fs";
-const domain = "${D}";
-const users = { ${zJ} };
+const domain = "${domain}";
+const users = { ${usersEntries} };
 const certDir = \`/etc/letsencrypt/live/mail.\${domain}\`;
 let tlsConfig = undefined;
 if (fs.existsSync(\`\${certDir}/privkey.pem\`)) {
   tlsConfig = { key: \`\${certDir}/privkey.pem\`, cert: \`\${certDir}/fullchain.pem\` };
 }
-const server = new SmtpServer({ port: 587, tlsPort: 465, host: "0.0.0.0", domain, users, tls: tlsConfig, sentBucket: "${G}-production-email", sentPrefix: "sent/" });
+const server = new SmtpServer({ port: 587, tlsPort: 465, host: "0.0.0.0", domain, users, tls: tlsConfig, sentBucket: "${projectName}-production-email", sentPrefix: "sent/" });
 await server.start();
-`;await L.putObject({bucket:g,key:"_deploy/smtp-server.js",body:t,contentType:"application/javascript"}),await L.putObject({bucket:g,key:"_deploy/smtp-entry.ts",body:Buffer.from(u),contentType:"application/typescript"});let e=$J.map((s)=>{let l=`MAIL_PASSWORD_${s.toUpperCase()}`;return`Environment=${l}=${T.env[l]||""}`}).join(`
-`),qJ=["mkdir -p /var/www/smtp",`aws s3 cp s3://${g}/_deploy/smtp-server.js /var/www/smtp/smtp-server.js`,`aws s3 cp s3://${g}/_deploy/smtp-entry.ts /var/www/smtp/smtp-entry.ts`,_J(p),"if ! command -v certbot &> /dev/null; then dnf install -y certbot || yum install -y certbot || apt-get install -y certbot || true; fi",`if [ ! -d /etc/letsencrypt/live/mail.${D} ]; then certbot certonly --standalone --non-interactive --agree-tos --email admin@${D} -d mail.${D} --http-01-port 80 || echo "Certbot failed"; fi`,`cat > /etc/systemd/system/stacks-smtp.service << 'SERVICEFILE'
+`;
+              await s3.putObject({ bucket: smtpBucketName, key: "_deploy/smtp-server.js", body: smtpBundle, contentType: "application/javascript" });
+              await s3.putObject({ bucket: smtpBucketName, key: "_deploy/smtp-entry.ts", body: Buffer.from(entryPoint), contentType: "application/typescript" });
+              const envLines = mailboxes.map((name) => {
+                const envKey = `MAIL_PASSWORD_${name.toUpperCase()}`;
+                return `Environment=${envKey}=${process.env[envKey] || ""}`;
+              }).join(`
+`), smtpSsmCommand = [
+                "mkdir -p /var/www/smtp",
+                `aws s3 cp s3://${smtpBucketName}/_deploy/smtp-server.js /var/www/smtp/smtp-server.js`,
+                `aws s3 cp s3://${smtpBucketName}/_deploy/smtp-entry.ts /var/www/smtp/smtp-entry.ts`,
+                firewallOpenCommand(mailPorts),
+                "if ! command -v certbot &> /dev/null; then dnf install -y certbot || yum install -y certbot || apt-get install -y certbot || true; fi",
+                `if [ ! -d /etc/letsencrypt/live/mail.${domain} ]; then certbot certonly --standalone --non-interactive --agree-tos --email admin@${domain} -d mail.${domain} --http-01-port 80 || echo "Certbot failed"; fi`,
+                `cat > /etc/systemd/system/stacks-smtp.service << 'SERVICEFILE'
 [Unit]
 Description=Stacks SMTP Proxy Server
 After=network.target
@@ -209,11 +1058,115 @@ ExecStart=/root/.bun/bin/bun smtp-entry.ts
 Restart=on-failure
 RestartSec=5
 Environment=NODE_ENV=production
-Environment=AWS_REGION=${Q}
-${e}
+Environment=AWS_REGION=${region}
+${envLines}
 [Install]
 WantedBy=multi-user.target
-SERVICEFILE`,"systemctl daemon-reload","systemctl enable stacks-smtp","systemctl restart stacks-smtp"].join(" && "),FJ=(await j.request({service:"ssm",region:Q,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":"AmazonSSM.SendCommand"},body:JSON.stringify({InstanceIds:[f],DocumentName:"AWS-RunShellScript",Parameters:{commands:[qJ]},TimeoutSeconds:180})}))?.Command?.CommandId;if(FJ){let s=0;while(s<60){await new Promise((l)=>setTimeout(l,3000));try{let l=await j.request({service:"ssm",region:Q,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":"AmazonSSM.GetCommandInvocation"},body:JSON.stringify({CommandId:FJ,InstanceId:f})}),YJ=l?.Status;if(YJ==="Success"){K.succeed("SMTP proxy deployed to EC2");break}else if(YJ==="Failed"||YJ==="Cancelled"||YJ==="TimedOut"){K.fail(`SMTP proxy deploy failed: ${l?.StandardErrorContent||"Unknown"}`);break}}catch{}s++}if(s>=60)K.fail("SMTP proxy deploy timed out")}else K.fail("Failed to send SSM command for SMTP proxy");try{await L.deleteObject({bucket:g,key:"_deploy/smtp-server.js"}),await L.deleteObject({bucket:g,key:"_deploy/smtp-entry.ts"})}catch{}}else if(K.stop(),V)$.debug("SMTP server bundle not found, skipping")}}else if(K.stop(),V)$.debug("No EC2 instance or bucket found, skipping mail server deploy")}catch(w){if(K.fail(`Mail server deployment failed: ${w.message}`),V)$.debug(`Mail server deploy error: ${w.stack}`)}}}let N=S("Deploying frontend to S3...");N.start();try{let{S3Client:z,CloudFormationClient:q}=await import("@stacksjs/ts-cloud"),{readFileSync:A}=await import("fs"),{buildFrontendStatic:W}=await import("../build/frontend-static.js"),K=new z(Q),w=new q(Q),I=`${G}-cloud`,Y=await w.getStackOutputs(I),F=Y.FrontendBucketName;if(!F)N.stop(),console.log("\u26A0 Frontend bucket not found in stack outputs (add storage.public to infrastructure config)");else{let x=await W();await(async(L,j="")=>{await HJ(L,async(P,C)=>{let f=A(P),g=WJ(P),v=C==="index.html"||C.endsWith("/index.html")?"no-cache, no-store, must-revalidate":"public, max-age=31536000, immutable";if(await a(()=>K.putObject({bucket:F,key:C,body:f,contentType:g,cacheControl:v}),`upload ${C}`),V)$.debug(`  Uploaded: ${C}`)})})(x);let M=X.projectPath("bootstrap");if(JJ(M)){let L=A(M);if(await a(()=>K.putObject({bucket:F,key:"install",body:L,contentType:"text/plain",cacheControl:"no-cache, no-store, must-revalidate"}),"upload bootstrap install script"),V)$.debug("  Uploaded bootstrap install script")}let O=Y.publicCloudFrontDistributionId||Y.CloudFrontDistributionId;if(O){if(V)$.debug("  Invalidating CloudFront cache...");let{AWSClient:L}=await import("@stacksjs/ts-cloud");await new L().request({service:"cloudfront",region:"us-east-1",method:"POST",path:`/2020-05-31/distribution/${O}/invalidation`,headers:{"Content-Type":"application/xml"},body:`<?xml version="1.0" encoding="UTF-8"?>
+SERVICEFILE`,
+                "systemctl daemon-reload",
+                "systemctl enable stacks-smtp",
+                "systemctl restart stacks-smtp"
+              ].join(" && "), cmdId = (await awsClient.request({
+                service: "ssm",
+                region,
+                method: "POST",
+                path: "/",
+                headers: { "Content-Type": "application/x-amz-json-1.1", "X-Amz-Target": "AmazonSSM.SendCommand" },
+                body: JSON.stringify({ InstanceIds: [smtpInstanceId], DocumentName: "AWS-RunShellScript", Parameters: { commands: [smtpSsmCommand] }, TimeoutSeconds: 180 })
+              }))?.Command?.CommandId;
+              if (cmdId) {
+                let ssmAttempts = 0;
+                while (ssmAttempts < 60) {
+                  await new Promise((resolve) => setTimeout(resolve, 3000));
+                  try {
+                    const invocation = await awsClient.request({
+                      service: "ssm",
+                      region,
+                      method: "POST",
+                      path: "/",
+                      headers: { "Content-Type": "application/x-amz-json-1.1", "X-Amz-Target": "AmazonSSM.GetCommandInvocation" },
+                      body: JSON.stringify({ CommandId: cmdId, InstanceId: smtpInstanceId })
+                    }), status = invocation?.Status;
+                    if (status === "Success") {
+                      smtpSpinner.succeed("SMTP proxy deployed to EC2");
+                      break;
+                    } else if (status === "Failed" || status === "Cancelled" || status === "TimedOut") {
+                      smtpSpinner.fail(`SMTP proxy deploy failed: ${invocation?.StandardErrorContent || "Unknown"}`);
+                      break;
+                    }
+                  } catch {}
+                  ssmAttempts++;
+                }
+                if (ssmAttempts >= 60)
+                  smtpSpinner.fail("SMTP proxy deploy timed out");
+              } else
+                smtpSpinner.fail("Failed to send SSM command for SMTP proxy");
+              try {
+                await s3.deleteObject({ bucket: smtpBucketName, key: "_deploy/smtp-server.js" });
+                await s3.deleteObject({ bucket: smtpBucketName, key: "_deploy/smtp-entry.ts" });
+              } catch {}
+            } else {
+              smtpSpinner.stop();
+              if (isVerbose)
+                log.debug("SMTP server bundle not found, skipping");
+            }
+          }
+        } else {
+          smtpSpinner.stop();
+          if (isVerbose)
+            log.debug("No EC2 instance or bucket found, skipping mail server deploy");
+        }
+      } catch (smtpDeployError) {
+        smtpSpinner.fail(`Mail server deployment failed: ${smtpDeployError.message}`);
+        if (isVerbose)
+          log.debug(`Mail server deploy error: ${smtpDeployError.stack}`);
+      }
+    }
+  }
+  const frontendSpinner = spinner("Deploying frontend to S3...");
+  frontendSpinner.start();
+  try {
+    const { S3Client, CloudFormationClient } = await import("@stacksjs/ts-cloud"), { readFileSync } = await import("node:fs"), { buildFrontendStatic } = await import("../build/frontend-static"), s3 = new S3Client(region), cf = new CloudFormationClient(region), stackName = `${projectName}-cloud`, stackOutputs = await cf.getStackOutputs(stackName), bucketName = stackOutputs.FrontendBucketName;
+    if (!bucketName) {
+      frontendSpinner.stop();
+      console.log("\u26A0 Frontend bucket not found in stack outputs (add storage.public to infrastructure config)");
+    } else {
+      const buildDir = await buildFrontendStatic();
+      await (async (dir, _prefix = "") => {
+        await traverseDirectory(dir, async (filePath, key) => {
+          const content = readFileSync(filePath), contentType = getMimeType(filePath), cacheControl = key === "index.html" || key.endsWith("/index.html") ? "no-cache, no-store, must-revalidate" : "public, max-age=31536000, immutable";
+          await withS3Retry(() => s3.putObject({ bucket: bucketName, key, body: content, contentType, cacheControl }), `upload ${key}`);
+          if (isVerbose)
+            log.debug(`  Uploaded: ${key}`);
+        });
+      })(buildDir);
+      const bootstrapPath = p.projectPath("bootstrap");
+      if (existsSync(bootstrapPath)) {
+        const bootstrapContent = readFileSync(bootstrapPath);
+        await withS3Retry(() => s3.putObject({
+          bucket: bucketName,
+          key: "install",
+          body: bootstrapContent,
+          contentType: "text/plain",
+          cacheControl: "no-cache, no-store, must-revalidate"
+        }), "upload bootstrap install script");
+        if (isVerbose)
+          log.debug("  Uploaded bootstrap install script");
+      }
+      const distributionId = stackOutputs.publicCloudFrontDistributionId || stackOutputs.CloudFrontDistributionId;
+      if (distributionId) {
+        if (isVerbose)
+          log.debug("  Invalidating CloudFront cache...");
+        const { AWSClient } = await import("@stacksjs/ts-cloud");
+        await new AWSClient().request({
+          service: "cloudfront",
+          region: "us-east-1",
+          method: "POST",
+          path: `/2020-05-31/distribution/${distributionId}/invalidation`,
+          headers: {
+            "Content-Type": "application/xml"
+          },
+          body: `<?xml version="1.0" encoding="UTF-8"?>
 <InvalidationBatch xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">
   <CallerReference>${Date.now()}</CallerReference>
   <Paths>
@@ -222,27 +1175,131 @@ SERVICEFILE`,"systemctl daemon-reload","systemctl enable stacks-smtp","systemctl
       <Path>/*</Path>
     </Items>
   </Paths>
-</InvalidationBatch>`})}N.succeed(`Frontend deployed to S3 (${F})`)}}catch(z){if(N.fail(`Frontend deployment failed: ${z.message}`),V)$.debug(`Frontend error: ${z.stack}`)}let QJ=X.projectPath("dist/docs/.bunpress"),{existsSync:UJ}=await import("fs");if(UJ(QJ)){let z=S("Deploying documentation to S3...");z.start();try{let{S3Client:q,CloudFormationClient:A}=await import("@stacksjs/ts-cloud"),{readFileSync:W}=await import("fs"),K=new q(Q),w=new A(Q),I=`${G}-cloud`,Y=await w.getStackOutputs(I),F=Y.DocsBucketName;if(!F)z.stop(),console.log("\u26A0 Docs bucket not found in stack outputs (infrastructure may not be updated yet)");else{await(async(M,O="")=>{await HJ(M,async(L,j)=>{let P=W(L),C=WJ(L),f=j.endsWith(".html")?"no-cache, no-store, must-revalidate":"public, max-age=31536000, immutable";if(await a(()=>K.putObject({bucket:F,key:j,body:P,contentType:C,cacheControl:f}),`upload docs ${j}`),V)$.debug(`  Uploaded docs: ${j}`)},"",[".DS_Store",".bunpress"])})(QJ);let E=Y.docsCloudFrontDistributionId||Y.publicCloudFrontDistributionId||Y.CloudFrontDistributionId;if(E){if(V)$.debug("  Invalidating CloudFront cache for docs...");let{AWSClient:M}=await import("@stacksjs/ts-cloud"),O=new M,L=Y.docsCloudFrontDistributionId?["/*"]:["/docs","/docs/*"];await O.request({service:"cloudfront",region:"us-east-1",method:"POST",path:`/2020-05-31/distribution/${E}/invalidation`,headers:{"Content-Type":"application/xml"},body:`<?xml version="1.0" encoding="UTF-8"?>
+</InvalidationBatch>`
+        });
+      }
+      frontendSpinner.succeed(`Frontend deployed to S3 (${bucketName})`);
+    }
+  } catch (frontendError) {
+    frontendSpinner.fail(`Frontend deployment failed: ${frontendError.message}`);
+    if (isVerbose)
+      log.debug(`Frontend error: ${frontendError.stack}`);
+  }
+  const docsDistPath = p.projectPath("dist/docs/.bunpress"), { existsSync: docsExists } = await import("node:fs");
+  if (docsExists(docsDistPath)) {
+    const docsDeploySpinner = spinner("Deploying documentation to S3...");
+    docsDeploySpinner.start();
+    try {
+      const { S3Client, CloudFormationClient } = await import("@stacksjs/ts-cloud"), { readFileSync } = await import("node:fs"), s3 = new S3Client(region), cf = new CloudFormationClient(region), stackName = `${projectName}-cloud`, docsOutputs = await cf.getStackOutputs(stackName), docsBucketName = docsOutputs.DocsBucketName;
+      if (!docsBucketName) {
+        docsDeploySpinner.stop();
+        console.log("\u26A0 Docs bucket not found in stack outputs (infrastructure may not be updated yet)");
+      } else {
+        await (async (dir, _prefix = "") => {
+          await traverseDirectory(dir, async (filePath, key) => {
+            const content = readFileSync(filePath), contentType = getMimeType(filePath), cacheControl = key.endsWith(".html") ? "no-cache, no-store, must-revalidate" : "public, max-age=31536000, immutable";
+            await withS3Retry(() => s3.putObject({ bucket: docsBucketName, key, body: content, contentType, cacheControl }), `upload docs ${key}`);
+            if (isVerbose)
+              log.debug(`  Uploaded docs: ${key}`);
+          }, "", [".DS_Store", ".bunpress"]);
+        })(docsDistPath);
+        const docsDistributionId = docsOutputs.docsCloudFrontDistributionId || docsOutputs.publicCloudFrontDistributionId || docsOutputs.CloudFrontDistributionId;
+        if (docsDistributionId) {
+          if (isVerbose)
+            log.debug("  Invalidating CloudFront cache for docs...");
+          const { AWSClient } = await import("@stacksjs/ts-cloud"), client = new AWSClient, docsInvalidationPaths = docsOutputs.docsCloudFrontDistributionId ? ["/*"] : ["/docs", "/docs/*"];
+          await client.request({
+            service: "cloudfront",
+            region: "us-east-1",
+            method: "POST",
+            path: `/2020-05-31/distribution/${docsDistributionId}/invalidation`,
+            headers: {
+              "Content-Type": "application/xml"
+            },
+            body: `<?xml version="1.0" encoding="UTF-8"?>
 <InvalidationBatch xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">
   <CallerReference>docs-${Date.now()}</CallerReference>
   <Paths>
-    <Quantity>${L.length}</Quantity>
+    <Quantity>${docsInvalidationPaths.length}</Quantity>
     <Items>
-      ${L.map((j)=>`<Path>${j}</Path>`).join(`
+      ${docsInvalidationPaths.map((path) => `<Path>${path}</Path>`).join(`
       `)}
     </Items>
   </Paths>
-</InvalidationBatch>`})}z.succeed(`Documentation deployed to S3 (${F})`)}}catch(q){if(z.fail(`Documentation deployment failed: ${q.message}`),V)$.debug(`Docs deploy error: ${q.stack}`)}}else if(V)$.debug("No docs build found at dist/docs, skipping docs deployment");let o=X.projectPath("dist/blog"),{existsSync:r}=await import("fs");if(r(o)){let z=S("Deploying blog to S3...");z.start();try{let{S3Client:q,CloudFormationClient:A}=await import("@stacksjs/ts-cloud"),{readFileSync:W}=await import("fs"),K=new q(Q),w=new A(Q),I=`${G}-cloud`,Y=await w.getStackOutputs(I),F=Y.BlogBucketName;if(!F)z.stop(),console.log("\u26A0 Blog bucket not found in stack outputs");else{await HJ(o,async(E,M)=>{let O=W(E),L=WJ(E),j=M.endsWith(".html")?"no-cache, no-store, must-revalidate":"public, max-age=31536000, immutable";if(await a(()=>K.putObject({bucket:F,key:M,body:O,contentType:L,cacheControl:j}),`upload blog ${M}`),V)$.debug(`  Uploaded blog: ${M}`)},"",[".DS_Store"]);let x=Y.blogCloudFrontDistributionId||Y.publicCloudFrontDistributionId||Y.CloudFrontDistributionId;if(x){if(V)$.debug("  Invalidating CloudFront cache for blog...");let{AWSClient:E}=await import("@stacksjs/ts-cloud"),M=new E,O=Y.blogCloudFrontDistributionId?["/*"]:["/blog","/blog/*"];await M.request({service:"cloudfront",region:"us-east-1",method:"POST",path:`/2020-05-31/distribution/${x}/invalidation`,headers:{"Content-Type":"application/xml"},body:`<?xml version="1.0" encoding="UTF-8"?>
+</InvalidationBatch>`
+          });
+        }
+        docsDeploySpinner.succeed(`Documentation deployed to S3 (${docsBucketName})`);
+      }
+    } catch (docsDeployError) {
+      docsDeploySpinner.fail(`Documentation deployment failed: ${docsDeployError.message}`);
+      if (isVerbose)
+        log.debug(`Docs deploy error: ${docsDeployError.stack}`);
+    }
+  } else if (isVerbose)
+    log.debug("No docs build found at dist/docs, skipping docs deployment");
+  const blogDistPath = p.projectPath("dist/blog"), { existsSync: blogExists } = await import("node:fs");
+  if (blogExists(blogDistPath)) {
+    const blogDeploySpinner = spinner("Deploying blog to S3...");
+    blogDeploySpinner.start();
+    try {
+      const { S3Client: BlogS3Client, CloudFormationClient: BlogCFClient } = await import("@stacksjs/ts-cloud"), { readFileSync: readBlogFile } = await import("node:fs"), blogS3 = new BlogS3Client(region), blogCf = new BlogCFClient(region), stackName = `${projectName}-cloud`, outputs = await blogCf.getStackOutputs(stackName), blogBucketName = outputs.BlogBucketName;
+      if (!blogBucketName) {
+        blogDeploySpinner.stop();
+        console.log("\u26A0 Blog bucket not found in stack outputs");
+      } else {
+        await traverseDirectory(blogDistPath, async (filePath, key) => {
+          const content = readBlogFile(filePath), contentType = getMimeType(filePath), cacheControl = key.endsWith(".html") ? "no-cache, no-store, must-revalidate" : "public, max-age=31536000, immutable";
+          await withS3Retry(() => blogS3.putObject({ bucket: blogBucketName, key, body: content, contentType, cacheControl }), `upload blog ${key}`);
+          if (isVerbose)
+            log.debug(`  Uploaded blog: ${key}`);
+        }, "", [".DS_Store"]);
+        const blogDistributionId = outputs.blogCloudFrontDistributionId || outputs.publicCloudFrontDistributionId || outputs.CloudFrontDistributionId;
+        if (blogDistributionId) {
+          if (isVerbose)
+            log.debug("  Invalidating CloudFront cache for blog...");
+          const { AWSClient: BlogAWSClient } = await import("@stacksjs/ts-cloud"), blogClient = new BlogAWSClient, blogInvalidationPaths = outputs.blogCloudFrontDistributionId ? ["/*"] : ["/blog", "/blog/*"];
+          await blogClient.request({
+            service: "cloudfront",
+            region: "us-east-1",
+            method: "POST",
+            path: `/2020-05-31/distribution/${blogDistributionId}/invalidation`,
+            headers: {
+              "Content-Type": "application/xml"
+            },
+            body: `<?xml version="1.0" encoding="UTF-8"?>
 <InvalidationBatch xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">
   <CallerReference>blog-${Date.now()}</CallerReference>
   <Paths>
-    <Quantity>${O.length}</Quantity>
+    <Quantity>${blogInvalidationPaths.length}</Quantity>
     <Items>
-      ${O.map((L)=>`<Path>${L}</Path>`).join(`
+      ${blogInvalidationPaths.map((path) => `<Path>${path}</Path>`).join(`
       `)}
     </Items>
   </Paths>
-</InvalidationBatch>`})}z.succeed(`Blog deployed to S3 (${F})`)}}catch(q){if(z.fail(`Blog deployment failed: ${q.message}`),V)$.debug(`Blog deploy error: ${q.stack}`)}}else if(V)$.debug("No blog build found at dist/blog, skipping blog deployment");let n=S("Configuring 404 error page...");n.start();try{let{S3Client:z,CloudFormationClient:q,AWSClient:A}=await import("@stacksjs/ts-cloud"),{existsSync:W,readFileSync:K}=await import("fs"),w=new z(Q),I=new q(Q),Y=new A,F=`${G}-cloud`,x=await I.getStackOutputs(F),E=x.FrontendBucketName,M=x.DocsBucketName,O=x.publicCloudFrontDistributionId||x.CloudFrontDistributionId,L=X.projectPath("dist/docs/.bunpress/404.html"),j;if(W(L)){if(j=K(L,"utf-8"),V)$.debug("  Using BunPress-generated 404.html")}else if(j=`<!DOCTYPE html>
+</InvalidationBatch>`
+          });
+        }
+        blogDeploySpinner.succeed(`Blog deployed to S3 (${blogBucketName})`);
+      }
+    } catch (blogDeployError) {
+      blogDeploySpinner.fail(`Blog deployment failed: ${blogDeployError.message}`);
+      if (isVerbose)
+        log.debug(`Blog deploy error: ${blogDeployError.stack}`);
+    }
+  } else if (isVerbose)
+    log.debug("No blog build found at dist/blog, skipping blog deployment");
+  const errorPageSpinner = spinner("Configuring 404 error page...");
+  errorPageSpinner.start();
+  try {
+    const { S3Client, CloudFormationClient, AWSClient } = await import("@stacksjs/ts-cloud"), { existsSync: exists404, readFileSync: read404 } = await import("node:fs"), s3 = new S3Client(region), cf = new CloudFormationClient(region), awsClient = new AWSClient, stackName = `${projectName}-cloud`, outputs = await cf.getStackOutputs(stackName), frontendBucket = outputs.FrontendBucketName, docsBucket = outputs.DocsBucketName, distributionId = outputs.publicCloudFrontDistributionId || outputs.CloudFrontDistributionId, docs404Path = p.projectPath("dist/docs/.bunpress/404.html");
+    let html404Content;
+    if (exists404(docs404Path)) {
+      html404Content = read404(docs404Path, "utf-8");
+      if (isVerbose)
+        log.debug("  Using BunPress-generated 404.html");
+    } else {
+      html404Content = `<!DOCTYPE html>
 <html lang="en">
 <head>
   <meta charset="UTF-8">
@@ -289,12 +1346,229 @@ SERVICEFILE`,"systemctl daemon-reload","systemctl enable stacks-smtp","systemctl
     <div class="action"><a class="link" href="/docs/">Take me home</a></div>
   </div>
 </body>
-</html>`,V)$.debug("  Using default 404.html template");if(E){if(await a(()=>w.putObject({bucket:E,key:"404.html",body:j,contentType:"text/html",cacheControl:"no-cache, no-store, must-revalidate"}),"upload 404.html to frontend bucket"),V)$.debug(`  Uploaded 404.html to frontend bucket: ${E}`)}if(M){if(await a(()=>w.putObject({bucket:M,key:"404.html",body:j,contentType:"text/html",cacheControl:"no-cache, no-store, must-revalidate"}),"upload 404.html to docs bucket"),V)$.debug(`  Uploaded 404.html to docs bucket: ${M}`)}if(O){if(V)$.debug("  Configuring CloudFront custom error responses...");let P=await Y.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${O}/config`,returnHeaders:!0}),C=P.headers?.etag||P.headers?.ETag||"",f=P.body?.DistributionConfig||P.DistributionConfig;if(f&&C){if(!((f.CustomErrorResponses?.Quantity||0)>0&&f.CustomErrorResponses?.Items?.CustomErrorResponse?.some?.((m)=>m.ErrorCode===404&&m.ResponsePagePath==="/404.html"))){f.CustomErrorResponses={Quantity:2,Items:{CustomErrorResponse:[{ErrorCode:403,ResponsePagePath:"/404.html",ResponseCode:404,ErrorCachingMinTTL:10},{ErrorCode:404,ResponsePagePath:"/404.html",ResponseCode:404,ErrorCachingMinTTL:10}]}};let m=(D,h,R="")=>{if(h===null||h===void 0)return"";if(typeof h==="boolean")return`${R}<${D}>${h}</${D}>
-`;if(typeof h==="number"||typeof h==="string")return`${R}<${D}>${h}</${D}>
-`;if(Array.isArray(h))return h.map((B)=>m(D,B,R)).join("");if(typeof h==="object"){if(D.startsWith("@_")||D==="?xml")return"";let B="";for(let[d,t]of Object.entries(h))if(!d.startsWith("@_")&&d!=="#text")B+=m(d,t,`${R}  `);if(h["#text"]!==void 0)return`${R}<${D}>${h["#text"]}</${D}>
-`;return`${R}<${D}>
-${B}${R}</${D}>
-`}return""},p=`<?xml version="1.0" encoding="UTF-8"?>
+</html>`;
+      if (isVerbose)
+        log.debug("  Using default 404.html template");
+    }
+    if (frontendBucket) {
+      await withS3Retry(() => s3.putObject({
+        bucket: frontendBucket,
+        key: "404.html",
+        body: html404Content,
+        contentType: "text/html",
+        cacheControl: "no-cache, no-store, must-revalidate"
+      }), "upload 404.html to frontend bucket");
+      if (isVerbose)
+        log.debug(`  Uploaded 404.html to frontend bucket: ${frontendBucket}`);
+    }
+    if (docsBucket) {
+      await withS3Retry(() => s3.putObject({
+        bucket: docsBucket,
+        key: "404.html",
+        body: html404Content,
+        contentType: "text/html",
+        cacheControl: "no-cache, no-store, must-revalidate"
+      }), "upload 404.html to docs bucket");
+      if (isVerbose)
+        log.debug(`  Uploaded 404.html to docs bucket: ${docsBucket}`);
+    }
+    if (distributionId) {
+      if (isVerbose)
+        log.debug("  Configuring CloudFront custom error responses...");
+      const getResult = await awsClient.request({
+        service: "cloudfront",
+        region: "us-east-1",
+        method: "GET",
+        path: `/2020-05-31/distribution/${distributionId}/config`,
+        returnHeaders: !0
+      }), etag = getResult.headers?.etag || getResult.headers?.ETag || "", currentConfig = getResult.body?.DistributionConfig || getResult.DistributionConfig;
+      if (currentConfig && etag) {
+        if (!((currentConfig.CustomErrorResponses?.Quantity || 0) > 0 && currentConfig.CustomErrorResponses?.Items?.CustomErrorResponse?.some?.((err) => err.ErrorCode === 404 && err.ResponsePagePath === "/404.html"))) {
+          currentConfig.CustomErrorResponses = {
+            Quantity: 2,
+            Items: {
+              CustomErrorResponse: [
+                {
+                  ErrorCode: 403,
+                  ResponsePagePath: "/404.html",
+                  ResponseCode: 404,
+                  ErrorCachingMinTTL: 10
+                },
+                {
+                  ErrorCode: 404,
+                  ResponsePagePath: "/404.html",
+                  ResponseCode: 404,
+                  ErrorCachingMinTTL: 10
+                }
+              ]
+            }
+          };
+          const buildXmlElement = (name, value, indent = "") => {
+            if (value === null || value === void 0)
+              return "";
+            if (typeof value === "boolean")
+              return `${indent}<${name}>${value}</${name}>
+`;
+            if (typeof value === "number" || typeof value === "string")
+              return `${indent}<${name}>${value}</${name}>
+`;
+            if (Array.isArray(value))
+              return value.map((item) => buildXmlElement(name, item, indent)).join("");
+            if (typeof value === "object") {
+              if (name.startsWith("@_") || name === "?xml")
+                return "";
+              let children = "";
+              for (const [key, val] of Object.entries(value))
+                if (!key.startsWith("@_") && key !== "#text")
+                  children += buildXmlElement(key, val, `${indent}  `);
+              if (value["#text"] !== void 0)
+                return `${indent}<${name}>${value["#text"]}</${name}>
+`;
+              return `${indent}<${name}>
+${children}${indent}</${name}>
+`;
+            }
+            return "";
+          }, xml = `<?xml version="1.0" encoding="UTF-8"?>
 <DistributionConfig xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">
-${Object.entries(f).filter(([D])=>!D.startsWith("@_")).map(([D,h])=>m(D,h,"  ")).join("")}</DistributionConfig>
-`;if(await Y.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${O}/config`,body:p,headers:{"Content-Type":"application/xml","If-Match":C}}),V)$.debug("  CloudFront custom error responses configured")}else if(V)$.debug("  CloudFront custom error responses already configured")}}n.succeed("404 error page configured")}catch(z){if(n.stop(),console.log(`\u26A0 404 page configuration skipped: ${z.message}`),V)$.debug(`Error page config error: ${z.stack}`)}try{let z=await import(X.projectPath("config/cloud")),q=z?.tsCloud?.infrastructure?.tunnel;if(q?.enabled){let A=q.domain||"";if(!A||A==="localtunnel.dev"||A==="api.localtunnel.dev")console.log("\u2139 Tunnel: Using shared localtunnel.dev (no custom tunnel deployment needed)");else{let W=S(`Deploying tunnel server to ${A}...`);W.start();try{let{deployTunnelServer:K}=await import("@stacksjs/tunnel");await K({domain:A,region:q.region||z?.tsCloud?.project?.region||"us-east-1",instanceType:q.instanceType,prefix:q.prefix,enableSsl:q.ssl?.enabled,porkbunApiKey:q.ssl?.porkbunApiKey,porkbunSecretKey:q.ssl?.porkbunSecretKey,verbose:V}),W.succeed(`Tunnel server deployed to ${A}`)}catch(K){if(W.stop(),console.log(`\u26A0 Tunnel deployment skipped: ${K.message}`),V)$.debug(`Tunnel deploy error: ${K.stack}`)}}}}catch{}let VJ=S("Reconciling DNS records...");VJ.start();try{let{Route53Client:z,CloudFormationClient:q}=await import("@stacksjs/ts-cloud"),A=new q(Q),W=`${G}-cloud`,K=await A.getStackOutputs(W),w=await import(X.projectPath("config/cloud")),I=w?.tsCloud?.infrastructure?.dns?.hostedZoneId,Y=w?.tsCloud?.infrastructure?.dns?.domain||"stacksjs.com";if(I){let F=new z(Q),x="Z2FDTNDATAQYW2",E=[{domain:Y,cfDomain:K.publicCloudFrontDomain},{domain:`www.${Y}`,cfDomain:K.publicCloudFrontDomain},{domain:`docs.${Y}`,cfDomain:K.docsCloudFrontDomain},{domain:`blog.${Y}`,cfDomain:K.blogCloudFrontDomain}],M=0;for(let{domain:O,cfDomain:L}of E){if(!L)continue;try{if(!((await F.listResourceRecordSets({HostedZoneId:I,StartRecordName:O,StartRecordType:"A",MaxItems:"1"}))?.ResourceRecordSets||[]).some((f)=>f.Name===`${O}.`&&f.Type==="A")){if(await F.changeResourceRecordSets({HostedZoneId:I,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:O,Type:"A",AliasTarget:{HostedZoneId:"Z2FDTNDATAQYW2",DNSName:L,EvaluateTargetHealth:!1}}},{Action:"UPSERT",ResourceRecordSet:{Name:O,Type:"AAAA",AliasTarget:{HostedZoneId:"Z2FDTNDATAQYW2",DNSName:L,EvaluateTargetHealth:!1}}}]}}),M++,V)$.debug(`  Created DNS records: ${O} -> ${L}`)}else if(V)$.debug(`  DNS record exists: ${O}`)}catch(j){if(V)$.debug(`  DNS check/create failed for ${O}: ${j.message}`)}}if(M>0)VJ.succeed(`DNS records reconciled (${M} created)`);else VJ.succeed("DNS records verified")}else if(VJ.stop(),V)$.debug("No hosted zone ID configured, skipping DNS reconciliation")}catch(z){if(VJ.stop(),console.log(`\u26A0 DNS reconciliation skipped: ${z.message}`),V)$.debug(`DNS error: ${z.stack}`)}console.log(""),$.success("Deployment completed successfully!")}catch(J){$.error("Deployment failed:",J),T.exit(EJ.FatalError)}
+${Object.entries(currentConfig).filter(([key]) => !key.startsWith("@_")).map(([key, val]) => buildXmlElement(key, val, "  ")).join("")}</DistributionConfig>
+`;
+          await awsClient.request({
+            service: "cloudfront",
+            region: "us-east-1",
+            method: "PUT",
+            path: `/2020-05-31/distribution/${distributionId}/config`,
+            body: xml,
+            headers: {
+              "Content-Type": "application/xml",
+              "If-Match": etag
+            }
+          });
+          if (isVerbose)
+            log.debug("  CloudFront custom error responses configured");
+        } else if (isVerbose)
+          log.debug("  CloudFront custom error responses already configured");
+      }
+    }
+    errorPageSpinner.succeed("404 error page configured");
+  } catch (errorPageError) {
+    errorPageSpinner.stop();
+    console.log(`\u26A0 404 page configuration skipped: ${errorPageError.message}`);
+    if (isVerbose)
+      log.debug(`Error page config error: ${errorPageError.stack}`);
+  }
+  try {
+    const tunnelCloudConfig = await import(p.projectPath("config/cloud")), tunnelConfig = tunnelCloudConfig?.tsCloud?.infrastructure?.tunnel;
+    if (tunnelConfig?.enabled) {
+      const tunnelDomain = tunnelConfig.domain || "";
+      if (!tunnelDomain || tunnelDomain === "localtunnel.dev" || tunnelDomain === "api.localtunnel.dev")
+        console.log("\u2139 Tunnel: Using shared localtunnel.dev (no custom tunnel deployment needed)");
+      else {
+        const tunnelSpinner = spinner(`Deploying tunnel server to ${tunnelDomain}...`);
+        tunnelSpinner.start();
+        try {
+          const { deployTunnelServer } = await import("@stacksjs/tunnel");
+          await deployTunnelServer({
+            domain: tunnelDomain,
+            region: tunnelConfig.region || tunnelCloudConfig?.tsCloud?.project?.region || "us-east-1",
+            instanceType: tunnelConfig.instanceType,
+            prefix: tunnelConfig.prefix,
+            enableSsl: tunnelConfig.ssl?.enabled,
+            porkbunApiKey: tunnelConfig.ssl?.porkbunApiKey,
+            porkbunSecretKey: tunnelConfig.ssl?.porkbunSecretKey,
+            verbose: isVerbose
+          });
+          tunnelSpinner.succeed(`Tunnel server deployed to ${tunnelDomain}`);
+        } catch (tunnelError) {
+          tunnelSpinner.stop();
+          console.log(`\u26A0 Tunnel deployment skipped: ${tunnelError.message}`);
+          if (isVerbose)
+            log.debug(`Tunnel deploy error: ${tunnelError.stack}`);
+        }
+      }
+    }
+  } catch {}
+  const dnsSpinner = spinner("Reconciling DNS records...");
+  dnsSpinner.start();
+  try {
+    const { Route53Client, CloudFormationClient: DnsCfClient } = await import("@stacksjs/ts-cloud"), dnsCf = new DnsCfClient(region), dnsStackName = `${projectName}-cloud`, dnsOutputs = await dnsCf.getStackOutputs(dnsStackName), dnsCloudConfig = await import(p.projectPath("config/cloud")), hostedZoneId = dnsCloudConfig?.tsCloud?.infrastructure?.dns?.hostedZoneId, siteDomain = dnsCloudConfig?.tsCloud?.infrastructure?.dns?.domain || "stacksjs.com";
+    if (hostedZoneId) {
+      const route53 = new Route53Client(region), cfHostedZoneId = "Z2FDTNDATAQYW2", domainMappings = [
+        { domain: siteDomain, cfDomain: dnsOutputs.publicCloudFrontDomain },
+        { domain: `www.${siteDomain}`, cfDomain: dnsOutputs.publicCloudFrontDomain },
+        { domain: `docs.${siteDomain}`, cfDomain: dnsOutputs.docsCloudFrontDomain },
+        { domain: `blog.${siteDomain}`, cfDomain: dnsOutputs.blogCloudFrontDomain }
+      ];
+      let recordsCreated = 0;
+      for (const { domain, cfDomain } of domainMappings) {
+        if (!cfDomain)
+          continue;
+        try {
+          if (!((await route53.listResourceRecordSets({
+            HostedZoneId: hostedZoneId,
+            StartRecordName: domain,
+            StartRecordType: "A",
+            MaxItems: "1"
+          }))?.ResourceRecordSets || []).some((r) => r.Name === `${domain}.` && r.Type === "A")) {
+            await route53.changeResourceRecordSets({
+              HostedZoneId: hostedZoneId,
+              ChangeBatch: {
+                Changes: [
+                  {
+                    Action: "UPSERT",
+                    ResourceRecordSet: {
+                      Name: domain,
+                      Type: "A",
+                      AliasTarget: {
+                        HostedZoneId: cfHostedZoneId,
+                        DNSName: cfDomain,
+                        EvaluateTargetHealth: !1
+                      }
+                    }
+                  },
+                  {
+                    Action: "UPSERT",
+                    ResourceRecordSet: {
+                      Name: domain,
+                      Type: "AAAA",
+                      AliasTarget: {
+                        HostedZoneId: cfHostedZoneId,
+                        DNSName: cfDomain,
+                        EvaluateTargetHealth: !1
+                      }
+                    }
+                  }
+                ]
+              }
+            });
+            recordsCreated++;
+            if (isVerbose)
+              log.debug(`  Created DNS records: ${domain} -> ${cfDomain}`);
+          } else if (isVerbose)
+            log.debug(`  DNS record exists: ${domain}`);
+        } catch (dnsErr) {
+          if (isVerbose)
+            log.debug(`  DNS check/create failed for ${domain}: ${dnsErr.message}`);
+        }
+      }
+      if (recordsCreated > 0)
+        dnsSpinner.succeed(`DNS records reconciled (${recordsCreated} created)`);
+      else
+        dnsSpinner.succeed("DNS records verified");
+    } else {
+      dnsSpinner.stop();
+      if (isVerbose)
+        log.debug("No hosted zone ID configured, skipping DNS reconciliation");
+    }
+  } catch (dnsError) {
+    dnsSpinner.stop();
+    console.log(`\u26A0 DNS reconciliation skipped: ${dnsError.message}`);
+    if (isVerbose)
+      log.debug(`DNS error: ${dnsError.stack}`);
+  }
+  console.log("");
+  log.success("Deployment completed successfully!");
+} catch (error) {
+  log.error("Deployment failed:", error);
+  process.exit(ExitCode.FatalError);
+}