@stacksjs/actions 0.70.88 → 0.70.90

package/dist/deploy/index.js

@@ -0,0 +1,1574 @@
+import { existsSync, readFileSync, statSync } from "node:fs";
+import process from "node:process";
+import { runCommand, spinner } from "@stacksjs/cli";
+import { config } from "@stacksjs/config";
+import { path as p } from "@stacksjs/path";
+import { storage } from "@stacksjs/storage";
+import { ExitCode } from "@stacksjs/types";
+const log = {
+  debug: (...args) => {
+    if (process.argv.includes("--verbose") || process.argv.includes("-v"))
+      console.log("\uD83D\uDD0D", ...args);
+  },
+  success: (...args) => console.log("\u2713", ...args),
+  error: (...args) => console.error("\u2717", ...args)
+}, MAIL_PACKAGE_DOMAIN = "github.com/mail-os/mail", MAIL_PACKAGE_SPEC = `${MAIL_PACKAGE_DOMAIN}@0.1.0`, MAIL_TARGET_PLATFORM = "linux-x86_64", MAIL_BINARY_NAMES = ["mail", "mail-x86_64-linux", "mail-x86_64-linux-gnu"], isVerbose = process.argv.includes("--verbose") || process.argv.includes("-v");
+async function collectMatchingFiles(root, names, maxDepth = 8) {
+  const { existsSync, readdirSync, statSync } = await import("node:fs"), { join, basename } = await import("node:path"), nameSet = new Set(names), matches = [];
+  if (!existsSync(root))
+    return matches;
+  function walk(dir, depth) {
+    if (depth > maxDepth)
+      return;
+    for (const entry of readdirSync(dir)) {
+      if (entry === ".git" || entry === "node_modules")
+        continue;
+      const fullPath = join(dir, entry), stat = statSync(fullPath);
+      if (stat.isDirectory())
+        walk(fullPath, depth + 1);
+      else if (stat.isFile() && nameSet.has(basename(fullPath)))
+        matches.push(fullPath);
+    }
+  }
+  walk(root, 0);
+  return matches;
+}
+async function isElfBinary(filePath) {
+  const { readFileSync } = await import("node:fs"), header = readFileSync(filePath).slice(0, 4);
+  return header[0] === 127 && header[1] === 69 && header[2] === 76 && header[3] === 70;
+}
+async function resolvePantryInstallCommand() {
+  const { existsSync } = await import("node:fs"), localPantryCli = `${process.env.HOME}/Code/Tools/pantry/packages/ts-pantry/bin/cli.ts`;
+  if (existsSync(localPantryCli))
+    return { command: "bun", args: [localPantryCli] };
+  const projectPantry = p.projectPath("pantry/.bin/pantry");
+  if (existsSync(projectPantry))
+    return { command: projectPantry, args: [] };
+  const globalPantry = `${process.env.HOME}/.local/share/pantry/global/bin/pantry`;
+  if (existsSync(globalPantry))
+    return { command: globalPantry, args: [] };
+  return { command: "pantry", args: [] };
+}
+async function installMailBinaryWithPantry() {
+  const { execFileSync } = await import("node:child_process"), installDir = p.projectPath("pantry"), pantry = await resolvePantryInstallCommand();
+  execFileSync(pantry.command, [
+    ...pantry.args,
+    "install",
+    MAIL_PACKAGE_SPEC,
+    "--install-dir",
+    installDir,
+    "--platform",
+    MAIL_TARGET_PLATFORM,
+    "--quiet"
+  ], {
+    cwd: p.projectPath(),
+    stdio: isVerbose ? "inherit" : "pipe",
+    env: process.env
+  });
+}
+async function findPantryMailBinary() {
+  const { existsSync } = await import("node:fs"), { join } = await import("node:path"), pantryRoots = [
+    p.projectPath("pantry"),
+    `${process.env.HOME}/.local/share/pantry`
+  ], directCandidates = [
+    ...MAIL_BINARY_NAMES.map((name) => p.projectPath(`pantry/.bin/${name}`)),
+    ...MAIL_BINARY_NAMES.map((name) => join(`${process.env.HOME}/.local/share/pantry/global/bin`, name))
+  ];
+  for (const candidate of directCandidates)
+    if (existsSync(candidate) && await isElfBinary(candidate))
+      return candidate;
+  for (const root of pantryRoots) {
+    const candidates = await collectMatchingFiles(root, MAIL_BINARY_NAMES);
+    for (const candidate of candidates)
+      if (await isElfBinary(candidate))
+        return candidate;
+  }
+  return null;
+}
+const MIME_TYPES = {
+  ".html": "text/html",
+  ".css": "text/css",
+  ".js": "application/javascript",
+  ".json": "application/json",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".svg": "image/svg+xml",
+  ".ico": "image/x-icon",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".ttf": "font/ttf",
+  ".eot": "application/vnd.ms-fontobject",
+  ".otf": "font/otf",
+  ".webp": "image/webp",
+  ".mp4": "video/mp4",
+  ".webm": "video/webm",
+  ".mp3": "audio/mpeg",
+  ".wav": "audio/wav",
+  ".pdf": "application/pdf",
+  ".xml": "application/xml",
+  ".txt": "text/plain"
+};
+function getMimeType(filePath) {
+  const dotIndex = filePath.lastIndexOf("."), ext = dotIndex >= 0 ? filePath.slice(dotIndex).toLowerCase() : "";
+  return MIME_TYPES[ext] || "application/octet-stream";
+}
+async function traverseDirectory(dir, callback, prefix = "", skipPatterns = [".DS_Store"]) {
+  const { readdirSync, statSync } = await import("node:fs"), { join } = await import("node:path"), items = readdirSync(dir);
+  for (const item of items) {
+    if (skipPatterns.includes(item))
+      continue;
+    const filePath = join(dir, item), key = prefix ? `${prefix}/${item}` : item;
+    if (statSync(filePath).isDirectory())
+      await traverseDirectory(filePath, callback, key, skipPatterns);
+    else
+      await callback(filePath, key);
+  }
+}
+async function withS3Retry(fn, label = "s3 operation") {
+  const maxRetries = 3;
+  for (let attempt = 0;attempt <= maxRetries; attempt++)
+    try {
+      return await fn();
+    } catch (error) {
+      if (attempt >= maxRetries)
+        throw error;
+      const delay = Math.min(500 * 2 ** attempt + Math.random() * 200, 5000);
+      if (isVerbose)
+        log.debug(`  Retrying ${label} (attempt ${attempt + 2}/${maxRetries + 1}) in ${Math.round(delay)}ms...`);
+      await new Promise((resolve) => setTimeout(resolve, delay));
+    }
+  throw Error(`${label} failed after ${maxRetries + 1} attempts`);
+}
+function normalizeArray(value) {
+  if (!value)
+    return [];
+  return Array.isArray(value) ? value : [value];
+}
+function buildCloudFrontXmlElement(name, value, indent = "") {
+  if (value === null || value === void 0)
+    return "";
+  if (typeof value === "boolean")
+    return `${indent}<${name}>${value}</${name}>
+`;
+  if (typeof value === "number" || typeof value === "string")
+    return `${indent}<${name}>${value}</${name}>
+`;
+  if (Array.isArray(value))
+    return value.map((item) => buildCloudFrontXmlElement(name, item, indent)).join("");
+  if (typeof value === "object") {
+    if (name.startsWith("@_") || name === "?xml")
+      return "";
+    let children = "";
+    for (const [key, val] of Object.entries(value))
+      if (!key.startsWith("@_") && key !== "#text")
+        children += buildCloudFrontXmlElement(key, val, `${indent}  `);
+    if (value["#text"] !== void 0)
+      return `${indent}<${name}>${value["#text"]}</${name}>
+`;
+    return `${indent}<${name}>
+${children}${indent}</${name}>
+`;
+  }
+  return "";
+}
+function buildCloudFrontDistributionConfigXml(config) {
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<DistributionConfig xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">
+${Object.entries(config).filter(([key]) => !key.startsWith("@_")).map(([key, val]) => buildCloudFrontXmlElement(key, val, "  ")).join("")}</DistributionConfig>
+`;
+}
+function firewallOpenCommand(ports) {
+  const uniquePorts = [...new Set(ports)].filter((port) => Number.isFinite(port) && port > 0).sort((a, b) => a - b);
+  if (uniquePorts.length === 0)
+    return "true";
+  return `if command -v firewall-cmd >/dev/null 2>&1; then firewall-cmd --permanent ${uniquePorts.map((port) => `--add-port=${port}/tcp`).join(" ")} && firewall-cmd --reload; fi`;
+}
+async function ensureSecurityGroupPort(ec2, securityGroupId, port) {
+  if (!securityGroupId)
+    return;
+  if (((await ec2.describeSecurityGroups({ GroupIds: [securityGroupId] }))?.SecurityGroups?.[0]?.IpPermissions || []).some((permission) => {
+    return permission.IpProtocol === "tcp" && Number(permission.FromPort) <= port && Number(permission.ToPort) >= port && normalizeArray(permission.IpRanges).some((range) => range.CidrIp === "0.0.0.0/0");
+  }))
+    return;
+  try {
+    await ec2.authorizeSecurityGroupIngress({
+      GroupId: securityGroupId,
+      IpPermissions: [{
+        IpProtocol: "tcp",
+        FromPort: port,
+        ToPort: port,
+        IpRanges: [{ CidrIp: "0.0.0.0/0", Description: `Stacks API port ${port}` }]
+      }]
+    });
+  } catch (error) {
+    if (!String(error?.message || "").includes("InvalidPermission.Duplicate"))
+      throw error;
+  }
+}
+async function ensureCloudFrontApiOriginPort(awsClient, distributionId, port) {
+  if (!distributionId)
+    return;
+  const getResult = await awsClient.request({
+    service: "cloudfront",
+    region: "us-east-1",
+    method: "GET",
+    path: `/2020-05-31/distribution/${distributionId}/config`,
+    returnHeaders: !0
+  }), etag = getResult.headers?.etag || getResult.headers?.ETag || "", currentConfig = getResult.body?.DistributionConfig || getResult.DistributionConfig || getResult.body;
+  if (!etag || !currentConfig?.Origins?.Items)
+    return;
+  const apiOrigin = normalizeArray(currentConfig.Origins.Items.Origin).find((origin) => String(origin.Id || "").includes("-api"));
+  if (!apiOrigin?.CustomOriginConfig)
+    return;
+  if (Number(apiOrigin.CustomOriginConfig.HTTPPort) === port)
+    return;
+  apiOrigin.CustomOriginConfig.HTTPPort = port;
+  await awsClient.request({
+    service: "cloudfront",
+    region: "us-east-1",
+    method: "PUT",
+    path: `/2020-05-31/distribution/${distributionId}/config`,
+    body: buildCloudFrontDistributionConfigXml(currentConfig),
+    headers: {
+      "Content-Type": "application/xml",
+      "If-Match": etag
+    }
+  });
+}
+const frameworkBuildSpinner = spinner("Building framework...");
+frameworkBuildSpinner.start();
+await runCommand("bun run build", {
+  cwd: p.frameworkPath("core"),
+  quiet: !1
+});
+frameworkBuildSpinner.succeed("Framework built");
+const docsDir = p.projectPath("docs"), docsBuildDir = p.projectPath("dist/docs/.bunpress");
+if (storage.hasFiles(docsDir)) {
+  const docsSpinner = spinner("Building documentation with BunPress...");
+  docsSpinner.start();
+  try {
+    const { rm } = await import("node:fs/promises"), localBunpressCli = `${process.env.HOME}/Code/Tools/bunpress/packages/bunpress/bin/cli.ts`, installedBunpressCli = p.projectPath("node_modules/@stacksjs/bunpress/dist/bin/cli.js"), hasLocalBunpress = await Bun.file(localBunpressCli).exists(), hasInstalledBunpress = await Bun.file(installedBunpressCli).exists(), command = hasLocalBunpress ? `bun ${localBunpressCli} build --dir ${docsDir} --outdir ${p.projectPath("dist/docs")}` : hasInstalledBunpress ? `bun ${installedBunpressCli} build --dir ${docsDir} --outdir ${p.projectPath("dist/docs")}` : "bunx @stacksjs/bunpress@0.1.5 build --dir ./docs --outdir ./dist/docs";
+    await rm(docsBuildDir, { recursive: !0, force: !0 });
+    await runCommand(command, {
+      cwd: p.projectPath(),
+      quiet: !isVerbose
+    });
+    docsSpinner.succeed(`Documentation built with BunPress${hasLocalBunpress ? " (local checkout)" : ""}`);
+  } catch (docsError) {
+    docsSpinner.stop();
+    console.log(`\u26A0 Documentation build skipped: ${docsError.message}`);
+    if (isVerbose)
+      log.debug("To build docs manually: cd ~/Code/Tools/bunpress && bun packages/bunpress/bin/cli.ts build --dir /path/to/docs --outdir /path/to/dist/docs");
+  }
+} else if (isVerbose)
+  log.debug("No docs directory found, skipping documentation build");
+const blogDistExists = storage.hasFiles(p.projectPath("dist/blog")), blogFontAssetsExist = [
+  "CampmateScript-Regular.woff2",
+  "SequoiaSans-Regular.woff2",
+  "Switchback-Regular.woff2"
+].every((file) => existsSync(p.projectPath(`dist/blog/assets/fonts/nps/${file}`))), blogImageAssetsExist = [
+  "topography.svg",
+  "park-ridge.svg"
+].every((file) => existsSync(p.projectPath(`dist/blog/assets/images/${file}`))), blogIndexPath = p.projectPath("dist/blog/index.html"), blogIndexHtml = existsSync(blogIndexPath) ? readFileSync(blogIndexPath, "utf8") : "", blogHtmlUsesCurrentFontFormat = blogIndexHtml.length > 0 && !blogIndexHtml.includes("woff2-variations"), blogHtmlUsesCurrentParkTheme = blogIndexHtml.includes("--on-primary") && blogIndexHtml.includes("--newsletter-bg"), blogHtmlUsesCurrentParkImages = blogIndexHtml.includes("topography.svg") && blogIndexHtml.includes("park-ridge.svg"), blogHtmlOmitsRetiredDecorations = !blogIndexHtml.includes("stamp-trail") && !blogIndexHtml.includes("blog-sign-tree.svg"), blogBuilderPath = p.frameworkPath("core/cms/src/build.ts"), blogConfigPath = p.projectPath("config/blog.ts"), blogHtmlIsFresh = existsSync(blogIndexPath) && [blogBuilderPath, blogConfigPath].filter((path) => existsSync(path)).every((path) => statSync(blogIndexPath).mtimeMs >= statSync(path).mtimeMs);
+if (!blogDistExists || !blogFontAssetsExist || !blogImageAssetsExist || !blogHtmlUsesCurrentFontFormat || !blogHtmlUsesCurrentParkTheme || !blogHtmlUsesCurrentParkImages || !blogHtmlOmitsRetiredDecorations || !blogHtmlIsFresh) {
+  const blogBuildSpinner = spinner("Building blog...");
+  blogBuildSpinner.start();
+  try {
+    const blogConfig = (await import(p.projectPath("config/blog"))).default, { buildBlogSite } = await import(p.frameworkPath("core/cms/src/build"));
+    await buildBlogSite({ config: blogConfig, outDir: p.projectPath("dist/blog") });
+    blogBuildSpinner.succeed("Blog built successfully");
+  } catch (blogBuildError) {
+    blogBuildSpinner.stop();
+    console.log(`\u26A0 Blog build skipped: ${blogBuildError.message}`);
+    if (isVerbose)
+      log.debug(`Blog build error: ${blogBuildError.stack}`);
+  }
+} else if (isVerbose)
+  log.debug("Pre-built blog found at dist/blog, skipping build");
+if (isVerbose)
+  log.debug("Skipping views build (vite-config not configured)");
+const earlyCloudConfig = await import(p.projectPath("config/cloud")), earlyDeploymentMode = earlyCloudConfig?.tsCloud?.mode || "server";
+if (earlyDeploymentMode === "serverless") {
+  const serverSpinner = spinner("Building server...");
+  serverSpinner.start();
+  await runCommand("bun build.ts", {
+    cwd: p.frameworkPath("server"),
+    quiet: !isVerbose
+  });
+  serverSpinner.succeed("Server built");
+  const packageSpinner = spinner("Packaging for deployment...");
+  packageSpinner.start();
+  await runCommand("bun zip.ts", {
+    cwd: p.corePath("cloud"),
+    quiet: !isVerbose
+  });
+  packageSpinner.succeed("Package ready");
+} else if (isVerbose)
+  log.debug("Skipping server build and packaging (server mode)");
+if (!process.env.AWS_ACCESS_KEY_ID || !process.env.AWS_SECRET_ACCESS_KEY) {
+  const { existsSync, readFileSync } = await import("node:fs"), environment = process.env.APP_ENV || process.env.NODE_ENV || "production", envFiles = [
+    p.projectPath(`.env.${environment}`),
+    p.projectPath(".env")
+  ];
+  for (const envPath of envFiles)
+    if (existsSync(envPath)) {
+      const content = readFileSync(envPath, "utf-8");
+      for (const line of content.split(`
+`)) {
+        const trimmed = line.trim();
+        if (trimmed.startsWith("#") || !trimmed.includes("="))
+          continue;
+        const eqIndex = trimmed.indexOf("="), key = trimmed.slice(0, eqIndex).trim();
+        let value = trimmed.slice(eqIndex + 1).trim();
+        if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'"))
+          value = value.slice(1, -1);
+        if (key === "AWS_ACCESS_KEY_ID" && value)
+          process.env.AWS_ACCESS_KEY_ID = value;
+        else if (key === "AWS_SECRET_ACCESS_KEY" && value)
+          process.env.AWS_SECRET_ACCESS_KEY = value;
+        else if (key === "AWS_REGION" && value && !process.env.AWS_REGION)
+          process.env.AWS_REGION = value;
+        else if (key === "AWS_ACCOUNT_ID" && value && !process.env.AWS_ACCOUNT_ID)
+          process.env.AWS_ACCOUNT_ID = value;
+        else if (key.startsWith("MAIL_PASSWORD_") && value && !process.env[key])
+          process.env[key] = value;
+      }
+      if (isVerbose)
+        log.debug(`Loaded AWS credentials from ${envPath}`);
+      break;
+    }
+}
+try {
+  const { deployStack, deployFrontend: _deployFrontend } = await import("../../deploy"), environment = process.env.APP_ENV || process.env.NODE_ENV || "production", region = process.env.AWS_REGION || "us-east-1", cloudConfigModule = await import(p.projectPath("config/cloud")), deploymentMode = cloudConfigModule?.tsCloud?.mode || "server", projectName = cloudConfigModule?.tsCloud?.project?.name || cloudConfigModule?.tsCloud?.project?.slug || "stacks";
+  if (deploymentMode === "serverless") {
+    console.log("");
+    console.log("Serverless deployment mode detected");
+    console.log("Building and pushing container image...");
+    console.log("");
+    const accountId = process.env.AWS_ACCOUNT_ID || await getAwsAccountId(region);
+    if (!accountId || accountId.length < 10)
+      throw Error(`Invalid AWS Account ID: "${accountId || "(empty)"}"
+Set AWS_ACCOUNT_ID in your .env file or ensure valid AWS credentials are configured.`);
+    const ecrRepository = `${accountId}.dkr.ecr.${region}.amazonaws.com/${projectName}-${environment}-api`, imageTag = `${ecrRepository}:latest`;
+    if (isVerbose)
+      log.debug(`ECR repository: ${ecrRepository}`);
+    if (isVerbose)
+      log.debug("ECR credentials will be validated before push...");
+    const buildSpinner = spinner("Building Docker image...");
+    buildSpinner.start();
+    try {
+      const { exec } = await import("node:child_process"), { promisify } = await import("node:util"), execAsync = promisify(exec), buildCmd = `docker build --platform linux/amd64 -t ${imageTag} -f Dockerfile .`, { stdout, stderr } = await execAsync(buildCmd, {
+        cwd: p.projectPath(),
+        env: process.env,
+        maxBuffer: 10485760,
+        timeout: 900000
+      });
+      if (isVerbose && stdout)
+        log.debug(stdout);
+      if (isVerbose && stderr)
+        log.debug(stderr);
+      buildSpinner.succeed(`Docker image built: ${imageTag}`);
+    } catch (error) {
+      buildSpinner.fail("Docker build failed");
+      if (isVerbose)
+        log.debug(`Docker build error: ${error.message}`);
+      throw error;
+    }
+    const repoSpinner = spinner("Checking ECR repository...");
+    repoSpinner.start();
+    try {
+      const { ECRClient } = await import("@stacksjs/ts-cloud"), ecr = new ECRClient(region), repoName = `${projectName}-${environment}-api`;
+      try {
+        await ecr.describeRepositories({ repositoryNames: [repoName] });
+        repoSpinner.succeed(`ECR repository exists: ${repoName}`);
+      } catch (err) {
+        if (err.code === "RepositoryNotFoundException" || err.message?.includes("RepositoryNotFoundException")) {
+          repoSpinner.text = `Creating ECR repository: ${repoName}...`;
+          await ecr.createRepository({
+            repositoryName: repoName,
+            imageScanningConfiguration: { scanOnPush: !0 },
+            imageTagMutability: "MUTABLE"
+          });
+          repoSpinner.succeed(`ECR repository created: ${repoName}`);
+        } else
+          throw err;
+      }
+    } catch (error) {
+      repoSpinner.fail("ECR repository check failed");
+      if (isVerbose)
+        log.debug(`ECR repository error: ${error.message}`);
+      throw error;
+    }
+    const authSpinner = spinner("Authenticating to ECR...");
+    authSpinner.start();
+    try {
+      const { ECRClient } = await import("@stacksjs/ts-cloud"), token = (await new ECRClient(region).getAuthorizationToken()).authorizationData?.[0];
+      if (!token?.authorizationToken)
+        throw Error("No authorization token received from ECR");
+      const decoded = Buffer.from(token.authorizationToken, "base64").toString("utf-8"), colonIndex = decoded.indexOf(":");
+      if (colonIndex === -1)
+        throw Error("ECR authorization token has unexpected format (missing colon separator)");
+      const password = decoded.slice(colonIndex + 1), loginResult = Bun.spawnSync([
+        "docker",
+        "login",
+        "--username",
+        "AWS",
+        "--password-stdin",
+        `${accountId}.dkr.ecr.${region}.amazonaws.com`
+      ], {
+        stdin: new TextEncoder().encode(password),
+        stdout: "pipe",
+        stderr: "pipe"
+      });
+      if (loginResult.exitCode !== 0) {
+        const loginError = new TextDecoder().decode(loginResult.stderr);
+        throw Error(`Docker login failed: ${loginError}`);
+      }
+      authSpinner.succeed("Authenticated to ECR");
+    } catch (error) {
+      authSpinner.fail("ECR authentication failed");
+      if (isVerbose)
+        log.debug(`ECR auth error: ${error.message}`);
+      throw error;
+    }
+    console.log("");
+    const pushSpinner = spinner("Pushing image to ECR...");
+    pushSpinner.start();
+    try {
+      const { exec } = await import("node:child_process"), { promisify } = await import("node:util"), execAsync = promisify(exec), pushCmd = `docker push ${imageTag}`;
+      await execAsync(pushCmd, { env: process.env });
+      pushSpinner.succeed(`Image pushed: ${imageTag}`);
+    } catch (error) {
+      pushSpinner.fail("Docker push failed");
+      if (isVerbose)
+        log.debug(`Push error: ${error.message}`);
+      throw error;
+    }
+    console.log("");
+    console.log("Container image ready in ECR. CloudFormation will use this image.");
+    console.log("");
+  } else {
+    console.log("");
+    console.log("Server deployment mode detected");
+    console.log("Deploying EC2 infrastructure via CloudFormation...");
+    console.log("");
+  }
+  async function getAwsAccountId(region) {
+    try {
+      const { STSClient } = await import("@stacksjs/ts-cloud"), accountId = (await new STSClient(region).getCallerIdentity()).Account || process.env.AWS_ACCOUNT_ID || "";
+      if (isVerbose)
+        log.debug(`Retrieved AWS Account ID: ${accountId || "(empty)"}`);
+      return accountId;
+    } catch (error) {
+      if (isVerbose)
+        log.debug(`Failed to get AWS Account ID: ${error.message}`);
+      return process.env.AWS_ACCOUNT_ID || "";
+    }
+  }
+  try {
+    const deployScript = await import(p.projectPath("cloud/deploy-script"));
+    if (typeof deployScript.beforeDeploy === "function")
+      await deployScript.beforeDeploy({ environment, region });
+  } catch (hookError) {
+    if (hookError.code === "ERR_MODULE_NOT_FOUND" || hookError.code === "MODULE_NOT_FOUND") {
+      if (isVerbose)
+        log.debug("No beforeDeploy hook found (cloud/deploy-script not found)");
+    } else {
+      console.warn(`\u26A0 beforeDeploy hook failed: ${hookError.message}`);
+      if (isVerbose)
+        log.debug(`beforeDeploy error stack: ${hookError.stack}`);
+    }
+  }
+  await deployStack({
+    environment,
+    region,
+    waitForCompletion: !0,
+    verbose: isVerbose
+  });
+  try {
+    const deployScript = await import(p.projectPath("cloud/deploy-script"));
+    if (typeof deployScript.afterDeploy === "function") {
+      const { CloudFormationClient } = await import("@stacksjs/ts-cloud"), cf = new CloudFormationClient(region), stackName = `${projectName}-cloud`;
+      let stackOutputs = {};
+      try {
+        stackOutputs = await cf.getStackOutputs(stackName);
+      } catch (e) {
+        if (isVerbose)
+          log.debug(`Failed to get stack outputs: ${e instanceof Error ? e.message : String(e)}`);
+      }
+      await deployScript.afterDeploy({ environment, region, outputs: stackOutputs });
+    }
+  } catch (hookError) {
+    if (hookError.code === "ERR_MODULE_NOT_FOUND" || hookError.code === "MODULE_NOT_FOUND") {
+      if (isVerbose)
+        log.debug("No afterDeploy hook found (cloud/deploy-script not found)");
+    } else {
+      console.warn(`\u26A0 afterDeploy hook failed: ${hookError.message}`);
+      if (isVerbose)
+        log.debug(`afterDeploy error stack: ${hookError.stack}`);
+    }
+  }
+  const migrateSpinner = spinner("Running database migrations...");
+  migrateSpinner.start();
+  try {
+    const { generateMigrations, runDatabaseMigration } = await import("@stacksjs/database");
+    await generateMigrations();
+    await runDatabaseMigration();
+    migrateSpinner.succeed("Database migrations completed");
+  } catch (migrationError) {
+    migrateSpinner.stop();
+    console.log(`\u26A0 Database migrations skipped: ${migrationError.message}`);
+    if (isVerbose)
+      log.debug(`Migration error: ${migrationError.stack}`);
+  }
+  const frameworkTablesSpinner = spinner("Ensuring framework tables (auth, notifications, RBAC)...");
+  frameworkTablesSpinner.start();
+  try {
+    const { migrateAuthTables, migrateNotificationTables, migrateRbacTables } = await import("@stacksjs/database"), failures = [], steps = [
+      ["auth", migrateAuthTables],
+      ["notification", migrateNotificationTables],
+      ["RBAC", migrateRbacTables]
+    ];
+    for (const [name, migrateTables] of steps) {
+      const result = await migrateTables({ verbose: isVerbose });
+      if (!result.success)
+        failures.push(`${name}: ${result.error}`);
+    }
+    if (failures.length > 0) {
+      frameworkTablesSpinner.stop();
+      console.log(`\u26A0 Some framework tables could not be migrated: ${failures.join("; ")}`);
+    } else
+      frameworkTablesSpinner.succeed("Framework tables ensured (auth, notifications, RBAC)");
+  } catch (frameworkTablesError) {
+    frameworkTablesSpinner.stop();
+    console.log(`\u26A0 Framework table migrations skipped: ${frameworkTablesError.message}`);
+    if (isVerbose)
+      log.debug(`Framework table migration error: ${frameworkTablesError.stack}`);
+  }
+  if (deploymentMode === "server") {
+    const serverOutputSpinner = spinner("Retrieving server instance details...");
+    serverOutputSpinner.start();
+    try {
+      const { CloudFormationClient } = await import("@stacksjs/ts-cloud"), cf = new CloudFormationClient(region), stackName = `${projectName}-cloud`, outputs = await cf.getStackOutputs(stackName);
+      serverOutputSpinner.succeed("Server instances deployed");
+      console.log("");
+      console.log("Server instances:");
+      for (const [key, value] of Object.entries(outputs)) {
+        if (key.endsWith("PublicIp"))
+          console.log(`  ${key}: ${value}`);
+        if (key.endsWith("InstanceId"))
+          console.log(`  ${key}: ${value}`);
+      }
+      console.log("");
+    } catch (outputError) {
+      serverOutputSpinner.stop();
+      console.log(`\u26A0 Could not retrieve server details: ${outputError.message}`);
+      if (isVerbose)
+        log.debug(`Output retrieval error: ${outputError.stack}`);
+    }
+    const serverDeploySpinner = spinner("Deploying API server to EC2...");
+    serverDeploySpinner.start();
+    try {
+      const { S3Client, CloudFormationClient, AWSClient } = await import("@stacksjs/ts-cloud"), { readFileSync: readServerFile, existsSync: serverFileExists } = await import("node:fs"), { resolve } = await import("node:path"), s3 = new S3Client(region), cf = new CloudFormationClient(region), awsClient = new AWSClient, stackName = `${projectName}-cloud`, outputs = await cf.getStackOutputs(stackName), bucketName = outputs.FrontendBucketName, apiServerPort = Number(config.ports?.api || 3008);
+      let instanceId;
+      for (const [key, value] of Object.entries(outputs))
+        if (key.endsWith("InstanceId") && typeof value === "string") {
+          instanceId = value;
+          break;
+        }
+      let securityGroupId;
+      if (instanceId) {
+        const { EC2Client } = await import("@stacksjs/ts-cloud"), ec2 = new EC2Client(region);
+        securityGroupId = (await ec2.describeInstances({
+          Filters: [{ Name: "instance-id", Values: [instanceId] }]
+        }))?.Reservations?.[0]?.Instances?.[0]?.SecurityGroups?.[0]?.GroupId;
+        await ensureSecurityGroupPort(ec2, securityGroupId, apiServerPort);
+      }
+      if (!instanceId || !bucketName) {
+        serverDeploySpinner.stop();
+        if (!instanceId)
+          console.log("\u26A0 No EC2 instance found in stack outputs, skipping server deploy");
+        if (!bucketName)
+          console.log("\u26A0 No S3 bucket found for staging server artifacts");
+      } else {
+        const publicDistributionId = outputs.publicCloudFrontDistributionId || outputs.CloudFrontDistributionId;
+        await ensureCloudFrontApiOriginPort(awsClient, publicDistributionId, apiServerPort);
+        const tsCloudDistPath = resolve(p.projectPath("node_modules/@stacksjs/ts-cloud/dist/index.js"));
+        if (serverFileExists(tsCloudDistPath)) {
+          const tsCloudDist = readServerFile(tsCloudDistPath);
+          await withS3Retry(() => s3.putObject({
+            bucket: bucketName,
+            key: "_deploy/ts-cloud-dist.js",
+            body: tsCloudDist,
+            contentType: "application/javascript"
+          }), "upload ts-cloud dist");
+          if (isVerbose)
+            log.debug("  Uploaded ts-cloud dist to S3");
+        }
+        const serverCode = `import { Database } from "bun:sqlite";
+import { SESClient } from "./ts-cloud-dist.js";
+
+const db = new Database("/var/www/api/stacks.db");
+db.run(\`CREATE TABLE IF NOT EXISTS subscribers (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  email TEXT NOT NULL UNIQUE,
+  status TEXT DEFAULT 'subscribed',
+  source TEXT DEFAULT 'homepage',
+  created_at TEXT DEFAULT CURRENT_TIMESTAMP
+)\`);
+
+const CORS_HEADERS = {
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+  "Access-Control-Allow-Headers": "Content-Type",
+};
+
+const ses = new SESClient("${region}");
+
+async function readBody(req) {
+  const contentType = req.headers.get("content-type") || "";
+
+  if (contentType.includes("application/json")) {
+    return await req.json();
+  }
+
+  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+    const form = await req.formData();
+    return Object.fromEntries(form.entries());
+  }
+
+  const text = await req.text();
+  return Object.fromEntries(new URLSearchParams(text));
+}
+
+async function sendWelcomeEmail(email) {
+  try {
+    await ses.sendSimpleEmail({
+      from: "hello@stacksjs.com",
+      to: email,
+      subject: "Welcome to Stacks!",
+      html: \`<!DOCTYPE html>
+<html>
+<head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"></head>
+<body style="margin:0;padding:0;background-color:#0e0e0e;font-family:-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Helvetica Neue,Arial,sans-serif;">
+  <table role="presentation" width="100%" cellspacing="0" cellpadding="0" style="max-width:600px;margin:0 auto;padding:40px 20px;">
+    <tr><td style="text-align:center;padding-bottom:32px;"><h1 style="color:#ececec;font-size:28px;font-weight:600;margin:0;">Stacks</h1></td></tr>
+    <tr><td style="background-color:#1a1a1a;border-radius:12px;padding:32px;">
+      <h2 style="color:#ececec;font-size:22px;font-weight:600;margin:0 0 16px;">Welcome aboard!</h2>
+      <p style="color:#a0a0a0;font-size:16px;line-height:1.6;margin:0 0 16px;">Thanks for subscribing to Stacks. You will be the first to know about new releases, features, and updates.</p>
+      <p style="color:#a0a0a0;font-size:16px;line-height:1.6;margin:0 0 24px;">Stacks is a rapid application development framework that helps you build type-safe web apps, APIs, and cloud infrastructure with ease.</p>
+      <a href="https://stacksjs.com" style="display:inline-block;background-color:#6366f1;color:#ffffff;text-decoration:none;padding:12px 24px;border-radius:8px;font-size:14px;font-weight:500;">Visit Stacks</a>
+    </td></tr>
+    <tr><td style="text-align:center;padding-top:32px;"><p style="color:#666;font-size:13px;margin:0;">You received this email because you subscribed at stacksjs.com</p></td></tr>
+  </table>
+</body>
+</html>\`,
+      text: "Welcome to Stacks! Thanks for subscribing. You will be the first to know about new releases, features, and updates. Visit us at https://stacksjs.com",
+    });
+    console.log(\`Welcome email sent to \${email}\`);
+  } catch (err) {
+    console.error(\`Failed to send welcome email to \${email}:\`, err.message);
+  }
+}
+
+const server = Bun.serve({
+  port: ${apiServerPort},
+  hostname: "0.0.0.0",
+  async fetch(req) {
+    const url = new URL(req.url);
+
+    if (req.method === "OPTIONS") {
+      return new Response(null, { status: 204, headers: CORS_HEADERS });
+    }
+
+    if (url.pathname === "/health" || url.pathname === "/api/health") {
+      return Response.json({ status: "ok" }, { headers: CORS_HEADERS });
+    }
+
+    if (url.pathname === "/api/email/subscribe" && req.method === "POST") {
+      try {
+        const body = await readBody(req);
+        const email = (body.email || "").trim().toLowerCase();
+        if (!email || !email.includes("@")) {
+          return Response.json(
+            { success: false, message: "A valid email is required" },
+            { status: 400, headers: CORS_HEADERS },
+          );
+        }
+
+        const existing = db.query("SELECT id FROM subscribers WHERE email = ?").get(email);
+        if (existing) {
+          return Response.json(
+            { success: true, message: "Already subscribed" },
+            { headers: CORS_HEADERS },
+          );
+        }
+
+        db.run("INSERT INTO subscribers (email, source) VALUES (?, ?)", [email, body.source || "homepage"]);
+
+        // Send welcome email asynchronously (do not block the response)
+        sendWelcomeEmail(email);
+
+        return Response.json(
+          { success: true, message: "Thanks for subscribing!" },
+          { headers: CORS_HEADERS },
+        );
+      } catch (e) {
+        return Response.json(
+          { success: false, message: "Server error" },
+          { status: 500, headers: CORS_HEADERS },
+        );
+      }
+    }
+
+    return Response.json({ error: "Not found" }, { status: 404, headers: CORS_HEADERS });
+  },
+});
+
+console.log(\`Stacks API server running on port \${server.port}\`);
+`;
+        await withS3Retry(() => s3.putObject({
+          bucket: bucketName,
+          key: "_deploy/server.ts",
+          body: Buffer.from(serverCode),
+          contentType: "application/typescript"
+        }), "upload server.ts");
+        if (isVerbose)
+          log.debug("  Uploaded server.ts to S3");
+        const ssmCommand = [
+          "mkdir -p /var/www/api",
+          `aws s3 cp s3://${bucketName}/_deploy/ts-cloud-dist.js /var/www/api/ts-cloud-dist.js`,
+          `aws s3 cp s3://${bucketName}/_deploy/server.ts /var/www/api/server.ts`,
+          firewallOpenCommand([apiServerPort]),
+          `cat > /etc/systemd/system/stacks-api.service << 'SERVICEFILE'
+[Unit]
+Description=Stacks Bun API Server
+After=network.target
+
+[Service]
+Type=simple
+WorkingDirectory=/var/www/api
+ExecStart=/root/.bun/bin/bun server.ts
+Restart=on-failure
+RestartSec=5
+Environment=NODE_ENV=production
+
+[Install]
+WantedBy=multi-user.target
+SERVICEFILE
+systemctl daemon-reload
+systemctl enable stacks-api`,
+          "systemctl reset-failed stacks-api || true",
+          "systemctl restart stacks-api",
+          `for i in $(seq 1 20); do curl -fsS http://127.0.0.1:${apiServerPort}/api/health && break; sleep 1; done`,
+          `curl -fsS http://127.0.0.1:${apiServerPort}/api/health`,
+          `echo "API server deployed and restarted on port ${apiServerPort}"`
+        ].join(" && "), commandId = (await awsClient.request({
+          service: "ssm",
+          region,
+          method: "POST",
+          path: "/",
+          headers: {
+            "Content-Type": "application/x-amz-json-1.1",
+            "X-Amz-Target": "AmazonSSM.SendCommand"
+          },
+          body: JSON.stringify({
+            InstanceIds: [instanceId],
+            DocumentName: "AWS-RunShellScript",
+            Parameters: {
+              commands: [ssmCommand]
+            },
+            TimeoutSeconds: 120
+          })
+        }))?.Command?.CommandId;
+        if (commandId) {
+          let attempts = 0;
+          while (attempts < 30) {
+            await new Promise((resolve) => setTimeout(resolve, 3000));
+            try {
+              const invocation = await awsClient.request({
+                service: "ssm",
+                region,
+                method: "POST",
+                path: "/",
+                headers: {
+                  "Content-Type": "application/x-amz-json-1.1",
+                  "X-Amz-Target": "AmazonSSM.GetCommandInvocation"
+                },
+                body: JSON.stringify({
+                  CommandId: commandId,
+                  InstanceId: instanceId
+                })
+              }), status = invocation?.Status;
+              if (status === "Success") {
+                serverDeploySpinner.succeed("API server deployed to EC2");
+                break;
+              } else if (status === "Failed" || status === "Cancelled" || status === "TimedOut") {
+                const errOutput = invocation?.StandardErrorContent || "Unknown error";
+                serverDeploySpinner.fail(`API server deploy failed: ${errOutput}`);
+                break;
+              }
+            } catch {}
+            attempts++;
+          }
+          if (attempts >= 30)
+            serverDeploySpinner.fail("API server deploy timed out waiting for SSM command");
+        } else
+          serverDeploySpinner.fail("Failed to send SSM command");
+        try {
+          await s3.deleteObject({ bucket: bucketName, key: "_deploy/ts-cloud-dist.js" });
+          await s3.deleteObject({ bucket: bucketName, key: "_deploy/server.ts" });
+        } catch {}
+      }
+    } catch (serverDeployError) {
+      serverDeploySpinner.fail(`API server deployment failed: ${serverDeployError.message}`);
+      if (isVerbose)
+        log.debug(`Server deploy error: ${serverDeployError.stack}`);
+    }
+    const emailConfig = config.email;
+    if (emailConfig?.server?.enabled) {
+      const mailServerMode = emailConfig?.server?.mode || "server", smtpSpinner = spinner(`Deploying mail server (${mailServerMode} mode) to EC2...`);
+      smtpSpinner.start();
+      try {
+        const { S3Client, AWSClient, EC2Client } = await import("@stacksjs/ts-cloud"), { readFileSync: readSmtpFile, existsSync: smtpFileExists } = await import("node:fs"), { resolve: resolvePath, join: joinPath } = await import("node:path"), { execSync } = await import("node:child_process"), s3 = new S3Client(region), awsClient = new AWSClient, ec2 = new EC2Client(region), stackName = `${projectName}-cloud`;
+        let smtpInstanceId, smtpBucketName, emailBucketName, securityGroupId;
+        try {
+          const { AWSCloudFormationClient: CfnClient } = await import("@stacksjs/ts-cloud"), cfnOutputs = await new CfnClient(region).getStackOutputs(stackName);
+          for (const [key, value] of Object.entries(cfnOutputs)) {
+            if (key.endsWith("InstanceId") && typeof value === "string")
+              smtpInstanceId = value;
+            if (key === "FrontendBucketName" && typeof value === "string")
+              smtpBucketName = value;
+            if (key === "emailBucketName" && typeof value === "string")
+              emailBucketName = value;
+          }
+        } catch {}
+        if (!emailBucketName)
+          emailBucketName = `${projectName}-production-s3-email`;
+        if (smtpInstanceId && smtpBucketName) {
+          const mailPorts = [25, 80, 110, 143, 465, 587, 993, 995];
+          try {
+            const sgs = (await ec2.describeInstances({
+              Filters: [{ Name: "instance-id", Values: [smtpInstanceId] }]
+            }))?.Reservations?.[0]?.Instances?.[0]?.SecurityGroups;
+            if (sgs?.[0]?.GroupId)
+              securityGroupId = sgs[0].GroupId;
+          } catch {
+            if (isVerbose)
+              log.debug("Could not get security group for instance");
+          }
+          if (securityGroupId)
+            for (const port of mailPorts)
+              try {
+                await ec2.authorizeSecurityGroupIngress({
+                  GroupId: securityGroupId,
+                  IpPermissions: [{
+                    IpProtocol: "tcp",
+                    FromPort: port,
+                    ToPort: port,
+                    IpRanges: [{ CidrIp: "0.0.0.0/0", Description: `Mail port ${port}` }]
+                  }]
+                });
+                if (isVerbose)
+                  log.debug(`  Opened port ${port} on security group ${securityGroupId}`);
+              } catch (e) {
+                if (!e.message?.includes("already exists")) {
+                  if (isVerbose)
+                    log.debug(`  Port ${port}: ${e.message}`);
+                }
+              }
+          const domain = emailConfig.domain || "stacksjs.com", mailSubdomain = emailConfig?.server?.subdomain || "mail";
+          if (mailServerMode === "server") {
+            if (isVerbose)
+              log.debug("Deploying Zig mail server binary...");
+            try {
+              await installMailBinaryWithPantry();
+            } catch (error) {
+              if (isVerbose)
+                log.debug(`  Pantry mail install failed: ${error.message}`);
+            }
+            const linuxBinaryPath = await findPantryMailBinary();
+            if (linuxBinaryPath && smtpFileExists(linuxBinaryPath)) {
+              if (!await isElfBinary(linuxBinaryPath)) {
+                smtpSpinner.fail(`Pantry installed ${MAIL_PACKAGE_DOMAIN}, but the ${MAIL_TARGET_PLATFORM} binary is not an ELF file.`);
+                throw Error("Linux binary is not a valid ELF file");
+              }
+              const binaryContent = readSmtpFile(linuxBinaryPath);
+              await s3.putObject({
+                bucket: emailBucketName,
+                key: "mail-server/smtp-server",
+                body: binaryContent,
+                contentType: "application/octet-stream"
+              });
+              if (isVerbose)
+                log.debug(`  Uploaded Zig binary (${(binaryContent.length / 1024 / 1024).toFixed(1)}MB) to S3`);
+              const zigSsmCommand = [
+                "systemctl stop stacks-mail 2>/dev/null || true",
+                "systemctl disable stacks-mail 2>/dev/null || true",
+                "systemctl stop stacks-smtp 2>/dev/null || true",
+                "systemctl disable stacks-smtp 2>/dev/null || true",
+                "systemctl stop smtp-server 2>/dev/null || true",
+                "mkdir -p /opt/smtp-server /var/lib/smtp-server /var/log/smtp-server /var/spool/mail /etc/smtp-server /var/lib/smtp-server/backups",
+                `aws s3 cp s3://${emailBucketName}/mail-server/smtp-server /opt/smtp-server/smtp-server --region ${region}`,
+                "chmod +x /opt/smtp-server/smtp-server",
+                'file /opt/smtp-server/smtp-server | grep -q ELF || { echo "Binary is not ELF"; exit 1; }',
+                firewallOpenCommand(mailPorts),
+                `cat > /etc/smtp-server/smtp-server.env << 'ENVEOF'
+SMTP_PROFILE=production
+SMTP_HOST=0.0.0.0
+SMTP_PORT=25
+SMTP_HOSTNAME=${mailSubdomain}.${domain}
+SMTP_ENABLE_TLS=false
+SMTP_ENABLE_AUTH=true
+SMTP_DB_PATH=/var/lib/smtp-server/smtp.db
+AWS_S3_BUCKET=${emailBucketName}
+AWS_REGION=${region}
+SMTP_ENABLE_JSON_LOGGING=true
+SMTP_LOG_LEVEL=info
+SMTP_MAILBOX_PATH=/var/spool/mail
+SMTP_BACKUP_PATH=/var/lib/smtp-server/backups
+SMTP_MAX_CONNECTIONS=1000
+SMTP_MAX_MESSAGE_SIZE=52428800
+SMTP_MAX_RECIPIENTS=100
+SMTP_RATE_LIMIT_PER_IP=100
+SMTP_RATE_LIMIT_PER_USER=200
+SMTP_IO_MODE=epoll
+ENVEOF`,
+                "chmod 600 /etc/smtp-server/smtp-server.env",
+                `cat > /etc/systemd/system/smtp-server.service << 'SVCEOF'
+[Unit]
+Description=Stacks Mail Server (Zig)
+After=network.target
+
+[Service]
+Type=simple
+WorkingDirectory=/opt/smtp-server
+EnvironmentFile=/etc/smtp-server/smtp-server.env
+ExecStart=/opt/smtp-server/smtp-server
+Restart=always
+RestartSec=10
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=smtp-server
+
+[Install]
+WantedBy=multi-user.target
+SVCEOF`,
+                "systemctl daemon-reload",
+                "systemctl enable smtp-server",
+                "systemctl restart smtp-server",
+                "sleep 3",
+                'systemctl is-active smtp-server && echo "Mail server is running" || echo "Mail server failed to start"',
+                'ss -tlnp | grep -E "(25|143)" || echo "Warning: mail ports not listening yet"'
+              ].join(" && "), cmdId = (await awsClient.request({
+                service: "ssm",
+                region,
+                method: "POST",
+                path: "/",
+                headers: {
+                  "Content-Type": "application/x-amz-json-1.1",
+                  "X-Amz-Target": "AmazonSSM.SendCommand"
+                },
+                body: JSON.stringify({
+                  InstanceIds: [smtpInstanceId],
+                  DocumentName: "AWS-RunShellScript",
+                  Parameters: { commands: [zigSsmCommand] },
+                  TimeoutSeconds: 300
+                })
+              }))?.Command?.CommandId;
+              if (cmdId) {
+                let ssmAttempts = 0;
+                while (ssmAttempts < 100) {
+                  await new Promise((resolve) => setTimeout(resolve, 3000));
+                  try {
+                    const invocation = await awsClient.request({
+                      service: "ssm",
+                      region,
+                      method: "POST",
+                      path: "/",
+                      headers: {
+                        "Content-Type": "application/x-amz-json-1.1",
+                        "X-Amz-Target": "AmazonSSM.GetCommandInvocation"
+                      },
+                      body: JSON.stringify({ CommandId: cmdId, InstanceId: smtpInstanceId })
+                    }), status = invocation?.Status;
+                    if (status === "Success") {
+                      smtpSpinner.succeed("Zig mail server deployed to EC2");
+                      if (isVerbose && invocation?.StandardOutputContent)
+                        console.log(invocation.StandardOutputContent);
+                      break;
+                    } else if (status === "Failed" || status === "Cancelled" || status === "TimedOut") {
+                      const errOutput = invocation?.StandardErrorContent || invocation?.StandardOutputContent || "Unknown error";
+                      smtpSpinner.fail(`Zig mail server deploy failed: ${errOutput.slice(0, 500)}`);
+                      break;
+                    }
+                  } catch {}
+                  ssmAttempts++;
+                }
+                if (ssmAttempts >= 100)
+                  smtpSpinner.fail("Zig mail server deploy timed out");
+              } else
+                smtpSpinner.fail("Failed to send SSM command for mail server");
+            } else
+              smtpSpinner.fail(`No Pantry-provided ${MAIL_TARGET_PLATFORM} mail binary found. Release ${MAIL_PACKAGE_DOMAIN}, then run the Pantry binary sync for that package.`);
+          } else {
+            const smtpServerSrc = resolvePath(p.projectPath("storage/framework/core/cloud/src/imap/smtp-server.ts")), bundleOutDir = joinPath(p.projectPath(), ".stacks/tmp/smtp-bundle");
+            execSync(`bun build ${smtpServerSrc} --target=bun --outdir=${bundleOutDir}`, { stdio: "pipe" });
+            const bundlePath = joinPath(bundleOutDir, "smtp-server.js");
+            if (smtpFileExists(bundlePath)) {
+              const smtpBundle = readSmtpFile(bundlePath), mailboxes = emailConfig.mailboxes || ["chris", "blake", "glenn"], usersEntries = mailboxes.map((name) => {
+                const envKey = `MAIL_PASSWORD_${name.toUpperCase()}`;
+                return `  "${name}": { password: process.env["${envKey}"] || "", email: "${name}@${domain}" }`;
+              }).join(`,
+`), entryPoint = `import { SmtpServer } from "./smtp-server.js";
+import * as fs from "fs";
+const domain = "${domain}";
+const users = { ${usersEntries} };
+const certDir = \`/etc/letsencrypt/live/mail.\${domain}\`;
+let tlsConfig = undefined;
+if (fs.existsSync(\`\${certDir}/privkey.pem\`)) {
+  tlsConfig = { key: \`\${certDir}/privkey.pem\`, cert: \`\${certDir}/fullchain.pem\` };
+}
+const server = new SmtpServer({ port: 587, tlsPort: 465, host: "0.0.0.0", domain, users, tls: tlsConfig, sentBucket: "${projectName}-production-email", sentPrefix: "sent/" });
+await server.start();
+`;
+              await s3.putObject({ bucket: smtpBucketName, key: "_deploy/smtp-server.js", body: smtpBundle, contentType: "application/javascript" });
+              await s3.putObject({ bucket: smtpBucketName, key: "_deploy/smtp-entry.ts", body: Buffer.from(entryPoint), contentType: "application/typescript" });
+              const envLines = mailboxes.map((name) => {
+                const envKey = `MAIL_PASSWORD_${name.toUpperCase()}`;
+                return `Environment=${envKey}=${process.env[envKey] || ""}`;
+              }).join(`
+`), smtpSsmCommand = [
+                "mkdir -p /var/www/smtp",
+                `aws s3 cp s3://${smtpBucketName}/_deploy/smtp-server.js /var/www/smtp/smtp-server.js`,
+                `aws s3 cp s3://${smtpBucketName}/_deploy/smtp-entry.ts /var/www/smtp/smtp-entry.ts`,
+                firewallOpenCommand(mailPorts),
+                "if ! command -v certbot &> /dev/null; then dnf install -y certbot || yum install -y certbot || apt-get install -y certbot || true; fi",
+                `if [ ! -d /etc/letsencrypt/live/mail.${domain} ]; then certbot certonly --standalone --non-interactive --agree-tos --email admin@${domain} -d mail.${domain} --http-01-port 80 || echo "Certbot failed"; fi`,
+                `cat > /etc/systemd/system/stacks-smtp.service << 'SERVICEFILE'
+[Unit]
+Description=Stacks SMTP Proxy Server
+After=network.target
+[Service]
+Type=simple
+WorkingDirectory=/var/www/smtp
+ExecStart=/root/.bun/bin/bun smtp-entry.ts
+Restart=on-failure
+RestartSec=5
+Environment=NODE_ENV=production
+Environment=AWS_REGION=${region}
+${envLines}
+[Install]
+WantedBy=multi-user.target
+SERVICEFILE`,
+                "systemctl daemon-reload",
+                "systemctl enable stacks-smtp",
+                "systemctl restart stacks-smtp"
+              ].join(" && "), cmdId = (await awsClient.request({
+                service: "ssm",
+                region,
+                method: "POST",
+                path: "/",
+                headers: { "Content-Type": "application/x-amz-json-1.1", "X-Amz-Target": "AmazonSSM.SendCommand" },
+                body: JSON.stringify({ InstanceIds: [smtpInstanceId], DocumentName: "AWS-RunShellScript", Parameters: { commands: [smtpSsmCommand] }, TimeoutSeconds: 180 })
+              }))?.Command?.CommandId;
+              if (cmdId) {
+                let ssmAttempts = 0;
+                while (ssmAttempts < 60) {
+                  await new Promise((resolve) => setTimeout(resolve, 3000));
+                  try {
+                    const invocation = await awsClient.request({
+                      service: "ssm",
+                      region,
+                      method: "POST",
+                      path: "/",
+                      headers: { "Content-Type": "application/x-amz-json-1.1", "X-Amz-Target": "AmazonSSM.GetCommandInvocation" },
+                      body: JSON.stringify({ CommandId: cmdId, InstanceId: smtpInstanceId })
+                    }), status = invocation?.Status;
+                    if (status === "Success") {
+                      smtpSpinner.succeed("SMTP proxy deployed to EC2");
+                      break;
+                    } else if (status === "Failed" || status === "Cancelled" || status === "TimedOut") {
+                      smtpSpinner.fail(`SMTP proxy deploy failed: ${invocation?.StandardErrorContent || "Unknown"}`);
+                      break;
+                    }
+                  } catch {}
+                  ssmAttempts++;
+                }
+                if (ssmAttempts >= 60)
+                  smtpSpinner.fail("SMTP proxy deploy timed out");
+              } else
+                smtpSpinner.fail("Failed to send SSM command for SMTP proxy");
+              try {
+                await s3.deleteObject({ bucket: smtpBucketName, key: "_deploy/smtp-server.js" });
+                await s3.deleteObject({ bucket: smtpBucketName, key: "_deploy/smtp-entry.ts" });
+              } catch {}
+            } else {
+              smtpSpinner.stop();
+              if (isVerbose)
+                log.debug("SMTP server bundle not found, skipping");
+            }
+          }
+        } else {
+          smtpSpinner.stop();
+          if (isVerbose)
+            log.debug("No EC2 instance or bucket found, skipping mail server deploy");
+        }
+      } catch (smtpDeployError) {
+        smtpSpinner.fail(`Mail server deployment failed: ${smtpDeployError.message}`);
+        if (isVerbose)
+          log.debug(`Mail server deploy error: ${smtpDeployError.stack}`);
+      }
+    }
+  }
+  const frontendSpinner = spinner("Deploying frontend to S3...");
+  frontendSpinner.start();
+  try {
+    const { S3Client, CloudFormationClient } = await import("@stacksjs/ts-cloud"), { readFileSync } = await import("node:fs"), { buildFrontendStatic } = await import("../build/frontend-static"), s3 = new S3Client(region), cf = new CloudFormationClient(region), stackName = `${projectName}-cloud`, stackOutputs = await cf.getStackOutputs(stackName), bucketName = stackOutputs.FrontendBucketName;
+    if (!bucketName) {
+      frontendSpinner.stop();
+      console.log("\u26A0 Frontend bucket not found in stack outputs (add storage.public to infrastructure config)");
+    } else {
+      const buildDir = await buildFrontendStatic();
+      await (async (dir, _prefix = "") => {
+        await traverseDirectory(dir, async (filePath, key) => {
+          const content = readFileSync(filePath), contentType = getMimeType(filePath), cacheControl = key === "index.html" || key.endsWith("/index.html") ? "no-cache, no-store, must-revalidate" : "public, max-age=31536000, immutable";
+          await withS3Retry(() => s3.putObject({ bucket: bucketName, key, body: content, contentType, cacheControl }), `upload ${key}`);
+          if (isVerbose)
+            log.debug(`  Uploaded: ${key}`);
+        });
+      })(buildDir);
+      const bootstrapPath = p.projectPath("bootstrap");
+      if (existsSync(bootstrapPath)) {
+        const bootstrapContent = readFileSync(bootstrapPath);
+        await withS3Retry(() => s3.putObject({
+          bucket: bucketName,
+          key: "install",
+          body: bootstrapContent,
+          contentType: "text/plain",
+          cacheControl: "no-cache, no-store, must-revalidate"
+        }), "upload bootstrap install script");
+        if (isVerbose)
+          log.debug("  Uploaded bootstrap install script");
+      }
+      const distributionId = stackOutputs.publicCloudFrontDistributionId || stackOutputs.CloudFrontDistributionId;
+      if (distributionId) {
+        if (isVerbose)
+          log.debug("  Invalidating CloudFront cache...");
+        const { AWSClient } = await import("@stacksjs/ts-cloud");
+        await new AWSClient().request({
+          service: "cloudfront",
+          region: "us-east-1",
+          method: "POST",
+          path: `/2020-05-31/distribution/${distributionId}/invalidation`,
+          headers: {
+            "Content-Type": "application/xml"
+          },
+          body: `<?xml version="1.0" encoding="UTF-8"?>
+<InvalidationBatch xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">
+  <CallerReference>${Date.now()}</CallerReference>
+  <Paths>
+    <Quantity>1</Quantity>
+    <Items>
+      <Path>/*</Path>
+    </Items>
+  </Paths>
+</InvalidationBatch>`
+        });
+      }
+      frontendSpinner.succeed(`Frontend deployed to S3 (${bucketName})`);
+    }
+  } catch (frontendError) {
+    frontendSpinner.fail(`Frontend deployment failed: ${frontendError.message}`);
+    if (isVerbose)
+      log.debug(`Frontend error: ${frontendError.stack}`);
+  }
+  const docsDistPath = p.projectPath("dist/docs/.bunpress"), { existsSync: docsExists } = await import("node:fs");
+  if (docsExists(docsDistPath)) {
+    const docsDeploySpinner = spinner("Deploying documentation to S3...");
+    docsDeploySpinner.start();
+    try {
+      const { S3Client, CloudFormationClient } = await import("@stacksjs/ts-cloud"), { readFileSync } = await import("node:fs"), s3 = new S3Client(region), cf = new CloudFormationClient(region), stackName = `${projectName}-cloud`, docsOutputs = await cf.getStackOutputs(stackName), docsBucketName = docsOutputs.DocsBucketName;
+      if (!docsBucketName) {
+        docsDeploySpinner.stop();
+        console.log("\u26A0 Docs bucket not found in stack outputs (infrastructure may not be updated yet)");
+      } else {
+        await (async (dir, _prefix = "") => {
+          await traverseDirectory(dir, async (filePath, key) => {
+            const content = readFileSync(filePath), contentType = getMimeType(filePath), cacheControl = key.endsWith(".html") ? "no-cache, no-store, must-revalidate" : "public, max-age=31536000, immutable";
+            await withS3Retry(() => s3.putObject({ bucket: docsBucketName, key, body: content, contentType, cacheControl }), `upload docs ${key}`);
+            if (isVerbose)
+              log.debug(`  Uploaded docs: ${key}`);
+          }, "", [".DS_Store", ".bunpress"]);
+        })(docsDistPath);
+        const docsDistributionId = docsOutputs.docsCloudFrontDistributionId || docsOutputs.publicCloudFrontDistributionId || docsOutputs.CloudFrontDistributionId;
+        if (docsDistributionId) {
+          if (isVerbose)
+            log.debug("  Invalidating CloudFront cache for docs...");
+          const { AWSClient } = await import("@stacksjs/ts-cloud"), client = new AWSClient, docsInvalidationPaths = docsOutputs.docsCloudFrontDistributionId ? ["/*"] : ["/docs", "/docs/*"];
+          await client.request({
+            service: "cloudfront",
+            region: "us-east-1",
+            method: "POST",
+            path: `/2020-05-31/distribution/${docsDistributionId}/invalidation`,
+            headers: {
+              "Content-Type": "application/xml"
+            },
+            body: `<?xml version="1.0" encoding="UTF-8"?>
+<InvalidationBatch xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">
+  <CallerReference>docs-${Date.now()}</CallerReference>
+  <Paths>
+    <Quantity>${docsInvalidationPaths.length}</Quantity>
+    <Items>
+      ${docsInvalidationPaths.map((path) => `<Path>${path}</Path>`).join(`
+      `)}
+    </Items>
+  </Paths>
+</InvalidationBatch>`
+          });
+        }
+        docsDeploySpinner.succeed(`Documentation deployed to S3 (${docsBucketName})`);
+      }
+    } catch (docsDeployError) {
+      docsDeploySpinner.fail(`Documentation deployment failed: ${docsDeployError.message}`);
+      if (isVerbose)
+        log.debug(`Docs deploy error: ${docsDeployError.stack}`);
+    }
+  } else if (isVerbose)
+    log.debug("No docs build found at dist/docs, skipping docs deployment");
+  const blogDistPath = p.projectPath("dist/blog"), { existsSync: blogExists } = await import("node:fs");
+  if (blogExists(blogDistPath)) {
+    const blogDeploySpinner = spinner("Deploying blog to S3...");
+    blogDeploySpinner.start();
+    try {
+      const { S3Client: BlogS3Client, CloudFormationClient: BlogCFClient } = await import("@stacksjs/ts-cloud"), { readFileSync: readBlogFile } = await import("node:fs"), blogS3 = new BlogS3Client(region), blogCf = new BlogCFClient(region), stackName = `${projectName}-cloud`, outputs = await blogCf.getStackOutputs(stackName), blogBucketName = outputs.BlogBucketName;
+      if (!blogBucketName) {
+        blogDeploySpinner.stop();
+        console.log("\u26A0 Blog bucket not found in stack outputs");
+      } else {
+        await traverseDirectory(blogDistPath, async (filePath, key) => {
+          const content = readBlogFile(filePath), contentType = getMimeType(filePath), cacheControl = key.endsWith(".html") ? "no-cache, no-store, must-revalidate" : "public, max-age=31536000, immutable";
+          await withS3Retry(() => blogS3.putObject({ bucket: blogBucketName, key, body: content, contentType, cacheControl }), `upload blog ${key}`);
+          if (isVerbose)
+            log.debug(`  Uploaded blog: ${key}`);
+        }, "", [".DS_Store"]);
+        const blogDistributionId = outputs.blogCloudFrontDistributionId || outputs.publicCloudFrontDistributionId || outputs.CloudFrontDistributionId;
+        if (blogDistributionId) {
+          if (isVerbose)
+            log.debug("  Invalidating CloudFront cache for blog...");
+          const { AWSClient: BlogAWSClient } = await import("@stacksjs/ts-cloud"), blogClient = new BlogAWSClient, blogInvalidationPaths = outputs.blogCloudFrontDistributionId ? ["/*"] : ["/blog", "/blog/*"];
+          await blogClient.request({
+            service: "cloudfront",
+            region: "us-east-1",
+            method: "POST",
+            path: `/2020-05-31/distribution/${blogDistributionId}/invalidation`,
+            headers: {
+              "Content-Type": "application/xml"
+            },
+            body: `<?xml version="1.0" encoding="UTF-8"?>
+<InvalidationBatch xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">
+  <CallerReference>blog-${Date.now()}</CallerReference>
+  <Paths>
+    <Quantity>${blogInvalidationPaths.length}</Quantity>
+    <Items>
+      ${blogInvalidationPaths.map((path) => `<Path>${path}</Path>`).join(`
+      `)}
+    </Items>
+  </Paths>
+</InvalidationBatch>`
+          });
+        }
+        blogDeploySpinner.succeed(`Blog deployed to S3 (${blogBucketName})`);
+      }
+    } catch (blogDeployError) {
+      blogDeploySpinner.fail(`Blog deployment failed: ${blogDeployError.message}`);
+      if (isVerbose)
+        log.debug(`Blog deploy error: ${blogDeployError.stack}`);
+    }
+  } else if (isVerbose)
+    log.debug("No blog build found at dist/blog, skipping blog deployment");
+  const errorPageSpinner = spinner("Configuring 404 error page...");
+  errorPageSpinner.start();
+  try {
+    const { S3Client, CloudFormationClient, AWSClient } = await import("@stacksjs/ts-cloud"), { existsSync: exists404, readFileSync: read404 } = await import("node:fs"), s3 = new S3Client(region), cf = new CloudFormationClient(region), awsClient = new AWSClient, stackName = `${projectName}-cloud`, outputs = await cf.getStackOutputs(stackName), frontendBucket = outputs.FrontendBucketName, docsBucket = outputs.DocsBucketName, distributionId = outputs.publicCloudFrontDistributionId || outputs.CloudFrontDistributionId, docs404Path = p.projectPath("dist/docs/.bunpress/404.html");
+    let html404Content;
+    if (exists404(docs404Path)) {
+      html404Content = read404(docs404Path, "utf-8");
+      if (isVerbose)
+        log.debug("  Using BunPress-generated 404.html");
+    } else {
+      html404Content = `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>404 - Page Not Found</title>
+  <meta name="robots" content="noindex">
+  <style>
+    :root {
+      --vp-c-bg: #ffffff;
+      --vp-c-divider: #e2e2e3;
+      --vp-c-text-1: rgba(60, 60, 67);
+      --vp-c-text-2: rgba(60, 60, 67, 0.78);
+      --vp-c-brand-1: #3451b2;
+      --vp-c-brand-2: #3a5ccc;
+    }
+    @media (prefers-color-scheme: dark) {
+      :root {
+        --vp-c-bg: #1b1b1f;
+        --vp-c-divider: #2e2e32;
+        --vp-c-text-1: rgba(255, 255, 245, 0.86);
+        --vp-c-text-2: rgba(235, 235, 245, 0.6);
+        --vp-c-brand-1: #a8b1ff;
+        --vp-c-brand-2: #5c73e7;
+      }
+    }
+    * { margin: 0; padding: 0; box-sizing: border-box; }
+    body { min-height: 100vh; background: var(--vp-c-bg); color: var(--vp-c-text-1); font-family: Inter, ui-sans-serif, system-ui, sans-serif; }
+    .NotFound { padding: 96px 32px 168px; text-align: center; min-height: 100vh; display: flex; flex-direction: column; justify-content: center; align-items: center; }
+    .code { font-size: 64px; font-weight: 600; line-height: 64px; }
+    .title { padding-top: 12px; letter-spacing: 2px; font-size: 20px; font-weight: 700; }
+    .divider { margin: 24px auto 18px; width: 64px; height: 1px; background: var(--vp-c-divider); }
+    .quote { max-width: 256px; font-size: 14px; font-weight: 500; color: var(--vp-c-text-2); }
+    .action { padding-top: 20px; }
+    .link { display: inline-block; border: 1px solid var(--vp-c-brand-1); border-radius: 16px; padding: 3px 16px; font-size: 14px; font-weight: 500; color: var(--vp-c-brand-1); text-decoration: none; transition: border-color 0.25s, color 0.25s; }
+    .link:hover { border-color: var(--vp-c-brand-2); color: var(--vp-c-brand-2); }
+  </style>
+</head>
+<body>
+  <div class="NotFound">
+    <p class="code">404</p>
+    <h1 class="title">PAGE NOT FOUND</h1>
+    <div class="divider"></div>
+    <blockquote class="quote">But if you don't change your direction, and if you keep looking, you may end up where you are heading.</blockquote>
+    <div class="action"><a class="link" href="/docs/">Take me home</a></div>
+  </div>
+</body>
+</html>`;
+      if (isVerbose)
+        log.debug("  Using default 404.html template");
+    }
+    if (frontendBucket) {
+      await withS3Retry(() => s3.putObject({
+        bucket: frontendBucket,
+        key: "404.html",
+        body: html404Content,
+        contentType: "text/html",
+        cacheControl: "no-cache, no-store, must-revalidate"
+      }), "upload 404.html to frontend bucket");
+      if (isVerbose)
+        log.debug(`  Uploaded 404.html to frontend bucket: ${frontendBucket}`);
+    }
+    if (docsBucket) {
+      await withS3Retry(() => s3.putObject({
+        bucket: docsBucket,
+        key: "404.html",
+        body: html404Content,
+        contentType: "text/html",
+        cacheControl: "no-cache, no-store, must-revalidate"
+      }), "upload 404.html to docs bucket");
+      if (isVerbose)
+        log.debug(`  Uploaded 404.html to docs bucket: ${docsBucket}`);
+    }
+    if (distributionId) {
+      if (isVerbose)
+        log.debug("  Configuring CloudFront custom error responses...");
+      const getResult = await awsClient.request({
+        service: "cloudfront",
+        region: "us-east-1",
+        method: "GET",
+        path: `/2020-05-31/distribution/${distributionId}/config`,
+        returnHeaders: !0
+      }), etag = getResult.headers?.etag || getResult.headers?.ETag || "", currentConfig = getResult.body?.DistributionConfig || getResult.DistributionConfig;
+      if (currentConfig && etag) {
+        if (!((currentConfig.CustomErrorResponses?.Quantity || 0) > 0 && currentConfig.CustomErrorResponses?.Items?.CustomErrorResponse?.some?.((err) => err.ErrorCode === 404 && err.ResponsePagePath === "/404.html"))) {
+          currentConfig.CustomErrorResponses = {
+            Quantity: 2,
+            Items: {
+              CustomErrorResponse: [
+                {
+                  ErrorCode: 403,
+                  ResponsePagePath: "/404.html",
+                  ResponseCode: 404,
+                  ErrorCachingMinTTL: 10
+                },
+                {
+                  ErrorCode: 404,
+                  ResponsePagePath: "/404.html",
+                  ResponseCode: 404,
+                  ErrorCachingMinTTL: 10
+                }
+              ]
+            }
+          };
+          const buildXmlElement = (name, value, indent = "") => {
+            if (value === null || value === void 0)
+              return "";
+            if (typeof value === "boolean")
+              return `${indent}<${name}>${value}</${name}>
+`;
+            if (typeof value === "number" || typeof value === "string")
+              return `${indent}<${name}>${value}</${name}>
+`;
+            if (Array.isArray(value))
+              return value.map((item) => buildXmlElement(name, item, indent)).join("");
+            if (typeof value === "object") {
+              if (name.startsWith("@_") || name === "?xml")
+                return "";
+              let children = "";
+              for (const [key, val] of Object.entries(value))
+                if (!key.startsWith("@_") && key !== "#text")
+                  children += buildXmlElement(key, val, `${indent}  `);
+              if (value["#text"] !== void 0)
+                return `${indent}<${name}>${value["#text"]}</${name}>
+`;
+              return `${indent}<${name}>
+${children}${indent}</${name}>
+`;
+            }
+            return "";
+          }, xml = `<?xml version="1.0" encoding="UTF-8"?>
+<DistributionConfig xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">
+${Object.entries(currentConfig).filter(([key]) => !key.startsWith("@_")).map(([key, val]) => buildXmlElement(key, val, "  ")).join("")}</DistributionConfig>
+`;
+          await awsClient.request({
+            service: "cloudfront",
+            region: "us-east-1",
+            method: "PUT",
+            path: `/2020-05-31/distribution/${distributionId}/config`,
+            body: xml,
+            headers: {
+              "Content-Type": "application/xml",
+              "If-Match": etag
+            }
+          });
+          if (isVerbose)
+            log.debug("  CloudFront custom error responses configured");
+        } else if (isVerbose)
+          log.debug("  CloudFront custom error responses already configured");
+      }
+    }
+    errorPageSpinner.succeed("404 error page configured");
+  } catch (errorPageError) {
+    errorPageSpinner.stop();
+    console.log(`\u26A0 404 page configuration skipped: ${errorPageError.message}`);
+    if (isVerbose)
+      log.debug(`Error page config error: ${errorPageError.stack}`);
+  }
+  try {
+    const tunnelCloudConfig = await import(p.projectPath("config/cloud")), tunnelConfig = tunnelCloudConfig?.tsCloud?.infrastructure?.tunnel;
+    if (tunnelConfig?.enabled) {
+      const tunnelDomain = tunnelConfig.domain || "";
+      if (!tunnelDomain || tunnelDomain === "localtunnel.dev" || tunnelDomain === "api.localtunnel.dev")
+        console.log("\u2139 Tunnel: Using shared localtunnel.dev (no custom tunnel deployment needed)");
+      else {
+        const tunnelSpinner = spinner(`Deploying tunnel server to ${tunnelDomain}...`);
+        tunnelSpinner.start();
+        try {
+          const { deployTunnelServer } = await import("@stacksjs/tunnel");
+          await deployTunnelServer({
+            domain: tunnelDomain,
+            region: tunnelConfig.region || tunnelCloudConfig?.tsCloud?.project?.region || "us-east-1",
+            instanceType: tunnelConfig.instanceType,
+            prefix: tunnelConfig.prefix,
+            enableSsl: tunnelConfig.ssl?.enabled,
+            porkbunApiKey: tunnelConfig.ssl?.porkbunApiKey,
+            porkbunSecretKey: tunnelConfig.ssl?.porkbunSecretKey,
+            verbose: isVerbose
+          });
+          tunnelSpinner.succeed(`Tunnel server deployed to ${tunnelDomain}`);
+        } catch (tunnelError) {
+          tunnelSpinner.stop();
+          console.log(`\u26A0 Tunnel deployment skipped: ${tunnelError.message}`);
+          if (isVerbose)
+            log.debug(`Tunnel deploy error: ${tunnelError.stack}`);
+        }
+      }
+    }
+  } catch {}
+  const dnsSpinner = spinner("Reconciling DNS records...");
+  dnsSpinner.start();
+  try {
+    const { Route53Client, CloudFormationClient: DnsCfClient } = await import("@stacksjs/ts-cloud"), dnsCf = new DnsCfClient(region), dnsStackName = `${projectName}-cloud`, dnsOutputs = await dnsCf.getStackOutputs(dnsStackName), dnsCloudConfig = await import(p.projectPath("config/cloud")), hostedZoneId = dnsCloudConfig?.tsCloud?.infrastructure?.dns?.hostedZoneId, siteDomain = dnsCloudConfig?.tsCloud?.infrastructure?.dns?.domain || "stacksjs.com";
+    if (hostedZoneId) {
+      const route53 = new Route53Client(region), cfHostedZoneId = "Z2FDTNDATAQYW2", domainMappings = [
+        { domain: siteDomain, cfDomain: dnsOutputs.publicCloudFrontDomain },
+        { domain: `www.${siteDomain}`, cfDomain: dnsOutputs.publicCloudFrontDomain },
+        { domain: `docs.${siteDomain}`, cfDomain: dnsOutputs.docsCloudFrontDomain },
+        { domain: `blog.${siteDomain}`, cfDomain: dnsOutputs.blogCloudFrontDomain }
+      ];
+      let recordsCreated = 0;
+      for (const { domain, cfDomain } of domainMappings) {
+        if (!cfDomain)
+          continue;
+        try {
+          if (!((await route53.listResourceRecordSets({
+            HostedZoneId: hostedZoneId,
+            StartRecordName: domain,
+            StartRecordType: "A",
+            MaxItems: "1"
+          }))?.ResourceRecordSets || []).some((r) => r.Name === `${domain}.` && r.Type === "A")) {
+            await route53.changeResourceRecordSets({
+              HostedZoneId: hostedZoneId,
+              ChangeBatch: {
+                Changes: [
+                  {
+                    Action: "UPSERT",
+                    ResourceRecordSet: {
+                      Name: domain,
+                      Type: "A",
+                      AliasTarget: {
+                        HostedZoneId: cfHostedZoneId,
+                        DNSName: cfDomain,
+                        EvaluateTargetHealth: !1
+                      }
+                    }
+                  },
+                  {
+                    Action: "UPSERT",
+                    ResourceRecordSet: {
+                      Name: domain,
+                      Type: "AAAA",
+                      AliasTarget: {
+                        HostedZoneId: cfHostedZoneId,
+                        DNSName: cfDomain,
+                        EvaluateTargetHealth: !1
+                      }
+                    }
+                  }
+                ]
+              }
+            });
+            recordsCreated++;
+            if (isVerbose)
+              log.debug(`  Created DNS records: ${domain} -> ${cfDomain}`);
+          } else if (isVerbose)
+            log.debug(`  DNS record exists: ${domain}`);
+        } catch (dnsErr) {
+          if (isVerbose)
+            log.debug(`  DNS check/create failed for ${domain}: ${dnsErr.message}`);
+        }
+      }
+      if (recordsCreated > 0)
+        dnsSpinner.succeed(`DNS records reconciled (${recordsCreated} created)`);
+      else
+        dnsSpinner.succeed("DNS records verified");
+    } else {
+      dnsSpinner.stop();
+      if (isVerbose)
+        log.debug("No hosted zone ID configured, skipping DNS reconciliation");
+    }
+  } catch (dnsError) {
+    dnsSpinner.stop();
+    console.log(`\u26A0 DNS reconciliation skipped: ${dnsError.message}`);
+    if (isVerbose)
+      log.debug(`DNS error: ${dnsError.stack}`);
+  }
+  console.log("");
+  log.success("Deployment completed successfully!");
+} catch (error) {
+  log.error("Deployment failed:", error);
+  process.exit(ExitCode.FatalError);
+}