@stacksjs/buddy 0.70.257 → 0.70.259

package/dist/commands/deploy.js

@@ -1,675 +1,6 @@
-import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { isAbsolute, join, relative, resolve } from "node:path";
-import process from "node:process";
-import { pathToFileURL } from "node:url";
-import { runAction } from "@stacksjs/actions";
-import { italic, onUnknownSubcommand, outro, prompts, runCommand } from "@stacksjs/cli";
-import { app, dns as dnsConfig, email as emailConfig, cloud as cloudConfig } from "@stacksjs/config";
-import { addDomain, hasUserDomainBeenAddedToCloud, syncDnsConfig } from "@stacksjs/dns";
-import { loadProjectDnsConfig } from "../config";
-import { encryptEnv, env } from "@stacksjs/env";
-import { Action } from "@stacksjs/enums";
-import { path as p } from "@stacksjs/path";
-import { ExitCode } from "@stacksjs/types";
-import { getErrorCode, getErrorMessage } from "@stacksjs/utils";
-import { ensureAppKey, ensureEnvIsSet } from "./setup";
-const log = {
-  info: (...args) => console.log("\u2139", ...args),
-  success: (...args) => console.log("\u2713", ...args),
-  warn: (...args) => console.log("\u26A0", ...args),
-  error: (...args) => console.error("\u2717", ...args),
-  debug: (...args) => {
-    if (process.argv.includes("--verbose") || process.argv.includes("-v"))
-      console.log("\uD83D\uDD0D", ...args);
-  }
-}, MAIL_PACKAGE_DOMAIN = "github.com/mail-os/mail", MAIL_PACKAGE_SPEC = `${MAIL_PACKAGE_DOMAIN}@0.1.0`, MAIL_TARGET_PLATFORM = "linux-x86_64", MAIL_BINARY_NAMES = ["mail", "mail-x86_64-linux", "mail-x86_64-linux-gnu"];
-function collectMatchingFiles(root, names, maxDepth = 8) {
-  const nameSet = new Set(names), matches = [];
-  if (!existsSync(root))
-    return matches;
-  function walk(dir, depth) {
-    if (depth > maxDepth)
-      return;
-    for (const entry of readdirSync(dir)) {
-      if (entry === ".git" || entry === "node_modules")
-        continue;
-      const fullPath = join(dir, entry), stat = statSync(fullPath);
-      if (stat.isDirectory())
-        walk(fullPath, depth + 1);
-      else if (stat.isFile() && nameSet.has(entry))
-        matches.push(fullPath);
-    }
-  }
-  walk(root, 0);
-  return matches;
-}
-function isElfBinary(filePath) {
-  const header = readFileSync(filePath).slice(0, 4);
-  return header[0] === 127 && header[1] === 69 && header[2] === 76 && header[3] === 70;
-}
-function resolvePantryInstallCommand() {
-  const localPantryCli = join(homedir(), "Code", "Tools", "pantry", "packages", "ts-pantry", "bin", "cli.ts");
-  if (existsSync(localPantryCli))
-    return { command: "bun", args: [localPantryCli] };
-  const projectPantry = p.projectPath("pantry/.bin/pantry");
-  if (existsSync(projectPantry))
-    return { command: projectPantry, args: [] };
-  const globalPantry = join(homedir(), ".local", "share", "pantry", "global", "bin", "pantry");
-  if (existsSync(globalPantry))
-    return { command: globalPantry, args: [] };
-  return { command: "pantry", args: [] };
-}
-async function installMailBinaryWithPantry() {
-  const { execFileSync } = await import("node:child_process"), pantry = resolvePantryInstallCommand();
-  execFileSync(pantry.command, [
-    ...pantry.args,
-    "install",
-    MAIL_PACKAGE_SPEC,
-    "--install-dir",
-    p.projectPath("pantry"),
-    "--platform",
-    MAIL_TARGET_PLATFORM,
-    "--quiet"
-  ], {
-    cwd: p.projectPath(),
-    stdio: process.argv.includes("--verbose") || process.argv.includes("-v") ? "inherit" : "pipe",
-    env: process.env
-  });
-}
-async function findPantryMailBinary() {
-  const directCandidates = [
-    ...MAIL_BINARY_NAMES.map((name) => p.projectPath(`pantry/.bin/${name}`)),
-    ...MAIL_BINARY_NAMES.map((name) => join(homedir(), ".local", "share", "pantry", "global", "bin", name))
-  ];
-  for (const candidate of directCandidates)
-    if (existsSync(candidate) && isElfBinary(candidate))
-      return candidate;
-  for (const root of [p.projectPath("pantry"), join(homedir(), ".local", "share", "pantry")])
-    for (const candidate of collectMatchingFiles(root, MAIL_BINARY_NAMES))
-      if (isElfBinary(candidate))
-        return candidate;
-  return null;
-}
-async function ensureDeployPrerequisites(verbose = !1) {
-  const cwd = p.projectPath();
-  await ensureEnvIsSet({ cwd, verbose });
-  await ensureAppKey(cwd);
-}
-function loadAwsCredentialsFromFile() {
-  const credentialsPath = join(homedir(), ".aws", "credentials"), configPath = join(homedir(), ".aws", "config");
-  if (!existsSync(credentialsPath))
-    return {};
-  try {
-    const lines = readFileSync(credentialsPath, "utf-8").split(`
-`), profiles = ["default", "stacks"];
-    let currentProfile = "", credentials = {};
-    const profileCredentials = {};
-    for (const line of lines) {
-      const trimmed = line.trim(), profileMatch = trimmed.match(/^\[(.+)\]$/);
-      if (profileMatch?.[1]) {
-        currentProfile = profileMatch[1];
-        profileCredentials[currentProfile] = {};
-        continue;
-      }
-      const keyValue = trimmed.match(/^(\w+)\s*=\s*(.+)$/);
-      if (keyValue && currentProfile) {
-        const [, key, value] = keyValue, target = profileCredentials[currentProfile];
-        if (!target || value === void 0)
-          continue;
-        if (key === "aws_access_key_id")
-          target.accessKeyId = value;
-        else if (key === "aws_secret_access_key")
-          target.secretAccessKey = value;
-      }
-    }
-    for (const profile of profiles)
-      if (profileCredentials[profile]?.accessKeyId && profileCredentials[profile]?.secretAccessKey) {
-        credentials = profileCredentials[profile];
-        log.debug(`Using AWS credentials from ~/.aws/credentials [${profile}] profile`);
-        break;
-      }
-    if (!credentials.accessKeyId) {
-      for (const [profile, creds] of Object.entries(profileCredentials))
-        if (creds.accessKeyId && creds.secretAccessKey) {
-          credentials = creds;
-          log.debug(`Using AWS credentials from ~/.aws/credentials [${profile}] profile`);
-          break;
-        }
-    }
-    let region;
-    if (existsSync(configPath)) {
-      const regionMatch = readFileSync(configPath, "utf-8").match(/region\s*=\s*(.+)/);
-      if (regionMatch?.[1])
-        region = regionMatch[1].trim();
-    }
-    return { ...credentials, region };
-  } catch (error) {
-    log.debug("Failed to read AWS credentials file:", error);
-    return {};
-  }
-}
-async function setupEmailDnsRecords(emailDomain, region, logger, options) {
-  logger.info("Setting up email DNS records...");
-  try {
-    const { SESClient } = await import("@stacksjs/ts-cloud"), { Route53Client } = await import("@stacksjs/ts-cloud"), ses = new SESClient(region), route53 = new Route53Client(region);
-    logger.info(`Getting DKIM tokens for ${emailDomain}...`);
-    const tokens = (await ses.getEmailIdentity(emailDomain)).DkimAttributes?.Tokens || [];
-    if (tokens.length === 0) {
-      logger.warn("No DKIM tokens found - domain may not be set up in SES yet");
-      return;
-    }
-    logger.info(`Found ${tokens.length} DKIM tokens`);
-    const zone = (await route53.listHostedZones()).HostedZones?.find((z) => z.Name === `${emailDomain}.`);
-    if (!zone) {
-      logger.warn(`Hosted zone not found for ${emailDomain} - DNS records must be added manually`);
-      logger.info("DKIM records needed:");
-      for (const token of tokens)
-        logger.info(`  CNAME: ${token}._domainkey.${emailDomain} -> ${token}.dkim.amazonses.com`);
-      logger.info(`  MX: ${emailDomain} -> 10 inbound-smtp.${region}.amazonaws.com`);
-      return;
-    }
-    const hostedZoneId = zone.Id?.replace("/hostedzone/", "");
-    logger.info(`Found hosted zone: ${hostedZoneId}`);
-    for (const token of tokens) {
-      const recordName = `${token}._domainkey.${emailDomain}`, recordValue = `${token}.dkim.amazonses.com`;
-      try {
-        await route53.changeResourceRecordSets({
-          HostedZoneId: hostedZoneId,
-          ChangeBatch: {
-            Changes: [{
-              Action: "UPSERT",
-              ResourceRecordSet: {
-                Name: recordName,
-                Type: "CNAME",
-                TTL: 300,
-                ResourceRecords: [{ Value: recordValue }]
-              }
-            }]
-          }
-        });
-        logger.success(`Added DKIM record: ${token}._domainkey`);
-      } catch (e) {
-        logger.warn(`Failed to add DKIM record: ${getErrorMessage(e)}`);
-      }
-    }
-    const mailSubdomain = options?.mailSubdomain || "mail", mxTarget = options?.mode === "server" ? `10 ${mailSubdomain}.${emailDomain}` : `10 inbound-smtp.${region}.amazonaws.com`;
-    try {
-      await route53.changeResourceRecordSets({
-        HostedZoneId: hostedZoneId,
-        ChangeBatch: {
-          Changes: [{
-            Action: "UPSERT",
-            ResourceRecordSet: {
-              Name: emailDomain,
-              Type: "MX",
-              TTL: 300,
-              ResourceRecords: [{ Value: mxTarget }]
-            }
-          }]
-        }
-      });
-      logger.success(`Added MX record: ${mxTarget}`);
-    } catch (e) {
-      logger.warn(`Failed to add MX record: ${getErrorMessage(e)}`);
-    }
-    try {
-      await route53.changeResourceRecordSets({
-        HostedZoneId: hostedZoneId,
-        ChangeBatch: {
-          Changes: [{
-            Action: "UPSERT",
-            ResourceRecordSet: {
-              Name: emailDomain,
-              Type: "TXT",
-              TTL: 300,
-              ResourceRecords: [{ Value: '"v=spf1 include:amazonses.com ~all"' }]
-            }
-          }]
-        }
-      });
-      logger.success("Added SPF record");
-    } catch (e) {
-      logger.warn(`Failed to add SPF record: ${getErrorMessage(e)}`);
-    }
-    try {
-      await route53.changeResourceRecordSets({
-        HostedZoneId: hostedZoneId,
-        ChangeBatch: {
-          Changes: [{
-            Action: "UPSERT",
-            ResourceRecordSet: {
-              Name: `_dmarc.${emailDomain}`,
-              Type: "TXT",
-              TTL: 300,
-              ResourceRecords: [{ Value: `"v=DMARC1;p=quarantine;pct=25;rua=mailto:dmarcreports@${emailDomain}"` }]
-            }
-          }]
-        }
-      });
-      logger.success("Added DMARC record");
-    } catch (e) {
-      logger.warn(`Failed to add DMARC record: ${getErrorMessage(e)}`);
-    }
-    try {
-      const ruleSetName = `${process.env.APP_NAME?.toLowerCase().replace(/[^a-z0-9]/g, "-") || "stacks"}-email-rules`;
-      await ses.setActiveReceiptRuleSet(ruleSetName);
-      logger.success(`Activated email receipt rule set: ${ruleSetName}`);
-    } catch (e) {
-      logger.warn(`Failed to activate receipt rule set: ${getErrorMessage(e)}`);
-    }
-    logger.success("Email DNS records configured!");
-    logger.info("Note: DKIM verification may take 5-15 minutes to complete");
-  } catch (error) {
-    logger.warn(`Failed to set up email DNS records: ${getErrorMessage(error)}`);
-    logger.info("You can manually set up DNS records using: buddy email:verify");
-  }
-}
-async function createDefaultMailUser(appName, emailDomain, region, logger) {
-  try {
-    const { DynamoDBClient } = await import("@stacksjs/ts-cloud"), crypto = await import("crypto"), dynamodb = new DynamoDBClient(region), tableName = `${appName}-mail-users`, mailboxes = emailConfig?.mailboxes || [];
-    if (mailboxes.length === 0) {
-      const defaultEmail = `admin@${emailDomain}`, defaultPassword = crypto.randomBytes(16).toString("hex"), passwordHash = crypto.createHash("sha256").update(defaultPassword).digest("hex");
-      try {
-        await dynamodb.putItem({
-          TableName: tableName,
-          Item: {
-            email: { S: defaultEmail },
-            passwordHash: { S: passwordHash },
-            createdAt: { S: new Date().toISOString() },
-            displayName: { S: "Admin" }
-          }
-        });
-        logger.success(`Created default mail user: ${defaultEmail}`);
-        logger.info(`Password: ${defaultPassword}`);
-        logger.info("Save this password - it will not be shown again!");
-      } catch (e) {
-        const msg = getErrorMessage(e);
-        if (msg.includes("ConditionalCheckFailedException") || msg.includes("already exists"))
-          logger.debug("Default mail user already exists");
-        else
-          throw e;
-      }
-    } else
-      for (const mailbox of mailboxes) {
-        const mb = mailbox, email = typeof mailbox === "string" ? `${mailbox}@${emailDomain}` : `${mb.name || mb.address?.split("@")[0]}@${emailDomain}`, password = typeof mailbox === "object" && mb.password ? mb.password : crypto.randomBytes(16).toString("hex"), passwordHash = crypto.createHash("sha256").update(password).digest("hex");
-        try {
-          await dynamodb.putItem({
-            TableName: tableName,
-            Item: {
-              email: { S: email },
-              passwordHash: { S: passwordHash },
-              createdAt: { S: new Date().toISOString() },
-              displayName: { S: typeof mailbox === "object" ? mb.displayName || mb.name || email : mailbox }
-            }
-          });
-          logger.success(`Created mail user: ${email}`);
-          if (typeof mailbox !== "object" || !mb.password)
-            logger.info(`  Password: ${password}`);
-        } catch (e) {
-          const msg = getErrorMessage(e);
-          if (msg.includes("ConditionalCheckFailedException"))
-            logger.debug(`Mail user ${email} already exists`);
-          else
-            logger.warn(`Failed to create mail user ${email}: ${msg}`);
-        }
-      }
-  } catch (error) {
-    logger.warn(`Failed to create mail users: ${getErrorMessage(error)}`);
-  }
-}
-async function uploadMailServerToS3(bucketName, region, mode) {
-  try {
-    const { S3Client: S3 } = await import("@stacksjs/ts-cloud"), s3Client = new S3(region);
-    if (mode === "serverless") {
-      const serverTsPath = p.frameworkPath("core/mail-server/server.ts");
-      if (existsSync(serverTsPath)) {
-        const serverCode = readFileSync(serverTsPath, "utf-8");
-        await s3Client.putObject({
-          bucket: bucketName,
-          key: "mail-server/server.ts",
-          body: serverCode,
-          contentType: "text/typescript"
-        });
-        log.success("Uploaded serverless mail server code to S3");
-      }
-      const pkgPath = p.frameworkPath("core/mail-server/package.json");
-      if (existsSync(pkgPath)) {
-        const pkgJson = readFileSync(pkgPath, "utf-8");
-        await s3Client.putObject({
-          bucket: bucketName,
-          key: "mail-server/package.json",
-          body: pkgJson,
-          contentType: "application/json"
-        });
-      }
-      return;
-    }
-    let binaryUploaded = !1;
-    try {
-      await installMailBinaryWithPantry();
-      const linuxBinaryPath = await findPantryMailBinary();
-      if (linuxBinaryPath && existsSync(linuxBinaryPath) && isElfBinary(linuxBinaryPath)) {
-        log.info(`Uploading Pantry mail binary: ${linuxBinaryPath}`);
-        const binaryContent = readFileSync(linuxBinaryPath);
-        await s3Client.putObject({
-          bucket: bucketName,
-          key: "mail-server/smtp-server",
-          body: binaryContent,
-          contentType: "application/octet-stream"
-        });
-        log.success("Uploaded Linux x86_64 mail server binary to S3");
-        binaryUploaded = !0;
-      }
-    } catch (error) {
-      log.debug(`Pantry mail install failed: ${getErrorMessage(error)}`);
-    }
-    if (!binaryUploaded)
-      log.warn(`No Pantry-provided ${MAIL_TARGET_PLATFORM} mail binary found. Release ${MAIL_PACKAGE_DOMAIN}, then run the Pantry binary sync for that package.`);
-  } catch (uploadErr) {
-    log.debug(`Could not upload mail server to S3 (bucket may not exist yet): ${uploadErr.message}`);
-  }
-}
-async function loadTsCloudConfig(envName) {
-  try {
-    const base = p.projectPath("config/cloud.ts");
-    return (await import(envName ? `${base}?env=${envName}` : base)).tsCloud;
-  } catch (err) {
-    log.debug("Could not load config/cloud.ts tsCloud export:", err);
-    return;
-  }
-}
-function resolveProvider(tsCloudConfig) {
-  return tsCloudConfig?.cloud?.provider || process.env.CLOUD_PROVIDER || "aws";
-}
-function readWaitSecs(name, defaultSecs) {
-  const secs = process.env[name] ? Number.parseInt(process.env[name], 10) : Number.NaN;
-  return Number.isFinite(secs) && secs > 0 ? secs : defaultSecs;
-}
-function fmtDuration(secs) {
-  const m = Math.floor(secs / 60), s = secs % 60;
-  return m ? s ? `${m}m${s}s` : `${m}m` : `${s}s`;
-}
-async function pollUntil(opts) {
-  log.info(`${opts.label} (up to ${fmtDuration(opts.timeoutSecs)})...`);
-  const started = Date.now(), deadline = started + opts.timeoutSecs * 1000;
-  let lastHeartbeat = 0;
-  for (;; )
-    try {
-      await opts.check();
-      return;
-    } catch {
-      const elapsedSecs = Math.floor((Date.now() - started) / 1000);
-      if (Date.now() > deadline)
-        throw Error(opts.timeoutMessage(elapsedSecs));
-      if (elapsedSecs - lastHeartbeat >= 30) {
-        log.info(`  \u2026 still waiting (${elapsedSecs}s elapsed)`);
-        lastHeartbeat = elapsedSecs;
-      }
-      await new Promise((r) => setTimeout(r, opts.intervalMs ?? 5000));
-    }
-}
-async function waitForRemoteReady(ip) {
-  const { sshExecOrThrow } = await import("@stacksjs/ts-cloud"), run = (remote) => sshExecOrThrow(ip, remote, { user: "root", connectTimeoutSec: 10 }), sshWaitSecs = readWaitSecs("TS_CLOUD_SSH_WAIT_SECS", 480);
-  await pollUntil({
-    label: "Waiting for SSH to come up",
-    timeoutSecs: sshWaitSecs,
-    check: () => run("true"),
-    timeoutMessage: (elapsed) => `SSH did not become reachable on ${ip} within ${fmtDuration(sshWaitSecs)} (waited ${elapsed}s). ` + "The box may still be booting \u2014 raise TS_CLOUD_SSH_WAIT_SECS and retry."
-  });
-  log.success("SSH is up");
-  log.info("Waiting for cloud-init (installing bun + caddy)...");
-  try {
-    await run("cloud-init status --wait || true");
-  } catch (err) {
-    log.debug("cloud-init status --wait returned non-zero (continuing):", err);
-  }
-  const bootWaitSecs = readWaitSecs("TS_CLOUD_BOOT_WAIT_SECS", 720);
-  await pollUntil({
-    label: "Waiting for the bun runtime",
-    timeoutSecs: bootWaitSecs,
-    check: () => run("test -x /usr/local/bin/bun"),
-    timeoutMessage: (elapsed) => `bun runtime did not appear at /usr/local/bin/bun within ${fmtDuration(bootWaitSecs)} (waited ${elapsed}s). ` + "cloud-init may have failed \u2014 SSH in and check /var/log/cloud-init-output.log; " + "raise TS_CLOUD_BOOT_WAIT_SECS for slow regions."
-  });
-  log.success("Server is ready (bun installed)");
-}
-async function resolveDeclaredTenants() {
-  try {
-    const { config } = await import("@stacksjs/config"), tenants = config.cloud?.tenants;
-    return Array.isArray(tenants) ? tenants.filter((slug) => typeof slug === "string") : [];
-  } catch {
-    return [];
-  }
-}
-export async function resolveDeployEnvValues(environment, tsCloudConfig) {
-  const fileName = environment === "production" ? ".env.production" : environment === "staging" ? ".env.staging" : existsSync(p.projectPath(".env.development")) ? ".env.development" : ".env", filePath = p.projectPath(fileName);
-  if (!existsSync(filePath))
-    return {};
-  try {
-    const { getEnv } = await import("@stacksjs/env"), result = getEnv(void 0, { file: fileName, format: "json" });
-    if (!result.success || !result.output) {
-      log.debug(`[deploy] Could not read ${fileName} for site env merging: ${result.error ?? "unknown error"}`);
-      return {};
-    }
-    const parsed = JSON.parse(result.output), values = {};
-    for (const [key, value] of Object.entries(parsed)) {
-      if (/^DOTENV_(PUBLIC|PRIVATE)_KEY/.test(key))
-        continue;
-      values[key] = String(value);
-    }
-    const { foreignTenantKeys, partitionTenantEnv } = await import("@stacksjs/env"), partition = partitionTenantEnv(values, {
-      self: tsCloudConfig?.project?.slug,
-      tenants: await resolveDeclaredTenants()
-    });
-    for (const { tenant, keys } of foreignTenantKeys(partition))
-      log.warn(`[deploy] Skipping ${keys.length} '${tenant}' key(s) in ${fileName} \u2014 they belong to that tenant's own ` + `repository, and shipping them writes its secrets into this project's site .env files. Remove them with: buddy env:check --file ${fileName}. Keys: ${keys.join(", ")}`);
-    return partition.own;
-  } catch (error) {
-    log.debug(`[deploy] Failed to resolve ${fileName} for site env merging:`, error);
-    return {};
-  }
-}
-export function mergeSiteDeployEnv(sites, resolvedDeployEnv) {
-  return Object.fromEntries(Object.entries(sites).map(([siteName, site]) => {
-    if (!site)
-      return [siteName, site];
-    const base = { ...resolvedDeployEnv };
-    if (site.port !== void 0)
-      delete base.PORT;
-    return [siteName, { ...site, env: { ...base, ...site.env || {} } }];
-  }));
-}
-function looksLikeSqliteFile(value) {
-  return typeof value === "string" && /\.(?:sqlite3?|db)$/i.test(value.trim());
-}
-export function siteSqlitePath(siteEnv = {}) {
-  if (String(siteEnv.DB_CONNECTION ?? "sqlite").trim().toLowerCase() !== "sqlite")
-    return null;
-  const configured = typeof siteEnv.DB_DATABASE_PATH === "string" && siteEnv.DB_DATABASE_PATH.trim() ? siteEnv.DB_DATABASE_PATH : looksLikeSqliteFile(siteEnv.DB_DATABASE) ? siteEnv.DB_DATABASE : "database/stacks.sqlite", path = String(configured).trim().replace(/^\.\//, "");
-  if (!path || path.startsWith("/") || path.startsWith("~") || path.split("/").includes(".."))
-    return null;
-  return path;
-}
-export function tsCloudPersistentStateSupport(buildSiteDeployScript) {
-  const missing = [];
-  if (typeof buildSiteDeployScript !== "function")
-    return { ok: !1, missing: ["buildSiteDeployScript"] };
-  const target = "/var/www/probe-shared/database/probe.sqlite";
-  let script = "";
-  try {
-    script = buildSiteDeployScript({
-      siteName: "probe",
-      slug: "probe",
-      appDir: "/var/www/probe-probe",
-      artifactFetch: [],
-      releaseId: "probe",
-      execStart: "/bin/true",
-      envEntries: {},
-      port: 3000,
-      sharedPaths: [{ path: "database/probe.sqlite", target, seed: !0 }]
-    }).join(`
-`);
-  } catch {
-    return { ok: !1, missing: ["shared paths with an explicit target"] };
-  }
-  if (!(script.includes("cp -a") && script.includes("/current/")))
-    missing.push("adoption of existing state into shared/");
-  if (!script.includes(`ln -sfn ${target} `))
-    missing.push("shared paths with an explicit target");
-  return { ok: missing.length === 0, missing };
-}
-export function projectDatabaseTarget(slug, relativePath) {
-  return `/var/www/${slug}-shared/${relativePath}`;
-}
-function runsMigrations(site) {
-  return Array.isArray(site?.preStart) && site.preStart.some((cmd) => typeof cmd === "string" && /\bmigrate\b/.test(cmd));
-}
-export function applyPersistentStatePaths(sites, slug) {
-  const isServerApp = (site) => !!site && typeof site.start === "string", appSites = Object.entries(sites).filter(([, site]) => isServerApp(site)), owner = (appSites.find(([, site]) => runsMigrations(site)) ?? appSites[0])?.[0], out = {};
-  for (const [name, site] of Object.entries(sites)) {
-    if (!isServerApp(site)) {
-      out[name] = site;
-      continue;
-    }
-    const sqlite = siteSqlitePath(site.env || {}), framework = [
-      "storage/logs"
-    ];
-    if (sqlite)
-      framework.unshift({
-        path: sqlite,
-        target: projectDatabaseTarget(slug, sqlite),
-        seed: name === owner
-      });
-    const declared = Array.isArray(site.sharedPaths) ? site.sharedPaths.filter(Boolean) : [], byPath = new Map;
-    for (const entry of [...declared, ...framework])
-      byPath.set(typeof entry === "string" ? entry : entry.path, entry);
-    out[name] = { ...site, sharedPaths: [...byPath.values()] };
-  }
-  return out;
-}
-function prefixHostForEnv(host, prefix) {
-  if (host.startsWith(`${prefix}.`) || host.startsWith(`www.${prefix}.`))
-    return host;
-  if (host.startsWith("www."))
-    return `www.${prefix}.${host.slice(4)}`;
-  return `${prefix}.${host}`;
-}
-export function applyEnvironmentToSites(sites, environment, config) {
-  const prefix = config?.environments?.[environment]?.domainPrefix;
-  if (!prefix || environment === "production")
-    return sites;
-  const allHosts = [];
-  for (const site of Object.values(sites)) {
-    const d = site?.domain;
-    if (typeof d === "string")
-      allHosts.push(d);
-    else if (Array.isArray(d)) {
-      for (const x of d)
-        if (typeof x === "string")
-          allHosts.push(x);
-    }
-  }
-  allHosts.sort((a, b) => b.length - a.length);
-  const rewrite = (val) => {
-    let r = val;
-    for (const h of allHosts) {
-      const esc = h.replace(/[.]/g, "\\.");
-      r = r.replace(new RegExp(`//${esc}(?=[/:?#]|$)`, "g"), `//${prefixHostForEnv(h, prefix)}`);
-    }
-    return r;
-  }, out = {};
-  for (const [name, site] of Object.entries(sites)) {
-    if (!site) {
-      out[name] = site;
-      continue;
-    }
-    const s = { ...site };
-    if (typeof s.domain === "string")
-      s.domain = prefixHostForEnv(s.domain, prefix);
-    else if (Array.isArray(s.domain))
-      s.domain = s.domain.map((d) => typeof d === "string" ? prefixHostForEnv(d, prefix) : d);
-    if (typeof s.redirect === "string")
-      s.redirect = rewrite(s.redirect);
-    if (s.env && typeof s.env === "object") {
-      const e = { ...s.env };
-      for (const k of Object.keys(e))
-        if (typeof e[k] === "string")
-          e[k] = rewrite(e[k]);
-      s.env = e;
-    }
-    out[name] = s;
-  }
-  return out;
-}
-async function deployToHetzner(tsCloudConfig, deployEnv, options) {
-  const verbose = options.verbose === !0, environment = deployEnv === "prod" ? "production" : deployEnv, apiToken = tsCloudConfig.hetzner?.apiToken || process.env.HCLOUD_TOKEN || process.env.HETZNER_API_TOKEN, persistedAttachBox = resolvePersistedAttachTargetBox(tsCloudConfig, environment);
-  if (!apiToken && !persistedAttachBox) {
-    log.error("No Hetzner API token found. Set HCLOUD_TOKEN in your .env (or hetzner.apiToken in config/cloud.ts).");
-    process.exit(ExitCode.FatalError);
-  }
-  const sshPubKey = join(homedir(), ".ssh", "id_ed25519.pub");
-  if (!existsSync(sshPubKey)) {
-    log.error(`SSH public key not found at ${sshPubKey}.`);
-    log.info("ts-cloud deploys to Hetzner over SSH and registers this key on the server.");
-    log.info("Generate one with:  ssh-keygen -t ed25519");
-    process.exit(ExitCode.FatalError);
-  }
-  const { createCloudDriver, deployAllComputeSites, ensureManagementDashboard, resolveSiteKind, buildSiteDeployScript } = await loadTsCloudDeployApi(), support = tsCloudPersistentStateSupport(buildSiteDeployScript);
-  if (!support.ok) {
-    log.error("This ts-cloud cannot keep your database across deploys, and deploying anyway would destroy it.");
-    log.error(`Missing: ${support.missing.join(", ")}.`);
-    log.error("Upgrade @stacksjs/ts-cloud (bun update @stacksjs/ts-cloud), or point TS_CLOUD_MODULE at a build that has it.");
-    process.exit(ExitCode.FatalError);
-  }
-  try {
-    await runHetznerDeploy({ tsCloudConfig, environment, verbose, docker: options.docker === !0, createCloudDriver, deployAllComputeSites, ensureManagementDashboard, resolveSiteKind, onlySite: options.site || void 0, persistedAttachBox });
-  } catch (err) {
-    log.error("Hetzner deploy failed:");
-    console.error(err instanceof Error ? err.stack || err.message : err);
-    process.exit(ExitCode.FatalError);
-  }
-}
-export async function loadTsCloudDeployApi() {
-  const requested = process.env.TS_CLOUD_MODULE?.trim();
-  if (!requested)
-    return import("@stacksjs/ts-cloud");
-  const modulePath = isAbsolute(requested) ? requested : resolve(process.cwd(), requested);
-  if (!existsSync(modulePath))
-    throw Error(`TS_CLOUD_MODULE points to a missing module: ${modulePath}`);
-  return import(pathToFileURL(modulePath).href);
-}
-export function shouldInjectManagementDashboard(tsCloudConfig) {
-  return !tsCloudConfig.cloud?.attachTo;
-}
-export function reconcilePartialDeployManagementDashboards(tsCloudConfig, livePorts) {
-  const sites = tsCloudConfig.sites, preserved = [], removed = [];
-  if (!sites)
-    return { preserved, removed };
-  for (const [siteName, site] of Object.entries(sites)) {
-    if (siteName !== "dashboard" && !siteName.startsWith("dashboard-"))
-      continue;
-    const livePort = livePorts[siteName];
-    if (typeof livePort !== "number" || !Number.isInteger(livePort) || livePort < 1 || livePort > 65535) {
-      delete sites[siteName];
-      removed.push(siteName);
-      continue;
-    }
-    const next = { ...site, port: livePort };
-    if (typeof next.start === "string")
-      next.start = next.start.replace(/(--port(?:=|\s+))\d+/, `$1${livePort}`);
-    sites[siteName] = next;
-    preserved.push(siteName);
-  }
-  return { preserved, removed };
-}
-async function reconcilePartialDeployManagementDashboardsWithLiveBox(tsCloudConfig, ip) {
-  const slug = String(tsCloudConfig.project?.slug || "app").replace(/[^a-z0-9._-]+/gi, "-"), siteNames = Object.keys(tsCloudConfig.sites ?? {}).filter((name) => name === "dashboard" || name.startsWith("dashboard-"));
-  if (siteNames.length === 0)
-    return;
-  const units = siteNames.map((siteName) => ({
-    siteName,
-    unit: `${slug}-${siteName}.service`
-  })), probe = `
+import{existsSync,mkdirSync,readFileSync,readdirSync,statSync,writeFileSync}from"node:fs";import{homedir}from"node:os";import{dirname,isAbsolute,join,relative,resolve}from"node:path";import process from"node:process";import{pathToFileURL}from"node:url";import{runAction}from"@stacksjs/actions";import{italic,onUnknownSubcommand,outro,prompts,runCommand}from"@stacksjs/cli";import{app,dns as dnsConfig,email as emailConfig,cloud as cloudConfig}from"@stacksjs/config";import{addDomain,hasUserDomainBeenAddedToCloud,syncDnsConfig}from"@stacksjs/dns";import{loadProjectDnsConfig}from"../config";import{encryptEnv,env}from"@stacksjs/env";import{Action}from"@stacksjs/enums";import{path as p}from"@stacksjs/path";import{ExitCode}from"@stacksjs/types";import{getErrorCode,getErrorMessage}from"@stacksjs/utils";import{ensureAppKey,ensureEnvIsSet}from"./setup";const log={info:(...args)=>console.log("\u2139",...args),success:(...args)=>console.log("\u2713",...args),warn:(...args)=>console.log("\u26A0",...args),error:(...args)=>console.error("\u2717",...args),debug:(...args)=>{if(process.argv.includes("--verbose")||process.argv.includes("-v"))console.log("\uD83D\uDD0D",...args)}},MAIL_PACKAGE_DOMAIN="github.com/mail-os/mail",MAIL_PACKAGE_SPEC=`${MAIL_PACKAGE_DOMAIN}@0.1.0`,MAIL_TARGET_PLATFORM="linux-x86_64",MAIL_BINARY_NAMES=["mail","mail-x86_64-linux","mail-x86_64-linux-gnu"];function collectMatchingFiles(root,names,maxDepth=8){const nameSet=new Set(names),matches=[];if(!existsSync(root))return matches;function walk(dir,depth){if(depth>maxDepth)return;for(const entry of readdirSync(dir)){if(entry===".git"||entry==="node_modules")continue;const fullPath=join(dir,entry),stat=statSync(fullPath);if(stat.isDirectory())walk(fullPath,depth+1);else if(stat.isFile()&&nameSet.has(entry))matches.push(fullPath)}}walk(root,0);return matches}function isElfBinary(filePath){const header=readFileSync(filePath).slice(0,4);return header[0]===127&&header[1]===69&&header[2]===76&&header[3]===70}function resolvePantryInstallCommand(){const localPantryCli=join(homedir(),"Code","Tools","pantry","packages","ts-pantry","bin","cli.ts");if(existsSync(localPantryCli))return{command:"bun",args:[localPantryCli]};const projectPantry=p.projectPath("pantry/.bin/pantry");if(existsSync(projectPantry))return{command:projectPantry,args:[]};const globalPantry=join(homedir(),".local","share","pantry","global","bin","pantry");if(existsSync(globalPantry))return{command:globalPantry,args:[]};return{command:"pantry",args:[]}}async function installMailBinaryWithPantry(){const{execFileSync}=await import("node:child_process"),pantry=resolvePantryInstallCommand();execFileSync(pantry.command,[...pantry.args,"install",MAIL_PACKAGE_SPEC,"--install-dir",p.projectPath("pantry"),"--platform",MAIL_TARGET_PLATFORM,"--quiet"],{cwd:p.projectPath(),stdio:process.argv.includes("--verbose")||process.argv.includes("-v")?"inherit":"pipe",env:process.env})}async function findPantryMailBinary(){const directCandidates=[...MAIL_BINARY_NAMES.map((name)=>p.projectPath(`pantry/.bin/${name}`)),...MAIL_BINARY_NAMES.map((name)=>join(homedir(),".local","share","pantry","global","bin",name))];for(const candidate of directCandidates)if(existsSync(candidate)&&isElfBinary(candidate))return candidate;for(const root of[p.projectPath("pantry"),join(homedir(),".local","share","pantry")])for(const candidate of collectMatchingFiles(root,MAIL_BINARY_NAMES))if(isElfBinary(candidate))return candidate;return null}async function ensureDeployPrerequisites(verbose=!1){const cwd=p.projectPath();await ensureEnvIsSet({cwd,verbose});await ensureAppKey(cwd)}function loadAwsCredentialsFromFile(){const credentialsPath=join(homedir(),".aws","credentials"),configPath=join(homedir(),".aws","config");if(!existsSync(credentialsPath))return{};try{const lines=readFileSync(credentialsPath,"utf-8").split(`
+`),profiles=["default","stacks"];let currentProfile="",credentials={};const profileCredentials={};for(const line of lines){const trimmed=line.trim(),profileMatch=trimmed.match(/^\[(.+)\]$/);if(profileMatch?.[1]){currentProfile=profileMatch[1];profileCredentials[currentProfile]={};continue}const keyValue=trimmed.match(/^(\w+)\s*=\s*(.+)$/);if(keyValue&&currentProfile){const[,key,value]=keyValue,target=profileCredentials[currentProfile];if(!target||value===void 0)continue;if(key==="aws_access_key_id")target.accessKeyId=value;else if(key==="aws_secret_access_key")target.secretAccessKey=value}}for(const profile of profiles)if(profileCredentials[profile]?.accessKeyId&&profileCredentials[profile]?.secretAccessKey){credentials=profileCredentials[profile];log.debug(`Using AWS credentials from ~/.aws/credentials [${profile}] profile`);break}if(!credentials.accessKeyId){for(const[profile,creds]of Object.entries(profileCredentials))if(creds.accessKeyId&&creds.secretAccessKey){credentials=creds;log.debug(`Using AWS credentials from ~/.aws/credentials [${profile}] profile`);break}}let region;if(existsSync(configPath)){const regionMatch=readFileSync(configPath,"utf-8").match(/region\s*=\s*(.+)/);if(regionMatch?.[1])region=regionMatch[1].trim()}return{...credentials,region}}catch(error){log.debug("Failed to read AWS credentials file:",error);return{}}}async function setupEmailDnsRecords(emailDomain,region,logger,options){logger.info("Setting up email DNS records...");try{const{SESClient}=await import("@stacksjs/ts-cloud"),{Route53Client}=await import("@stacksjs/ts-cloud"),ses=new SESClient(region),route53=new Route53Client(region);logger.info(`Getting DKIM tokens for ${emailDomain}...`);const tokens=(await ses.getEmailIdentity(emailDomain)).DkimAttributes?.Tokens||[];if(tokens.length===0){logger.warn("No DKIM tokens found - domain may not be set up in SES yet");return}logger.info(`Found ${tokens.length} DKIM tokens`);const zone=(await route53.listHostedZones()).HostedZones?.find((z)=>z.Name===`${emailDomain}.`);if(!zone){logger.warn(`Hosted zone not found for ${emailDomain} - DNS records must be added manually`);logger.info("DKIM records needed:");for(const token of tokens)logger.info(`  CNAME: ${token}._domainkey.${emailDomain} -> ${token}.dkim.amazonses.com`);logger.info(`  MX: ${emailDomain} -> 10 inbound-smtp.${region}.amazonaws.com`);return}const hostedZoneId=zone.Id?.replace("/hostedzone/","");logger.info(`Found hosted zone: ${hostedZoneId}`);for(const token of tokens){const recordName=`${token}._domainkey.${emailDomain}`,recordValue=`${token}.dkim.amazonses.com`;try{await route53.changeResourceRecordSets({HostedZoneId:hostedZoneId,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:recordName,Type:"CNAME",TTL:300,ResourceRecords:[{Value:recordValue}]}}]}});logger.success(`Added DKIM record: ${token}._domainkey`)}catch(e){logger.warn(`Failed to add DKIM record: ${getErrorMessage(e)}`)}}const mailSubdomain=options?.mailSubdomain||"mail",mxTarget=options?.mode==="server"?`10 ${mailSubdomain}.${emailDomain}`:`10 inbound-smtp.${region}.amazonaws.com`;try{await route53.changeResourceRecordSets({HostedZoneId:hostedZoneId,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:emailDomain,Type:"MX",TTL:300,ResourceRecords:[{Value:mxTarget}]}}]}});logger.success(`Added MX record: ${mxTarget}`)}catch(e){logger.warn(`Failed to add MX record: ${getErrorMessage(e)}`)}try{await route53.changeResourceRecordSets({HostedZoneId:hostedZoneId,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:emailDomain,Type:"TXT",TTL:300,ResourceRecords:[{Value:'"v=spf1 include:amazonses.com ~all"'}]}}]}});logger.success("Added SPF record")}catch(e){logger.warn(`Failed to add SPF record: ${getErrorMessage(e)}`)}try{await route53.changeResourceRecordSets({HostedZoneId:hostedZoneId,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:`_dmarc.${emailDomain}`,Type:"TXT",TTL:300,ResourceRecords:[{Value:`"v=DMARC1;p=quarantine;pct=25;rua=mailto:dmarcreports@${emailDomain}"`}]}}]}});logger.success("Added DMARC record")}catch(e){logger.warn(`Failed to add DMARC record: ${getErrorMessage(e)}`)}try{const ruleSetName=`${process.env.APP_NAME?.toLowerCase().replace(/[^a-z0-9]/g,"-")||"stacks"}-email-rules`;await ses.setActiveReceiptRuleSet(ruleSetName);logger.success(`Activated email receipt rule set: ${ruleSetName}`)}catch(e){logger.warn(`Failed to activate receipt rule set: ${getErrorMessage(e)}`)}logger.success("Email DNS records configured!");logger.info("Note: DKIM verification may take 5-15 minutes to complete")}catch(error){logger.warn(`Failed to set up email DNS records: ${getErrorMessage(error)}`);logger.info("You can manually set up DNS records using: buddy email:verify")}}async function createDefaultMailUser(appName,emailDomain,region,logger){try{const{DynamoDBClient}=await import("@stacksjs/ts-cloud"),crypto=await import("crypto"),dynamodb=new DynamoDBClient(region),tableName=`${appName}-mail-users`,mailboxes=emailConfig?.mailboxes||[];if(mailboxes.length===0){const defaultEmail=`admin@${emailDomain}`,defaultPassword=crypto.randomBytes(16).toString("hex"),passwordHash=crypto.createHash("sha256").update(defaultPassword).digest("hex");try{await dynamodb.putItem({TableName:tableName,Item:{email:{S:defaultEmail},passwordHash:{S:passwordHash},createdAt:{S:new Date().toISOString()},displayName:{S:"Admin"}}});logger.success(`Created default mail user: ${defaultEmail}`);logger.info(`Password: ${defaultPassword}`);logger.info("Save this password - it will not be shown again!")}catch(e){const msg=getErrorMessage(e);if(msg.includes("ConditionalCheckFailedException")||msg.includes("already exists"))logger.debug("Default mail user already exists");else throw e}}else for(const mailbox of mailboxes){const mb=mailbox,email=typeof mailbox==="string"?`${mailbox}@${emailDomain}`:`${mb.name||mb.address?.split("@")[0]}@${emailDomain}`,password=typeof mailbox==="object"&&mb.password?mb.password:crypto.randomBytes(16).toString("hex"),passwordHash=crypto.createHash("sha256").update(password).digest("hex");try{await dynamodb.putItem({TableName:tableName,Item:{email:{S:email},passwordHash:{S:passwordHash},createdAt:{S:new Date().toISOString()},displayName:{S:typeof mailbox==="object"?mb.displayName||mb.name||email:mailbox}}});logger.success(`Created mail user: ${email}`);if(typeof mailbox!=="object"||!mb.password)logger.info(`  Password: ${password}`)}catch(e){const msg=getErrorMessage(e);if(msg.includes("ConditionalCheckFailedException"))logger.debug(`Mail user ${email} already exists`);else logger.warn(`Failed to create mail user ${email}: ${msg}`)}}}catch(error){logger.warn(`Failed to create mail users: ${getErrorMessage(error)}`)}}async function uploadMailServerToS3(bucketName,region,mode){try{const{S3Client:S3}=await import("@stacksjs/ts-cloud"),s3Client=new S3(region);if(mode==="serverless"){const serverTsPath=p.frameworkPath("core/mail-server/server.ts");if(existsSync(serverTsPath)){const serverCode=readFileSync(serverTsPath,"utf-8");await s3Client.putObject({bucket:bucketName,key:"mail-server/server.ts",body:serverCode,contentType:"text/typescript"});log.success("Uploaded serverless mail server code to S3")}const pkgPath=p.frameworkPath("core/mail-server/package.json");if(existsSync(pkgPath)){const pkgJson=readFileSync(pkgPath,"utf-8");await s3Client.putObject({bucket:bucketName,key:"mail-server/package.json",body:pkgJson,contentType:"application/json"})}return}let binaryUploaded=!1;try{await installMailBinaryWithPantry();const linuxBinaryPath=await findPantryMailBinary();if(linuxBinaryPath&&existsSync(linuxBinaryPath)&&isElfBinary(linuxBinaryPath)){log.info(`Uploading Pantry mail binary: ${linuxBinaryPath}`);const binaryContent=readFileSync(linuxBinaryPath);await s3Client.putObject({bucket:bucketName,key:"mail-server/smtp-server",body:binaryContent,contentType:"application/octet-stream"});log.success("Uploaded Linux x86_64 mail server binary to S3");binaryUploaded=!0}}catch(error){log.debug(`Pantry mail install failed: ${getErrorMessage(error)}`)}if(!binaryUploaded)log.warn(`No Pantry-provided ${MAIL_TARGET_PLATFORM} mail binary found. Release ${MAIL_PACKAGE_DOMAIN}, then run the Pantry binary sync for that package.`)}catch(uploadErr){log.debug(`Could not upload mail server to S3 (bucket may not exist yet): ${uploadErr.message}`)}}async function loadTsCloudConfig(envName){try{const base=p.projectPath("config/cloud.ts");return(await import(envName?`${base}?env=${envName}`:base)).tsCloud}catch(err){log.debug("Could not load config/cloud.ts tsCloud export:",err);return}}function resolveProvider(tsCloudConfig){return tsCloudConfig?.cloud?.provider||process.env.CLOUD_PROVIDER||"aws"}function readWaitSecs(name,defaultSecs){const secs=process.env[name]?Number.parseInt(process.env[name],10):Number.NaN;return Number.isFinite(secs)&&secs>0?secs:defaultSecs}function fmtDuration(secs){const m=Math.floor(secs/60),s=secs%60;return m?s?`${m}m${s}s`:`${m}m`:`${s}s`}async function pollUntil(opts){log.info(`${opts.label} (up to ${fmtDuration(opts.timeoutSecs)})...`);const started=Date.now(),deadline=started+opts.timeoutSecs*1000;let lastHeartbeat=0;for(;;)try{await opts.check();return}catch{const elapsedSecs=Math.floor((Date.now()-started)/1000);if(Date.now()>deadline)throw Error(opts.timeoutMessage(elapsedSecs));if(elapsedSecs-lastHeartbeat>=30){log.info(`  \u2026 still waiting (${elapsedSecs}s elapsed)`);lastHeartbeat=elapsedSecs}await new Promise((r)=>setTimeout(r,opts.intervalMs??5000))}}async function waitForRemoteReady(ip){const{sshExecOrThrow}=await import("@stacksjs/ts-cloud"),run=(remote)=>sshExecOrThrow(ip,remote,{user:"root",connectTimeoutSec:10}),sshWaitSecs=readWaitSecs("TS_CLOUD_SSH_WAIT_SECS",480);await pollUntil({label:"Waiting for SSH to come up",timeoutSecs:sshWaitSecs,check:()=>run("true"),timeoutMessage:(elapsed)=>`SSH did not become reachable on ${ip} within ${fmtDuration(sshWaitSecs)} (waited ${elapsed}s). `+"The box may still be booting \u2014 raise TS_CLOUD_SSH_WAIT_SECS and retry."});log.success("SSH is up");log.info("Waiting for cloud-init (installing bun + caddy)...");try{await run("cloud-init status --wait || true")}catch(err){log.debug("cloud-init status --wait returned non-zero (continuing):",err)}const bootWaitSecs=readWaitSecs("TS_CLOUD_BOOT_WAIT_SECS",720);await pollUntil({label:"Waiting for the bun runtime",timeoutSecs:bootWaitSecs,check:()=>run("test -x /usr/local/bin/bun"),timeoutMessage:(elapsed)=>`bun runtime did not appear at /usr/local/bin/bun within ${fmtDuration(bootWaitSecs)} (waited ${elapsed}s). `+"cloud-init may have failed \u2014 SSH in and check /var/log/cloud-init-output.log; "+"raise TS_CLOUD_BOOT_WAIT_SECS for slow regions."});log.success("Server is ready (bun installed)")}async function resolveDeclaredTenants(){try{const{config}=await import("@stacksjs/config"),tenants=config.cloud?.tenants;return Array.isArray(tenants)?tenants.filter((slug)=>typeof slug==="string"):[]}catch{return[]}}export async function resolveDeployEnvValues(environment,tsCloudConfig){const fileName=environment==="production"?".env.production":environment==="staging"?".env.staging":existsSync(p.projectPath(".env.development"))?".env.development":".env",filePath=p.projectPath(fileName);if(!existsSync(filePath))return{};try{const{getEnv}=await import("@stacksjs/env"),result=getEnv(void 0,{file:fileName,format:"json"});if(!result.success||!result.output){log.debug(`[deploy] Could not read ${fileName} for site env merging: ${result.error??"unknown error"}`);return{}}const parsed=JSON.parse(result.output),values={};for(const[key,value]of Object.entries(parsed)){if(/^DOTENV_(PUBLIC|PRIVATE)_KEY/.test(key))continue;values[key]=String(value)}const{foreignTenantKeys,partitionTenantEnv}=await import("@stacksjs/env"),partition=partitionTenantEnv(values,{self:tsCloudConfig?.project?.slug,tenants:await resolveDeclaredTenants()});for(const{tenant,keys}of foreignTenantKeys(partition))log.warn(`[deploy] Skipping ${keys.length} '${tenant}' key(s) in ${fileName} \u2014 they belong to that tenant's own `+`repository, and shipping them writes its secrets into this project's site .env files. Remove them with: buddy env:check --file ${fileName}. Keys: ${keys.join(", ")}`);return partition.own}catch(error){log.debug(`[deploy] Failed to resolve ${fileName} for site env merging:`,error);return{}}}export function mergeSiteDeployEnv(sites,resolvedDeployEnv){return Object.fromEntries(Object.entries(sites).map(([siteName,site])=>{if(!site)return[siteName,site];const base={...resolvedDeployEnv};if(site.port!==void 0)delete base.PORT;return[siteName,{...site,env:{...base,...site.env||{}}}]}))}function looksLikeSqliteFile(value){return typeof value==="string"&&/\.(?:sqlite3?|db)$/i.test(value.trim())}export function siteSqlitePath(siteEnv={}){if(String(siteEnv.DB_CONNECTION??"sqlite").trim().toLowerCase()!=="sqlite")return null;const configured=typeof siteEnv.DB_DATABASE_PATH==="string"&&siteEnv.DB_DATABASE_PATH.trim()?siteEnv.DB_DATABASE_PATH:looksLikeSqliteFile(siteEnv.DB_DATABASE)?siteEnv.DB_DATABASE:"database/stacks.sqlite",path=String(configured).trim().replace(/^\.\//,"");if(!path||path.startsWith("/")||path.startsWith("~")||path.split("/").includes(".."))return null;return path}export function tsCloudPersistentStateSupport(buildSiteDeployScript){const missing=[];if(typeof buildSiteDeployScript!=="function")return{ok:!1,missing:["buildSiteDeployScript"]};const target="/var/www/probe-shared/database/probe.sqlite";let script="";try{script=buildSiteDeployScript({siteName:"probe",slug:"probe",appDir:"/var/www/probe-probe",artifactFetch:[],releaseId:"probe",execStart:"/bin/true",envEntries:{},port:3000,sharedPaths:[{path:"database/probe.sqlite",target,seed:!0}]}).join(`
+`)}catch{return{ok:!1,missing:["shared paths with an explicit target"]}}if(!(script.includes("cp -a")&&script.includes("/current/")))missing.push("adoption of existing state into shared/");if(!script.includes(`ln -sfn ${target} `))missing.push("shared paths with an explicit target");return{ok:missing.length===0,missing}}export function projectDatabaseTarget(slug,relativePath){return`/var/www/${slug}-shared/${relativePath}`}function runsMigrations(site){return Array.isArray(site?.preStart)&&site.preStart.some((cmd)=>typeof cmd==="string"&&/\bmigrate\b/.test(cmd))}export function applyPersistentStatePaths(sites,slug){const isServerApp=(site)=>!!site&&typeof site.start==="string",appSites=Object.entries(sites).filter(([,site])=>isServerApp(site)),owner=(appSites.find(([,site])=>runsMigrations(site))??appSites[0])?.[0],out={};for(const[name,site]of Object.entries(sites)){if(!isServerApp(site)){out[name]=site;continue}const sqlite=siteSqlitePath(site.env||{}),framework=["storage/logs"];if(sqlite)framework.unshift({path:sqlite,target:projectDatabaseTarget(slug,sqlite),seed:name===owner});const declared=Array.isArray(site.sharedPaths)?site.sharedPaths.filter(Boolean):[],byPath=new Map;for(const entry of[...declared,...framework])byPath.set(typeof entry==="string"?entry:entry.path,entry);out[name]={...site,sharedPaths:[...byPath.values()]}}return out}function prefixHostForEnv(host,prefix){if(host.startsWith(`${prefix}.`)||host.startsWith(`www.${prefix}.`))return host;if(host.startsWith("www."))return`www.${prefix}.${host.slice(4)}`;return`${prefix}.${host}`}export function applyEnvironmentToSites(sites,environment,config){const prefix=config?.environments?.[environment]?.domainPrefix;if(!prefix||environment==="production")return sites;const allHosts=[];for(const site of Object.values(sites)){const d=site?.domain;if(typeof d==="string")allHosts.push(d);else if(Array.isArray(d)){for(const x of d)if(typeof x==="string")allHosts.push(x)}}allHosts.sort((a,b)=>b.length-a.length);const rewrite=(val)=>{let r=val;for(const h of allHosts){const esc=h.replace(/[.]/g,"\\.");r=r.replace(new RegExp(`//${esc}(?=[/:?#]|$)`,"g"),`//${prefixHostForEnv(h,prefix)}`)}return r},out={};for(const[name,site]of Object.entries(sites)){if(!site){out[name]=site;continue}const s={...site};if(typeof s.domain==="string")s.domain=prefixHostForEnv(s.domain,prefix);else if(Array.isArray(s.domain))s.domain=s.domain.map((d)=>typeof d==="string"?prefixHostForEnv(d,prefix):d);if(typeof s.redirect==="string")s.redirect=rewrite(s.redirect);if(s.env&&typeof s.env==="object"){const e={...s.env};for(const k of Object.keys(e))if(typeof e[k]==="string")e[k]=rewrite(e[k]);s.env=e}out[name]=s}return out}async function deployToHetzner(tsCloudConfig,deployEnv,options){const verbose=options.verbose===!0,environment=deployEnv==="prod"?"production":deployEnv,apiToken=tsCloudConfig.hetzner?.apiToken||process.env.HCLOUD_TOKEN||process.env.HETZNER_API_TOKEN,persistedAttachBox=resolvePersistedAttachTargetBox(tsCloudConfig,environment);if(!apiToken&&!persistedAttachBox){log.error("No Hetzner API token found. Set HCLOUD_TOKEN in your .env (or hetzner.apiToken in config/cloud.ts).");process.exit(ExitCode.FatalError)}const sshPubKey=join(homedir(),".ssh","id_ed25519.pub");if(!existsSync(sshPubKey)){log.error(`SSH public key not found at ${sshPubKey}.`);log.info("ts-cloud deploys to Hetzner over SSH and registers this key on the server.");log.info("Generate one with:  ssh-keygen -t ed25519");process.exit(ExitCode.FatalError)}const{createCloudDriver,deployAllComputeSites,ensureManagementDashboard,resolveSiteKind,buildSiteDeployScript}=await loadTsCloudDeployApi(),support=tsCloudPersistentStateSupport(buildSiteDeployScript);if(!support.ok){log.error("This ts-cloud cannot keep your database across deploys, and deploying anyway would destroy it.");log.error(`Missing: ${support.missing.join(", ")}.`);log.error("Upgrade @stacksjs/ts-cloud (bun update @stacksjs/ts-cloud), or point TS_CLOUD_MODULE at a build that has it.");process.exit(ExitCode.FatalError)}try{await runHetznerDeploy({tsCloudConfig,environment,verbose,docker:options.docker===!0,createCloudDriver,deployAllComputeSites,ensureManagementDashboard,resolveSiteKind,onlySite:options.site||void 0,persistedAttachBox})}catch(err){log.error("Hetzner deploy failed:");console.error(err instanceof Error?err.stack||err.message:err);process.exit(ExitCode.FatalError)}}export function resolveProjectTsCloudModule(projectRoot=process.cwd()){const manifestPath=join(projectRoot,"node_modules","@stacksjs","ts-cloud","package.json");if(!existsSync(manifestPath))return;const manifest=JSON.parse(readFileSync(manifestPath,"utf8")),rootExport=manifest.exports?.["."],entry=manifest.module??(typeof rootExport==="string"?rootExport:rootExport?.import);if(!entry)return;const modulePath=resolve(dirname(manifestPath),entry);return existsSync(modulePath)?modulePath:void 0}export async function loadTsCloudDeployApi(){const requested=process.env.TS_CLOUD_MODULE?.trim();if(!requested){const projectModule=resolveProjectTsCloudModule();return projectModule?import(pathToFileURL(projectModule).href):import("@stacksjs/ts-cloud")}const modulePath=isAbsolute(requested)?requested:resolve(process.cwd(),requested);if(!existsSync(modulePath))throw Error(`TS_CLOUD_MODULE points to a missing module: ${modulePath}`);return import(pathToFileURL(modulePath).href)}export function shouldInjectManagementDashboard(tsCloudConfig){return!tsCloudConfig.cloud?.attachTo}export function reconcilePartialDeployManagementDashboards(tsCloudConfig,livePorts){const sites=tsCloudConfig.sites,preserved=[],removed=[];if(!sites)return{preserved,removed};for(const[siteName,site]of Object.entries(sites)){if(siteName!=="dashboard"&&!siteName.startsWith("dashboard-"))continue;const livePort=livePorts[siteName];if(typeof livePort!=="number"||!Number.isInteger(livePort)||livePort<1||livePort>65535){delete sites[siteName];removed.push(siteName);continue}const next={...site,port:livePort};if(typeof next.start==="string")next.start=next.start.replace(/(--port(?:=|\s+))\d+/,`$1${livePort}`);sites[siteName]=next;preserved.push(siteName)}return{preserved,removed}}async function reconcilePartialDeployManagementDashboardsWithLiveBox(tsCloudConfig,ip){const slug=String(tsCloudConfig.project?.slug||"app").replace(/[^a-z0-9._-]+/gi,"-"),siteNames=Object.keys(tsCloudConfig.sites??{}).filter((name)=>name==="dashboard"||name.startsWith("dashboard-"));if(siteNames.length===0)return;const units=siteNames.map((siteName)=>({siteName,unit:`${slug}-${siteName}.service`})),probe=`
 const units = ${JSON.stringify(units)}
 const text = bytes => new TextDecoder().decode(bytes).trim()
 const run = args => text(Bun.spawnSync(args).stdout)
@@ -683,378 +14,12 @@ for (const entry of units) {
     ports[entry.siteName] = Number(match[1])
 }
 console.log(JSON.stringify(ports))
-`.trim(), encoded = Buffer.from(probe).toString("base64"), { sshExecOrThrow } = await import("@stacksjs/ts-cloud"), line = (await sshExecOrThrow(ip, `/usr/local/bin/bun -e "eval(Buffer.from('${encoded}','base64').toString())"`, { user: "root", connectTimeoutSec: 10 })).trim().split(`
-`).at(-1) || "{}", livePorts = JSON.parse(line), result = reconcilePartialDeployManagementDashboards(tsCloudConfig, livePorts);
-  for (const siteName of result.preserved)
-    log.info(`Partial deploy: preserving the live management dashboard service '${siteName}' on port ${livePorts[siteName]}`);
-  for (const siteName of result.removed)
-    log.info(`Partial deploy: omitting management dashboard route '${siteName}' because no active service owns it`);
-}
-export function resolvePersistedAttachTargetBox(tsCloudConfig, environment, cwd = process.cwd()) {
-  const owner = tsCloudConfig.cloud?.attachTo;
-  if (!owner)
-    return null;
-  const stackName = tsCloudConfig.project?.stackName || `${tsCloudConfig.project?.slug || "app"}-${environment}`, statePath = join(cwd, "storage", "cloud", "state", `${stackName}.json`);
-  if (!existsSync(statePath))
-    return null;
-  try {
-    const state = JSON.parse(readFileSync(statePath, "utf8"));
-    if (state.stackName !== stackName || typeof state.serverId !== "number" || typeof state.publicIp !== "string" || !state.publicIp.trim())
-      return null;
-    return {
-      serverId: state.serverId,
-      serverName: typeof state.serverName === "string" && state.serverName ? state.serverName : `${owner}-${environment}-app`,
-      publicIp: state.publicIp,
-      publicIpv6: typeof state.publicIpv6 === "string" ? state.publicIpv6 : void 0
-    };
-  } catch {
-    return null;
-  }
-}
-export function scrubLoopbackSitePortsForFirewall(tsCloudConfig) {
-  const sites = tsCloudConfig?.sites;
-  if (!sites)
-    return tsCloudConfig;
-  const loopbackHosts = new Set(["127.0.0.1", "::1", "localhost"]), scrubbed = {};
-  for (const [siteName, site] of Object.entries(sites)) {
-    const host = String(site?.env?.HOST ?? "").toLowerCase();
-    if (site && typeof site.port === "number" && !site.domain && loopbackHosts.has(host)) {
-      const rest = { ...site };
-      delete rest.port;
-      scrubbed[siteName] = rest;
-    } else
-      scrubbed[siteName] = site;
-  }
-  return { ...tsCloudConfig, sites: scrubbed };
-}
-function githubDeploymentsEnabled() {
-  return process.env.GITHUB_ACTIONS !== "true" && process.env.TS_CLOUD_GITHUB_DEPLOYMENTS !== "0";
-}
-async function ghCliAvailable() {
-  try {
-    const { execSync } = await import("node:child_process");
-    execSync("gh --version", { stdio: "ignore" });
-    return !0;
-  } catch {
-    return !1;
-  }
-}
-async function resolveSiteGithubSource(root) {
-  try {
-    const { execSync } = await import("node:child_process"), run = (cmd) => execSync(cmd, { cwd: root, stdio: ["ignore", "pipe", "ignore"] }).toString().trim(), match = run("git config --get remote.origin.url").match(/github\.com[:/]([^/]+\/[^/]+?)(?:\.git)?$/);
-    if (!match?.[1])
-      return null;
-    return { repo: match[1], ref: run("git rev-parse HEAD") };
-  } catch {
-    return null;
-  }
-}
-async function setGithubDeploymentStatus(record, state) {
-  try {
-    const { execSync } = await import("node:child_process"), body = JSON.stringify({
-      state,
-      environment: record.environment,
-      ...record.environmentUrl ? { environment_url: record.environmentUrl } : {},
-      description: state === "success" ? "Deployed" : state === "failure" ? "Deploy failed" : "Deploying"
-    });
-    execSync(`gh api -X POST repos/${record.repo}/deployments/${record.id}/statuses --input -`, { input: body, stdio: ["pipe", "ignore", "ignore"] });
-  } catch (err) {
-    log.warn(`GitHub deployment status (${state}) skipped for ${record.repo}: ${getErrorMessage(err)}`);
-  }
-}
-async function startGithubDeployment(source, environment, environmentUrl) {
-  try {
-    const { execSync } = await import("node:child_process"), body = JSON.stringify({
-      ref: source.ref,
-      environment,
-      description: `buddy deploy (${environment})`,
-      auto_merge: !1,
-      required_contexts: [],
-      production_environment: environment === "production"
-    }), out = execSync(`gh api -X POST repos/${source.repo}/deployments --input - --jq '.id'`, { input: body, stdio: ["pipe", "pipe", "ignore"] }).toString().trim(), id = Number(out);
-    if (!out || !Number.isInteger(id) || id <= 0)
-      return null;
-    const record = { repo: source.repo, id, environment, environmentUrl };
-    await setGithubDeploymentStatus(record, "in_progress");
-    return record;
-  } catch (err) {
-    log.warn(`GitHub deployment record skipped for ${source.repo}: ${getErrorMessage(err)}`);
-    return null;
-  }
-}
-async function startGithubDeployments(args) {
-  const { sites, onlySite, environment, resolveSiteKind } = args, records = [];
-  if (!githubDeploymentsEnabled() || !await ghCliAvailable())
-    return records;
-  const seen = new Set;
-  for (const [siteName, site] of Object.entries(sites)) {
-    if (!site || onlySite && siteName !== onlySite)
-      continue;
-    const kind = resolveSiteKind(site);
-    if (kind === "bucket" || kind === "redirect")
-      continue;
-    const source = await resolveSiteGithubSource(site.root || ".");
-    if (!source)
-      continue;
-    const key = `${source.repo}@${source.ref}`;
-    if (seen.has(key))
-      continue;
-    seen.add(key);
-    const record = await startGithubDeployment(source, environment, site.domain ? `https://${site.domain}` : void 0);
-    if (record) {
-      records.push(record);
-      log.info(`GitHub deployment ${record.repo}#${record.id} \u2192 ${environment}`);
-    }
-  }
-  return records;
-}
-async function runHetznerDeploy(args) {
-  const { tsCloudConfig, environment, verbose, docker, createCloudDriver, deployAllComputeSites, ensureManagementDashboard, resolveSiteKind, onlySite, persistedAttachBox } = args, startTime = performance.now();
-  console.log("");
-  console.log("\uD83D\uDE80 Deploy \u2192 Hetzner Cloud");
-  console.log("");
-  log.info(`Project: ${tsCloudConfig.project?.slug}`);
-  log.info(`Environment: ${environment}`);
-  log.info(`Location: ${tsCloudConfig.hetzner?.location || process.env.HCLOUD_LOCATION || "fsn1"}`);
-  log.info(`Size: ${tsCloudConfig.infrastructure?.compute?.size || "small"}`);
-  try {
-    if (shouldInjectManagementDashboard(tsCloudConfig) && typeof ensureManagementDashboard === "function")
-      ensureManagementDashboard(tsCloudConfig, {
-        cwd: process.cwd(),
-        logger: { info: (m) => log.info(m), warn: (m) => log.warn(m) }
-      });
-    else if (tsCloudConfig.cloud?.attachTo)
-      log.info(`Management dashboard: using the '${tsCloudConfig.cloud.attachTo}' server owner's dashboard`);
-  } catch (err) {
-    log.warn(`Management dashboard injection skipped: ${getErrorMessage(err)}`);
-  }
-  const driver = createCloudDriver({ config: tsCloudConfig, provider: "hetzner" });
-  if (!driver.provisionComputeInfrastructure) {
-    log.error("Hetzner driver does not support compute provisioning (update @stacksjs/ts-cloud).");
-    process.exit(ExitCode.FatalError);
-  }
-  const attachTo = tsCloudConfig.cloud?.attachTo;
-  let ip, ipv6;
-  if (attachTo) {
-    const box = persistedAttachBox ?? await resolveAttachTargetBox(attachTo, environment);
-    if (!box?.publicIp) {
-      log.error(`Attach target '${attachTo}' has no reachable box for '${environment}'. Is '${attachTo}-${environment}-app' provisioned (by its owner)?`);
-      process.exit(ExitCode.FatalError);
-    }
-    ip = box.publicIp;
-    ipv6 = box.publicIpv6;
-    log.info(`Attaching to '${attachTo}' box '${box.serverName}' (${ip}) \u2014 skipping provisioning`);
-    const compute = (tsCloudConfig.infrastructure ??= {}).compute ??= {};
-    compute.webServer = "rpx";
-    compute.proxy = { onDemandTls: !0, ...compute.proxy ?? {}, engine: "rpx" };
-    const stackName = tsCloudConfig.project?.stackName || `${tsCloudConfig.project?.slug || "app"}-${environment}`, stateDir = join(process.cwd(), "storage", "cloud", "state");
-    mkdirSync(stateDir, { recursive: !0 });
-    writeFileSync(join(stateDir, `${stackName}.json`), `${JSON.stringify({
-      stackName,
-      serverId: box.serverId,
-      serverName: box.serverName,
-      publicIp: ip,
-      sshUser: "root",
-      deployStoragePath: "/var/ts-cloud/staging"
-    }, null, 2)}
-`);
-  } else {
-    log.info("Provisioning Hetzner compute infrastructure...");
-    const outputs = await driver.provisionComputeInfrastructure({ config: scrubLoopbackSitePortsForFirewall(tsCloudConfig), environment });
-    ip = outputs.appPublicIp;
-    ipv6 = outputs.appPublicIpv6;
-    log.success("Hetzner compute infrastructure ready");
-    if (outputs.appInstanceId)
-      log.info(`Server ID: ${outputs.appInstanceId}`);
-  }
-  if (ip)
-    log.info(`Server IP: ${ip}`);
-  if (!ip) {
-    log.error("Provisioned server has no public IP \u2014 cannot deploy over SSH.");
-    process.exit(ExitCode.FatalError);
-  }
-  await waitForRemoteReady(ip);
-  if (onlySite && !attachTo)
-    await reconcilePartialDeployManagementDashboardsWithLiveBox(tsCloudConfig, ip);
-  const { execSync } = await import("node:child_process"), { tmpdir } = await import("node:os"), sites = applyEnvironmentToSites(tsCloudConfig.sites || {}, environment, tsCloudConfig), slug = tsCloudConfig.project?.slug || "app";
-  let sha;
-  try {
-    sha = execSync("git rev-parse --short HEAD", { stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
-  } catch {
-    sha = Date.now().toString(36);
-  }
-  const tarExcludes = [
-    "node_modules",
-    "pantry",
-    ".git",
-    ".github",
-    ".cache",
-    "bin",
-    "dist",
-    relative(p.projectPath(), p.stxPath()).replace(/\/$/, ""),
-    ".stx",
-    relative(p.projectPath(), p.cloudStatePath()).replace(/\/$/, ""),
-    ".ts-cloud",
-    relative(p.projectPath(), p.frameworkRuntimePath()).replace(/\/$/, ""),
-    "tmp",
-    "temp",
-    ".DS_Store",
-    "*.log",
-    ".env",
-    ".env.local",
-    ".env.keys",
-    ".env.production.bak",
-    ".env.production.plain",
-    "*.sqlite",
-    "*.sqlite-wal",
-    "*.sqlite-shm"
-  ];
-  if (onlySite && !sites[onlySite]) {
-    log.error(`--site '${onlySite}' is not a configured site. Available: ${Object.keys(sites).join(", ")}`);
-    process.exit(ExitCode.FatalError);
-  }
-  const tarballs = new Map;
-  for (const [siteName, site] of Object.entries(sites)) {
-    if (!site)
-      continue;
-    if (onlySite && siteName !== onlySite)
-      continue;
-    const kind = resolveSiteKind(site);
-    if (kind === "bucket")
-      continue;
-    if (kind === "redirect")
-      continue;
-    if (kind === "server-static" && site.build) {
-      log.info(`Building static site '${siteName}': ${site.build}`);
-      execSync(site.build, { stdio: verbose ? "inherit" : "pipe" });
-    }
-    const root = site.root || ".", tarballPath = join(tmpdir(), `${slug}-${siteName}-${sha}.tar.gz`), siteExcludes = Array.isArray(site.exclude) ? site.exclude.filter((entry) => typeof entry === "string" && entry.length > 0) : [], excludeArgs = [...tarExcludes, ...siteExcludes].flatMap((pattern) => [`--exclude='${pattern}'`, `--exclude='*/${pattern}'`]);
-    if (siteExcludes.length > 0)
-      log.info(`Excluding server-owned paths: ${siteExcludes.join(", ")}`);
-    log.info(`Packaging ${root} \u2192 ${tarballPath}...`);
-    execSync(`tar czf "${tarballPath}" ${excludeArgs.join(" ")} -C "${root}" .`, { stdio: verbose ? "inherit" : "pipe", env: { ...process.env, COPYFILE_DISABLE: "1" } });
-    const sizeMb = Math.max(1, Math.round(statSync(tarballPath).size / 1048576));
-    log.info(`Release tarball: ~${sizeMb} MB`);
-    tarballs.set(siteName, tarballPath);
-  }
-  if (docker)
-    await buildContainerImageWithPantry({ slug, sites, verbose });
-  const resolvedDeployEnv = await resolveDeployEnvValues(environment, tsCloudConfig), sitesWithResolvedEnv = applyPersistentStatePaths(mergeSiteDeployEnv(sites, resolvedDeployEnv), slug);
-  for (const [envKey, envValue] of Object.entries(resolvedDeployEnv))
-    if (process.env[envKey] === void 0)
-      process.env[envKey] = envValue;
-  const githubDeployments = await startGithubDeployments({ sites, onlySite, environment, resolveSiteKind });
-  log.info(onlySite ? `Shipping site '${onlySite}' to the server...` : "Shipping release to the server...");
-  const deployConfig = onlySite ? { ...tsCloudConfig, sites: { [onlySite]: sitesWithResolvedEnv[onlySite] } } : { ...tsCloudConfig, sites: sitesWithResolvedEnv }, ok = await deployAllComputeSites({
-    config: deployConfig,
-    managementDashboard: !onlySite,
-    rpxConfig: { ...tsCloudConfig, sites: sitesWithResolvedEnv },
-    environment,
-    driver,
-    sha,
-    runtime: tsCloudConfig.infrastructure?.compute?.runtime || "bun",
-    tarballForSite: (siteName) => {
-      const path = tarballs.get(siteName);
-      if (!path)
-        throw Error(`Missing tarball for site '${siteName}'`);
-      return path;
-    },
-    logger: {
-      info: (m) => log.info(m),
-      warn: (m) => log.warn(m),
-      error: (m) => log.error(m),
-      step: (m) => log.info(m),
-      success: (m) => log.success(m)
-    }
-  });
-  let publishedDns = [];
-  if (ok)
-    publishedDns = await reconcileHetznerDns(onlySite ? { [onlySite]: sites[onlySite] } : sites, ip, log, ipv6);
-  if (ok && publishedDns.length > 0) {
-    log.info(`Issuing TLS for ${publishedDns.length} newly published record(s)...`);
-    try {
-      const { execSync } = await import("node:child_process"), unit = `rpx-cert-renew-${tsCloudConfig.project?.slug || "app"}.service`, certSshArgs = ["-o", "StrictHostKeyChecking=accept-new", "-o", "BatchMode=yes", "-o", "ConnectTimeout=20", `root@${ip}`], out = execSync(`ssh ${certSshArgs.map((a) => `'${a}'`).join(" ")} bash -s`, {
-        input: `systemctl start ${unit} 2>&1 || true
+`.trim(),encoded=Buffer.from(probe).toString("base64"),{sshExecOrThrow}=await import("@stacksjs/ts-cloud"),line=(await sshExecOrThrow(ip,`/usr/local/bin/bun -e "eval(Buffer.from('${encoded}','base64').toString())"`,{user:"root",connectTimeoutSec:10})).trim().split(`
+`).at(-1)||"{}",livePorts=JSON.parse(line),result=reconcilePartialDeployManagementDashboards(tsCloudConfig,livePorts);for(const siteName of result.preserved)log.info(`Partial deploy: preserving the live management dashboard service '${siteName}' on port ${livePorts[siteName]}`);for(const siteName of result.removed)log.info(`Partial deploy: omitting management dashboard route '${siteName}' because no active service owns it`)}export function resolvePersistedAttachTargetBox(tsCloudConfig,environment,cwd=process.cwd()){const owner=tsCloudConfig.cloud?.attachTo;if(!owner)return null;const stackName=tsCloudConfig.project?.stackName||`${tsCloudConfig.project?.slug||"app"}-${environment}`,statePath=join(cwd,"storage","cloud","state",`${stackName}.json`);if(!existsSync(statePath))return null;try{const state=JSON.parse(readFileSync(statePath,"utf8"));if(state.stackName!==stackName||typeof state.serverId!=="number"||typeof state.publicIp!=="string"||!state.publicIp.trim())return null;return{serverId:state.serverId,serverName:typeof state.serverName==="string"&&state.serverName?state.serverName:`${owner}-${environment}-app`,publicIp:state.publicIp,publicIpv6:typeof state.publicIpv6==="string"?state.publicIpv6:void 0}}catch{return null}}export function scrubLoopbackSitePortsForFirewall(tsCloudConfig){const sites=tsCloudConfig?.sites;if(!sites)return tsCloudConfig;const loopbackHosts=new Set(["127.0.0.1","::1","localhost"]),scrubbed={};for(const[siteName,site]of Object.entries(sites)){const host=String(site?.env?.HOST??"").toLowerCase();if(site&&typeof site.port==="number"&&!site.domain&&loopbackHosts.has(host)){const rest={...site};delete rest.port;scrubbed[siteName]=rest}else scrubbed[siteName]=site}return{...tsCloudConfig,sites:scrubbed}}function githubDeploymentsEnabled(){return process.env.GITHUB_ACTIONS!=="true"&&process.env.TS_CLOUD_GITHUB_DEPLOYMENTS!=="0"}async function ghCliAvailable(){try{const{execSync}=await import("node:child_process");execSync("gh --version",{stdio:"ignore"});return!0}catch{return!1}}async function resolveSiteGithubSource(root){try{const{execSync}=await import("node:child_process"),run=(cmd)=>execSync(cmd,{cwd:root,stdio:["ignore","pipe","ignore"]}).toString().trim(),match=run("git config --get remote.origin.url").match(/github\.com[:/]([^/]+\/[^/]+?)(?:\.git)?$/);if(!match?.[1])return null;return{repo:match[1],ref:run("git rev-parse HEAD")}}catch{return null}}async function setGithubDeploymentStatus(record,state){try{const{execSync}=await import("node:child_process"),body=JSON.stringify({state,environment:record.environment,...record.environmentUrl?{environment_url:record.environmentUrl}:{},description:state==="success"?"Deployed":state==="failure"?"Deploy failed":"Deploying"});execSync(`gh api -X POST repos/${record.repo}/deployments/${record.id}/statuses --input -`,{input:body,stdio:["pipe","ignore","ignore"]})}catch(err){log.warn(`GitHub deployment status (${state}) skipped for ${record.repo}: ${getErrorMessage(err)}`)}}async function startGithubDeployment(source,environment,environmentUrl){try{const{execSync}=await import("node:child_process"),body=JSON.stringify({ref:source.ref,environment,description:`buddy deploy (${environment})`,auto_merge:!1,required_contexts:[],production_environment:environment==="production"}),out=execSync(`gh api -X POST repos/${source.repo}/deployments --input - --jq '.id'`,{input:body,stdio:["pipe","pipe","ignore"]}).toString().trim(),id=Number(out);if(!out||!Number.isInteger(id)||id<=0)return null;const record={repo:source.repo,id,environment,environmentUrl};await setGithubDeploymentStatus(record,"in_progress");return record}catch(err){log.warn(`GitHub deployment record skipped for ${source.repo}: ${getErrorMessage(err)}`);return null}}async function startGithubDeployments(args){const{sites,onlySite,environment,resolveSiteKind}=args,records=[];if(!githubDeploymentsEnabled()||!await ghCliAvailable())return records;const seen=new Set;for(const[siteName,site]of Object.entries(sites)){if(!site||onlySite&&siteName!==onlySite)continue;const kind=resolveSiteKind(site);if(kind==="bucket"||kind==="redirect")continue;const source=await resolveSiteGithubSource(site.root||".");if(!source)continue;const key=`${source.repo}@${source.ref}`;if(seen.has(key))continue;seen.add(key);const record=await startGithubDeployment(source,environment,site.domain?`https://${site.domain}`:void 0);if(record){records.push(record);log.info(`GitHub deployment ${record.repo}#${record.id} \u2192 ${environment}`)}}return records}async function runHetznerDeploy(args){const{tsCloudConfig,environment,verbose,docker,createCloudDriver,deployAllComputeSites,ensureManagementDashboard,resolveSiteKind,onlySite,persistedAttachBox}=args,startTime=performance.now();console.log("");console.log("\uD83D\uDE80 Deploy \u2192 Hetzner Cloud");console.log("");log.info(`Project: ${tsCloudConfig.project?.slug}`);log.info(`Environment: ${environment}`);log.info(`Location: ${tsCloudConfig.hetzner?.location||process.env.HCLOUD_LOCATION||"fsn1"}`);log.info(`Size: ${tsCloudConfig.infrastructure?.compute?.size||"small"}`);try{if(shouldInjectManagementDashboard(tsCloudConfig)&&typeof ensureManagementDashboard==="function")ensureManagementDashboard(tsCloudConfig,{cwd:process.cwd(),logger:{info:(m)=>log.info(m),warn:(m)=>log.warn(m)}});else if(tsCloudConfig.cloud?.attachTo)log.info(`Management dashboard: using the '${tsCloudConfig.cloud.attachTo}' server owner's dashboard`)}catch(err){log.warn(`Management dashboard injection skipped: ${getErrorMessage(err)}`)}const driver=createCloudDriver({config:tsCloudConfig,provider:"hetzner"});if(!driver.provisionComputeInfrastructure){log.error("Hetzner driver does not support compute provisioning (update @stacksjs/ts-cloud).");process.exit(ExitCode.FatalError)}const attachTo=tsCloudConfig.cloud?.attachTo;let ip,ipv6;if(attachTo){const box=persistedAttachBox??await resolveAttachTargetBox(attachTo,environment);if(!box?.publicIp){log.error(`Attach target '${attachTo}' has no reachable box for '${environment}'. Is '${attachTo}-${environment}-app' provisioned (by its owner)?`);process.exit(ExitCode.FatalError)}ip=box.publicIp;ipv6=box.publicIpv6;log.info(`Attaching to '${attachTo}' box '${box.serverName}' (${ip}) \u2014 skipping provisioning`);const compute=(tsCloudConfig.infrastructure??={}).compute??={};compute.webServer="rpx";compute.proxy={onDemandTls:!0,...compute.proxy??{},engine:"rpx"};const stackName=tsCloudConfig.project?.stackName||`${tsCloudConfig.project?.slug||"app"}-${environment}`,stateDir=join(process.cwd(),"storage","cloud","state");mkdirSync(stateDir,{recursive:!0});writeFileSync(join(stateDir,`${stackName}.json`),`${JSON.stringify({stackName,serverId:box.serverId,serverName:box.serverName,publicIp:ip,sshUser:"root",deployStoragePath:"/var/ts-cloud/staging"},null,2)}
+`)}else{log.info("Provisioning Hetzner compute infrastructure...");const outputs=await driver.provisionComputeInfrastructure({config:scrubLoopbackSitePortsForFirewall(tsCloudConfig),environment});ip=outputs.appPublicIp;ipv6=outputs.appPublicIpv6;log.success("Hetzner compute infrastructure ready");if(outputs.appInstanceId)log.info(`Server ID: ${outputs.appInstanceId}`)}if(ip)log.info(`Server IP: ${ip}`);if(!ip){log.error("Provisioned server has no public IP \u2014 cannot deploy over SSH.");process.exit(ExitCode.FatalError)}await waitForRemoteReady(ip);if(onlySite&&!attachTo)await reconcilePartialDeployManagementDashboardsWithLiveBox(tsCloudConfig,ip);const{execSync}=await import("node:child_process"),{tmpdir}=await import("node:os"),sites=applyEnvironmentToSites(tsCloudConfig.sites||{},environment,tsCloudConfig),slug=tsCloudConfig.project?.slug||"app";let sha;try{sha=execSync("git rev-parse --short HEAD",{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{sha=Date.now().toString(36)}const tarExcludes=["node_modules","pantry",".git",".github",".cache","bin","dist",relative(p.projectPath(),p.stxPath()).replace(/\/$/,""),".stx",relative(p.projectPath(),p.cloudStatePath()).replace(/\/$/,""),".ts-cloud",relative(p.projectPath(),p.frameworkRuntimePath()).replace(/\/$/,""),"tmp","temp",".DS_Store","*.log",".env",".env.local",".env.keys",".env.production.bak",".env.production.plain","*.sqlite","*.sqlite-wal","*.sqlite-shm"];if(onlySite&&!sites[onlySite]){log.error(`--site '${onlySite}' is not a configured site. Available: ${Object.keys(sites).join(", ")}`);process.exit(ExitCode.FatalError)}const tarballs=new Map;for(const[siteName,site]of Object.entries(sites)){if(!site)continue;if(onlySite&&siteName!==onlySite)continue;const kind=resolveSiteKind(site);if(kind==="bucket")continue;if(kind==="redirect")continue;if(kind==="server-static"&&site.build){log.info(`Building static site '${siteName}': ${site.build}`);execSync(site.build,{stdio:verbose?"inherit":"pipe"})}const root=site.root||".",tarballPath=join(tmpdir(),`${slug}-${siteName}-${sha}.tar.gz`),siteExcludes=Array.isArray(site.exclude)?site.exclude.filter((entry)=>typeof entry==="string"&&entry.length>0):[],excludeArgs=[...tarExcludes,...siteExcludes].flatMap((pattern)=>[`--exclude='${pattern}'`,`--exclude='*/${pattern}'`]);if(siteExcludes.length>0)log.info(`Excluding server-owned paths: ${siteExcludes.join(", ")}`);log.info(`Packaging ${root} \u2192 ${tarballPath}...`);execSync(`tar czf "${tarballPath}" ${excludeArgs.join(" ")} -C "${root}" .`,{stdio:verbose?"inherit":"pipe",env:{...process.env,COPYFILE_DISABLE:"1"}});const sizeMb=Math.max(1,Math.round(statSync(tarballPath).size/1048576));log.info(`Release tarball: ~${sizeMb} MB`);tarballs.set(siteName,tarballPath)}if(docker)await buildContainerImageWithPantry({slug,sites,verbose});const resolvedDeployEnv=await resolveDeployEnvValues(environment,tsCloudConfig),sitesWithResolvedEnv=applyPersistentStatePaths(mergeSiteDeployEnv(sites,resolvedDeployEnv),slug);for(const[envKey,envValue]of Object.entries(resolvedDeployEnv))if(process.env[envKey]===void 0)process.env[envKey]=envValue;const githubDeployments=await startGithubDeployments({sites,onlySite,environment,resolveSiteKind});log.info(onlySite?`Shipping site '${onlySite}' to the server...`:"Shipping release to the server...");const deployConfig=onlySite?{...tsCloudConfig,sites:{[onlySite]:sitesWithResolvedEnv[onlySite]}}:{...tsCloudConfig,sites:sitesWithResolvedEnv},ok=await deployAllComputeSites({config:deployConfig,managementDashboard:!onlySite,rpxConfig:{...tsCloudConfig,sites:sitesWithResolvedEnv},environment,driver,sha,runtime:tsCloudConfig.infrastructure?.compute?.runtime||"bun",tarballForSite:(siteName)=>{const path=tarballs.get(siteName);if(!path)throw Error(`Missing tarball for site '${siteName}'`);return path},logger:{info:(m)=>log.info(m),warn:(m)=>log.warn(m),error:(m)=>log.error(m),step:(m)=>log.info(m),success:(m)=>log.success(m)}});let publishedDns=[];if(ok)publishedDns=await reconcileHetznerDns(onlySite?{[onlySite]:sites[onlySite]}:sites,ip,log,ipv6);if(ok&&publishedDns.length>0){log.info(`Issuing TLS for ${publishedDns.length} newly published record(s)...`);try{const{execSync}=await import("node:child_process"),unit=`rpx-cert-renew-${tsCloudConfig.project?.slug||"app"}.service`,certSshArgs=["-o","StrictHostKeyChecking=accept-new","-o","BatchMode=yes","-o","ConnectTimeout=20",`root@${ip}`],out=execSync(`ssh ${certSshArgs.map((a)=>`'${a}'`).join(" ")} bash -s`,{input:`systemctl start ${unit} 2>&1 || true
 systemctl is-active ${unit} >/dev/null 2>&1 && echo TLSUNIT:running || echo TLSUNIT:done
-journalctl -u ${unit} -n 20 --no-pager 2>/dev/null | grep -E 'Certificate written|Skipping|error|Error' | tail -5 || true`,
-        encoding: "utf8",
-        stdio: ["pipe", "pipe", "pipe"]
-      });
-      for (const line of out.split(`
-`))
-        if (/Certificate written|Skipping/.test(line))
-          log.info(`  ${line.replace(/^.*?\]:\s*/, "").trim()}`);
-      log.success("TLS issued and gateway reloaded for the new record(s)");
-    } catch (err) {
-      log.warn(`TLS issuance after DNS failed: ${err?.message || err}`);
-      log.warn(`  Until it succeeds, ${publishedDns.join(", ")} serves a fallback certificate.`);
-    }
-  }
-  if (ok)
-    await reconcileConfigDns(onlySite ? { [onlySite]: sites[onlySite] } : sites, log);
-  if (ok) {
-    const mailOwner = mailServerOwnerFromConfig(emailConfig);
-    let mailIp = ip;
-    if (mailOwner) {
-      const mailBox = await resolveAttachTargetBox(mailOwner, environment);
-      if (mailBox?.publicIp) {
-        mailIp = mailBox.publicIp;
-        log.info(`Mail: reconciling on '${mailOwner}' box '${mailBox.serverName}' (${mailIp})`);
-      } else {
-        mailIp = void 0;
-        log.warn(`Mail: attach target '${mailOwner}' has no reachable '${environment}' box; application deploy remains live`);
-      }
-    }
-    const mailRes = mailIp ? await provisionMailTenant(mailIp, log) : null;
-    if (mailOwner && mailIp && mailIp !== ip)
-      await cleanupDetachedMailHealth(ip, log);
-    if (mailRes)
-      await reconcileMailDns(mailRes, mailIp, log);
-  }
-  for (const record of githubDeployments)
-    await setGithubDeploymentStatus(record, ok ? "success" : "failure");
-  console.log("");
-  if (ok) {
-    await outro(`Deployed to Hetzner. Your site is live at http://${ip}:3000`, { startTime, useSeconds: !0 });
-    log.info(`Coming-soon page: http://${ip}:3000  (bypass with ?secret=\u2026)`);
-  } else {
-    await outro("Hetzner deploy reported a failure \u2014 see the per-instance output above.", { startTime, useSeconds: !0 });
-    process.exit(ExitCode.FatalError);
-  }
-}
-function resolveMailboxes(mailboxes, domain) {
-  if (!Array.isArray(mailboxes))
-    return [];
-  const out = [];
-  for (const entry of mailboxes) {
-    let raw, explicitPw;
-    if (typeof entry === "string")
-      raw = entry;
-    else if (entry && typeof entry === "object") {
-      raw = entry.email ?? entry.username;
-      explicitPw = entry.password;
-    }
-    if (!raw || typeof raw !== "string")
-      continue;
-    const localPart = (raw.includes("@") ? raw.split("@")[0] ?? "" : raw).trim();
-    if (!localPart)
-      continue;
-    const address = `${localPart}@${domain}`, envPw = explicitPw || process.env[`MAIL_PASSWORD_${localPart.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`];
-    if (!envPw)
-      continue;
-    out.push({ address, localPart: localPart.toUpperCase(), password: envPw, generated: !1 });
-  }
-  return out;
-}
-export function hasExplicitEmailConfig(projectRoot = p.projectPath()) {
-  return existsSync(join(projectRoot, "config", "email.ts"));
-}
-export function mailServerOwnerFromConfig(config) {
-  const owner = config?.server?.attachTo;
-  return typeof owner === "string" && owner.trim() ? owner.trim() : void 0;
-}
-async function cleanupDetachedMailHealth(ip, logger) {
-  const { execSync } = await import("node:child_process"), sshArgs = ["-o", "StrictHostKeyChecking=accept-new", "-o", "BatchMode=yes", "-o", "ConnectTimeout=20", `root@${ip}`], script = `set -e
+journalctl -u ${unit} -n 20 --no-pager 2>/dev/null | grep -E 'Certificate written|Skipping|error|Error' | tail -5 || true`,encoding:"utf8",stdio:["pipe","pipe","pipe"]});for(const line of out.split(`
+`))if(/Certificate written|Skipping/.test(line))log.info(`  ${line.replace(/^.*?\]:\s*/,"").trim()}`);log.success("TLS issued and gateway reloaded for the new record(s)")}catch(err){log.warn(`TLS issuance after DNS failed: ${err?.message||err}`);log.warn(`  Until it succeeds, ${publishedDns.join(", ")} serves a fallback certificate.`)}}if(ok)await reconcileConfigDns(onlySite?{[onlySite]:sites[onlySite]}:sites,log);if(ok){const mailOwner=mailServerOwnerFromConfig(emailConfig);let mailIp=ip;if(mailOwner){const mailBox=await resolveAttachTargetBox(mailOwner,environment);if(mailBox?.publicIp){mailIp=mailBox.publicIp;log.info(`Mail: reconciling on '${mailOwner}' box '${mailBox.serverName}' (${mailIp})`)}else{mailIp=void 0;log.warn(`Mail: attach target '${mailOwner}' has no reachable '${environment}' box; application deploy remains live`)}}const mailRes=mailIp?await provisionMailTenant(mailIp,log):null;if(mailOwner&&mailIp&&mailIp!==ip)await cleanupDetachedMailHealth(ip,log);if(mailRes)await reconcileMailDns(mailRes,mailIp,log)}for(const record of githubDeployments)await setGithubDeploymentStatus(record,ok?"success":"failure");console.log("");if(ok){await outro(`Deployed to Hetzner. Your site is live at http://${ip}:3000`,{startTime,useSeconds:!0});log.info(`Coming-soon page: http://${ip}:3000  (bypass with ?secret=\u2026)`)}else{await outro("Hetzner deploy reported a failure \u2014 see the per-instance output above.",{startTime,useSeconds:!0});process.exit(ExitCode.FatalError)}}function resolveMailboxes(mailboxes,domain){if(!Array.isArray(mailboxes))return[];const out=[];for(const entry of mailboxes){let raw,explicitPw;if(typeof entry==="string")raw=entry;else if(entry&&typeof entry==="object"){raw=entry.email??entry.username;explicitPw=entry.password}if(!raw||typeof raw!=="string")continue;const localPart=(raw.includes("@")?raw.split("@")[0]??"":raw).trim();if(!localPart)continue;const address=`${localPart}@${domain}`,envPw=explicitPw||process.env[`MAIL_PASSWORD_${localPart.toUpperCase().replace(/[^A-Z0-9]/g,"_")}`];if(!envPw)continue;out.push({address,localPart:localPart.toUpperCase(),password:envPw,generated:!1})}return out}export function hasExplicitEmailConfig(projectRoot=p.projectPath()){return existsSync(join(projectRoot,"config","email.ts"))}export function mailServerOwnerFromConfig(config){const owner=config?.server?.attachTo;return typeof owner==="string"&&owner.trim()?owner.trim():void 0}async function cleanupDetachedMailHealth(ip,logger){const{execSync}=await import("node:child_process"),sshArgs=["-o","StrictHostKeyChecking=accept-new","-o","BatchMode=yes","-o","ConnectTimeout=20",`root@${ip}`],script=`set -e
 if systemctl list-unit-files --type=service --no-legend | awk '{print $1}' | grep -qx mail.service; then
   exit 0
 fi
@@ -1065,67 +30,10 @@ rm -f /etc/systemd/system/mail-health.service /etc/systemd/system/mail-health.ti
 rm -f /usr/local/sbin/mail-health-check /etc/systemd/system/mail.service.d/reliability.conf
 rmdir /etc/systemd/system/mail.service.d 2>/dev/null || true
 systemctl daemon-reload
-systemctl reset-failed`;
-  try {
-    execSync(`ssh ${sshArgs.map((a) => `'${a}'`).join(" ")} bash -s`, {
-      input: script,
-      encoding: "utf8",
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    logger.success("Mail: removed the detached health timer from the application box");
-  } catch (err) {
-    logger.warn(`Mail: could not remove the detached health timer: ${getErrorMessage(err)}`);
-  }
-}
-async function resolveAttachTargetBox(owner, environment) {
-  const token = process.env.HCLOUD_TOKEN;
-  if (!token)
-    return null;
-  const pick = (servers) => servers.find((s) => s?.status !== "off" && s?.public_net?.ipv4?.ip) || servers[0], req = async (qs) => {
-    try {
-      const res = await fetch(`https://api.hetzner.cloud/v1/servers?${qs}`, {
-        headers: { Authorization: `Bearer ${token}` }
-      });
-      if (!res.ok)
-        return [];
-      return (await res.json()).servers || [];
-    } catch {
-      return [];
-    }
-  }, byLabel = await req(`label_selector=${encodeURIComponent(`ts-cloud/project=${owner},ts-cloud/environment=${environment},ts-cloud/role=app`)}`), chosen = pick(byLabel) || pick(await req(`name=${encodeURIComponent(`${owner}-${environment}-app`)}`));
-  if (!chosen)
-    return null;
-  const { hetznerBoxIpv6 } = await import("@stacksjs/ts-cloud");
-  return {
-    serverId: chosen.id,
-    serverName: chosen.name,
-    publicIp: chosen.public_net?.ipv4?.ip,
-    publicIpv6: hetznerBoxIpv6?.(chosen.public_net?.ipv6?.ip)
-  };
-}
-export async function provisionMailTenant(ip, logger) {
-  if (!hasExplicitEmailConfig())
-    return null;
-  const cfg = emailConfig || {};
-  if (cfg.server?.enabled === !1)
-    return null;
-  const domain = cfg.domain || (typeof cfg.from?.address === "string" && cfg.from.address.includes("@") ? cfg.from.address.split("@")[1] : void 0), declaredForwards = cfg.forwards && typeof cfg.forwards === "object" ? cfg.forwards : {}, forwards = { ...declaredForwards }, declaredBoxes = new Set(domain ? resolveMailboxes(cfg.mailboxes, domain).map((b) => b.address) : []);
-  for (const [key, targets] of Object.entries(declaredForwards)) {
-    const at = key.indexOf("@");
-    if (at === -1 || declaredBoxes.has(key))
-      continue;
-    const localPart = key.slice(0, at);
-    if (key.slice(at + 1) !== domain || forwards[localPart])
-      continue;
-    forwards[localPart] = targets;
-  }
-  const hasForwards = Object.keys(forwards).length > 0, boxes = domain ? resolveMailboxes(cfg.mailboxes, domain) : [];
-  if (!domain && !hasForwards)
-    return null;
-  const { execSync } = await import("node:child_process"), sshArgs = ["-o", "StrictHostKeyChecking=accept-new", "-o", "BatchMode=yes", "-o", "ConnectTimeout=20", `root@${ip}`], forwardsB64 = hasForwards ? Buffer.from(JSON.stringify(forwards)).toString("base64") : "", readme = "Auto-forwarding rules, re-read on every message (edits take effect immediately, no restart). KEY = the delivered mailbox: the FULL address for per-domain isolated mailboxes (e.g. no-reply@app.com), or a bare local-part for legacy role mailboxes. VALUE = list of destination addresses; targets on a local domain are written straight to that mailbox Maildir, external targets are relayed. Managed by buddy deploy " + "from config/email.ts (merge-based \u2014 hand edits to other keys are preserved).", readmeB64 = Buffer.from(readme).toString("base64"), boxesB64 = boxes.length ? Buffer.from(`${boxes.map((b) => `${b.address}	${b.password}`).join(`
+systemctl reset-failed`;try{execSync(`ssh ${sshArgs.map((a)=>`'${a}'`).join(" ")} bash -s`,{input:script,encoding:"utf8",stdio:["pipe","pipe","pipe"]});logger.success("Mail: removed the detached health timer from the application box")}catch(err){logger.warn(`Mail: could not remove the detached health timer: ${getErrorMessage(err)}`)}}async function resolveAttachTargetBox(owner,environment){const token=process.env.HCLOUD_TOKEN;if(!token)return null;const pick=(servers)=>servers.find((s)=>s?.status!=="off"&&s?.public_net?.ipv4?.ip)||servers[0],req=async(qs)=>{try{const res=await fetch(`https://api.hetzner.cloud/v1/servers?${qs}`,{headers:{Authorization:`Bearer ${token}`}});if(!res.ok)return[];return(await res.json()).servers||[]}catch{return[]}},byLabel=await req(`label_selector=${encodeURIComponent(`ts-cloud/project=${owner},ts-cloud/environment=${environment},ts-cloud/role=app`)}`),chosen=pick(byLabel)||pick(await req(`name=${encodeURIComponent(`${owner}-${environment}-app`)}`));if(!chosen)return null;const{hetznerBoxIpv6}=await import("@stacksjs/ts-cloud");return{serverId:chosen.id,serverName:chosen.name,publicIp:chosen.public_net?.ipv4?.ip,publicIpv6:hetznerBoxIpv6?.(chosen.public_net?.ipv6?.ip)}}export async function provisionMailTenant(ip,logger){if(!hasExplicitEmailConfig())return null;const cfg=emailConfig||{};if(cfg.server?.enabled===!1)return null;const domain=cfg.domain||(typeof cfg.from?.address==="string"&&cfg.from.address.includes("@")?cfg.from.address.split("@")[1]:void 0),declaredForwards=cfg.forwards&&typeof cfg.forwards==="object"?cfg.forwards:{},forwards={...declaredForwards},declaredBoxes=new Set(domain?resolveMailboxes(cfg.mailboxes,domain).map((b)=>b.address):[]);for(const[key,targets]of Object.entries(declaredForwards)){const at=key.indexOf("@");if(at===-1||declaredBoxes.has(key))continue;const localPart=key.slice(0,at);if(key.slice(at+1)!==domain||forwards[localPart])continue;forwards[localPart]=targets}const hasForwards=Object.keys(forwards).length>0,boxes=domain?resolveMailboxes(cfg.mailboxes,domain):[];if(!domain&&!hasForwards)return null;const{execSync}=await import("node:child_process"),sshArgs=["-o","StrictHostKeyChecking=accept-new","-o","BatchMode=yes","-o","ConnectTimeout=20",`root@${ip}`],forwardsB64=hasForwards?Buffer.from(JSON.stringify(forwards)).toString("base64"):"",readme="Auto-forwarding rules, re-read on every message (edits take effect immediately, no restart). KEY = the delivered mailbox: the FULL address for per-domain isolated mailboxes (e.g. no-reply@app.com), or a bare local-part for legacy role mailboxes. VALUE = list of destination addresses; targets on a local domain are written straight to that mailbox Maildir, external targets are relayed. Managed by buddy deploy "+"from config/email.ts (merge-based \u2014 hand edits to other keys are preserved).",readmeB64=Buffer.from(readme).toString("base64"),boxesB64=boxes.length?Buffer.from(`${boxes.map((b)=>`${b.address}	${b.password}`).join(`
 `)}
-`).toString("base64") : "", script = `set -e
-DOMAIN=${domain ? `'${domain}'` : "''"}
+`).toString("base64"):"",script=`set -e
+DOMAIN=${domain?`'${domain}'`:"''"}
 FWD_B64='${forwardsB64}'
 README_B64='${readmeB64}'
 BOXES_B64='${boxesB64}'
@@ -1354,564 +262,5 @@ EOF
 systemctl daemon-reload
 systemctl enable --now mail-health.timer >/dev/null 2>&1
 # 6) Restart only when the startup-read env actually changed (domain or DKIM key).
-if [ "$ENV_CHANGED" = 1 ]; then systemctl restart mail 2>/dev/null || true; echo "MAILTENANT:env-changed+restarted,forwards=$FWD_STATE"; else echo "MAILTENANT:current,forwards=$FWD_STATE"; fi`;
-  try {
-    const out = execSync(`ssh ${sshArgs.map((a) => `'${a}'`).join(" ")} bash -s`, {
-      input: script,
-      encoding: "utf8",
-      stdio: ["pipe", "pipe", "pipe"]
-    }), line = (out.match(/MAILTENANT:[^\n]*/) || [])[0] || "MAILTENANT:done", mailHostFromOut = (out.match(/MAILHOST:([^\n]*)/) || [])[1]?.trim(), mailHost = mailHostFromOut || `mail.${domain}`, dkimPubB64 = (out.match(/DKIMPUB:([^\n]*)/) || [])[1]?.trim() || void 0, madeAddrs = new Set([...out.matchAll(/MADE:([^\n]+)/g)].flatMap((m) => m[1] ? [m[1].trim()] : [])), migratedAddrs = new Set([...out.matchAll(/MIGRATED:([^\n]+)/g)].flatMap((m) => m[1] ? [m[1].trim()] : [])), created = boxes.filter((b) => madeAddrs.has(b.address)).map((b) => ({ address: b.address, password: b.password }));
-    logger.success(`Mail routing reconciled (${line.replace("MAILTENANT:", "")})`);
-    const failed = [...out.matchAll(/FAIL:([^\n]+)/g)].flatMap((m) => m[1] ? [m[1].trim()] : []);
-    if (failed.length)
-      logger.warn(`Mail: the server refused ${failed.length} mailbox(es): ${failed.join(", ")}`);
-    const forwardError = (out.match(/FWDERR:([^\n]*)/) || [])[1]?.trim();
-    if (forwardError)
-      logger.warn(`Mail: the forward rules were not merged: ${forwardError}`);
-    const certHost = (out.match(/CERTHOST:([^\n]*)/) || [])[1]?.trim();
-    if (certHost)
-      logger.success(`Mail: ${certHost} added to the mail certificate \u2014 clients can use it as the server name`);
-    const certError = (out.match(/CERTFAIL:([^\n]*)/) || [])[1]?.trim();
-    if (certError)
-      logger.warn(`Mail: could not issue a certificate for mail.${domain} (clients should use ${mailHostFromOut || "the shared mail host"}): ${certError}`);
-    const seen = new Set([...madeAddrs, ...migratedAddrs, ...[...out.matchAll(/EXISTS:([^\n]+)/g)].flatMap((m) => m[1] ? [m[1].trim()] : [])]), unaccounted = boxes.filter((b) => !seen.has(b.address)).map((b) => b.address);
-    if (unaccounted.length)
-      logger.warn(`Mail: ${unaccounted.length} declared mailbox(es) were not reconciled: ${unaccounted.join(", ")}`);
-    if (created.length) {
-      logger.info(`Mail: created ${created.length} mailbox(es) \u2014 credentials below (save them; shown once):`);
-      for (const b of created)
-        logger.info(`  ${b.address}  ${b.password}`);
-    }
-    if (migratedAddrs.size)
-      logger.success(`Mail: migrated ${migratedAddrs.size} legacy mailbox username(s) to isolated full addresses`);
-    return domain ? { domain, mailHost, dkimPubB64, created } : null;
-  } catch (err) {
-    logger.warn(`Mail routing reconcile skipped: ${getErrorMessage(err)}`);
-    return null;
-  }
-}
-export async function reconcileMailDns(res, ip, logger) {
-  const { domain, dkimPubB64 } = res;
-  let { mailHost } = res;
-  try {
-    const dns = await import("node:dns"), own = `mail.${domain}`;
-    if (own !== mailHost && (await dns.promises.resolve4(own)).includes(ip))
-      mailHost = own;
-  } catch {}
-  const spf = `v=spf1 ip4:${ip} ~all`, cfg = emailConfig || {}, firstBox = resolveMailboxes(cfg.mailboxes, domain)[0]?.address, dmarc = `v=DMARC1; p=quarantine; rua=mailto:${(typeof cfg.from?.address === "string" && cfg.from.address.includes("@") ? cfg.from.address : void 0) || firstBox || `chris@${domain}`}`, dkim = dkimPubB64 ? `v=DKIM1; k=rsa; p=${dkimPubB64}` : void 0, apiKey = process.env.PORKBUN_API_KEY, secretKey = process.env.PORKBUN_SECRET_KEY;
-  if (!apiKey || !secretKey) {
-    logger.warn(`Mail DNS: no Porkbun credentials \u2014 add these records for ${domain} by hand:`);
-    logger.info(`  MX    @                 10 ${mailHost}`);
-    logger.info(`  TXT   @                 ${spf}`);
-    if (dkim)
-      logger.info(`  TXT   mail._domainkey   ${dkim}`);
-    logger.info(`  TXT   _dmarc            ${dmarc}`);
-    return;
-  }
-  const auth = { apikey: apiKey, secretapikey: secretKey }, call = async (path, body) => {
-    return (await fetch(`https://api.porkbun.com/api/json/v3/${path}`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ ...auth, ...body })
-    })).json().catch(() => ({}));
-  }, ownership = await call(`dns/retrieve/${domain}`, {});
-  if (ownership?.status !== "SUCCESS") {
-    logger.warn(`Mail DNS skipped: ${domain} is not administered by these Porkbun credentials (${ownership?.message || "domain not in this account"}).`);
-    logger.info(`Set \`domain\` in config/email.ts to a zone you own, or add these records for ${domain} by hand:`);
-    logger.info(`  MX    @                 10 ${mailHost}`);
-    logger.info(`  TXT   @                 ${spf}`);
-    if (dkim)
-      logger.info(`  TXT   mail._domainkey   ${dkim}`);
-    logger.info(`  TXT   _dmarc            ${dmarc}`);
-    return;
-  }
-  const upsert = async (type, name, content, extra = {}) => {
-    const sub = name === "@" ? "" : `/${name}`;
-    await call(`dns/deleteByNameType/${domain}/${type}${sub}`, {});
-    const created = await call(`dns/create/${domain}`, { name: name === "@" ? "" : name, type, content, ttl: "600", ...extra });
-    if (created?.status !== "SUCCESS")
-      throw Error(`${type} ${name}: ${created?.message || "unknown Porkbun error"}`);
-  };
-  try {
-    await upsert("MX", "@", mailHost, { prio: "10" });
-    await upsert("TXT", "@", spf);
-    if (dkim)
-      await upsert("TXT", "mail._domainkey", dkim);
-    await upsert("TXT", "_dmarc", dmarc);
-    await upsert("A", "mail", ip);
-    logger.success(`Mail DNS published for ${domain} (MX\u2192${mailHost}, SPF, DKIM, DMARC, mail.${domain}\u2192${ip})`);
-  } catch (err) {
-    logger.warn(`Mail DNS reconcile skipped for ${domain}: ${getErrorMessage(err)}`);
-  }
-}
-export function configDnsDomains(sites) {
-  const domains = new Set;
-  for (const site of Object.values(sites))
-    if (!site?.redirect && site?.domain && typeof site.domain === "string")
-      domains.add(site.domain.replace(/^www\./, ""));
-  return [...domains];
-}
-export function dnsProviderNameFromNameservers(nameservers) {
-  const normalized = nameservers.map((name) => name.toLowerCase().replace(/\.$/, ""));
-  if (normalized.some((name) => name.endsWith(".porkbun.com")))
-    return "porkbun";
-  if (normalized.some((name) => name.endsWith(".ns.cloudflare.com")))
-    return "cloudflare";
-  if (normalized.some((name) => /(^|\.)awsdns-\d+\.(?:com|net|org|co\.uk)$/.test(name)))
-    return "route53";
-  if (normalized.some((name) => name.endsWith(".domaincontrol.com")))
-    return "godaddy";
-  return null;
-}
-async function reconcileConfigDns(sites, logger) {
-  const projectDnsConfig = await loadProjectDnsConfig(dnsConfig);
-  if (["a", "aaaa", "cname", "mx", "txt"].reduce((total, key) => total + (Array.isArray(projectDnsConfig?.[key]) ? projectDnsConfig[key].length : 0), 0) === 0)
-    return;
-  for (const domain of configDnsDomains(sites))
-    try {
-      const result = await syncDnsConfig(domain, projectDnsConfig);
-      if (!result.provider)
-        continue;
-      if (result.created || result.failed)
-        logger.info(`DNS (config/dns.ts) ${domain}: ${result.created} created, ${result.kept} kept${result.failed ? `, ${result.failed} failed` : ""}`);
-    } catch (err) {
-      logger.warn(`DNS (config/dns.ts) reconcile for ${domain} failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
-}
-async function reconcileHetznerDns(sites, ip, logger, ipv6) {
-  const published = [], domains = new Set;
-  for (const site of Object.values(sites))
-    if (site?.domain && typeof site.domain === "string")
-      domains.add(site.domain.replace(/^www\./, ""));
-  if (domains.size === 0)
-    return published;
-  const providerConfigs = [];
-  if (process.env.PORKBUN_API_KEY && process.env.PORKBUN_SECRET_KEY)
-    providerConfigs.push({ provider: "porkbun", apiKey: process.env.PORKBUN_API_KEY, secretKey: process.env.PORKBUN_SECRET_KEY });
-  if (process.env.CLOUDFLARE_API_TOKEN)
-    providerConfigs.push({ provider: "cloudflare", apiToken: process.env.CLOUDFLARE_API_TOKEN });
-  if (process.env.GODADDY_API_KEY && process.env.GODADDY_API_SECRET)
-    providerConfigs.push({ provider: "godaddy", apiKey: process.env.GODADDY_API_KEY, apiSecret: process.env.GODADDY_API_SECRET, environment: process.env.GODADDY_ENVIRONMENT });
-  if (process.env.AWS_ACCESS_KEY_ID || process.env.AWS_PROFILE)
-    providerConfigs.push({ provider: "route53" });
-  if (providerConfigs.length === 0) {
-    logger.warn("DNS: no DNS provider credentials found (PORKBUN_API_KEY/\u2026); skipping DNS reconciliation.");
-    for (const d of domains)
-      logger.info(`  Point manually:  A ${d} \u2192 ${ip}   and   A www.${d} \u2192 ${ip}`);
-    return published;
-  }
-  const {
-    createDnsProvider,
-    detectDnsProvider,
-    reconcileAddressRecords
-  } = await import("@stacksjs/ts-cloud");
-  logger.info("Reconciling DNS records...");
-  const resolveA = async (fqdn) => {
-    try {
-      const { resolve4 } = await import("node:dns/promises");
-      return await resolve4(fqdn);
-    } catch {
-      return [];
-    }
-  }, resolveAuthoritativeNameservers = async (domain) => {
-    try {
-      const { resolveNs } = await import("node:dns/promises");
-      return await resolveNs(domain);
-    } catch {
-      return [];
-    }
-  };
-  for (const domain of domains)
-    try {
-      let provider = await detectDnsProvider(domain, providerConfigs).catch((err) => {
-        logger.warn(`  DNS: ignoring a configured provider for ${domain} - its credentials were rejected (${err?.message || err})`);
-        return;
-      });
-      if (!provider) {
-        const providerName = dnsProviderNameFromNameservers(await resolveAuthoritativeNameservers(domain)), providerConfig = providerConfigs.find((config) => config.provider === providerName);
-        if (providerConfig)
-          provider = createDnsProvider(providerConfig);
-      }
-      if (!provider) {
-        for (const sub of ["", "www"]) {
-          const fqdn = sub ? `${sub}.${domain}` : domain, current = await resolveA(fqdn);
-          if (current.includes(ip))
-            logger.success(`  DNS: ${fqdn} \u2192 ${ip} (externally managed, already correct)`);
-          else if (current.length === 0)
-            logger.warn(`  DNS: ${fqdn} does not resolve and no configured provider manages ${domain} \u2014 create it manually: A ${fqdn} \u2192 ${ip}`);
-          else
-            logger.warn(`  DNS: ${fqdn} resolves to ${current.join(", ")} but this deploy targets ${ip}, and no configured provider manages ${domain} \u2014 update it manually: A ${fqdn} \u2192 ${ip}`);
-        }
-        continue;
-      }
-      for (const sub of ["", "www"]) {
-        const fqdn = sub ? `${sub}.${domain}` : domain, report = await reconcileAddressRecords({ provider, zone: domain, fqdn, ipv4: ip, ipv6 });
-        for (const record of report.published) {
-          logger.success(`  DNS: ${record.fqdn} \u2192 ${record.content} (${provider.name})`);
-          published.push(record.fqdn);
-        }
-        for (const warning of report.warnings)
-          logger.warn(`  DNS: ${warning}`);
-      }
-    } catch (err) {
-      logger.warn(`  DNS: ${domain} reconciliation failed: ${err?.message || err}`);
-    }
-  return published;
-}
-async function buildContainerImageWithPantry(args) {
-  const { slug, sites, verbose } = args, { execSync } = await import("node:child_process");
-  let cli;
-  for (const candidate of ["pantry", "ts-pantry"])
-    try {
-      execSync(`command -v ${candidate}`, { stdio: "pipe" });
-      cli = candidate;
-      break;
-    } catch {}
-  if (!cli) {
-    log.warn("pantry CLI not found on PATH \u2014 skipping container image build. Install pantry to enable `--docker`.");
-    return;
-  }
-  const dockerfile = "storage/framework/Dockerfile", canPush = Boolean(process.env.PANTRY_REGISTRY_TOKEN || process.env.PANTRY_TOKEN);
-  for (const [siteName, site] of Object.entries(sites)) {
-    if (!site?.start)
-      continue;
-    const tag = `${slug}-${siteName}:latest`;
-    log.info(`[${siteName}] building image ${tag} with pantry (native, no Docker daemon)...`);
-    const flags = [
-      "build",
-      ".",
-      "-t",
-      tag,
-      "-f",
-      dockerfile,
-      "--run-mode",
-      "skip"
-    ];
-    if (canPush)
-      flags.push("--push");
-    execSync(`${cli} ${flags.map((f) => f.includes(" ") ? `'${f}'` : f).join(" ")}`, {
-      stdio: verbose ? "inherit" : "pipe",
-      maxBuffer: 536870912
-    });
-    log.success(`[${siteName}] image built${canPush ? " + pushed to the pantry registry" : ""}`);
-  }
-}
-export function deploy(buddy) {
-  const descriptions = {
-    deploy: "Deploy your project",
-    project: "Target a specific project",
-    production: "Deploy to production",
-    development: "Deploy to development",
-    staging: "Deploy to staging",
-    yes: "Confirm all prompts by default",
-    domain: "Specify a domain to deploy to",
-    verbose: "Enable verbose output"
-  };
-  buddy.command("deploy [env]", descriptions.deploy).option("--domain", descriptions.domain, { default: void 0 }).option("-p, --project [project]", descriptions.project, { default: !1 }).option("--prod", descriptions.production, { default: !0 }).option("--dev", descriptions.development, { default: !1 }).option("--yes", descriptions.yes, { default: !1 }).option("--site <name>", "Deploy only this one site to the existing server (multi-tenant surgical add)", { default: void 0 }).option("--staging", descriptions.staging, { default: !1 }).option("--docker", "Also build an OCI image with pantry (native, no Docker daemon) and push it to the pantry registry", { default: !1 }).option("--verbose", descriptions.verbose, { default: !1 }).action(async (envArg, options) => {
-    log.debug("Running `buddy deploy` ...", options);
-    if (process.argv.includes("--dry-run") || options.dryRun === !0) {
-      log.error("`buddy deploy --dry-run` is not supported.");
-      log.info("Deploy has no preview mode: provisioning, release shipping, and DNS all mutate real infrastructure.");
-      log.info("To see what would ship without touching the server, inspect `config/cloud.ts` sites, or run `buddy deploy --site <name>` to narrow a real deploy to one site.");
-      process.exit(ExitCode.FatalError);
-    }
-    await ensureDeployPrerequisites(options.verbose === !0);
-    const deployEnv = envArg || (options.staging ? "staging" : options.dev ? "development" : "production"), deployEnvName = deployEnv === "prod" ? "production" : deployEnv === "dev" ? "development" : deployEnv;
-    process.env.APP_ENV = deployEnvName;
-    {
-      const envFile = deployEnvName === "production" ? ".env.production" : `.env.${deployEnvName}`;
-      if (existsSync(p.projectPath(envFile)))
-        try {
-          const { loadEnv } = await import("@stacksjs/env");
-          loadEnv({ path: envFile, env: deployEnvName, keysFile: ".env.keys", overload: !0, quiet: !0 });
-        } catch (err) {
-          log.warn(`Could not load ${envFile}: ${getErrorMessage(err)}`);
-        }
-    }
-    const tsCloudConfig = await loadTsCloudConfig(deployEnvName);
-    if (tsCloudConfig && resolveProvider(tsCloudConfig) === "hetzner") {
-      await deployToHetzner(tsCloudConfig, deployEnv, options);
-      return;
-    }
-    if (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY)
-      delete process.env.AWS_PROFILE;
-    const startTime = performance.now();
-    console.log("");
-    console.log("\uD83D\uDE80 Deploy");
-    console.log("");
-    let productionUrl;
-    if (deployEnv === "production" || deployEnv === "prod") {
-      const prodEnvPath = p.projectPath(".env.production");
-      if (existsSync(prodEnvPath)) {
-        const urlMatch = readFileSync(prodEnvPath, "utf-8").match(/^APP_URL=(.+)$/m);
-        if (urlMatch?.[1]) {
-          productionUrl = urlMatch[1].trim();
-          log.debug("Using APP_URL from .env.production:", productionUrl);
-        }
-      }
-    }
-    const envUrl = env.APP_URL, domain = options.domain || productionUrl || envUrl || app.url;
-    if ((options.prod || deployEnv === "production" || deployEnv === "prod") && !options.yes)
-      await confirmProductionDeployment();
-    if (!domain) {
-      log.info("No domain found in your .env.production or ./config/app.ts");
-      log.info("Please ensure your domain is properly configured.");
-      log.info("For more info, check out the docs or join our Discord.");
-      process.exit(ExitCode.FatalError);
-    }
-    log.info(`Deploying to ${italic(domain)} (${deployEnv})`);
-    await checkIfAwsIsBootstrapped(options);
-    options.domain = await configureDomain(domain, options, startTime);
-    const result = await runAction(Action.Deploy, options);
-    if (result.isErr) {
-      await outro("While running the `buddy deploy`, there was an issue", { startTime, useSeconds: !0 }, result.error);
-      process.exit(ExitCode.FatalError);
-    }
-    await outro("Project deployed.", { startTime, useSeconds: !0 });
-  });
-  onUnknownSubcommand(buddy, "deploy");
-}
-async function confirmProductionDeployment() {
-  if (!process.stdin.isTTY) {
-    log.error("Refusing to deploy to production from a non-interactive shell without confirmation.");
-    log.info("   \u27A1\uFE0F  Re-run with `--yes` to confirm (e.g. in CI): `buddy deploy --prod --yes`");
-    process.exit(ExitCode.InvalidArgument);
-  }
-  if (!await prompts.confirm({
-    message: "Are you sure you want to deploy to production?",
-    initial: !0
-  })) {
-    log.info("Aborting deployment...");
-    process.exit(ExitCode.InvalidArgument);
-  }
-}
-async function configureDomain(domain, options, startTime) {
-  log.debug("Configuring domain...", domain);
-  if (!domain) {
-    log.info("We could not identify a domain to deploy to.");
-    log.warn("Please set your .env or ./config/app.ts properly.");
-    log.info("Alternatively, specify a domain to deploy via the `--domain` flag.");
-    console.log("");
-    log.info("   \u27A1\uFE0F  Example: `buddy deploy --domain example.com`");
-    console.log("");
-    process.exit(ExitCode.FatalError);
-  }
-  if (domain.includes("localhost")) {
-    log.info("You are deploying to a local environment.");
-    log.warn("Please set your .env or ./config/app.ts properly. The domain we are deploying cannot be a `localhost` domain.");
-    log.info("Alternatively, specify a domain to deploy via the `--domain` flag.");
-    console.log("");
-    log.info("   \u27A1\uFE0F  Example: `buddy deploy --domain example.com`");
-    console.log("");
-    process.exit(ExitCode.FatalError);
-  }
-  if (await hasUserDomainBeenAddedToCloud(domain)) {
-    log.info("Domain is properly configured");
-    log.info("Your cloud is deploying...");
-    log.info(`${italic("This may take a while...")}`);
-    return domain;
-  }
-  console.log("");
-  log.info(`  \uD83D\uDC4B  It appears to be your first ${italic(domain)} deployment.`);
-  console.log("");
-  log.info(italic("Let\u2019s ensure it is all connected properly."));
-  log.info(italic("One moment..."));
-  console.log("");
-  const result = await addDomain({
-    ...options,
-    deploy: !0,
-    startTime
-  });
-  if (result.isErr) {
-    await outro("While running the `buddy deploy`, there was an issue", { startTime, useSeconds: !0 }, result.error);
-    process.exit(ExitCode.FatalError);
-  }
-  await outro("Added your domain.", { startTime, useSeconds: !0 });
-  process.exit(ExitCode.Success);
-}
-async function promptAndSaveCredentials() {
-  const accessKeyId = await prompts.text({
-    message: "AWS Access Key ID:",
-    validate: (value) => value.length > 0 ? !0 : "Access Key ID is required"
-  });
-  if (!accessKeyId) {
-    log.info("Deployment cancelled");
-    process.exit(ExitCode.Success);
-  }
-  const secretAccessKey = await prompts.password({
-    message: "AWS Secret Access Key:",
-    validate: (value) => value.length > 0 ? !0 : "Secret Access Key is required"
-  });
-  if (!secretAccessKey) {
-    log.info("Deployment cancelled");
-    process.exit(ExitCode.Success);
-  }
-  const region = await prompts.text({
-    message: "AWS Region:",
-    initial: "us-east-1"
-  });
-  if (!region) {
-    log.info("Deployment cancelled");
-    process.exit(ExitCode.Success);
-  }
-  const { setEnv } = await import("@stacksjs/env");
-  await setEnv("AWS_ACCESS_KEY_ID", accessKeyId, { file: ".env.production", encrypt: !0 });
-  await setEnv("AWS_SECRET_ACCESS_KEY", secretAccessKey, { file: ".env.production", encrypt: !0 });
-  await setEnv("AWS_REGION", region || "us-east-1", { file: ".env.production" });
-  process.env.AWS_ACCESS_KEY_ID = accessKeyId;
-  process.env.AWS_SECRET_ACCESS_KEY = secretAccessKey;
-  process.env.AWS_REGION = region || "us-east-1";
-  log.success("AWS credentials saved securely to .env.production");
-  console.log("");
-}
-function loadAwsCredentialsFromEnv() {
-  const environment = process.env.APP_ENV || process.env.NODE_ENV || "production", envFiles = [
-    p.projectPath(`.env.${environment}`),
-    p.projectPath(".env")
-  ];
-  for (const envPath of envFiles) {
-    if (!existsSync(envPath))
-      continue;
-    try {
-      const lines = readFileSync(envPath, "utf-8").split(`
-`);
-      let accessKeyId, secretAccessKey, region, accountId;
-      for (const line of lines) {
-        const trimmed = line.trim();
-        if (trimmed.startsWith("#") || !trimmed.includes("="))
-          continue;
-        const [key, ...valueParts] = trimmed.split("="), value = valueParts.join("=").trim();
-        if (key === "AWS_ACCESS_KEY_ID" && value)
-          accessKeyId = value;
-        else if (key === "AWS_SECRET_ACCESS_KEY" && value)
-          secretAccessKey = value;
-        else if (key === "AWS_REGION" && value)
-          region = value;
-        else if (key === "AWS_ACCOUNT_ID" && value)
-          accountId = value;
-      }
-      if (accessKeyId && secretAccessKey) {
-        log.debug(`Found AWS credentials in ${envPath}`);
-        return { accessKeyId, secretAccessKey, region, accountId };
-      }
-    } catch (error) {
-      log.debug(`Failed to read ${envPath} file:`, error);
-    }
-  }
-  return {};
-}
-async function checkIfAwsIsBootstrapped(options) {
-  let handlingAlreadyExists = !1;
-  try {
-    log.info("Ensuring AWS cloud stack exists...");
-    let hasCredentials = process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY;
-    if (!hasCredentials) {
-      const envCredentials = loadAwsCredentialsFromEnv();
-      if (envCredentials.accessKeyId && envCredentials.secretAccessKey) {
-        process.env.AWS_ACCESS_KEY_ID = envCredentials.accessKeyId;
-        process.env.AWS_SECRET_ACCESS_KEY = envCredentials.secretAccessKey;
-        if (envCredentials.region && !process.env.AWS_REGION)
-          process.env.AWS_REGION = envCredentials.region;
-        if (envCredentials.accountId && !process.env.AWS_ACCOUNT_ID)
-          process.env.AWS_ACCOUNT_ID = envCredentials.accountId;
-        hasCredentials = !0;
-        const environment = process.env.APP_ENV || process.env.NODE_ENV || "production";
-        log.success(`Using AWS credentials from .env.${environment}`);
-      }
-    }
-    if (!hasCredentials) {
-      const fileCredentials = loadAwsCredentialsFromFile();
-      if (fileCredentials.accessKeyId && fileCredentials.secretAccessKey) {
-        process.env.AWS_ACCESS_KEY_ID = fileCredentials.accessKeyId;
-        process.env.AWS_SECRET_ACCESS_KEY = fileCredentials.secretAccessKey;
-        if (fileCredentials.region && !process.env.AWS_REGION)
-          process.env.AWS_REGION = fileCredentials.region;
-        hasCredentials = !0;
-        log.success("Using AWS credentials from ~/.aws/credentials");
-      }
-    }
-    if (!hasCredentials) {
-      log.info("AWS credentials not found in .env or ~/.aws/credentials.");
-      log.info("You can either:");
-      log.info("  1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY in .env.production");
-      log.info("  2. Add credentials to ~/.aws/credentials");
-      log.info("  3. Configure them interactively below");
-      console.log("");
-      if (options?.yes) {
-        log.info("Skipping credential setup (--yes flag provided)");
-        process.exit(ExitCode.FatalError);
-      }
-      const setupCredentials = await prompts.confirm({
-        message: "Would you like to configure AWS credentials now?",
-        initial: !0
-      });
-      log.debug("setupCredentials response:", setupCredentials, typeof setupCredentials);
-      if (setupCredentials === void 0 || setupCredentials === !1) {
-        if (setupCredentials === void 0) {
-          console.log("");
-          log.info("Deployment cancelled");
-          process.exit(ExitCode.Success);
-        }
-        console.log("");
-        log.info("Skipping cloud infrastructure check");
-        log.info("You can configure AWS credentials later by running: buddy configure:aws");
-        return !0;
-      }
-      await promptAndSaveCredentials();
-    } else
-      log.success("AWS credentials found");
-    const appName = (process.env.APP_NAME || app.name || "stacks").toLowerCase().replace(/[^a-z0-9-]/g, "-"), stackName = `${appName}-cloud`, { AWSCloudFormationClient } = await import("@stacksjs/ts-cloud"), cfnClient = new AWSCloudFormationClient(process.env.AWS_REGION || "us-east-1");
-    let stackExists = !1, needsEmailUpdate = !1;
-    try {
-      const stack = (await cfnClient.describeStacks({ stackName })).Stacks?.[0];
-      if (stack) {
-        stackExists = !0;
-        log.success("Cloud stack exists");
-        const { AWSCloudFormationClient } = await import("@stacksjs/ts-cloud"), resources = await new AWSCloudFormationClient(process.env.AWS_REGION || "us-east-1").listStackResources(stackName), hasEmailBucket = resources.StackResourceSummaries?.some((r) => r.LogicalResourceId === "EmailBucket"), hasOutboundLambda = resources.StackResourceSummaries?.some((r) => r.LogicalResourceId === "OutboundEmailLambda"), hasConversionLambda = resources.StackResourceSummaries?.some((r) => r.LogicalResourceId === "EmailConversionLambda"), hasNotificationTopic = resources.StackResourceSummaries?.some((r) => r.LogicalResourceId === "EmailNotificationTopic"), hasMailApiLambda = resources.StackResourceSummaries?.some((r) => r.LogicalResourceId === "MailApiLambda"), hasMailUsersTable = resources.StackResourceSummaries?.some((r) => r.LogicalResourceId === "MailUsersTable"), hasMailServerInstance = resources.StackResourceSummaries?.some((r) => r.LogicalResourceId === "MailServerInstance"), currentEmailDomain = stack.Outputs?.find((o) => o.OutputKey === "EmailDomain")?.OutputValue, configuredDomain = (emailConfig?.from?.address?.includes("@") ? emailConfig.from.address.split("@")[1] : void 0) || "stacksjs.com";
-        if (!hasEmailBucket && emailConfig?.server?.scan !== void 0) {
-          log.info("Email infrastructure not found in stack, will update...");
-          needsEmailUpdate = !0;
-        } else if (currentEmailDomain && currentEmailDomain !== configuredDomain) {
-          log.info(`Email domain changed: ${currentEmailDomain} -> ${configuredDomain}, will update...`);
-          needsEmailUpdate = !0;
-        } else if (hasEmailBucket && (!hasOutboundLambda || !hasConversionLambda || !hasNotificationTopic)) {
-          log.info("Email infrastructure incomplete, will update...");
-          needsEmailUpdate = !0;
-        } else if (hasEmailBucket && (!hasMailApiLambda || !hasMailUsersTable)) {
-          log.info("Mail API infrastructure missing, will update...");
-          needsEmailUpdate = !0;
-        } else if (hasEmailBucket && !hasMailServerInstance && emailConfig?.server?.enabled) {
-          log.info("Mail server EC2 instance missing, will update...");
-          needsEmailUpdate = !0;
-        }
-        const currentMode = (stack.Outputs || []).find((o) => o.OutputKey === "MailServerMode")?.OutputValue, configuredMode = emailConfig?.server?.mode || "serverless";
-        if (currentMode && currentMode !== configuredMode) {
-          log.info(`Mail server mode changed: ${currentMode} -> ${configuredMode}, will update...`);
-          needsEmailUpdate = !0;
-        }
-        if (hasMailServerInstance && emailConfig?.server?.enabled) {
-          if (process.env.FORCE_MAIL_UPDATE === "true") {
-            log.info("Forcing mail server update...");
-            needsEmailUpdate = !0;
-          }
-        }
-        if (!needsEmailUpdate)
-          return !0;
-      }
-    } catch (error) {
-      const caught = error && typeof error === "object" ? error : { message: String(error) };
-      log.debug(`Stack not found: ${getErrorMessage(error)}`);
-    }
-    if (!stackExists)
-      log.info("Cloud stack not found, will be created by deploy action");
-    return !0;
-  } catch (err) {
-    if (!handlingAlreadyExists) {
-      log.error("Error checking cloud infrastructure");
-      log.error(`Error: ${getErrorMessage(err)}`);
-      if (options?.verbose)
-        console.error(err);
-    }
-    process.exit(ExitCode.FatalError);
-  }
-}
+if [ "$ENV_CHANGED" = 1 ]; then systemctl restart mail 2>/dev/null || true; echo "MAILTENANT:env-changed+restarted,forwards=$FWD_STATE"; else echo "MAILTENANT:current,forwards=$FWD_STATE"; fi`;try{const out=execSync(`ssh ${sshArgs.map((a)=>`'${a}'`).join(" ")} bash -s`,{input:script,encoding:"utf8",stdio:["pipe","pipe","pipe"]}),line=(out.match(/MAILTENANT:[^\n]*/)||[])[0]||"MAILTENANT:done",mailHostFromOut=(out.match(/MAILHOST:([^\n]*)/)||[])[1]?.trim(),mailHost=mailHostFromOut||`mail.${domain}`,dkimPubB64=(out.match(/DKIMPUB:([^\n]*)/)||[])[1]?.trim()||void 0,madeAddrs=new Set([...out.matchAll(/MADE:([^\n]+)/g)].flatMap((m)=>m[1]?[m[1].trim()]:[])),migratedAddrs=new Set([...out.matchAll(/MIGRATED:([^\n]+)/g)].flatMap((m)=>m[1]?[m[1].trim()]:[])),created=boxes.filter((b)=>madeAddrs.has(b.address)).map((b)=>({address:b.address,password:b.password}));logger.success(`Mail routing reconciled (${line.replace("MAILTENANT:","")})`);const failed=[...out.matchAll(/FAIL:([^\n]+)/g)].flatMap((m)=>m[1]?[m[1].trim()]:[]);if(failed.length)logger.warn(`Mail: the server refused ${failed.length} mailbox(es): ${failed.join(", ")}`);const forwardError=(out.match(/FWDERR:([^\n]*)/)||[])[1]?.trim();if(forwardError)logger.warn(`Mail: the forward rules were not merged: ${forwardError}`);const certHost=(out.match(/CERTHOST:([^\n]*)/)||[])[1]?.trim();if(certHost)logger.success(`Mail: ${certHost} added to the mail certificate \u2014 clients can use it as the server name`);const certError=(out.match(/CERTFAIL:([^\n]*)/)||[])[1]?.trim();if(certError)logger.warn(`Mail: could not issue a certificate for mail.${domain} (clients should use ${mailHostFromOut||"the shared mail host"}): ${certError}`);const seen=new Set([...madeAddrs,...migratedAddrs,...[...out.matchAll(/EXISTS:([^\n]+)/g)].flatMap((m)=>m[1]?[m[1].trim()]:[])]),unaccounted=boxes.filter((b)=>!seen.has(b.address)).map((b)=>b.address);if(unaccounted.length)logger.warn(`Mail: ${unaccounted.length} declared mailbox(es) were not reconciled: ${unaccounted.join(", ")}`);if(created.length){logger.info(`Mail: created ${created.length} mailbox(es) \u2014 credentials below (save them; shown once):`);for(const b of created)logger.info(`  ${b.address}  ${b.password}`)}if(migratedAddrs.size)logger.success(`Mail: migrated ${migratedAddrs.size} legacy mailbox username(s) to isolated full addresses`);return domain?{domain,mailHost,dkimPubB64,created}:null}catch(err){logger.warn(`Mail routing reconcile skipped: ${getErrorMessage(err)}`);return null}}export async function reconcileMailDns(res,ip,logger){const{domain,dkimPubB64}=res;let{mailHost}=res;try{const dns=await import("node:dns"),own=`mail.${domain}`;if(own!==mailHost&&(await dns.promises.resolve4(own)).includes(ip))mailHost=own}catch{}const spf=`v=spf1 ip4:${ip} ~all`,cfg=emailConfig||{},firstBox=resolveMailboxes(cfg.mailboxes,domain)[0]?.address,dmarc=`v=DMARC1; p=quarantine; rua=mailto:${(typeof cfg.from?.address==="string"&&cfg.from.address.includes("@")?cfg.from.address:void 0)||firstBox||`chris@${domain}`}`,dkim=dkimPubB64?`v=DKIM1; k=rsa; p=${dkimPubB64}`:void 0,apiKey=process.env.PORKBUN_API_KEY,secretKey=process.env.PORKBUN_SECRET_KEY;if(!apiKey||!secretKey){logger.warn(`Mail DNS: no Porkbun credentials \u2014 add these records for ${domain} by hand:`);logger.info(`  MX    @                 10 ${mailHost}`);logger.info(`  TXT   @                 ${spf}`);if(dkim)logger.info(`  TXT   mail._domainkey   ${dkim}`);logger.info(`  TXT   _dmarc            ${dmarc}`);return}const auth={apikey:apiKey,secretapikey:secretKey},call=async(path,body)=>{return(await fetch(`https://api.porkbun.com/api/json/v3/${path}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({...auth,...body})})).json().catch(()=>({}))},ownership=await call(`dns/retrieve/${domain}`,{});if(ownership?.status!=="SUCCESS"){logger.warn(`Mail DNS skipped: ${domain} is not administered by these Porkbun credentials (${ownership?.message||"domain not in this account"}).`);logger.info(`Set \`domain\` in config/email.ts to a zone you own, or add these records for ${domain} by hand:`);logger.info(`  MX    @                 10 ${mailHost}`);logger.info(`  TXT   @                 ${spf}`);if(dkim)logger.info(`  TXT   mail._domainkey   ${dkim}`);logger.info(`  TXT   _dmarc            ${dmarc}`);return}const upsert=async(type,name,content,extra={})=>{const sub=name==="@"?"":`/${name}`;await call(`dns/deleteByNameType/${domain}/${type}${sub}`,{});const created=await call(`dns/create/${domain}`,{name:name==="@"?"":name,type,content,ttl:"600",...extra});if(created?.status!=="SUCCESS")throw Error(`${type} ${name}: ${created?.message||"unknown Porkbun error"}`)};try{await upsert("MX","@",mailHost,{prio:"10"});await upsert("TXT","@",spf);if(dkim)await upsert("TXT","mail._domainkey",dkim);await upsert("TXT","_dmarc",dmarc);await upsert("A","mail",ip);logger.success(`Mail DNS published for ${domain} (MX\u2192${mailHost}, SPF, DKIM, DMARC, mail.${domain}\u2192${ip})`)}catch(err){logger.warn(`Mail DNS reconcile skipped for ${domain}: ${getErrorMessage(err)}`)}}export function configDnsDomains(sites){const domains=new Set;for(const site of Object.values(sites))if(!site?.redirect&&site?.domain&&typeof site.domain==="string")domains.add(site.domain.replace(/^www\./,""));return[...domains]}export function dnsProviderNameFromNameservers(nameservers){const normalized=nameservers.map((name)=>name.toLowerCase().replace(/\.$/,""));if(normalized.some((name)=>name.endsWith(".porkbun.com")))return"porkbun";if(normalized.some((name)=>name.endsWith(".ns.cloudflare.com")))return"cloudflare";if(normalized.some((name)=>/(^|\.)awsdns-\d+\.(?:com|net|org|co\.uk)$/.test(name)))return"route53";if(normalized.some((name)=>name.endsWith(".domaincontrol.com")))return"godaddy";return null}async function reconcileConfigDns(sites,logger){const projectDnsConfig=await loadProjectDnsConfig(dnsConfig);if(["a","aaaa","cname","mx","txt"].reduce((total,key)=>total+(Array.isArray(projectDnsConfig?.[key])?projectDnsConfig[key].length:0),0)===0)return;for(const domain of configDnsDomains(sites))try{const result=await syncDnsConfig(domain,projectDnsConfig);if(!result.provider)continue;if(result.created||result.failed)logger.info(`DNS (config/dns.ts) ${domain}: ${result.created} created, ${result.kept} kept${result.failed?`, ${result.failed} failed`:""}`)}catch(err){logger.warn(`DNS (config/dns.ts) reconcile for ${domain} failed: ${err instanceof Error?err.message:String(err)}`)}}async function reconcileHetznerDns(sites,ip,logger,ipv6){const published=[],domains=new Set;for(const site of Object.values(sites))if(site?.domain&&typeof site.domain==="string")domains.add(site.domain.replace(/^www\./,""));if(domains.size===0)return published;const providerConfigs=[];if(process.env.PORKBUN_API_KEY&&process.env.PORKBUN_SECRET_KEY)providerConfigs.push({provider:"porkbun",apiKey:process.env.PORKBUN_API_KEY,secretKey:process.env.PORKBUN_SECRET_KEY});if(process.env.CLOUDFLARE_API_TOKEN)providerConfigs.push({provider:"cloudflare",apiToken:process.env.CLOUDFLARE_API_TOKEN});if(process.env.GODADDY_API_KEY&&process.env.GODADDY_API_SECRET)providerConfigs.push({provider:"godaddy",apiKey:process.env.GODADDY_API_KEY,apiSecret:process.env.GODADDY_API_SECRET,environment:process.env.GODADDY_ENVIRONMENT});if(process.env.AWS_ACCESS_KEY_ID||process.env.AWS_PROFILE)providerConfigs.push({provider:"route53"});if(providerConfigs.length===0){logger.warn("DNS: no DNS provider credentials found (PORKBUN_API_KEY/\u2026); skipping DNS reconciliation.");for(const d of domains)logger.info(`  Point manually:  A ${d} \u2192 ${ip}   and   A www.${d} \u2192 ${ip}`);return published}const{createDnsProvider,detectDnsProvider,reconcileAddressRecords}=await import("@stacksjs/ts-cloud");logger.info("Reconciling DNS records...");const resolveA=async(fqdn)=>{try{const{resolve4}=await import("node:dns/promises");return await resolve4(fqdn)}catch{return[]}},resolveAuthoritativeNameservers=async(domain)=>{try{const{resolveNs}=await import("node:dns/promises");return await resolveNs(domain)}catch{return[]}};for(const domain of domains)try{let provider=await detectDnsProvider(domain,providerConfigs).catch((err)=>{logger.warn(`  DNS: ignoring a configured provider for ${domain} - its credentials were rejected (${err?.message||err})`);return});if(!provider){const providerName=dnsProviderNameFromNameservers(await resolveAuthoritativeNameservers(domain)),providerConfig=providerConfigs.find((config)=>config.provider===providerName);if(providerConfig)provider=createDnsProvider(providerConfig)}if(!provider){for(const sub of["","www"]){const fqdn=sub?`${sub}.${domain}`:domain,current=await resolveA(fqdn);if(current.includes(ip))logger.success(`  DNS: ${fqdn} \u2192 ${ip} (externally managed, already correct)`);else if(current.length===0)logger.warn(`  DNS: ${fqdn} does not resolve and no configured provider manages ${domain} \u2014 create it manually: A ${fqdn} \u2192 ${ip}`);else logger.warn(`  DNS: ${fqdn} resolves to ${current.join(", ")} but this deploy targets ${ip}, and no configured provider manages ${domain} \u2014 update it manually: A ${fqdn} \u2192 ${ip}`)}continue}for(const sub of["","www"]){const fqdn=sub?`${sub}.${domain}`:domain,report=await reconcileAddressRecords({provider,zone:domain,fqdn,ipv4:ip,ipv6});for(const record of report.published){logger.success(`  DNS: ${record.fqdn} \u2192 ${record.content} (${provider.name})`);published.push(record.fqdn)}for(const warning of report.warnings)logger.warn(`  DNS: ${warning}`)}}catch(err){logger.warn(`  DNS: ${domain} reconciliation failed: ${err?.message||err}`)}return published}async function buildContainerImageWithPantry(args){const{slug,sites,verbose}=args,{execSync}=await import("node:child_process");let cli;for(const candidate of["pantry","ts-pantry"])try{execSync(`command -v ${candidate}`,{stdio:"pipe"});cli=candidate;break}catch{}if(!cli){log.warn("pantry CLI not found on PATH \u2014 skipping container image build. Install pantry to enable `--docker`.");return}const dockerfile="storage/framework/Dockerfile",canPush=Boolean(process.env.PANTRY_REGISTRY_TOKEN||process.env.PANTRY_TOKEN);for(const[siteName,site]of Object.entries(sites)){if(!site?.start)continue;const tag=`${slug}-${siteName}:latest`;log.info(`[${siteName}] building image ${tag} with pantry (native, no Docker daemon)...`);const flags=["build",".","-t",tag,"-f",dockerfile,"--run-mode","skip"];if(canPush)flags.push("--push");execSync(`${cli} ${flags.map((f)=>f.includes(" ")?`'${f}'`:f).join(" ")}`,{stdio:verbose?"inherit":"pipe",maxBuffer:536870912});log.success(`[${siteName}] image built${canPush?" + pushed to the pantry registry":""}`)}}export function deploy(buddy){const descriptions={deploy:"Deploy your project",project:"Target a specific project",production:"Deploy to production",development:"Deploy to development",staging:"Deploy to staging",yes:"Confirm all prompts by default",domain:"Specify a domain to deploy to",verbose:"Enable verbose output"};buddy.command("deploy [env]",descriptions.deploy).option("--domain",descriptions.domain,{default:void 0}).option("-p, --project [project]",descriptions.project,{default:!1}).option("--prod",descriptions.production,{default:!0}).option("--dev",descriptions.development,{default:!1}).option("--yes",descriptions.yes,{default:!1}).option("--site <name>","Deploy only this one site to the existing server (multi-tenant surgical add)",{default:void 0}).option("--staging",descriptions.staging,{default:!1}).option("--docker","Also build an OCI image with pantry (native, no Docker daemon) and push it to the pantry registry",{default:!1}).option("--verbose",descriptions.verbose,{default:!1}).action(async(envArg,options)=>{log.debug("Running `buddy deploy` ...",options);if(process.argv.includes("--dry-run")||options.dryRun===!0){log.error("`buddy deploy --dry-run` is not supported.");log.info("Deploy has no preview mode: provisioning, release shipping, and DNS all mutate real infrastructure.");log.info("To see what would ship without touching the server, inspect `config/cloud.ts` sites, or run `buddy deploy --site <name>` to narrow a real deploy to one site.");process.exit(ExitCode.FatalError)}await ensureDeployPrerequisites(options.verbose===!0);const deployEnv=envArg||(options.staging?"staging":options.dev?"development":"production"),deployEnvName=deployEnv==="prod"?"production":deployEnv==="dev"?"development":deployEnv;process.env.APP_ENV=deployEnvName;{const envFile=deployEnvName==="production"?".env.production":`.env.${deployEnvName}`;if(existsSync(p.projectPath(envFile)))try{const{loadEnv}=await import("@stacksjs/env");loadEnv({path:envFile,env:deployEnvName,keysFile:".env.keys",overload:!0,quiet:!0})}catch(err){log.warn(`Could not load ${envFile}: ${getErrorMessage(err)}`)}}const tsCloudConfig=await loadTsCloudConfig(deployEnvName);if(tsCloudConfig&&resolveProvider(tsCloudConfig)==="hetzner"){await deployToHetzner(tsCloudConfig,deployEnv,options);return}if(process.env.AWS_ACCESS_KEY_ID&&process.env.AWS_SECRET_ACCESS_KEY)delete process.env.AWS_PROFILE;const startTime=performance.now();console.log("");console.log("\uD83D\uDE80 Deploy");console.log("");let productionUrl;if(deployEnv==="production"||deployEnv==="prod"){const prodEnvPath=p.projectPath(".env.production");if(existsSync(prodEnvPath)){const urlMatch=readFileSync(prodEnvPath,"utf-8").match(/^APP_URL=(.+)$/m);if(urlMatch?.[1]){productionUrl=urlMatch[1].trim();log.debug("Using APP_URL from .env.production:",productionUrl)}}}const envUrl=env.APP_URL,domain=options.domain||productionUrl||envUrl||app.url;if((options.prod||deployEnv==="production"||deployEnv==="prod")&&!options.yes)await confirmProductionDeployment();if(!domain){log.info("No domain found in your .env.production or ./config/app.ts");log.info("Please ensure your domain is properly configured.");log.info("For more info, check out the docs or join our Discord.");process.exit(ExitCode.FatalError)}log.info(`Deploying to ${italic(domain)} (${deployEnv})`);await checkIfAwsIsBootstrapped(options);options.domain=await configureDomain(domain,options,startTime);const result=await runAction(Action.Deploy,options);if(result.isErr){await outro("While running the `buddy deploy`, there was an issue",{startTime,useSeconds:!0},result.error);process.exit(ExitCode.FatalError)}await outro("Project deployed.",{startTime,useSeconds:!0})});onUnknownSubcommand(buddy,"deploy")}async function confirmProductionDeployment(){if(!process.stdin.isTTY){log.error("Refusing to deploy to production from a non-interactive shell without confirmation.");log.info("   \u27A1\uFE0F  Re-run with `--yes` to confirm (e.g. in CI): `buddy deploy --prod --yes`");process.exit(ExitCode.InvalidArgument)}if(!await prompts.confirm({message:"Are you sure you want to deploy to production?",initial:!0})){log.info("Aborting deployment...");process.exit(ExitCode.InvalidArgument)}}async function configureDomain(domain,options,startTime){log.debug("Configuring domain...",domain);if(!domain){log.info("We could not identify a domain to deploy to.");log.warn("Please set your .env or ./config/app.ts properly.");log.info("Alternatively, specify a domain to deploy via the `--domain` flag.");console.log("");log.info("   \u27A1\uFE0F  Example: `buddy deploy --domain example.com`");console.log("");process.exit(ExitCode.FatalError)}if(domain.includes("localhost")){log.info("You are deploying to a local environment.");log.warn("Please set your .env or ./config/app.ts properly. The domain we are deploying cannot be a `localhost` domain.");log.info("Alternatively, specify a domain to deploy via the `--domain` flag.");console.log("");log.info("   \u27A1\uFE0F  Example: `buddy deploy --domain example.com`");console.log("");process.exit(ExitCode.FatalError)}if(await hasUserDomainBeenAddedToCloud(domain)){log.info("Domain is properly configured");log.info("Your cloud is deploying...");log.info(`${italic("This may take a while...")}`);return domain}console.log("");log.info(`  \uD83D\uDC4B  It appears to be your first ${italic(domain)} deployment.`);console.log("");log.info(italic("Let\u2019s ensure it is all connected properly."));log.info(italic("One moment..."));console.log("");const result=await addDomain({...options,deploy:!0,startTime});if(result.isErr){await outro("While running the `buddy deploy`, there was an issue",{startTime,useSeconds:!0},result.error);process.exit(ExitCode.FatalError)}await outro("Added your domain.",{startTime,useSeconds:!0});process.exit(ExitCode.Success)}async function promptAndSaveCredentials(){const accessKeyId=await prompts.text({message:"AWS Access Key ID:",validate:(value)=>value.length>0?!0:"Access Key ID is required"});if(!accessKeyId){log.info("Deployment cancelled");process.exit(ExitCode.Success)}const secretAccessKey=await prompts.password({message:"AWS Secret Access Key:",validate:(value)=>value.length>0?!0:"Secret Access Key is required"});if(!secretAccessKey){log.info("Deployment cancelled");process.exit(ExitCode.Success)}const region=await prompts.text({message:"AWS Region:",initial:"us-east-1"});if(!region){log.info("Deployment cancelled");process.exit(ExitCode.Success)}const{setEnv}=await import("@stacksjs/env");await setEnv("AWS_ACCESS_KEY_ID",accessKeyId,{file:".env.production",encrypt:!0});await setEnv("AWS_SECRET_ACCESS_KEY",secretAccessKey,{file:".env.production",encrypt:!0});await setEnv("AWS_REGION",region||"us-east-1",{file:".env.production"});process.env.AWS_ACCESS_KEY_ID=accessKeyId;process.env.AWS_SECRET_ACCESS_KEY=secretAccessKey;process.env.AWS_REGION=region||"us-east-1";log.success("AWS credentials saved securely to .env.production");console.log("")}function loadAwsCredentialsFromEnv(){const environment=process.env.APP_ENV||process.env.NODE_ENV||"production",envFiles=[p.projectPath(`.env.${environment}`),p.projectPath(".env")];for(const envPath of envFiles){if(!existsSync(envPath))continue;try{const lines=readFileSync(envPath,"utf-8").split(`
+`);let accessKeyId,secretAccessKey,region,accountId;for(const line of lines){const trimmed=line.trim();if(trimmed.startsWith("#")||!trimmed.includes("="))continue;const[key,...valueParts]=trimmed.split("="),value=valueParts.join("=").trim();if(key==="AWS_ACCESS_KEY_ID"&&value)accessKeyId=value;else if(key==="AWS_SECRET_ACCESS_KEY"&&value)secretAccessKey=value;else if(key==="AWS_REGION"&&value)region=value;else if(key==="AWS_ACCOUNT_ID"&&value)accountId=value}if(accessKeyId&&secretAccessKey){log.debug(`Found AWS credentials in ${envPath}`);return{accessKeyId,secretAccessKey,region,accountId}}}catch(error){log.debug(`Failed to read ${envPath} file:`,error)}}return{}}async function checkIfAwsIsBootstrapped(options){let handlingAlreadyExists=!1;try{log.info("Ensuring AWS cloud stack exists...");let hasCredentials=process.env.AWS_ACCESS_KEY_ID&&process.env.AWS_SECRET_ACCESS_KEY;if(!hasCredentials){const envCredentials=loadAwsCredentialsFromEnv();if(envCredentials.accessKeyId&&envCredentials.secretAccessKey){process.env.AWS_ACCESS_KEY_ID=envCredentials.accessKeyId;process.env.AWS_SECRET_ACCESS_KEY=envCredentials.secretAccessKey;if(envCredentials.region&&!process.env.AWS_REGION)process.env.AWS_REGION=envCredentials.region;if(envCredentials.accountId&&!process.env.AWS_ACCOUNT_ID)process.env.AWS_ACCOUNT_ID=envCredentials.accountId;hasCredentials=!0;const environment=process.env.APP_ENV||process.env.NODE_ENV||"production";log.success(`Using AWS credentials from .env.${environment}`)}}if(!hasCredentials){const fileCredentials=loadAwsCredentialsFromFile();if(fileCredentials.accessKeyId&&fileCredentials.secretAccessKey){process.env.AWS_ACCESS_KEY_ID=fileCredentials.accessKeyId;process.env.AWS_SECRET_ACCESS_KEY=fileCredentials.secretAccessKey;if(fileCredentials.region&&!process.env.AWS_REGION)process.env.AWS_REGION=fileCredentials.region;hasCredentials=!0;log.success("Using AWS credentials from ~/.aws/credentials")}}if(!hasCredentials){log.info("AWS credentials not found in .env or ~/.aws/credentials.");log.info("You can either:");log.info("  1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY in .env.production");log.info("  2. Add credentials to ~/.aws/credentials");log.info("  3. Configure them interactively below");console.log("");if(options?.yes){log.info("Skipping credential setup (--yes flag provided)");process.exit(ExitCode.FatalError)}const setupCredentials=await prompts.confirm({message:"Would you like to configure AWS credentials now?",initial:!0});log.debug("setupCredentials response:",setupCredentials,typeof setupCredentials);if(setupCredentials===void 0||setupCredentials===!1){if(setupCredentials===void 0){console.log("");log.info("Deployment cancelled");process.exit(ExitCode.Success)}console.log("");log.info("Skipping cloud infrastructure check");log.info("You can configure AWS credentials later by running: buddy configure:aws");return!0}await promptAndSaveCredentials()}else log.success("AWS credentials found");const appName=(process.env.APP_NAME||app.name||"stacks").toLowerCase().replace(/[^a-z0-9-]/g,"-"),stackName=`${appName}-cloud`,{AWSCloudFormationClient}=await import("@stacksjs/ts-cloud"),cfnClient=new AWSCloudFormationClient(process.env.AWS_REGION||"us-east-1");let stackExists=!1,needsEmailUpdate=!1;try{const stack=(await cfnClient.describeStacks({stackName})).Stacks?.[0];if(stack){stackExists=!0;log.success("Cloud stack exists");const{AWSCloudFormationClient}=await import("@stacksjs/ts-cloud"),resources=await new AWSCloudFormationClient(process.env.AWS_REGION||"us-east-1").listStackResources(stackName),hasEmailBucket=resources.StackResourceSummaries?.some((r)=>r.LogicalResourceId==="EmailBucket"),hasOutboundLambda=resources.StackResourceSummaries?.some((r)=>r.LogicalResourceId==="OutboundEmailLambda"),hasConversionLambda=resources.StackResourceSummaries?.some((r)=>r.LogicalResourceId==="EmailConversionLambda"),hasNotificationTopic=resources.StackResourceSummaries?.some((r)=>r.LogicalResourceId==="EmailNotificationTopic"),hasMailApiLambda=resources.StackResourceSummaries?.some((r)=>r.LogicalResourceId==="MailApiLambda"),hasMailUsersTable=resources.StackResourceSummaries?.some((r)=>r.LogicalResourceId==="MailUsersTable"),hasMailServerInstance=resources.StackResourceSummaries?.some((r)=>r.LogicalResourceId==="MailServerInstance"),currentEmailDomain=stack.Outputs?.find((o)=>o.OutputKey==="EmailDomain")?.OutputValue,configuredDomain=(emailConfig?.from?.address?.includes("@")?emailConfig.from.address.split("@")[1]:void 0)||"stacksjs.com";if(!hasEmailBucket&&emailConfig?.server?.scan!==void 0){log.info("Email infrastructure not found in stack, will update...");needsEmailUpdate=!0}else if(currentEmailDomain&&currentEmailDomain!==configuredDomain){log.info(`Email domain changed: ${currentEmailDomain} -> ${configuredDomain}, will update...`);needsEmailUpdate=!0}else if(hasEmailBucket&&(!hasOutboundLambda||!hasConversionLambda||!hasNotificationTopic)){log.info("Email infrastructure incomplete, will update...");needsEmailUpdate=!0}else if(hasEmailBucket&&(!hasMailApiLambda||!hasMailUsersTable)){log.info("Mail API infrastructure missing, will update...");needsEmailUpdate=!0}else if(hasEmailBucket&&!hasMailServerInstance&&emailConfig?.server?.enabled){log.info("Mail server EC2 instance missing, will update...");needsEmailUpdate=!0}const currentMode=(stack.Outputs||[]).find((o)=>o.OutputKey==="MailServerMode")?.OutputValue,configuredMode=emailConfig?.server?.mode||"serverless";if(currentMode&&currentMode!==configuredMode){log.info(`Mail server mode changed: ${currentMode} -> ${configuredMode}, will update...`);needsEmailUpdate=!0}if(hasMailServerInstance&&emailConfig?.server?.enabled){if(process.env.FORCE_MAIL_UPDATE==="true"){log.info("Forcing mail server update...");needsEmailUpdate=!0}}if(!needsEmailUpdate)return!0}}catch(error){const caught=error&&typeof error==="object"?error:{message:String(error)};log.debug(`Stack not found: ${getErrorMessage(error)}`)}if(!stackExists)log.info("Cloud stack not found, will be created by deploy action");return!0}catch(err){if(!handlingAlreadyExists){log.error("Error checking cloud infrastructure");log.error(`Error: ${getErrorMessage(err)}`);if(options?.verbose)console.error(err)}process.exit(ExitCode.FatalError)}}